Permission error when attaching a file on ai_oca_bridge

[yoadria]

Module

ai_oca_bridge

Describe the bug

When a bridge sends a post_message with attachment_ids in its JSON, it returns a 400 error.

INFO devel werkzeug: 51.75.157.34 - - [20/Aug/2025 10:37:55] "POST /ai/response/7/26833a97271259d6621224345edd32c34e83d799a37d5b4e454d4bf7bac0e724 HTTP/1.0" 400 - 23 0.023 0.026

Investigating this, it occurs if the file related to the attachment_ids belongs to a model that the user does not have permissions for.

To Reproduce

Affected versions: 16.0

Steps to reproduce the behavior:

1. Create and configure an AI bridge with a user who does not have administrator permissions
   • usage: thread
   • result kind: asynchronous
   • result type: post a message
2. Activate the bridge that has been created.
3. Send the following JSON to the ‘_response_url’ that it sends you:

{
    "body": "attachment",
    "message_type": "comment",
    "subtype_xmlid": "mail.mt_comment",
    "attachment_ids": [1]
}

Expected behavior
The bridge is functioning normally, but the message will not appear.

Additional context
Running on doodba, using odoo OCB v16. Only repo available is OCA/ai

[github-actions]

There hasn't been any activity on this issue in the past 6 months, so it has been marked as stale and it will be closed automatically if no further activity occurs in the next 30 days.
If you want this issue to never become stale, please ask a PSC member to apply the "no stale" label.