Hi,

I just created an add-on to filter partner's information made available to users. To be able to see partners, their sale orders and invoice, a user must be added to a list declared as follow:

class Partner(models.Model):
    _inherit = "res.partner"

    access_user_ids = fields.Many2many(
        'res.users',
        'partner_users_access_rel',
        column1='partner_id',
        column2='user_id',
        string='Allowed to access',
        help='Only users listed here will have access to the partner, their sales orders and invoices',
    )

To make it happen, rules are declared like so:

<odoo>

    <data>
        <!-- Grant access to partner to creator or user allowed to access partner -->
        <record id="my_access_partner" model="ir.rule">
            <field name="name">Partner restricted access</field>
            <field name="model_id" ref="base.model_res_partner"/>
            <field name="global" eval="True"/>
            <field name="domain_force">
                [('parent_id','=',False),'|','|',('create_uid','=',user.id),('user_id','=',user.id'),('access_user_ids','in',[user.id])]
            </field>
        </record>

        <!-- Grant access to sale order creator, salesperson or user allowed to access partner -->
        <record id="my_access_sale_order" model="ir.rule">
            <field name="name">Sale order restricted access</field>
            <field name="model_id" ref="sale.model_sale_order"/>
            <field name="domain_force">['|','|',('create_uid','=',user.id),('user_id','=',user.id),('partner_id.access_user_ids','in',[user.id])]</field>
        </record>

        <!-- Grant access to invoice creator, salesperson or user allowed to access partner or partner's parent (invoice address) -->
        <record id="my_access_invoice" model="ir.rule">
            <field name="name">Invoice restricted access</field>
            <field name="model_id" ref="account.model_account_invoice"/>
            <field name="global" eval="True"/>
            <field name="domain_force">['|','|','|',('create_uid','=',user.id),('user_id','=',user.id),('partner_id.access_user_ids','in',[user.id]),('partner_id.parent_id.access_user_ids','in',[user.id])]</field>
        </record>
    </data>

</odoo>

For some reason, I get the following error message :

ParseError: "Error while validating constraint

sale.order
None" while parsing /home/maxime/PycharmProjects/odoo-20200827/odoo/addons/exnihilo_access/security/exnihilo_access_security.xml:17, near
<record id="my_access_sale_order" model="ir.rule">
            <field name="name">Sale order restricted access</field>
            <field name="model_id" ref="sale.model_sale_order"/>
            <field name="domain_force">['|','|',('create_uid','=',user.id),('user_id','=',user.id),('partner_id.access_user_ids','in',[user.id])]</field>
        </record>

I though about an issue with the constraint domain, but I was able to create it from the web UI, copy-pasting the domain value. And it works as expected.

Thing is I would like these rules to be added when the add-on is installed but I can't find what can be wrong with this piece of XML.