[FIX] website: avoid to instanciate `env` in request

  - The module `website` instanciate the environment bound to
    request before `_dispatch` is called.
    This causes issues with with routes that create their own
    psycopg2 cursor.

    To be more precise, the issue that allowed us to discover this
    instanciation is linked to the module `auth_oauth`.

    The route `/auth_oauth/signin` is a `none` route that receives
    a database name. It uses the db name to create a cursor and
    an environment manually to process the OAuth signin, log-in the user
    then assume it is safe to now use `request.env` to process the rest
    of the code.

    But here, since a cursor has already been created in `request` before the
    route had the chance to commit its changes to `res.users`, the
    changes made in the route `/auth_oauth/signin` are not available.

    And this causes issues with the computation of the session token
    done in the method `_compute_session_token` in the model `res.users`.

    It uses the field `oauth_access_token` to compute the session token.
    But since, the cursor in `request` is in a transaction that is not
    yet aware of the changes made on this field, it will compute a
    session token using the old `oauth_access_token` and store this
    outdated token in the client's session.

    Then here depending if you are using a multi-worker or a multi-thread
    Odoo, you either are never signed in or your session is expired
    after a cache cleaning (the method `_compute_session_token` is cached).

closes odoo/odoo#42808

X-original-commit: ceec103826ae2a18c63b48c17850d035e352fa3b
Signed-off-by: Toufik Benjaa (tbe) <tbe@odoo.com>

0 files changed, 0 insertions, 0 deletions