From 32d3cef4e4f932fc330dbd607fb2efe1553ad48a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Tue, 31 Mar 2026 13:26:00 +0200
Subject: [PATCH] Use session property instead of authorization for bus
 subscription

Since 375fb083e95a the userid may be defined in a cookie instead of the
authorization header.

Closes #14726
---
 trytond/trytond/bus.py | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/trytond/trytond/bus.py b/trytond/trytond/bus.py
index 39c83f464a..5d31549351 100644
--- a/trytond/trytond/bus.py
+++ b/trytond/trytond/bus.py
@@ -226,19 +226,22 @@ def subscribe(request, database_name):
     url_host = config.get('bus', 'url_host')
     if url_host and url_host != request.host_url:
         abort(HTTPStatus.UNAUTHORIZED)
-    user = request.authorization.get('userid')
+    if session := request.session:
+        userid = session.userid
+    else:
+        abort(HTTPStatus.UNAUTHORIZED)
     channels = request.parsed_data.get('channels', [])
-    if user is None:
+    if userid is None:
         raise exceptions.BadRequest
 
     channels = set(filter(lambda c: not c.startswith('user:'), channels))
-    channels.add('user:%s' % user)
+    channels.add('user:%s' % userid)
 
     last_message = request.parsed_data.get('last_message')
 
     logger.info(
         "get bus messages for %s since %s from %s@%s%s",
-        channels, last_message, request.authorization.username,
+        channels, last_message, session.username,
         request.remote_addr, request.path)
     bus_response = Bus.subscribe(database_name, channels, last_message)
     return Response(