[MIG] auth_device: Migration to 19.0

Author: Raphael Vicini

auth_device/__manifest__.py

@@ -4,7 +4,7 @@
 {
     "name": "Auth Device",
     "summary": "Allows users to log in through an external device.",
-    "version": "14.0.1.0.0",
+    "version": "19.0.1.0.0",
     "license": "AGPL-3",
     "author": "ACSONE SA/NV,Odoo Community Association (OCA)",
     "maintainers": ["FrancoMaxime"],
@@ -13,8 +13,12 @@
         "web",
     ],
     "data": [
-        "views/assets_frontend.xml",
         "views/auth_device_connection.xml",
         "views/res_users_views.xml",
     ],
+    "assets": {
+        "web.assets_frontend": [
+            "auth_device/static/src/interactions/*",
+        ],
+    },
 }

auth_device/controllers/main.py

@@ -4,12 +4,12 @@
 
 import werkzeug.utils
 
-from odoo import _, http
+from odoo import http
 from odoo.exceptions import AccessDenied
 from odoo.http import request
 
 from odoo.addons.portal.controllers.web import Home
-from odoo.addons.web.controllers.main import ensure_db, login_and_redirect
+from odoo.addons.web.controllers.utils import ensure_db
 
 
 class DeviceController(Home):
@@ -28,11 +28,11 @@ def web_login(self, *args, **kw):
         if response.is_qweb:
             error = request.params.get("auth_device_error")
             if error == "1":
-                error = _("Access Denied")
+                error = self.env._("Access Denied")
             elif error == "2":
-                error = _("Missing Device Code")
+                error = self.env._("Missing Device Code")
             elif error == "3":
-                error = _("Internal Error")
+                error = self.env._("Internal Error")
             else:
                 error = None
             if error:
@@ -42,7 +42,7 @@ def web_login(self, *args, **kw):
 
 
 class AuthDeviceController(http.Controller):
-    @http.route("/auth_device/login", type="http", auth="none")
+    @http.route("/auth_device/login", type="http", auth="none", readonly=False)
     def device_login(self, redirect="/web", **kw):
         ensure_db()
         if request.httprequest.method == "GET" or request.session.uid:
@@ -70,12 +70,13 @@ def device_login(self, redirect="/web", **kw):
             url = "/web/login?auth_device_error=3"
         elif user and request.httprequest.method == "POST":
             try:
-                return login_and_redirect(
-                    db=request.session.db,
-                    login=user.login,
-                    key=request.params["device_code"],
-                    redirect_url=redirect,
-                )
+                credential = {
+                    "login": user.login,
+                    "password": request.params["device_code"],
+                    "type": "password",
+                }
+                request.session.authenticate(request.env, credential)
+                return request.redirect(redirect or "/web")
             except AccessDenied:
                 url = "/web/login?auth_device_error=1"
         return werkzeug.utils.redirect(url, 303)

auth_device/i18n/auth_device.pot

@@ -6,24 +6,22 @@
 
 class ResUsers(models.Model):
     _inherit = "res.users"
-    _sql_constraints = [
-        (
-            "device_code_uniq",
-            "UNIQUE(device_code)",
-            "The device code should be unique.",
-        )
-    ]
 
-    device_code = fields.Char("Device Code", copy=False)
+    _device_code_uniq = models.Constraint(
+        "UNIQUE(device_code)",
+        "The device code should be unique.",
+    )
+
+    device_code = fields.Char(copy=False)
 
     is_allowed_to_connect_with_device = fields.Boolean(
         string="Is allowed to connect with the external device?"
     )
 
     # pylint: disable=missing-return
-    def _check_credentials(self, password, env):
+    def _check_credentials(self, credential, env):
         try:
-            super()._check_credentials(password, env)
+            return super()._check_credentials(credential, env)
 
         except exceptions.AccessDenied:
             # Just be sure that parent methods aren't wrong
@@ -32,10 +30,16 @@ def _check_credentials(self, password, env):
                 .sudo()
                 .search(
                     [
-                        ("device_code", "=", password),
+                        ("device_code", "=", credential["password"]),
                         ("is_allowed_to_connect_with_device", "=", True),
                     ]
                 )
             )
             if not user or len(user) > 1:
                 raise
+
+            return {
+                "uid": self.env.user.id,
+                "auth_method": "passkey",
+                "mfa": "skip",
+            }

auth_device/i18n/fr.po

@@ -0,0 +1,27 @@
+import {Interaction} from "@web/public/interaction";
+import {registry} from "@web/core/registry";
+
+export class DeviceLogin extends Interaction {
+    static selector = ".o_auth_device_login";
+
+    dynamicContent = {
+        _root: {"t-on-click.prevent": this.onClick},
+    };
+
+    onClick() {
+        const modalEl = document.querySelector("#loginDevice");
+        if (!modalEl) {
+            return;
+        }
+
+        window.Modal.getOrCreateInstance(modalEl).show();
+
+        modalEl.addEventListener(
+            "shown.bs.modal",
+            () => modalEl.querySelector("#device_code_input")?.focus(),
+            {once: true}
+        );
+    }
+}
+
+registry.category("public.interactions").add("auth_device.device_login", DeviceLogin);

auth_device/models/res_users.py

@@ -6,11 +6,11 @@
 
 from odoo import exceptions
 from odoo.tests import tagged
-from odoo.tests.common import SavepointCase
+from odoo.tests.common import TransactionCase
 
 
 @tagged("post_install", "-at_install")
-class TestAuthDevice(SavepointCase):
+class TestAuthDevice(TransactionCase):
     @classmethod
     def setUpClass(cls):
         super().setUpClass()
@@ -37,16 +37,29 @@ def setUpClass(cls):
         )
         cls.user = cls.user.with_user(cls.user)
 
+    def _device_credential(self, device_code):
+        return {
+            "login": self.user.login,
+            "password": device_code,
+            "type": "password",
+        }
+
     def test_01_normal_login_succeed(self):
-        self.user._check_credentials(self.user_device_code, {"interactive": True})
+        self.user._check_credentials(
+            self._device_credential(self.user_device_code), {"interactive": True}
+        )
 
     def test_02_normal_login_fail(self):
         with self.assertRaises(exceptions.AccessDenied):
-            self.user._check_credentials(self.bad_device_code, {"interactive": True})
+            self.user._check_credentials(
+                self._device_credential(self.bad_device_code), {"interactive": True}
+            )
 
     def test_03_missing_device_code(self):
-        with self.assertRaises(AssertionError):
-            self.user._check_credentials("", {"interactive": True})
+        with self.assertRaises(exceptions.AccessDenied):
+            self.user._check_credentials(
+                self._device_credential(""), {"interactive": True}
+            )
 
     def test_04_duplicate_device_code(self):
         partner_2 = self.partner_user = self.ResPartner.create(
@@ -71,4 +84,6 @@ def test_04_duplicate_device_code(self):
     def test_05_not_allowed_to_connect(self):
         self.user.sudo().is_allowed_to_connect_with_device = False
         with self.assertRaises(exceptions.AccessDenied):
-            self.user._check_credentials(self.user_device_code, {"interactive": True})
+            self.user._check_credentials(
+                self._device_credential(self.user_device_code), {"interactive": True}
+            )

auth_device/static/js/device_connection.js

@@ -2,10 +2,7 @@
 # License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
 
 from lxml import html
-from werkzeug.test import Client
-from werkzeug.wrappers import BaseResponse
 
-from odoo.service import wsgi_server
 from odoo.tests import common, tagged
 
 
@@ -46,33 +43,29 @@ def setUp(self):
 
             self.dbname = env.cr.dbname
 
-        self.werkzeug_environ = {"REMOTE_ADDR": "127.0.0.1"}
-        self.test_client = Client(wsgi_server.application, BaseResponse)
-        self.test_client.get("/web/session/logout")
+        self.url_open("/web/session/logout")
 
     def html_doc(self, response):
         """Get an HTML LXML document."""
-        return html.fromstring(response.data)
+        return html.fromstring(response.content)
 
     def get_request(self, url, data=None):
-        return self.test_client.get(url, query_string=data, follow_redirects=True)
+        return self.url_open(url, params=data, allow_redirects=True)
 
     def csrf_token(self, response):
         """Get a valid CSRF token."""
         doc = self.html_doc(response)
         return doc.xpath("//input[@name='csrf_token']")[1].get("value")
 
     def post_request(self, url, data=None):
-        return self.test_client.post(
-            url, data=data, follow_redirects=True, environ_base=self.werkzeug_environ
-        )
+        return self.url_open(url, data=data, allow_redirects=True)
 
     def test_01_ui_normal_login_succeed(self):
         # Our user wants to go to backoffice part of Odoo
         response = self.get_request("/web/", data={"db": self.dbname})
 
         # He notices that his redirected to login page as not authenticated
-        self.assertIn("oe_login_device_form", response.data.decode("utf8"))
+        self.assertIn("oe_login_device_form", response.text)
 
         # He needs to enter his credentials and submit the form
         data = {
@@ -83,14 +76,14 @@ def test_01_ui_normal_login_succeed(self):
         response = self.post_request("/auth_device/login", data=data)
 
         # He notices that his redirected to backoffice
-        self.assertNotIn("oe_login_device_form", response.data.decode("utf8"))
+        self.assertNotIn("oe_login_device_form", response.text)
 
     def test_02_normal_login_fail(self):
         # Our user wants to go to backoffice part of Odoo
         response = self.get_request("/web/", data={"db": self.dbname})
 
         # He notices that he's redirected to login page as not authenticated
-        self.assertIn("oe_login_device_form", response.data.decode("utf8"))
+        self.assertIn("oe_login_device_form", response.text)
 
         # He needs to enter his credentials and submit the form
         data = {
@@ -101,14 +94,14 @@ def test_02_normal_login_fail(self):
         response = self.post_request("/auth_device/login", data=data)
 
         # He mistyped his password so he's redirected to login page again
-        self.assertIn("oe_login_device_form", response.data.decode("utf8"))
+        self.assertIn("oe_login_device_form", response.text)
 
     def test_03_no_login(self):
         # Our user wants to go to backoffice part of Odoo
         response = self.get_request("/web/", data={"db": self.dbname})
 
         # He notices that he's redirected to login page as not authenticated
-        self.assertIn("oe_login_device_form", response.data.decode("utf8"))
+        self.assertIn("oe_login_device_form", response.text)
 
         # He forgot to enter his credentials and submit the form
         data = {
@@ -118,4 +111,4 @@ def test_03_no_login(self):
         response = self.post_request("/auth_device/login", data=data)
 
         # He forgot to complete the form so he's redirected to login page again
-        self.assertIn("oe_login_device_form", response.data.decode("utf8"))
+        self.assertIn("oe_login_device_form", response.text)