fix: Add sudo() for portal inventory counts and staging location creation

- Inventory counts route: Added sudo() for all model search_count calls
  so portal users can see their container/file/document/temp/location counts
- Staging location creation: Added sudo() so portal users can create
  customer.staging.location records
- Stock location model: Added sudo() to _create_or_update_stock_location
  so the auto-created stock.location records work for portal users

Portal users don't have direct access to records.container, records.file,
records.document, temp.inventory, or stock.location models - they need
sudo() with proper domain filtering by partner_id for security.

Author: John75SunCity

records_management/controllers/portal.py

@@ -5425,18 +5425,18 @@ def portal_inventory_counts(self, **kw):
             if accessible_departments:
                 domain.append(('department_id', 'in', accessible_departments))
 
-        # Get counts for all inventory types
-        containers_count = request.env['records.container'].search_count(domain)
-        files_count = request.env['records.file'].search_count(domain)
-        documents_count = request.env['records.document'].search_count(domain)
+        # Get counts for all inventory types (use sudo for portal access)
+        containers_count = request.env['records.container'].sudo().search_count(domain)
+        files_count = request.env['records.file'].sudo().search_count(domain)
+        documents_count = request.env['records.document'].sudo().search_count(domain)
 
         # Temp inventory count
         temp_domain = [('partner_id', '=', partner.commercial_partner_id.id)]
-        temp_count = request.env['temp.inventory'].search_count(temp_domain)
+        temp_count = request.env['temp.inventory'].sudo().search_count(temp_domain)
 
         # Customer staging locations count
         locations_domain = [('partner_id', '=', partner.commercial_partner_id.id)]
-        locations_count = request.env['customer.staging.location'].search_count(locations_domain)
+        locations_count = request.env['customer.staging.location'].sudo().search_count(locations_domain)
 
         return {
             'containers': containers_count,
@@ -6586,8 +6586,8 @@ def portal_staging_location_create(self, **post):
         partner = request.env.user.partner_id.commercial_partner_id
 
         if request.httprequest.method == 'POST':
-            # Create location
-            StagingLocation = request.env['customer.staging.location']
+            # Create location (use sudo for portal users to create staging locations)
+            StagingLocation = request.env['customer.staging.location'].sudo()
 
             vals = {
                 'name': post.get('name'),

records_management/models/customer_staging_location.py

@@ -277,12 +277,13 @@ def _create_or_update_stock_location(self):
         }
 
         if self.stock_location_id:
-            # Update existing
-            self.stock_location_id.write(location_vals)
+            # Update existing (use sudo to bypass stock.location permissions)
+            self.stock_location_id.sudo().write(location_vals)
         else:
-            # Create new
-            stock_location = self.env['stock.location'].create(location_vals)
-            self.stock_location_id = stock_location.id
+            # Create new (use sudo - portal users can create staging locations
+            # but don't have direct stock.location create permissions)
+            stock_location = self.env['stock.location'].sudo().create(location_vals)
+            self.sudo().stock_location_id = stock_location.id
 
     # ============================================================================
     # ACTIONS