[FIX] *_mail_plugin: hide modules if the user doesn't have access

Bug
===
If the user doesn't have access to the project / CRM module, those
menus were visible on the addin side.

Now, the sections are not visible if the user doesn't have access to.

Task-2765323

closes odoo/odoo#89260

X-original-commit: 7b7aa72ecdc7e69e425ae08c28e1e7827e423548
Related: odoo/enterprise#26446
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>

addons/crm_mail_plugin/controllers/mail_plugin.py

@@ -52,7 +52,16 @@ class MailPluginController(mail_plugin.MailPluginController):
         return leads
 
     def _get_contact_data(self, partner):
+        """
+        Return the leads key only if the current user can create leads. So, if he can not
+        create leads, the section won't be visible on the addin side (like if the CRM
+        module was not installed on the database).
+        """
         contact_values = super(MailPluginController, self)._get_contact_data(partner)
+
+        if not request.env['crm.lead'].check_access_rights('create', raise_exception=False):
+            return contact_values
+
         if not partner:
             contact_values['leads'] = []
         else:
@@ -60,7 +69,13 @@ class MailPluginController(mail_plugin.MailPluginController):
         return contact_values
 
     def _mail_content_logging_models_whitelist(self):
-        return super(MailPluginController, self)._mail_content_logging_models_whitelist() + ['crm.lead']
+        models_whitelist = super(MailPluginController, self)._mail_content_logging_models_whitelist()
+        if not request.env['crm.lead'].check_access_rights('create', raise_exception=False):
+            return models_whitelist
+        return models_whitelist + ['crm.lead']
 
     def _translation_modules_whitelist(self):
-        return super(MailPluginController, self)._translation_modules_whitelist() + ['crm_mail_plugin']
+        modules_whitelist = super(MailPluginController, self)._translation_modules_whitelist()
+        if not request.env['crm.lead'].check_access_rights('create', raise_exception=False):
+            return modules_whitelist
+        return modules_whitelist + ['crm_mail_plugin']

addons/crm_mail_plugin/tests/__init__.py

@@ -0,0 +1,4 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from . import test_crm_mail_plugin

addons/crm_mail_plugin/tests/test_crm_mail_plugin.py

@@ -0,0 +1,56 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+import json
+
+from odoo.addons.mail_plugin.tests.common import TestMailPluginControllerCommon, mock_auth_method_outlook
+
+
+class TestCrmMailPlugin(TestMailPluginControllerCommon):
+    @mock_auth_method_outlook('employee')
+    def test_get_contact_data(self):
+        """Check that the leads section is not visible if the user has not access to crm.lead."""
+        partner, partner_2 = self.env["res.partner"].create([
+            {"name": "Partner 1"},
+            {"name": "Partner 2"},
+        ])
+
+        data = {
+            "id": 0,
+            "jsonrpc": "2.0",
+            "method": "call",
+            "params": {"partner_id": partner.id},
+        }
+
+        result = self.url_open(
+            "/mail_plugin/partner/get",
+            data=json.dumps(data).encode(),
+            headers={"Content-Type": "application/json"},
+        ).json()["result"]
+
+        self.assertNotIn("leads", result,
+            msg="The user has no access to crm.lead, the leads section should not be visible")
+
+        self.user_test.groups_id |= self.env.ref("sales_team.group_sale_salesman_all_leads")
+
+        lead_1, lead_2 = self.env["crm.lead"].create([
+            {"name": "Lead Partner 1", "partner_id": partner.id},
+            {"name": "Lead Partner 2", "partner_id": partner_2.id},
+        ])
+
+        result = self.url_open(
+            "/mail_plugin/partner/get",
+            data=json.dumps(data).encode(),
+            headers={"Content-Type": "application/json"},
+        ).json()["result"]
+
+        self.assertIn(
+            "leads",
+            result,
+            msg="The user has access to crm.lead, the leads section should be visible",
+        )
+
+        self.assertTrue([lead for lead in result["leads"] if lead["lead_id"] == lead_1.id],
+            msg="The first lead belongs to the first partner, it should be returned")
+        self.assertFalse([lead for lead in result["leads"] if lead["lead_id"] == lead_2.id],
+            msg="The second lead does not belong to the first partner, it should not be returned")

addons/project_mail_plugin/controllers/mail_plugin.py

@@ -18,8 +18,16 @@ class MailPluginController(mail_plugin.MailPluginController):
         information dict loaded when opening an email on Outlook.
         This is structured this way to enable the "project" feature on the Outlook side only if the Odoo version
         supports it.
+
+        Return the tasks key only if the current user can create tasks. So, if he can not
+        create tasks, the section won't be visible on the addin side (like if the project
+        module was not installed on the database).
         """
         contact_values = super(MailPluginController, self)._get_contact_data(partner)
+
+        if not request.env['project.task'].check_access_rights('create', raise_exception=False):
+            return contact_values
+
         if not partner:
             contact_values['tasks'] = []
         else:
@@ -40,7 +48,13 @@ class MailPluginController(mail_plugin.MailPluginController):
         return contact_values
 
     def _mail_content_logging_models_whitelist(self):
-        return super(MailPluginController, self)._mail_content_logging_models_whitelist() + ['project.task']
+        models_whitelist = super(MailPluginController, self)._mail_content_logging_models_whitelist()
+        if not request.env['project.task'].check_access_rights('create', raise_exception=False):
+            return models_whitelist
+        return models_whitelist + ['project.task']
 
     def _translation_modules_whitelist(self):
-        return super(MailPluginController, self)._translation_modules_whitelist() + ['project_mail_plugin']
+        modules_whitelist = super(MailPluginController, self)._translation_modules_whitelist()
+        if not request.env['project.task'].check_access_rights('create', raise_exception=False):
+            return modules_whitelist
+        return modules_whitelist + ['project_mail_plugin']