ERP5Catalog: Allow not relying on catalog to index documents in catalog.

But still rely on it by default.

product/ERP5Catalog/CatalogTool.py

@@ -852,12 +852,34 @@ class CatalogTool (UniqueObject, ZCatalog, CMFCoreCatalogTool, ActiveObject):
         """
         return ZCatalog.countResults(self, REQUEST, **kw)
 
+    def _filterUserIdSet(id_set):
+      """
+      This is the historical implementation answering the need to sort out
+      which identifiers are actual users, the others being assumed to be
+      security groups.
+      The issue with this approach is that searchUsers, when involving
+      ERP5 user plugins, relies on the catalog. Which means that if a user
+      document (ex: Person) grants a local role to its user, the first
+      indexation will be unable to find that user through searchUsers, and
+      hence will assume it is a security group. In turn, this means that
+      role-specific catalog columns cannot be used for this role on such
+      document, causing a security uid to be allocated. On second
+      reindexation, the user will be properly identified as a user, but
+      security uids are never de-allocated and so the cost of having that
+      extra entry around (longer list of possible values applying to
+      security_uid column) will persist.
+      """
+      return (
+        x['id'] for x in self.getPortalObject().acl_users.searchUsers(
+          id=list(id_set),
+          exact_match=True,
+        )
+      )
+
     def wrapObjectList(self, object_value_list, catalog_value):
       """
         Return a list of wrapped objects for reindexing.
       """
-      portal = self.getPortalObject()
-
       user_set = set()
       catalog_role_set = {x for x, _ in catalog_value.getSQLCatalogRoleKeysList()}
       catalog_security_uid_groups_columns_dict = catalog_value.getSQLCatalogSecurityUidGroupsColumnsDict()
@@ -896,10 +918,11 @@ class CatalogTool (UniqueObject, ZCatalog, CMFCoreCatalogTool, ActiveObject):
         # affected by this, which must happen before _getSecurityParameterList
         # is called (which happens when calling getSecurityUidDict below).
         user_set.update(
-          x['id'] for x in portal.acl_users.searchUsers(
-            id=list(security_group_set),
-            exact_match=True,
-          )
+          getattr(
+            self,
+            'ERP5Site_filterUserIdSet',
+            self._filterUserIdSet,
+          )(security_group_set),
         )
 
       getSecurityUidDict = catalog_value.getSecurityUidDict