<?xml version="1.0" encoding="utf-8"?>
<odoo>

    <!-- Groups -->
    <record id="group_fusion_clock_user" model="res.groups">
        <field name="name">Fusion Clock / User</field>
        <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
        <field name="comment">Can clock in/out and view own attendance</field>
    </record>

    <record id="group_fusion_clock_team_lead" model="res.groups">
        <field name="name">Fusion Clock / Team Lead</field>
        <field name="implied_ids" eval="[(4, ref('group_fusion_clock_user'))]"/>
        <field name="comment">Can view direct reports attendance (read-only)</field>
    </record>

    <record id="group_fusion_clock_manager" model="res.groups">
        <field name="name">Fusion Clock / Manager</field>
        <field name="implied_ids" eval="[(4, ref('group_fusion_clock_team_lead'))]"/>
        <field name="comment">Can manage locations, view all attendance, generate reports</field>
    </record>

    <!-- Auto-assign admin to Manager group -->
    <function model="res.users" name="write">
        <value eval="[ref('base.user_admin')]"/>
        <value eval="{'group_ids': [(4, ref('group_fusion_clock_manager'))]}"/>
    </function>

    <!-- ================================================================
         Record Rules - Clock Location
         ================================================================ -->
    <record id="rule_clock_location_user" model="ir.rule">
        <field name="name">Clock Location: User sees active company locations</field>
        <field name="model_id" ref="model_fusion_clock_location"/>
        <field name="domain_force">[('company_id', 'in', company_ids), ('active', '=', True)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_user'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_clock_location_manager" model="ir.rule">
        <field name="name">Clock Location: Manager full access</field>
        <field name="model_id" ref="model_fusion_clock_location"/>
        <field name="domain_force">[('company_id', 'in', company_ids)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_manager'))]"/>
    </record>

    <!-- ================================================================
         Record Rules - Clock Penalty
         ================================================================ -->
    <record id="rule_clock_penalty_user" model="ir.rule">
        <field name="name">Clock Penalty: User sees own penalties</field>
        <field name="model_id" ref="model_fusion_clock_penalty"/>
        <field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_user'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_clock_penalty_team_lead" model="ir.rule">
        <field name="name">Clock Penalty: Team Lead sees direct reports</field>
        <field name="model_id" ref="model_fusion_clock_penalty"/>
        <field name="domain_force">['|', ('employee_id.user_id', '=', user.id), ('employee_id.parent_id.user_id', '=', user.id)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_team_lead'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_clock_penalty_manager" model="ir.rule">
        <field name="name">Clock Penalty: Manager full access</field>
        <field name="model_id" ref="model_fusion_clock_penalty"/>
        <field name="domain_force">[(1, '=', 1)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_manager'))]"/>
    </record>

    <!-- ================================================================
         Record Rules - Clock Report
         ================================================================ -->
    <record id="rule_clock_report_user" model="ir.rule">
        <field name="name">Clock Report: User sees own reports</field>
        <field name="model_id" ref="model_fusion_clock_report"/>
        <field name="domain_force">['|', ('employee_id.user_id', '=', user.id), ('employee_id', '=', False)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_user'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_clock_report_manager" model="ir.rule">
        <field name="name">Clock Report: Manager full access</field>
        <field name="model_id" ref="model_fusion_clock_report"/>
        <field name="domain_force">[(1, '=', 1)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_manager'))]"/>
    </record>

    <!-- ================================================================
         Record Rules - Activity Log
         ================================================================ -->
    <record id="rule_activity_log_user" model="ir.rule">
        <field name="name">Activity Log: User sees own logs</field>
        <field name="model_id" ref="model_fusion_clock_activity_log"/>
        <field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_user'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_activity_log_team_lead" model="ir.rule">
        <field name="name">Activity Log: Team Lead sees direct reports</field>
        <field name="model_id" ref="model_fusion_clock_activity_log"/>
        <field name="domain_force">['|', ('employee_id.user_id', '=', user.id), ('employee_id.parent_id.user_id', '=', user.id)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_team_lead'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_activity_log_manager" model="ir.rule">
        <field name="name">Activity Log: Manager full access</field>
        <field name="model_id" ref="model_fusion_clock_activity_log"/>
        <field name="domain_force">[(1, '=', 1)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_manager'))]"/>
    </record>

    <!-- ================================================================
         Record Rules - Leave Request
         ================================================================ -->
    <record id="rule_leave_request_user" model="ir.rule">
        <field name="name">Leave Request: User sees own</field>
        <field name="model_id" ref="model_fusion_clock_leave_request"/>
        <field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_user'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_leave_request_manager" model="ir.rule">
        <field name="name">Leave Request: Manager full access</field>
        <field name="model_id" ref="model_fusion_clock_leave_request"/>
        <field name="domain_force">[(1, '=', 1)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_manager'))]"/>
    </record>

    <!-- ================================================================
         Record Rules - Shift
         ================================================================ -->
    <record id="rule_shift_user" model="ir.rule">
        <field name="name">Shift: User reads active</field>
        <field name="model_id" ref="model_fusion_clock_shift"/>
        <field name="domain_force">[('active', '=', True)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_user'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_shift_manager" model="ir.rule">
        <field name="name">Shift: Manager full access</field>
        <field name="model_id" ref="model_fusion_clock_shift"/>
        <field name="domain_force">[(1, '=', 1)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_manager'))]"/>
    </record>

    <!-- ================================================================
         Record Rules - Correction Request
         ================================================================ -->
    <record id="rule_correction_user" model="ir.rule">
        <field name="name">Correction: User sees own</field>
        <field name="model_id" ref="model_fusion_clock_correction"/>
        <field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_user'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_correction_team_lead" model="ir.rule">
        <field name="name">Correction: Team Lead sees direct reports</field>
        <field name="model_id" ref="model_fusion_clock_correction"/>
        <field name="domain_force">['|', ('employee_id.user_id', '=', user.id), ('employee_id.parent_id.user_id', '=', user.id)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_team_lead'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_correction_manager" model="ir.rule">
        <field name="name">Correction: Manager full access</field>
        <field name="model_id" ref="model_fusion_clock_correction"/>
        <field name="domain_force">[(1, '=', 1)]</field>
        <field name="groups" eval="[(4, ref('group_fusion_clock_manager'))]"/>
    </record>

    <!-- ================================================================
         Portal Access
         ================================================================ -->
    <record id="rule_hr_attendance_portal" model="ir.rule">
        <field name="name">HR Attendance: Portal user sees own</field>
        <field name="model_id" ref="hr_attendance.model_hr_attendance"/>
        <field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_clock_location_portal" model="ir.rule">
        <field name="name">Clock Location: Portal user sees active</field>
        <field name="model_id" ref="model_fusion_clock_location"/>
        <field name="domain_force">[('active', '=', True)]</field>
        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_clock_report_portal" model="ir.rule">
        <field name="name">Clock Report: Portal user sees own</field>
        <field name="model_id" ref="model_fusion_clock_report"/>
        <field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_clock_penalty_portal" model="ir.rule">
        <field name="name">Clock Penalty: Portal user sees own</field>
        <field name="model_id" ref="model_fusion_clock_penalty"/>
        <field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_activity_log_portal" model="ir.rule">
        <field name="name">Activity Log: Portal user sees own</field>
        <field name="model_id" ref="model_fusion_clock_activity_log"/>
        <field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_leave_request_portal" model="ir.rule">
        <field name="name">Leave Request: Portal user sees own</field>
        <field name="model_id" ref="model_fusion_clock_leave_request"/>
        <field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

    <record id="rule_correction_portal" model="ir.rule">
        <field name="name">Correction: Portal user sees own</field>
        <field name="model_id" ref="model_fusion_clock_correction"/>
        <field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_create" eval="False"/>
        <field name="perm_unlink" eval="False"/>
    </record>

</odoo>
