[FIX] core: position of finalization when authenticating

Missed while merging the 2FA: in a mono-db scenario, the request is
bound to a database more or less immediately; however in a multi-db
scenario the current request *may* not be bound to a database by the
time we reach session authentication, this binding is performed *by*
the authentication step[0].

By trying to access an environment (requiring a db) before this
binding is performed, the authentication procedure broke.

We could create the environment by hand, but it seems completely
unnecessary: while there is a bundle of operations to perform in all
cases and a bundle to perform during finalization, they don't seem to
strictly depend on one another (and indeed this separation is already
a reordering of the operations from before), so the finalization can
be performed *after* having bound the current session to a database.

In fact that is closer to the older order: in the pre-totp iteration,
only the binding of the uid was performed before that of the login,
and even it was done after binding the database.

[0] this really is mostly a concern when using this step
    programmatically, as interactively the database selector should
    require selecting (and binding) a database before it's possible
    to log-in

closes odoo/odoo#56093

Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>

0 files changed, 0 insertions, 0 deletions