[FIX] web: deal with can_create and can_write option in M2O

The server postproccess the view to add attributes on many2one fields, i.e.
`can_create` and `can_write`, according to access rights.

These attributes are parsed by the client as string but should also be parsed by
the many2one when evaluating them.

The mock server has also been adapted to set these attributes.

addons/web/static/src/js/fields/relational_fields.js

@@ -93,8 +93,12 @@ var FieldMany2One = AbstractField.extend({
         this._super.apply(this, arguments);
         this.limit = 7;
         this.orderer = new concurrency.DropMisordered();
-        this.can_create = ('can_create' in this.attrs ? this.attrs.can_create : true) && !this.nodeOptions.no_create;
-        this.can_write = 'can_write' in this.attrs ? this.attrs.can_write : true;
+
+        // should normally also be set, except in standalone M20
+        this.can_create = ('can_create' in this.attrs ? JSON.parse(this.attrs.can_create) : true) &&
+            !this.nodeOptions.no_create;
+        this.can_write = 'can_write' in this.attrs ? JSON.parse(this.attrs.can_write) : true;
+
         this.nodeOptions = _.defaults(this.nodeOptions, {
             quick_create: true,
         });

addons/web/static/tests/fields/relational_fields_tests.js

@@ -1362,6 +1362,56 @@ QUnit.module('relational_fields', {
         form.destroy();
     });
 
+    QUnit.test('can_create and can_write option on a many2one', function (assert) {
+        assert.expect(5);
+
+        this.data.product.options = {
+            can_create: "false",
+            can_write: "false",
+        };
+
+        var form = createView({
+            View: FormView,
+            model: 'partner',
+            data: this.data,
+            arch: '<form string="Partners">' +
+                        '<sheet>' +
+                            '<field name="product_id" can_create="false" can_write="false"/>' +
+                        '</sheet>' +
+                '</form>',
+            archs: {
+                'product,false,form': '<form string="Products"><field name="display_name"/></form>',
+            },
+            mockRPC: function (route) {
+                if (route === '/web/dataset/call_kw/product/get_formview_id') {
+                    return $.when(false);
+                }
+                return this._super.apply(this, arguments);
+            },
+        });
+
+        form.$('.o_field_many2one input').click();
+        assert.strictEqual($('.ui-autocomplete .o_m2o_dropdown_option:contains(Create)').length, 0,
+            "there shouldn't be any option to search and create");
+
+        $('.ui-autocomplete li:contains(xpad)').mouseenter().click();
+        assert.strictEqual(form.$('.o_field_many2one input').val(), "xpad",
+            "the correct record should be selected");
+        assert.strictEqual(form.$('.o_field_many2one .o_external_button').length, 1,
+            "there should be an external button displayed");
+
+        form.$('.o_field_many2one .o_external_button').click();
+        assert.strictEqual($('.modal .o_form_view.o_form_readonly').length, 1,
+            "there should be a readonly form view opened");
+
+        $('.modal .o_form_button_cancel').click();
+
+        form.$('.o_field_many2one input').val('new product').trigger('keyup').trigger('focusout');
+
+        assert.strictEqual($('.modal').length, 0, "should not display the create modal");
+        form.destroy();
+    });
+
     QUnit.test('pressing enter in a m2o in an editable list', function (assert) {
         assert.expect(9);
         var done = assert.async();

addons/web/static/tests/helpers/mock_server.js

@@ -255,6 +255,10 @@ var MockServer = Class.extend({
         var relModel, relFields;
         _.each(fieldNodes, function (node, name) {
             var field = fields[name];
+            if (field.type === "many2one" || field.type === "many2many") {
+                node.attrs.can_create = node.attrs.can_create || "true";
+                node.attrs.can_write = node.attrs.can_write || "true";
+            }
             if (field.type === "one2many" || field.type === "many2many") {
                 field.views = {};
                 _.each(node.children, function (children) {