Let donors view and download their own tax receipts from
``/my/tax-receipts``: a paginated list, a detail page with the receipt
information, its invoices and the native portal chatter, and a PDF
download rendered on demand through the configured ``pdf_form`` report.
The PDF rendering is delegated to ``pdf_form_report`` and nothing is
archived: a confirmed receipt is frozen by ``l10n_fr_tax_receipt``, so
rendering it again yields the same document.
Two safety nets compensate third-party behaviors:
- report resolution by ``report_uuid`` (system parameter
``tax_receipt_in_portal.report_uuid``) with strict validation of
report type and target model;
- a blank-field guard which resolves every mapped PDF field value
before rendering, because ``pdf_form_report`` swallows resolution
errors and would otherwise silently serve a receipt with a blank
amount.
Access is enforced twice: a portal record rule (own commercial partner,
confirmed/sent state only) and an explicit controller domain that also
covers internal users browsing ``/my``.
Tested with 17 tests (portal isolation, draft exposure, chatter data
access, blank-field guard, report misconfiguration, private API
contract of ``pdf_form_report``), including a mutation check proving
the security tests fail when the record rule is opened.
73c0684623