80 lines
2.9 KiB
Python
80 lines
2.9 KiB
Python
# -*- coding: utf-8 -*-
|
|
# pyrefly: ignore [missing-import]
|
|
from odoo import http, exceptions
|
|
# pyrefly: ignore [missing-import]
|
|
from odoo.http import request
|
|
|
|
class EducationDemoController(http.Controller):
|
|
|
|
@http.route('/demo/login', type='http', auth='public', methods=['POST'], website=True, csrf=False)
|
|
def demo_login(self, role=None, **kw):
|
|
"""
|
|
Secure Demo Login Endpoint.
|
|
Accepts only 'role' (admin, faculty, student).
|
|
Redirects to safe destinations.
|
|
"""
|
|
if not role:
|
|
raise exceptions.AccessDenied("Missing role parameter.")
|
|
|
|
# Map allowed roles to specific, pre-configured demo user logins
|
|
# Do not allow arbitrary user login
|
|
demo_accounts = {
|
|
'admin': {
|
|
'login': 'demo.admin',
|
|
'password': 'Demo@Admin2026',
|
|
'redirect': '/web'
|
|
},
|
|
'faculty': {
|
|
'login': 'demo.faculty',
|
|
'password': 'Demo@Faculty2026',
|
|
'redirect': '/web'
|
|
},
|
|
'student': {
|
|
'login': 'demo.student',
|
|
'password': 'Demo@Student2026',
|
|
'redirect': '/my/education/dashboard'
|
|
}
|
|
}
|
|
|
|
if role not in demo_accounts:
|
|
raise exceptions.AccessDenied("Invalid role.")
|
|
|
|
account = demo_accounts[role]
|
|
db = request.db
|
|
|
|
if not db:
|
|
# If no DB is set, force it to the single DB (we can get it if there's only one)
|
|
dbs = http.db_list()
|
|
if len(dbs) == 1:
|
|
db = dbs[0]
|
|
else:
|
|
return request.redirect('/web/login')
|
|
|
|
try:
|
|
credential = {
|
|
'login': account['login'],
|
|
'password': account['password'],
|
|
'type': 'password'
|
|
}
|
|
if request.env.cr:
|
|
auth_info = request.session.authenticate(request.env, credential)
|
|
uid = auth_info.get('uid') if auth_info else request.session.uid
|
|
else:
|
|
import odoo
|
|
with odoo.modules.registry.Registry(db).cursor() as cr:
|
|
env = odoo.api.Environment(cr, None, {})
|
|
auth_info = request.session.authenticate(env, credential)
|
|
request._save_session(env)
|
|
request.session.db = db
|
|
uid = auth_info.get('uid') if auth_info else request.session.uid
|
|
except Exception:
|
|
uid = False
|
|
|
|
if not uid:
|
|
# Maybe the demo user doesn't exist yet, or password was changed.
|
|
# Redirect to login with error.
|
|
return request.redirect('/web/login?error=Demo account not properly configured.')
|
|
|
|
# Protect against open redirects: Only use our pre-defined safe redirects
|
|
return request.redirect(account['redirect'])
|