From a8ab3063e88537b33b9947971f4e3bf3892d4ced Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lucas=20Lef=C3=A8vre?= <lul@odoo.com>
Date: Fri, 1 Mar 2019 14:30:39 +0000
Subject: [PATCH] [FIX] hr_holidays: Allow Team leader to approve

Currently, a Team leader can't approve a leave of an employee
in his team if the leave type requires an allocation.

The reason is the `ir.rule` for `base.group_user` restricting allocation
read access to only your own allocation (`[('employee_id.user_id', '=', user.id)]`)
There are no `ir.rule` for group Team leader.
Therefore, a team leader can't read allocations for his team members.

Fix: add an `ir.rule` to allow a team leader to read allocations
of employees in his team.

+ add associated tests
---
 .../security/hr_holidays_security.xml         | 10 ++++++
 addons/hr_holidays/tests/common.py            |  3 ++
 .../hr_holidays/tests/test_access_rights.py   | 31 +++++++++++++++++++
 3 files changed, 44 insertions(+)

diff --git a/addons/hr_holidays/security/hr_holidays_security.xml b/addons/hr_holidays/security/hr_holidays_security.xml
index 3e10c16ca65..fb49f9a0ef6 100644
--- a/addons/hr_holidays/security/hr_holidays_security.xml
+++ b/addons/hr_holidays/security/hr_holidays_security.xml
@@ -129,6 +129,16 @@
         <field name="groups" eval="[(4, ref('group_hr_holidays_manager'))]"/>
     </record>
 
+    <record id="hr_leave_allocation_rule_team_leader" model="ir.rule">
+        <field name="name">Allocations: Team Leader: read employee's allocations in his team</field>
+        <field name="model_id" ref="model_hr_leave_allocation"/>
+        <field name="domain_force">[('employee_id.leave_manager_id', '=' , user.id)]</field>
+        <field name="perm_write" eval="False"/>
+        <field name="perm_create" eval="False"/>
+        <field name="perm_unlink" eval="False"/>
+        <field name="groups" eval="[(4, ref('hr_holidays.group_hr_holidays_team_leader'))]"/>
+    </record>
+
     <record id="resource_leaves_team_leader" model="ir.rule">
         <field name="name">Leaves Resources: Team Leader</field>
         <field name="model_id" ref="model_resource_calendar_leaves"/>
diff --git a/addons/hr_holidays/tests/common.py b/addons/hr_holidays/tests/common.py
index 0f9c6f1cc89..510c6883b41 100644
--- a/addons/hr_holidays/tests/common.py
+++ b/addons/hr_holidays/tests/common.py
@@ -23,6 +23,9 @@ class TestHrHolidaysBase(common.TransactionCase):
         self.user_hrmanager_2 = mail_new_test_user(self.env, login='florence', groups='base.group_user,hr_holidays.group_hr_holidays_manager')
         self.user_hrmanager_2_id = self.user_hrmanager_2.id
 
+        self.user_team_leader = mail_new_test_user(self.env, login='arthur', groups='base.group_user,hr_holidays.group_hr_holidays_team_leader')
+        self.user_team_leader_id = self.user_team_leader.id
+
         # Hr Data
         Department = self.env['hr.department'].with_context(tracking_disable=True)
 
diff --git a/addons/hr_holidays/tests/test_access_rights.py b/addons/hr_holidays/tests/test_access_rights.py
index ca651a69010..00ac2856d20 100644
--- a/addons/hr_holidays/tests/test_access_rights.py
+++ b/addons/hr_holidays/tests/test_access_rights.py
@@ -362,6 +362,37 @@ class TestLeavesRights(TestHrHolidaysBase):
         self.employee_leave.sudo(self.user_hruser).action_approve()
         self.employee_leave.sudo(self.user_hrmanager_id).action_validate()
 
+    # ----------------------------------------
+    # Validation: team leader
+    # ----------------------------------------
+
+    @mute_logger('odoo.models.unlink', 'odoo.addons.mail.models.mail_mail')
+    def test_leave_validation_team_leader_other(self):
+        """ Team Leader validates its employee's leave only"""
+        self.leave_type.write({'allocation_type': 'fixed'})
+        self.env['hr.leave.allocation'].create({
+            'holiday_status_id': self.leave_type.id,
+            'employee_id': self.employee_emp.id,
+            'number_of_days': 10,
+        }).action_approve()
+        with self.assertRaises(AccessError):
+            self.employee_leave.sudo(self.user_team_leader).action_approve()
+
+    @mute_logger('odoo.models.unlink', 'odoo.addons.mail.models.mail_mail')
+    def test_leave_validation_team_leader(self):
+        """ Team Leader validates its employee's leave"""
+        self.leave_type.write({'allocation_type': 'fixed'})
+
+        # set the team leader
+        self.employee_emp.leave_manager_id = self.user_team_leader
+
+        self.env['hr.leave.allocation'].create({
+            'holiday_status_id': self.leave_type.id,
+            'employee_id': self.employee_emp.id,
+            'number_of_days': 10,
+        }).action_approve()
+        self.employee_leave.sudo(self.user_team_leader).action_approve()
+
 
 class TestMultiCompany(TestHrHolidaysBase):