[19.0][MIG] mail_activity_restrict: Migration to 19.0

[CRogos]

No description provided.

[github-actions]

There hasn't been any activity on this pull request in the past 4 months, so it has been marked as stale and it will be closed automatically if no further activity occurs in the next 30 days.
If you want this PR to never become stale, please ask a PSC member to apply the "no stale" label.

[CRogos]

Feature needs review.

[MohamedOsman7]

If nobody is assigned, this matches nobody, so nobody can edit, delete, assign or mark it done, not even Admin. In the UI the buttons are hidden for everyone, and in the Activity overview you only get an AccessError. The activity is stuck forever.

A possible fix:

return self.sudo().filtered_domain(
    ["|", ("user_id", "=", False), ("user_id", "=", self.env.uid)]
)

So if there is no assignee, normal odoo rules will apply. If assignee is set, the restriction applies.

[CRogos]

Yes I agree. If nobody is assigned, no restriction should be made. But check this also in the mail_activity_team_restrict. When there is no user_id but a team_id set, in this case only the team should be able to edit.

[MohamedOsman7]

This is actually suggested by Claude and i think it is useful:
"""
restricted = self.filtered("activity_type_id.can_write_restrict")

This reads mail.activity.type as the current user inside _check_access. If a read fails here it would raise instead of returning the (records, error) tuple. The helper above does it right with self.sudo(). Works today, but it's fragile:

restricted = self.sudo().filtered("activity_type_id.can_write_restrict")

"""

[MohamedOsman7]

@CRogos

I clicked everything through in the UI. I found these things that i think should be fixed:

1. In connection with the module mail_activity_reminder, nobody can create a restricted activity for other user: If you as Admin, open a contact -> Schedule Activity with "Restrict Write to Assigned User" -> assign it to another user -> Save. You get an AccessError and the activity is not created at all. It only works if you assign it to yourself.

2. An activity without assignee is locked forever: Since 19.0 user_id is optional. (comment 1)

3. (comment 2)

4. Should reassigning be allowed at all, and by whom? Because currently when I create a restricted activity and assign it to myself, then save it, the activity is created successfully. However, if I assign it to someone else, I am no longer able to make any changes to the activity because the buttons are no longer visible. (Yet, with the "mail_activity_reminder" module, you aren't even allowed to change the user, you get an access error.)

[CRogos]

4. The idea behind the restricted activities is a kind of approval. But approval should only be granted by the assigned users. Therefore changing the user by the creator is not intended.
   When these activity types are defined by a custom module, and the activity is created from code, these activity could also be removed by some code. (like it is done in the timeoff approval process)
   We could allow assigning only on create or reassigned by the assigned user/team. Or we could also prevent user from manually creating restricted activities and leave these kind of activity exclusive to activities created by code (like the timeoff approval activity)