[FIX] point_of_sale: incorrect Closing Control for limited access users

Steps to reproduce the issue:

 1. Install modules "point_of_sale", "sale", and "account_accountant"
 2. Create a user with only "Point Of Sale User" and "Sales User: Own
    Documents Only" access
 3. Open a point of sale session and input a different opening amount
=> This resulted in incorrect information being displayed in the
   "Closing Control"

opw-3188250

closes odoo/odoo#116877

X-original-commit: dc494bc8e68ddde361e0f73b4b2593a59fdeccba
Signed-off-by: Trinh Jacky (trj) <trj@odoo.com>
Signed-off-by: Pedram Bi Ria (pebr) <pebr@odoo.com>

addons/point_of_sale/i18n/point_of_sale.pot

@@ -7201,3 +7201,9 @@ msgstr ""
 #, python-format
 msgid "were duplicates of existing orders"
 msgstr ""
+
+#. module: point_of_sale
+#: code:addons/point_of_sale/models/pos_session.py:0
+#, python-format
+msgid "You don't have the access rights to get the point of sale closing control data."
+msgstr ""

addons/point_of_sale/models/pos_session.py

@@ -284,8 +284,8 @@ class PosSession(models.Model):
         bank_payment_method_diffs = bank_payment_method_diffs or {}
         self.ensure_one()
         sudo = self.user_has_groups('point_of_sale.group_pos_user')
-        if self.order_ids or self.statement_line_ids:
-            self.cash_real_transaction = sum(self.statement_line_ids.mapped('amount'))
+        if self.order_ids or self.sudo().statement_line_ids:
+            self.cash_real_transaction = sum(self.sudo().statement_line_ids.mapped('amount'))
             if self.state == 'closed':
                 raise UserError(_('This session is already closed.'))
             self._check_if_no_draft_orders()
@@ -525,6 +525,8 @@ class PosSession(models.Model):
                 return {'successful': False, 'message': message, 'redirect': False}
 
     def get_closing_control_data(self):
+        if not self.env.user.has_group('point_of_sale.group_pos_user'):
+            raise AccessError(_("You don't have the access rights to get the point of sale closing control data."))
         self.ensure_one()
         orders = self.order_ids.filtered(lambda o: o.state == 'paid' or o.state == 'invoiced')
         payments = orders.payment_ids.filtered(lambda p: p.payment_method_id.type != "pay_later")
@@ -537,7 +539,7 @@ class PosSession(models.Model):
         cash_out_count = 0
         cash_in_out_list = []
         last_session = self.search([('config_id', '=', self.config_id.id), ('id', '!=', self.id)], limit=1)
-        for cash_move in self.statement_line_ids.sorted('create_date'):
+        for cash_move in self.sudo().statement_line_ids.sorted('create_date'):
             if cash_move.amount > 0:
                 cash_in_count += 1
                 name = f'Cash in {cash_in_count}'
@@ -561,7 +563,7 @@ class PosSession(models.Model):
                 'name': default_cash_payment_method_id.name,
                 'amount': last_session.cash_register_balance_end_real
                           + total_default_cash_payment_amount
-                          + sum(self.statement_line_ids.mapped('amount')),
+                          + sum(self.sudo().statement_line_ids.mapped('amount')),
                 'opening': last_session.cash_register_balance_end_real,
                 'payment_amount': total_default_cash_payment_amount,
                 'moves': cash_in_out_list,