[FIX] mail: allow searching on message_partner_ids for portal

Because we now check groups in the domain, some searches raise
`AccessError` when using `message_partner_ids` in the domain for the
portal user:
- https://github.com/odoo/odoo/blob/4d1a1f1c99d6055b60921ce464b72f0f4d9bbfe2/addons/sale/controllers/portal.py#L35
- https://github.com/odoo/odoo/blob/4d1a1f1c99d6055b60921ce464b72f0f4d9bbfe2/addons/sale/controllers/portal.py#L41
- https://github.com/odoo/odoo/blob/ba1a5509fa49fd846739252d16083dd8cb334b53/addons/website_forum/models/forum_post.py#L831
- https://github.com/odoo/odoo/blob/86b43bcfa6c9a5b6ac1b3ac9ba0c308f1169ea3b/addons/hr_timesheet/models/hr_timesheet.py#L41

Since there are many invalid domains and it is impossible to sudo only
part of the domain, it is easier to override `_flush_search` to allow
`message_partner_ids` in search domain leafs with some restriction.

closes odoo/odoo#135111

Related: odoo/enterprise#47822
Signed-off-by: Raphael Collet <rco@odoo.com>

addons/crm/tests/test_performances.py

@@ -95,7 +95,7 @@ class TestLeadAssignPerf(TestLeadAssignCommon):
 
         # randomness: at least 1 query
         with self.with_user('user_sales_manager'):
-            with self.assertQueryCount(user_sales_manager=583):  # crm 582
+            with self.assertQueryCount(user_sales_manager=584):  # crm 582
                 self.env['crm.team'].browse(self.sales_teams.ids)._action_assign_leads(work_days=2)
 
         # teams assign

addons/mail/models/mail_thread.py

@@ -92,7 +92,8 @@ class MailThread(models.AbstractModel):
         compute='_compute_message_partner_ids',
         inverse='_inverse_message_partner_ids',
         search='_search_message_partner_ids',
-        groups='base.group_user')
+        groups='base.group_user',
+    )
     message_ids = fields.One2many(
         'mail.message', 'res_id', string='Messages',
         domain=lambda self: [('message_type', '!=', 'user_notification')], auto_join=True)
@@ -389,6 +390,28 @@ class MailThread(models.AbstractModel):
 
         return super().get_empty_list_help(help_message)
 
+    def _flush_search(self, domain, fields=None, order=None, seen=None):
+        """ Override _flush_search in order to relax field groups security
+        check on `message_partner_ids`. Accept portal user to filter
+        threads by themselves as followers.
+        """
+        if self.env.su or self.user_has_groups('base.group_user'):
+            return super()._flush_search(domain, fields, order, seen)
+
+        domain = list(domain)
+        for i, leaf in enumerate(domain):
+            if len(leaf) != 3 or leaf[0] != 'message_partner_ids':
+                continue
+            user_partner = self.env.user.partner_id
+            allow_partner_ids = set((user_partner | user_partner.commercial_partner_id).ids)
+            operand = leaf[2] if isinstance(leaf[2], (list, tuple)) else [leaf[2]]
+            if not allow_partner_ids.issuperset(operand):
+                raise AccessError("Portal users can only filter threads by themselves as followers.")
+            # Replace the leaf with dummy leaf
+            domain[i] = expression.TRUE_LEAF
+
+        return super()._flush_search(domain, fields, order, seen)
+
     # ------------------------------------------------------
     # MODELS / CRUD HELPERS
     # ------------------------------------------------------