feat(spp_dci_server): accept OAuth2 access tokens for bearer auth

The DCI server only string-matched a static bearer-token list (dci.api_tokens),
so the client's OAuth2 client-credentials support had nothing to authenticate
against. Extend verify_bearer_token to also accept an OAuth2 access token: a JWT
issued by spp_api_v2 (POST /api_v2/oauth/token) is validated with spp_api_v2's
own verifier (HS256 signature, iss/aud, expiry), then the client_id claim must
resolve to an active spp.api.client. Static bearer tokens keep working unchanged;
the JWT path is an additive fallback. spp_dci_server already depends on
spp_api_v2, so the verifier is reused, not duplicated.

End-to-end: point the client data source's oauth2_token_url at the server's
/api_v2/oauth/token with an spp.api.client's credentials.

Author: gonzalesedwin1123

spp_dci_server/README.rst

@@ -35,6 +35,10 @@ Key Capabilities
   ``/dci_api/v1`` with automatic OpenAPI documentation
 - **HTTP Signature Verification**: Validates inbound requests using
   Ed25519/RSA signatures against sender public keys
+- **Bearer Authentication**: Accepts either a static token (system
+  parameter ``dci.api_tokens``) or an OAuth2 client-credentials access
+  token (a JWT issued by ``spp_api_v2`` at ``POST /api_v2/oauth/token``,
+  validated against an active ``spp.api.client``)
 - **Async Transaction Processing**: Queues search, subscribe, and
   unsubscribe operations for background processing with automatic
   callbacks

spp_dci_server/__manifest__.py

@@ -1,7 +1,7 @@
 {  # pylint: disable=pointless-statement
     "name": "OpenSPP DCI Server",
     "summary": "DCI API server infrastructure with FastAPI routers",
-    "version": "19.0.2.0.1",
+    "version": "19.0.2.0.2",
     "category": "OpenSPP/Integration",
     "author": "OpenSPP.org",
     "website": "https://github.com/OpenSPP/OpenSPP2",

spp_dci_server/middleware/signature.py

@@ -246,6 +246,40 @@ async def verify_dci_signature(
 _empty_tokens_warning_logged = False
 
 
+def _validate_oauth2_jwt(env: Environment, token: str) -> str | None:
+    """Return the client_id when ``token`` is a valid OAuth2 access token.
+
+    Lets a DCI caller authenticate with an OAuth2 client-credentials JWT issued
+    by spp_api_v2 (``POST /api_v2/oauth/token``) instead of a static bearer
+    token. The JWT is validated with spp_api_v2's own verifier (HS256 signature,
+    ``iss``/``aud``, expiry), then the ``client_id`` claim must resolve to an
+    active ``spp.api.client``.
+
+    Returns the client_id on success, or ``None`` on any failure (bad signature,
+    expired, wrong issuer/audience, secret unset, unknown/inactive client, or a
+    non-JWT opaque token) so the caller can fall back to other auth paths.
+    """
+    try:
+        from odoo.addons.spp_api_v2.middleware.auth import _validate_jwt_token
+    except ImportError:
+        return None
+    try:
+        payload = _validate_jwt_token(env, token)
+    except Exception:
+        # Not a valid spp_api_v2 JWT — fall back to static-token handling.
+        return None
+    client_id = payload.get("client_id")
+    if not client_id:
+        return None
+    # nosemgrep: odoo-sudo-without-context
+    client = env["spp.api.client"].sudo().search([("client_id", "=", client_id), ("active", "=", True)], limit=1)
+    if not client:
+        _logger.warning("OAuth2 JWT names unknown/inactive client_id: %s", client_id)
+        return None
+    _logger.debug("DCI request authenticated via OAuth2 JWT for client %s", client_id)
+    return client_id
+
+
 async def verify_bearer_token(
     env: Annotated[Environment, Depends(odoo_env)],
     authorization: Annotated[str | None, Header()] = None,
@@ -332,15 +366,22 @@ async def verify_bearer_token(
         for candidate in accepted_tokens:
             if hmac.compare_digest(token, candidate):
                 matched = True
-        if not matched:
-            _logger.warning("DCI request has invalid Bearer token")
-            raise DCIHTTPException(
-                status_code=status.HTTP_401_UNAUTHORIZED,
-                error_message="Invalid Bearer token",
-                error_code="err.auth.invalid_token",
-                headers={"WWW-Authenticate": "Bearer"},
-            )
-        _logger.debug("Bearer token validated against configured tokens")
+        if matched:
+            _logger.debug("Bearer token validated against configured tokens")
+            return token
+        # Not a configured static token — it may be an OAuth2 access token.
+        if _validate_oauth2_jwt(env, token):
+            return token
+        _logger.warning("DCI request has invalid Bearer token")
+        raise DCIHTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            error_message="Invalid Bearer token",
+            error_code="err.auth.invalid_token",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    # No static tokens configured: still accept a valid OAuth2 access token.
+    if _validate_oauth2_jwt(env, token):
         return token
 
     # nosemgrep: odoo-timing-attack-password  # not a token compare; matches a config flag value

spp_dci_server/readme/DESCRIPTION.md

@@ -4,6 +4,7 @@ DCI API server infrastructure for receiving and processing Digital Convergence I
 
 - **FastAPI Endpoints**: Exposes DCI-compliant REST API at `/dci_api/v1` with automatic OpenAPI documentation
 - **HTTP Signature Verification**: Validates inbound requests using Ed25519/RSA signatures against sender public keys
+- **Bearer Authentication**: Accepts either a static token (system parameter `dci.api_tokens`) or an OAuth2 client-credentials access token (a JWT issued by `spp_api_v2` at `POST /api_v2/oauth/token`, validated against an active `spp.api.client`)
 - **Async Transaction Processing**: Queues search, subscribe, and unsubscribe operations for background processing with automatic callbacks
 - **Event Subscriptions**: Manages external system subscriptions to registry events (registration, update, delete) with notification delivery
 - **JWKS Distribution**: Publishes server public keys at `/.well-known/jwks.json` for signature verification by clients

spp_dci_server/static/description/index.html

@@ -382,6 +382,10 @@ <h1>Key Capabilities</h1>
 <tt class="docutils literal">/dci_api/v1</tt> with automatic OpenAPI documentation</li>
 <li><strong>HTTP Signature Verification</strong>: Validates inbound requests using
 Ed25519/RSA signatures against sender public keys</li>
+<li><strong>Bearer Authentication</strong>: Accepts either a static token (system
+parameter <tt class="docutils literal">dci.api_tokens</tt>) or an OAuth2 client-credentials access
+token (a JWT issued by <tt class="docutils literal">spp_api_v2</tt> at <tt class="docutils literal">POST /api_v2/oauth/token</tt>,
+validated against an active <tt class="docutils literal">spp.api.client</tt>)</li>
 <li><strong>Async Transaction Processing</strong>: Queues search, subscribe, and
 unsubscribe operations for background processing with automatic
 callbacks</li>

spp_dci_server/tests/test_bearer_middleware.py

@@ -9,13 +9,19 @@
 """
 
 import asyncio
+import os
+from datetime import datetime, timedelta
 
 from odoo.tests import tagged
 
 from fastapi import HTTPException
 
 from .common import DCIServerCommon
 
+# 48-char high-entropy secret so spp_api_v2's _validate_jwt_secret_strength
+# (>=32 chars, entropy >= 3.0) accepts it.
+_TEST_JWT_SECRET = "Zx9Kq2Lm7Pw4Rt6Yv1Nb8Hc3Jd5Fg0SaUeWiOqTzXyMnBvCr"
+
 
 def _run(coro):
     loop = asyncio.new_event_loop()
@@ -191,3 +197,97 @@ def test_security_flags_default_to_fail_closed(self):
                 safe_value,
                 f"{key} must default to {safe_value!r} (fail-closed)",
             )
+
+
+@tagged("post_install", "-at_install")
+class TestOAuth2BearerToken(DCIServerCommon):
+    """The bearer dependency also accepts OAuth2 access tokens (spp_api_v2
+    JWTs) so DCI callers can authenticate with client-credentials, not only
+    static tokens."""
+
+    def setUp(self):
+        super().setUp()
+        from odoo.addons.spp_dci_server.middleware import signature as sig_module
+
+        self.verify_bearer_token = sig_module.verify_bearer_token
+        sig_module._bearer_bypass_warning_logged = False
+        sig_module._empty_tokens_warning_logged = False
+        self.ICP = self.env["ir.config_parameter"].sudo()
+        # Sign with the secret the verifier will use (env var wins over param).
+        self.secret = os.environ.get("OPENSPP_JWT_SECRET") or _TEST_JWT_SECRET
+        if not os.environ.get("OPENSPP_JWT_SECRET"):
+            self.ICP.set_param("spp_api_v2.jwt_secret", self.secret)
+        self.client = self.env["spp.api.client"].create(
+            {
+                "name": "DCI OAuth Test Client",
+                "partner_id": self.test_partner.id,
+                "organization_type_id": self.org_type_government.id,
+            }
+        )
+
+    def _call(self, authorization=None):
+        return _run(self.verify_bearer_token(self.env, authorization))
+
+    def _mint_jwt(self, client_id=None, expires_in_hours=1, secret=None):
+        import jwt
+
+        now = datetime.utcnow()
+        payload = {
+            "iss": "openspp-api-v2",
+            "aud": "openspp",
+            "sub": client_id or self.client.client_id,
+            "client_id": client_id or self.client.client_id,
+            "iat": now,
+            "exp": now + timedelta(hours=expires_in_hours),
+            "scopes": [],
+        }
+        return jwt.encode(payload, secret or self.secret, algorithm="HS256")
+
+    def test_valid_oauth2_jwt_accepted(self):
+        """A valid OAuth2 JWT is accepted even with no static tokens and
+        dci.api_tokens_required=true."""
+        self.ICP.set_param("dci.api_tokens", "")
+        self.ICP.set_param("dci.api_tokens_required", "true")
+        token = self._mint_jwt()
+        self.assertEqual(self._call(f"Bearer {token}"), token)
+
+    def test_oauth2_jwt_accepted_alongside_nonmatching_static(self):
+        """A valid OAuth2 JWT is accepted even when a (non-matching) static
+        token list is configured."""
+        self.ICP.set_param("dci.api_tokens", "some-other-static-token")
+        token = self._mint_jwt()
+        self.assertEqual(self._call(f"Bearer {token}"), token)
+
+    def test_static_token_still_accepted(self):
+        """Regression: configured static tokens keep working."""
+        self.ICP.set_param("dci.api_tokens", "static-abc")
+        self.assertEqual(self._call("Bearer static-abc"), "static-abc")
+
+    def test_expired_oauth2_jwt_rejected(self):
+        self.ICP.set_param("dci.api_tokens", "")
+        token = self._mint_jwt(expires_in_hours=-1)
+        with self.assertRaises(HTTPException) as ctx:
+            self._call(f"Bearer {token}")
+        self.assertEqual(ctx.exception.status_code, 401)
+
+    def test_invalid_signature_jwt_rejected(self):
+        self.ICP.set_param("dci.api_tokens", "")
+        token = self._mint_jwt(secret="wrong-but-long-enough-secret-aB3dE6fH9jK2mN5pQ8rT1v")
+        with self.assertRaises(HTTPException) as ctx:
+            self._call(f"Bearer {token}")
+        self.assertEqual(ctx.exception.status_code, 401)
+
+    def test_oauth2_jwt_for_inactive_client_rejected(self):
+        self.ICP.set_param("dci.api_tokens", "")
+        self.client.active = False
+        token = self._mint_jwt()
+        with self.assertRaises(HTTPException) as ctx:
+            self._call(f"Bearer {token}")
+        self.assertEqual(ctx.exception.status_code, 401)
+
+    def test_oauth2_jwt_unknown_client_rejected(self):
+        self.ICP.set_param("dci.api_tokens", "")
+        token = self._mint_jwt(client_id="no-such-client-id")
+        with self.assertRaises(HTTPException) as ctx:
+            self._call(f"Bearer {token}")
+        self.assertEqual(ctx.exception.status_code, 401)