Authlib 1.6.1__tar.gz → 1.6.3__tar.gz

{authlib-1.6.1 → authlib-1.6.3}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.1
+Version: 1.6.3
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.1 → authlib-1.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.1
+Version: 1.6.3
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.1 → authlib-1.6.3}/README.md

@@ -1,27 +1,35 @@
-<a href="https://authlib.org/">
-<img align="right" width="120" height="120" src="https://authlib.org/assets/logo.svg">
-</a>
+<div align="center">
 
-# Authlib
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/_static/dark-logo.svg" />
+  <img alt="Authlib" src="docs/_static/light-logo.svg" height="68" />
+</picture>
 
-<a href="https://github.com/sponsors/lepture"><img src="https://badgen.net/badge/support/authlib/ff69b4?icon=patreon" /></a>
-<a href="https://github.com/authlib/authlib/actions"><img src="https://github.com/authlib/authlib/workflows/tests/badge.svg" alt="Build Status"></a>
-<a href="https://codecov.io/gh/authlib/authlib" > <img src="https://codecov.io/gh/authlib/authlib/graph/badge.svg?token=BQKzPoql9j"/></a>
-<a href="https://pypi.org/project/Authlib/"><img src="https://badgen.net/pypi/v/authlib" alt="PyPI Version"></a>
-<a href="https://codeclimate.com/github/authlib/authlib/maintainability"><img src="https://badgen.net/codeclimate/maintainability/authlib/authlib?icon=codeclimate" alt="Maintainability" /></a>
+[![Build Status](https://github.com/authlib/authlib/workflows/tests/badge.svg)](https://github.com/authlib/authlib/actions)
+[![PyPI version](https://img.shields.io/pypi/v/authlib.svg)](https://pypi.org/project/authlib)
+[![conda-forge version](https://img.shields.io/conda/v/conda-forge/authlib.svg?label=conda-forge&colorB=0090ff)](https://anaconda.org/conda-forge/authlib)
+[![PyPI Downloads](https://static.pepy.tech/badge/authlib/month)](https://pepy.tech/projects/authlib)
+[![Code Coverage](https://codecov.io/gh/authlib/authlib/graph/badge.svg?token=OWTdxAIsPI)](https://codecov.io/gh/authlib/authlib)
+[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=authlib_authlib&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=authlib_authlib)
+
+</div>
 
 The ultimate Python library in building OAuth and OpenID Connect servers.
 JWS, JWK, JWA, JWT are included.
 
 Authlib is compatible with Python3.9+.
 
-**[Migrating from `authlib.jose` to `joserfc`](https://jose.authlib.org/en/dev/migrations/authlib/)**
+## Migrations
+
+Authlib will deprecate `authlib.jose` module, please read:
+
+- [Migrating from `authlib.jose` to `joserfc`](https://jose.authlib.org/en/dev/migrations/authlib/)
 
 ## Sponsors
 
 <table>
 <tr>
-<td><img align="middle" width="48" src="https://avatars.githubusercontent.com/u/70178963?v=4"></td>
+<td><img align="middle" width="48" src="https://cdn.auth0.com/website/website/favicons/auth0-favicon.svg"></td>
 <td>If you want to quickly add secure token-based authentication to Python projects, feel free to check Auth0's Python SDK and free plan at <a href="https://auth0.com/overview?utm_source=GHsponsor&utm_medium=GHsponsor&utm_campaign=authlib&utm_content=auth">auth0.com/overview</a>.</td>
 </tr>
 <tr>

{authlib-1.6.1 → authlib-1.6.3}/authlib/common/security.py

@@ -16,4 +16,4 @@ def is_secure_transport(uri):
         return True
 
     uri = uri.lower()
-    return uri.startswith(("https://", "http://localhost:"))
+    return uri.startswith(("https://", "http://localhost:", "http://127.0.0.1:"))

{authlib-1.6.1 → authlib-1.6.3}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.6.1"
+version = "1.6.3"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.6.1 → authlib-1.6.3}/authlib/integrations/base_client/sync_openid.py

@@ -82,10 +82,14 @@ class OpenIDMixin:
         def load_key(header, _):
             jwk_set = JsonWebKey.import_key_set(self.fetch_jwk_set())
             try:
-                return jwk_set.find_by_kid(header.get("kid"), use="sig", alg=header.get("alg"))
+                return jwk_set.find_by_kid(
+                    header.get("kid"), use="sig", alg=header.get("alg")
+                )
             except ValueError:
                 # re-try with new jwk set
                 jwk_set = JsonWebKey.import_key_set(self.fetch_jwk_set(force=True))
-                return jwk_set.find_by_kid(header.get("kid"), use="sig", alg=header.get("alg"))
+                return jwk_set.find_by_kid(
+                    header.get("kid"), use="sig", alg=header.get("alg")
+                )
 
         return load_key

{authlib-1.6.1 → authlib-1.6.3}/authlib/integrations/django_oauth2/requests.py

@@ -33,7 +33,11 @@ class DjangoOAuth2Payload(OAuth2Payload):
 
 class DjangoOAuth2Request(OAuth2Request):
     def __init__(self, request: HttpRequest):
-        super().__init__(request.method, request.build_absolute_uri(), request.headers)
+        super().__init__(
+            method=request.method,
+            uri=request.build_absolute_uri(),
+            headers=request.headers,
+        )
         self.payload = DjangoOAuth2Payload(request)
         self._request = request
 

{authlib-1.6.1 → authlib-1.6.3}/authlib/integrations/flask_oauth2/requests.py

@@ -27,7 +27,9 @@ class FlaskOAuth2Payload(OAuth2Payload):
 
 class FlaskOAuth2Request(OAuth2Request):
     def __init__(self, request: Request):
-        super().__init__(request.method, request.url, request.headers)
+        super().__init__(
+            method=request.method, uri=request.url, headers=request.headers
+        )
         self._request = request
         self.payload = FlaskOAuth2Payload(request)
 

{authlib-1.6.1 → authlib-1.6.3}/authlib/integrations/sqla_oauth2/client_mixin.py

@@ -110,6 +110,10 @@ class OAuth2ClientMixin(ClientMixin):
     def software_version(self):
         return self.client_metadata.get("software_version")
 
+    @property
+    def id_token_signed_response_alg(self):
+        return self.client_metadata.get("id_token_signed_response_alg")
+
     def get_client_id(self):
         return self.client_id
 

{authlib-1.6.1 → authlib-1.6.3}/authlib/jose/rfc7517/key_set.py

@@ -32,10 +32,9 @@ class KeySet:
         if params:
             keys = list(_filter_keys_by_params(keys, **params))
 
-        if len(keys) == 1:
+        if keys:
             return keys[0]
-
-        raise ValueError("Invalid JSON Web Key Set")
+        raise ValueError("Key not found")
 
 
 def _filter_keys_by_params(keys, **params):

{authlib-1.6.1 → authlib-1.6.3}/authlib/oauth2/client.py

@@ -205,7 +205,8 @@ class OAuth2Client:
                        be added as needed.
         :param headers: Dict to default request headers with.
         :param auth: An auth tuple or method as accepted by requests.
-        :param grant_type: Use specified grant_type to fetch token
+        :param grant_type: Use specified grant_type to fetch token.
+        :param state: Optional "state" value to fetch token.
         :return: A :class:`OAuth2Token` object (a dict too).
         """
         state = state or self.state

{authlib-1.6.1 → authlib-1.6.3}/authlib/oauth2/rfc6749/parameters.py

@@ -92,7 +92,7 @@ def prepare_token_request(grant_type, body="", redirect_uri=None, **kwargs):
     if "scope" in kwargs:
         kwargs["scope"] = list_to_scope(kwargs["scope"])
 
-    if grant_type == "authorization_code" and "code" not in kwargs:
+    if grant_type == "authorization_code" and kwargs.get("code") is None:
         raise MissingCodeException()
 
     for k in kwargs:

{authlib-1.6.1 → authlib-1.6.3}/authlib/oauth2/rfc6749/requests.py

@@ -65,7 +65,7 @@ class BasicOAuth2Payload(OAuth2Payload):
 
 
 class OAuth2Request(OAuth2Payload):
-    def __init__(self, method: str, uri: str, headers=None):
+    def __init__(self, method: str, uri: str, body=None, headers=None):
         InsecureTransportError.check(uri)
         #: HTTP method
         self.method = method
@@ -73,6 +73,15 @@ class OAuth2Request(OAuth2Payload):
         #: HTTP headers
         self.headers = headers or {}
 
+        # Store body for backward compatibility but issue deprecation warning if used
+        if body is not None:
+            deprecate(
+                "'body' parameter in OAuth2Request is deprecated. "
+                "Use the payload system instead.",
+                version="1.8",
+            )
+        self._body = body
+
         self.payload = None
 
         self.client = None
@@ -88,6 +97,8 @@ class OAuth2Request(OAuth2Payload):
 
     @property
     def form(self):
+        if self._body:
+            return self._body
         raise NotImplementedError()
 
     @property
@@ -154,6 +165,14 @@ class OAuth2Request(OAuth2Payload):
         )
         return self.payload.state
 
+    @property
+    def body(self):
+        deprecate(
+            "'request.body' is deprecated. Use the payload system instead.",
+            version="1.8",
+        )
+        return self._body
+
 
 class JsonPayload:
     @property

{authlib-1.6.1 → authlib-1.6.3}/authlib/oidc/core/grants/code.py

@@ -22,8 +22,12 @@ log = logging.getLogger(__name__)
 class OpenIDToken:
     def get_jwt_config(self, grant):  # pragma: no cover
         """Get the JWT configuration for OpenIDCode extension. The JWT
-        configuration will be used to generate ``id_token``. Developers
-        MUST implement this method in subclass, e.g.::
+        configuration will be used to generate ``id_token``.
+        If ``alg`` is undefined, the ``id_token_signed_response_alg`` client
+        metadata will be used. By default ``RS256`` will be used.
+        If ``key`` is undefined, the ``jwks_uri`` or ``jwks`` client metadata
+        will be used.
+        Developers MUST implement this method in subclass, e.g.::
 
             def get_jwt_config(self, grant):
                 return {
@@ -77,6 +81,13 @@ class OpenIDToken:
         config = self.get_jwt_config(grant)
         config["aud"] = self.get_audiences(request)
 
+        # Per OpenID Connect Registration 1.0 Section 2:
+        # Use client's id_token_signed_response_alg if specified
+        if not config.get("alg") and (
+            client_alg := request.client.id_token_signed_response_alg
+        ):
+            config["alg"] = client_alg
+
         if authorization_code:
             config["nonce"] = authorization_code.get_nonce()
             config["auth_time"] = authorization_code.get_auth_time()

{authlib-1.6.1 → authlib-1.6.3}/authlib/oidc/core/grants/implicit.py

@@ -4,6 +4,7 @@ from authlib.oauth2.rfc6749 import AccessDeniedError
 from authlib.oauth2.rfc6749 import ImplicitGrant
 from authlib.oauth2.rfc6749 import InvalidScopeError
 from authlib.oauth2.rfc6749 import OAuth2Error
+from authlib.oauth2.rfc6749.errors import InvalidRequestError
 from authlib.oauth2.rfc6749.hooks import hooked
 
 from .util import create_response_mode_response
@@ -148,6 +149,26 @@ class OpenIDImplicitGrant(ImplicitGrant):
         if code is not None:
             config["code"] = code
 
+        # Per OpenID Connect Registration 1.0 Section 2:
+        # Use client's id_token_signed_response_alg if specified
+        if not config.get("alg") and (
+            client_alg := self.request.client.id_token_signed_response_alg
+        ):
+            if client_alg == "none":
+                # According to oidc-registration §2 the 'none' alg is not valid in
+                # implicit flows:
+                #    The value none MUST NOT be used as the ID Token alg value unless
+                #    the Client uses only Response Types that return no ID Token from
+                #    the Authorization Endpoint (such as when only using the
+                #    Authorization Code Flow).
+                raise InvalidRequestError(
+                    "id_token must be signed in implicit flows",
+                    redirect_uri=self.request.payload.redirect_uri,
+                    redirect_fragment=True,
+                )
+
+            config["alg"] = client_alg
+
         user_info = self.generate_user_info(self.request.user, token["scope"])
         id_token = generate_id_token(token, user_info, **config)
         token["id_token"] = id_token

{authlib-1.6.1 → authlib-1.6.3}/authlib/oidc/core/grants/util.py

@@ -100,11 +100,15 @@ def generate_id_token(
         payload["amr"] = amr
 
     if code:
-        payload["c_hash"] = to_native(create_half_hash(code, alg))
+        c_hash = create_half_hash(code, alg)
+        if c_hash is not None:
+            payload["c_hash"] = to_native(c_hash)
 
     access_token = token.get("access_token")
     if access_token:
-        payload["at_hash"] = to_native(create_half_hash(access_token, alg))
+        at_hash = create_half_hash(access_token, alg)
+        if at_hash is not None:
+            payload["at_hash"] = to_native(at_hash)
 
     payload.update(user_info)
     return to_native(jwt.encode(header, payload, key))

{authlib-1.6.1 → authlib-1.6.3}/authlib/oidc/core/util.py

@@ -5,10 +5,14 @@ from authlib.common.encoding import urlsafe_b64encode
 
 
 def create_half_hash(s, alg):
-    hash_type = f"sha{alg[2:]}"
-    hash_alg = getattr(hashlib, hash_type, None)
-    if not hash_alg:
-        return None
+    if alg == "EdDSA":
+        hash_alg = hashlib.sha512
+    else:
+        hash_type = f"sha{alg[2:]}"
+        hash_alg = getattr(hashlib, hash_type, None)
+        if not hash_alg:
+            return None
+
     data_digest = hash_alg(to_bytes(s)).digest()
     slice_index = int(len(data_digest) / 2)
     return urlsafe_b64encode(data_digest[:slice_index])

{authlib-1.6.1 → authlib-1.6.3}/pyproject.toml

@@ -47,9 +47,11 @@ Blog = "https://blog.authlib.org/"
 dev = [
     "coverage",
     "cryptography",
-    "pre-commit-uv>=4.1.4",
+    "diff-cover>=9.6.0",
+    "prek>=0.1.3",
     "pytest",
     "pytest-asyncio",
+    "pytest-env",
     "tox-uv >= 1.16.0",
 ]
 
@@ -120,6 +122,10 @@ docstring-code-format = true
 asyncio_default_fixture_loop_scope = "function"
 asyncio_mode = "auto"
 norecursedirs = ["authlib", "build", "dist", "docs", "htmlcov"]
+pythonpath = ["."]
+env = [
+    "DJANGO_SETTINGS_MODULE = tests.django_settings",
+]
 
 [tool.coverage.run]
 branch = true