[16.0][IMP] helpdesk_mgmt_fieldservice: review fsm_order_close_wizard security

helpdesk_mgmt_fieldservice/models/fsm_order.py

@@ -3,17 +3,31 @@
 # License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
 
 from odoo import fields, models
+from odoo.exceptions import AccessError
 
 
 class FSMOrder(models.Model):
     _inherit = "fsm.order"
 
     ticket_id = fields.Many2one("helpdesk.ticket", string="Ticket", tracking=True)
 
+    def _check_tickets_access(self):
+        """The current user can access the tickets of `self`."""
+        tickets = self.ticket_id
+        try:
+            tickets.check_access_rights("write")
+            tickets.check_access_rule("write")
+        except AccessError:
+            can_access_tickets = False
+        else:
+            can_access_tickets = True
+        return can_access_tickets
+
     def action_complete(self):
         res = super().action_complete()
         if (
-            not self.ticket_id.stage_id.closed
+            self._check_tickets_access()
+            and not self.ticket_id.stage_id.closed
             and self.ticket_id.fsm_order_ids
             and all(self.ticket_id.mapped("fsm_order_ids.stage_id.is_closed"))
         ):
@@ -24,7 +38,6 @@ def action_complete(self):
                 "target": "new",
                 "context": {
                     "default_ticket_id": self.ticket_id.id,
-                    "default_team_id": self.ticket_id.team_id.id,
                     "default_resolution": self.resolution,
                 },
             }

helpdesk_mgmt_fieldservice/security/ir.model.access.csv

@@ -1,3 +1,3 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_helpdesk_ticket_fsm_user,helpdesk.ticket.fsm.user,model_helpdesk_ticket,fieldservice.group_fsm_user,1,0,0,0
-access_fsm_order_close_wizard,fsm.order.close.wizard,model_fsm_order_close_wizard,fieldservice.group_fsm_user,1,1,1,0
+access_fsm_order_close_wizard,fsm.order.close.wizard,model_fsm_order_close_wizard,fieldservice.group_fsm_user_own,1,1,1,0

helpdesk_mgmt_fieldservice/tests/test_helpdesk_ticket_fsm_order.py

@@ -4,6 +4,8 @@
 from odoo.exceptions import ValidationError
 from odoo.tests.common import Form, TransactionCase
 
+from odoo.addons.mail.tests.common import mail_new_test_user
+
 
 class TestHelpdeskTicketFSMOrder(TransactionCase):
     @classmethod
@@ -15,6 +17,13 @@ def setUpClass(cls):
         cls.partner = cls.env["res.partner"].create({"name": "Partner 1"})
         cls.user_demo = cls.env.ref("base.user_demo")
         cls.HelpdeskTicketTeam = cls.env["helpdesk.ticket.team"]
+        cls.all_doc_group_xmlid = "fieldservice.group_fsm_user"
+        cls.own_doc_group_xmlid = "fieldservice.group_fsm_user_own"
+        cls.own_doc_user = mail_new_test_user(
+            cls.env,
+            login="test fieldservice user own documents",
+            groups=cls.own_doc_group_xmlid,
+        )
         cls.fsm_team = cls.env["fsm.team"].create({"name": "FSM Team"})
         cls.fsm_stage_new = cls.env.ref("fieldservice.fsm_stage_new")
         cls.fsm_stage_cancelled = cls.env.ref("fieldservice.fsm_stage_cancelled")
@@ -134,7 +143,6 @@ def test_helpdesk_ticket_fsm_order(self):
             action_complete_last_order["context"],
             {
                 "default_ticket_id": self.ticket_1.id,
-                "default_team_id": self.team_id.id,
                 "default_resolution": "Just another resolution",
             },
         )
@@ -174,3 +182,20 @@ def test_can_not_close_ticket_if_only_some_fsm_order_are_closed(self):
             ValidationError, "Please complete all service orders"
         ):
             self.ticket_1.stage_id = self.stage_closed
+
+    def test_user_own_close_wizard(self):
+        """A user that can only access their own documents,
+        can close an order."""
+        # Arrange
+        user = self.own_doc_user
+        fsm_order = self._create_ticket_fsm_orders(self.ticket_1)
+        # pre-condition
+        self.assertNotEqual(fsm_order.stage_id, self.stage_completed)
+        self.assertTrue(user.has_group(self.own_doc_group_xmlid))
+        self.assertFalse(user.has_group(self.all_doc_group_xmlid))
+
+        # Act
+        fsm_order.with_user(user).action_complete()
+
+        # Assert
+        self.assertEqual(fsm_order.stage_id, self.stage_completed)

helpdesk_mgmt_fieldservice/wizards/fsm_order_close_wizard.py

@@ -10,7 +10,6 @@ class FSMOrderCloseWizard(models.TransientModel):
     _description = "FSM Close - Option to Close Ticket"
 
     resolution = fields.Text()
-    team_id = fields.Many2one("helpdesk.ticket.team", string="Helpdesk Team")
     stage_id = fields.Many2one("helpdesk.ticket.stage", string="Stage")
     ticket_id = fields.Many2one("helpdesk.ticket", string="Ticket")
 

helpdesk_mgmt_fieldservice/wizards/fsm_order_close_wizard.xml

@@ -11,13 +11,7 @@
                   There is an open Ticket, would you like to update the related ticket?
               </div>
               <group>
-                  <field name="team_id" invisible="1" />
                   <field name="ticket_id" invisible="1" />
-<!--                  <field name="stage_id"-->
-<!--                         string="Ticket Stage"-->
-<!--                         required="1"-->
-<!--                         domain="[('team_ids', '=', team_id)]"-->
-<!--                         options="{'no_create': True, 'no_open': True, 'no_create_edit': True}"/>-->
                   <field
                         name="stage_id"
                         string="Ticket Stage"