<?xml version="1.0" encoding="utf-8"?>
<odoo>
    <data>

        <!-- ============================================================
             Security Groups
        ============================================================ -->

        <record id="module_category_jb_timesheet" model="ir.module.category">
            <field name="name">JB Timesheets</field>
            <field name="description">JB Timesheet module security category.</field>
            <field name="sequence">20</field>
        </record>

        <record id="group_timesheet_user" model="res.groups">
            <field name="name">Timesheet User</field>
            <field name="category_id" ref="module_category_jb_timesheet"/>
            <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
            <field name="comment">Can enter and view own timesheet lines.</field>
        </record>

        <record id="group_timesheet_manager" model="res.groups">
            <field name="name">Timesheet Manager</field>
            <field name="category_id" ref="module_category_jb_timesheet"/>
            <field name="implied_ids" eval="[(4, ref('jb_timesheet.group_timesheet_user'))]"/>
            <field name="comment">Can view and manage all timesheet lines.</field>
        </record>

        <record id="group_timesheet_invoice" model="res.groups">
            <field name="name">Timesheet Invoice Manager</field>
            <field name="category_id" ref="module_category_jb_timesheet"/>
            <field name="implied_ids" eval="[(4, ref('jb_timesheet.group_timesheet_user'))]"/>
            <field name="comment">Can mark timesheets as invoiced and push to EIT.</field>
        </record>

        <!-- ============================================================
             Record Rules
        ============================================================ -->

        <!-- My Timesheets: users see only their own analytic lines -->
        <record id="rule_my_timesheets_user" model="ir.rule">
            <field name="name">My Timesheets</field>
            <field name="model_id" ref="analytic.model_account_analytic_line"/>
            <field name="domain_force">[('user_id', '=', user.id)]</field>
            <field name="groups" eval="[(4, ref('jb_timesheet.group_timesheet_user'))]"/>
            <field name="perm_read" eval="True"/>
            <field name="perm_write" eval="True"/>
            <field name="perm_create" eval="True"/>
            <field name="perm_unlink" eval="True"/>
        </record>

        <!-- Managers see all timesheet lines (no restriction) -->
        <record id="rule_all_timesheets_manager" model="ir.rule">
            <field name="name">All Timesheets (Manager)</field>
            <field name="model_id" ref="analytic.model_account_analytic_line"/>
            <field name="domain_force">[(1, '=', 1)]</field>
            <field name="groups" eval="[(4, ref('jb_timesheet.group_timesheet_manager'))]"/>
            <field name="perm_read" eval="True"/>
            <field name="perm_write" eval="True"/>
            <field name="perm_create" eval="True"/>
            <field name="perm_unlink" eval="True"/>
        </record>

        <!-- My Tasks: users see tasks they own or are assigned to -->
        <record id="rule_my_tasks_user" model="ir.rule">
            <field name="name">My Tasks and Tickets</field>
            <field name="model_id" ref="project.model_project_task"/>
            <field name="domain_force">
                ['|', ('user_ids', 'in', [user.id]), ('create_uid', '=', user.id)]
            </field>
            <field name="groups" eval="[(4, ref('jb_timesheet.group_timesheet_user'))]"/>
            <field name="perm_read" eval="True"/>
            <field name="perm_write" eval="True"/>
            <field name="perm_create" eval="True"/>
            <field name="perm_unlink" eval="False"/>
        </record>

        <!-- Managers see all tasks -->
        <record id="rule_all_tasks_manager" model="ir.rule">
            <field name="name">All Tasks (Manager)</field>
            <field name="model_id" ref="project.model_project_task"/>
            <field name="domain_force">[(1, '=', 1)]</field>
            <field name="groups" eval="[(4, ref('jb_timesheet.group_timesheet_manager'))]"/>
            <field name="perm_read" eval="True"/>
            <field name="perm_write" eval="True"/>
            <field name="perm_create" eval="True"/>
            <field name="perm_unlink" eval="True"/>
        </record>

    </data>
</odoo>
