<?xml version="1.0" encoding="utf-8"?>
<odoo>
  <data>
    <record model="ir.module.category" id="module_project">
      <field name="name">Runbot</field>
    </record>

    <record id="group_user" model="res.groups">
      <field name="name">User</field>
      <field name="category_id" ref="module_project"/>
      <!-- as public user is inactive, it wont be automatically added
           to this group via implied groups. add it manually -->
      <field name="users" eval="[(4, ref('base.public_user'))]"/>
    </record>

    <record id="base.group_public" model="res.groups">
      <field name="implied_ids" eval="[(4, ref('runbot.group_user'))]"/>
    </record>

    <record id="base.group_user" model="res.groups">
      <field name="implied_ids" eval="[(4, ref('runbot.group_user'))]"/>
    </record>

    <record id="base.group_portal" model="res.groups">
      <field name="implied_ids" eval="[(4, ref('runbot.group_user'))]"/>
    </record>

    <record model="ir.module.category" id="build_config_project">
      <field name="name">Build Config</field>
    </record>

    <record id="group_build_config_user" model="res.groups">
      <field name="name">Build config user</field>
      <field name="category_id" ref="build_config_project"/>
    </record>

    <record id="group_build_config_manager" model="res.groups">
        <field name="name">Build config manager</field>
      <field name="category_id" ref="build_config_project"/>
        <field name="implied_ids" eval="[(4, ref('runbot.group_build_config_user'))]"/>
    </record>

    <record id="group_build_config_administrator" model="res.groups">
        <field name="name">Build config administrator</field>
        <field name="category_id" ref="build_config_project"/>
        <field name="implied_ids" eval="[(4, ref('runbot.group_build_config_manager'))]"/>
        <field name="users" eval="[(4, ref('base.user_root'))]"/>
    </record>

    <record id="group_runbot_error_manager" model="res.groups">
      <field name="name">Build error manager</field>
      <field name="category_id" ref="module_project"/>
    </record>

    <record id="group_runbot_team_manager" model="res.groups">
      <field name="name">Team manager</field>
      <field name="category_id" ref="module_project"/>
    </record>

    <record id="group_runbot_advanced_user" model="res.groups">
      <field name="name">Advanced runbot user</field>
      <field name="category_id" ref="module_project"/>
    </record>

    <record id="group_runbot_admin" model="res.groups">
      <field name="name">Runbot administrator</field>
      <field name="category_id" ref="module_project"/>
      <field name="users" eval="[(4, ref('base.user_root')), (4, ref('base.user_admin'))]"/>
      <field name="implied_ids" eval="[(4, ref('runbot.group_runbot_advanced_user')), (4, ref('runbot.group_user')), (4, ref('runbot.group_build_config_administrator'))]"/>
    </record>
    

    <!-- config access rules-->
    <record id="runbot_build_config_access_administrator" model="ir.rule">
        <field name="name">All config can be edited by config admin</field>
        <field name="groups" eval="[(4, ref('group_build_config_administrator'))]"/>
        <field name="model_id" ref="model_runbot_build_config"/>
        <field name="domain_force">[(1, '=', 1)]</field>
        <field name="perm_write" eval="True"/>
        <field name="perm_unlink" eval="True"/>
        <field name="perm_read" eval="False"/>
        <field name="perm_create" eval="False"/>
    </record>

    <record id="runbot_build_config_access_manager" model="ir.rule">
        <field name="name">Own config can be edited by user</field>
        <field name="groups" eval="[(4, ref('group_build_config_manager'))]"/>
        <field name="model_id" ref="model_runbot_build_config"/>
        <field name="domain_force">[('protected', '=', False)]</field>
        <field name="perm_write" eval="True"/>
        <field name="perm_unlink" eval="True"/>
        <field name="perm_read" eval="False"/>
        <field name="perm_create" eval="True"/>
    </record>

    <record id="runbot_build_config_access_user" model="ir.rule">
        <field name="name">All config can be edited by config admin</field>
        <field name="groups" eval="[(4, ref('group_build_config_user'))]"/>
        <field name="model_id" ref="model_runbot_build_config"/>
        <field name="domain_force">[('create_uid', '=', user.id)]</field>
        <field name="perm_write" eval="True"/>
        <field name="perm_unlink" eval="True"/>
        <field name="perm_read" eval="False"/>
        <field name="perm_create" eval="True"/>
    </record>


    <!-- step access rules-->
    <record id="runbot_build_config_step_access_administrator" model="ir.rule">
        <field name="name">All config step can be edited by config admin</field>
        <field name="groups" eval="[(4, ref('group_build_config_administrator'))]"/>
        <field name="model_id" ref="model_runbot_build_config_step"/>
        <field name="domain_force">[(1, '=', 1)]</field>
        <field name="perm_read" eval="False"/>
    </record>

    <record id="runbot_build_config_step_access_manager" model="ir.rule">
        <field name="name">Unprotected config step can be edited by manager</field>
        <field name="groups" eval="[(4, ref('group_build_config_manager'))]"/>
        <field name="model_id" ref="model_runbot_build_config_step"/>
        <field name="domain_force">[('protected', '=', False)]</field>
        <field name="perm_read" eval="False"/>
    </record>

    <record id="runbot_build_config_step_access_user" model="ir.rule">
        <field name="name">Own config step can be edited by user</field>
        <field name="groups" eval="[(4, ref('group_build_config_user'))]"/>
        <field name="model_id" ref="model_runbot_build_config_step"/>
        <field name="domain_force">[('protected', '=', False), ('create_uid', '=', user.id)]</field>
        <field name="perm_read" eval="False"/>
    </record>

  </data>
</odoo>
