diff --git a/auth_res_users_apikeys_server_env/README.rst b/auth_res_users_apikeys_server_env/README.rst new file mode 100644 index 0000000000..52350f8a75 --- /dev/null +++ b/auth_res_users_apikeys_server_env/README.rst @@ -0,0 +1,103 @@ +===================================== +Auth Users API key server environment +===================================== + +.. + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! This file is generated by oca-gen-addon-readme !! + !! changes will be overwritten. !! + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! source digest: sha256:2c7e031d4a765b77b1cd162f11ba209e35cdc152033b1c6d11899e3b70398113 + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + +.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png + :target: https://odoo-community.org/page/development-status + :alt: Beta +.. |badge2| image:: https://img.shields.io/badge/licence-LGPL--3-blue.png + :target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html + :alt: License: LGPL-3 +.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--auth-lightgray.png?logo=github + :target: https://github.com/OCA/server-auth/tree/14.0/auth_res_users_apikeys_server_env + :alt: OCA/server-auth +.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png + :target: https://translation.odoo-community.org/projects/server-auth-14-0/server-auth-14-0-auth_res_users_apikeys_server_env + :alt: Translate me on Weblate +.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png + :target: https://runboat.odoo-community.org/builds?repo=OCA/server-auth&target_branch=14.0 + :alt: Try me on Runboat + +|badge1| |badge2| |badge3| |badge4| |badge5| + +Configure API keys (`res.users.apikeys`) per environment. + +This can be very useful when other applications communicate with odoo +over jsonrpc to avoid mixing your keys between various +environments ie: when restoring Odoo production databases to staging/tests/dev environments. + +This module let change the scope of your API keys in user form view. This module expect scope +set to `rpc_` where `` is the `running_env` used by `server_environment` module. + +**Table of contents** + +.. contents:: + :local: + +Configuration +============= + + +* got to the user preference form +* add new keys for each env on production databases +* set scope of each key regarding target environment with template: `rpc_` + where `` is the `running_env` used by `server_environment` module. + +only api key matching this env would works. + +.. note:: + + If you keep scope as empty string you would get default behavior and match any env +.. warning:: + + Unfortunately as key are already encrypted and key field not expose to the ORM + on base module we can't configure key in config files as it would be with + server_environment and server_environment_data_encryption + +Bug Tracker +=========== + +Bugs are tracked on `GitHub Issues `_. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +`feedback `_. + +Do not contact contributors directly about support or help with technical issues. + +Credits +======= + +Authors +~~~~~~~ + +* Camptocamp + +Contributors +~~~~~~~~~~~~ + +* Pierre Verkest + +Maintainers +~~~~~~~~~~~ + +This module is maintained by the OCA. + +.. image:: https://odoo-community.org/logo.png + :alt: Odoo Community Association + :target: https://odoo-community.org + +OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use. + +This module is part of the `OCA/server-auth `_ project on GitHub. + +You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute. diff --git a/auth_res_users_apikeys_server_env/__init__.py b/auth_res_users_apikeys_server_env/__init__.py new file mode 100644 index 0000000000..0650744f6b --- /dev/null +++ b/auth_res_users_apikeys_server_env/__init__.py @@ -0,0 +1 @@ +from . import models diff --git a/auth_res_users_apikeys_server_env/__manifest__.py b/auth_res_users_apikeys_server_env/__manifest__.py new file mode 100644 index 0000000000..9fd7b8f7a7 --- /dev/null +++ b/auth_res_users_apikeys_server_env/__manifest__.py @@ -0,0 +1,19 @@ +# Copyright 2021 Camptocamp SA +# @author: Simone Orsi +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl). + +{ + "name": "Auth Users API key server environment", + "summary": """ +Configure user api keys (`res.users.apikeys`) via server env. + """, + "version": "14.0.1.1.0", + "license": "LGPL-3", + "website": "https://github.com/OCA/server-auth", + "author": "Camptocamp,Odoo Community Association (OCA)", + "depends": ["base", "server_environment"], + "data": [ + "security/ir.model.access.csv", + "views/res_users_apikeys.xml", + ], +} diff --git a/auth_res_users_apikeys_server_env/models/__init__.py b/auth_res_users_apikeys_server_env/models/__init__.py new file mode 100644 index 0000000000..ad26d79a35 --- /dev/null +++ b/auth_res_users_apikeys_server_env/models/__init__.py @@ -0,0 +1,2 @@ +from . import res_users_apikeys +from . import res_users diff --git a/auth_res_users_apikeys_server_env/models/res_users.py b/auth_res_users_apikeys_server_env/models/res_users.py new file mode 100644 index 0000000000..bbb924ed5f --- /dev/null +++ b/auth_res_users_apikeys_server_env/models/res_users.py @@ -0,0 +1,29 @@ +# Copyright 2018 ACSONE SA/NV +# Copyright 2021 Camptocamp SA +# @author: Simone Orsi +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl). + + +from odoo import models +from odoo.exceptions import AccessDenied +from odoo.tools.config import config + + +class ResUsers(models.Model): + + _inherit = "res.users" + + def _check_credentials(self, password, user_agent_env): + try: + return super()._check_credentials(password, user_agent_env) + except AccessDenied: + pass + if ( + self.env["res.users.apikeys"]._check_credentials( + scope=f'rpc_{config.get("running_env", "test")}', key=password + ) + == self.env.uid + ): + return self.env.uid + + raise AccessDenied() diff --git a/auth_res_users_apikeys_server_env/models/res_users_apikeys.py b/auth_res_users_apikeys_server_env/models/res_users_apikeys.py new file mode 100644 index 0000000000..0a62a1062d --- /dev/null +++ b/auth_res_users_apikeys_server_env/models/res_users_apikeys.py @@ -0,0 +1,12 @@ +# Copyright 2023 Foodles +# @author: Pierre Verkest +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl). + + +from odoo import fields, models + + +class ResUsersAPIKeys(models.Model): + _inherit = "res.users.apikeys" + + scope = fields.Char(readonly=False) diff --git a/auth_res_users_apikeys_server_env/readme/CONFIGURE.rst b/auth_res_users_apikeys_server_env/readme/CONFIGURE.rst new file mode 100644 index 0000000000..2866365184 --- /dev/null +++ b/auth_res_users_apikeys_server_env/readme/CONFIGURE.rst @@ -0,0 +1,16 @@ + +* got to the user preference form +* add new keys for each env on production databases +* set scope of each key regarding target environment with template: `rpc_` + where `` is the `running_env` used by `server_environment` module. + +only api key matching this env would works. + +.. note:: + + If you keep scope as empty string you would get default behavior and match any env +.. warning:: + + Unfortunately as key are already encrypted and key field not expose to the ORM + on base module we can't configure key in config files as it would be with + server_environment and server_environment_data_encryption diff --git a/auth_res_users_apikeys_server_env/readme/CONTRIBUTORS.rst b/auth_res_users_apikeys_server_env/readme/CONTRIBUTORS.rst new file mode 100644 index 0000000000..d49959cf05 --- /dev/null +++ b/auth_res_users_apikeys_server_env/readme/CONTRIBUTORS.rst @@ -0,0 +1 @@ +* Pierre Verkest diff --git a/auth_res_users_apikeys_server_env/readme/DESCRIPTION.rst b/auth_res_users_apikeys_server_env/readme/DESCRIPTION.rst new file mode 100644 index 0000000000..fec4561ca4 --- /dev/null +++ b/auth_res_users_apikeys_server_env/readme/DESCRIPTION.rst @@ -0,0 +1,8 @@ +Configure API keys (`res.users.apikeys`) per environment. + +This can be very useful when other applications communicate with odoo +over jsonrpc to avoid mixing your keys between various +environments ie: when restoring Odoo production databases to staging/tests/dev environments. + +This module let change the scope of your API keys in user form view. This module expect scope +set to `rpc_` where `` is the `running_env` used by `server_environment` module. diff --git a/auth_res_users_apikeys_server_env/security/ir.model.access.csv b/auth_res_users_apikeys_server_env/security/ir.model.access.csv new file mode 100644 index 0000000000..39029d90f6 --- /dev/null +++ b/auth_res_users_apikeys_server_env/security/ir.model.access.csv @@ -0,0 +1,2 @@ +"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink" +"access_res_users_apikeys_admin","API user key managed by admin",model_res_users_apikeys,base.group_system,1,1,1,1 diff --git a/auth_res_users_apikeys_server_env/static/description/icon.png b/auth_res_users_apikeys_server_env/static/description/icon.png new file mode 100644 index 0000000000..3a0328b516 Binary files /dev/null and b/auth_res_users_apikeys_server_env/static/description/icon.png differ diff --git a/auth_res_users_apikeys_server_env/static/description/index.html b/auth_res_users_apikeys_server_env/static/description/index.html new file mode 100644 index 0000000000..37799efe73 --- /dev/null +++ b/auth_res_users_apikeys_server_env/static/description/index.html @@ -0,0 +1,446 @@ + + + + + +Auth Users API key server environment + + + +
+

Auth Users API key server environment

+ + +

Beta License: LGPL-3 OCA/server-auth Translate me on Weblate Try me on Runboat

+

Configure API keys (res.users.apikeys) per environment.

+

This can be very useful when other applications communicate with odoo +over jsonrpc to avoid mixing your keys between various +environments ie: when restoring Odoo production databases to staging/tests/dev environments.

+

This module let change the scope of your API keys in user form view. This module expect scope +set to rpc_<env> where <env> is the running_env used by server_environment module.

+

Table of contents

+ +
+

Configuration

+
    +
  • got to the user preference form
    • +
  • add new keys for each env on production databases
    • +
  • set scope of each key regarding target environment with template: rpc_<env> +where <env> is the running_env used by server_environment module.
    • +
+

only api key matching this env would works.

+
+

Note

+

If you keep scope as empty string you would get default behavior and match any env

+
+
+

Warning

+

Unfortunately as key are already encrypted and key field not expose to the ORM +on base module we can’t configure key in config files as it would be with +server_environment and server_environment_data_encryption

+
+
+
+

Bug Tracker

+

Bugs are tracked on GitHub Issues. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +feedback.

+

Do not contact contributors directly about support or help with technical issues.

+
+
+

Credits

+
+

Authors

+
    +
  • Camptocamp
    • +
+
+
+

Contributors

+ +
+
+

Maintainers

+

This module is maintained by the OCA.

+Odoo Community Association +

OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use.

+

This module is part of the OCA/server-auth project on GitHub.

+

You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

+
+
+
+ + diff --git a/auth_res_users_apikeys_server_env/tests/__init__.py b/auth_res_users_apikeys_server_env/tests/__init__.py new file mode 100644 index 0000000000..b76d7bba04 --- /dev/null +++ b/auth_res_users_apikeys_server_env/tests/__init__.py @@ -0,0 +1 @@ +from . import test_res_users_api_keys diff --git a/auth_res_users_apikeys_server_env/tests/test_res_users_api_keys.py b/auth_res_users_apikeys_server_env/tests/test_res_users_api_keys.py new file mode 100644 index 0000000000..f1cf46dd21 --- /dev/null +++ b/auth_res_users_apikeys_server_env/tests/test_res_users_api_keys.py @@ -0,0 +1,57 @@ +# Copyright 2018 ACSONE SA/NV +# Copyright 2021 Camptocamp SA +# @author: Simone Orsi +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl). +from odoo.exceptions import AccessDenied +from odoo.tests.common import SavepointCase +from odoo.tools.config import config + + +class TestAuthApiKey(SavepointCase): + @classmethod + def setUpClass(cls, *args, **kwargs): + super().setUpClass(*args, **kwargs) + cls.demo_user = cls.env.ref("base.user_demo") + cls.demo_user = cls.demo_user.with_user(cls.demo_user) + cls.secret = ( + cls.env["res.users.apikeys"] + .with_user(cls.demo_user) + ._generate( + f"rpc_{config.get('running_env','test')}", + "Test JSONRPC api key", + ) + ) + cls.api_key = cls.env["res.users.apikeys"].search( + [("user_id", "=", cls.demo_user.id)], limit=1 + ) + + def test_check_credentials_ok_any_scope(self): + """test no regression""" + self.api_key.scope = False + self.assertEqual( + self.demo_user._check_credentials(self.secret, {"interactive": True}), + self.demo_user.id, + ) + + def test_check_credentials_ok(self): + self.assertEqual( + self.demo_user._check_credentials(self.secret, {"interactive": True}), + self.demo_user.id, + ) + + def test_wrong_user(self): + admin = self.env.ref("base.user_admin") + with self.assertRaises(AccessDenied): + admin.with_user(admin)._check_credentials( + self.secret, {"interactive": True} + ), + + def test_check_credentials_wrong_scope(self): + self.api_key.scope = "rpc_wrong" + with self.assertRaises(AccessDenied): + self.demo_user._check_credentials(self.secret, {"interactive": True}), + + def test_check_credentials_no_api_keys(self): + self.api_key.unlink() + with self.assertRaises(AccessDenied): + self.demo_user._check_credentials(self.secret, {"interactive": True}), diff --git a/auth_res_users_apikeys_server_env/views/res_users_apikeys.xml b/auth_res_users_apikeys_server_env/views/res_users_apikeys.xml new file mode 100644 index 0000000000..0d52f935d5 --- /dev/null +++ b/auth_res_users_apikeys_server_env/views/res_users_apikeys.xml @@ -0,0 +1,50 @@ + + + + + res.users.apikeys.form (in auth_user_api_key_server_env) + res.users.apikeys + +
+ + +
+ + + + res.users.apikeys.tree (in auth_user_api_key_server_env) + res.users.apikeys + + + + + + + + + Auth User API Key + res.users.apikeys + tree,form + [] + {} + + + Auth User API Key + + + + + diff --git a/setup/auth_res_users_apikeys_server_env/odoo/addons/auth_res_users_apikeys_server_env b/setup/auth_res_users_apikeys_server_env/odoo/addons/auth_res_users_apikeys_server_env new file mode 120000 index 0000000000..1d25d2d64f --- /dev/null +++ b/setup/auth_res_users_apikeys_server_env/odoo/addons/auth_res_users_apikeys_server_env @@ -0,0 +1 @@ +../../../../auth_res_users_apikeys_server_env \ No newline at end of file diff --git a/setup/auth_res_users_apikeys_server_env/setup.py b/setup/auth_res_users_apikeys_server_env/setup.py new file mode 100644 index 0000000000..28c57bb640 --- /dev/null +++ b/setup/auth_res_users_apikeys_server_env/setup.py @@ -0,0 +1,6 @@ +import setuptools + +setuptools.setup( + setup_requires=['setuptools-odoo'], + odoo_addon=True, +)