Authlib 1.9.3__tar.gz → 1.9.5__tar.gz

{authlib-1.9.3 → authlib-1.9.5}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.9.3
+Version: 1.9.5
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.9.3 → authlib-1.9.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.9.3
+Version: 1.9.5
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.9.3 → authlib-1.9.5}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.9.3"
+version = "1.9.5"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.9.3 → authlib-1.9.5}/authlib/jose/rfc7518/oct_key.py

@@ -1,5 +1,8 @@
 import secrets
 
+from cryptography.exceptions import UnsupportedAlgorithm
+from cryptography.hazmat.primitives.serialization import load_ssh_public_key
+
 from authlib.common.encoding import to_bytes
 from authlib.common.encoding import to_unicode
 from authlib.common.encoding import urlsafe_b64decode
@@ -16,6 +19,21 @@ POSSIBLE_UNSAFE_KEYS = (
     b"ecdsa-sha2-",
 )
 
+_SSH_PUBLIC_PREFIXES = (b"ssh-rsa", b"ssh-ed25519", b"ecdsa-sha2-")
+
+
+def _is_ssh_public_key(raw_key):
+    """Tell if the asymmetric key classes would load the bytes as an SSH key."""
+    if not raw_key.startswith(_SSH_PUBLIC_PREFIXES):
+        return False
+
+    try:
+        load_ssh_public_key(raw_key)
+    except (ValueError, UnsupportedAlgorithm):
+        return False
+
+    return True
+
 
 class OctKey(Key):
     """Key class of the ``oct`` key type."""
@@ -73,6 +91,9 @@ class OctKey(Key):
         if any(marker in raw_key for marker in POSSIBLE_UNSAFE_KEYS):
             raise ValueError("This key may not be safe to import")
 
+        if _is_ssh_public_key(raw_key):
+            raise ValueError("This key may not be safe to import")
+
     @classmethod
     def import_key(cls, raw, options=None):
         """Import a key from bytes, string, or dict data."""

{authlib-1.9.3 → authlib-1.9.5}/authlib/oauth2/drafts/id_jag.py

@@ -161,6 +161,7 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
             raise InvalidRequestError("Missing 'assertion' in request")
 
         claims = self._process_assertion_claims(assertion)
+        self.request.id_jag_claims = claims
 
         client_id_claim = claims["client_id"]
         if client.get_client_id() != client_id_claim:
@@ -328,7 +329,19 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
         raise NotImplementedError()
 
     def authenticate_user(self, subject):
-        """Return the user identified by the ``sub`` claim, or *None*."""
+        """Return the user identified by the ``sub`` claim, or *None*.
+
+        Per the ID-JAG draft -06 §3.1, ``sub`` is only unique within its issuer,
+        and within its ``tenant`` for a multi-tenant issuer. When the server
+        trusts several IdPs, resolve the user with the issuer too (§4.1). The
+        verified claims are in ``self.request.id_jag_claims``::
+
+            def authenticate_user(self, subject):
+                issuer = self.request.id_jag_claims["iss"]
+                return User.query.filter_by(issuer=issuer, sub=subject).first()
+
+        :param subject: the ``sub`` claim of the ID-JAG
+        """
         raise NotImplementedError()
 
     def check_jti(self, claims, jti) -> bool:
@@ -338,5 +351,10 @@ class IDJAGGrant(BaseGrant, TokenEndpointMixin):
 
     def check_id_jag_permission(self, client, user, scopes) -> bool:
         """Application policy: return *True* if *client* may act on
-        behalf of *user* for *scopes*."""
+        behalf of *user* for *scopes*.
+
+        The verified claims of the ID-JAG are in
+        ``self.request.id_jag_claims``, for a policy that depends on the
+        issuer or the tenant.
+        """
         raise NotImplementedError()