Merge pull request #831 from OpenSPP/oauth-update

emjay0921 · web-flow · commit 164b332d83d4 · 2025-09-12T16:06:04.000+08:00
Oauth update
diff --git a/spp_api/controllers/pinguin.py b/spp_api/controllers/pinguin.py
@@ -233,7 +233,7 @@ def get_data_from_bearer_auth_header(header):
     normalized_token = header.replace("Bearer ", "").replace("\\n", "").encode("utf-8")
 
     try:
-        res = verify_and_decode_signature(normalized_token)
+        res = verify_and_decode_signature(request.env, normalized_token)
     except OpenSPPOAuthJWTException as e:
         raise werkzeug.exceptions.HTTPException(response=error_response(*CODE__no_user_auth)) from e
 
diff --git a/spp_api/wizards/res_users_bearer_token.py b/spp_api/wizards/res_users_bearer_token.py
@@ -32,6 +32,7 @@ class SppUsersBearerToken(models.TransientModel):
     def _compute_bearer_token(self):
         for rec in self:
             rec.calculated_token = calculate_signature(
+                env=rec.env,
                 header=None,
                 payload={
                     "database": rec.db_name,
diff --git a/spp_api/wizards/res_users_bearer_token_views.xml b/spp_api/wizards/res_users_bearer_token_views.xml
@@ -7,9 +7,10 @@
         <field name="arch" type="xml">
             <form string="Users Bearer Token">
                 <sheet>
-                    <group>
-                        <field name="calculated_token" widget="CopyClipboardText" nolabel="1" />
-                    </group>
+                    <div>
+
+                    <field name="calculated_token" widget="CopyClipboardText" nolabel="1" />
+                    </div>
                 </sheet>
                     <button string="Cancel" class="btn-secondary" special="cancel" data-hotkey="z" />
             </form>
diff --git a/spp_attendance/controllers/controllers.py b/spp_attendance/controllers/controllers.py
@@ -40,7 +40,7 @@ def verify_auth_header(self):
 
         access_token = auth_header.replace("Bearer ", "").replace("\\n", "").encode("utf-8")
         try:
-            verify_and_decode_signature(access_token)
+            verify_and_decode_signature(request.env, access_token)
         except OpenSPPOAuthJWTException:
             return False
 
diff --git a/spp_attendance/models/attendance_api_client_credentials.py b/spp_attendance/models/attendance_api_client_credentials.py
@@ -63,7 +63,7 @@ def generate_access_token(self):
             "iss": "openspp:auth-service",
         }
 
-        return calculate_signature(header, payload)
+        return calculate_signature(self.env, header, payload)
 
     def show_credentials(self):
         self.ensure_one()
diff --git a/spp_base_gis_rest/controllers/controllers.py b/spp_base_gis_rest/controllers/controllers.py
@@ -108,7 +108,7 @@ def verify_auth_header():
     if auth_header.startswith("Bearer "):
         access_token = auth_header.replace("Bearer ", "").replace("\\n", "").encode("utf-8")
         try:
-            verify_and_decode_signature(access_token)
+            verify_and_decode_signature(request.env, access_token)
             verified = True
         except OpenSPPOAuthJWTException:
             verified = False
diff --git a/spp_base_gis_rest/models/api_client_credentials.py b/spp_base_gis_rest/models/api_client_credentials.py
@@ -82,7 +82,7 @@ def generate_access_token(self):
             "iss": "openspp:auth-service",
         }
 
-        return calculate_signature(header, payload)
+        return calculate_signature(self.env, header, payload)
 
     def show_credentials(self):
         self.ensure_one()
diff --git a/spp_dci_api_server/controllers/controllers.py b/spp_dci_api_server/controllers/controllers.py
@@ -140,7 +140,7 @@ def retrieve_registry(self, page=1, limit=30, **kw):
         access_token = auth_header.replace("Bearer ", "").replace("\\n", "").encode("utf-8")
 
         try:
-            payload = verify_and_decode_signature(access_token)
+            payload = verify_and_decode_signature(request.env, access_token)
         except OpenSPPOAuthJWTException:
             return error_wrapper(401, "Invalid Access Token.")
 
diff --git a/spp_dci_api_server/models/client_credentials.py b/spp_dci_api_server/models/client_credentials.py
@@ -61,7 +61,7 @@ def generate_access_token(self, db_name):
             "db_name": db_name,
         }
 
-        return calculate_signature(header, payload)
+        return calculate_signature(self.env, header, payload)
 
     def show_credentials(self):
         self.ensure_one()
diff --git a/spp_oauth/__init__.py b/spp_oauth/__init__.py
@@ -0,0 +1 @@
+from . import models
diff --git a/spp_oauth/__manifest__.py b/spp_oauth/__manifest__.py
@@ -12,7 +12,10 @@
     "depends": [
         "base",
     ],
-    "data": [],
+    "data": [
+        "data/ir_config_parameter_data.xml",
+        "views/res_config_view.xml",
+    ],
     "application": True,
     "auto_install": False,
     "installable": True,
diff --git a/spp_oauth/data/ir_config_parameter_data.xml b/spp_oauth/data/ir_config_parameter_data.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<odoo noupdate="1">
+    <record id="oauth_priv_key" model="ir.config_parameter">
+        <field name="key">spp_oauth.oauth_priv_key</field>
+        <field name="value">YourPrivateKeyHere</field>
+    </record>
+    <record id="oauth_pub_key" model="ir.config_parameter">
+        <field name="key">spp_oauth.oauth_pub_key</field>
+        <field name="value">YourPublicKeyHere</field>
+    </record>
+</odoo>
diff --git a/spp_oauth/models/__init__.py b/spp_oauth/models/__init__.py
@@ -0,0 +1 @@
+from . import res_config_settings
diff --git a/spp_oauth/models/res_config_settings.py b/spp_oauth/models/res_config_settings.py
@@ -0,0 +1,14 @@
+from odoo import fields, models
+
+
+class RegistryConfig(models.TransientModel):
+    _inherit = "res.config.settings"
+
+    oauth_priv_key = fields.Char(
+        string="OAuth Private Key",
+        config_parameter="spp_oauth.oauth_priv_key",
+    )
+    oauth_pub_key = fields.Char(
+        string="OAuth Public Key",
+        config_parameter="spp_oauth.oauth_pub_key",
+    )
diff --git a/spp_oauth/static/description/icon.png b/spp_oauth/static/description/icon.png
diff --git a/spp_oauth/tests/common.py b/spp_oauth/tests/common.py
@@ -0,0 +1,37 @@
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+
+from odoo.tests import TransactionCase
+
+MOCK_PRIVATE_KEY = "any_private_key"
+
+
+class Common(TransactionCase):
+    @classmethod
+    def setUpClass(cls):
+        super().setUpClass()
+        cls.env["ir.config_parameter"].sudo().set_param("spp_oauth.oauth_priv_key", None)
+        cls.env["ir.config_parameter"].sudo().set_param("spp_oauth.oauth_pub_key", None)
+
+    def set_parameters(self):
+        # Generate test RSA keys
+        private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048, backend=default_backend())
+        public_key = private_key.public_key()
+
+        self.env["ir.config_parameter"].sudo().set_param(
+            "spp_oauth.oauth_priv_key",
+            private_key.private_bytes(
+                encoding=serialization.Encoding.PEM,
+                format=serialization.PrivateFormat.TraditionalOpenSSL,
+                encryption_algorithm=serialization.NoEncryption(),
+            ).decode("utf-8"),
+        )
+
+        self.env["ir.config_parameter"].sudo().set_param(
+            "spp_oauth.oauth_pub_key",
+            public_key.public_bytes(
+                encoding=serialization.Encoding.PEM,
+                format=serialization.PublicFormat.SubjectPublicKeyInfo,
+            ).decode("utf-8"),
+        )
diff --git a/spp_oauth/tests/test_rsa_encode_decode.py b/spp_oauth/tests/test_rsa_encode_decode.py
@@ -1,35 +1,64 @@
-from unittest.mock import patch
+import uuid
 
-from odoo.tests.common import TransactionCase
+from ..tools.rsa_encode_decode import calculate_signature
+from .common import Common
 
-from ..tools.rsa_encode_decode import calculate_signature, verify_and_decode_signature
 
-MOCK_PRIVATE_KEY = "any_private_key"
+class TestRSA(Common):
+    def test_01_get_private_key(self):
+        self.set_parameters()
 
-MOCK_PUBLIC_KEY = "any_public_key"
+        from ..tools.rsa_encode_decode import get_private_key
 
+        private_key = get_private_key(self.env)
+        self.assertTrue(private_key is not None)
 
-class TestRSA(TransactionCase):
-    @patch("odoo.addons.spp_oauth.tools.rsa_encode_decode.jwt.encode")
-    @patch("odoo.addons.spp_oauth.tools.rsa_encode_decode.get_private_key")
-    def test_calculate_signature(self, mock_get_private_key, mock_encode):
-        mock_encode.return_value = "mocked_signature"
-        mock_get_private_key.return_value = MOCK_PRIVATE_KEY
+    def test_02_get_public_key(self):
+        self.set_parameters()
 
-        header = {"typ": "JWT"}
-        payload = {"data": "test"}
-        signature = calculate_signature(header, payload)
+        from ..tools.rsa_encode_decode import get_public_key
 
-        self.assertEqual(signature, "mocked_signature")
+        public_key = get_public_key(self.env)
+        self.assertTrue(public_key is not None)
 
-    @patch("odoo.addons.spp_oauth.tools.rsa_encode_decode.jwt.decode")
-    @patch("odoo.addons.spp_oauth.tools.rsa_encode_decode.get_public_key")
-    def test_verify_and_decode_signature(self, mock_get_public_key, mock_decode):
-        mock_decode.return_value = {"data": "test"}
-        mock_get_public_key.return_value = MOCK_PUBLIC_KEY
+    def test_03_calculate_signature(self):
+        self.set_parameters()
 
-        access_token = "mocked_access_token"
+        from ..tools.rsa_encode_decode import calculate_signature
 
-        decoded = verify_and_decode_signature(access_token)
+        openapi_token = str(uuid.uuid4())
 
-        self.assertEqual(decoded, {"data": "test"})
+        token = calculate_signature(
+            env=self.env,
+            header=None,
+            payload={
+                "database": self.env.cr.dbname,
+                "token": openapi_token,
+            },
+        )
+        self.assertTrue(token is not None)
+
+    def test_04_verify_and_decode_signature(self):
+        self.set_parameters()
+
+        from ..tools.rsa_encode_decode import verify_and_decode_signature
+
+        openapi_token = str(uuid.uuid4())
+
+        token = calculate_signature(
+            env=self.env,
+            header=None,
+            payload={
+                "database": self.env.cr.dbname,
+                "token": openapi_token,
+            },
+        )
+        self.assertTrue(token is not None)
+
+        decoded = verify_and_decode_signature(
+            env=self.env,
+            access_token=token,
+        )
+        self.assertTrue(decoded is not None)
+        self.assertEqual(decoded.get("database"), self.env.cr.dbname)
+        self.assertEqual(decoded.get("token"), openapi_token)
diff --git a/spp_oauth/tools/rsa_encode_decode.py b/spp_oauth/tools/rsa_encode_decode.py
@@ -1,41 +1,62 @@
-import os
-
 import jwt  # pylint: disable=missing-manifest-dependency
 
 from .oauth_exception import OpenSPPOAuthJWTException
 
 JWT_ALGORITHM = "RS256"
 
-# Initialize cache variables to None
-_privkey = None
-_pubkey = None
+
+def get_private_key(env):
+    """
+    Retrieves the OAuth private key from Odoo's system parameters.
+
+    :param env: The Odoo environment.
+    :return: The private key as a string.
+    :raises OpenSPPOAuthJWTException: If the private key is not configured.
+    """
+    priv_key = env["ir.config_parameter"].sudo().get_param("spp_oauth.oauth_priv_key")
+    if not priv_key:
+        raise OpenSPPOAuthJWTException("OAuth private key not configured in settings.")
+    return priv_key
 
 
-def get_private_key():
-    global _privkey
-    if _privkey is None:
-        private_key_path = os.environ.get("SPP_OAUTH_RSA_PRIV_KEY_PATH", "/etc/secrets/private_key.pem")
-        with open(private_key_path) as privatefile:
-            _privkey = privatefile.read()
-    return _privkey
+def get_public_key(env):
+    """
+    Retrieves the OAuth public key from Odoo's system parameters.
 
+    :param env: The Odoo environment.
+    :return: The public key as a string.
+    :raises OpenSPPOAuthJWTException: If the public key is not configured.
+    """
+    pub_key = env["ir.config_parameter"].sudo().get_param("spp_oauth.oauth_pub_key")
+    if not pub_key:
+        raise OpenSPPOAuthJWTException("OAuth public key not configured in settings.")
+    return pub_key
 
-def get_public_key():
-    global _pubkey
-    if _pubkey is None:
-        public_key_path = os.environ.get("SPP_OAUTH_RSA_PUB_KEY_PATH", "/etc/secrets/public_key.pub")
-        with open(public_key_path) as publicfile:
-            _pubkey = publicfile.read()
-    return _pubkey
 
+def calculate_signature(env, header, payload):
+    """
+    Calculates a JWT signature.
 
-def calculate_signature(header, payload):
-    privkey = get_private_key()
+    :param env: The Odoo environment.
+    :param header: The JWT header.
+    :param payload: The JWT payload.
+    :return: The encoded JWT.
+    """
+
+    privkey = get_private_key(env)
     return jwt.encode(headers=header, payload=payload, key=privkey, algorithm=JWT_ALGORITHM)
 
 
-def verify_and_decode_signature(access_token):
-    pubkey = get_public_key()
+def verify_and_decode_signature(env, access_token):
+    """
+    Verifies and decodes a JWT access token.
+
+    :param env: The Odoo environment.
+    :param access_token: The JWT to verify and decode.
+    :return: The decoded payload.
+    :raises OpenSPPOAuthJWTException: If verification fails or for any other JWT error.
+    """
+    pubkey = get_public_key(env)
     try:
         return jwt.decode(access_token, key=pubkey, algorithms=[JWT_ALGORITHM])
     except Exception as e:
diff --git a/spp_oauth/views/res_config_view.xml b/spp_oauth/views/res_config_view.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<odoo>
+    <record id="spp_oauth_config_view" model="ir.ui.view">
+        <field name="name">spp_oauth_config_view</field>
+        <field name="model">res.config.settings</field>
+        <field name="priority" eval="999" />
+        <field name="inherit_id" ref="base.res_config_settings_view_form" />
+        <field name="arch" type="xml">
+            <xpath expr="//form" position="inside">
+                <app
+                    string="SPP OAuth Settings"
+                    name="spp_oauth_config_settings"
+                    logo="/spp_attendance/static/description/icon.png"
+                >
+                    <block title="OAuth Settings (4096 bits RSA keys)">
+                        <setting string="Private Key">
+                            <field name="oauth_priv_key" password="true" />
+                        </setting>
+                        <setting string="Public Key">
+                            <field name="oauth_pub_key" password="true" />
+                        </setting>
+                    </block>
+                </app>
+            </xpath>
+        </field>
+    </record>
+</odoo>

Original file line number	Diff line number	Diff line change
`@@ -63,7 +63,7 @@ def generate_access_token(self):`
`63`	`63`	`"iss": "openspp:auth-service",`
`64`	`64`	`}`
`65`	`65`
`66`		`- return calculate_signature(header, payload)`
	`66`	`+ return calculate_signature(self.env, header, payload)`
`67`	`67`
`68`	`68`	`def show_credentials(self):`
`69`	`69`	`self.ensure_one()`
Original file line number	Diff line number	Diff line change
`@@ -82,7 +82,7 @@ def generate_access_token(self):`
`82`	`82`	`"iss": "openspp:auth-service",`
`83`	`83`	`}`
`84`	`84`
`85`		`- return calculate_signature(header, payload)`
	`85`	`+ return calculate_signature(self.env, header, payload)`
`86`	`86`
`87`	`87`	`def show_credentials(self):`
`88`	`88`	`self.ensure_one()`
Original file line number	Diff line number	Diff line change
`@@ -61,7 +61,7 @@ def generate_access_token(self, db_name):`
`61`	`61`	`"db_name": db_name,`
`62`	`62`	`}`
`63`	`63`
`64`		`- return calculate_signature(header, payload)`
	`64`	`+ return calculate_signature(self.env, header, payload)`
`65`	`65`
`66`	`66`	`def show_credentials(self):`
`67`	`67`	`self.ensure_one()`