update

docs/plans/2026-03-14-fusion-api-design.md

@@ -0,0 +1,79 @@
+# Fusion API - Design Document
+
+**Goal:** Build a standalone Odoo 19 module (`fusion_api`) serving as the central hub for API key management, usage tracking, rate limiting, and access control across all Fusion products.
+
+**Architecture:** Dedicated Odoo application with a provider/key vault, auto-detected consumer modules, per-module and per-user access rules with budget caps and rate limits, granular usage logging with daily aggregation, and an OWL dashboard. Other Fusion modules call `self.env['fusion.api.service']` methods which handle key retrieval, access checks, usage logging, and API execution.
+
+**Tech Stack:** Odoo 19, Python 3.12, OWL 2, OpenAI SDK (optional), Anthropic SDK (optional)
+
+---
+
+## Scope
+
+### In Scope
+- Shared service keys: OpenAI, Anthropic, Google Maps, Twilio
+- OAuth services: Google OAuth, Microsoft OAuth
+- Usage tracking: per module, per feature, per user, per AI model
+- Rate limiting: global budgets, per-module budgets, RPM/RPD limits, per-user limits
+- Access control: enable/disable per module, per user blocking
+- Auto-detection of consumer modules on first API call
+- OWL dashboard with usage stats and charts
+
+### Out of Scope
+- Shipping carrier credentials (stay on `delivery.carrier`)
+- Payment provider credentials (stay on `payment.provider`)
+- Migrating existing modules (phased rollout later)
+
+---
+
+## Data Model
+
+### `fusion.api.provider`
+API service providers (OpenAI, Anthropic, Google Maps, etc.). Pre-seeded with known providers.
+
+### `fusion.api.key`
+Credential storage per provider. Supports simple API keys and OAuth (client_id/secret/tokens). Masked in UI, system-group access only. Multiple keys per provider with default selection.
+
+### `fusion.api.consumer`
+Auto-detected Fusion modules. Created automatically when a module first calls the API service. Links to `ir.module.module`. Master kill switch per module.
+
+### `fusion.api.access`
+Access rules linking consumers to providers. Configures: enable/disable, monthly/daily budget caps, RPM/RPD rate limits. Computed fields show current usage and budget percentage.
+
+### `fusion.api.user.limit`
+Optional per-user overrides. Monthly budget, daily request cap, manual block toggle.
+
+### `fusion.api.usage`
+Individual API call log. Full granularity: consumer, provider, user, feature, model, tokens, cost, response time, status.
+
+### `fusion.api.usage.daily`
+Cron-aggregated daily summaries. Same dimensions with summed totals. Used for reporting and charts.
+
+---
+
+## Service Layer
+
+`fusion.api.service` (AbstractModel) provides:
+- `call_openai()` - Make OpenAI chat completion calls
+- `call_anthropic()` - Make Anthropic messages API calls
+- `get_api_key()` - Get raw API key for any provider (for non-chat uses like Google Maps)
+- Auto-registration of consumers on first call
+- Access control checks (budget, rate limit, user limit)
+- Usage logging with cost estimation
+- Key validation
+
+---
+
+## Migration Path
+
+1. Module is standalone - no existing modules need changes to install it
+2. Existing modules will be migrated one-by-one to use `fusion.api.service` instead of their own API key fields
+3. During migration, modules can check `fusion_api` first and fall back to their own keys
+
+---
+
+## Security Groups
+
+- `fusion_api.group_user` - View usage data
+- `fusion_api.group_manager` - Manage providers, consumers, access rules
+- `fusion_api.group_admin` - View/edit API keys, full system access

docs/plans/2026-03-15-schedule-redesign.md

@@ -0,0 +1,89 @@
+# Fusion Schedule Redesign
+
+Date: 2026-03-15
+Status: Approved
+
+## Summary
+
+Redesign the `/my/schedule` portal page with responsive mobile-friendly layout,
+add email/phone to the booking form, enable reschedule/cancel for both staff and
+public visitors, show source calendar in event listings, and add a share button
+for the public booking link.
+
+## Features
+
+### 1. Booking Form -- Email & Phone Fields
+
+Add optional Email and Phone fields to the internal booking form (Step 2).
+If email is provided, find-or-create a `res.partner` and add them as an attendee
+so Odoo sends a calendar invitation. If no email, event is created with only the
+staff user as attendee (current behavior).
+
+Files: `portal_schedule.xml`, `portal_schedule.py`
+
+### 2. Reschedule & Cancel
+
+**Staff users** (logged in, `/my/schedule`):
+- Each event row gets Reschedule and Cancel action buttons
+- Reschedule opens a modal with date picker + slot selector (reuses existing slot API)
+- Cancel shows confirmation, then deletes the event
+- New endpoints: `/my/schedule/event/reschedule`, `/my/schedule/event/cancel`
+
+**External visitors** (booked via public link):
+- After booking, show a manage URL with a unique token: `/schedule/manage/<token>`
+- Token stored as `x_fc_manage_token` on `calendar.event`
+- Manage page shows appointment details + Reschedule / Cancel buttons
+- No login required; token is the auth
+- New endpoints: `/schedule/manage/<token>`, `/schedule/manage/<token>/reschedule`,
+  `/schedule/manage/<token>/cancel`
+
+Files: `calendar_event.py`, `portal_schedule.py`, `portal_schedule.xml`,
+`public_booking.xml`, `portal_schedule_accounts.js`
+
+### 3. Source Calendar Column
+
+Add a "Source" column to Today's Appointments and Upcoming Appointments tables.
+Show provider icon (Google/Outlook) + truncated email, or "Odoo" for local events.
+Data already available via `x_fc_source_account_id`.
+
+Files: `portal_schedule.xml`, `portal_schedule.py`
+
+### 4. Share Public Booking Link
+
+Add a prominent "Share Calendar" button in the header area of `/my/schedule`.
+Clicking copies the public booking link to clipboard. The public booking page
+already only shows available time slots (no existing events).
+
+Files: `portal_schedule.xml`
+
+### 5. Responsive Redesign
+
+- Connected Calendars: collapsible section, compact status bar when collapsed,
+  full details when expanded. Collapsed by default.
+- Today's Appointments: card-based on mobile, list on desktop
+- Upcoming Appointments: table on desktop, card list on mobile
+- All action buttons: icon-only on mobile, icon+text on desktop
+- Bootstrap 5 responsive utilities throughout
+
+Files: `portal_schedule.xml`, new CSS in `portal_schedule.css`
+
+## Data Model Changes
+
+`calendar.event`:
+- Add `x_fc_manage_token` (Char, index=True) for public manage links
+
+## New Endpoints
+
+| Route | Auth | Method | Purpose |
+|-------|------|--------|---------|
+| `/my/schedule/event/cancel` | user | JSONRPC | Cancel/delete a calendar event |
+| `/my/schedule/event/reschedule` | user | JSONRPC | Reschedule a calendar event |
+| `/schedule/manage/<token>` | public | HTTP | View appointment details |
+| `/schedule/manage/<token>/reschedule` | public | POST | Reschedule via token |
+| `/schedule/manage/<token>/cancel` | public | POST | Cancel via token |
+
+## Security
+
+- Staff reschedule/cancel: verify `partner_ids` contains current user
+- Public manage: token-only access, tokens are 32-char hex random
+- All mutations use CSRF protection