Odoo/addons/auth_totp/models, branch 14.0 The current checkout of upstream Odoo [IMP] auth_totp: notify user on activation and deactivation of OTP 2020-09-10T12:50:20+00:00 Xavier Morel xmo@odoo.com 2020-08-21T10:39:55+00:00 b992619840a70c600c50fac0383ad9396351af75 Was not super visible, especially without HR as the dialog immediately closes (limitation of the web client), or when an administrator user massively disables totp. Show a toast notification indicating the success of the action. Also fix the logging of `totp_disable` so it correctly handles being called on more than one record, and change the logging data to <browse_record> (<logins>) across the board. Also add a way to provide an action to execute after a notification: by default nothing happens, which leads to dialogs not closing and forms not reloading, and there is no good way to show a notification and/then do some other thing, which is inconvenient. 
Was not super visible, especially without HR as the dialog immediately
closes (limitation of the web client), or when an administrator user
massively disables totp.

Show a toast notification indicating the success of the action.

Also fix the logging of `totp_disable` so it correctly handles being
called on more than one record, and change the logging data to
<browse_record> (<logins>) across the board.

Also add a way to provide an action to execute after a notification:
by default nothing happens, which leads to dialogs not closing and
forms not reloading, and there is no good way to show a notification
and/then do some other thing, which is inconvenient.
 [IMP] auth_totp: label of totp_enabled field & show status in form 2020-09-10T12:50:20+00:00 Xavier Morel xmo@odoo.com 2020-08-20T09:25:32+00:00 f91970f4d9288e97cc9b3f3846472515078fc29a Use same look in form as in preferences dialog, just without the buttons to enable / disable it (technically could have the button to disable with the correct group I guess?) 
Use same look in form as in preferences dialog, just without the
buttons to enable / disable it (technically could have the button to
disable with the correct group I guess?)
 [IMP] auth_totp: better issuer label 2020-09-10T12:50:19+00:00 Xavier Morel xmo@odoo.com 2020-08-20T08:09:01+00:00 01725a210ebab3790d254ebca4a81d35db9e0e90 The "issuer" being the user's company is not necessarily helpful as e.g. the company might have multiple services which all use 2FA. Use the domain name instead (fallback on the company if for some reason we're in a situation where this is computed without a request). 
The "issuer" being the user's company is not necessarily helpful as
e.g. the company might have multiple services which all use 2FA.

Use the domain name instead (fallback on the company if for some
reason we're in a situation where this is computed without a request).
 [IMP] auth_totp: allow spaces in totp code input 2020-09-10T12:50:19+00:00 Xavier Morel xmo@odoo.com 2020-08-19T14:24:47+00:00 6d3f4acdda85bf5a6c4bd1c56066c5f8ea73dd1e TOTP programs generally group the code into two groups of 3 digits, but we'd only allow a single group of 6 digits. Allow spaces in the value for a bit of flexibility, and fix placeholders to look like codes (also turns out @placeholder on a field doesn't do anything, not sure where I got this idea). Also improve the label slightly in the login flow: * add information to the label itself * properly link the label & input via an `id` 
TOTP programs generally group the code into two groups of 3 digits,
but we'd only allow a single group of 6 digits.

Allow spaces in the value for a bit of flexibility, and fix
placeholders to look like codes (also turns out @placeholder on a
field doesn't do anything, not sure where I got this idea).

Also improve the label slightly in the login flow:

* add information to the label itself
* properly link the label & input via an `id`
 [FIX] auth_totp: session update after enabling or disabling totp 2020-09-10T12:50:19+00:00 Xavier Morel xmo@odoo.com 2020-08-19T13:19:57+00:00 3fc9b40561af001fac6914ec56f12d433e012b2a bfcc7dee8f40afb5f7dec4e2cf5a669c0682e2ed tried to fix the session disconnection issue, but the fix only worked in single-process (either threaded or workers=1): because the cache was cleared but the update not flushed, since `_compute_session_token` uses SQL directly it would recompute the old session_token which it would cache, and thus the process would carry-on with the old token just re-set in the session and cache. Meanwhile in multi-process, odds are good that the next request will be on a different worker which *will* see the change, and will immediately complain & destroy the session. Add the missing flush calls right before recomputing the session token so the SQL "sees" the correct state. 
bfcc7dee8f40afb5f7dec4e2cf5a669c0682e2ed tried to fix the session
disconnection issue, but the fix only worked in single-process (either
threaded or workers=1): because the cache was cleared but the update
not flushed, since `_compute_session_token` uses SQL directly it would
recompute the old session_token which it would cache, and thus the
process would carry-on with the old token just re-set in the session
and cache.

Meanwhile in multi-process, odds are good that the next request will
be on a different worker which *will* see the change, and will
immediately complain & destroy the session.

Add the missing flush calls right before recomputing the session token
so the SQL "sees" the correct state.
 [IMP] auth_totp: import qrcode lazily 2020-09-09T13:47:11+00:00 Xavier Morel xmo@odoo.com 2020-09-09T13:47:11+00:00 e10cbc792f8f6432f8ee5d8065cd4a123f2a4754 fp request closes odoo/odoo#57363 Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com> 
fp request

closes odoo/odoo#57363

Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
[IMP] core: clarify making fields inaccessible 2020-08-17T09:30:53+00:00 Xavier Morel xmo@odoo.com 2020-08-17T07:39:25+00:00 bfa00919cd893694c55d5fa9680c3dbbd1f66d3e * add a constant to `fields` for that purpose * add a test to ensure that it works as expected * fix the formatter so it handles the pattern correctly 
* add a constant to `fields` for that purpose
* add a test to ensure that it works as expected
* fix the formatter so it handles the pattern correctly
 [FIX] auth_totp: add totp secret to session-relevant fields 2020-08-17T09:30:41+00:00 Olivier Dony odo@odoo.com 2020-08-17T07:02:13+00:00 bfcc7dee8f40afb5f7dec4e2cf5a669c0682e2ed Setting the totp secret is a significant change to the user's auth-ability, and as such should be taken in account for the session's validity. For convenience, update the user's session in-place to avoid logging them out. 
Setting the totp secret is a significant change to the user's
auth-ability, and as such should be taken in account for the session's
validity.

For convenience, update the user's session in-place to avoid logging
them out.
 [ADD] auth_totp 2020-08-14T23:06:24+00:00 Xavier Morel xmo@odoo.com 2019-06-05T12:45:16+00:00 a9a65097132b53813991c9ce61c878ab3f302f53 New module for supporting two-factor authentication via time-base one-time-password (TOTP). Users (including portal users) can choose to enable two-factor auth in their user account settings, by scanning a QR code and adding it to an authenticator app, such as Google Auth, 1Password, etc. When two-factor is enabled, password-based non-interactive RPC is only possible by using API keys. Co-authored-by: Olivier Dony <odo@odoo.com> 
New module for supporting two-factor authentication via time-base
one-time-password (TOTP).

Users (including portal users) can choose to enable two-factor auth in
their user account settings, by scanning a QR code and adding it to an
authenticator app, such as Google Auth, 1Password, etc.

When two-factor is enabled, password-based non-interactive RPC is only
possible by using API keys.

Co-authored-by: Olivier Dony <odo@odoo.com>