[IMP] hr_holidays: add company access rule to hr_leave

Before this commit, a company access rule existed for hr_leave but it
checked the company of the associated leave type, instead of the
company associated with the specific employee (or company in case of a
company leave) the leave applied to. This is especially problematic as
leave type are often reused across companies.

This was partially worked around by forcing the company domain using
employee_company_id on the specific actions that showed overviews of
leaves.

With this commit, this is rectified.

task-3383478

Part-of: odoo/odoo#119317

addons/hr_holidays/models/hr_leave.py

@@ -163,7 +163,8 @@ class HolidaysRequest(models.Model):
     employee_id = fields.Many2one(
         'hr.employee', compute='_compute_from_employee_ids', store=True, string='Employee', index=True, readonly=False, ondelete="restrict",
         tracking=True, compute_sudo=False)
-    employee_company_id = fields.Many2one(related='employee_id.company_id', readonly=True, store=True)
+    employee_company_id = fields.Many2one(related='employee_id.company_id', string="Employee Company", readonly=True, store=True)
+    company_id = fields.Many2one('res.company', compute='_compute_company_id', readonly=True, store=True)
     active_employee = fields.Boolean(related='employee_id.active', string='Employee Active', readonly=True)
     tz_mismatch = fields.Boolean(compute='_compute_tz_mismatch')
     tz = fields.Selection(_tz_get, compute='_compute_tz')
@@ -496,6 +497,14 @@ class HolidaysRequest(models.Model):
             else:
                 holiday.number_of_days = 0
 
+    @api.depends('employee_company_id', 'mode_company_id')
+    def _compute_company_id(self):
+        for holiday in self:
+            holiday.company_id = holiday.employee_company_id \
+                or holiday.mode_company_id \
+                or holiday.department_id.company_id \
+                or self.env.company
+
     @api.depends('tz')
     @api.depends_context('uid')
     def _compute_tz_mismatch(self):

addons/hr_holidays/security/hr_holidays_security.xml

@@ -135,7 +135,7 @@
     <record id="hr_leave_rule_multicompany" model="ir.rule">
         <field name="name">Time Off: multi company global rule</field>
         <field name="model_id" ref="model_hr_leave"/>
-        <field name="domain_force">['|', ('holiday_status_id.company_id', '=', False), ('holiday_status_id.company_id', 'in', company_ids)]</field>
+        <field name="domain_force">[('company_id', 'in', company_ids)]</field>
     </record>
 
     <record id="hr_leave_allocation_rule_multicompany" model="ir.rule">

addons/hr_holidays/tests/test_access_rights.py

@@ -466,7 +466,7 @@ class TestAccessRightsCreate(TestHrHolidaysAccessRightsCommon):
             'name': 'Hol10',
             'holiday_status_id': self.leave_type.id,
             'holiday_type': 'company',
-            'mode_company_id': 1,
+            'mode_company_id': self.company.id,
         }
         self.request_leave(self.user_hrmanager_id, datetime.today() + relativedelta(days=5), 1, values)
 
@@ -782,6 +782,7 @@ class TestMultiCompany(TestHrHolidaysCommon):
             'leave_validation_type': 'hr',
             'requires_allocation': 'no',
         })
+        cls.employee_emp.company_id = cls.new_company
         cls.rd_dept.manager_id = False
         cls.hr_dept.manager_id = False
 
@@ -827,6 +828,7 @@ class TestMultiCompany(TestHrHolidaysCommon):
 
     @mute_logger('odoo.models.unlink', 'odoo.addons.mail.models.mail_mail')
     def test_leave_access_no_company_user(self):
+        self.employee_emp.company_id = self.user_employee.company_id
         self.leave_type.write({'company_id': False})
         employee_leave = self.employee_leave.with_user(self.user_employee)
 
@@ -837,6 +839,7 @@ class TestMultiCompany(TestHrHolidaysCommon):
 
     @mute_logger('odoo.models.unlink', 'odoo.addons.mail.models.mail_mail')
     def test_leave_access_no_company_officer(self):
+        self.employee_emp.company_id = self.user_employee.company_id
         self.leave_type.write({'company_id': False})
         employee_leave_hruser = self.employee_leave.with_user(self.user_hruser)
 
@@ -846,6 +849,7 @@ class TestMultiCompany(TestHrHolidaysCommon):
 
     @mute_logger('odoo.models.unlink', 'odoo.addons.mail.models.mail_mail')
     def test_leave_access_no_company_manager(self):
+        self.employee_emp.company_id = self.user_employee.company_id
         self.leave_type.write({'company_id': False})
         employee_leave_hrmanager = self.employee_leave.with_user(self.user_hrmanager)
 

addons/hr_holidays/views/hr_leave_views.xml

@@ -467,7 +467,6 @@
                 <field name="duration_display" string="Duration"/>
                 <field name="state" widget="badge" decoration-info="state == 'draft'" decoration-warning="state in ('confirm','validate1')" decoration-success="state == 'validate'"/>
                 <field name="active_employee" column_invisible="True"/>
-                <field name="employee_company_id" column_invisible="True"/>
                 <field name="category_id" column_invisible="True" readonly="state not in ['confirm', 'draft']"/>
                 <field name="user_id" column_invisible="True"/>
                 <field name="message_needaction" column_invisible="True"/>
@@ -630,7 +629,7 @@
         <field name="search_view_id" ref="hr_leave_view_search_my"/>
         <field name="view_ids" eval="[(5, 0, 0),
                 (0, 0, {'view_mode': 'kanban', 'view_id': ref('hr_leave_view_kanban_my')})]"/>
-        <field name="domain">[('user_id', '=', uid), ('employee_company_id', 'in', allowed_company_ids)]</field>
+        <field name="domain">[('user_id', '=', uid)]</field>
         <field name="help" type="html">
             <p class="o_view_nocontent_smiling_face">
                 Keep track of your PTOs.