From 76e04a8ea07b02902cab784d2d4ee39106772a5d Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Tue, 11 Jun 2013 18:38:51 +0200
Subject: [PATCH 01/54] added noauth and nodb

bzr revid: nicolas.vanhoren@openerp.com-20130611163851-okd35aitcj4jnh5i
---
 addons/web/http.py    | 62 ++++++++++++++++++++++++++++++++++---------
 addons/web/session.py | 27 ++++++++++++++-----
 2 files changed, 70 insertions(+), 19 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 2dc41c8cad9..20431eb4233 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -83,10 +83,13 @@ class WebRequest(object):
 
         ``bool``, indicates whether the debug mode is active on the client
     """
-    def __init__(self, request):
-        self.httprequest = request
+    def __init__(self, httprequest, method):
+        self.httprequest = httprequest
         self.httpresponse = None
-        self.httpsession = request.session
+        self.httpsession = httprequest.session
+        self.db = None
+        self.uid = None
+        self.method = method
 
     def init(self, params):
         self.params = dict(params)
@@ -97,6 +100,9 @@ class WebRequest(object):
             self.session = session.OpenERPSession()
             self.httpsession[self.session_id] = self.session
 
+        self.authenticate()
+
+        # TODO: remove this shit
         # set db/uid trackers - they're cleaned up at the WSGI
         # dispatching phase in openerp.service.wsgi_server.application
         if self.session._db:
@@ -121,12 +127,38 @@ class WebRequest(object):
         # we use _ as seprator where RFC2616 uses '-'
         self.lang = lang.replace('-', '_')
 
+    def authenticate(self):
+        if self.method.auth == "nodb":
+            self.db = None
+            self.uid = None
+        elif self.method.auth == "noauth":
+            self.db = (self.session._db or openerp.addons.web.controllers.main.db_monodb(self)).lower()
+            self.uid = None
+        else:
+            self.session.check_security()
+            self.db = self.session._db
+            self.uid = self.session_uid
+
+    def registry(self):
+        return openerp.modules.registry.RegistryManager.get(self.db)
+
+    @contextlib.contextmanager
+    def cr(self):
+        with registry.cursor() as cr:
+            yield cr
+
     @contextlib.contextmanager
     def registry_cr(self):
-        dbname = self.session._db or openerp.addons.web.controllers.main.db_monodb(self)
-        registry = openerp.modules.registry.RegistryManager.get(dbname.lower())
-        with registry.cursor() as cr:
-            yield (registry, cr)
+        with self.cr() as cr:
+            yield (self.registry(), cr)
+
+def noauth(f):
+    f.auth = "noauth"
+    return f
+
+def nodb(f):
+    f.auth = "nodb"
+    return f
 
 def reject_nonliteral(dct):
     if '__ref' in dct:
@@ -167,13 +199,14 @@ class JsonRequest(WebRequest):
            "id": null}
 
     """
-    def dispatch(self, method):
+    def dispatch(self):
         """ Calls the method asked for by the JSON-RPC2 or JSONP request
 
         :param method: the method which received the request
 
         :returns: an utf8 encoded JSON-RPC2 or JSONP reply
         """
+        method = self.method
         args = self.httprequest.args
         jsonp = args.get('jsonp')
         requestf = None
@@ -291,7 +324,8 @@ def jsonrequest(f):
 class HttpRequest(WebRequest):
     """ Regular GET/POST request
     """
-    def dispatch(self, method):
+    def dispatch(self):
+        method = self.method
         params = dict(self.httprequest.args)
         params.update(self.httprequest.form)
         params.update(self.httprequest.files)
@@ -658,20 +692,22 @@ class Root(object):
                     method = getattr(c, method_name, None)
                     if method:
                         exposed = getattr(method, 'exposed', False)
+                        auth = getattr(method, 'auth', None)
                         method = c.get_wrapped_method(method_name)
+                        method.auth = auth
                         if exposed == 'json':
                             _logger.debug("Dispatch json to %s %s %s", ps, c, method_name)
                             def fct(_request):
-                                _req = JsonRequest(_request)
+                                _req = JsonRequest(_request, method)
                                 with set_request(_req):
-                                    return request.dispatch(method)
+                                    return request.dispatch()
                             return fct
                         elif exposed == 'http':
                             _logger.debug("Dispatch http to %s %s %s", ps, c, method_name)
                             def fct(_request):
-                                _req = HttpRequest(_request)
+                                _req = HttpRequest(_request, method)
                                 with set_request(_req):
-                                    return request.dispatch(method)
+                                    return request.dispatch()
                             return fct
                     if method_name != "index":
                         method_name = "index"
diff --git a/addons/web/session.py b/addons/web/session.py
index 13c3bc7cb94..9568da261f0 100644
--- a/addons/web/session.py
+++ b/addons/web/session.py
@@ -20,6 +20,7 @@ class AuthenticationError(Exception):
 class SessionExpiredException(Exception):
     pass
 
+# deprecated
 class Service(object):
     def __init__(self, session, service_name):
         self.session = session
@@ -31,6 +32,7 @@ class Service(object):
             return result
         return proxy_method
 
+# deprecated
 class Model(object):
     def __init__(self, session, model):
         self.session = session
@@ -84,12 +86,6 @@ class OpenERPSession(object):
         self.context = {}
         self.jsonp_requests = {}     # FIXME use a LRU
 
-    def send(self, service_name, method, *args):
-        return openerp.netsvc.dispatch_rpc(service_name, method, args)
-
-    def proxy(self, service):
-        return Service(self, service)
-
     def bind(self, db, uid, login, password):
         self._db = db
         self._uid = uid
@@ -103,6 +99,21 @@ class OpenERPSession(object):
         if uid: self.get_context()
         return uid
 
+    def check_security(self):
+        import openerp.service.security as security
+        if not self._db or not self._uid:
+            raise SessionExpiredException("Session expired")
+        security.check(self._db, self._uid, self._password)
+
+    #deprecated
+    def send(self, service_name, method, *args):
+        return openerp.netsvc.dispatch_rpc(service_name, method, args)
+
+    #deprecated
+    def proxy(self, service):
+        return Service(self, service)
+
+    #deprecated
     def assert_valid(self, force=False):
         """
         Ensures this session is valid (logged into the openerp server)
@@ -114,6 +125,7 @@ class OpenERPSession(object):
         if not self._uid:
             raise AuthenticationError("Authentication failure")
 
+    #deprecated
     def ensure_valid(self):
         if self._uid:
             try:
@@ -121,16 +133,19 @@ class OpenERPSession(object):
             except Exception:
                 self._uid = None
 
+    #deprecated
     def execute(self, model, func, *l, **d):
         model = self.model(model)
         r = getattr(model, func)(*l, **d)
         return r
 
+    #deprecated
     def exec_workflow(self, model, id, signal):
         self.assert_valid()
         r = self.proxy('object').exec_workflow(self._db, self._uid, self._password, model, signal, id)
         return r
 
+    #deprecated
     def model(self, model):
         """ Get an RPC proxy for the object ``model``, bound to this session.
 

From c6b4e77df4bb29e4057df48f9fed2536f3b4344d Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Tue, 11 Jun 2013 18:59:01 +0200
Subject: [PATCH 02/54] Put @nodb on all methods where it is required in
 main.py

bzr revid: nicolas.vanhoren@openerp.com-20130611165901-l1pyzpvpniq41a29
---
 addons/web/controllers/main.py | 25 ++++++++++++++++++++++++-
 addons/web/http.py             | 19 +++++++++++--------
 2 files changed, 35 insertions(+), 9 deletions(-)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 8683ef177bc..db0a124f2f4 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -36,7 +36,7 @@ from openerp.tools.translate import _
 from .. import http
 openerpweb = http
 
-from openerp.addons.web.http import request as req
+from openerp.addons.web.http import request as req, noauth, nodb
 
 #----------------------------------------------------------
 # OpenERP Web helpers
@@ -574,6 +574,7 @@ class Home(openerpweb.Controller):
     _cp_path = '/'
 
     @openerpweb.httprequest
+    @nodb
     def index(self, s_action=None, db=None, **kw):
         db, redir = db_monodb_redirect()
         if redir:
@@ -603,18 +604,22 @@ class WebClient(openerpweb.Controller):
     _cp_path = "/web/webclient"
 
     @openerpweb.jsonrequest
+    @nodb
     def csslist(self, mods=None):
         return manifest_list('css', mods=mods)
 
     @openerpweb.jsonrequest
+    @nodb
     def jslist(self, mods=None):
         return manifest_list('js', mods=mods)
 
     @openerpweb.jsonrequest
+    @nodb
     def qweblist(self, mods=None):
         return manifest_list('qweb', mods=mods)
 
     @openerpweb.httprequest
+    @nodb
     def css(self, mods=None, db=None):
         files = list(manifest_glob('css', addons=mods, db=db))
         last_modified = get_last_modified(f[0] for f in files)
@@ -666,6 +671,7 @@ class WebClient(openerpweb.Controller):
             last_modified, checksum)
 
     @openerpweb.httprequest
+    @nodb
     def js(self, mods=None, db=None):
         files = [f[0] for f in manifest_glob('js', addons=mods, db=db)]
         last_modified = get_last_modified(files)
@@ -679,6 +685,7 @@ class WebClient(openerpweb.Controller):
             last_modified, checksum)
 
     @openerpweb.httprequest
+    @nodb
     def qweb(self, mods=None, db=None):
         files = [f[0] for f in manifest_glob('qweb', addons=mods, db=db)]
         last_modified = get_last_modified(files)
@@ -692,6 +699,7 @@ class WebClient(openerpweb.Controller):
             last_modified, checksum)
 
     @openerpweb.jsonrequest
+    @nodb
     def bootstrap_translations(self, mods):
         """ Load local translations from *.po files, as a temporary solution
             until we have established a valid session. This is meant only
@@ -715,6 +723,7 @@ class WebClient(openerpweb.Controller):
                 "lang_parameters": None}
 
     @openerpweb.jsonrequest
+    @nodb
     def translations(self, mods, lang):
         res_lang = req.session.model('res.lang')
         ids = res_lang.search([("code", "=", lang)])
@@ -740,6 +749,7 @@ class WebClient(openerpweb.Controller):
                 "lang_parameters": lang_params}
 
     @openerpweb.jsonrequest
+    @nodb
     def version_info(self):
         return openerp.service.common.exp_version()
 
@@ -747,6 +757,7 @@ class Proxy(openerpweb.Controller):
     _cp_path = '/web/proxy'
 
     @openerpweb.jsonrequest
+    @nodb
     def load(self, path):
         """ Proxies an HTTP request through a JSON request.
 
@@ -765,10 +776,12 @@ class Database(openerpweb.Controller):
     _cp_path = "/web/database"
 
     @openerpweb.jsonrequest
+    @nodb
     def get_list(self):
         return db_list()
 
     @openerpweb.jsonrequest
+    @nodb
     def create(self, fields):
         params = dict(map(operator.itemgetter('name', 'value'), fields))
         return req.session.proxy("db").create_database(
@@ -779,6 +792,7 @@ class Database(openerpweb.Controller):
             params['create_admin_pwd'])
 
     @openerpweb.jsonrequest
+    @nodb
     def duplicate(self, fields):
         params = dict(map(operator.itemgetter('name', 'value'), fields))
         return req.session.proxy("db").duplicate_database(
@@ -787,6 +801,7 @@ class Database(openerpweb.Controller):
             params['db_name'])
 
     @openerpweb.jsonrequest
+    @nodb
     def duplicate(self, fields):
         params = dict(map(operator.itemgetter('name', 'value'), fields))
         duplicate_attrs = (
@@ -798,6 +813,7 @@ class Database(openerpweb.Controller):
         return req.session.proxy("db").duplicate_database(*duplicate_attrs)
 
     @openerpweb.jsonrequest
+    @nodb
     def drop(self, fields):
         password, db = operator.itemgetter(
             'drop_pwd', 'drop_db')(
@@ -811,6 +827,7 @@ class Database(openerpweb.Controller):
             return {'error': _('Could not drop database !'), 'title': _('Drop Database')}
 
     @openerpweb.httprequest
+    @nodb
     def backup(self, backup_db, backup_pwd, token):
         try:
             db_dump = base64.b64decode(
@@ -829,6 +846,7 @@ class Database(openerpweb.Controller):
             return simplejson.dumps([[],[{'error': openerp.tools.ustr(e), 'title': _('Backup Database')}]])
 
     @openerpweb.httprequest
+    @nodb
     def restore(self, db_file, restore_pwd, new_db):
         try:
             data = base64.b64encode(db_file.read())
@@ -838,6 +856,7 @@ class Database(openerpweb.Controller):
             raise Exception("AccessDenied")
 
     @openerpweb.jsonrequest
+    @nodb
     def change_password(self, fields):
         old_password, new_password = operator.itemgetter(
             'old_pwd', 'new_pwd')(
@@ -863,10 +882,12 @@ class Session(openerpweb.Controller):
         }
 
     @openerpweb.jsonrequest
+    @nodb
     def get_session_info(self):
         return self.session_info()
 
     @openerpweb.jsonrequest
+    @nodb
     def authenticate(self, db, login, password, base_location=None):
         wsgienv = req.httprequest.environ
         env = dict(
@@ -907,6 +928,7 @@ class Session(openerpweb.Controller):
             return {"error": e, "title": _("Languages")}
 
     @openerpweb.jsonrequest
+    @nodb
     def modules(self):
         # return all installed modules. Web client is smart enough to not load a module twice
         return module_installed()
@@ -986,6 +1008,7 @@ class Menu(openerpweb.Controller):
         return Menus.search(menu_domain, 0, False, False, req.context)
 
     @openerpweb.jsonrequest
+    @nodb
     def load(self):
         """ Loads all menu items (all applications and their sub-menus).
 
diff --git a/addons/web/http.py b/addons/web/http.py
index 20431eb4233..0d55a12311b 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -83,13 +83,14 @@ class WebRequest(object):
 
         ``bool``, indicates whether the debug mode is active on the client
     """
-    def __init__(self, httprequest, method):
+    def __init__(self, httprequest, method, auth_method=None):
         self.httprequest = httprequest
         self.httpresponse = None
         self.httpsession = httprequest.session
         self.db = None
         self.uid = None
         self.method = method
+        self.auth_method = auth_method
 
     def init(self, params):
         self.params = dict(params)
@@ -128,16 +129,19 @@ class WebRequest(object):
         self.lang = lang.replace('-', '_')
 
     def authenticate(self):
-        if self.method.auth == "nodb":
+        if self.auth_method == "nodb":
             self.db = None
             self.uid = None
-        elif self.method.auth == "noauth":
+        elif self.auth_method == "noauth":
             self.db = (self.session._db or openerp.addons.web.controllers.main.db_monodb(self)).lower()
             self.uid = None
         else:
-            self.session.check_security()
+            try:
+                self.session.check_security()
+            except session.SessionExpiredException, e:
+                raise session.SessionExpiredException("Session expired for request %s" % self.httprequest)
             self.db = self.session._db
-            self.uid = self.session_uid
+            self.uid = self.session._uid
 
     def registry(self):
         return openerp.modules.registry.RegistryManager.get(self.db)
@@ -694,18 +698,17 @@ class Root(object):
                         exposed = getattr(method, 'exposed', False)
                         auth = getattr(method, 'auth', None)
                         method = c.get_wrapped_method(method_name)
-                        method.auth = auth
                         if exposed == 'json':
                             _logger.debug("Dispatch json to %s %s %s", ps, c, method_name)
                             def fct(_request):
-                                _req = JsonRequest(_request, method)
+                                _req = JsonRequest(_request, method, auth)
                                 with set_request(_req):
                                     return request.dispatch()
                             return fct
                         elif exposed == 'http':
                             _logger.debug("Dispatch http to %s %s %s", ps, c, method_name)
                             def fct(_request):
-                                _req = HttpRequest(_request, method)
+                                _req = HttpRequest(_request, method, auth)
                                 with set_request(_req):
                                     return request.dispatch()
                             return fct

From f58374357e4ffff72a59cdbb655c9d65f752e7af Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Wed, 12 Jun 2013 16:56:47 +0200
Subject: [PATCH 03/54] minor cosmetic improvements

bzr revid: nicolas.vanhoren@openerp.com-20130612145647-5wwy71u6lrm7g744
---
 addons/web/http.py | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 0d55a12311b..101229d0024 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -83,13 +83,13 @@ class WebRequest(object):
 
         ``bool``, indicates whether the debug mode is active on the client
     """
-    def __init__(self, httprequest, method, auth_method=None):
+    def __init__(self, httprequest, func, auth_method="auth"):
         self.httprequest = httprequest
         self.httpresponse = None
         self.httpsession = httprequest.session
         self.db = None
         self.uid = None
-        self.method = method
+        self.func = func
         self.auth_method = auth_method
 
     def init(self, params):
@@ -135,7 +135,7 @@ class WebRequest(object):
         elif self.auth_method == "noauth":
             self.db = (self.session._db or openerp.addons.web.controllers.main.db_monodb(self)).lower()
             self.uid = None
-        else:
+        else: # auth
             try:
                 self.session.check_security()
             except session.SessionExpiredException, e:
@@ -146,6 +146,7 @@ class WebRequest(object):
     def registry(self):
         return openerp.modules.registry.RegistryManager.get(self.db)
 
+    @property
     @contextlib.contextmanager
     def cr(self):
         with registry.cursor() as cr:
@@ -206,11 +207,11 @@ class JsonRequest(WebRequest):
     def dispatch(self):
         """ Calls the method asked for by the JSON-RPC2 or JSONP request
 
-        :param method: the method which received the request
+        :param func: the func which received the request
 
         :returns: an utf8 encoded JSON-RPC2 or JSONP reply
         """
-        method = self.method
+        func = self.func
         args = self.httprequest.args
         jsonp = args.get('jsonp')
         requestf = None
@@ -245,9 +246,9 @@ class JsonRequest(WebRequest):
                 self.jsonrequest = simplejson.loads(request, object_hook=reject_nonliteral)
             self.init(self.jsonrequest.get("params", {}))
             #if _logger.isEnabledFor(logging.DEBUG):
-            #    _logger.debug("--> %s.%s\n%s", method.im_class.__name__, method.__name__, pprint.pformat(self.jsonrequest))
+            #    _logger.debug("--> %s.%s\n%s", func.im_class.__name__, func.__name__, pprint.pformat(self.jsonrequest))
             response['id'] = self.jsonrequest.get('id')
-            response["result"] = method(**self.params)
+            response["result"] = func(**self.params)
         except session.AuthenticationError, e:
             se = serialize_exception(e)
             error = {
@@ -329,7 +330,7 @@ class HttpRequest(WebRequest):
     """ Regular GET/POST request
     """
     def dispatch(self):
-        method = self.method
+        func = self.func
         params = dict(self.httprequest.args)
         params.update(self.httprequest.form)
         params.update(self.httprequest.files)
@@ -340,9 +341,9 @@ class HttpRequest(WebRequest):
                 akw[key] = value
             else:
                 akw[key] = type(value)
-        #_logger.debug("%s --> %s.%s %r", self.httprequest.method, method.im_class.__name__, method.__name__, akw)
+        #_logger.debug("%s --> %s.%s %r", self.httprequest.func, func.im_class.__name__, func.__name__, akw)
         try:
-            r = method(**self.params)
+            r = func(**self.params)
         except werkzeug.exceptions.HTTPException, e:
             r = e
         except Exception, e:

From 9ee7c3f41a9941a81249c8ed5835883406dc8356 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 11:58:42 +0200
Subject: [PATCH 04/54] added cr property

bzr revid: nicolas.vanhoren@openerp.com-20130613095842-29da30ppr6c06xac
---
 addons/web/http.py | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 101229d0024..c92e2f2244b 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -91,6 +91,7 @@ class WebRequest(object):
         self.uid = None
         self.func = func
         self.auth_method = auth_method
+        self._cr = None
 
     def init(self, params):
         self.params = dict(params)
@@ -101,8 +102,6 @@ class WebRequest(object):
             self.session = session.OpenERPSession()
             self.httpsession[self.session_id] = self.session
 
-        self.authenticate()
-
         # TODO: remove this shit
         # set db/uid trackers - they're cleaned up at the WSGI
         # dispatching phase in openerp.service.wsgi_server.application
@@ -143,19 +142,30 @@ class WebRequest(object):
             self.db = self.session._db
             self.uid = self.session._uid
 
+    @property
     def registry(self):
-        return openerp.modules.registry.RegistryManager.get(self.db)
+        return openerp.modules.registry.RegistryManager.get(self.db) if self.db else None
 
     @property
-    @contextlib.contextmanager
     def cr(self):
-        with registry.cursor() as cr:
-            yield cr
+        return self._cr
 
     @contextlib.contextmanager
     def registry_cr(self):
-        with self.cr() as cr:
-            yield (self.registry(), cr)
+        return (self.registry, cr)
+
+    def call_function(self, *args, **kwargs):
+        self.authenticate()
+        if self.registry:
+            with self.registry.cursor() as cr:
+                self._cr = cr
+                try:
+                    return self.func(*args, **kwargs)
+                finally:
+                    self._cr = None
+        else:
+            return self.func(*args, **kwargs)
+
 
 def noauth(f):
     f.auth = "noauth"
@@ -207,11 +217,8 @@ class JsonRequest(WebRequest):
     def dispatch(self):
         """ Calls the method asked for by the JSON-RPC2 or JSONP request
 
-        :param func: the func which received the request
-
         :returns: an utf8 encoded JSON-RPC2 or JSONP reply
         """
-        func = self.func
         args = self.httprequest.args
         jsonp = args.get('jsonp')
         requestf = None
@@ -248,7 +255,7 @@ class JsonRequest(WebRequest):
             #if _logger.isEnabledFor(logging.DEBUG):
             #    _logger.debug("--> %s.%s\n%s", func.im_class.__name__, func.__name__, pprint.pformat(self.jsonrequest))
             response['id'] = self.jsonrequest.get('id')
-            response["result"] = func(**self.params)
+            response["result"] = self.call_function(**self.params)
         except session.AuthenticationError, e:
             se = serialize_exception(e)
             error = {
@@ -330,7 +337,6 @@ class HttpRequest(WebRequest):
     """ Regular GET/POST request
     """
     def dispatch(self):
-        func = self.func
         params = dict(self.httprequest.args)
         params.update(self.httprequest.form)
         params.update(self.httprequest.files)
@@ -343,7 +349,7 @@ class HttpRequest(WebRequest):
                 akw[key] = type(value)
         #_logger.debug("%s --> %s.%s %r", self.httprequest.func, func.im_class.__name__, func.__name__, akw)
         try:
-            r = func(**self.params)
+            r = self.call_function(**self.params)
         except werkzeug.exceptions.HTTPException, e:
             r = e
         except Exception, e:

From 4cc12c7f44325b4d1f271b82d033cf8d7cb45248 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 12:07:43 +0200
Subject: [PATCH 05/54] Made cr lazy

bzr revid: nicolas.vanhoren@openerp.com-20130613100743-m5tcv0anibiw820f
---
 addons/web/http.py | 40 ++++++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index c92e2f2244b..f54488c13e7 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -148,23 +148,39 @@ class WebRequest(object):
 
     @property
     def cr(self):
+        # some magic to lazy create the cr
+        if not self._cr:
+            self._cr = self.registry.cursor()
+            self._cr.__enter__()
         return self._cr
 
+    #TODO: remove
     @contextlib.contextmanager
     def registry_cr(self):
         return (self.registry, cr)
 
-    def call_function(self, *args, **kwargs):
+    def _call_function(self, *args, **kwargs):
         self.authenticate()
-        if self.registry:
-            with self.registry.cursor() as cr:
-                self._cr = cr
-                try:
+        try:
+            if self.registry:
+                # ugly syntax only to get the __exit__ arguments to pass to self._cr
+                request = self
+                class with_obj(object):
+                    def __enter__(self):
+                        pass
+                    def __exit__(self, *args):
+                        if request._cr:
+                            request._cr.__exit__(*args)
+                            request._cr = None
+
+                with with_obj():
                     return self.func(*args, **kwargs)
-                finally:
-                    self._cr = None
-        else:
-            return self.func(*args, **kwargs)
+            else:
+                return self.func(*args, **kwargs)
+        finally:
+            # just to be sure no one tries to re-use the request
+            self.db = None
+            self.uid = None
 
 
 def noauth(f):
@@ -255,7 +271,7 @@ class JsonRequest(WebRequest):
             #if _logger.isEnabledFor(logging.DEBUG):
             #    _logger.debug("--> %s.%s\n%s", func.im_class.__name__, func.__name__, pprint.pformat(self.jsonrequest))
             response['id'] = self.jsonrequest.get('id')
-            response["result"] = self.call_function(**self.params)
+            response["result"] = self._call_function(**self.params)
         except session.AuthenticationError, e:
             se = serialize_exception(e)
             error = {
@@ -349,7 +365,7 @@ class HttpRequest(WebRequest):
                 akw[key] = type(value)
         #_logger.debug("%s --> %s.%s %r", self.httprequest.func, func.im_class.__name__, func.__name__, akw)
         try:
-            r = self.call_function(**self.params)
+            r = self._call_function(**self.params)
         except werkzeug.exceptions.HTTPException, e:
             r = e
         except Exception, e:
@@ -703,7 +719,7 @@ class Root(object):
                     method = getattr(c, method_name, None)
                     if method:
                         exposed = getattr(method, 'exposed', False)
-                        auth = getattr(method, 'auth', None)
+                        auth = getattr(method, 'auth', "auth")
                         method = c.get_wrapped_method(method_name)
                         if exposed == 'json':
                             _logger.debug("Dispatch json to %s %s %s", ps, c, method_name)

From 50a5a612dae47a2075dbce11c9573ab82e28e830 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 13:00:05 +0200
Subject: [PATCH 06/54] Now uses request.cr for Model

bzr revid: nicolas.vanhoren@openerp.com-20130613110005-idverfbs9xe6l32w
---
 addons/web/controllers/main.py |  4 ----
 addons/web/http.py             | 14 +++++++++-----
 addons/web/session.py          | 11 ++++++++++-
 3 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index db0a124f2f4..2e470314ec3 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -723,7 +723,6 @@ class WebClient(openerpweb.Controller):
                 "lang_parameters": None}
 
     @openerpweb.jsonrequest
-    @nodb
     def translations(self, mods, lang):
         res_lang = req.session.model('res.lang')
         ids = res_lang.search([("code", "=", lang)])
@@ -882,7 +881,6 @@ class Session(openerpweb.Controller):
         }
 
     @openerpweb.jsonrequest
-    @nodb
     def get_session_info(self):
         return self.session_info()
 
@@ -928,7 +926,6 @@ class Session(openerpweb.Controller):
             return {"error": e, "title": _("Languages")}
 
     @openerpweb.jsonrequest
-    @nodb
     def modules(self):
         # return all installed modules. Web client is smart enough to not load a module twice
         return module_installed()
@@ -1008,7 +1005,6 @@ class Menu(openerpweb.Controller):
         return Menus.search(menu_domain, 0, False, False, req.context)
 
     @openerpweb.jsonrequest
-    @nodb
     def load(self):
         """ Loads all menu items (all applications and their sub-menus).
 
diff --git a/addons/web/http.py b/addons/web/http.py
index f54488c13e7..c09321693aa 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -91,6 +91,7 @@ class WebRequest(object):
         self.uid = None
         self.func = func
         self.auth_method = auth_method
+        self._cr_cm = None
         self._cr = None
 
     def init(self, params):
@@ -149,9 +150,9 @@ class WebRequest(object):
     @property
     def cr(self):
         # some magic to lazy create the cr
-        if not self._cr:
-            self._cr = self.registry.cursor()
-            self._cr.__enter__()
+        if not self._cr_cm:
+            self._cr_cm = self.registry.cursor()
+            self._cr = self._cr_cm.__enter__()
         return self._cr
 
     #TODO: remove
@@ -169,8 +170,9 @@ class WebRequest(object):
                     def __enter__(self):
                         pass
                     def __exit__(self, *args):
-                        if request._cr:
-                            request._cr.__exit__(*args)
+                        if request._cr_cm:
+                            request._cr_cm.__exit__(*args)
+                            request._cr_cm = None
                             request._cr = None
 
                 with with_obj():
@@ -273,6 +275,7 @@ class JsonRequest(WebRequest):
             response['id'] = self.jsonrequest.get('id')
             response["result"] = self._call_function(**self.params)
         except session.AuthenticationError, e:
+            _logger.exception("Exception during JSON request handling.")
             se = serialize_exception(e)
             error = {
                 'code': 100,
@@ -280,6 +283,7 @@ class JsonRequest(WebRequest):
                 'data': se
             }
         except Exception, e:
+            _logger.exception("Exception during JSON request handling.")
             se = serialize_exception(e)
             error = {
                 'code': 200,
diff --git a/addons/web/session.py b/addons/web/session.py
index 9568da261f0..05749d35ee3 100644
--- a/addons/web/session.py
+++ b/addons/web/session.py
@@ -8,6 +8,7 @@ import traceback
 import sys
 
 import openerp
+import http
 
 _logger = logging.getLogger(__name__)
 
@@ -42,7 +43,15 @@ class Model(object):
     def __getattr__(self, method):
         self.session.assert_valid()
         def proxy(*args, **kw):
-            result = self.proxy.execute_kw(self.session._db, self.session._uid, self.session._password, self.model, method, args, kw)
+            # Can't provide any retro-compatibility for this case, so we check it and raise an Exception
+            # to tell the programmer to adapt his code
+            if self.session._db != http.request.db or self.session._uid != http.request.uid:
+                raise Exception("Trying to use Model with badly configured database or user.")
+                
+            mod = http.request.registry.get(self.model)
+            meth = getattr(mod, method)
+            cr = http.request.cr
+            result = meth(cr, http.request.uid, *args, **kw)
             # reorder read
             if method == "read":
                 if isinstance(result, list) and len(result) > 0 and "id" in result[0]:

From 1c0282d09d4e5d192fe44fcacd846b31f1459306 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 13:20:27 +0200
Subject: [PATCH 07/54] fixed lot of problem with nodb

bzr revid: nicolas.vanhoren@openerp.com-20130613112027-1fps4v7h6zx5omo0
---
 addons/web/controllers/main.py |  4 ++++
 addons/web/http.py             | 27 ++++++++++++---------------
 addons/web/session.py          |  2 ++
 3 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 2e470314ec3..697db75797d 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -881,7 +881,10 @@ class Session(openerpweb.Controller):
         }
 
     @openerpweb.jsonrequest
+    @nodb
     def get_session_info(self):
+        req.uid = req.session._uid
+        req.db = req.session._db
         return self.session_info()
 
     @openerpweb.jsonrequest
@@ -1382,6 +1385,7 @@ class Binary(openerpweb.Controller):
         return out % (simplejson.dumps(callback), simplejson.dumps(args))
 
     @openerpweb.httprequest
+    @nodb
     def company_logo(self, dbname=None):
         # TODO add etag, refactor to use /image code for etag
         uid = None
diff --git a/addons/web/http.py b/addons/web/http.py
index c09321693aa..d9ee06a201e 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -158,26 +158,23 @@ class WebRequest(object):
     #TODO: remove
     @contextlib.contextmanager
     def registry_cr(self):
-        return (self.registry, cr)
+        return (self.registry, self.cr)
 
     def _call_function(self, *args, **kwargs):
         self.authenticate()
         try:
-            if self.registry:
-                # ugly syntax only to get the __exit__ arguments to pass to self._cr
-                request = self
-                class with_obj(object):
-                    def __enter__(self):
-                        pass
-                    def __exit__(self, *args):
-                        if request._cr_cm:
-                            request._cr_cm.__exit__(*args)
-                            request._cr_cm = None
-                            request._cr = None
+            # ugly syntax only to get the __exit__ arguments to pass to self._cr
+            request = self
+            class with_obj(object):
+                def __enter__(self):
+                    pass
+                def __exit__(self, *args):
+                    if request._cr_cm:
+                        request._cr_cm.__exit__(*args)
+                        request._cr_cm = None
+                        request._cr = None
 
-                with with_obj():
-                    return self.func(*args, **kwargs)
-            else:
+            with with_obj():
                 return self.func(*args, **kwargs)
         finally:
             # just to be sure no one tries to re-use the request
diff --git a/addons/web/session.py b/addons/web/session.py
index 05749d35ee3..fa5b83b6892 100644
--- a/addons/web/session.py
+++ b/addons/web/session.py
@@ -104,6 +104,8 @@ class OpenERPSession(object):
     def authenticate(self, db, login, password, env=None):
         uid = self.proxy('common').authenticate(db, login, password, env)
         self.bind(db, uid, login, password)
+        http.request.db = db
+        http.request.uid = uid
 
         if uid: self.get_context()
         return uid

From 8fe3da4d557252f77c65ca4a7340916f380f91d0 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 13:25:17 +0200
Subject: [PATCH 08/54] cosmetic

bzr revid: nicolas.vanhoren@openerp.com-20130613112517-90hwu5l6h3c2dvsd
---
 addons/web/session.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/web/session.py b/addons/web/session.py
index fa5b83b6892..56f2da9c582 100644
--- a/addons/web/session.py
+++ b/addons/web/session.py
@@ -111,9 +111,9 @@ class OpenERPSession(object):
         return uid
 
     def check_security(self):
-        import openerp.service.security as security
         if not self._db or not self._uid:
             raise SessionExpiredException("Session expired")
+        import openerp.service.security as security
         security.check(self._db, self._uid, self._password)
 
     #deprecated

From 085d34bec3e24c0479ed78548d5da17b6623d6b3 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 13:32:03 +0200
Subject: [PATCH 09/54] some polish in session.py

bzr revid: nicolas.vanhoren@openerp.com-20130613113203-w0vralvme3coz0sf
---
 addons/web/session.py | 73 +++++++++++++++++++++----------------------
 1 file changed, 35 insertions(+), 38 deletions(-)

diff --git a/addons/web/session.py b/addons/web/session.py
index 56f2da9c582..0dbda02352d 100644
--- a/addons/web/session.py
+++ b/addons/web/session.py
@@ -95,15 +95,12 @@ class OpenERPSession(object):
         self.context = {}
         self.jsonp_requests = {}     # FIXME use a LRU
 
-    def bind(self, db, uid, login, password):
+    def authenticate(self, db, login, password, env=None):
+        uid = openerp.netsvc.dispatch_rpc('common', 'authenticate', [db, login, password, env])
         self._db = db
         self._uid = uid
         self._login = login
         self._password = password
-
-    def authenticate(self, db, login, password, env=None):
-        uid = self.proxy('common').authenticate(db, login, password, env)
-        self.bind(db, uid, login, password)
         http.request.db = db
         http.request.uid = uid
 
@@ -116,6 +113,39 @@ class OpenERPSession(object):
         import openerp.service.security as security
         security.check(self._db, self._uid, self._password)
 
+    def get_context(self):
+        """ Re-initializes the current user's session context (based on
+        his preferences) by calling res.users.get_context() with the old
+        context
+
+        :returns: the new context
+        """
+        assert self._uid, "The user needs to be logged-in to initialize his context"
+        self.context = http.request.registry.get('res.users').context_get(http.request.cr, http.request.uid) or {}
+        self.context['uid'] = self._uid
+        self._fix_lang(self.context)
+        return self.context
+
+    def _fix_lang(self, context):
+        """ OpenERP provides languages which may not make sense and/or may not
+        be understood by the web client's libraries.
+
+        Fix those here.
+
+        :param dict context: context to fix
+        """
+        lang = context['lang']
+
+        # inane OpenERP locale
+        if lang == 'ar_AR':
+            lang = 'ar'
+
+        # lang to lang_REGION (datejs only handles lang_REGION, no bare langs)
+        if lang in babel.core.LOCALE_ALIASES:
+            lang = babel.core.LOCALE_ALIASES[lang]
+
+        context['lang'] = lang or 'en_US'
+
     #deprecated
     def send(self, service_name, method, *args):
         return openerp.netsvc.dispatch_rpc(service_name, method, args)
@@ -169,37 +199,4 @@ class OpenERPSession(object):
 
         return Model(self, model)
 
-    def get_context(self):
-        """ Re-initializes the current user's session context (based on
-        his preferences) by calling res.users.get_context() with the old
-        context
-
-        :returns: the new context
-        """
-        assert self._uid, "The user needs to be logged-in to initialize his context"
-        self.context = self.model('res.users').context_get() or {}
-        self.context['uid'] = self._uid
-        self._fix_lang(self.context)
-        return self.context
-
-    def _fix_lang(self, context):
-        """ OpenERP provides languages which may not make sense and/or may not
-        be understood by the web client's libraries.
-
-        Fix those here.
-
-        :param dict context: context to fix
-        """
-        lang = context['lang']
-
-        # inane OpenERP locale
-        if lang == 'ar_AR':
-            lang = 'ar'
-
-        # lang to lang_REGION (datejs only handles lang_REGION, no bare langs)
-        if lang in babel.core.LOCALE_ALIASES:
-            lang = babel.core.LOCALE_ALIASES[lang]
-
-        context['lang'] = lang or 'en_US'
-
 # vim:et:ts=4:sw=4:

From 2c959246b762ffe18cd1cfa028f1335fc9889f84 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 13:34:58 +0200
Subject: [PATCH 10/54] even more security

bzr revid: nicolas.vanhoren@openerp.com-20130613113458-2ww1cbb9q5nz6ayk
---
 addons/web/session.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/addons/web/session.py b/addons/web/session.py
index 0dbda02352d..a0c924975ca 100644
--- a/addons/web/session.py
+++ b/addons/web/session.py
@@ -45,7 +45,8 @@ class Model(object):
         def proxy(*args, **kw):
             # Can't provide any retro-compatibility for this case, so we check it and raise an Exception
             # to tell the programmer to adapt his code
-            if self.session._db != http.request.db or self.session._uid != http.request.uid:
+            if not http.request.db or not http.request.uid or self.session._db != http.request.db \
+                or self.session._uid != http.request.uid:
                 raise Exception("Trying to use Model with badly configured database or user.")
                 
             mod = http.request.registry.get(self.model)

From 787cb04b2dba0276e2bedcd239b9e62aa9fd08b1 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 13:40:30 +0200
Subject: [PATCH 11/54] wip

bzr revid: nicolas.vanhoren@openerp.com-20130613114030-hmrc7881jp8ctjic
---
 addons/web/session.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/web/session.py b/addons/web/session.py
index a0c924975ca..b51c540aec5 100644
--- a/addons/web/session.py
+++ b/addons/web/session.py
@@ -29,7 +29,7 @@ class Service(object):
 
     def __getattr__(self, method):
         def proxy_method(*args):
-            result = self.session.send(self.service_name, method, *args)
+            result = openerp.netsvc.dispatch_rpc(self.service_name, method, args)
             return result
         return proxy_method
 

From 20c0e6fbb7e6494bdaeb13d4b5b20a1d05e31a27 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 13:44:21 +0200
Subject: [PATCH 12/54] fixed get_lang_list

bzr revid: nicolas.vanhoren@openerp.com-20130613114421-hv3rgj0rxghpwlgp
---
 addons/web/controllers/main.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 697db75797d..361db5567e3 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -922,6 +922,7 @@ class Session(openerpweb.Controller):
             req.session._uid, "ir.ui.menu", req.context)
 
     @openerpweb.jsonrequest
+    @nodb
     def get_lang_list(self):
         try:
             return req.session.proxy("db").list_lang() or []

From ef6779f484a3b8251c88050c8cf0a008360a025a Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 16:03:43 +0200
Subject: [PATCH 13/54] Added some doc

bzr revid: nicolas.vanhoren@openerp.com-20130613140343-hjvlc697eimgcb55
---
 addons/web/doc/index.rst           | 37 +++++++++----
 addons/web/doc/web_controllers.rst | 85 ++++++++++++++++++++++++++++++
 2 files changed, 112 insertions(+), 10 deletions(-)
 create mode 100644 addons/web/doc/web_controllers.rst

diff --git a/addons/web/doc/index.rst b/addons/web/doc/index.rst
index 7127bb975ed..650c12f55ec 100644
--- a/addons/web/doc/index.rst
+++ b/addons/web/doc/index.rst
@@ -6,32 +6,49 @@
 Welcome to OpenERP Web's documentation!
 =======================================
 
-Contents:
+Basics
+------
 
 .. toctree::
     :maxdepth: 1
 
     module
-    widget
+    changelog-7.0
 
+Server-Side Web Framework
+-------------------------
 
-    async
-    rpc
-    qweb
-    client_action
+.. toctree::
+    :maxdepth: 1
+
+    web_controllers
+
+Javascript
+----------
+
+.. toctree::
+    :maxdepth: 1
 
     guidelines
-
+    widget
+    rpc
+    async
+    qweb
+    client_action
     testing
 
+Views
+-----
+
+.. toctree::
+    :maxdepth: 1
+
     search_view
     list_view
     form_view
 
-    changelog-7.0
-
 Indices and tables
-==================
+------------------
 
 * :ref:`genindex`
 * :ref:`modindex`
diff --git a/addons/web/doc/web_controllers.rst b/addons/web/doc/web_controllers.rst
new file mode 100644
index 00000000000..4694b72070f
--- /dev/null
+++ b/addons/web/doc/web_controllers.rst
@@ -0,0 +1,85 @@
+
+Web Controllers
+===============
+
+Web controllers are classes in OpenERP able to catch the http requests sent by any browser. They allow to generate
+html pages to be served like any web server, implement new methods to be used by the Javascript client, etc...
+
+Controllers File
+----------------
+
+By convention the controllers should be placed in the controllers directory of the module. Example:
+
+.. code-block:: text
+
+    web_example
+    ├── controllers
+    │   ├── __init__.py
+    │   └── my_controllers.py
+    ├── __init__.py
+    └── __openerp__.py
+
+In ``__init__.py`` you must add:
+
+::
+
+    import controllers
+
+And here is the content of ``controllers/__init__.py``:
+
+::
+    
+    import my_controllers
+
+Now you can put the following content in ``controllers/my_controllers.py``:
+
+::
+
+    import openerp.addons.web.http as http
+    from openerp.addons.web.http import request
+
+
+Controller Declaration
+----------------------
+
+In your controllers file, you can now declare a controller this way:
+
+::
+
+    class MyController(http.Controller):
+        _cp_path = '/my_url'
+
+        @http.httprequest
+        def some_html(self):
+            return "<h1>This is a test</h1>"
+
+        @http.jsonrequest
+        def some_json(self):
+            return {"sample_dictionary": "This is a sample JSON dictionary"}
+
+A controller must inherit from ``http.Controller``. When defining a controller, you must define the url it will match.
+This is the ``_cp_path`` class attribute.
+
+Each time you define a method with ``@http.httprequest`` or ``@http.jsonrequest`` it defines a new part of url to
+match. As example, the ``some_html()`` method will be called a client query the ``/my_url/some_html`` url.
+
+If you want to match precisely the ``/my_url`` url, you must a define a method called ``index``. This is an exception
+compared to other methods:
+
+::
+
+    @http.httprequest
+    def index(self):
+        return "<div>This is the /my_url</div>"
+
+Pure HTTP Requests
+------------------
+
+You can define methods to get any requests using the ``@http.httprequest`` decorator. When doing so, you get the
+HTTP parameters as named parameters of the method:
+
+::
+
+    @http.httprequest
+    def some_html(self, name):
+        return "<h1>You name is %s</h1>" % name

From d6c89cdb7c7f9770f2e0c92ffd0b9670e49cb588 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 16:04:18 +0200
Subject: [PATCH 14/54] Implemented jsonrpc method

bzr revid: nicolas.vanhoren@openerp.com-20130613140418-2i1qsb6jykhx5jaz
---
 addons/web/controllers/main.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 361db5567e3..d2f425e0c49 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -596,9 +596,10 @@ class Home(openerpweb.Controller):
         return login_and_redirect(db, login, key)
 
     @openerpweb.jsonrequest
+    @nodb
     def jsonrpc(self, service, method, args):
         """ Method used by client APIs to contact OpenERP. """
-        return getattr(req.session.proxy(service), method)(*args)
+        return openerp.netsvc.dispatch_rpc(service, method, args)
 
 class WebClient(openerpweb.Controller):
     _cp_path = "/web/webclient"

From 7c916c593653fae8f32203b17dc6efdd018c204e Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 16:27:17 +0200
Subject: [PATCH 15/54] added doc

bzr revid: nicolas.vanhoren@openerp.com-20130613142717-nj3ox24vip56buc0
---
 addons/web/doc/web_controllers.rst | 56 ++++++++++++++++++++++++++++--
 1 file changed, 54 insertions(+), 2 deletions(-)

diff --git a/addons/web/doc/web_controllers.rst b/addons/web/doc/web_controllers.rst
index 4694b72070f..32b49f768ee 100644
--- a/addons/web/doc/web_controllers.rst
+++ b/addons/web/doc/web_controllers.rst
@@ -81,5 +81,57 @@ HTTP parameters as named parameters of the method:
 ::
 
     @http.httprequest
-    def some_html(self, name):
-        return "<h1>You name is %s</h1>" % name
+    def say_hello(self, name):
+        return "<h1>Hello %s</h1>" % name
+
+This url could be contacted by typing this url in a browser: ``http://localhost:8069/my_url/say_hello?name=Nicolas``.
+
+JSON Requests
+-------------
+
+The ``@http.jsonrequest`` decorator is used to define JSON requests. The OpenERP Javascript client can contact these
+methods using the JSON-RPC protocol. JSON methods must return JSON. Like the HTTP methods they receive arguments
+as named parameters (except these arguments are JSON-RPC parameters).
+
+::
+
+    @http.jsonrequest
+    def division(self, i, j):
+        return i / j # returns a number
+
+Contacting Models
+-----------------
+
+To use the database you must access the OpenERP models. The global ``request`` object provides the necessary objects:
+
+::
+
+    @http.httprequest
+    def my_name(self):
+        my_user_record = request.registry.get("res.users").browse(request.cr, request.uid, request.ui)
+        return "<h1>Your name is %s</h1>" % my_user_record.name
+
+``request.registry`` is the registry that gives you access to the models. It is the equivalent of ``self.pool`` when
+working inside OpenERP models.
+
+``request.cr`` is the cursor object. This is the ``cr`` parameter you have to pass as first argument of every model
+method in OpenERP.
+
+``request.uid`` is the id of the current logged in user. This is the ``uid`` parameter you have to pass as second
+argument of every model method in OpenERP.
+
+Authorization Levels
+--------------------
+
+By default, all methods can only be used by users logged into OpenERP (OpenERP uses cookies to track logged users).
+There are some cases when you need to enable not-logged in users to access some methods. To do so, add the
+``http.noauth`` decorator to your method:
+
+::
+
+    @http.httprequest
+    @http.noauth
+    def hello(self):
+        return "<div>Hello unknown user!</div>"
+
+Please note the ``request.cr`` cursor will not be available in this case.

From 1e70a1f2e11e6926644dfb4b87a6b9f1213aee88 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 16:27:38 +0200
Subject: [PATCH 16/54] fix bug with monodb

bzr revid: nicolas.vanhoren@openerp.com-20130613142738-s4zp2b89xlxoaot4
---
 addons/web/http.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index d9ee06a201e..42ba0c2e35f 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -133,7 +133,7 @@ class WebRequest(object):
             self.db = None
             self.uid = None
         elif self.auth_method == "noauth":
-            self.db = (self.session._db or openerp.addons.web.controllers.main.db_monodb(self)).lower()
+            self.db = (self.session._db or openerp.addons.web.controllers.main.db_monodb()).lower()
             self.uid = None
         else: # auth
             try:

From 213a1a53a346595a3b603a100fdd4ff4fa2ffeb1 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 16:29:28 +0200
Subject: [PATCH 17/54] doc

bzr revid: nicolas.vanhoren@openerp.com-20130613142928-8z4ivvhb9jjm5gxc
---
 addons/web/doc/web_controllers.rst | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/addons/web/doc/web_controllers.rst b/addons/web/doc/web_controllers.rst
index 32b49f768ee..6c0137e8282 100644
--- a/addons/web/doc/web_controllers.rst
+++ b/addons/web/doc/web_controllers.rst
@@ -134,4 +134,5 @@ There are some cases when you need to enable not-logged in users to access some
     def hello(self):
         return "<div>Hello unknown user!</div>"
 
-Please note the ``request.cr`` cursor will not be available in this case.
+Please note the ``request.uid`` user id will be ``None`` inside this method call. This is due to the fact no user was
+authenticated.

From 5a22702043d5b29d67e27e8c93051716d727357c Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 18:23:19 +0200
Subject: [PATCH 18/54] added black magic to detect the user when using http
 requests

bzr revid: nicolas.vanhoren@openerp.com-20130613162319-1w0renis7g2x5cw0
---
 addons/web/doc/web_controllers.rst | 2 +-
 addons/web/http.py                 | 9 ++++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/addons/web/doc/web_controllers.rst b/addons/web/doc/web_controllers.rst
index 6c0137e8282..8938f0adbb8 100644
--- a/addons/web/doc/web_controllers.rst
+++ b/addons/web/doc/web_controllers.rst
@@ -108,7 +108,7 @@ To use the database you must access the OpenERP models. The global ``request`` o
 
     @http.httprequest
     def my_name(self):
-        my_user_record = request.registry.get("res.users").browse(request.cr, request.uid, request.ui)
+        my_user_record = request.registry.get("res.users").browse(request.cr, request.uid, request.uid)
         return "<h1>Your name is %s</h1>" % my_user_record.name
 
 ``request.registry`` is the registry that gives you access to the models. It is the equivalent of ``self.pool`` when
diff --git a/addons/web/http.py b/addons/web/http.py
index 42ba0c2e35f..d919c247bcb 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -29,6 +29,7 @@ import werkzeug.exceptions
 import werkzeug.utils
 import werkzeug.wrappers
 import werkzeug.wsgi
+import urllib2
 
 import openerp
 
@@ -97,7 +98,13 @@ class WebRequest(object):
     def init(self, params):
         self.params = dict(params)
         # OpenERP session setup
-        self.session_id = self.params.pop("session_id", None) or uuid.uuid4().hex
+        self.session_id = self.params.pop("session_id", None)
+        if not self.session_id:
+            i0 = self.httprequest.cookies.get("instance0|session_id", None)
+            if i0:
+                self.session_id = simplejson.loads(urllib2.unquote(i0))
+            else:
+                self.session_id = uuid.uuid4().hex
         self.session = self.httpsession.get(self.session_id)
         if not self.session:
             self.session = session.OpenERPSession()

From 4257dfed8a99d917e106cb8d4b6339135a8ffa15 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 13 Jun 2013 19:01:47 +0200
Subject: [PATCH 19/54] Added doc in the code

bzr revid: nicolas.vanhoren@openerp.com-20130613170147-d2mfdwlvkg088jtq
---
 addons/web/http.py    | 42 +++++++++++++++++++++++++++++------
 addons/web/session.py | 51 +++++++++++++++++++++++++++++++++----------
 2 files changed, 74 insertions(+), 19 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index d919c247bcb..0f5450ffd30 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -83,6 +83,16 @@ class WebRequest(object):
     .. attribute:: debug
 
         ``bool``, indicates whether the debug mode is active on the client
+
+    .. attribute:: db
+
+        ``str``, the name of the database linked to the current request. Can be ``None``
+        if the current request uses the @nodb decorator.
+
+    .. attribute:: uid
+
+        ``int``, the id of the user related to the current request. Can be ``None``
+        if the current request uses the @nodb or the @noauth decorator.
     """
     def __init__(self, httprequest, func, auth_method="auth"):
         self.httprequest = httprequest
@@ -135,12 +145,14 @@ class WebRequest(object):
         # we use _ as seprator where RFC2616 uses '-'
         self.lang = lang.replace('-', '_')
 
-    def authenticate(self):
+    def _authenticate(self):
         if self.auth_method == "nodb":
             self.db = None
             self.uid = None
         elif self.auth_method == "noauth":
             self.db = (self.session._db or openerp.addons.web.controllers.main.db_monodb()).lower()
+            if not self.db:
+                raise session.SessionExpiredException("No valid database for request %s" % self.httprequest)
             self.uid = None
         else: # auth
             try:
@@ -152,23 +164,26 @@ class WebRequest(object):
 
     @property
     def registry(self):
+        """
+        The registry to the database linked to this request. Can be ``None`` if the current request uses the
+        @nodb decorator.
+        """
         return openerp.modules.registry.RegistryManager.get(self.db) if self.db else None
 
     @property
     def cr(self):
+        """
+        The cursor initialized for the current method call. If the current request uses the @nodb decorator
+        trying to access this property will raise an exception.
+        """
         # some magic to lazy create the cr
         if not self._cr_cm:
             self._cr_cm = self.registry.cursor()
             self._cr = self._cr_cm.__enter__()
         return self._cr
 
-    #TODO: remove
-    @contextlib.contextmanager
-    def registry_cr(self):
-        return (self.registry, self.cr)
-
     def _call_function(self, *args, **kwargs):
-        self.authenticate()
+        self._authenticate()
         try:
             # ugly syntax only to get the __exit__ arguments to pass to self._cr
             request = self
@@ -190,10 +205,20 @@ class WebRequest(object):
 
 
 def noauth(f):
+    """
+    Decorator to put on a controller method to inform it does not require a user to be logged. When this decorator
+    is used, ``request.uid`` will be ``None``. The request will still try to detect the database and an exception
+    will be launched if there is no way to guess it.
+    """
     f.auth = "noauth"
     return f
 
 def nodb(f):
+    """
+    Decorator to put on a controller method to inform it does not require authentication nor any link to a database.
+    When this decorator is used, ``request.uid`` and ``request.db`` will be ``None``. Trying to use ``request.cr``
+    will launch an exception.
+    """
     f.auth = "nodb"
     return f
 
@@ -447,6 +472,9 @@ def set_request(request):
             _request_stack.pop()
     return with_obj()
 
+"""
+    A global proxy that always redirect to the current request object.
+"""
 request = _request_stack()
 
 #----------------------------------------------------------
diff --git a/addons/web/session.py b/addons/web/session.py
index b51c540aec5..aaa712fdedd 100644
--- a/addons/web/session.py
+++ b/addons/web/session.py
@@ -21,8 +21,10 @@ class AuthenticationError(Exception):
 class SessionExpiredException(Exception):
     pass
 
-# deprecated
 class Service(object):
+    """
+        Deprecated. Use ``openerp.netsvc.dispatch_rpc()`` instead.
+    """
     def __init__(self, session, service_name):
         self.session = session
         self.service_name = service_name
@@ -33,8 +35,10 @@ class Service(object):
             return result
         return proxy_method
 
-# deprecated
 class Model(object):
+    """
+        Deprecated. Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+    """
     def __init__(self, session, model):
         self.session = session
         self.model = model
@@ -97,6 +101,10 @@ class OpenERPSession(object):
         self.jsonp_requests = {}     # FIXME use a LRU
 
     def authenticate(self, db, login, password, env=None):
+        """
+        Authenticate the current user with the given db, login and password. If successful, store
+        the authentication parameters in the current session and request.
+        """
         uid = openerp.netsvc.dispatch_rpc('common', 'authenticate', [db, login, password, env])
         self._db = db
         self._uid = uid
@@ -109,15 +117,21 @@ class OpenERPSession(object):
         return uid
 
     def check_security(self):
+        """
+        Chech the current authentication parameters to know if those are still valid. This method
+        should be called at each request. If the authentication fails, a ``SessionExpiredException``
+        is raised.
+        """
         if not self._db or not self._uid:
             raise SessionExpiredException("Session expired")
         import openerp.service.security as security
         security.check(self._db, self._uid, self._password)
 
     def get_context(self):
-        """ Re-initializes the current user's session context (based on
+        """
+        Re-initializes the current user's session context (based on
         his preferences) by calling res.users.get_context() with the old
-        context
+        context.
 
         :returns: the new context
         """
@@ -147,17 +161,22 @@ class OpenERPSession(object):
 
         context['lang'] = lang or 'en_US'
 
-    #deprecated
     def send(self, service_name, method, *args):
+        """
+        Deprecated. Use ``openerp.netsvc.dispatch_rpc()`` instead.
+        """
         return openerp.netsvc.dispatch_rpc(service_name, method, args)
 
-    #deprecated
     def proxy(self, service):
+        """
+        Deprecated. Use ``openerp.netsvc.dispatch_rpc()`` instead.
+        """
         return Service(self, service)
 
-    #deprecated
     def assert_valid(self, force=False):
         """
+        Deprecated. Use ``check_security()`` instead.
+
         Ensures this session is valid (logged into the openerp server)
         """
         if self._uid and not force:
@@ -167,29 +186,37 @@ class OpenERPSession(object):
         if not self._uid:
             raise AuthenticationError("Authentication failure")
 
-    #deprecated
     def ensure_valid(self):
+        """
+        Deprecated. Use ``check_security()`` instead.
+        """
         if self._uid:
             try:
                 self.assert_valid(True)
             except Exception:
                 self._uid = None
 
-    #deprecated
     def execute(self, model, func, *l, **d):
+        """
+        Deprecated. Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+        """
         model = self.model(model)
         r = getattr(model, func)(*l, **d)
         return r
 
-    #deprecated
     def exec_workflow(self, model, id, signal):
+        """
+        Deprecated. Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+        """
         self.assert_valid()
         r = self.proxy('object').exec_workflow(self._db, self._uid, self._password, model, signal, id)
         return r
 
-    #deprecated
     def model(self, model):
-        """ Get an RPC proxy for the object ``model``, bound to this session.
+        """
+        Deprecated. Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+
+        Get an RPC proxy for the object ``model``, bound to this session.
 
         :param model: an OpenERP model name
         :type model: str

From 0ab2825e343ed2f9afcdd6e2826b5c73a70e86ab Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 14 Jun 2013 14:24:00 +0200
Subject: [PATCH 20/54] corrected test

bzr revid: nicolas.vanhoren@openerp.com-20130614122400-9xns98yv1k42gsoz
---
 addons/web/controllers/testing.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/addons/web/controllers/testing.py b/addons/web/controllers/testing.py
index b6327bf4622..8b89ab8ac9d 100644
--- a/addons/web/controllers/testing.py
+++ b/addons/web/controllers/testing.py
@@ -89,6 +89,7 @@ class TestRunnerController(http.Controller):
     _cp_path = '/web/tests'
 
     @http.httprequest
+    @http.nodb
     def index(self, req, mod=None, **kwargs):
         ms = module.get_modules()
         manifests = dict(

From faf2ef3d1ac8212d6ce9542cb9617d019513a012 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 14 Jun 2013 17:01:25 +0200
Subject: [PATCH 21/54] Simplefied a little current routing

bzr revid: nicolas.vanhoren@openerp.com-20130614150125-w8fnyclnw0l8b3r7
---
 addons/web/http.py | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 0f5450ffd30..a9039f38f9e 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -29,6 +29,7 @@ import werkzeug.exceptions
 import werkzeug.utils
 import werkzeug.wrappers
 import werkzeug.wsgi
+import werkzeug.routing as routing
 import urllib2
 
 import openerp
@@ -482,7 +483,6 @@ request = _request_stack()
 #----------------------------------------------------------
 addons_module = {}
 addons_manifest = {}
-controllers_class = []
 controllers_class_path = {}
 controllers_object = {}
 controllers_object_path = {}
@@ -505,9 +505,8 @@ class ControllerType(type):
 
         # store the controller in the controllers list
         name_class = ("%s.%s" % (cls.__module__, cls.__name__), cls)
-        controllers_class.append(name_class)
         path = attrs.get('_cp_path')
-        if path not in controllers_class_path:
+        if path and path not in controllers_class_path:
             controllers_class_path[path] = name_class
 
 class Controller(object):
@@ -655,6 +654,7 @@ class Root(object):
     def __init__(self):
         self.addons = {}
         self.statics = {}
+        self.routing_map = None
 
         self.load_addons()
 
@@ -727,12 +727,11 @@ class Root(object):
                         self.statics['/%s/static' % module] = path_static
 
         for k, v in controllers_class_path.items():
-            if k not in controllers_object_path and hasattr(v[1], '_cp_path'):
-                o = v[1]()
-                controllers_object[v[0]] = o
-                controllers_object_path[k] = o
-                if hasattr(o, '_cp_path'):
-                    controllers_path[o._cp_path] = o
+            o = v[1]()
+            controllers_object[v[0]] = o
+            controllers_object_path[k] = o
+            if hasattr(o, '_cp_path'):
+                controllers_path[o._cp_path] = o
 
         app = werkzeug.wsgi.SharedDataMiddleware(self.dispatch, self.statics)
         self.dispatch = DisableCacheMiddleware(app)

From c44888527bc027a49777bc2394a2ae69e64b547c Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 14 Jun 2013 17:26:21 +0200
Subject: [PATCH 22/54] Added werkzeug route building, not yet switched

bzr revid: nicolas.vanhoren@openerp.com-20130614152621-t8jv4474gt9k6yib
---
 addons/web/controllers/main.py |  4 ++--
 addons/web/http.py             | 22 ++++++++++++++--------
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index d2f425e0c49..87355d075f3 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -1477,8 +1477,8 @@ class Export(openerpweb.Controller):
         """
         return sorted([
             controller.fmt
-            for path, controller in openerpweb.controllers_path.iteritems()
-            if path.startswith(self._cp_path)
+            for controller in openerpweb.controllers_object.itervalues()
+            if (controller._cp_path or "").startswith(self._cp_path)
             if hasattr(controller, 'fmt')
         ], key=operator.itemgetter("label"))
 
diff --git a/addons/web/http.py b/addons/web/http.py
index a9039f38f9e..ddb253c6b22 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -485,7 +485,6 @@ addons_module = {}
 addons_manifest = {}
 controllers_class_path = {}
 controllers_object = {}
-controllers_object_path = {}
 controllers_path = {}
 
 class ControllerType(type):
@@ -680,7 +679,7 @@ class Root(object):
         request.parameter_storage_class = werkzeug.datastructures.ImmutableDict
         request.app = self
 
-        handler = self.find_handler(*(request.path.split('/')[1:]))
+        handler = self.find_handler(request.path)
 
         if not handler:
             response = werkzeug.exceptions.NotFound()
@@ -726,25 +725,32 @@ class Root(object):
                         addons_manifest[module] = manifest
                         self.statics['/%s/static' % module] = path_static
 
-        for k, v in controllers_class_path.items():
+        self.routing_map = routing.Map()
+        for k, v in controllers_class_path.iteritems():
             o = v[1]()
             controllers_object[v[0]] = o
-            controllers_object_path[k] = o
-            if hasattr(o, '_cp_path'):
-                controllers_path[o._cp_path] = o
+            members = inspect.getmembers(o)
+            for mk, mv in members:
+                if inspect.ismethod(mv) and getattr(mv, 'exposed', False):
+                    url = os.path.join(o._cp_path, mk)
+                    url += "/<path:path>"
+                    function = (mv, o.get_wrapped_method(mk))
+                    self.routing_map.add(routing.Rule(url, function))
+            controllers_path[o._cp_path] = o
 
         app = werkzeug.wsgi.SharedDataMiddleware(self.dispatch, self.statics)
         self.dispatch = DisableCacheMiddleware(app)
 
-    def find_handler(self, *l):
+    def find_handler(self, path):
         """
         Tries to discover the controller handling the request for the path
         specified by the provided parameters
 
-        :param l: path sections to a controller or controller method
+        :param path: path to match
         :returns: a callable matching the path sections, or ``None``
         :rtype: ``Controller | None``
         """
+        l = path.split('/')[1:]
         if l:
             ps = '/' + '/'.join(filter(None, l))
             method_name = 'index'

From bd5eaa5f9239d92d8517be56dd524f6ab324cc0a Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 14 Jun 2013 17:52:50 +0200
Subject: [PATCH 23/54] Replaced routing by werkzeug routing

bzr revid: nicolas.vanhoren@openerp.com-20130614155250-2a29y2uv2255a79x
---
 addons/web/http.py | 94 +++++++++++++++++++---------------------------
 1 file changed, 39 insertions(+), 55 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index ddb253c6b22..35c68d1ca82 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -681,26 +681,23 @@ class Root(object):
 
         handler = self.find_handler(request.path)
 
-        if not handler:
-            response = werkzeug.exceptions.NotFound()
-        else:
-            sid = request.cookies.get('sid')
-            if not sid:
-                sid = request.args.get('sid')
+        sid = request.cookies.get('sid')
+        if not sid:
+            sid = request.args.get('sid')
 
-            session_gc(self.session_store)
+        session_gc(self.session_store)
 
-            with session_context(request, self.session_store, self.session_lock, sid) as session:
-                result = handler(request)
+        with session_context(request, self.session_store, self.session_lock, sid) as session:
+            result = handler(request)
 
-                if isinstance(result, basestring):
-                    headers=[('Content-Type', 'text/html; charset=utf-8'), ('Content-Length', len(result))]
-                    response = werkzeug.wrappers.Response(result, headers=headers)
-                else:
-                    response = result
+            if isinstance(result, basestring):
+                headers=[('Content-Type', 'text/html; charset=utf-8'), ('Content-Length', len(result))]
+                response = werkzeug.wrappers.Response(result, headers=headers)
+            else:
+                response = result
 
-                if hasattr(response, 'set_cookie'):
-                    response.set_cookie('sid', session.sid)
+            if hasattr(response, 'set_cookie'):
+                response.set_cookie('sid', session.sid)
 
         return response(environ, start_response)
 
@@ -726,16 +723,20 @@ class Root(object):
                         self.statics['/%s/static' % module] = path_static
 
         self.routing_map = routing.Map()
-        for k, v in controllers_class_path.iteritems():
+        for v in controllers_class_path.itervalues():
             o = v[1]()
             controllers_object[v[0]] = o
             members = inspect.getmembers(o)
             for mk, mv in members:
                 if inspect.ismethod(mv) and getattr(mv, 'exposed', False):
-                    url = os.path.join(o._cp_path, mk)
-                    url += "/<path:path>"
-                    function = (mv, o.get_wrapped_method(mk))
-                    self.routing_map.add(routing.Rule(url, function))
+                    if mk == "index":
+                        url = o._cp_path
+                    else:
+                        url = os.path.join(o._cp_path, mk)
+                    function = (o.get_wrapped_method(mk), mv)
+                    self.routing_map.add(routing.Rule(url, endpoint=function))
+                    url = os.path.join(url, "<path:path>")
+                    self.routing_map.add(routing.Rule(url, endpoint=function))
             controllers_path[o._cp_path] = o
 
         app = werkzeug.wsgi.SharedDataMiddleware(self.dispatch, self.statics)
@@ -747,42 +748,25 @@ class Root(object):
         specified by the provided parameters
 
         :param path: path to match
-        :returns: a callable matching the path sections, or ``None``
+        :returns: a callable matching the path sections
         :rtype: ``Controller | None``
         """
-        l = path.split('/')[1:]
-        if l:
-            ps = '/' + '/'.join(filter(None, l))
-            method_name = 'index'
-            while ps:
-                c = controllers_path.get(ps)
-                if c:
-                    method = getattr(c, method_name, None)
-                    if method:
-                        exposed = getattr(method, 'exposed', False)
-                        auth = getattr(method, 'auth', "auth")
-                        method = c.get_wrapped_method(method_name)
-                        if exposed == 'json':
-                            _logger.debug("Dispatch json to %s %s %s", ps, c, method_name)
-                            def fct(_request):
-                                _req = JsonRequest(_request, method, auth)
-                                with set_request(_req):
-                                    return request.dispatch()
-                            return fct
-                        elif exposed == 'http':
-                            _logger.debug("Dispatch http to %s %s %s", ps, c, method_name)
-                            def fct(_request):
-                                _req = HttpRequest(_request, method, auth)
-                                with set_request(_req):
-                                    return request.dispatch()
-                            return fct
-                    if method_name != "index":
-                        method_name = "index"
-                        continue
-                ps, _slash, method_name = ps.rpartition('/')
-                if not ps and method_name:
-                    ps = '/'
-        return None
+        urls = self.routing_map.bind("")
+        func, original = urls.match(path)[0]
+        auth = getattr(original, "auth", "auth")
+
+        if original.exposed == "json":
+            def fct(_request):
+                _req = JsonRequest(_request, func, auth)
+                with set_request(_req):
+                    return request.dispatch()
+            return fct
+        else: # http
+            def fct(_request):
+                _req = HttpRequest(_request, func, auth)
+                with set_request(_req):
+                    return request.dispatch()
+            return fct
 
 def wsgi_postload():
     openerp.wsgi.register_wsgi_handler(Root())

From 0aaa5edd9dd50c03d7e6250481ac0c20874d7ba7 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Tue, 18 Jun 2013 13:39:05 +0200
Subject: [PATCH 24/54] removed useless var

bzr revid: nicolas.vanhoren@openerp.com-20130618113905-yyezil4z5dl12k2v
---
 addons/web/http.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 35c68d1ca82..8d7c7fbee9d 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -485,7 +485,6 @@ addons_module = {}
 addons_manifest = {}
 controllers_class_path = {}
 controllers_object = {}
-controllers_path = {}
 
 class ControllerType(type):
     def __init__(cls, name, bases, attrs):
@@ -737,7 +736,6 @@ class Root(object):
                     self.routing_map.add(routing.Rule(url, endpoint=function))
                     url = os.path.join(url, "<path:path>")
                     self.routing_map.add(routing.Rule(url, endpoint=function))
-            controllers_path[o._cp_path] = o
 
         app = werkzeug.wsgi.SharedDataMiddleware(self.dispatch, self.statics)
         self.dispatch = DisableCacheMiddleware(app)

From f83c1d0f4c724fb72a95d7c62dbf158c86dea6fd Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Tue, 18 Jun 2013 16:50:28 +0200
Subject: [PATCH 25/54] changed the way controllers are loaded

bzr revid: nicolas.vanhoren@openerp.com-20130618145028-qrhp0uwp03g95u8h
---
 addons/web/http.py | 42 +++++++++++++++++++++++++-----------------
 1 file changed, 25 insertions(+), 17 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 8d7c7fbee9d..1cc0e488be8 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -483,7 +483,7 @@ request = _request_stack()
 #----------------------------------------------------------
 addons_module = {}
 addons_manifest = {}
-controllers_class_path = {}
+controllers_per_module = {}
 controllers_object = {}
 
 class ControllerType(type):
@@ -503,9 +503,12 @@ class ControllerType(type):
 
         # store the controller in the controllers list
         name_class = ("%s.%s" % (cls.__module__, cls.__name__), cls)
+        class_path = name_class[0].split(".")
         path = attrs.get('_cp_path')
-        if path and path not in controllers_class_path:
-            controllers_class_path[path] = name_class
+        if not path or not class_path[:2] == ["openerp", "addons"]:
+            return
+        module = class_path[2]
+        controllers_per_module.setdefault(module, []).append(name_class)
 
 class Controller(object):
     __metaclass__ = ControllerType
@@ -722,20 +725,25 @@ class Root(object):
                         self.statics['/%s/static' % module] = path_static
 
         self.routing_map = routing.Map()
-        for v in controllers_class_path.itervalues():
-            o = v[1]()
-            controllers_object[v[0]] = o
-            members = inspect.getmembers(o)
-            for mk, mv in members:
-                if inspect.ismethod(mv) and getattr(mv, 'exposed', False):
-                    if mk == "index":
-                        url = o._cp_path
-                    else:
-                        url = os.path.join(o._cp_path, mk)
-                    function = (o.get_wrapped_method(mk), mv)
-                    self.routing_map.add(routing.Rule(url, endpoint=function))
-                    url = os.path.join(url, "<path:path>")
-                    self.routing_map.add(routing.Rule(url, endpoint=function))
+        modules = controllers_per_module.keys()
+        modules.sort()
+        modules.remove("web")
+        modules = ["web"] + modules
+        for module in modules:
+            for v in controllers_per_module[module]:
+                o = v[1]()
+                controllers_object[v[0]] = o
+                members = inspect.getmembers(o)
+                for mk, mv in members:
+                    if inspect.ismethod(mv) and getattr(mv, 'exposed', False):
+                        if mk == "index":
+                            url = o._cp_path
+                        else:
+                            url = os.path.join(o._cp_path, mk)
+                        function = (o.get_wrapped_method(mk), mv)
+                        self.routing_map.add(routing.Rule(url, endpoint=function))
+                        url = os.path.join(url, "<path:path>")
+                        self.routing_map.add(routing.Rule(url, endpoint=function))
 
         app = werkzeug.wsgi.SharedDataMiddleware(self.dispatch, self.statics)
         self.dispatch = DisableCacheMiddleware(app)

From c2531549ac97fe6ce6a57d3cbad26b7063a55b25 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Tue, 18 Jun 2013 17:42:07 +0200
Subject: [PATCH 26/54] small improvements

bzr revid: nicolas.vanhoren@openerp.com-20130618154207-p1n49dwoj2357n5j
---
 addons/web/http.py | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 1cc0e488be8..ad5b2eee5e6 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -121,7 +121,10 @@ class WebRequest(object):
             self.session = session.OpenERPSession()
             self.httpsession[self.session_id] = self.session
 
-        # TODO: remove this shit
+        with set_request(self):
+            self.db = (self.session._db or openerp.addons.web.controllers.main.db_monodb()).lower()
+
+        # TODO: remove this
         # set db/uid trackers - they're cleaned up at the WSGI
         # dispatching phase in openerp.service.wsgi_server.application
         if self.session._db:
@@ -269,7 +272,6 @@ class JsonRequest(WebRequest):
         """
         args = self.httprequest.args
         jsonp = args.get('jsonp')
-        requestf = None
         request = None
         request_id = args.get('id')
 
@@ -289,16 +291,13 @@ class JsonRequest(WebRequest):
             request = self.session.jsonp_requests.pop(request_id, "")
         else:
             # regular jsonrpc2
-            requestf = self.httprequest.stream
+            request = self.httprequest.stream.read()
 
         response = {"jsonrpc": "2.0" }
         error = None
         try:
             # Read POST content or POST Form Data named "request"
-            if requestf:
-                self.jsonrequest = simplejson.load(requestf, object_hook=reject_nonliteral)
-            else:
-                self.jsonrequest = simplejson.loads(request, object_hook=reject_nonliteral)
+            self.jsonrequest = simplejson.loads(request, object_hook=reject_nonliteral)
             self.init(self.jsonrequest.get("params", {}))
             #if _logger.isEnabledFor(logging.DEBUG):
             #    _logger.debug("--> %s.%s\n%s", func.im_class.__name__, func.__name__, pprint.pformat(self.jsonrequest))

From 424c2e61e638989ebea39a1ea1a0a77831de2a00 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Tue, 18 Jun 2013 18:10:50 +0200
Subject: [PATCH 27/54] wip

bzr revid: nicolas.vanhoren@openerp.com-20130618161050-flzsozt2palfqp1t
---
 addons/web/http.py | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index ad5b2eee5e6..980acfe9509 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -676,20 +676,20 @@ class Root(object):
 
         Call the object directly.
         """
-        request = werkzeug.wrappers.Request(environ)
-        request.parameter_storage_class = werkzeug.datastructures.ImmutableDict
-        request.app = self
+        httprequest = werkzeug.wrappers.Request(environ)
+        httprequest.parameter_storage_class = werkzeug.datastructures.ImmutableDict
+        httprequest.app = self
 
-        handler = self.find_handler(request.path)
+        handler = self.find_handler(httprequest.path)
 
-        sid = request.cookies.get('sid')
+        sid = httprequest.cookies.get('sid')
         if not sid:
-            sid = request.args.get('sid')
+            sid = httprequest.args.get('sid')
 
         session_gc(self.session_store)
 
-        with session_context(request, self.session_store, self.session_lock, sid) as session:
-            result = handler(request)
+        with session_context(httprequest, self.session_store, self.session_lock, sid) as session:
+            result = handler(httprequest)
 
             if isinstance(result, basestring):
                 headers=[('Content-Type', 'text/html; charset=utf-8'), ('Content-Length', len(result))]
@@ -761,14 +761,14 @@ class Root(object):
         auth = getattr(original, "auth", "auth")
 
         if original.exposed == "json":
-            def fct(_request):
-                _req = JsonRequest(_request, func, auth)
+            def fct(httprequest):
+                _req = JsonRequest(httprequest, func, auth)
                 with set_request(_req):
                     return request.dispatch()
             return fct
         else: # http
-            def fct(_request):
-                _req = HttpRequest(_request, func, auth)
+            def fct(httprequest):
+                _req = HttpRequest(httprequest, func, auth)
                 with set_request(_req):
                     return request.dispatch()
             return fct

From fdc08bd64e4b141376f4747b01c05662fcb05484 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Tue, 18 Jun 2013 18:20:33 +0200
Subject: [PATCH 28/54] wip

bzr revid: nicolas.vanhoren@openerp.com-20130618162033-pgl073m9g91rgtxg
---
 addons/web/http.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 980acfe9509..1bb03a60093 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -680,8 +680,6 @@ class Root(object):
         httprequest.parameter_storage_class = werkzeug.datastructures.ImmutableDict
         httprequest.app = self
 
-        handler = self.find_handler(httprequest.path)
-
         sid = httprequest.cookies.get('sid')
         if not sid:
             sid = httprequest.args.get('sid')
@@ -689,6 +687,8 @@ class Root(object):
         session_gc(self.session_store)
 
         with session_context(httprequest, self.session_store, self.session_lock, sid) as session:
+            handler = self.find_handler(httprequest.path)
+
             result = handler(httprequest)
 
             if isinstance(result, basestring):

From 14329ab05707738fdcb0be55c44f0ea299857c0f Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Tue, 18 Jun 2013 19:20:59 +0200
Subject: [PATCH 29/54] added request typing guessing

bzr revid: nicolas.vanhoren@openerp.com-20130618172059-v34p34jkrr8vclb8
---
 addons/web/http.py | 44 +++++++++++++++++++++++++-------------------
 1 file changed, 25 insertions(+), 19 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 1bb03a60093..931d359c542 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -95,14 +95,14 @@ class WebRequest(object):
         ``int``, the id of the user related to the current request. Can be ``None``
         if the current request uses the @nodb or the @noauth decorator.
     """
-    def __init__(self, httprequest, func, auth_method="auth"):
+    def __init__(self, httprequest):
         self.httprequest = httprequest
         self.httpresponse = None
         self.httpsession = httprequest.session
         self.db = None
         self.uid = None
-        self.func = func
-        self.auth_method = auth_method
+        self.func = None
+        self.auth_method = None
         self._cr_cm = None
         self._cr = None
 
@@ -687,9 +687,12 @@ class Root(object):
         session_gc(self.session_store)
 
         with session_context(httprequest, self.session_store, self.session_lock, sid) as session:
-            handler = self.find_handler(httprequest.path)
+            request = self._build_request(httprequest)
 
-            result = handler(httprequest)
+            self.find_handler(httprequest.path, request)
+
+            with set_request(request):
+                result = request.dispatch()
 
             if isinstance(result, basestring):
                 headers=[('Content-Type', 'text/html; charset=utf-8'), ('Content-Length', len(result))]
@@ -700,7 +703,20 @@ class Root(object):
             if hasattr(response, 'set_cookie'):
                 response.set_cookie('sid', session.sid)
 
-        return response(environ, start_response)
+            return response(environ, start_response)
+
+    def _build_request(self, httprequest):
+        if httprequest.args.get('jsonp'):
+            return JsonRequest(httprequest)
+
+        content = httprequest.stream.read()
+        import cStringIO
+        httprequest.stream = cStringIO.StringIO(content)
+        try:
+            simplejson.loads(content)
+            return JsonRequest(httprequest)
+        except:
+            return HttpRequest(httprequest)
 
     def load_addons(self):
         """ Load all addons from addons patch containg static files and
@@ -747,7 +763,7 @@ class Root(object):
         app = werkzeug.wsgi.SharedDataMiddleware(self.dispatch, self.statics)
         self.dispatch = DisableCacheMiddleware(app)
 
-    def find_handler(self, path):
+    def find_handler(self, path, request):
         """
         Tries to discover the controller handling the request for the path
         specified by the provided parameters
@@ -760,18 +776,8 @@ class Root(object):
         func, original = urls.match(path)[0]
         auth = getattr(original, "auth", "auth")
 
-        if original.exposed == "json":
-            def fct(httprequest):
-                _req = JsonRequest(httprequest, func, auth)
-                with set_request(_req):
-                    return request.dispatch()
-            return fct
-        else: # http
-            def fct(httprequest):
-                _req = HttpRequest(httprequest, func, auth)
-                with set_request(_req):
-                    return request.dispatch()
-            return fct
+        request.func = func
+        request.auth_method = auth
 
 def wsgi_postload():
     openerp.wsgi.register_wsgi_handler(Root())

From d6676ec846c3553915d849056be858434ee66afc Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Wed, 19 Jun 2013 11:44:37 +0200
Subject: [PATCH 30/54] Changed the way the request init

bzr revid: nicolas.vanhoren@openerp.com-20130619094437-ybbgtrgz12n66sno
---
 addons/web/http.py | 44 ++++++++++++++++++++++++++++++--------------
 1 file changed, 30 insertions(+), 14 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 931d359c542..b0ab28b2249 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -265,23 +265,28 @@ class JsonRequest(WebRequest):
            "id": null}
 
     """
-    def dispatch(self):
-        """ Calls the method asked for by the JSON-RPC2 or JSONP request
+    def __init__(self, *args):
+        super(JsonRequest, self).__init__(*args)
+
+        self.jsonp_handler = None
 
-        :returns: an utf8 encoded JSON-RPC2 or JSONP reply
-        """
         args = self.httprequest.args
         jsonp = args.get('jsonp')
+        self.jsonp = jsonp
         request = None
         request_id = args.get('id')
 
         if jsonp and self.httprequest.method == 'POST':
             # jsonp 2 steps step1 POST: save call
             self.init(args)
-            self.session.jsonp_requests[request_id] = self.httprequest.form['r']
-            headers=[('Content-Type', 'text/plain; charset=utf-8')]
-            r = werkzeug.wrappers.Response(request_id, headers=headers)
-            return r
+
+            def handler():
+                self.session.jsonp_requests[request_id] = self.httprequest.form['r']
+                headers=[('Content-Type', 'text/plain; charset=utf-8')]
+                r = werkzeug.wrappers.Response(request_id, headers=headers)
+                return r
+            self.jsonp_handler = handler
+            return
         elif jsonp and args.get('r'):
             # jsonp method GET
             request = args.get('r')
@@ -293,12 +298,20 @@ class JsonRequest(WebRequest):
             # regular jsonrpc2
             request = self.httprequest.stream.read()
 
+        # Read POST content or POST Form Data named "request"
+        self.jsonrequest = simplejson.loads(request, object_hook=reject_nonliteral)
+        self.init(self.jsonrequest.get("params", {}))
+
+    def dispatch(self):
+        """ Calls the method asked for by the JSON-RPC2 or JSONP request
+
+        :returns: an utf8 encoded JSON-RPC2 or JSONP reply
+        """
+        if self.jsonp_handler:
+            return self.jsonp_handler()
         response = {"jsonrpc": "2.0" }
         error = None
         try:
-            # Read POST content or POST Form Data named "request"
-            self.jsonrequest = simplejson.loads(request, object_hook=reject_nonliteral)
-            self.init(self.jsonrequest.get("params", {}))
             #if _logger.isEnabledFor(logging.DEBUG):
             #    _logger.debug("--> %s.%s\n%s", func.im_class.__name__, func.__name__, pprint.pformat(self.jsonrequest))
             response['id'] = self.jsonrequest.get('id')
@@ -325,13 +338,13 @@ class JsonRequest(WebRequest):
         if _logger.isEnabledFor(logging.DEBUG):
             _logger.debug("<--\n%s", pprint.pformat(response))
 
-        if jsonp:
+        if self.jsonp:
             # If we use jsonp, that's mean we are called from another host
             # Some browser (IE and Safari) do no allow third party cookies
             # We need then to manage http sessions manually.
             response['httpsessionid'] = self.httpsession.sid
             mime = 'application/javascript'
-            body = "%s(%s);" % (jsonp, simplejson.dumps(response),)
+            body = "%s(%s);" % (self.jsonp, simplejson.dumps(response),)
         else:
             mime = 'application/json'
             body = simplejson.dumps(response)
@@ -385,11 +398,14 @@ def jsonrequest(f):
 class HttpRequest(WebRequest):
     """ Regular GET/POST request
     """
-    def dispatch(self):
+    def __init__(self, *args):
+        super(HttpRequest, self).__init__(*args)
         params = dict(self.httprequest.args)
         params.update(self.httprequest.form)
         params.update(self.httprequest.files)
         self.init(params)
+
+    def dispatch(self):
         akw = {}
         for key, value in self.httprequest.args.iteritems():
             if isinstance(value, basestring) and len(value) < 1024:

From 2e0461e483438710dd1e967863c662bc1440ccee Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Wed, 19 Jun 2013 11:49:03 +0200
Subject: [PATCH 31/54] wip

bzr revid: nicolas.vanhoren@openerp.com-20130619094903-5vblw05lvm4ow19n
---
 addons/web/http.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index b0ab28b2249..b5a94de4b6c 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -705,7 +705,7 @@ class Root(object):
         with session_context(httprequest, self.session_store, self.session_lock, sid) as session:
             request = self._build_request(httprequest)
 
-            self.find_handler(httprequest.path, request)
+            self.find_handler(request)
 
             with set_request(request):
                 result = request.dispatch()
@@ -779,7 +779,7 @@ class Root(object):
         app = werkzeug.wsgi.SharedDataMiddleware(self.dispatch, self.statics)
         self.dispatch = DisableCacheMiddleware(app)
 
-    def find_handler(self, path, request):
+    def find_handler(self, request):
         """
         Tries to discover the controller handling the request for the path
         specified by the provided parameters
@@ -788,6 +788,7 @@ class Root(object):
         :returns: a callable matching the path sections
         :rtype: ``Controller | None``
         """
+        path = request.httprequest.path
         urls = self.routing_map.bind("")
         func, original = urls.match(path)[0]
         auth = getattr(original, "auth", "auth")

From ee104c9ed0ef39dd9fa941bbe7240359dd29b34b Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Wed, 19 Jun 2013 12:15:50 +0200
Subject: [PATCH 32/54] now uses one routing map per db

bzr revid: nicolas.vanhoren@openerp.com-20130619101550-e3nb5aq2u474b1wx
---
 addons/web/http.py | 34 +++++++++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index b5a94de4b6c..b9873fb653e 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -670,7 +670,9 @@ class Root(object):
     def __init__(self):
         self.addons = {}
         self.statics = {}
-        self.routing_map = None
+        
+        self.db_routers = {}
+        self.db_routers_lock = threading.Lock()
 
         self.load_addons()
 
@@ -680,6 +682,7 @@ class Root(object):
         self.session_lock = threading.Lock()
         _logger.debug('HTTP sessions stored in: %s', path)
 
+
     def __call__(self, environ, start_response):
         """ Handle a WSGI request
         """
@@ -755,7 +758,13 @@ class Root(object):
                         addons_manifest[module] = manifest
                         self.statics['/%s/static' % module] = path_static
 
-        self.routing_map = routing.Map()
+        self.db_routers[None] = self._build_router(None)
+
+        app = werkzeug.wsgi.SharedDataMiddleware(self.dispatch, self.statics)
+        self.dispatch = DisableCacheMiddleware(app)
+
+    def _build_router(self, db):
+        routing_map = routing.Map()
         modules = controllers_per_module.keys()
         modules.sort()
         modules.remove("web")
@@ -767,17 +776,27 @@ class Root(object):
                 members = inspect.getmembers(o)
                 for mk, mv in members:
                     if inspect.ismethod(mv) and getattr(mv, 'exposed', False):
+                        auth = getattr(mv, 'auth', None)
+                        if (db is None and auth != 'nodb'):
+                            continue
                         if mk == "index":
                             url = o._cp_path
                         else:
                             url = os.path.join(o._cp_path, mk)
                         function = (o.get_wrapped_method(mk), mv)
-                        self.routing_map.add(routing.Rule(url, endpoint=function))
+                        routing_map.add(routing.Rule(url, endpoint=function))
                         url = os.path.join(url, "<path:path>")
-                        self.routing_map.add(routing.Rule(url, endpoint=function))
+                        routing_map.add(routing.Rule(url, endpoint=function))
+        return routing_map
 
-        app = werkzeug.wsgi.SharedDataMiddleware(self.dispatch, self.statics)
-        self.dispatch = DisableCacheMiddleware(app)
+    def get_db_router(self, db):
+        with self.db_routers_lock:
+            router = self.db_routers.get(db)
+        if not router:
+            router = self._build_router(db)
+            with self.db_routers_lock:
+                router = self.db_routers[db] = router
+        return router
 
     def find_handler(self, request):
         """
@@ -789,8 +808,9 @@ class Root(object):
         :rtype: ``Controller | None``
         """
         path = request.httprequest.path
-        urls = self.routing_map.bind("")
+        urls = self.get_db_router(request.db).bind("")
         func, original = urls.match(path)[0]
+
         auth = getattr(original, "auth", "auth")
 
         request.func = func

From 1d2bab08e118eeca63c6aa06470394327ab3d1f4 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Wed, 19 Jun 2013 12:55:31 +0200
Subject: [PATCH 33/54] now calls registrymanager update methods

bzr revid: nicolas.vanhoren@openerp.com-20130619105531-aqo7lc71d48lzmw8
---
 addons/web/http.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index b9873fb653e..fc75c323d3f 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -670,7 +670,7 @@ class Root(object):
     def __init__(self):
         self.addons = {}
         self.statics = {}
-        
+
         self.db_routers = {}
         self.db_routers_lock = threading.Lock()
 
@@ -707,12 +707,16 @@ class Root(object):
 
         with session_context(httprequest, self.session_store, self.session_lock, sid) as session:
             request = self._build_request(httprequest)
+            db = request.db
+
+            updated = openerp.modules.registry.RegistryManager.check_registry_signaling(db)
 
             self.find_handler(request)
-
             with set_request(request):
                 result = request.dispatch()
 
+            openerp.modules.registry.RegistryManager.signal_caches_change(db)
+
             if isinstance(result, basestring):
                 headers=[('Content-Type', 'text/html; charset=utf-8'), ('Content-Length', len(result))]
                 response = werkzeug.wrappers.Response(result, headers=headers)

From da9abb25ed38050af9c3bdef870cd3724170d6ba Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Wed, 19 Jun 2013 14:23:22 +0200
Subject: [PATCH 34/54] fixed minor stuff and removed controllers_object, which
 will cause some addons to crash

bzr revid: nicolas.vanhoren@openerp.com-20130619122322-aza8yd8jz4lbndnq
---
 addons/web/http.py | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index fc75c323d3f..d8e12fef1e8 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -105,6 +105,7 @@ class WebRequest(object):
         self.auth_method = None
         self._cr_cm = None
         self._cr = None
+        self.func_request_type = None
 
     def init(self, params):
         self.params = dict(params)
@@ -201,6 +202,9 @@ class WebRequest(object):
                         request._cr = None
 
             with with_obj():
+                if self.func_request_type != self._request_type:
+                    raise Exception("%s: Function declared as capable of handling request of type '%s' but called with a request of type '%s'" \
+                        % (self.httprequest.path, self.func_request_type, self._request_type))
                 return self.func(*args, **kwargs)
         finally:
             # just to be sure no one tries to re-use the request
@@ -265,6 +269,8 @@ class JsonRequest(WebRequest):
            "id": null}
 
     """
+    _request_type = "json"
+
     def __init__(self, *args):
         super(JsonRequest, self).__init__(*args)
 
@@ -398,6 +404,8 @@ def jsonrequest(f):
 class HttpRequest(WebRequest):
     """ Regular GET/POST request
     """
+    _request_type = "http"
+
     def __init__(self, *args):
         super(HttpRequest, self).__init__(*args)
         params = dict(self.httprequest.args)
@@ -499,7 +507,6 @@ request = _request_stack()
 addons_module = {}
 addons_manifest = {}
 controllers_per_module = {}
-controllers_object = {}
 
 class ControllerType(type):
     def __init__(cls, name, bases, attrs):
@@ -709,13 +716,18 @@ class Root(object):
             request = self._build_request(httprequest)
             db = request.db
 
-            updated = openerp.modules.registry.RegistryManager.check_registry_signaling(db)
+            if db:
+                updated = openerp.modules.registry.RegistryManager.check_registry_signaling(db)
+                if updated:
+                    with self.db_routers_lock:
+                        del self.db_routers[db]
 
             self.find_handler(request)
             with set_request(request):
                 result = request.dispatch()
 
-            openerp.modules.registry.RegistryManager.signal_caches_change(db)
+            if db:
+                openerp.modules.registry.RegistryManager.signal_caches_change(db)
 
             if isinstance(result, basestring):
                 headers=[('Content-Type', 'text/html; charset=utf-8'), ('Content-Length', len(result))]
@@ -776,7 +788,6 @@ class Root(object):
         for module in modules:
             for v in controllers_per_module[module]:
                 o = v[1]()
-                controllers_object[v[0]] = o
                 members = inspect.getmembers(o)
                 for mk, mv in members:
                     if inspect.ismethod(mv) and getattr(mv, 'exposed', False):
@@ -815,10 +826,9 @@ class Root(object):
         urls = self.get_db_router(request.db).bind("")
         func, original = urls.match(path)[0]
 
-        auth = getattr(original, "auth", "auth")
-
         request.func = func
-        request.auth_method = auth
+        request.auth_method = getattr(original, "auth", "auth")
+        request.func_request_type = original.exposed
 
 def wsgi_postload():
     openerp.wsgi.register_wsgi_handler(Root())

From 1a977c7d0d357588e5aa142830609621ecdee832 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Wed, 19 Jun 2013 14:33:25 +0200
Subject: [PATCH 35/54] wip

bzr revid: nicolas.vanhoren@openerp.com-20130619123325-mal77wf9pvdnubo2
---
 addons/web/http.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index d8e12fef1e8..df9a785752d 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -774,8 +774,6 @@ class Root(object):
                         addons_manifest[module] = manifest
                         self.statics['/%s/static' % module] = path_static
 
-        self.db_routers[None] = self._build_router(None)
-
         app = werkzeug.wsgi.SharedDataMiddleware(self.dispatch, self.statics)
         self.dispatch = DisableCacheMiddleware(app)
 

From b3a99c860f6e30f6a159ca1d9f53a14d97a21158 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Wed, 19 Jun 2013 15:47:11 +0200
Subject: [PATCH 36/54] now uses only the installed modules to build the routes

bzr revid: nicolas.vanhoren@openerp.com-20130619134711-evs92rdtikdeqjt1
---
 addons/web/http.py | 49 ++++++++++++++++++++++++++++++++++------------
 1 file changed, 37 insertions(+), 12 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index df9a785752d..4f89dbf10bb 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -203,8 +203,8 @@ class WebRequest(object):
 
             with with_obj():
                 if self.func_request_type != self._request_type:
-                    raise Exception("%s: Function declared as capable of handling request of type '%s' but called with a request of type '%s'" \
-                        % (self.httprequest.path, self.func_request_type, self._request_type))
+                    raise Exception("%s, %s: Function declared as capable of handling request of type '%s' but called with a request of type '%s'" \
+                        % (self.func, self.httprequest.path, self.func_request_type, self._request_type))
                 return self.func(*args, **kwargs)
         finally:
             # just to be sure no one tries to re-use the request
@@ -722,8 +722,8 @@ class Root(object):
                     with self.db_routers_lock:
                         del self.db_routers[db]
 
-            self.find_handler(request)
             with set_request(request):
+                self.find_handler()
                 result = request.dispatch()
 
             if db:
@@ -778,20 +778,45 @@ class Root(object):
         self.dispatch = DisableCacheMiddleware(app)
 
     def _build_router(self, db):
+        _logger.info("Generating routing configuration for database %s" % db)
         routing_map = routing.Map()
-        modules = controllers_per_module.keys()
-        modules.sort()
-        modules.remove("web")
-        modules = ["web"] + modules
+        modules_set = set(controllers_per_module.keys())
+        modules_set -= set("web")
+
+        modules = ["web"] + sorted(modules_set)
+        # building all nodb methods
+        for module in modules:
+            for v in controllers_per_module[module]:
+                members = inspect.getmembers(v[1]())
+                for mk, mv in members:
+                    if inspect.ismethod(mv) and getattr(mv, 'exposed', False) and getattr(mv, 'auth', None) == "nodb":
+                        o = v[1]()
+                        if mk == "index":
+                            url = o._cp_path
+                        else:
+                            url = os.path.join(o._cp_path, mk)
+                        function = (o.get_wrapped_method(mk), mv)
+                        routing_map.add(routing.Rule(url, endpoint=function))
+                        url = os.path.join(url, "<path:path>")
+                        routing_map.add(routing.Rule(url, endpoint=function))
+
+        if not db:
+            return routing_map
+
+        registry = openerp.modules.registry.RegistryManager.get(db)
+        with registry.cursor() as cr:
+            m = registry.get('ir.module.module')
+            ids = m.search(cr, openerp.SUPERUSER_ID, [('state','=','installed')])
+            installed = set([x['name'] for x in m.read(cr, 1, ids, ['name'])])
+            modules_set -= set(installed)
+        modules = ["web"] + sorted(modules_set)
+        # building all other methods
         for module in modules:
             for v in controllers_per_module[module]:
                 o = v[1]()
                 members = inspect.getmembers(o)
                 for mk, mv in members:
-                    if inspect.ismethod(mv) and getattr(mv, 'exposed', False):
-                        auth = getattr(mv, 'auth', None)
-                        if (db is None and auth != 'nodb'):
-                            continue
+                    if inspect.ismethod(mv) and getattr(mv, 'exposed', False) and getattr(mv, 'auth', None) != "nodb":
                         if mk == "index":
                             url = o._cp_path
                         else:
@@ -811,7 +836,7 @@ class Root(object):
                 router = self.db_routers[db] = router
         return router
 
-    def find_handler(self, request):
+    def find_handler(self):
         """
         Tries to discover the controller handling the request for the path
         specified by the provided parameters

From 69ae9cc0b5fa0d0db0a72111619f6b27dfd8a68e Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Wed, 19 Jun 2013 18:16:27 +0200
Subject: [PATCH 37/54] Big refactoring to prepare even more refactoring

bzr revid: nicolas.vanhoren@openerp.com-20130619161627-543e0brldclvvw98
---
 addons/web/controllers/main.py    | 412 +++++++++++++++---------------
 addons/web/controllers/testing.py |   4 +-
 addons/web/http.py                |  94 ++++---
 3 files changed, 267 insertions(+), 243 deletions(-)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 87355d075f3..708600fdb99 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -34,9 +34,9 @@ import openerp.modules.registry
 from openerp.tools.translate import _
 
 from .. import http
-openerpweb = http
+http = http
 
-from openerp.addons.web.http import request as req, noauth, nodb
+from openerp.addons.web.http import request, nodb, noauth
 
 #----------------------------------------------------------
 # OpenERP Web helpers
@@ -87,9 +87,9 @@ def rjsmin(script):
     return result
 
 def db_list():
-    proxy = req.session.proxy("db")
+    proxy = request.session.proxy("db")
     dbs = proxy.list()
-    h = req.httprequest.environ['HTTP_HOST'].split(':')[0]
+    h = request.httprequest.environ['HTTP_HOST'].split(':')[0]
     d = h.split('.')[0]
     r = openerp.tools.config['dbfilter'].replace('%h', h).replace('%d', d)
     dbs = [i for i in dbs if re.match(r, i)]
@@ -100,7 +100,7 @@ def db_monodb_redirect():
     redirect = False
 
     # 1 try the db in the url
-    db_url = req.params.get('db')
+    db_url = request.params.get('db')
     if db_url:
         return (db_url, False)
 
@@ -111,7 +111,7 @@ def db_monodb_redirect():
         dbs = []
 
     # 2 use the database from the cookie if it's listable and still listed
-    cookie_db = req.httprequest.cookies.get('last_used_database')
+    cookie_db = request.httprequest.cookies.get('last_used_database')
     if cookie_db in dbs:
         db = cookie_db
 
@@ -121,9 +121,9 @@ def db_monodb_redirect():
 
     # redirect to the chosen db if multiple are available
     if db and len(dbs) > 1:
-        query = dict(urlparse.parse_qsl(req.httprequest.query_string, keep_blank_values=True))
+        query = dict(urlparse.parse_qsl(request.httprequest.query_string, keep_blank_values=True))
         query.update({ 'db': db })
-        redirect = req.httprequest.path + '?' + urllib.urlencode(query)
+        redirect = request.httprequest.path + '?' + urllib.urlencode(query)
     return (db, redirect)
 
 def db_monodb():
@@ -131,9 +131,9 @@ def db_monodb():
     return db_monodb_redirect()[0]
 
 def redirect_with_hash(url, code=303):
-    if req.httprequest.user_agent.browser == 'msie':
+    if request.httprequest.user_agent.browser == 'msie':
         try:
-            version = float(req.httprequest.user_agent.version)
+            version = float(request.httprequest.user_agent.version)
             if version < 10:
                 return "<html><head><script>window.location = '%s#' + location.hash;</script></head></html>" % url
         except Exception:
@@ -186,18 +186,18 @@ def module_topological_sort(modules):
 
 def module_installed():
     # Candidates module the current heuristic is the /static dir
-    loadable = openerpweb.addons_manifest.keys()
+    loadable = http.addons_manifest.keys()
     modules = {}
 
     # Retrieve database installed modules
     # TODO The following code should move to ir.module.module.list_installed_modules()
-    Modules = req.session.model('ir.module.module')
+    Modules = request.session.model('ir.module.module')
     domain = [('state','=','installed'), ('name','in', loadable)]
     for module in Modules.search_read(domain, ['name', 'dependencies_id']):
         modules[module['name']] = []
         deps = module.get('dependencies_id')
         if deps:
-            deps_read = req.session.model('ir.module.module.dependency').read(deps, ['name'])
+            deps_read = request.session.model('ir.module.module.dependency').read(deps, ['name'])
             dependencies = [i['name'] for i in deps_read]
             modules[module['name']] = dependencies
 
@@ -205,7 +205,7 @@ def module_installed():
     return sorted_modules
 
 def module_installed_bypass_session(dbname):
-    loadable = openerpweb.addons_manifest.keys()
+    loadable = http.addons_manifest.keys()
     modules = {}
     try:
         registry = openerp.modules.registry.RegistryManager.get(dbname)
@@ -231,7 +231,7 @@ def module_boot(db=None):
     serverside = []
     dbside = []
     for i in server_wide_modules:
-        if i in openerpweb.addons_manifest:
+        if i in http.addons_manifest:
             serverside.append(i)
     monodb = db or db_monodb()
     if monodb:
@@ -317,7 +317,7 @@ def manifest_glob(extension, addons=None, db=None, include_remotes=False):
         addons = addons.split(',')
     r = []
     for addon in addons:
-        manifest = openerpweb.addons_manifest.get(addon, None)
+        manifest = http.addons_manifest.get(addon, None)
         if not manifest:
             continue
         # ensure does not ends with /
@@ -338,7 +338,7 @@ def manifest_list(extension, mods=None, db=None):
     db: a database name (return all installed modules in that database)
     """
     files = manifest_glob(extension, addons=mods, db=db, include_remotes=True)
-    if not req.debug:
+    if not request.debug:
         path = '/web/webclient/' + extension
         if mods is not None:
             path += '?' + urllib.urlencode({'mods': mods})
@@ -383,28 +383,28 @@ def make_conditional(response, last_modified=None, etag=None):
         response.last_modified = last_modified
     if etag:
         response.set_etag(etag)
-    return response.make_conditional(req.httprequest)
+    return response.make_conditional(request.httprequest)
 
 def login_and_redirect(db, login, key, redirect_url='/'):
-    wsgienv = req.httprequest.environ
+    wsgienv = request.httprequest.environ
     env = dict(
-        base_location=req.httprequest.url_root.rstrip('/'),
+        base_location=request.httprequest.url_root.rstrip('/'),
         HTTP_HOST=wsgienv['HTTP_HOST'],
         REMOTE_ADDR=wsgienv['REMOTE_ADDR'],
     )
-    req.session.authenticate(db, login, key, env)
+    request.session.authenticate(db, login, key, env)
     return set_cookie_and_redirect(redirect_url)
 
 def set_cookie_and_redirect(redirect_url):
     redirect = werkzeug.utils.redirect(redirect_url, 303)
     redirect.autocorrect_location_header = False
-    cookie_val = urllib2.quote(simplejson.dumps(req.session_id))
+    cookie_val = urllib2.quote(simplejson.dumps(request.session_id))
     redirect.set_cookie('instance0|session_id', cookie_val)
     return redirect
 
 def load_actions_from_ir_values(key, key2, models, meta):
-    Values = req.session.model('ir.values')
-    actions = Values.get(key, key2, models, meta, req.context)
+    Values = request.session.model('ir.values')
+    actions = Values.get(key, key2, models, meta, request.context)
 
     return [(id, name, clean_action(action))
             for id, name, action in actions]
@@ -530,8 +530,8 @@ def xml2json_from_elementtree(el, preserve_whitespaces=False):
 def content_disposition(filename):
     filename = filename.encode('utf8')
     escaped = urllib2.quote(filename)
-    browser = req.httprequest.user_agent.browser
-    version = int((req.httprequest.user_agent.version or '0').split('.')[0])
+    browser = request.httprequest.user_agent.browser
+    version = int((request.httprequest.user_agent.version or '0').split('.')[0])
     if browser == 'msie' and version < 9:
         return "attachment; filename=%s" % escaped
     elif browser == 'safari':
@@ -570,10 +570,10 @@ html_template = """<!DOCTYPE html>
 </html>
 """
 
-class Home(openerpweb.Controller):
+class Home(http.Controller):
     _cp_path = '/'
 
-    @openerpweb.httprequest
+    @http.httprequest
     @nodb
     def index(self, s_action=None, db=None, **kw):
         db, redir = db_monodb_redirect()
@@ -591,40 +591,40 @@ class Home(openerpweb.Controller):
         }
         return r
 
-    @openerpweb.httprequest
+    @http.httprequest
     def login(self, db, login, key):
         return login_and_redirect(db, login, key)
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def jsonrpc(self, service, method, args):
         """ Method used by client APIs to contact OpenERP. """
         return openerp.netsvc.dispatch_rpc(service, method, args)
 
-class WebClient(openerpweb.Controller):
+class WebClient(http.Controller):
     _cp_path = "/web/webclient"
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def csslist(self, mods=None):
         return manifest_list('css', mods=mods)
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def jslist(self, mods=None):
         return manifest_list('js', mods=mods)
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def qweblist(self, mods=None):
         return manifest_list('qweb', mods=mods)
 
-    @openerpweb.httprequest
+    @http.httprequest
     @nodb
     def css(self, mods=None, db=None):
         files = list(manifest_glob('css', addons=mods, db=db))
         last_modified = get_last_modified(f[0] for f in files)
-        if req.httprequest.if_modified_since and req.httprequest.if_modified_since >= last_modified:
+        if request.httprequest.if_modified_since and request.httprequest.if_modified_since >= last_modified:
             return werkzeug.wrappers.Response(status=304)
 
         file_map = dict(files)
@@ -668,38 +668,38 @@ class WebClient(openerpweb.Controller):
         content = '\n'.join(matches)
 
         return make_conditional(
-            req.make_response(content, [('Content-Type', 'text/css')]),
+            request.make_response(content, [('Content-Type', 'text/css')]),
             last_modified, checksum)
 
-    @openerpweb.httprequest
+    @http.httprequest
     @nodb
     def js(self, mods=None, db=None):
         files = [f[0] for f in manifest_glob('js', addons=mods, db=db)]
         last_modified = get_last_modified(files)
-        if req.httprequest.if_modified_since and req.httprequest.if_modified_since >= last_modified:
+        if request.httprequest.if_modified_since and request.httprequest.if_modified_since >= last_modified:
             return werkzeug.wrappers.Response(status=304)
 
         content, checksum = concat_js(files)
 
         return make_conditional(
-            req.make_response(content, [('Content-Type', 'application/javascript')]),
+            request.make_response(content, [('Content-Type', 'application/javascript')]),
             last_modified, checksum)
 
-    @openerpweb.httprequest
+    @http.httprequest
     @nodb
     def qweb(self, mods=None, db=None):
         files = [f[0] for f in manifest_glob('qweb', addons=mods, db=db)]
         last_modified = get_last_modified(files)
-        if req.httprequest.if_modified_since and req.httprequest.if_modified_since >= last_modified:
+        if request.httprequest.if_modified_since and request.httprequest.if_modified_since >= last_modified:
             return werkzeug.wrappers.Response(status=304)
 
         content, checksum = concat_xml(files)
 
         return make_conditional(
-            req.make_response(content, [('Content-Type', 'text/xml')]),
+            request.make_response(content, [('Content-Type', 'text/xml')]),
             last_modified, checksum)
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def bootstrap_translations(self, mods):
         """ Load local translations from *.po files, as a temporary solution
@@ -709,12 +709,12 @@ class WebClient(openerpweb.Controller):
         # For performance reasons we only load a single translation, so for
         # sub-languages (that should only be partially translated) we load the
         # main language PO instead - that should be enough for the login screen.
-        lang = req.lang.split('_')[0]
+        lang = request.lang.split('_')[0]
 
         translations_per_module = {}
         for addon_name in mods:
-            if openerpweb.addons_manifest[addon_name].get('bootstrap'):
-                addons_path = openerpweb.addons_manifest[addon_name]['addons_path']
+            if http.addons_manifest[addon_name].get('bootstrap'):
+                addons_path = http.addons_manifest[addon_name]['addons_path']
                 f_name = os.path.join(addons_path, addon_name, "i18n", lang + ".po")
                 if not os.path.exists(f_name):
                     continue
@@ -723,9 +723,9 @@ class WebClient(openerpweb.Controller):
         return {"modules": translations_per_module,
                 "lang_parameters": None}
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def translations(self, mods, lang):
-        res_lang = req.session.model('res.lang')
+        res_lang = request.session.model('res.lang')
         ids = res_lang.search([("code", "=", lang)])
         lang_params = None
         if ids:
@@ -734,7 +734,7 @@ class WebClient(openerpweb.Controller):
 
         # Regional languages (ll_CC) must inherit/override their parent lang (ll), but this is
         # done server-side when the language is loaded, so we only need to load the user's lang.
-        ir_translation = req.session.model('ir.translation')
+        ir_translation = request.session.model('ir.translation')
         translations_per_module = {}
         messages = ir_translation.search_read([('module','in',mods),('lang','=',lang),
                                                ('comments','like','openerp-web'),('value','!=',False),
@@ -748,15 +748,15 @@ class WebClient(openerpweb.Controller):
         return {"modules": translations_per_module,
                 "lang_parameters": lang_params}
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def version_info(self):
         return openerp.service.common.exp_version()
 
-class Proxy(openerpweb.Controller):
+class Proxy(http.Controller):
     _cp_path = '/web/proxy'
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def load(self, path):
         """ Proxies an HTTP request through a JSON request.
@@ -770,37 +770,37 @@ class Proxy(openerpweb.Controller):
         from werkzeug.test import Client
         from werkzeug.wrappers import BaseResponse
 
-        return Client(req.httprequest.app, BaseResponse).get(path).data
+        return Client(request.httprequest.app, BaseResponse).get(path).data
 
-class Database(openerpweb.Controller):
+class Database(http.Controller):
     _cp_path = "/web/database"
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def get_list(self):
         return db_list()
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def create(self, fields):
         params = dict(map(operator.itemgetter('name', 'value'), fields))
-        return req.session.proxy("db").create_database(
+        return request.session.proxy("db").create_database(
             params['super_admin_pwd'],
             params['db_name'],
             bool(params.get('demo_data')),
             params['db_lang'],
             params['create_admin_pwd'])
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def duplicate(self, fields):
         params = dict(map(operator.itemgetter('name', 'value'), fields))
-        return req.session.proxy("db").duplicate_database(
+        return request.session.proxy("db").duplicate_database(
             params['super_admin_pwd'],
             params['db_original_name'],
             params['db_name'])
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def duplicate(self, fields):
         params = dict(map(operator.itemgetter('name', 'value'), fields))
@@ -810,9 +810,9 @@ class Database(openerpweb.Controller):
             params['db_name'],
         )
 
-        return req.session.proxy("db").duplicate_database(*duplicate_attrs)
+        return request.session.proxy("db").duplicate_database(*duplicate_attrs)
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def drop(self, fields):
         password, db = operator.itemgetter(
@@ -820,24 +820,24 @@ class Database(openerpweb.Controller):
                 dict(map(operator.itemgetter('name', 'value'), fields)))
 
         try:
-            return req.session.proxy("db").drop(password, db)
+            return request.session.proxy("db").drop(password, db)
         except openerp.exceptions.AccessDenied:
             return {'error': 'AccessDenied', 'title': 'Drop Database'}
         except Exception:
             return {'error': _('Could not drop database !'), 'title': _('Drop Database')}
 
-    @openerpweb.httprequest
+    @http.httprequest
     @nodb
     def backup(self, backup_db, backup_pwd, token):
         try:
             db_dump = base64.b64decode(
-                req.session.proxy("db").dump(backup_pwd, backup_db))
+                request.session.proxy("db").dump(backup_pwd, backup_db))
             filename = "%(db)s_%(timestamp)s.dump" % {
                 'db': backup_db,
                 'timestamp': datetime.datetime.utcnow().strftime(
                     "%Y-%m-%d_%H-%M-%SZ")
             }
-            return req.make_response(db_dump,
+            return request.make_response(db_dump,
                [('Content-Type', 'application/octet-stream; charset=binary'),
                ('Content-Disposition', content_disposition(filename))],
                {'fileToken': int(token)}
@@ -845,63 +845,63 @@ class Database(openerpweb.Controller):
         except Exception, e:
             return simplejson.dumps([[],[{'error': openerp.tools.ustr(e), 'title': _('Backup Database')}]])
 
-    @openerpweb.httprequest
+    @http.httprequest
     @nodb
     def restore(self, db_file, restore_pwd, new_db):
         try:
             data = base64.b64encode(db_file.read())
-            req.session.proxy("db").restore(restore_pwd, new_db, data)
+            request.session.proxy("db").restore(restore_pwd, new_db, data)
             return ''
         except openerp.exceptions.AccessDenied, e:
             raise Exception("AccessDenied")
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def change_password(self, fields):
         old_password, new_password = operator.itemgetter(
             'old_pwd', 'new_pwd')(
                 dict(map(operator.itemgetter('name', 'value'), fields)))
         try:
-            return req.session.proxy("db").change_admin_password(old_password, new_password)
+            return request.session.proxy("db").change_admin_password(old_password, new_password)
         except openerp.exceptions.AccessDenied:
             return {'error': 'AccessDenied', 'title': _('Change Password')}
         except Exception:
             return {'error': _('Error, password not changed !'), 'title': _('Change Password')}
 
-class Session(openerpweb.Controller):
+class Session(http.Controller):
     _cp_path = "/web/session"
 
     def session_info(self):
-        req.session.ensure_valid()
+        request.session.ensure_valid()
         return {
-            "session_id": req.session_id,
-            "uid": req.session._uid,
-            "user_context": req.session.get_context() if req.session._uid else {},
-            "db": req.session._db,
-            "username": req.session._login,
+            "session_id": request.session_id,
+            "uid": request.session._uid,
+            "user_context": request.session.get_context() if request.session._uid else {},
+            "db": request.session._db,
+            "username": request.session._login,
         }
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def get_session_info(self):
-        req.uid = req.session._uid
-        req.db = req.session._db
+        request.uid = request.session._uid
+        request.db = request.session._db
         return self.session_info()
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def authenticate(self, db, login, password, base_location=None):
-        wsgienv = req.httprequest.environ
+        wsgienv = request.httprequest.environ
         env = dict(
             base_location=base_location,
             HTTP_HOST=wsgienv['HTTP_HOST'],
             REMOTE_ADDR=wsgienv['REMOTE_ADDR'],
         )
-        req.session.authenticate(db, login, password, env)
+        request.session.authenticate(db, login, password, env)
 
         return self.session_info()
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def change_password (self, fields):
         old_password, new_password,confirm_password = operator.itemgetter('old_pwd', 'new_password','confirm_pwd')(
                 dict(map(operator.itemgetter('name', 'value'), fields)))
@@ -910,32 +910,32 @@ class Session(openerpweb.Controller):
         if new_password != confirm_password:
             return {'error': _('The new password and its confirmation must be identical.'),'title': _('Change Password')}
         try:
-            if req.session.model('res.users').change_password(
+            if request.session.model('res.users').change_password(
                 old_password, new_password):
                 return {'new_password':new_password}
         except Exception:
             return {'error': _('The old password you provided is incorrect, your password was not changed.'), 'title': _('Change Password')}
         return {'error': _('Error, password not changed !'), 'title': _('Change Password')}
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def sc_list(self):
-        return req.session.model('ir.ui.view_sc').get_sc(
-            req.session._uid, "ir.ui.menu", req.context)
+        return request.session.model('ir.ui.view_sc').get_sc(
+            request.session._uid, "ir.ui.menu", request.context)
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     @nodb
     def get_lang_list(self):
         try:
-            return req.session.proxy("db").list_lang() or []
+            return request.session.proxy("db").list_lang() or []
         except Exception, e:
             return {"error": e, "title": _("Languages")}
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def modules(self):
         # return all installed modules. Web client is smart enough to not load a module twice
         return module_installed()
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def save_session_action(self, the_action):
         """
         This method store an action object in the session object and returns an integer
@@ -947,10 +947,10 @@ class Session(openerpweb.Controller):
         :return: A key identifying the saved action.
         :rtype: integer
         """
-        saved_actions = req.httpsession.get('saved_actions')
+        saved_actions = request.httpsession.get('saved_actions')
         if not saved_actions:
             saved_actions = {"next":1, "actions":{}}
-            req.httpsession['saved_actions'] = saved_actions
+            request.httpsession['saved_actions'] = saved_actions
         # we don't allow more than 10 stored actions
         if len(saved_actions["actions"]) >= 10:
             del saved_actions["actions"][min(saved_actions["actions"])]
@@ -959,7 +959,7 @@ class Session(openerpweb.Controller):
         saved_actions["next"] = key + 1
         return key
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def get_session_action(self, key):
         """
         Gets back a previously saved action. This method can return None if the action
@@ -970,57 +970,57 @@ class Session(openerpweb.Controller):
         :return: The saved action or None.
         :rtype: anything
         """
-        saved_actions = req.httpsession.get('saved_actions')
+        saved_actions = request.httpsession.get('saved_actions')
         if not saved_actions:
             return None
         return saved_actions["actions"].get(key)
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def check(self):
-        req.session.assert_valid()
+        request.session.assert_valid()
         return None
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def destroy(self):
-        req.session._suicide = True
+        request.session._suicide = True
 
-class Menu(openerpweb.Controller):
+class Menu(http.Controller):
     _cp_path = "/web/menu"
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def get_user_roots(self):
         """ Return all root menu ids visible for the session user.
 
         :return: the root menu ids
         :rtype: list(int)
         """
-        s = req.session
+        s = request.session
         Menus = s.model('ir.ui.menu')
         # If a menu action is defined use its domain to get the root menu items
         user_menu_id = s.model('res.users').read([s._uid], ['menu_id'],
-                                                 req.context)[0]['menu_id']
+                                                 request.context)[0]['menu_id']
 
         menu_domain = [('parent_id', '=', False)]
         if user_menu_id:
             domain_string = s.model('ir.actions.act_window').read(
-                [user_menu_id[0]], ['domain'],req.context)[0]['domain']
+                [user_menu_id[0]], ['domain'],request.context)[0]['domain']
             if domain_string:
                 menu_domain = ast.literal_eval(domain_string)
 
-        return Menus.search(menu_domain, 0, False, False, req.context)
+        return Menus.search(menu_domain, 0, False, False, request.context)
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def load(self):
         """ Loads all menu items (all applications and their sub-menus).
 
         :return: the menu root
         :rtype: dict('children': menu_nodes)
         """
-        Menus = req.session.model('ir.ui.menu')
+        Menus = request.session.model('ir.ui.menu')
 
         fields = ['name', 'sequence', 'parent_id', 'action']
         menu_root_ids = self.get_user_roots()
-        menu_roots = Menus.read(menu_root_ids, fields, req.context) if menu_root_ids else []
+        menu_roots = Menus.read(menu_root_ids, fields, request.context) if menu_root_ids else []
         menu_root = {
             'id': False,
             'name': 'root',
@@ -1033,8 +1033,8 @@ class Menu(openerpweb.Controller):
 
         # menus are loaded fully unlike a regular tree view, cause there are a
         # limited number of items (752 when all 6.1 addons are installed)
-        menu_ids = Menus.search([('id', 'child_of', menu_root_ids)], 0, False, False, req.context)
-        menu_items = Menus.read(menu_ids, fields, req.context)
+        menu_ids = Menus.search([('id', 'child_of', menu_root_ids)], 0, False, False, request.context)
+        menu_items = Menus.read(menu_ids, fields, request.context)
         # adds roots at the end of the sequence, so that they will overwrite
         # equivalent menu items from full menu read when put into id:item
         # mapping, resulting in children being correctly set on the roots.
@@ -1060,26 +1060,26 @@ class Menu(openerpweb.Controller):
 
         return menu_root
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def load_needaction(self, menu_ids):
         """ Loads needaction counters for specific menu ids.
 
             :return: needaction data
             :rtype: dict(menu_id: {'needaction_enabled': boolean, 'needaction_counter': int})
         """
-        return req.session.model('ir.ui.menu').get_needaction_data(menu_ids, req.context)
+        return request.session.model('ir.ui.menu').get_needaction_data(menu_ids, request.context)
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def action(self, menu_id):
         # still used by web_shortcut
         actions = load_actions_from_ir_values('action', 'tree_but_open',
                                              [('ir.ui.menu', menu_id)], False)
         return {"action": actions}
 
-class DataSet(openerpweb.Controller):
+class DataSet(http.Controller):
     _cp_path = "/web/dataset"
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def search_read(self, model, fields=False, offset=0, limit=False, domain=None, sort=None):
         return self.do_search_read(model, fields, offset, limit, domain, sort)
     def do_search_read(self, model, fields=False, offset=0, limit=False, domain=None
@@ -1099,12 +1099,12 @@ class DataSet(openerpweb.Controller):
                   matching fields selection set)
         :rtype: list
         """
-        Model = req.session.model(model)
+        Model = request.session.model(model)
 
         ids = Model.search(domain, offset or 0, limit or False, sort or False,
-                           req.context)
+                           request.context)
         if limit and len(ids) == limit:
-            length = Model.search_count(domain, req.context)
+            length = Model.search_count(domain, request.context)
         else:
             length = len(ids) + (offset or 0)
         if fields and fields == ['id']:
@@ -1114,18 +1114,18 @@ class DataSet(openerpweb.Controller):
                 'records': [{'id': id} for id in ids]
             }
 
-        records = Model.read(ids, fields or False, req.context)
+        records = Model.read(ids, fields or False, request.context)
         records.sort(key=lambda obj: ids.index(obj['id']))
         return {
             'length': length,
             'records': records
         }
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def load(self, model, id, fields):
-        m = req.session.model(model)
+        m = request.session.model(model)
         value = {}
-        r = m.read([id], False, req.context)
+        r = m.read([id], False, request.context)
         if r:
             value = r[0]
         return {'value': value}
@@ -1137,36 +1137,36 @@ class DataSet(openerpweb.Controller):
         # Temporary implements future display_name special field for model#read()
         if method == 'read' and kwargs.get('context', {}).get('future_display_name'):
             if 'display_name' in args[1]:
-                names = dict(req.session.model(model).name_get(args[0], **kwargs))
+                names = dict(request.session.model(model).name_get(args[0], **kwargs))
                 args[1].remove('display_name')
-                records = req.session.model(model).read(*args, **kwargs)
+                records = request.session.model(model).read(*args, **kwargs)
                 for record in records:
                     record['display_name'] = \
                         names.get(record['id']) or "%s#%d" % (model, (record['id']))
                 return records
 
-        return getattr(req.session.model(model), method)(*args, **kwargs)
+        return getattr(request.session.model(model), method)(*args, **kwargs)
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def call(self, model, method, args, domain_id=None, context_id=None):
         return self._call_kw(model, method, args, {})
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def call_kw(self, model, method, args, kwargs):
         return self._call_kw(model, method, args, kwargs)
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def call_button(self, model, method, args, domain_id=None, context_id=None):
         action = self._call_kw(model, method, args, {})
         if isinstance(action, dict) and action.get('type') != '':
             return clean_action(action)
         return False
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def exec_workflow(self, model, id, signal):
-        return req.session.exec_workflow(model, id, signal)
+        return request.session.exec_workflow(model, id, signal)
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def resequence(self, model, ids, field='sequence', offset=0):
         """ Re-sequences a number of records in the model, by their ids
 
@@ -1181,7 +1181,7 @@ class DataSet(openerpweb.Controller):
                            starting the resequencing from an arbitrary number,
                            defaults to ``0``
         """
-        m = req.session.model(model)
+        m = request.session.model(model)
         if not m.fields_get([field]):
             return False
         # python 2.6 has no start parameter
@@ -1189,51 +1189,51 @@ class DataSet(openerpweb.Controller):
             m.write(id, { field: i + offset })
         return True
 
-class View(openerpweb.Controller):
+class View(http.Controller):
     _cp_path = "/web/view"
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def add_custom(self, view_id, arch):
-        CustomView = req.session.model('ir.ui.view.custom')
+        CustomView = request.session.model('ir.ui.view.custom')
         CustomView.create({
-            'user_id': req.session._uid,
+            'user_id': request.session._uid,
             'ref_id': view_id,
             'arch': arch
-        }, req.context)
+        }, request.context)
         return {'result': True}
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def undo_custom(self, view_id, reset=False):
-        CustomView = req.session.model('ir.ui.view.custom')
-        vcustom = CustomView.search([('user_id', '=', req.session._uid), ('ref_id' ,'=', view_id)],
-                                    0, False, False, req.context)
+        CustomView = request.session.model('ir.ui.view.custom')
+        vcustom = CustomView.search([('user_id', '=', request.session._uid), ('ref_id' ,'=', view_id)],
+                                    0, False, False, request.context)
         if vcustom:
             if reset:
-                CustomView.unlink(vcustom, req.context)
+                CustomView.unlink(vcustom, request.context)
             else:
-                CustomView.unlink([vcustom[0]], req.context)
+                CustomView.unlink([vcustom[0]], request.context)
             return {'result': True}
         return {'result': False}
 
 class TreeView(View):
     _cp_path = "/web/treeview"
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def action(self, model, id):
         return load_actions_from_ir_values(
             'action', 'tree_but_open',[(model, id)],
             False)
 
-class Binary(openerpweb.Controller):
+class Binary(http.Controller):
     _cp_path = "/web/binary"
 
-    @openerpweb.httprequest
+    @http.httprequest
     def image(self, model, id, field, **kw):
         last_update = '__last_update'
-        Model = req.session.model(model)
+        Model = request.session.model(model)
         headers = [('Content-Type', 'image/png')]
-        etag = req.httprequest.headers.get('If-None-Match')
-        hashed_session = hashlib.md5(req.session_id).hexdigest()
+        etag = request.httprequest.headers.get('If-None-Match')
+        hashed_session = hashlib.md5(request.session_id).hexdigest()
         retag = hashed_session
         id = None if not id else simplejson.loads(id)
         if type(id) is list:
@@ -1243,15 +1243,15 @@ class Binary(openerpweb.Controller):
                 if not id and hashed_session == etag:
                     return werkzeug.wrappers.Response(status=304)
                 else:
-                    date = Model.read([id], [last_update], req.context)[0].get(last_update)
+                    date = Model.read([id], [last_update], request.context)[0].get(last_update)
                     if hashlib.md5(date).hexdigest() == etag:
                         return werkzeug.wrappers.Response(status=304)
 
             if not id:
-                res = Model.default_get([field], req.context).get(field)
+                res = Model.default_get([field], request.context).get(field)
                 image_base64 = res
             else:
-                res = Model.read([id], [last_update, field], req.context)[0]
+                res = Model.read([id], [last_update, field], request.context)[0]
                 retag = hashlib.md5(res.get(last_update)).hexdigest()
                 image_base64 = res.get(field)
 
@@ -1276,13 +1276,13 @@ class Binary(openerpweb.Controller):
             headers.append(('Cache-Control', 'no-cache' if ncache == 0 else 'max-age=%s' % (ncache)))
         except:
             pass
-        return req.make_response(image_data, headers)
+        return request.make_response(image_data, headers)
 
     def placeholder(self, image='placeholder.png'):
-        addons_path = openerpweb.addons_manifest['web']['addons_path']
+        addons_path = http.addons_manifest['web']['addons_path']
         return open(os.path.join(addons_path, 'web', 'static', 'src', 'img', image), 'rb').read()
 
-    @openerpweb.httprequest
+    @http.httprequest
     def saveas(self, model, field, id=None, filename_field=None, **kw):
         """ Download link for files stored as binary fields.
 
@@ -1296,26 +1296,26 @@ class Binary(openerpweb.Controller):
         :param str filename_field: field holding the file's name, if any
         :returns: :class:`werkzeug.wrappers.Response`
         """
-        Model = req.session.model(model)
+        Model = request.session.model(model)
         fields = [field]
         if filename_field:
             fields.append(filename_field)
         if id:
-            res = Model.read([int(id)], fields, req.context)[0]
+            res = Model.read([int(id)], fields, request.context)[0]
         else:
-            res = Model.default_get(fields, req.context)
+            res = Model.default_get(fields, request.context)
         filecontent = base64.b64decode(res.get(field, ''))
         if not filecontent:
-            return req.not_found()
+            return request.not_found()
         else:
             filename = '%s_%s' % (model.replace('.', '_'), id)
             if filename_field:
                 filename = res.get(filename_field, '') or filename
-            return req.make_response(filecontent,
+            return request.make_response(filecontent,
                 [('Content-Type', 'application/octet-stream'),
                  ('Content-Disposition', content_disposition(filename))])
 
-    @openerpweb.httprequest
+    @http.httprequest
     def saveas_ajax(self, data, token):
         jdata = simplejson.loads(data)
         model = jdata['model']
@@ -1325,7 +1325,7 @@ class Binary(openerpweb.Controller):
         filename_field = jdata.get('filename_field', None)
         context = jdata.get('context', {})
 
-        Model = req.session.model(model)
+        Model = request.session.model(model)
         fields = [field]
         if filename_field:
             fields.append(filename_field)
@@ -1343,12 +1343,12 @@ class Binary(openerpweb.Controller):
             filename = '%s_%s' % (model.replace('.', '_'), id)
             if filename_field:
                 filename = res.get(filename_field, '') or filename
-            return req.make_response(filecontent,
+            return request.make_response(filecontent,
                 headers=[('Content-Type', 'application/octet-stream'),
                         ('Content-Disposition', content_disposition(filename))],
                 cookies={'fileToken': int(token)})
 
-    @openerpweb.httprequest
+    @http.httprequest
     def upload(self, callback, ufile):
         # TODO: might be useful to have a configuration flag for max-length file uploads
         out = """<script language="javascript" type="text/javascript">
@@ -1363,9 +1363,9 @@ class Binary(openerpweb.Controller):
             args = [False, e.message]
         return out % (simplejson.dumps(callback), simplejson.dumps(args))
 
-    @openerpweb.httprequest
+    @http.httprequest
     def upload_attachment(self, callback, model, id, ufile):
-        Model = req.session.model('ir.attachment')
+        Model = request.session.model('ir.attachment')
         out = """<script language="javascript" type="text/javascript">
                     var win = window.top.window;
                     win.jQuery(win).trigger(%s, %s);
@@ -1377,7 +1377,7 @@ class Binary(openerpweb.Controller):
                 'datas_fname': ufile.filename,
                 'res_model': model,
                 'res_id': int(id)
-            }, req.context)
+            }, request.context)
             args = {
                 'filename': ufile.filename,
                 'id':  attachment_id
@@ -1386,14 +1386,14 @@ class Binary(openerpweb.Controller):
             args = {'error': "Something horrible happened"}
         return out % (simplejson.dumps(callback), simplejson.dumps(args))
 
-    @openerpweb.httprequest
+    @http.httprequest
     @nodb
     def company_logo(self, dbname=None):
         # TODO add etag, refactor to use /image code for etag
         uid = None
-        if req.session._db:
-            dbname = req.session._db
-            uid = req.session._uid
+        if request.session._db:
+            dbname = request.session._db
+            uid = request.session._uid
         elif dbname is None:
             dbname = db_monodb()
 
@@ -1425,50 +1425,50 @@ class Binary(openerpweb.Controller):
             ('Content-Type', 'image/png'),
             ('Content-Length', len(image_data)),
         ]
-        return req.make_response(image_data, headers)
+        return request.make_response(image_data, headers)
 
-class Action(openerpweb.Controller):
+class Action(http.Controller):
     _cp_path = "/web/action"
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def load(self, action_id, do_not_eval=False):
-        Actions = req.session.model('ir.actions.actions')
+        Actions = request.session.model('ir.actions.actions')
         value = False
         try:
             action_id = int(action_id)
         except ValueError:
             try:
                 module, xmlid = action_id.split('.', 1)
-                model, action_id = req.session.model('ir.model.data').get_object_reference(module, xmlid)
+                model, action_id = request.session.model('ir.model.data').get_object_reference(module, xmlid)
                 assert model.startswith('ir.actions.')
             except Exception:
                 action_id = 0   # force failed read
 
-        base_action = Actions.read([action_id], ['type'], req.context)
+        base_action = Actions.read([action_id], ['type'], request.context)
         if base_action:
             ctx = {}
             action_type = base_action[0]['type']
             if action_type == 'ir.actions.report.xml':
                 ctx.update({'bin_size': True})
-            ctx.update(req.context)
-            action = req.session.model(action_type).read([action_id], False, ctx)
+            ctx.update(request.context)
+            action = request.session.model(action_type).read([action_id], False, ctx)
             if action:
                 value = clean_action(action[0])
         return value
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def run(self, action_id):
-        return_action = req.session.model('ir.actions.server').run(
-            [action_id], req.context)
+        return_action = request.session.model('ir.actions.server').run(
+            [action_id], request.context)
         if return_action:
             return clean_action(return_action)
         else:
             return False
 
-class Export(openerpweb.Controller):
+class Export(http.Controller):
     _cp_path = "/web/export"
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def formats(self):
         """ Returns all valid export formats
 
@@ -1477,17 +1477,17 @@ class Export(openerpweb.Controller):
         """
         return sorted([
             controller.fmt
-            for controller in openerpweb.controllers_object.itervalues()
+            for controller in http.controllers_object.itervalues()
             if (controller._cp_path or "").startswith(self._cp_path)
             if hasattr(controller, 'fmt')
         ], key=operator.itemgetter("label"))
 
     def fields_get(self, model):
-        Model = req.session.model(model)
-        fields = Model.fields_get(False, req.context)
+        Model = request.session.model(model)
+        fields = Model.fields_get(False, request.context)
         return fields
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def get_fields(self, model, prefix='', parent_name= '',
                    import_compat=True, parent_field_type=None,
                    exclude=None):
@@ -1536,11 +1536,11 @@ class Export(openerpweb.Controller):
 
         return records
 
-    @openerpweb.jsonrequest
+    @http.jsonrequest
     def namelist(self, model, export_id):
         # TODO: namelist really has no reason to be in Python (although itertools.groupby helps)
-        export = req.session.model("ir.exports").read([export_id])[0]
-        export_fields_list = req.session.model("ir.exports.line").read(
+        export = request.session.model("ir.exports").read([export_id])[0]
+        export_fields_list = request.session.model("ir.exports.line").read(
             export['export_fields'])
 
         fields_data = self.fields_info(
@@ -1629,18 +1629,18 @@ class ExportFormat(object):
         """
         raise NotImplementedError()
 
-    @openerpweb.httprequest
+    @http.httprequest
     def index(self, data, token):
         model, fields, ids, domain, import_compat = \
             operator.itemgetter('model', 'fields', 'ids', 'domain',
                                 'import_compat')(
                 simplejson.loads(data))
 
-        Model = req.session.model(model)
-        ids = ids or Model.search(domain, 0, False, False, req.context)
+        Model = request.session.model(model)
+        ids = ids or Model.search(domain, 0, False, False, request.context)
 
         field_names = map(operator.itemgetter('name'), fields)
-        import_data = Model.export_data(ids, field_names, req.context).get('datas',[])
+        import_data = Model.export_data(ids, field_names, request.context).get('datas',[])
 
         if import_compat:
             columns_headers = field_names
@@ -1648,7 +1648,7 @@ class ExportFormat(object):
             columns_headers = [val['label'].strip() for val in fields]
 
 
-        return req.make_response(self.from_data(columns_headers, import_data),
+        return request.make_response(self.from_data(columns_headers, import_data),
             headers=[('Content-Disposition',
                             content_disposition(self.filename(model))),
                      ('Content-Type', self.content_type)],
@@ -1728,7 +1728,7 @@ class ExcelExport(ExportFormat, http.Controller):
         fp.close()
         return data
 
-class Reports(openerpweb.Controller):
+class Reports(http.Controller):
     _cp_path = "/web/report"
     POLLING_DELAY = 0.25
     TYPES_MAPPING = {
@@ -1740,12 +1740,12 @@ class Reports(openerpweb.Controller):
         'xls': 'application/vnd.ms-excel',
     }
 
-    @openerpweb.httprequest
+    @http.httprequest
     def index(self, action, token):
         action = simplejson.loads(action)
 
-        report_srv = req.session.proxy("report")
-        context = dict(req.context)
+        report_srv = request.session.proxy("report")
+        context = dict(request.context)
         context.update(action["context"])
 
         report_data = {}
@@ -1758,14 +1758,14 @@ class Reports(openerpweb.Controller):
             report_data.update(action['datas'])
 
         report_id = report_srv.report(
-            req.session._db, req.session._uid, req.session._password,
+            request.session._db, request.session._uid, request.session._password,
             action["report_name"], report_ids,
             report_data, context)
 
         report_struct = None
         while True:
             report_struct = report_srv.report_get(
-                req.session._db, req.session._uid, req.session._password, report_id)
+                request.session._db, request.session._uid, request.session._password, report_id)
             if report_struct["state"]:
                 break
 
@@ -1778,7 +1778,7 @@ class Reports(openerpweb.Controller):
             report_struct['format'], 'octet-stream')
         file_name = action.get('name', 'report')
         if 'name' not in action:
-            reports = req.session.model('ir.actions.report.xml')
+            reports = request.session.model('ir.actions.report.xml')
             res_id = reports.search([('report_name', '=', action['report_name']),],
                                     0, False, False, context)
             if len(res_id) > 0:
@@ -1787,7 +1787,7 @@ class Reports(openerpweb.Controller):
                 file_name = action['report_name']
         file_name = '%s.%s' % (file_name, report_struct['format'])
 
-        return req.make_response(report,
+        return request.make_response(report,
              headers=[
                  ('Content-Disposition', content_disposition(file_name)),
                  ('Content-Type', report_mimetype),
diff --git a/addons/web/controllers/testing.py b/addons/web/controllers/testing.py
index 8b89ab8ac9d..5e156dc410e 100644
--- a/addons/web/controllers/testing.py
+++ b/addons/web/controllers/testing.py
@@ -86,10 +86,8 @@ TESTING = Template(u"""<!DOCTYPE html>
 """, default_filters=['h'])
 
 class TestRunnerController(http.Controller):
-    _cp_path = '/web/tests'
 
-    @http.httprequest
-    @http.nodb
+    @http.route('/web/tests', type='http', authentication="nodb")
     def index(self, req, mod=None, **kwargs):
         ms = module.get_modules()
         manifests = dict(
diff --git a/addons/web/http.py b/addons/web/http.py
index 4f89dbf10bb..61a6a4e1250 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -88,12 +88,12 @@ class WebRequest(object):
     .. attribute:: db
 
         ``str``, the name of the database linked to the current request. Can be ``None``
-        if the current request uses the @nodb decorator.
+        if the current request uses the ``nodb`` authentication.
 
     .. attribute:: uid
 
         ``int``, the id of the user related to the current request. Can be ``None``
-        if the current request uses the @nodb or the @noauth decorator.
+        if the current request uses the ``nodb`` or the ``noauth`` authenticatoin.
     """
     def __init__(self, httprequest):
         self.httprequest = httprequest
@@ -171,14 +171,14 @@ class WebRequest(object):
     def registry(self):
         """
         The registry to the database linked to this request. Can be ``None`` if the current request uses the
-        @nodb decorator.
+        ``nodb'' authentication.
         """
         return openerp.modules.registry.RegistryManager.get(self.db) if self.db else None
 
     @property
     def cr(self):
         """
-        The cursor initialized for the current method call. If the current request uses the @nodb decorator
+        The cursor initialized for the current method call. If the current request uses the ``nodb`` authentication
         trying to access this property will raise an exception.
         """
         # some magic to lazy create the cr
@@ -211,22 +211,43 @@ class WebRequest(object):
             self.db = None
             self.uid = None
 
-
-def noauth(f):
+def route(route, type="http", authentication="auth"):
     """
+    Decorator marking the decorated method as being a handler for requests. The method must be part of a subclass
+    of ``Controller``.
+
     Decorator to put on a controller method to inform it does not require a user to be logged. When this decorator
     is used, ``request.uid`` will be ``None``. The request will still try to detect the database and an exception
     will be launched if there is no way to guess it.
+
+    :param route: string or array. The route part that will determine which http requests will match the decorated
+    method. Can be a single string or an array of strings. See werkzeug's routing documentation for the format of
+    route expression ( http://werkzeug.pocoo.org/docs/routing/ ).
+    :param type: The type of request, can be ``'http'`` or ``'json'``.
+    :param authentication: The type of authentication method, can on of the following:
+
+        * ``auth``: The user must be authenticated.
+        * ``noauth``: There is no need for the user to be authenticated but there must be a way to find the current
+        database.
+        * ``nodb``: The method is always active, even if there is no database. Mainly used by the framework and
+        authentication modules.
     """
+    def decorator(f):
+        if isinstance(route, list):
+            f.routes = route
+        else:
+            f.routes = [route]
+        f.exposed = type
+        if getattr(f, "auth", None) is None:
+            f.auth = authentication
+        return f
+    return decorator
+
+def noauth(f):
     f.auth = "noauth"
     return f
 
 def nodb(f):
-    """
-    Decorator to put on a controller method to inform it does not require authentication nor any link to a database.
-    When this decorator is used, ``request.uid`` and ``request.db`` will be ``None``. Trying to use ``request.cr``
-    will launch an exception.
-    """
     f.auth = "nodb"
     return f
 
@@ -398,8 +419,11 @@ def jsonrequest(f):
     the ``session_id``, ``context`` and ``debug`` keys (which are stripped out
     beforehand)
     """
-    f.exposed = 'json'
-    return f
+    f.combine = True
+    base = f.__name__
+    if f.__name__ == "index":
+        base = ""
+    return route([base, os.path.join(base, "<path:path>")], type="json", authentication="auth")(f)
 
 class HttpRequest(WebRequest):
     """ Regular GET/POST request
@@ -478,8 +502,11 @@ def httprequest(f):
     merged in the same dictionary), apart from the ``session_id``, ``context``
     and ``debug`` keys (which are stripped out beforehand)
     """
-    f.exposed = 'http'
-    return f
+    f.combine = True
+    base = f.__name__
+    if f.__name__ == "index":
+        base = ""
+    return route([base, os.path.join(base, "<path:path>")], type="http", authentication="auth")(f)
 
 #----------------------------------------------------------
 # Local storage of requests
@@ -526,8 +553,7 @@ class ControllerType(type):
         # store the controller in the controllers list
         name_class = ("%s.%s" % (cls.__module__, cls.__name__), cls)
         class_path = name_class[0].split(".")
-        path = attrs.get('_cp_path')
-        if not path or not class_path[:2] == ["openerp", "addons"]:
+        if not class_path[:2] == ["openerp", "addons"]:
             return
         module = class_path[2]
         controllers_per_module.setdefault(module, []).append(name_class)
@@ -535,13 +561,13 @@ class ControllerType(type):
 class Controller(object):
     __metaclass__ = ControllerType
 
-    def __new__(cls, *args, **kwargs):
-        subclasses = [c for c in cls.__subclasses__() if c._cp_path == cls._cp_path]
+    """def __new__(cls, *args, **kwargs):
+        subclasses = [c for c in cls.__subclasses__() if getattr(c, "_cp_path", None) == getattr(cls, "_cp_path", None)]
         if subclasses:
             name = "%s (extended by %s)" % (cls.__name__, ', '.join(sub.__name__ for sub in subclasses))
             cls = type(name, tuple(reversed(subclasses)), {})
 
-        return object.__new__(cls)
+        return object.__new__(cls)"""
 
     def get_wrapped_method(self, name):
         if name in self.__class__._methods_wrapper:
@@ -791,14 +817,14 @@ class Root(object):
                 for mk, mv in members:
                     if inspect.ismethod(mv) and getattr(mv, 'exposed', False) and getattr(mv, 'auth', None) == "nodb":
                         o = v[1]()
-                        if mk == "index":
-                            url = o._cp_path
-                        else:
-                            url = os.path.join(o._cp_path, mk)
                         function = (o.get_wrapped_method(mk), mv)
-                        routing_map.add(routing.Rule(url, endpoint=function))
-                        url = os.path.join(url, "<path:path>")
-                        routing_map.add(routing.Rule(url, endpoint=function))
+                        for url in mv.routes:
+                            if getattr(mv, "combine", False):
+                                url = os.path.join(o._cp_path, url)
+                                if url.endswith("/") and len(url) > 1:
+                                    url = url[: -1]
+                            print "<<<<<<<<<<<<<<<< nodb", url
+                            routing_map.add(routing.Rule(url, endpoint=function))
 
         if not db:
             return routing_map
@@ -817,14 +843,14 @@ class Root(object):
                 members = inspect.getmembers(o)
                 for mk, mv in members:
                     if inspect.ismethod(mv) and getattr(mv, 'exposed', False) and getattr(mv, 'auth', None) != "nodb":
-                        if mk == "index":
-                            url = o._cp_path
-                        else:
-                            url = os.path.join(o._cp_path, mk)
                         function = (o.get_wrapped_method(mk), mv)
-                        routing_map.add(routing.Rule(url, endpoint=function))
-                        url = os.path.join(url, "<path:path>")
-                        routing_map.add(routing.Rule(url, endpoint=function))
+                        for url in mv.routes:
+                            if getattr(mv, "combine", False):
+                                url = os.path.join(o._cp_path, url)
+                                if url.endswith("/") and len(url) > 1:
+                                    url = url[: -1]
+                            print "<<<<<<<<<<<<<<<< db", url
+                            routing_map.add(routing.Rule(url, endpoint=function))
         return routing_map
 
     def get_db_router(self, db):

From 5a2c7af2971cff5857af90ba961a894f3a98aad6 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Wed, 19 Jun 2013 18:59:57 +0200
Subject: [PATCH 38/54] Refactored main.py

bzr revid: nicolas.vanhoren@openerp.com-20130619165957-nw7eb80c7gqqcj7v
---
 addons/web/controllers/main.py | 180 +++++++++++++--------------------
 addons/web/http.py             |  16 ++-
 2 files changed, 75 insertions(+), 121 deletions(-)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 708600fdb99..b67ddaf2bd0 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -36,7 +36,7 @@ from openerp.tools.translate import _
 from .. import http
 http = http
 
-from openerp.addons.web.http import request, nodb, noauth
+from openerp.addons.web.http import request
 
 #----------------------------------------------------------
 # OpenERP Web helpers
@@ -571,10 +571,8 @@ html_template = """<!DOCTYPE html>
 """
 
 class Home(http.Controller):
-    _cp_path = '/'
 
-    @http.httprequest
-    @nodb
+    @http.route('/', type='http', authentication="nodb")
     def index(self, s_action=None, db=None, **kw):
         db, redir = db_monodb_redirect()
         if redir:
@@ -591,36 +589,30 @@ class Home(http.Controller):
         }
         return r
 
-    @http.httprequest
+    @http.route('/login', type='http', authentication="auth")
     def login(self, db, login, key):
         return login_and_redirect(db, login, key)
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/jsonrpc', type='json', authentication="nodb")
     def jsonrpc(self, service, method, args):
         """ Method used by client APIs to contact OpenERP. """
         return openerp.netsvc.dispatch_rpc(service, method, args)
 
 class WebClient(http.Controller):
-    _cp_path = "/web/webclient"
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/webclient/csslist', type='json', authentication="nodb")
     def csslist(self, mods=None):
         return manifest_list('css', mods=mods)
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/webclient/jslist', type='json', authentication="nodb")
     def jslist(self, mods=None):
         return manifest_list('js', mods=mods)
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/webclient/qweblist', type='json', authentication="nodb")
     def qweblist(self, mods=None):
         return manifest_list('qweb', mods=mods)
 
-    @http.httprequest
-    @nodb
+    @http.route('/web/webclient/css', type='http', authentication="nodb")
     def css(self, mods=None, db=None):
         files = list(manifest_glob('css', addons=mods, db=db))
         last_modified = get_last_modified(f[0] for f in files)
@@ -671,8 +663,7 @@ class WebClient(http.Controller):
             request.make_response(content, [('Content-Type', 'text/css')]),
             last_modified, checksum)
 
-    @http.httprequest
-    @nodb
+    @http.route('/web/webclient/js', type='http', authentication="nodb")
     def js(self, mods=None, db=None):
         files = [f[0] for f in manifest_glob('js', addons=mods, db=db)]
         last_modified = get_last_modified(files)
@@ -685,8 +676,7 @@ class WebClient(http.Controller):
             request.make_response(content, [('Content-Type', 'application/javascript')]),
             last_modified, checksum)
 
-    @http.httprequest
-    @nodb
+    @http.route('/web/webclient/qweb', type='http', authentication="nodb")
     def qweb(self, mods=None, db=None):
         files = [f[0] for f in manifest_glob('qweb', addons=mods, db=db)]
         last_modified = get_last_modified(files)
@@ -699,8 +689,7 @@ class WebClient(http.Controller):
             request.make_response(content, [('Content-Type', 'text/xml')]),
             last_modified, checksum)
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/webclient/bootstrap_translations', type='json', authentication="nodb")
     def bootstrap_translations(self, mods):
         """ Load local translations from *.po files, as a temporary solution
             until we have established a valid session. This is meant only
@@ -723,7 +712,7 @@ class WebClient(http.Controller):
         return {"modules": translations_per_module,
                 "lang_parameters": None}
 
-    @http.jsonrequest
+    @http.route('/web/webclient/translations', type='json', authentication="auth")
     def translations(self, mods, lang):
         res_lang = request.session.model('res.lang')
         ids = res_lang.search([("code", "=", lang)])
@@ -748,16 +737,13 @@ class WebClient(http.Controller):
         return {"modules": translations_per_module,
                 "lang_parameters": lang_params}
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/webclient/version_info', type='json', authentication="nodb")
     def version_info(self):
         return openerp.service.common.exp_version()
 
 class Proxy(http.Controller):
-    _cp_path = '/web/proxy'
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/proxy/load', type='json', authentication="nodb")
     def load(self, path):
         """ Proxies an HTTP request through a JSON request.
 
@@ -773,15 +759,12 @@ class Proxy(http.Controller):
         return Client(request.httprequest.app, BaseResponse).get(path).data
 
 class Database(http.Controller):
-    _cp_path = "/web/database"
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/database/get_list', type='json', authentication="nodb")
     def get_list(self):
         return db_list()
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/database/create', type='json', authentication="nodb")
     def create(self, fields):
         params = dict(map(operator.itemgetter('name', 'value'), fields))
         return request.session.proxy("db").create_database(
@@ -791,17 +774,7 @@ class Database(http.Controller):
             params['db_lang'],
             params['create_admin_pwd'])
 
-    @http.jsonrequest
-    @nodb
-    def duplicate(self, fields):
-        params = dict(map(operator.itemgetter('name', 'value'), fields))
-        return request.session.proxy("db").duplicate_database(
-            params['super_admin_pwd'],
-            params['db_original_name'],
-            params['db_name'])
-
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/database/duplicate', type='json', authentication="nodb")
     def duplicate(self, fields):
         params = dict(map(operator.itemgetter('name', 'value'), fields))
         duplicate_attrs = (
@@ -812,8 +785,7 @@ class Database(http.Controller):
 
         return request.session.proxy("db").duplicate_database(*duplicate_attrs)
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/database/drop', type='json', authentication="nodb")
     def drop(self, fields):
         password, db = operator.itemgetter(
             'drop_pwd', 'drop_db')(
@@ -826,8 +798,7 @@ class Database(http.Controller):
         except Exception:
             return {'error': _('Could not drop database !'), 'title': _('Drop Database')}
 
-    @http.httprequest
-    @nodb
+    @http.route('/web/database/backup', type='http', authentication="nodb")
     def backup(self, backup_db, backup_pwd, token):
         try:
             db_dump = base64.b64decode(
@@ -845,8 +816,7 @@ class Database(http.Controller):
         except Exception, e:
             return simplejson.dumps([[],[{'error': openerp.tools.ustr(e), 'title': _('Backup Database')}]])
 
-    @http.httprequest
-    @nodb
+    @http.route('/web/database/restore', type='http', authentication="nodb")
     def restore(self, db_file, restore_pwd, new_db):
         try:
             data = base64.b64encode(db_file.read())
@@ -855,8 +825,7 @@ class Database(http.Controller):
         except openerp.exceptions.AccessDenied, e:
             raise Exception("AccessDenied")
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/database/change_password', type='json', authentication="nodb")
     def change_password(self, fields):
         old_password, new_password = operator.itemgetter(
             'old_pwd', 'new_pwd')(
@@ -869,7 +838,6 @@ class Database(http.Controller):
             return {'error': _('Error, password not changed !'), 'title': _('Change Password')}
 
 class Session(http.Controller):
-    _cp_path = "/web/session"
 
     def session_info(self):
         request.session.ensure_valid()
@@ -881,15 +849,13 @@ class Session(http.Controller):
             "username": request.session._login,
         }
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/session/get_session_info', type='json', authentication="nodb")
     def get_session_info(self):
         request.uid = request.session._uid
         request.db = request.session._db
         return self.session_info()
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/session/authenticate', type='json', authentication="nodb")
     def authenticate(self, db, login, password, base_location=None):
         wsgienv = request.httprequest.environ
         env = dict(
@@ -901,8 +867,8 @@ class Session(http.Controller):
 
         return self.session_info()
 
-    @http.jsonrequest
-    def change_password (self, fields):
+    @http.route('/web/session/change_password', type='json', authentication="auth")
+    def change_password(self, fields):
         old_password, new_password,confirm_password = operator.itemgetter('old_pwd', 'new_password','confirm_pwd')(
                 dict(map(operator.itemgetter('name', 'value'), fields)))
         if not (old_password.strip() and new_password.strip() and confirm_password.strip()):
@@ -917,25 +883,24 @@ class Session(http.Controller):
             return {'error': _('The old password you provided is incorrect, your password was not changed.'), 'title': _('Change Password')}
         return {'error': _('Error, password not changed !'), 'title': _('Change Password')}
 
-    @http.jsonrequest
+    @http.route('/web/session/sc_list', type='json', authentication="auth")
     def sc_list(self):
         return request.session.model('ir.ui.view_sc').get_sc(
             request.session._uid, "ir.ui.menu", request.context)
 
-    @http.jsonrequest
-    @nodb
+    @http.route('/web/session/get_lang_list', type='json', authentication="nodb")
     def get_lang_list(self):
         try:
             return request.session.proxy("db").list_lang() or []
         except Exception, e:
             return {"error": e, "title": _("Languages")}
 
-    @http.jsonrequest
+    @http.route('/web/session/modules', type='json', authentication="auth")
     def modules(self):
         # return all installed modules. Web client is smart enough to not load a module twice
         return module_installed()
 
-    @http.jsonrequest
+    @http.route('/web/session/save_session_action', type='json', authentication="auth")
     def save_session_action(self, the_action):
         """
         This method store an action object in the session object and returns an integer
@@ -959,7 +924,7 @@ class Session(http.Controller):
         saved_actions["next"] = key + 1
         return key
 
-    @http.jsonrequest
+    @http.route('/web/session/get_session_action', type='json', authentication="auth")
     def get_session_action(self, key):
         """
         Gets back a previously saved action. This method can return None if the action
@@ -975,19 +940,18 @@ class Session(http.Controller):
             return None
         return saved_actions["actions"].get(key)
 
-    @http.jsonrequest
+    @http.route('/web/session/check', type='json', authentication="auth")
     def check(self):
         request.session.assert_valid()
         return None
 
-    @http.jsonrequest
+    @http.route('/web/session/destroy', type='json', authentication="auth")
     def destroy(self):
         request.session._suicide = True
 
 class Menu(http.Controller):
-    _cp_path = "/web/menu"
 
-    @http.jsonrequest
+    @http.route('/web/menu/get_user_roots', type='json', authentication="auth")
     def get_user_roots(self):
         """ Return all root menu ids visible for the session user.
 
@@ -1009,7 +973,7 @@ class Menu(http.Controller):
 
         return Menus.search(menu_domain, 0, False, False, request.context)
 
-    @http.jsonrequest
+    @http.route('/web/menu/load', type='json', authentication="auth")
     def load(self):
         """ Loads all menu items (all applications and their sub-menus).
 
@@ -1060,7 +1024,7 @@ class Menu(http.Controller):
 
         return menu_root
 
-    @http.jsonrequest
+    @http.route('/web/menu/load_needaction', type='json', authentication="auth")
     def load_needaction(self, menu_ids):
         """ Loads needaction counters for specific menu ids.
 
@@ -1069,7 +1033,7 @@ class Menu(http.Controller):
         """
         return request.session.model('ir.ui.menu').get_needaction_data(menu_ids, request.context)
 
-    @http.jsonrequest
+    @http.route('/web/menu/action', type='json', authentication="auth")
     def action(self, menu_id):
         # still used by web_shortcut
         actions = load_actions_from_ir_values('action', 'tree_but_open',
@@ -1077,9 +1041,8 @@ class Menu(http.Controller):
         return {"action": actions}
 
 class DataSet(http.Controller):
-    _cp_path = "/web/dataset"
 
-    @http.jsonrequest
+    @http.route('/web/dataset/search_read', type='json', authentication="auth")
     def search_read(self, model, fields=False, offset=0, limit=False, domain=None, sort=None):
         return self.do_search_read(model, fields, offset, limit, domain, sort)
     def do_search_read(self, model, fields=False, offset=0, limit=False, domain=None
@@ -1121,7 +1084,7 @@ class DataSet(http.Controller):
             'records': records
         }
 
-    @http.jsonrequest
+    @http.route('/web/dataset/load', type='json', authentication="auth")
     def load(self, model, id, fields):
         m = request.session.model(model)
         value = {}
@@ -1147,26 +1110,26 @@ class DataSet(http.Controller):
 
         return getattr(request.session.model(model), method)(*args, **kwargs)
 
-    @http.jsonrequest
+    @http.route('/web/dataset/call', type='json', authentication="auth")
     def call(self, model, method, args, domain_id=None, context_id=None):
         return self._call_kw(model, method, args, {})
 
-    @http.jsonrequest
+    @http.route(['/web/dataset/call_kw', '/web/dataset/call_kw/<path:path>'], type='json', authentication="auth")
     def call_kw(self, model, method, args, kwargs):
         return self._call_kw(model, method, args, kwargs)
 
-    @http.jsonrequest
+    @http.route('/web/dataset/call_button', type='json', authentication="auth")
     def call_button(self, model, method, args, domain_id=None, context_id=None):
         action = self._call_kw(model, method, args, {})
         if isinstance(action, dict) and action.get('type') != '':
             return clean_action(action)
         return False
 
-    @http.jsonrequest
+    @http.route('/web/dataset/exec_workflow', type='json', authentication="auth")
     def exec_workflow(self, model, id, signal):
         return request.session.exec_workflow(model, id, signal)
 
-    @http.jsonrequest
+    @http.route('/web/dataset/resequence', type='json', authentication="auth")
     def resequence(self, model, ids, field='sequence', offset=0):
         """ Re-sequences a number of records in the model, by their ids
 
@@ -1190,9 +1153,8 @@ class DataSet(http.Controller):
         return True
 
 class View(http.Controller):
-    _cp_path = "/web/view"
 
-    @http.jsonrequest
+    @http.route('/web/view/add_custom', type='json', authentication="auth")
     def add_custom(self, view_id, arch):
         CustomView = request.session.model('ir.ui.view.custom')
         CustomView.create({
@@ -1202,7 +1164,7 @@ class View(http.Controller):
         }, request.context)
         return {'result': True}
 
-    @http.jsonrequest
+    @http.route('/web/view/undo_custom', type='json', authentication="auth")
     def undo_custom(self, view_id, reset=False):
         CustomView = request.session.model('ir.ui.view.custom')
         vcustom = CustomView.search([('user_id', '=', request.session._uid), ('ref_id' ,'=', view_id)],
@@ -1216,18 +1178,16 @@ class View(http.Controller):
         return {'result': False}
 
 class TreeView(View):
-    _cp_path = "/web/treeview"
 
-    @http.jsonrequest
+    @http.route('/web/treeview/action', type='json', authentication="auth")
     def action(self, model, id):
         return load_actions_from_ir_values(
             'action', 'tree_but_open',[(model, id)],
             False)
 
 class Binary(http.Controller):
-    _cp_path = "/web/binary"
 
-    @http.httprequest
+    @http.route('/web/binary/image', type='http', authentication="auth")
     def image(self, model, id, field, **kw):
         last_update = '__last_update'
         Model = request.session.model(model)
@@ -1282,7 +1242,7 @@ class Binary(http.Controller):
         addons_path = http.addons_manifest['web']['addons_path']
         return open(os.path.join(addons_path, 'web', 'static', 'src', 'img', image), 'rb').read()
 
-    @http.httprequest
+    @http.route('/web/binary/saveas', type='http', authentication="auth")
     def saveas(self, model, field, id=None, filename_field=None, **kw):
         """ Download link for files stored as binary fields.
 
@@ -1315,7 +1275,7 @@ class Binary(http.Controller):
                 [('Content-Type', 'application/octet-stream'),
                  ('Content-Disposition', content_disposition(filename))])
 
-    @http.httprequest
+    @http.route('/web/binary/saveas_ajax', type='http', authentication="auth")
     def saveas_ajax(self, data, token):
         jdata = simplejson.loads(data)
         model = jdata['model']
@@ -1348,7 +1308,7 @@ class Binary(http.Controller):
                         ('Content-Disposition', content_disposition(filename))],
                 cookies={'fileToken': int(token)})
 
-    @http.httprequest
+    @http.route('/web/binary/upload', type='http', authentication="auth")
     def upload(self, callback, ufile):
         # TODO: might be useful to have a configuration flag for max-length file uploads
         out = """<script language="javascript" type="text/javascript">
@@ -1363,7 +1323,7 @@ class Binary(http.Controller):
             args = [False, e.message]
         return out % (simplejson.dumps(callback), simplejson.dumps(args))
 
-    @http.httprequest
+    @http.route('/web/binary/upload_attachment', type='http', authentication="auth")
     def upload_attachment(self, callback, model, id, ufile):
         Model = request.session.model('ir.attachment')
         out = """<script language="javascript" type="text/javascript">
@@ -1386,8 +1346,7 @@ class Binary(http.Controller):
             args = {'error': "Something horrible happened"}
         return out % (simplejson.dumps(callback), simplejson.dumps(args))
 
-    @http.httprequest
-    @nodb
+    @http.route('/web/binary/company_logo', type='http', authentication="nodb")
     def company_logo(self, dbname=None):
         # TODO add etag, refactor to use /image code for etag
         uid = None
@@ -1428,9 +1387,8 @@ class Binary(http.Controller):
         return request.make_response(image_data, headers)
 
 class Action(http.Controller):
-    _cp_path = "/web/action"
 
-    @http.jsonrequest
+    @http.route('/web/action/load', type='json', authentication="auth")
     def load(self, action_id, do_not_eval=False):
         Actions = request.session.model('ir.actions.actions')
         value = False
@@ -1456,7 +1414,7 @@ class Action(http.Controller):
                 value = clean_action(action[0])
         return value
 
-    @http.jsonrequest
+    @http.route('/web/action/run', type='json', authentication="auth")
     def run(self, action_id):
         return_action = request.session.model('ir.actions.server').run(
             [action_id], request.context)
@@ -1466,28 +1424,22 @@ class Action(http.Controller):
             return False
 
 class Export(http.Controller):
-    _cp_path = "/web/export"
 
-    @http.jsonrequest
+    @http.route('/web/export/formats', type='json', authentication="auth")
     def formats(self):
         """ Returns all valid export formats
 
         :returns: for each export format, a pair of identifier and printable name
         :rtype: [(str, str)]
         """
-        return sorted([
-            controller.fmt
-            for controller in http.controllers_object.itervalues()
-            if (controller._cp_path or "").startswith(self._cp_path)
-            if hasattr(controller, 'fmt')
-        ], key=operator.itemgetter("label"))
+        return ["CSV", "Excel"]
 
     def fields_get(self, model):
         Model = request.session.model(model)
         fields = Model.fields_get(False, request.context)
         return fields
 
-    @http.jsonrequest
+    @http.route('/web/export/get_fields', type='json', authentication="auth")
     def get_fields(self, model, prefix='', parent_name= '',
                    import_compat=True, parent_field_type=None,
                    exclude=None):
@@ -1536,7 +1488,7 @@ class Export(http.Controller):
 
         return records
 
-    @http.jsonrequest
+    @http.route('/web/export/namelist', type='json', authentication="auth")
     def namelist(self, model, export_id):
         # TODO: namelist really has no reason to be in Python (although itertools.groupby helps)
         export = request.session.model("ir.exports").read([export_id])[0]
@@ -1629,8 +1581,7 @@ class ExportFormat(object):
         """
         raise NotImplementedError()
 
-    @http.httprequest
-    def index(self, data, token):
+    def base(self, data, token):
         model, fields, ids, domain, import_compat = \
             operator.itemgetter('model', 'fields', 'ids', 'domain',
                                 'import_compat')(
@@ -1655,9 +1606,12 @@ class ExportFormat(object):
             cookies={'fileToken': int(token)})
 
 class CSVExport(ExportFormat, http.Controller):
-    _cp_path = '/web/export/csv'
     fmt = {'tag': 'csv', 'label': 'CSV'}
 
+    @http.route('/web/export/csv', type='http', authentication="auth")
+    def index(self, data, token):
+        return self.base(data, token)
+
     @property
     def content_type(self):
         return 'text/csv;charset=utf8'
@@ -1690,13 +1644,16 @@ class CSVExport(ExportFormat, http.Controller):
         return data
 
 class ExcelExport(ExportFormat, http.Controller):
-    _cp_path = '/web/export/xls'
     fmt = {
         'tag': 'xls',
         'label': 'Excel',
         'error': None if xlwt else "XLWT required"
     }
 
+    @http.route('/web/export/xls', type='http', authentication="auth")
+    def index(self, data, token):
+        return self.base(data, token)
+
     @property
     def content_type(self):
         return 'application/vnd.ms-excel'
@@ -1729,7 +1686,6 @@ class ExcelExport(ExportFormat, http.Controller):
         return data
 
 class Reports(http.Controller):
-    _cp_path = "/web/report"
     POLLING_DELAY = 0.25
     TYPES_MAPPING = {
         'doc': 'application/vnd.ms-word',
@@ -1740,7 +1696,7 @@ class Reports(http.Controller):
         'xls': 'application/vnd.ms-excel',
     }
 
-    @http.httprequest
+    @http.route('/web/report', type='http', authentication="auth")
     def index(self, action, token):
         action = simplejson.loads(action)
 
diff --git a/addons/web/http.py b/addons/web/http.py
index 61a6a4e1250..8809921bbda 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -232,6 +232,8 @@ def route(route, type="http", authentication="auth"):
         * ``nodb``: The method is always active, even if there is no database. Mainly used by the framework and
         authentication modules.
     """
+    assert type in ["http", "json"]
+    assert authentication in ["auth", "noauth", "nodb"]
     def decorator(f):
         if isinstance(route, list):
             f.routes = route
@@ -243,14 +245,6 @@ def route(route, type="http", authentication="auth"):
         return f
     return decorator
 
-def noauth(f):
-    f.auth = "noauth"
-    return f
-
-def nodb(f):
-    f.auth = "nodb"
-    return f
-
 def reject_nonliteral(dct):
     if '__ref' in dct:
         raise ValueError(
@@ -873,7 +867,11 @@ class Root(object):
         """
         path = request.httprequest.path
         urls = self.get_db_router(request.db).bind("")
-        func, original = urls.match(path)[0]
+        try:
+            func, original = urls.match(path)[0]
+        except:
+            _logger.exception("Routing error for url %s" % path)
+            raise
 
         request.func = func
         request.auth_method = getattr(original, "auth", "auth")

From 7e4e72f01cf3354340bfacedba80a46f19edd7cc Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 20 Jun 2013 12:00:50 +0200
Subject: [PATCH 39/54] removed prints

bzr revid: nicolas.vanhoren@openerp.com-20130620100050-nr3nh1b05ttt72ae
---
 addons/web/http.py | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 8809921bbda..83e1560501b 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -817,7 +817,6 @@ class Root(object):
                                 url = os.path.join(o._cp_path, url)
                                 if url.endswith("/") and len(url) > 1:
                                     url = url[: -1]
-                            print "<<<<<<<<<<<<<<<< nodb", url
                             routing_map.add(routing.Rule(url, endpoint=function))
 
         if not db:
@@ -843,7 +842,6 @@ class Root(object):
                                 url = os.path.join(o._cp_path, url)
                                 if url.endswith("/") and len(url) > 1:
                                     url = url[: -1]
-                            print "<<<<<<<<<<<<<<<< db", url
                             routing_map.add(routing.Rule(url, endpoint=function))
         return routing_map
 
@@ -867,11 +865,7 @@ class Root(object):
         """
         path = request.httprequest.path
         urls = self.get_db_router(request.db).bind("")
-        try:
-            func, original = urls.match(path)[0]
-        except:
-            _logger.exception("Routing error for url %s" % path)
-            raise
+        func, original = urls.match(path)[0]
 
         request.func = func
         request.auth_method = getattr(original, "auth", "auth")

From 027f77a3cecc0a6e6b37caf1e881a03122173bea Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 20 Jun 2013 13:28:57 +0200
Subject: [PATCH 40/54] doc

bzr revid: nicolas.vanhoren@openerp.com-20130620112857-knwne19buizfheen
---
 addons/web/doc/web_controllers.rst | 46 +++++++++++-------------------
 1 file changed, 16 insertions(+), 30 deletions(-)

diff --git a/addons/web/doc/web_controllers.rst b/addons/web/doc/web_controllers.rst
index 8938f0adbb8..3f30f55b8c0 100644
--- a/addons/web/doc/web_controllers.rst
+++ b/addons/web/doc/web_controllers.rst
@@ -47,55 +47,42 @@ In your controllers file, you can now declare a controller this way:
 ::
 
     class MyController(http.Controller):
-        _cp_path = '/my_url'
 
-        @http.httprequest
+        @http.route('/my_url/some_html', type="html")
         def some_html(self):
             return "<h1>This is a test</h1>"
 
-        @http.jsonrequest
+        @http.route('/my_url/some_json', type="json")
         def some_json(self):
             return {"sample_dictionary": "This is a sample JSON dictionary"}
 
-A controller must inherit from ``http.Controller``. When defining a controller, you must define the url it will match.
-This is the ``_cp_path`` class attribute.
-
-Each time you define a method with ``@http.httprequest`` or ``@http.jsonrequest`` it defines a new part of url to
-match. As example, the ``some_html()`` method will be called a client query the ``/my_url/some_html`` url.
-
-If you want to match precisely the ``/my_url`` url, you must a define a method called ``index``. This is an exception
-compared to other methods:
-
-::
-
-    @http.httprequest
-    def index(self):
-        return "<div>This is the /my_url</div>"
+A controller must inherit from ``http.Controller``. Each time you define a method with ``@http.route()`` it defines a
+url to match. As example, the ``some_html()`` method will be called a client query the ``/my_url/some_html`` url.
 
 Pure HTTP Requests
 ------------------
 
-You can define methods to get any requests using the ``@http.httprequest`` decorator. When doing so, you get the
-HTTP parameters as named parameters of the method:
+You can define methods to get any normal http requests by passing ``'html'`` to the ``type`` argument of
+``http.route()``. When doing so, you get the HTTP parameters as named parameters of the method:
 
 ::
 
-    @http.httprequest
+    @http.route('/say_hello', type="html")
     def say_hello(self, name):
         return "<h1>Hello %s</h1>" % name
 
-This url could be contacted by typing this url in a browser: ``http://localhost:8069/my_url/say_hello?name=Nicolas``.
+This url could be contacted by typing this url in a browser: ``http://localhost:8069/say_hello?name=Nicolas``.
 
 JSON Requests
 -------------
 
-The ``@http.jsonrequest`` decorator is used to define JSON requests. The OpenERP Javascript client can contact these
-methods using the JSON-RPC protocol. JSON methods must return JSON. Like the HTTP methods they receive arguments
-as named parameters (except these arguments are JSON-RPC parameters).
+Methods that received JSON can be defined by passing ``'json'`` to the ``type`` argument of ``http.route()``. The
+OpenERP Javascript client can contact these methods using the JSON-RPC protocol. JSON methods must return JSON. Like the
+HTTP methods they receive arguments as named parameters (except these arguments are JSON-RPC parameters).
 
 ::
 
-    @http.jsonrequest
+    @http.route('/division', type="json")
     def division(self, i, j):
         return i / j # returns a number
 
@@ -106,7 +93,7 @@ To use the database you must access the OpenERP models. The global ``request`` o
 
 ::
 
-    @http.httprequest
+    @http.route('/my_name', type="html")
     def my_name(self):
         my_user_record = request.registry.get("res.users").browse(request.cr, request.uid, request.uid)
         return "<h1>Your name is %s</h1>" % my_user_record.name
@@ -124,13 +111,12 @@ Authorization Levels
 --------------------
 
 By default, all methods can only be used by users logged into OpenERP (OpenERP uses cookies to track logged users).
-There are some cases when you need to enable not-logged in users to access some methods. To do so, add the
-``http.noauth`` decorator to your method:
+There are some cases when you need to enable not-logged in users to access some methods. To do so, add the ``'noauth'``
+value to the ``authentication`` parameter of ``http.route()``:
 
 ::
 
-    @http.httprequest
-    @http.noauth
+    @http.route('/hello', type="html", authentication="noauth")
     def hello(self):
         return "<div>Hello unknown user!</div>"
 

From 4119d7ce9963244a7a3e02e223461599d0f2fe03 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 20 Jun 2013 14:10:26 +0200
Subject: [PATCH 41/54] Added werkzeug's arguments

bzr revid: nicolas.vanhoren@openerp.com-20130620121026-btc06m36x9jg1ok0
---
 addons/web/controllers/main.py |  2 +-
 addons/web/http.py             | 14 ++++++++++----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index b67ddaf2bd0..16efea06f13 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -1115,7 +1115,7 @@ class DataSet(http.Controller):
         return self._call_kw(model, method, args, {})
 
     @http.route(['/web/dataset/call_kw', '/web/dataset/call_kw/<path:path>'], type='json', authentication="auth")
-    def call_kw(self, model, method, args, kwargs):
+    def call_kw(self, model, method, args, kwargs, path=None):
         return self._call_kw(model, method, args, kwargs)
 
     @http.route('/web/dataset/call_button', type='json', authentication="auth")
diff --git a/addons/web/http.py b/addons/web/http.py
index 83e1560501b..beac395c8a1 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -417,7 +417,7 @@ def jsonrequest(f):
     base = f.__name__
     if f.__name__ == "index":
         base = ""
-    return route([base, os.path.join(base, "<path:path>")], type="json", authentication="auth")(f)
+    return route([base, os.path.join(base, "<path:_ignored_path>")], type="json", authentication="auth")(f)
 
 class HttpRequest(WebRequest):
     """ Regular GET/POST request
@@ -500,7 +500,7 @@ def httprequest(f):
     base = f.__name__
     if f.__name__ == "index":
         base = ""
-    return route([base, os.path.join(base, "<path:path>")], type="http", authentication="auth")(f)
+    return route([base, os.path.join(base, "<path:_ignored_path>")], type="http", authentication="auth")(f)
 
 #----------------------------------------------------------
 # Local storage of requests
@@ -865,9 +865,15 @@ class Root(object):
         """
         path = request.httprequest.path
         urls = self.get_db_router(request.db).bind("")
-        func, original = urls.match(path)[0]
+        matched, arguments = urls.match(path)
+        arguments = dict([(k, v) for k, v in arguments.items() if not k.startswith("_ignored_")])
+        func, original = matched
 
-        request.func = func
+        def nfunc(*args, **kwargs):
+            kwargs.update(arguments)
+            return func(*args, **kwargs)
+
+        request.func = nfunc
         request.auth_method = getattr(original, "auth", "auth")
         request.func_request_type = original.exposed
 

From 0867b705347595b0fb58b1ff1cdf8c36c99c5ae2 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 20 Jun 2013 14:18:58 +0200
Subject: [PATCH 42/54] Added doc

bzr revid: nicolas.vanhoren@openerp.com-20130620121858-mwu5t9t4oxv1w7tw
---
 addons/web/doc/web_controllers.rst | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/addons/web/doc/web_controllers.rst b/addons/web/doc/web_controllers.rst
index 3f30f55b8c0..34655b99674 100644
--- a/addons/web/doc/web_controllers.rst
+++ b/addons/web/doc/web_controllers.rst
@@ -86,6 +86,30 @@ HTTP methods they receive arguments as named parameters (except these arguments
     def division(self, i, j):
         return i / j # returns a number
 
+URL Patterns
+------------
+
+Any URL passed to ``http.route()`` can contain patterns. Example:
+
+::
+
+    @http.route('/files/<path:file_path>', type="html")
+    def files(self, file_path):
+        ... # return a file identified by the path store in the 'my_path' variable
+
+When such patterns are used, the method will received additional parameters that correspond to the parameters defined in
+the url. For exact documentation about url patterns, see Werkzeug's documentation:
+http://werkzeug.pocoo.org/docs/routing/ .
+
+Also note you can pass multiple urls to ``http.route()``:
+
+
+::
+
+    @http.route(['/files/<path:file_path>', '/other_url/<path:file_path>'], type="html")
+    def files(self, file_path):
+        ...
+
 Contacting Models
 -----------------
 

From 09f5b819274efdd772606daa1fae7a2a215045a6 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 20 Jun 2013 14:48:05 +0200
Subject: [PATCH 43/54] Fixed some bug

bzr revid: nicolas.vanhoren@openerp.com-20130620124805-pvvylxc4z8yl0sp2
---
 addons/web/http.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index beac395c8a1..de3fb1386e6 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -827,7 +827,7 @@ class Root(object):
             m = registry.get('ir.module.module')
             ids = m.search(cr, openerp.SUPERUSER_ID, [('state','=','installed')])
             installed = set([x['name'] for x in m.read(cr, 1, ids, ['name'])])
-            modules_set -= set(installed)
+            modules_set = modules_set.intersection(set(installed))
         modules = ["web"] + sorted(modules_set)
         # building all other methods
         for module in modules:

From 00528bc4f91e99e07f89a21ee9c40460f23b9a43 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 20 Jun 2013 18:19:45 +0200
Subject: [PATCH 44/54] Re-created magic inheritance of controllers

bzr revid: nicolas.vanhoren@openerp.com-20130620161945-r8a93itijdrc3ut0
---
 addons/web/http.py | 71 ++++++++++++++++++++++------------------------
 1 file changed, 34 insertions(+), 37 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index de3fb1386e6..b42a7d7d0eb 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -549,20 +549,17 @@ class ControllerType(type):
         class_path = name_class[0].split(".")
         if not class_path[:2] == ["openerp", "addons"]:
             return
+        # we want to know all modules that have controllers
         module = class_path[2]
+        controllers_per_module.setdefault(module, [])
+        # but we only store controllers directly inheriting from Controller
+        if not "Controller" in globals() or not Controller in bases:
+            return
         controllers_per_module.setdefault(module, []).append(name_class)
 
 class Controller(object):
     __metaclass__ = ControllerType
 
-    """def __new__(cls, *args, **kwargs):
-        subclasses = [c for c in cls.__subclasses__() if getattr(c, "_cp_path", None) == getattr(cls, "_cp_path", None)]
-        if subclasses:
-            name = "%s (extended by %s)" % (cls.__name__, ', '.join(sub.__name__ for sub in subclasses))
-            cls = type(name, tuple(reversed(subclasses)), {})
-
-        return object.__new__(cls)"""
-
     def get_wrapped_method(self, name):
         if name in self.__class__._methods_wrapper:
             return functools.partial(self.__class__._methods_wrapper[name], self)
@@ -800,25 +797,36 @@ class Root(object):
     def _build_router(self, db):
         _logger.info("Generating routing configuration for database %s" % db)
         routing_map = routing.Map()
+
+        def gen(modules, nodb_only):
+            for module in modules:
+                for v in controllers_per_module[module]:
+                    cls = v[1]
+
+                    subclasses = cls.__subclasses__()
+                    subclasses = [c for c in subclasses if c.__module__.split(".")[:2] == ["openerp", "addons"] and \
+                        cls.__module__.split(".")[2] in modules]
+                    if subclasses:
+                        name = "%s (extended by %s)" % (cls.__name__, ', '.join(sub.__name__ for sub in subclasses))
+                        cls = type(name, tuple(reversed(subclasses)), {})
+
+                    o = cls()
+                    members = inspect.getmembers(o)
+                    for mk, mv in members:
+                        if inspect.ismethod(mv) and getattr(mv, 'exposed', False) and \
+                                nodb_only == (getattr(mv, 'auth', None) == "nodb"):
+                            function = (o.get_wrapped_method(mk), mv)
+                            for url in mv.routes:
+                                if getattr(mv, "combine", False):
+                                    url = os.path.join(o._cp_path, url)
+                                    if url.endswith("/") and len(url) > 1:
+                                        url = url[: -1]
+                                routing_map.add(routing.Rule(url, endpoint=function))
+
         modules_set = set(controllers_per_module.keys())
         modules_set -= set("web")
-
-        modules = ["web"] + sorted(modules_set)
         # building all nodb methods
-        for module in modules:
-            for v in controllers_per_module[module]:
-                members = inspect.getmembers(v[1]())
-                for mk, mv in members:
-                    if inspect.ismethod(mv) and getattr(mv, 'exposed', False) and getattr(mv, 'auth', None) == "nodb":
-                        o = v[1]()
-                        function = (o.get_wrapped_method(mk), mv)
-                        for url in mv.routes:
-                            if getattr(mv, "combine", False):
-                                url = os.path.join(o._cp_path, url)
-                                if url.endswith("/") and len(url) > 1:
-                                    url = url[: -1]
-                            routing_map.add(routing.Rule(url, endpoint=function))
-
+        gen(["web"] + sorted(modules_set), True)
         if not db:
             return routing_map
 
@@ -830,19 +838,8 @@ class Root(object):
             modules_set = modules_set.intersection(set(installed))
         modules = ["web"] + sorted(modules_set)
         # building all other methods
-        for module in modules:
-            for v in controllers_per_module[module]:
-                o = v[1]()
-                members = inspect.getmembers(o)
-                for mk, mv in members:
-                    if inspect.ismethod(mv) and getattr(mv, 'exposed', False) and getattr(mv, 'auth', None) != "nodb":
-                        function = (o.get_wrapped_method(mk), mv)
-                        for url in mv.routes:
-                            if getattr(mv, "combine", False):
-                                url = os.path.join(o._cp_path, url)
-                                if url.endswith("/") and len(url) > 1:
-                                    url = url[: -1]
-                            routing_map.add(routing.Rule(url, endpoint=function))
+        gen(["web"] + sorted(modules_set), False)
+
         return routing_map
 
     def get_db_router(self, db):

From 73c447f843e76f5499abee4f980b3422511244ba Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Thu, 20 Jun 2013 18:51:58 +0200
Subject: [PATCH 45/54] added doc and corrected existing one

bzr revid: nicolas.vanhoren@openerp.com-20130620165158-554jlc1cn7acgrua
---
 addons/web/doc/web_controllers.rst | 32 +++++++++++++++++++++++-------
 1 file changed, 25 insertions(+), 7 deletions(-)

diff --git a/addons/web/doc/web_controllers.rst b/addons/web/doc/web_controllers.rst
index 34655b99674..c35bd66eef4 100644
--- a/addons/web/doc/web_controllers.rst
+++ b/addons/web/doc/web_controllers.rst
@@ -48,7 +48,7 @@ In your controllers file, you can now declare a controller this way:
 
     class MyController(http.Controller):
 
-        @http.route('/my_url/some_html', type="html")
+        @http.route('/my_url/some_html', type="http")
         def some_html(self):
             return "<h1>This is a test</h1>"
 
@@ -62,12 +62,12 @@ url to match. As example, the ``some_html()`` method will be called a client que
 Pure HTTP Requests
 ------------------
 
-You can define methods to get any normal http requests by passing ``'html'`` to the ``type`` argument of
+You can define methods to get any normal http requests by passing ``'http'`` to the ``type`` argument of
 ``http.route()``. When doing so, you get the HTTP parameters as named parameters of the method:
 
 ::
 
-    @http.route('/say_hello', type="html")
+    @http.route('/say_hello', type="http")
     def say_hello(self, name):
         return "<h1>Hello %s</h1>" % name
 
@@ -93,7 +93,7 @@ Any URL passed to ``http.route()`` can contain patterns. Example:
 
 ::
 
-    @http.route('/files/<path:file_path>', type="html")
+    @http.route('/files/<path:file_path>', type="http")
     def files(self, file_path):
         ... # return a file identified by the path store in the 'my_path' variable
 
@@ -106,7 +106,7 @@ Also note you can pass multiple urls to ``http.route()``:
 
 ::
 
-    @http.route(['/files/<path:file_path>', '/other_url/<path:file_path>'], type="html")
+    @http.route(['/files/<path:file_path>', '/other_url/<path:file_path>'], type="http")
     def files(self, file_path):
         ...
 
@@ -117,7 +117,7 @@ To use the database you must access the OpenERP models. The global ``request`` o
 
 ::
 
-    @http.route('/my_name', type="html")
+    @http.route('/my_name', type="http")
     def my_name(self):
         my_user_record = request.registry.get("res.users").browse(request.cr, request.uid, request.uid)
         return "<h1>Your name is %s</h1>" % my_user_record.name
@@ -140,9 +140,27 @@ value to the ``authentication`` parameter of ``http.route()``:
 
 ::
 
-    @http.route('/hello', type="html", authentication="noauth")
+    @http.route('/hello', type="http", authentication="noauth")
     def hello(self):
         return "<div>Hello unknown user!</div>"
 
 Please note the ``request.uid`` user id will be ``None`` inside this method call. This is due to the fact no user was
 authenticated.
+
+Overriding Controllers
+----------------------
+
+Existing routes can be overridden. To do so, create a controller that inherit the controller containing the route you
+want to override. Example that redefine the home page of your OpenERP application.
+
+::
+
+    import openerp.addons.web.controllers.main as main
+
+    class Home2(main.Home):
+        @http.route('/', type="http", authentication="noauth")
+        def index(self):
+            return "<div>This is my new home page.</div>"
+
+By re-defining the ``index()`` method, you change the behavior of the original ``Home`` class. Now the ``'/'`` route
+will match the new ``index()`` method in ``Home2``.

From 275b103855b92f831cec2d9ffa19c3941bddca3b Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 21 Jun 2013 12:15:26 +0200
Subject: [PATCH 46/54] changed some doc

bzr revid: nicolas.vanhoren@openerp.com-20130621101526-pf85k7iikv0eh8dz
---
 addons/web/session.py | 33 ++++++++++++++++++---------------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/addons/web/session.py b/addons/web/session.py
index aaa712fdedd..948cd4c4ad0 100644
--- a/addons/web/session.py
+++ b/addons/web/session.py
@@ -23,7 +23,8 @@ class SessionExpiredException(Exception):
 
 class Service(object):
     """
-        Deprecated. Use ``openerp.netsvc.dispatch_rpc()`` instead.
+        .. deprecated:: 8.0
+        Use ``openerp.netsvc.dispatch_rpc()`` instead.
     """
     def __init__(self, session, service_name):
         self.session = session
@@ -37,7 +38,8 @@ class Service(object):
 
 class Model(object):
     """
-        Deprecated. Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+        .. deprecated:: 8.0
+        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
     """
     def __init__(self, session, model):
         self.session = session
@@ -67,12 +69,6 @@ class Model(object):
             return result
         return proxy
 
-    def search_read(self, domain=None, fields=None, offset=0, limit=None, order=None, context=None):
-        record_ids = self.search(domain or [], offset, limit or False, order or False, context or {})
-        if not record_ids: return []
-        records = self.read(record_ids, fields or [], context or {})
-        return records
-
 class OpenERPSession(object):
     """
     An OpenERP RPC session, a given user can own multiple such sessions
@@ -163,19 +159,22 @@ class OpenERPSession(object):
 
     def send(self, service_name, method, *args):
         """
-        Deprecated. Use ``openerp.netsvc.dispatch_rpc()`` instead.
+        .. deprecated:: 8.0
+        Use ``openerp.netsvc.dispatch_rpc()`` instead.
         """
         return openerp.netsvc.dispatch_rpc(service_name, method, args)
 
     def proxy(self, service):
         """
-        Deprecated. Use ``openerp.netsvc.dispatch_rpc()`` instead.
+        .. deprecated:: 8.0
+        Use ``openerp.netsvc.dispatch_rpc()`` instead.
         """
         return Service(self, service)
 
     def assert_valid(self, force=False):
         """
-        Deprecated. Use ``check_security()`` instead.
+        .. deprecated:: 8.0
+        Use ``check_security()`` instead.
 
         Ensures this session is valid (logged into the openerp server)
         """
@@ -188,7 +187,8 @@ class OpenERPSession(object):
 
     def ensure_valid(self):
         """
-        Deprecated. Use ``check_security()`` instead.
+        .. deprecated:: 8.0
+        Use ``check_security()`` instead.
         """
         if self._uid:
             try:
@@ -198,7 +198,8 @@ class OpenERPSession(object):
 
     def execute(self, model, func, *l, **d):
         """
-        Deprecated. Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+        .. deprecated:: 8.0
+        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
         """
         model = self.model(model)
         r = getattr(model, func)(*l, **d)
@@ -206,7 +207,8 @@ class OpenERPSession(object):
 
     def exec_workflow(self, model, id, signal):
         """
-        Deprecated. Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+        .. deprecated:: 8.0
+        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
         """
         self.assert_valid()
         r = self.proxy('object').exec_workflow(self._db, self._uid, self._password, model, signal, id)
@@ -214,7 +216,8 @@ class OpenERPSession(object):
 
     def model(self, model):
         """
-        Deprecated. Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+        .. deprecated:: 8.0
+        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
 
         Get an RPC proxy for the object ``model``, bound to this session.
 

From c90e8119bb2f4e51f21fa2cb8ca633d5ddd8fb05 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 21 Jun 2013 13:44:24 +0200
Subject: [PATCH 47/54] Put session.py in http.py

bzr revid: nicolas.vanhoren@openerp.com-20130621114424-s0nd8orv5ej05pwv
---
 addons/web/http.py    | 235 ++++++++++++++++++++++++++++++++++++++++--
 addons/web/session.py | 233 -----------------------------------------
 2 files changed, 226 insertions(+), 242 deletions(-)
 delete mode 100644 addons/web/session.py

diff --git a/addons/web/http.py b/addons/web/http.py
index b42a7d7d0eb..83a3ac4fa42 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -34,8 +34,6 @@ import urllib2
 
 import openerp
 
-import session
-
 import inspect
 import functools
 
@@ -119,7 +117,7 @@ class WebRequest(object):
                 self.session_id = uuid.uuid4().hex
         self.session = self.httpsession.get(self.session_id)
         if not self.session:
-            self.session = session.OpenERPSession()
+            self.session = OpenERPSession()
             self.httpsession[self.session_id] = self.session
 
         with set_request(self):
@@ -157,13 +155,13 @@ class WebRequest(object):
         elif self.auth_method == "noauth":
             self.db = (self.session._db or openerp.addons.web.controllers.main.db_monodb()).lower()
             if not self.db:
-                raise session.SessionExpiredException("No valid database for request %s" % self.httprequest)
+                raise SessionExpiredException("No valid database for request %s" % self.httprequest)
             self.uid = None
         else: # auth
             try:
                 self.session.check_security()
-            except session.SessionExpiredException, e:
-                raise session.SessionExpiredException("Session expired for request %s" % self.httprequest)
+            except SessionExpiredException, e:
+                raise SessionExpiredException("Session expired for request %s" % self.httprequest)
             self.db = self.session._db
             self.uid = self.session._uid
 
@@ -337,7 +335,7 @@ class JsonRequest(WebRequest):
             #    _logger.debug("--> %s.%s\n%s", func.im_class.__name__, func.__name__, pprint.pformat(self.jsonrequest))
             response['id'] = self.jsonrequest.get('id')
             response["result"] = self._call_function(**self.params)
-        except session.AuthenticationError, e:
+        except AuthenticationError, e:
             _logger.exception("Exception during JSON request handling.")
             se = serialize_exception(e)
             error = {
@@ -566,6 +564,225 @@ class Controller(object):
         else:
             return getattr(self, name)
 
+#############################
+# OpenERP Sessions          #
+#############################
+
+class AuthenticationError(Exception):
+    pass
+
+class SessionExpiredException(Exception):
+    pass
+
+class Service(object):
+    """
+        .. deprecated:: 8.0
+        Use ``openerp.netsvc.dispatch_rpc()`` instead.
+    """
+    def __init__(self, session, service_name):
+        self.session = session
+        self.service_name = service_name
+
+    def __getattr__(self, method):
+        def proxy_method(*args):
+            result = openerp.netsvc.dispatch_rpc(self.service_name, method, args)
+            return result
+        return proxy_method
+
+class Model(object):
+    """
+        .. deprecated:: 8.0
+        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+    """
+    def __init__(self, session, model):
+        self.session = session
+        self.model = model
+        self.proxy = self.session.proxy('object')
+
+    def __getattr__(self, method):
+        self.session.assert_valid()
+        def proxy(*args, **kw):
+            # Can't provide any retro-compatibility for this case, so we check it and raise an Exception
+            # to tell the programmer to adapt his code
+            if not http.request.db or not http.request.uid or self.session._db != http.request.db \
+                or self.session._uid != http.request.uid:
+                raise Exception("Trying to use Model with badly configured database or user.")
+                
+            mod = http.request.registry.get(self.model)
+            meth = getattr(mod, method)
+            cr = http.request.cr
+            result = meth(cr, http.request.uid, *args, **kw)
+            # reorder read
+            if method == "read":
+                if isinstance(result, list) and len(result) > 0 and "id" in result[0]:
+                    index = {}
+                    for r in result:
+                        index[r['id']] = r
+                    result = [index[x] for x in args[0] if x in index]
+            return result
+        return proxy
+
+class OpenERPSession(object):
+    """
+    An OpenERP RPC session, a given user can own multiple such sessions
+    in a web session.
+
+    .. attribute:: context
+
+        The session context, a ``dict``. Can be reloaded by calling
+        :meth:`openerpweb.openerpweb.OpenERPSession.get_context`
+
+    .. attribute:: domains_store
+
+        A ``dict`` matching domain keys to evaluable (but non-literal) domains.
+
+        Used to store references to non-literal domains which need to be
+        round-tripped to the client browser.
+    """
+    def __init__(self):
+        self._creation_time = time.time()
+        self._db = False
+        self._uid = False
+        self._login = False
+        self._password = False
+        self._suicide = False
+        self.context = {}
+        self.jsonp_requests = {}     # FIXME use a LRU
+
+    def authenticate(self, db, login, password, env=None):
+        """
+        Authenticate the current user with the given db, login and password. If successful, store
+        the authentication parameters in the current session and request.
+        """
+        uid = openerp.netsvc.dispatch_rpc('common', 'authenticate', [db, login, password, env])
+        self._db = db
+        self._uid = uid
+        self._login = login
+        self._password = password
+        http.request.db = db
+        http.request.uid = uid
+
+        if uid: self.get_context()
+        return uid
+
+    def check_security(self):
+        """
+        Chech the current authentication parameters to know if those are still valid. This method
+        should be called at each request. If the authentication fails, a ``SessionExpiredException``
+        is raised.
+        """
+        if not self._db or not self._uid:
+            raise SessionExpiredException("Session expired")
+        import openerp.service.security as security
+        security.check(self._db, self._uid, self._password)
+
+    def get_context(self):
+        """
+        Re-initializes the current user's session context (based on
+        his preferences) by calling res.users.get_context() with the old
+        context.
+
+        :returns: the new context
+        """
+        assert self._uid, "The user needs to be logged-in to initialize his context"
+        self.context = http.request.registry.get('res.users').context_get(http.request.cr, http.request.uid) or {}
+        self.context['uid'] = self._uid
+        self._fix_lang(self.context)
+        return self.context
+
+    def _fix_lang(self, context):
+        """ OpenERP provides languages which may not make sense and/or may not
+        be understood by the web client's libraries.
+
+        Fix those here.
+
+        :param dict context: context to fix
+        """
+        lang = context['lang']
+
+        # inane OpenERP locale
+        if lang == 'ar_AR':
+            lang = 'ar'
+
+        # lang to lang_REGION (datejs only handles lang_REGION, no bare langs)
+        if lang in babel.core.LOCALE_ALIASES:
+            lang = babel.core.LOCALE_ALIASES[lang]
+
+        context['lang'] = lang or 'en_US'
+
+    def send(self, service_name, method, *args):
+        """
+        .. deprecated:: 8.0
+        Use ``openerp.netsvc.dispatch_rpc()`` instead.
+        """
+        return openerp.netsvc.dispatch_rpc(service_name, method, args)
+
+    def proxy(self, service):
+        """
+        .. deprecated:: 8.0
+        Use ``openerp.netsvc.dispatch_rpc()`` instead.
+        """
+        return Service(self, service)
+
+    def assert_valid(self, force=False):
+        """
+        .. deprecated:: 8.0
+        Use ``check_security()`` instead.
+
+        Ensures this session is valid (logged into the openerp server)
+        """
+        if self._uid and not force:
+            return
+        # TODO use authenticate instead of login
+        self._uid = self.proxy("common").login(self._db, self._login, self._password)
+        if not self._uid:
+            raise AuthenticationError("Authentication failure")
+
+    def ensure_valid(self):
+        """
+        .. deprecated:: 8.0
+        Use ``check_security()`` instead.
+        """
+        if self._uid:
+            try:
+                self.assert_valid(True)
+            except Exception:
+                self._uid = None
+
+    def execute(self, model, func, *l, **d):
+        """
+        .. deprecated:: 8.0
+        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+        """
+        model = self.model(model)
+        r = getattr(model, func)(*l, **d)
+        return r
+
+    def exec_workflow(self, model, id, signal):
+        """
+        .. deprecated:: 8.0
+        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+        """
+        self.assert_valid()
+        r = self.proxy('object').exec_workflow(self._db, self._uid, self._password, model, signal, id)
+        return r
+
+    def model(self, model):
+        """
+        .. deprecated:: 8.0
+        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+
+        Get an RPC proxy for the object ``model``, bound to this session.
+
+        :param model: an OpenERP model name
+        :type model: str
+        :rtype: a model object
+        """
+        if self._db == False:
+            raise SessionExpiredException("Session expired")
+
+        return Model(self, model)
+
 #----------------------------------------------------------
 # Session context manager
 #----------------------------------------------------------
@@ -584,7 +801,7 @@ def session_context(request, session_store, session_lock, sid):
         # session id, and are generally noise
         removed_sessions = set()
         for key, value in request.session.items():
-            if not isinstance(value, session.OpenERPSession):
+            if not isinstance(value, OpenERPSession):
                 continue
             if getattr(value, '_suicide', False) or (
                         not value._uid
@@ -612,7 +829,7 @@ def session_context(request, session_store, session_lock, sid):
                 in_store = session_store.get(sid)
                 for k, v in request.session.iteritems():
                     stored = in_store.get(k)
-                    if stored and isinstance(v, session.OpenERPSession):
+                    if stored and isinstance(v, OpenERPSession):
                         if hasattr(v, 'contexts_store'):
                             del v.contexts_store
                         if hasattr(v, 'domains_store'):
diff --git a/addons/web/session.py b/addons/web/session.py
deleted file mode 100644
index 948cd4c4ad0..00000000000
--- a/addons/web/session.py
+++ /dev/null
@@ -1,233 +0,0 @@
-#!/usr/bin/python
-import datetime
-import babel
-import dateutil.relativedelta
-import logging
-import time
-import traceback
-import sys
-
-import openerp
-import http
-
-_logger = logging.getLogger(__name__)
-
-#----------------------------------------------------------
-# OpenERPSession RPC openerp backend access
-#----------------------------------------------------------
-class AuthenticationError(Exception):
-    pass
-
-class SessionExpiredException(Exception):
-    pass
-
-class Service(object):
-    """
-        .. deprecated:: 8.0
-        Use ``openerp.netsvc.dispatch_rpc()`` instead.
-    """
-    def __init__(self, session, service_name):
-        self.session = session
-        self.service_name = service_name
-
-    def __getattr__(self, method):
-        def proxy_method(*args):
-            result = openerp.netsvc.dispatch_rpc(self.service_name, method, args)
-            return result
-        return proxy_method
-
-class Model(object):
-    """
-        .. deprecated:: 8.0
-        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
-    """
-    def __init__(self, session, model):
-        self.session = session
-        self.model = model
-        self.proxy = self.session.proxy('object')
-
-    def __getattr__(self, method):
-        self.session.assert_valid()
-        def proxy(*args, **kw):
-            # Can't provide any retro-compatibility for this case, so we check it and raise an Exception
-            # to tell the programmer to adapt his code
-            if not http.request.db or not http.request.uid or self.session._db != http.request.db \
-                or self.session._uid != http.request.uid:
-                raise Exception("Trying to use Model with badly configured database or user.")
-                
-            mod = http.request.registry.get(self.model)
-            meth = getattr(mod, method)
-            cr = http.request.cr
-            result = meth(cr, http.request.uid, *args, **kw)
-            # reorder read
-            if method == "read":
-                if isinstance(result, list) and len(result) > 0 and "id" in result[0]:
-                    index = {}
-                    for r in result:
-                        index[r['id']] = r
-                    result = [index[x] for x in args[0] if x in index]
-            return result
-        return proxy
-
-class OpenERPSession(object):
-    """
-    An OpenERP RPC session, a given user can own multiple such sessions
-    in a web session.
-
-    .. attribute:: context
-
-        The session context, a ``dict``. Can be reloaded by calling
-        :meth:`openerpweb.openerpweb.OpenERPSession.get_context`
-
-    .. attribute:: domains_store
-
-        A ``dict`` matching domain keys to evaluable (but non-literal) domains.
-
-        Used to store references to non-literal domains which need to be
-        round-tripped to the client browser.
-    """
-    def __init__(self):
-        self._creation_time = time.time()
-        self._db = False
-        self._uid = False
-        self._login = False
-        self._password = False
-        self._suicide = False
-        self.context = {}
-        self.jsonp_requests = {}     # FIXME use a LRU
-
-    def authenticate(self, db, login, password, env=None):
-        """
-        Authenticate the current user with the given db, login and password. If successful, store
-        the authentication parameters in the current session and request.
-        """
-        uid = openerp.netsvc.dispatch_rpc('common', 'authenticate', [db, login, password, env])
-        self._db = db
-        self._uid = uid
-        self._login = login
-        self._password = password
-        http.request.db = db
-        http.request.uid = uid
-
-        if uid: self.get_context()
-        return uid
-
-    def check_security(self):
-        """
-        Chech the current authentication parameters to know if those are still valid. This method
-        should be called at each request. If the authentication fails, a ``SessionExpiredException``
-        is raised.
-        """
-        if not self._db or not self._uid:
-            raise SessionExpiredException("Session expired")
-        import openerp.service.security as security
-        security.check(self._db, self._uid, self._password)
-
-    def get_context(self):
-        """
-        Re-initializes the current user's session context (based on
-        his preferences) by calling res.users.get_context() with the old
-        context.
-
-        :returns: the new context
-        """
-        assert self._uid, "The user needs to be logged-in to initialize his context"
-        self.context = http.request.registry.get('res.users').context_get(http.request.cr, http.request.uid) or {}
-        self.context['uid'] = self._uid
-        self._fix_lang(self.context)
-        return self.context
-
-    def _fix_lang(self, context):
-        """ OpenERP provides languages which may not make sense and/or may not
-        be understood by the web client's libraries.
-
-        Fix those here.
-
-        :param dict context: context to fix
-        """
-        lang = context['lang']
-
-        # inane OpenERP locale
-        if lang == 'ar_AR':
-            lang = 'ar'
-
-        # lang to lang_REGION (datejs only handles lang_REGION, no bare langs)
-        if lang in babel.core.LOCALE_ALIASES:
-            lang = babel.core.LOCALE_ALIASES[lang]
-
-        context['lang'] = lang or 'en_US'
-
-    def send(self, service_name, method, *args):
-        """
-        .. deprecated:: 8.0
-        Use ``openerp.netsvc.dispatch_rpc()`` instead.
-        """
-        return openerp.netsvc.dispatch_rpc(service_name, method, args)
-
-    def proxy(self, service):
-        """
-        .. deprecated:: 8.0
-        Use ``openerp.netsvc.dispatch_rpc()`` instead.
-        """
-        return Service(self, service)
-
-    def assert_valid(self, force=False):
-        """
-        .. deprecated:: 8.0
-        Use ``check_security()`` instead.
-
-        Ensures this session is valid (logged into the openerp server)
-        """
-        if self._uid and not force:
-            return
-        # TODO use authenticate instead of login
-        self._uid = self.proxy("common").login(self._db, self._login, self._password)
-        if not self._uid:
-            raise AuthenticationError("Authentication failure")
-
-    def ensure_valid(self):
-        """
-        .. deprecated:: 8.0
-        Use ``check_security()`` instead.
-        """
-        if self._uid:
-            try:
-                self.assert_valid(True)
-            except Exception:
-                self._uid = None
-
-    def execute(self, model, func, *l, **d):
-        """
-        .. deprecated:: 8.0
-        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
-        """
-        model = self.model(model)
-        r = getattr(model, func)(*l, **d)
-        return r
-
-    def exec_workflow(self, model, id, signal):
-        """
-        .. deprecated:: 8.0
-        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
-        """
-        self.assert_valid()
-        r = self.proxy('object').exec_workflow(self._db, self._uid, self._password, model, signal, id)
-        return r
-
-    def model(self, model):
-        """
-        .. deprecated:: 8.0
-        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
-
-        Get an RPC proxy for the object ``model``, bound to this session.
-
-        :param model: an OpenERP model name
-        :type model: str
-        :rtype: a model object
-        """
-        if self._db == False:
-            raise SessionExpiredException("Session expired")
-
-        return Model(self, model)
-
-# vim:et:ts=4:sw=4:

From 2fd53a468cf55d4d4beadd7f620677d172b5d3ed Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 21 Jun 2013 14:15:10 +0200
Subject: [PATCH 48/54] multiple refactoring with authentication

bzr revid: nicolas.vanhoren@openerp.com-20130621121510-gx22b6j9pwsfe352
---
 addons/web/controllers/main.py     | 116 ++++++++++++++---------------
 addons/web/controllers/testing.py  |   2 +-
 addons/web/doc/web_controllers.rst |   8 +-
 addons/web/http.py                 |  50 ++++++-------
 4 files changed, 88 insertions(+), 88 deletions(-)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 16efea06f13..51abe2d8a01 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -572,7 +572,7 @@ html_template = """<!DOCTYPE html>
 
 class Home(http.Controller):
 
-    @http.route('/', type='http', authentication="nodb")
+    @http.route('/', type='http', auth="none")
     def index(self, s_action=None, db=None, **kw):
         db, redir = db_monodb_redirect()
         if redir:
@@ -589,30 +589,30 @@ class Home(http.Controller):
         }
         return r
 
-    @http.route('/login', type='http', authentication="auth")
+    @http.route('/login', type='http', auth="user")
     def login(self, db, login, key):
         return login_and_redirect(db, login, key)
 
-    @http.route('/jsonrpc', type='json', authentication="nodb")
+    @http.route('/jsonrpc', type='json', auth="none")
     def jsonrpc(self, service, method, args):
         """ Method used by client APIs to contact OpenERP. """
         return openerp.netsvc.dispatch_rpc(service, method, args)
 
 class WebClient(http.Controller):
 
-    @http.route('/web/webclient/csslist', type='json', authentication="nodb")
+    @http.route('/web/webclient/csslist', type='json', auth="none")
     def csslist(self, mods=None):
         return manifest_list('css', mods=mods)
 
-    @http.route('/web/webclient/jslist', type='json', authentication="nodb")
+    @http.route('/web/webclient/jslist', type='json', auth="none")
     def jslist(self, mods=None):
         return manifest_list('js', mods=mods)
 
-    @http.route('/web/webclient/qweblist', type='json', authentication="nodb")
+    @http.route('/web/webclient/qweblist', type='json', auth="none")
     def qweblist(self, mods=None):
         return manifest_list('qweb', mods=mods)
 
-    @http.route('/web/webclient/css', type='http', authentication="nodb")
+    @http.route('/web/webclient/css', type='http', auth="none")
     def css(self, mods=None, db=None):
         files = list(manifest_glob('css', addons=mods, db=db))
         last_modified = get_last_modified(f[0] for f in files)
@@ -663,7 +663,7 @@ class WebClient(http.Controller):
             request.make_response(content, [('Content-Type', 'text/css')]),
             last_modified, checksum)
 
-    @http.route('/web/webclient/js', type='http', authentication="nodb")
+    @http.route('/web/webclient/js', type='http', auth="none")
     def js(self, mods=None, db=None):
         files = [f[0] for f in manifest_glob('js', addons=mods, db=db)]
         last_modified = get_last_modified(files)
@@ -676,7 +676,7 @@ class WebClient(http.Controller):
             request.make_response(content, [('Content-Type', 'application/javascript')]),
             last_modified, checksum)
 
-    @http.route('/web/webclient/qweb', type='http', authentication="nodb")
+    @http.route('/web/webclient/qweb', type='http', auth="none")
     def qweb(self, mods=None, db=None):
         files = [f[0] for f in manifest_glob('qweb', addons=mods, db=db)]
         last_modified = get_last_modified(files)
@@ -689,7 +689,7 @@ class WebClient(http.Controller):
             request.make_response(content, [('Content-Type', 'text/xml')]),
             last_modified, checksum)
 
-    @http.route('/web/webclient/bootstrap_translations', type='json', authentication="nodb")
+    @http.route('/web/webclient/bootstrap_translations', type='json', auth="none")
     def bootstrap_translations(self, mods):
         """ Load local translations from *.po files, as a temporary solution
             until we have established a valid session. This is meant only
@@ -712,7 +712,7 @@ class WebClient(http.Controller):
         return {"modules": translations_per_module,
                 "lang_parameters": None}
 
-    @http.route('/web/webclient/translations', type='json', authentication="auth")
+    @http.route('/web/webclient/translations', type='json', auth="user")
     def translations(self, mods, lang):
         res_lang = request.session.model('res.lang')
         ids = res_lang.search([("code", "=", lang)])
@@ -737,13 +737,13 @@ class WebClient(http.Controller):
         return {"modules": translations_per_module,
                 "lang_parameters": lang_params}
 
-    @http.route('/web/webclient/version_info', type='json', authentication="nodb")
+    @http.route('/web/webclient/version_info', type='json', auth="none")
     def version_info(self):
         return openerp.service.common.exp_version()
 
 class Proxy(http.Controller):
 
-    @http.route('/web/proxy/load', type='json', authentication="nodb")
+    @http.route('/web/proxy/load', type='json', auth="none")
     def load(self, path):
         """ Proxies an HTTP request through a JSON request.
 
@@ -760,11 +760,11 @@ class Proxy(http.Controller):
 
 class Database(http.Controller):
 
-    @http.route('/web/database/get_list', type='json', authentication="nodb")
+    @http.route('/web/database/get_list', type='json', auth="none")
     def get_list(self):
         return db_list()
 
-    @http.route('/web/database/create', type='json', authentication="nodb")
+    @http.route('/web/database/create', type='json', auth="none")
     def create(self, fields):
         params = dict(map(operator.itemgetter('name', 'value'), fields))
         return request.session.proxy("db").create_database(
@@ -774,7 +774,7 @@ class Database(http.Controller):
             params['db_lang'],
             params['create_admin_pwd'])
 
-    @http.route('/web/database/duplicate', type='json', authentication="nodb")
+    @http.route('/web/database/duplicate', type='json', auth="none")
     def duplicate(self, fields):
         params = dict(map(operator.itemgetter('name', 'value'), fields))
         duplicate_attrs = (
@@ -785,7 +785,7 @@ class Database(http.Controller):
 
         return request.session.proxy("db").duplicate_database(*duplicate_attrs)
 
-    @http.route('/web/database/drop', type='json', authentication="nodb")
+    @http.route('/web/database/drop', type='json', auth="none")
     def drop(self, fields):
         password, db = operator.itemgetter(
             'drop_pwd', 'drop_db')(
@@ -798,7 +798,7 @@ class Database(http.Controller):
         except Exception:
             return {'error': _('Could not drop database !'), 'title': _('Drop Database')}
 
-    @http.route('/web/database/backup', type='http', authentication="nodb")
+    @http.route('/web/database/backup', type='http', auth="none")
     def backup(self, backup_db, backup_pwd, token):
         try:
             db_dump = base64.b64decode(
@@ -816,7 +816,7 @@ class Database(http.Controller):
         except Exception, e:
             return simplejson.dumps([[],[{'error': openerp.tools.ustr(e), 'title': _('Backup Database')}]])
 
-    @http.route('/web/database/restore', type='http', authentication="nodb")
+    @http.route('/web/database/restore', type='http', auth="none")
     def restore(self, db_file, restore_pwd, new_db):
         try:
             data = base64.b64encode(db_file.read())
@@ -825,7 +825,7 @@ class Database(http.Controller):
         except openerp.exceptions.AccessDenied, e:
             raise Exception("AccessDenied")
 
-    @http.route('/web/database/change_password', type='json', authentication="nodb")
+    @http.route('/web/database/change_password', type='json', auth="none")
     def change_password(self, fields):
         old_password, new_password = operator.itemgetter(
             'old_pwd', 'new_pwd')(
@@ -849,13 +849,13 @@ class Session(http.Controller):
             "username": request.session._login,
         }
 
-    @http.route('/web/session/get_session_info', type='json', authentication="nodb")
+    @http.route('/web/session/get_session_info', type='json', auth="none")
     def get_session_info(self):
         request.uid = request.session._uid
         request.db = request.session._db
         return self.session_info()
 
-    @http.route('/web/session/authenticate', type='json', authentication="nodb")
+    @http.route('/web/session/authenticate', type='json', auth="none")
     def authenticate(self, db, login, password, base_location=None):
         wsgienv = request.httprequest.environ
         env = dict(
@@ -867,7 +867,7 @@ class Session(http.Controller):
 
         return self.session_info()
 
-    @http.route('/web/session/change_password', type='json', authentication="auth")
+    @http.route('/web/session/change_password', type='json', auth="user")
     def change_password(self, fields):
         old_password, new_password,confirm_password = operator.itemgetter('old_pwd', 'new_password','confirm_pwd')(
                 dict(map(operator.itemgetter('name', 'value'), fields)))
@@ -883,24 +883,24 @@ class Session(http.Controller):
             return {'error': _('The old password you provided is incorrect, your password was not changed.'), 'title': _('Change Password')}
         return {'error': _('Error, password not changed !'), 'title': _('Change Password')}
 
-    @http.route('/web/session/sc_list', type='json', authentication="auth")
+    @http.route('/web/session/sc_list', type='json', auth="user")
     def sc_list(self):
         return request.session.model('ir.ui.view_sc').get_sc(
             request.session._uid, "ir.ui.menu", request.context)
 
-    @http.route('/web/session/get_lang_list', type='json', authentication="nodb")
+    @http.route('/web/session/get_lang_list', type='json', auth="none")
     def get_lang_list(self):
         try:
             return request.session.proxy("db").list_lang() or []
         except Exception, e:
             return {"error": e, "title": _("Languages")}
 
-    @http.route('/web/session/modules', type='json', authentication="auth")
+    @http.route('/web/session/modules', type='json', auth="user")
     def modules(self):
         # return all installed modules. Web client is smart enough to not load a module twice
         return module_installed()
 
-    @http.route('/web/session/save_session_action', type='json', authentication="auth")
+    @http.route('/web/session/save_session_action', type='json', auth="user")
     def save_session_action(self, the_action):
         """
         This method store an action object in the session object and returns an integer
@@ -924,7 +924,7 @@ class Session(http.Controller):
         saved_actions["next"] = key + 1
         return key
 
-    @http.route('/web/session/get_session_action', type='json', authentication="auth")
+    @http.route('/web/session/get_session_action', type='json', auth="user")
     def get_session_action(self, key):
         """
         Gets back a previously saved action. This method can return None if the action
@@ -940,18 +940,18 @@ class Session(http.Controller):
             return None
         return saved_actions["actions"].get(key)
 
-    @http.route('/web/session/check', type='json', authentication="auth")
+    @http.route('/web/session/check', type='json', auth="user")
     def check(self):
         request.session.assert_valid()
         return None
 
-    @http.route('/web/session/destroy', type='json', authentication="auth")
+    @http.route('/web/session/destroy', type='json', auth="user")
     def destroy(self):
         request.session._suicide = True
 
 class Menu(http.Controller):
 
-    @http.route('/web/menu/get_user_roots', type='json', authentication="auth")
+    @http.route('/web/menu/get_user_roots', type='json', auth="user")
     def get_user_roots(self):
         """ Return all root menu ids visible for the session user.
 
@@ -973,7 +973,7 @@ class Menu(http.Controller):
 
         return Menus.search(menu_domain, 0, False, False, request.context)
 
-    @http.route('/web/menu/load', type='json', authentication="auth")
+    @http.route('/web/menu/load', type='json', auth="user")
     def load(self):
         """ Loads all menu items (all applications and their sub-menus).
 
@@ -1024,7 +1024,7 @@ class Menu(http.Controller):
 
         return menu_root
 
-    @http.route('/web/menu/load_needaction', type='json', authentication="auth")
+    @http.route('/web/menu/load_needaction', type='json', auth="user")
     def load_needaction(self, menu_ids):
         """ Loads needaction counters for specific menu ids.
 
@@ -1033,7 +1033,7 @@ class Menu(http.Controller):
         """
         return request.session.model('ir.ui.menu').get_needaction_data(menu_ids, request.context)
 
-    @http.route('/web/menu/action', type='json', authentication="auth")
+    @http.route('/web/menu/action', type='json', auth="user")
     def action(self, menu_id):
         # still used by web_shortcut
         actions = load_actions_from_ir_values('action', 'tree_but_open',
@@ -1042,7 +1042,7 @@ class Menu(http.Controller):
 
 class DataSet(http.Controller):
 
-    @http.route('/web/dataset/search_read', type='json', authentication="auth")
+    @http.route('/web/dataset/search_read', type='json', auth="user")
     def search_read(self, model, fields=False, offset=0, limit=False, domain=None, sort=None):
         return self.do_search_read(model, fields, offset, limit, domain, sort)
     def do_search_read(self, model, fields=False, offset=0, limit=False, domain=None
@@ -1084,7 +1084,7 @@ class DataSet(http.Controller):
             'records': records
         }
 
-    @http.route('/web/dataset/load', type='json', authentication="auth")
+    @http.route('/web/dataset/load', type='json', auth="user")
     def load(self, model, id, fields):
         m = request.session.model(model)
         value = {}
@@ -1110,26 +1110,26 @@ class DataSet(http.Controller):
 
         return getattr(request.session.model(model), method)(*args, **kwargs)
 
-    @http.route('/web/dataset/call', type='json', authentication="auth")
+    @http.route('/web/dataset/call', type='json', auth="user")
     def call(self, model, method, args, domain_id=None, context_id=None):
         return self._call_kw(model, method, args, {})
 
-    @http.route(['/web/dataset/call_kw', '/web/dataset/call_kw/<path:path>'], type='json', authentication="auth")
+    @http.route(['/web/dataset/call_kw', '/web/dataset/call_kw/<path:path>'], type='json', auth="user")
     def call_kw(self, model, method, args, kwargs, path=None):
         return self._call_kw(model, method, args, kwargs)
 
-    @http.route('/web/dataset/call_button', type='json', authentication="auth")
+    @http.route('/web/dataset/call_button', type='json', auth="user")
     def call_button(self, model, method, args, domain_id=None, context_id=None):
         action = self._call_kw(model, method, args, {})
         if isinstance(action, dict) and action.get('type') != '':
             return clean_action(action)
         return False
 
-    @http.route('/web/dataset/exec_workflow', type='json', authentication="auth")
+    @http.route('/web/dataset/exec_workflow', type='json', auth="user")
     def exec_workflow(self, model, id, signal):
         return request.session.exec_workflow(model, id, signal)
 
-    @http.route('/web/dataset/resequence', type='json', authentication="auth")
+    @http.route('/web/dataset/resequence', type='json', auth="user")
     def resequence(self, model, ids, field='sequence', offset=0):
         """ Re-sequences a number of records in the model, by their ids
 
@@ -1154,7 +1154,7 @@ class DataSet(http.Controller):
 
 class View(http.Controller):
 
-    @http.route('/web/view/add_custom', type='json', authentication="auth")
+    @http.route('/web/view/add_custom', type='json', auth="user")
     def add_custom(self, view_id, arch):
         CustomView = request.session.model('ir.ui.view.custom')
         CustomView.create({
@@ -1164,7 +1164,7 @@ class View(http.Controller):
         }, request.context)
         return {'result': True}
 
-    @http.route('/web/view/undo_custom', type='json', authentication="auth")
+    @http.route('/web/view/undo_custom', type='json', auth="user")
     def undo_custom(self, view_id, reset=False):
         CustomView = request.session.model('ir.ui.view.custom')
         vcustom = CustomView.search([('user_id', '=', request.session._uid), ('ref_id' ,'=', view_id)],
@@ -1179,7 +1179,7 @@ class View(http.Controller):
 
 class TreeView(View):
 
-    @http.route('/web/treeview/action', type='json', authentication="auth")
+    @http.route('/web/treeview/action', type='json', auth="user")
     def action(self, model, id):
         return load_actions_from_ir_values(
             'action', 'tree_but_open',[(model, id)],
@@ -1187,7 +1187,7 @@ class TreeView(View):
 
 class Binary(http.Controller):
 
-    @http.route('/web/binary/image', type='http', authentication="auth")
+    @http.route('/web/binary/image', type='http', auth="user")
     def image(self, model, id, field, **kw):
         last_update = '__last_update'
         Model = request.session.model(model)
@@ -1242,7 +1242,7 @@ class Binary(http.Controller):
         addons_path = http.addons_manifest['web']['addons_path']
         return open(os.path.join(addons_path, 'web', 'static', 'src', 'img', image), 'rb').read()
 
-    @http.route('/web/binary/saveas', type='http', authentication="auth")
+    @http.route('/web/binary/saveas', type='http', auth="user")
     def saveas(self, model, field, id=None, filename_field=None, **kw):
         """ Download link for files stored as binary fields.
 
@@ -1275,7 +1275,7 @@ class Binary(http.Controller):
                 [('Content-Type', 'application/octet-stream'),
                  ('Content-Disposition', content_disposition(filename))])
 
-    @http.route('/web/binary/saveas_ajax', type='http', authentication="auth")
+    @http.route('/web/binary/saveas_ajax', type='http', auth="user")
     def saveas_ajax(self, data, token):
         jdata = simplejson.loads(data)
         model = jdata['model']
@@ -1308,7 +1308,7 @@ class Binary(http.Controller):
                         ('Content-Disposition', content_disposition(filename))],
                 cookies={'fileToken': int(token)})
 
-    @http.route('/web/binary/upload', type='http', authentication="auth")
+    @http.route('/web/binary/upload', type='http', auth="user")
     def upload(self, callback, ufile):
         # TODO: might be useful to have a configuration flag for max-length file uploads
         out = """<script language="javascript" type="text/javascript">
@@ -1323,7 +1323,7 @@ class Binary(http.Controller):
             args = [False, e.message]
         return out % (simplejson.dumps(callback), simplejson.dumps(args))
 
-    @http.route('/web/binary/upload_attachment', type='http', authentication="auth")
+    @http.route('/web/binary/upload_attachment', type='http', auth="user")
     def upload_attachment(self, callback, model, id, ufile):
         Model = request.session.model('ir.attachment')
         out = """<script language="javascript" type="text/javascript">
@@ -1346,7 +1346,7 @@ class Binary(http.Controller):
             args = {'error': "Something horrible happened"}
         return out % (simplejson.dumps(callback), simplejson.dumps(args))
 
-    @http.route('/web/binary/company_logo', type='http', authentication="nodb")
+    @http.route('/web/binary/company_logo', type='http', auth="none")
     def company_logo(self, dbname=None):
         # TODO add etag, refactor to use /image code for etag
         uid = None
@@ -1388,7 +1388,7 @@ class Binary(http.Controller):
 
 class Action(http.Controller):
 
-    @http.route('/web/action/load', type='json', authentication="auth")
+    @http.route('/web/action/load', type='json', auth="user")
     def load(self, action_id, do_not_eval=False):
         Actions = request.session.model('ir.actions.actions')
         value = False
@@ -1414,7 +1414,7 @@ class Action(http.Controller):
                 value = clean_action(action[0])
         return value
 
-    @http.route('/web/action/run', type='json', authentication="auth")
+    @http.route('/web/action/run', type='json', auth="user")
     def run(self, action_id):
         return_action = request.session.model('ir.actions.server').run(
             [action_id], request.context)
@@ -1425,7 +1425,7 @@ class Action(http.Controller):
 
 class Export(http.Controller):
 
-    @http.route('/web/export/formats', type='json', authentication="auth")
+    @http.route('/web/export/formats', type='json', auth="user")
     def formats(self):
         """ Returns all valid export formats
 
@@ -1439,7 +1439,7 @@ class Export(http.Controller):
         fields = Model.fields_get(False, request.context)
         return fields
 
-    @http.route('/web/export/get_fields', type='json', authentication="auth")
+    @http.route('/web/export/get_fields', type='json', auth="user")
     def get_fields(self, model, prefix='', parent_name= '',
                    import_compat=True, parent_field_type=None,
                    exclude=None):
@@ -1488,7 +1488,7 @@ class Export(http.Controller):
 
         return records
 
-    @http.route('/web/export/namelist', type='json', authentication="auth")
+    @http.route('/web/export/namelist', type='json', auth="user")
     def namelist(self, model, export_id):
         # TODO: namelist really has no reason to be in Python (although itertools.groupby helps)
         export = request.session.model("ir.exports").read([export_id])[0]
@@ -1608,7 +1608,7 @@ class ExportFormat(object):
 class CSVExport(ExportFormat, http.Controller):
     fmt = {'tag': 'csv', 'label': 'CSV'}
 
-    @http.route('/web/export/csv', type='http', authentication="auth")
+    @http.route('/web/export/csv', type='http', auth="user")
     def index(self, data, token):
         return self.base(data, token)
 
@@ -1650,7 +1650,7 @@ class ExcelExport(ExportFormat, http.Controller):
         'error': None if xlwt else "XLWT required"
     }
 
-    @http.route('/web/export/xls', type='http', authentication="auth")
+    @http.route('/web/export/xls', type='http', auth="user")
     def index(self, data, token):
         return self.base(data, token)
 
@@ -1696,7 +1696,7 @@ class Reports(http.Controller):
         'xls': 'application/vnd.ms-excel',
     }
 
-    @http.route('/web/report', type='http', authentication="auth")
+    @http.route('/web/report', type='http', auth="user")
     def index(self, action, token):
         action = simplejson.loads(action)
 
diff --git a/addons/web/controllers/testing.py b/addons/web/controllers/testing.py
index 5e156dc410e..36afbd1e653 100644
--- a/addons/web/controllers/testing.py
+++ b/addons/web/controllers/testing.py
@@ -87,7 +87,7 @@ TESTING = Template(u"""<!DOCTYPE html>
 
 class TestRunnerController(http.Controller):
 
-    @http.route('/web/tests', type='http', authentication="nodb")
+    @http.route('/web/tests', type='http', auth="none")
     def index(self, req, mod=None, **kwargs):
         ms = module.get_modules()
         manifests = dict(
diff --git a/addons/web/doc/web_controllers.rst b/addons/web/doc/web_controllers.rst
index c35bd66eef4..86ac0248e7e 100644
--- a/addons/web/doc/web_controllers.rst
+++ b/addons/web/doc/web_controllers.rst
@@ -135,12 +135,12 @@ Authorization Levels
 --------------------
 
 By default, all methods can only be used by users logged into OpenERP (OpenERP uses cookies to track logged users).
-There are some cases when you need to enable not-logged in users to access some methods. To do so, add the ``'noauth'``
-value to the ``authentication`` parameter of ``http.route()``:
+There are some cases when you need to enable not-logged in users to access some methods. To do so, add the ``'db'``
+value to the ``auth`` parameter of ``http.route()``:
 
 ::
 
-    @http.route('/hello', type="http", authentication="noauth")
+    @http.route('/hello', type="http", auth="db")
     def hello(self):
         return "<div>Hello unknown user!</div>"
 
@@ -158,7 +158,7 @@ want to override. Example that redefine the home page of your OpenERP applicatio
     import openerp.addons.web.controllers.main as main
 
     class Home2(main.Home):
-        @http.route('/', type="http", authentication="noauth")
+        @http.route('/', type="http", auth="db")
         def index(self):
             return "<div>This is my new home page.</div>"
 
diff --git a/addons/web/http.py b/addons/web/http.py
index 83a3ac4fa42..3e17f27774f 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -86,12 +86,12 @@ class WebRequest(object):
     .. attribute:: db
 
         ``str``, the name of the database linked to the current request. Can be ``None``
-        if the current request uses the ``nodb`` authentication.
+        if the current request uses the ``none`` authentication.
 
     .. attribute:: uid
 
         ``int``, the id of the user related to the current request. Can be ``None``
-        if the current request uses the ``nodb`` or the ``noauth`` authenticatoin.
+        if the current request uses the ``none`` or the ``db`` authenticatoin.
     """
     def __init__(self, httprequest):
         self.httprequest = httprequest
@@ -149,10 +149,10 @@ class WebRequest(object):
         self.lang = lang.replace('-', '_')
 
     def _authenticate(self):
-        if self.auth_method == "nodb":
+        if self.auth_method == "none":
             self.db = None
             self.uid = None
-        elif self.auth_method == "noauth":
+        elif self.auth_method == "db":
             self.db = (self.session._db or openerp.addons.web.controllers.main.db_monodb()).lower()
             if not self.db:
                 raise SessionExpiredException("No valid database for request %s" % self.httprequest)
@@ -169,14 +169,14 @@ class WebRequest(object):
     def registry(self):
         """
         The registry to the database linked to this request. Can be ``None`` if the current request uses the
-        ``nodb'' authentication.
+        ``none'' authentication.
         """
         return openerp.modules.registry.RegistryManager.get(self.db) if self.db else None
 
     @property
     def cr(self):
         """
-        The cursor initialized for the current method call. If the current request uses the ``nodb`` authentication
+        The cursor initialized for the current method call. If the current request uses the ``none`` authentication
         trying to access this property will raise an exception.
         """
         # some magic to lazy create the cr
@@ -209,7 +209,7 @@ class WebRequest(object):
             self.db = None
             self.uid = None
 
-def route(route, type="http", authentication="auth"):
+def route(route, type="http", auth="user"):
     """
     Decorator marking the decorated method as being a handler for requests. The method must be part of a subclass
     of ``Controller``.
@@ -222,16 +222,16 @@ def route(route, type="http", authentication="auth"):
     method. Can be a single string or an array of strings. See werkzeug's routing documentation for the format of
     route expression ( http://werkzeug.pocoo.org/docs/routing/ ).
     :param type: The type of request, can be ``'http'`` or ``'json'``.
-    :param authentication: The type of authentication method, can on of the following:
+    :param auth: The type of authentication method, can on of the following:
 
         * ``auth``: The user must be authenticated.
-        * ``noauth``: There is no need for the user to be authenticated but there must be a way to find the current
+        * ``db``: There is no need for the user to be authenticated but there must be a way to find the current
         database.
-        * ``nodb``: The method is always active, even if there is no database. Mainly used by the framework and
+        * ``none``: The method is always active, even if there is no database. Mainly used by the framework and
         authentication modules.
     """
     assert type in ["http", "json"]
-    assert authentication in ["auth", "noauth", "nodb"]
+    assert auth in ["user", "db", "none"]
     def decorator(f):
         if isinstance(route, list):
             f.routes = route
@@ -239,7 +239,7 @@ def route(route, type="http", authentication="auth"):
             f.routes = [route]
         f.exposed = type
         if getattr(f, "auth", None) is None:
-            f.auth = authentication
+            f.auth = auth
         return f
     return decorator
 
@@ -415,7 +415,7 @@ def jsonrequest(f):
     base = f.__name__
     if f.__name__ == "index":
         base = ""
-    return route([base, os.path.join(base, "<path:_ignored_path>")], type="json", authentication="auth")(f)
+    return route([base, os.path.join(base, "<path:_ignored_path>")], type="json", auth="user")(f)
 
 class HttpRequest(WebRequest):
     """ Regular GET/POST request
@@ -498,7 +498,7 @@ def httprequest(f):
     base = f.__name__
     if f.__name__ == "index":
         base = ""
-    return route([base, os.path.join(base, "<path:_ignored_path>")], type="http", authentication="auth")(f)
+    return route([base, os.path.join(base, "<path:_ignored_path>")], type="http", auth="user")(f)
 
 #----------------------------------------------------------
 # Local storage of requests
@@ -604,14 +604,14 @@ class Model(object):
         def proxy(*args, **kw):
             # Can't provide any retro-compatibility for this case, so we check it and raise an Exception
             # to tell the programmer to adapt his code
-            if not http.request.db or not http.request.uid or self.session._db != http.request.db \
-                or self.session._uid != http.request.uid:
+            if not request.db or not request.uid or self.session._db != request.db \
+                or self.session._uid != request.uid:
                 raise Exception("Trying to use Model with badly configured database or user.")
                 
-            mod = http.request.registry.get(self.model)
+            mod = request.registry.get(self.model)
             meth = getattr(mod, method)
-            cr = http.request.cr
-            result = meth(cr, http.request.uid, *args, **kw)
+            cr = request.cr
+            result = meth(cr, request.uid, *args, **kw)
             # reorder read
             if method == "read":
                 if isinstance(result, list) and len(result) > 0 and "id" in result[0]:
@@ -659,8 +659,8 @@ class OpenERPSession(object):
         self._uid = uid
         self._login = login
         self._password = password
-        http.request.db = db
-        http.request.uid = uid
+        request.db = db
+        request.uid = uid
 
         if uid: self.get_context()
         return uid
@@ -685,7 +685,7 @@ class OpenERPSession(object):
         :returns: the new context
         """
         assert self._uid, "The user needs to be logged-in to initialize his context"
-        self.context = http.request.registry.get('res.users').context_get(http.request.cr, http.request.uid) or {}
+        self.context = request.registry.get('res.users').context_get(request.cr, request.uid) or {}
         self.context['uid'] = self._uid
         self._fix_lang(self.context)
         return self.context
@@ -1031,7 +1031,7 @@ class Root(object):
                     members = inspect.getmembers(o)
                     for mk, mv in members:
                         if inspect.ismethod(mv) and getattr(mv, 'exposed', False) and \
-                                nodb_only == (getattr(mv, 'auth', None) == "nodb"):
+                                nodb_only == (getattr(mv, "user", None) == "none"):
                             function = (o.get_wrapped_method(mk), mv)
                             for url in mv.routes:
                                 if getattr(mv, "combine", False):
@@ -1042,7 +1042,7 @@ class Root(object):
 
         modules_set = set(controllers_per_module.keys())
         modules_set -= set("web")
-        # building all nodb methods
+        # building all none methods
         gen(["web"] + sorted(modules_set), True)
         if not db:
             return routing_map
@@ -1088,7 +1088,7 @@ class Root(object):
             return func(*args, **kwargs)
 
         request.func = nfunc
-        request.auth_method = getattr(original, "auth", "auth")
+        request.auth_method = getattr(original, "auth", "user")
         request.func_request_type = original.exposed
 
 def wsgi_postload():

From 95f94912523f427dd5039aa791d220f01b2545db Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 21 Jun 2013 14:31:49 +0200
Subject: [PATCH 49/54] Rewrite db_monodb

bzr revid: nicolas.vanhoren@openerp.com-20130621123149-ukxjzz9jyckf9a4r
---
 addons/web/controllers/main.py | 35 +++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 51abe2d8a01..3c26494f499 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -96,13 +96,32 @@ def db_list():
     return dbs
 
 def db_monodb_redirect():
-    db = False
+    db = db_monodb()
+
+    if request.params.get('db'):
+        return (db, False)
+
+    try:
+        dbs = db_list()
+    except Exception:
+        # ignore access denied
+        dbs = []
+
+    # redirect to the chosen db if multiple are available
     redirect = False
+    if db and len(dbs) > 1:
+        query = dict(urlparse.parse_qsl(request.httprequest.query_string, keep_blank_values=True))
+        query.update({ 'db': db })
+        redirect = request.httprequest.path + '?' + urllib.urlencode(query)
+    return (db, redirect)
+
+def db_monodb():
+    db = False
 
     # 1 try the db in the url
     db_url = request.params.get('db')
     if db_url:
-        return (db_url, False)
+        return db_url
 
     try:
         dbs = db_list()
@@ -118,17 +137,7 @@ def db_monodb_redirect():
     # 3 use the first db
     if dbs and not db:
         db = dbs[0]
-
-    # redirect to the chosen db if multiple are available
-    if db and len(dbs) > 1:
-        query = dict(urlparse.parse_qsl(request.httprequest.query_string, keep_blank_values=True))
-        query.update({ 'db': db })
-        redirect = request.httprequest.path + '?' + urllib.urlencode(query)
-    return (db, redirect)
-
-def db_monodb():
-    # if only one db exists, return it else return False
-    return db_monodb_redirect()[0]
+    return db
 
 def redirect_with_hash(url, code=303):
     if request.httprequest.user_agent.browser == 'msie':

From 93979c30b838792aed134c24850c4f882db12f05 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 21 Jun 2013 14:34:14 +0200
Subject: [PATCH 50/54] variable rename

bzr revid: nicolas.vanhoren@openerp.com-20130621123414-3hkklobsbf86glx6
---
 addons/web/http.py | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 3e17f27774f..b0177aa35d8 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -787,20 +787,20 @@ class OpenERPSession(object):
 # Session context manager
 #----------------------------------------------------------
 @contextlib.contextmanager
-def session_context(request, session_store, session_lock, sid):
+def session_context(httprequest, session_store, session_lock, sid):
     with session_lock:
         if sid:
-            request.session = session_store.get(sid)
+            httprequest.session = session_store.get(sid)
         else:
-            request.session = session_store.new()
+            httprequest.session = session_store.new()
     try:
-        yield request.session
+        yield httprequest.session
     finally:
         # Remove all OpenERPSession instances with no uid, they're generated
         # either by login process or by HTTP requests without an OpenERP
         # session id, and are generally noise
         removed_sessions = set()
-        for key, value in request.session.items():
+        for key, value in httprequest.session.items():
             if not isinstance(value, OpenERPSession):
                 continue
             if getattr(value, '_suicide', False) or (
@@ -810,7 +810,7 @@ def session_context(request, session_store, session_lock, sid):
                     and value._creation_time + (60*5) < time.time()):
                 _logger.debug('remove session %s', key)
                 removed_sessions.add(key)
-                del request.session[key]
+                del httprequest.session[key]
 
         with session_lock:
             if sid:
@@ -827,7 +827,7 @@ def session_context(request, session_store, session_lock, sid):
                 # other to get the right result, if we want to merge the
                 # ``context`` dict we'll need something smarter
                 in_store = session_store.get(sid)
-                for k, v in request.session.iteritems():
+                for k, v in httprequest.session.iteritems():
                     stored = in_store.get(k)
                     if stored and isinstance(v, OpenERPSession):
                         if hasattr(v, 'contexts_store'):
@@ -841,10 +841,10 @@ def session_context(request, session_store, session_lock, sid):
 
                 # add missing keys
                 for k, v in in_store.iteritems():
-                    if k not in request.session and k not in removed_sessions:
-                        request.session[k] = v
+                    if k not in httprequest.session and k not in removed_sessions:
+                        httprequest.session[k] = v
 
-            session_store.save(request.session)
+            session_store.save(httprequest.session)
 
 def session_gc(session_store):
     if random.random() < 0.001:

From 52d1b26b2fe8942faa7289a357e777e0c0a3e342 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 21 Jun 2013 14:41:43 +0200
Subject: [PATCH 51/54] Put db_monodb() method in http.py

bzr revid: nicolas.vanhoren@openerp.com-20130621124143-pe5hgwj81j2degg6
---
 addons/web/controllers/main.py | 33 ++--------------------------
 addons/web/http.py             | 40 +++++++++++++++++++++++++++++++---
 2 files changed, 39 insertions(+), 34 deletions(-)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 3c26494f499..09032513b8d 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -86,14 +86,7 @@ def rjsmin(script):
     ).strip()
     return result
 
-def db_list():
-    proxy = request.session.proxy("db")
-    dbs = proxy.list()
-    h = request.httprequest.environ['HTTP_HOST'].split(':')[0]
-    d = h.split('.')[0]
-    r = openerp.tools.config['dbfilter'].replace('%h', h).replace('%d', d)
-    dbs = [i for i in dbs if re.match(r, i)]
-    return dbs
+db_list = http.db_list
 
 def db_monodb_redirect():
     db = db_monodb()
@@ -115,29 +108,7 @@ def db_monodb_redirect():
         redirect = request.httprequest.path + '?' + urllib.urlencode(query)
     return (db, redirect)
 
-def db_monodb():
-    db = False
-
-    # 1 try the db in the url
-    db_url = request.params.get('db')
-    if db_url:
-        return db_url
-
-    try:
-        dbs = db_list()
-    except Exception:
-        # ignore access denied
-        dbs = []
-
-    # 2 use the database from the cookie if it's listable and still listed
-    cookie_db = request.httprequest.cookies.get('last_used_database')
-    if cookie_db in dbs:
-        db = cookie_db
-
-    # 3 use the first db
-    if dbs and not db:
-        db = dbs[0]
-    return db
+db_monodb = http.db_monodb
 
 def redirect_with_hash(url, code=303):
     if request.httprequest.user_agent.browser == 'msie':
diff --git a/addons/web/http.py b/addons/web/http.py
index b0177aa35d8..4566d45eed4 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -20,6 +20,7 @@ import traceback
 import urlparse
 import uuid
 import errno
+import re
 
 import babel.core
 import simplejson
@@ -121,7 +122,7 @@ class WebRequest(object):
             self.httpsession[self.session_id] = self.session
 
         with set_request(self):
-            self.db = (self.session._db or openerp.addons.web.controllers.main.db_monodb()).lower()
+            self.db = self.session._db or db_monodb()
 
         # TODO: remove this
         # set db/uid trackers - they're cleaned up at the WSGI
@@ -153,7 +154,7 @@ class WebRequest(object):
             self.db = None
             self.uid = None
         elif self.auth_method == "db":
-            self.db = (self.session._db or openerp.addons.web.controllers.main.db_monodb()).lower()
+            self.db = self.session._db or db_monodb()
             if not self.db:
                 raise SessionExpiredException("No valid database for request %s" % self.httprequest)
             self.uid = None
@@ -1031,7 +1032,7 @@ class Root(object):
                     members = inspect.getmembers(o)
                     for mk, mv in members:
                         if inspect.ismethod(mv) and getattr(mv, 'exposed', False) and \
-                                nodb_only == (getattr(mv, "user", None) == "none"):
+                                nodb_only == (getattr(mv, "auth", None) == "none"):
                             function = (o.get_wrapped_method(mk), mv)
                             for url in mv.routes:
                                 if getattr(mv, "combine", False):
@@ -1091,6 +1092,39 @@ class Root(object):
         request.auth_method = getattr(original, "auth", "user")
         request.func_request_type = original.exposed
 
+def db_list():
+    proxy = request.session.proxy("db")
+    dbs = proxy.list()
+    h = request.httprequest.environ['HTTP_HOST'].split(':')[0]
+    d = h.split('.')[0]
+    r = openerp.tools.config['dbfilter'].replace('%h', h).replace('%d', d)
+    dbs = [i for i in dbs if re.match(r, i)]
+    return dbs
+
+def db_monodb():
+    db = None
+
+    # 1 try the db in the url
+    db_url = request.params.get('db')
+    if db_url:
+        return db_url
+
+    try:
+        dbs = db_list()
+    except Exception:
+        # ignore access denied
+        dbs = []
+
+    # 2 use the database from the cookie if it's listable and still listed
+    cookie_db = request.httprequest.cookies.get('last_used_database')
+    if cookie_db in dbs:
+        db = cookie_db
+
+    # 3 use the first db
+    if dbs and not db:
+        db = dbs[0]
+    return db.lower() if db else db
+
 def wsgi_postload():
     openerp.wsgi.register_wsgi_handler(Root())
 

From 6a82e64e4d119f3aecaa21bc39b70e46723f0f45 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 21 Jun 2013 15:23:39 +0200
Subject: [PATCH 52/54] small improvement, useful in some cases

bzr revid: nicolas.vanhoren@openerp.com-20130621132339-ohk9wiufk1l9z61v
---
 addons/web/http.py | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/addons/web/http.py b/addons/web/http.py
index 4566d45eed4..c5f542d8f78 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -34,6 +34,7 @@ import werkzeug.routing as routing
 import urllib2
 
 import openerp
+import openerp.service.security as security
 
 import inspect
 import functools
@@ -650,12 +651,17 @@ class OpenERPSession(object):
         self.context = {}
         self.jsonp_requests = {}     # FIXME use a LRU
 
-    def authenticate(self, db, login, password, env=None):
+    def authenticate(self, db, login=None, password=None, env=None, uid=None):
         """
         Authenticate the current user with the given db, login and password. If successful, store
         the authentication parameters in the current session and request.
+
+        :param uid: If not None, that user id will be used instead the login to authenticate the user.
         """
-        uid = openerp.netsvc.dispatch_rpc('common', 'authenticate', [db, login, password, env])
+        if uid is None:
+            uid = openerp.netsvc.dispatch_rpc('common', 'authenticate', [db, login, password, env])
+        else:
+            security.check(db, uid, password)
         self._db = db
         self._uid = uid
         self._login = login
@@ -674,7 +680,6 @@ class OpenERPSession(object):
         """
         if not self._db or not self._uid:
             raise SessionExpiredException("Session expired")
-        import openerp.service.security as security
         security.check(self._db, self._uid, self._password)
 
     def get_context(self):

From 770751c7d7570907743e0efd0ba256cd5deea9c1 Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 21 Jun 2013 16:36:48 +0200
Subject: [PATCH 53/54] removed some useless code

bzr revid: nicolas.vanhoren@openerp.com-20130621143648-fh7vnyt3o6a7swqj
---
 addons/web/controllers/main.py | 1 -
 addons/web/http.py             | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index f30c57a9617..7c845dd141c 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -35,7 +35,6 @@ from openerp.tools.translate import _
 from openerp.tools import config
 
 from .. import http
-http = http
 
 from openerp.addons.web.http import request
 
diff --git a/addons/web/http.py b/addons/web/http.py
index 249189a30de..f9a7e251453 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -1075,7 +1075,7 @@ class Root(object):
         if not router:
             router = self._build_router(db)
             with self.db_routers_lock:
-                router = self.db_routers[db] = router
+                self.db_routers[db] = router
         return router
 
     def find_handler(self):

From c433395b4ff2888d2fc11dce09704be7fce79efa Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Fri, 21 Jun 2013 16:54:55 +0200
Subject: [PATCH 54/54] Put json-rpc controller in http.py

bzr revid: nicolas.vanhoren@openerp.com-20130621145455-n933uz1dcdmsv9t7
---
 addons/web/controllers/main.py | 5 -----
 addons/web/http.py             | 8 ++++++++
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 7c845dd141c..d82f4a85775 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -569,11 +569,6 @@ class Home(http.Controller):
     def login(self, db, login, key):
         return login_and_redirect(db, login, key)
 
-    @http.route('/jsonrpc', type='json', auth="none")
-    def jsonrpc(self, service, method, args):
-        """ Method used by client APIs to contact OpenERP. """
-        return openerp.netsvc.dispatch_rpc(service, method, args)
-
 class WebClient(http.Controller):
 
     @http.route('/web/webclient/csslist', type='json', auth="none")
diff --git a/addons/web/http.py b/addons/web/http.py
index f9a7e251453..7105b4a74c1 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -1134,6 +1134,14 @@ def db_monodb():
         db = dbs[0]
     return db.lower() if db else db
 
+
+class JsonRpcController(Controller):
+
+    @route('/jsonrpc', type='json', auth="none")
+    def jsonrpc(self, service, method, args):
+        """ Method used by client APIs to contact OpenERP. """
+        return openerp.netsvc.dispatch_rpc(service, method, args)
+
 def wsgi_postload():
     openerp.wsgi.register_wsgi_handler(Root())