Authlib 1.8.0__tar.gz → 1.9.0__tar.gz

{authlib-1.8.0 → authlib-1.9.0}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.8.0
+Version: 1.9.0
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.8.0 → authlib-1.9.0}/Authlib.egg-info/SOURCES.txt

@@ -126,6 +126,8 @@ authlib/oauth2/auth.py
 authlib/oauth2/base.py
 authlib/oauth2/claims.py
 authlib/oauth2/client.py
+authlib/oauth2/drafts/__init__.py
+authlib/oauth2/drafts/id_jag.py
 authlib/oauth2/rfc6749/__init__.py
 authlib/oauth2/rfc6749/authenticate_client.py
 authlib/oauth2/rfc6749/authorization_server.py
@@ -200,6 +202,7 @@ authlib/oauth2/rfc9207/discovery.py
 authlib/oauth2/rfc9207/parameter.py
 authlib/oidc/__init__.py
 authlib/oidc/core/__init__.py
+authlib/oidc/core/authorization_request.py
 authlib/oidc/core/claims.py
 authlib/oidc/core/errors.py
 authlib/oidc/core/models.py

{authlib-1.8.0 → authlib-1.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.8.0
+Version: 1.9.0
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.8.0 → authlib-1.9.0}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.8.0"
+version = "1.9.0"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.8.0 → authlib-1.9.0}/authlib/integrations/base_client/async_openid.py

@@ -43,6 +43,9 @@ class AsyncOpenIDMixin:
         self, token, nonce, claims_options=None, claims_cls=None, leeway=120
     ):
         """Return an instance of UserInfo from token's ``id_token``."""
+        if "id_token" not in token:
+            return None
+
         claims_params = dict(
             nonce=nonce,
             client_id=self.client_id,
@@ -80,9 +83,6 @@ class AsyncOpenIDMixin:
             )
 
         claims = claims_cls(token.claims, token.header, claims_options, claims_params)
-        # https://github.com/authlib/authlib/issues/259
-        if claims.get("nonce_supported") is False:
-            claims.params["nonce"] = None
         claims.validate(leeway=leeway)
         return UserInfo(claims)
 

{authlib-1.8.0 → authlib-1.9.0}/authlib/integrations/base_client/sync_openid.py

@@ -40,7 +40,11 @@ class OpenIDMixin:
     def parse_id_token(
         self, token, nonce, claims_options=None, claims_cls=None, leeway=120
     ):
-        """Return an instance of UserInfo from token's ``id_token``."""
+        """Return UserInfo after validating the token's ``id_token``.
+
+        The expected ``nonce`` is controlled by the application. Token claims
+        such as ``nonce_supported`` cannot disable its validation.
+        """
         if "id_token" not in token:
             return None
 
@@ -78,10 +82,6 @@ class OpenIDMixin:
             )
 
         claims = claims_cls(token.claims, token.header, claims_options, claims_params)
-        # https://github.com/authlib/authlib/issues/259
-        if claims.get("nonce_supported") is False:
-            claims.params["nonce"] = None
-
         claims.validate(leeway=leeway)
         return UserInfo(claims)
 

{authlib-1.8.0 → authlib-1.9.0}/authlib/integrations/httpx_client/_compat.py

@@ -11,8 +11,6 @@ try:
 except ImportError:
     import httpx as httpx2
 
-    deprecate(
-        "The httpx module is deprecated; please use httpx2 instead."
-    )
+    deprecate("The httpx module is deprecated; please use httpx2 instead.")
 
 __all__ = ["httpx2"]

{authlib-1.8.0 → authlib-1.9.0}/authlib/integrations/httpx_client/oauth2_client.py

@@ -5,7 +5,7 @@ import typing
 from contextlib import asynccontextmanager
 
 from ._compat import httpx2
-from anyio import Lock # Import after httpx so import errors refer to httpx
+from anyio import Lock  # Import after httpx so import errors refer to httpx
 
 from authlib.common.urls import url_decode
 from authlib.oauth2.auth import ClientAuth

{authlib-1.8.0 → authlib-1.9.0}/authlib/integrations/requests_client/assertion_session.py

@@ -17,9 +17,7 @@ class AssertionAuth(OAuth2Auth):
 
 class AssertionSession(AssertionClient, Session):
     """Constructs a new Assertion Framework for OAuth 2.0 Authorization Grants
-    per RFC7521_.
-
-    .. _RFC7521: https://tools.ietf.org/html/rfc7521
+    per :rfc:`7521`.
     """
 
     token_auth_class = AssertionAuth

{authlib-1.8.0 → authlib-1.9.0}/authlib/integrations/sqla_oauth2/client_mixin.py

@@ -22,9 +22,7 @@ class OAuth2ClientMixin(ClientMixin):
     @property
     def client_info(self):
         """Implementation for Client Info in OAuth 2.0 Dynamic Client
-        Registration Protocol via `Section 3.2.1`_.
-
-        .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc7591#section-3.2.1
+        Registration Protocol via :rfc:`7591#section-3.2.1`.
         """
         return dict(
             client_id=self.client_id,

{authlib-1.8.0 → authlib-1.9.0}/authlib/jose/drafts/_jwe_enc_cryptodome.py

@@ -1,9 +1,8 @@
 """authlib.jose.draft.
 ~~~~~~~~~~~~~~~~~~~~
 
-Content Encryption per `Section 4`_.
-
-.. _`Section 4`: https://datatracker.ietf.org/doc/html/draft-amringer-jose-chacha-02#section-4
+Content Encryption per
+:draft:`draft-amringer-jose-chacha-02 Section 4 <draft-amringer-jose-chacha-02#section-4>`.
 """
 
 from Cryptodome.Cipher import ChaCha20_Poly1305 as Cryptodome_ChaCha20_Poly1305

{authlib-1.8.0 → authlib-1.9.0}/authlib/jose/drafts/_jwe_enc_cryptography.py

@@ -1,9 +1,8 @@
 """authlib.jose.draft.
 ~~~~~~~~~~~~~~~~~~~~
 
-Content Encryption per `Section 4`_.
-
-.. _`Section 4`: https://datatracker.ietf.org/doc/html/draft-amringer-jose-chacha-02#section-4
+Content Encryption per
+:draft:`draft-amringer-jose-chacha-02 Section 4 <draft-amringer-jose-chacha-02#section-4>`.
 """
 
 from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305

{authlib-1.8.0 → authlib-1.9.0}/authlib/jose/rfc7515/__init__.py

@@ -4,7 +4,7 @@
 This module represents a direct implementation of
 JSON Web Signature (JWS).
 
-https://tools.ietf.org/html/rfc7515
+:rfc:`7515`
 """
 
 from .jws import JsonWebSignature

{authlib-1.8.0 → authlib-1.9.0}/authlib/jose/rfc7515/jws.py

@@ -52,7 +52,7 @@ class JsonWebSignature:
     def serialize_compact(self, protected, payload, key):
         """Generate a JWS Compact Serialization. The JWS Compact Serialization
         represents digitally signed or MACed content as a compact, URL-safe
-        string, per `Section 7.1`_.
+        string, per :rfc:`7515#section-7.1`.
 
         .. code-block:: text
 
@@ -81,15 +81,13 @@ class JsonWebSignature:
     def deserialize_compact(self, s, key, decode=None):
         """Exact JWS Compact Serialization, and validate with the given key.
         If key is not provided, the returned dict will contain the signature,
-        and signing input values. Via `Section 7.1`_.
+        and signing input values. Via :rfc:`7515#section-7.1`.
 
         :param s: text of JWS Compact Serialization
         :param key: key used to verify the signature
         :param decode: a function to decode payload data
         :return: JWSObject
         :raise: BadSignatureError
-
-        .. _`Section 7.1`: https://tools.ietf.org/html/rfc7515#section-7.1
         """
         if len(s) > self.MAX_CONTENT_LENGTH:
             raise ValueError("Serialization is too long.")
@@ -119,7 +117,7 @@ class JsonWebSignature:
     def serialize_json(self, header_obj, payload, key):
         """Generate a JWS JSON Serialization. The JWS JSON Serialization
         represents digitally signed or MACed content as a JSON object,
-        per `Section 7.2`_.
+        per :rfc:`7515#section-7.2`.
 
         :param header_obj: A dict/list of header
         :param payload: A string/dict of payload
@@ -170,15 +168,13 @@ class JsonWebSignature:
     def deserialize_json(self, obj, key, decode=None):
         """Exact JWS JSON Serialization, and validate with the given key.
         If key is not provided, it will return a dict without signature
-        verification. Header will still be validated. Via `Section 7.2`_.
+        verification. Header will still be validated. Via :rfc:`7515#section-7.2`.
 
         :param obj: text of JWS JSON Serialization
         :param key: key used to verify the signature
         :param decode: a function to decode payload data
         :return: JWSObject
         :raise: BadSignatureError
-
-        .. _`Section 7.2`: https://tools.ietf.org/html/rfc7515#section-7.2
         """
         obj = ensure_dict(obj, "JWS")
 
@@ -204,6 +200,11 @@ class JsonWebSignature:
 
         headers = []
         is_valid = True
+
+        # invalidates cases like obj["signatures"] = None or obj["signatures"] = []
+        if not obj["signatures"]:
+            is_valid = False
+
         for header_obj in obj["signatures"]:
             jws_header, valid = self._validate_json_jws(
                 payload_segment, payload, header_obj, key

{authlib-1.8.0 → authlib-1.9.0}/authlib/jose/rfc7516/__init__.py

@@ -4,7 +4,7 @@
 This module represents a direct implementation of
 JSON Web Encryption (JWE).
 
-https://tools.ietf.org/html/rfc7516
+:rfc:`7516`
 """
 
 from .jwe import JsonWebEncryption

{authlib-1.8.0 → authlib-1.9.0}/authlib/jose/rfc7517/__init__.py

@@ -4,7 +4,7 @@
 This module represents a direct implementation of
 JSON Web Key (JWK).
 
-https://tools.ietf.org/html/rfc7517
+:rfc:`7517`
 """
 
 from ._cryptography_key import load_pem_key

{authlib-1.8.0 → authlib-1.9.0}/authlib/jose/rfc7518/jwe_encs.py

@@ -2,9 +2,7 @@
 ~~~~~~~~~~~~~~~~~~~~
 
 Cryptographic Algorithms for Cryptographic Algorithms for Content
-Encryption per `Section 5`_.
-
-.. _`Section 5`: https://tools.ietf.org/html/rfc7518#section-5
+Encryption per :rfc:`7518#section-5`.
 """
 
 import hashlib

{authlib-1.8.0 → authlib-1.9.0}/authlib/jose/rfc7518/jws_algs.py

@@ -1,9 +1,7 @@
 """authlib.jose.rfc7518.
 ~~~~~~~~~~~~~~~~~~~~
 
-"alg" (Algorithm) Header Parameter Values for JWS per `Section 3`_.
-
-.. _`Section 3`: https://tools.ietf.org/html/rfc7518#section-3
+"alg" (Algorithm) Header Parameter Values for JWS per :rfc:`7518#section-3`.
 """
 
 import hashlib

{authlib-1.8.0 → authlib-1.9.0}/authlib/jose/rfc7518/oct_key.py

@@ -41,6 +41,7 @@ class OctKey(Key):
         self.check_key_op(operation)
         if not self.raw_key:
             self.load_raw_key()
+        self._check_key(self.raw_key)
         return self.raw_key
 
     def load_raw_key(self):
@@ -62,6 +63,12 @@ class OctKey(Key):
     def validate_raw_key(cls, key):
         return isinstance(key, bytes)
 
+    @staticmethod
+    def _check_key(raw_key):
+        # PEM parsers accept leading text, including comments and whitespace.
+        if any(marker in raw_key for marker in POSSIBLE_UNSAFE_KEYS):
+            raise ValueError("This key may not be safe to import")
+
     @classmethod
     def import_key(cls, raw, options=None):
         """Import a key from bytes, string, or dict data."""
@@ -77,9 +84,7 @@ class OctKey(Key):
         else:
             raw_key = to_bytes(raw)
 
-            # security check
-            if raw_key.startswith(POSSIBLE_UNSAFE_KEYS):
-                raise ValueError("This key may not be safe to import")
+            cls._check_key(raw_key)
 
             key = cls(raw_key=raw_key, options=options)
         return key

{authlib-1.8.0 → authlib-1.9.0}/authlib/jose/rfc7519/__init__.py

@@ -4,7 +4,7 @@
 This module represents a direct implementation of
 JSON Web Token (JWT).
 
-https://tools.ietf.org/html/rfc7519
+:rfc:`7519`
 """
 
 from .claims import BaseClaims

{authlib-1.8.0 → authlib-1.9.0}/authlib/jose/rfc7519/claims.py

@@ -224,4 +224,4 @@ class JWTClaims(BaseClaims):
 
 
 def _validate_numeric_time(s):
-    return isinstance(s, (int, float))
+    return isinstance(s, (int, float)) and not isinstance(s, bool)

{authlib-1.8.0 → authlib-1.9.0}/authlib/oauth1/rfc5849/__init__.py

@@ -3,7 +3,7 @@
 
 This module represents a direct implementation of The OAuth 1.0 Protocol.
 
-https://tools.ietf.org/html/rfc5849
+:rfc:`5849`
 """
 
 from .authorization_server import AuthorizationServer

{authlib-1.8.0 → authlib-1.9.0}/authlib/oauth1/rfc5849/client_auth.py

@@ -78,12 +78,10 @@ class ClientAuth:
     def get_oauth_signature(self, method, uri, headers, body):
         """Get an OAuth signature to be used in signing a request.
 
-        To satisfy `section 3.4.1.2`_ item 2, if the request argument's
+        To satisfy :rfc:`5849#section-3.4.1.2` item 2, if the request argument's
         headers dict attribute contains a Host item, its value will
         replace any netloc part of the request argument's uri attribute
         value.
-
-        .. _`section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2
         """
         sign = self.SIGNATURE_METHODS.get(self.signature_method)
         if not sign:
@@ -150,9 +148,16 @@ class ClientAuth:
             oauth_body_hash = base64.b64encode(hashlib.sha1(body).digest())
             oauth_params.append(("oauth_body_hash", oauth_body_hash.decode("utf-8")))
 
-        uri, headers, body = self._render(uri, headers, body, oauth_params)
+        # The signature is calculated over a rendered request that
+        # includes the OAuth parameters. The final request is rendered
+        # from the original values so the parameters are not duplicated.
+        rendered_uri, rendered_headers, rendered_body = self._render(
+            uri, headers, body, oauth_params
+        )
 
-        sig = self.get_oauth_signature(method, uri, headers, body)
+        sig = self.get_oauth_signature(
+            method, rendered_uri, rendered_headers, rendered_body
+        )
         oauth_params.append(("oauth_signature", sig))
 
         uri, headers, body = self._render(uri, headers, body, oauth_params)

{authlib-1.8.0 → authlib-1.9.0}/authlib/oauth1/rfc5849/parameters.py

@@ -1,9 +1,7 @@
 """authlib.spec.rfc5849.parameters.
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-This module contains methods related to `section 3.5`_ of the OAuth 1.0a spec.
-
-.. _`section 3.5`: https://tools.ietf.org/html/rfc5849#section-3.5
+This module contains methods related to :rfc:`5849#section-3.5`.
 """
 
 from authlib.common.urls import extract_params
@@ -15,10 +13,10 @@ from .util import escape
 
 def prepare_headers(oauth_params, headers=None, realm=None):
     """**Prepare the Authorization header.**
-    Per `section 3.5.1`_ of the spec.
+    Per :rfc:`5849#section-3.5.1`.
 
     Protocol parameters can be transmitted using the HTTP "Authorization"
-    header field as defined by `RFC2617`_ with the auth-scheme name set to
+    header field as defined by :rfc:`2617` with the auth-scheme name set to
     "OAuth" (case insensitive).
 
     For example::
@@ -31,9 +29,6 @@ def prepare_headers(oauth_params, headers=None, realm=None):
             oauth_callback="http%3A%2F%2Fprinter.example.com%2Fready",
             oauth_signature="74KNZJeDHnMBp0EMJ9ZHt%2FXKycU%3D",
             oauth_version="1.0"
-
-    .. _`section 3.5.1`: https://tools.ietf.org/html/rfc5849#section-3.5.1
-    .. _`RFC2617`: https://tools.ietf.org/html/rfc2617
     """
     headers = headers or {}
 
@@ -64,10 +59,7 @@ def _append_params(oauth_params, params):
 
     Both params and oauth_params is must be lists of 2-tuples.
 
-    Per `section 3.5.2`_ and `3.5.3`_ of the spec.
-
-    .. _`section 3.5.2`: https://tools.ietf.org/html/rfc5849#section-3.5.2
-    .. _`3.5.3`: https://tools.ietf.org/html/rfc5849#section-3.5.3
+    Per :rfc:`5849#section-3.5.2` and :rfc:`5849#section-3.5.3`.
 
     """
     merged = list(params)
@@ -83,9 +75,7 @@ def _append_params(oauth_params, params):
 def prepare_form_encoded_body(oauth_params, body):
     """Prepare the Form-Encoded Body.
 
-    Per `section 3.5.2`_ of the spec.
-
-    .. _`section 3.5.2`: https://tools.ietf.org/html/rfc5849#section-3.5.2
+    Per :rfc:`5849#section-3.5.2`.
 
     """
     # append OAuth params to the existing body
@@ -95,9 +85,7 @@ def prepare_form_encoded_body(oauth_params, body):
 def prepare_request_uri_query(oauth_params, uri):
     """Prepare the Request URI Query.
 
-    Per `section 3.5.3`_ of the spec.
-
-    .. _`section 3.5.3`: https://tools.ietf.org/html/rfc5849#section-3.5.3
+    Per :rfc:`5849#section-3.5.3`.
 
     """
     # append OAuth params to the existing set of query components

{authlib-1.8.0 → authlib-1.9.0}/authlib/oauth1/rfc5849/signature.py

@@ -1,9 +1,7 @@
 """authlib.oauth1.rfc5849.signature.
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-This module represents a direct implementation of `section 3.4`_ of the spec.
-
-.. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4
+This module represents a direct implementation of :rfc:`5849#section-3.4`.
 """
 
 import binascii
@@ -27,7 +25,7 @@ SIGNATURE_TYPE_BODY = "BODY"
 
 
 def construct_base_string(method, uri, params, host=None):
-    """Generate signature base string from request, per `Section 3.4.1`_.
+    """Generate signature base string from request, per :rfc:`5849#section-3.4.1`.
 
     For example, the HTTP request::
 
@@ -52,8 +50,6 @@ def construct_base_string(method, uri, params, host=None):
         key%3D9djdj82h48djs9d2%26oauth_nonce%3D7d8f3e4a%26oauth_signature_m
         ethod%3DHMAC-SHA1%26oauth_timestamp%3D137131201%26oauth_token%3Dkkk
         9d7dh3k39sjv7
-
-    .. _`Section 3.4.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1
     """
     # Create base string URI per Section 3.4.1.2
     base_string_uri = normalize_base_string_uri(uri, host)
@@ -84,7 +80,7 @@ def construct_base_string(method, uri, params, host=None):
 
 
 def normalize_base_string_uri(uri, host=None):
-    """Normalize Base String URI per `Section 3.4.1.2`_.
+    """Normalize Base String URI per :rfc:`5849#section-3.4.1.2`.
 
     For example, the HTTP request::
 
@@ -100,8 +96,6 @@ def normalize_base_string_uri(uri, host=None):
 
     is represented by the base string URI: "https://www.example.net:8080/".
 
-    .. _`Section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2
-
     The host argument overrides the netloc part of the uri argument.
     """
     uri = to_unicode(uri)
@@ -155,7 +149,7 @@ def normalize_base_string_uri(uri, host=None):
 
 
 def normalize_parameters(params):
-    """Normalize parameters per `Section 3.4.1.3.2`_.
+    """Normalize parameters per :rfc:`5849#section-3.4.1.3.2`.
 
     For example, the list of parameters from the previous section would
     be normalized as follows:
@@ -220,8 +214,6 @@ def normalize_parameters(params):
         a2=r%20b&a3=2%20q&a3=a&b5=%3D%253D&c%40=&c2=&oauth_consumer_key=9dj
         dj82h48djs9d2&oauth_nonce=7d8f3e4a&oauth_signature_method=HMAC-SHA1
         &oauth_timestamp=137131201&oauth_token=kkk9d7dh3k39sjv7
-
-    .. _`Section 3.4.1.3.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.2
     """
     # 1.  First, the name and value of each parameter are encoded
     #     (`Section 3.6`_).
@@ -252,15 +244,12 @@ def generate_signature_base_string(request):
 
 
 def hmac_sha1_signature(base_string, client_secret, token_secret):
-    """Generate signature via HMAC-SHA1 method, per `Section 3.4.2`_.
+    """Generate signature via HMAC-SHA1 method, per :rfc:`5849#section-3.4.2`.
 
     The "HMAC-SHA1" signature method uses the HMAC-SHA1 signature
-    algorithm as defined in `RFC2104`_::
+    algorithm as defined in :rfc:`2104`::
 
         digest = HMAC - SHA1(key, text)
-
-    .. _`RFC2104`: https://tools.ietf.org/html/rfc2104
-    .. _`Section 3.4.2`: https://tools.ietf.org/html/rfc5849#section-3.4.2
     """
     # The HMAC-SHA1 function variables are used in following way:
 
@@ -297,17 +286,14 @@ def hmac_sha1_signature(base_string, client_secret, token_secret):
 
 
 def rsa_sha1_signature(base_string, rsa_private_key):
-    """Generate signature via RSA-SHA1 method, per `Section 3.4.3`_.
+    """Generate signature via RSA-SHA1 method, per :rfc:`5849#section-3.4.3`.
 
     The "RSA-SHA1" signature method uses the RSASSA-PKCS1-v1_5 signature
-    algorithm as defined in `RFC3447, Section 8.2`_ (also known as
+    algorithm as defined in :rfc:`3447#section-8.2` (also known as
     PKCS#1), using SHA-1 as the hash function for EMSA-PKCS1-v1_5.  To
     use this method, the client MUST have established client credentials
     with the server that included its RSA public key (in a manner that is
     beyond the scope of this specification).
-
-    .. _`Section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3
-    .. _`RFC3447, Section 8.2`: https://tools.ietf.org/html/rfc3447#section-8.2
     """
     from .rsa import sign_sha1
 
@@ -318,15 +304,13 @@ def rsa_sha1_signature(base_string, rsa_private_key):
 
 
 def plaintext_signature(client_secret, token_secret):
-    """Generate signature via PLAINTEXT method, per `Section 3.4.4`_.
+    """Generate signature via PLAINTEXT method, per :rfc:`5849#section-3.4.4`.
 
     The "PLAINTEXT" method does not employ a signature algorithm.  It
     MUST be used with a transport-layer mechanism such as TLS or SSL (or
     sent over a secure channel with equivalent protections).  It does not
     utilize the signature base string or the "oauth_timestamp" and
     "oauth_nonce" parameters.
-
-    .. _`Section 3.4.4`: https://tools.ietf.org/html/rfc5849#section-3.4.4
     """
     # The "oauth_signature" protocol parameter is set to the concatenated
     # value of:

{authlib-1.8.0 → authlib-1.9.0}/authlib/oauth2/base.py

@@ -5,7 +5,7 @@ from authlib.common.urls import add_params_to_uri
 def invalid_error_characters(text: str) -> list[str]:
     """Check whether the string only contains characters from the restricted ASCII set defined in RFC6749 for errors.
 
-    https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
+    :rfc:`6749#section-4.1.2.1`
     """
     valid_ranges = [
         (0x20, 0x21),

{authlib-1.8.0 → authlib-1.9.0}/authlib/oauth2/client.py

@@ -17,6 +17,28 @@ DEFAULT_HEADERS = {
 }
 
 
+def _load_token_response(resp):
+    """Return the JSON object of a token endpoint response.
+
+    Raise the HTTP error of the response when its body is not a JSON object,
+    such as a rate-limit page from a gateway.
+    """
+    if resp.status_code >= 500:
+        resp.raise_for_status()
+
+    try:
+        token = resp.json()
+    except ValueError:
+        token = None
+
+    if not isinstance(token, dict):
+        resp.raise_for_status()
+        raise ValueError(
+            f"Token endpoint response is not a JSON object (HTTP {resp.status_code})."
+        )
+    return token
+
+
 class OAuth2Client:
     """Construct a new OAuth 2 protocol client.
 
@@ -325,7 +347,7 @@ class OAuth2Client:
         headers=None,
         **kwargs,
     ):
-        """Revoke token method defined via `RFC7009`_.
+        """Revoke token method defined via :rfc:`7009`.
 
         :param url: Revoke Token endpoint, must be HTTPS.
         :param token: The token to be revoked.
@@ -336,8 +358,6 @@ class OAuth2Client:
         :param auth: An auth tuple or method as accepted by requests.
         :param headers: Dict to default request headers with.
         :return: Revocation Response
-
-        .. _`RFC7009`: https://tools.ietf.org/html/rfc7009
         """
         if auth is None:
             auth = self.client_auth(self.revocation_endpoint_auth_method)
@@ -362,7 +382,7 @@ class OAuth2Client:
         headers=None,
         **kwargs,
     ):
-        """Implementation of OAuth 2.0 Token Introspection defined via `RFC7662`_.
+        """Implementation of OAuth 2.0 Token Introspection defined via :rfc:`7662`.
 
         :param url: Introspection Endpoint, must be HTTPS.
         :param token: The token to be introspected.
@@ -373,8 +393,6 @@ class OAuth2Client:
         :param auth: An auth tuple or method as accepted by requests.
         :param headers: Dict to default request headers with.
         :return: Introspection Response
-
-        .. _`RFC7662`: https://tools.ietf.org/html/rfc7662
         """
         if auth is None:
             auth = self.client_auth(self.token_endpoint_auth_method)
@@ -412,10 +430,7 @@ class OAuth2Client:
         self.compliance_hook[hook_type].add(hook)
 
     def parse_response_token(self, resp):
-        if resp.status_code >= 500:
-            resp.raise_for_status()
-
-        token = resp.json()
+        token = _load_token_response(resp)
         if "error" in token:
             raise self.oauth_error_class(
                 error=token["error"], description=token.get("error_description")

authlib-1.9.0/authlib/oauth2/drafts/__init__.py

@@ -0,0 +1,11 @@
+"""authlib.oauth2.drafts.
+~~~~~~~~~~~~~~~~~~~~~~~~
+
+Implementations of OAuth 2.0 specifications that are still in IETF draft
+status.  APIs in this package may change to track spec revisions until
+the corresponding RFC is published.
+"""
+
+from .id_jag import IDJAGGrant
+
+__all__ = ["IDJAGGrant"]