[FIX] account_operating_unit: filter payment register journals by OU

When registering a payment from the invoice form, the payment wizard
shows journals from all operating units instead of filtering by the
invoice's operating unit. This causes AccessError when users with
restricted OU access try to create payments.

Override _get_batch_available_journals in account.payment.register
to filter journals by the invoice's operating unit when all invoices
in the batch belong to the same OU.

Author: IJOL

account_operating_unit/__init__.py

@@ -2,3 +2,4 @@
 
 from . import models
 from . import report
+from . import wizard

account_operating_unit/tests/test_account_operating_unit.py

@@ -2,6 +2,7 @@
 # © 2019 Serpent Consulting Services Pvt. Ltd.
 # License LGPL-3.0 or later (https://www.gnu.org/licenses/lgpl.html).
 
+from odoo import fields
 from odoo.models import Command
 from odoo.tests import tagged
 
@@ -181,3 +182,48 @@ def _prepare_invoice(self, operating_unit_id, name="Test Supplier Invoice"):
             "invoice_line_ids": lines,
         }
         return inv_vals
+
+    def test_payment_register_journals_filtered_by_ou(self):
+        """Payment register wizard should only show journals matching the
+        invoice's operating unit. A user with access to a single OU must
+        not see journals from other OUs, and creating a payment must not
+        raise AccessError."""
+        inv_vals = self._prepare_invoice(self.b2b.id, name="Test B2B Invoice")
+        inv_vals["invoice_date"] = fields.Date.today()
+        invoice = (
+            self.move_model.with_user(self.user1)
+            .with_context(default_move_type="in_invoice")
+            .create(inv_vals)
+        )
+        invoice.action_post()
+
+        ctx = {
+            "active_model": "account.move",
+            "active_ids": invoice.ids,
+        }
+        wizard = (
+            self.register_payments_model.with_user(self.user1)
+            .with_context(**ctx)
+            .create({"journal_id": self.cash2_journal_b2b.id})
+        )
+
+        available_journals = wizard.available_journal_ids
+        for journal in available_journals:
+            self.assertTrue(
+                not journal.operating_unit_id
+                or journal.operating_unit_id == self.b2b,
+                "Journal '%s' (OU=%s) should not be available for OU %s"
+                % (
+                    journal.name,
+                    journal.operating_unit_id.name,
+                    self.b2b.name,
+                ),
+            )
+
+        self.assertNotIn(
+            self.cash_journal_ou1,
+            available_journals,
+            "OU1 journal should not be available when paying a B2B invoice",
+        )
+
+        wizard.action_create_payments()

account_operating_unit/wizard/__init__.py

@@ -0,0 +1 @@
+from . import account_payment_register

account_operating_unit/wizard/account_payment_register.py

@@ -0,0 +1,21 @@
+# License LGPL-3.0 or later (https://www.gnu.org/licenses/lgpl.html).
+
+from odoo import api, models
+
+
+class AccountPaymentRegister(models.TransientModel):
+    _inherit = "account.payment.register"
+
+    @api.model
+    def _get_batch_available_journals(self, batch_result):
+        """Filter available journals by the operating unit of the invoices."""
+        journals = super()._get_batch_available_journals(batch_result)
+        lines = batch_result.get("lines")
+        if lines:
+            invoice_ous = lines.move_id.operating_unit_id
+            if invoice_ous and len(invoice_ous) == 1:
+                journals = journals.filtered(
+                    lambda j: not j.operating_unit_id
+                    or j.operating_unit_id == invoice_ous
+                )
+        return journals