Authlib 1.9.1__tar.gz → 1.9.3__tar.gz

{authlib-1.9.1 → authlib-1.9.3}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.9.1
+Version: 1.9.3
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.9.1 → authlib-1.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.9.1
+Version: 1.9.3
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.9.1 → authlib-1.9.3}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.9.1"
+version = "1.9.3"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.9.1 → authlib-1.9.3}/authlib/oauth2/drafts/id_jag.py

@@ -32,6 +32,7 @@ from authlib.common.security import generate_token
 from ..rfc6749 import BaseGrant
 from ..rfc6749 import InvalidGrantError
 from ..rfc6749 import InvalidRequestError
+from ..rfc6749 import InvalidScopeError
 from ..rfc6749 import TokenEndpointMixin
 from ..rfc6749 import UnauthorizedClientError
 from ..rfc6749 import scope_to_list
@@ -182,6 +183,7 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
         self.request.client = client
         log.debug("Validate token request of %s", client)
         self.validate_requested_scope()
+        self.request.scope = self._resolve_scope(claims)
 
         # Authenticate user from sub claim (required by ID-JAG).
         user = self.authenticate_user(claims["sub"])
@@ -189,7 +191,7 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
             raise InvalidGrantError(description="Invalid 'sub' value in assertion")
 
         # Application policy check.
-        scopes = scope_to_list(self.request.payload.scope) or []
+        scopes = scope_to_list(self.request.scope) or []
         if not self.check_id_jag_permission(client, user, scopes):
             raise InvalidGrantError(
                 description=(
@@ -203,7 +205,7 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
     def create_token_response(self):
         """Issue an access token (no refresh token per the ID-JAG draft)."""
         token = self.generate_token(
-            scope=self.request.payload.scope,
+            scope=self.request.scope,
             user=self.request.user,
             include_refresh_token=False,
         )
@@ -241,6 +243,31 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
 
         return token.claims
 
+    def _resolve_scope(self, claims):
+        """Return the scope of the access token.
+
+        The scope is bounded by the scope claim of the assertion, and
+        defaults to it. Without that claim, the requested scope is used.
+        """
+        requested = self.request.payload.scope
+        if "scope" not in claims:
+            return requested
+
+        granted = claims["scope"]
+        if not isinstance(granted, str):
+            raise InvalidGrantError(description="Invalid 'scope' claim in assertion")
+
+        if not requested:
+            return granted
+
+        # RFC 7521 §4.1: "the requested scope MUST be equal to or less than
+        # the scope originally granted to the authorized accessor."
+        if not set(scope_to_list(requested)).issubset(scope_to_list(granted)):
+            raise InvalidScopeError(
+                description="The requested scope exceeds the 'scope' claim in assertion"
+            )
+        return requested
+
     def _extract_assertion(self, assertion: str):
         try:
             obj = jws.extract_compact(to_bytes(assertion))

{authlib-1.9.1 → authlib-1.9.3}/authlib/oidc/core/grants/hybrid.py

@@ -8,6 +8,7 @@ from authlib.oauth2.rfc6749.grants.authorization_code import (
 
 from .implicit import OpenIDImplicitGrant
 from .util import is_openid_scope
+from .util import validate_form_post_redirect_uri
 from .util import validate_nonce
 
 log = logging.getLogger(__name__)
@@ -56,6 +57,7 @@ class OpenIDHybridGrant(OpenIDImplicitGrant):
             ),
         )
         redirect_uri = validate_code_authorization_request(self)
+        validate_form_post_redirect_uri(self, redirect_uri)
         if not is_openid_scope(self.request.scope):
             raise InvalidScopeError(
                 "Missing 'openid' scope",

{authlib-1.9.1 → authlib-1.9.3}/authlib/oidc/core/grants/implicit.py

@@ -15,6 +15,7 @@ from ._legacy import LegacyMixin
 from .util import create_half_hash
 from .util import create_response_mode_response
 from .util import is_openid_scope
+from .util import validate_form_post_redirect_uri
 from .util import validate_nonce
 from .util import validate_request_prompt
 
@@ -69,6 +70,7 @@ class OpenIDImplicitGrant(LegacyMixin, ImplicitGrant):
 
     def validate_authorization_request(self):
         redirect_uri = super().validate_authorization_request()
+        validate_form_post_redirect_uri(self, redirect_uri)
         if not is_openid_scope(self.request.scope):
             raise InvalidScopeError(
                 "Missing 'openid' scope",

{authlib-1.9.1 → authlib-1.9.3}/authlib/oidc/core/grants/util.py

@@ -6,6 +6,7 @@ from authlib._joserfc_helpers import import_any_key
 from authlib.common.encoding import to_native
 from authlib.common.urls import add_params_to_uri
 from authlib.common.urls import quote_url
+from authlib.common.urls import urlparse
 from authlib.oauth2.rfc6749 import InvalidRequestError
 from authlib.oauth2.rfc6749 import scope_to_list
 
@@ -51,6 +52,28 @@ def validate_request_prompt(grant, redirect_uri, redirect_fragment=False):
     return grant
 
 
+def validate_form_post_redirect_uri(grant, redirect_uri):
+    """Reject the ``form_post`` response mode for a non-HTTP redirect URI.
+
+    With ``form_post``, the user-agent submits an HTML form to the redirect
+    URI. A ``javascript:`` redirect URI would then run a script in the
+    origin of the authorization server.
+
+    :param grant: the grant that validates the authorization request
+    :param redirect_uri: the redirect URI of the authorization request
+    :raises InvalidRequestError: if the redirect URI scheme is not http or https
+    """
+    response_mode = grant.request.payload.data.get(
+        "response_mode", grant.DEFAULT_RESPONSE_MODE
+    )
+    if response_mode != "form_post":
+        return
+    if urlparse.urlparse(redirect_uri).scheme not in ("http", "https"):
+        raise InvalidRequestError(
+            "The 'form_post' response mode requires an http or https redirect URI."
+        )
+
+
 def validate_nonce(request, exists_nonce, required=False):
     nonce = request.payload.data.get("nonce")
     if not nonce: