From 5a1905ee7d5eec58bdc15256a9b13d60cc5ee6c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Baranx=20=28bar=29?= <bar@odoo.com>
Date: Fri, 16 Apr 2021 05:49:57 +0000
Subject: [PATCH] [FIX] gamification: apply res.users ir rules when retrieving
 badge owner info

When retreiving the list of badge owners in `_get_owners_info()`,
we should apply `res.users` ir rules to be sure to respect multi-company
rules.

upg-7081

closes odoo/odoo#70182

X-original-commit: d75deff4791702e1f085b2b16247d7f7c5335720
Signed-off-by: Christophe Simonis <chs@odoo.com>
---
 addons/gamification/models/badge.py | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/addons/gamification/models/badge.py b/addons/gamification/models/badge.py
index 9dd276096da..aa065140e8f 100644
--- a/addons/gamification/models/badge.py
+++ b/addons/gamification/models/badge.py
@@ -147,14 +147,25 @@ class GamificationBadge(models.Model):
             self.update(defaults)
             return
 
-        self.env.cr.execute("""
-            SELECT badge_id, count(user_id) as granted_count,
-                count(distinct(user_id)) as granted_users_count,
-                array_agg(distinct(user_id)) as unique_owner_ids
-            FROM gamification_badge_user
-            WHERE badge_id in %s
-            GROUP BY badge_id
-            """, [tuple(self.ids)])
+        Users = self.env["res.users"]
+        query = Users._where_calc([])
+        Users._apply_ir_rules(query)
+        badge_alias = query.join("res_users", "id", "gamification_badge_user", "user_id", "badges")
+
+        tables, where_clauses, where_params = query.get_sql()
+
+        self.env.cr.execute(
+            f"""
+              SELECT {badge_alias}.badge_id, count(res_users.id) as stat_count,
+                     count(distinct(res_users.id)) as stat_count_distinct,
+                     array_agg(distinct(res_users.id)) as unique_owner_ids
+                FROM {tables}
+               WHERE {where_clauses}
+                 AND {badge_alias}.badge_id IN %s
+            GROUP BY {badge_alias}.badge_id
+            """,
+            [*where_params, tuple(self.ids)]
+        )
 
         mapping = {
             badge_id: {