Steps to reproduce:
- Download 'Project' and 'Subscription'
- Create a product with: -- Product type: 'Service'
-- Create on order: 'Task'
-- Project: Pick any
-- Recurring checkbox must not be ticked
- Subscription > New > Add any recurring product > Confirm
- Create invoice > Confirm invoice > Back to subscription
- Upsell > Add your task creation product > Confirm
- The project is linked but no task is created

The ability to create tasks from upsell orders was disabled in cbbc70f73e6fe9e29e27dea4415e20a262bbdf82.
According to the commit message, this was done because upsell orders prorate the price of subscriptions accoding to the time until next invoice relative to the subscription's recurrence (i.e. if the upsell is created halfway through the recurrence it is discounted by 50% etc...). Since we do not have a way to prorate tasks it is marked as a technical limitation.

This however does not need to extend to non-recurring products on subscription sale orders as they are not prorated.

opw-4114049

Issue 1:
========

To reproduce:
-------------
- on an appraisal request -> ask for feedback -> set a deadline
- the employee can answer after the deadline

Problem:
--------

the method `_check_validity` was overriden in `hr_appraisal_survey` module to do different checks than the original method in `survey` module in case of `validity_code = answer_wrong_user`, but this override bypasses the other checks in the original method like the deadline check.

Solution:
---------

call the original method `_check_validity` in the override, to make sure all the checks are done, then if the original method returns `validity_code = answer_wrong_user` we can do our specific checks.

Issue 2:
========

To reproduce:
-------------

- on an appraisal request -> ask for feedback -> set a deadline
- manager can't see the answers after the deadline

Problem:
--------

- to display answer in appraisal module we rely on the url of the survey
that contains the tokens for suervey/answer
- the deadline handling is done in the survey module where the url is dead
after the deadline which is not suitable for the appraisal module

Solution:
---------

- override the method `_get_access_data` and bypass the deadline check
in case of appraisal feedback for manager.

opw-4128638

Steps to reproduce:
- Helpdesk > Configuration > SLA policies
- Create one if necessary or use existing
- Helpdesk > Tickets > Create
- Configure it so that it corresponds to SLA requirements
- Duplicate the ticket and merge them both (data_merge module required)

Currently helpdesk ticket uses the default merge fuction, which simply concatenates the values of merged records. This causes a few strange things to happen:

1. sla_ids which registers SLA policy types, has duplicate entries. This recordset should remain a set.

2. Followers of the merged tickets are sometimes not added to the resulting record. The default merge simply swaps the resource id with no regard for a possible duplication of unique key (res_model, res_id, partner_id), which causes the transaction to fail on repeat followers. This is a common problem with every record inheriting mail.thread which does not define its own merge function as well.

3. Keeping every SLA status record is redundant, merging tickets makes it impossbile to keep track of which task each deadline was originally related to anyway. Hence why we only keep those with the shortest deadline for each type. Priority is not a concern here since SLA policies are recomputed according to a ticket's priority rating, so we cannot have 2 SLAs with the same policy and different priorities.

opw-4037262

Steps to reproduce the error:
- Install "contacts" and "whatsapp" module
- Configure WhatsApp Business Account and create a whatsapp template
- Go to Contacts > Create a new contact > add mobile number >
  click on whatsapp button > select template > send message
- reply to message from mobile number
- Delete contact
- Go to Discuss > open channel of contact > send message

Traceback:
```
IndexError: tuple index out of range
  File "odoo/http.py", line 2256, in __call__
    response = request._serve_db()
  File "odoo/http.py", line 1832, in _serve_db
    return self._transactioning(_serve_ir_http, readonly=ro)
  File "odoo/http.py", line 1852, in _transactioning
    return service_model.retrying(func, env=self.env)
  File "odoo/service/model.py", line 134, in retrying
    result = func()
  File "odoo/http.py", line 1830, in _serve_ir_http
    return self._serve_ir_http(rule, args)
  File "odoo/http.py", line 1837, in _serve_ir_http
    response = self.dispatcher.dispatch(rule.endpoint, args)
  File "odoo/http.py", line 2062, in dispatch
    result = self.request.registry['ir.http']._dispatch(endpoint)
  File "odoo/addons/base/models/ir_http.py", line 220, in _dispatch
    result = endpoint(**request.params)
  File "odoo/http.py", line 742, in route_wrapper
    result = endpoint(self, *args, **params_ok)
  File "home/odoo/src/enterprise/saas-17.2/whatsapp/controller/main.py", line 41, in webhookpost
    request.env['whatsapp.message']._process_statuses(value)
  File "home/odoo/src/enterprise/saas-17.2/whatsapp/models/whatsapp_message.py", line 413, in _process_statuses
    whatsapp_message_id._update_message_fetched_seen()
  File "home/odoo/src/enterprise/saas-17.2/whatsapp/models/whatsapp_message.py", line 426, in _update_message_fetched_seen
    channel_member = channel.channel_member_ids.filtered(lambda cm: cm.partner_id == channel.whatsapp_partner_id)[0]
  File "odoo/models.py", line 6580, in __getitem__
    return self.browse((self._ids[key],))
```

https://github.com/odoo/enterprise/blob/a134bea9c6fa1a0806c5501046e358c82d7a3fe5/whatsapp/models/whatsapp_message.py#L428
Here, when user deletes the contact, channel.whatsapp_partner_id will be False,
and channel_member will become an empty tuple,
So when it tries to access the index of an empty tuple,
It will lead to the above traceback.

sentry-5314291061

Steps to reproduce the bug:
- Log in as a Kenyan company
- Create a storable product “P1” with the following Bill of Materials (BoM):
  - Type: Subcontracting
  - Subcontractor: Azure Interior
  - Component:
    - C1: - Routes: “Resupply Subcontractor on Order”

- Create a purchase order for one unit of “P1”
- Confirm the PO
- Create a second PO for one unit of “C1” and receive it
- Confirm the resupply picking of C1
- Confirm the receipt of P1

**Problem:**
A validation error is triggered: “You cannot end up with a negative stock quantity.”

We added a constraint to prevent negative stock quantities in internal locations for a company in Kenya. However, the location linked to subcontracting is internal but has no warehouse, so we don’t care if its quantity is negative, and it should be ignored. This could also happen with other internal locations that don’t have a warehouse.

Additionally, when reporting stock quantities, we only consider
quantities in locations that have a warehouse:
https://github.com/odoo/enterprise/blob/9dea0f2696084235ee1192b0a14adfa43eb732ef/l10n_ke_edi_oscu_stock/models/product.py#L47


opw-4184857

To reproduce the bug:

1. Install the subscription feature on your website.
2. Create a second company and link it to the website.
3. Create a recurring product with the service type.
4. In the subscription app, create a quotation with the specified product.
5. Preview the invoice for the quotation.
6. Copy the link for the portal invoice and open it in an incognito window.
7. Pay the invoice.

You will encounter a TraceBack error depending on the modules installed. This is due to the `company_id` being set to an empty record as a result of how it is computed here:

https://github.com/odoo/odoo/blob/17.0/addons/account/models/account_move.py#L696-L698

In our case, `move.journal_id.company_id` (the invoice company) exists, so `self.env.company` (the website company) gets ignored. However, since the public user of the website doesn't have access to the invoice company, the `company_id` is set to an empty record after checking the access rights with `._accessible_branches()[:1]`.

opw-3999546

Steps to reproduce:
- Project > New > Create Project
- Project > ':' menu > Settings > Settings tab
- Set 'Visibility' to 'Invited Internal Users'
- Create a task and assign it to Marc Demo
- General Settings > Users & Companies > Users
- Edit Marc Demo to have 'User' access rights in 'Project'
- As Marc Demo: Project > Tasks > My Tasks > Click your task

Access is denied because Marc is not a follower of the project, and therefore cannot read the task's 'is_fsm' field (which is computed from the project). Due to the specifications of the visibility mode, the task should however be accessible to him.

A fix was previously made for a similar issue in Field Service 5fc4f7d15e56d2b4335aa70e896fdfbd901d6076, where we changed the _search_is_fsm function to sudo the project for the same reason as here (accessing project_id.is_fsm) so this should not raise any additional security concerns.

In that same fix we switched from a related field to a compute, compute_sudo was however defaulting to False since is_fsm is not stored, hence the access error.

opw-4176243