[FIX] point_of_sale: prevent closing a POS session multiple times in a

row

When it comes to closing POS sessions, both the frontend and the backend
currently have some way to prevent the same operations from executing
simultaneously because of repeated clicks. `closeSession` in the
frontend has a `closeSessionClicked` boolean that prevents the operation
 from triggering multiple times at once. `close_session_from_ui`
in the backend checks if the session state isn't already `closed`.

A flaw in the current logic is that
`update_closing_control_state_session`, which is called by the frontend
before `close_session_from_ui`, doesn't check the session state before
writing it to be `closing_control`. This means that if you time things
in such a way that the `closeSession` logic in the frontend triggers
again right after it finishes, it will call
`update_closing_control_state_session` and `close_session_from_ui`
again, which will happily close the session again, duplicating stock
moves and account moves resulting from it.

This fix has `update_closing_control_state_session` check if the session
is already closed and raises a UserError if so. This prevents the
duplicate closings and records from happening.

There were two variants in the UI I observed when the issue occurred:
the first is when the repeated execution of
`update_closing_control_state_session` and `close_session_from_ui`
successfully finished. In that case the session would be closed with
duplicate stock moves and journal entries.

In the second variant, from the repeated calls only
`update_closing_control_state_session` executed but not
`close_session_from_ui`. This could happen if the timing of the
frontend was such that it redirected to the POS dashboard before it was
able to call `close_session_from_ui`. In that case, the session would
be in the `closing_control` state, which is visible in the POS dashboard
. If the user then closed the session, it would be closed twice and the
duplicate records would again be created.

opw-2988701

closes odoo/odoo#107873

Signed-off-by: Trinh Jacky (trj) <trj@odoo.com>

addons/point_of_sale/models/pos_session.py

@@ -435,6 +435,9 @@ class PosSession(models.Model):
         return {'successful': True}
 
     def update_closing_control_state_session(self, notes):
+        # Prevent closing the session again if it was already closed
+        if self.state == 'closed':
+            raise UserError(_('This session is already closed.'))
         # Prevent the session to be opened again.
         self.write({'state': 'closing_control', 'stop_at': fields.Datetime.now()})
         self._post_cash_details_message('Closing', self.cash_register_difference, notes)