How odevmo/security-scanner-odoo works
Purpose and Runtime
This is an Odoo addon that records and runs security-posture diagnostics against the current Odoo deployment. It runs inside the Odoo Python server and uses Odoo ORM/configuration APIs rather than a separate scanner service. Module metadata and dependency/loading behavior originate in security_scanner_suite/__manifest__.py.
Module Entry and Installation Surface
Odoo discovers the addon through security_scanner_suite/__manifest__.py, then imports model registrations through security_scanner_suite/__init__.py and security_scanner_suite/models/__init__.py. XML data, views, and access controls are loaded by the module manifest:
• security_scanner_suite/data/security_scan_sequence.xml
• security_scanner_suite/views/security_scan_views.xml
• security_scanner_suite/security/ir.model.access.csv
Scan Record Domain Model
The core component is the scan model in security_scanner_suite/models/security_scan.py. It represents an individual scan, including its generated identity, state/progress, and HTML-formatted findings. A scan is persisted as an Odoo record, enabling administrators to create, rerun, and review historical scan outputs through standard ORM-backed storage.
Scan Execution and Checks
The scan action implemented in security_scanner_suite/models/security_scan.py is the principal control-flow entry point. It evaluates server and Odoo security settings, including master password presence, HTTPS/proxy behavior, logging configuration, database filtering/listing controls, and access-rule coverage for non-core models. Findings are aggregated into a human-readable HTML result field and the record state is updated after execution.
Odoo Configuration and Metadata Boundary
Checks cross from addon business logic into Odoo runtime configuration and model metadata. The scanner reads deployment-level configuration, so results depend on the active Odoo server process and its configured options. Access-rule verification also queries Odoo model/access-control metadata, distinguishing framework/core models from custom or non-core models. This boundary is concentrated in security_scanner_suite/models/security_scan.py.
UI and Operator Workflow
Administrators use the Security Scan menu, list/form views, and a form action to create and run scans. The view layer renders scan state and formatted HTML findings:
• security_scanner_suite/views/security_scan_views.xml
• security_scanner_suite/models/security_scan.py
The expected flow is: operator creates a scan record → invokes “Run Scan” → model action evaluates configuration and access metadata → persisted results are displayed in the scan form.
Identity, Authorization, and Sequencing
Odoo ACLs govern who can access scan records through security_scanner_suite/security/ir.model.access.csv. Automatic scan naming/traceability is provided by the Odoo sequence declaration in security_scanner_suite/data/security_scan_sequence.xml. These components rely on Odoo’s built-in authentication, authorization, database, and menu/action infrastructure; no external API, worker, scheduler, or standalone frontend is indicated.
Main entry points: security_scan.py Security Scan Model · __manifest__.py Module Manifest · security_scan_views.xml Scan Views & Action · __init__.py Model Registration
Components 12
Security Scanner Addon
- Module Manifest · Declares dependencies and loaded addon resources.
security_scanner_suite/__manifest__.py - Model Registration
security_scanner_suite/__init__.py - Models Package
security_scanner_suite/models/__init__.py - Security Scan Model · Persists scan state, progress, identity, and HTML findings; runs diagnostics.
security_scanner_suite/models/security_scan.py - Scan Views & Action · Provides menu, list/form views, and the Run Scan action.
security_scanner_suite/views/security_scan_views.xml - Scan Sequence · Generates scan names for traceability.
security_scanner_suite/data/security_scan_sequence.xml - Scan Record ACLs · Controls access to security scan records.
security_scanner_suite/security/ir.model.access.csv
Odoo Runtime
- Odoo Database · Stores scan records and completed findings history.
- Server Configuration · Active deployment options evaluated by security checks.
- Model & Access Metadata · Provides model and access-rule data for coverage checks.
- Odoo Web Client · Renders addon views and dispatches form actions.
Other components
- Administrator
Connections 16
- Module Manifest → Model Registration: loads
- Model Registration → Models Package: imports
- Models Package → Security Scan Model: registers
- Module Manifest → Scan Views & Action: loads
- Module Manifest → Scan Sequence: loads
- Module Manifest → Scan Record ACLs: loads
- Administrator → Odoo Web Client: uses
- Odoo Web Client → Scan Views & Action: renders
- Scan Views & Action → Security Scan Model: creates and runs
- Scan Record ACLs → Security Scan Model: authorizes access
- Scan Sequence → Security Scan Model: names records
- Security Scan Model → Server Configuration: evaluates
- Security Scan Model → Model & Access Metadata: checks access coverage
- Security Scan Model → Odoo Database: persists results
- Odoo Database → Security Scan Model: loads history
- Security Scan Model → Scan Views & Action: returns state and HTML findings