[FIX] website_sale, payment: perf issue when displaying tokens

Problem:
the controller rely on record rules to select the payment.token
to be displayed on the payment page.
This works fine with portal user, but internal user
will face client side performance issue
as they can see all the token of the database

Solution:
Don't rely on record.rule in the controller. Use the domain
from the portal user rule in the search.

To make the search of token working for partners with more than
2 levels of hierachy, use child_of operator

closes odoo/odoo#56326

X-original-commit: 3999e249ea9902e009f0366949886e14e3d7fdf4
Related: odoo/enterprise#12579
Signed-off-by: Damien Bouvy (dbo) <dbo@odoo.com>

addons/payment/security/payment_security.xml

@@ -10,7 +10,7 @@
     <record id="payment_token_user_rule" model="ir.rule">
         <field name="name">Access own payment tokens only</field>
         <field name="model_id" ref="payment.model_payment_token"/>
-        <field name="domain_force">['|', ('partner_id','=',user.partner_id.id), ('partner_id', '=', user.partner_id.commercial_partner_id.id)]</field>
+        <field name="domain_force">[('partner_id', 'child_of', user.partner_id.commercial_partner_id.id)]</field>
         <field name="groups" eval="[(4, ref('base.group_user')), (4, ref('base.group_portal')), (4, ref('base.group_public'))]"/>
     </record>
 

addons/website_sale/controllers/main.py

@@ -838,8 +838,9 @@ class WebsiteSale(http.Controller):
         values['access_token'] = order.access_token
         values['acquirers'] = [acq for acq in acquirers if (acq.payment_flow == 'form' and acq.view_template_id) or
                                     (acq.payment_flow == 's2s' and acq.registration_view_template_id)]
-        values['tokens'] = request.env['payment.token'].search(
-            [('acquirer_id', 'in', acquirers.ids)])
+        values['tokens'] = request.env['payment.token'].search([
+            ('acquirer_id', 'in', acquirers.ids),
+            ('partner_id', 'child_of', order.partner_id.commercial_partner_id.id)])
 
         if order:
             values['acq_extra_fees'] = acquirers.get_acquirer_extra_fees(order.amount_total, order.currency_id, order.partner_id.country_id.id)