[20.0][MIG] oauth_provider: Migration to 20.0

oauth_provider/README.rst

@@ -0,0 +1,211 @@
+.. image:: https://odoo-community.org/readme-banner-image
+   :target: https://odoo-community.org/get-involved?utm_source=readme
+   :alt: Odoo Community Association
+
+==============
+OAuth Provider
+==============
+
+.. 
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! This file is generated by oca-gen-addon-readme !!
+   !! changes will be overwritten.                   !!
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! source digest: sha256:aa4309bd3541d2e392e872caef424619e80e84eaeefc61d1d631850118d6483a
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png
+    :target: https://odoo-community.org/page/development-status
+    :alt: Beta
+.. |badge2| image:: https://img.shields.io/badge/license-AGPL--3-blue.png
+    :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html
+    :alt: License: AGPL-3
+.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--auth-lightgray.png?logo=github
+    :target: https://github.com/OCA/server-auth/tree/20.0/oauth_provider
+    :alt: OCA/server-auth
+.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
+    :target: https://translation.odoo-community.org/projects/server-auth-20-0/server-auth-20-0-oauth_provider
+    :alt: Translate me on Weblate
+.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
+    :target: https://runboat.odoo-community.org/builds?repo=OCA/server-auth&target_branch=20.0
+    :alt: Try me on Runboat
+
+|badge1| |badge2| |badge3| |badge4| |badge5|
+
+This module allows you to turn Odoo into an OAuth 2 provider.
+
+It's meant to provide the basic authentication feature, and some data
+access routes. But you are encouraged to create custom routes, in other
+modules, to give structured data for any specific need.
+
+**Table of contents**
+
+.. contents::
+   :local:
+
+Installation
+============
+
+To install this module, you need to:
+
+1. Install the oauthlib python module
+2. Install the module like any other in Odoo
+3. For the token retrieval to work on a multi-database instance, you
+   should add this module in the server_wide_modules list
+
+Configuration
+=============
+
+This module requires you to configure two things:
+
+1. The scopes are used to define restricted data access
+2. The clients are used to declare applications that will be allowed to
+   request tokens and data
+
+To configure scopes, you need to:
+
+1. Go to Settings > Users > OAuth Provider Scopes
+2. Create some scopes:
+
+   - The scope name and description will be displayed to the user on the
+     authorization page.
+   - The code is the value provided by the OAuth clients to request
+     access to the scope.
+   - The model defines which model the scope is linked to (access to
+     user data, partners, sales orders, etc.).
+   - The filter allows you to determine which records will be accessible
+     through this scope. No filter means all records of the model are
+     accessible.
+   - The field names allows you to define which fields will be provided
+     to the clients. An empty list only returns the id of accessible
+     records.
+
+To configure clients, you need to:
+
+1. Go to Settings > Users > OAuth Provider Clients
+2. Create at least one client:
+
+   - The name will be displayed to the user on the authorization page.
+   - The client identifier is the value provided by the OAuth clients to
+     request authorizations/tokens.
+   - The application type adapts the process to four pre-defined
+     profiles:
+
+     - Web Application: Authorization Code Grant
+     - Mobile Application: Implicit Grant
+     - Legacy Application: Resource Owner Password Credentials Grant
+     - Backend Application: User Credentials Grant (not implemented yet)
+
+   - The skip authorization checkbox allows the client to skip the
+     authorization page, and directly deliver a token without prompting
+     the user (useful when the application is trusted).
+   - The allowed scopes list defines which data will be accessible by
+     this client application.
+   - The allowed redirect URIs must match the URI sent by the client, to
+     avoid redirecting users to an unauthorized service. The first value
+     in the list is the default redirect URI.
+
+For example, to configure an Odoo's *auth_oauth* module compatible
+client, you will enter these values:
+
+- Name: Anything you want
+- Client identifier: The identifier you want to give to this client
+- Application Type: Mobile Application (Odoo uses the implicit grant
+  mode, which corresponds to the mobile application profile)
+- Allowed Scopes: Nothing required, but allowing access to current
+  user's email and name is used by Odoo to fill user's information on
+  signup
+- Allowed Redirect URIs: http://odoo.example.com/auth_oauth/signin
+
+Usage
+=====
+
+This module will allow OAuth clients to use your Odoo instance as an
+OAuth provider.
+
+Once configured, you must give these information to your client
+application:
+
+1. Client identifier: Identifies the application (to be able to check
+   allowed scopes and redirect URIs)
+2. Allowed scopes: The codes of scopes allowed for this client
+3. URLs for the requests:
+
+   - Authorization request: http://odoo.example.com/oauth2/authorize
+   - Token request: http://odoo.example.com/oauth2/token
+   - Token information request: http://odoo.example.com/oauth2/tokeninfo
+     (parameter: access_token)
+   - User information request: http://odoo.example.com/oauth2/userinfo
+     (parameter: access_token)
+   - Any other model information request (depending on the scopes):
+     ``http://odoo.example.com/oauth2/resources/<model>``, with the
+     ``Authorization: Bearer <access_token>`` header (optional
+     parameter: resource_id)
+   - Token revocation request:
+     http://odoo.example.com/oauth2/revoke_token (parameter: token)
+
+The ``/oauth2/otherinfo`` endpoint (parameters: access_token and model)
+is deprecated and only kept for backward compatibility: use
+``/oauth2/resources/<model>`` instead.
+
+For example, to configure the *auth_oauth* Odoo module as a client, you
+will enter these values:
+
+- Provider name: Anything you want
+- Client ID: The identifier of the client configured in your Odoo
+  Provider instance
+- Body: Text displayed on Odoo's login page link
+- Authentication URL: http://odoo.example.com/oauth2/authorize
+- Scope: A space separated list of scope codes allowed to the client in
+  your Odoo Provider instance
+- Validation URL: http://odoo.example.com/oauth2/tokeninfo
+- Data URL: http://odoo.example.com/oauth2/userinfo
+
+Known issues / Roadmap
+======================
+
+- Implement the backend application profile (client credentials grant
+  type)
+- Add checkboxes on the authorization page to allow the user to disable
+  some scopes for a token? (I don't know if this is allowed in the OAuth
+  protocol)
+
+Bug Tracker
+===========
+
+Bugs are tracked on `GitHub Issues <https://github.com/OCA/server-auth/issues>`_.
+In case of trouble, please check there if your issue has already been reported.
+If you spotted it first, help us to smash it by providing a detailed and welcomed
+`feedback <https://github.com/OCA/server-auth/issues/new?body=module:%20oauth_provider%0Aversion:%2020.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
+
+Do not contact contributors directly about support or help with technical issues.
+
+Credits
+=======
+
+Authors
+-------
+
+* SYLEAM
+
+Contributors
+------------
+
+- Sylvain Garancher <sylvain.garancher@syleam.fr>
+
+Maintainers
+-----------
+
+This module is maintained by the OCA.
+
+.. image:: https://odoo-community.org/logo.png
+   :alt: Odoo Community Association
+   :target: https://odoo-community.org
+
+OCA, or the Odoo Community Association, is a nonprofit organization whose
+mission is to support the collaborative development of Odoo features and
+promote its widespread use.
+
+This module is part of the `OCA/server-auth <https://github.com/OCA/server-auth/tree/20.0/oauth_provider>`_ project on GitHub.
+
+You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

oauth_provider/__init__.py

@@ -0,0 +1,24 @@
+# Copyright 2016 SYLEAM
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
+
+from . import controllers
+from . import models
+
+import uuid
+
+
+def pre_init_hook(env):
+    """Initialize oauth_identifier on res.users
+
+    The standard initialization puts the same value for every existing record,
+    which is invalid for this field.
+    This is done in the pre_init_hook to be able to add the unique constrait
+    on the first run, when installing the module.
+    """
+    env.cr.execute("ALTER TABLE res_users ADD COLUMN oauth_identifier varchar")
+    env.cr.execute("SELECT id FROM res_users")
+    for user_id in env.cr.fetchall():
+        env.cr.execute(
+            "UPDATE res_users SET oauth_identifier = %s WHERE id = %s",
+            (str(uuid.uuid4()), user_id),
+        )

oauth_provider/__manifest__.py

@@ -0,0 +1,28 @@
+# Copyright 2016 SYLEAM
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
+
+{
+    "name": "OAuth Provider",
+    "summary": "Allows to use Odoo as an OAuth2 provider",
+    "version": "20.0.1.0.0",
+    "category": "Authentication",
+    "website": "https://github.com/OCA/server-auth",
+    "author": "SYLEAM, Odoo Community Association (OCA)",
+    "license": "AGPL-3",
+    "installable": True,
+    "external_dependencies": {
+        "python": ["oauthlib"],
+    },
+    "depends": [
+        "base",
+        "web",
+    ],
+    "data": [
+        "security/oauth_provider_security.xml",
+        "security/ir.access.csv",
+        "views/oauth_provider_client.xml",
+        "views/oauth_provider_scope.xml",
+        "templates/authorization.xml",
+    ],
+    "pre_init_hook": "pre_init_hook",
+}

oauth_provider/controllers/__init__.py

@@ -0,0 +1,4 @@
+# Copyright 2016 SYLEAM
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
+
+from . import main