security(spp_registry_search): un-sudo'd sub-searches 500 for roles without ACL on phone/ID co-models [Severity: Low]

[gonzalesedwin1123]

Follow-up discovered during the staff review of the Registry Search server-side limits fix (PR #335). Pre-existing behavior, unchanged by that PR; needs a small design decision, so filed separately.

Severity: Low (availability/UX for narrowly-permissioned roles; needs design decision)

Problem

search_registrants fans out un-sudo'd sub-searches (_search_unified / _search_by_field in spp_registry_search/models/res_partner.py) over spp.registry.id and spp.phone.number in addition to res.partner. A role that has read access on res.partner but no read ACL on one of those co-models gets an AccessError → generic 500 from the whole search, instead of results filtered to what they may see.

Running un-sudo'd is the intended security posture (ACLs and record rules govern visibility — confirmed as a deliberate decision in PR #335), so this is not a leak; it is an all-or-nothing failure mode for thin roles.

Design decision needed

1. Skip inaccessible fields: wrap each co-model sub-search in try/except AccessError and skip that field (search degrades gracefully; a user without phone-ACL simply can't find people by phone). Preserves least privilege; recommended starting point.
2. Require the ACLs: declare read ACLs on spp.registry.id / spp.phone.number for every group allowed to use registry search (visibility then governed by record rules). Simpler code, wider grants.
3. Leave as-is and document that registry-search roles must hold read ACLs on both co-models.

Origin

• PR security(registry): enforce configured search limits server-side in search_registrants #335 (security(registry): enforce configured search limits server-side in search_registrants)
• Plan: internal/plans/sec-registry-search-limit-bypass.md (staff review, Low finding b)