API keys can now be locked to a single Odoo connection at creation time.
A scoped key's tool calls silently default to that connection when none
is specified, and are rejected outright if the caller explicitly requests
a different one. Unscoped keys (including the legacy key) keep working
across all connections as before. New instance_name column on api_keys,
added via a runtime migration so it applies safely to already-deployed
databases, not just fresh installs.
Also fixes a significant pre-existing bug found while testing this:
get_user_by_api_key (used for both REST and MCP auth) only ever checked
the legacy single-key column — it never checked the api_keys table at
all, meaning every named key created via POST /api/keys was completely
unusable for actual authentication. You could create/list/revoke them,
but never log in with one. Named keys now authenticate correctly
everywhere.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
regenerate_api_key() only updated users.api_key_hash/prefix, leaving the
backfilled 'Default (legacy)' row in api_keys stale after rotation — not a
security issue (the old hash was still correctly rejected) but the Tokens
page would show a wrong/orphaned prefix for a key that no longer works.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds forgot/reset password flow with dev-mode email logging, multiple
named/revocable API keys per user (replacing the single legacy key model
while keeping it working), per-tool-call usage analytics recorded from the
MCP call_tool handler, and a separate admin API (auth/queries/routes) for
managing all users and viewing system-wide analytics — authenticated via a
hardcoded operator identity, fully isolated from regular user auth.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Replaces the old SseServerTransport (broken against current MCP clients —
405s on POST, session-id redirects, no protocol negotiation) with
StreamableHTTPServerTransport. Adds an idle-session sweeper to prevent
abandoned client connections from leaking memory indefinitely, CORS
middleware for browser-based frontend access, and PUBLIC_URL/CORS_ORIGINS
settings so signup responses show the correct connection URL instead of a
placeholder.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
