Authlib 1.7.2__tar.gz → 1.8.0__tar.gz

{authlib-1.7.2 → authlib-1.8.0}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.7.2
+Version: 1.8.0
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause
@@ -32,8 +32,8 @@ Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: cryptography
-Requires-Dist: joserfc>=1.6.0
+Requires-Dist: cryptography>=45.0.1
+Requires-Dist: joserfc>=1.6.1
 Dynamic: license-file
 
 <div align="center">

{authlib-1.7.2 → authlib-1.8.0}/Authlib.egg-info/SOURCES.txt

@@ -54,6 +54,7 @@ authlib/integrations/flask_oauth2/requests.py
 authlib/integrations/flask_oauth2/resource_protector.py
 authlib/integrations/flask_oauth2/signals.py
 authlib/integrations/httpx_client/__init__.py
+authlib/integrations/httpx_client/_compat.py
 authlib/integrations/httpx_client/assertion_client.py
 authlib/integrations/httpx_client/oauth1_client.py
 authlib/integrations/httpx_client/oauth2_client.py

authlib-1.8.0/Authlib.egg-info/requires.txt

@@ -0,0 +1,2 @@
+cryptography>=45.0.1
+joserfc>=1.6.1

{authlib-1.7.2 → authlib-1.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.7.2
+Version: 1.8.0
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause
@@ -32,8 +32,8 @@ Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: cryptography
-Requires-Dist: joserfc>=1.6.0
+Requires-Dist: cryptography>=45.0.1
+Requires-Dist: joserfc>=1.6.1
 Dynamic: license-file
 
 <div align="center">

authlib-1.8.0/authlib/common/security.py

@@ -0,0 +1,48 @@
+import ipaddress
+import os
+import random
+import string
+from urllib.parse import urlsplit
+
+UNICODE_ASCII_CHARACTER_SET = string.ascii_letters + string.digits
+
+
+def generate_token(length=30, chars=UNICODE_ASCII_CHARACTER_SET):
+    rand = random.SystemRandom()
+    return "".join(rand.choice(chars) for _ in range(length))
+
+
+def is_secure_transport(uri):
+    """Check if the uri is over ssl."""
+    if os.getenv("AUTHLIB_INSECURE_TRANSPORT"):
+        return True
+
+    try:
+        parts = urlsplit(uri)
+    except ValueError:
+        return False
+
+    if not parts.hostname:
+        return False
+
+    if parts.scheme == "https":
+        return True
+
+    if parts.scheme != "http":
+        return False
+
+    # rfc8252 §7.3: native apps may use http for loopback redirection URIs.
+    if parts.hostname == "localhost":
+        return True
+
+    try:
+        address = ipaddress.ip_address(parts.hostname)
+    except ValueError:
+        return False
+
+    # IPv6Address.is_loopback only accounts for the mapped IPv4 address since
+    # CPython 3.10.16, 3.11.11 and 3.12.4.
+    if isinstance(address, ipaddress.IPv6Address) and address.ipv4_mapped:
+        address = address.ipv4_mapped
+
+    return address.is_loopback

{authlib-1.7.2 → authlib-1.8.0}/authlib/common/urls.py

@@ -140,7 +140,16 @@ def extract_params(raw):
 
 
 def is_valid_url(url: str, fragments_allowed=True):
-    parsed = urlparse.urlparse(url)
-    return (
+    try:
+        parsed = urlparse.urlparse(url)
+    except ValueError:
+        return False
+
+    # The userinfo component can disguise the actual host,
+    # as in "https://provider.test@attacker.test/".
+    if "@" in parsed.netloc:
+        return False
+
+    return bool(
         parsed.scheme and parsed.hostname and (fragments_allowed or not parsed.fragment)
     )

{authlib-1.7.2 → authlib-1.8.0}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.7.2"
+version = "1.8.0"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.7.2 → authlib-1.8.0}/authlib/integrations/base_client/async_openid.py

@@ -1,6 +1,7 @@
 from joserfc import jwt
 from joserfc.errors import InvalidKeyIdError
 from joserfc.jwk import KeySet
+from joserfc.jws import JWSRegistry
 
 from authlib.common.security import generate_token
 from authlib.common.urls import add_params_to_uri
@@ -67,7 +68,7 @@ class AsyncOpenIDMixin:
             token = jwt.decode(
                 token["id_token"],
                 key=key_set,
-                algorithms=alg_values,
+                registry=JWSRegistry(algorithms=alg_values, strict_check_header=False),
             )
         except InvalidKeyIdError:
             jwks = await self.fetch_jwk_set(force=True)
@@ -75,7 +76,7 @@ class AsyncOpenIDMixin:
             token = jwt.decode(
                 token["id_token"],
                 key=key_set,
-                algorithms=alg_values,
+                registry=JWSRegistry(algorithms=alg_values, strict_check_header=False),
             )
 
         claims = claims_cls(token.claims, token.header, claims_options, claims_params)

{authlib-1.7.2 → authlib-1.8.0}/authlib/integrations/base_client/sync_openid.py

@@ -1,6 +1,7 @@
 from joserfc import jwt
 from joserfc.errors import InvalidKeyIdError
 from joserfc.jwk import KeySet
+from joserfc.jws import JWSRegistry
 
 from authlib.common.security import generate_token
 from authlib.common.urls import add_params_to_uri
@@ -66,14 +67,14 @@ class OpenIDMixin:
             token = jwt.decode(
                 token["id_token"],
                 key=key_set,
-                algorithms=alg_values,
+                registry=JWSRegistry(algorithms=alg_values, strict_check_header=False),
             )
         except InvalidKeyIdError:
             key_set = KeySet.import_key_set(self.fetch_jwk_set(force=True))
             token = jwt.decode(
                 token["id_token"],
                 key=key_set,
-                algorithms=alg_values,
+                registry=JWSRegistry(algorithms=alg_values, strict_check_header=False),
             )
 
         claims = claims_cls(token.claims, token.header, claims_options, claims_params)

authlib-1.8.0/authlib/integrations/httpx_client/_compat.py

@@ -0,0 +1,18 @@
+"""Compatibility shim for httpx2 with legacy httpx fallback.
+
+Falls back to httpx when httpx2 is unavailable. The fallback is deprecated
+and will be removed in a future release.
+"""
+
+from authlib.deprecate import deprecate
+
+try:
+    import httpx2
+except ImportError:
+    import httpx as httpx2
+
+    deprecate(
+        "The httpx module is deprecated; please use httpx2 instead."
+    )
+
+__all__ = ["httpx2"]

{authlib-1.7.2 → authlib-1.8.0}/authlib/integrations/httpx_client/assertion_client.py

@@ -1,18 +1,18 @@
-import httpx
-from httpx import USE_CLIENT_DEFAULT
-from httpx import Response
-
 from authlib.oauth2.rfc7521 import AssertionClient as _AssertionClient
 from authlib.oauth2.rfc7523 import JWTBearerGrant
 
 from ..base_client import OAuthError
+from ._compat import httpx2
 from .oauth2_client import OAuth2Auth
 from .utils import extract_client_kwargs
 
+USE_CLIENT_DEFAULT = httpx2.USE_CLIENT_DEFAULT
+Response = httpx2.Response
+
 __all__ = ["AsyncAssertionClient"]
 
 
-class AsyncAssertionClient(_AssertionClient, httpx.AsyncClient):
+class AsyncAssertionClient(_AssertionClient, httpx2.AsyncClient):
     token_auth_class = OAuth2Auth
     oauth_error_class = OAuthError
     JWT_BEARER_GRANT_TYPE = JWTBearerGrant.GRANT_TYPE
@@ -31,10 +31,11 @@ class AsyncAssertionClient(_AssertionClient, httpx.AsyncClient):
         claims=None,
         token_placement="header",
         scope=None,
+        client_id=None,
         **kwargs,
     ):
         client_kwargs = extract_client_kwargs(kwargs)
-        httpx.AsyncClient.__init__(self, **client_kwargs)
+        httpx2.AsyncClient.__init__(self, **client_kwargs)
 
         _AssertionClient.__init__(
             self,
@@ -47,6 +48,7 @@ class AsyncAssertionClient(_AssertionClient, httpx.AsyncClient):
             claims=claims,
             token_placement=token_placement,
             scope=scope,
+            client_id=client_id,
             **kwargs,
         )
 
@@ -69,7 +71,7 @@ class AsyncAssertionClient(_AssertionClient, httpx.AsyncClient):
         return self.parse_response_token(resp)
 
 
-class AssertionClient(_AssertionClient, httpx.Client):
+class AssertionClient(_AssertionClient, httpx2.Client):
     token_auth_class = OAuth2Auth
     oauth_error_class = OAuthError
     JWT_BEARER_GRANT_TYPE = JWTBearerGrant.GRANT_TYPE
@@ -88,15 +90,11 @@ class AssertionClient(_AssertionClient, httpx.Client):
         claims=None,
         token_placement="header",
         scope=None,
+        client_id=None,
         **kwargs,
     ):
         client_kwargs = extract_client_kwargs(kwargs)
-        # app keyword was dropped!
-        app_value = client_kwargs.pop("app", None)
-        if app_value is not None:
-            client_kwargs["transport"] = httpx.WSGITransport(app=app_value)
-
-        httpx.Client.__init__(self, **client_kwargs)
+        httpx2.Client.__init__(self, **client_kwargs)
 
         _AssertionClient.__init__(
             self,
@@ -109,6 +107,7 @@ class AssertionClient(_AssertionClient, httpx.Client):
             claims=claims,
             token_placement=token_placement,
             scope=scope,
+            client_id=client_id,
             **kwargs,
         )
 

{authlib-1.7.2 → authlib-1.8.0}/authlib/integrations/httpx_client/oauth1_client.py

@@ -1,10 +1,5 @@
 import typing
 
-import httpx
-from httpx import Auth
-from httpx import Request
-from httpx import Response
-
 from authlib.common.encoding import to_unicode
 from authlib.oauth1 import SIGNATURE_HMAC_SHA1
 from authlib.oauth1 import SIGNATURE_TYPE_HEADER
@@ -12,12 +7,17 @@ from authlib.oauth1 import ClientAuth
 from authlib.oauth1.client import OAuth1Client as _OAuth1Client
 
 from ..base_client import OAuthError
+from ._compat import httpx2
 from .utils import build_request
 from .utils import extract_client_kwargs
 
+Auth = httpx2.Auth
+Request = httpx2.Request
+Response = httpx2.Response
+
 
 class OAuth1Auth(Auth, ClientAuth):
-    """Signs the httpx request using OAuth 1 (RFC5849)."""
+    """Signs the httpx2 request using OAuth 1 (RFC5849)."""
 
     requires_request_body = True
 
@@ -31,7 +31,7 @@ class OAuth1Auth(Auth, ClientAuth):
         )
 
 
-class AsyncOAuth1Client(_OAuth1Client, httpx.AsyncClient):
+class AsyncOAuth1Client(_OAuth1Client, httpx2.AsyncClient):
     auth_class = OAuth1Auth
 
     def __init__(
@@ -49,7 +49,7 @@ class AsyncOAuth1Client(_OAuth1Client, httpx.AsyncClient):
         **kwargs,
     ):
         _client_kwargs = extract_client_kwargs(kwargs)
-        httpx.AsyncClient.__init__(self, **_client_kwargs)
+        httpx2.AsyncClient.__init__(self, **_client_kwargs)
 
         _OAuth1Client.__init__(
             self,
@@ -99,7 +99,7 @@ class AsyncOAuth1Client(_OAuth1Client, httpx.AsyncClient):
         raise OAuthError(error_type, error_description)
 
 
-class OAuth1Client(_OAuth1Client, httpx.Client):
+class OAuth1Client(_OAuth1Client, httpx2.Client):
     auth_class = OAuth1Auth
 
     def __init__(
@@ -117,12 +117,7 @@ class OAuth1Client(_OAuth1Client, httpx.Client):
         **kwargs,
     ):
         _client_kwargs = extract_client_kwargs(kwargs)
-        # app keyword was dropped!
-        app_value = _client_kwargs.pop("app", None)
-        if app_value is not None:
-            _client_kwargs["transport"] = httpx.WSGITransport(app=app_value)
-
-        httpx.Client.__init__(self, **_client_kwargs)
+        httpx2.Client.__init__(self, **_client_kwargs)
 
         _OAuth1Client.__init__(
             self,

{authlib-1.7.2 → authlib-1.8.0}/authlib/integrations/httpx_client/oauth2_client.py

@@ -1,12 +1,11 @@
+# ruff: noqa: I001
+# The import order below is intentional: httpx compatibility must be loaded
+# before anyio so import errors refer to httpx.
 import typing
 from contextlib import asynccontextmanager
 
-import httpx
-from anyio import Lock  # Import after httpx so import errors refer to httpx
-from httpx import USE_CLIENT_DEFAULT
-from httpx import Auth
-from httpx import Request
-from httpx import Response
+from ._compat import httpx2
+from anyio import Lock # Import after httpx so import errors refer to httpx
 
 from authlib.common.urls import url_decode
 from authlib.oauth2.auth import ClientAuth
@@ -20,6 +19,11 @@ from ..base_client import UnsupportedTokenTypeError
 from .utils import HTTPX_CLIENT_KWARGS
 from .utils import build_request
 
+USE_CLIENT_DEFAULT = httpx2.USE_CLIENT_DEFAULT
+Auth = httpx2.Auth
+Request = httpx2.Request
+Response = httpx2.Response
+
 __all__ = [
     "OAuth2Auth",
     "OAuth2ClientAuth",
@@ -60,7 +64,7 @@ class OAuth2ClientAuth(Auth, ClientAuth):
         )
 
 
-class AsyncOAuth2Client(_OAuth2Client, httpx.AsyncClient):
+class AsyncOAuth2Client(_OAuth2Client, httpx2.AsyncClient):
     SESSION_REQUEST_PARAMS = HTTPX_CLIENT_KWARGS
 
     client_auth_class = OAuth2ClientAuth
@@ -81,9 +85,9 @@ class AsyncOAuth2Client(_OAuth2Client, httpx.AsyncClient):
         leeway=60,
         **kwargs,
     ):
-        # extract httpx.Client kwargs
+        # extract httpx2.Client kwargs
         client_kwargs = self._extract_session_request_params(kwargs)
-        httpx.AsyncClient.__init__(self, **client_kwargs)
+        httpx2.AsyncClient.__init__(self, **client_kwargs)
 
         # We use a Lock to synchronize coroutines to prevent
         # multiple concurrent attempts to refresh the same token
@@ -208,7 +212,7 @@ class AsyncOAuth2Client(_OAuth2Client, httpx.AsyncClient):
         )
 
 
-class OAuth2Client(_OAuth2Client, httpx.Client):
+class OAuth2Client(_OAuth2Client, httpx2.Client):
     SESSION_REQUEST_PARAMS = HTTPX_CLIENT_KWARGS
 
     client_auth_class = OAuth2ClientAuth
@@ -228,14 +232,9 @@ class OAuth2Client(_OAuth2Client, httpx.Client):
         update_token=None,
         **kwargs,
     ):
-        # extract httpx.Client kwargs
+        # extract httpx2.Client kwargs
         client_kwargs = self._extract_session_request_params(kwargs)
-        # app keyword was dropped!
-        app_value = client_kwargs.pop("app", None)
-        if app_value is not None:
-            client_kwargs["transport"] = httpx.WSGITransport(app=app_value)
-
-        httpx.Client.__init__(self, **client_kwargs)
+        httpx2.Client.__init__(self, **client_kwargs)
 
         _OAuth2Client.__init__(
             self,

{authlib-1.7.2 → authlib-1.8.0}/authlib/integrations/httpx_client/utils.py

@@ -1,4 +1,6 @@
-from httpx import Request
+from ._compat import httpx2
+
+Request = httpx2.Request
 
 HTTPX_CLIENT_KWARGS = [
     "headers",
@@ -32,7 +34,10 @@ def extract_client_kwargs(kwargs):
 def build_request(url, headers, body, initial_request: Request) -> Request:
     """Make sure that all the data from initial request is passed to the updated object."""
     updated_request = Request(
-        method=initial_request.method, url=url, headers=headers, content=body
+        method=initial_request.method,
+        url=url,
+        headers=headers,
+        content=body,
     )
 
     if hasattr(initial_request, "extensions"):

{authlib-1.7.2 → authlib-1.8.0}/authlib/integrations/requests_client/assertion_session.py

@@ -39,6 +39,7 @@ class AssertionSession(AssertionClient, Session):
         claims=None,
         token_placement="header",
         scope=None,
+        client_id=None,
         default_timeout=None,
         leeway=60,
         **kwargs,
@@ -57,6 +58,7 @@ class AssertionSession(AssertionClient, Session):
             claims=claims,
             token_placement=token_placement,
             scope=scope,
+            client_id=client_id,
             leeway=leeway,
             **kwargs,
         )

{authlib-1.7.2 → authlib-1.8.0}/authlib/oauth1/rfc5849/errors.py

@@ -26,7 +26,7 @@ class OAuth1Error(AuthlibHTTPError):
 
 class InsecureTransportError(OAuth1Error):
     error = "insecure_transport"
-    description = "OAuth 2 MUST utilize https."
+    description = "OAuth 1 MUST utilize https."
 
     @classmethod
     def check(cls, uri):

{authlib-1.7.2 → authlib-1.8.0}/authlib/oauth2/rfc7521/client.py

@@ -25,6 +25,7 @@ class AssertionClient:
         claims=None,
         token_placement="header",
         scope=None,
+        client_id=None,
         leeway=60,
         **kwargs,
     ):
@@ -46,6 +47,7 @@ class AssertionClient:
         self.audience = audience
         self.claims = claims
         self.scope = scope
+        self.client_id = client_id
         if self.token_auth_class is not None:
             self.token_auth = self.token_auth_class(None, token_placement, self)
         self._kwargs = kwargs
@@ -79,6 +81,8 @@ class AssertionClient:
         }
         if self.scope:
             data["scope"] = self.scope
+        if self.client_id:
+            data["client_id"] = self.client_id
 
         return self._refresh_token(data)
 

{authlib-1.7.2 → authlib-1.8.0}/authlib/oauth2/rfc7523/assertion.py

@@ -41,6 +41,12 @@ def sign_jwt_bearer_assertion(
     payload["iat"] = issued_at
     payload["exp"] = expires_at
 
+    if claims is None:
+        claims = {}
+    # jti uniquely identifies the JWT and prevents replay attacks (RFC 7523 §3)
+    if "jti" not in claims:
+        claims["jti"] = generate_token(36)
+
     if claims:
         payload.update(claims)
 

{authlib-1.7.2 → authlib-1.8.0}/authlib/oauth2/rfc7523/client.py

@@ -46,7 +46,15 @@ class JWTBearerClientAssertion:
         assertion = data.get("client_assertion")
         if assertion_type == ASSERTION_TYPE and assertion:
             headers, claims = self.extract_assertion(assertion)
+            # "sub" is read before the signature and the claims are verified,
+            # so it cannot be assumed to be present nor to be a string.
+            if "sub" not in claims:
+                raise InvalidClientError(description="Missing claim: 'sub'")
+
             client_id = claims["sub"]
+            if not isinstance(client_id, str):
+                raise InvalidClientError(description="Invalid claim: 'sub'")
+
             client = query_client(client_id)
             if not client:
                 raise InvalidClientError(
@@ -137,11 +145,20 @@ class JWTBearerClientAssertion:
         )
 
     def extract_assertion(self, assertion: str):
-        obj = jws.extract_compact(to_bytes(assertion))
+        try:
+            obj = jws.extract_compact(to_bytes(assertion))
+        except JoseError as e:
+            log.debug("Assertion Error: %r", e)
+            raise InvalidClientError(description="Invalid JWT assertion.") from e
+
         try:
             claims = json_loads(obj.payload)
         except ValueError:
             raise InvalidClientError(description="Invalid JWT payload.") from None
+
+        if not isinstance(claims, dict):
+            raise InvalidClientError(description="Invalid JWT payload.")
+
         return obj.headers(), claims
 
     def validate_jti(self, claims, jti):

{authlib-1.7.2 → authlib-1.8.0}/authlib/oauth2/rfc7523/jwt_bearer.py

@@ -82,7 +82,20 @@ class JWTBearerGrant(BaseGrant, TokenEndpointMixin):
         .. _`Section 3.1`: https://tools.ietf.org/html/rfc7523#section-3.1
         """
         headers, claims = self.extract_assertion(assertion)
-        client = self.resolve_issuer_client(claims["iss"])
+        # "iss" is read before the signature and the claims are verified, so it
+        # cannot be assumed to be present nor to be a string.
+        if "iss" not in claims:
+            raise InvalidGrantError(description="Missing claim: 'iss'")
+
+        issuer = claims["iss"]
+        if not isinstance(issuer, str):
+            raise InvalidGrantError(description="Invalid claim: 'iss'")
+
+        client = self.resolve_issuer_client(issuer)
+        if not client:
+            raise InvalidGrantError(
+                description="The client does not exist on this server."
+            )
 
         if hasattr(self, "resolve_client_key"):  # pragma: no cover
             key = import_any_key(self.resolve_client_key(client, headers, claims))
@@ -106,11 +119,20 @@ class JWTBearerGrant(BaseGrant, TokenEndpointMixin):
         return token.claims
 
     def extract_assertion(self, assertion: str):
-        obj = jws.extract_compact(to_bytes(assertion))
+        try:
+            obj = jws.extract_compact(to_bytes(assertion))
+        except JoseError as e:
+            log.debug("Assertion Error: %r", e)
+            raise InvalidGrantError(description="Invalid JWT assertion.") from e
+
         try:
             claims = json_loads(obj.payload)
         except ValueError:
             raise InvalidGrantError(description="Invalid JWT payload.") from None
+
+        if not isinstance(claims, dict):
+            raise InvalidGrantError(description="Invalid JWT payload.")
+
         return obj.headers(), claims
 
     def validate_token_request(self):
@@ -194,7 +216,8 @@ class JWTBearerGrant(BaseGrant, TokenEndpointMixin):
                 return Client.query_by_iss(issuer)
 
         :param issuer: "iss" value in assertion
-        :return: Client instance
+        :return: Client instance, or ``None`` when no client matches the
+            issuer. In that case an ``invalid_grant`` error is returned.
         """
         raise NotImplementedError()
 

{authlib-1.7.2 → authlib-1.8.0}/authlib/oauth2/rfc7523/token.py

@@ -48,7 +48,7 @@ class JWTBearerTokenGenerator:
         def get_sub_value(user):
             return str(user.id)
         """
-        return user.get_user_id()
+        return str(user.get_user_id())
 
     def get_token_data(self, grant_type, client, expires_in, user=None, scope=None):
         scope = self.get_allowed_scope(client, scope)

{authlib-1.7.2 → authlib-1.8.0}/authlib/oauth2/rfc7523/validator.py

@@ -33,9 +33,10 @@ class JWTBearerTokenValidator(BearerTokenValidator):
     TOKEN_TYPE = "bearer"
     token_cls = JWTBearerToken
 
-    def __init__(self, public_key, issuer=None, realm=None, **extra_attributes):
+    def __init__(self, public_key, issuer=None, realm=None, leeway=60, **extra_attributes):
         super().__init__(realm, **extra_attributes)
         self.public_key = import_any_key(public_key)
+        self.leeway = leeway
         claims_options = {
             "exp": {"essential": True},
             "client_id": {"essential": True},
@@ -52,7 +53,7 @@ class JWTBearerTokenValidator(BearerTokenValidator):
             logger.debug("Authenticate token failed. %r", error)
             return None
 
-        claims_requests = jwt.JWTClaimsRegistry(leeway=60, **self.claims_options)
+        claims_requests = jwt.JWTClaimsRegistry(leeway=self.leeway, **self.claims_options)
         try:
             claims_requests.validate(token.claims)
         except JoseError as error:

{authlib-1.7.2 → authlib-1.8.0}/authlib/oauth2/rfc8628/endpoint.py

@@ -115,7 +115,7 @@ class DeviceAuthorizationEndpoint:
         }
 
         self.save_device_credential(
-            request.payload.client_id, request.payload.scope, data
+            request.client.get_client_id(), request.payload.scope, data
         )
         return 200, data, default_json_headers
 

{authlib-1.7.2 → authlib-1.8.0}/authlib/oauth2/rfc9068/token.py

@@ -144,7 +144,7 @@ class JWTBearerTokenGenerator(BearerTokenGenerator):
         # correspond to the subject identifier of the resource owner.
 
         if user:
-            token_data["sub"] = user.get_user_id()
+            token_data["sub"] = str(user.get_user_id())
 
         # In cases of access tokens obtained through grants where no resource owner is
         # involved, such as the client credentials grant, the value of 'sub' SHOULD

{authlib-1.7.2 → authlib-1.8.0}/authlib/oauth2/rfc9068/token_validator.py

@@ -7,7 +7,6 @@ Implementation of Validating JWT Access Tokens per `Section 4`_.
 """
 
 from joserfc import jwt
-from joserfc.errors import DecodeError
 from joserfc.errors import JoseError
 
 from authlib._joserfc_helpers import import_any_key
@@ -115,7 +114,7 @@ class JWTBearerTokenValidator(BearerTokenValidator):
         try:
             token = jwt.decode(token_string, key=key)
             return JWTAccessTokenClaims(token.claims, token.header, claims_options)
-        except DecodeError as exc:
+        except JoseError as exc:
             raise InvalidTokenError(
                 realm=self.realm, extra_attributes=self.extra_attributes
             ) from exc