[FIX] password_security: password expiration 2FA

[MIG] password_security: Migration to 18.0

Author: BT-cjimeno

password_security/README.rst

@@ -104,6 +104,8 @@ Contributors
 
 - Florian Kantelberg <florian.kantelberg@initos.com>
 
+- Carlos Jimeno <carlos.jimeno@bt-group.com>
+
 - Dhara Solanki <dhara.solanki@initos.com>
 
 - `Open Source Integrators <https://opensourceintegrators.com>`__

password_security/__manifest__.py

@@ -17,6 +17,7 @@
     "depends": [
         "auth_signup",
         "auth_password_policy_signup",
+        "auth_totp",
     ],
     "website": "https://github.com/OCA/server-auth",
     "license": "LGPL-3",

password_security/controllers/__init__.py

@@ -2,3 +2,4 @@
 # License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
 
 from . import main
+from . import home

password_security/controllers/home.py

@@ -0,0 +1,23 @@
+# Copyright 2022 brain-tec AG (https://bt-group.com)
+# License LGPL-3.0 or later (https://www.gnu.org/licenses/lgpl.html).
+
+from odoo import http
+from odoo.http import request
+
+from odoo.addons.auth_totp.controllers.home import Home
+
+
+class PasswordSecurity2FAHome(Home):
+    @http.route()
+    def web_totp(self, redirect=None, **kwargs):
+        already_logged_in = request.session.uid
+        result = super().web_totp(redirect, **kwargs)
+        if already_logged_in or not (
+            request.session.uid and request.env.user._password_has_expired()
+        ):
+            return result
+        # My password is expired, kick me out
+        request.env.user.action_expire_password()
+        request.session.logout(keep_db=True)
+        redirect = request.env.user.partner_id.signup_url
+        return request.redirect(redirect)

password_security/controllers/main.py

@@ -30,7 +30,8 @@ def web_login(self, *args, **kw):
         if not request.env.user:
             return response
         # Now, I'm an authenticated user
-        if not request.env.user._password_has_expired():
+        # With 2FA there is a second step, and we would not be completely logged in
+        if not (request.session.uid and request.env.user._password_has_expired()):
             return response
         # My password is expired, kick me out
         request.env.user.action_expire_password()

password_security/readme/CONTRIBUTORS.md

@@ -10,12 +10,14 @@
 
 - Florian Kantelberg \<<florian.kantelberg@initos.com>\>
 
+- Carlos Jimeno \<<carlos.jimeno@bt-group.com>\>
+
 - Dhara Solanki \<<dhara.solanki@initos.com>\>
 
 - [Open Source Integrators](https://opensourceintegrators.com)
 
   > - Chandresh Thakkar \<<cthakkar@opensourceintegrators.com>\>
   > - Daniel Reis \<<dreis@opensourceintegrators.com>\>
 
-- [Onestein](https://www.onestein.nl):  
+- [Onestein](https://www.onestein.nl):
   - Andrea Stirpe \<<a.stirpe@onestein.nl>\>

password_security/static/description/index.html

@@ -445,6 +445,8 @@ <h2><a class="toc-backref" href="#toc-entry-6">Contributors</a></h2>
 </li>
 <li><p class="first">Florian Kantelberg &lt;<a class="reference external" href="mailto:florian.kantelberg&#64;initos.com">florian.kantelberg&#64;initos.com</a>&gt;</p>
 </li>
+<li><p class="first">Carlos Jimeno &lt;<a class="reference external" href="mailto:carlos.jimeno&#64;bt-group.com">carlos.jimeno&#64;bt-group.com</a>&gt;</p>
+</li>
 <li><p class="first">Dhara Solanki &lt;<a class="reference external" href="mailto:dhara.solanki&#64;initos.com">dhara.solanki&#64;initos.com</a>&gt;</p>
 </li>
 <li><p class="first"><a class="reference external" href="https://opensourceintegrators.com">Open Source Integrators</a></p>

password_security/tests/__init__.py

@@ -4,3 +4,5 @@
 from . import test_password_history
 from . import test_reset_password
 from . import test_signup
+from . import test_migration
+from . import test_totp

password_security/tests/test_totp.py

@@ -0,0 +1,30 @@
+# Copyright 2022 Braintec AG
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
+
+from datetime import datetime, timedelta
+
+from odoo.tests import HttpCase, tagged
+
+
+@tagged("post_install", "-at_install")
+class TestTOTP(HttpCase):
+    def test_totp(self):
+        # 1. Login with demo user
+        uid = self.env.ref("base.user_demo").id
+        self.assertEqual(uid, self.env.ref("base.user_demo").id)
+
+        # 2. Check that we are logged in
+        self.authenticate(user="demo", password="demo")
+        self.assertEqual(self.session.uid, uid)
+
+        # 3. Check expired password
+        self.assertEqual(self.env.user._password_has_expired(), False)
+        self.env.user.action_expire_password()
+        date_tomorrow = datetime.now() + timedelta(days=1)
+        self.assertEqual(
+            self.env.user.partner_id.signup_expiration.strftime("%m/%d/%Y %H:%M:%S"),
+            date_tomorrow.strftime("%m/%d/%Y %H:%M:%S"),
+        )
+
+        self.logout()
+        self.assertNotEqual(self.session.uid, uid)