A trailing slash on CORS_ORIGINS never matches a browser's Origin header
(which never includes a path), silently breaking CORS with no error
message beyond the browser's generic "No Access-Control-Allow-Origin
header" — exactly what happened in production after switching domains.
A trailing slash on PUBLIC_URL/FRONTEND_BASE_URL similarly produced
double-slash URLs in API responses and reset-password links. All three
are now normalized at config-load time so a .env typo can't cause this
again.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Renames all user-facing branding to match the new getodoomcp.com domain:
default MCP server name (shown to MCP clients during the initialize
handshake), password-reset email subject/from-address. Internal Python
package name (mt_odoo_mcp) deliberately left unchanged — renaming it would
require updating every import plus the deployed systemd/pm2 invocation,
for zero user-visible benefit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Documents the current production domains (api.getodoomcp.com backend,
getodoomcp.com frontend) and warns against trailing slashes on
PUBLIC_URL/CORS_ORIGINS/FRONTEND_BASE_URL, which caused a CORS + double-
slash 404 bug on the frontend.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
API keys can now be locked to a single Odoo connection at creation time.
A scoped key's tool calls silently default to that connection when none
is specified, and are rejected outright if the caller explicitly requests
a different one. Unscoped keys (including the legacy key) keep working
across all connections as before. New instance_name column on api_keys,
added via a runtime migration so it applies safely to already-deployed
databases, not just fresh installs.
Also fixes a significant pre-existing bug found while testing this:
get_user_by_api_key (used for both REST and MCP auth) only ever checked
the legacy single-key column — it never checked the api_keys table at
all, meaning every named key created via POST /api/keys was completely
unusable for actual authentication. You could create/list/revoke them,
but never log in with one. Named keys now authenticate correctly
everywhere.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
regenerate_api_key() only updated users.api_key_hash/prefix, leaving the
backfilled 'Default (legacy)' row in api_keys stale after rotation — not a
security issue (the old hash was still correctly rejected) but the Tokens
page would show a wrong/orphaned prefix for a key that no longer works.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds forgot/reset password flow with dev-mode email logging, multiple
named/revocable API keys per user (replacing the single legacy key model
while keeping it working), per-tool-call usage analytics recorded from the
MCP call_tool handler, and a separate admin API (auth/queries/routes) for
managing all users and viewing system-wide analytics — authenticated via a
hardcoded operator identity, fully isolated from regular user auth.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Replaces the old SseServerTransport (broken against current MCP clients —
405s on POST, session-id redirects, no protocol negotiation) with
StreamableHTTPServerTransport. Adds an idle-session sweeper to prevent
abandoned client connections from leaking memory indefinitely, CORS
middleware for browser-based frontend access, and PUBLIC_URL/CORS_ORIGINS
settings so signup responses show the correct connection URL instead of a
placeholder.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
