ERP5Type: Allow overriding _getAcquireLocalRoles .

Put auto-generated _getAcquireLocalRoles at the end of mro, removing it
from Base.
Also, document why it is treated specially here.
Also, add _getAcquireLocalRoles methods on a few leaf classes whose
instances fake being portal types, without actually being proper document
instances. At least, the ones which are detected in unit tests. The
proper fix would likely rather be to make them proper document classes,
but this carries data migration concerns which go beyond the scope of
this regression fix (_getAcquireLocalRoles was not possible to override
anymore).

product/ERP5/Tool/CertificateAuthorityTool.py

@@ -280,4 +280,12 @@ class CertificateAuthorityTool(BaseTool):
     serial = self._getValidSerial(common_name)
     self.revokeCertificate(serial)
 
+  # XXX: This class lacks a corresponding portal type, so its instances are not
+  # actual documents. A portal type should be created from it, and backward
+  # compatibility added to keep existing instances working.
+  # Until then, hardcode some methods expected to exist on all document
+  # classes so that they can be removed from Base.
+  def _getAcquireLocalRoles(self):
+    return True
+
 InitializeClass(CertificateAuthorityTool)

product/ERP5Form/Form.py

@@ -1302,6 +1302,14 @@ class ERP5Form(Base, ZMIForm, ZopePageTemplate):
       return str((self.pt, self.name, self.action, self.update_action,
                   self.encoding, self.stored_encoding, self.enctype))
 
+    # XXX: This class is a mix between a document class and a regular class.
+    # Ideally, it should be made an alias to "erp5.portal_type.ERP5 Form",
+    # which is the corresponding fully-functional document class.
+    # Until then, hardcode some methods expected to exist on all document
+    # classes so that they can be removed from Base.
+    def _getAcquireLocalRoles(self):
+      return True
+
 # utility function
 def get_field_meta_type_and_proxy_flag(field):
     if field.meta_type=='ProxyField':

product/ERP5Type/Base.py

@@ -3034,22 +3034,6 @@ class Base( CopyContainer,
           return object.__of__(portal).__of__(self)
     raise AttributeError(id)
 
-  def _getAcquireLocalRoles(self):
-    """This method returns the value of acquire_local_roles of the object's
-    portal_type.
-      - True means local roles are acquired, which is the standard behavior of
-      Zope objects.
-      - False means that the role acquisition chain is cut.
-
-    The code to support this is on the user class, see
-    ERP5Type.patches.User and ERP5Type.patches.PropertiedUser .
-
-    This specific implementation of this method should only be reached when
-    processing an object with a missing portal type, otherwise portal type
-    class should hold such accessor.
-    """
-    return True
-
   security.declareProtected(Permissions.AccessContentsInformation,
                             'get_local_permissions')
   def get_local_permissions(self):

product/ERP5Type/dynamic/portal_type_class.py

@@ -45,6 +45,20 @@ from Products.ERP5Type.TransactionalVariable import TransactionalResource
 from zLOG import LOG, ERROR, INFO, WARNING, PANIC
 
 ACQUIRE_LOCAL_ROLE_GETTER_ID = '_getAcquireLocalRoles'
+ACQUIRE_LOCAL_ROLE_GETTER_DICT = {
+  acquire_local_role: type(
+    'GetAcquireLocalRolesMixIn',
+    (object, ),
+    {
+      ACQUIRE_LOCAL_ROLE_GETTER_ID: ConstantGetter(
+        id=ACQUIRE_LOCAL_ROLE_GETTER_ID,
+        key=None,
+        value=acquire_local_role,
+      ),
+    },
+  )
+  for acquire_local_role in (False, True)
+}
 
 def _importClass(classpath):
   try:
@@ -156,11 +170,7 @@ def generatePortalTypeClass(site, portal_type_name):
     interface_list = portal_type.getTypeInterfaceList()
     portal_type_category_list = portal_type.getTypeBaseCategoryList()
     attribute_dict['_categories'] = portal_type_category_list[:]
-    attribute_dict[ACQUIRE_LOCAL_ROLE_GETTER_ID] = ConstantGetter(
-      id=ACQUIRE_LOCAL_ROLE_GETTER_ID,
-      key=None,
-      value=bool(portal_type.getTypeAcquireLocalRole()),
-    )
+    acquire_local_role = bool(portal_type.getTypeAcquireLocalRole())
   else:
     LOG("ERP5Type.dynamic", WARNING,
         "Cannot find a portal type definition for '%s', trying to guess..."
@@ -186,6 +196,7 @@ def generatePortalTypeClass(site, portal_type_name):
 
     mixin_list = []
     interface_list = []
+    acquire_local_role = True
 
   if type_class is None:
     raise AttributeError('Document class is not defined on Portal Type ' + \
@@ -275,7 +286,12 @@ def generatePortalTypeClass(site, portal_type_name):
 
       mixin_class_list.append(mixin_class)
 
-  base_class_list = [klass] + accessor_holder_list + mixin_class_list
+  base_class_list = [klass] + accessor_holder_list + mixin_class_list + [
+    # _getAcquireLocalRoles is accessed by security machinery, so it needs to
+    # be fast: make it a ConstantGetter while we have access to portal_type
+    # configuration.
+    ACQUIRE_LOCAL_ROLE_GETTER_DICT[acquire_local_role],
+  ]
 
   interface_class_list = []
   if interface_list: