[IMP] base, *: tighten ir.model.access access rights

In `website_crm_partner_assign`, remove duplicate ACLs and reorganize files.

addons/point_of_sale/models/pos_session.py

@@ -249,7 +249,7 @@ class PosSession(models.Model):
             for st in session.statement_ids:
                 if abs(st.difference) > st.journal_id.amount_authorized_diff:
                     # The pos manager can close statements with maximums.
-                    if not self.env['ir.model.access'].check_groups("point_of_sale.group_pos_manager"):
+                    if not self.user_has_groups("point_of_sale.group_pos_manager"):
                         raise UserError(_("Your ending balance is too different from the theoretical cash closing (%.2f), the maximum allowed is: %.2f. You can contact your manager to force it.") % (st.difference, st.journal_id.amount_authorized_diff))
                 if (st.journal_id.type not in ['bank', 'cash']):
                     raise UserError(_("The type of the journal for your payment method should be bank or cash "))

addons/website_crm_partner_assign/__manifest__.py

@@ -14,9 +14,9 @@ Publish and Assign Partner
     'depends': ['base_geolocalize', 'crm', 'account', 'portal',
                 'website_partner', 'website_google_map', 'website_portal'],
     'data': [
-        'data/portal_data.xml',
-        'data/crm_partner_assign_data.xml',
         'security/ir.model.access.csv',
+        'security/ir_rule.xml',
+        'data/crm_partner_assign_data.xml',
         'wizard/crm_forward_to_partner_view.xml',
         'views/res_partner_views.xml',
         'views/crm_lead_views.xml',

addons/website_crm_partner_assign/data/portal_data.xml

@@ -1,30 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<odoo>
-        <!-- Partner and address -->
-        <record id="res_partner_grade_access" model="ir.model.access">
-            <field name="name">odoo.portal.res.partner.grade</field>
-            <field name="model_id" ref="website_crm_partner_assign.model_res_partner_grade"/>
-            <field name="group_id" ref="base.group_portal"/>
-            <field name="perm_read" eval="1"/>
-            <field name="perm_create" eval="0"/>
-            <field name="perm_write" eval="0"/>
-            <field name="perm_unlink" eval="0"/>
-        </record>
-
-        <!-- CRM Lead portal -->
-        <record id="assigned_lead_portal_rule_1" model="ir.rule">
-            <field name="name">odoo.portal.crm.lead</field>
-            <field name="model_id" ref="crm.model_crm_lead"/>
-            <field name="groups" eval="[(6,0,[ref('base.group_portal')])]"/>
-            <field name="domain_force">[('partner_assigned_id','child_of',user.commercial_partner_id.id)]</field>
-        </record>
-        <record id="lead_portal_access" model="ir.model.access">
-            <field name="name">odoo.portal.crm.lead</field>
-            <field name="model_id" ref="crm.model_crm_lead"/>
-            <field name="group_id" ref="base.group_portal"/>
-            <field name="perm_read" eval="1"/>
-            <field name="perm_create" eval="0"/>
-            <field name="perm_write" eval="1"/>
-            <field name="perm_unlink" eval="0"/>
-        </record>
-</odoo>

addons/website_crm_partner_assign/security/ir.model.access.csv

@@ -11,6 +11,4 @@ access_res_partner_activation_user,res.partner.activation.user,model_res_partner
 access_partner_activation_manager,res.partner.activation.manager,model_res_partner_activation,base.group_partner_manager,1,1,1,1
 partner_access_crm_lead,crm.lead,crm.model_crm_lead,base.group_portal,1,1,0,0
 access_res_partner_grade_invoicing_payment,res.partner.grade,model_res_partner_grade,account.group_account_invoice,1,0,0,0
-access_res_partner_grade_portal,res.partner.grade,model_res_partner_grade,base.group_portal,1,0,0,0
-crm_lead_portal_access,crm.lead.portal,crm.model_crm_lead,base.group_portal,1,1,0,0
-mail_message_subtype_portal_access,mail.message.subtype.portal,mail.model_mail_message_subtype,base.group_portal,1,1,1,0
+mail_message_subtype_portal_access,mail.message.subtype.portal,mail.model_mail_message_subtype,base.group_portal,1,1,1,0

addons/website_crm_partner_assign/security/ir_rule.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <!-- CRM Lead portal -->
+    <record id="assigned_lead_portal_rule_1" model="ir.rule">
+        <field name="name">odoo.portal.crm.lead</field>
+        <field name="model_id" ref="crm.model_crm_lead"/>
+        <field name="groups" eval="[(6,0,[ref('base.group_portal')])]"/>
+        <field name="domain_force">[('partner_assigned_id','child_of',user.commercial_partner_id.id)]</field>
+    </record>
+</odoo>

odoo/addons/base/security/ir.model.access.csv

@@ -10,7 +10,6 @@
 "access_ir_model_access_group_erp_manager","ir_model_access_group_erp_manager","model_ir_model_access","group_erp_manager",1,1,1,1
 "access_ir_model_data_group_erp_manager","ir_model_data group_erp_manager","model_ir_model_data","group_erp_manager",1,1,1,1
 "access_ir_model_fields_group_erp_manager","ir_model_fields group_erp_manager","model_ir_model_fields","group_erp_manager",1,1,1,1
-"access_ir_model_access_all","ir_model_access_all","model_ir_model_access",,1,0,0,0
 "access_ir_model_data_all","ir_model_data all","model_ir_model_data",,1,0,0,0
 "access_ir_model_data_user","ir_model_data user","model_ir_model_data",base.group_user,1,0,1,0
 "access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_erp_manager",1,0,0,0