[FIX] hr_holidays: Allow Team leader to approve

Currently, a Team leader can't approve a leave of an employee
in his team if the leave type requires an allocation.

The reason is the `ir.rule` for `base.group_user` restricting allocation
read access to only your own allocation (`[('employee_id.user_id', '=', user.id)]`)
There are no `ir.rule` for group Team leader.
Therefore, a team leader can't read allocations for his team members.

Fix: add an `ir.rule` to allow a team leader to read allocations
of employees in his team.

+ add associated tests

addons/hr_holidays/security/hr_holidays_security.xml

@@ -129,6 +129,16 @@
         <field name="groups" eval="[(4, ref('group_hr_holidays_manager'))]"/>
     </record>
 
+    <record id="hr_leave_allocation_rule_team_leader" model="ir.rule">
+        <field name="name">Allocations: Team Leader: read employee's allocations in his team</field>
+        <field name="model_id" ref="model_hr_leave_allocation"/>
+        <field name="domain_force">[('employee_id.leave_manager_id', '=' , user.id)]</field>
+        <field name="perm_write" eval="False"/>
+        <field name="perm_create" eval="False"/>
+        <field name="perm_unlink" eval="False"/>
+        <field name="groups" eval="[(4, ref('hr_holidays.group_hr_holidays_team_leader'))]"/>
+    </record>
+
     <record id="resource_leaves_team_leader" model="ir.rule">
         <field name="name">Leaves Resources: Team Leader</field>
         <field name="model_id" ref="model_resource_calendar_leaves"/>

addons/hr_holidays/tests/common.py

@@ -23,6 +23,9 @@ class TestHrHolidaysBase(common.TransactionCase):
         self.user_hrmanager_2 = mail_new_test_user(self.env, login='florence', groups='base.group_user,hr_holidays.group_hr_holidays_manager')
         self.user_hrmanager_2_id = self.user_hrmanager_2.id
 
+        self.user_team_leader = mail_new_test_user(self.env, login='arthur', groups='base.group_user,hr_holidays.group_hr_holidays_team_leader')
+        self.user_team_leader_id = self.user_team_leader.id
+
         # Hr Data
         Department = self.env['hr.department'].with_context(tracking_disable=True)
 

addons/hr_holidays/tests/test_access_rights.py

@@ -362,6 +362,37 @@ class TestLeavesRights(TestHrHolidaysBase):
         self.employee_leave.sudo(self.user_hruser).action_approve()
         self.employee_leave.sudo(self.user_hrmanager_id).action_validate()
 
+    # ----------------------------------------
+    # Validation: team leader
+    # ----------------------------------------
+
+    @mute_logger('odoo.models.unlink', 'odoo.addons.mail.models.mail_mail')
+    def test_leave_validation_team_leader_other(self):
+        """ Team Leader validates its employee's leave only"""
+        self.leave_type.write({'allocation_type': 'fixed'})
+        self.env['hr.leave.allocation'].create({
+            'holiday_status_id': self.leave_type.id,
+            'employee_id': self.employee_emp.id,
+            'number_of_days': 10,
+        }).action_approve()
+        with self.assertRaises(AccessError):
+            self.employee_leave.sudo(self.user_team_leader).action_approve()
+
+    @mute_logger('odoo.models.unlink', 'odoo.addons.mail.models.mail_mail')
+    def test_leave_validation_team_leader(self):
+        """ Team Leader validates its employee's leave"""
+        self.leave_type.write({'allocation_type': 'fixed'})
+
+        # set the team leader
+        self.employee_emp.leave_manager_id = self.user_team_leader
+
+        self.env['hr.leave.allocation'].create({
+            'holiday_status_id': self.leave_type.id,
+            'employee_id': self.employee_emp.id,
+            'number_of_days': 10,
+        }).action_approve()
+        self.employee_leave.sudo(self.user_team_leader).action_approve()
+
 
 class TestMultiCompany(TestHrHolidaysBase):