erp5_maileva_connector: Rework security to not require roles

   The way to use the connector should NOT require us to set Roles on portal_web_services objects.

   Documents on portal_web_services contains passwords to third-party software so, that should be not accessible by the user (even with proper roles).

   I set a minimal set of proxy roles and re-work to use path rather them object to not require roles everywhere.

bt5/erp5_maileva_connector/SkinTemplateItem/portal_skins/erp5_maileva_connector/Alarm_checkMailevaDocumentStatus.py

 portal = context.getPortalObject()
-maileva_connector = portal.ERP5Site_getAvailableMailevaSOAPConnector()
+maileva_connector_path = portal.ERP5Site_getAvailableMailevaSOAPConnector()
+maileva_connector = portal.restrictTraverse(maileva_connector_path)
 
 notification_dict = maileva_connector.checkPendingNotifications()
 

bt5/erp5_maileva_connector/SkinTemplateItem/portal_skins/erp5_maileva_connector/ERP5Site_getAvailableMailevaSOAPConnector.py

+from zExceptions import Unauthorized
+if REQUEST is not None:
+  raise Unauthorized
 maileva_connector = context.portal_catalog.getResultValue(
   portal_type='Maileva SOAP Connector',
   reference=reference,
   validation_state='validated')
 if not maileva_connector:
   raise ValueError('Maileav soap connector is not defined')
-return maileva_connector
+return maileva_connector.getRelativeUrl()

bt5/erp5_maileva_connector/SkinTemplateItem/portal_skins/erp5_maileva_connector/ERP5Site_getAvailableMailevaSOAPConnector.xml

@@ -50,7 +50,15 @@
         </item>
         <item>
             <key> <string>_params</string> </key>
-            <value> <string>reference="maileva_soap_connector"</string> </value>
+            <value> <string>reference="maileva_soap_connector", REQUEST=None</string> </value>
+        </item>
+        <item>
+            <key> <string>_proxy_roles</string> </key>
+            <value>
+              <tuple>
+                <string>Manager</string>
+              </tuple>
+            </value>
         </item>
         <item>
             <key> <string>id</string> </key>

bt5/erp5_maileva_connector/SkinTemplateItem/portal_skins/erp5_maileva_connector/MailevaExchange_checkStatus.py

-maileva_connector = context.getPortalObject().ERP5Site_getAvailableMailevaSOAPConnector()
+portal = context.getPortalObject()
+maileva_connector = portal.restrictedTraverse(portal.ERP5Site_getAvailableMailevaSOAPConnector())
 result = maileva_connector.getPendingNotificationDetails(track_id)
 if result['status'] == "SENT":
   document = context.getFollowUpValue()

bt5/erp5_maileva_connector/SkinTemplateItem/portal_skins/erp5_maileva_connector/MailevaExchange_submitMailevaRequest.py

+from zExceptions import Unauthorized
+if REQUEST is not None:
+    raise Unauthorized
+
 connector = context.getResourceValue()
 connector.submitRequest(context)

bt5/erp5_maileva_connector/SkinTemplateItem/portal_skins/erp5_maileva_connector/MailevaExchange_submitMailevaRequest.xml

@@ -50,7 +50,15 @@
         </item>
         <item>
             <key> <string>_params</string> </key>
-            <value> <string></string> </value>
+            <value> <string>REQUEST=None</string> </value>
+        </item>
+        <item>
+            <key> <string>_proxy_roles</string> </key>
+            <value>
+              <tuple>
+                <string>Manager</string>
+              </tuple>
+            </value>
         </item>
         <item>
             <key> <string>id</string> </key>

bt5/erp5_maileva_connector/SkinTemplateItem/portal_skins/erp5_maileva_connector/PDF_sendToMaileva.py

@@ -4,7 +4,8 @@ now = DateTime()
 portal = context.getPortalObject()
 
 # Do some check here
-maileva_connector = portal.ERP5Site_getAvailableMailevaSOAPConnector()
+maileva_connector_path = portal.ERP5Site_getAvailableMailevaSOAPConnector()
+maileva_connector = portal.restrictedTraverse(maileva_connector_path)
 
 today = now.toZone('UTC').asdatetime().strftime('%Y-%m-%d')
 number = str(portal.portal_ids.generateNewId(