Authlib 1.6.8__tar.gz → 1.6.10__tar.gz

{authlib-1.6.8 → authlib-1.6.10}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.8
+Version: 1.6.10
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.8 → authlib-1.6.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.8
+Version: 1.6.10
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.8 → authlib-1.6.10}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.6.8"
+version = "1.6.10"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.6.8 → authlib-1.6.10}/authlib/jose/__init__.py

@@ -55,6 +55,7 @@ jwt = JsonWebToken(
         "RS384",
         "RS512",
         "ES256",
+        "ES256K",
         "ES384",
         "ES512",
         "PS256",

{authlib-1.6.8 → authlib-1.6.10}/authlib/jose/rfc7515/jws.py

@@ -261,16 +261,18 @@ class JsonWebSignature:
             raise MissingAlgorithmError()
 
         alg = header["alg"]
-        if self._algorithms is not None and alg not in self._algorithms:
-            raise UnsupportedAlgorithmError()
         if alg not in self.ALGORITHMS_REGISTRY:
             raise UnsupportedAlgorithmError()
 
         algorithm = self.ALGORITHMS_REGISTRY[alg]
+        if self._algorithms is None:
+            if algorithm.deprecated:
+                raise UnsupportedAlgorithmError()
+        elif alg not in self._algorithms:
+            raise UnsupportedAlgorithmError()
+
         if callable(key):
             key = key(header, payload)
-        elif key is None and "jwk" in header:
-            key = header["jwk"]
         key = algorithm.prepare_key(key)
         return algorithm, key
 

{authlib-1.6.8 → authlib-1.6.10}/authlib/jose/rfc7515/models.py

@@ -5,6 +5,7 @@ class JWSAlgorithm:
 
     name = None
     description = None
+    deprecated = False
     algorithm_type = "JWS"
     algorithm_location = "alg"
 

{authlib-1.6.8 → authlib-1.6.10}/authlib/jose/rfc7516/jwe.py

@@ -697,11 +697,19 @@ class JsonWebEncryption:
             raise MissingAlgorithmError()
 
         alg = header["alg"]
-        if self._algorithms is not None and alg not in self._algorithms:
-            raise UnsupportedAlgorithmError()
         if alg not in self.ALG_REGISTRY:
             raise UnsupportedAlgorithmError()
-        return self.ALG_REGISTRY[alg]
+
+        instance = self.ALG_REGISTRY[alg]
+
+        # use all ALG_REGISTRY algorithms
+        if self._algorithms is None:
+            # do not use deprecated algorithms
+            if instance.deprecated:
+                raise UnsupportedAlgorithmError()
+        elif alg not in self._algorithms:
+            raise UnsupportedAlgorithmError()
+        return instance
 
     def get_header_enc(self, header):
         if "enc" not in header:
@@ -754,6 +762,4 @@ class JsonWebEncryption:
 def prepare_key(alg, header, key):
     if callable(key):
         key = key(header, None)
-    elif key is None and "jwk" in header:
-        key = header["jwk"]
     return alg.prepare_key(key)

{authlib-1.6.8 → authlib-1.6.10}/authlib/jose/rfc7516/models.py

@@ -9,6 +9,7 @@ class JWEAlgorithmBase(metaclass=ABCMeta):  # noqa: B024
 
     name = None
     description = None
+    deprecated = False
     algorithm_type = "JWE"
     algorithm_location = "alg"
 

{authlib-1.6.8 → authlib-1.6.10}/authlib/jose/rfc7518/jwe_algs.py

@@ -1,4 +1,4 @@
-import os
+import secrets
 import struct
 
 from cryptography.hazmat.backends import default_backend
@@ -41,7 +41,7 @@ class DirectAlgorithm(JWEAlgorithm):
     def unwrap(self, enc_alg, ek, headers, key):
         cek = key.get_op_key("decrypt")
         if len(cek) * 8 != enc_alg.CEK_SIZE:
-            raise ValueError('Invalid "cek" length')
+            cek = secrets.token_bytes(enc_alg.CEK_SIZE // 8)
         return cek
 
 
@@ -52,6 +52,7 @@ class RSAAlgorithm(JWEAlgorithm):
 
     def __init__(self, name, description, pad_fn):
         self.name = name
+        self.deprecated = name == "RSA1_5"
         self.description = description
         self.padding = pad_fn
 
@@ -75,11 +76,10 @@ class RSAAlgorithm(JWEAlgorithm):
         return {"ek": ek, "cek": cek}
 
     def unwrap(self, enc_alg, ek, headers, key):
-        # it will raise ValueError if failed
         op_key = key.get_op_key("unwrapKey")
         cek = op_key.decrypt(ek, self.padding)
         if len(cek) * 8 != enc_alg.CEK_SIZE:
-            raise ValueError('Invalid "cek" length')
+            cek = secrets.token_bytes(enc_alg.CEK_SIZE // 8)
         return cek
 
 
@@ -118,7 +118,7 @@ class AESAlgorithm(JWEAlgorithm):
         self._check_key(op_key)
         cek = aes_key_unwrap(op_key, ek, default_backend())
         if len(cek) * 8 != enc_alg.CEK_SIZE:
-            raise ValueError('Invalid "cek" length')
+            cek = secrets.token_bytes(enc_alg.CEK_SIZE // 8)
         return cek
 
 
@@ -154,7 +154,7 @@ class AESGCMAlgorithm(JWEAlgorithm):
         #: The "iv" (initialization vector) Header Parameter value is the
         #: base64url-encoded representation of the 96-bit IV value
         iv_size = 96
-        iv = os.urandom(iv_size // 8)
+        iv = secrets.token_bytes(iv_size // 8)
 
         cipher = Cipher(AES(op_key), GCM(iv), backend=default_backend())
         enc = cipher.encryptor()
@@ -185,7 +185,7 @@ class AESGCMAlgorithm(JWEAlgorithm):
         d = cipher.decryptor()
         cek = d.update(ek) + d.finalize()
         if len(cek) * 8 != enc_alg.CEK_SIZE:
-            raise ValueError('Invalid "cek" length')
+            cek = secrets.token_bytes(enc_alg.CEK_SIZE // 8)
         return cek
 
 

{authlib-1.6.8 → authlib-1.6.10}/authlib/jose/rfc7518/jws_algs.py

@@ -27,6 +27,7 @@ from .util import encode_int
 class NoneAlgorithm(JWSAlgorithm):
     name = "none"
     description = "No digital signature or MAC performed"
+    deprecated = True
 
     def prepare_key(self, raw_data):
         return None

{authlib-1.6.8 → authlib-1.6.10}/authlib/oauth2/rfc6749/authorization_server.py

@@ -241,10 +241,21 @@ class AuthorizationServer(Hookable):
             if grant_cls.check_authorization_endpoint(request):
                 return _create_grant(grant_cls, extensions, request, self)
 
+        # Per RFC 6749 §4.1.2.1, only redirect with the error if the client
+        # exists and the redirect_uri has been validated against it.
+        redirect_uri = None
+        if client_id := request.payload.client_id:
+            if client := self.query_client(client_id):
+                if requested_uri := request.payload.redirect_uri:
+                    if client.check_redirect_uri(requested_uri):
+                        redirect_uri = requested_uri
+                else:
+                    redirect_uri = client.get_default_redirect_uri()
+
         raise UnsupportedResponseTypeError(
             f"The response type '{request.payload.response_type}' is not supported by the server.",
             request.payload.response_type,
-            redirect_uri=request.payload.redirect_uri,
+            redirect_uri=redirect_uri,
         )
 
     def get_consent_grant(self, request=None, end_user=None):

{authlib-1.6.8 → authlib-1.6.10}/authlib/oidc/core/claims.py

@@ -303,6 +303,6 @@ def get_claim_cls_by_response_type(response_type):
 
 def _verify_hash(signature, s, alg):
     hash_value = create_half_hash(s, alg)
-    if not hash_value:
-        return True
+    if hash_value is None:
+        return False
     return hmac.compare_digest(hash_value, to_bytes(signature))