[IMP] oauth_provider: get access_token from headers, remove werkzeug.wrappers.BaseResponse

[P-H-Phuc]

Changes

• At the token request stage, the scope parameter is optional. The authorization server may ignore it entirely or only honor a subset of the values provided. For this reason, the effective scope should not be assumed from the request, but rather treated as pre-defined and managed by the client’s registered configuration.
  (See Section 3.3 ("Access Token Scope"), Section 4.4.2 ("Access Token Request")

• access_token should be passed in the Authorization: Bearer ... header (See RFC 6750 Section 2.1)

• Fallbacks: some providers (legacy APIs) still allow ?access_token=...

• BaseResponse deprecatied

  • Since odoo 17.0, werkzeug >= 2 is used regardless of python version

  werkzeug 2.0.0

  BaseResponse will show a deprecation warning and check against Response instead.

  werkzeug 2.1.0:

  Remove BaseResponse.

(See pallets/werkzeug#2360 (comment))

[augusto-weiss]

Thanks for collaborating with this module... i am working a little on it