[pull] develop from frappe:develop

.github/workflows/linters.yml

@@ -46,4 +46,7 @@ jobs:
         run: pip install semgrep
 
       - name: Run Semgrep rules
-        run: semgrep ci --config ./frappe-semgrep-rules/rules --config r/python.lang.correctness
+        run: semgrep ci --config ./frappe-semgrep-rules/rules --config r/python.lang.correctness
+
+      - name: Semgrep for Test Correctness
+        run: semgrep ci --include=**/test_*.py --config ./semgrep/test-correctness.yml        

hrms/hr/doctype/leave_application/leave_application.py

@@ -968,6 +968,8 @@ def get_number_of_leave_days(
 
 @frappe.whitelist()
 def get_leave_details(employee: str, date: str | datetime.date, for_salary_slip: bool = False) -> dict:
+	frappe.has_permission("Employee", "read", employee, throw=True)
+
 	allocation_records = get_leave_allocation_records(employee, date)
 	leave_allocation = {}
 	precision = cint(frappe.db.get_single_value("System Settings", "float_precision")) or 2
@@ -1027,6 +1029,8 @@ def get_leave_balance_on(
 	        if True, returns a dict eg: {'leave_balance': 10, 'leave_balance_for_consumption': 1}
 	        else, returns leave_balance (in this case 10)
 	"""
+	if frappe.request:
+		frappe.has_permission("Employee", "read", employee, throw=True)
 
 	if not to_date:
 		to_date = nowdate()

semgrep/test-correctness.yml

@@ -0,0 +1,18 @@
+rules:
+- id: Dont-commit
+  pattern: frappe.db.commit()
+  message: Commiting inside test breaks idempotency.
+  languages: [python]
+  severity: ERROR
+- id: Implicit-commit
+  pattern: frappe.db.truncate()
+  message: DB truncation does implict commit which breaks test idempotency.
+  languages: [python]
+  severity: ERROR
+- id: Dont-override-teardown
+  pattern: |
+    def tearDown(...):
+      ...
+  message: HRMSTestSuite forces rollback on each tearDown, which ensures idempotency. Don't override tearDown.
+  languages: [python]
+  severity: ERROR