[FIX] stock: wrong security rule

rev[0] aimed to fix an intercompany reservation issue by allowing the
intercompany moves to be seen, however the new domain was too soft and
also allows the visibility of any moves going to a location without
company, for example now outgoing moves to customer from all companies
are visible.

We strengthen the domain to only allow intercompany moves, ie we add the
transit constraint in the domain.

We also fix the same issue for the move line model (see [1])

Now that this one is fixed, the next move is automatically reserved
during _action_done. This didn't work either, so we carefully sudo and
force_company on the destination move.

[0] 3c4bb08
[1] f9461c7
task-2157248

closes odoo#41930

Signed-off-by: Simon Lejeune (sle) <[email protected]>

addons/stock/models/stock_move.py

@@ -1357,7 +1357,12 @@ def _action_done(self, cancel_backorder=False):
                 raise UserError(_('You cannot move the same package content more than once in the same transfer or split the same package into two location.'))
         picking = moves_todo.mapped('picking_id')
         moves_todo.write({'state': 'done', 'date': fields.Datetime.now()})
-        moves_todo.mapped('move_dest_ids')._action_assign()
+
+        move_dests_per_company = defaultdict(lambda: self.env['stock.move'])
+        for move_dest in moves_todo.move_dest_ids:
+            move_dests_per_company[move_dest.company_id.id] |= move_dest
+        for company_id, move_dests in move_dests_per_company.items():
+            move_dests.sudo().with_context(force_company=company_id)._action_assign()
 
         # We don't want to create back order for scrap moves
         # Replace by a kwarg in master

addons/stock/security/stock_security.xml

@@ -111,14 +111,14 @@
          <field name="name">stock_move multi-company</field>
         <field name="model_id" search="[('model','=','stock.move')]" model="ir.model"/>
         <field name="global" eval="True"/>
-        <field name="domain_force">['|', ('company_id', 'in', company_ids), ('location_dest_id.company_id', '=', False)]</field>
+        <field name="domain_force">['|', ('company_id', 'in', company_ids), '&amp;', ('location_dest_id.company_id', '=', False), ('location_dest_id.usage', '=', 'transit')]</field>
      </record>
 
      <record model="ir.rule" id="stock_move_line_rule">
         <field name="name">stock_move_line multi-company</field>
         <field name="model_id" search="[('model','=','stock.move.line')]" model="ir.model"/>
         <field name="global" eval="True"/>
-        <field name="domain_force">['|','|',('company_id','=',False),('company_id', 'in', company_ids),('location_dest_id.company_id', '=', False)]</field>
+        <field name="domain_force">['|','|',('company_id','=',False),('company_id', 'in', company_ids),'&amp;',('location_dest_id.company_id', '=', False), ('location_dest_id.usage', '=', 'transit')]</field>
      </record>
 
     <record model="ir.rule" id="stock_quant_rule">