[FIX] kw_api_custom_endpoint: apply the endpoint domain when change() resolves by id

kw_api_custom_endpoint/__manifest__.py

@@ -1,6 +1,6 @@
 {
     'name': 'Custom API controller',
-    'version': '19.0.1.7.4',
+    'version': '19.0.1.7.5',
     'license': 'LGPL-3',
     'category': 'Extra Tools',
 

kw_api_custom_endpoint/models/custom_endpoint.py

@@ -344,6 +344,30 @@ def get_requested_domain(self, kw_api, **kw):
                 domain.append((s_field_name, '=', v))
         return domain
 
+    def api_get_obj_domain(self, obj_id):
+        """Domain that resolves one record by id, narrowed by this endpoint's own domain.
+
+        The list branch has always applied ``self.domain``; the by-id branches did not, so
+        a record the endpoint declares to be in scope could still be invisible to them.
+
+        This also settles ``active`` without touching the context: Odoo skips the implicit
+        ``active = True`` whenever a domain mentions ``active``, so an endpoint configured
+        with ``[("active", "in", [True, False])]`` reaches archived records, and one that
+        says nothing about ``active`` keeps the previous behaviour exactly.
+        """
+        self.ensure_one()
+        domain = [(self.model_id_field, '=', obj_id)]
+        if not self.domain:
+            return domain
+        try:
+            endpoint_domain = safe_eval(self.domain)
+        except Exception as e:
+            _logger.debug(e)
+            return domain
+        if not endpoint_domain:
+            return domain
+        return AND([domain, endpoint_domain])
+
     def change(self, kw_api, obj_id=False, **kw):
         self.ensure_one()
         m = self.env[self.model_id.model].sudo()
@@ -363,7 +387,11 @@ def change(self, kw_api, obj_id=False, **kw):
         try:
             if obj_id:
                 obj_id = m.search(
-                    [(self.model_id_field, '=', obj_id)], limit=1)
+                    self.api_get_obj_domain(obj_id), limit=1)
+                if not obj_id:
+                    return kw_api.response(
+                        code=400, error='Wrong ID', data={'error': {
+                            'code': '400', 'message': 'Wrong ID'}}, )
                 obj_id.write(data)
             else:
                 obj_id = m.create(data)