[14.0][IMP] currency_rate_update_wise: rename from transferwise + security hardening#219
Open
klodr wants to merge 1 commit into
Open
[14.0][IMP] currency_rate_update_wise: rename from transferwise + security hardening#219klodr wants to merge 1 commit into
klodr wants to merge 1 commit into
Conversation
OCA-git-bot
added
mod:currency_rate_update_wise
…urity hardening Rename the provider after the TransferWise -> Wise rebrand (2021) and apply security fixes from a code audit, on the module that was merged in 14.0 (OCA PR OCA#174). Existing installations get the renamed, hardened module through a plain module update (an OpenUpgrade pre-migration handles the rename). Why keep and update this provider, as a worldwide complement to the ECB provider. The ECB provider is the official European, EUR-centric daily reference; Wise is a global rate source covering currencies and use cases ECB does not: - Rate quality: Wise returns the interbank mid-market rate. Aligned with the ECB fixing on a working day, it tracks the ECB reference markedly closer than xe.com (mean deviation ~0.02% vs ~0.12%, closest to ECB on 25 of 29 currencies). - Worldwide coverage: Wise quotes ~164 currencies against the ECB reference list of 29, including ones ECB omits (e.g. AED, COP). ECB stays the European reference; Wise extends accurate rates to the rest of the world. - Stable JSON API: an authenticated REST endpoint, not HTML scraping like the xe.com provider (which breaks whenever the web page changes). - Targeted requests: we fetch only the currency pairs actually configured, instead of downloading a whole rate table. - History and granularity: the API serves past rates (by timestamp or date range) at day/hour/minute granularity, enabling backfill and corrections. Rename: - module currency_rate_update_transferwise -> currency_rate_update_wise - field res.company.transferwise_api_key -> wise_api_key - provider service value 'TransferWise' -> 'Wise' (label "Wise.com") - API base URL api.transferwise.com -> api.wise.com (/v1/rates endpoint unchanged) - OpenUpgrade pre-migration (update_module_names + rename_columns + UPDATE service) -> no data loss: token, provider records and rate history preserved Security hardening (from audit): - network via requests with a (10, 30)s timeout instead of urllib without any timeout: a cron/worker can no longer hang indefinitely on an unresponsive API - API token restricted with groups="base.group_system" (model + settings + view) and shown with the password widget -> no longer readable by non-admin users - query parameters passed through requests params= (proper encoding) - explicit handling of non-JSON responses (UserError instead of a raw traceback) - robust error detection: isinstance(data, dict) and data.get("error") - ondelete fixed (key is the service value "Wise"; dropped the stray label key) - token storage is an unlimited opaque string, so both the legacy UUID format and the newer JWT format Wise is migrating to are accepted without truncation - legacy-token heads-up: Wise is migrating API access tokens from UUID to JWT, with production issuing JWT from the end-July-2026 transition. During the migration window (2026-08-01 to 2027-08-01) a warning is logged (at Odoo load time and on each scheduled update) when a Wise token still uses the UUID format, inviting regeneration in the Wise Developer Hub. No warning outside that window (before: UUID is the only format; after: migration is over) nor when no key is set. Ref: https://docs.wise.com/guides/developer/auth-and-security/client-credentials-token-migration - tests made hermetic (HTTP mocked, no real network call) + error-response and legacy-token-warning cases Signed-off-by: Claude Perrin <klodr@users.noreply.github.com>
klodr
force-pushed
the
14.0-imp-currency_rate_update_wise
branch
from
be25d88 to
5a3db5f
Compare
Author
|
@OCA/currency-maintainers when you have a moment, could you please review? This renames |
This was referenced Jun 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
currency_rate_update_wise (rename of currency_rate_update_transferwise)
TransferWise rebranded to Wise in 2021. This renames the module
currency_rate_update_transferwise→currency_rate_update_wiseand the providerTransferWise→Wise, with identical rate-fetching functionality.res_currency_rate_provider_Wise.py.migrations/14.0.2.0.0/pre-migration.pymigrates existingres.currency.rate.providerrecords (serviceTransferWise→Wise) and the relatedir.model.data, so existing configurations keep working after a plain module update.base.group_system.See the commit message for the full rationale (Wise vs ECB coverage, UUID→JWT token transition).
Migrations to 15.0–18.0 will follow in dedicated PRs.