[ADD] core, web: support for partial sessions & MFA

1 files changed, 15 insertions, 5 deletions

diff --git a/odoo/http.py b/odoo/http.py
index 40da5a5b131..d025e7fac31 100644
--- a/odoo/http.py
+++ b/odoo/http.py
@@ -48,7 +48,6 @@ except ImportError:
     psutil = None
 
 import odoo
-from odoo import fields
 from .service.server import memory_info
 from .service import security, model as service_model
 from .sql_db import flush_env
@@ -992,18 +991,29 @@ class OpenERPSession(sessions.Session):
             REMOTE_ADDR=wsgienv['REMOTE_ADDR'],
         )
         uid = odoo.registry(db)['res.users'].authenticate(db, login, password, env)
+        self.pre_uid = uid
+
+        user = request.env(user=uid)['res.users'].browse(uid)
+        if not user._mfa_url():
+            self.finalize()
 
         self.rotate = True
         self.db = db
-        self.uid = uid
         self.login = login
-        self.session_token = security.compute_session_token(self, request.env)
-        request.uid = uid
         request.disable_db = False
 
-        self.get_context()
         return uid
 
+    def finalize(self):
+        """ Finalizes a partial session, should be called on MFA validation to
+        convert a partial / pre-session into a full-fledged "logged-in" one
+        """
+        self.rotate = True
+        request.uid = self.uid = self.pop('pre_uid')
+        user = request.env(user=self.uid)['res.users'].browse(self.uid)
+        self.session_token = user._compute_session_token(self.sid)
+        self.get_context()
+
     def check_security(self):
         """
         Check the current authentication parameters to know if those are still