feat: add branch isolation for managers and zkteco biometric tracking

app/Http/Controllers/EmployeeController.php

@@ -31,11 +31,20 @@ class EmployeeController extends Controller
         if (Auth::user()->can('manage-employees')) {
             $authUser = Auth::user();
             $query = User::with(['employee.branch', 'employee.department', 'employee.designation'])
-                ->where(function ($q) {
-                    if (Auth::user()->can('manage-any-employees')) {
+                ->where(function ($q) use ($authUser) {
+                    if ($authUser->can('manage-any-employees')) {
                         $q->whereIn('created_by', getCompanyAndUsersId());
-                    } elseif (Auth::user()->can('manage-own-employees')) {
-                        $q->where('created_by', Auth::id())->orWhere('id', Auth::id());
+                    } elseif ($authUser->can('manage-employees')) {
+                        // Scope to branch if they only have 'manage-employees'
+                        $branchId = $authUser->employee->branch_id ?? null;
+                        if ($branchId) {
+                            $q->whereHas('employee', function($eq) use ($branchId) {
+                                $eq->where('branch_id', $branchId);
+                            });
+                        } else {
+                            // Fallback to own employees if no branch assigned
+                            $q->where('created_by', $authUser->id)->orWhere('id', $authUser->id);
+                        }
                     } else {
                         $q->whereRaw('1 = 0');
                     }
@@ -227,6 +236,7 @@ class EmployeeController extends Controller
                     'rest_days' => 'nullable|array',
                     'rest_days.*' => 'string|in:monday,tuesday,wednesday,thursday,friday,saturday,sunday',
                     'attendance_policy_id' => 'nullable|exists:attendance_policies,id',
+                    'is_location_exempt' => 'nullable|boolean',
                     'salary' => 'required|numeric|min:0',
 
                     // Employment details
@@ -308,6 +318,7 @@ class EmployeeController extends Controller
                 $user->password = Hash::make($request->password);
                 $user->type = 'employee';
                 $user->lang = 'en';
+                $user->is_location_exempt = $request->has('is_location_exempt') ? filter_var($request->is_location_exempt, FILTER_VALIDATE_BOOLEAN) : false;
                 $user->created_by = creatorId();
 
                 // Handle profile image upload for user
@@ -557,6 +568,7 @@ class EmployeeController extends Controller
                     'rest_days' => 'nullable|array',
                     'rest_days.*' => 'string|in:monday,tuesday,wednesday,thursday,friday,saturday,sunday',
                     'attendance_policy_id' => 'nullable|exists:attendance_policies,id',
+                    'is_location_exempt' => 'nullable|boolean',
                     'salary' => 'required|numeric|min:0',
 
                     // Employment details
@@ -604,6 +616,9 @@ class EmployeeController extends Controller
                 // Update User model object
                 $user->name = $request->name;
                 $user->email = $request->email;
+                if ($request->has('is_location_exempt')) {
+                    $user->is_location_exempt = filter_var($request->is_location_exempt, FILTER_VALIDATE_BOOLEAN);
+                }
 
                 // Hash password if provided
                 if ($request->has('password') && !empty($request->password)) {