Multi-Tenant-ODOO-MCP

Go to file

MOHAN b56435e258 Add per-key Odoo connection scoping, fix named keys never authenticating

API keys can now be locked to a single Odoo connection at creation time.
A scoped key's tool calls silently default to that connection when none
is specified, and are rejected outright if the caller explicitly requests
a different one. Unscoped keys (including the legacy key) keep working
across all connections as before. New instance_name column on api_keys,
added via a runtime migration so it applies safely to already-deployed
databases, not just fresh installs.

Also fixes a significant pre-existing bug found while testing this:
get_user_by_api_key (used for both REST and MCP auth) only ever checked
the legacy single-key column — it never checked the api_keys table at
all, meaning every named key created via POST /api/keys was completely
unusable for actual authentication. You could create/list/revoke them,
but never log in with one. Named keys now authenticate correctly
everywhere.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-02 02:28:18 +05:30

src/mt_odoo_mcp

Add per-key Odoo connection scoping, fix named keys never authenticating

2026-07-02 02:28:18 +05:30

tests

fixed known bugs_new

2026-06-29 09:10:05 +05:30

.env.example

Add password reset, revocable API keys, usage analytics, and admin panel

2026-07-01 17:05:01 +05:30

.gitignore

Migrate MCP transport to Streamable HTTP, add session sweeper, CORS, public URL config