[FIX] website_sale: fix accessory_product

Accessory product was showed to user in cart
even when it was unpublished, now it's only
showed to internal user if unpublished.
task-3218286

closes odoo/odoo#139358

X-original-commit: b1f617135d64875d8306387482ddea535dcff1bc
Signed-off-by: anko-odoo <anko@odoo.com>

addons/website_sale/models/product_template.py

@@ -175,6 +175,8 @@ class ProductTemplate(models.Model):
 
     def _get_website_accessory_product(self):
         domain = self.env['website'].sale_product_domain()
+        if not self.env.user._is_internal():
+            domain = expression.AND([domain, [('is_published', '=', True)]])
         return self.accessory_product_ids.filtered_domain(domain)
 
     def _get_website_alternative_product(self):

addons/website_sale/tests/test_website_sale_cart.py

@@ -4,6 +4,8 @@ from odoo.addons.website_sale.controllers.main import WebsiteSale, PaymentPortal
 from odoo.addons.website.tools import MockRequest
 from odoo.exceptions import UserError
 from odoo.tests.common import TransactionCase, tagged
+from odoo.fields import Command
+
 
 @tagged('post_install', '-at_install')
 class WebsiteSaleCart(TransactionCase):
@@ -110,3 +112,23 @@ class WebsiteSaleCart(TransactionCase):
 
             self.WebsiteSaleController.cart_update_json(product_id=product.id, add_qty=0)
             self.assertEqual(sale_order.order_line, SaleOrderLine)
+
+    def test_unpublished_accessory_product_visibility(self):
+        # Check if unpublished product is shown to public user
+        accessory_product = self.env['product.product'].create({
+            'name': 'Access Product',
+            'is_published': False,
+        })
+
+        product = self.env['product.product'].create({
+            'name': 'Test Product',
+            'sale_ok': True,
+            'website_published': True,
+            'accessory_product_ids': [Command.link(accessory_product.id)]
+        })
+
+        website = self.website.with_user(self.public_user)
+        with MockRequest(product.with_user(self.public_user).env, website=self.website.with_user(self.public_user)):
+            self.WebsiteSaleController.cart_update_json(product_id=product.id, add_qty=1)
+            sale_order = website.sale_get_order()
+            self.assertEqual(len(sale_order._cart_accessories()), 0)