from odoo import _, api, fields, models
from odoo.exceptions import AccessError, UserError

# These already exist on hr.employee (delegated from hr.version) and all
# carry groups="hr.group_hr_user" -- by design, even the owning employee
# can't read/write them directly. Rather than loosen that group (a
# system-wide ACL change that would let ANY employee read ANY colleague's
# private phone/address via a plain searchRead), the two methods below
# expose a self-service surface that always hard-scopes to
# self.env.user.employee_id server-side -- a client can never pass a
# different employee_id, so there's no way to use this to reach anyone
# else's data, no matter what the caller sends.
_XENO_PERSONAL_INFO_FIELDS = [
    "private_phone", "private_email", "emergency_contact", "emergency_phone",
    "private_street", "private_street2", "private_city", "private_zip",
    "private_state_id", "private_country_id",
    "marital", "certificate", "study_school", "study_field",
    "xeno_health_conditions",
    "private_car_plate", "xeno_motorbike_plate",
    "country_id", "identification_id", "xeno_id_card_expire",
    "ssnid", "xeno_sso_expire",
    "passport_id", "xeno_passport_issue_place", "xeno_passport_issue_date",
    "passport_expiration_date",
]

_MARITAL_OPTIONS = [
    ("single", "Single"),
    ("married", "Married"),
    ("cohabitant", "Legal Cohabitant"),
    ("widower", "Widower"),
    ("divorced", "Divorced"),
]

_CERTIFICATE_OPTIONS = [
    ("graduate", "Graduate"),
    ("bachelor", "Bachelor"),
    ("master", "Master"),
    ("doctor", "Doctor"),
    ("other", "Other"),
]


class HrEmployee(models.Model):
    _inherit = "hr.employee"

    xeno_health_conditions = fields.Text(
        string="Health Conditions",
        groups="hr.group_hr_user",
        help="E.g. peanut allergy, asthma, diabetes.")
    xeno_motorbike_plate = fields.Char(
        string="Motorbike License Plate",
        groups="hr.group_hr_user")
    xeno_id_card_expire = fields.Date(
        string="ID Card Expiration Date",
        groups="hr.group_hr_user")
    xeno_sso_expire = fields.Date(
        string="SSO Expiration Date",
        groups="hr.group_hr_user")
    xeno_personal_document_ids = fields.One2many(
        "xeno.hr.personal.document", "employee_id",
        string="Personal Documents",
        groups="hr.group_hr_user")

    @api.model
    def xeno_get_my_personal_info(self):
        employee = self.env.user.employee_id
        if not employee:
            return {}
        data = employee.sudo().read(["id"] + _XENO_PERSONAL_INFO_FIELDS)[0]
        data["marital_options"] = _MARITAL_OPTIONS
        data["certificate_options"] = _CERTIFICATE_OPTIONS
        return data

    @api.model
    def xeno_update_my_personal_info(self, vals):
        employee = self.env.user.employee_id
        if not employee:
            raise UserError(_("Your login isn't linked to an employee record."))
        allowed = {k: v for k, v in vals.items() if k in _XENO_PERSONAL_INFO_FIELDS}
        employee.sudo().write(allowed)
        return True