from odoo import api, fields, models


class ResCompany(models.Model):
    _inherit = "res.company"

    xeno_policy_ack_version = fields.Integer(
        string="Policy Acknowledgment Version", default=1, groups="hr.group_hr_manager",
        help="Bump this when company policies change materially enough that "
             "every employee should be re-prompted to acknowledge them on "
             "their next login. Anyone whose own acknowledgment is on an "
             "older version (or who has never acknowledged) sees the "
             "mandatory policy pop-up again.",
    )


class XenoHrPolicyAck(models.Model):
    """Append-only audit log of policy acknowledgments -- one row per
    acknowledgment event (not just the latest), so a full history survives
    for compliance even across multiple re-prompted versions."""

    _name = "xeno.hr.policy.ack"
    _description = "Policy Acknowledgment"
    _order = "acknowledged_at desc, id desc"

    employee_id = fields.Many2one("hr.employee", required=True, index=True, ondelete="cascade")
    version = fields.Integer(required=True, string="Policy Version Acknowledged")
    acknowledged_at = fields.Datetime(default=fields.Datetime.now, required=True)


class HrEmployee(models.Model):
    _inherit = "hr.employee"

    def _xeno_needs_policy_ack(self):
        """True if this employee has never acknowledged the company's
        current required policy version -- gates the mandatory first-login
        pop-up (see ir_http.session_info + navbar_patch.js)."""
        self.ensure_one()
        required = self.company_id.sudo().xeno_policy_ack_version
        last = self.env["xeno.hr.policy.ack"].sudo().search(
            [("employee_id", "=", self.id)], order="version desc", limit=1)
        return not last or last.version < required

    @api.model
    def action_xeno_acknowledge_policies(self):
        """Called by the logged-in user's own browser once they've checked
        the acknowledgment box -- always records against the ACTING user's
        own employee (never a caller-supplied id), so this can be exposed
        to any internal user without a bespoke access rule."""
        employee = self.env.user.employee_id
        if not employee:
            return False
        self.env["xeno.hr.policy.ack"].sudo().create({
            "employee_id": employee.id,
            "version": employee.company_id.sudo().xeno_policy_ack_version,
        })
        return True