[IMP] booking_channex: add config parameter for channex webhook secret by chga-odoo · Pull Request #19 · odoo-dev/industry

chga-odoo · 2026-07-02T12:46:09Z

secure webhook adding a kind of security token to secure this communication.

Task: 6043950

pgu-odoo

@chga-odoo Good work. A few remarks are added.

pgu-odoo · 2026-07-13T05:08:01Z

+channex_secret_token = payload.get('headers', {}).get('X-Channex-Webhook-Secret')
+
+if not channex_secret_token or channex_secret_token != odoo_secret_token:
+    raise UserError("Invalid secret token for Channex webhook")   # temperary for testing, 


Suggested change

raise UserError("Invalid secret token for Channex webhook") # temperary for testing,

raise UserError("Unauthorized access.") # temperary for testing,

pgu-odoo · 2026-07-13T05:14:02Z

        <field name="state">code</field>
        <field name="code"><![CDATA[
+#TODO: validate secret token in header with booking_channex.x_channex_secret_token in ir.config_parameter
+odoo_secret_token = env['ir.config_parameter'].get_str('booking_channex.x_channex_secret_token')


why get_str() and not get_param()?

We can use get_param() but its return False if we not set default ' '
and get_str() return string always so that i thought better to return string always.
what you think?
get_param() is also check access rights so I think batter to use that 😊

pgu-odoo · 2026-07-13T05:19:14Z

+    if not env['ir.config_parameter'].get_str('booking_channex.x_channex_secret_token'):
+        raise UserError("Error generating secret token for Channex webhook")


Check if the correct expected value is set or not.

Update msg.

Suggested change

if not env['ir.config_parameter'].get_str('booking_channex.x_channex_secret_token'):

raise UserError("Error generating secret token for Channex webhook")

if env['ir.config_parameter'].get_str('booking_channex.x_channex_secret_token') != token:

raise UserError("Failed to store the Channex webhook secret token.")

pgu-odoo · 2026-07-13T05:23:24Z

            "request_params": {},
-            "headers": {},
+            "headers": {
+                "X-Channex-Webhook-Secret": env['ir.config_parameter'].get_str('booking_channex.x_channex_secret_token')


Suggested change

"X-Channex-Webhook-Secret": env['ir.config_parameter'].get_str('booking_channex.x_channex_secret_token')

"x-channex-token": env['ir.config_parameter'].get_str('booking_channex.x_channex_token')

You can use either all letters in small or in caps.

You can keep both key and system parameter's name same.

pgu-odoo · 2026-07-13T07:13:57Z

@vava-odoo PR is ready to review.

vava-odoo · 2026-07-14T07:26:33Z

                headers={'Content-Type': 'application/json'}
            )
-            self.assertTrue(self.env['sale.order.line'].search_count([('product_id', '=', room.id)]), 'The sale order has not been created when webhook received the payload.')
+            self.assertTrue(not self.env['sale.order.line'].search_count([('product_id', '=', room.id)]), 'The sale order has been created when webhook received the payload with wrong token.')


Suggested change

self.assertTrue(not self.env['sale.order.line'].search_count([('product_id', '=', room.id)]), 'The sale order has been created when webhook received the payload with wrong token.')

self.assertFalse(self.env['sale.order.line'].search_count([('product_id', '=', room.id)], limit=1), 'The sale order has been created when webhook received the payload with wrong token.')

vava-odoo · 2026-07-14T07:27:06Z

+
+        payload_receive_booking['headers']['x-channex-token'] = 'MyTestWebhookSecret'
+        with (
+        self.assertLogs(level="WARNING"),  # Is preventing any warning to be logged, we should replace this to ignore only the Unsafe Error


which kind of warning happens here?

thrown error from called server actions.

vava-odoo · 2026-07-14T07:29:35Z

+        with (
+        self.assertLogs(level="WARNING"),  # Is preventing any warning to be logged, we should replace this to ignore only the Unsafe Error
+        MockHTTPClient(url="https://staging.channex.io/api/v1/booking_revisions/074cd7f9-df51-4fc6-a8f4-7658573a235d/ack", return_json=booking_ack_answer, return_status=200),
+        MockHTTPClient(url="https://staging.channex.io/api/v1/bookings/e868f16e-b474-4b95-af12-5b114133e670", return_json=get_booking_answer, return_status=200),
+        ):


indent issue

vava-odoo · 2026-07-14T07:31:24Z

+        payload_receive_booking['headers']['x-channex-token'] = 'MyTestWebhookSecret'
+        with (
+        self.assertLogs(level="WARNING"),  # Is preventing any warning to be logged, we should replace this to ignore only the Unsafe Error
+        MockHTTPClient(url="https://staging.channex.io/api/v1/booking_revisions/074cd7f9-df51-4fc6-a8f4-7658573a235d/ack", return_json=booking_ack_answer, return_status=200),
+        MockHTTPClient(url="https://staging.channex.io/api/v1/bookings/e868f16e-b474-4b95-af12-5b114133e670", return_json=get_booking_answer, return_status=200),
+        ):


Do you need to escape the with environment?

Suggested change

payload_receive_booking['headers']['x-channex-token'] = 'MyTestWebhookSecret'

with (

self.assertLogs(level="WARNING"), # Is preventing any warning to be logged, we should replace this to ignore only the Unsafe Error

MockHTTPClient(url="https://staging.channex.io/api/v1/booking_revisions/074cd7f9-df51-4fc6-a8f4-7658573a235d/ack", return_json=booking_ack_answer, return_status=200),

MockHTTPClient(url="https://staging.channex.io/api/v1/bookings/e868f16e-b474-4b95-af12-5b114133e670", return_json=get_booking_answer, return_status=200),

):

payload_receive_booking['headers']['x-channex-token'] = 'MyTestWebhookSecret'

Not really, but functional flow for both cases would be same. so writing it outside clearly expresses the intent

Perform the "wrong token" test.

Prepare the payload for the "correct token" test.

Perform the "correct token" test.

what's your opinion on this?

vava-odoo · 2026-07-14T07:33:37Z

+    if env['ir.config_parameter'].get_str('booking_channex.x_channex_token') != token:
+        raise UserError("Failed to store the Channex webhook secret token.")


how could this happen?

just for extra check but i think its not needed.

vava-odoo · 2026-07-14T07:36:42Z

+        'x_remote_id': existing_webhook.get('attributes', {}).get('id')
+    })
+else:
+    token = env['ir.attachment']._generate_access_token()


isn't there a validity limit to this token? What happens then? How can the user easily change the token?

No, for now no validity exist for token, user can change token only manually but not any separate functionality exist for update token on channex. so for now its become a permanent token 😢
we can discuss on this with @Pierre-savp and @frva-odoo

@chga-odoo @frva-odoo
ha, we missed this non ARI aspect right?
on channex_webhook_secret change -> update webhook on channex side

@chga-odoo
I discussed with SAVP about this and we agreed that it was not especially needed and we could keep it as a static value, so you can drop the automation to update on channex idea. We may add it later on if we feel this is needed but let's keep it simple for now

secure webhook adding a kind of security token to secure this communication. Task: 6043950

chga-odoo force-pushed the saas-19.3-booking-channex-webhook-secure-chga branch from 6a5df29 to 79de7fb Compare July 3, 2026 13:18

pgu-odoo reviewed Jul 13, 2026

View reviewed changes

chga-odoo force-pushed the saas-19.3-booking-channex-webhook-secure-chga branch 2 times, most recently from fe02859 to 676fa26 Compare July 13, 2026 06:48

chga-odoo force-pushed the saas-19.3-booking-channex-webhook-secure-chga branch from 676fa26 to b1f1435 Compare July 13, 2026 09:27

vava-odoo reviewed Jul 14, 2026

View reviewed changes

[IMP] booking_channex: add config parameter for channex webhook secret

72cd550

secure webhook adding a kind of security token to secure this communication. Task: 6043950

chga-odoo force-pushed the saas-19.3-booking-channex-webhook-secure-chga branch from b1f1435 to 72cd550 Compare July 15, 2026 11:30

	raise UserError("Invalid secret token for Channex webhook") # temperary for testing,
	raise UserError("Unauthorized access.") # temperary for testing,

		if not env['ir.config_parameter'].get_str('booking_channex.x_channex_secret_token'):
		raise UserError("Error generating secret token for Channex webhook")

	"X-Channex-Webhook-Secret": env['ir.config_parameter'].get_str('booking_channex.x_channex_secret_token')
	"x-channex-token": env['ir.config_parameter'].get_str('booking_channex.x_channex_token')

	self.assertTrue(not self.env['sale.order.line'].search_count([('product_id', '=', room.id)]), 'The sale order has been created when webhook received the payload with wrong token.')
	self.assertFalse(self.env['sale.order.line'].search_count([('product_id', '=', room.id)], limit=1), 'The sale order has been created when webhook received the payload with wrong token.')

		if env['ir.config_parameter'].get_str('booking_channex.x_channex_token') != token:
		raise UserError("Failed to store the Channex webhook secret token.")

Uh oh!

Conversation

chga-odoo commented Jul 2, 2026

Uh oh!

pgu-odoo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chga-odoo Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pgu-odoo commented Jul 13, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

chga-odoo Jul 13, 2026 •

edited

Loading