[18.0] queue_job_batch record rule fails in multi-company environment with no child companies

[federicotorresyakusik]

Environment

• Odoo Version: 18.0
• Module: queue_job_batch
• Module Version: 18.0.1.0.0

Description

In a multi-company Odoo 18 environment where companies have no parent-child relationships, the default record rule for the queue.job.batch model (queue_job_batch_comp_rule) prevents users from accessing records for companies other than their default company, even when the user has access to all companies and the desired company is set as the active company in the session.

The problematic rule is defined as:

<record id="queue_job_batch_comp_rule" model="ir.rule">
    <field name="name">Job Queue batch multi-company</field>
    <field name="model_id" ref="model_queue_job_batch" />
    <field name="global" eval="True" />
    <field name="domain_force">['|', ('company_id', '=', False), ('company_id', 'child_of', [user.company_id.id])]</field>
</record>

Issue Details

• User Configuration: The user (e.g., Administrator, ID=2) has access to all companies in the system via the Allowed Companies setting (res.users.company_ids). The user’s default company (res.users.company_id) is set to a company other than the target company (e.g., Company B).
• Company Structure: No companies in the instance have parent-child relationships (i.e., res.company.parent_id is False for all companies).
• Active Company: The user has set the active company to Company B in the Odoo UI (via the company switcher), so env.context['company_id'] or env.context['allowed_company_ids'] includes Company B.
• Behavior: When attempting to access a queue.job.batch record with company_id set to Company B, the user receives an access denied error:

Uh-oh! Looks like you have stumbled upon some top-secret records.
Sorry, Administrator (id=2) doesn't have 'read' access to:
- Batch of jobs, Translate to English Batch (queue.job.batch: 10, company=Company B)
Blame the following rules:
- Job Queue batch multi-company
This seems to be a multi-company issue, you might be able to access the record by switching to the company: Company B.

• Root Cause: The record rule uses user.company_id.id, which refers to the user’s default company, not the active company in the session. Since there are no child companies, the child_of operator only allows access to records where company_id matches the user’s default company or is False. This prevents access to records for other allowed companies, such as Company B, even when it’s the active company.

Steps to Reproduce

1. Install Odoo 18 with the queue_job_batch module.
2. Configure a multi-company environment with at least two companies (e.g., Company A and Company B) and no parent-child relationships.
3. Assign a user (e.g., Administrator) access to all companies via Allowed Companies, but set their default company to Company A.
4. In the Odoo UI, switch the active company to Company B.
5. Create a queue.job.batch record with company_id set to Company B.
6. Attempt to view the record as the user.
7. Observe the access denied error due to the queue_job_batch_comp_rule.

Fix Implemented

Changing the record rule’s domain to use the user’s allowed companies resolves the issue. The updated rule tested successfully is:

<record id="queue_job_batch_comp_rule" model="ir.rule">
    <field name="name">Job Queue batch multi-company</field>
    <field name="model_id" ref="model_queue_job_batch" />
    <field name="global" eval="True" />
    <field name="domain_force">['|', ('company_id', '=', False), ('company_id', 'in', company_ids)]</field>
</record>

This domain works because Odoo 18’s core ir.rule model defines company_ids as self.env.companies.ids in its _eval_context method, making it available for all ir.rule domains, including those in queue_job and queue_job_batch. The queue_job module uses the same domain (['|', ('company_id', '=', False), ('company_id', 'in', company_ids)]) without needing a custom _eval_context override, confirming that company_ids is provided by Odoo’s core.

This change allows users to access queue.job.batch records for any company in their Allowed Companies, aligning with Odoo’s multi-company behavior where the active company is respected.

Suggested Action

• Update the queue_job_batch module’s default record rule to use ['|', ('company_id', '=', False), ('company_id', 'in', company_ids)] to align with the queue_job module’s approach and leverage Odoo 18’s core _eval_context definition of company_ids.

Please let me know if additional details or testing is needed to address this issue. I’m happy to assist with further debugging or validation.