[IMP] mail: add mailing.activity tests based on read operation

This commit adds some tests on mailing.activity to ensure reading is only
possible when the user has access to the underlying document.

Task-2272475

addons/mail/models/mail_activity.py

@@ -408,6 +408,17 @@ class MailActivity(models.Model):
                     {'type': 'activity_updated', 'activity_created': True})
         return activities
 
+    def read(self, fields=None, load='_classic_read'):
+        """ When reading specific fields, read calls _read that manually applies ir rules
+        (_apply_ir_rules), instead of calling check_access_rule.
+
+        Meaning that our custom rules enforcing from '_filter_access_rules' and
+        '_filter_access_rules_python' are bypassed in that case.
+        To make sure we apply our custom security rules, we force a call to 'check_access_rule'. """
+
+        self.check_access_rule('read')
+        return super(MailActivity, self).read(fields=fields, load=load)
+
     def write(self, values):
         if values.get('user_id'):
             user_changes = self.filtered(lambda activity: activity.user_id.id != values.get('user_id'))

addons/test_mail/tests/test_mail_activity.py

@@ -69,6 +69,28 @@ class TestActivityRights(TestActivityCommon):
                 raise exceptions.AccessError('Hop hop hop Ernest, please step back.')
             return DEFAULT
 
+        test_activity = self.env['mail.activity'].with_user(self.user_admin).create({
+            'activity_type_id': self.env.ref('test_mail.mail_act_test_todo').id,
+            'res_model_id': self.env.ref('test_mail.model_mail_test_activity').id,
+            'res_id': self.test_record.id,
+            'user_id': self.user_admin.id,
+            'summary': 'Summary',
+        })
+
+        # cannot read activities if no access to the document
+        with patch.object(MailTestActivity, 'check_access_rights', autospec=True, side_effect=_employee_crash):
+            with self.assertRaises(exceptions.AccessError):
+                searched_activity = self.env['mail.activity'].with_user(self.user_employee).search(
+                    [('id', '=', test_activity.id)])
+                searched_activity.read(['summary'])
+
+        # cannot search_read activities if no access to the document
+        with patch.object(MailTestActivity, 'check_access_rights', autospec=True, side_effect=_employee_crash):
+            with self.assertRaises(exceptions.AccessError):
+                self.env['mail.activity'].with_user(self.user_employee).search_read(
+                    [('id', '=', test_activity.id)],
+                    ['summary'])
+
         # cannot create activities for people that cannot access record
         with patch.object(MailTestActivity, 'check_access_rights', autospec=True, side_effect=_employee_crash):
             with self.assertRaises(exceptions.UserError):