Odoo Changelog — 2025-02-21

Friday, February 21, 2025

1 change · 17.0

Improvements(1)

Enhancements to existing features

[IMP] social_facebook: implement the deletion callback URL

Enterprise17.0social_facebookMedium

Odoo Social now supports Facebook’s data deletion callback, allowing user requests from Facebook settings to trigger removal of related social accounts and selected content automatically. This reduces manual cleanup work and helps businesses respond more reliably to user data removal requests.

Original PR description

Purpose
=======
In the Facebook settings, a user can ask an application (eg Social) to remove his data.

If the deletion is not implemented, it should be done manually for each user, and so we want to automate that process.

Technical
=========
The deletion process is done in that order:
1. The user go to his settings and ask Odoo to remove the data we have
2. Facebook will hit an endpoint in IAP, with a signature, and the  Facebook user id
3. IAP will reach the database, (with a shared secret to authenticate itself) and that endpoint will remove the social accounts, and also the social posts / templates if the account is selected

We do it that way, instead of having a CRON on the client database, because we are able to know if the user uninstalled social, or if he already removed the account.

If the database is not reachable from the internet, we will have it's dbuuid, and so, we will be able to take an action.

Authentication
==============
IAP needs to authenticate to the Odoo database,
so both need to share a secret.

That secret can not be the extended token,
because we don't store it on the Odoo side.

That secret is derived from the database secret, and sent when we ask the Facebook URL (in python, without a browser redirection), so the social user can not see it (otherwise, he will be able to bypass company access rules, and delete the social accounts of different company).

Setup
=====
1. Start Odoo and IAP instances
2. Start ngrok on the IAP port
3. In the Facebook settings ("Facebook Login For Business" -> Settings)
    - Add <ngrok_url>/api/social/facebook/1/callback in the Facebook settings
    - Add <ngrok_url>/api/social_facebook/1/deletion_callback in the Facebook settings
4. Add the Facebook credentials in the IAP settings
5. In the Odoo db, add the system parameter `social.social_iap_endpoint` with the ngrok url
6. In the IAP db, change the system parameter `web.base.url` with the ngrok url
7. In the IAP code, in `facebook_controller.py`, comment the dbuid check `_check_has_access`
8. Add your accounts
9. Go to `https://www.facebook.com/settings/?tab=business_tools`, and remove the app
10. Go to the "Removed" tab, then "View Details" and click on "Send Request"

Task-4350697

#facebook#data deletion#privacy#social

Purpose ======= In the Facebook settings, a user can ask an application (eg Social) to remove his data. If the deletion is not implemented, it should be done manually for each user, and so we want to automate that process. Technical ========= The deletion process is done in that order: 1. The user go to his settings and ask Odoo to remove the data we have 2. Facebook will hit an endpoint in IAP, with a signature, and the Facebook user id 3. IAP will reach the database, (with a shared secret to authenticate itself) and that endpoint will remove the social accounts, and also the social posts / templates if the account is selected We do it that way, instead of having a CRON on the client database, because we are able to know if the user uninstalled social, or if he already removed the account. If the database is not reachable from the internet, we will have it's dbuuid, and so, we will be able to take an action. Authentication ============== IAP needs to authenticate to the Odoo database, so both need to share a secret. That secret can not be the extended token, because we don't store it on the Odoo side. That secret is derived from the database secret, and sent when we ask the Facebook URL (in python, without a browser redirection), so the social user can not see it (otherwise, he will be able to bypass company access rules, and delete the social accounts of different company). Setup ===== 1. Start Odoo and IAP instances 2. Start ngrok on the IAP port 3. In the Facebook settings ("Facebook Login For Business" -> Settings) - Add <ngrok_url>/api/social/facebook/1/callback in the Facebook settings - Add <ngrok_url>/api/social_facebook/1/deletion_callback in the Facebook settings 4. Add the Facebook credentials in the IAP settings 5. In the Odoo db, add the system parameter `social.social_iap_endpoint` with the ngrok url 6. In the IAP db, change the system parameter `web.base.url` with the ngrok url 7. In the IAP code, in `facebook_controller.py`, comment the dbuid check `_check_has_access` 8. Add your accounts 9. Go to `https://www.facebook.com/settings/?tab=business_tools`, and remove the app 10. Go to the "Removed" tab, then "View Details" and click on "Send Request" Task-4350697