Authlib 1.9.2__tar.gz → 1.9.4__tar.gz

{authlib-1.9.2 → authlib-1.9.4}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.9.2
+Version: 1.9.4
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.9.2 → authlib-1.9.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.9.2
+Version: 1.9.4
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.9.2 → authlib-1.9.4}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.9.2"
+version = "1.9.4"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.9.2 → authlib-1.9.4}/authlib/oauth2/drafts/id_jag.py

@@ -161,6 +161,7 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
             raise InvalidRequestError("Missing 'assertion' in request")
 
         claims = self._process_assertion_claims(assertion)
+        self.request.id_jag_claims = claims
 
         client_id_claim = claims["client_id"]
         if client.get_client_id() != client_id_claim:
@@ -328,7 +329,19 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
         raise NotImplementedError()
 
     def authenticate_user(self, subject):
-        """Return the user identified by the ``sub`` claim, or *None*."""
+        """Return the user identified by the ``sub`` claim, or *None*.
+
+        Per the ID-JAG draft -06 §3.1, ``sub`` is only unique within its issuer,
+        and within its ``tenant`` for a multi-tenant issuer. When the server
+        trusts several IdPs, resolve the user with the issuer too (§4.1). The
+        verified claims are in ``self.request.id_jag_claims``::
+
+            def authenticate_user(self, subject):
+                issuer = self.request.id_jag_claims["iss"]
+                return User.query.filter_by(issuer=issuer, sub=subject).first()
+
+        :param subject: the ``sub`` claim of the ID-JAG
+        """
         raise NotImplementedError()
 
     def check_jti(self, claims, jti) -> bool:
@@ -338,5 +351,10 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
 
     def check_id_jag_permission(self, client, user, scopes) -> bool:
         """Application policy: return *True* if *client* may act on
-        behalf of *user* for *scopes*."""
+        behalf of *user* for *scopes*.
+
+        The verified claims of the ID-JAG are in
+        ``self.request.id_jag_claims``, for a policy that depends on the
+        issuer or the tenant.
+        """
         raise NotImplementedError()

{authlib-1.9.2 → authlib-1.9.4}/authlib/oidc/core/grants/hybrid.py

@@ -8,6 +8,7 @@ from authlib.oauth2.rfc6749.grants.authorization_code import (
 
 from .implicit import OpenIDImplicitGrant
 from .util import is_openid_scope
+from .util import validate_form_post_redirect_uri
 from .util import validate_nonce
 
 log = logging.getLogger(__name__)
@@ -56,6 +57,7 @@ class OpenIDHybridGrant(OpenIDImplicitGrant):
             ),
         )
         redirect_uri = validate_code_authorization_request(self)
+        validate_form_post_redirect_uri(self, redirect_uri)
         if not is_openid_scope(self.request.scope):
             raise InvalidScopeError(
                 "Missing 'openid' scope",

{authlib-1.9.2 → authlib-1.9.4}/authlib/oidc/core/grants/implicit.py

@@ -15,6 +15,7 @@ from ._legacy import LegacyMixin
 from .util import create_half_hash
 from .util import create_response_mode_response
 from .util import is_openid_scope
+from .util import validate_form_post_redirect_uri
 from .util import validate_nonce
 from .util import validate_request_prompt
 
@@ -69,6 +70,7 @@ class OpenIDImplicitGrant(LegacyMixin, ImplicitGrant):
 
     def validate_authorization_request(self):
         redirect_uri = super().validate_authorization_request()
+        validate_form_post_redirect_uri(self, redirect_uri)
         if not is_openid_scope(self.request.scope):
             raise InvalidScopeError(
                 "Missing 'openid' scope",

{authlib-1.9.2 → authlib-1.9.4}/authlib/oidc/core/grants/util.py

@@ -6,6 +6,7 @@ from authlib._joserfc_helpers import import_any_key
 from authlib.common.encoding import to_native
 from authlib.common.urls import add_params_to_uri
 from authlib.common.urls import quote_url
+from authlib.common.urls import urlparse
 from authlib.oauth2.rfc6749 import InvalidRequestError
 from authlib.oauth2.rfc6749 import scope_to_list
 
@@ -51,6 +52,28 @@ def validate_request_prompt(grant, redirect_uri, redirect_fragment=False):
     return grant
 
 
+def validate_form_post_redirect_uri(grant, redirect_uri):
+    """Reject the ``form_post`` response mode for a non-HTTP redirect URI.
+
+    With ``form_post``, the user-agent submits an HTML form to the redirect
+    URI. A ``javascript:`` redirect URI would then run a script in the
+    origin of the authorization server.
+
+    :param grant: the grant that validates the authorization request
+    :param redirect_uri: the redirect URI of the authorization request
+    :raises InvalidRequestError: if the redirect URI scheme is not http or https
+    """
+    response_mode = grant.request.payload.data.get(
+        "response_mode", grant.DEFAULT_RESPONSE_MODE
+    )
+    if response_mode != "form_post":
+        return
+    if urlparse.urlparse(redirect_uri).scheme not in ("http", "https"):
+        raise InvalidRequestError(
+            "The 'form_post' response mode requires an http or https redirect URI."
+        )
+
+
 def validate_nonce(request, exists_nonce, required=False):
     nonce = request.payload.data.get("nonce")
     if not nonce: