Authlib 1.6.5__tar.gz → 1.6.7__tar.gz

{authlib-1.6.5 → authlib-1.6.7}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.5
+Version: 1.6.7
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.5 → authlib-1.6.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.5
+Version: 1.6.7
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.5 → authlib-1.6.7}/authlib/__init__.py

@@ -1,4 +1,5 @@
-"""authlib.
+"""
+authlib
 ~~~~~~~
 
 The ultimate Python library in building OAuth 1.0, OAuth 2.0 and OpenID

{authlib-1.6.5 → authlib-1.6.7}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.6.5"
+version = "1.6.7"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.6.5 → authlib-1.6.7}/authlib/integrations/base_client/framework_integration.py

@@ -20,11 +20,9 @@ class FrameworkIntegration:
 
     def _clear_session_state(self, session):
         now = time.time()
+        prefix = f"_state_{self.name}"
         for key in dict(session):
-            if "_authlib_" in key:
-                # TODO: remove in future
-                session.pop(key)
-            elif key.startswith("_state_"):
+            if key.startswith(prefix):
                 value = session[key]
                 exp = value.get("exp")
                 if not exp or exp < now:
@@ -32,29 +30,32 @@ class FrameworkIntegration:
 
     def get_state_data(self, session, state):
         key = f"_state_{self.name}_{state}"
+        session_data = session.get(key)
+        if not session_data:
+            return None
         if self.cache:
-            value = self._get_cache_data(key)
+            cached_value = self._get_cache_data(key)
         else:
-            value = session.get(key)
-        if value:
-            return value.get("data")
+            cached_value = session_data
+        if cached_value:
+            return cached_value.get("data")
         return None
 
     def set_state_data(self, session, state, data):
         key = f"_state_{self.name}_{state}"
+        now = time.time()
         if self.cache:
             self.cache.set(key, json.dumps({"data": data}), self.expires_in)
+            session[key] = {"exp": now + self.expires_in}
         else:
-            now = time.time()
             session[key] = {"data": data, "exp": now + self.expires_in}
 
     def clear_state_data(self, session, state):
         key = f"_state_{self.name}_{state}"
         if self.cache:
             self.cache.delete(key)
-        else:
-            session.pop(key, None)
-            self._clear_session_state(session)
+        session.pop(key, None)
+        self._clear_session_state(session)
 
     def update_token(self, token, refresh_token=None, access_token=None):
         raise NotImplementedError()

{authlib-1.6.5 → authlib-1.6.7}/authlib/jose/__init__.py

@@ -46,7 +46,22 @@ JsonWebKey.JWK_KEY_CLS = {
     OKPKey.kty: OKPKey,
 }
 
-jwt = JsonWebToken(list(JsonWebSignature.ALGORITHMS_REGISTRY.keys()))
+jwt = JsonWebToken(
+    [
+        "HS256",
+        "HS384",
+        "HS512",
+        "RS256",
+        "RS384",
+        "RS512",
+        "ES256",
+        "ES384",
+        "ES512",
+        "PS256",
+        "PS384",
+        "PS512",
+    ]
+)
 
 
 __all__ = [

{authlib-1.6.5 → authlib-1.6.7}/authlib/oauth1/rfc5849/client_auth.py

@@ -172,6 +172,8 @@ class ClientAuth:
 
         if CONTENT_TYPE_FORM_URLENCODED in content_type:
             headers["Content-Type"] = CONTENT_TYPE_FORM_URLENCODED
+            if isinstance(body, bytes):
+                body = body.decode()
             uri, headers, body = self.sign(method, uri, headers, body)
         elif self.force_include_body:
             # To allow custom clients to work on non form encoded bodies.

{authlib-1.6.5 → authlib-1.6.7}/authlib/oauth2/rfc6749/wrappers.py

@@ -4,15 +4,26 @@ import time
 class OAuth2Token(dict):
     def __init__(self, params):
         if params.get("expires_at"):
-            params["expires_at"] = int(params["expires_at"])
+            try:
+                params["expires_at"] = int(params["expires_at"])
+            except ValueError:
+                # If expires_at is not parseable, fall back to expires_in if available
+                # Otherwise leave expires_at untouched
+                if params.get("expires_in"):
+                    params["expires_at"] = int(time.time()) + int(params["expires_in"])
+
         elif params.get("expires_in"):
             params["expires_at"] = int(time.time()) + int(params["expires_in"])
+
         super().__init__(params)
 
     def is_expired(self, leeway=60):
         expires_at = self.get("expires_at")
         if not expires_at:
             return None
+        # Only check expiration if expires_at is an integer
+        if not isinstance(expires_at, int):
+            return None
         # small timedelta to consider token as expired before it actually expires
         expiration_threshold = expires_at - leeway
         return expiration_threshold < time.time()

{authlib-1.6.5 → authlib-1.6.7}/authlib/oauth2/rfc9101/authorization_server.py

@@ -1,4 +1,5 @@
-from authlib.jose import jwt
+from authlib.jose import JsonWebSignature
+from authlib.jose import JsonWebToken
 from authlib.jose.errors import JoseError
 
 from ..rfc6749 import AuthorizationServer
@@ -135,8 +136,8 @@ class JWTAuthenticationRequest:
         self, request, client: ClientMixin, raw_request_object: str
     ):
         jwks = self.resolve_client_public_key(client)
-
         try:
+            jwt = JsonWebToken(list(JsonWebSignature.ALGORITHMS_REGISTRY.keys()))
             request_object = jwt.decode(raw_request_object, jwks)
             request_object.validate()
 

{authlib-1.6.5 → authlib-1.6.7}/authlib/oidc/core/grants/code.py

@@ -8,6 +8,7 @@ per `Section 3.1`_.
 """
 
 import logging
+import warnings
 
 from authlib.oauth2.rfc6749 import OAuth2Request
 
@@ -20,7 +21,7 @@ log = logging.getLogger(__name__)
 
 
 class OpenIDToken:
-    def get_jwt_config(self, grant):  # pragma: no cover
+    def get_jwt_config(self, grant, client):  # pragma: no cover
         """Get the JWT configuration for OpenIDCode extension. The JWT
         configuration will be used to generate ``id_token``.
         If ``alg`` is undefined, the ``id_token_signed_response_alg`` client
@@ -29,15 +30,16 @@ class OpenIDToken:
         will be used.
         Developers MUST implement this method in subclass, e.g.::
 
-            def get_jwt_config(self, grant):
+            def get_jwt_config(self, grant, client):
                 return {
                     "key": read_private_key_file(key_path),
-                    "alg": "RS256",
+                    "alg": client.id_token_signed_response_alg or "RS256",
                     "iss": "issuer-identity",
                     "exp": 3600,
                 }
 
         :param grant: AuthorizationCodeGrant instance
+        :param client: OAuth2 client instance
         :return: dict
         """
         raise NotImplementedError()
@@ -78,7 +80,17 @@ class OpenIDToken:
         request: OAuth2Request = grant.request
         authorization_code = request.authorization_code
 
-        config = self.get_jwt_config(grant)
+        try:
+            config = self.get_jwt_config(grant, request.client)
+        except TypeError:
+            warnings.warn(
+                "get_jwt_config(self, grant) is deprecated and will be removed in version 1.8. "
+                "Use get_jwt_config(self, grant, client) instead.",
+                DeprecationWarning,
+                stacklevel=2,
+            )
+            config = self.get_jwt_config(grant)
+
         config["aud"] = self.get_audiences(request)
 
         # Per OpenID Connect Registration 1.0 Section 2:

{authlib-1.6.5 → authlib-1.6.7}/authlib/oidc/core/grants/implicit.py

@@ -1,4 +1,5 @@
 import logging
+import warnings
 
 from authlib.oauth2.rfc6749 import AccessDeniedError
 from authlib.oauth2.rfc6749 import ImplicitGrant
@@ -36,19 +37,20 @@ class OpenIDImplicitGrant(ImplicitGrant):
         """
         raise NotImplementedError()
 
-    def get_jwt_config(self):
+    def get_jwt_config(self, client):
         """Get the JWT configuration for OpenIDImplicitGrant. The JWT
         configuration will be used to generate ``id_token``. Developers
         MUST implement this method in subclass, e.g.::
 
-            def get_jwt_config(self):
+            def get_jwt_config(self, client):
                 return {
                     "key": read_private_key_file(key_path),
-                    "alg": "RS256",
+                    "alg": client.id_token_signed_response_alg or "RS256",
                     "iss": "issuer-identity",
                     "exp": 3600,
                 }
 
+        :param client: OAuth2 client instance
         :return: dict
         """
         raise NotImplementedError()
@@ -143,7 +145,17 @@ class OpenIDImplicitGrant(ImplicitGrant):
         return params
 
     def process_implicit_token(self, token, code=None):
-        config = self.get_jwt_config()
+        try:
+            config = self.get_jwt_config(self.request.client)
+        except TypeError:
+            warnings.warn(
+                "get_jwt_config(self) is deprecated and will be removed in version 1.8. "
+                "Use get_jwt_config(self, client) instead.",
+                DeprecationWarning,
+                stacklevel=2,
+            )
+            config = self.get_jwt_config()
+
         config["aud"] = self.get_audiences(self.request)
         config["nonce"] = self.request.payload.data.get("nonce")
         if code is not None:

{authlib-1.6.5 → authlib-1.6.7}/authlib/oidc/core/grants/util.py

@@ -3,7 +3,7 @@ import time
 from authlib.common.encoding import to_native
 from authlib.common.urls import add_params_to_uri
 from authlib.common.urls import quote_url
-from authlib.jose import jwt
+from authlib.jose import JsonWebToken
 from authlib.oauth2.rfc6749 import InvalidRequestError
 from authlib.oauth2.rfc6749 import scope_to_list
 
@@ -111,7 +111,7 @@ def generate_id_token(
             payload["at_hash"] = to_native(at_hash)
 
     payload.update(user_info)
-    return to_native(jwt.encode(header, payload, key))
+    return to_native(JsonWebToken([alg]).encode(header, payload, key))
 
 
 def create_response_mode_response(redirect_uri, params, response_mode):

{authlib-1.6.5 → authlib-1.6.7}/authlib/oidc/core/userinfo.py

@@ -1,7 +1,7 @@
 from typing import Optional
 
 from authlib.consts import default_json_headers
-from authlib.jose import jwt
+from authlib.jose import JsonWebToken
 from authlib.oauth2.rfc6749.authorization_server import AuthorizationServer
 from authlib.oauth2.rfc6749.authorization_server import OAuth2Request
 from authlib.oauth2.rfc6749.resource_protector import ResourceProtector
@@ -74,7 +74,9 @@ class UserInfoEndpoint:
             user_info["iss"] = self.get_issuer()
             user_info["aud"] = client.client_id
 
-            data = jwt.encode({"alg": alg}, user_info, self.resolve_private_key())
+            data = JsonWebToken([alg]).encode(
+                {"alg": alg}, user_info, self.resolve_private_key()
+            )
             return 200, data, [("Content-Type", "application/jwt")]
 
         return 200, user_info, default_json_headers