Initial commit: OCA Server Auth packages (29 packages)

2026-04-18 05:12:02 +02:00 · 2025-08-29 15:43:06 +02:00 · 2025-08-29 15:43:06 +02:00 · 3ed80311c4
commit 3ed80311c4
1325 changed files with 127292 additions and 0 deletions
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/README.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/README.md
@ -0,0 +1,46 @@
+# Auth JWT Test
+
+Odoo addon: auth_jwt_demo
+
+## Installation
+
+```bash
+pip install odoo-bringout-oca-server-auth-auth_jwt_demo
+```
+
+## Dependencies
+
+This addon depends on:
+- auth_jwt
+
+## Manifest Information
+
+- **Name**: Auth JWT Test
+- **Version**: 16.0.1.1.1
+- **Category**: N/A
+- **License**: LGPL-3
+- **Installable**: False
+
+## Source
+
+Based on [OCA/server-auth](https://github.com/OCA/server-auth) branch 16.0, addon `auth_jwt_demo`.
+
+## License
+
+This package maintains the original LGPL-3 license from the upstream Odoo project.
+
+## Documentation
+
+- Overview: doc/OVERVIEW.md
+- Architecture: doc/ARCHITECTURE.md
+- Models: doc/MODELS.md
+- Controllers: doc/CONTROLLERS.md
+- Wizards: doc/WIZARDS.md
+- Reports: doc/REPORTS.md
+- Security: doc/SECURITY.md
+- Install: doc/INSTALL.md
+- Usage: doc/USAGE.md
+- Configuration: doc/CONFIGURATION.md
+- Dependencies: doc/DEPENDENCIES.md
+- Troubleshooting: doc/TROUBLESHOOTING.md
+- FAQ: doc/FAQ.md
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/README.rst
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/README.rst
@ -0,0 +1,120 @@
+=============
+Auth JWT Test
+=============
+
+.. 
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! This file is generated by oca-gen-addon-readme !!
+   !! changes will be overwritten.                   !!
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! source digest: sha256:9ce33333821bc91d449de0e10a8ac8633e13a98234e40abd300951b71eb85e6b
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png
+    :target: https://odoo-community.org/page/development-status
+    :alt: Beta
+.. |badge2| image:: https://img.shields.io/badge/licence-LGPL--3-blue.png
+    :target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html
+    :alt: License: LGPL-3
+.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--auth-lightgray.png?logo=github
+    :target: https://github.com/OCA/server-auth/tree/16.0/auth_jwt_demo
+    :alt: OCA/server-auth
+.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
+    :target: https://translation.odoo-community.org/projects/server-auth-16-0/server-auth-16-0-auth_jwt_demo
+    :alt: Translate me on Weblate
+.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
+    :target: https://runboat.odoo-community.org/builds?repo=OCA/server-auth&target_branch=16.0
+    :alt: Try me on Runboat
+
+|badge1| |badge2| |badge3| |badge4| |badge5|
+
+A test/demo module for ``auth_jwt``.
+
+**Table of contents**
+
+.. contents::
+   :local:
+
+Usage
+=====
+
+This modules creates a JWT validator named ``demo``, and adds a
+``/auth_jwt_demo/whoami`` route which returns information about the partner
+identified in the token.
+
+The ``whoami`` endpoint can be invoked as such, assuming `python-jose
+<https://pypi.org/project/python-jose/>`_ is installed.
+
+
+.. code-block:: python
+
+    # /usr/bin/env python3
+    import time
+
+    import requests
+    from jose import jwt
+
+    token = jwt.encode(
+        {
+            "aud": "auth_jwt_test_api",
+            "iss": "some issuer",
+            "exp": time.time() + 60,
+            "email": "mark.brown23@example.com",
+        },
+        key="thesecret",
+        algorithm=jwt.ALGORITHMS.HS256,
+    )
+    r = requests.get(
+        "http://localhost:8069/auth_jwt_demo/whoami",
+        headers={"Authorization": "Bearer " + token},
+    )
+    r.raise_for_status()
+    print(r.json())
+
+Bug Tracker
+===========
+
+Bugs are tracked on `GitHub Issues <https://github.com/OCA/server-auth/issues>`_.
+In case of trouble, please check there if your issue has already been reported.
+If you spotted it first, help us to smash it by providing a detailed and welcomed
+`feedback <https://github.com/OCA/server-auth/issues/new?body=module:%20auth_jwt_demo%0Aversion:%2016.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
+
+Do not contact contributors directly about support or help with technical issues.
+
+Credits
+=======
+
+Authors
+~~~~~~~
+
+* ACSONE SA/NV
+
+Contributors
+~~~~~~~~~~~~
+
+* Stéphane Bidoul <stephane.bidoul@acsone.eu>
+
+Maintainers
+~~~~~~~~~~~
+
+This module is maintained by the OCA.
+
+.. image:: https://odoo-community.org/logo.png
+   :alt: Odoo Community Association
+   :target: https://odoo-community.org
+
+OCA, or the Odoo Community Association, is a nonprofit organization whose
+mission is to support the collaborative development of Odoo features and
+promote its widespread use.
+
+.. |maintainer-sbidoul| image:: https://github.com/sbidoul.png?size=40px
+    :target: https://github.com/sbidoul
+    :alt: sbidoul
+
+Current `maintainer <https://odoo-community.org/page/maintainer-role>`__:
+
+|maintainer-sbidoul| 
+
+This module is part of the `OCA/server-auth <https://github.com/OCA/server-auth/tree/16.0/auth_jwt_demo>`_ project on GitHub.
+
+You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/init.py
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/init.py
@ -0,0 +1 @@
+from . import controllers
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/manifest.py
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/manifest.py
@ -0,0 +1,16 @@
+# Copyright 2021 ACSONE SA/NV
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl).
+
+{
+    "name": "Auth JWT Test",
+    "summary": """
+        Test/demo module for auth_jwt.""",
+    "version": "16.0.1.1.1",
+    "license": "LGPL-3",
+    "author": "ACSONE SA/NV,Odoo Community Association (OCA)",
+    "maintainers": ["sbidoul"],
+    "website": "https://github.com/OCA/server-auth",
+    "depends": ["auth_jwt"],
+    "data": [],
+    "demo": ["demo/auth_jwt_validator.xml"],
+}
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/controllers/init.py
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/controllers/init.py
@ -0,0 +1 @@
+from . import main
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/controllers/main.py
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/controllers/main.py
@ -0,0 +1,117 @@
+# Copyright 2021 ACSONE SA/NV
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl).
+
+import json
+
+from odoo.http import Controller, Response, request, route
+
+
+class JWTTestController(Controller):
+    @route(
+        "/auth_jwt_demo/whoami",
+        type="http",
+        auth="jwt_demo",
+        csrf=False,
+        cors="*",
+        save_session=False,
+        methods=["GET", "OPTIONS"],
+    )
+    def whoami(self):
+        data = {}
+        if getattr(request, "jwt_partner_id", None):
+            partner = request.env["res.partner"].browse(request.jwt_partner_id)
+            data.update(name=partner.name, email=partner.email, uid=request.env.uid)
+        return Response(json.dumps(data), content_type="application/json", status=200)
+
+    @route(
+        "/auth_jwt_demo/whoami-public-or-jwt",
+        type="http",
+        auth="public_or_jwt_demo",
+        csrf=False,
+        cors="*",
+        save_session=False,
+        methods=["GET", "OPTIONS"],
+    )
+    def whoami_public_or_jwt(self):
+        data = {"uid": request.env.uid}
+        if getattr(request, "jwt_partner_id", None):
+            partner = request.env["res.partner"].browse(request.jwt_partner_id)
+            data.update(name=partner.name, email=partner.email)
+        return Response(json.dumps(data), content_type="application/json", status=200)
+
+    @route(
+        "/auth_jwt_demo_cookie/whoami",
+        type="http",
+        auth="jwt_demo_cookie",
+        csrf=False,
+        cors="*",
+        save_session=False,
+        methods=["GET", "OPTIONS"],
+    )
+    def whoami_cookie(self):
+        data = {"uid": request.env.uid}
+        if getattr(request, "jwt_partner_id", None):
+            partner = request.env["res.partner"].browse(request.jwt_partner_id)
+            data.update(name=partner.name, email=partner.email)
+        return Response(json.dumps(data), content_type="application/json", status=200)
+
+    @route(
+        "/auth_jwt_demo_cookie/whoami-public-or-jwt",
+        type="http",
+        auth="public_or_jwt_demo_cookie",
+        csrf=False,
+        cors="*",
+        save_session=False,
+        methods=["GET", "OPTIONS"],
+    )
+    def whoami_cookie_public_or_jwt(self):
+        data = {"uid": request.env.uid}
+        if getattr(request, "jwt_partner_id", None):
+            partner = request.env["res.partner"].browse(request.jwt_partner_id)
+            data.update(name=partner.name, email=partner.email)
+        return Response(json.dumps(data), content_type="application/json", status=200)
+
+    @route(
+        "/auth_jwt_demo/keycloak/whoami",
+        type="http",
+        auth="jwt_demo_keycloak",
+        csrf=False,
+        cors="*",
+        save_session=False,
+        methods=["GET", "OPTIONS"],
+    )
+    def whoami_keycloak(self):
+        """To use with the demo_keycloak validator.
+
+        You can play with this using the browser app in tests/spa and the
+        identity provider in tests/keycloak.
+        """
+        data = {}
+        if getattr(request, "jwt_partner_id", None):
+            partner = request.env["res.partner"].browse(request.jwt_partner_id)
+            data.update(name=partner.name, email=partner.email)
+        return Response(json.dumps(data), content_type="application/json", status=200)
+
+    @route(
+        "/auth_jwt_demo/keycloak/whoami-public-or-jwt",
+        type="http",
+        auth="public_or_jwt_demo_keycloak",
+        csrf=False,
+        cors="*",
+        save_session=False,
+        methods=["GET", "OPTIONS"],
+    )
+    def whoami_public_or_keycloak(self):
+        """To use with the demo_keycloak validator.
+
+        You can play with this using the browser app in tests/spa and the
+        identity provider in tests/keycloak.
+        """
+        data = {"uid": request.env.uid}
+        if getattr(request, "jwt_partner_id", None):
+            partner = request.env["res.partner"].browse(request.jwt_partner_id)
+            data.update(name=partner.name, email=partner.email)
+        else:
+            # public
+            data.update(name="Anonymous")
+        return Response(json.dumps(data), content_type="application/json", status=200)
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/demo/auth_jwt_validator.xml
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/demo/auth_jwt_validator.xml
@ -0,0 +1,42 @@
+<odoo>
+    <record id="demo_validator" model="auth.jwt.validator">
+        <field name="name">demo</field>
+        <field name="audience">auth_jwt_test_api</field>
+        <field name="issuer">theissuer</field>
+        <field name="signature_type">secret</field>
+        <field name="secret_algorithm">HS256</field>
+        <field name="secret_key">thesecret</field>
+        <field name="user_id_strategy">static</field>
+        <field name="static_user_id" ref="base.user_demo" />
+        <field name="partner_id_strategy">email</field>
+        <field name="partner_id_required" eval="False" />
+    </record>
+    <record id="demo_cookie_validator" model="auth.jwt.validator">
+        <field name="name">demo_cookie</field>
+        <field name="audience">auth_jwt_test_api</field>
+        <field name="issuer">theissuer</field>
+        <field name="signature_type">secret</field>
+        <field name="secret_algorithm">HS256</field>
+        <field name="secret_key">thesecret</field>
+        <field name="user_id_strategy">static</field>
+        <field name="static_user_id" ref="base.user_demo" />
+        <field name="partner_id_strategy">email</field>
+        <field name="partner_id_required" eval="False" />
+        <field name="cookie_enabled" eval="True" />
+        <field name="cookie_name">demo_auth</field>
+    </record>
+    <record id="demo_keycloak_validator" model="auth.jwt.validator">
+        <field name="name">demo_keycloak</field>
+        <field name="audience">auth_jwt_test_api</field>
+        <field name="issuer">http://localhost:8080/auth/realms/master</field>
+        <field name="signature_type">public_key</field>
+        <field name="public_key_algorithm">RS256</field>
+        <field
+            name="public_key_jwk_uri"
+        >http://localhost:8080/auth/realms/master/protocol/openid-connect/certs</field>
+        <field name="user_id_strategy">static</field>
+        <field name="static_user_id">1</field>
+        <field name="partner_id_strategy">email</field>
+        <field name="partner_id_required" eval="False" />
+    </record>
+</odoo>
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/i18n/auth_jwt_demo.pot
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/i18n/auth_jwt_demo.pot
@ -0,0 +1,13 @@
+# Translation of Odoo Server.
+# This file contains the translation of the following modules:
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: Odoo Server 16.0\n"
+"Report-Msgid-Bugs-To: \n"
+"Last-Translator: \n"
+"Language-Team: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: \n"
+"Plural-Forms: \n"
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/i18n/it.po
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/i18n/it.po
@ -0,0 +1,14 @@
+# Translation of Odoo Server.
+# This file contains the translation of the following modules:
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: Odoo Server 16.0\n"
+"Report-Msgid-Bugs-To: \n"
+"Last-Translator: Automatically generated\n"
+"Language-Team: none\n"
+"Language: it\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: \n"
+"Plural-Forms: nplurals=2; plural=n != 1;\n"
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/readme/CONTRIBUTORS.rst
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/readme/CONTRIBUTORS.rst
@ -0,0 +1 @@
+* Stéphane Bidoul <stephane.bidoul@acsone.eu>
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/readme/DESCRIPTION.rst
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/readme/DESCRIPTION.rst
@ -0,0 +1 @@
+A test/demo module for ``auth_jwt``.
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/readme/USAGE.rst
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/readme/USAGE.rst
@ -0,0 +1,32 @@
+This modules creates a JWT validator named ``demo``, and adds a
+``/auth_jwt_demo/whoami`` route which returns information about the partner
+identified in the token.
+
+The ``whoami`` endpoint can be invoked as such, assuming `python-jose
+<https://pypi.org/project/python-jose/>`_ is installed.
+
+
+.. code-block:: python
+
+    # /usr/bin/env python3
+    import time
+
+    import requests
+    from jose import jwt
+
+    token = jwt.encode(
+        {
+            "aud": "auth_jwt_test_api",
+            "iss": "some issuer",
+            "exp": time.time() + 60,
+            "email": "mark.brown23@example.com",
+        },
+        key="thesecret",
+        algorithm=jwt.ALGORITHMS.HS256,
+    )
+    r = requests.get(
+        "http://localhost:8069/auth_jwt_demo/whoami",
+        headers={"Authorization": "Bearer " + token},
+    )
+    r.raise_for_status()
+    print(r.json())
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/static/description/icon.png
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/static/description/icon.png
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/static/description/index.html
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/static/description/index.html
@ -0,0 +1,455 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<meta name="generator" content="Docutils: https://docutils.sourceforge.io/" />
+<title>Auth JWT Test</title>
+<style type="text/css">
+
+/*
+:Author: David Goodger (goodger@python.org)
+:Id: $Id: html4css1.css 8954 2022-01-20 10:10:25Z milde $
+:Copyright: This stylesheet has been placed in the public domain.
+
+Default cascading style sheet for the HTML output of Docutils.
+
+See https://docutils.sourceforge.io/docs/howto/html-stylesheets.html for how to
+customize this style sheet.
+*/
+
+/* used to remove borders from tables and images */
+.borderless, table.borderless td, table.borderless th {
+  border: 0 }
+
+table.borderless td, table.borderless th {
+  /* Override padding for "table.docutils td" with "! important".
+     The right padding separates the table cells. */
+  padding: 0 0.5em 0 0 ! important }
+
+.first {
+  /* Override more specific margin styles with "! important". */
+  margin-top: 0 ! important }
+
+.last, .with-subtitle {
+  margin-bottom: 0 ! important }
+
+.hidden {
+  display: none }
+
+.subscript {
+  vertical-align: sub;
+  font-size: smaller }
+
+.superscript {
+  vertical-align: super;
+  font-size: smaller }
+
+a.toc-backref {
+  text-decoration: none ;
+  color: black }
+
+blockquote.epigraph {
+  margin: 2em 5em ; }
+
+dl.docutils dd {
+  margin-bottom: 0.5em }
+
+object[type="image/svg+xml"], object[type="application/x-shockwave-flash"] {
+  overflow: hidden;
+}
+
+/* Uncomment (and remove this text!) to get bold-faced definition list terms
+dl.docutils dt {
+  font-weight: bold }
+*/
+
+div.abstract {
+  margin: 2em 5em }
+
+div.abstract p.topic-title {
+  font-weight: bold ;
+  text-align: center }
+
+div.admonition, div.attention, div.caution, div.danger, div.error,
+div.hint, div.important, div.note, div.tip, div.warning {
+  margin: 2em ;
+  border: medium outset ;
+  padding: 1em }
+
+div.admonition p.admonition-title, div.hint p.admonition-title,
+div.important p.admonition-title, div.note p.admonition-title,
+div.tip p.admonition-title {
+  font-weight: bold ;
+  font-family: sans-serif }
+
+div.attention p.admonition-title, div.caution p.admonition-title,
+div.danger p.admonition-title, div.error p.admonition-title,
+div.warning p.admonition-title, .code .error {
+  color: red ;
+  font-weight: bold ;
+  font-family: sans-serif }
+
+/* Uncomment (and remove this text!) to get reduced vertical space in
+   compound paragraphs.
+div.compound .compound-first, div.compound .compound-middle {
+  margin-bottom: 0.5em }
+
+div.compound .compound-last, div.compound .compound-middle {
+  margin-top: 0.5em }
+*/
+
+div.dedication {
+  margin: 2em 5em ;
+  text-align: center ;
+  font-style: italic }
+
+div.dedication p.topic-title {
+  font-weight: bold ;
+  font-style: normal }
+
+div.figure {
+  margin-left: 2em ;
+  margin-right: 2em }
+
+div.footer, div.header {
+  clear: both;
+  font-size: smaller }
+
+div.line-block {
+  display: block ;
+  margin-top: 1em ;
+  margin-bottom: 1em }
+
+div.line-block div.line-block {
+  margin-top: 0 ;
+  margin-bottom: 0 ;
+  margin-left: 1.5em }
+
+div.sidebar {
+  margin: 0 0 0.5em 1em ;
+  border: medium outset ;
+  padding: 1em ;
+  background-color: #ffffee ;
+  width: 40% ;
+  float: right ;
+  clear: right }
+
+div.sidebar p.rubric {
+  font-family: sans-serif ;
+  font-size: medium }
+
+div.system-messages {
+  margin: 5em }
+
+div.system-messages h1 {
+  color: red }
+
+div.system-message {
+  border: medium outset ;
+  padding: 1em }
+
+div.system-message p.system-message-title {
+  color: red ;
+  font-weight: bold }
+
+div.topic {
+  margin: 2em }
+
+h1.section-subtitle, h2.section-subtitle, h3.section-subtitle,
+h4.section-subtitle, h5.section-subtitle, h6.section-subtitle {
+  margin-top: 0.4em }
+
+h1.title {
+  text-align: center }
+
+h2.subtitle {
+  text-align: center }
+
+hr.docutils {
+  width: 75% }
+
+img.align-left, .figure.align-left, object.align-left, table.align-left {
+  clear: left ;
+  float: left ;
+  margin-right: 1em }
+
+img.align-right, .figure.align-right, object.align-right, table.align-right {
+  clear: right ;
+  float: right ;
+  margin-left: 1em }
+
+img.align-center, .figure.align-center, object.align-center {
+  display: block;
+  margin-left: auto;
+  margin-right: auto;
+}
+
+table.align-center {
+  margin-left: auto;
+  margin-right: auto;
+}
+
+.align-left {
+  text-align: left }
+
+.align-center {
+  clear: both ;
+  text-align: center }
+
+.align-right {
+  text-align: right }
+
+/* reset inner alignment in figures */
+div.align-right {
+  text-align: inherit }
+
+/* div.align-center * { */
+/*   text-align: left } */
+
+.align-top    {
+  vertical-align: top }
+
+.align-middle {
+  vertical-align: middle }
+
+.align-bottom {
+  vertical-align: bottom }
+
+ol.simple, ul.simple {
+  margin-bottom: 1em }
+
+ol.arabic {
+  list-style: decimal }
+
+ol.loweralpha {
+  list-style: lower-alpha }
+
+ol.upperalpha {
+  list-style: upper-alpha }
+
+ol.lowerroman {
+  list-style: lower-roman }
+
+ol.upperroman {
+  list-style: upper-roman }
+
+p.attribution {
+  text-align: right ;
+  margin-left: 50% }
+
+p.caption {
+  font-style: italic }
+
+p.credits {
+  font-style: italic ;
+  font-size: smaller }
+
+p.label {
+  white-space: nowrap }
+
+p.rubric {
+  font-weight: bold ;
+  font-size: larger ;
+  color: maroon ;
+  text-align: center }
+
+p.sidebar-title {
+  font-family: sans-serif ;
+  font-weight: bold ;
+  font-size: larger }
+
+p.sidebar-subtitle {
+  font-family: sans-serif ;
+  font-weight: bold }
+
+p.topic-title {
+  font-weight: bold }
+
+pre.address {
+  margin-bottom: 0 ;
+  margin-top: 0 ;
+  font: inherit }
+
+pre.literal-block, pre.doctest-block, pre.math, pre.code {
+  margin-left: 2em ;
+  margin-right: 2em }
+
+pre.code .ln { color: grey; } /* line numbers */
+pre.code, code { background-color: #eeeeee }
+pre.code .comment, code .comment { color: #5C6576 }
+pre.code .keyword, code .keyword { color: #3B0D06; font-weight: bold }
+pre.code .literal.string, code .literal.string { color: #0C5404 }
+pre.code .name.builtin, code .name.builtin { color: #352B84 }
+pre.code .deleted, code .deleted { background-color: #DEB0A1}
+pre.code .inserted, code .inserted { background-color: #A3D289}
+
+span.classifier {
+  font-family: sans-serif ;
+  font-style: oblique }
+
+span.classifier-delimiter {
+  font-family: sans-serif ;
+  font-weight: bold }
+
+span.interpreted {
+  font-family: sans-serif }
+
+span.option {
+  white-space: nowrap }
+
+span.pre {
+  white-space: pre }
+
+span.problematic {
+  color: red }
+
+span.section-subtitle {
+  /* font-size relative to parent (h1..h6 element) */
+  font-size: 80% }
+
+table.citation {
+  border-left: solid 1px gray;
+  margin-left: 1px }
+
+table.docinfo {
+  margin: 2em 4em }
+
+table.docutils {
+  margin-top: 0.5em ;
+  margin-bottom: 0.5em }
+
+table.footnote {
+  border-left: solid 1px black;
+  margin-left: 1px }
+
+table.docutils td, table.docutils th,
+table.docinfo td, table.docinfo th {
+  padding-left: 0.5em ;
+  padding-right: 0.5em ;
+  vertical-align: top }
+
+table.docutils th.field-name, table.docinfo th.docinfo-name {
+  font-weight: bold ;
+  text-align: left ;
+  white-space: nowrap ;
+  padding-left: 0 }
+
+/* "booktabs" style (no vertical lines) */
+table.docutils.booktabs {
+  border: 0px;
+  border-top: 2px solid;
+  border-bottom: 2px solid;
+  border-collapse: collapse;
+}
+table.docutils.booktabs * {
+  border: 0px;
+}
+table.docutils.booktabs th {
+  border-bottom: thin solid;
+  text-align: left;
+}
+
+h1 tt.docutils, h2 tt.docutils, h3 tt.docutils,
+h4 tt.docutils, h5 tt.docutils, h6 tt.docutils {
+  font-size: 100% }
+
+ul.auto-toc {
+  list-style-type: none }
+
+</style>
+</head>
+<body>
+<div class="document" id="auth-jwt-test">
+<h1 class="title">Auth JWT Test</h1>
+
+<!-- !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!! This file is generated by oca-gen-addon-readme !!
+!! changes will be overwritten.                   !!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!! source digest: sha256:9ce33333821bc91d449de0e10a8ac8633e13a98234e40abd300951b71eb85e6b
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -->
+<p><a class="reference external image-reference" href="https://odoo-community.org/page/development-status"><img alt="Beta" src="https://img.shields.io/badge/maturity-Beta-yellow.png" /></a> <a class="reference external image-reference" href="http://www.gnu.org/licenses/lgpl-3.0-standalone.html"><img alt="License: LGPL-3" src="https://img.shields.io/badge/licence-LGPL--3-blue.png" /></a> <a class="reference external image-reference" href="https://github.com/OCA/server-auth/tree/16.0/auth_jwt_demo"><img alt="OCA/server-auth" src="https://img.shields.io/badge/github-OCA%2Fserver--auth-lightgray.png?logo=github" /></a> <a class="reference external image-reference" href="https://translation.odoo-community.org/projects/server-auth-16-0/server-auth-16-0-auth_jwt_demo"><img alt="Translate me on Weblate" src="https://img.shields.io/badge/weblate-Translate%20me-F47D42.png" /></a> <a class="reference external image-reference" href="https://runboat.odoo-community.org/builds?repo=OCA/server-auth&amp;target_branch=16.0"><img alt="Try me on Runboat" src="https://img.shields.io/badge/runboat-Try%20me-875A7B.png" /></a></p>
+<p>A test/demo module for <tt class="docutils literal">auth_jwt</tt>.</p>
+<p><strong>Table of contents</strong></p>
+<div class="contents local topic" id="contents">
+<ul class="simple">
+<li><a class="reference internal" href="#usage" id="toc-entry-1">Usage</a></li>
+<li><a class="reference internal" href="#bug-tracker" id="toc-entry-2">Bug Tracker</a></li>
+<li><a class="reference internal" href="#credits" id="toc-entry-3">Credits</a><ul>
+<li><a class="reference internal" href="#authors" id="toc-entry-4">Authors</a></li>
+<li><a class="reference internal" href="#contributors" id="toc-entry-5">Contributors</a></li>
+<li><a class="reference internal" href="#maintainers" id="toc-entry-6">Maintainers</a></li>
+</ul>
+</li>
+</ul>
+</div>
+<div class="section" id="usage">
+<h1><a class="toc-backref" href="#toc-entry-1">Usage</a></h1>
+<p>This modules creates a JWT validator named <tt class="docutils literal">demo</tt>, and adds a
+<tt class="docutils literal">/auth_jwt_demo/whoami</tt> route which returns information about the partner
+identified in the token.</p>
+<p>The <tt class="docutils literal">whoami</tt> endpoint can be invoked as such, assuming <a class="reference external" href="https://pypi.org/project/python-jose/">python-jose</a> is installed.</p>
+<pre class="code python literal-block">
+<span class="c1"># /usr/bin/env python3</span><span class="w">
+</span><span class="kn">import</span> <span class="nn">time</span><span class="w">
+
+</span><span class="kn">import</span> <span class="nn">requests</span><span class="w">
+</span><span class="kn">from</span> <span class="nn">jose</span> <span class="kn">import</span> <span class="n">jwt</span><span class="w">
+
+</span><span class="n">token</span> <span class="o">=</span> <span class="n">jwt</span><span class="o">.</span><span class="n">encode</span><span class="p">(</span><span class="w">
+</span>    <span class="p">{</span><span class="w">
+</span>        <span class="s2">&quot;aud&quot;</span><span class="p">:</span> <span class="s2">&quot;auth_jwt_test_api&quot;</span><span class="p">,</span><span class="w">
+</span>        <span class="s2">&quot;iss&quot;</span><span class="p">:</span> <span class="s2">&quot;some issuer&quot;</span><span class="p">,</span><span class="w">
+</span>        <span class="s2">&quot;exp&quot;</span><span class="p">:</span> <span class="n">time</span><span class="o">.</span><span class="n">time</span><span class="p">()</span> <span class="o">+</span> <span class="mi">60</span><span class="p">,</span><span class="w">
+</span>        <span class="s2">&quot;email&quot;</span><span class="p">:</span> <span class="s2">&quot;mark.brown23&#64;example.com&quot;</span><span class="p">,</span><span class="w">
+</span>    <span class="p">},</span><span class="w">
+</span>    <span class="n">key</span><span class="o">=</span><span class="s2">&quot;thesecret&quot;</span><span class="p">,</span><span class="w">
+</span>    <span class="n">algorithm</span><span class="o">=</span><span class="n">jwt</span><span class="o">.</span><span class="n">ALGORITHMS</span><span class="o">.</span><span class="n">HS256</span><span class="p">,</span><span class="w">
+</span><span class="p">)</span><span class="w">
+</span><span class="n">r</span> <span class="o">=</span> <span class="n">requests</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="w">
+</span>    <span class="s2">&quot;http://localhost:8069/auth_jwt_demo/whoami&quot;</span><span class="p">,</span><span class="w">
+</span>    <span class="n">headers</span><span class="o">=</span><span class="p">{</span><span class="s2">&quot;Authorization&quot;</span><span class="p">:</span> <span class="s2">&quot;Bearer &quot;</span> <span class="o">+</span> <span class="n">token</span><span class="p">},</span><span class="w">
+</span><span class="p">)</span><span class="w">
+</span><span class="n">r</span><span class="o">.</span><span class="n">raise_for_status</span><span class="p">()</span><span class="w">
+</span><span class="nb">print</span><span class="p">(</span><span class="n">r</span><span class="o">.</span><span class="n">json</span><span class="p">())</span>
+</pre>
+</div>
+<div class="section" id="bug-tracker">
+<h1><a class="toc-backref" href="#toc-entry-2">Bug Tracker</a></h1>
+<p>Bugs are tracked on <a class="reference external" href="https://github.com/OCA/server-auth/issues">GitHub Issues</a>.
+In case of trouble, please check there if your issue has already been reported.
+If you spotted it first, help us to smash it by providing a detailed and welcomed
+<a class="reference external" href="https://github.com/OCA/server-auth/issues/new?body=module:%20auth_jwt_demo%0Aversion:%2016.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**">feedback</a>.</p>
+<p>Do not contact contributors directly about support or help with technical issues.</p>
+</div>
+<div class="section" id="credits">
+<h1><a class="toc-backref" href="#toc-entry-3">Credits</a></h1>
+<div class="section" id="authors">
+<h2><a class="toc-backref" href="#toc-entry-4">Authors</a></h2>
+<ul class="simple">
+<li>ACSONE SA/NV</li>
+</ul>
+</div>
+<div class="section" id="contributors">
+<h2><a class="toc-backref" href="#toc-entry-5">Contributors</a></h2>
+<ul class="simple">
+<li>Stéphane Bidoul &lt;<a class="reference external" href="mailto:stephane.bidoul&#64;acsone.eu">stephane.bidoul&#64;acsone.eu</a>&gt;</li>
+</ul>
+</div>
+<div class="section" id="maintainers">
+<h2><a class="toc-backref" href="#toc-entry-6">Maintainers</a></h2>
+<p>This module is maintained by the OCA.</p>
+<a class="reference external image-reference" href="https://odoo-community.org"><img alt="Odoo Community Association" src="https://odoo-community.org/logo.png" /></a>
+<p>OCA, or the Odoo Community Association, is a nonprofit organization whose
+mission is to support the collaborative development of Odoo features and
+promote its widespread use.</p>
+<p>Current <a class="reference external" href="https://odoo-community.org/page/maintainer-role">maintainer</a>:</p>
+<p><a class="reference external image-reference" href="https://github.com/sbidoul"><img alt="sbidoul" src="https://github.com/sbidoul.png?size=40px" /></a></p>
+<p>This module is part of the <a class="reference external" href="https://github.com/OCA/server-auth/tree/16.0/auth_jwt_demo">OCA/server-auth</a> project on GitHub.</p>
+<p>You are welcome to contribute. To learn how please visit <a class="reference external" href="https://odoo-community.org/page/Contribute">https://odoo-community.org/page/Contribute</a>.</p>
+</div>
+</div>
+</div>
+</body>
+</html>
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/init.py
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/init.py
@ -0,0 +1 @@
+from . import test_auth_jwt_demo
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/keycloak/keycloak-config.json
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/keycloak/keycloak-config.json
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/keycloak/keycloak.sh
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/keycloak/keycloak.sh
@ -0,0 +1,10 @@
+#!/bin/sh
+set -x
+$(which docker || which podman) run --rm \
+  -v $(dirname $0)/keycloak-config.json:/tmp/keycloak-config.json \
+  -p 8080:8080 \
+  quay.io/keycloak/keycloak:12.0.4 \
+  -Dkeycloak.migration.action=import \
+  -Dkeycloak.migration.provider=singleFile \
+  -Dkeycloak.migration.file=/tmp/keycloak-config.json \
+  -Dkeycloak.migration.strategy=OVERWRITE_EXISTING
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/spa/README.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/spa/README.md
@ -0,0 +1,12 @@
+# auth_jwt demo app
+
+Inspired by https://auth0.com/docs/quickstart/spa/vanillajs, using
+https://github.com/IdentityModel/oidc-client-js.
+
+First start keycloak with `keycloak.sh` in `../keycloak`. Then serve this app by running
+`python3 -m http.server` in this directory.
+
+Try `demo/demo` as keycloak login.
+
+The `Who am I ?` button calls the `http://localhost:8069/auth_jwt_demo/keycloak/whoami`
+Odoo endpoint which is provided by this `auth_jwt_demo` module.
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/spa/auth_settings.json
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/spa/auth_settings.json
@ -0,0 +1,14 @@
+{
+  "authority": "http://localhost:8080/auth/realm/master",
+  "client_id": "auth_jwt_test_api",
+  "response_type": "code",
+  "scope": "openid email",
+  "metadata": {
+    "issuer": "http://localhost:8080/auth/realms/master",
+    "authorization_endpoint": "http://localhost:8080/auth/realms/master/protocol/openid-connect/auth",
+    "token_endpoint": "http://localhost:8080/auth/realms/master/protocol/openid-connect/token",
+    "userinfo_endpoint": "http://localhost:8080/auth/realms/master/protocol/openid-connect/userinfo",
+    "end_session_endpoint": "http://localhost:8080/auth/realms/master/protocol/openid-connect/logout",
+    "jwks_uri": "http://localhost:8080/auth/realms/master/protocol/openid-connect/certs"
+  }
+}
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/spa/index.html
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/spa/index.html
@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="UTF-8" />
+    <title>SPA OIDC Sample</title>
+  </head>
+
+  <body>
+    <h2>SPA OIDC Authentication Sample</h2>
+    <p>Welcome to our page <span id="txt-email"></span>!</p>
+    <button id="btn-login" disabled>Log in</button>
+    <button id="btn-logout" disabled>Log out</button>
+    <button id="btn-whoami">Who am I? (api call)</button>
+    <button id="btn-whoami-public-or-jwt">Who am I (public or auth)? (api call)</button>
+    <script type="module">
+      import {onload, login, logout, whoami, whoami_public_or_jwt} from "./js/app.js";
+
+      window.onload = onload;
+      document.getElementById("btn-login").onclick = login;
+      document.getElementById("btn-logout").onclick = logout;
+      document.getElementById("btn-whoami").onclick = whoami;
+      document.getElementById("btn-whoami-public-or-jwt").onclick =
+        whoami_public_or_jwt;
+    </script>
+  </body>
+</html>
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/spa/js/app.js
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/spa/js/app.js
@ -0,0 +1,105 @@
+import {Oidc} from "./oidc-client.js";
+
+let client = null;
+
+class InMemoryWebStorageStateStore {
+    constructor() {
+        this._data = {};
+    }
+
+    set(key, value) {
+        this._data[key] = value;
+        return Promise.resolve();
+    }
+
+    get(key) {
+        const item = this._data[key];
+        return Promise.resolve(item);
+    }
+
+    remove(key) {
+        const item = this._data[key];
+        delete this._data[key];
+        return Promise.resolve(item);
+    }
+
+    getAllKeys() {
+        var keys = Object.getOwnPropertyNames(this._data);
+        return Promise.resolve(keys);
+    }
+}
+
+async function onload() {
+    const settings_response = await fetch("/auth_settings.json");
+    const settings = await settings_response.json();
+    settings.redirect_uri = window.location.href;
+    settings.post_logout_redirect_uri = window.location.href;
+    // Avoid storing JWT tokens in session storage
+    settings.userStore = new InMemoryWebStorageStateStore();
+    client = new Oidc.UserManager(settings);
+    client.events.addAccessTokenExpiring(refresh);
+
+    const query = window.location.search;
+    if (query.includes("code=") && query.includes("state=")) {
+        // Process the redirect callback from the identity provider
+        const user = await client.signinCallback();
+        console.log(user); // Don't do this IRL!
+        // Use replaceState to redirect the user away and remove the querystring parameters
+        window.history.replaceState({}, document.title, "/");
+    }
+
+    updateUI();
+}
+
+async function updateUI() {
+    const user = await client.getUser();
+    const isAuthenticated = Boolean(user);
+
+    document.getElementById("btn-login").disabled = isAuthenticated;
+    document.getElementById("btn-logout").disabled = !isAuthenticated;
+    document.getElementById("txt-email").textContent = isAuthenticated
+        ? user.profile.email || user.profile.sub
+        : "(please log in)";
+}
+
+async function login() {
+    client.signinRedirect();
+}
+
+async function logout() {
+    client.removeUser();
+    updateUI();
+}
+
+async function refresh() {
+    console.log("refresh token");
+    client.startSilentRenew();
+}
+
+async function _whoami(endpoint) {
+    const user = await client.getUser();
+    try {
+        const response = await fetch(
+            "http://localhost:8069/auth_jwt_demo/keycloak" + endpoint,
+            {
+                headers: {
+                    ...(user && {Authorization: `Bearer ${user.access_token}`}),
+                },
+            }
+        );
+        const data = await response.json();
+        alert(JSON.stringify(data));
+    } catch (error) {
+        alert(error);
+    }
+}
+
+async function whoami() {
+    await _whoami("/whoami");
+}
+
+async function whoami_public_or_jwt() {
+    await _whoami("/whoami-public-or-jwt");
+}
+
+export {onload, login, logout, whoami, whoami_public_or_jwt};
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/spa/js/oidc-client.js
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/spa/js/oidc-client.js
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/test_auth_jwt_demo.py
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/auth_jwt_demo/tests/test_auth_jwt_demo.py
@ -0,0 +1,166 @@
+# Copyright 2021 ACSONE SA/NV
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl).
+
+import time
+
+import jwt
+
+from odoo import tests
+
+
+@tests.tagged("post_install", "-at_install")
+class TestRegisterHook(tests.HttpCase):
+    def test_auth_method_exists(self):
+        validator = self.env["auth.jwt.validator"].search([("name", "=", "demo")])
+        self.assertEqual(len(validator), 1)
+        self.assertTrue(hasattr(self.env["ir.http"].__class__, "_auth_method_jwt_demo"))
+
+
+@tests.tagged("post_install", "-at_install")
+class TestEndToEnd(tests.HttpCase):
+    def _get_token(self, aud=None, email=None):
+        validator = self.env["auth.jwt.validator"].search([("name", "=", "demo")])
+        payload = {
+            "aud": aud or validator.audience,
+            "iss": validator.issuer,
+            "exp": time.time() + 60,
+        }
+        if email:
+            payload["email"] = email
+        access_token = jwt.encode(
+            payload, key=validator.secret_key, algorithm=validator.secret_algorithm
+        )
+        return "Bearer " + access_token
+
+    def test_whoami(self):
+        """A end-to-end test with positive authentication and partner retrieval."""
+        partner = self.env["res.users"].search([("email", "!=", False)])[0]
+        token = self._get_token(email=partner.email)
+        resp = self.url_open("/auth_jwt_demo/whoami", headers={"Authorization": token})
+        resp.raise_for_status()
+        whoami = resp.json()
+        self.assertEqual(whoami.get("name"), partner.name)
+        self.assertEqual(whoami.get("email"), partner.email)
+        self.assertEqual(whoami.get("uid"), self.env.ref("base.user_demo").id)
+        # Try again in a user session, it will be rejected because auth_jwt
+        # is not designed to work in user session.
+        self.authenticate("demo", "demo")
+        resp = self.url_open("/auth_jwt_demo/whoami", headers={"Authorization": token})
+        self.assertEqual(resp.status_code, 401)
+
+    def test_whoami_cookie(self):
+        """A end-to-end test with positive authentication and cookie."""
+        partner = self.env["res.users"].search([("email", "!=", False)])[0]
+        token = self._get_token(email=partner.email)
+        resp = self.url_open(
+            "/auth_jwt_demo_cookie/whoami", headers={"Authorization": token}
+        )
+        resp.raise_for_status()
+        whoami = resp.json()
+        self.assertEqual(whoami.get("name"), partner.name)
+        self.assertEqual(whoami.get("email"), partner.email)
+        self.assertEqual(whoami.get("uid"), self.env.ref("base.user_demo").id)
+        cookie = resp.cookies.get("demo_auth")
+        self.assertTrue(cookie)
+        # Try again with the cookie.
+        resp = self.url_open(
+            "/auth_jwt_demo_cookie/whoami", headers={"Cookie": f"demo_auth={cookie}"}
+        )
+        resp.raise_for_status()
+        whoami = resp.json()
+        self.assertEqual(whoami.get("name"), partner.name)
+        self.assertEqual(whoami.get("email"), partner.email)
+        self.assertEqual(whoami.get("uid"), self.env.ref("base.user_demo").id)
+        cookie = resp.cookies.get("demo_auth")
+        self.assertTrue(cookie)
+
+    def test_forbidden(self):
+        """A end-to-end test with negative authentication."""
+        token = self._get_token(aud="invalid")
+        resp = self.url_open("/auth_jwt_demo/whoami", headers={"Authorization": token})
+        self.assertEqual(resp.status_code, 401)
+
+    def test_public(self):
+        """A end-to-end test for anonymous/public access."""
+        resp = self.url_open("/auth_jwt_demo/whoami-public-or-jwt")
+        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(resp.json()["uid"], self.ref("base.public_user"))
+        # try with a token for an non-existing partner, auth works
+        # but we don't get any partner info
+        token = self._get_token(email="not-a-partner@example.com")
+        resp = self.url_open(
+            "/auth_jwt_demo/whoami-public-or-jwt", headers={"Authorization": token}
+        )
+        self.assertEqual(resp.status_code, 200)
+        resp.raise_for_status()
+        whoami = resp.json()
+        self.assertTrue("name" not in whoami)
+        self.assertTrue("email" not in whoami)
+        self.assertEqual(whoami.get("uid"), self.env.ref("base.user_demo").id)
+        # now try with a token
+        partner = self.env["res.users"].search([("email", "!=", False)], limit=1)
+        token = self._get_token(email=partner.email)
+        resp = self.url_open(
+            "/auth_jwt_demo/whoami-public-or-jwt", headers={"Authorization": token}
+        )
+        resp.raise_for_status()
+        whoami = resp.json()
+        self.assertEqual(whoami.get("name"), partner.name)
+        self.assertEqual(whoami.get("email"), partner.email)
+        self.assertEqual(whoami.get("uid"), self.env.ref("base.user_demo").id)
+
+    def test_public_cookie_mode(self):
+        """A end-to-end test for anonymous/public access with cookie."""
+        resp = self.url_open("/auth_jwt_demo_cookie/whoami-public-or-jwt")
+        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(resp.json()["uid"], self.ref("base.public_user"))
+        cookie = resp.cookies.get("demo_auth")
+        self.assertFalse(cookie)
+        # try with a token for an non-existing partner, auth works
+        # but we don't get any partner info
+        token = self._get_token(email="not-a-partner@example.com")
+        resp = self.url_open(
+            "/auth_jwt_demo_cookie/whoami-public-or-jwt",
+            headers={"Authorization": token},
+        )
+        resp.raise_for_status()
+        whoami = resp.json()
+        self.assertTrue("name" not in whoami)
+        self.assertTrue("email" not in whoami)
+        self.assertEqual(whoami.get("uid"), self.env.ref("base.user_demo").id)
+        cookie = resp.cookies.get("demo_auth")
+        self.assertTrue(cookie)
+        # now try with a token
+        partner = self.env["res.users"].search([("email", "!=", False)], limit=1)
+        token = self._get_token(email=partner.email)
+        resp = self.url_open(
+            "/auth_jwt_demo_cookie/whoami-public-or-jwt",
+            headers={"Authorization": token},
+        )
+        resp.raise_for_status()
+        whoami = resp.json()
+        self.assertEqual(whoami.get("name"), partner.name)
+        self.assertEqual(whoami.get("email"), partner.email)
+        self.assertEqual(whoami.get("uid"), self.env.ref("base.user_demo").id)
+        # now try with the cookie
+        cookie = resp.cookies.get("demo_auth")
+        self.assertTrue(cookie)
+        partner = self.env["res.users"].search([("email", "!=", False)], limit=1)
+        token = self._get_token(email=partner.email)
+        resp = self.url_open(
+            "/auth_jwt_demo_cookie/whoami-public-or-jwt",
+            headers={"Cookie": f"demo_auth={cookie}"},
+        )
+        resp.raise_for_status()
+        whoami = resp.json()
+        self.assertEqual(whoami.get("name"), partner.name)
+        self.assertEqual(whoami.get("email"), partner.email)
+        self.assertEqual(whoami.get("uid"), self.env.ref("base.user_demo").id)
+        cookie = resp.cookies.get("demo_auth")
+        self.assertTrue(cookie)
+
+    def test_public_keyloak(self):
+        """A end-to-end test for anonymous/public access."""
+        resp = self.url_open("/auth_jwt_demo/keycloak/whoami-public-or-jwt")
+        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(resp.json()["uid"], self.ref("base.public_user"))
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/ARCHITECTURE.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/ARCHITECTURE.md
@ -0,0 +1,32 @@
+# Architecture
+
+```mermaid
+flowchart TD
+    U[Users] -->|HTTP| V[Views and QWeb Templates]
+    V --> C[Controllers]
+    V --> W[Wizards – Transient Models]
+    C --> M[Models and ORM]
+    W --> M
+    M --> R[Reports]
+    DX[Data XML] --> M
+    S[Security – ACLs and Groups] -. enforces .-> M
+
+    subgraph Auth_jwt_demo Module - auth_jwt_demo
+      direction LR
+      M:::layer
+      W:::layer
+      C:::layer
+      V:::layer
+      R:::layer
+      S:::layer
+      DX:::layer
+    end
+
+    classDef layer fill:#eef8ff,stroke:#6ea8fe,stroke-width:1px
+```
+
+Notes
+- Views include tree/form/kanban templates and report templates.
+- Controllers provide website/portal routes when present.
+- Wizards are UI flows implemented with `models.TransientModel`.
+- Data XML loads data/demo records; Security defines groups and access.
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/CONFIGURATION.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/CONFIGURATION.md
@ -0,0 +1,3 @@
+# Configuration
+
+Refer to Odoo settings for auth_jwt_demo. Configure related models, access rights, and options as needed.
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/CONTROLLERS.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/CONTROLLERS.md
@ -0,0 +1,17 @@
+# Controllers
+
+HTTP routes provided by this module.
+
+```mermaid
+sequenceDiagram
+    participant U as User/Client
+    participant C as Module Controllers
+    participant O as ORM/Views
+
+    U->>C: HTTP GET/POST (routes)
+    C->>O: ORM operations, render templates
+    O-->>U: HTML/JSON/PDF
+```
+
+Notes
+- See files in controllers/ for route definitions.
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/DEPENDENCIES.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/DEPENDENCIES.md
@ -0,0 +1,5 @@
+# Dependencies
+
+This addon depends on:
+
+- [auth_jwt](../../odoo-bringout-oca-server-auth-auth_jwt)
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/FAQ.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/FAQ.md
@ -0,0 +1,4 @@
+# FAQ
+
+- Q: Which Odoo version? A: 16.0 (OCA/OCB packaged).
+- Q: How to enable? A: Start server with --addon auth_jwt_demo or install in UI.
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/INSTALL.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/INSTALL.md
@ -0,0 +1,7 @@
+# Install
+
+```bash
+pip install odoo-bringout-oca-server-auth-auth_jwt_demo"
+# or
+uv pip install odoo-bringout-oca-server-auth-auth_jwt_demo"
+```
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/MODELS.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/MODELS.md
@ -0,0 +1,11 @@
+# Models
+
+Detected core models and extensions in auth_jwt_demo.
+
+```mermaid
+classDiagram
+```
+
+Notes
+- Classes show model technical names; fields omitted for brevity.
+- Items listed under _inherit are extensions of existing models.
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/OVERVIEW.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/OVERVIEW.md
@ -0,0 +1,6 @@
+# Overview
+
+Packaged Odoo addon: auth_jwt_demo. Provides features documented in upstream Odoo 16 under this addon.
+
+- Source: OCA/OCB 16.0, addon auth_jwt_demo
+- License: LGPL-3
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/REPORTS.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/REPORTS.md
@ -0,0 +1,3 @@
+# Reports
+
+This module does not define custom reports.
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/SECURITY.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/SECURITY.md
@ -0,0 +1,8 @@
+# Security
+
+This module does not define custom security rules or access controls beyond Odoo defaults.
+
+Default Odoo security applies:
+- Base user access through standard groups
+- Model access inherited from dependencies
+- No custom row-level security rules
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/TROUBLESHOOTING.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/TROUBLESHOOTING.md
@ -0,0 +1,5 @@
+# Troubleshooting
+
+- Ensure Python and Odoo environment matches repo guidance.
+- Check database connectivity and logs if startup fails.
+- Validate that dependent addons listed in DEPENDENCIES.md are installed.
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/USAGE.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/USAGE.md
@ -0,0 +1,7 @@
+# Usage
+
+Start Odoo including this addon (from repo root):
+
+```bash
+python3 scripts/nix_odoo_web_server.py --db-name mydb --addon auth_jwt_demo
+```
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/WIZARDS.md
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/doc/WIZARDS.md
@ -0,0 +1,3 @@
+# Wizards
+
+This module does not include UI wizards.
--- a/odoo-bringout-oca-server-auth-auth_jwt_demo/pyproject.toml
+++ b/odoo-bringout-oca-server-auth-auth_jwt_demo/pyproject.toml
@ -0,0 +1,43 @@
+[project]
+name = "odoo-bringout-oca-server-auth-auth_jwt_demo"
+version = "16.0.0"
+description = "Auth JWT Test - 
+        Test/demo module for auth_jwt."
+authors = [
+    { name = "Ernad Husremovic", email = "hernad@bring.out.ba" }
+]
+dependencies = [
+    "odoo-bringout-oca-server-auth-auth_jwt>=16.0.0",
+    "requests>=2.25.1"
+]
+readme = "README.md"
+requires-python = ">= 3.11"
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11", 
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Office/Business",
+]
+
+[project.urls]
+homepage = "https://github.com/bringout/0"
+repository = "https://github.com/bringout/0"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.metadata]
+allow-direct-references = true
+
+[tool.hatch.build.targets.wheel]
+packages = ["auth_jwt_demo"]
+
+[tool.rye]
+managed = true
+dev-dependencies = [
+    "pytest>=8.4.1",
+]
				`@ -0,0 +1 @@`
				`* Stéphane Bidoul <stephane.bidoul@acsone.eu>`