[FIX] mail, hr_recruitment: fix creation of alias for source

A user that is not admin cannot create an mail.alias.
We can create the alias in sudo since we control the default_values and
model that are created with the new alias.

Check the _check_alias_domain_id_mc constraint in sudo because non amdin
user cannot read model ir.model.

closes odoo/odoo#153222

Signed-off-by: Olivier Dony (odo) <odo@odoo.com>

addons/hr_recruitment/models/hr_recruitment_source.py

@@ -40,7 +40,11 @@ class RecruitmentSource(models.Model):
                 'alias_parent_thread_id': source.job_id.id,
                 'alias_parent_model_id': self.env['ir.model']._get_id('hr.job'),
             }
-            source.alias_id = self.env['mail.alias'].create(vals)
+
+            # check that you can create source before to call mail.alias in sudo with known/controlled vals
+            source.check_access_rights('create')
+            source.check_access_rule('create')
+            source.alias_id = self.env['mail.alias'].sudo().create(vals)
 
     def unlink(self):
         """ Cascade delete aliases to avoid useless / badly configured aliases. """

addons/mail/models/mail_alias.py

@@ -108,7 +108,9 @@ class Alias(models.Model):
         """ Check for invalid alias domains based on company configuration.
         When having a parent record and/or updating an existing record alias
         domain should match the one used on the related record. """
-        tocheck = self.filtered(lambda domain: domain.alias_domain_id.company_ids)
+
+        # in sudo, to be able to read alias_parent_model_id (ir.model)
+        tocheck = self.sudo().filtered(lambda domain: domain.alias_domain_id.company_ids)
         if not tocheck:
             return