[FIX] auth_signup: added a check for internal_user

add a write permission check on internal user to quietly dismiss the
error upon landing on the user page

closes odoo/odoo#127094

X-original-commit: ec85785b4629b474d96d070a5a8b44b9ba5f9dcb
Signed-off-by: Vranckx Florian (flvr) <flvr@odoo.com>

addons/auth_signup/models/res_partner.py

@@ -48,6 +48,8 @@ class ResPartner(models.Model):
         for partner in self:
             if any(u._is_internal() for u in partner.user_ids if u != self.env.user):
                 self.env['res.users'].check_access_rights('write')
+            if any(u.has_group('base.group_portal') for u in partner.user_ids if u != self.env.user):
+                self.env['res.partner'].check_access_rights('write')
             partner.signup_url = result.get(partner.id, False)
 
     def _compute_token(self):

addons/auth_signup/tests/test_auth_signup.py

@@ -6,6 +6,7 @@ from unittest.mock import patch
 import odoo
 from odoo.tests import HttpCase
 from odoo import http
+from odoo.exceptions import AccessError
 
 class TestAuthSignupFlow(HttpCase):
 
@@ -52,3 +53,13 @@ class TestAuthSignupFlow(HttpCase):
             self.assertTrue(new_user)
             mail = self.env['mail.message'].search([('message_type', '=', 'email'), ('model', '=', 'res.users'), ('res_id', '=', new_user.id)], limit=1)
             self.assertTrue(mail, "The new user must be informed of his registration")
+
+    def test_compute_signup_url(self):
+        user = self.env.ref('base.user_demo')
+        user.groups_id -= self.env.ref('base.group_partner_manager')
+
+        partner = self.env.ref('base.partner_demo_portal')
+        partner.signup_prepare()
+
+        with self.assertRaises(AccessError):
+            partner.with_user(user.id).signup_url