[FIX] auth_signup, website: make reset password multi website friendly

The "reset password" feature does not take into account
multi-website.

steps to reproduce:
- create a website A
- uncheck 'Shared Customer Accounts' on website A
- create a portal user user@example.com on website A
- create a website B
- uncheck 'Shared Customer Accounts' on website B
- create a portal user user@example.com on website B
- reset password for user@example.com on any website

before this commit:
An error is raised "No account found for this login"
(which is false, actually 2 accounts are found)

after this commit:
Only the user linked to the current website is properly
selected

opw-3551540

closes odoo/odoo#142110

X-original-commit: a2196253d6cf90dca3042a777703e0679f74f542
Signed-off-by: Romain Derie (rde) <rde@odoo.com>

addons/auth_signup/i18n/auth_signup.pot

@@ -488,6 +488,12 @@ msgstr ""
 msgid "Marc Demo"
 msgstr ""
 
+#. module: auth_signup
+#: code:addons/auth_signup/models/res_users.py:0
+#, python-format
+msgid "Multiple accounts found for this login"
+msgstr ""
+
 #. module: auth_signup
 #. odoo-python
 #: code:addons/auth_signup/models/res_users.py:0

addons/auth_signup/models/res_users.py

@@ -166,11 +166,13 @@ class ResUsers(models.Model):
         """ retrieve the user corresponding to login (login or email),
             and reset their password
         """
-        users = self.search([('login', '=', login)])
+        users = self.search(self._get_login_domain(login))
+        if not users:
+            users = self.search(self._get_email_domain(login))
         if not users:
-            users = self.search([('email', '=', login)])
-        if len(users) != 1:
             raise Exception(_('No account found for this login'))
+        if len(users) > 1:
+            raise Exception(_('Multiple accounts found for this login'))
         return users.action_reset_password()
 
     def action_reset_password(self):

addons/website/models/res_users.py

@@ -41,6 +41,11 @@ class ResUsers(models.Model):
         website = self.env['website'].get_current_website()
         return super(ResUsers, self)._get_login_domain(login) + website.website_domain()
 
+    @api.model
+    def _get_email_domain(self, email):
+        website = self.env['website'].get_current_website()
+        return super()._get_email_domain(email) + website.website_domain()
+
     @api.model
     def _get_login_order(self):
         return 'website_id, ' + super(ResUsers, self)._get_login_order()

addons/website/tests/test_website_reset_password.py

@@ -75,3 +75,26 @@ class TestWebsiteResetPassword(HttpCase):
         # The most specific user should be selected
         self.authenticate("bobo@mail.com", "bobo@mail.com")
         self.assertEqual(self.session["uid"], user2.id)
+
+    def test_multi_website_reset_password_user_specific_user_account(self):
+        # Create same user on different websites with 'Specific User Account'
+        # option enabled and then reset password. Only the user from the
+        # current website should be reset.
+        website_1, website_2 = self.env['website'].create([
+            {'name': 'Website 1', 'specific_user_account': True},
+            {'name': 'Website 2', 'specific_user_account': True},
+        ])
+
+        login = 'user@example.com'  # same login for both users
+        user_website_1, user_website_2 = self.env['res.users'].with_context(no_reset_password=True).create([
+            {'website_id': website_1.id, 'login': login, 'email': login, 'name': login},
+            {'website_id': website_2.id, 'login': login, 'email': login, 'name': login},
+        ])
+
+        self.assertFalse(user_website_1.signup_valid)
+        self.assertFalse(user_website_2.signup_valid)
+
+        self.env['res.users'].with_context(website_id=website_1.id).reset_password(login)
+
+        self.assertTrue(user_website_1.signup_valid)
+        self.assertFalse(user_website_2.signup_valid)

odoo/addons/base/models/res_users.py

@@ -767,6 +767,10 @@ class Users(models.Model):
     def _get_login_domain(self, login):
         return [('login', '=', login)]
 
+    @api.model
+    def _get_email_domain(self, email):
+        return [('email', '=', email)]
+
     @api.model
     def _get_login_order(self):
         return self._order