[FIX] payment: a user should see all his available partner tokens

... even if they are in a company in which he has no access rights.

Finetuning of #79253 to keep previous multi-company behavior.
We didn't consider the fact that the previous behavior was fully managed
in sudo (through request.env.user.partner, which gives a sudoed record)
and changed the behavior by using an unsudoed search.

closes odoo/odoo#80694

Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>

addons/payment/controllers/portal.py

@@ -155,25 +155,23 @@ class PaymentPortal(portal.CustomerPortal):
         :return: The rendered manage form
         :rtype: str
         """
-        partner = request.env.user.partner_id
+        partner_sudo = request.env.user.partner_id  # env.user is always sudoed
         acquirers_sudo = request.env['payment.acquirer'].sudo()._get_compatible_acquirers(
-            request.env.company.id, partner.id, force_tokenization=True, is_validation=True
+            request.env.company.id, partner_sudo.id, force_tokenization=True, is_validation=True
         )
 
         # Get all partner's tokens for which acquirers are not disabled.
-        tokens = request.env['payment.token'].search([
-            ('partner_id', 'in', [partner.id, partner.commercial_partner_id.id]),
-            ('acquirer_id', 'in', request.env['payment.acquirer'].sudo()._search([
-                ('state', 'in', ['enabled', 'test'])
-            ])
-        )])
+        tokens_sudo = request.env['payment.token'].sudo().search([
+            ('partner_id', 'in', [partner_sudo.id, partner_sudo.commercial_partner_id.id]),
+            ('acquirer_id.state', 'in', ['enabled', 'test']),
+        ])
 
-        access_token = payment_utils.generate_access_token(partner.id, None, None)
+        access_token = payment_utils.generate_access_token(partner_sudo.id, None, None)
         rendering_context = {
             'acquirers': acquirers_sudo,
-            'tokens': tokens,
+            'tokens': tokens_sudo,
             'reference_prefix': payment_utils.singularize_reference_prefix(prefix='validation'),
-            'partner_id': partner.id,
+            'partner_id': partner_sudo.id,
             'access_token': access_token,
             'transaction_route': '/payment/transaction',
             'landing_route': '/my/payment_method',

addons/payment/tests/test_flows.py

@@ -359,8 +359,7 @@ class TestFlows(PaymentCommon, PaymentHttpCommon):
         acquirer_b.state = 'test'
         token_b = self.create_token(acquirer_id=acquirer_b.id)
 
-        # A partner should see all his tokens on the /my/payment_method route,
-        # even if they are in other companies otherwise he won't ever see them.
+        # User must see both enabled acquirers and tokens
         manage_context = self.get_tx_manage_context()
         self.assertEqual(manage_context['partner_id'], self.partner.id)
         self.assertIn(self.acquirer.id, manage_context['acquirer_ids'])
@@ -374,3 +373,10 @@ class TestFlows(PaymentCommon, PaymentHttpCommon):
         self.assertEqual(manage_context['partner_id'], self.partner.id)
         self.assertEqual(manage_context['acquirer_ids'], [acquirer_b.id])
         self.assertEqual(manage_context['token_ids'], [token_b.id])
+
+        # Archived tokens must be hidden from the user
+        token_b.active = False
+        manage_context = self.get_tx_manage_context()
+        self.assertEqual(manage_context['partner_id'], self.partner.id)
+        self.assertEqual(manage_context['acquirer_ids'], [acquirer_b.id])
+        self.assertEqual(manage_context['token_ids'], [])

addons/payment/tests/test_multicompany_flows.py

@@ -69,3 +69,20 @@ class TestMultiCompanyFlows(PaymentMultiCompanyCommon, PaymentHttpCommon):
         self.assertEqual(processing_values['currency_id'], self.currency.id)
         self.assertEqual(processing_values['partner_id'], self.user_company_a.partner_id.id)
         self.assertEqual(processing_values['reference'], self.reference)
+
+    def test_full_access_to_partner_tokens(self):
+        self.partner = self.portal_partner
+
+        # Log in as user from Company A
+        self.authenticate(self.portal_user.login, self.portal_user.login)
+
+        token = self.create_token()
+        token_company_b = self.create_token(acquirer_id=self.acquirer_company_b.id)
+
+        # A partner should see all his tokens on the /my/payment_method route,
+        # even if they are in other companies otherwise he won't ever see them.
+        manage_context = self.get_tx_manage_context()
+        self.assertEqual(manage_context['partner_id'], self.partner.id)
+        self.assertEqual(manage_context['acquirer_ids'], self.acquirer.ids)
+        self.assertIn(token.id, manage_context['token_ids'])
+        self.assertIn(token_company_b.id, manage_context['token_ids'])