[FIX] portal_backend: add missing company fields in session_info and [FIX] portal_holidays: fix multi-company access for portal users

portal_backend/models/ir_http.py

@@ -10,10 +10,41 @@ def session_info(self):
 
         session_info = super().session_info()
         if self.env.user.has_group("portal_backend.group_portal_backend"):
+<<<<<<< 48e87b28d371901ad6ea6f896bb13dcc8bb3580d
             # Add similar session info as internal users get (adapted from native web/models/ir_http.py)
             user_companies = self.env["res.company"].browse(user._get_company_ids()).sudo()
             disallowed_ancestor_companies_sudo = user_companies.parent_ids - user_companies
             all_companies_in_hierarchy_sudo = disallowed_ancestor_companies_sudo + user_companies
+||||||| 32d3a6492d218095eca4c7bcf23257ed29a2f3bd
+            # the following is only useful in the context of a webclient bootstrapping
+            # but is still included in some other calls (e.g. '/web/session/authenticate')
+            # to avoid access errors and unnecessary information, it is only included for users
+            # with access to the backend ('internal'-type users)
+            menus = request.env["ir.ui.menu"].load_menus(request.session.debug)
+            ordered_menus = {str(k): v for k, v in menus.items()}
+            menu_json_utf8 = json.dumps(ordered_menus, default=ustr, sort_keys=True).encode()
+            session_info["cache_hashes"].update(
+                {
+                    "load_menus": hashlib.sha512(menu_json_utf8).hexdigest()[:64],  # sha512/256
+                }
+            )
+=======
+            # the following is only useful in the context of a webclient bootstrapping
+            # but is still included in some other calls (e.g. '/web/session/authenticate')
+            # to avoid access errors and unnecessary information, it is only included for users
+            # with access to the backend ('internal'-type users)
+            menus = request.env["ir.ui.menu"].load_menus(request.session.debug)
+            ordered_menus = {str(k): v for k, v in menus.items()}
+            menu_json_utf8 = json.dumps(ordered_menus, default=ustr, sort_keys=True).encode()
+            session_info["cache_hashes"].update(
+                {
+                    "load_menus": hashlib.sha512(menu_json_utf8).hexdigest()[:64],  # sha512/256
+                }
+            )
+            # We need sudo since a user may not have access to ancestor companies
+            disallowed_ancestor_companies_sudo = user.company_ids.sudo().parent_ids - user.company_ids
+            all_companies_in_hierarchy_sudo = disallowed_ancestor_companies_sudo + user.company_ids
+>>>>>>> 15305f046af102d97d6b2f5f553bb93cd75e30a7
             session_info.update(
                 {
                     # current_company should be default_company
@@ -24,9 +55,15 @@ def session_info(self):
                                 "id": comp.id,
                                 "name": comp.name,
                                 "sequence": comp.sequence,
+<<<<<<< 48e87b28d371901ad6ea6f896bb13dcc8bb3580d
                                 "child_ids": (comp.child_ids & user_companies).ids,
                                 "parent_id": comp.parent_id.id,
                                 "currency_id": comp.currency_id.id,
+||||||| 32d3a6492d218095eca4c7bcf23257ed29a2f3bd
+=======
+                                "child_ids": (comp.child_ids & all_companies_in_hierarchy_sudo).ids,
+                                "parent_id": comp.parent_id.id,
+>>>>>>> 15305f046af102d97d6b2f5f553bb93cd75e30a7
                             }
                             for comp in user_companies
                         },
@@ -40,6 +77,16 @@ def session_info(self):
                             }
                             for comp in disallowed_ancestor_companies_sudo
                         },
+                        "disallowed_ancestor_companies": {
+                            comp.id: {
+                                "id": comp.id,
+                                "name": comp.name,
+                                "sequence": comp.sequence,
+                                "child_ids": (comp.child_ids & all_companies_in_hierarchy_sudo).ids,
+                                "parent_id": comp.parent_id.id,
+                            }
+                            for comp in disallowed_ancestor_companies_sudo
+                        },
                     },
                     "show_effect": True,
                 }

portal_holidays/__manifest__.py

@@ -19,7 +19,13 @@
 ##############################################################################
 {
     "name": "Portal Holidays",
+<<<<<<< 48e87b28d371901ad6ea6f896bb13dcc8bb3580d
     "version": "19.0.1.0.0",
+||||||| 32d3a6492d218095eca4c7bcf23257ed29a2f3bd
+    "version": "18.0.1.5.0",
+=======
+    "version": "18.0.1.6.0",
+>>>>>>> 15305f046af102d97d6b2f5f553bb93cd75e30a7
     "category": "Base",
     "sequence": 14,
     "summary": "",

portal_holidays/security/ir.model.access.csv

@@ -11,4 +11,3 @@ portal_holiday_resource_calendar_leaves,portal-holiday-model_resource_calendar_l
 portal_holiday_resource_resource,portal-holiday-model_resource_resource,resource.model_resource_resource,group_portal_backend_holiday,1,0,0,0
 portal_holiday_hr_leave_mandatory_day,portal-holiday-model_hr_leave_mandatory_day,hr_holidays.model_hr_leave_mandatory_day,group_portal_backend_holiday,1,0,0,0
 portal_holiday_user_calendar,portal_holiday_calendar_atendee,calendar.model_calendar_attendee,group_portal_backend_holiday,1,0,1,0
-portal_holiday_access_hr_leave_type,hr.leave.type,hr_holidays.model_hr_leave_type,group_portal_backend_holiday,1,0,0,0

portal_holidays/security/ir_rule.xml

@@ -9,4 +9,11 @@
         <field name="perm_unlink" eval="False"/>
         <field name="perm_write" eval="False"/>
     </record>
+
+    <record model="ir.rule" id="hr_leave_type_portal_holiday_rule">
+        <field name="name">Time Off Type: portal holiday: multi-company</field>
+        <field name="model_id" ref="hr_holidays.model_hr_leave_type"/>
+        <field name="domain_force">['|', ('company_id', '=', False), ('company_id', 'in', company_ids)]</field>
+        <field name="groups" eval="[Command.link(ref('portal_holidays.group_portal_backend_holiday'))]"/>
+    </record>
 </odoo>