[tryton-commits] [tryton] [8.0] Check access only on entry points of chat channel

[Cédric Krier]

details:   https://code.tryton.org/tryton/commit/541fcd51940b
branch:    8.0
user:      Cédric Krier <c...@b2ck.com>
date:      Tue Apr 21 12:15:36 2026 +0200
description:
        Check access only on entry points of chat channel

        Since 317e5ff39097 the read access is restricted to the admin group.
        The access right should not be enforced for the transaction but only at 
the RPC
        entry point.

        Closes #14791
        (grafted from 8c311ddd3da49bdbd61f2ae22074880ea79ae2ec)
diffstat:

 trytond/trytond/ir/chat.py |  32 ++++++++++++++++++++------------
 1 files changed, 20 insertions(+), 12 deletions(-)

diffs (106 lines):

diff -r 244aa73573d2 -r 541fcd51940b trytond/trytond/ir/chat.py
--- a/trytond/trytond/ir/chat.py        Mon Apr 20 22:24:47 2026 +0200
+++ b/trytond/trytond/ir/chat.py        Tue Apr 21 12:15:36 2026 +0200
@@ -22,7 +22,7 @@
 from trytond.tools import cached_property, firstline
 from trytond.tools.email_ import (
     EmailNotValidError, normalize_email, set_from_header, validate_email)
-from trytond.transaction import Transaction
+from trytond.transaction import Transaction, check_access
 from trytond.url import host
 
 FOLLOWER_SEARCH_LIMIT = 20
@@ -53,15 +53,15 @@
                 'ir.msg_chat_channel_identifier_unique'),
             ]
         cls.__rpc__.update(
-            subscribe=RPC(readonly=False),
-            unsubscribe=RPC(readonly=False),
-            subscribe_email=RPC(readonly=False),
-            unsubscribe_email=RPC(readonly=False),
-            get_followers=RPC(),
-            search_followers=RPC(),
-            post=RPC(readonly=False, result=int),
+            subscribe=RPC(readonly=False, check_access=False),
+            unsubscribe=RPC(readonly=False, check_access=False),
+            subscribe_email=RPC(readonly=False, check_access=False),
+            unsubscribe_email=RPC(readonly=False, check_access=False),
+            get_followers=RPC(check_access=False),
+            search_followers=RPC(check_access=False),
+            post=RPC(readonly=False, check_access=False, result=int),
             get_models=RPC(),
-            get=RPC(),
+            get=RPC(check_access=False),
             )
         cls._buttons.update({
                 'reset_identifier': {
@@ -98,6 +98,7 @@
         return self.resource.rec_name
 
     @classmethod
+    @check_access
     def check_access(cls, resource):
         pool = Pool()
         ModelAccess = pool.get('ir.model.access')
@@ -107,7 +108,6 @@
 
     @classmethod
     def _get_channel(cls, resource):
-        cls.check_access(resource)
         channels = cls.search([
                 ('resource', '=', str(resource)),
                 ])
@@ -144,12 +144,13 @@
 
     @classmethod
     def unsubscribe(cls, resource, username=None):
+        cls.check_access(resource)
+
         pool = Pool()
         Follower = pool.get('ir.chat.follower')
         User = pool.get('res.user')
 
         if username:
-            cls.check_access(resource)
             try:
                 user, = User.search([('login', '=', username)], limit=1)
             except ValueError:
@@ -226,6 +227,8 @@
 
     @classmethod
     def get_followers(cls, resource):
+        cls.check_access(resource)
+
         return sorted(
             cls._get_followers(resource).values(), key=itemgetter('name'))
 
@@ -246,6 +249,8 @@
 
     @classmethod
     def search_followers(cls, resource, text, limit=FOLLOWER_SEARCH_LIMIT):
+        cls.check_access(resource)
+
         potential_followers = cls._search_followers(resource, text)
         current_followers = cls.get_followers(resource)
 
@@ -256,6 +261,8 @@
 
     @classmethod
     def post(cls, resource, content, audience='internal'):
+        cls.check_access(resource)
+
         pool = Pool()
         Message = pool.get('ir.chat.message')
         User = pool.get('res.user')
@@ -373,9 +380,10 @@
 
     @classmethod
     def get(cls, resource, before=None, after=None):
+        cls.check_access(resource)
+
         pool = Pool()
         Message = pool.get('ir.chat.message')
-        cls.check_access(resource)
         domain = [
             ('channel.resource', '=', resource),
             ]