[IMP] auth_totp: add trusted device method to validate user

Adds a variant `_check_credentials_for_uid()` for auth_totp.device's
`_check_credentials()`. The new method will directly verify the device
key matches the given uid.

This spares the redundant uid comparison on the caller side, and
allows extension modules to customise the user/device matching logic.

closes odoo/odoo#94365

X-original-commit: 0e266eb3c73409950d1eb160c41eb6668d439856
Signed-off-by: Olivier Dony <odo@odoo.com>

addons/auth_totp/controllers/home.py

@@ -30,8 +30,9 @@ class Home(web_home.Home):
             cookies = request.httprequest.cookies
             key = cookies.get(TRUSTED_DEVICE_COOKIE)
             if key:
-                checked_credentials = request.env['auth_totp.device']._check_credentials(scope="browser", key=key)
-                if checked_credentials == user.id:
+                user_match = request.env['auth_totp.device']._check_credentials_for_uid(
+                    scope="browser", key=key, uid=user.id)
+                if user_match:
                     request.session.finalize(request.env)
                     return request.redirect(self._login_redirect(request.session.uid, redirect=redirect))
 

addons/auth_totp/models/auth_totp.py

@@ -12,3 +12,8 @@ class AuthTotpDevice(models.Model):
     _inherit = "res.users.apikeys"
     _description = "Authentication Device"
     _auto = False
+
+    def _check_credentials_for_uid(self, *, scope, key, uid):
+        """Return True if device key matches given `scope` for user ID `uid`"""
+        assert uid, "uid is required"
+        return self._check_credentials(scope=scope, key=key) == uid