From e39ded1256c8f0c9c98468f7a995e1dbe19170dd Mon Sep 17 00:00:00 2001 From: Do Anh Duy Date: Mon, 13 Jul 2026 16:21:41 +0700 Subject: [PATCH] [ADD] auth_api_key_native_generate: endpoint to generate native API key from credentials --- auth_api_key_native_generate/README.rst | 180 ++++++ auth_api_key_native_generate/__init__.py | 2 + auth_api_key_native_generate/__manifest__.py | 17 + .../controllers/__init__.py | 1 + .../controllers/main.py | 161 ++++++ .../models/__init__.py | 1 + .../models/res_config_settings.py | 17 + auth_api_key_native_generate/pyproject.toml | 3 + .../readme/CONFIGURE.md | 29 + .../readme/CONTRIBUTORS.md | 1 + .../readme/DESCRIPTION.md | 13 + auth_api_key_native_generate/readme/USAGE.md | 38 ++ .../static/description/icon.png | Bin 0 -> 9455 bytes .../static/description/index.html | 525 ++++++++++++++++++ .../tests/__init__.py | 1 + .../tests/test_generate_api_key.py | 115 ++++ .../views/res_config_settings.xml | 33 ++ 17 files changed, 1137 insertions(+) create mode 100644 auth_api_key_native_generate/README.rst create mode 100644 auth_api_key_native_generate/__init__.py create mode 100644 auth_api_key_native_generate/__manifest__.py create mode 100644 auth_api_key_native_generate/controllers/__init__.py create mode 100644 auth_api_key_native_generate/controllers/main.py create mode 100644 auth_api_key_native_generate/models/__init__.py create mode 100644 auth_api_key_native_generate/models/res_config_settings.py create mode 100644 auth_api_key_native_generate/pyproject.toml create mode 100644 auth_api_key_native_generate/readme/CONFIGURE.md create mode 100644 auth_api_key_native_generate/readme/CONTRIBUTORS.md create mode 100644 auth_api_key_native_generate/readme/DESCRIPTION.md create mode 100644 auth_api_key_native_generate/readme/USAGE.md create mode 100644 auth_api_key_native_generate/static/description/icon.png create mode 100644 auth_api_key_native_generate/static/description/index.html create mode 100644 auth_api_key_native_generate/tests/__init__.py create mode 100644 auth_api_key_native_generate/tests/test_generate_api_key.py create mode 100644 auth_api_key_native_generate/views/res_config_settings.xml diff --git a/auth_api_key_native_generate/README.rst b/auth_api_key_native_generate/README.rst new file mode 100644 index 0000000000..045be85627 --- /dev/null +++ b/auth_api_key_native_generate/README.rst @@ -0,0 +1,180 @@ +.. image:: https://odoo-community.org/readme-banner-image + :target: https://odoo-community.org/get-involved?utm_source=readme + :alt: Odoo Community Association + +============================ +Auth Api Key Native Generate +============================ + +.. + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! This file is generated by oca-gen-addon-readme !! + !! changes will be overwritten. !! + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! source digest: sha256:586ca7eec36781512625c0ce8c9dd99769d5a566f6df800a48e8408399e03a92 + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + +.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png + :target: https://odoo-community.org/page/development-status + :alt: Beta +.. |badge2| image:: https://img.shields.io/badge/license-AGPL--3-blue.png + :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html + :alt: License: AGPL-3 +.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--auth-lightgray.png?logo=github + :target: https://github.com/OCA/server-auth/tree/19.0/auth_api_key_native_generate + :alt: OCA/server-auth +.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png + :target: https://translation.odoo-community.org/projects/server-auth-19-0/server-auth-19-0-auth_api_key_native_generate + :alt: Translate me on Weblate +.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png + :target: https://runboat.odoo-community.org/builds?repo=OCA/server-auth&target_branch=19.0 + :alt: Try me on Runboat + +|badge1| |badge2| |badge3| |badge4| |badge5| + +This module adds an HTTP endpoint that allows to create a new native +Odoo API key (``res.users.apikeys``) with a user's login and password. + +It is for clients such as mobile apps that cannot use session-cookie +authentication and need a bearer API key to call the new native Odoo +``/json/2`` api. + +The ```auth_api_key`` <../auth_api_key>`__ module manages its own +``auth.api.key`` records and a custom ``API-KEY`` header. This module +instead reuses the native Odoo API key mechanism: + +- Credentials are checked through ``res.users.authenticate``, which goes + through Odoo's ``_assert_can_auth()`` login cooldown for brute-force + protection. +- Keys are created with ``res.users.apikeys._generate()`` using the + ``rpc`` scope. +- Each key has a fixed validity window, 90 days by default and + configurable. + +**Table of contents** + +.. contents:: + :local: + +Configuration +============= + +Go to **Settings > General Settings > Integrations > API Key Generation +Endpoint** to set the validity window, in days, applied to newly +generated API keys. The value is stored in the +``auth_api_key_native_generate.duration`` system parameter (default: +``90``). + +Notes on the key lifecycle: + +- The validity window is fixed. There is no rolling or automatic + renewal. +- Changing the duration only affects keys generated afterwards. Existing + keys keep their own expiration date. +- Generating a key does not revoke the user's other keys, so the same + user can hold valid keys on several devices (with no maximum number of + devices) + +Reverse proxy hardening (recommended) +------------------------------------- + +This endpoint exposes a credential-exchange surface. Add these +protections at the reverse proxy layer: + +- HTTP Basic Authentication in front of ``/json/2`` and + ``/api/auth/generate_api_key``. +- Rate limiting on ``/api/auth/generate_api_key`` (for example 6 + requests per minute per IP) to slow down brute-force attempts in + multi-worker deployments. + +The new endpoint relies on Odoo's native login cooldown +(``_assert_can_auth``), which throttles per client IP using +``request.httprequest.remote_addr``. When Odoo runs behind a reverse +proxy, enable proxy mode (``--proxy-mode`` / ``proxy_mode = True``) and +have the proxy forward ``X-Forwarded-For``, so the cooldown sees the +real client IP. Otherwise every request shares one IP and the per-IP +protection is useless. + +Usage +===== + +Request a key by POSTing JSON credentials to the endpoint: + +:: + + POST /api/auth/generate_api_key + Content-Type: application/json + + { + "db": "mydb", + "login": "user@example.com", + "password": "the-user-password" + } + +On success (HTTP 200) the response holds the key and its expiration date +(ISO 8601, UTC): + +.. code:: json + + { + "api_key": "0123456789abcdef...", + "expiration_date": "2026-10-11T09:30:00+00:00" + } + +Error responses: + +- ``400``: missing ``db``, ``login`` or ``password``, or a body that is + not a JSON object. +- ``401``: invalid credentials. +- ``403``: the user has two-factor authentication enabled, so a password + alone cannot issue a key. +- ``404``: unknown database. +- ``413``: request body too large. + +Use the returned ``api_key`` as the bearer credential for the native +Odoo ``/json/2`` and RPC endpoints, in place of the user password: + +:: + + curl -H "Authorization: Bearer 0123456789abcdef..." \ + https://mydb.example.com/json/2/... + +Bug Tracker +=========== + +Bugs are tracked on `GitHub Issues `_. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +`feedback `_. + +Do not contact contributors directly about support or help with technical issues. + +Credits +======= + +Authors +------- + +* Trobz + +Contributors +------------ + +- Do Anh Duy + +Maintainers +----------- + +This module is maintained by the OCA. + +.. image:: https://odoo-community.org/logo.png + :alt: Odoo Community Association + :target: https://odoo-community.org + +OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use. + +This module is part of the `OCA/server-auth `_ project on GitHub. + +You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute. diff --git a/auth_api_key_native_generate/__init__.py b/auth_api_key_native_generate/__init__.py new file mode 100644 index 0000000000..91c5580fed --- /dev/null +++ b/auth_api_key_native_generate/__init__.py @@ -0,0 +1,2 @@ +from . import controllers +from . import models diff --git a/auth_api_key_native_generate/__manifest__.py b/auth_api_key_native_generate/__manifest__.py new file mode 100644 index 0000000000..1c407f22f1 --- /dev/null +++ b/auth_api_key_native_generate/__manifest__.py @@ -0,0 +1,17 @@ +# Copyright 2026 Trobz +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). + +{ + "name": "Auth Api Key Native Generate", + "summary": """ + Endpoint to generate a native Odoo API key from user credentials""", + "version": "19.0.1.0.0", + "license": "AGPL-3", + "author": "Trobz,Odoo Community Association (OCA)", + "website": "https://github.com/OCA/server-auth", + "development_status": "Beta", + "depends": ["base_setup"], + "data": [ + "views/res_config_settings.xml", + ], +} diff --git a/auth_api_key_native_generate/controllers/__init__.py b/auth_api_key_native_generate/controllers/__init__.py new file mode 100644 index 0000000000..12a7e529b6 --- /dev/null +++ b/auth_api_key_native_generate/controllers/__init__.py @@ -0,0 +1 @@ +from . import main diff --git a/auth_api_key_native_generate/controllers/main.py b/auth_api_key_native_generate/controllers/main.py new file mode 100644 index 0000000000..187dfd28e5 --- /dev/null +++ b/auth_api_key_native_generate/controllers/main.py @@ -0,0 +1,161 @@ +# Copyright 2026 Trobz +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). + +import logging +from contextlib import ExitStack +from datetime import timedelta, timezone + +import odoo +from odoo import fields, http +from odoo.exceptions import AccessDenied +from odoo.http import Controller, request, route + +_logger = logging.getLogger(__name__) + +# Default validity window for a generated API key, in days. Can be overridden +# through the ``auth_api_key_native_generate.duration`` system parameter. +DEFAULT_DURATION_DAYS = 90 + +# The endpoint is unauthenticated (auth="none"); cap the request body to a small +# size so it cannot be abused to feed large payloads into memory. Odoo's default +# limit is 128MiB, far more than a credentials payload ever needs. +MAX_CONTENT_LENGTH = 8 * 1024 # 8 KiB + + +class AuthApiKeyNativeGenerate(Controller): + def _get_api_key_duration(self, env): + """Return the configured validity duration (in days) for new keys.""" + param = ( + env["ir.config_parameter"] + .sudo() + .get_param("auth_api_key_native_generate.duration") + ) + try: + duration = int(param) + except (TypeError, ValueError): + return DEFAULT_DURATION_DAYS + return duration if duration > 0 else DEFAULT_DURATION_DAYS + + @route( + "/api/auth/generate_api_key", + type="http", + auth="none", + methods=["POST"], + csrf=False, + save_session=False, + readonly=False, + max_content_length=MAX_CONTENT_LENGTH, + ) + def generate_api_key(self): + """Exchange user credentials for a native Odoo API key. + + Request body (JSON):: + + {"db": "...", "login": "...", "password": "..."} + + Response body (JSON):: + + {"api_key": "...", "expiration_date": "..."} + + The credentials are verified through the native + ``res.users.authenticate`` path, which relies on ``_assert_can_auth`` + for the built-in login cooldown protection. On success a new API key is + issued with ``res.users.apikeys._generate`` using the ``rpc`` scope and + a fixed validity window (default 90 days, configurable in the settings). + """ + try: + data = request.get_json_data() + except ValueError: + return request.make_json_response( + {"error": "Invalid JSON body."}, status=400 + ) + # get_json_data() does no shape validation: reject anything that is not + # a JSON object so the .get() calls below cannot raise a 500. + if not isinstance(data, dict): + return request.make_json_response( + {"error": "Request body must be a JSON object."}, status=400 + ) + + db = data.get("db") + login = data.get("login") + password = data.get("password") + if not (db and login and password): + return request.make_json_response( + {"error": "'db', 'login' and 'password' are required."}, status=400 + ) + + if not http.db_filter([db]): + return request.make_json_response( + {"error": "Database not found."}, status=404 + ) + + with ExitStack() as stack: + if not request.db or request.db != db: + # Open a dedicated cursor/env when the request is not already + # bound to the requested database. The cursor is committed on a + # clean exit of the ExitStack, persisting the new key. + try: + registry = odoo.modules.registry.Registry(db) + except Exception: + _logger.warning("Database %r not found or not reachable.", db) + return request.make_json_response( + {"error": "Database not found."}, status=404 + ) + cr = stack.enter_context(registry.cursor()) + env = odoo.api.Environment(cr, None, {}) + else: + env = request.env(user=None, su=False) + + credential = {"login": login, "password": password, "type": "password"} + # "interactive": True selects the password-login path in + # _check_credentials (verify the real password, not treat it as an + # API key) and silences the "assuming interactive login" warning. + try: + auth_info = env["res.users"].authenticate( + credential, {"interactive": True} + ) + except AccessDenied: + return request.make_json_response( + {"error": "Invalid credentials."}, status=401 + ) + + uid = auth_info["uid"] + # Enforce the same MFA gate as the native login flow + # (see Session.authenticate / odoo.http). This endpoint only accepts + # a password, so a user with two-factor authentication enabled must + # not be able to obtain an API key by password alone. + user = env["res.users"].browse(uid) + if auth_info.get("mfa") != "skip" and user._mfa_url(): + return request.make_json_response( + { + "error": "Two-factor authentication is enabled for this " + "user; API key generation from a password is not allowed." + }, + status=403, + ) + duration = self._get_api_key_duration(env) + # fields.Datetime.now() returns naive UTC, matching how Odoo stores + # and compares apikeys.expiration_date (now() at time zone 'utc'). + # The response below serializes it timezone-aware to be explicit + # towards external clients. + expiration_date = fields.Datetime.now() + timedelta(days=duration) + + # Generate the key as the authenticated user, in superuser mode so + # the fixed validity window is not capped by the user's group + # ``api_key_duration`` limit. Keeping ``uid`` ensures the key is + # owned by the authenticated user, not the superuser. + key_env = env(user=uid, su=True) + api_key = key_env["res.users.apikeys"]._generate( + scope="rpc", + name="Generated via /api/auth/generate_api_key", + expiration_date=expiration_date, + ) + + return request.make_json_response( + { + "api_key": api_key, + "expiration_date": expiration_date.replace( + tzinfo=timezone.utc + ).isoformat(), + } + ) diff --git a/auth_api_key_native_generate/models/__init__.py b/auth_api_key_native_generate/models/__init__.py new file mode 100644 index 0000000000..0deb68c468 --- /dev/null +++ b/auth_api_key_native_generate/models/__init__.py @@ -0,0 +1 @@ +from . import res_config_settings diff --git a/auth_api_key_native_generate/models/res_config_settings.py b/auth_api_key_native_generate/models/res_config_settings.py new file mode 100644 index 0000000000..e46cd0226c --- /dev/null +++ b/auth_api_key_native_generate/models/res_config_settings.py @@ -0,0 +1,17 @@ +# Copyright 2026 Trobz +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). + +from odoo import fields, models + + +class ResConfigSettings(models.TransientModel): + _inherit = "res.config.settings" + + auth_api_key_native_generate_duration = fields.Integer( + string="Generated API Key Validity (days)", + default=90, + config_parameter="auth_api_key_native_generate.duration", + help="Validity window, in days, applied to API keys issued through the " + "/api/auth/generate_api_key endpoint. Only newly generated keys are " + "affected; existing keys keep their own expiration date.", + ) diff --git a/auth_api_key_native_generate/pyproject.toml b/auth_api_key_native_generate/pyproject.toml new file mode 100644 index 0000000000..4231d0cccb --- /dev/null +++ b/auth_api_key_native_generate/pyproject.toml @@ -0,0 +1,3 @@ +[build-system] +requires = ["whool"] +build-backend = "whool.buildapi" diff --git a/auth_api_key_native_generate/readme/CONFIGURE.md b/auth_api_key_native_generate/readme/CONFIGURE.md new file mode 100644 index 0000000000..f15c39f7be --- /dev/null +++ b/auth_api_key_native_generate/readme/CONFIGURE.md @@ -0,0 +1,29 @@ +Go to **Settings > General Settings > Integrations > API Key Generation +Endpoint** to set the validity window, in days, applied to newly generated API +keys. The value is stored in the `auth_api_key_native_generate.duration` system +parameter (default: `90`). + +Notes on the key lifecycle: + +- The validity window is fixed. There is no rolling or automatic renewal. +- Changing the duration only affects keys generated afterwards. Existing keys + keep their own expiration date. +- Generating a key does not revoke the user's other keys, so the same user can + hold valid keys on several devices (with no maximum number of devices) + +## Reverse proxy hardening (recommended) + +This endpoint exposes a credential-exchange surface. Add these protections at +the reverse proxy layer: + +- HTTP Basic Authentication in front of `/json/2` and + `/api/auth/generate_api_key`. +- Rate limiting on `/api/auth/generate_api_key` (for example 6 requests per + minute per IP) to slow down brute-force attempts in multi-worker deployments. + +The new endpoint relies on Odoo's native login cooldown (`_assert_can_auth`), which +throttles per client IP using `request.httprequest.remote_addr`. When Odoo runs +behind a reverse proxy, enable proxy mode (`--proxy-mode` / `proxy_mode = True`) +and have the proxy forward `X-Forwarded-For`, so the cooldown sees the real +client IP. Otherwise every request shares one IP and the per-IP protection is +useless. diff --git a/auth_api_key_native_generate/readme/CONTRIBUTORS.md b/auth_api_key_native_generate/readme/CONTRIBUTORS.md new file mode 100644 index 0000000000..630fca33e8 --- /dev/null +++ b/auth_api_key_native_generate/readme/CONTRIBUTORS.md @@ -0,0 +1 @@ +- Do Anh Duy \<\> diff --git a/auth_api_key_native_generate/readme/DESCRIPTION.md b/auth_api_key_native_generate/readme/DESCRIPTION.md new file mode 100644 index 0000000000..b0d1fe888d --- /dev/null +++ b/auth_api_key_native_generate/readme/DESCRIPTION.md @@ -0,0 +1,13 @@ +This module adds an HTTP endpoint that allows to create a new native Odoo API key (`res.users.apikeys`) with a user's login and password. + +It is for clients such as mobile apps that cannot use session-cookie +authentication and need a bearer API key to call the new native Odoo `/json/2` api. + +The [`auth_api_key`](../auth_api_key) module manages its own `auth.api.key` +records and a custom `API-KEY` header. This module instead reuses the native +Odoo API key mechanism: + +- Credentials are checked through `res.users.authenticate`, which goes through + Odoo's `_assert_can_auth()` login cooldown for brute-force protection. +- Keys are created with `res.users.apikeys._generate()` using the `rpc` scope. +- Each key has a fixed validity window, 90 days by default and configurable. diff --git a/auth_api_key_native_generate/readme/USAGE.md b/auth_api_key_native_generate/readme/USAGE.md new file mode 100644 index 0000000000..193c584a28 --- /dev/null +++ b/auth_api_key_native_generate/readme/USAGE.md @@ -0,0 +1,38 @@ +Request a key by POSTing JSON credentials to the endpoint: + +``` +POST /api/auth/generate_api_key +Content-Type: application/json + +{ + "db": "mydb", + "login": "user@example.com", + "password": "the-user-password" +} +``` + +On success (HTTP 200) the response holds the key and its expiration date +(ISO 8601, UTC): + +```json +{ + "api_key": "0123456789abcdef...", + "expiration_date": "2026-10-11T09:30:00+00:00" +} +``` + +Error responses: + +- `400`: missing `db`, `login` or `password`, or a body that is not a JSON object. +- `401`: invalid credentials. +- `403`: the user has two-factor authentication enabled, so a password alone cannot issue a key. +- `404`: unknown database. +- `413`: request body too large. + +Use the returned `api_key` as the bearer credential for the native Odoo +`/json/2` and RPC endpoints, in place of the user password: + +``` +curl -H "Authorization: Bearer 0123456789abcdef..." \ + https://mydb.example.com/json/2/... +``` diff --git a/auth_api_key_native_generate/static/description/icon.png b/auth_api_key_native_generate/static/description/icon.png new file mode 100644 index 0000000000000000000000000000000000000000..3a0328b516c4980e8e44cdb63fd945757ddd132d GIT binary patch literal 9455 zcmW++2RxMjAAjx~&dlBk9S+%}OXg)AGE&Cb*&}d0jUxM@u(PQx^-s)697TX`ehR4?GS^qbkof1cslKgkU)h65qZ9Oc=ml_0temigYLJfnz{IDzUf>bGs4N!v3=Z3jMq&A#7%rM5eQ#dc?k~! zVpnB`o+K7|Al`Q_U;eD$B zfJtP*jH`siUq~{KE)`jP2|#TUEFGRryE2`i0**z#*^6~AI|YzIWy$Cu#CSLW3q=GA z6`?GZymC;dCPk~rBS%eCb`5OLr;RUZ;D`}um=H)BfVIq%7VhiMr)_#G0N#zrNH|__ zc+blN2UAB0=617@>_u;MPHN;P;N#YoE=)R#i$k_`UAA>WWCcEVMh~L_ zj--gtp&|K1#58Yz*AHCTMziU1Jzt_jG0I@qAOHsk$2}yTmVkBp_eHuY$A9)>P6o~I z%aQ?!(GqeQ-Y+b0I(m9pwgi(IIZZzsbMv+9w{PFtd_<_(LA~0H(xz{=FhLB@(1&qHA5EJw1>>=%q2f&^X>IQ{!GJ4e9U z&KlB)z(84HmNgm2hg2C0>WM{E(DdPr+EeU_N@57;PC2&DmGFW_9kP&%?X4}+xWi)( z;)z%wI5>D4a*5XwD)P--sPkoY(a~WBw;E~AW`Yue4kFa^LM3X`8x|}ZUeMnqr}>kH zG%WWW>3ml$Yez?i%)2pbKPI7?5o?hydokgQyZsNEr{a|mLdt;X2TX(#B1j35xPnPW z*bMSSOauW>o;*=kO8ojw91VX!qoOQb)zHJ!odWB}d+*K?#sY_jqPdg{Sm2HdYzdEx zOGVPhVRTGPtv0o}RfVP;Nd(|CB)I;*t&QO8h zFfekr30S!-LHmV_Su-W+rEwYXJ^;6&3|L$mMC8*bQptyOo9;>Qb9Q9`ySe3%V$A*9 zeKEe+b0{#KWGp$F+tga)0RtI)nhMa-K@JS}2krK~n8vJ=Ngm?R!9G<~RyuU0d?nz# z-5EK$o(!F?hmX*2Yt6+coY`6jGbb7tF#6nHA zuKk=GGJ;ZwON1iAfG$E#Y7MnZVmrY|j0eVI(DN_MNFJmyZ|;w4tf@=CCDZ#5N_0K= z$;R~bbk?}TpfDjfB&aiQ$VA}s?P}xPERJG{kxk5~R`iRS(SK5d+Xs9swCozZISbnS zk!)I0>t=A<-^z(cmSFz3=jZ23u13X><0b)P)^1T_))Kr`e!-pb#q&J*Q`p+B6la%C zuVl&0duN<;uOsB3%T9Fp8t{ED108<+W(nOZd?gDnfNBC3>M8WE61$So|P zVvqH0SNtDTcsUdzaMDpT=Ty0pDHHNL@Z0w$Y`XO z2M-_r1S+GaH%pz#Uy0*w$Vdl=X=rQXEzO}d6J^R6zjM1u&c9vYLvLp?W7w(?np9x1 zE_0JSAJCPB%i7p*Wvg)pn5T`8k3-uR?*NT|J`eS#_#54p>!p(mLDvmc-3o0mX*mp_ zN*AeS<>#^-{S%W<*mz^!X$w_2dHWpcJ6^j64qFBft-o}o_Vx80o0>}Du;>kLts;$8 zC`7q$QI(dKYG`Wa8#wl@V4jVWBRGQ@1dr-hstpQL)Tl+aqVpGpbSfN>5i&QMXfiZ> zaA?T1VGe?rpQ@;+pkrVdd{klI&jVS@I5_iz!=UMpTsa~mBga?1r}aRBm1WS;TT*s0f0lY=JBl66Upy)-k4J}lh=P^8(SXk~0xW=T9v*B|gzIhN z>qsO7dFd~mgxAy4V?&)=5ieYq?zi?ZEoj)&2o)RLy=@hbCRcfT5jigwtQGE{L*8<@Yd{zg;CsL5mvzfDY}P-wos_6PfprFVaeqNE%h zKZhLtcQld;ZD+>=nqN~>GvROfueSzJD&BE*}XfU|H&(FssBqY=hPCt`d zH?@s2>I(|;fcW&YM6#V#!kUIP8$Nkdh0A(bEVj``-AAyYgwY~jB zT|I7Bf@%;7aL7Wf4dZ%VqF$eiaC38OV6oy3Z#TER2G+fOCd9Iaoy6aLYbPTN{XRPz z;U!V|vBf%H!}52L2gH_+j;`bTcQRXB+y9onc^wLm5wi3-Be}U>k_u>2Eg$=k!(l@I zcCg+flakT2Nej3i0yn+g+}%NYb?ta;R?(g5SnwsQ49U8Wng8d|{B+lyRcEDvR3+`O{zfmrmvFrL6acVP%yG98X zo&+VBg@px@i)%o?dG(`T;n*$S5*rnyiR#=wW}}GsAcfyQpE|>a{=$Hjg=-*_K;UtD z#z-)AXwSRY?OPefw^iI+ z)AXz#PfEjlwTes|_{sB?4(O@fg0AJ^g8gP}ex9Ucf*@_^J(s_5jJV}c)s$`Myn|Kd z$6>}#q^n{4vN@+Os$m7KV+`}c%4)4pv@06af4-x5#wj!KKb%caK{A&Y#Rfs z-po?Dcb1({W=6FKIUirH&(yg=*6aLCekcKwyfK^JN5{wcA3nhO(o}SK#!CINhI`-I z1)6&n7O&ZmyFMuNwvEic#IiOAwNkR=u5it{B9n2sAJV5pNhar=j5`*N!Na;c7g!l$ z3aYBqUkqqTJ=Re-;)s!EOeij=7SQZ3Hq}ZRds%IM*PtM$wV z@;rlc*NRK7i3y5BETSKuumEN`Xu_8GP1Ri=OKQ$@I^ko8>H6)4rjiG5{VBM>B|%`&&s^)jS|-_95&yc=GqjNo{zFkw%%HHhS~e=s zD#sfS+-?*t|J!+ozP6KvtOl!R)@@-z24}`9{QaVLD^9VCSR2b`b!KC#o;Ki<+wXB6 zx3&O0LOWcg4&rv4QG0)4yb}7BFSEg~=IR5#ZRj8kg}dS7_V&^%#Do==#`u zpy6{ox?jWuR(;pg+f@mT>#HGWHAJRRDDDv~@(IDw&R>9643kK#HN`!1vBJHnC+RM&yIh8{gG2q zA%e*U3|N0XSRa~oX-3EAneep)@{h2vvd3Xvy$7og(sayr@95+e6~Xvi1tUqnIxoIH zVWo*OwYElb#uyW{Imam6f2rGbjR!Y3`#gPqkv57dB6K^wRGxc9B(t|aYDGS=m$&S!NmCtrMMaUg(c zc2qC=2Z`EEFMW-me5B)24AqF*bV5Dr-M5ig(l-WPS%CgaPzs6p_gnCIvTJ=Y<6!gT zVt@AfYCzjjsMEGi=rDQHo0yc;HqoRNnNFeWZgcm?f;cp(6CNylj36DoL(?TS7eU#+ z7&mfr#y))+CJOXQKUMZ7QIdS9@#-}7y2K1{8)cCt0~-X0O!O?Qx#E4Og+;A2SjalQ zs7r?qn0H044=sDN$SRG$arw~n=+T_DNdSrarmu)V6@|?1-ZB#hRn`uilTGPJ@fqEy zGt(f0B+^JDP&f=r{#Y_wi#AVDf-y!RIXU^0jXsFpf>=Ji*TeqSY!H~AMbJdCGLhC) zn7Rx+sXw6uYj;WRYrLd^5IZq@6JI1C^YkgnedZEYy<&4(z%Q$5yv#Boo{AH8n$a zhb4Y3PWdr269&?V%uI$xMcUrMzl=;w<_nm*qr=c3Rl@i5wWB;e-`t7D&c-mcQl7x! zZWB`UGcw=Y2=}~wzrfLx=uet<;m3~=8I~ZRuzvMQUQdr+yTV|ATf1Uuomr__nDf=X zZ3WYJtHp_ri(}SQAPjv+Y+0=fH4krOP@S&=zZ-t1jW1o@}z;xk8 z(Nz1co&El^HK^NrhVHa-_;&88vTU>_J33=%{if;BEY*J#1n59=07jrGQ#IP>@u#3A z;!q+E1Rj3ZJ+!4bq9F8PXJ@yMgZL;>&gYA0%_Kbi8?S=XGM~dnQZQ!yBSgcZhY96H zrWnU;k)qy`rX&&xlDyA%(a1Hhi5CWkmg(`Gb%m(HKi-7Z!LKGRP_B8@`7&hdDy5n= z`OIxqxiVfX@OX1p(mQu>0Ai*v_cTMiw4qRt3~NBvr9oBy0)r>w3p~V0SCm=An6@3n)>@z!|o-$HvDK z|3D2ZMJkLE5loMKl6R^ez@Zz%S$&mbeoqH5`Bb){Ei21q&VP)hWS2tjShfFtGE+$z zzCR$P#uktu+#!w)cX!lWN1XU%K-r=s{|j?)Akf@q#3b#{6cZCuJ~gCxuMXRmI$nGtnH+-h z+GEi!*X=AP<|fG`1>MBdTb?28JYc=fGvAi2I<$B(rs$;eoJCyR6_bc~p!XR@O-+sD z=eH`-ye})I5ic1eL~TDmtfJ|8`0VJ*Yr=hNCd)G1p2MMz4C3^Mj?7;!w|Ly%JqmuW zlIEW^Ft%z?*|fpXda>Jr^1noFZEwFgVV%|*XhH@acv8rdGxeEX{M$(vG{Zw+x(ei@ zmfXb22}8-?Fi`vo-YVrTH*C?a8%M=Hv9MqVH7H^J$KsD?>!SFZ;ZsvnHr_gn=7acz z#W?0eCdVhVMWN12VV^$>WlQ?f;P^{(&pYTops|btm6aj>_Uz+hqpGwB)vWp0Cf5y< zft8-je~nn?W11plq}N)4A{l8I7$!ks_x$PXW-2XaRFswX_BnF{R#6YIwMhAgd5F9X zGmwdadS6(a^fjHtXg8=l?Rc0Sm%hk6E9!5cLVloEy4eh(=FwgP`)~I^5~pBEWo+F6 zSf2ncyMurJN91#cJTy_u8Y}@%!bq1RkGC~-bV@SXRd4F{R-*V`bS+6;W5vZ(&+I<9$;-V|eNfLa5n-6% z2(}&uGRF;p92eS*sE*oR$@pexaqr*meB)VhmIg@h{uzkk$9~qh#cHhw#>O%)b@+(| z^IQgqzuj~Sk(J;swEM-3TrJAPCq9k^^^`q{IItKBRXYe}e0Tdr=Huf7da3$l4PdpwWDop%^}n;dD#K4s#DYA8SHZ z&1!riV4W4R7R#C))JH1~axJ)RYnM$$lIR%6fIVA@zV{XVyx}C+a-Dt8Y9M)^KU0+H zR4IUb2CJ{Hg>CuaXtD50jB(_Tcx=Z$^WYu2u5kubqmwp%drJ6 z?Fo40g!Qd<-l=TQxqHEOuPX0;^z7iX?Ke^a%XT<13TA^5`4Xcw6D@Ur&VT&CUe0d} z1GjOVF1^L@>O)l@?bD~$wzgf(nxX1OGD8fEV?TdJcZc2KoUe|oP1#=$$7ee|xbY)A zDZq+cuTpc(fFdj^=!;{k03C69lMQ(|>uhRfRu%+!k&YOi-3|1QKB z z?n?eq1XP>p-IM$Z^C;2L3itnbJZAip*Zo0aw2bs8@(s^~*8T9go!%dHcAz2lM;`yp zD=7&xjFV$S&5uDaiScyD?B-i1ze`+CoRtz`Wn+Zl&#s4&}MO{@N!ufrzjG$B79)Y2d3tBk&)TxUTw@QS0TEL_?njX|@vq?Uz(nBFK5Pq7*xj#u*R&i|?7+6# z+|r_n#SW&LXhtheZdah{ZVoqwyT{D>MC3nkFF#N)xLi{p7J1jXlmVeb;cP5?e(=f# zuT7fvjSbjS781v?7{)-X3*?>tq?)Yd)~|1{BDS(pqC zC}~H#WXlkUW*H5CDOo<)#x7%RY)A;ShGhI5s*#cRDA8YgqG(HeKDx+#(ZQ?386dv! zlXCO)w91~Vw4AmOcATuV653fa9R$fyK8ul%rG z-wfS zihugoZyr38Im?Zuh6@RcF~t1anQu7>#lPpb#}4cOA!EM11`%f*07RqOVkmX{p~KJ9 z^zP;K#|)$`^Rb{rnHGH{~>1(fawV0*Z#)}M`m8-?ZJV<+e}s9wE# z)l&az?w^5{)`S(%MRzxdNqrs1n*-=jS^_jqE*5XDrA0+VE`5^*p3CuM<&dZEeCjoz zR;uu_H9ZPZV|fQq`Cyw4nscrVwi!fE6ciMmX$!_hN7uF;jjKG)d2@aC4ropY)8etW=xJvni)8eHi`H$%#zn^WJ5NLc-rqk|u&&4Z6fD_m&JfSI1Bvb?b<*n&sfl0^t z=HnmRl`XrFvMKB%9}>PaA`m-fK6a0(8=qPkWS5bb4=v?XcWi&hRY?O5HdulRi4?fN zlsJ*N-0Qw+Yic@s0(2uy%F@ib;GjXt01Fmx5XbRo6+n|pP(&nodMoap^z{~q ziEeaUT@Mxe3vJSfI6?uLND(CNr=#^W<1b}jzW58bIfyWTDle$mmS(|x-0|2UlX+9k zQ^EX7Nw}?EzVoBfT(-LT|=9N@^hcn-_p&sqG z&*oVs2JSU+N4ZD`FhCAWaS;>|wH2G*Id|?pa#@>tyxX`+4HyIArWDvVrX)2WAOQff z0qyHu&-S@i^MS-+j--!pr4fPBj~_8({~e1bfcl0wI1kaoN>mJL6KUPQm5N7lB(ui1 zE-o%kq)&djzWJ}ob<-GfDlkB;F31j-VHKvQUGQ3sp`CwyGJk_i!y^sD0fqC@$9|jO zOqN!r!8-p==F@ZVP=U$qSpY(gQ0)59P1&t@y?5rvg<}E+GB}26NYPp4f2YFQrQtot5mn3wu_qprZ=>Ig-$ zbW26Ws~IgY>}^5w`vTB(G`PTZaDiGBo5o(tp)qli|NeV( z@H_=R8V39rt5J5YB2Ky?4eJJ#b`_iBe2ot~6%7mLt5t8Vwi^Jy7|jWXqa3amOIoRb zOr}WVFP--DsS`1WpN%~)t3R!arKF^Q$e12KEqU36AWwnCBICpH4XCsfnyrHr>$I$4 z!DpKX$OKLWarN7nv@!uIA+~RNO)l$$w}p(;b>mx8pwYvu;dD_unryX_NhT8*Tj>BTrTTL&!?O+%Rv;b?B??gSzdp?6Uug9{ zd@V08Z$BdI?fpoCS$)t4mg4rT8Q_I}h`0d-vYZ^|dOB*Q^S|xqTV*vIg?@fVFSmMpaw0qtTRbx} z({Pg?#{2`sc9)M5N$*N|4;^t$+QP?#mov zGVC@I*lBVrOU-%2y!7%)fAKjpEFsgQc4{amtiHb95KQEwvf<(3T<9-Zm$xIew#P22 zc2Ix|App^>v6(3L_MCU0d3W##AB0M~3D00EWoKZqsJYT(#@w$Y_H7G22M~ApVFTRHMI_3be)Lkn#0F*V8Pq zc}`Cjy$bE;FJ6H7p=0y#R>`}-m4(0F>%@P|?7fx{=R^uFdISRnZ2W_xQhD{YuR3t< z{6yxu=4~JkeA;|(J6_nv#>Nvs&FuLA&PW^he@t(UwFFE8)|a!R{`E`K`i^ZnyE4$k z;(749Ix|oi$c3QbEJ3b~D_kQsPz~fIUKym($a_7dJ?o+40*OLl^{=&oq$<#Q(yyrp z{J-FAniyAw9tPbe&IhQ|a`DqFTVQGQ&Gq3!C2==4x{6EJwiPZ8zub-iXoUtkJiG{} zPaR&}_fn8_z~(=;5lD-aPWD3z8PZS@AaUiomF!G8I}Mf>e~0g#BelA-5#`cj;O5>N Xviia!U7SGha1wx#SCgwmn*{w2TRX*I literal 0 HcmV?d00001 diff --git a/auth_api_key_native_generate/static/description/index.html b/auth_api_key_native_generate/static/description/index.html new file mode 100644 index 0000000000..8915e0d14c --- /dev/null +++ b/auth_api_key_native_generate/static/description/index.html @@ -0,0 +1,525 @@ + + + + + +README.rst + + + +
+ + + +Odoo Community Association + +
+

Auth Api Key Native Generate

+ +

Beta License: AGPL-3 OCA/server-auth Translate me on Weblate Try me on Runboat

+

This module adds an HTTP endpoint that allows to create a new native +Odoo API key (res.users.apikeys) with a user’s login and password.

+

It is for clients such as mobile apps that cannot use session-cookie +authentication and need a bearer API key to call the new native Odoo +/json/2 api.

+

The `auth_api_key <../auth_api_key>`__ module manages its own +auth.api.key records and a custom API-KEY header. This module +instead reuses the native Odoo API key mechanism:

+
    +
  • Credentials are checked through res.users.authenticate, which goes +through Odoo’s _assert_can_auth() login cooldown for brute-force +protection.
    • +
  • Keys are created with res.users.apikeys._generate() using the +rpc scope.
    • +
  • Each key has a fixed validity window, 90 days by default and +configurable.
    • +
+

Table of contents

+ +
+

Configuration

+

Go to Settings > General Settings > Integrations > API Key Generation +Endpoint to set the validity window, in days, applied to newly +generated API keys. The value is stored in the +auth_api_key_native_generate.duration system parameter (default: +90).

+

Notes on the key lifecycle:

+
    +
  • The validity window is fixed. There is no rolling or automatic +renewal.
    • +
  • Changing the duration only affects keys generated afterwards. Existing +keys keep their own expiration date.
    • +
  • Generating a key does not revoke the user’s other keys, so the same +user can hold valid keys on several devices (with no maximum number of +devices)
    • +
+ +
+
+

Usage

+

Request a key by POSTing JSON credentials to the endpoint:

+
+POST /api/auth/generate_api_key
+Content-Type: application/json
+
+{
+  "db": "mydb",
+  "login": "user@example.com",
+  "password": "the-user-password"
+}
+
+

On success (HTTP 200) the response holds the key and its expiration date +(ISO 8601, UTC):

+
+{
+  "api_key": "0123456789abcdef...",
+  "expiration_date": "2026-10-11T09:30:00+00:00"
+}
+
+

Error responses:

+
    +
  • 400: missing db, login or password, or a body that is +not a JSON object.
    • +
  • 401: invalid credentials.
    • +
  • 403: the user has two-factor authentication enabled, so a password +alone cannot issue a key.
    • +
  • 404: unknown database.
    • +
  • 413: request body too large.
    • +
+

Use the returned api_key as the bearer credential for the native +Odoo /json/2 and RPC endpoints, in place of the user password:

+
+curl -H "Authorization: Bearer 0123456789abcdef..." \
+     https://mydb.example.com/json/2/...
+
+
+
+

Bug Tracker

+

Bugs are tracked on GitHub Issues. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +feedback.

+

Do not contact contributors directly about support or help with technical issues.

+
+
+

Credits

+
+

Authors

+
    +
  • Trobz
    • +
+
+
+

Contributors

+ +
+
+

Maintainers

+

This module is maintained by the OCA.

+ +Odoo Community Association + +

OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use.

+

This module is part of the OCA/server-auth project on GitHub.

+

You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

+
+
+
+
+ + diff --git a/auth_api_key_native_generate/tests/__init__.py b/auth_api_key_native_generate/tests/__init__.py new file mode 100644 index 0000000000..3dba20e354 --- /dev/null +++ b/auth_api_key_native_generate/tests/__init__.py @@ -0,0 +1 @@ +from . import test_generate_api_key diff --git a/auth_api_key_native_generate/tests/test_generate_api_key.py b/auth_api_key_native_generate/tests/test_generate_api_key.py new file mode 100644 index 0000000000..f511327cd9 --- /dev/null +++ b/auth_api_key_native_generate/tests/test_generate_api_key.py @@ -0,0 +1,115 @@ +# Copyright 2026 Trobz +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). + +import json +from datetime import datetime, timezone +from unittest.mock import patch + +from odoo import fields +from odoo.tests import HttpCase, new_test_user, tagged +from odoo.tools import mute_logger + +ENDPOINT = "/api/auth/generate_api_key" + + +@tagged("-at_install", "post_install") +class TestGenerateApiKey(HttpCase): + @classmethod + def setUpClass(cls): + super().setUpClass() + cls.password = "Str0ng-P@ssw0rd" + cls.user = new_test_user( + cls.env, + login="api-key-user", + password=cls.password, + group_ids=[cls.env.ref("base.group_user").id], + ) + + def _generate(self, payload, *, expected_code=200): + res = self.url_open( + ENDPOINT, + data=json.dumps(payload), + headers={"Content-Type": "application/json"}, + ) + self.assertEqual(res.status_code, expected_code) + return res + + def _credentials(self, **overrides): + payload = { + "db": self.env.cr.dbname, + "login": "api-key-user", + "password": self.password, + } + payload.update(overrides) + return payload + + def _parse_expiration(self, body): + """Parse the ISO 8601 expiration date and check it is UTC-aware.""" + expiration = datetime.fromisoformat(body["expiration_date"]) + self.assertEqual(expiration.utcoffset(), timezone.utc.utcoffset(None)) + return expiration.replace(tzinfo=None) + + def test_generate_ok(self): + # Clear the parameter so the code default (90 days) is exercised, + # independently of any value persisted in the database. + self.env["ir.config_parameter"].set_param( + "auth_api_key_native_generate.duration", False + ) + body = self._generate(self._credentials()).json() + + # The returned key must authenticate as the target user with rpc scope. + uid = self.env["res.users.apikeys"]._check_credentials( + scope="rpc", key=body["api_key"] + ) + self.assertEqual(uid, self.user.id) + + # Default validity window is 90 days ahead (UTC). + expiration = self._parse_expiration(body) + delta_days = (expiration - fields.Datetime.now()).days + self.assertGreaterEqual(delta_days, 88) + self.assertLessEqual(delta_days, 90) + + def test_generate_respects_configured_duration(self): + self.env["ir.config_parameter"].set_param( + "auth_api_key_native_generate.duration", "30" + ) + body = self._generate(self._credentials()).json() + expiration = self._parse_expiration(body) + delta_days = (expiration - fields.Datetime.now()).days + self.assertGreaterEqual(delta_days, 28) + self.assertLessEqual(delta_days, 30) + + @mute_logger("odoo.addons.base.models.res_users", "odoo.http") + def test_generate_wrong_password(self): + self._generate(self._credentials(password="wrong"), expected_code=401) + + def test_generate_missing_fields(self): + self._generate( + {"db": self.env.cr.dbname, "login": "api-key-user"}, expected_code=400 + ) + + def test_generate_non_object_body(self): + # Valid JSON that is not an object must be rejected, not 500. + self._generate([1, 2, 3], expected_code=400) + + def test_generate_oversized_body(self): + # Body above the route max_content_length must be rejected (413). + res = self.url_open( + ENDPOINT, + data=json.dumps({"db": self.env.cr.dbname, "pad": "x" * 9000}), + headers={"Content-Type": "application/json"}, + ) + self.assertEqual(res.status_code, 413) + + @mute_logger("odoo.http") + def test_generate_unknown_db(self): + self._generate( + self._credentials(db="this-db-does-not-exist"), expected_code=404 + ) + + def test_generate_refused_when_mfa_enabled(self): + # A user with two-factor authentication must not obtain a key by + # password alone. _mfa_url() is truthy when MFA is enabled. + users_cls = type(self.env["res.users"]) + with patch.object(users_cls, "_mfa_url", return_value="/web/login/totp"): + self._generate(self._credentials(), expected_code=403) diff --git a/auth_api_key_native_generate/views/res_config_settings.xml b/auth_api_key_native_generate/views/res_config_settings.xml new file mode 100644 index 0000000000..9ee0635f42 --- /dev/null +++ b/auth_api_key_native_generate/views/res_config_settings.xml @@ -0,0 +1,33 @@ + + + + + res.config.settings.view.form.inherit.auth.api.key.native.generate + res.config.settings + + + + +
+
+ + + + +