{"record":{"id":"db4b959863d2beee","repo":"odoo/odoo","slug":"you-do-not-have-permissions-to-remove-the-access-t","errorCode":null,"errorMessage":"You do not have permissions to remove the access token","messagePattern":"You do not have permissions to remove the access token","errorType":"exception","errorClass":"AccessError","httpStatus":null,"severity":"error","filePath":"addons/auth_oauth/models/res_users.py","lineNumber":44,"sourceCode":"\n    _uniq_users_oauth_provider_oauth_uid = models.Constraint(\n        'unique(oauth_provider_id, oauth_uid)',\n        'OAuth UID must be unique per provider',\n    )\n\n    @property\n    def SELF_READABLE_FIELDS(self):\n        return super().SELF_READABLE_FIELDS + ['has_oauth_access_token']\n\n    @api.depends('oauth_access_token')\n    def _compute_has_oauth_access_token(self):\n        for user in self:\n            user.has_oauth_access_token = bool(user.sudo().oauth_access_token)\n\n    def remove_oauth_access_token(self):\n        user = self.env.user\n        if not (user.has_group('base.group_erp_manager') or self == user):\n            raise AccessError(self.env._('You do not have permissions to remove the access token'))\n        self.sudo().oauth_access_token = False\n\n    def _auth_oauth_rpc(self, endpoint, access_token):\n        if self.env['ir.config_parameter'].sudo().get_param('auth_oauth.authorization_header'):\n            response = requests.get(endpoint, headers={'Authorization': 'Bearer %s' % access_token}, timeout=10)\n        else:\n            response = requests.get(endpoint, params={'access_token': access_token}, timeout=10)\n\n        if response.ok: # nb: could be a successful failure\n            return response.json()\n\n        auth_challenge = parse_auth(response.headers.get(\"WWW-Authenticate\"))\n        if auth_challenge and auth_challenge.type == 'bearer' and 'error' in auth_challenge:\n            return dict(auth_challenge)\n\n        return {'error': 'invalid_request'}\n\n    @api.model","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/odoo/odoo/blob/1e661df964b1b264c9cef3ab28430d4785be3fda/addons/auth_oauth/models/res_users.py#L26-L62","documentation":"Access check in res.users.remove_oauth_access_token (auth_oauth): a user may only clear their own oauth_access_token, and only members of base.group_erp_manager may clear someone else's. Any other caller gets AccessError before the sudo() write clears the token.","triggerScenarios":"Calling remove_oauth_access_token on a res.users record that is neither the current env.user nor is the caller in the Administrator/erp_manager group — e.g. a regular user RPC-calling the method on a colleague's id.","commonSituations":"Custom profile screens exposing token removal for other users without elevation; RPC/XML-RPC scripts acting on arbitrary user ids; testing token removal with a non-admin session.","solutions":["Restrict UI/RPC exposure of this button to self or group_erp_manager members","Run the operation as a user in base.group_erp_manager when admin action is intended","Guard before calling: check record == env.user or user.has_group('base.group_erp_manager')"],"exampleFix":"// before\nenv['res.users'].browse(other_user_id).remove_oauth_access_token()  # AccessError\n// after\nif env.user.has_group('base.group_erp_manager') or other_user_id == env.user.id:\n    env['res.users'].browse(other_user_id).remove_oauth_access_token()","handlingStrategy":"type-guard","validationCode":"if not (user.has_group('base.group_erp_manager') or record == user):\n    raise AccessError(env._('You do not have permissions to remove the access token'))","typeGuard":"def can_remove_token(env, target_user) -> bool:\n    return target_user == env.user or env.user.has_group('base.group_erp_manager')","tryCatchPattern":"try:\n    target.remove_oauth_access_token()\nexcept AccessError:\n    # run as manager or restrict UI to self-service only\n    raise","preventionTips":["Only expose the token-removal button on one's own profile or to erp managers","Check has_group before RPC calls instead of relying on the server error"],"tags":["odoo","auth-oauth","access-control","authorization","users"],"backgroundTag":null,"analyzedSha":"1e661df964b1b264c9cef3ab28430d4785be3fda","analyzedAt":"2026-08-15T05:22:16.142Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}