Add support to skip the logout confirmation in the auth provider

Add field to oauth provider to toggle skip logout confirmation

Added tests for the skip confirmation feature

Applied auto format changes

auth_oidc/controllers/main.py

@@ -72,6 +72,8 @@ def logout(self, redirect="/web/login"):
                 params = parse_qs(components.query)
                 params["client_id"] = provider.client_id
                 params["post_logout_redirect_uri"] = redirect_url
+                if provider.skip_logout_confirmation and user.oauth_id_token:
+                    params["id_token_hint"] = user.oauth_id_token
                 logout_url = components._replace(query=url_encode(params)).geturl()
                 return super().logout(redirect=logout_url)
         # User has no account with any provider or no logout URL is configured for the provider

auth_oidc/models/auth_oauth_provider.py

@@ -52,6 +52,11 @@ class AuthOauthProvider(models.Model):
         "in the client, should be the value of end_session_endpoint specified by "
         "the authorization provider.",
     )
+    skip_logout_confirmation = fields.Boolean(
+        default=False,
+        string="Skip Logout Confirmation",
+        help="If set to true, the logout confirmation is skipped in the authorization provider.",
+    )
 
     @tools.ormcache("self.jwks_uri", "kid")
     def _get_keys(self, kid):

auth_oidc/models/res_users.py

@@ -6,7 +6,7 @@
 
 import requests
 
-from odoo import api, models
+from odoo import api, fields, models
 from odoo.exceptions import AccessDenied
 from odoo.http import request
 
@@ -16,6 +16,8 @@
 class ResUsers(models.Model):
     _inherit = "res.users"
 
+    oauth_id_token = fields.Char(string="OAuth Id Token", readonly=True, copy=False)
+
     def _auth_oauth_get_tokens_implicit_flow(self, oauth_provider, params):
         # https://openid.net/specs/openid-connect-core-1_0.html#ImplicitAuthResponse
         return params.get("access_token"), params.get("id_token")
@@ -74,7 +76,12 @@ def auth_oauth(self, provider, params):
             raise AccessDenied()
         # retrieve and sign in user
         params["access_token"] = access_token
+        params["id_token"] = id_token
         login = self._auth_oauth_signin(provider, validation, params)
+        oauth_user = self.search(
+            [("login", "=", login), ("oauth_access_token", "=", access_token)]
+        )
+        oauth_user.write({"oauth_id_token": params["id_token"]})
         if not login:
             raise AccessDenied()
         # return user credentials

auth_oidc/tests/test_auth_oidc_logout.py

@@ -128,3 +128,59 @@ def test_oidc_logout_with_absolute_redirect_url(self):
             actual_params = dict(parse_qsl(actual_components.query))
             self.assertEqual(CLIENT_ID, actual_params["client_id"])
             self.assertEqual(BASE_URL, actual_params["post_logout_redirect_uri"])
+
+    def test_oidc_logout_skip_confirmation(self):
+        """Test that oidc logout skips confirmation"""
+        id_token = "test-id-token"
+        self._set_test_oidc_logout_url(urljoin(OIDC_BASE_LOGOUT_URL, OIDC_LOGOUT_PATH))
+        self.provider.write({"skip_logout_confirmation": True})
+        user = self._prepare_login_test_user(self.provider)
+        user.write({"oauth_id_token": id_token})
+        with create_request(self.env, user.id, self.mock_logout_user):
+            resp = OpenIDLogout().logout()
+            self.assertTrue(resp.location.startswith(OIDC_BASE_LOGOUT_URL))
+            actual_components = urlparse(resp.location)
+            self.assertEqual(OIDC_LOGOUT_PATH, actual_components.path)
+            actual_params = dict(parse_qsl(actual_components.query))
+            self.assertEqual(CLIENT_ID, actual_params["client_id"])
+            self.assertEqual(id_token, actual_params["id_token_hint"])
+            self.assertEqual(
+                urljoin(BASE_URL, LOGIN_PATH), actual_params["post_logout_redirect_uri"]
+            )
+
+    def test_oidc_logout_not_skip_confirmation_if_no_id_token(self):
+        """Test that oidc logout does not skip confirmation if user has no oauth_id_token"""
+        id_token = "test-id-token"
+        self._set_test_oidc_logout_url(urljoin(OIDC_BASE_LOGOUT_URL, OIDC_LOGOUT_PATH))
+        self.provider.write({"skip_logout_confirmation": True})
+        user = self._prepare_login_test_user(self.provider)
+        with create_request(self.env, user.id, self.mock_logout_user):
+            resp = OpenIDLogout().logout()
+            self.assertTrue(resp.location.startswith(OIDC_BASE_LOGOUT_URL))
+            actual_components = urlparse(resp.location)
+            self.assertEqual(OIDC_LOGOUT_PATH, actual_components.path)
+            actual_params = dict(parse_qsl(actual_components.query))
+            self.assertEqual(CLIENT_ID, actual_params["client_id"])
+            self.assertIsNone(actual_params.get("id_token_hint"))
+            self.assertEqual(
+                urljoin(BASE_URL, LOGIN_PATH), actual_params["post_logout_redirect_uri"]
+            )
+
+    def test_oidc_logout_not_skip_confirmation_if_not_enabled(self):
+        """Test that oidc logout skips confirmation"""
+        id_token = "test-id-token"
+        self._set_test_oidc_logout_url(urljoin(OIDC_BASE_LOGOUT_URL, OIDC_LOGOUT_PATH))
+        self.provider.write({"skip_logout_confirmation": False})
+        user = self._prepare_login_test_user(self.provider)
+        user.write({"oauth_id_token": id_token})
+        with create_request(self.env, user.id, self.mock_logout_user):
+            resp = OpenIDLogout().logout()
+            self.assertTrue(resp.location.startswith(OIDC_BASE_LOGOUT_URL))
+            actual_components = urlparse(resp.location)
+            self.assertEqual(OIDC_LOGOUT_PATH, actual_components.path)
+            actual_params = dict(parse_qsl(actual_components.query))
+            self.assertEqual(CLIENT_ID, actual_params["client_id"])
+            self.assertIsNone(actual_params.get("id_token_hint"))
+            self.assertEqual(
+                urljoin(BASE_URL, LOGIN_PATH), actual_params["post_logout_redirect_uri"]
+            )

auth_oidc/views/auth_oauth_provider.xml

@@ -19,6 +19,7 @@
                 <field name="token_endpoint" />
                 <field name="jwks_uri" />
                 <field name="end_session_endpoint" />
+                <field name="skip_logout_confirmation" />
             </field>
         </field>
     </record>