first push message

survey_multi_company/security/survey_security.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<odoo>
+    <!--
+        Multi-company record rule for survey.survey.
+
+        Allows users to see surveys that either:
+          (a) have no company set (company_id = False) — globally visible, or
+          (b) belong to one of the companies the current user is allowed to access.
+
+        This mirrors the standard Odoo pattern used by sale.order, account.move,
+        stock.picking, etc.
+
+        The rule applies to all users including portal and public:
+          - Internal users: filtered by their allowed_company_ids
+          - Portal / public: they access surveys via tokens (controller handles
+            company switching), so the record rule must not block them entirely.
+            The [False] part of the domain ensures tokenless-company surveys
+            stay reachable even without an active company in the session.
+    -->
+    <record id="survey_survey_company_rule" model="ir.rule">
+        <field name="name">Survey: Multi-Company Access Rule</field>
+        <field name="model_id" ref="survey.model_survey_survey" />
+        <field name="domain_force">
+            [("company_id", "in", [False] + company_ids)]
+        </field>
+        <field name="groups" eval="[(4, ref('base.group_user'))]" />
+    </record>
+</odoo>