Authlib 1.6.2__tar.gz → 1.6.3__tar.gz

{authlib-1.6.2 → authlib-1.6.3}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.2
+Version: 1.6.3
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.2 → authlib-1.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.2
+Version: 1.6.3
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.2 → authlib-1.6.3}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.6.2"
+version = "1.6.3"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.6.2 → authlib-1.6.3}/authlib/integrations/sqla_oauth2/client_mixin.py

@@ -110,6 +110,10 @@ class OAuth2ClientMixin(ClientMixin):
     def software_version(self):
         return self.client_metadata.get("software_version")
 
+    @property
+    def id_token_signed_response_alg(self):
+        return self.client_metadata.get("id_token_signed_response_alg")
+
     def get_client_id(self):
         return self.client_id
 

{authlib-1.6.2 → authlib-1.6.3}/authlib/oidc/core/grants/code.py

@@ -22,8 +22,12 @@ log = logging.getLogger(__name__)
 class OpenIDToken:
     def get_jwt_config(self, grant):  # pragma: no cover
         """Get the JWT configuration for OpenIDCode extension. The JWT
-        configuration will be used to generate ``id_token``. Developers
-        MUST implement this method in subclass, e.g.::
+        configuration will be used to generate ``id_token``.
+        If ``alg`` is undefined, the ``id_token_signed_response_alg`` client
+        metadata will be used. By default ``RS256`` will be used.
+        If ``key`` is undefined, the ``jwks_uri`` or ``jwks`` client metadata
+        will be used.
+        Developers MUST implement this method in subclass, e.g.::
 
             def get_jwt_config(self, grant):
                 return {
@@ -77,6 +81,13 @@ class OpenIDToken:
         config = self.get_jwt_config(grant)
         config["aud"] = self.get_audiences(request)
 
+        # Per OpenID Connect Registration 1.0 Section 2:
+        # Use client's id_token_signed_response_alg if specified
+        if not config.get("alg") and (
+            client_alg := request.client.id_token_signed_response_alg
+        ):
+            config["alg"] = client_alg
+
         if authorization_code:
             config["nonce"] = authorization_code.get_nonce()
             config["auth_time"] = authorization_code.get_auth_time()

{authlib-1.6.2 → authlib-1.6.3}/authlib/oidc/core/grants/implicit.py

@@ -4,6 +4,7 @@ from authlib.oauth2.rfc6749 import AccessDeniedError
 from authlib.oauth2.rfc6749 import ImplicitGrant
 from authlib.oauth2.rfc6749 import InvalidScopeError
 from authlib.oauth2.rfc6749 import OAuth2Error
+from authlib.oauth2.rfc6749.errors import InvalidRequestError
 from authlib.oauth2.rfc6749.hooks import hooked
 
 from .util import create_response_mode_response
@@ -148,6 +149,26 @@ class OpenIDImplicitGrant(ImplicitGrant):
         if code is not None:
             config["code"] = code
 
+        # Per OpenID Connect Registration 1.0 Section 2:
+        # Use client's id_token_signed_response_alg if specified
+        if not config.get("alg") and (
+            client_alg := self.request.client.id_token_signed_response_alg
+        ):
+            if client_alg == "none":
+                # According to oidc-registration §2 the 'none' alg is not valid in
+                # implicit flows:
+                #    The value none MUST NOT be used as the ID Token alg value unless
+                #    the Client uses only Response Types that return no ID Token from
+                #    the Authorization Endpoint (such as when only using the
+                #    Authorization Code Flow).
+                raise InvalidRequestError(
+                    "id_token must be signed in implicit flows",
+                    redirect_uri=self.request.payload.redirect_uri,
+                    redirect_fragment=True,
+                )
+
+            config["alg"] = client_alg
+
         user_info = self.generate_user_info(self.request.user, token["scope"])
         id_token = generate_id_token(token, user_info, **config)
         token["id_token"] = id_token

{authlib-1.6.2 → authlib-1.6.3}/pyproject.toml

@@ -47,9 +47,11 @@ Blog = "https://blog.authlib.org/"
 dev = [
     "coverage",
     "cryptography",
-    "pre-commit-uv>=4.1.4",
+    "diff-cover>=9.6.0",
+    "prek>=0.1.3",
     "pytest",
     "pytest-asyncio",
+    "pytest-env",
     "tox-uv >= 1.16.0",
 ]
 
@@ -120,6 +122,10 @@ docstring-code-format = true
 asyncio_default_fixture_loop_scope = "function"
 asyncio_mode = "auto"
 norecursedirs = ["authlib", "build", "dist", "docs", "htmlcov"]
+pythonpath = ["."]
+env = [
+    "DJANGO_SETTINGS_MODULE = tests.django_settings",
+]
 
 [tool.coverage.run]
 branch = true