T1486 can not log in 2fa activated

[clementcharmillot]

This is a draft to support token-based authentication on the Translation Platform.

Currently self-contained in its own module for simplicity purpose.

TODO before merging

• Write unit / integration tests to verify the security of the implementation
• Fix points marked "TODO" in the code
• Improve documentation

Related PR to modify the frontend

CompassionCH/translation-platform-web#41
Note: The current PR must be merged/deployed before the related frontend PR. Otherwise, the frontend will make requests that the backend doesn't understand.

[sonarcloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[nlachat-compassion]

I tested this PR locally.
Authentication for users with 2FA enabled seems to work with the modified frontend ( CompassionCH/translation-platform-web#41 ).
Looking at the code, the implementation seems secure. However, I would like to write unit/integration tests to increase certainty, as this is very sensitive code.

[nlachat-compassion]

In the process of trying to store the tokens in HttpOnly cookies, I discovered that the XmlRpcClient library used by the frontend (import { XmlRpcClient } from '@foxglove/xmlrpc';) does not support the withCredentials property (https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials). This means that the access token is not being sent with XmlRpc requests, and thus the server rejects them with AccessDenied. It would require substantial efforts to use another library or to re-implement the library with the required withCredentials property.
For now, I will revert the changes made in order to use cookies for the tokens. Maybe in the future, the transition to a new XmlRpc library can be made, and thus the tokens could be stored in cookies, which is more secure than the current implementation using localStorage.

[nlachat-compassion]

Quality Gate failed

Failed conditions 5 Security Hotspots

See analysis details on SonarCloud

These are false positives.

[sonarcloud]

Quality Gate failed

Failed conditions
5 Security Hotspots

See analysis details on SonarCloud

[nlachat-compassion]

Pre-commit is failing because of setup files:

setup/account_reconcile_checkout/odoo/addons/account_reconcile_checkout
setup/account_reconcile_checkout/setup.py
setup/auth_external/odoo/addons/auth_external
setup/auth_external/setup.py
setup/crm_switzerland/odoo/addons/crm_switzerland
setup/crm_switzerland/setup.py

I don't know what they're used for. Should they be committed?