Securing Odoo REST & JSON-RPC Endpoints: Rate Limits, Token Rotation & OAuth2 Security

# -*- coding: utf-8 -*-
from odoo import models, fields, api, _
from odoo.exceptions import AccessError
import secrets

class ScopedEnterpriseApiKey(models.Model):
    _name = 'scoped.enterprise.api.key'
    _description = 'Hardened Scoped API Key Manager'

    name = fields.Char(string="Integration Client Name", required=True)
    api_key_secret = fields.Char(string="Secret Key Token", readonly=True, index=True)
    user_id = fields.Many2one('res.users', string="Associated Service User", required=True)
    allowed_model_ids = fields.Many2many('ir.model', string="Permitted Models Only")
    expiration_date = fields.Date(string="Token Expiration Date", required=True)
    is_active = fields.Boolean(string="Active Key", default=True)

    @api.model
    def generate_scoped_token(self, client_name, user_id, model_names, validity_days=90):
        """
        Generates cryptographic 64-character token with automatic expiration.
        """
        token = secrets.token_urlsafe(48)
        models_to_permit = self.env['ir.model'].search([('model', 'in', model_names)])

        record = self.create({
            'name': client_name,
            'api_key_secret': token,
            'user_id': user_id,
            'allowed_model_ids': [(6, 0, models_to_permit.ids)],
            'expiration_date': fields.Date.add(fields.Date.today(), days=validity_days)
        })
        return token

    def validate_request_access(self, target_model):
        self.ensure_one()
        if not self.is_active or self.expiration_date < fields.Date.today():
            raise AccessError(_("API Security Token expired or deactivated."))

        if target_model not in self.allowed_model_ids.mapped('model'):
            raise AccessError(_("UNAUTHORIZED API CALL: Key not permitted to access model %s") % target_model)
        return True