diff --git a/CLAUDE.md b/CLAUDE.md
index 3d6588f4..bedaf02a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -13,7 +13,7 @@
4. **HTTP routes**: `type="jsonrpc"` — NOT `type="json"` (deprecated).
5. **res.config.settings**: Only boolean/integer/float/char/selection/many2one/datetime. NO Date fields.
**`config_parameter=` Boolean fields don't round-trip `False` as a string.** Odoo's `set_values()` calls `IrConfigParameter.set_param(key, value)`, and `set_param` deletes the row when `value` is falsy (False / None / empty). So writing `False` to a Boolean config field means the param no longer exists in `ir_config_parameter`; a subsequent `get_param(key)` returns the *default* (Python `False`), not `'False'`. Test like `self.assertFalse(ICP.get_param('...'))` — never `assertEqual(..., 'False')`. (Integer/Float/Char go through `repr(value)` / strip, so they DO persist as strings — `'90'`, `'0'`, etc.) Source: `odoo/addons/base/models/res_config.py::set_values` and `ir_config_parameter.py::set_param`.
-6. **res.groups**: NO `users` field, NO `category_id` field.
+6. **res.groups**: NO `users` field, NO `category_id` field. **The Odoo 19 replacement for `category_id` is `res.groups.privilege`.** To make a module's groups appear as application-access dropdowns on the user form (Settings → Users → *Application Accesses*) instead of only in developer mode: define an `ir.module.category`, a `res.groups.privilege` (with `category_id` → that category), and set each group's `privilege_id` → that privilege. Groups under one privilege that form an `implied_ids` chain render as a single role dropdown; a standalone group in its own privilege renders as a separate row under the same category header. Verified in `fusion_clock/security/security.xml`; mirrors `fusion_plating`/`fusion_tasks`.
**res.users**: field was renamed `groups_id` → `group_ids` (also `all_group_ids` for implied). The plural form is gone; using `groups_id` raises `ValueError: Invalid field 'groups_id' in 'res.users'`.
**`ir.ui.view`**: same rename — view-level visibility gating uses `group_ids`, not `groups_id`. A record like ``, ``, `` is unrelated and still works.)
**`ir.rule` `groups` field is additive, not restrictive.** A rule with `groups=[some_group]` applies ONLY to users in that group — it does NOT restrict non-members. So `domain_force=[(1,'=',1)]` + `groups=[base.group_system]` does NOT mean "only admins see rows"; it means "admins see all rows (and the rule is silent on everyone else)". Non-admins are gated by the ACL (`ir.model.access.csv`), not the rule. To truly restrict by group at the rule layer, pair a global rule (`groups=[]`, `domain_force=[(0,'=',1)]` = block-all baseline) with a group-scoped allow rule. Default to letting the ACL do the gating; use rules for row-level filters that ACLs cannot express.
diff --git a/fusion_clock/__manifest__.py b/fusion_clock/__manifest__.py
index 804fbc05..417a762a 100644
--- a/fusion_clock/__manifest__.py
+++ b/fusion_clock/__manifest__.py
@@ -5,7 +5,7 @@
{
'name': 'Fusion Clock',
- 'version': '19.0.3.5.6',
+ 'version': '19.0.3.6.0',
'category': 'Human Resources/Attendances',
'summary': 'Complete Employee T&A with Geofencing, Shifts, Penalties, Overtime, Kiosk, Dashboard & Payroll Export',
'description': """
diff --git a/fusion_clock/controllers/clock_kiosk.py b/fusion_clock/controllers/clock_kiosk.py
index 30ca2fcb..efe4264e 100644
--- a/fusion_clock/controllers/clock_kiosk.py
+++ b/fusion_clock/controllers/clock_kiosk.py
@@ -10,6 +10,12 @@ from odoo.addons.fusion_clock.models.tz_utils import get_local_today
_logger = logging.getLogger(__name__)
+def _is_kiosk_operator(user):
+ """Kiosk surfaces accept a full Clock Manager OR a dedicated Kiosk Operator."""
+ return (user.has_group('fusion_clock.group_fusion_clock_manager')
+ or user.has_group('fusion_clock.group_fusion_clock_kiosk_app'))
+
+
class FusionClockKiosk(http.Controller):
"""Kiosk mode controller for shared-device clock-in/out."""
@@ -17,7 +23,7 @@ class FusionClockKiosk(http.Controller):
def kiosk_page(self, **kw):
"""Kiosk clock-in/out page for shared tablets."""
user = request.env.user
- if not user.has_group('fusion_clock.group_fusion_clock_manager'):
+ if not _is_kiosk_operator(user):
return request.redirect('/my')
ICP = request.env['ir.config_parameter'].sudo()
@@ -34,7 +40,7 @@ class FusionClockKiosk(http.Controller):
def kiosk_search(self, query='', **kw):
"""Search employees for kiosk identification."""
user = request.env.user
- if not user.has_group('fusion_clock.group_fusion_clock_manager'):
+ if not _is_kiosk_operator(user):
return {'error': 'Access denied.'}
employees = request.env['hr.employee'].sudo().search([
@@ -55,7 +61,7 @@ class FusionClockKiosk(http.Controller):
def kiosk_verify_pin(self, employee_id=0, pin='', **kw):
"""Verify employee PIN for kiosk mode."""
user = request.env.user
- if not user.has_group('fusion_clock.group_fusion_clock_manager'):
+ if not _is_kiosk_operator(user):
return {'error': 'Access denied.'}
employee = request.env['hr.employee'].sudo().browse(employee_id)
@@ -75,7 +81,7 @@ class FusionClockKiosk(http.Controller):
def kiosk_clock(self, employee_id=0, latitude=0, longitude=0, **kw):
"""Perform clock action from kiosk on behalf of an employee."""
user = request.env.user
- if not user.has_group('fusion_clock.group_fusion_clock_manager'):
+ if not _is_kiosk_operator(user):
return {'error': 'Access denied.'}
employee = request.env['hr.employee'].sudo().browse(employee_id)
diff --git a/fusion_clock/controllers/clock_nfc_kiosk.py b/fusion_clock/controllers/clock_nfc_kiosk.py
index ae18ebc9..8699e1de 100644
--- a/fusion_clock/controllers/clock_nfc_kiosk.py
+++ b/fusion_clock/controllers/clock_nfc_kiosk.py
@@ -2,6 +2,7 @@
# Copyright 2026 Nexa Systems Inc.
# License OPL-1 (Odoo Proprietary License v1.0)
+import json
import logging
import re
import time
@@ -44,6 +45,12 @@ def _strip_data_url_prefix(b64):
return b64.encode('ascii', errors='ignore') if isinstance(b64, str) else b64
+def _is_kiosk_operator(user):
+ """Kiosk surfaces accept a full Clock Manager OR a dedicated Kiosk Operator."""
+ return (user.has_group('fusion_clock.group_fusion_clock_manager')
+ or user.has_group('fusion_clock.group_fusion_clock_kiosk_app'))
+
+
class FusionClockNfcKiosk(http.Controller):
"""NFC tap-to-clock kiosk controller. Reuses FusionClockAPI helpers."""
@@ -66,14 +73,14 @@ class FusionClockNfcKiosk(http.Controller):
def nfc_kiosk_page(self, **kw):
"""Render the NFC kiosk page for a wall-mounted tablet."""
user = request.env.user
- if not user.has_group('fusion_clock.group_fusion_clock_manager'):
+ if not _is_kiosk_operator(user):
return request.redirect('/my')
ICP = request.env['ir.config_parameter'].sudo()
if ICP.get_param('fusion_clock.enable_nfc_kiosk', 'False') != 'True':
return request.redirect('/my')
- company = request.env.company
+ company = request.env.company.sudo()
location = company.x_fclk_nfc_kiosk_location_id
company_logo_url = (
'/web/image/res.company/%s/logo' % company.id if company.logo else ''
@@ -89,6 +96,42 @@ class FusionClockNfcKiosk(http.Controller):
}
return request.render('fusion_clock.nfc_kiosk_page', values)
+ @http.route('/fusion_clock/kiosk/nfc/manifest.webmanifest', type='http', auth='public')
+ def nfc_kiosk_manifest(self, **kw):
+ """Web App Manifest so the NFC kiosk installs as a full-screen home-screen app.
+
+ On a wall tablet, 'Install' (Chrome) / 'Add to Home Screen' (Safari) then
+ launches the kiosk standalone -- no address bar or browser tabs, like Odoo's
+ own PWA. Public so the icon/splash can load without a session.
+ """
+ company = request.env.company.sudo()
+ # Square icons via Odoo's on-the-fly resizer (placeholder if the company has no logo).
+ icon_192 = '/web/image/res.company/%s/logo/192x192' % company.id
+ icon_512 = '/web/image/res.company/%s/logo/512x512' % company.id
+ manifest = {
+ 'name': 'Fusion Clock Kiosk',
+ 'short_name': 'Clock Kiosk',
+ 'description': 'Tap-to-clock NFC kiosk',
+ 'start_url': '/fusion_clock/kiosk/nfc',
+ 'scope': '/',
+ 'display': 'fullscreen',
+ 'display_override': ['fullscreen', 'standalone'],
+ 'background_color': '#0e1116',
+ 'theme_color': '#0e1116',
+ 'orientation': 'any',
+ 'icons': [
+ {'src': icon_192, 'sizes': '192x192', 'type': 'image/png'},
+ {'src': icon_512, 'sizes': '512x512', 'type': 'image/png'},
+ ],
+ }
+ return request.make_response(
+ json.dumps(manifest),
+ headers=[
+ ('Content-Type', 'application/manifest+json; charset=utf-8'),
+ ('Cache-Control', 'public, max-age=3600'),
+ ],
+ )
+
@staticmethod
def _check_enroll_password(env, supplied):
"""Verify the enroll-mode password. Empty config = always-allow for managers."""
@@ -101,7 +144,7 @@ class FusionClockNfcKiosk(http.Controller):
def nfc_enroll(self, employee_id=0, card_uid='', enroll_password='', **kw):
"""Bind an NFC card UID to an employee. Manager-gated, password-gated."""
user = request.env.user
- if not user.has_group('fusion_clock.group_fusion_clock_manager'):
+ if not _is_kiosk_operator(user):
return {'error': 'access_denied'}
if not self._check_enroll_password(request.env, enroll_password):
@@ -146,7 +189,7 @@ class FusionClockNfcKiosk(http.Controller):
def nfc_tap(self, card_uid='', photo_b64='', **kw):
"""Toggle attendance state for the employee owning this card UID."""
user = request.env.user
- if not user.has_group('fusion_clock.group_fusion_clock_manager'):
+ if not _is_kiosk_operator(user):
return {'error': 'access_denied'}
ICP = request.env['ir.config_parameter'].sudo()
@@ -165,7 +208,7 @@ class FusionClockNfcKiosk(http.Controller):
return {'error': 'photo_required', 'message': 'Camera unavailable. Ask IT to check the kiosk.'}
photo_bytes = _strip_data_url_prefix(photo_b64) if photo_b64 else b''
- company = request.env.company
+ company = request.env.company.sudo()
location = company.x_fclk_nfc_kiosk_location_id
if not location:
return {'error': 'no_location_configured'}
diff --git a/fusion_clock/security/security.xml b/fusion_clock/security/security.xml
index 017aa1e2..4dfc9647 100644
--- a/fusion_clock/security/security.xml
+++ b/fusion_clock/security/security.xml
@@ -1,25 +1,66 @@
+
+
+ Fusion Clock
+ 45
+
+
+
+
+ Fusion Clock
+ 45
+
+
+
+
+ Fusion Clock Kiosk
+ 46
+
+
- Fusion Clock / User
+ User
+ Can clock in/out and view own attendance
- Fusion Clock / Team Lead
+ Team Lead
+ Can view direct reports attendance (read-only)
- Fusion Clock / Manager
+ Manager
+ Can manage locations, view all attendance, generate reports
+
+
+ Kiosk Operator
+ Can open and operate the shared clock kiosk (NFC tap / PIN) without full Clock Manager access. Intended for shared wall-tablet accounts.
+
+
+ Fusion Clock Kiosk
+ /fusion_clock/kiosk/nfc
+ self
+
+
+
+