flask-odoo-graphql 0.0.2
Graphql API for Odoo instance
License: MIT

# Flask-Odoo-Graphql
A flask app for serving Odoo models in Graphql compatable format with user specific secret (authorization) key.

## Table of Content
1.0 [Getting started](#10-getting-started)
  * [How to install](#11-how-to-install)
  * [How to expose models](#12-how-to-expose-models)
  * [How to specify fields to be read](#13-how-to-specify-fields-to-be-read)

2.0 [Authentication](#20-authentication)
  * [How are users authenticated?](#21-how-are-users-authenticated)
  * [How is auth_key generated?](#22-how-is-auth_key-generated)
  * [How sure am I that auth keys can't decryted?](#23-can-authentication-keys-be-decryted)
  * [How can authentication keys be invalidated](#24-how-can-authentication-keys-be-invalidated)
  
3.0 [Authorization](#30-authorization)


---

### 1.0 Getting started

#### 1.1 How to install
>* Create a new folder or clone [flask_odoo_graphql_example template repo](https://github.com/EwetoyeIbrahim/flask_odoo_graphql_example) by running `git clone https://github.com/EwetoyeIbrahim/flask_odoo_graphql_example.git`
>* Install by running `python -m pip install flask_odoo_graphql`
>* In the folder, create or edit the app entry file (`run.py`) to suite your need.
>* run the app by doing something like `python run.py`
>* visit your graphql endpoint (something like `localhost:5000/`) to test it out

#### 1.2 How to expose models
Typically, you have three files to edit when exposing models:
* Create a python file in `schema` folder: see example [code examples](https://github.com/EwetoyeIbrahim/flask_odoo_graphql_example/blob/main/schema/models).
    1. For each model, create a class that contain the fields of interest (note that functions and variables that start with underscore are not included in query fields, so feel free to use them for computation);
    2. Include a `resolve` function.
* Specify the query arguments and `resolve_function` in the `__init__.py` file of schema folder: see how Partners and SaleOrderLines are implementaed for clarification [code example](https://github.com/EwetoyeIbrahim/flask_odoo_graphql_example/blob/main/schema/__init__.py)

#### 1.3 How to specify fields to be read
Fields to be read can be specified in three ways

* Read only the fields in the schema class and available in the queried Odoo model. This is the default.
* Read only the queried fields by passing ('minimal', info) to the field variable. This will save us the overhead of querying irrevelant fields, which may be enormous.
* Read a specified list of fields by passing the list of their names, even if not part of the schema class, to the field variable. This ensures that we have maximum control over what is read

### 2.0 Authentication
In Odoo, authentication is handled with username (yields uid) and password. In order to precvent imputting your uid and password fro all queries, this implementation makes use of auth_key which is a cryptographially encryted dictionary of uid and password.

#### 2.1 How are users authenticated?
> Users are authenticated with the use of auth_key (a user specific long string which should be kept secret as anyone with the key can query the API based on the user level of authorization.

#### 2.2 How is auth_key generated?  
> Appending `/key` to your Graphql endpoint (defaults to /) displays a form which asks for your login detail to the connected Odoo instance. note that no data is stored so don't ask about where is it stored.
The app uses the provided user credentials to to request for a valid uid from Odoo, if the supplied user name and password is actually valid on the instance.
The uid and password are encrypted and encoded to generate an authentication key which should required to access any resources.  

#### 2.3 Can authentication keys be decrypted?
> As long as you require akeep your ENCRPTION_KEY configuration value not guessable (by using an insane mixture of characters) and secret (by not disclosing it) you are 100% safe. Yet it's best to [invalidate an auth_key](#-1.4-How-can-I-invalidate-authentication-key(s)) when leaked.

#### 2.4 How can authentication keys be invalidated?
>* To invalidate auth_key for a specific user; change the password the user on Odoo. Archived users also won't be authenticated.
>* To invalidate auth_key for all users without changing passwords; change your `ENCRYPTION_KEY`

### 3.0 Authorization
All forms of authorization flow is handled in Odoo. To control what  users get to see, go to Settings >> Manage access rights >> Select the API user and Click on `Edit` button >> scroll down and adjust the rights as desired.