[FIX] web: ignore allowed company from session storage

When switching the company, if the displayed action hasn't any
identifier, the RPC will be based on the previous company.

To reproduce the issue:
(Need stock. Use demo data)
1. Inventory > Operations > Inventory Adjustments
2. Enable the column 'Company'
3. Switch the company to "My Company (Chicago)"

Error: The quants of "My Company (San Fransisco)" are listed -> this
does not respect the selected company

On step 1, when clicking on Inventory Adjustment, it loads a Server
Action that returns another action:
https://github.com/odoo/odoo/blob/68657a85eb09dd306feab91d805b8c21eb75010f/addons/stock/views/stock_quant_views.xml#L356-L364
The returned action is a Window Action built on PY-side:
https://github.com/odoo/odoo/blob/b5d16141dc48d4379452ea40e167f3b00f956c20/addons/stock/models/stock_quant.py#L283-L300
So this Window Action hasn't any identifier (there isn't any
`action=...` in the URL)

Later on, when reloading the page (because of the company switch), we
try to load the action. To do so, we first call `_getActionParams`. In
this method, we take the current state and try to extract some
information. Because there isn't any action defined on the state (as
explained in the previous paragraph), we use the `current_action` stored
in the session storage (i.e., the window action returned by the server):
https://github.com/odoo/odoo/blob/590fa18cafe2c7bbd109692f564c2175ca6d820c/addons/web/static/src/webclient/actions/action_service.js#L294-L302
And here is the issue: the stored action contains its context and this
context contains the `allowed_company_ids` key (-> with the previous
company)

As a result, when performing the search_read to get all the quants of
the view:
https://github.com/odoo/odoo/blob/f5ba34e45b66e0fccc2559bf434e255d38a0faa0/addons/web/static/src/legacy/js/views/basic/basic_model.js#L5016-L5025
And when getting the context, it leads to `_getEvalContext`
https://github.com/odoo/odoo/blob/f5ba34e45b66e0fccc2559bf434e255d38a0faa0/addons/web/static/src/legacy/js/views/basic/basic_model.js#L3716-L3728
We apply the user context (which contains the correct value for the
company) and then apply the element context (which contains the
incorrect one, as explained above)
This explains why it will display the quants of the previously-selected
company.

OPW-2871086

closes odoo/odoo#94039

closes odoo/odoo#96161

Signed-off-by: Géry Debongnie <ged@odoo.com>

addons/web/static/src/webclient/actions/action_service.js

@@ -311,6 +311,11 @@ function makeActionManager(env) {
                 const storedAction = browser.sessionStorage.getItem("current_action");
                 const lastAction = JSON.parse(storedAction || "{}");
                 if (lastAction.res_model === state.model) {
+                    if (lastAction.context) {
+                        // If this method is called because of a company switch, the
+                        // stored allowed_company_ids is incorrect.
+                        delete lastAction.context.allowed_company_ids;
+                    }
                     actionRequest = lastAction;
                     options.viewType = state.view_type;
                 }

addons/web/static/tests/webclient/actions/misc_tests.js

@@ -1,6 +1,8 @@
 /** @odoo-module **/
 
+import { browser } from "@web/core/browser/browser";
 import { registry } from "@web/core/registry";
+import { session } from "@web/session";
 import AbstractAction from "web.AbstractAction";
 import core from "web.core";
 import testUtils from "web.test_utils";
@@ -22,6 +24,7 @@ import {
 } from "./../helpers";
 import * as cpHelpers from "@web/../tests/search/helpers";
 import { listView } from "@web/views/list/list_view";
+import { companyService } from "@web/webclient/company_service";
 
 let serverData;
 let target;
@@ -546,4 +549,51 @@ QUnit.module("ActionManager", (hooks) => {
             assert.containsN(document.body, ".modal .o_form_view", 2);
         }
     );
+
+    QUnit.test(
+        "retrieving a stored action should remove 'allowed_company_ids' from its context",
+        async function (assert) {
+            // Prepare a multi company scenario
+            session.user_companies = {
+                allowed_companies: {
+                    3: { id: 3, name: "Hermit", sequence: 1 },
+                    2: { id: 2, name: "Herman's", sequence: 2 },
+                    1: { id: 1, name: "Heroes TM", sequence: 3 },
+                },
+                current_company: 3,
+            };
+            registry.category("services").add("company", companyService);
+
+            // Prepare a stored action
+            browser.sessionStorage.setItem(
+                "current_action",
+                JSON.stringify({
+                    ...serverData.actions[1],
+                    context: {
+                        someKey: 44,
+                        allowed_company_ids: [1, 2],
+                        lang: "not_en",
+                        tz: "not_taht",
+                        uid: 42,
+                    },
+                })
+            );
+
+            // Prepare the URL hash to make sure the stored action will get executed.
+            browser.location.hash = "#model=partner&view_type=kanban";
+
+            // Create the web client. It should execute the stored action.
+            const webClient = await createWebClient({ serverData });
+
+            // Check the current action context
+            assert.deepEqual(webClient.env.services.action.currentController.action.context, {
+                // action context
+                someKey: 44,
+                lang: "not_en",
+                tz: "not_taht",
+                uid: 42,
+                // note there is no 'allowed_company_ids' in the action context
+            });
+        }
+    );
 });