Security

What Power BI Connector for Odoo can read and write, what it stores, and what leaves your instance.

A token reads as a person

Every Odoo-to-BI connector on the market authenticates with an administrator's API key, which is why the refreshed dataset contains rows the person who built it was never allowed to see.

Here a token is bound to one Odoo user, and every row is read through with_user(that person) by the Report Builder's own execution path. There is no query path in this module.

Credentials

HTTP Basic, because that is what Power BI's OData connector offers and what its scheduled refresh can store. The 401 carries WWW-Authenticate: Basic, without which Power BI never offers a password box at all.
Never a query-string key. A URL ends up in browser history, proxy logs and the dataset settings screen; a password box does not.
Stored as a SHA-256 digest plus a short non-secret prefix, compared in constant time. Shown once, unrecoverable.
Owner and digest frozen after issue, so revocation cannot be downgraded to a rename.
Expiry and revocation take effect on the next refresh.

Publishing

Off by default and per report. Exposing every saved report the moment somebody installs a module is a data-egress decision made by the wrong person.

A table that is unpublished and a table that does not exist answer identically, so the feed cannot be used to enumerate what reports a database has.

Transport

Serve Odoo over HTTPS. Odoo warns you at issue time if web.base.url is not HTTPS, because a token sent over plain HTTP is readable by anything between Power BI and your server.

Read-only

The feed exposes no write of any kind. There is nothing in the underlying tool layer to write with.

Reporting a vulnerability

info@technovision.dev, with the Odoo version, the module version and enough detail to reproduce.

A token reads as a person

Every Odoo-to-BI connector on the market authenticates with an administrator's API key, which is why the refreshed dataset contains rows the person who built it was never allowed to see.

Here a token is bound to one Odoo user, and every row is read through with_user(that person) by the Report Builder's own execution path. There is no query path in this module.

Credentials

HTTP Basic, because that is what Power BI's OData connector offers and what its scheduled refresh can store. The 401 carries WWW-Authenticate: Basic, without which Power BI never offers a password box at all.

Never a query-string key. A URL ends up in browser history, proxy logs and the dataset settings screen; a password box does not.

Stored as a SHA-256 digest plus a short non-secret prefix, compared in constant time. Shown once, unrecoverable.

Owner and digest frozen after issue, so revocation cannot be downgraded to a rename.

Expiry and revocation take effect on the next refresh.