[FIX] auth_signup: fix password reset

Steps to reproduce:
- generate password reset link
- access the link
- the page redirects to login

Bug:
password reset and new account creation share the same path
this commit [1] made it so when you click on the new account link after
it was activated you are redirected to login

Fix:
the distinction between both scenarios is made using the presence of
'signup_email' in the query.
only add signup_email when creating a new account

opw-3068790
[1]:https://github.com/odoo/odoo/commit/97658791306349456761ba4c18d504f861e3bb98

closes odoo/odoo#108093

X-original-commit: 3ba02fbeb54afc0ebd5ab434cdf921159646e9d0
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>
Signed-off-by: Walid Hanniche (waha) <waha@odoo.com>

addons/auth_signup/models/res_partner.py

@@ -58,7 +58,10 @@ class ResPartner(models.Model):
 
             route = 'login'
             # the parameters to encode for the query
-            query = {'db': self.env.cr.dbname, 'signup_email': partner.email}
+            query = {'db': self.env.cr.dbname}
+            if self.env.context.get('create_user'):
+                query['signup_email'] = partner.email
+
             signup_type = self.env.context.get('signup_force_type_in_url', partner.sudo().signup_type or '')
             if signup_type:
                 route = 'reset_password' if signup_type == 'reset' else signup_type

addons/auth_signup/tests/__init__.py

@@ -1 +1,2 @@
 from . import test_login
+from . import test_reset_password

addons/auth_signup/tests/test_reset_password.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+from odoo.tests.common import HttpCase
+from werkzeug.urls import url_parse
+
+
+class TestResetPassword(HttpCase):
+
+    def test_reset_password(self):
+        """
+            Test that first signup link and password reset link are different to accomodate for the different behaviour
+            on first signup if a password is already set user is redirected to login page when accessing that link again
+            'signup_email' is used in the web controller (web_auth_reset_password) to detect this behaviour
+        """
+        test_user = self.env['res.users'].create({
+            'login': 'test',
+            'name': 'The King',
+            'email': 'noop@example.com',
+        })
+
+        self.assertEqual(test_user.email, url_parse(test_user.signup_url).decode_query()["signup_email"], "query must contain 'signup_email'")
+
+        # Invalidate signup_url to skip signup process
+        self.env.invalidate_all()
+        test_user.action_reset_password()
+
+        self.assertNotIn("signup_email", url_parse(test_user.signup_url).decode_query(), "query should not contain 'signup_email'")