[FIX] account,point_of_sale: fix access error on PoS

Current behavior:
When a user has only "User" right for point of sale and no other access
some functionalities are not working properly. For example, the user
cannot create an invoice from the PoS interface. And the user cannot
use the "Ship Later" functionality.

Steps to reproduce:
- Change the right of a user to "User" for point of sale and no other
  access.
- Log in as this user and try to create an invoice from the PoS
- Try to use the "Ship Later" functionality

Note:
This commit modify the access right of the test pos_user so that it has
the minimum access to be able to use the PoS interface properly.

opw-3644739

closes odoo/odoo#153104

Signed-off-by: Vlad Stroia (vlst) <vlst@odoo.com>

addons/point_of_sale/models/pos_order.py

@@ -592,7 +592,7 @@ class PosOrder(models.Model):
                             })
 
                     else:
-                        self.env['account.move.line'].with_context(skip_invoice_sync=True).create({
+                        self.env['account.move.line'].sudo().with_context(skip_invoice_sync=True).create({
                             'balance': -rounding_applied,
                             'quantity': 1.0,
                             'partner_id': new_move.partner_id.id,
@@ -984,7 +984,7 @@ class PosOrder(models.Model):
     def _create_order_picking(self):
         self.ensure_one()
         if self.shipping_date:
-            self.lines._launch_stock_rule_from_pos_order_lines()
+            self.sudo().lines._launch_stock_rule_from_pos_order_lines()
         else:
             if self._should_create_picking_real_time():
                 picking_type = self.config_id.picking_type_id

addons/point_of_sale/security/ir.model.access.csv

@@ -57,3 +57,4 @@ access_pos_close_session_wizard,access.pos.close.session.wizard,model_pos_close_
 access_account_cash_rounding_pos_user,account.cash.rounding pos_user,account.model_account_cash_rounding,group_pos_user,1,0,0,0
 access_pos_bill,pos.bill pos_user,model_pos_bill,group_pos_user,1,1,1,1
 access_pos_daily_sales_reports_wizard,access.pos.daily.sales.reports.wizard,model_pos_daily_sales_reports_wizard,group_pos_manager,1,1,1,0
+access_account_journal_entry,account.move,model_account_move,group_pos_user,1,0,0,0

addons/point_of_sale/security/point_of_sale_security.xml

@@ -66,6 +66,12 @@
         <field name="model_id" ref="model_pos_payment" />
         <field name="domain_force">[('company_id', 'in', company_ids)]</field>
     </record>
+    <record id="rule_invoice_pos_user" model="ir.rule">
+        <field name="name">Invoice POS User</field>
+        <field name="model_id" ref="account.model_account_move" />
+        <field name="groups" eval="[(4, ref('group_pos_user'))]"/>
+        <field name="domain_force">[('pos_order_ids', '!=', False)]</field>
+    </record>
 
         <record id="base.default_user" model="res.users">
             <field name="groups_id" eval="[(4,ref('point_of_sale.group_pos_manager'))]"/>

addons/point_of_sale/static/tests/tours/PaymentScreen.tour.js

@@ -275,3 +275,21 @@ registry.category("web_tour.tours").add("PaymentScreenTotalDueWithOverPayment",
             PaymentScreen.totalDueIs("1.95"),
         ].flat(),
 });
+
+registry.category("web_tour.tours").add("InvoiceShipLaterAccessRight", {
+    test: true,
+    url: "/pos/ui",
+    steps: () =>
+        [
+            ProductScreen.confirmOpeningPopup(),
+            ProductScreen.clickHomeCategory(),
+            ProductScreen.addOrderline("Whiteboard Pen", "1"),
+            ProductScreen.clickPartnerButton(),
+            ProductScreen.clickCustomer("Deco Addict"),
+            ProductScreen.clickPayButton(),
+
+            PaymentScreen.clickPaymentMethod("Cash"),
+            PaymentScreen.clickShipLaterButton(),
+            PaymentScreen.clickValidate(),
+        ].flat(),
+});

addons/point_of_sale/static/tests/tours/helpers/PaymentScreenTourMethods.js

@@ -264,3 +264,16 @@ export function isInvoiceButtonChecked() {
         }
     ]
 }
+
+export function clickShipLaterButton() {
+    return [
+        {
+            content: 'click ship later button',
+            trigger: '.button:contains("Ship Later")',
+        },
+        {
+            content: 'click confirm button',
+            trigger: '.button.confirm',
+        },
+    ]
+}

addons/point_of_sale/tests/test_frontend.py

@@ -48,7 +48,6 @@ class TestPointOfSaleHttpCommon(AccountTestInvoicingHttpCommon):
             'groups_id': [
                 (4, cls.env.ref('base.group_user').id),
                 (4, cls.env.ref('point_of_sale.group_pos_user').id),
-                (4, cls.env.ref('account.group_account_invoice').id),
             ],
         })
         cls.pos_admin = cls.env['res.users'].create({