From e50bc120020d606962c1d9b687e53b1bdb34c048 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Wed, 18 Aug 2021 11:01:46 +0200
Subject: [PATCH 01/33] [IMP] project: add Project Sharing feature

Purpose:
=======

This commit adds the project sharing feature. This feature consists to
share the backend views about project.task to portal users.

About the access rights:
- The project manager can share a project with project sharing feature.
  To do this, he need to give access to portal users that we want their access in project sharing views.
  He can choose between 3 differents accesses:
    1. Readonly: the portal with this access right will only have read access to the project
        sharing views of the project shared.
    2. Comment: the portal with this access right will can use the chatter in task form view.
    3. Edit: the portal with this access right will can edit some fields of `project.task` model.

The difference between the classic backend views and the project sharing
views is in the project sharing views, we list the fields that the user
can read/write, so the portal users can see only the fields in
our list.
Moreover, the actions and the contextual menu (actions dropdown) are not
available in the project sharing views and the stat buttons are visible
but the click on these buttons are disabled.

Implementation details:
======================

This commit is realized in many steps:

- create the webclient and routes.
- create own qweb bundle.
- add project sharing views.
- use the session to define the action and active_id
- create public fields for project sharing: in this step, we lists all field
names of the `project.task` model that we want to display for the
portal user. Two lists are created, one for only readable field names
and the other one for the writable field names.
Moreover, two properties are defined in the `project.task` model to use the
both lists.
- use `access_token` and check model in project sharing route: in this
step we check if the model is `project.project` and the `access_token`
is the one set in the project since we have the id of the project in the
params url.
- allow only `GET` method to enter project_sharing routes: the
`/my/project/<int:project_id>/project_sharing` route must only be
called with a `GET` method because this route is only used to have the template
to render the project sharing webclient.

task-2379518

closes #73341
---
 addons/project/__manifest__.py                |  17 ++
 addons/project/controllers/portal.py          |  49 +++-
 addons/project/models/project.py              |  63 ++++
 .../static/src/project_sharing/main.js        |   5 +
 .../src/project_sharing/project_sharing.js    |  75 +++++
 .../src/project_sharing/project_sharing.xml   |  14 +
 .../views/project_sharing_templates.xml       |  26 ++
 .../project/views/project_sharing_views.xml   | 273 ++++++++++++++++++
 8 files changed, 520 insertions(+), 2 deletions(-)
 create mode 100644 addons/project/static/src/project_sharing/main.js
 create mode 100644 addons/project/static/src/project_sharing/project_sharing.js
 create mode 100644 addons/project/static/src/project_sharing/project_sharing.xml
 create mode 100644 addons/project/views/project_sharing_templates.xml
 create mode 100644 addons/project/views/project_sharing_views.xml

diff --git a/addons/project/__manifest__.py b/addons/project/__manifest__.py
index 625ee834690..c4970f054f6 100644
--- a/addons/project/__manifest__.py
+++ b/addons/project/__manifest__.py
@@ -36,8 +36,10 @@
         'views/res_partner_views.xml',
         'views/res_config_settings_views.xml',
         'views/mail_activity_views.xml',
+        'views/project_sharing_views.xml',
         'views/project_portal_templates.xml',
         'views/project_task_templates.xml',
+        'views/project_sharing_templates.xml',
         'data/ir_cron_data.xml',
         'data/mail_data.xml',
         'data/mail_template_data.xml',
@@ -87,6 +89,21 @@
         'web.assets_tests': [
             'project/static/tests/tours/**/*',
         ],
+        'project.assets_qweb': [
+            ('include', 'web.assets_qweb'),
+            'project/static/src/project_sharing/**/*.xml',
+        ],
+        'project.webclient': [
+            ('include', 'web.assets_backend'),
+            ('remove', 'web/static/src/webclient/menu_service.js'),
+            ('remove', 'mail/static/src/components/dialog_manager/dialog_manager.js'),
+            ('remove', 'mail/static/src/services/dialog_service/dialog_service.js'),
+            ('remove', 'mail/static/src/components/chat_window_manager/chat_window_manager.js'),
+            ('remove', 'mail/static/src/services/chat_window_service/chat_window_service.js'),
+            'project/static/src/project_sharing/**/*.js',
+            'web/static/src/start.js',
+            'web/static/src/legacy/legacy_setup.js',
+        ],
     },
     'license': 'LGPL-3',
 }
diff --git a/addons/project/controllers/portal.py b/addons/project/controllers/portal.py
index f5bb7cc91c9..cbdb6e87f01 100644
--- a/addons/project/controllers/portal.py
+++ b/addons/project/controllers/portal.py
@@ -6,11 +6,12 @@ from operator import itemgetter
 
 from markupsafe import Markup
 
-from odoo import http, _
+from odoo import conf, http, _
 from odoo.exceptions import AccessError, MissingError
 from odoo.http import request
+from odoo.addons.web.controllers.main import HomeStaticTemplateHelpers
 from odoo.addons.portal.controllers.portal import CustomerPortal, pager as portal_pager
-from odoo.tools import groupby as groupbyelem
+from odoo.tools import consteq, groupby as groupbyelem
 
 from odoo.osv.expression import OR
 
@@ -89,6 +90,50 @@ class ProjectCustomerPortal(CustomerPortal):
         values = self._project_get_page_view_values(project_sudo, access_token, **kw)
         return request.render("project.portal_my_project", values)
 
+    @http.route("/project_sharing/<int:project_id>", type='http', auth="user", methods=['GET'])
+    def get_project_sharing(self, project_id, model='project.project', access_token=None):
+        if not model or model != 'project.project' or not access_token:
+            return request.not_found()
+        project = request.env[model].sudo().browse(project_id)
+        project_validation = project and project.exists() and consteq(project.access_token, access_token) and project.privacy_visibility == 'portal'
+        if not project_validation:
+            return request.not_found()
+        return request.render('project.project_sharing', {'project_id': project.id})
+
+    @http.route("/embed/project/<int:project_id>", type="http", auth="user", methods=['GET'])
+    def render_project_backend_view(self, project_id):
+        project = request.env['project.project'].sudo().browse(project_id)
+
+        if not project.exists():
+            return request.not_found()
+
+        session_info = request.env['ir.http'].session_info()
+        user_context = request.session.get_context() if request.session.uid else {}
+        mods = conf.server_wide_modules or []
+        qweb_checksum = HomeStaticTemplateHelpers.get_qweb_templates_checksum(debug=request.session.debug, bundle="project.assets_qweb")
+        lang = user_context.get("lang")
+        translation_hash = request.env['ir.translation'].get_web_translations_hash(mods, lang)
+        cache_hashes = {
+            "qweb": qweb_checksum,
+            "translations": translation_hash,
+        }
+
+        project_company = project.company_id
+        session_info.update(cache_hashes=cache_hashes, action_name='project.project_sharing_project_task_action', project_id=project.id, user_companies={
+            'current_company': project_company.id,
+            'allowed_companies': {
+                project_company.id: {
+                    'id': project_company.id,
+                    'name': project_company.name,
+                },
+            },
+        })
+
+        return request.render(
+            'project.project_sharing_embed',
+            {'session_info': session_info},
+        )
+
     # ------------------------------------------------------------
     # My Task
     # ------------------------------------------------------------
diff --git a/addons/project/models/project.py b/addons/project/models/project.py
index 5dedfe41179..0eb864dd6fe 100644
--- a/addons/project/models/project.py
+++ b/addons/project/models/project.py
@@ -14,6 +14,45 @@ from odoo.osv.expression import OR
 from .project_task_recurrence import DAYS, WEEKS
 from .project_update import STATUS_COLOR
 
+
+PROJECT_TASK_READABLE_FIELDS = [
+    'id',
+    'active',
+    'description',
+    'priority',
+    'kanban_state_label',
+    'project_id',
+    'display_project_id',
+    'color',
+    'partner_is_company',
+    'commercial_partner_id',
+    'allow_subtasks',
+    'child_text',
+    'is_closed',
+    'email_from',
+    'create_date',
+    'write_date',
+    'company_id',
+    'displayed_image_id',
+    'display_name',
+    'priority',
+]
+
+PROJECT_TASK_WRITABLE_FIELDS = [
+    'name',
+    'partner_id',
+    'partner_email',
+    'user_id',
+    'date_deadline',
+    'tag_ids',
+    'sequence',
+    'stage_id',
+    'kanban_state',
+    'child_ids',
+    'parent_id',
+]
+
+
 class ProjectTaskType(models.Model):
     _name = 'project.task.type'
     _description = 'Task Stage'
@@ -899,6 +938,14 @@ class Task(models.Model):
     repeat_show_week = fields.Boolean(compute='_compute_repeat_visibility')
     repeat_show_month = fields.Boolean(compute='_compute_repeat_visibility')
 
+    @property
+    def SELF_READABLE_FIELDS(self):
+        return PROJECT_TASK_READABLE_FIELDS | self.SELF_WRITABLE_FIELDS
+
+    @property
+    def SELF_WRITABLE_FIELDS(self):
+        return PROJECT_TASK_WRITABLE_FIELDS
+
     @api.constrains('depend_on_ids')
     def _check_no_cyclic_dependencies(self):
         if not self._check_m2m_recursion('depend_on_ids'):
@@ -1185,6 +1232,22 @@ class Task(models.Model):
     # ------------------------------------------------
     # CRUD overrides
     # ------------------------------------------------
+    @api.model
+    def fields_get(self, allfields=None, attributes=None):
+        fields = super().fields_get(allfields=allfields, attributes=attributes)
+        if not self.env.user.has_group('base.group_portal'):
+            return fields
+        readable_fields = self.SELF_READABLE_FIELDS
+        public_fields = {field_name: description for field_name, description in fields.items() if field_name in readable_fields}
+
+            writable_fields = self.SELF_WRITABLE_FIELDS
+            for field_name, description in public_fields.items():
+                if field_name not in writable_fields and not description.get('readonly', False):
+                    # If the field is not in Writable fields and it is not readonly then we force the readonly to True
+                description['readonly'] = True
+
+        return public_fields
+
     @api.model
     def default_get(self, default_fields):
         vals = super(Task, self).default_get(default_fields)
diff --git a/addons/project/static/src/project_sharing/main.js b/addons/project/static/src/project_sharing/main.js
new file mode 100644
index 00000000000..61458f6992c
--- /dev/null
+++ b/addons/project/static/src/project_sharing/main.js
@@ -0,0 +1,5 @@
+/** @odoo-module **/
+import { startWebClient } from '@web/start';
+import { ProjectSharingWebClient } from './project_sharing';
+
+startWebClient(ProjectSharingWebClient);
diff --git a/addons/project/static/src/project_sharing/project_sharing.js b/addons/project/static/src/project_sharing/project_sharing.js
new file mode 100644
index 00000000000..a8a0503130d
--- /dev/null
+++ b/addons/project/static/src/project_sharing/project_sharing.js
@@ -0,0 +1,75 @@
+/** @odoo-module **/
+
+import { registry } from '@web/core/registry';
+import { useBus, useEffect, useService } from '@web/core/utils/hooks';
+import { ActionContainer } from '@web/webclient/actions/action_container';
+import { MainComponentsContainer } from "@web/core/main_components_container";
+import { useOwnDebugContext } from "@web/core/debug/debug_context";
+import { DebugMenu } from "@web/core/debug/debug_menu";
+import { ErrorHandler, NotUpdatable } from "@web/core/utils/components";
+import { session } from '@web/session';
+
+const { Component } = owl;
+
+export class ProjectSharingWebClient extends Component {
+    setup() {
+        window.parent.document.body.style.margin = "0"; // remove the margin in the parent body
+        this.actionService = useService('action');
+        this.user = useService("user");
+        useService("legacy_service_provider");
+        useOwnDebugContext({ categories: ["default"] });
+        if (this.env.debug) {
+            registry.category("systray").add(
+                "web.debug_mode_menu",
+                {
+                    Component: DebugMenu,
+                },
+                { sequence: 100 }
+            );
+        }
+        useBus(this.env.bus, "ACTION_MANAGER:UI-UPDATED", (mode) => {
+            if (mode !== "new") {
+                this.el.classList.toggle("o_fullscreen", mode === "fullscreen");
+            }
+        });
+        useEffect(
+            () => {
+                this._showView();
+            },
+            () => []
+        );
+    }
+
+    mounted() {
+        this.env.bus.trigger("WEB_CLIENT_READY");
+    }
+
+    handleComponentError(error, C) {
+        // remove the faulty component
+        this.Components.splice(this.Components.indexOf(C), 1);
+        /**
+         * we rethrow the error to notify the user something bad happened.
+         * We do it after a tick to make sure owl can properly finish its
+         * rendering
+         */
+        Promise.resolve().then(() => {
+            throw error;
+        });
+    }
+
+    async _showView() {
+        const { action_name, project_id } = session;
+        await this.actionService.doAction(
+            action_name,
+            {
+                clearBreadcrumbs: true,
+                additionalContext: {
+                    active_id: project_id,
+                }
+            }
+        );
+    }
+}
+
+ProjectSharingWebClient.components = { ActionContainer, ErrorHandler, NotUpdatable, MainComponentsContainer };
+ProjectSharingWebClient.template = 'project.ProjectSharingWebClient';
diff --git a/addons/project/static/src/project_sharing/project_sharing.xml b/addons/project/static/src/project_sharing/project_sharing.xml
new file mode 100644
index 00000000000..9f021f9530d
--- /dev/null
+++ b/addons/project/static/src/project_sharing/project_sharing.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8"?>
+<templates xml:space="preserve">
+
+    <t t-name="project.ProjectSharingWebClient" owl="1">
+        <body class="o_project_sharing">
+            <NotUpdatable>
+                <ActionContainer />
+            </NotUpdatable>
+            <div class="o_dialog_container"/>
+            <MainComponentsContainer/>
+        </body>
+    </t>
+
+</templates>
diff --git a/addons/project/views/project_sharing_templates.xml b/addons/project/views/project_sharing_templates.xml
new file mode 100644
index 00000000000..2717036f7bc
--- /dev/null
+++ b/addons/project/views/project_sharing_templates.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+
+    <template id="project_sharing" name="Project Sharing View">
+        <iframe width="100%" height="100%" frameborder="0" t-attf-src="/embed/project/{{ project_id }}"/>
+    </template>
+
+    <template id="project_sharing_embed" name="Project Sharing View Embed">
+        <t t-call="web.layout">
+            <t t-set="head_project_sharing">
+                <script type="text/javascript">
+                    odoo.__session_info__ = <t t-out="json.dumps(session_info)"/>;
+                    odoo.loadTemplatesPromise = fetch(`/web/webclient/qweb/${odoo.__session_info__.cache_hashes.qweb}?bundle=project.assets_qweb`).then(doc => doc.text());
+                </script>
+                <base target="_parent"/>
+                <t t-call-assets="web.assets_common" t-js="false"/>
+                <t t-call-assets="project.webclient" t-js="false"/>
+                <t t-call-assets="web.assets_common" t-css="false"/>
+                <t t-call-assets="project.webclient" t-css="false"/>
+            </t>
+            <t t-set="head" t-value="head_project_sharing + (head or '')"/>
+            <t t-set="body_classname" t-value="'o_web_client'"/>
+        </t>
+    </template>
+
+</odoo>
diff --git a/addons/project/views/project_sharing_views.xml b/addons/project/views/project_sharing_views.xml
new file mode 100644
index 00000000000..e37cdaed17c
--- /dev/null
+++ b/addons/project/views/project_sharing_views.xml
@@ -0,0 +1,273 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+
+    <record id="project_sharing_quick_create_task_form" model="ir.ui.view">
+        <field name="name">project.task.form.quick_create</field>
+        <field name="model">project.task</field>
+        <field name="priority">999</field>
+        <field name="groups_id" eval="[(4, ref('base.group_portal')), (4, ref('base.group_user'))]"/>
+        <field name="arch" type="xml">
+            <form>
+                <group>
+                    <field name="name" string="Task Title" placeholder="e.g. New Design"/>
+                </group>
+            </form>
+        </field>
+    </record>
+
+    <record id="project_sharing_project_task_view_kanban" model="ir.ui.view">
+        <field name="name">project.sharing.project.task.view.kanban</field>
+        <field name="model">project.task</field>
+        <field name="priority">999</field>
+        <field name="groups_id" eval="[(4, ref('base.group_portal')), (4, ref('base.group_user'))]"/>
+        <field name="arch" type="xml">
+            <kanban
+                class="o_kanban_small_column o_kanban_project_tasks"
+                default_group_by="stage_id"
+                on_create="quick_create"
+                quick_create_view="project.project_sharing_quick_create_task_form"
+            >
+                <field name="color"/>
+                <field name="priority"/>
+                <field name="stage_id" options='{"group_by_tooltip": {"description": "Description"}}'/>
+                <field name="user_id"/>
+                <field name="partner_id"/>
+                <field name="sequence"/>
+                <field name="is_closed"/>
+                <field name="partner_is_company"/>
+                <field name="displayed_image_id"/>
+                <field name="active"/>
+                <field name="allow_subtasks"/>
+                <field name="child_text"/>
+                <progressbar field="kanban_state" colors='{"done": "success", "blocked": "danger", "normal": "muted"}'/>
+                <templates>
+                <t t-name="kanban-box">
+                    <div t-attf-class="{{!selection_mode ? 'oe_kanban_color_' + kanban_getcolor(record.color.raw_value) : ''}} oe_kanban_card oe_kanban_global_click">
+                        <div class="oe_kanban_content">
+                            <div class="o_kanban_record_top">
+                                <div class="o_kanban_record_headings">
+                                    <strong class="o_kanban_record_title">
+                                        <s t-if="!record.active.raw_value"><field name="name" widget="name_with_subtask_count"/></s>
+                                        <t t-else=""><field name="name" widget="name_with_subtask_count"/></t>
+                                    </strong>
+                                    <span invisible="context.get('default_project_id', False)"><br/><field name="project_id" required="1"/></span>
+                                    <br />
+                                    <t t-if="record.partner_id.value">
+                                        <span t-if="!record.partner_is_company.raw_value">
+                                            <field name="commercial_partner_id"/>
+                                        </span>
+                                        <span t-else="">
+                                            <field name="partner_id"/>
+                                        </span>
+                                    </t>
+                                    <t t-else="record.email_from.raw_value"><span><field name="email_from"/></span></t>
+                                </div>
+                                <div class="o_dropdown_kanban dropdown" t-if="!selection_mode">
+                                    <a role="button" class="dropdown-toggle o-no-caret btn" data-toggle="dropdown" data-display="static" href="#" aria-label="Dropdown menu" title="Dropdown menu">
+                                        <span class="fa fa-ellipsis-v"/>
+                                    </a>
+                                    <div class="dropdown-menu" role="menu">
+                                        <a t-if="widget.editable" role="menuitem" type="set_cover" class="dropdown-item" data-field="displayed_image_id">Set Cover Image</a>
+                                        <a t-if="widget.editable" role="menuitem" type="edit" class="dropdown-item">Edit</a>
+                                        <div role="separator" class="dropdown-divider"></div>
+                                        <ul class="oe_kanban_colorpicker" data-field="color"/>
+                                    </div>
+                                </div>
+                            </div>
+                            <div class="o_kanban_record_body">
+                                <field name="tag_ids" widget="many2many_tags" options="{'color_field': 'color'}"/>
+                                <div t-if="record.date_deadline.raw_value" name="date_deadline" attrs="{'invisible': [('is_closed', '=', True)]}">
+                                    <field name="date_deadline" widget="remaining_days"/>
+                                </div>
+                                <div t-if="record.displayed_image_id.value">
+                                    <field name="displayed_image_id" widget="attachment_image"/>
+                                </div>
+                            </div>
+                            <div class="o_kanban_record_bottom" t-if="!selection_mode">
+                                <div class="oe_kanban_bottom_left">
+                                    <field name="priority" widget="priority"/>
+                                </div>
+                                <div class="oe_kanban_bottom_right" t-if="!selection_mode">
+                                    <field name="kanban_state" widget="state_selection"/>
+                                    <field name="user_id" widget="many2one_avatar_user"/>
+                                </div>
+                            </div>
+                        </div>
+                        <div class="oe_clear"></div>
+                    </div>
+                </t>
+                </templates>
+            </kanban>
+        </field>
+    </record>
+
+    <record id="project_sharing_project_task_view_tree" model="ir.ui.view">
+        <field name="name">project.sharing.project.task.tree</field>
+        <field name="model">project.task</field>
+        <field name="priority">999</field>
+        <field name="arch" type="xml">
+            <tree string="Tasks" sample="1" delete="0">
+                <field name="is_closed" invisible="1" />
+                <field name="allow_subtasks" invisible="1" />
+                <field name="sequence" invisible="1" readonly="1"/>
+                <field name="priority" widget="priority" optional="show" nolabel="1"/>
+                <field name="name" widget="name_with_subtask_count"/>
+                <field name="child_text" invisible="1"/>
+                <field name="company_id" invisible="1"/>
+                <field name="partner_id" optional="hide"/>
+                <field name="user_id" optional="show" widget="many2one_avatar_user"/>
+                <field name="date_deadline" optional="hide" widget="remaining_days" attrs="{'invisible': [('is_closed', '=', True)]}"/>
+                <field name="tag_ids" widget="many2many_tags" options="{'color_field': 'color'}" optional="show"/>
+                <field name="kanban_state" widget="state_selection" optional="hide"/>
+                <field name="stage_id" invisible="context.get('set_visible',False)" optional="show"/>
+            </tree>
+        </field>
+    </record>
+
+    <record id="project_sharing_project_task_view_form" model="ir.ui.view">
+        <field name="name">project.sharing.project.task.view.form</field>
+        <field name="model">project.task</field>
+        <field name="priority">999</field>
+        <field name="groups_id" eval="[(4, ref('base.group_portal')), (4, ref('base.group_user'))]"/>
+        <field name="arch" type="xml">
+            <form string="Project Sharing: Task" class="o_form_project_tasks">
+                <header>
+                    <field name="stage_id" widget="statusbar" options="{'fold_field': 'fold'}" attrs="{'invisible': [('project_id', '=', False), ('stage_id', '=', False)]}" />
+                </header>
+                <sheet string="Task">
+                    <div class="oe_button_box" name="button_box">
+                        <button name="action_open_parent_task" type="object" special="cancel" class="oe_stat_button o_debounce_disabled" icon="fa-tasks" string="Parent Task" attrs="{'invisible': [('parent_id', '=', False)]}"/>
+                    </div>
+                    <widget name="web_ribbon" title="Archived" bg_color="bg-danger" attrs="{'invisible': [('active', '=', True)]}"/>
+                    <div class="oe_title pr-0">
+                        <h1 class="d-flex flex-row justify-content-between">
+                            <field name="priority" widget="priority" class="mr-3"/>
+                            <field name="name" class="o_task_name text-truncate" placeholder="Task Title..."/>
+                            <field name="kanban_state" widget="state_selection" class="ml-auto" readonly="1"/>
+                        </h1>
+                    </div>
+                    <group>
+                        <group>
+                            <field name="project_id" invisible="1"/>
+                            <field name="display_project_id" string="Project" invisible="1"/>
+                            <field name="user_id"
+                                class="o_task_user_field"
+                                options="{'no_open': True}"
+                                widget="many2one_avatar_user"
+                                domain="[('share', '=', False)]"/>
+                        </group>
+                        <group>
+                            <field name="active" invisible="1"/>
+                            <field name="parent_id" invisible="1" />
+                            <field name="company_id" invisible="1" />
+                            <field name="is_closed" invisible="1" />
+                            <field name="allow_subtasks" invisible="1" />
+                            <field name="partner_id" options="{'no_open': True, 'no_create': True, 'no_edit': True}"/>
+                            <field name="date_deadline" attrs="{'invisible': [('is_closed', '=', True)]}"/>
+                            <field name="tag_ids" widget="many2many_tags" options="{'color_field': 'color', 'no_create_edit': True, 'no_edit_color': True}"/>
+                        </group>
+                    </group>
+                    <notebook>
+                        <page name="description_page" string="Description">
+                            <field name="description" type="html"/>
+                        </page>
+                        <page name="sub_tasks_page" string="Sub-tasks" attrs="{'invisible': [('allow_subtasks', '=', False)]}">
+                            <field name="child_ids" context="{'default_project_id': project_id if not parent_id or not display_project_id else display_project_id, 'default_user_id': uid, 'default_parent_id': id, 'default_partner_id': partner_id}">
+                                <tree editable="bottom">
+                                    <field name="project_id" invisible="1"/>
+                                    <field name="is_closed" invisible="1"/>
+                                    <field name="sequence" widget="handle"/>
+                                    <field name="name"/>
+                                    <field name="display_project_id" string="Project" optional="hide" invisible="1"/>
+                                    <field name="company_id" invisible="1"/>
+                                    <field name="partner_id" options="{'no_open': True, 'no_create': True, 'no_edit': True}" optional="hide"/>
+                                    <field name="user_id" widget="many2one_avatar_user" optional="show"/>
+                                    <field name="date_deadline" attrs="{'invisible': [('is_closed', '=', True)]}" optional="show"/>
+                                    <field name="tag_ids" widget="many2many_tags" options="{'color_field': 'color'}" optional="hide"/>
+                                    <field name="kanban_state" widget="state_selection" optional="hide"/>
+                                    <field name="stage_id" optional="show"/>
+                                    <button name="action_open_task" type="object" title="View Task" string="View Task" class="btn btn-link pull-right"
+                                            context="{'form_view_ref': 'project.project_sharing_project_task_view_form'}"
+                                            attrs="{'invisible': [('display_project_id', '!=', False), ('display_project_id', '!=', 'parent.display_project_id')]}"/>
+                                </tree>
+                            </field>
+                        </page>
+                    </notebook>
+                </sheet>
+            </form>
+        </field>
+    </record>
+
+    <record id="project_sharing_project_task_view_search" model="ir.ui.view">
+        <field name="name">project.task.search.form</field>
+        <field name="model">project.task</field>
+        <field name="priority">999</field>
+        <field name="arch" type="xml">
+            <search string="Tasks">
+                <field name="name" string="Task"/>
+                <field name="tag_ids"/>
+                <field name="user_id"/>
+                <field name="partner_id" operator="child_of"/>
+                <field name="stage_id"/>
+                <field string="Project" name="display_project_id"/>
+                <filter string="Unassigned" name="unassigned" domain="[('user_id', '=', False)]"/>
+                <separator/>
+                <filter string="Starred" name="starred" domain="[('priority', 'in', [1, 2])]"/>
+                <filter string="Late Tasks" name="late" domain="[('date_deadline', '&lt;', context_today().strftime('%Y-%m-%d'))]"/>
+                <separator/>
+                <filter invisible="1" string="Today Activities" name="activities_today"
+                    domain="[('activity_ids.date_deadline', '=', context_today().strftime('%Y-%m-%d'))]"/>
+                <filter invisible="1" string="Future Activities" name="activities_upcoming_all"
+                    domain="[('activity_ids.date_deadline', '&gt;', context_today().strftime('%Y-%m-%d'))]"/>
+                <group expand="0" string="Group By">
+                    <filter string="Stage" name="stage" context="{'group_by': 'stage_id'}"/>
+                    <filter string="Assigned to" name="user" context="{'group_by': 'user_id'}"/>
+                    <filter string="Project" name="project" context="{'group_by': 'project_id'}"/>
+                    <filter string="Customer" name="customer" context="{'group_by': 'partner_id'}"/>
+                    <filter string="Kanban State" name="kanban_state" context="{'group_by': 'kanban_state'}"/>
+                    <filter string="Deadline" name="date_deadline" context="{'group_by': 'date_deadline'}"/>
+                    <filter string="Creation Date" name="group_create_date" context="{'group_by': 'create_date'}"/>
+                </group>
+            </search>
+        </field>
+    </record>
+
+    <record id="project_sharing_project_task_action" model="ir.actions.act_window">
+        <field name="name">Project Sharing</field>
+        <field name="res_model">project.task</field>
+        <field name="view_mode">kanban,tree,form</field>
+        <field name="search_view_id" ref="project.project_sharing_project_task_view_search"/>
+        <field name="domain">[('display_project_id', '=', active_id)]</field>
+        <field name="context">{
+            'default_project_id': active_id,
+            'delete': 0,
+        }</field>
+        <field name="help" type="html">
+            <p class="o_view_nocontent_smiling_face">
+                No tasks found. Let's create one!
+            </p><p>
+                To get things done, use activities and status on tasks.<br/>
+                Chat in real time or by email to collaborate efficiently.
+            </p>
+        </field>
+    </record>
+
+    <record id="project_sharing_kanban_action_view" model="ir.actions.act_window.view">
+        <field name="view_mode">kanban</field>
+        <field name="act_window_id" ref="project.project_sharing_project_task_action"/>
+        <field name="view_id" ref="project.project_sharing_project_task_view_kanban"/>
+    </record>
+
+    <record id="project_sharing_tree_action_view" model="ir.actions.act_window.view">
+        <field name="view_mode">tree</field>
+        <field name="act_window_id" ref="project.project_sharing_project_task_action"/>
+        <field name="view_id" ref="project.project_sharing_project_task_view_tree"/>
+    </record>
+
+    <record id="project_sharing_form_action_view" model="ir.actions.act_window.view">
+        <field name="view_mode">form</field>
+        <field name="act_window_id" ref="project.project_sharing_project_task_action"/>
+        <field name="view_id" ref="project.project_sharing_project_task_view_form"/>
+    </record>
+
+</odoo>

From 45c96edae77811924c2809dbe25591bde3140975 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Mon, 14 Jun 2021 12:34:03 +0200
Subject: [PATCH 02/33] [IMP] project: remove the longpolling for project
 sharing views

Before this commit, the longpolling is active in the project sharing
views but it is not necessary for these views, since the chat is
disabled and the goal of these views is to give access to external
users to `project.task` views.

This commit removes the files about the longpolling for the bundle used
for project sharing.

task-2379518

closes #73341
---
 addons/project/__manifest__.py                              | 6 ++++++
 .../project/static/src/project_sharing/project_sharing.js   | 4 +---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/addons/project/__manifest__.py b/addons/project/__manifest__.py
index c4970f054f6..a20d1a6d86c 100644
--- a/addons/project/__manifest__.py
+++ b/addons/project/__manifest__.py
@@ -96,6 +96,12 @@
         'project.webclient': [
             ('include', 'web.assets_backend'),
             ('remove', 'web/static/src/webclient/menu_service.js'),
+
+            # Remove Longpolling bus and packages needed this bus
+            ('remove', 'bus/static/src/js/services/assets_watchdog_service.js'),
+            ('remove', 'mail/static/src/services/messaging/messaging.js'),
+            ('remove', 'mail/static/src/components/notification_request/notification_request.js'),
+
             ('remove', 'mail/static/src/components/dialog_manager/dialog_manager.js'),
             ('remove', 'mail/static/src/services/dialog_service/dialog_service.js'),
             ('remove', 'mail/static/src/components/chat_window_manager/chat_window_manager.js'),
diff --git a/addons/project/static/src/project_sharing/project_sharing.js b/addons/project/static/src/project_sharing/project_sharing.js
index a8a0503130d..cf1affa05eb 100644
--- a/addons/project/static/src/project_sharing/project_sharing.js
+++ b/addons/project/static/src/project_sharing/project_sharing.js
@@ -40,9 +40,7 @@ export class ProjectSharingWebClient extends Component {
         );
     }
 
-    mounted() {
-        this.env.bus.trigger("WEB_CLIENT_READY");
-    }
+    mounted() { }
 
     handleComponentError(error, C) {
         // remove the faulty component

From 58a12e03abfb8c980764ae4306ef1846bc8585c5 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Tue, 25 May 2021 12:21:33 +0200
Subject: [PATCH 03/33] [FIX] project: remove duplicate field in project task
 kanban view

task-2379518

closes #73341
---
 addons/project/views/project_views.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/addons/project/views/project_views.xml b/addons/project/views/project_views.xml
index d2048d0b193..9427a085848 100644
--- a/addons/project/views/project_views.xml
+++ b/addons/project/views/project_views.xml
@@ -975,7 +975,6 @@
                     <field name="activity_state"/>
                     <field name="rating_last_value"/>
                     <field name="rating_ids"/>
-                    <field name="active"/>
                     <field name="allow_subtasks"/>
                     <field name="child_text"/>
                     <progressbar field="kanban_state" colors='{"done": "success", "blocked": "danger", "normal": "muted"}'/>

From 0e659dc4d78161f6fc24a1adc885689bd4395fc8 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Tue, 15 Jun 2021 15:46:42 +0200
Subject: [PATCH 04/33] [IMP] hr_timesheet,project: override project sharing
 views

This commit override the project_sharing views to add fields defined in
`hr_timesheet` module.

task-2379518

closes #73341
---
 addons/hr_timesheet/__manifest__.py           |   1 +
 addons/hr_timesheet/models/project.py         |  20 ++
 .../views/project_sharing_views.xml           | 174 ++++++++++++++++++
 addons/project/models/project.py              |   9 +-
 4 files changed, 200 insertions(+), 4 deletions(-)
 create mode 100644 addons/hr_timesheet/views/project_sharing_views.xml

diff --git a/addons/hr_timesheet/__manifest__.py b/addons/hr_timesheet/__manifest__.py
index 92d085b7f1f..ff049b01573 100644
--- a/addons/hr_timesheet/__manifest__.py
+++ b/addons/hr_timesheet/__manifest__.py
@@ -37,6 +37,7 @@ up a management by affair.
         'views/hr_views.xml',
         'data/hr_timesheet_data.xml',
         'wizard/project_task_create_timesheet_views.xml',
+        'views/project_sharing_views.xml',
     ],
     'demo': [
         'data/hr_timesheet_demo.xml',
diff --git a/addons/hr_timesheet/models/project.py b/addons/hr_timesheet/models/project.py
index 2021e89c08f..e0d0a09b7df 100644
--- a/addons/hr_timesheet/models/project.py
+++ b/addons/hr_timesheet/models/project.py
@@ -7,6 +7,22 @@ from odoo import models, fields, api, _
 from odoo.exceptions import UserError, ValidationError, RedirectWarning
 
 
+PROJECT_TASK_READABLE_FIELDS = {
+    'allow_subtasks',
+    'allow_timesheets',
+    'analytic_account_active',
+    'effective_hours',
+    'encode_uom_in_days',
+    'planned_hours',
+    'progress',
+    'overtime',
+    'remaining_hours',
+    'subtask_effective_hours',
+    'subtask_planned_hours',
+    'timesheet_ids',
+    'total_hours_spent',
+}
+
 class Project(models.Model):
     _inherit = "project.project"
 
@@ -178,6 +194,10 @@ class Task(models.Model):
     timesheet_ids = fields.One2many('account.analytic.line', 'task_id', 'Timesheets')
     encode_uom_in_days = fields.Boolean(compute='_compute_encode_uom_in_days', default=lambda self: self._uom_in_days())
 
+    @property
+    def SELF_READABLE_FIELDS(self):
+        return super().SELF_READABLE_FIELDS | PROJECT_TASK_READABLE_FIELDS
+
     def _uom_in_days(self):
         return self.env.company.timesheet_encode_uom_id == self.env.ref('uom.product_uom_day')
 
diff --git a/addons/hr_timesheet/views/project_sharing_views.xml b/addons/hr_timesheet/views/project_sharing_views.xml
new file mode 100644
index 00000000000..6f6d958b919
--- /dev/null
+++ b/addons/hr_timesheet/views/project_sharing_views.xml
@@ -0,0 +1,174 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+
+    <record id="project_sharing_inherit_project_task_view_form" model="ir.ui.view">
+        <field name="name">project.sharing.project.task.view.form.inherit</field>
+        <field name="model">project.task</field>
+        <field name="inherit_id" ref="project.project_sharing_project_task_view_form"/>
+        <field name="arch" type="xml">
+            <xpath expr="//field[@name='child_ids']/tree/field[@name='kanban_state']" position="after">
+                <field name="planned_hours" widget="timesheet_uom_no_toggle" sum="Initially Planned Hours" optional="hide"/>
+                <field name="effective_hours" widget="timesheet_uom" sum="Effective Hours" optional="hide"/>
+                <field name="remaining_hours" widget="timesheet_uom" sum="Remaining Hours" optional="hide" decoration-danger="progress &gt;= 100" decoration-warning="progress &gt;= 80 and progress &lt; 100"/>
+                <field name="progress" widget="progressbar" optional="hide"/>
+            </xpath>
+            <xpath expr="//notebook/page[@name='description_page']" position="after">
+                <field name="analytic_account_active" invisible="1"/>
+                <field name="allow_timesheets" invisible="1"/>
+                <field name="encode_uom_in_days" invisible="1"/>
+                <field name="subtask_count" invisible="1"/>
+                <page string="Timesheets" id="timesheets_tab" attrs="{'invisible': [('allow_timesheets', '=', False)]}">
+                    <group>
+                        <group>
+                            <div class="o_td_label">
+                                <label for="planned_hours" string="Initially Planned Hours" attrs="{'invisible': [('encode_uom_in_days', '=', True)]}"/>
+                                <label for="planned_hours" string="Initially Planned Days" attrs="{'invisible': [('encode_uom_in_days', '=', False)]}"/>
+                            </div>
+                            <field name="planned_hours" widget="timesheet_uom_no_toggle" nolabel="1"/>
+                            <div class="o_td_label" groups="project.group_subtask_project" attrs="{'invisible': ['|', ('allow_subtasks', '=', False), ('subtask_count', '=', 0)]}">
+                                <label for="subtask_planned_hours" string="Sub-tasks Planned Hours" attrs="{'invisible': [('encode_uom_in_days', '=', True)]}"/>
+                                <label for="subtask_planned_hours" string="Sub-tasks Planned Days" attrs="{'invisible': [('encode_uom_in_days', '=', False)]}"/>
+                            </div>
+                            <field name="subtask_planned_hours" widget="timesheet_uom_no_toggle" nolabel="1" groups="project.group_subtask_project" attrs="{'invisible': ['|', ('allow_subtasks', '=', False), ('subtask_count', '=', 0)]}"/>
+                        </group>
+                        <group>
+                            <field name="progress" widget="progressbar"/>
+                        </group>
+                    </group>
+                    <field name="timesheet_ids" mode="tree,kanban"
+                          attrs="{'invisible': [('analytic_account_active', '=', False)]}">
+                        <!-- TODO: see how to disable the _onRowclicked to not try to open form view -->
+                        <tree string="Timesheet Activities" default_order="date" no_open="1">
+                            <field name="date"/>
+                            <field name="user_id" invisible="1"/>
+                            <field name="employee_id" widget="many2one_avatar_employee"/>
+                            <field name="name"/>
+                            <field name="unit_amount" widget="timesheet_uom" decoration-danger="unit_amount &gt; 24"/>
+                        </tree>
+                        <kanban class="o_kanban_mobile">
+                            <field name="date"/>
+                            <field name="user_id" invisible="1"/>
+                            <field name="employee_id" widget="many2one_avatar_employee"/>
+                            <field name="name"/>
+                            <field name="unit_amount" decoration-danger="unit_amount &gt; 24"/>
+                            <field name="project_id"/>
+                            <field name="task_id" invisible="1"/>
+                            <templates>
+                                <t t-name="kanban-box">
+                                    <div t-attf-class="oe_kanban_card oe_kanban_global_click">
+                                        <div class="row">
+                                            <div class="col-6">
+                                                <strong><span><t t-esc="record.employee_id.value"/></span></strong>
+                                            </div>
+                                            <div class="col-6 pull-right text-right">
+                                                <strong><t t-esc="record.date.value"/></strong>
+                                            </div>
+                                        </div>
+                                        <div class="row">
+                                            <div class="col-6 text-muted">
+                                                <span><t t-esc="record.name.value"/></span>
+                                            </div>
+                                            <div class="col-6">
+                                                <span class="pull-right text-right">
+                                                    <field name="unit_amount" widget="float_time"/>
+                                                </span>
+                                            </div>
+                                        </div>
+                                    </div>
+                                </t>
+                            </templates>
+                        </kanban>
+                    </field>
+                    <group attrs="{'invisible': [('analytic_account_active', '=', False)]}">
+                        <group class="oe_subtotal_footer oe_right" name="project_hours">
+                            <span>
+                                <label class="font-weight-bold" for="effective_hours" string="Hours Spent" attrs="{'invisible': [('encode_uom_in_days', '=', True)]}"/>
+                                <label class="font-weight-bold" for="effective_hours" string="Days Spent" attrs="{'invisible': [('encode_uom_in_days', '=', False)]}"/>
+                            </span>
+                            <field name="effective_hours" widget="timesheet_uom" nolabel="1"/>
+                            <button name="action_view_subtask_timesheet" type="object" class="o_td_label o_form_label o_form_subtask_button oe_inline oe_link mr-0" attrs="{'invisible' : ['|', ('allow_subtasks', '=', False), ('subtask_effective_hours', '=', 0.0)]}">
+                                <span class="text-nowrap" attrs="{'invisible' : [('encode_uom_in_days', '=', True)]}">Sub-tasks Hours Spent</span>
+                                <span class="text-nowrap" attrs="{'invisible' : [('encode_uom_in_days', '=', False)]}">Sub-tasks Days Spent</span>
+                            </button>
+                            <field name="subtask_effective_hours" class="mt-2" widget="timesheet_uom"
+                                  attrs="{'invisible' : ['|', ('allow_subtasks', '=', False), ('subtask_effective_hours', '=', 0.0)]}" nolabel="1"/>
+                            <span>
+                                <label class="font-weight-bold" for="total_hours_spent" string="Total Hours"
+                                      attrs="{'invisible': ['|', '|', ('allow_subtasks', '=', False), ('subtask_effective_hours', '=', 0.0), ('encode_uom_in_days', '=', True)]}"/>
+                                <label class="font-weight-bold" for="total_hours_spent" string="Total Days"
+                                      attrs="{'invisible': ['|', '|', ('allow_subtasks', '=', False), ('subtask_effective_hours', '=', 0.0), ('encode_uom_in_days', '=', False)]}"/>
+                            </span>
+                            <field name="total_hours_spent" widget="timesheet_uom" class="oe_subtotal_footer_separator" nolabel="1"
+                                  attrs="{'invisible' : ['|', ('allow_subtasks', '=', False), ('subtask_effective_hours', '=', 0.0)]}" />
+                            <span>
+                                <label class="font-weight-bold" for="remaining_hours" string="Remaining Hours"
+                                      attrs="{'invisible': ['|', ('planned_hours', '=', 0.0), ('encode_uom_in_days', '=', True)]}"/>
+                                <label class="font-weight-bold" for="remaining_hours" string="Remaining Days"
+                                      attrs="{'invisible': ['|', ('planned_hours', '=', 0.0), ('encode_uom_in_days', '=', False)]}"/>
+                            </span>
+                            <field name="remaining_hours" widget="timesheet_uom" class="oe_subtotal_footer_separator"
+                                  attrs="{'invisible' : [('planned_hours', '=', 0.0)]}" nolabel="1"/>
+                        </group>
+                    </group>
+                </page>
+            </xpath>
+        </field>
+    </record>
+
+    <record id="project_sharing_kanban_inherit_project_task_view_kanban" model="ir.ui.view">
+        <field name="name">project.sharing.project.task.timesheet.kanban.inherited</field>
+        <field name="model">project.task</field>
+        <field name="inherit_id" ref="project.project_sharing_project_task_view_kanban"/>
+        <field name="arch" type="xml">
+            <templates position="before">
+                <field name="progress" />
+                <field name="remaining_hours" />
+                <field name="planned_hours" />
+                <field name="allow_timesheets"/>
+                <field name="encode_uom_in_days" invisible="1"/>
+            </templates>
+            <div class="oe_kanban_bottom_left" position="inside">
+                <t name="planned_hours" t-if="record.planned_hours.raw_value &gt; 0 and record.allow_timesheets.raw_value">
+                    <t t-set="badge" t-value=""/>
+                    <t t-set="badge" t-value="'badge-warning'" t-if="record.progress.raw_value &gt;= 80 and record.progress.raw_value &lt;= 100"/>
+                    <t t-set="badge" t-value="'badge-danger'" t-if="record.remaining_hours.raw_value &lt; 0"/>
+                    <t t-set="title" t-value="'Remaining days'" t-if="record.encode_uom_in_days.raw_value"/>
+                    <t t-set="title" t-value="'Remaining hours'" t-else=""/>
+                    <div t-attf-class="oe_kanban_align badge {{ badge }}" t-att-title="title">
+                        <field name="remaining_hours" widget="timesheet_uom" />
+                    </div>
+                </t>
+            </div>
+        </field>
+    </record>
+
+    <record id="project_sharing_inherit_project_task_view_tree" model="ir.ui.view">
+        <field name="name">project.task.tree.inherited</field>
+        <field name="model">project.task</field>
+        <field name="inherit_id" ref="project.project_sharing_project_task_view_tree" />
+        <field name="arch" type="xml">
+            <field name="user_id" position="after">
+                <field name="allow_subtasks" invisible="1"/>
+                <field name="allow_timesheets" invisible="1"/>
+                <field name="planned_hours" widget="timesheet_uom_no_toggle" sum="Initially Planned Hours" optional="hide" attrs="{'column_invisible': [('allow_timesheets', '=', False)]}"/>
+                <field name="effective_hours" widget="timesheet_uom" sum="Effective Hours" optional="show" attrs="{'column_invisible': [('allow_timesheets', '=', False)]}"/>
+                <field name="remaining_hours" widget="timesheet_uom" sum="Remaining Hours" optional="hide" decoration-danger="progress &gt;= 100" decoration-warning="progress &gt;= 80 and progress &lt; 100" attrs="{'column_invisible': [('allow_timesheets', '=', False)]}"/>
+                <field name="subtask_effective_hours" widget="timesheet_uom" attrs="{'column_invisible' : ['|', ('allow_subtasks', '=', False), ('allow_timesheets', '=', False)]}" optional="hide"/>
+                <field name="total_hours_spent" widget="timesheet_uom" attrs="{'invisible' : ['|', ('allow_subtasks', '=', False), ('allow_timesheets', '=', False)]}" optional="hide"/>
+                <field name="progress" widget="progressbar" optional="show" groups="hr_timesheet.group_hr_timesheet_user"/>
+            </field>
+        </field>
+    </record>
+
+    <record id="project_sharing_inherit_project_task_view_search" model="ir.ui.view">
+        <field name="name">project.sharing.inherit.project.task.view.search</field>
+        <field name="model">project.task</field>
+        <field name="inherit_id" ref="project.project_sharing_project_task_view_search"/>
+        <field name="arch" type="xml">
+            <xpath expr="//filter[@name='late']" position='after'>
+                <filter string="Tasks in Overtime" name="overtime" domain="[('overtime', '&gt;', 0)]"/>
+            </xpath>
+        </field>
+    </record>
+
+</odoo>
diff --git a/addons/project/models/project.py b/addons/project/models/project.py
index 0eb864dd6fe..c426a259344 100644
--- a/addons/project/models/project.py
+++ b/addons/project/models/project.py
@@ -15,7 +15,7 @@ from .project_task_recurrence import DAYS, WEEKS
 from .project_update import STATUS_COLOR
 
 
-PROJECT_TASK_READABLE_FIELDS = [
+PROJECT_TASK_READABLE_FIELDS = {
     'id',
     'active',
     'description',
@@ -27,6 +27,7 @@ PROJECT_TASK_READABLE_FIELDS = [
     'partner_is_company',
     'commercial_partner_id',
     'allow_subtasks',
+    'subtask_count',
     'child_text',
     'is_closed',
     'email_from',
@@ -36,9 +37,9 @@ PROJECT_TASK_READABLE_FIELDS = [
     'displayed_image_id',
     'display_name',
     'priority',
-]
+}
 
-PROJECT_TASK_WRITABLE_FIELDS = [
+PROJECT_TASK_WRITABLE_FIELDS = {
     'name',
     'partner_id',
     'partner_email',
@@ -50,7 +51,7 @@ PROJECT_TASK_WRITABLE_FIELDS = [
     'kanban_state',
     'child_ids',
     'parent_id',
-]
+}
 
 
 class ProjectTaskType(models.Model):

From 31d943666f87fab1909a7c20b06a3c99c244e3d7 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Wed, 16 Jun 2021 15:51:27 +0200
Subject: [PATCH 05/33] [IMP] sale_project: add project sharing views

task-2379518

closes #73341
---
 addons/sale_project/__manifest__.py           |  1 +
 addons/sale_project/models/project.py         |  4 ++
 .../views/project_sharing_views.xml           | 41 +++++++++++++++++++
 3 files changed, 46 insertions(+)
 create mode 100644 addons/sale_project/views/project_sharing_views.xml

diff --git a/addons/sale_project/__manifest__.py b/addons/sale_project/__manifest__.py
index 0f50f47727f..88df257a86e 100644
--- a/addons/sale_project/__manifest__.py
+++ b/addons/sale_project/__manifest__.py
@@ -17,6 +17,7 @@ This module allows to generate a project/task from sales orders.
         'views/product_views.xml',
         'views/project_task_views.xml',
         'views/sale_order_views.xml',
+        'views/project_sharing_views.xml',
     ],
     'auto_install': True,
     'license': 'LGPL-3',
diff --git a/addons/sale_project/models/project.py b/addons/sale_project/models/project.py
index 3af3077d108..10bb47f2a5d 100644
--- a/addons/sale_project/models/project.py
+++ b/addons/sale_project/models/project.py
@@ -67,6 +67,10 @@ class ProjectTask(models.Model):
     invoice_count = fields.Integer("Number of invoices", related='sale_order_id.invoice_count')
     task_to_invoice = fields.Boolean("To invoice", compute='_compute_task_to_invoice', search='_search_task_to_invoice', groups='sales_team.group_sale_salesman_all_leads')
 
+    @property
+    def SELF_READABLE_FIELDS(self):
+        return super().SELF_READABLE_FIELDS | {'sale_order_id', 'sale_line_id'}
+
     @api.depends('sale_line_id', 'project_id', 'commercial_partner_id')
     def _compute_sale_order_id(self):
         for task in self:
diff --git a/addons/sale_project/views/project_sharing_views.xml b/addons/sale_project/views/project_sharing_views.xml
new file mode 100644
index 00000000000..d4776bfcdc6
--- /dev/null
+++ b/addons/sale_project/views/project_sharing_views.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+
+    <record id="project_sharing_inherit_project_task_view_form" model="ir.ui.view">
+        <field name="name">project.task.view.inherit</field>
+        <field name="model">project.task</field>
+        <field name="inherit_id" ref="project.project_sharing_project_task_view_form"/>
+        <field name="arch" type="xml">
+            <div name="button_box" position="inside">
+                <field name="sale_order_id" invisible="1"/>
+                <button class="d-none d-md-inline oe_stat_button o_debounce_disabled"
+                        type="object" name="action_view_so" icon="fa-dollar" special="cancel"
+                        attrs="{'invisible': [('sale_order_id', '=', False)]}"
+                        string="Sales Order"/>
+            </div>
+            <xpath expr="//field[@name='partner_id']" position="attributes">
+                <attribute name="options">{'no_open': True, 'no_create': True, 'no_edit': True}</attribute>
+                <attribute name="context">{'res_partner_search_mode': 'customer'}</attribute>
+            </xpath>
+            <xpath expr="//field[@name='partner_id']" position="after">
+                <field name="commercial_partner_id" invisible="1" />
+                <field name="sale_line_id" string="Sales Order Item" attrs="{'invisible': [('partner_id', '=', False)]}" options='{"no_open": True}' readonly="1" context="{'create': False, 'edit': False, 'delete': False}"/>
+            </xpath>
+        </field>
+    </record>
+
+    <record id="project_sharing_inherit_project_task_view_search" model="ir.ui.view">
+        <field name="name">project.task.search.inherit</field>
+        <field name="model">project.task</field>
+        <field name="inherit_id" ref="project.project_sharing_project_task_view_search"/>
+        <field name="arch" type="xml">
+            <xpath expr="//field[@name='partner_id']" position="before">
+                <field name="sale_order_id" string="Sale Order" filter_domain="['|', ('sale_order_id', 'ilike', self), ('sale_line_id', 'ilike', self)]"/>
+            </xpath>
+            <xpath expr="//group/filter[@name='customer']" position="after">
+                <filter name="sale_order_id" string="Sales Order Id" context="{'group_by': 'sale_order_id'}" />
+            </xpath>
+        </field>
+    </record>
+
+</odoo>

From 0748caa97cfb42119aa80a81fb542c6fbb0087ef Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Wed, 16 Jun 2021 16:45:28 +0200
Subject: [PATCH 06/33] [IMP] sale_timesheet: add project sharing views

task-2379518

closes #73341
---
 addons/sale_timesheet/__manifest__.py         |  1 +
 addons/sale_timesheet/models/project.py       |  8 ++++
 .../views/project_sharing_views.xml           | 37 +++++++++++++++++++
 3 files changed, 46 insertions(+)
 create mode 100644 addons/sale_timesheet/views/project_sharing_views.xml

diff --git a/addons/sale_timesheet/__manifest__.py b/addons/sale_timesheet/__manifest__.py
index 9a441ea4b3b..5491dc2ab4f 100644
--- a/addons/sale_timesheet/__manifest__.py
+++ b/addons/sale_timesheet/__manifest__.py
@@ -27,6 +27,7 @@ have real delivered quantities in sales orders.
         'views/res_config_settings_views.xml',
         'views/hr_timesheet_templates.xml',
         'views/sale_timesheet_portal_templates.xml',
+        'views/project_sharing_views.xml',
         'report/project_profitability_report_analysis_views.xml',
         'data/sale_timesheet_filters.xml',
         'wizard/project_create_sale_order_views.xml',
diff --git a/addons/sale_timesheet/models/project.py b/addons/sale_timesheet/models/project.py
index 39f6976f3b6..2e79e71ab76 100644
--- a/addons/sale_timesheet/models/project.py
+++ b/addons/sale_timesheet/models/project.py
@@ -354,6 +354,14 @@ class ProjectTask(models.Model):
     remaining_hours_so = fields.Float('Remaining Hours on SO', compute='_compute_remaining_hours_so', compute_sudo=True)
     remaining_hours_available = fields.Boolean(related="sale_line_id.remaining_hours_available")
 
+    @property
+    def SELF_READABLE_FIELDS(self):
+        return super().SELF_READABLE_FIELDS | {
+            'allow_billable',
+            'remaining_hours_available',
+            'remaining_hours_so',
+        }
+
     @api.depends('sale_line_id', 'timesheet_ids', 'timesheet_ids.unit_amount')
     def _compute_remaining_hours_so(self):
         # TODO This is not yet perfectly working as timesheet.so_line stick to its old value although changed
diff --git a/addons/sale_timesheet/views/project_sharing_views.xml b/addons/sale_timesheet/views/project_sharing_views.xml
new file mode 100644
index 00000000000..5580b34fdaf
--- /dev/null
+++ b/addons/sale_timesheet/views/project_sharing_views.xml
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+
+    <record id="project_sharing_inherit_project_task_view_form" model="ir.ui.view">
+        <field name="name">project.task.form.inherit.timesheet</field>
+        <field name="model">project.task</field>
+        <field name="inherit_id" ref="project.project_sharing_project_task_view_form"/>
+        <field name="arch" type="xml">
+            <xpath expr="//field[@name='timesheet_ids']/tree" position="attributes">
+                <attribute name="decoration-muted">timesheet_invoice_id != False</attribute>
+            </xpath>
+            <xpath expr="//field[@name='timesheet_ids']/tree/field[@name='unit_amount']" position="before">
+                <field name="timesheet_invoice_id" invisible="1"/>
+                <field name="so_line"
+                    attrs="{'column_invisible': [('parent.allow_billable', '=', False)]}"
+                    context="{'with_remaining_hours': True, 'with_price_unit': True}" options="{'no_create': True, 'no_open': True}"
+                    optional="hide"/>
+            </xpath>
+            <xpath expr="//field[@name='remaining_hours']" position="after">
+                <field name="allow_billable" invisible="1" />
+                <field name="remaining_hours_available" invisible="1"/>
+                <span id="remaining_hours_so_label" attrs="{'invisible': ['|', '|', '|', '|', ('allow_billable', '=', False), ('sale_order_id', '=', False), ('partner_id', '=', False), ('sale_line_id', '=', False), ('remaining_hours_available', '=', False)]}">
+                    <label class="font-weight-bold" for="remaining_hours_so" string="Remaining Hours on SO"
+                            attrs="{'invisible': ['|', ('encode_uom_in_days', '=', True), ('remaining_hours_so', '&lt;', 0)]}"/>
+                    <label class="font-weight-bold" for="remaining_hours_so" string="Remaining Days on SO"
+                            attrs="{'invisible': ['|', ('encode_uom_in_days', '=', False), ('remaining_hours_so', '&lt;', 0)]}"/>
+                    <label class="font-weight-bold text-danger" for="remaining_hours_so" string="Remaining Hours on SO"
+                            attrs="{'invisible': ['|', ('encode_uom_in_days', '=', True), ('remaining_hours_so', '&gt;=', 0)]}"/>
+                    <label class="font-weight-bold text-danger" for="remaining_hours_so" string="Remaining Days on SO"
+                            attrs="{'invisible': ['|', ('encode_uom_in_days', '=', False), ('remaining_hours_so', '&gt;=', 0)]}"/>
+                </span>
+                <field name="remaining_hours_so" nolabel="1" widget="timesheet_uom" attrs="{'invisible': ['|', '|', '|', '|', ('allow_billable', '=', False), ('sale_order_id', '=', False), ('partner_id', '=', False), ('sale_line_id', '=', False), ('remaining_hours_available', '=', False)]}"></field>
+            </xpath>
+        </field>
+    </record>
+
+</odoo>

From 0e1961b1dd16b335663236cdb9d76a92c09c3244 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Mon, 14 Jun 2021 16:27:07 +0200
Subject: [PATCH 07/33] [IMP] project,mail: disable click on avatar

Before this commit, there is no options to disable the click on the
avatar to open the chat in `Many2OneAvatarUser` widget.

This commit adds an option called `no_open_chat` set by default to false
and this option allow to disable the click when it is true. This option
is useful for the project sharing views.

task-2379518

closes #73341
---
 .../views/project_sharing_views.xml           |   4 +-
 addons/mail/static/src/js/m2x_avatar_user.js  |  10 +-
 .../static/tests/m2x_avatar_user_tests.js     | 104 ++++++++++++++++++
 .../project/views/project_sharing_views.xml   |   8 +-
 4 files changed, 117 insertions(+), 9 deletions(-)

diff --git a/addons/hr_timesheet/views/project_sharing_views.xml b/addons/hr_timesheet/views/project_sharing_views.xml
index 6f6d958b919..efbb9bad9ac 100644
--- a/addons/hr_timesheet/views/project_sharing_views.xml
+++ b/addons/hr_timesheet/views/project_sharing_views.xml
@@ -41,14 +41,14 @@
                         <tree string="Timesheet Activities" default_order="date" no_open="1">
                             <field name="date"/>
                             <field name="user_id" invisible="1"/>
-                            <field name="employee_id" widget="many2one_avatar_employee"/>
+                            <field name="employee_id" widget="many2one_avatar_employee" options="{'no_open_chat': True}"/>
                             <field name="name"/>
                             <field name="unit_amount" widget="timesheet_uom" decoration-danger="unit_amount &gt; 24"/>
                         </tree>
                         <kanban class="o_kanban_mobile">
                             <field name="date"/>
                             <field name="user_id" invisible="1"/>
-                            <field name="employee_id" widget="many2one_avatar_employee"/>
+                            <field name="employee_id" widget="many2one_avatar_employee" options="{'no_open_chat': True}"/>
                             <field name="name"/>
                             <field name="unit_amount" decoration-danger="unit_amount &gt; 24"/>
                             <field name="project_id"/>
diff --git a/addons/mail/static/src/js/m2x_avatar_user.js b/addons/mail/static/src/js/m2x_avatar_user.js
index f0a6f12731e..d30d5a95302 100644
--- a/addons/mail/static/src/js/m2x_avatar_user.js
+++ b/addons/mail/static/src/js/m2x_avatar_user.js
@@ -30,6 +30,7 @@ const M2XAvatarMixin = {
             throw new Error(`This widget is only supported on many2one and many2many fields pointing to ${JSON.stringify(this.supportedModels)}`);
         }
         this.className = `${this.className || ''} o_clickable_m2x_avatar`.trim();
+        this.noOpenChat = this.nodeOptions.no_open_chat || false;
     },
 
     //--------------------------------------------------------------------------
@@ -44,8 +45,11 @@ const M2XAvatarMixin = {
      * @returns {Promise}
      */
     async _openChat(params) {
-        const messaging = await Component.env.services.messaging.get();
-        return messaging.openChat(params);
+        if (!this.noOpenChat) {
+            const messaging = await Component.env.services.messaging.get();
+            return messaging.openChat(params);
+        }
+        return Promise.resolve();
     },
 };
 
@@ -68,7 +72,7 @@ export const Many2OneAvatarUser = Many2OneAvatar.extend(M2XAvatarMixin, {
     _onAvatarClicked(ev) {
         ev.stopPropagation(); // in list view, prevent from opening the record
         this._openChat({ userId: this.value.res_id });
-    }
+    },
 });
 
 export const KanbanMany2OneAvatarUser = Many2OneAvatarUser.extend({
diff --git a/addons/mail/static/tests/m2x_avatar_user_tests.js b/addons/mail/static/tests/m2x_avatar_user_tests.js
index 7e4f4350046..98e3efa1df3 100644
--- a/addons/mail/static/tests/m2x_avatar_user_tests.js
+++ b/addons/mail/static/tests/m2x_avatar_user_tests.js
@@ -304,4 +304,108 @@ QUnit.module('mail', {}, function () {
         kanban.destroy();
     });
 
+    QUnit.test('many2one_avatar_user widget in list view with no_open_chat set to true', async function (assert) {
+        assert.expect(3);
+
+        const { widget: list } = await start({
+            hasView: true,
+            View: ListView,
+            model: 'foo',
+            data: this.data,
+            arch: `<tree><field name="user_id" widget="many2one_avatar_user" options="{'no_open_chat': 1}"/></tree>`,
+            mockRPC(route, args) {
+                if (args.method === 'read') {
+                    assert.step(`read ${args.model} ${args.args[0]}`);
+                }
+                return this._super(...arguments);
+            },
+        });
+
+        mock.intercept(list, 'open_record', () => {
+            assert.step('open record');
+        });
+
+        assert.strictEqual(list.$('.o_data_cell span').text(), 'MarioLuigiMarioYoshi');
+
+        // sanity check: later on, we'll check that clicking on the avatar doesn't open the record
+        await dom.click(list.$('.o_data_row:first span'));
+
+        await dom.click(list.$('.o_data_cell:nth(0) .o_m2o_avatar > img'));
+        await dom.click(list.$('.o_data_cell:nth(1) .o_m2o_avatar > img'));
+        await dom.click(list.$('.o_data_cell:nth(2) .o_m2o_avatar > img'));
+
+
+        assert.verifySteps([
+            'open record',
+        ]);
+
+        list.destroy();
+    });
+
+    QUnit.test('many2one_avatar_user widget in kanban view', async function (assert) {
+        assert.expect(3);
+
+        const { widget: kanban } = await start({
+            hasView: true,
+            View: KanbanView,
+            model: 'foo',
+            data: this.data,
+            arch: `
+                <kanban>
+                    <templates>
+                        <t t-name="kanban-box">
+                            <div>
+                                <field name="user_id" widget="many2one_avatar_user" options="{'no_open_chat': 1}"/>
+                            </div>
+                        </t>
+                    </templates>
+                </kanban>`,
+        });
+
+        assert.strictEqual(kanban.$('.o_kanban_record').text().trim(), '');
+        assert.containsN(kanban, '.o_m2o_avatar', 4);
+        dom.click(kanban.$('.o_m2o_avatar:nth(0) > img'));
+        dom.click(kanban.$('.o_m2o_avatar:nth(1) > img'));
+        dom.click(kanban.$('.o_m2o_avatar:nth(2) > img'));
+        dom.click(kanban.$('.o_m2o_avatar:nth(3) > img'));
+
+        assert.verifySteps([], "no read res.user should be done since we don't want to open chat when the user clicks on avatar.");
+
+        kanban.destroy();
+    });
+
+    QUnit.test('many2many_avatar_user widget in form view', async function (assert) {
+        assert.expect(5);
+
+        const { widget: form } = await start({
+            hasView: true,
+            View: FormView,
+            model: 'foo',
+            data: this.data,
+            arch: `<form><field name="user_ids" widget="many2many_avatar_user" options="{'no_open_chat': 1}"/></form>`,
+            mockRPC(route, args) {
+                if (args.method === 'read') {
+                    assert.step(`read ${args.model} ${args.args[0]}`);
+                }
+                return this._super(...arguments);
+            },
+            res_id: 1,
+        });
+
+        assert.containsN(form, '.o_field_many2manytags.avatar.o_field_widget .badge', 2,
+            "should have 2 records");
+        assert.strictEqual(form.$('.o_field_many2manytags.avatar.o_field_widget .badge:first img').data('src'), '/web/image/res.users/11/avatar_128',
+            "should have correct avatar image");
+
+        await dom.click(form.$('.o_field_many2manytags.avatar .badge:first .o_m2m_avatar'));
+        await dom.click(form.$('.o_field_many2manytags.avatar .badge:nth(1) .o_m2m_avatar'));
+
+        assert.verifySteps([
+            "read foo 1",
+            'read res.users 11,23',
+        ]);
+
+        form.destroy();
+    });
+
 });
diff --git a/addons/project/views/project_sharing_views.xml b/addons/project/views/project_sharing_views.xml
index e37cdaed17c..6b39b0ffdaa 100644
--- a/addons/project/views/project_sharing_views.xml
+++ b/addons/project/views/project_sharing_views.xml
@@ -89,7 +89,7 @@
                                 </div>
                                 <div class="oe_kanban_bottom_right" t-if="!selection_mode">
                                     <field name="kanban_state" widget="state_selection"/>
-                                    <field name="user_id" widget="many2one_avatar_user"/>
+                                    <field name="user_id" widget="many2one_avatar_user" options="{'no_open_chat': True}"/>
                                 </div>
                             </div>
                         </div>
@@ -115,7 +115,7 @@
                 <field name="child_text" invisible="1"/>
                 <field name="company_id" invisible="1"/>
                 <field name="partner_id" optional="hide"/>
-                <field name="user_id" optional="show" widget="many2one_avatar_user"/>
+                <field name="user_id" optional="show" widget="many2one_avatar_user" options="{'no_open_chat': True}"/>
                 <field name="date_deadline" optional="hide" widget="remaining_days" attrs="{'invisible': [('is_closed', '=', True)]}"/>
                 <field name="tag_ids" widget="many2many_tags" options="{'color_field': 'color'}" optional="show"/>
                 <field name="kanban_state" widget="state_selection" optional="hide"/>
@@ -152,7 +152,7 @@
                             <field name="display_project_id" string="Project" invisible="1"/>
                             <field name="user_id"
                                 class="o_task_user_field"
-                                options="{'no_open': True}"
+                                options="{'no_open': True, 'no_open_chat': True}"
                                 widget="many2one_avatar_user"
                                 domain="[('share', '=', False)]"/>
                         </group>
@@ -181,7 +181,7 @@
                                     <field name="display_project_id" string="Project" optional="hide" invisible="1"/>
                                     <field name="company_id" invisible="1"/>
                                     <field name="partner_id" options="{'no_open': True, 'no_create': True, 'no_edit': True}" optional="hide"/>
-                                    <field name="user_id" widget="many2one_avatar_user" optional="show"/>
+                                    <field name="user_id" widget="many2one_avatar_user" optional="show" options="{'no_open_chat': True}"/>
                                     <field name="date_deadline" attrs="{'invisible': [('is_closed', '=', True)]}" optional="show"/>
                                     <field name="tag_ids" widget="many2many_tags" options="{'color_field': 'color'}" optional="hide"/>
                                     <field name="kanban_state" widget="state_selection" optional="hide"/>

From 36f5982e181b7e7b20a493852c3ecfb8e8547eec Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Wed, 18 Aug 2021 11:12:13 +0200
Subject: [PATCH 08/33] [IMP] project: remove the action contextual menu in
 project sharing

Before this commit, the user in the project sharing views can
Archive/Unarchive the record via the action menu. He can also click on
the share button in the action menu.

This commit removes the default action buttons defined in the action
menu for form and kanban views.

task-2379518

closes #73341
---
 .../src/project_sharing/views/form/controller.js       |  8 ++++++++
 .../static/src/project_sharing/views/form/view.js      | 10 ++++++++++
 .../src/project_sharing/views/list/controller.js       |  8 ++++++++
 .../static/src/project_sharing/views/list/view.js      | 10 ++++++++++
 .../static/src/project_sharing/views/registry.js       | 10 ++++++++++
 5 files changed, 46 insertions(+)
 create mode 100644 addons/project/static/src/project_sharing/views/form/controller.js
 create mode 100644 addons/project/static/src/project_sharing/views/form/view.js
 create mode 100644 addons/project/static/src/project_sharing/views/list/controller.js
 create mode 100644 addons/project/static/src/project_sharing/views/list/view.js
 create mode 100644 addons/project/static/src/project_sharing/views/registry.js

diff --git a/addons/project/static/src/project_sharing/views/form/controller.js b/addons/project/static/src/project_sharing/views/form/controller.js
new file mode 100644
index 00000000000..b54daf2167e
--- /dev/null
+++ b/addons/project/static/src/project_sharing/views/form/controller.js
@@ -0,0 +1,8 @@
+/** @odoo-module **/
+
+import FormController from 'web.FormController';
+import BasicController from 'web.BasicController';
+
+export default FormController.extend({
+    _getActionMenuItems: BasicController.prototype._getActionMenuItems,
+});
diff --git a/addons/project/static/src/project_sharing/views/form/view.js b/addons/project/static/src/project_sharing/views/form/view.js
new file mode 100644
index 00000000000..6513e12d32d
--- /dev/null
+++ b/addons/project/static/src/project_sharing/views/form/view.js
@@ -0,0 +1,10 @@
+/** @odoo-module **/
+
+import FormView from 'web.FormView';
+import Controller from './controller';
+
+export default FormView.extend({
+    config: _.extend({}, FormView.prototype.config, {
+        Controller,
+    }),
+});
diff --git a/addons/project/static/src/project_sharing/views/list/controller.js b/addons/project/static/src/project_sharing/views/list/controller.js
new file mode 100644
index 00000000000..f6dbac12087
--- /dev/null
+++ b/addons/project/static/src/project_sharing/views/list/controller.js
@@ -0,0 +1,8 @@
+/** @odoo-module **/
+
+import ListController from 'web.ListController';
+import BasicController from 'web.BasicController';
+
+export default ListController.extend({
+    _getActionMenuItems: BasicController.prototype._getActionMenuItems,
+});
diff --git a/addons/project/static/src/project_sharing/views/list/view.js b/addons/project/static/src/project_sharing/views/list/view.js
new file mode 100644
index 00000000000..4c202d29682
--- /dev/null
+++ b/addons/project/static/src/project_sharing/views/list/view.js
@@ -0,0 +1,10 @@
+/** @odoo-module **/
+
+import ListView from 'web.ListView';
+import Controller from './controller';
+
+export default ListView.extend({
+    config: Object.assign({}, ListView.prototype.config, {
+        Controller,
+    }),
+});
diff --git a/addons/project/static/src/project_sharing/views/registry.js b/addons/project/static/src/project_sharing/views/registry.js
new file mode 100644
index 00000000000..62543381893
--- /dev/null
+++ b/addons/project/static/src/project_sharing/views/registry.js
@@ -0,0 +1,10 @@
+/** @odoo-module **/
+
+import ViewRegistry from 'web.view_registry';
+
+import FormView from './form/view';
+import ListView from './list/view';
+
+ViewRegistry
+    .add('form', FormView)
+    .add('list', ListView);

From 2bbb038f22d3790fad0481466021e8caee03ac54 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Wed, 18 Aug 2021 11:15:09 +0200
Subject: [PATCH 09/33] [IMP] project: replace the basic portal views when
 project selected

Before this commit, when the portal user is connected and selects a project
in the list when he is in `/my/projects` route, we redirect him in the
task list of this project.

This commit replaces the basic portal view by the project sharing views
if the Project Sharing feature is enabled for this project.

task-2379518

closes #73341
---
 addons/project/controllers/portal.py          | 22 ++++++++++++-------
 .../views/project_sharing_templates.xml       |  7 ++++++
 2 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/addons/project/controllers/portal.py b/addons/project/controllers/portal.py
index cbdb6e87f01..7fdebe216a3 100644
--- a/addons/project/controllers/portal.py
+++ b/addons/project/controllers/portal.py
@@ -86,7 +86,8 @@ class ProjectCustomerPortal(CustomerPortal):
             project_sudo = self._document_check_access('project.project', project_id, access_token)
         except (AccessError, MissingError):
             return request.redirect('/my')
-
+        if project_sudo.privacy_visibility == 'portal' and not request.env.user._is_public():
+            return request.render("project.project_sharing_portal", {'project_id': project_id})
         values = self._project_get_page_view_values(project_sudo, access_token, **kw)
         return request.render("project.portal_my_project", values)
 
@@ -119,15 +120,20 @@ class ProjectCustomerPortal(CustomerPortal):
         }
 
         project_company = project.company_id
-        session_info.update(cache_hashes=cache_hashes, action_name='project.project_sharing_project_task_action', project_id=project.id, user_companies={
-            'current_company': project_company.id,
-            'allowed_companies': {
-                project_company.id: {
-                    'id': project_company.id,
-                    'name': project_company.name,
+        session_info.update(
+            cache_hashes=cache_hashes,
+            action_name='project.project_sharing_project_task_action',
+            project_id=project.id,
+            user_companies={
+                'current_company': project_company.id,
+                'allowed_companies': {
+                    project_company.id: {
+                        'id': project_company.id,
+                        'name': project_company.name,
+                    },
                 },
             },
-        })
+        )
 
         return request.render(
             'project.project_sharing_embed',
diff --git a/addons/project/views/project_sharing_templates.xml b/addons/project/views/project_sharing_templates.xml
index 2717036f7bc..3456532c48f 100644
--- a/addons/project/views/project_sharing_templates.xml
+++ b/addons/project/views/project_sharing_templates.xml
@@ -1,6 +1,13 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
 
+    <template id="project_sharing_portal" name="Project Sharing View in Portal">
+        <t t-call="portal.frontend_layout">
+            <t t-set="no_footer" t-value="true"/>
+            <t t-call="project.project_sharing"/>
+        </t>
+    </template>
+
     <template id="project_sharing" name="Project Sharing View">
         <iframe width="100%" height="100%" frameborder="0" t-attf-src="/embed/project/{{ project_id }}"/>
     </template>

From 60e97e4ffbcd20d4c2aee6fbfce5ce4bac10c5a5 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Mon, 12 Jul 2021 11:31:56 +0200
Subject: [PATCH 10/33] [IMP] project: add chatter in project sharing form view

Before this commit, the chatter is not available in form view of project
sharing even for portal user. Since the portal views, we have a chatter
for the portal users, we need a chatter for those users in project
sharing.

This commit integrates the portal chatter in the form view for only the
portal users.

task-2379518

closes #73341
---
 addons/project/__manifest__.py                |  6 ++-
 .../project_sharing/views/form/renderer.js    | 32 ++++++++++++++
 .../src/project_sharing/views/form/view.js    |  2 +
 .../src/scss/project_sharing/chatter.scss     | 44 +++++++++++++++++++
 .../project/views/project_sharing_views.xml   |  1 +
 5 files changed, 84 insertions(+), 1 deletion(-)
 create mode 100644 addons/project/static/src/project_sharing/views/form/renderer.js
 create mode 100644 addons/project/static/src/scss/project_sharing/chatter.scss

diff --git a/addons/project/__manifest__.py b/addons/project/__manifest__.py
index a20d1a6d86c..869f59caee8 100644
--- a/addons/project/__manifest__.py
+++ b/addons/project/__manifest__.py
@@ -100,13 +100,17 @@
             # Remove Longpolling bus and packages needed this bus
             ('remove', 'bus/static/src/js/services/assets_watchdog_service.js'),
             ('remove', 'mail/static/src/services/messaging/messaging.js'),
-            ('remove', 'mail/static/src/components/notification_request/notification_request.js'),
 
             ('remove', 'mail/static/src/components/dialog_manager/dialog_manager.js'),
             ('remove', 'mail/static/src/services/dialog_service/dialog_service.js'),
             ('remove', 'mail/static/src/components/chat_window_manager/chat_window_manager.js'),
             ('remove', 'mail/static/src/services/chat_window_service/chat_window_service.js'),
+
+            'web/static/src/legacy/js/public/public_widget.js',
+            'portal/static/src/js/portal_chatter.js',
+            'portal/static/src/js/portal_composer.js',
             'project/static/src/project_sharing/**/*.js',
+            'project/static/src/scss/project_sharing/*',
             'web/static/src/start.js',
             'web/static/src/legacy/legacy_setup.js',
         ],
diff --git a/addons/project/static/src/project_sharing/views/form/renderer.js b/addons/project/static/src/project_sharing/views/form/renderer.js
new file mode 100644
index 00000000000..5ef0ddc3470
--- /dev/null
+++ b/addons/project/static/src/project_sharing/views/form/renderer.js
@@ -0,0 +1,32 @@
+/** @odoo-module **/
+
+import FormRenderer from 'web.FormRenderer';
+import { PortalChatter } from 'portal.chatter';
+
+export default FormRenderer.extend({
+    _makeChatterContainerComponent() {
+        const props = this._makeChatterContainerProps();
+        this._chatterContainerComponent = new PortalChatter(this, props);
+    },
+    _makeChatterContainerProps() {
+        return {
+            token: '',
+            res_model: 'project.task',
+            pid: '',
+            hash: '',
+            res_id: this.state.res_id,
+            pager_step: 10,
+            allow_composer: true,
+            two_columns: false,
+        };
+    },
+    _makeChatterContainerTarget() {
+        const $el = $('<div class="o_FormRenderer_chatterContainer"/>');
+        this._chatterContainerTarget = $el[0];
+        return $el;
+    },
+    _mountChatterContainerComponent() {
+        this._chatterContainerComponent.appendTo(this._chatterContainerTarget);
+    },
+    _updateChatterContainerComponent() {},
+});
diff --git a/addons/project/static/src/project_sharing/views/form/view.js b/addons/project/static/src/project_sharing/views/form/view.js
index 6513e12d32d..36f7904679b 100644
--- a/addons/project/static/src/project_sharing/views/form/view.js
+++ b/addons/project/static/src/project_sharing/views/form/view.js
@@ -2,9 +2,11 @@
 
 import FormView from 'web.FormView';
 import Controller from './controller';
+import Renderer from './renderer';
 
 export default FormView.extend({
     config: _.extend({}, FormView.prototype.config, {
         Controller,
+        Renderer,
     }),
 });
diff --git a/addons/project/static/src/scss/project_sharing/chatter.scss b/addons/project/static/src/scss/project_sharing/chatter.scss
new file mode 100644
index 00000000000..ab108ff1d22
--- /dev/null
+++ b/addons/project/static/src/scss/project_sharing/chatter.scss
@@ -0,0 +1,44 @@
+.o_FormRenderer_chatterContainer {
+    display: flex;
+    background-color: $white;
+    border-color: $border-color;
+    height: fit-content;
+
+    .o_portal_chatter {
+        width: 100%;
+
+        .o_portal_chatter_header {
+            text-align: center;
+            vertical-align: middle;
+        }
+
+        div.o_portal_chatter_composer,
+        div.o_portal_chatter_messages {
+            div.media {
+                gap: 10px;
+
+                .o_portal_chatter_attachments {
+                    margin-bottom: 1rem;
+                }
+            }
+        }
+
+    }
+
+    &.o-aside {
+        flex-direction: column;
+
+        .o_portal_chatter {
+            .o_portal_chatter_header {
+                padding-top: 1rem;
+                padding-bottom: 2px;
+            }
+
+            .o_portal_chatter_composer, .o_portal_chatter_messages {
+                margin-left: 1rem;
+                margin-right: 1rem;
+            }
+        }
+    }
+}
+
diff --git a/addons/project/views/project_sharing_views.xml b/addons/project/views/project_sharing_views.xml
index 6b39b0ffdaa..db325793e41 100644
--- a/addons/project/views/project_sharing_views.xml
+++ b/addons/project/views/project_sharing_views.xml
@@ -194,6 +194,7 @@
                         </page>
                     </notebook>
                 </sheet>
+                <div class="oe_chatter"/>
             </form>
         </field>
     </record>

From 0c7b99987ac560f8f2bb045394f10a90442c2368 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Tue, 13 Jul 2021 17:50:00 +0200
Subject: [PATCH 11/33] [IMP] project,portal: allow portal user not follow task
 to use chatter

Before this commit, if the portal user is a follower of the project he
can use the chatter of new tasks in the project sharing feature since
the follower of the project is automatically the follower of new tasks.
But if he is not a follower of the task (for instance, old task in the
project) then we have to check if the
access token is the one of the shared project to give the access to
the chatter.

This commit checks the `access_token` of the project when we are in the
project sharing form view to allow the portal user to use the chatter.

task-2379518

closes #73341

Co-authored: Yannick Tivisse (yti) <yti@odoo.com>
---
 addons/portal/static/src/js/portal_chatter.js |   5 +-
 .../portal/static/src/js/portal_composer.js   |  17 +--
 addons/project/controllers/__init__.py        |   1 +
 .../controllers/project_sharing_chatter.py    | 105 ++++++++++++++++++
 .../src/project_sharing/components/chatter.js |  17 +++
 .../project_sharing/components/composer.js    |  17 +++
 .../project_sharing/views/form/renderer.js    |  11 +-
 7 files changed, 162 insertions(+), 11 deletions(-)
 create mode 100644 addons/project/controllers/project_sharing_chatter.py
 create mode 100644 addons/project/static/src/project_sharing/components/chatter.js
 create mode 100644 addons/project/static/src/project_sharing/components/composer.js

diff --git a/addons/portal/static/src/js/portal_chatter.js b/addons/portal/static/src/js/portal_chatter.js
index 962699bc003..c80a5f0de97 100644
--- a/addons/portal/static/src/js/portal_chatter.js
+++ b/addons/portal/static/src/js/portal_chatter.js
@@ -144,6 +144,9 @@ var PortalChatter = publicWidget.Widget.extend({
         this.messageFetch();
         this._reloadComposer();
     },
+    _createComposerWidget: function () {
+        return new portalComposer.PortalComposer(this, this.options);
+    },
     /**
      * Destroy current composer widget and initialize and insert new widget
      *
@@ -154,7 +157,7 @@ var PortalChatter = publicWidget.Widget.extend({
             this._composer.destroy();
         }
         if (this.options.display_composer) {
-            this._composer = new portalComposer.PortalComposer(this, this.options);
+            this._composer = this._createComposerWidget();
             await this._composer.appendTo(this.$('.o_portal_chatter_composer'));
         }
     },
diff --git a/addons/portal/static/src/js/portal_composer.js b/addons/portal/static/src/js/portal_composer.js
index 8d8cabecb28..645210c0116 100644
--- a/addons/portal/static/src/js/portal_composer.js
+++ b/addons/portal/static/src/js/portal_composer.js
@@ -98,6 +98,15 @@ var PortalComposer = publicWidget.Widget.extend({
             self.$sendButton.prop('disabled', false);
         });
     },
+    _prepareAttachmentData: function (file) {
+        return {
+            'name': file.name,
+            'file': file,
+            'res_id': this.options.res_id,
+            'res_model': this.options.res_model,
+            'access_token': this.options.token,
+        };
+    },
     /**
      * @private
      * @returns {Promise}
@@ -109,13 +118,7 @@ var PortalComposer = publicWidget.Widget.extend({
 
         return Promise.all(_.map(this.$fileInput[0].files, function (file) {
             return new Promise(function (resolve, reject) {
-                var data = {
-                    'name': file.name,
-                    'file': file,
-                    'res_id': self.options.res_id,
-                    'res_model': self.options.res_model,
-                    'access_token': self.options.token,
-                };
+                var data = self._prepareAttachmentData(file);
                 ajax.post('/portal/attachment/add', data).then(function (attachment) {
                     attachment.state = 'pending';
                     self.attachments.push(attachment);
diff --git a/addons/project/controllers/__init__.py b/addons/project/controllers/__init__.py
index 903b755e71e..22decb94323 100644
--- a/addons/project/controllers/__init__.py
+++ b/addons/project/controllers/__init__.py
@@ -2,3 +2,4 @@
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
 from . import portal
+from . import project_sharing_chatter
diff --git a/addons/project/controllers/project_sharing_chatter.py b/addons/project/controllers/project_sharing_chatter.py
new file mode 100644
index 00000000000..77f3145e52f
--- /dev/null
+++ b/addons/project/controllers/project_sharing_chatter.py
@@ -0,0 +1,105 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from werkzeug.exceptions import Forbidden
+
+from odoo.http import request, route
+from odoo.tools import consteq
+
+from odoo.addons.portal.controllers.mail import PortalChatter
+
+
+class ProjectSharingChatter(PortalChatter):
+    def _check_project_access_and_get_token(self, project_id, res_model, res_id, token):
+        """ Check if the chatter in project sharing can be accessed
+
+            If the portal user is in the project sharing, then we do not have the access token of the task
+            but we can have the one of the project (if the user accessed to the project sharing views via the shared link).
+            So, we need to check if the chatter is for a task and if the res_id is a task
+            in the project shared. Then, if we had the project token and this one is the one in the project
+            then we return the token of the task to continue the portal chatter process.
+            If we do not have any token, then we need to check if the portal user is a follower of the project shared.
+            If it is the case, then we give the access token of the task.
+        """
+        project_sudo = request.env['project.project'].browse(project_id).sudo()
+        can_access = project_sudo and res_model == 'project.task' and res_id in project_sudo.tasks.ids
+        if token:
+            can_access &= consteq(project_sudo.access_token, token)
+        else:
+            can_access &= request.env.user.partner_id.commercial_partner_id in project_sudo.message_partner_ids
+        task = None
+        if can_access:
+            task = request.env['project.task'].sudo().search([('id', '=', res_id), ('project_id', '=', project_sudo.id)])
+        if not can_access or not task:
+            raise Forbidden()
+        return task[task._mail_post_token_field]
+
+    # ============================================================ #
+    # Note concerning the methods portal_chatter_(init/post/fetch)
+    # ============================================================ #
+    #
+    # When the project is shared to a portal user with the edit rights,
+    # he has the read/write access to the related tasks. So it could be
+    # possible to call directly the message_post method on a task.
+    #
+    # This change is considered as safe, as we only willingly expose
+    # records, for some assumed fields only, and this feature is
+    # optional and opt-in. (like the public employee model for example).
+    # It doesn't allow portal users to access other models, like
+    # a timesheet or an invoice.
+    #
+    # It could seem odd to use those routes, and converting the project
+    # access token into the task access token, as the user has actually
+    # access to the records.
+    #
+    # However, it has been decided that it was the less hacky way to
+    # achieve this, as:
+    #
+    # - We're reusing the existing routes, that convert all the data
+    #   into valid arguments for the methods we use (message_post, ...).
+    #   That way, we don't have to reinvent the wheel, duplicating code
+    #   from mail/portal that surely will lead too desynchronization
+    #   and inconsistencies over the time.
+    #
+    # - We don't define new routes, to do the exact same things than portal,
+    #   considering that the portal user can use message_post for example
+    #   because he has access to the record.
+    #   Let's suppose that we remove this in a future development, those
+    #   new routes won't be valid anymore.
+    #
+    # - We could have reused the mail widgets, as we already reuse the
+    #   form/list/kanban views, etc. However, we only want to display
+    #   the messages and allow to post. We don't need the next activities
+    #   the followers system, etc. This required to override most of the
+    #   mail.thread basic methods, without being sure that this would
+    #   work with other installed applications or customizations
+
+    @route()
+    def portal_chatter_init(self, res_model, res_id, domain=False, limit=False, **kwargs):
+        project_sharing_id = kwargs.get('project_sharing_id')
+        if project_sharing_id:
+            # if there is a token in `kwargs` then it should be the access_token of the project shared
+            token = self._check_project_access_and_get_token(project_sharing_id, res_model, res_id, kwargs.get('token'))
+            if token:
+                del kwargs['project_sharing_id']
+                kwargs['token'] = token
+        return super().portal_chatter_init(res_model, res_id, domain=domain, limit=limit, **kwargs)
+
+    @route()
+    def portal_chatter_post(self, res_model, res_id, message, attachment_ids=None, attachment_tokens=None, **kw):
+        project_sharing_id = kw.get('project_sharing_id')
+        if project_sharing_id:
+            token = self._check_project_access_and_get_token(project_sharing_id, res_model, res_id, kw.get('token'))
+            if token:
+                del kw['project_sharing_id']
+                kw['token'] = token
+        return super().portal_chatter_post(res_model, res_id, message, attachment_ids=attachment_ids, attachment_tokens=attachment_tokens, **kw)
+
+    @route()
+    def portal_message_fetch(self, res_model, res_id, domain=False, limit=10, offset=0, **kw):
+        project_sharing_id = kw.get('project_sharing_id')
+        if project_sharing_id:
+            token = self._check_project_access_and_get_token(project_sharing_id, res_model, res_id, kw.get('token'))
+            if token:
+                kw['token'] = token
+        return super().portal_message_fetch(res_model, res_id, domain=domain, limit=limit, offset=offset, **kw)
diff --git a/addons/project/static/src/project_sharing/components/chatter.js b/addons/project/static/src/project_sharing/components/chatter.js
new file mode 100644
index 00000000000..3f85c37f935
--- /dev/null
+++ b/addons/project/static/src/project_sharing/components/chatter.js
@@ -0,0 +1,17 @@
+/** @odoo-module **/
+
+import { PortalChatter } from 'portal.chatter';
+import Composer from './composer';
+
+export default PortalChatter.extend({
+    _messageFetchPrepareParams() {
+        const data = this._super.apply(this, arguments);
+        if (this.options.project_sharing_id) {
+            data.project_sharing_id = this.options.project_sharing_id;
+        }
+        return data;
+    },
+    _createComposerWidget() {
+        return new Composer(this, this.options);
+    },
+});
diff --git a/addons/project/static/src/project_sharing/components/composer.js b/addons/project/static/src/project_sharing/components/composer.js
new file mode 100644
index 00000000000..a7e75aad119
--- /dev/null
+++ b/addons/project/static/src/project_sharing/components/composer.js
@@ -0,0 +1,17 @@
+/** @odoo-module **/
+
+import { PortalComposer } from 'portal.composer';
+
+export default PortalComposer.extend({
+    _prepareAttachmentData() {
+        const data = this._super.apply(this, arguments);
+        const newData = {};
+        if (this.options.display_composer && typeof this.options.display_composer == 'string') {
+            // then we should have the access_token of the task
+            newData.access_token = this.options.display_composer;
+        } else {
+            newData.project_sharing_id = this.options.project_sharing_id;
+        }
+        return Object.assign(data, newData);
+    },
+});
diff --git a/addons/project/static/src/project_sharing/views/form/renderer.js b/addons/project/static/src/project_sharing/views/form/renderer.js
index 5ef0ddc3470..41105160548 100644
--- a/addons/project/static/src/project_sharing/views/form/renderer.js
+++ b/addons/project/static/src/project_sharing/views/form/renderer.js
@@ -1,16 +1,20 @@
 /** @odoo-module **/
 
 import FormRenderer from 'web.FormRenderer';
-import { PortalChatter } from 'portal.chatter';
+import Chatter from '@project/project_sharing/components/chatter';
+import { session } from '@web/session';
 
 export default FormRenderer.extend({
     _makeChatterContainerComponent() {
         const props = this._makeChatterContainerProps();
-        this._chatterContainerComponent = new PortalChatter(this, props);
+        this._chatterContainerComponent = new Chatter(this, props);
     },
     _makeChatterContainerProps() {
+        // FIXME: perhaps check if we have a parent in the window ?
+        // Call the parent window to get the url displayed in the browser since we are in an iframe
+        const query = new URLSearchParams(window.parent.location.search);
         return {
-            token: '',
+            token: query.get('access_token') || '',
             res_model: 'project.task',
             pid: '',
             hash: '',
@@ -18,6 +22,7 @@ export default FormRenderer.extend({
             pager_step: 10,
             allow_composer: true,
             two_columns: false,
+            project_sharing_id: session.project_id,
         };
     },
     _makeChatterContainerTarget() {

From d3ecc4962ef659aa783264bec2d679b077b37142 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Wed, 14 Jul 2021 10:30:48 +0200
Subject: [PATCH 12/33] [IMP] project: update chatter when create/change task

Before this commit, when the user changes the task, the chatter is not
updated so we keep the messages of the previous task. Same thing when
the portal user wants to create a new task.

This commit updates the chatter to allow to fetch the messages when the
user changes the task and also disables the chatter when the user is
creating a new task.

task-2379518

closes #73341
---
 addons/portal/static/src/js/portal_chatter.js | 54 +++++++++++--------
 .../src/project_sharing/components/chatter.js | 17 ++++++
 .../project_sharing/components/chatter.xml    |  8 +++
 .../project_sharing/views/form/renderer.js    |  3 +-
 4 files changed, 59 insertions(+), 23 deletions(-)
 create mode 100644 addons/project/static/src/project_sharing/components/chatter.xml

diff --git a/addons/portal/static/src/js/portal_chatter.js b/addons/portal/static/src/js/portal_chatter.js
index c80a5f0de97..0f379460d06 100644
--- a/addons/portal/static/src/js/portal_chatter.js
+++ b/addons/portal/static/src/js/portal_chatter.js
@@ -34,27 +34,7 @@ var PortalChatter = publicWidget.Widget.extend({
         this.options = {};
         this._super.apply(this, arguments);
 
-        // underscorize the camelcased option keys
-        _.each(options, function (val, key) {
-            self.options[_.str.underscored(key)] = val;
-        });
-        // set default options
-        this.options = _.defaults(this.options, {
-            'allow_composer': true,
-            'display_composer': false,
-            'csrf_token': odoo.csrf_token,
-            'message_count': 0,
-            'pager_step': 10,
-            'pager_scope': 5,
-            'pager_start': 1,
-            'is_user_public': true,
-            'is_user_employee': false,
-            'is_user_publisher': false,
-            'hash': false,
-            'pid': false,
-            'domain': [],
-            'two_columns': false,
-        });
+        this._setOptions(options);
 
         this.set('messages', []);
         this.set('message_count', this.options['message_count']);
@@ -135,6 +115,38 @@ var PortalChatter = publicWidget.Widget.extend({
     // Private
     //--------------------------------------------------------------------------
 
+    /**
+     * Set options
+     *
+     * @param {Array<string>} options: new options to set
+     */
+    _setOptions: function (options) {
+        // underscorize the camelcased option keys
+        const defaultOptions = {
+            'allow_composer': true,
+            'display_composer': false,
+            'csrf_token': odoo.csrf_token,
+            'message_count': 0,
+            'pager_step': 10,
+            'pager_scope': 5,
+            'pager_start': 1,
+            'is_user_public': true,
+            'is_user_employee': false,
+            'is_user_publisher': false,
+            'hash': false,
+            'pid': false,
+            'domain': [],
+            'two_columns': false,
+        };
+
+        this.options = Object.entries(options).reduce(
+            (acc, [key, value]) => {
+                acc[_.str.underscored(key)] = value;
+                return acc;
+            },
+            defaultOptions);
+    },
+
     /**
      * Reloads chatter and message count after posting message
      *
diff --git a/addons/project/static/src/project_sharing/components/chatter.js b/addons/project/static/src/project_sharing/components/chatter.js
index 3f85c37f935..e1ad0d48a25 100644
--- a/addons/project/static/src/project_sharing/components/chatter.js
+++ b/addons/project/static/src/project_sharing/components/chatter.js
@@ -4,6 +4,19 @@ import { PortalChatter } from 'portal.chatter';
 import Composer from './composer';
 
 export default PortalChatter.extend({
+    messageFetch(domain) {
+        if (!this.options.res_id) {
+            return Promise.resolve();
+        }
+        return this._super.apply(this, arguments);
+    },
+    _chatterInit() {
+        if (!this.options.res_id) {
+            this.result = { messages: [] };
+            return Promise.resolve();
+        }
+        return this._super.apply(this, arguments);
+    },
     _messageFetchPrepareParams() {
         const data = this._super.apply(this, arguments);
         if (this.options.project_sharing_id) {
@@ -14,4 +27,8 @@ export default PortalChatter.extend({
     _createComposerWidget() {
         return new Composer(this, this.options);
     },
+    update(props) {
+        this._setOptions(props);
+        this._reloadChatterContent();
+    },
 });
diff --git a/addons/project/static/src/project_sharing/components/chatter.xml b/addons/project/static/src/project_sharing/components/chatter.xml
new file mode 100644
index 00000000000..aca16ce257a
--- /dev/null
+++ b/addons/project/static/src/project_sharing/components/chatter.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<templates id="template" xml:space="preserve">
+    <t t-extend="portal.chatter_messages">
+        <t t-jquery="t[t-as='message']" t-operation="attributes">
+            <attribute name="t-foreach">!!widget.options.res_id &amp;&amp; widget.get('messages') || []</attribute>
+        </t>
+    </t>
+</templates>
diff --git a/addons/project/static/src/project_sharing/views/form/renderer.js b/addons/project/static/src/project_sharing/views/form/renderer.js
index 41105160548..1ac113fbd7f 100644
--- a/addons/project/static/src/project_sharing/views/form/renderer.js
+++ b/addons/project/static/src/project_sharing/views/form/renderer.js
@@ -20,7 +20,7 @@ export default FormRenderer.extend({
             hash: '',
             res_id: this.state.res_id,
             pager_step: 10,
-            allow_composer: true,
+            allow_composer: !!this.state.res_id,
             two_columns: false,
             project_sharing_id: session.project_id,
         };
@@ -33,5 +33,4 @@ export default FormRenderer.extend({
     _mountChatterContainerComponent() {
         this._chatterContainerComponent.appendTo(this._chatterContainerTarget);
     },
-    _updateChatterContainerComponent() {},
 });

From a8af1361e58a9d161a9b38d21ec6a1da0d162763 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Thu, 29 Jul 2021 13:13:06 +0200
Subject: [PATCH 13/33] [IMP] project: limit access to portal user in project
 sharing

Before this commit, the portal user can read all fields in the
`project.task` model.

This commit checks when the portal user wants to read task record(s) if
this user can see all fields given in parameters. When the portal user
edits or creates a task, we check if this user can edit fields and
create/edit the task based on his access rights and the ir.rules.

task-2379518

closes #73341

Co-Authored-by: Yannick Tivisse (yti) <yti@odoo.com>
---
 addons/project/models/project.py | 61 ++++++++++++++++++++++++++++++--
 1 file changed, 59 insertions(+), 2 deletions(-)

diff --git a/addons/project/models/project.py b/addons/project/models/project.py
index c426a259344..6701e7a1860 100644
--- a/addons/project/models/project.py
+++ b/addons/project/models/project.py
@@ -8,7 +8,7 @@ from datetime import timedelta, datetime
 from random import randint
 
 from odoo import api, fields, models, tools, SUPERUSER_ID, _
-from odoo.exceptions import UserError, ValidationError
+from odoo.exceptions import UserError, ValidationError, AccessError
 from odoo.osv.expression import OR
 
 from .project_task_recurrence import DAYS, WEEKS
@@ -1281,10 +1281,38 @@ class Task(models.Model):
 
         return vals
 
+    def _ensure_fields_are_accessible(self, fields, operation='read', check_group_user=True):
+        """" ensure all fields are accessible by the current user
+
+            This method checks if the portal user can access to all fields given in parameter.
+            By default, it checks if the current user is a portal user and then checks if all fields are accessible for this user.
+
+            :param fields: list of fields to check if the current user can access.
+            :param operation: contains either 'read' to check readable fields or 'write' to check writable fields.
+            :param check_group_user: contains boolean value.
+                - True, if the method has to check if the current user is a portal one.
+                - False if we are sure the user is a portal user,
+        """
+        assert operation in ('read', 'write'), 'Invalid operation'
+        if fields and (not check_group_user or self.env.user.has_group('base.group_portal')) and not self.env.su:
+            unauthorized_fields = set(fields) - (self.SELF_READABLE_FIELDS if operation == 'read' else self.SELF_WRITABLE_FIELDS)
+            if unauthorized_fields:
+                raise AccessError(_('You cannot %s %s fields in task.', operation if operation == 'read' else '%s on' % operation, ', '.join(unauthorized_fields)))
+
+    def read(self, fields=None, load='_classic_read'):
+        self._ensure_fields_are_accessible(fields)
+        return super(Task, self).read(fields=fields, load=load)
+
     @api.model_create_multi
     def create(self, vals_list):
+        is_portal_user = self.env.user.has_group('base.group_portal')
+        if is_portal_user:
+            self.check_access_rights('create')
         default_stage = dict()
         for vals in vals_list:
+            if is_portal_user:
+                self._ensure_fields_are_accessible(vals.keys(), operation='write', check_group_user=False)
+
             project_id = vals.get('project_id') or self.env.context.get('default_project_id')
             if not vals.get('parent_id'):
                 # 1) We must initialize display_project_id to follow project_id if there is no parent_id
@@ -1316,13 +1344,36 @@ class Task(models.Model):
                 rec_values['next_recurrence_date'] = fields.Datetime.today()
                 recurrence = self.env['project.task.recurrence'].create(rec_values)
                 vals['recurrence_id'] = recurrence.id
-        tasks = super().create(vals_list)
+        # The sudo is required for a portal user as the record creation
+        # requires the read access on other models, as mail.template
+        # in order to compute the field tracking
+        if is_portal_user:
+            ctx = {
+                key: value for key, value in self.env.context.items()
+                if key == 'default_project_id' \
+                    or not key.startswith('default_') \
+                    or key[8:] in self.SELF_WRITABLE_FIELDS
+            }
+            self = self.with_context(ctx).sudo()
+        tasks = super(Task, self).create(vals_list)
+        if is_portal_user:
+            # since we use sudo to create tasks, we need to check
+            # if the portal user could really create the tasks based on the ir rule.
+            tasks.with_user(self.env.user).check_access_rule('create')
         for task in tasks:
             if task.project_id.privacy_visibility == 'portal':
                 task._portal_ensure_token()
         return tasks
 
     def write(self, vals):
+        portal_can_write = False
+        if self.env.user.has_group('base.group_portal') and not self.env.su:
+            # Check if all fields in vals are in SELF_WRITABLE_FIELDS
+            self._ensure_fields_are_accessible(vals.keys(), operation='write', check_group_user=False)
+            self.check_access_rights('write')
+            self.check_access_rule('write')
+            portal_can_write = True
+
         now = fields.Datetime.now()
         if 'parent_id' in vals and vals['parent_id'] in self.ids:
             raise UserError(_("Sorry. You can't set a task as its parent task."))
@@ -1366,6 +1417,12 @@ class Task(models.Model):
                 recurrence_domain = [('recurrence_id', 'in', self.recurrence_id.ids)]
             tasks |= self.env['project.task'].search(recurrence_domain)
 
+        # The sudo is required for a portal user as the record update
+        # requires the write access on others models, as rating.rating
+        # in order to keep the same name than the task.
+        if portal_can_write:
+            tasks = tasks.sudo()
+
         result = super(Task, tasks).write(vals)
         # rating on stage
         if 'stage_id' in vals and vals.get('stage_id'):

From bad706d34c0e84024cbea897be065a7d67a99998 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Tue, 3 Aug 2021 14:08:28 +0200
Subject: [PATCH 14/33] [IMP] project: check if the chatter is visible before
 mounting it

Before this commit, if we put an invisible in attrs of div tag for the
chatter, the attrs is not taken into account because when the chatter
is mounting this div is replaced.

This commit changes the class for the chatter in project sharing and
check if the div is visible before mounting the chatter.

task-2379518

closes #73341
---
 .../src/project_sharing/views/form/renderer.js | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/addons/project/static/src/project_sharing/views/form/renderer.js b/addons/project/static/src/project_sharing/views/form/renderer.js
index 1ac113fbd7f..f4acf457a66 100644
--- a/addons/project/static/src/project_sharing/views/form/renderer.js
+++ b/addons/project/static/src/project_sharing/views/form/renderer.js
@@ -33,4 +33,22 @@ export default FormRenderer.extend({
     _mountChatterContainerComponent() {
         this._chatterContainerComponent.appendTo(this._chatterContainerTarget);
     },
+    _renderNode(node) {
+        if (node.tag === 'div' && node.attrs.class === 'oe_project_sharing_chatter') {
+            let isVisible = true;
+            if (node.attrs.modifiers && node.attrs.modifiers.invisible) {
+                const record = this._getRecord(this.state.id);
+                if (record) {
+                    isVisible = !record.evalModifiers(node.attrs.modifiers).invisible;
+                }
+            }
+            if (isVisible) {
+                if (this._isFromFormViewDialog) {
+                    return $('<div/>');
+                }
+                return this._makeChatterContainerTarget();
+            }
+        }
+        return this._super(...arguments);
+    },
 });

From 716f47d14bf1838703b73d9181327092b67e7a08 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Tue, 3 Aug 2021 17:59:27 +0200
Subject: [PATCH 15/33] [IMP] project: give create/write access right to portal
 user

Before this commit, the portal users can only see the tasks in the
project sharing views.

This commit allows these users can also create tasks and edit some
fields in task.

task-2379518

closes #73341
---
 addons/project/security/ir.model.access.csv | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/project/security/ir.model.access.csv b/addons/project/security/ir.model.access.csv
index ae03a42a613..7ad3b2bda89 100644
--- a/addons/project/security/ir.model.access.csv
+++ b/addons/project/security/ir.model.access.csv
@@ -11,7 +11,7 @@ access_project_task,project.task,model_project_task,project.group_project_user,1
 access_report_project_task_user,report.project.task.user,model_report_project_task_user,project.group_project_manager,1,1,1,1
 access_partner_task_user,base.res.partner user,base.model_res_partner,project.group_project_user,1,0,0,0
 access_task_on_partner,project.task on partners,model_project_task,base.group_user,1,0,0,0
-access_task_portal,task_portal,project.model_project_task,base.group_portal,1,0,0,0
+access_task_portal,task_portal,project.model_project_task,base.group_portal,1,1,1,0
 access_project_user,project.project on partners,model_project_project,base.group_user,1,0,0,0
 access_project_portal,project_portal,project.model_project_project,base.group_portal,1,0,0,0
 access_resource_calendar,project.resource_calendar user,resource.model_resource_calendar,project.group_project_user,1,0,0,0

From 5ea5ddafea936ac53b2dd7b098c1da644c5bc577 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Tue, 3 Aug 2021 18:04:53 +0200
Subject: [PATCH 16/33] [IMP] project: select access rights in project sharing

Before this commit, when the portal user can access to project sharing
views, he can just read. If we just add ir.rule to allow the edition,
the portal could create/edit. We have to allow the project manager to
define the access rights of portal users when he want to share them a
project with the project sharing feature.

This commit adds 3 access modes portal users in project sharing views.
1. **Readonly**: the portal can only see the tasks in the different views.
2. **Comment**: the portal can use the chatter in task form view.
3. **Edit**: the portal user can create and edit tasks.

task-2379518

closes #73341

Co-Authored-by: Yannick Tivisse (yti) <yti@odoo.com>
---
 addons/project/__manifest__.py                |  1 +
 addons/project/controllers/portal.py          |  4 +-
 addons/project/models/__init__.py             |  1 +
 addons/project/models/project.py              | 59 ++++++++++++--
 .../project/models/project_sharing_access.py  | 24 ++++++
 addons/project/security/ir.model.access.csv   |  4 +
 addons/project/security/project_security.xml  | 38 +++++++--
 .../src/project_sharing/project_sharing.js    |  4 +-
 .../project/views/project_sharing_views.xml   |  7 +-
 addons/project/views/project_views.xml        |  4 +-
 addons/project/wizard/__init__.py             |  1 +
 addons/project/wizard/project_share_wizard.py | 78 +++++++++++++++++++
 .../wizard/project_share_wizard_views.xml     | 47 +++++++++++
 13 files changed, 252 insertions(+), 20 deletions(-)
 create mode 100644 addons/project/models/project_sharing_access.py
 create mode 100644 addons/project/wizard/project_share_wizard.py
 create mode 100644 addons/project/wizard/project_share_wizard_views.xml

diff --git a/addons/project/__manifest__.py b/addons/project/__manifest__.py
index 869f59caee8..bde65068b5d 100644
--- a/addons/project/__manifest__.py
+++ b/addons/project/__manifest__.py
@@ -32,6 +32,7 @@
         'views/project_update_views.xml',
         'views/project_update_templates.xml',
         'views/project_project_stage_views.xml',
+        'wizard/project_share_wizard_views.xml',
         'views/project_views.xml',
         'views/res_partner_views.xml',
         'views/res_config_settings_views.xml',
diff --git a/addons/project/controllers/portal.py b/addons/project/controllers/portal.py
index 7fdebe216a3..e7a3f3dfd53 100644
--- a/addons/project/controllers/portal.py
+++ b/addons/project/controllers/portal.py
@@ -104,8 +104,7 @@ class ProjectCustomerPortal(CustomerPortal):
     @http.route("/embed/project/<int:project_id>", type="http", auth="user", methods=['GET'])
     def render_project_backend_view(self, project_id):
         project = request.env['project.project'].sudo().browse(project_id)
-
-        if not project.exists():
+        if not project.exists() or not project.with_user(request.env.user)._check_project_sharing_access():
             return request.not_found()
 
         session_info = request.env['ir.http'].session_info()
@@ -124,6 +123,7 @@ class ProjectCustomerPortal(CustomerPortal):
             cache_hashes=cache_hashes,
             action_name='project.project_sharing_project_task_action',
             project_id=project.id,
+            can_edit=project.user_can_edit,
             user_companies={
                 'current_company': project_company.id,
                 'allowed_companies': {
diff --git a/addons/project/models/__init__.py b/addons/project/models/__init__.py
index 2fe4f0e7823..dae83cffa9e 100644
--- a/addons/project/models/__init__.py
+++ b/addons/project/models/__init__.py
@@ -6,6 +6,7 @@ from . import project_milestone
 from . import project_project_stage
 from . import project_task_recurrence
 from . import project
+from . import project_sharing_access
 from . import project_update
 from . import res_config_settings
 from . import res_partner
diff --git a/addons/project/models/project.py b/addons/project/models/project.py
index 6701e7a1860..781c0629466 100644
--- a/addons/project/models/project.py
+++ b/addons/project/models/project.py
@@ -9,10 +9,11 @@ from random import randint
 
 from odoo import api, fields, models, tools, SUPERUSER_ID, _
 from odoo.exceptions import UserError, ValidationError, AccessError
-from odoo.osv.expression import OR
+from odoo.osv import expression
 
 from .project_task_recurrence import DAYS, WEEKS
 from .project_update import STATUS_COLOR
+from .project_sharing_access import PROJECT_SHARING_ACCESS_MODE
 
 
 PROJECT_TASK_READABLE_FIELDS = {
@@ -37,6 +38,7 @@ PROJECT_TASK_READABLE_FIELDS = {
     'displayed_image_id',
     'display_name',
     'priority',
+    'project_sharing_access_mode',
 }
 
 PROJECT_TASK_WRITABLE_FIELDS = {
@@ -280,6 +282,9 @@ class Project(models.Model):
     allow_task_dependencies = fields.Boolean('Task Dependencies', default=lambda self: self.env.user.has_group('project.group_project_task_dependencies'))
     tag_ids = fields.Many2many('project.tags', relation='project_project_project_tags_rel', string='Tags')
 
+    # Project Sharing fields
+    project_sharing_access_ids = fields.One2many('project.sharing.access', 'project_id', 'Project Sharing Access', copy=False)
+
     # rating fields
     rating_request_deadline = fields.Datetime(compute='_compute_rating_request_deadline', store=True)
     rating_active = fields.Boolean('Customer Ratings', default=lambda self: self.env.user.has_group('project.group_project_rating'))
@@ -695,6 +700,25 @@ class Project(models.Model):
             })
             project.write({'analytic_account_id': analytic_account.id})
 
+    def _check_project_sharing_access(self, access_mode='read'):
+        self.ensure_one()
+        if access_mode not in map(lambda access: access[0], PROJECT_SHARING_ACCESS_MODE):
+            raise ValidationError('The %s does not exists in project sharing accesses.' % access_mode)
+        if self.privacy_visibility != 'portal' or self.env.user._is_public():
+            return False
+        if self.env.user.has_group('base.group_portal'):
+            # check in project sharing access model of the project
+            project_sharing_access = self.project_sharing_access_ids.filtered(lambda access: access.user_id == self.env.user)
+            if not project_sharing_access:
+                return False
+            if access_mode == 'edit':
+                return project_sharing_access.access_mode == 'edit'
+            elif access_mode == 'comment':
+                return project_sharing_access.access_mode in ('comment', 'edit')
+            else:
+                return True
+        return self.env.user.has_group('base.group_user')
+
     # ---------------------------------------------------
     # Rating business
     # ---------------------------------------------------
@@ -856,6 +880,9 @@ class Task(models.Model):
     allow_task_dependencies = fields.Boolean(related='project_id.allow_task_dependencies')
     depend_on_ids = fields.Many2many('project.task', relation="task_dependencies_rel", column1="task_id", column2="depends_on_id", string="Blocked By", domain="[('allow_task_dependencies', '=', True), ('id', '!=', id)]")
 
+    # Project Sharing fields
+    project_sharing_access_mode = fields.Selection(PROJECT_SHARING_ACCESS_MODE, compute='_compute_project_sharing_access_mode')
+
     # recurrence fields
     allow_recurring_tasks = fields.Boolean(related='project_id.allow_recurring_tasks')
     recurring_task = fields.Boolean(string="Recurrent")
@@ -1162,6 +1189,26 @@ class Task(models.Model):
             else:
                 task.stage_id = False
 
+    @api.depends_context('uid')
+    @api.depends('project_id.project_sharing_access_ids', 'project_id.privacy_visibility')
+    def _compute_project_sharing_access_mode(self):
+        if self.env.user._is_public():
+            self.project_sharing_access_mode = False
+            return
+        portal_user = self.user_has_groups('base.group_portal')
+        project_sharings = self.project_id.filtered(lambda project: project.privacy_visibility == 'portal')
+        if portal_user:
+            project_sharing_access_read = self.env['project.sharing.access'].search_read(
+                [('user_id', '=', self.env.user.id), ('project_id', 'in', project_sharings.ids)],
+                ['project_id', 'access_mode']
+            )
+            project_sharing_access_dict = {res['project_id'][0]: res['access_mode'] for res in project_sharing_access_read}
+        for task in self:
+            if not portal_user:
+                task.project_sharing_access_mode = task.project_id in project_sharings and 'edit'
+                continue
+            task.project_sharing_access_mode = project_sharing_access_dict.get(task.project_id.id, False)
+
     @api.constrains('recurring_task')
     def _check_recurring_task(self):
         if self.filtered(lambda task: task.parent_id and task.recurring_task):
@@ -1241,10 +1288,10 @@ class Task(models.Model):
         readable_fields = self.SELF_READABLE_FIELDS
         public_fields = {field_name: description for field_name, description in fields.items() if field_name in readable_fields}
 
-            writable_fields = self.SELF_WRITABLE_FIELDS
-            for field_name, description in public_fields.items():
-                if field_name not in writable_fields and not description.get('readonly', False):
-                    # If the field is not in Writable fields and it is not readonly then we force the readonly to True
+        writable_fields = self.SELF_WRITABLE_FIELDS
+        for field_name, description in public_fields.items():
+            if field_name not in writable_fields and not description.get('readonly', False):
+                # If the field is not in Writable fields and it is not readonly then we force the readonly to True
                 description['readonly'] = True
 
         return public_fields
@@ -1412,7 +1459,7 @@ class Task(models.Model):
             recurrence_domain = []
             if recurrence_update == 'subsequent':
                 for task in self:
-                    recurrence_domain = OR([recurrence_domain, ['&', ('recurrence_id', '=', task.recurrence_id.id), ('create_date', '>=', task.create_date)]])
+                    recurrence_domain = expression.OR([recurrence_domain, ['&', ('recurrence_id', '=', task.recurrence_id.id), ('create_date', '>=', task.create_date)]])
             else:
                 recurrence_domain = [('recurrence_id', 'in', self.recurrence_id.ids)]
             tasks |= self.env['project.task'].search(recurrence_domain)
diff --git a/addons/project/models/project_sharing_access.py b/addons/project/models/project_sharing_access.py
new file mode 100644
index 00000000000..c164f89681e
--- /dev/null
+++ b/addons/project/models/project_sharing_access.py
@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo import fields, models
+
+
+PROJECT_SHARING_ACCESS_MODE = [
+    ('read', 'Read'),
+    ('comment', 'Comment'),
+    ('edit', 'Edit'),
+]
+
+
+class ProjectSharingAccess(models.Model):
+    _name = 'project.sharing.access'
+    _description = 'Project Sharing Access'
+
+    project_id = fields.Many2one('project.project', 'Project Shared', required=True)
+    user_id = fields.Many2one('res.users', string='Portal Users', domain=lambda self: [('groups_id', 'in', self.env.ref('base.group_portal').id)], required=True)
+    access_mode = fields.Selection(PROJECT_SHARING_ACCESS_MODE, string='Access Mode', required=True)
+
+    _sql_constraints = [
+        ('unique_user', 'UNIQUE(project_id, user_id)', 'A user cannot be selected more than once in the project sharing access. Please remove duplicate(s) and try again.'),
+    ]
diff --git a/addons/project/security/ir.model.access.csv b/addons/project/security/ir.model.access.csv
index 7ad3b2bda89..0f06777ee58 100644
--- a/addons/project/security/ir.model.access.csv
+++ b/addons/project/security/ir.model.access.csv
@@ -36,3 +36,7 @@ access_project_milestone_user,project.milestone.user,model_project_milestone,bas
 access_project_milestone_portal,project.milestone.portal,model_project_milestone,base.group_portal,1,0,0,0
 access_project_milestone_project_user,project.milestone.project.user,model_project_milestone,project.group_project_user,1,0,0,0
 access_project_milestone_project_manager,project.milestone.project.manager,model_project_milestone,project.group_project_manager,1,1,1,1
+access_project_share_project_manager,project.share.wizard.project.manager,model_project_share_wizard,project.group_project_manager,1,1,1,0
+access_project_share_wizard_line_project_manager,project.share.wizard.line.project.manager,model_project_share_wizard_line,project.group_project_manager,1,1,1,0
+access_project_sharing_access_project_manager,project.sharing.access.project.manager,model_project_sharing_access,project.group_project_manager,1,1,1,1
+access_project_sharing_access_project_portal,project.sharing.access.project.portal,model_project_sharing_access,base.group_portal,1,0,0,0
diff --git a/addons/project/security/project_security.xml b/addons/project/security/project_security.xml
index 1f56577fdae..83e748dacd6 100644
--- a/addons/project/security/project_security.xml
+++ b/addons/project/security/project_security.xml
@@ -123,14 +123,33 @@
         <field name="name">Project/Task: portal users: (portal and following project) or (portal and following task)</field>
         <field name="model_id" ref="project.model_project_task"/>
         <field name="domain_force">[
+        ('project_id.privacy_visibility', '=', 'portal'),
         '|',
-            '&amp;',
-                ('project_id.privacy_visibility', '=', 'portal'),
-                ('project_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
-            '&amp;',
-                ('project_id.privacy_visibility', '=', 'portal'),
-                ('message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
+            ('project_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
+            ('message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
         ]</field>
+        <field name="perm_read" eval="True"/>
+        <field name="perm_write" eval="False"/>
+        <field name="perm_create" eval="False"/>
+        <field name="perm_unlink" eval="False"/>
+        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
+    </record>
+
+    <record id="project_task_rule_portal_project_sharing" model="ir.rule">
+        <field name="name">Project/Task: portal users: portal user can edit with project sharing feature</field>
+        <field name="model_id" ref="project.model_project_task"/>
+        <field name="domain_force">[
+            ('project_id.privacy_visibility', '=', 'portal'),
+            '|',
+                ('project_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
+                ('message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
+            ('project_id.project_sharing_access_ids.user_id', 'in', [user.id]),
+            ('project_id.project_sharing_access_ids.access_mode', '=', 'edit'),
+        ]</field>
+        <field name="perm_read" eval="False"/>
+        <field name="perm_write" eval="True"/>
+        <field name="perm_create" eval="True"/>
+        <field name="perm_unlink" eval="False"/>
         <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
     </record>
 
@@ -162,5 +181,12 @@
         <field name="groups" eval="[(4,ref('project.group_project_manager'))]"/>
     </record>
 
+    <record id="project_sharing_access_portal" model="ir.rule">
+        <field name="name">Project Sharing Access: Portal user can read its own access</field>
+        <field name="model_id" ref="project.model_project_sharing_access" />
+        <field name="domain_force">[('user_id', '=', user.id)]</field>
+        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
+    </record>
+
 </data>
 </odoo>
diff --git a/addons/project/static/src/project_sharing/project_sharing.js b/addons/project/static/src/project_sharing/project_sharing.js
index cf1affa05eb..cc59095bdfe 100644
--- a/addons/project/static/src/project_sharing/project_sharing.js
+++ b/addons/project/static/src/project_sharing/project_sharing.js
@@ -56,13 +56,15 @@ export class ProjectSharingWebClient extends Component {
     }
 
     async _showView() {
-        const { action_name, project_id } = session;
+        const { action_name, project_id, can_edit } = session;
         await this.actionService.doAction(
             action_name,
             {
                 clearBreadcrumbs: true,
                 additionalContext: {
                     active_id: project_id,
+                    create: can_edit,
+                    edit: can_edit,
                 }
             }
         );
diff --git a/addons/project/views/project_sharing_views.xml b/addons/project/views/project_sharing_views.xml
index db325793e41..ef0fb958115 100644
--- a/addons/project/views/project_sharing_views.xml
+++ b/addons/project/views/project_sharing_views.xml
@@ -132,7 +132,8 @@
         <field name="arch" type="xml">
             <form string="Project Sharing: Task" class="o_form_project_tasks">
                 <header>
-                    <field name="stage_id" widget="statusbar" options="{'fold_field': 'fold'}" attrs="{'invisible': [('project_id', '=', False), ('stage_id', '=', False)]}" />
+                    <field name="project_sharing_access_mode" invisible="1"/>
+                    <field name="stage_id" widget="statusbar" options="{'clickable': '1', 'fold_field': 'fold'}" attrs="{'invisible': [('project_id', '=', False), ('stage_id', '=', False)], 'readonly': [('project_sharing_access_mode', '!=', 'edit')]}" />
                 </header>
                 <sheet string="Task">
                     <div class="oe_button_box" name="button_box">
@@ -143,7 +144,7 @@
                         <h1 class="d-flex flex-row justify-content-between">
                             <field name="priority" widget="priority" class="mr-3"/>
                             <field name="name" class="o_task_name text-truncate" placeholder="Task Title..."/>
-                            <field name="kanban_state" widget="state_selection" class="ml-auto" readonly="1"/>
+                            <field name="kanban_state" widget="state_selection" class="ml-auto" attrs="{'readonly': [('project_sharing_access_mode', '!=', 'edit')]}"/>
                         </h1>
                     </div>
                     <group>
@@ -194,7 +195,7 @@
                         </page>
                     </notebook>
                 </sheet>
-                <div class="oe_chatter"/>
+                <div class="oe_project_sharing_chatter" attrs="{'invisible': [('project_sharing_access_mode', 'not in', ['comment', 'edit'])]}"/>
             </form>
         </field>
     </record>
diff --git a/addons/project/views/project_views.xml b/addons/project/views/project_views.xml
index 9427a085848..47661621d4e 100644
--- a/addons/project/views/project_views.xml
+++ b/addons/project/views/project_views.xml
@@ -264,7 +264,7 @@
             <field name="arch" type="xml">
                 <form string="Project" delete="0">
                     <header>
-                        <button name="%(portal.portal_share_action)d" string="Share" type="action" class="oe_highlight" groups="project.group_project_manager"
+                        <button name="%(project.project_share_action)d" string="Share" type="action" class="oe_highlight" groups="project.group_project_manager"
                         attrs="{'invisible': [('privacy_visibility', '!=', 'portal')]}"/>
                         <field name="stage_id" widget="statusbar" options="{'clickable': '1', 'fold_field': 'fold'}" groups="project.group_project_stages"/>
                     </header>
@@ -640,7 +640,7 @@
                                                 <ul class="oe_kanban_colorpicker" data-field="color" role="popup"/>
                                             </div>
                                             <div role="menuitem" class="col-4">
-                                                <a t-if="record.privacy_visibility.raw_value == 'portal'" class="dropdown-item" role="menuitem" name="%(portal.portal_share_action)d" type="action">Share</a>
+                                                <a t-if="record.privacy_visibility.raw_value == 'portal'" class="dropdown-item" role="menuitem" name="%(project.project_share_action)d" type="action">Share</a>
                                                 <a class="dropdown-item" role="menuitem" type="edit">Edit</a>
                                             </div>
                                         </div>
diff --git a/addons/project/wizard/__init__.py b/addons/project/wizard/__init__.py
index 063a6b88728..96e583bead0 100644
--- a/addons/project/wizard/__init__.py
+++ b/addons/project/wizard/__init__.py
@@ -3,3 +3,4 @@
 
 from . import project_delete_wizard
 from . import project_task_type_delete
+from . import project_share_wizard
diff --git a/addons/project/wizard/project_share_wizard.py b/addons/project/wizard/project_share_wizard.py
new file mode 100644
index 00000000000..0b54ae1c307
--- /dev/null
+++ b/addons/project/wizard/project_share_wizard.py
@@ -0,0 +1,78 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo import api, Command, fields, models, _
+from odoo.exceptions import ValidationError, UserError
+
+from ..models.project_sharing_access import PROJECT_SHARING_ACCESS_MODE
+
+
+class ProjectShareWizard(models.TransientModel):
+    _name = 'project.share.wizard'
+    _inherit = 'portal.share'
+    _description = 'Project Share'
+
+    @api.model
+    def default_get(self, fields_list):
+        result = super().default_get(fields_list)
+        if result['res_model'] and result['res_id']:
+            project = self.env[result['res_model']].browse(result['res_id'])
+            result.update(
+                line_ids=[
+                    Command.create(
+                        {'user_id': access.user_id, 'access_mode': access.access_mode}
+                    ) for access in project.project_sharing_access_ids
+                ],
+            )
+        return result
+
+    partner_ids = fields.Many2many(compute="_compute_partner_ids", readonly=False, store=True, required=False)
+    line_ids = fields.One2many('project.share.wizard.line', 'project_share_id')
+
+    @api.depends('line_ids.user_id')
+    def _compute_partner_ids(self):
+        for project_share_wizard in self:
+            project_share_wizard.partner_ids |= project_share_wizard.line_ids.user_id.partner_id
+
+    def action_send_mail_and_confirm_access(self):
+        if not self.partner_ids:
+            raise UserError(_('Impossible to send email, no recipients are mentionned.'))
+        self.action_confirm_access()
+        return self.action_send_mail()
+
+    def action_confirm_access(self):
+        project = self.env[self.res_model].browse(self.res_id)
+        if not project or not project.exists():
+            raise ValidationError(_('Impossible to confirm the project sharing access, the project is not found or project sharing is disabled for this project.'))
+        project_sharing_access_dict = {access.user_id.id: access for access in project.project_sharing_access_ids}
+        project_sharing_access_vals_list = [
+            Command.delete(access.id)
+            for user_id, access in project_sharing_access_dict.items()
+            if user_id not in self.line_ids.user_id.ids
+        ]
+        for share_access in self.line_ids:
+            project_sharing_access = project_sharing_access_dict.get(share_access.user_id.id)
+            if not project_sharing_access:
+                project_sharing_access_vals_list.append(
+                    Command.create(
+                        {'user_id': share_access.user_id.id, 'access_mode': share_access.access_mode}
+                    )
+                )
+            elif project_sharing_access.access_mode != share_access.access_mode:
+                project_sharing_access_vals_list.append(Command.update(project_sharing_access.id, {'access_mode': share_access.access_mode}))
+        project.write({'project_sharing_access_ids': project_sharing_access_vals_list})
+        project.message_subscribe(self.line_ids.user_id.partner_id.ids)
+        return {'type': 'ir.actions.act_window_close'}
+
+
+class ProjectShareAccessWizard(models.TransientModel):
+    _name = 'project.share.wizard.line'
+    _description = 'Project Share Access'
+
+    project_share_id = fields.Many2one('project.share.wizard', required=True, ondelete='cascade')
+    user_id = fields.Many2one('res.users', string='Portal Users', domain=lambda self: [('groups_id', 'in', self.env.ref('base.group_portal').id)], required=True)
+    access_mode = fields.Selection(PROJECT_SHARING_ACCESS_MODE, string='Access Mode', required=True)
+
+    _sql_constraints = [
+        ('uniqueness_user', 'UNIQUE(project_share_id, user_id)', 'An user cannot be selected more than once in the project sharing access. Please remove duplicate(s) and try again.'),
+    ]
diff --git a/addons/project/wizard/project_share_wizard_views.xml b/addons/project/wizard/project_share_wizard_views.xml
new file mode 100644
index 00000000000..b3a6882ab94
--- /dev/null
+++ b/addons/project/wizard/project_share_wizard_views.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+
+    <record id="project_share_wizard" model="ir.ui.view">
+        <field name="name">project.share.wizard</field>
+        <field name="model">project.share.wizard</field>
+        <field name="arch" type="xml">
+            <form string="Share Document">
+                <p class="alert alert-warning" attrs="{'invisible': [('access_warning', '=', '')]}" role="alert"><field name="access_warning"/></p>
+                <group name="share_link">
+                    <field name="res_model" invisible="1"/>
+                    <field name="res_id" invisible="1"/>
+                    <field name="share_link" widget="CopyClipboardChar" options="{'string': 'Copy Link'}"/>
+                </group>
+                <group>
+                    <field name="partner_ids" widget="many2many_tags_email" placeholder="Add contacts to share the document..."/>
+                </group>
+                <group>
+                    <field name="note" placeholder="Add a note"/>
+                </group>
+                <group>
+                    <field name="line_ids" nolabel="1">
+                        <tree create="1" edit="1" delete="1" editable="bottom">
+                            <field name="user_id" />
+                            <field name="access_mode" />
+                        </tree>
+                    </field>
+                </group>
+                <footer>
+                    <button string="Confirm Access" name="action_confirm_access" attrs="{'invisible': ['|', ('access_warning', '!=', ''), ('line_ids', '=', [])]}" type="object" class="btn-primary" data-hotkey="v"/>
+                    <button string="Send" name="action_send_mail" attrs="{'invisible': ['|', ('access_warning', '!=', ''), ('line_ids', '!=', [])]}" type="object" class="btn-primary" data-hotkey="q"/>
+                    <button string="Send &amp; Confirm" name="action_send_mail_and_confirm_access" attrs="{'invisible': ['|', ('access_warning', '!=', ''), ('line_ids', '=', [])]}" type="object" class="btn-primary" data-hotkey="q"/>
+                    <button string="Cancel" class="btn-default" special="cancel" data-hotkey="z" />
+                </footer>
+            </form>
+        </field>
+    </record>
+
+    <record id="project_share_action" model="ir.actions.act_window">
+        <field name="name">Share Project</field>
+        <field name="res_model">project.share.wizard</field>
+        <field name="binding_model_id" ref="model_project_share_wizard"/>
+        <field name="view_mode">form</field>
+        <field name="target">new</field>
+    </record>
+
+</odoo>

From 4c5edbd0fcd74eb3fedfe888663f2ac3409a4548 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Wed, 4 Aug 2021 08:59:50 +0200
Subject: [PATCH 17/33] [IMP] hr_timesheet: add read access to timesheets for
 portal users

Before this commit, the portal could not access to timesheets of the
task in project sharing views.

This commit adds the access to give him the read access to the
timesheets in the tasks of the shared project.
Moreover, this commit adds a `ir.rule` to limit the access to this
portal user and we keep the default values to True on all perms,
that way if someone modifies the ACL to give C/W/U permissions,
this rule will still give some protection.

task-2379518

closes #73341

Co-authored: Yannick Tivisse (yti) <yti@odoo.com>
---
 .../security/hr_timesheet_security.xml         | 18 ++++++++++++++++++
 .../hr_timesheet/security/ir.model.access.csv  |  1 +
 2 files changed, 19 insertions(+)

diff --git a/addons/hr_timesheet/security/hr_timesheet_security.xml b/addons/hr_timesheet/security/hr_timesheet_security.xml
index d4fd4902c46..2b20fc60087 100644
--- a/addons/hr_timesheet/security/hr_timesheet_security.xml
+++ b/addons/hr_timesheet/security/hr_timesheet_security.xml
@@ -30,6 +30,24 @@
             <field name="groups_id" eval="[(4,ref('group_timesheet_manager'))]"/>
         </record>
 
+        <record id="timesheet_line_rule_portal_user" model="ir.rule">
+            <field name="name">account.analytic.line.timesheet.portal.user</field>
+            <field name="model_id" ref="analytic.model_account_analytic_line"/>
+            <field name="domain_force">[
+                ('project_id', '!=', False),
+                '|',
+                    ('project_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
+                    ('task_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
+                ('project_id.privacy_visibility', '=', 'portal'),
+                ('project_id.project_sharing_access_ids.user_id', 'in', [user.id]),
+            ]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="True"/>
+            <field name="perm_create" eval="True"/>
+            <field name="perm_unlink" eval="True"/>
+            <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
+        </record>
+
         <record id="timesheet_line_rule_user" model="ir.rule">
             <field name="name">account.analytic.line.timesheet.user</field>
             <field name="model_id" ref="analytic.model_account_analytic_line"/>
diff --git a/addons/hr_timesheet/security/ir.model.access.csv b/addons/hr_timesheet/security/ir.model.access.csv
index db5329a5262..ccddcb13a5d 100644
--- a/addons/hr_timesheet/security/ir.model.access.csv
+++ b/addons/hr_timesheet/security/ir.model.access.csv
@@ -1,4 +1,5 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_account_analytic_line_portal_user,analytic.account.analytic.line.timesheet.portal.user,analytic.model_account_analytic_line,base.group_portal,1,0,0,0
 access_account_analytic_line_user,analytic.account.analytic.line.timesheet.user,analytic.model_account_analytic_line,hr_timesheet.group_hr_timesheet_user,1,1,1,1
 access_account_analytic_user,analytic.account.analytic.timesheet.user,analytic.model_account_analytic_account,hr_timesheet.group_hr_timesheet_user,1,1,0,0
 access_uom_uom_hr_timesheet,uom.uom.timesheet.user,uom.model_uom_uom,hr_timesheet.group_hr_timesheet_user,1,0,0,0

From c0e569dd9040e9712d986fdc9fa8b57cbdb8ca78 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Mon, 23 Aug 2021 09:04:15 +0200
Subject: [PATCH 18/33] [FIX] hr_timesheet: add compute_sudo for
 analytic_account_active compute

Before this commit, the portal user cannot access to the task form view
since he does not have any access to `account.analytic.account` model.

This commit adds `compute_sudo=True` in field definition of
`analytic_account_active` to bypass the access rights in its compute
method.

task-2379518

closes #73341
---
 addons/hr_timesheet/models/project.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/hr_timesheet/models/project.py b/addons/hr_timesheet/models/project.py
index e0d0a09b7df..ca181f12c14 100644
--- a/addons/hr_timesheet/models/project.py
+++ b/addons/hr_timesheet/models/project.py
@@ -183,7 +183,7 @@ class Task(models.Model):
     _name = "project.task"
     _inherit = "project.task"
 
-    analytic_account_active = fields.Boolean("Active Analytic Account", compute='_compute_analytic_account_active')
+    analytic_account_active = fields.Boolean("Active Analytic Account", compute='_compute_analytic_account_active', compute_sudo=True)
     allow_timesheets = fields.Boolean("Allow timesheets", related='project_id.allow_timesheets', help="Timesheets can be logged on this task.", readonly=True)
     remaining_hours = fields.Float("Remaining Hours", compute='_compute_remaining_hours', store=True, readonly=True, help="Total remaining time, can be re-estimated periodically by the assignee of the task.")
     effective_hours = fields.Float("Hours Spent", compute='_compute_effective_hours', compute_sudo=True, store=True, help="Time spent on this task, excluding its sub-tasks.")

From 5fcf6dee6684ec5e844c6c1b5167add724a0b39e Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Mon, 23 Aug 2021 09:06:33 +0200
Subject: [PATCH 19/33] [FIX] hr_timesheet: add sudo to _apply_timesheet_label
 method

Before this commit, the portal user has no access to uom.uom model.
Therefore, this user has an access error when we want to see task form
view.

This commit adds a sudo to use this method to correctly display the
label for the unit_amount of timesheets shown in the task form view.

task-2379518

closes #73341
---
 addons/hr_timesheet/models/project.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/addons/hr_timesheet/models/project.py b/addons/hr_timesheet/models/project.py
index ca181f12c14..3f0e5b51e8b 100644
--- a/addons/hr_timesheet/models/project.py
+++ b/addons/hr_timesheet/models/project.py
@@ -299,7 +299,8 @@ class Task(models.Model):
     def _fields_view_get(self, view_id=None, view_type='form', toolbar=False, submenu=False):
         """ Set the correct label for `unit_amount`, depending on company UoM """
         result = super(Task, self)._fields_view_get(view_id=view_id, view_type=view_type, toolbar=toolbar, submenu=submenu)
-        result['arch'] = self.env['account.analytic.line']._apply_timesheet_label(result['arch'])
+        # Use of sudo as the portal user doesn't have access to uom
+        result['arch'] = self.env['account.analytic.line'].sudo()._apply_timesheet_label(result['arch'])
 
         if view_type in ['tree', 'pivot', 'graph'] and self.env.company.timesheet_encode_uom_id == self.env.ref('uom.product_uom_day'):
             result['arch'] = self.env['account.analytic.line']._apply_time_label(result['arch'], related_model=self._name)

From a60aaa391075e04626457c2f0b3b9cb7315da91f Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Thu, 5 Aug 2021 15:38:37 +0200
Subject: [PATCH 20/33] [IMP] project: use project sharings in portal route

Before this commit, when the portal user can access to project sharing
and click on the shared link of the project. He is redirected to the
`/project_sharing/<int:project_id>` route. Since only the portal user
can access and no public users, we could directly redirect to the portal
route and display project sharing views.

This commit removes the `/project_sharing/<int:project_id>` route.
The main route will always be the `/my/project/<int:project_id>` and
we check if the user can access project before rendering.

If the user can access to the project via the shared link:

1. If he is a public user then we render the classic portal view.
2. If he is a portal user then
    - we check if he is an access to project sharing, if yes then we
      render project sharing views otherwise we display the classic
      portal views.

task-2379518

closes #73341
---
 addons/project/controllers/portal.py          | 22 +++++--------------
 .../views/project_sharing_templates.xml       |  2 +-
 2 files changed, 7 insertions(+), 17 deletions(-)

diff --git a/addons/project/controllers/portal.py b/addons/project/controllers/portal.py
index e7a3f3dfd53..cd04920d309 100644
--- a/addons/project/controllers/portal.py
+++ b/addons/project/controllers/portal.py
@@ -3,18 +3,18 @@
 
 from collections import OrderedDict
 from operator import itemgetter
-
 from markupsafe import Markup
 
 from odoo import conf, http, _
 from odoo.exceptions import AccessError, MissingError
 from odoo.http import request
-from odoo.addons.web.controllers.main import HomeStaticTemplateHelpers
 from odoo.addons.portal.controllers.portal import CustomerPortal, pager as portal_pager
-from odoo.tools import consteq, groupby as groupbyelem
+from odoo.tools import groupby as groupbyelem
 
 from odoo.osv.expression import OR
 
+from odoo.addons.web.controllers.main import HomeStaticTemplateHelpers
+
 
 class ProjectCustomerPortal(CustomerPortal):
 
@@ -86,22 +86,12 @@ class ProjectCustomerPortal(CustomerPortal):
             project_sudo = self._document_check_access('project.project', project_id, access_token)
         except (AccessError, MissingError):
             return request.redirect('/my')
-        if project_sudo.privacy_visibility == 'portal' and not request.env.user._is_public():
+        if project_sudo.with_user(request.env.user)._check_project_sharing_access():
             return request.render("project.project_sharing_portal", {'project_id': project_id})
         values = self._project_get_page_view_values(project_sudo, access_token, **kw)
         return request.render("project.portal_my_project", values)
 
-    @http.route("/project_sharing/<int:project_id>", type='http', auth="user", methods=['GET'])
-    def get_project_sharing(self, project_id, model='project.project', access_token=None):
-        if not model or model != 'project.project' or not access_token:
-            return request.not_found()
-        project = request.env[model].sudo().browse(project_id)
-        project_validation = project and project.exists() and consteq(project.access_token, access_token) and project.privacy_visibility == 'portal'
-        if not project_validation:
-            return request.not_found()
-        return request.render('project.project_sharing', {'project_id': project.id})
-
-    @http.route("/embed/project/<int:project_id>", type="http", auth="user", methods=['GET'])
+    @http.route("/my/project/<int:project_id>/project_sharing", type="http", auth="user", methods=['GET'])
     def render_project_backend_view(self, project_id):
         project = request.env['project.project'].sudo().browse(project_id)
         if not project.exists() or not project.with_user(request.env.user)._check_project_sharing_access():
@@ -123,7 +113,7 @@ class ProjectCustomerPortal(CustomerPortal):
             cache_hashes=cache_hashes,
             action_name='project.project_sharing_project_task_action',
             project_id=project.id,
-            can_edit=project.user_can_edit,
+            can_edit=project._check_project_sharing_access('edit'),
             user_companies={
                 'current_company': project_company.id,
                 'allowed_companies': {
diff --git a/addons/project/views/project_sharing_templates.xml b/addons/project/views/project_sharing_templates.xml
index 3456532c48f..0dcc2e574a5 100644
--- a/addons/project/views/project_sharing_templates.xml
+++ b/addons/project/views/project_sharing_templates.xml
@@ -9,7 +9,7 @@
     </template>
 
     <template id="project_sharing" name="Project Sharing View">
-        <iframe width="100%" height="100%" frameborder="0" t-attf-src="/embed/project/{{ project_id }}"/>
+        <iframe width="100%" height="100%" frameborder="0" t-attf-src="/my/project/{{ project_id }}/project_sharing"/>
     </template>
 
     <template id="project_sharing_embed" name="Project Sharing View Embed">

From 19a8bf95274b401e4a7208d11b64f16e3529a2f5 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Thu, 5 Aug 2021 17:44:53 +0200
Subject: [PATCH 21/33] [IMP] project: check portal user can access to project
 sharing chatter

Before this commit, when we change the access right to the portal user
and this user is in task form view with chatter. He can send message
even we remove the access right.

This commit checks if the user has the access before sending the
message.

task-2379518
---
 addons/project/controllers/project_sharing_chatter.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/addons/project/controllers/project_sharing_chatter.py b/addons/project/controllers/project_sharing_chatter.py
index 77f3145e52f..c29123bb216 100644
--- a/addons/project/controllers/project_sharing_chatter.py
+++ b/addons/project/controllers/project_sharing_chatter.py
@@ -7,6 +7,7 @@ from odoo.http import request, route
 from odoo.tools import consteq
 
 from odoo.addons.portal.controllers.mail import PortalChatter
+from .portal import ProjectCustomerPortal
 
 
 class ProjectSharingChatter(PortalChatter):
@@ -21,8 +22,8 @@ class ProjectSharingChatter(PortalChatter):
             If we do not have any token, then we need to check if the portal user is a follower of the project shared.
             If it is the case, then we give the access token of the task.
         """
-        project_sudo = request.env['project.project'].browse(project_id).sudo()
-        can_access = project_sudo and res_model == 'project.task' and res_id in project_sudo.tasks.ids
+        project_sudo = ProjectCustomerPortal._document_check_access(self, 'project.project', project_id, token)
+        can_access = project_sudo and res_model == 'project.task' and project_sudo.with_user(request.env.user)._check_project_sharing_access('comment')
         if token:
             can_access &= consteq(project_sudo.access_token, token)
         else:

From a55de1e0a1b5330d42102cfa7a48760cd1146bfb Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Wed, 18 Aug 2021 13:45:48 +0200
Subject: [PATCH 22/33] [FIX] sale_timesheet: cannot create task in billable
 project

Before this commit, the portal user cannot create task in billable
project because he has no access rights to employee mappings model.
Indeed, this model is used to know the pricing type of the project and
also to search the default partner of the new task. If the user cannot
access we need to do it in sudo.

This commit adds a sudo to search correctly the default partner of the
task.

task-2379518

closes #73341
---
 addons/sale_timesheet/models/project.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/addons/sale_timesheet/models/project.py b/addons/sale_timesheet/models/project.py
index 2e79e71ab76..9af4cd514b6 100644
--- a/addons/sale_timesheet/models/project.py
+++ b/addons/sale_timesheet/models/project.py
@@ -340,8 +340,10 @@ class ProjectTask(models.Model):
     def _get_default_partner_id(self, project, parent):
         res = super()._get_default_partner_id(project, parent)
         if not res and project:
-            if project.pricing_type == 'employee_rate':
-                return project.sale_line_employee_ids.sale_line_id.order_partner_id[:1]
+            # project in sudo if the current user is a portal user.
+            related_project = project if not self.user_has_groups('!base.group_user,base.group_portal') else project.sudo()
+            if related_project.pricing_type == 'employee_rate':
+                return related_project.sale_line_employee_ids.sale_line_id.order_partner_id[:1]
         return res
 
     sale_order_id = fields.Many2one(domain="['|', '|', ('partner_id', '=', partner_id), ('partner_id', 'child_of', commercial_partner_id), ('partner_id', 'parent_of', partner_id)]")

From 768c63b15ec37cdb0a227c416dd2c419bd8bdc26 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Thu, 19 Aug 2021 14:36:35 +0200
Subject: [PATCH 23/33] [IMP] project: add unit test for project sharing
 feature

task-2379518

closes #73341
---
 addons/project/tests/__init__.py             |   1 +
 addons/project/tests/test_project_sharing.py | 265 +++++++++++++++++++
 2 files changed, 266 insertions(+)
 create mode 100644 addons/project/tests/test_project_sharing.py

diff --git a/addons/project/tests/__init__.py b/addons/project/tests/__init__.py
index 4e9ae83c97b..ee0446182b4 100644
--- a/addons/project/tests/__init__.py
+++ b/addons/project/tests/__init__.py
@@ -6,6 +6,7 @@ from . import test_project_base
 from . import test_project_config
 from . import test_project_flow
 from . import test_project_recurrence
+from . import test_project_sharing
 from . import test_project_subtasks
 from . import test_project_ui
 from . import test_project_update_access_rights
diff --git a/addons/project/tests/test_project_sharing.py b/addons/project/tests/test_project_sharing.py
new file mode 100644
index 00000000000..a39b81b913f
--- /dev/null
+++ b/addons/project/tests/test_project_sharing.py
@@ -0,0 +1,265 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo import Command
+from odoo.exceptions import AccessError
+from odoo.tests.common import Form
+
+from .test_project_base import TestProjectCommon
+
+
+class TestProjectSharingCommon(TestProjectCommon):
+
+    @classmethod
+    def setUpClass(cls):
+        super().setUpClass()
+
+        project_sharing_stages_vals_list = [
+            (0, 0, {'name': 'To Do', 'sequence': 1}),
+            (0, 0, {'name': 'Done', 'sequence': 10}),
+        ]
+        cls.project_cows = cls.env['project.project'].with_context({'mail_create_nolog': True}).create({
+            'name': 'Cows',
+            'privacy_visibility': 'portal',
+            'alias_name': 'project+cows',
+            'type_ids': project_sharing_stages_vals_list,
+        })
+        cls.project_portal = cls.env['project.project'].with_context({'mail_create_nolog': True}).create({
+            'name': 'Portal',
+            'privacy_visibility': 'portal',
+            'alias_name': 'project+portal',
+            'partner_id': cls.user_portal.partner_id.id,
+            'type_ids': project_sharing_stages_vals_list,
+        })
+
+        cls.task_cow = cls.env['project.task'].with_context({'mail_create_nolog': True}).create({
+            'name': 'Cow UserTask',
+            'user_id': cls.user_projectuser.id,
+            'project_id': cls.project_cows.id,
+        })
+        cls.task_portal = cls.env['project.task'].with_context({'mail_create_nolog': True}).create({
+            'name': 'Portal UserTask',
+            'user_id': cls.user_projectuser.id,
+            'project_id': cls.project_portal.id,
+        })
+
+    def get_project_sharing_form_view(self, record, with_user=None):
+        return Form(
+            record.with_user(with_user or self.env.user),
+            view="project.project_sharing_project_task_view_form"
+        )
+
+    def get_project_sharing_access_for_user(self, with_user, project):
+        project_with_user = project.with_user(with_user or self.env.user)
+        return {
+            'read': project_with_user._check_project_sharing_access(),
+            'comment': project_with_user._check_project_sharing_access('comment'),
+            'edit': project_with_user._check_project_sharing_access('edit')
+        }
+
+
+
+class TestProjectSharing(TestProjectSharingCommon):
+
+    def test_project_share_wizard(self):
+        """ Test Project Share Wizard
+
+            Test Cases:
+            ==========
+            1) Create the wizard record
+            2) Check if no access rights are given to a portal user
+            3) Add access rights to a portal user
+        """
+        project_share_wizard = self.env['project.share.wizard'].create({
+            'res_model': 'project.project',
+            'res_id': self.project_portal.id,
+        })
+        self.assertFalse(project_share_wizard.line_ids, 'No access rights should be given to a portal user in this project.')
+        self.assertFalse(self.project_portal.with_user(self.user_portal)._check_project_sharing_access(), 'The portal user should not have accessed in project sharing views.')
+        project_share_wizard.write({'line_ids': [
+            Command.create({
+                'user_id': self.user_portal.id,
+                'access_mode': 'read',
+            }),
+        ]})
+        project_share_wizard.action_confirm_access()
+        self.assertEqual(len(self.project_portal.project_sharing_access_ids), 1, 'The access right added in project share wizard should be added in the project when the user confirm the access in the wizard.')
+        self.assertDictEqual({
+            'user_id': self.project_portal.project_sharing_access_ids.user_id,
+            'access_mode': self.project_portal.project_sharing_access_ids.access_mode,
+            'project_id': self.project_portal.project_sharing_access_ids.project_id,
+        }, {
+            'user_id': self.user_portal,
+            'access_mode': 'read',
+            'project_id': self.project_portal,
+        }, 'The access rights added should be the read access for the portal project for Chell Gladys.')
+        self.assertTrue(self.project_portal._check_project_sharing_access(), 'The portal user should have read access to the portal project with project sharing feature.')
+        self.assertTrue(self.user_portal.partner_id in self.project_portal.message_partner_ids)
+
+    def test_project_sharing_access(self):
+        """ Check the _check_project_sharing_access returns the expected value for all access mode defined in project sharing.
+        """
+        self.assertDictEqual(
+            self.get_project_sharing_access_for_user(self.user_public, self.project_portal),
+            {
+                'read': False,
+                'comment': False,
+                'edit': False,
+            },
+            'The public user should not have any access to project sharing feature of the portal project.'
+        )
+        self.assertDictEqual(
+            self.get_project_sharing_access_for_user(self.user_projectuser, self.project_portal),
+            {
+                'read': True,
+                'comment': True,
+                'edit': True,
+            },
+            'The internal user should have all accesses to project sharing feature of the portal project.'
+        )
+        self.assertDictEqual(
+            self.get_project_sharing_access_for_user(self.user_portal, self.project_portal),
+            {
+                'read': False,
+                'comment': False,
+                'edit': False,
+            },
+            'The portal user should not have any access to project sharing feature of the portal project.'
+        )
+        self.project_portal.write({
+            'project_sharing_access_ids': [Command.create({
+                'user_id': self.user_portal.id,
+                'access_mode': 'read',
+            })],
+        })
+        project_sharing_access = self.project_portal.project_sharing_access_ids
+        self.assertDictEqual(
+            self.get_project_sharing_access_for_user(self.user_portal, self.project_portal),
+            {
+                'read': True,
+                'comment': False,
+                'edit': False,
+            },
+            'The portal user should have only the read access to project sharing feature of the portal project.'
+        )
+        project_sharing_access.write({'access_mode': 'comment'})
+        self.assertDictEqual(
+            self.get_project_sharing_access_for_user(self.user_portal, self.project_portal),
+            {
+                'read': True,
+                'comment': True,
+                'edit': False,
+            },
+            'The portal user should can read and comment the tasks of the portal project in project sharing views.'
+        )
+        project_sharing_access.write({'access_mode': 'edit'})
+        self.assertDictEqual(
+            self.get_project_sharing_access_for_user(self.user_portal, self.project_portal),
+            {
+                'read': True,
+                'comment': True,
+                'edit': True,
+            },
+            'The portal user should can read, comment and edit the tasks of the portal project in project sharing views.'
+        )
+
+    def test_create_task_in_project_sharing(self):
+        """ Test when portal user creates a task in project sharing views.
+
+            Test Cases:
+            ==========
+            1) Give the 'read' access mode to a portal user in a project and try to create task with this user.
+            2) Give the 'comment' access mode to a portal user in a project and try to create task with this user.
+            3) Give the 'edit' access mode to a portal user in a project and try to create task with this user.
+            3.1) Try to change the project of the new task with this user.
+        """
+        # 1) Give the 'read' access mode to a portal user in a project and try to create task with this user.
+        self.project_portal.write({
+            'project_sharing_access_ids': [
+                Command.create({
+                    'user_id': self.user_portal.id,
+                    'access_mode': 'read',
+                }),
+            ],
+        })
+        with self.assertRaises(AccessError, msg="Should not accept the portal user create a task in the project when he has not the edit access right."):
+            with self.get_project_sharing_form_view(self.env['project.task'].with_context({'tracking_disable': True, 'default_project_id': self.project_portal.id}), self.user_portal) as form:
+                form.name = 'Test'
+                task = form.save()
+
+        # 2) Give the 'comment' access mode to a portal user in a project and try to create task with this user.
+        project_sharing_access = self.project_portal.project_sharing_access_ids
+        project_sharing_access.write({'access_mode': 'comment'})
+        with self.assertRaises(AccessError, msg="Should not accept the portal user create a task in the project when he has not the edit access right."):
+            with self.get_project_sharing_form_view(self.env['project.task'].with_context({'tracking_disable': True, 'default_project_id': self.project_portal.id}), self.user_portal) as form:
+                form.name = 'Test'
+                task = form.save()
+
+        # 3) Give the 'edit' access mode to a portal user in a project and try to create task with this user.
+        project_sharing_access.write({'access_mode': 'edit'})
+        with self.get_project_sharing_form_view(self.env['project.task'].with_context({'tracking_disable': True, 'default_project_id': self.project_portal.id}), self.user_portal) as form:
+            form.name = 'Test'
+            task = form.save()
+            self.assertEqual(task.name, 'Test')
+            self.assertEqual(task.project_id, self.project_portal)
+            self.assertEqual(task.user_id, self.user_portal)
+            # 3.1) Try to change the project of the new task with this user.
+            with self.assertRaises(AssertionError, msg="Should not accept the portal user changes the project of the task."):
+                form.project_id = self.project_cows
+                task = form.save()
+
+    def test_edit_task_in_project_sharing(self):
+        """ Test when portal user creates a task in project sharing views.
+
+            Test Cases:
+            ==========
+            1) Give the 'read' access mode to a portal user in a project and try to edit task with this user.
+            2) Give the 'comment' access mode to a portal user in a project and try to edit task with this user.
+            3) Give the 'edit' access mode to a portal user in a project and try to create task with this user.
+            3.1) Try to change the project of the new task with this user.
+        """
+        # 1) Give the 'read' access mode to a portal user in a project and try to create task with this user.
+        project_share_wizard = self.env['project.share.wizard'].create({
+            'res_model': 'project.project',
+            'res_id': self.project_cows.id,
+            'line_ids': [
+                Command.create({
+                    'user_id': self.user_portal.id,
+                    'access_mode': 'read',
+                }),
+            ],
+        })
+        project_share_wizard.action_confirm_access()
+        with self.assertRaises(AccessError, msg="Should not accept the portal user create a task in the project when he has not the edit access right."):
+            with self.get_project_sharing_form_view(self.task_cow.with_context({'tracking_disable': True, 'default_project_id': self.project_cows.id}), self.user_portal) as form:
+                form.name = 'Test'
+                task = form.save()
+
+        # 2) Give the 'comment' access mode to a portal user in a project and try to create task with this user.
+        project_sharing_access = self.project_cows.project_sharing_access_ids
+        project_sharing_access.write({'access_mode': 'comment'})
+        with self.assertRaises(AccessError, msg="Should not accept the portal user create a task in the project when he has not the edit access right."):
+            with self.get_project_sharing_form_view(self.task_cow.with_context({'tracking_disable': True, 'default_project_id': self.project_cows.id}), self.user_portal) as form:
+                form.name = 'Test'
+                task = form.save()
+
+        # 3) Give the 'edit' access mode to a portal user in a project and try to create task with this user.
+        project_sharing_access.write({'access_mode': 'edit'})
+        with self.get_project_sharing_form_view(self.task_cow.with_context({'tracking_disable': True, 'default_project_id': self.project_cows.id, 'uid': self.user_portal.id}), self.user_portal) as form:
+            form.name = 'Test'
+            task = form.save()
+            self.assertEqual(task.name, 'Test')
+            self.assertEqual(task.project_id, self.project_cows)
+            # 3.1) Try to change the project of the new task with this user.
+            with self.assertRaises(AssertionError, msg="Should not accept the portal user changes the project of the task."):
+                form.project_id = self.project_portal
+                task = form.save()
+            # 3.2) Create a sub-task
+            with form.child_ids.new() as subtask_form:
+                subtask_form.name = 'Test Subtask'
+                with self.assertRaises(AssertionError, msg="Should not accept the portal user changes the project of the task."):
+                    subtask_form.display_project_id = self.project_portal
+            form.save()
+            self.assertEqual(task.child_ids.name, 'Test Subtask')
+            self.assertEqual(task.child_ids.project_id, self.project_cows)
+            self.assertEqual(task.child_ids.user_id, self.user_portal)

From ed0a5ea431076b2c4a4ebf6a2ec9c5336b378a68 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Thu, 19 Aug 2021 17:53:12 +0200
Subject: [PATCH 24/33] [IMP] web: allow no open in x2m list view in form view

Before this commit, when we set `no_open` in list view for x2m record in
form view, the no_open is not take into account. Either the list is
editable and then the form dialog is no displayed and the user can edit
in the list or the list view is readonly and when the user clicks on a
row in this list view, the form view dialog appears.

This commit changes the condition in the `no_open` to force to set to true
when the no_open is set to true. So, when the no_open=True even if the
list view of x2m record is in readonly, the form view dialog is not
called and thus it will no longer appear in this case.

task-2379518

closes #73341
---
 addons/web/static/src/legacy/js/fields/relational_fields.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/addons/web/static/src/legacy/js/fields/relational_fields.js b/addons/web/static/src/legacy/js/fields/relational_fields.js
index 880ca9aaf28..41d48f03f98 100644
--- a/addons/web/static/src/legacy/js/fields/relational_fields.js
+++ b/addons/web/static/src/legacy/js/fields/relational_fields.js
@@ -1486,8 +1486,8 @@ var FieldX2Many = AbstractField.extend(WidgetAdapterMixin, {
                 addCreateLine: this._hasCreateLine(),
                 addTrashIcon: this._hasTrashIcon(),
                 isMany2Many: this.isMany2Many,
-                no_open: (this.isReadonly && !this.hasReadonlyModifier) &&
-                    (this._canQuickEdit || toBoolElse(arch.attrs.no_open || '', false)),
+                no_open: ((this.isReadonly && !this.hasReadonlyModifier) &&
+                    this._canQuickEdit) || toBoolElse(arch.attrs.no_open || '', false),
                 columnInvisibleFields: this.currentColInvisibleFields,
             });
         }

From 82b522ce3b81c0b04434dc9f605652385f3cbac8 Mon Sep 17 00:00:00 2001
From: Yannick Tivisse <yti@odoo.com>
Date: Fri, 20 Aug 2021 14:15:17 +0200
Subject: [PATCH 25/33] [IMP] project: protect orm methods

Before this commit, the portal user could use the public orm methods to
get more information than he allowed.

This commit checks in the orm methods if the fields used in those
methods can be accessed by this user.

task-2379518

closes #73341
---
 addons/project/models/project.py | 38 ++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/addons/project/models/project.py b/addons/project/models/project.py
index 781c0629466..a75561cf9cb 100644
--- a/addons/project/models/project.py
+++ b/addons/project/models/project.py
@@ -1350,6 +1350,44 @@ class Task(models.Model):
         self._ensure_fields_are_accessible(fields)
         return super(Task, self).read(fields=fields, load=load)
 
+    @api.model
+    def read_group(self, domain, fields, groupby, offset=0, limit=None, orderby=False, lazy=True):
+        fields_list = ([f.split(':')[0] for f in fields] or [])
+        if groupby:
+            fields_list += [groupby] if isinstance(groupby, str) else groupby
+        if domain:
+            fields_list += [term[0].split('.')[0] for term in domain if isinstance(term, (tuple, list))]
+        self._ensure_fields_are_accessible(fields_list)
+        return super(Task, self).read_group(domain, fields, groupby, offset=offset, limit=limit, orderby=orderby, lazy=lazy)
+
+    @api.model
+    def _search(self, args, offset=0, limit=None, order=None, count=False, access_rights_uid=None):
+        fields_list = {term[0] for term in args if isinstance(term, (tuple, list))}
+        self._ensure_fields_are_accessible(fields_list)
+        return super(Task, self)._search(args, offset=offset, limit=limit, order=order, count=count, access_rights_uid=access_rights_uid)
+
+    def mapped(self, func):
+        # Note: This will protect the filtered method too
+        if func and isinstance(func, str):
+            fields_list = func.split('.')
+            self._ensure_fields_are_accessible(fields_list)
+        return super(Task, self).mapped(func)
+
+    def filtered_domain(self, domain):
+        fields_list = [term[0] for term in domain if isinstance(term, (tuple, list))]
+        self._ensure_fields_are_accessible(fields_list)
+        return super(Task, self).filtered_domain(domain)
+
+    def copy_data(self, default=None):
+        defaults = super().copy_data(default=default)
+        return [{k: v for k, v in default.items() if k in self.SELF_READABLE_FIELDS} for default in defaults]
+
+    @api.model
+    def _ensure_portal_user_can_write(self, fields):
+        for field in fields:
+            if field not in self.SELF_WRITABLE_FIELDS:
+                raise AccessError(_('You have not write access of %s field.') % field)
+
     @api.model_create_multi
     def create(self, vals_list):
         is_portal_user = self.env.user.has_group('base.group_portal')

From 57b8eb7e3bd516cd6727fc4984111c2ff580449a Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Fri, 20 Aug 2021 14:43:54 +0200
Subject: [PATCH 26/33] [IMP] project: not allow portal user to archive tasks

Before this commit, the portal can archive tasks via the kanban views

This commit removes the buttons thanks to the `archivable` option set to
false.

task-2379518

closes #73341
---
 addons/project/views/project_sharing_views.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/addons/project/views/project_sharing_views.xml b/addons/project/views/project_sharing_views.xml
index ef0fb958115..6426e3c8a75 100644
--- a/addons/project/views/project_sharing_views.xml
+++ b/addons/project/views/project_sharing_views.xml
@@ -26,6 +26,7 @@
                 default_group_by="stage_id"
                 on_create="quick_create"
                 quick_create_view="project.project_sharing_quick_create_task_form"
+                archivable="0"
             >
                 <field name="color"/>
                 <field name="priority"/>

From 7ed6e9e16b0f17adfd4c1e8d8b9a6ca213eb36af Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Fri, 20 Aug 2021 17:54:25 +0200
Subject: [PATCH 27/33] [IMP] project: detect if the user changes the access
 rights

Before this commit, the user cannot remove all access rights for project
sharing feature of a project with allow_project_sharing enabled.

This commit checks if the user has made a change in the access rights if
yes then the 'Confirm Access' button appears otherwise only 'Send'
button appears.

task-2379518

closes #73341
---
 addons/project/wizard/project_share_wizard.py   | 17 +++++++++++++++++
 .../wizard/project_share_wizard_views.xml       |  7 ++++---
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/addons/project/wizard/project_share_wizard.py b/addons/project/wizard/project_share_wizard.py
index 0b54ae1c307..635a87c45cb 100644
--- a/addons/project/wizard/project_share_wizard.py
+++ b/addons/project/wizard/project_share_wizard.py
@@ -28,12 +28,29 @@ class ProjectShareWizard(models.TransientModel):
 
     partner_ids = fields.Many2many(compute="_compute_partner_ids", readonly=False, store=True, required=False)
     line_ids = fields.One2many('project.share.wizard.line', 'project_share_id')
+    has_access_changed = fields.Boolean(compute='_compute_has_access_changed')
 
     @api.depends('line_ids.user_id')
     def _compute_partner_ids(self):
         for project_share_wizard in self:
             project_share_wizard.partner_ids |= project_share_wizard.line_ids.user_id.partner_id
 
+    @api.depends('line_ids.user_id', 'line_ids.access_mode')
+    def _compute_has_access_changed(self):
+        project_sharing_access_read = self.env['project.sharing.access'].search_read([('project_id', '=', self.res_id)], ['user_id', 'access_mode'])
+        project_sharing_access_dict = {res['user_id'][0]: res['access_mode'] for res in project_sharing_access_read}
+        for project_share in self:
+            if len(project_share.line_ids) != len(project_sharing_access_dict):
+                project_share.has_access_changed = True
+                continue
+            has_access_changed = False
+            for line in project_share.line_ids:
+                access_mode = project_sharing_access_dict.get(line.user_id.id)
+                if not access_mode or access_mode != line.access_mode:
+                    has_access_changed = True
+                    break
+            project_share.has_access_changed = has_access_changed
+
     def action_send_mail_and_confirm_access(self):
         if not self.partner_ids:
             raise UserError(_('Impossible to send email, no recipients are mentionned.'))
diff --git a/addons/project/wizard/project_share_wizard_views.xml b/addons/project/wizard/project_share_wizard_views.xml
index b3a6882ab94..ee8bdb230c6 100644
--- a/addons/project/wizard/project_share_wizard_views.xml
+++ b/addons/project/wizard/project_share_wizard_views.xml
@@ -27,9 +27,10 @@
                     </field>
                 </group>
                 <footer>
-                    <button string="Confirm Access" name="action_confirm_access" attrs="{'invisible': ['|', ('access_warning', '!=', ''), ('line_ids', '=', [])]}" type="object" class="btn-primary" data-hotkey="v"/>
-                    <button string="Send" name="action_send_mail" attrs="{'invisible': ['|', ('access_warning', '!=', ''), ('line_ids', '!=', [])]}" type="object" class="btn-primary" data-hotkey="q"/>
-                    <button string="Send &amp; Confirm" name="action_send_mail_and_confirm_access" attrs="{'invisible': ['|', ('access_warning', '!=', ''), ('line_ids', '=', [])]}" type="object" class="btn-primary" data-hotkey="q"/>
+                    <field name="has_access_changed" invisible="1" />
+                    <button string="Confirm Access" name="action_confirm_access" attrs="{'invisible': ['|', ('access_warning', '!=', ''), ('has_access_changed', '=', False)]}" type="object" class="btn-primary" data-hotkey="v"/>
+                    <button string="Send" name="action_send_mail" attrs="{'invisible': ['|', ('access_warning', '!=', ''), ('has_access_changed', '=', True)]}" type="object" class="btn-primary" data-hotkey="q"/>
+                    <button string="Send &amp; Confirm" name="action_send_mail_and_confirm_access" attrs="{'invisible': ['|', ('access_warning', '!=', ''), ('has_access_changed', '=', False)]}" type="object" class="btn-primary" data-hotkey="q"/>
                     <button string="Cancel" class="btn-default" special="cancel" data-hotkey="z" />
                 </footer>
             </form>

From 0de3f3ace5bdae562f33d30f137d75fe9aeeb357 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Mon, 23 Aug 2021 08:47:52 +0200
Subject: [PATCH 28/33] [IMP] project: allow portal user to see only active
 tasks

Before this commit, the portal user could see archived tasks by filtering the
tasks with the search view.

This commit adds a condition in the domain of the `ir.rule` for this user
to allow him to see only the active tasks.

task-2379518

closes #73341
---
 addons/project/security/project_security.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/addons/project/security/project_security.xml b/addons/project/security/project_security.xml
index 83e748dacd6..e66dde35ba5 100644
--- a/addons/project/security/project_security.xml
+++ b/addons/project/security/project_security.xml
@@ -124,6 +124,7 @@
         <field name="model_id" ref="project.model_project_task"/>
         <field name="domain_force">[
         ('project_id.privacy_visibility', '=', 'portal'),
+        ('active', '=', True),
         '|',
             ('project_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
             ('message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
@@ -140,6 +141,7 @@
         <field name="model_id" ref="project.model_project_task"/>
         <field name="domain_force">[
             ('project_id.privacy_visibility', '=', 'portal'),
+            ('active', '=', True),
             '|',
                 ('project_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
                 ('message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),

From a28cc6333af3a1799fd5f5437a8f88de1b73b70f Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Mon, 23 Aug 2021 16:56:01 +0200
Subject: [PATCH 29/33] [REV] project: select access rights in project sharing

This reverts commit fc7778f8c512202dc3361d6b87be8c28b299c3c8 because of
a change in the spec.
The access mode are removed and replaced by this access mode for portal
user:
- read: the user goes to the classic portal view
- edit: the user is added as collaborator of the shared project and can
access to project sharing views.

To do this, the portal share is inherited by the project share wizard.
This new wizard can be open to share in readonly and open to share in
edit mode via 2 buttons in the form view of the shared project.
A new stat button is added to form view of project to see the
collaborators of this project. That is, the ones can access to the
project sharing views. The project manager will can remove or also add
new collaborators via the views in this stat button.

task-2379518

closes #73341
---
 .../security/hr_timesheet_security.xml        |   2 +-
 addons/portal/wizard/portal_share.py          |  90 +++++----
 addons/project/__manifest__.py                |   1 +
 addons/project/controllers/portal.py          |   1 -
 .../controllers/project_sharing_chatter.py    |   2 +-
 addons/project/models/__init__.py             |   2 +-
 addons/project/models/project.py              |  94 +++++-----
 addons/project/models/project_collaborator.py |  23 +++
 .../project/models/project_sharing_access.py  |  24 ---
 addons/project/models/res_partner.py          |  17 ++
 addons/project/security/ir.model.access.csv   |   7 +-
 addons/project/security/project_security.xml  |  12 +-
 .../src/project_sharing/project_sharing.js    |   4 +-
 addons/project/tests/test_project_sharing.py  | 172 +++++-------------
 .../views/project_collaborator_views.xml      |  53 ++++++
 .../project/views/project_sharing_views.xml   |   7 +-
 addons/project/views/project_views.xml        |  18 +-
 addons/project/wizard/project_share_wizard.py | 108 +++--------
 .../wizard/project_share_wizard_views.xml     |  39 ++--
 19 files changed, 314 insertions(+), 362 deletions(-)
 create mode 100644 addons/project/models/project_collaborator.py
 delete mode 100644 addons/project/models/project_sharing_access.py
 create mode 100644 addons/project/views/project_collaborator_views.xml

diff --git a/addons/hr_timesheet/security/hr_timesheet_security.xml b/addons/hr_timesheet/security/hr_timesheet_security.xml
index 2b20fc60087..63d1b679d9d 100644
--- a/addons/hr_timesheet/security/hr_timesheet_security.xml
+++ b/addons/hr_timesheet/security/hr_timesheet_security.xml
@@ -39,7 +39,7 @@
                     ('project_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
                     ('task_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
                 ('project_id.privacy_visibility', '=', 'portal'),
-                ('project_id.project_sharing_access_ids.user_id', 'in', [user.id]),
+                ('project_id.collaborator_ids.partner_id', 'in', [user.partner_id.id]),
             ]</field>
             <field name="perm_read" eval="True"/>
             <field name="perm_write" eval="True"/>
diff --git a/addons/portal/wizard/portal_share.py b/addons/portal/wizard/portal_share.py
index c8c36418a01..48f19e8ff22 100644
--- a/addons/portal/wizard/portal_share.py
+++ b/addons/portal/wizard/portal_share.py
@@ -17,13 +17,26 @@ class PortalShare(models.TransientModel):
             result['share_link'] = record.get_base_url() + record._get_share_url(redirect=True)
         return result
 
+    @api.model
+    def _selection_target_model(self):
+        return [(model.model, model.name) for model in self.env['ir.model'].sudo().search([])]
+
     res_model = fields.Char('Related Document Model', required=True)
     res_id = fields.Integer('Related Document ID', required=True)
+    resource_ref = fields.Reference('_selection_target_model', 'Related Document', compute='_compute_resource_ref')
     partner_ids = fields.Many2many('res.partner', string="Recipients", required=True)
     note = fields.Text(help="Add extra content to display in the email")
     share_link = fields.Char(string="Link", compute='_compute_share_link')
     access_warning = fields.Text("Access warning", compute="_compute_access_warning")
 
+    @api.depends('res_model', 'res_id')
+    def _compute_resource_ref(self):
+        for wizard in self:
+            if wizard.res_model and wizard.res_model in self.env:
+                wizard.resource_ref = '%s,%s' % (wizard.res_model, wizard.res_id or 0)
+            else:
+                wizard.resource_ref = None
+
     @api.depends('res_model', 'res_id')
     def _compute_share_link(self):
         for rec in self:
@@ -44,48 +57,61 @@ class PortalShare(models.TransientModel):
                     record = res_model.browse(rec.res_id)
                     rec.access_warning = record.access_warning
 
+    @api.model
+    def _get_note(self):
+        return self.env.ref('mail.mt_note')
+
+    def _send_public_link(self, note, partners=None):
+        if not partners:
+            partners = self.partner_ids
+        for partner in partners:
+            share_link = self.resource_ref.get_base_url() + self.resource_ref._get_share_url(redirect=True, pid=partner.id)
+            saved_lang = self.env.lang
+            self = self.with_context(lang=partner.lang)
+            template = self.env.ref('portal.portal_share_template', False)
+            self.resource_ref.message_post_with_view(template,
+                values={'partner': partner, 'note': self.note, 'record': self.resource_ref,
+                        'share_link': share_link},
+                subject=_("You are invited to access %s", self.resource_ref.display_name),
+                subtype_id=note.id,
+                email_layout_xmlid='mail.mail_notification_light',
+                partner_ids=[(6, 0, partner.ids)])
+            self = self.with_context(lang=saved_lang)
+
+    def _send_signup_link(self, note, partners=None):
+        if not partners:
+            partners = self.partner_ids.filtered(lambda partner: not partner.user_ids)
+        for partner in partners:
+            #  prepare partner for signup and send singup url with redirect url
+            partner.signup_get_auth_param()
+            share_link = partner._get_signup_url_for_action(action='/mail/view', res_id=self.res_id, model=self.res_model)[partner.id]
+            saved_lang = self.env.lang
+            self = self.with_context(lang=partner.lang)
+            template = self.env.ref('portal.portal_share_template', False)
+            self.resource_ref.message_post_with_view(template,
+                values={'partner': partner, 'note': self.note, 'record': self.resource_ref,
+                        'share_link': share_link},
+                subject=_("You are invited to access %s", self.resource_ref.display_name),
+                subtype_id=note.id,
+                email_layout_xmlid='mail.mail_notification_light',
+                partner_ids=[(6, 0, partner.ids)])
+            self = self.with_context(lang=saved_lang)
+
     def action_send_mail(self):
-        active_record = self.env[self.res_model].browse(self.res_id)
-        note = self.env.ref('mail.mt_note')
+        note = self._get_note()
         signup_enabled = self.env['ir.config_parameter'].sudo().get_param('auth_signup.invitation_scope') == 'b2c'
 
-        if hasattr(active_record, 'access_token') and active_record.access_token or not signup_enabled:
+        if getattr(self.resource_ref, 'access_token', False) or not signup_enabled:
             partner_ids = self.partner_ids
         else:
             partner_ids = self.partner_ids.filtered(lambda x: x.user_ids)
         # if partner already user or record has access token send common link in batch to all user
-        for partner in self.partner_ids:
-            share_link = active_record.get_base_url() + active_record._get_share_url(redirect=True, pid=partner.id)
-            saved_lang = self.env.lang
-            self = self.with_context(lang=partner.lang)
-            template = self.env.ref('portal.portal_share_template', False)
-            active_record.message_post_with_view(template,
-                values={'partner': partner, 'note': self.note, 'record': active_record,
-                        'share_link': share_link},
-                subject=_("You are invited to access %s", active_record.display_name),
-                subtype_id=note.id,
-                email_layout_xmlid='mail.mail_notification_light',
-                partner_ids=[(6, 0, partner.ids)])
-            self = self.with_context(lang=saved_lang)
+        self._send_public_link(note, partner_ids)
         # when partner not user send individual mail with signup token
-        for partner in self.partner_ids - partner_ids:
-            #  prepare partner for signup and send singup url with redirect url
-            partner.signup_get_auth_param()
-            share_link = partner._get_signup_url_for_action(action='/mail/view', res_id=self.res_id, model=self.model)[partner.id]
-            saved_lang = self.env.lang
-            self = self.with_context(lang=partner.lang)
-            template = self.env.ref('portal.portal_share_template', False)
-            active_record.message_post_with_view(template,
-                values={'partner': partner, 'note': self.note, 'record': active_record,
-                        'share_link': share_link},
-                subject=_("You are invited to access %s", active_record.display_name),
-                subtype_id=note.id,
-                email_layout_xmlid='mail.mail_notification_light',
-                partner_ids=[(6, 0, partner.ids)])
-            self = self.with_context(lang=saved_lang)
+        self._send_signup_link(note, self.partner_ids - partner_ids)
 
         # subscribe all recipients so that they receive future communication (better than
         # using autofollow as more precise)
-        active_record.message_subscribe(partner_ids=self.partner_ids.ids)
+        self.resource_ref.message_subscribe(partner_ids=self.partner_ids.ids)
 
         return {'type': 'ir.actions.act_window_close'}
diff --git a/addons/project/__manifest__.py b/addons/project/__manifest__.py
index bde65068b5d..0c28fc67a61 100644
--- a/addons/project/__manifest__.py
+++ b/addons/project/__manifest__.py
@@ -33,6 +33,7 @@
         'views/project_update_templates.xml',
         'views/project_project_stage_views.xml',
         'wizard/project_share_wizard_views.xml',
+        'views/project_collaborator_views.xml',
         'views/project_views.xml',
         'views/res_partner_views.xml',
         'views/res_config_settings_views.xml',
diff --git a/addons/project/controllers/portal.py b/addons/project/controllers/portal.py
index cd04920d309..152e531f5f7 100644
--- a/addons/project/controllers/portal.py
+++ b/addons/project/controllers/portal.py
@@ -113,7 +113,6 @@ class ProjectCustomerPortal(CustomerPortal):
             cache_hashes=cache_hashes,
             action_name='project.project_sharing_project_task_action',
             project_id=project.id,
-            can_edit=project._check_project_sharing_access('edit'),
             user_companies={
                 'current_company': project_company.id,
                 'allowed_companies': {
diff --git a/addons/project/controllers/project_sharing_chatter.py b/addons/project/controllers/project_sharing_chatter.py
index c29123bb216..c3e3bc2b9c2 100644
--- a/addons/project/controllers/project_sharing_chatter.py
+++ b/addons/project/controllers/project_sharing_chatter.py
@@ -23,7 +23,7 @@ class ProjectSharingChatter(PortalChatter):
             If it is the case, then we give the access token of the task.
         """
         project_sudo = ProjectCustomerPortal._document_check_access(self, 'project.project', project_id, token)
-        can_access = project_sudo and res_model == 'project.task' and project_sudo.with_user(request.env.user)._check_project_sharing_access('comment')
+        can_access = project_sudo and res_model == 'project.task' and project_sudo.with_user(request.env.user)._check_project_sharing_access()
         if token:
             can_access &= consteq(project_sudo.access_token, token)
         else:
diff --git a/addons/project/models/__init__.py b/addons/project/models/__init__.py
index dae83cffa9e..2f66f8d42bc 100644
--- a/addons/project/models/__init__.py
+++ b/addons/project/models/__init__.py
@@ -6,7 +6,7 @@ from . import project_milestone
 from . import project_project_stage
 from . import project_task_recurrence
 from . import project
-from . import project_sharing_access
+from . import project_collaborator
 from . import project_update
 from . import res_config_settings
 from . import res_partner
diff --git a/addons/project/models/project.py b/addons/project/models/project.py
index a75561cf9cb..8f4a3b7c2d6 100644
--- a/addons/project/models/project.py
+++ b/addons/project/models/project.py
@@ -7,13 +7,12 @@ from collections import defaultdict
 from datetime import timedelta, datetime
 from random import randint
 
-from odoo import api, fields, models, tools, SUPERUSER_ID, _
+from odoo import api, Command, fields, models, tools, SUPERUSER_ID, _
 from odoo.exceptions import UserError, ValidationError, AccessError
-from odoo.osv import expression
+from odoo.osv.expression import OR
 
 from .project_task_recurrence import DAYS, WEEKS
 from .project_update import STATUS_COLOR
-from .project_sharing_access import PROJECT_SHARING_ACCESS_MODE
 
 
 PROJECT_TASK_READABLE_FIELDS = {
@@ -38,7 +37,6 @@ PROJECT_TASK_READABLE_FIELDS = {
     'displayed_image_id',
     'display_name',
     'priority',
-    'project_sharing_access_mode',
 }
 
 PROJECT_TASK_WRITABLE_FIELDS = {
@@ -283,7 +281,8 @@ class Project(models.Model):
     tag_ids = fields.Many2many('project.tags', relation='project_project_project_tags_rel', string='Tags')
 
     # Project Sharing fields
-    project_sharing_access_ids = fields.One2many('project.sharing.access', 'project_id', 'Project Sharing Access', copy=False)
+    collaborator_ids = fields.One2many('project.collaborator', 'project_id', string='Collaborators', copy=False)
+    collaborator_count = fields.Integer('# Collaborators', compute='_compute_collaborator_count')
 
     # rating fields
     rating_request_deadline = fields.Datetime(compute='_compute_rating_request_deadline', store=True)
@@ -397,6 +396,18 @@ class Project(models.Model):
             else:
                 project.alias_value = "%s@%s" % (project.alias_name, project.alias_domain)
 
+    @api.depends('collaborator_ids', 'privacy_visibility')
+    def _compute_collaborator_count(self):
+        project_sharings = self.filtered(lambda project: project.privacy_visibility == 'portal')
+        collaborator_read_group = self.env['project.collaborator'].read_group(
+            [('project_id', 'in', project_sharings.ids)],
+            ['project_id'],
+            ['project_id'],
+        )
+        collaborator_count_by_project = {res['project_id'][0]: res['project_id_count'] for res in collaborator_read_group}
+        for project in self:
+            project.collaborator_count = collaborator_count_by_project.get(project.id, 0)
+
     @api.model
     def _map_tasks_default_valeus(self, task, project):
         """ get the default value for the copied task on project duplication """
@@ -700,25 +711,6 @@ class Project(models.Model):
             })
             project.write({'analytic_account_id': analytic_account.id})
 
-    def _check_project_sharing_access(self, access_mode='read'):
-        self.ensure_one()
-        if access_mode not in map(lambda access: access[0], PROJECT_SHARING_ACCESS_MODE):
-            raise ValidationError('The %s does not exists in project sharing accesses.' % access_mode)
-        if self.privacy_visibility != 'portal' or self.env.user._is_public():
-            return False
-        if self.env.user.has_group('base.group_portal'):
-            # check in project sharing access model of the project
-            project_sharing_access = self.project_sharing_access_ids.filtered(lambda access: access.user_id == self.env.user)
-            if not project_sharing_access:
-                return False
-            if access_mode == 'edit':
-                return project_sharing_access.access_mode == 'edit'
-            elif access_mode == 'comment':
-                return project_sharing_access.access_mode in ('comment', 'edit')
-            else:
-                return True
-        return self.env.user.has_group('base.group_user')
-
     # ---------------------------------------------------
     # Rating business
     # ---------------------------------------------------
@@ -750,6 +742,35 @@ class Project(models.Model):
             project.message_unsubscribe(partner_ids=portal_users.partner_id.ids)
             project.mapped('tasks')._change_project_privacy_visibility()
 
+    # ---------------------------------------------------
+    # Project sharing
+    # ---------------------------------------------------
+    def _check_project_sharing_access(self):
+        self.ensure_one()
+        if self.privacy_visibility != 'portal':
+            return False
+        if self.env.user.has_group('base.group_portal'):
+            return self.env.user.partner_id in self.collaborator_ids.partner_id
+        return self.env.user.has_group('base.group_user')
+
+    def _add_collaborators(self, partners):
+        self.ensure_one()
+        user_group_id = self.env['ir.model.data']._xmlid_to_res_id('base.group_user')
+        all_collaborators = self.collaborator_ids.partner_id
+        new_collaborators = partners.filtered(
+            lambda partner:
+                partner not in all_collaborators
+                and (not partner.user_ids or user_group_id not in partner.user_ids[0].groups_id.ids)
+        )
+        if not new_collaborators:
+            # Then we have nothing to do
+            return
+        self.write({'collaborator_ids': [
+            Command.create({
+                'partner_id': collaborator.id,
+            }) for collaborator in new_collaborators],
+        })
+
 class Task(models.Model):
     _name = "project.task"
     _description = "Task"
@@ -880,9 +901,6 @@ class Task(models.Model):
     allow_task_dependencies = fields.Boolean(related='project_id.allow_task_dependencies')
     depend_on_ids = fields.Many2many('project.task', relation="task_dependencies_rel", column1="task_id", column2="depends_on_id", string="Blocked By", domain="[('allow_task_dependencies', '=', True), ('id', '!=', id)]")
 
-    # Project Sharing fields
-    project_sharing_access_mode = fields.Selection(PROJECT_SHARING_ACCESS_MODE, compute='_compute_project_sharing_access_mode')
-
     # recurrence fields
     allow_recurring_tasks = fields.Boolean(related='project_id.allow_recurring_tasks')
     recurring_task = fields.Boolean(string="Recurrent")
@@ -1189,26 +1207,6 @@ class Task(models.Model):
             else:
                 task.stage_id = False
 
-    @api.depends_context('uid')
-    @api.depends('project_id.project_sharing_access_ids', 'project_id.privacy_visibility')
-    def _compute_project_sharing_access_mode(self):
-        if self.env.user._is_public():
-            self.project_sharing_access_mode = False
-            return
-        portal_user = self.user_has_groups('base.group_portal')
-        project_sharings = self.project_id.filtered(lambda project: project.privacy_visibility == 'portal')
-        if portal_user:
-            project_sharing_access_read = self.env['project.sharing.access'].search_read(
-                [('user_id', '=', self.env.user.id), ('project_id', 'in', project_sharings.ids)],
-                ['project_id', 'access_mode']
-            )
-            project_sharing_access_dict = {res['project_id'][0]: res['access_mode'] for res in project_sharing_access_read}
-        for task in self:
-            if not portal_user:
-                task.project_sharing_access_mode = task.project_id in project_sharings and 'edit'
-                continue
-            task.project_sharing_access_mode = project_sharing_access_dict.get(task.project_id.id, False)
-
     @api.constrains('recurring_task')
     def _check_recurring_task(self):
         if self.filtered(lambda task: task.parent_id and task.recurring_task):
@@ -1497,7 +1495,7 @@ class Task(models.Model):
             recurrence_domain = []
             if recurrence_update == 'subsequent':
                 for task in self:
-                    recurrence_domain = expression.OR([recurrence_domain, ['&', ('recurrence_id', '=', task.recurrence_id.id), ('create_date', '>=', task.create_date)]])
+                    recurrence_domain = OR([recurrence_domain, ['&', ('recurrence_id', '=', task.recurrence_id.id), ('create_date', '>=', task.create_date)]])
             else:
                 recurrence_domain = [('recurrence_id', 'in', self.recurrence_id.ids)]
             tasks |= self.env['project.task'].search(recurrence_domain)
diff --git a/addons/project/models/project_collaborator.py b/addons/project/models/project_collaborator.py
new file mode 100644
index 00000000000..4268a62f705
--- /dev/null
+++ b/addons/project/models/project_collaborator.py
@@ -0,0 +1,23 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo import api, fields, models
+
+
+class ProjectCollaborator(models.Model):
+    _name = 'project.collaborator'
+    _description = 'Collaborators in project shared'
+
+    project_id = fields.Many2one('project.project', 'Project Shared', domain=[('privacy_visibility', '=', 'portal')], required=True)
+    partner_id = fields.Many2one('res.partner', 'Collaborator', required=True)
+
+    _sql_constraints = [
+        ('unique_collaborator', 'UNIQUE(project_id, partner_id)', 'A collaborator cannot be selected more than once in the project sharing access. Please remove duplicate(s) and try again.'),
+    ]
+
+    @api.model_create_multi
+    def create(self, vals_list):
+        project_collaborators = super().create(vals_list)
+        non_authenticated_collaborator = project_collaborators.partner_id.filtered(lambda partner: not partner.user_ids)
+        non_authenticated_collaborator._create_portal_users()
+        return project_collaborators
diff --git a/addons/project/models/project_sharing_access.py b/addons/project/models/project_sharing_access.py
deleted file mode 100644
index c164f89681e..00000000000
--- a/addons/project/models/project_sharing_access.py
+++ /dev/null
@@ -1,24 +0,0 @@
-# -*- coding: utf-8 -*-
-# Part of Odoo. See LICENSE file for full copyright and licensing details.
-
-from odoo import fields, models
-
-
-PROJECT_SHARING_ACCESS_MODE = [
-    ('read', 'Read'),
-    ('comment', 'Comment'),
-    ('edit', 'Edit'),
-]
-
-
-class ProjectSharingAccess(models.Model):
-    _name = 'project.sharing.access'
-    _description = 'Project Sharing Access'
-
-    project_id = fields.Many2one('project.project', 'Project Shared', required=True)
-    user_id = fields.Many2one('res.users', string='Portal Users', domain=lambda self: [('groups_id', 'in', self.env.ref('base.group_portal').id)], required=True)
-    access_mode = fields.Selection(PROJECT_SHARING_ACCESS_MODE, string='Access Mode', required=True)
-
-    _sql_constraints = [
-        ('unique_user', 'UNIQUE(project_id, user_id)', 'A user cannot be selected more than once in the project sharing access. Please remove duplicate(s) and try again.'),
-    ]
diff --git a/addons/project/models/res_partner.py b/addons/project/models/res_partner.py
index d7646c8d411..290e92d8474 100644
--- a/addons/project/models/res_partner.py
+++ b/addons/project/models/res_partner.py
@@ -2,6 +2,7 @@
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
 from odoo import fields, models
+from odoo.tools import email_normalize
 
 
 class ResPartner(models.Model):
@@ -28,3 +29,19 @@ class ResPartner(models.Model):
                 if partner in self:
                     partner.task_count += group['partner_id_count']
                 partner = partner.parent_id
+
+    def _create_portal_users(self):
+        partners_without_user = self.filtered(lambda partner: not partner.user_ids)
+        if not partners_without_user:
+            return self.env['res.users']
+        created_users = self.env['res.users']
+        for partner in partners_without_user:
+            created_users += self.env['res.users'].with_context(no_reset_password=True)._create_user_from_template({
+                'email': email_normalize(partner.email),
+                'login': email_normalize(partner.email),
+                'partner_id': partner.id,
+                'company_id': self.env.company.id,
+                'company_ids': [(6, 0, self.env.company.ids)],
+                'active': True,
+            })
+        return created_users
diff --git a/addons/project/security/ir.model.access.csv b/addons/project/security/ir.model.access.csv
index 0f06777ee58..f9637300734 100644
--- a/addons/project/security/ir.model.access.csv
+++ b/addons/project/security/ir.model.access.csv
@@ -36,7 +36,6 @@ access_project_milestone_user,project.milestone.user,model_project_milestone,bas
 access_project_milestone_portal,project.milestone.portal,model_project_milestone,base.group_portal,1,0,0,0
 access_project_milestone_project_user,project.milestone.project.user,model_project_milestone,project.group_project_user,1,0,0,0
 access_project_milestone_project_manager,project.milestone.project.manager,model_project_milestone,project.group_project_manager,1,1,1,1
-access_project_share_project_manager,project.share.wizard.project.manager,model_project_share_wizard,project.group_project_manager,1,1,1,0
-access_project_share_wizard_line_project_manager,project.share.wizard.line.project.manager,model_project_share_wizard_line,project.group_project_manager,1,1,1,0
-access_project_sharing_access_project_manager,project.sharing.access.project.manager,model_project_sharing_access,project.group_project_manager,1,1,1,1
-access_project_sharing_access_project_portal,project.sharing.access.project.portal,model_project_sharing_access,base.group_portal,1,0,0,0
+access_project_collaborator_manager,project.collaborator.manager,model_project_collaborator,project.group_project_manager,1,1,1,1
+access_project_collaborator_portal,project.collaborator.portal,model_project_collaborator,base.group_portal,1,0,0,0
+access_project_share_manager,project.share.wizard.manager,model_project_share_wizard,project.group_project_manager,1,1,1,0
diff --git a/addons/project/security/project_security.xml b/addons/project/security/project_security.xml
index e66dde35ba5..ebe00e1ca0f 100644
--- a/addons/project/security/project_security.xml
+++ b/addons/project/security/project_security.xml
@@ -145,14 +145,13 @@
             '|',
                 ('project_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
                 ('message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
-            ('project_id.project_sharing_access_ids.user_id', 'in', [user.id]),
-            ('project_id.project_sharing_access_ids.access_mode', '=', 'edit'),
+            ('project_id.collaborator_ids.partner_id', 'in', [user.partner_id.id]),
         ]</field>
+        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
         <field name="perm_read" eval="False"/>
         <field name="perm_write" eval="True"/>
         <field name="perm_create" eval="True"/>
         <field name="perm_unlink" eval="False"/>
-        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
     </record>
 
     <record model="ir.rule" id="update_comp_rule">
@@ -183,12 +182,5 @@
         <field name="groups" eval="[(4,ref('project.group_project_manager'))]"/>
     </record>
 
-    <record id="project_sharing_access_portal" model="ir.rule">
-        <field name="name">Project Sharing Access: Portal user can read its own access</field>
-        <field name="model_id" ref="project.model_project_sharing_access" />
-        <field name="domain_force">[('user_id', '=', user.id)]</field>
-        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
-    </record>
-
 </data>
 </odoo>
diff --git a/addons/project/static/src/project_sharing/project_sharing.js b/addons/project/static/src/project_sharing/project_sharing.js
index cc59095bdfe..cf1affa05eb 100644
--- a/addons/project/static/src/project_sharing/project_sharing.js
+++ b/addons/project/static/src/project_sharing/project_sharing.js
@@ -56,15 +56,13 @@ export class ProjectSharingWebClient extends Component {
     }
 
     async _showView() {
-        const { action_name, project_id, can_edit } = session;
+        const { action_name, project_id } = session;
         await this.actionService.doAction(
             action_name,
             {
                 clearBreadcrumbs: true,
                 additionalContext: {
                     active_id: project_id,
-                    create: can_edit,
-                    edit: can_edit,
                 }
             }
         );
diff --git a/addons/project/tests/test_project_sharing.py b/addons/project/tests/test_project_sharing.py
index a39b81b913f..04af79e5333 100644
--- a/addons/project/tests/test_project_sharing.py
+++ b/addons/project/tests/test_project_sharing.py
@@ -3,6 +3,7 @@
 
 from odoo import Command
 from odoo.exceptions import AccessError
+from odoo.tests import tagged
 from odoo.tests.common import Form
 
 from .test_project_base import TestProjectCommon
@@ -18,6 +19,13 @@ class TestProjectSharingCommon(TestProjectCommon):
             (0, 0, {'name': 'To Do', 'sequence': 1}),
             (0, 0, {'name': 'Done', 'sequence': 10}),
         ]
+
+        cls.partner_portal = cls.env['res.partner'].create({
+            'name': 'Chell Gladys',
+            'email': 'chell@gladys.portal',
+            'company_id': False,
+            'user_ids': [Command.link(cls.user_portal.id)]})
+
         cls.project_cows = cls.env['project.project'].with_context({'mail_create_nolog': True}).create({
             'name': 'Cows',
             'privacy_visibility': 'portal',
@@ -49,16 +57,7 @@ class TestProjectSharingCommon(TestProjectCommon):
             view="project.project_sharing_project_task_view_form"
         )
 
-    def get_project_sharing_access_for_user(self, with_user, project):
-        project_with_user = project.with_user(with_user or self.env.user)
-        return {
-            'read': project_with_user._check_project_sharing_access(),
-            'comment': project_with_user._check_project_sharing_access('comment'),
-            'edit': project_with_user._check_project_sharing_access('edit')
-        }
-
-
-
+@tagged('project_sharing')
 class TestProjectSharing(TestProjectSharingCommon):
 
     def test_project_share_wizard(self):
@@ -73,95 +72,30 @@ class TestProjectSharing(TestProjectSharingCommon):
         project_share_wizard = self.env['project.share.wizard'].create({
             'res_model': 'project.project',
             'res_id': self.project_portal.id,
+            'access_mode': 'edit',
         })
-        self.assertFalse(project_share_wizard.line_ids, 'No access rights should be given to a portal user in this project.')
+        self.assertFalse(project_share_wizard.partner_ids, 'No collaborator should be in the wizard.')
         self.assertFalse(self.project_portal.with_user(self.user_portal)._check_project_sharing_access(), 'The portal user should not have accessed in project sharing views.')
-        project_share_wizard.write({'line_ids': [
-            Command.create({
-                'user_id': self.user_portal.id,
-                'access_mode': 'read',
-            }),
-        ]})
-        project_share_wizard.action_confirm_access()
-        self.assertEqual(len(self.project_portal.project_sharing_access_ids), 1, 'The access right added in project share wizard should be added in the project when the user confirm the access in the wizard.')
+        project_share_wizard.write({'partner_ids': [Command.link(self.user_portal.partner_id.id)]})
+        project_share_wizard.action_send_mail()
+        self.assertEqual(len(self.project_portal.collaborator_ids), 1, 'The access right added in project share wizard should be added in the project when the user confirm the access in the wizard.')
         self.assertDictEqual({
-            'user_id': self.project_portal.project_sharing_access_ids.user_id,
-            'access_mode': self.project_portal.project_sharing_access_ids.access_mode,
-            'project_id': self.project_portal.project_sharing_access_ids.project_id,
+            'partner_id': self.project_portal.collaborator_ids.partner_id,
+            'project_id': self.project_portal.collaborator_ids.project_id,
         }, {
-            'user_id': self.user_portal,
-            'access_mode': 'read',
+            'partner_id': self.user_portal.partner_id,
             'project_id': self.project_portal,
         }, 'The access rights added should be the read access for the portal project for Chell Gladys.')
-        self.assertTrue(self.project_portal._check_project_sharing_access(), 'The portal user should have read access to the portal project with project sharing feature.')
-        self.assertTrue(self.user_portal.partner_id in self.project_portal.message_partner_ids)
+        self.assertTrue(self.project_portal.with_user(self.user_portal)._check_project_sharing_access(), 'The portal user should have read access to the portal project with project sharing feature.')
 
     def test_project_sharing_access(self):
-        """ Check the _check_project_sharing_access returns the expected value for all access mode defined in project sharing.
-        """
-        self.assertDictEqual(
-            self.get_project_sharing_access_for_user(self.user_public, self.project_portal),
-            {
-                'read': False,
-                'comment': False,
-                'edit': False,
-            },
-            'The public user should not have any access to project sharing feature of the portal project.'
-        )
-        self.assertDictEqual(
-            self.get_project_sharing_access_for_user(self.user_projectuser, self.project_portal),
-            {
-                'read': True,
-                'comment': True,
-                'edit': True,
-            },
-            'The internal user should have all accesses to project sharing feature of the portal project.'
-        )
-        self.assertDictEqual(
-            self.get_project_sharing_access_for_user(self.user_portal, self.project_portal),
-            {
-                'read': False,
-                'comment': False,
-                'edit': False,
-            },
-            'The portal user should not have any access to project sharing feature of the portal project.'
-        )
-        self.project_portal.write({
-            'project_sharing_access_ids': [Command.create({
-                'user_id': self.user_portal.id,
-                'access_mode': 'read',
-            })],
-        })
-        project_sharing_access = self.project_portal.project_sharing_access_ids
-        self.assertDictEqual(
-            self.get_project_sharing_access_for_user(self.user_portal, self.project_portal),
-            {
-                'read': True,
-                'comment': False,
-                'edit': False,
-            },
-            'The portal user should have only the read access to project sharing feature of the portal project.'
-        )
-        project_sharing_access.write({'access_mode': 'comment'})
-        self.assertDictEqual(
-            self.get_project_sharing_access_for_user(self.user_portal, self.project_portal),
-            {
-                'read': True,
-                'comment': True,
-                'edit': False,
-            },
-            'The portal user should can read and comment the tasks of the portal project in project sharing views.'
-        )
-        project_sharing_access.write({'access_mode': 'edit'})
-        self.assertDictEqual(
-            self.get_project_sharing_access_for_user(self.user_portal, self.project_portal),
-            {
-                'read': True,
-                'comment': True,
-                'edit': True,
-            },
-            'The portal user should can read, comment and edit the tasks of the portal project in project sharing views.'
-        )
+        """ Check if the different user types can access to project sharing feature as expected. """
+        with self.assertRaises(AccessError, msg='The public user should not have any access to project sharing feature of the portal project.'):
+            self.project_portal.with_user(self.user_public)._check_project_sharing_access()
+        self.assertTrue(self.project_portal.with_user(self.user_projectuser)._check_project_sharing_access(), 'The internal user should have all accesses to project sharing feature of the portal project.')
+        self.assertFalse(self.project_portal.with_user(self.user_portal)._check_project_sharing_access(), 'The portal user should not have any access to project sharing feature of the portal project.')
+        self.project_portal.write({'collaborator_ids': [Command.create({'partner_id': self.user_portal.partner_id.id})]})
+        self.assertTrue(self.project_portal.with_user(self.user_portal)._check_project_sharing_access(), 'The portal user can access to project sharing feature of the portal project.')
 
     def test_create_task_in_project_sharing(self):
         """ Test when portal user creates a task in project sharing views.
@@ -174,29 +108,16 @@ class TestProjectSharing(TestProjectSharingCommon):
             3.1) Try to change the project of the new task with this user.
         """
         # 1) Give the 'read' access mode to a portal user in a project and try to create task with this user.
+        with self.assertRaises(AccessError, msg="Should not accept the portal user create a task in the project when he has not the edit access right."):
+            with self.get_project_sharing_form_view(self.env['project.task'].with_context({'tracking_disable': True, 'default_project_id': self.project_portal.id}), self.user_portal) as form:
+                form.name = 'Test'
+                task = form.save()
+
         self.project_portal.write({
-            'project_sharing_access_ids': [
-                Command.create({
-                    'user_id': self.user_portal.id,
-                    'access_mode': 'read',
-                }),
+            'collaborator_ids': [
+                Command.create({'partner_id': self.user_portal.partner_id.id}),
             ],
         })
-        with self.assertRaises(AccessError, msg="Should not accept the portal user create a task in the project when he has not the edit access right."):
-            with self.get_project_sharing_form_view(self.env['project.task'].with_context({'tracking_disable': True, 'default_project_id': self.project_portal.id}), self.user_portal) as form:
-                form.name = 'Test'
-                task = form.save()
-
-        # 2) Give the 'comment' access mode to a portal user in a project and try to create task with this user.
-        project_sharing_access = self.project_portal.project_sharing_access_ids
-        project_sharing_access.write({'access_mode': 'comment'})
-        with self.assertRaises(AccessError, msg="Should not accept the portal user create a task in the project when he has not the edit access right."):
-            with self.get_project_sharing_form_view(self.env['project.task'].with_context({'tracking_disable': True, 'default_project_id': self.project_portal.id}), self.user_portal) as form:
-                form.name = 'Test'
-                task = form.save()
-
-        # 3) Give the 'edit' access mode to a portal user in a project and try to create task with this user.
-        project_sharing_access.write({'access_mode': 'edit'})
         with self.get_project_sharing_form_view(self.env['project.task'].with_context({'tracking_disable': True, 'default_project_id': self.project_portal.id}), self.user_portal) as form:
             form.name = 'Test'
             task = form.save()
@@ -219,32 +140,21 @@ class TestProjectSharing(TestProjectSharingCommon):
             3.1) Try to change the project of the new task with this user.
         """
         # 1) Give the 'read' access mode to a portal user in a project and try to create task with this user.
+        with self.assertRaises(AccessError, msg="Should not accept the portal user create a task in the project when he has not the edit access right."):
+            with self.get_project_sharing_form_view(self.task_cow.with_context({'tracking_disable': True, 'default_project_id': self.project_cows.id}), self.user_portal) as form:
+                form.name = 'Test'
+                task = form.save()
+
         project_share_wizard = self.env['project.share.wizard'].create({
+            'access_mode': 'edit',
             'res_model': 'project.project',
             'res_id': self.project_cows.id,
-            'line_ids': [
-                Command.create({
-                    'user_id': self.user_portal.id,
-                    'access_mode': 'read',
-                }),
+            'partner_ids': [
+                Command.link(self.user_portal.partner_id.id),
             ],
         })
-        project_share_wizard.action_confirm_access()
-        with self.assertRaises(AccessError, msg="Should not accept the portal user create a task in the project when he has not the edit access right."):
-            with self.get_project_sharing_form_view(self.task_cow.with_context({'tracking_disable': True, 'default_project_id': self.project_cows.id}), self.user_portal) as form:
-                form.name = 'Test'
-                task = form.save()
+        project_share_wizard.action_send_mail()
 
-        # 2) Give the 'comment' access mode to a portal user in a project and try to create task with this user.
-        project_sharing_access = self.project_cows.project_sharing_access_ids
-        project_sharing_access.write({'access_mode': 'comment'})
-        with self.assertRaises(AccessError, msg="Should not accept the portal user create a task in the project when he has not the edit access right."):
-            with self.get_project_sharing_form_view(self.task_cow.with_context({'tracking_disable': True, 'default_project_id': self.project_cows.id}), self.user_portal) as form:
-                form.name = 'Test'
-                task = form.save()
-
-        # 3) Give the 'edit' access mode to a portal user in a project and try to create task with this user.
-        project_sharing_access.write({'access_mode': 'edit'})
         with self.get_project_sharing_form_view(self.task_cow.with_context({'tracking_disable': True, 'default_project_id': self.project_cows.id, 'uid': self.user_portal.id}), self.user_portal) as form:
             form.name = 'Test'
             task = form.save()
diff --git a/addons/project/views/project_collaborator_views.xml b/addons/project/views/project_collaborator_views.xml
new file mode 100644
index 00000000000..09ebf0173d4
--- /dev/null
+++ b/addons/project/views/project_collaborator_views.xml
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+
+    <record id="project_collaborator_view_form" model="ir.ui.view">
+        <field name="name">project.collaborator.view.form</field>
+        <field name="model">project.collaborator</field>
+        <field name="arch" type="xml">
+            <form string="Project Collaborator">
+                <sheet>
+                    <group>
+                        <field name="partner_id" options="{'no_create': True}" />
+                        <field name="project_id" options="{'no_create': True}" />
+                    </group>
+                </sheet>
+            </form>
+        </field>
+    </record>
+
+    <record id="project_sharing_access_view_tree" model="ir.ui.view">
+        <field name="name">project.collaborator.view.tree</field>
+        <field name="model">project.collaborator</field>
+        <field name="arch" type="xml">
+            <tree string="Project Collaborators" edit="1" editable="bottom">
+                <field name="partner_id" options="{'no_create': True}"/>
+                <field name="project_id" options="{'no_create': True}"/>
+            </tree>
+        </field>
+    </record>
+
+    <record id="project_collaborator_view_search" model="ir.ui.view">
+        <field name="name">project.collaborator.view.search</field>
+        <field name="model">project.collaborator</field>
+        <field name="arch" type="xml">
+            <search>
+                <field name="partner_id" />
+                <field name="project_id" />
+                <group expand="0" string="Group By">
+                    <filter name="project" string="Project" context="{'group_by': 'project_id'}" />
+                    <filter name="collaborator" string="Collaborator" context="{'group_by': 'partner_id'}" />
+                </group>
+            </search>
+        </field>
+    </record>
+
+    <record id="project_collaborator_action" model="ir.actions.act_window">
+        <field name="name">Project Collaborators</field>
+        <field name="res_model">project.collaborator</field>
+        <field name="view_mode">tree,form</field>
+        <field name="domain">[('project_id', '=', active_id)]</field>
+        <field name="search_view_id" ref="project_collaborator_view_search"/>
+    </record>
+
+</odoo>
diff --git a/addons/project/views/project_sharing_views.xml b/addons/project/views/project_sharing_views.xml
index 6426e3c8a75..ea603592e99 100644
--- a/addons/project/views/project_sharing_views.xml
+++ b/addons/project/views/project_sharing_views.xml
@@ -133,8 +133,7 @@
         <field name="arch" type="xml">
             <form string="Project Sharing: Task" class="o_form_project_tasks">
                 <header>
-                    <field name="project_sharing_access_mode" invisible="1"/>
-                    <field name="stage_id" widget="statusbar" options="{'clickable': '1', 'fold_field': 'fold'}" attrs="{'invisible': [('project_id', '=', False), ('stage_id', '=', False)], 'readonly': [('project_sharing_access_mode', '!=', 'edit')]}" />
+                    <field name="stage_id" widget="statusbar" options="{'clickable': '1', 'fold_field': 'fold'}" attrs="{'invisible': [('project_id', '=', False), ('stage_id', '=', False)]}" />
                 </header>
                 <sheet string="Task">
                     <div class="oe_button_box" name="button_box">
@@ -145,7 +144,7 @@
                         <h1 class="d-flex flex-row justify-content-between">
                             <field name="priority" widget="priority" class="mr-3"/>
                             <field name="name" class="o_task_name text-truncate" placeholder="Task Title..."/>
-                            <field name="kanban_state" widget="state_selection" class="ml-auto" attrs="{'readonly': [('project_sharing_access_mode', '!=', 'edit')]}"/>
+                            <field name="kanban_state" widget="state_selection" class="ml-auto"/>
                         </h1>
                     </div>
                     <group>
@@ -196,7 +195,7 @@
                         </page>
                     </notebook>
                 </sheet>
-                <div class="oe_project_sharing_chatter" attrs="{'invisible': [('project_sharing_access_mode', 'not in', ['comment', 'edit'])]}"/>
+                <div class="oe_chatter"/>
             </form>
         </field>
     </record>
diff --git a/addons/project/views/project_views.xml b/addons/project/views/project_views.xml
index 47661621d4e..cf46269bf37 100644
--- a/addons/project/views/project_views.xml
+++ b/addons/project/views/project_views.xml
@@ -264,8 +264,10 @@
             <field name="arch" type="xml">
                 <form string="Project" delete="0">
                     <header>
-                        <button name="%(project.project_share_action)d" string="Share" type="action" class="oe_highlight" groups="project.group_project_manager"
-                        attrs="{'invisible': [('privacy_visibility', '!=', 'portal')]}"/>
+                        <button name="%(project.project_share_wizard_action)d" string="Share Readonly" type="action" class="oe_highlight" groups="project.group_project_manager"
+                        attrs="{'invisible': [('privacy_visibility', '!=', 'portal')]}" context="{'default_access_mode': 'read'}"/>
+                        <button name="%(project.project_share_wizard_action)d" string="Share Editable" type="action" class="oe_highlight" groups="project.group_project_manager"
+                        attrs="{'invisible': [('privacy_visibility', '!=', 'portal')]}" context="{'default_access_mode': 'edit'}"/>
                         <field name="stage_id" widget="statusbar" options="{'clickable': '1', 'fold_field': 'fold'}" groups="project.group_project_stages"/>
                     </header>
                 <sheet string="Project">
@@ -312,6 +314,16 @@
                                 <field name="last_update_status" widget="status_with_color" options="{'color_field': 'last_update_color', 'no_quick_edit': 1}"/>
                             </div>
                         </button>
+                        <button class="oe_stat_button" name="%(project.project_collaborator_action)d" type="action" icon="fa-users" groups="project.group_project_manager">
+                            <div class="o_field_widget o_stat_info">
+                                <span class="o_stat_value">
+                                    <field name="collaborator_count" nolabel="1"/>
+                                </span>
+                                <span class="o_stat_text">
+                                    Collaborators
+                                </span>
+                            </div>
+                        </button>
                     </div>
                     <widget name="web_ribbon" title="Archived" bg_color="bg-danger" attrs="{'invisible': [('active', '=', True)]}"/>
                     <div class="oe_title">
@@ -640,7 +652,7 @@
                                                 <ul class="oe_kanban_colorpicker" data-field="color" role="popup"/>
                                             </div>
                                             <div role="menuitem" class="col-4">
-                                                <a t-if="record.privacy_visibility.raw_value == 'portal'" class="dropdown-item" role="menuitem" name="%(project.project_share_action)d" type="action">Share</a>
+                                                <a t-if="record.privacy_visibility.raw_value == 'portal'" class="dropdown-item" role="menuitem" name="%(project.project_share_wizard_action)d" type="action">Share</a>
                                                 <a class="dropdown-item" role="menuitem" type="edit">Edit</a>
                                             </div>
                                         </div>
diff --git a/addons/project/wizard/project_share_wizard.py b/addons/project/wizard/project_share_wizard.py
index 635a87c45cb..113f0252023 100644
--- a/addons/project/wizard/project_share_wizard.py
+++ b/addons/project/wizard/project_share_wizard.py
@@ -1,95 +1,47 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
-from odoo import api, Command, fields, models, _
-from odoo.exceptions import ValidationError, UserError
-
-from ..models.project_sharing_access import PROJECT_SHARING_ACCESS_MODE
+from odoo import api, fields, models
 
 
 class ProjectShareWizard(models.TransientModel):
     _name = 'project.share.wizard'
     _inherit = 'portal.share'
-    _description = 'Project Share'
+    _description = 'Project Sharing'
 
     @api.model
-    def default_get(self, fields_list):
-        result = super().default_get(fields_list)
-        if result['res_model'] and result['res_id']:
-            project = self.env[result['res_model']].browse(result['res_id'])
+    def default_get(self, fields):
+        result = super().default_get(fields)
+        if not result.get('access_mode'):
             result.update(
-                line_ids=[
-                    Command.create(
-                        {'user_id': access.user_id, 'access_mode': access.access_mode}
-                    ) for access in project.project_sharing_access_ids
-                ],
+                access_mode='read',
+                display_access_mode=True,
             )
         return result
 
-    partner_ids = fields.Many2many(compute="_compute_partner_ids", readonly=False, store=True, required=False)
-    line_ids = fields.One2many('project.share.wizard.line', 'project_share_id')
-    has_access_changed = fields.Boolean(compute='_compute_has_access_changed')
+    @api.model
+    def _selection_target_model(self):
+        return [(model.model, model.name) for model in self.env['ir.model'].sudo().search([('model', '=', 'project.project')])]
 
-    @api.depends('line_ids.user_id')
-    def _compute_partner_ids(self):
-        for project_share_wizard in self:
-            project_share_wizard.partner_ids |= project_share_wizard.line_ids.user_id.partner_id
+    access_mode = fields.Selection([('read', 'Readonly'), ('edit', 'Edit')])
+    display_access_mode = fields.Boolean()
 
-    @api.depends('line_ids.user_id', 'line_ids.access_mode')
-    def _compute_has_access_changed(self):
-        project_sharing_access_read = self.env['project.sharing.access'].search_read([('project_id', '=', self.res_id)], ['user_id', 'access_mode'])
-        project_sharing_access_dict = {res['user_id'][0]: res['access_mode'] for res in project_sharing_access_read}
-        for project_share in self:
-            if len(project_share.line_ids) != len(project_sharing_access_dict):
-                project_share.has_access_changed = True
-                continue
-            has_access_changed = False
-            for line in project_share.line_ids:
-                access_mode = project_sharing_access_dict.get(line.user_id.id)
-                if not access_mode or access_mode != line.access_mode:
-                    has_access_changed = True
-                    break
-            project_share.has_access_changed = has_access_changed
+    @api.depends('res_model', 'res_id')
+    def _compute_resource_ref(self):
+        for wizard in self:
+            if wizard.res_model and wizard.res_model == 'project.project':
+                wizard.resource_ref = '%s,%s' % (wizard.res_model, wizard.res_id or 0)
+            else:
+                wizard.resource_ref = None
 
-    def action_send_mail_and_confirm_access(self):
-        if not self.partner_ids:
-            raise UserError(_('Impossible to send email, no recipients are mentionned.'))
-        self.action_confirm_access()
-        return self.action_send_mail()
-
-    def action_confirm_access(self):
-        project = self.env[self.res_model].browse(self.res_id)
-        if not project or not project.exists():
-            raise ValidationError(_('Impossible to confirm the project sharing access, the project is not found or project sharing is disabled for this project.'))
-        project_sharing_access_dict = {access.user_id.id: access for access in project.project_sharing_access_ids}
-        project_sharing_access_vals_list = [
-            Command.delete(access.id)
-            for user_id, access in project_sharing_access_dict.items()
-            if user_id not in self.line_ids.user_id.ids
-        ]
-        for share_access in self.line_ids:
-            project_sharing_access = project_sharing_access_dict.get(share_access.user_id.id)
-            if not project_sharing_access:
-                project_sharing_access_vals_list.append(
-                    Command.create(
-                        {'user_id': share_access.user_id.id, 'access_mode': share_access.access_mode}
-                    )
-                )
-            elif project_sharing_access.access_mode != share_access.access_mode:
-                project_sharing_access_vals_list.append(Command.update(project_sharing_access.id, {'access_mode': share_access.access_mode}))
-        project.write({'project_sharing_access_ids': project_sharing_access_vals_list})
-        project.message_subscribe(self.line_ids.user_id.partner_id.ids)
-        return {'type': 'ir.actions.act_window_close'}
-
-
-class ProjectShareAccessWizard(models.TransientModel):
-    _name = 'project.share.wizard.line'
-    _description = 'Project Share Access'
-
-    project_share_id = fields.Many2one('project.share.wizard', required=True, ondelete='cascade')
-    user_id = fields.Many2one('res.users', string='Portal Users', domain=lambda self: [('groups_id', 'in', self.env.ref('base.group_portal').id)], required=True)
-    access_mode = fields.Selection(PROJECT_SHARING_ACCESS_MODE, string='Access Mode', required=True)
-
-    _sql_constraints = [
-        ('uniqueness_user', 'UNIQUE(project_share_id, user_id)', 'An user cannot be selected more than once in the project sharing access. Please remove duplicate(s) and try again.'),
-    ]
+    def action_send_mail(self):
+        self.ensure_one()
+        if self.access_mode == 'edit':
+            portal_partners = self.partner_ids.filtered('user_ids')
+            note = self._get_note()
+            self.resource_ref._add_collaborators(self.partner_ids)
+            self._send_public_link(note, portal_partners)
+            self._send_signup_link(note, partners=self.partner_ids - portal_partners)
+            self.resource_ref.message_subscribe(partner_ids=self.partner_ids.ids)
+            return {'type': 'ir.actions.act_window_close'}
+        return super().action_send_mail()
diff --git a/addons/project/wizard/project_share_wizard_views.xml b/addons/project/wizard/project_share_wizard_views.xml
index ee8bdb230c6..786a7383059 100644
--- a/addons/project/wizard/project_share_wizard_views.xml
+++ b/addons/project/wizard/project_share_wizard_views.xml
@@ -1,46 +1,43 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
 
-    <record id="project_share_wizard" model="ir.ui.view">
-        <field name="name">project.share.wizard</field>
+    <record id="project_share_wizard_view_form" model="ir.ui.view">
+        <field name="name">project.share.wizard.view.form</field>
         <field name="model">project.share.wizard</field>
         <field name="arch" type="xml">
-            <form string="Share Document">
+            <form string="Share Project">
+                <field name="res_model" invisible="1"/>
+                <field name="res_id" invisible="1"/>
+                <field name="display_access_mode" invisible="1" />
                 <p class="alert alert-warning" attrs="{'invisible': [('access_warning', '=', '')]}" role="alert"><field name="access_warning"/></p>
-                <group name="share_link">
-                    <field name="res_model" invisible="1"/>
-                    <field name="res_id" invisible="1"/>
+                <group attrs="{'invisible': [('display_access_mode', '=', False)]}">
+                    <field class="flex-row" name="access_mode" widget="radio"/>
+                </group>
+                <group name="share_link" attrs="{'invisible': [('access_mode', '=', 'edit')]}">
                     <field name="share_link" widget="CopyClipboardChar" options="{'string': 'Copy Link'}"/>
                 </group>
                 <group>
-                    <field name="partner_ids" widget="many2many_tags_email" placeholder="Add contacts to share the document..."/>
+                    <div class="o_td_label">
+                        <label for="partner_ids" string="Invite People" attrs="{'invisible': [('access_mode', '=', 'read')]}"/>
+                        <label for="partner_ids" attrs="{'invisible': [('access_mode', '=', 'edit')]}"/>
+                    </div>
+                    <field name="partner_ids" widget="many2many_tags_email" placeholder="Add contacts to share the project..." nolabel="1"/>
                 </group>
                 <group>
                     <field name="note" placeholder="Add a note"/>
                 </group>
-                <group>
-                    <field name="line_ids" nolabel="1">
-                        <tree create="1" edit="1" delete="1" editable="bottom">
-                            <field name="user_id" />
-                            <field name="access_mode" />
-                        </tree>
-                    </field>
-                </group>
                 <footer>
-                    <field name="has_access_changed" invisible="1" />
-                    <button string="Confirm Access" name="action_confirm_access" attrs="{'invisible': ['|', ('access_warning', '!=', ''), ('has_access_changed', '=', False)]}" type="object" class="btn-primary" data-hotkey="v"/>
-                    <button string="Send" name="action_send_mail" attrs="{'invisible': ['|', ('access_warning', '!=', ''), ('has_access_changed', '=', True)]}" type="object" class="btn-primary" data-hotkey="q"/>
-                    <button string="Send &amp; Confirm" name="action_send_mail_and_confirm_access" attrs="{'invisible': ['|', ('access_warning', '!=', ''), ('has_access_changed', '=', False)]}" type="object" class="btn-primary" data-hotkey="q"/>
+                    <button string="Send" name="action_send_mail" attrs="{'invisible': [('access_warning', '!=', '')]}" type="object" class="btn-primary" data-hotkey="q"/>
                     <button string="Cancel" class="btn-default" special="cancel" data-hotkey="z" />
                 </footer>
             </form>
         </field>
     </record>
 
-    <record id="project_share_action" model="ir.actions.act_window">
+    <record id="project_share_wizard_action" model="ir.actions.act_window">
         <field name="name">Share Project</field>
         <field name="res_model">project.share.wizard</field>
-        <field name="binding_model_id" ref="model_project_share_wizard"/>
+        <field name="binding_model_id" ref="model_project_project"/>
         <field name="view_mode">form</field>
         <field name="target">new</field>
     </record>

From a571faa3dba4d177023ee21ac7e98238ce27e869 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Wed, 25 Aug 2021 17:16:55 +0200
Subject: [PATCH 30/33] [IMP] project: limit access to portal user in
 project.collaborator

---
 addons/project/security/project_security.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/addons/project/security/project_security.xml b/addons/project/security/project_security.xml
index ebe00e1ca0f..9d233304c84 100644
--- a/addons/project/security/project_security.xml
+++ b/addons/project/security/project_security.xml
@@ -119,6 +119,16 @@
         <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
     </record>
 
+    <record id="project_collaborator_rule_portal" model="ir.rule">
+        <field name="name">Project/Collaborator: portal users: can only see his own collobaroration in shared projects</field>
+        <field name="model_id" ref="project.model_project_collaborator"/>
+        <field name="domain_force">[
+            ('project_id.privacy_visibility', '=', 'portal'),
+            ('partner_id', '=', user.partner_id.id),
+        ]</field>
+        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
+    </record>
+
     <record id="project_task_rule_portal" model="ir.rule">
         <field name="name">Project/Task: portal users: (portal and following project) or (portal and following task)</field>
         <field name="model_id" ref="project.model_project_task"/>

From 5d5be956f3ec1de5b45f71fe13c229c83ddf69e4 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Thu, 26 Aug 2021 12:09:22 +0200
Subject: [PATCH 31/33] [IMP] project,hr_timesheet: enable project sharing
 feature when needed

Before this commit, the project sharing feature is enabled by default
when the Project app is installed but the user could never use the
feature and thus we add more access rights to portal user for nothing.

To avoid this, this commit removes by default all additional access
rights given by project sharing feature and adds this access rights only
when a collaborator is added.
If the user removes all collaborators for all projects then we need
to disable the feature. That is, we will remove the access rights and
ir.rule records added.
So, the feature will not really disable but we remove the additionnal
access rights and ir.rule records added with this feature.

task-2379518

closes #73341
---
 addons/hr_timesheet/__init__.py               |  4 +++
 addons/hr_timesheet/__manifest__.py           |  1 +
 addons/hr_timesheet/models/__init__.py        |  1 +
 .../models/project_collaborator.py            | 21 +++++++++++++
 .../security/hr_timesheet_security.xml        |  1 +
 .../hr_timesheet/security/ir.model.access.csv |  1 -
 .../hr_timesheet/security/ir.model.access.xml | 19 ++++++++++++
 addons/project/__init__.py                    | 18 +++++++++++
 addons/project/__manifest__.py                |  2 ++
 addons/project/models/project_collaborator.py | 30 +++++++++++++++++++
 addons/project/security/ir.model.access.csv   |  2 +-
 addons/project/security/ir.model.access.xml   | 19 ++++++++++++
 addons/project/security/project_security.xml  |  1 +
 13 files changed, 118 insertions(+), 2 deletions(-)
 create mode 100644 addons/hr_timesheet/models/project_collaborator.py
 create mode 100644 addons/hr_timesheet/security/ir.model.access.xml
 create mode 100644 addons/project/security/ir.model.access.xml

diff --git a/addons/hr_timesheet/__init__.py b/addons/hr_timesheet/__init__.py
index ea15e1da791..5556aba9fe4 100644
--- a/addons/hr_timesheet/__init__.py
+++ b/addons/hr_timesheet/__init__.py
@@ -8,6 +8,8 @@ from . import wizard
 
 from odoo import api, fields, SUPERUSER_ID, _
 
+from odoo.addons.project import _check_exists_collaborators_for_project_sharing
+
 
 def create_internal_project(cr, registry):
     env = api.Environment(cr, SUPERUSER_ID, {})
@@ -28,3 +30,5 @@ def create_internal_project(cr, registry):
         'project_id': task.project_id.id,
         'task_id': task.id,
     } for task in project_ids.task_ids.filtered(lambda t: t.company_id in admin.employee_ids.company_id)])
+
+    _check_exists_collaborators_for_project_sharing(env)
diff --git a/addons/hr_timesheet/__manifest__.py b/addons/hr_timesheet/__manifest__.py
index ff049b01573..4cb43356441 100644
--- a/addons/hr_timesheet/__manifest__.py
+++ b/addons/hr_timesheet/__manifest__.py
@@ -24,6 +24,7 @@ up a management by affair.
     'data': [
         'security/hr_timesheet_security.xml',
         'security/ir.model.access.csv',
+        'security/ir.model.access.xml',
         'data/digest_data.xml',
         'views/hr_timesheet_views.xml',
         'views/res_config_settings_views.xml',
diff --git a/addons/hr_timesheet/models/__init__.py b/addons/hr_timesheet/models/__init__.py
index 969632575ce..87061d8bb36 100644
--- a/addons/hr_timesheet/models/__init__.py
+++ b/addons/hr_timesheet/models/__init__.py
@@ -7,5 +7,6 @@ from . import ir_http
 from . import res_company
 from . import res_config_settings
 from . import project
+from . import project_collaborator
 from . import project_update
 from . import uom
diff --git a/addons/hr_timesheet/models/project_collaborator.py b/addons/hr_timesheet/models/project_collaborator.py
new file mode 100644
index 00000000000..d2083a3258e
--- /dev/null
+++ b/addons/hr_timesheet/models/project_collaborator.py
@@ -0,0 +1,21 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo import api, models
+
+
+class ProjectCollaborator(models.Model):
+    _inherit = 'project.collaborator'
+
+    @api.model
+    def _toggle_project_sharing_portal_rules(self, active):
+        super()._toggle_project_sharing_portal_rules(active)
+        # ir.model.access
+        access_timesheet_portal = self.env.ref('hr_timesheet.access_account_analytic_line_portal_user').sudo()
+        if access_timesheet_portal.active != active:
+            access_timesheet_portal.write({'active': active})
+
+        # ir.rule
+        timesheet_portal_ir_rule = self.env.ref('hr_timesheet.timesheet_line_rule_portal_user').sudo()
+        if timesheet_portal_ir_rule.active != active:
+            access_timesheet_portal.write({'active': active})
diff --git a/addons/hr_timesheet/security/hr_timesheet_security.xml b/addons/hr_timesheet/security/hr_timesheet_security.xml
index 63d1b679d9d..2c35c99bfb2 100644
--- a/addons/hr_timesheet/security/hr_timesheet_security.xml
+++ b/addons/hr_timesheet/security/hr_timesheet_security.xml
@@ -33,6 +33,7 @@
         <record id="timesheet_line_rule_portal_user" model="ir.rule">
             <field name="name">account.analytic.line.timesheet.portal.user</field>
             <field name="model_id" ref="analytic.model_account_analytic_line"/>
+            <field name="active">0</field>
             <field name="domain_force">[
                 ('project_id', '!=', False),
                 '|',
diff --git a/addons/hr_timesheet/security/ir.model.access.csv b/addons/hr_timesheet/security/ir.model.access.csv
index ccddcb13a5d..db5329a5262 100644
--- a/addons/hr_timesheet/security/ir.model.access.csv
+++ b/addons/hr_timesheet/security/ir.model.access.csv
@@ -1,5 +1,4 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-access_account_analytic_line_portal_user,analytic.account.analytic.line.timesheet.portal.user,analytic.model_account_analytic_line,base.group_portal,1,0,0,0
 access_account_analytic_line_user,analytic.account.analytic.line.timesheet.user,analytic.model_account_analytic_line,hr_timesheet.group_hr_timesheet_user,1,1,1,1
 access_account_analytic_user,analytic.account.analytic.timesheet.user,analytic.model_account_analytic_account,hr_timesheet.group_hr_timesheet_user,1,1,0,0
 access_uom_uom_hr_timesheet,uom.uom.timesheet.user,uom.model_uom_uom,hr_timesheet.group_hr_timesheet_user,1,0,0,0
diff --git a/addons/hr_timesheet/security/ir.model.access.xml b/addons/hr_timesheet/security/ir.model.access.xml
new file mode 100644
index 00000000000..5732923928f
--- /dev/null
+++ b/addons/hr_timesheet/security/ir.model.access.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+
+    <data noupdate="1">
+
+        <record id="access_account_analytic_line_portal_user" model="ir.model.access">
+            <field name="name">analytic.account.analytic.line.timesheet.portal.user</field>
+            <field name="model_id" ref="analytic.model_account_analytic_line"/>
+            <field name="group_id" ref="base.group_portal"/>
+            <field name="active">0</field>
+            <field name="perm_read">1</field>
+            <field name="perm_write">0</field>
+            <field name="perm_create">0</field>
+            <field name="perm_unlink">0</field>
+        </record>
+
+    </data>
+
+</odoo>
diff --git a/addons/project/__init__.py b/addons/project/__init__.py
index e35155177e6..0f9917d22dd 100644
--- a/addons/project/__init__.py
+++ b/addons/project/__init__.py
@@ -6,3 +6,21 @@ from . import models
 from . import report
 from . import wizard
 from . import populate
+
+from odoo import api, SUPERUSER_ID
+
+
+def _check_exists_collaborators_for_project_sharing(env):
+    """ Check if it exists at least a collaborator in a shared project
+
+        If it is the case we need to active the portal rules added only for this feature.
+    """
+    collaborator = env['project.collaborator'].search([], limit=1)
+    if collaborator:
+        # Then we need to enable the access rights linked to project sharing for the portal user
+        env['project.collaborator']._toggle_project_sharing_portal_rules(True)
+
+
+def _project_post_init(cr, registry):
+    env = api.Environment(cr, SUPERUSER_ID, {})
+    _check_exists_collaborators_for_project_sharing(env)
diff --git a/addons/project/__manifest__.py b/addons/project/__manifest__.py
index 0c28fc67a61..d635e16c866 100644
--- a/addons/project/__manifest__.py
+++ b/addons/project/__manifest__.py
@@ -23,6 +23,7 @@
     'data': [
         'security/project_security.xml',
         'security/ir.model.access.csv',
+        'security/ir.model.access.xml',
         'data/digest_data.xml',
         'report/project_report_views.xml',
         'report/project_task_burndown_chart_report_views.xml',
@@ -55,6 +56,7 @@
     'installable': True,
     'auto_install': False,
     'application': True,
+    'post_init_hook': '_project_post_init',
     'assets': {
         'web.assets_backend': [
             'project/static/src/css/project.css',
diff --git a/addons/project/models/project_collaborator.py b/addons/project/models/project_collaborator.py
index 4268a62f705..4315e5a2a9b 100644
--- a/addons/project/models/project_collaborator.py
+++ b/addons/project/models/project_collaborator.py
@@ -17,7 +17,37 @@ class ProjectCollaborator(models.Model):
 
     @api.model_create_multi
     def create(self, vals_list):
+        collaborator = self.env['project.collaborator'].search([], limit=1)
         project_collaborators = super().create(vals_list)
         non_authenticated_collaborator = project_collaborators.partner_id.filtered(lambda partner: not partner.user_ids)
         non_authenticated_collaborator._create_portal_users()
+        if not collaborator:
+            self._toggle_project_sharing_portal_rules(True)
         return project_collaborators
+
+    def unlink(self):
+        res = super().unlink()
+        # Check if it remains at least a collaborator in all shared projects.
+        collaborator = self.env['project.collaborator'].search([], limit=1)
+        if not collaborator:  # then disable the project sharing feature
+            self._toggle_project_sharing_portal_rules(False)
+        return res
+
+    @api.model
+    def _toggle_project_sharing_portal_rules(self, active):
+        """ Enable/disable project sharing feature
+
+            When the first collaborator is added in the model then we need to enable the feature.
+            In the inverse case, if no collaborator is stored in the model then we disable the feature.
+            To enable/disable the feature, we just need to enable/disable the ir.model.access and ir.rule
+            added to portal user that we do not want to give when we know the project sharing is unused.
+
+            :param active: contains boolean value, True to enable the project sharing feature, otherwise we disable the feature.
+        """
+        access_project_sharing_portal = self.env.ref('project.access_project_sharing_task_portal').sudo()
+        if access_project_sharing_portal.active != active:
+            access_project_sharing_portal.write({'active': active})
+
+        task_portal_ir_rule = self.env.ref('project.project_task_rule_portal_project_sharing').sudo()
+        if task_portal_ir_rule.active != active:
+            task_portal_ir_rule.write({'active': active})
diff --git a/addons/project/security/ir.model.access.csv b/addons/project/security/ir.model.access.csv
index f9637300734..35c80887da6 100644
--- a/addons/project/security/ir.model.access.csv
+++ b/addons/project/security/ir.model.access.csv
@@ -11,7 +11,7 @@ access_project_task,project.task,model_project_task,project.group_project_user,1
 access_report_project_task_user,report.project.task.user,model_report_project_task_user,project.group_project_manager,1,1,1,1
 access_partner_task_user,base.res.partner user,base.model_res_partner,project.group_project_user,1,0,0,0
 access_task_on_partner,project.task on partners,model_project_task,base.group_user,1,0,0,0
-access_task_portal,task_portal,project.model_project_task,base.group_portal,1,1,1,0
+access_task_portal,task_portal,project.model_project_task,base.group_portal,1,0,0,0
 access_project_user,project.project on partners,model_project_project,base.group_user,1,0,0,0
 access_project_portal,project_portal,project.model_project_project,base.group_portal,1,0,0,0
 access_resource_calendar,project.resource_calendar user,resource.model_resource_calendar,project.group_project_user,1,0,0,0
diff --git a/addons/project/security/ir.model.access.xml b/addons/project/security/ir.model.access.xml
new file mode 100644
index 00000000000..5657be31cdd
--- /dev/null
+++ b/addons/project/security/ir.model.access.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+
+    <data noupdate="1">
+
+        <record id="access_project_sharing_task_portal" model="ir.model.access">
+            <field name="name">project_sharing_task_portal</field>
+            <field name="model_id" ref="model_project_task"/>
+            <field name="group_id" ref="base.group_portal"/>
+            <field name="active">0</field>
+            <field name="perm_read">0</field>
+            <field name="perm_write">1</field>
+            <field name="perm_create">1</field>
+            <field name="perm_unlink">0</field>
+        </record>
+
+    </data>
+
+</odoo>
diff --git a/addons/project/security/project_security.xml b/addons/project/security/project_security.xml
index 9d233304c84..84a5865ae16 100644
--- a/addons/project/security/project_security.xml
+++ b/addons/project/security/project_security.xml
@@ -149,6 +149,7 @@
     <record id="project_task_rule_portal_project_sharing" model="ir.rule">
         <field name="name">Project/Task: portal users: portal user can edit with project sharing feature</field>
         <field name="model_id" ref="project.model_project_task"/>
+        <field name="active">0</field>
         <field name="domain_force">[
             ('project_id.privacy_visibility', '=', 'portal'),
             ('active', '=', True),

From e9134c71b60d20da943978d978b09082f8f4d950 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Thu, 26 Aug 2021 09:50:28 +0200
Subject: [PATCH 32/33] [IMP] project: remove the create and edit in views of
 collaborators

Before this commit, the project manager could edit the collaborator
records. That is, he could change the shared project or the
collaborator.

This commit allows the user to only see or remove the collaborators for
a shared project. If the user wants to add some new collaborators, he
has to use the project share wizard.

task-2379518

closes #73341
---
 addons/project/models/project_collaborator.py       | 8 ++++++--
 addons/project/views/project_collaborator_views.xml | 8 ++++----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/addons/project/models/project_collaborator.py b/addons/project/models/project_collaborator.py
index 4315e5a2a9b..223d33155ac 100644
--- a/addons/project/models/project_collaborator.py
+++ b/addons/project/models/project_collaborator.py
@@ -8,13 +8,17 @@ class ProjectCollaborator(models.Model):
     _name = 'project.collaborator'
     _description = 'Collaborators in project shared'
 
-    project_id = fields.Many2one('project.project', 'Project Shared', domain=[('privacy_visibility', '=', 'portal')], required=True)
-    partner_id = fields.Many2one('res.partner', 'Collaborator', required=True)
+    project_id = fields.Many2one('project.project', 'Project Shared', domain=[('privacy_visibility', '=', 'portal')], required=True, readonly=True)
+    partner_id = fields.Many2one('res.partner', 'Collaborator', required=True, readonly=True)
 
     _sql_constraints = [
         ('unique_collaborator', 'UNIQUE(project_id, partner_id)', 'A collaborator cannot be selected more than once in the project sharing access. Please remove duplicate(s) and try again.'),
     ]
 
+    def name_get(self):
+        collaborator_search_read = self.search_read([('id', 'in', self.ids)], ['id', 'project_id', 'partner_id'])
+        return [(collaborator['id'], '%s - %s' % (collaborator['project_id'][1], collaborator['partner_id'][1])) for collaborator in collaborator_search_read]
+
     @api.model_create_multi
     def create(self, vals_list):
         collaborator = self.env['project.collaborator'].search([], limit=1)
diff --git a/addons/project/views/project_collaborator_views.xml b/addons/project/views/project_collaborator_views.xml
index 09ebf0173d4..29b48984023 100644
--- a/addons/project/views/project_collaborator_views.xml
+++ b/addons/project/views/project_collaborator_views.xml
@@ -5,11 +5,11 @@
         <field name="name">project.collaborator.view.form</field>
         <field name="model">project.collaborator</field>
         <field name="arch" type="xml">
-            <form string="Project Collaborator">
+            <form string="Project Collaborator" create="0" edit="0">
                 <sheet>
                     <group>
-                        <field name="partner_id" options="{'no_create': True}" />
                         <field name="project_id" options="{'no_create': True}" />
+                        <field name="partner_id" options="{'no_create': True}" />
                     </group>
                 </sheet>
             </form>
@@ -20,9 +20,9 @@
         <field name="name">project.collaborator.view.tree</field>
         <field name="model">project.collaborator</field>
         <field name="arch" type="xml">
-            <tree string="Project Collaborators" edit="1" editable="bottom">
-                <field name="partner_id" options="{'no_create': True}"/>
+            <tree string="Project Collaborators" create="0">
                 <field name="project_id" options="{'no_create': True}"/>
+                <field name="partner_id" options="{'no_create': True}"/>
             </tree>
         </field>
     </record>

From 7fd05a38642fc55e6b056f49bc12d0e4c9b0f4ae Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Wed, 25 Aug 2021 14:46:12 +0200
Subject: [PATCH 33/33] [IMP] project: review content in '/my/project/<id>'
 route

Before this commit, this route displayed the portal form view of the
project. This view does not seem useful for the external user and prefer
directly see the tasks of this project.

This commit replaces the portal form view of the project by the tasks
list containing in the project. Moreover, another route has been added
to allow the external user to go to the portal form view of the task
selected in ths list.
This route is called '/my/project/<project_id>/task/<task_id>'.

We decide to replace the content of the route because we want to allow
the public user to access to the tasks list of the project with the
access_token of the project. Also, with this same token, the public
could access to the form view of the selected task and send a message if
he needs.

task-2379518

closes #73341
---
 addons/project/controllers/portal.py          | 132 ++++++++++++---
 .../views/project_portal_templates.xml        | 153 ++++++++----------
 addons/sale_project/controllers/portal.py     |   7 -
 .../views/sale_project_portal_templates.xml   |   2 +-
 4 files changed, 174 insertions(+), 120 deletions(-)

diff --git a/addons/project/controllers/portal.py b/addons/project/controllers/portal.py
index 152e531f5f7..a1a4894a54e 100644
--- a/addons/project/controllers/portal.py
+++ b/addons/project/controllers/portal.py
@@ -29,11 +29,77 @@ class ProjectCustomerPortal(CustomerPortal):
     # ------------------------------------------------------------
     # My Project
     # ------------------------------------------------------------
-    def _project_get_page_view_values(self, project, access_token, **kwargs):
-        values = {
-            'page_name': 'project',
-            'project': project,
-        }
+    def _project_get_page_view_values(self, project, access_token, page=1, date_begin=None, date_end=None, sortby=None, search=None, search_in='content', groupby=None, **kwargs):
+        # TODO: refactor this because most of this code is duplicated from portal_my_tasks method
+        values = self._prepare_portal_layout_values()
+        searchbar_sortings = self._task_get_searchbar_sortings()
+
+        searchbar_inputs = self._task_get_searchbar_inputs()
+        searchbar_groupby = self._task_get_searchbar_groupby()
+
+        # default sort by value
+        if not sortby:
+            sortby = 'date'
+        order = searchbar_sortings[sortby]['order']
+
+        # default filter by value
+        domain = [('project_id', '=', project.id)]
+
+        # default group by value
+        if not groupby:
+            groupby = 'project'
+
+        if date_begin and date_end:
+            domain += [('create_date', '>', date_begin), ('create_date', '<=', date_end)]
+
+        # search
+        if search and search_in:
+            domain += self._task_get_search_domain(search_in, search)
+
+        Task = request.env['project.task']
+        if access_token:
+            Task = Task.sudo()
+
+        # task count
+        task_count = Task.search_count(domain)
+        # pager
+        url = "/my/project/%s" % project.id
+        pager = portal_pager(
+            url=url,
+            url_args={'date_begin': date_begin, 'date_end': date_end, 'sortby': sortby, 'groupby': groupby, 'search_in': search_in, 'search': search},
+            total=task_count,
+            page=page,
+            step=self._items_per_page
+        )
+        # content according to pager and archive selected
+        order = self._task_get_order(order, groupby)
+
+        tasks = Task.search(domain, order=order, limit=self._items_per_page, offset=pager['offset'])
+        request.session['my_project_tasks_history'] = tasks.ids[:100]
+
+        groupby_mapping = self._task_get_groupby_mapping()
+        group = groupby_mapping.get(groupby)
+        if group:
+            grouped_tasks = [Task.concat(*g) for k, g in groupbyelem(tasks, itemgetter(group))]
+        else:
+            grouped_tasks = [tasks]
+
+        values.update(
+            date=date_begin,
+            date_end=date_end,
+            grouped_tasks=grouped_tasks,
+            page_name='project',
+            default_url=url,
+            pager=pager,
+            searchbar_sortings=searchbar_sortings,
+            searchbar_groupby=searchbar_groupby,
+            searchbar_inputs=searchbar_inputs,
+            search_in=search_in,
+            search=search,
+            sortby=sortby,
+            groupby=groupby,
+            project=project,
+        )
         return self._get_page_view_values(project, access_token, values, 'my_projects_history', False, **kwargs)
 
     @http.route(['/my/projects', '/my/projects/page/<int:page>'], type='http', auth="user", website=True)
@@ -81,14 +147,16 @@ class ProjectCustomerPortal(CustomerPortal):
         return request.render("project.portal_my_projects", values)
 
     @http.route(['/my/project/<int:project_id>'], type='http', auth="public", website=True)
-    def portal_my_project(self, project_id=None, access_token=None, **kw):
+    def portal_my_project(self, project_id=None, access_token=None, page=1, date_begin=None, date_end=None, sortby=None, search=None, search_in='content', groupby=None, **kw):
         try:
             project_sudo = self._document_check_access('project.project', project_id, access_token)
         except (AccessError, MissingError):
             return request.redirect('/my')
         if project_sudo.with_user(request.env.user)._check_project_sharing_access():
             return request.render("project.project_sharing_portal", {'project_id': project_id})
-        values = self._project_get_page_view_values(project_sudo, access_token, **kw)
+        project_sudo = project_sudo if access_token else project_sudo.with_user(request.env.user)
+        values = self._project_get_page_view_values(project_sudo, access_token, page, date_begin, date_end, sortby, search, search_in, groupby, **kw)
+        values['task_url'] = 'project/%s/task' % project_id
         return request.render("project.portal_my_project", values)
 
     @http.route("/my/project/<int:project_id>/project_sharing", type="http", auth="user", methods=['GET'])
@@ -129,22 +197,44 @@ class ProjectCustomerPortal(CustomerPortal):
             {'session_info': session_info},
         )
 
+    @http.route('/my/project/<int:project_id>/task/<int:task_id>', type='http', auth='public', website=True)
+    def portal_my_project_task(self, project_id=None, task_id=None, access_token=None, **kw):
+        try:
+            project_sudo = self._document_check_access('project.project', project_id, access_token)
+        except (AccessError, MissingError):
+            return request.redirect('/my')
+        Task = request.env['project.task']
+        if access_token:
+            Task = Task.sudo()
+        task = Task.search([('project_id', '=', project_id), ('id', '=', task_id)], limit=1)
+        task.sudo().attachment_ids.generate_access_token()
+        values = self._task_get_page_view_values(task, access_token, project=project_sudo, **kw)
+        values['project'] = project_sudo
+        return request.render("project.portal_my_task", values)
+
     # ------------------------------------------------------------
     # My Task
     # ------------------------------------------------------------
     def _task_get_page_view_values(self, task, access_token, **kwargs):
-        try:
-            project_accessible = bool(task.project_id.id and self._document_check_access('project.project', task.project_id.id))
-        except (AccessError, MissingError):
-            project_accessible = False
-
+        project = kwargs.get('project')
+        if project:
+            project_accessible = True
+            page_name = 'project_task'
+            history = 'my_project_tasks_history'
+        else:
+            page_name = 'task'
+            history = 'my_tasks_history'
+            try:
+                project_accessible = bool(task.project_id.id and self._document_check_access('project.project', task.project_id.id))
+            except (AccessError, MissingError):
+                project_accessible = False
         values = {
-            'page_name': 'task',
+            'page_name': page_name,
             'task': task,
             'user': request.env.user,
             'project_accessible': project_accessible,
         }
-        return self._get_page_view_values(task, access_token, values, 'my_tasks_history', False, **kwargs)
+        return self._get_page_view_values(task, access_token, values, history, False, **kwargs)
 
     def _task_get_searchbar_sortings(self):
         return {
@@ -181,13 +271,6 @@ class ProjectCustomerPortal(CustomerPortal):
             return order
         return '%s, %s' % (field_name, order)
 
-    def _task_get_grouped_tasks(self, groupby, tasks):
-        if groupby:
-            grouped_tasks = [request.env['project.task'].concat(*g) for k, g in groupbyelem(tasks, itemgetter(groupby))]
-        else:
-            grouped_tasks = [tasks]
-        return grouped_tasks
-
     def _task_get_searchbar_inputs(self):
         values = {
             'all': {'input': 'all', 'label': _('Search in All'), 'order': 1},
@@ -288,7 +371,11 @@ class ProjectCustomerPortal(CustomerPortal):
         request.session['my_tasks_history'] = tasks.ids[:100]
 
         groupby_mapping = self._task_get_groupby_mapping()
-        grouped_tasks = self._task_get_grouped_tasks(groupby_mapping.get(groupby), tasks)
+        group = groupby_mapping.get(groupby)
+        if group:
+            grouped_tasks = [request.env['project.task'].concat(*g) for k, g in groupbyelem(tasks, itemgetter(group))]
+        else:
+            grouped_tasks = [tasks]
 
         values.update({
             'date': date_begin,
@@ -296,6 +383,7 @@ class ProjectCustomerPortal(CustomerPortal):
             'grouped_tasks': grouped_tasks,
             'page_name': 'task',
             'default_url': '/my/tasks',
+            'task_url': 'task',
             'pager': pager,
             'searchbar_sortings': searchbar_sortings,
             'searchbar_groupby': searchbar_groupby,
diff --git a/addons/project/views/project_portal_templates.xml b/addons/project/views/project_portal_templates.xml
index b7196affb5a..ff01397ecae 100644
--- a/addons/project/views/project_portal_templates.xml
+++ b/addons/project/views/project_portal_templates.xml
@@ -6,14 +6,17 @@
                 <a t-if="project" t-attf-href="/my/projects?{{ keep_query() }}">Projects</a>
                 <t t-else="">Projects</t>
             </li>
-            <li t-if="project" class="breadcrumb-item active text-truncate col-8 col-lg-10">
+            <li t-if="page_name == 'project_task' and project" class="breadcrumb-item active">
+                <a t-if="project" t-attf-href="/my/project/{{ project.id }}?{{ keep_query() }}"><t t-esc="project.name"/></a>
+            </li>
+            <li t-elif="project" t-attf-class="breadcrumb-item #{'active ' if not project else ''} text-truncate col-8 col-lg-10">
                 <t t-esc="project.name"/>
             </li>
-            <li t-if="page_name == 'task' or task" t-attf-class="breadcrumb-item #{'active ' if not task else ''}">
+            <li t-if="page_name == 'task' or (task and not project)" t-attf-class="breadcrumb-item #{'active ' if not task else ''}">
                 <a t-if="task" t-attf-href="/my/tasks?{{ keep_query() }}">Tasks</a>
                 <t t-else="">Tasks</t>
             </li>
-            <li t-if="task" class="breadcrumb-item active col-8 col-lg-10 text-truncate">
+            <li t-if="task" class="breadcrumb-item active text-truncate">
                 <span t-field="task.name"/>
             </li>
         </xpath>
@@ -68,52 +71,65 @@
         <t t-call="portal.portal_layout">
             <t t-set="o_portal_fullwidth_alert" groups="project.group_project_user">
                 <t t-call="portal.portal_back_in_edit_mode">
-                    <t t-set="backend_url" t-value="'/web#model=project.project&amp;id=%s&amp;view_type=form' % (project.id)"/>
+                    <t t-set="backend_url" t-value="'/web#model=project.project&amp;id=%s&amp;view_type=kanban' % (project.id)"/>
                 </t>
             </t>
 
-            <t t-call="portal.portal_record_layout">
-                <t t-set="card_header">
-                    <h5 class="mb-0">
-                        <span t-field="project.name" class="text-truncate"/>
-                        <span class="float-right">
-                            <a role="button" t-attf-href="/my/tasks?filterby=#{project.id}" class="btn btn-sm btn-secondary">
-                                <span class="fa fa-tasks" role="img" aria-label="Tasks" title="Tasks"/>
-                                <span t-esc="project.task_count_with_subtasks" />
-                                <span t-field="project.label_tasks" />
-                            </a>
-                        </span>
-                    </h5>
-                </t>
-                <t t-set="card_body">
-                    <div class="row">
-                        <div t-if="project.user_id" class="col-12 col-md-6">
-                            <h6><strong> Project Manager </strong></h6>
-                            <div class="row">
-                                <div class="col flex-grow-0 pr-3">
-                                    <img class="rounded-circle mt-1 o_portal_contact_img" t-att-src="image_data_uri(project.user_id.avatar_1024)" alt="Contact"/>
-                                </div>
-                                <div class="col pl-sm-0">
-                                    <div t-field="project.user_id" t-options='{"widget": "contact", "fields": ["name"]}'/>
-                                    <a t-attf-href="mailto:{{project.user_id.email}}" t-if="project.user_id.email"><div t-field="project.user_id" t-options='{"widget": "contact", "fields": ["email"]}'/></a>
-                                    <a t-attf-href="tel:{{project.user_id.phone}}" t-if="project.user_id.phone"><div t-field="project.user_id" t-options='{"widget": "contact", "fields": ["phone"]}'/></a>
-                                </div>
-                            </div>
-                        </div>
-                        <div t-if="project.partner_id" class="col-12 col-md-6 mb-2 mb-md-0">
-                            <h6><strong> Customer </strong></h6>
-                            <div class="row">
-                                <div class="col flex-grow-0 pr-3">
-                                    <img class="rounded-circle mt-1 o_portal_contact_img" t-att-src="image_data_uri(project.partner_id.avatar_1024)" alt="Contact"/>
-                                </div>
-                                <div class="col pl-sm-0">
-                                    <div t-field="project.partner_id" t-options='{"widget": "contact", "fields": ["name"]}'/>
-                                    <a t-attf-href="mailto:{{project.partner_email}}" t-if="project.partner_email"><div t-field="project.partner_id" t-options='{"widget": "contact", "fields": ["email"]}'/></a>
-                                    <a t-attf-href="tel:{{project.partner_phone}}" t-if="project.partner_phone"><div t-field="project.partner_id" t-options='{"widget": "contact", "fields": ["phone"]}'/></a>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
+            <t t-call="portal.portal_searchbar">
+                <t t-set="title">Tasks</t>
+            </t>
+            <t t-if="not grouped_tasks">
+                <div class="alert alert-warning mt8" role="alert">
+                    There are no tasks.
+                </div>
+            </t>
+
+            <t t-call="project.portal_tasks_list"/>
+        </t>
+    </template>
+
+    <template id="portal_tasks_list" name="Tasks List">
+        <t t-if="grouped_tasks">
+            <t t-call="portal.portal_table">
+                <t t-foreach="grouped_tasks" t-as="tasks">
+                    <thead>
+                        <tr t-attf-class="{{'thead-light' if not groupby == 'none' else ''}}">
+                            <th class="text-left">Ref</th>
+                            <th t-if="groupby == 'none'">Name</th>
+                            <th t-if="groupby == 'project'">
+                                <em class="font-weight-normal text-muted"><span t-field="tasks[0].sudo().project_id.label_tasks"/> for project:</em>
+                                <span t-field="tasks[0].sudo().project_id.name"/></th>
+                            <th t-if="groupby == 'stage'">
+                                <em class="font-weight-normal text-muted"><span t-field="tasks[0].sudo().project_id.label_tasks"/> in stage:</em>
+                                <span class="text-truncate" t-field="tasks[0].sudo().stage_id.name"/></th>
+                            <th t-if="groupby == 'user'">
+                                <em class="font-weight-normal text-muted" t-if="tasks[0].sudo().user_id"><span t-field="tasks[0].sudo().project_id.label_tasks"/> assigned to:</em>
+                                <span class="text-truncate" t-field="tasks[0].sudo().user_id.name"/></th>
+                            <th t-if="groupby == 'customer'">
+                                <em class="font-weight-normal text-muted" t-if="tasks[0].sudo().partner_id"><span t-field="tasks[0].sudo().project_id.label_tasks"/> for customer:</em>
+                                <span class="text-truncate" t-field="tasks[0].sudo().partner_id.name"/></th>
+                            <th t-if="groupby != 'project'" class="text-center" name="portal_my_tasks_project_th">Project</th>
+                            <th t-if="groupby != 'stage'" class="text-center">Stage</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        <t t-foreach="tasks" t-as="task">
+                            <tr>
+                                <td class="text-left">
+                                    #<span t-esc="task.id"/>
+                                </td>
+                                <td>
+                                    <a t-attf-href="/my/#{task_url}/#{task.id}?{{ keep_query() }}"><span t-field="task.name"/></a>
+                                </td>
+                                <td t-if="groupby != 'project'" class="text-center">
+                                    <span class="badge badge-pill badge-info" title="Current project of the task" t-esc="task.project_id.name" />
+                                </td>
+                                <td t-if="groupby != 'stage'" class="text-center">
+                                    <span class="badge badge-pill badge-info" title="Current stage of the task" t-esc="task.stage_id.name" />
+                                </td>
+                            </tr>
+                        </t>
+                    </tbody>
                 </t>
             </t>
         </t>
@@ -131,50 +147,7 @@
                     There are no tasks.
                 </div>
             </t>
-            <t t-if="grouped_tasks">
-                <t t-call="portal.portal_table">
-                    <t t-foreach="grouped_tasks" t-as="tasks">
-                        <thead>
-                            <tr t-attf-class="{{'thead-light' if not groupby == 'none' else ''}}">
-                                <th class="text-left">Ref</th>
-                                <th t-if="groupby == 'none'">Name</th>
-                                <th t-if="groupby == 'project'">
-                                    <em class="font-weight-normal text-muted"><span t-field="tasks[0].sudo().project_id.label_tasks"/> for project:</em>
-                                    <span t-field="tasks[0].sudo().project_id.name"/></th>
-                                <th t-if="groupby == 'stage'">
-                                    <em class="font-weight-normal text-muted"><span t-field="tasks[0].sudo().project_id.label_tasks"/> in stage:</em>
-                                    <span class="text-truncate" t-field="tasks[0].sudo().stage_id.name"/></th>
-                                <th t-if="groupby == 'user'">
-                                    <em class="font-weight-normal text-muted" t-if="tasks[0].sudo().user_id"><span t-field="tasks[0].sudo().project_id.label_tasks"/> assigned to:</em>
-                                    <span class="text-truncate" t-field="tasks[0].sudo().user_id.name"/></th>
-                                <th t-if="groupby == 'customer'">
-                                    <em class="font-weight-normal text-muted" t-if="tasks[0].sudo().partner_id"><span t-field="tasks[0].sudo().project_id.label_tasks"/> for customer:</em>
-                                    <span class="text-truncate" t-field="tasks[0].sudo().partner_id.name"/></th>
-                                <th t-if="groupby != 'project'" class="text-center" name="portal_my_tasks_project_th">Project</th>
-                                <th t-if="groupby != 'stage'" class="text-center">Stage</th>
-                            </tr>
-                        </thead>
-                        <tbody>
-                            <t t-foreach="tasks" t-as="task">
-                                <tr>
-                                    <td class="text-left">
-                                        #<span t-esc="task.id"/>
-                                    </td>
-                                    <td>
-                                        <a t-attf-href="/my/task/#{task.id}?{{ keep_query() }}"><span t-field="task.name"/></a>
-                                    </td>
-                                    <td t-if="groupby != 'project'" class="text-center">
-                                        <span class="badge badge-pill badge-info" title="Current project of the task" t-esc="task.project_id.name" />
-                                    </td>
-                                    <td t-if="groupby != 'stage'" class="text-center">
-                                        <span class="badge badge-pill badge-info" title="Current stage of the task" t-esc="task.stage_id.name" />
-                                    </td>
-                                </tr>
-                            </t>
-                        </tbody>
-                    </t>
-                </t>
-            </t>
+            <t t-call="project.portal_tasks_list"/>
         </t>
     </template>
 
diff --git a/addons/sale_project/controllers/portal.py b/addons/sale_project/controllers/portal.py
index bc308b9280a..bb70c8a2bf0 100644
--- a/addons/sale_project/controllers/portal.py
+++ b/addons/sale_project/controllers/portal.py
@@ -25,13 +25,6 @@ class SaleProjectCustomerPortal(ProjectCustomerPortal):
         groupby_mapping.update(sale_order='sale_order_id', sale_line='sale_line_id')
         return groupby_mapping
 
-    def _task_get_grouped_tasks(self, groupby, tasks):
-        if groupby:
-            grouped_tasks = [request.env['project.task'].concat(*g) for k, g in groupbyelem(tasks, itemgetter(groupby))]
-        else:
-            grouped_tasks = super()._task_get_grouped_tasks(groupby, tasks)
-        return grouped_tasks
-
     def _task_get_searchbar_inputs(self):
         values = super()._task_get_searchbar_inputs()
         values['sale_order'] = {'input': 'sale_order', 'label': _('Search in Sales Order'), 'order': 4}
diff --git a/addons/sale_project/views/sale_project_portal_templates.xml b/addons/sale_project/views/sale_project_portal_templates.xml
index 24a2cfa15a1..36229951f98 100644
--- a/addons/sale_project/views/sale_project_portal_templates.xml
+++ b/addons/sale_project/views/sale_project_portal_templates.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
 
-    <template id="portal_my_tasks_inherit" inherit_id="project.portal_my_tasks">
+    <template id="portal_tasks_list_inherit" inherit_id="project.portal_tasks_list">
         <xpath expr="//t[@t-call='portal.portal_table']//thead/tr/th[@name='portal_my_tasks_project_th']" position="before">
             <th t-if="groupby == 'sale_order'">
                 <em class="font-weight-normal text-muted" t-if="tasks[0].sudo().sale_order_id"><span t-field="tasks[0].sudo().project_id.label_tasks"/> for sale order:</em>