[FIX] hr: change user on employee Access Error

Issue

    Admin unable to change related user on employee profile due to
    restricted access to bank account.

Steps to reproduce

    1- In the Employee app, go to the HR settings tab of an employee.
    2- Remove the related user from this profile.
    3- Set that removed user as the related user on a different employee
        profile and save (expect no error).
    4- Attempt to revert back to the original user.
    5- Encounter an access error.

resolution

    - Added sudo() in the browse operation to prevent access errors.

opw-3578412

closes odoo/odoo#147993

X-original-commit: 2b27b740ec3cff2fc088f4d01d7347668f6eb441
Signed-off-by: Sofie Gvaladze (sgv) <sgv@odoo.com>
Signed-off-by: Kawtar Drissi El Bouzaidi (kdeb) <kdeb@odoo.com>

addons/hr/models/hr_employee.py

@@ -410,11 +410,11 @@ class HrEmployeePrivate(models.Model):
         if 'work_contact_id' in vals:
             account_ids = vals.get('bank_account_id') or self.bank_account_id.ids
             if account_ids:
-                bank_accounts = self.env['res.partner.bank'].browse(account_ids)
+                bank_accounts = self.env['res.partner.bank'].sudo().browse(account_ids)
                 for bank_account in bank_accounts:
                     if vals['work_contact_id'] != bank_account.partner_id.id:
                         if bank_account.allow_out_payment:
-                            bank_account.sudo().allow_out_payment = False
+                            bank_account.allow_out_payment = False
                         if vals['work_contact_id']:
                             bank_account.partner_id = vals['work_contact_id']
             self.message_unsubscribe(self.work_contact_id.ids)

addons/hr/tests/test_hr_employee.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
-from odoo.tests import Form
+from odoo.tests import Form, users
 from odoo.addons.hr.tests.common import TestHrCommon
 
 
@@ -209,3 +209,36 @@ class TestHrEmployee(TestHrCommon):
         employee_B.work_email = 'new_email@example.com'
         self.assertEqual(employee_A.work_email, 'employee_A@example.com')
         self.assertEqual(employee_B.work_email, 'new_email@example.com')
+
+    @users('admin')
+    def test_change_user_on_employee(self):
+        test_other_user = self.env['res.users'].create({
+            'name': 'Test Other User',
+            'login': 'test_other_user',
+        })
+        test_other_user.partner_id.company_id = self.env.company
+        test_company = self.env['res.company'].create({
+            'name' : 'Test User Company',
+        })
+        self.env.user.write({'company_ids': test_company.ids, 'company_id': test_company.id})
+        test_user = self.env['res.users'].create({
+            'name': 'Test User',
+            'login': 'test_user',
+        })
+        test_user.partner_id.company_id = test_company
+        bank_account = self.env['res.partner.bank'].create({
+            'acc_number' : '1234567',
+            'partner_id' : test_user.partner_id.id,
+        })
+        test_employee = self.env['hr.employee'].create({
+            'name': 'Test User - employee',
+            'user_id': test_user.id,
+            'company_id': test_company.id,
+            'bank_account_id': bank_account.id,
+        })
+        # change user -> bank account change company
+        with Form(test_employee) as employee_form:
+            employee_form.user_id = test_other_user
+        # change user back -> check that there is no company error
+        with Form(test_employee) as employee_form:
+            employee_form.user_id = test_user

addons/hr/views/hr_employee_views.xml

@@ -189,7 +189,7 @@
                                 <group>
                                     <group string='Status' name="active_group">
                                         <field name="employee_type"/>
-                                        <field name="user_id" string="Related User" domain="[('share', '=', False)]" context="{'default_create_employee_id': id}" widget="many2one_avatar_user"/>
+                                        <field name="user_id" string="Related User" domain="[('company_ids', 'in', company_id), ('share', '=', False)]" context="{'default_create_employee_id': id}" widget="many2one_avatar_user"/>
                                     </group>
                                     <group string="Attendance/Point of Sale" name="identification_group">
                                         <field name="pin" string="PIN Code"/>