[ADD] core, web: support for partial sessions & MFA

2 files changed, 18 insertions, 5 deletions

diff --git a/odoo/addons/base/models/res_users.py b/odoo/addons/base/models/res_users.py
index 336be363e36..11d0f0980ae 100644
--- a/odoo/addons/base/models/res_users.py
+++ b/odoo/addons/base/models/res_users.py
@@ -998,6 +998,9 @@ class Users(models.Model):
             return 'base/static/img/user-slash.png'
         return super()._get_placeholder_filename(field=field)
 
+    def _mfa_url(self):
+        """ If an MFA method is enabled, returns the URL for its second step. """
+        return
 #
 # Implied groups
 #
diff --git a/odoo/http.py b/odoo/http.py
index 40da5a5b131..d025e7fac31 100644
--- a/odoo/http.py
+++ b/odoo/http.py
@@ -48,7 +48,6 @@ except ImportError:
     psutil = None
 
 import odoo
-from odoo import fields
 from .service.server import memory_info
 from .service import security, model as service_model
 from .sql_db import flush_env
@@ -992,18 +991,29 @@ class OpenERPSession(sessions.Session):
             REMOTE_ADDR=wsgienv['REMOTE_ADDR'],
         )
         uid = odoo.registry(db)['res.users'].authenticate(db, login, password, env)
+        self.pre_uid = uid
+
+        user = request.env(user=uid)['res.users'].browse(uid)
+        if not user._mfa_url():
+            self.finalize()
 
         self.rotate = True
         self.db = db
-        self.uid = uid
         self.login = login
-        self.session_token = security.compute_session_token(self, request.env)
-        request.uid = uid
         request.disable_db = False
 
-        self.get_context()
         return uid
 
+    def finalize(self):
+        """ Finalizes a partial session, should be called on MFA validation to
+        convert a partial / pre-session into a full-fledged "logged-in" one
+        """
+        self.rotate = True
+        request.uid = self.uid = self.pop('pre_uid')
+        user = request.env(user=self.uid)['res.users'].browse(self.uid)
+        self.session_token = user._compute_session_token(self.sid)
+        self.get_context()
+
     def check_security(self):
         """
         Check the current authentication parameters to know if those are still