From 72ec839b677364411ed4a1095d2ded1abfec14e9 Mon Sep 17 00:00:00 2001
From: Julien Castiaux <juc@odoo.com>
Date: Thu, 14 Dec 2023 10:34:20 +0100
Subject: [PATCH] [FIX] auth_totp: unbound request with xmlrpc

Enable TOTP on your account and create yourself an API key. Connect in
xmlrpc using that API key. Traceback `request` is not bound.

Fixes: odoo/documentation#6919
See also: #147475

closes odoo/odoo#146270

Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
---
 addons/auth_totp/tests/test_totp.py              | 14 +++++++++-----
 odoo/addons/test_apikeys/__manifest__.py         |  2 +-
 .../test_apikeys/static/tests/apikey_flow.js     |  2 +-
 odoo/addons/test_apikeys/tests/test_flow.py      | 16 +++++++++++++++-
 4 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/addons/auth_totp/tests/test_totp.py b/addons/auth_totp/tests/test_totp.py
index 9a209fa350f..ef25f3c0d21 100644
--- a/addons/auth_totp/tests/test_totp.py
+++ b/addons/auth_totp/tests/test_totp.py
@@ -16,11 +16,8 @@ from ..controllers.home import Home
 
 _logger = logging.getLogger(__name__)
 
-
-@tagged('post_install', '-at_install')
-class TestTOTP(HttpCaseWithUserDemo):
-    def setUp(self):
-        super().setUp()
+class TestTOTPMixin:
+    def install_totphook(self):
         totp = None
         # might be possible to do client-side using `crypto.subtle` instead of
         # this horror show, but requires working on 64b integers, & BigInt is
@@ -47,6 +44,13 @@ class TestTOTP(HttpCaseWithUserDemo):
             del Home.totp_hook
             self.env.registry.clear_cache('routing')
 
+
+@tagged('post_install', '-at_install')
+class TestTOTP(HttpCaseWithUserDemo, TestTOTPMixin):
+    def setUp(self):
+        super().setUp()
+        self.install_totphook()
+
     def test_totp(self):
         # TODO: Make this work if no demo data + hr installed
         if not loaded_demo_data(self.env):
diff --git a/odoo/addons/test_apikeys/__manifest__.py b/odoo/addons/test_apikeys/__manifest__.py
index 22c608fa227..797053c10d5 100644
--- a/odoo/addons/test_apikeys/__manifest__.py
+++ b/odoo/addons/test_apikeys/__manifest__.py
@@ -3,7 +3,7 @@
 {
     'name': 'Tests flow of API keys',
     'category': 'Tools',
-    'depends': ['web_tour'],
+    'depends': ['web_tour', 'auth_totp'],
     'assets': {
         'web.assets_tests': [
             # inside .
diff --git a/odoo/addons/test_apikeys/static/tests/apikey_flow.js b/odoo/addons/test_apikeys/static/tests/apikey_flow.js
index a14ec708e7e..dfdc660b7d3 100644
--- a/odoo/addons/test_apikeys/static/tests/apikey_flow.js
+++ b/odoo/addons/test_apikeys/static/tests/apikey_flow.js
@@ -56,7 +56,7 @@ registry.category("web_tour.tours").add('apikeys_tour_setup', {
         $('button:contains("Done")').click();
     }
 }, {
-    content: "check that our key is present",
+    content: "check that our key is present (FIXME: requires HR to be installed)",
     trigger: '[name=api_key_ids] td:contains("my key")',
     run() {},
 }]});
diff --git a/odoo/addons/test_apikeys/tests/test_flow.py b/odoo/addons/test_apikeys/tests/test_flow.py
index ccc3db58163..7a39fceb2a3 100644
--- a/odoo/addons/test_apikeys/tests/test_flow.py
+++ b/odoo/addons/test_apikeys/tests/test_flow.py
@@ -4,12 +4,13 @@ import json
 from odoo import api
 from odoo.tests import tagged, get_db_name, loaded_demo_data
 from odoo.addons.base.tests.common import HttpCaseWithUserDemo
+from odoo.addons.auth_totp.tests.test_totp import TestTOTPMixin
 
 _logger = logging.getLogger(__name__)
 
 
 @tagged('post_install', '-at_install')
-class TestAPIKeys(HttpCaseWithUserDemo):
+class TestAPIKeys(HttpCaseWithUserDemo, TestTOTPMixin):
     def setUp(self):
         super().setUp()
 
@@ -44,3 +45,16 @@ class TestAPIKeys(HttpCaseWithUserDemo):
             "the key should be usable as a way to perform RPC calls"
         )
         self.start_tour('/web', 'apikeys_tour_teardown', login='demo')
+
+    def test_apikeys_totp(self):
+        # TODO: Make this work if no demo data + hr installed
+        if not loaded_demo_data(self.env):
+            _logger.warning("This test relies on demo data. To be rewritten independently of demo data for accurate and reliable results.")
+            return
+        db = get_db_name()
+        self.install_totphook()
+        self.start_tour('/web', 'apikeys_tour_setup', login='demo')
+        self.start_tour('/web', 'totp_tour_setup', login='demo')
+        [(_, [key], [])] = self.messages  # pylint: disable=unbalanced-tuple-unpacking
+        uid = self.xmlrpc_common.authenticate(db, 'demo', key, {})
+        self.assertEqual(uid, self.env.ref('base.user_demo').id)