[19.0][FIX] base_tier_validation: gate exception field_ids to Settings users

[bosd]

Problem

Opening the Tier Validation Exception list or form as a non-Settings internal user raises a hard Access Error:

You are not allowed to access 'Fields' (ir.model.fields) records.
This operation is allowed for the following groups: - Access Rights

tier.validation.exception.field_ids is a Many2many to ir.model.fields. The model's read ACL is granted to base.group_user (access_tier_validation_exceptions_all) so the validation logic can check exceptions as the acting user. But the list, form and search views expose field_ids with no groups=, so the web client reads the co-records' display_name as that user, which triggers the ir.model.fields ACL read check and fails for anyone outside base.group_system.

(A Many2one to the same model would be read with sudo() by the web client and would not raise — this is specific to the x2many path.)

Fix

Only base.group_system can create/edit exceptions (access_tier_validation_exceptions_settings), so field_ids is effectively a Settings-level config field. Gate it with groups="base.group_system" in the list, form and search views. Non-Settings users (who only have read for the internal exception check) no longer load the field, so no Access Error; Settings users are unaffected.

Adds a test asserting field_ids is absent from the exception views for a base.group_user user and present for a Settings user.

Notes

• No behaviour change for Settings users; non-Settings users could only ever read (not edit) exceptions anyway.
• Surfaced by a lint rule that flags x2many fields to admin-only comodels exposed in views without a groups= gate.

[OCA-git-bot]

Hi @LoisRForgeFlow,
some modules you are maintaining are being modified, check this out!