Authlib 1.9.0__tar.gz → 1.9.2__tar.gz

{authlib-1.9.0 → authlib-1.9.2}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.9.0
+Version: 1.9.2
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause
@@ -33,7 +33,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cryptography>=45.0.1
-Requires-Dist: joserfc>=1.6.1
+Requires-Dist: joserfc>=1.6.8
 Dynamic: license-file
 
 <div align="center">

{authlib-1.9.0 → authlib-1.9.2}/Authlib.egg-info/requires.txt

@@ -1,2 +1,2 @@
 cryptography>=45.0.1
-joserfc>=1.6.1
+joserfc>=1.6.8

{authlib-1.9.0 → authlib-1.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.9.0
+Version: 1.9.2
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause
@@ -33,7 +33,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cryptography>=45.0.1
-Requires-Dist: joserfc>=1.6.1
+Requires-Dist: joserfc>=1.6.8
 Dynamic: license-file
 
 <div align="center">

{authlib-1.9.0 → authlib-1.9.2}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.9.0"
+version = "1.9.2"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.9.0 → authlib-1.9.2}/authlib/jose/rfc7518/oct_key.py

@@ -65,6 +65,10 @@ class OctKey(Key):
 
     @staticmethod
     def _check_key(raw_key):
+        # Per RFC 7518 §3.2, an HMAC key must be at least as long as the hash output.
+        if not raw_key:
+            raise ValueError("oct key material must not be empty")
+
         # PEM parsers accept leading text, including comments and whitespace.
         if any(marker in raw_key for marker in POSSIBLE_UNSAFE_KEYS):
             raise ValueError("This key may not be safe to import")

{authlib-1.9.0 → authlib-1.9.2}/authlib/oauth2/drafts/id_jag.py

@@ -32,6 +32,7 @@ from authlib.common.security import generate_token
 from ..rfc6749 import BaseGrant
 from ..rfc6749 import InvalidGrantError
 from ..rfc6749 import InvalidRequestError
+from ..rfc6749 import InvalidScopeError
 from ..rfc6749 import TokenEndpointMixin
 from ..rfc6749 import UnauthorizedClientError
 from ..rfc6749 import scope_to_list
@@ -106,14 +107,15 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
 
         :param key: signing key (private key or shared secret)
         :param issuer: ``iss`` claim - identifies the IdP
-        :param audience: ``aud`` claim - the resource AS token endpoint
+        :param audience: ``aud`` claim - the resource AS issuer identifier
         :param subject: ``sub`` claim - the end user (required)
-        :param client_id: ``client_id`` claim - the application
+        :param client_id: ``client_id`` claim - the client identifier at the
+            resource AS
         :param jti: ``jti`` claim (auto-generated when *None*)
         :param issued_at: ``iat`` claim (defaults to now)
         :param expires_at: ``exp`` claim
         :param claims: additional claims dict
-        :param kwargs: forwarded to :func:`sign_jwt_bearer_assertion`
+        :param kwargs: forwarded to ``sign_jwt_bearer_assertion``
             (e.g. ``alg="RS256"``)
         :return: compact-serialised JWT string
         """
@@ -181,6 +183,7 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
         self.request.client = client
         log.debug("Validate token request of %s", client)
         self.validate_requested_scope()
+        self.request.scope = self._resolve_scope(claims)
 
         # Authenticate user from sub claim (required by ID-JAG).
         user = self.authenticate_user(claims["sub"])
@@ -188,7 +191,7 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
             raise InvalidGrantError(description="Invalid 'sub' value in assertion")
 
         # Application policy check.
-        scopes = scope_to_list(self.request.payload.scope) or []
+        scopes = scope_to_list(self.request.scope) or []
         if not self.check_id_jag_permission(client, user, scopes):
             raise InvalidGrantError(
                 description=(
@@ -202,7 +205,7 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
     def create_token_response(self):
         """Issue an access token (no refresh token per the ID-JAG draft)."""
         token = self.generate_token(
-            scope=self.request.payload.scope,
+            scope=self.request.scope,
             user=self.request.user,
             include_refresh_token=False,
         )
@@ -240,6 +243,31 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
 
         return token.claims
 
+    def _resolve_scope(self, claims):
+        """Return the scope of the access token.
+
+        The scope is bounded by the scope claim of the assertion, and
+        defaults to it. Without that claim, the requested scope is used.
+        """
+        requested = self.request.payload.scope
+        if "scope" not in claims:
+            return requested
+
+        granted = claims["scope"]
+        if not isinstance(granted, str):
+            raise InvalidGrantError(description="Invalid 'scope' claim in assertion")
+
+        if not requested:
+            return granted
+
+        # RFC 7521 §4.1: "the requested scope MUST be equal to or less than
+        # the scope originally granted to the authorized accessor."
+        if not set(scope_to_list(requested)).issubset(scope_to_list(granted)):
+            raise InvalidScopeError(
+                description="The requested scope exceeds the 'scope' claim in assertion"
+            )
+        return requested
+
     def _extract_assertion(self, assertion: str):
         try:
             obj = jws.extract_compact(to_bytes(assertion))
@@ -285,8 +313,8 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
     def get_audiences(self) -> list:
         """Return the list of valid ``aud`` values for this AS.
 
-        Typically the token endpoint URL and/or the AS issuer identifier.
-        The returned list must be non-empty; ``aud`` validation is
+        Per the ID-JAG draft, ``aud`` is the issuer identifier of the
+        Resource Authorization Server. The returned list must be non-empty; ``aud`` validation is
         mandatory for ID-JAG assertions.
         """
         raise NotImplementedError()

{authlib-1.9.0 → authlib-1.9.2}/authlib/oauth2/rfc7592/endpoint.py

@@ -39,6 +39,11 @@ class ClientConfigurationEndpoint:
                 status_code=401, description="The client does not exist on this server."
             )
 
+        # The registration access token is only valid for the client it was
+        # issued to.
+        if not token.check_client(client):
+            raise AccessDeniedError()
+
         if not self.check_permission(client, request):
             # If the client does not have permission to read its record, the server
             # MUST return an HTTP 403 Forbidden.
@@ -146,25 +151,35 @@ class ClientConfigurationEndpoint:
         raise NotImplementedError()
 
     def authenticate_token(self, request):
-        """Authenticate current credential who is requesting to register a client.
+        """Authenticate the registration access token of the request.
         Developers MUST implement this method in subclass::
 
             def authenticate_token(self, request):
                 auth = request.headers.get("Authorization")
                 return get_token_by_auth(auth)
 
+        The token MUST implement
+        :meth:`~authlib.oauth2.rfc6749.TokenMixin.check_client`. Requests
+        are denied when the token was not issued to the requested client.
+
         :return: token instance
         """
         raise NotImplementedError()
 
     def authenticate_client(self, request):
-        """Read a client from the request payload.
+        """Read the client from the client configuration endpoint URL.
         Developers MUST implement this method in subclass::
 
+            from urllib.parse import urlparse
+
+
             def authenticate_client(self, request):
-                client_id = request.payload.data.get("client_id")
+                path = urlparse(request.uri).path
+                client_id = path.rstrip("/").rsplit("/", 1)[-1]
                 return Client.get(client_id=client_id)
 
+        The route parameter of the web framework can also be used.
+
         :return: client instance
         """
         raise NotImplementedError()

{authlib-1.9.0 → authlib-1.9.2}/authlib/oauth2/rfc8628/device_code.py

@@ -171,7 +171,7 @@ class DeviceCodeGrant(BaseGrant, TokenEndpointMixin):
 
                 user_id, allowed = data.split()
                 user = User.get(user_id)
-                return user, bool(allowed)
+                return user, allowed == "1"
 
         Note, user grant information is saved by verification endpoint.
         """

{authlib-1.9.0 → authlib-1.9.2}/pyproject.toml

@@ -8,7 +8,7 @@ description = "The ultimate Python library in building OAuth and OpenID Connect
 authors = [{name = "Hsiaoming Yang", email="me@lepture.com"}]
 dependencies = [
     "cryptography>=45.0.1",
-    "joserfc>=1.6.1",
+    "joserfc>=1.6.8",
 ]
 license = {text = "BSD-3-Clause"}
 requires-python = ">=3.10"
@@ -52,6 +52,7 @@ dev = [
     "pytest>=8.2",
     "pytest-asyncio>=0.21",
     "pytest-env>=1.0",
+    "scriv[toml]>=1.8.0",
     "tox-uv >= 1.16.0",
 ]
 
@@ -94,6 +95,15 @@ version = {attr = "authlib.__version__"}
 where = ["."]
 include = ["authlib", "authlib.*"]
 
+[tool.scriv]
+format = "rst"
+changelog = "docs/upgrades/changelog.rst"
+version = "literal: authlib/consts.py: version"
+categories = ["Breaking changes", "Added", "Changed", "Deprecated", "Fixed", "Security"]
+rst_header_chars = "-~"
+compact_fragments = true
+entry_title_template = "Version {{ version }} — {{ date.strftime('%Y-%m-%d') }}"
+
 [tool.ruff.lint]
 select = [
     "B", # flake8-bugbear