[FW][FIX] project: remove uneccessary read access for portal user

Before this commit, the portal user can read the `project.update`
and `project.milestone` records but there is no reason to grant this
access for those models.

This commit removes the read access for thoses models since we don't
show the data in its portal.

X-original-commit: f0331531826974ddaab5dff28739115c37a351c0
Forward-port-of: #88546
Forward-port-of: #88509
Part-of: odoo/odoo#88819

addons/project/security/ir.model.access.csv

@@ -31,11 +31,11 @@ access_project_task_recurrence,project.task.recurrence,model_project_task_recurr
 project.access_project_task_burndown_chart_report,access_project_task_burndown_chart_report,project.model_project_task_burndown_chart_report,project.group_project_manager,1,1,1,1
 project.access_project_task_burndown_chart_report_user,access_project_task_burndown_chart_report_user,project.model_project_task_burndown_chart_report,project.group_project_user,1,0,0,0
 access_project_update_user,project.update.user,model_project_update,base.group_user,1,0,0,0
-access_project_update_portal,project.update.portal,model_project_update,base.group_portal,1,0,0,0
+access_project_update_portal,project.update.portal,model_project_update,base.group_portal,0,0,0,0
 access_project_update_project_user,project.update.project.user,model_project_update,project.group_project_user,1,1,1,1
 access_project_update_project_manager,project.update.project.manager,model_project_update,project.group_project_manager,1,1,1,1
 access_project_milestone_user,project.milestone.user,model_project_milestone,base.group_user,1,0,0,0
-access_project_milestone_portal,project.milestone.portal,model_project_milestone,base.group_portal,1,0,0,0
+access_project_milestone_portal,project.milestone.portal,model_project_milestone,base.group_portal,0,0,0,0
 access_project_milestone_project_user,project.milestone.project.user,model_project_milestone,project.group_project_user,1,1,1,1
 access_project_milestone_project_manager,project.milestone.project.manager,model_project_milestone,project.group_project_manager,1,1,1,1
 access_project_collaborator_manager,project.collaborator.manager,model_project_collaborator,project.group_project_manager,1,1,1,1

addons/project/tests/test_project_update_access_rights.py

@@ -17,9 +17,14 @@ class TestProjectUpdateAccessRights(TestProjectCommon):
             'project_id': cls.project_pigs.id,
             'status': 'on_track',
         })
+        cls.project_milestone = cls.env['project.milestone'].create({
+            'name': 'Test Projec Milestone',
+            'project_id': cls.project_pigs.id,
+        })
         cls.base_user = mail_new_test_user(cls.env, 'Base user', groups='base.group_user')
         cls.project_user = mail_new_test_user(cls.env, 'Project user', groups='project.group_project_user')
         cls.project_manager = mail_new_test_user(cls.env, 'Project admin', groups='project.group_project_manager')
+        cls.portal_user = mail_new_test_user(cls.env, 'Portal user', groups='base.group_portal')
 
     @users('Project user', 'Project admin', 'Base user')
     def test_project_update_user_can_read(self):
@@ -42,3 +47,50 @@ class TestProjectUpdateAccessRights(TestProjectCommon):
     @users('Project admin')
     def test_project_update_admin_unlink(self):
         self.project_update_1.with_user(self.env.user).unlink()
+
+    @users('Portal user')
+    def test_project_update_portal_user_no_read(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to read in the project update"):
+            self.project_update_1.with_user(self.env.user).name
+
+    @users('Portal user')
+    def test_project_update_portal_user_no_write(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to write in the project update"):
+            self.project_update_1.with_user(self.env.user).name = 'Test write'
+
+    @users('Portal user')
+    def test_project_update_portal_user_no_create(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to create in the project update model"):
+            self.env['project.update'].with_user(self.env.user).create({
+                'name': 'Test Create with portal user',
+                'project_id': self.project_pigs.id,
+                'state': 'on_track',
+            })
+
+    @users('Portal user')
+    def test_project_update_portal_user_no_unlink(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to unlink in the project update"):
+            self.project_update_1.with_user(self.env.user).unlink()
+
+    @users('Portal user')
+    def test_project_milestone_portal_user_no_read(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to read in the project update"):
+            self.project_milestone.with_user(self.env.user).name
+
+    @users('Portal user')
+    def test_project_milestone_portal_user_no_write(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to write in the project update"):
+            self.project_milestone.with_user(self.env.user).name = 'Test write'
+
+    @users('Portal user')
+    def test_project_milestone_portal_user_no_create(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to create in the project update model"):
+            self.env['project.update'].with_user(self.env.user).create({
+                'name': 'Test Create with portal user',
+                'project_id': self.project_pigs.id,
+            })
+
+    @users('Portal user')
+    def test_project_milestone_portal_user_no_unlink(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to unlink in the project update"):
+            self.project_milestone.with_user(self.env.user).unlink()