Root cause:
A document that is linked to a record keeps its file in an ir.attachment that carries the record res_model and res_id. Attachment access is granted whenever the linked record is readable, so a user who can read that record but not the document, because the document folder is not shared with them, can still read the file through the attachment, both in the chatter Files panel and through /web/content. The document access rules do not apply here because they only cover documents.document, not the attachment that stores the file. Project creates the folder of a project whose visibility is Invited internal users with Internal users set to None, so a file uploaded from a task lands in a folder that is not shared without any manual change.

Fix:
Override _compute_res_access and _search_res_access on ir.attachment in documents so an attachment that stores a document only grants access when that document is accessible to the user. These two methods are the only paths that decide attachment access, the first for a direct check_access and the second for the record rule applied on search, and documents is the module that links a document to its attachment.

Steps to reproduce:
1. In Settings, Users and Companies, Users, create a new internal user.
2. In Project, create a project, open its Settings and set Visibility to Invited internal users.
3. In the follower list of the project, add that user so they can open the tasks.
4. Create a task in that project and upload a file in its chatter.
5. Log in as that user and open the task.
6. Open the chatter attachments and click the file.

=> the user can open and download the file although the project folder is not shared with them

Ticket [link](https://www.odoo.com/odoo/project/49/tasks/6374227)

opw-6374227