GitHubKit 0.11.6__py3-none-any.whl → 0.11.8__py3-none-any.whl

githubkit/auth/oauth.py

@@ -6,12 +6,12 @@ from typing import (
     Any,
     Dict,
     List,
-    Union,
     Callable,
     ClassVar,
     Optional,
     Coroutine,
     Generator,
+    TypedDict,
     AsyncGenerator,
     cast,
 )
@@ -19,7 +19,7 @@ from typing import (
 import httpx
 
 from githubkit.utils import is_async
-from githubkit.exception import AuthExpiredError
+from githubkit.exception import AuthExpiredError, AuthCredentialError
 
 from .base import BaseAuthStrategy
 from ._url import require_bypass, get_oauth_base_url, require_basic_auth
@@ -115,7 +115,10 @@ def exchange_device_code(
 
 
 def refresh_token(
-    github: "GitHubCore", client_id: str, client_secret: str, refresh_token: str
+    github: "GitHubCore",
+    client_id: str,
+    client_secret: Optional[str],  # client secret is optional in device flow
+    refresh_token: str,
 ) -> Generator[httpx.Request, httpx.Response, Dict[str, Any]]:
     """Refresh token."""
     base_url = get_oauth_base_url(github.config.base_url)
@@ -135,73 +138,135 @@ def refresh_token(
     return response.json()
 
 
+class TokenExchangeResult(TypedDict):
+    token: str
+    expire_time: Optional[datetime]
+    refresh_token: Optional[str]
+    refresh_token_expire_time: Optional[datetime]
+
+
+def _parse_token_exchange_response(data: Dict[str, Any]) -> TokenExchangeResult:
+    if "access_token" not in data:
+        raise AuthExpiredError(
+            "Refresh access token error! Check your credentials.", data
+        )
+
+    token = data["access_token"]
+    expire_time = None
+    refresh_token = data.get("refresh_token", None)
+    refresh_token_expire_time = None
+    if refresh_token is not None:
+        expire_time = datetime.now(timezone.utc) + timedelta(
+            minutes=-1, seconds=int(data["expires_in"])
+        )
+        refresh_token_expire_time = datetime.now(timezone.utc) + timedelta(
+            minutes=-1, seconds=int(data["refresh_token_expires_in"])
+        )
+    return {
+        "token": token,
+        "expire_time": expire_time,
+        "refresh_token": refresh_token,
+        "refresh_token_expire_time": refresh_token_expire_time,
+    }
+
+
+class CreateDeviceCodeResult(TypedDict):
+    device_code: str
+    expire_time: datetime
+    interval: int
+
+
+def _parse_create_device_code_response(data: Dict[str, Any]) -> CreateDeviceCodeResult:
+    return {
+        "device_code": data["device_code"],
+        "expire_time": (
+            datetime.now(timezone.utc) + timedelta(seconds=int(data["expires_in"]))
+        ),
+        "interval": int(data["interval"]),
+    }
+
+
+def _call_handler(handler: Callable, data: Dict[str, Any]) -> None:
+    if is_async(handler):
+        if anyio is None or threadlocals is None or run_async is None:
+            raise RuntimeError(
+                "AnyIO support for OAuth Device Callback should be installed "
+                "with `pip install githubkit[auth-oauth-device]`"
+            )
+        handler = cast(Callable[[Dict[str, Any]], Coroutine[None, None, None]], handler)
+        if getattr(threadlocals, "current_async_module", None):
+            # in anyio thread worker
+            run_async(handler, data)
+        else:
+            # create and start a new event loop
+            anyio.run(handler, data)
+    else:
+        handler = cast(Callable[[Dict[str, Any]], None], handler)
+        handler(data)
+
+
+async def _async_call_handler(handler: Callable, data: Dict[str, Any]) -> None:
+    if is_async(handler):
+        handler = cast(Callable[[Dict[str, Any]], Coroutine[None, None, None]], handler)
+        await handler(data)
+    else:
+        if run_sync is None:
+            raise RuntimeError(
+                "AnyIO support for OAuth Device Callback should be installed "
+                "with `pip install githubkit[auth-oauth-device]`"
+            )
+        handler = cast(Callable[[Dict[str, Any]], None], handler)
+        await run_sync(handler, data)
+
+
 @dataclass
-class OAuthWebAuth(httpx.Auth):
-    """OAuth Web Flow Hook Authentication"""
+class OAuthTokenAuth(httpx.Auth):
+    """OAuth Token Authentication"""
 
     github: "GitHubCore"
-    client_id: str
-    client_secret: str
-    code: str
-    redirect_uri: Optional[str] = None
-
-    _token: Optional[str] = field(default=None, init=False, repr=False, compare=False)
-    _expire_time: Optional[datetime] = field(
-        default=None, init=False, repr=False, compare=False
-    )
-    _refresh_token: Optional[str] = field(
-        default=None, init=False, repr=False, compare=False
-    )
-    _refresh_token_expire_time: Optional[datetime] = field(
-        default=None, init=False, repr=False, compare=False
-    )
+    auth_strategy: "OAuthTokenAuthStrategy"
 
     requires_response_body: ClassVar[bool] = True
 
     @property
-    def token(self) -> str:
-        if not self._token:
-            raise RuntimeError("Token not exchanged yet.")
-        return self._token
+    def client_id(self) -> str:
+        return self.auth_strategy.client_id
+
+    @property
+    def client_secret(self) -> Optional[str]:
+        return self.auth_strategy.client_secret
+
+    @property
+    def token(self) -> Optional[str]:
+        return self.auth_strategy.token
+
+    @token.setter
+    def token(self, value: str) -> None:
+        self.auth_strategy.token = value
 
     @property
     def expire_time(self) -> Optional[datetime]:
-        return self._expire_time
+        return self.auth_strategy.expire_time
 
-    def _exchange_code(self) -> httpx.Request:
-        base_url = self.github.config.base_url
-        url = base_url.copy_with(
-            raw_path=f"{base_url.raw_path}login/oauth/access_token"
-        )
+    @expire_time.setter
+    def expire_time(self, value: Optional[datetime]) -> None:
+        self.auth_strategy.expire_time = value
 
-        body = {
-            "client_id": self.client_id,
-            "client_secret": self.client_secret,
-            "code": self.code,
-        }
-        if self.redirect_uri:
-            body["redirect_uri"] = self.redirect_uri
-        return httpx.Request(
-            "POST",
-            url,
-            json=body,
-            headers={
-                "User-Agent": self.github.config.user_agent,
-                "Accept": "application/json",
-            },
-        )
+    @property
+    def refresh_token(self) -> Optional[str]:
+        return self.auth_strategy.refresh_token
 
-    def _parse_response_data(self, data: Dict[str, Any]) -> str:
-        self._token = data["access_token"]
-        if "refresh_token" in data:
-            self._expire_time = datetime.now(timezone.utc) + timedelta(
-                minutes=-1, seconds=int(data["expires_in"])
-            )
-            self._refresh_token = data["refresh_token"]
-            self._refresh_token_expire_time = datetime.now(timezone.utc) + timedelta(
-                minutes=-1, seconds=int(data["refresh_token_expires_in"])
-            )
-        return self._token
+    @refresh_token.setter
+    def refresh_token(self, value: Optional[str]) -> None:
+        self.auth_strategy.refresh_token = value
+
+    @property
+    def refresh_token_expire_time(self) -> Optional[datetime]:
+        return self.auth_strategy.refresh_token_expire_time
+
+    @refresh_token_expire_time.setter
+    def refresh_token_expire_time(self, value: Optional[datetime]) -> None:
+        self.auth_strategy.refresh_token_expire_time = value
 
     def auth_flow(
         self, request: httpx.Request
@@ -209,100 +274,174 @@ class OAuthWebAuth(httpx.Auth):
         if require_bypass(request.url):
             yield request
             return
-        if require_basic_auth(request.url):
+
+        # check basic auth if is not device flow
+        if self.client_secret is not None and require_basic_auth(request.url):
             yield from httpx.BasicAuth(self.client_id, self.client_secret).auth_flow(
                 request
             )
             return
-        if not (token := self._token):
-            data = yield from exchange_web_flow_code(
-                self.github,
-                self.client_id,
-                self.client_secret,
-                self.code,
-                self.redirect_uri,
-            )
-            token = self._parse_response_data(data)
-        elif (
-            self._refresh_token_expire_time
-            and datetime.now(timezone.utc) > self._refresh_token_expire_time
+
+        # check refresh token expire
+        if (
+            self.refresh_token_expire_time
+            and datetime.now(timezone.utc) > self.refresh_token_expire_time
         ):
             raise AuthExpiredError("Refresh token expired.")
-        elif self._expire_time and datetime.now(timezone.utc) > self._expire_time:
+
+        # refresh token if token is not provided or expired
+        if not (token := self.token) or (
+            self.expire_time and datetime.now(timezone.utc) > self.expire_time
+        ):
             data = yield from refresh_token(
                 self.github,
                 self.client_id,
                 self.client_secret,
-                cast(str, self._refresh_token),
+                cast(str, self.refresh_token),
             )
-            token = self._parse_response_data(data)
+            result = _parse_token_exchange_response(data)
+            self.token = token = result["token"]
+            self.expire_time = result["expire_time"]
+            self.refresh_token = result["refresh_token"]
+            self.refresh_token_expire_time = result["refresh_token_expire_time"]
+
         request.headers["Authorization"] = f"token {token}"
         yield request
 
 
 @dataclass
-class OAuthDeviceAuth(httpx.Auth):
-    """OAuth Device Flow Hook Authentication"""
+class OAuthWebAuth(httpx.Auth):
+    """OAuth Web Flow Hook Authentication
+
+    This auth flow wraps the OAuth token auth flow.
+    """
 
     github: "GitHubCore"
-    client_id: str
-    on_verification: Union[
-        Callable[[Dict[str, Any]], None],
-        Callable[[Dict[str, Any]], Coroutine[Any, Any, None]],
-    ]
-    scopes: Optional[List[str]] = None
+    auth_strategy: "OAuthWebAuthStrategy"
 
-    _token: Optional[str] = field(default=None, init=False, repr=False, compare=False)
-    _expire_time: Optional[datetime] = field(
-        default=None, init=False, repr=False, compare=False
-    )
-    _refresh_token: Optional[str] = field(
-        default=None, init=False, repr=False, compare=False
-    )
-    _refresh_token_expires_time: Optional[datetime] = field(
-        default=None, init=False, repr=False, compare=False
-    )
+    @property
+    def client_id(self) -> str:
+        return self.auth_strategy.client_id
 
-    def _parse_response_data(self, data: Dict[str, Any]) -> str:
-        self._token = data["access_token"]
-        return self._token
+    @property
+    def client_secret(self) -> str:
+        return self.auth_strategy.client_secret
 
-    def call_handler(self, data: Dict[str, Any]) -> None:
-        if is_async(self.on_verification):
-            if anyio is None or threadlocals is None or run_async is None:
-                raise RuntimeError(
-                    "AnyIO support for OAuth Device Callback should be installed "
-                    "with `pip install githubkit[auth-oauth-device]`"
-                )
-            handler = cast(
-                Callable[[Dict[str, Any]], Coroutine[None, None, None]],
-                self.on_verification,
+    @property
+    def code(self) -> str:
+        return self.auth_strategy.code
+
+    @property
+    def redirect_uri(self) -> Optional[str]:
+        return self.auth_strategy.redirect_uri
+
+    @property
+    def _token_auth_strategy(self) -> Optional["OAuthTokenAuthStrategy"]:
+        return self.auth_strategy._token_auth
+
+    @_token_auth_strategy.setter
+    def _token_auth_strategy(self, value: "OAuthTokenAuthStrategy") -> None:
+        self.auth_strategy._token_auth = value
+
+    def sync_auth_flow(
+        self, request: httpx.Request
+    ) -> Generator[httpx.Request, httpx.Response, None]:
+        # exchange token for the first time
+        if (token_auth_strategy := self._token_auth_strategy) is None:
+            flow = exchange_web_flow_code(
+                self.github,
+                self.client_id,
+                self.client_secret,
+                self.code,
+                self.redirect_uri,
             )
-            if getattr(threadlocals, "current_async_module", None):
-                # in anyio thread worker
-                run_async(handler, data)
-            else:
-                # create and start a new event loop
-                anyio.run(handler, data)
-        else:
-            handler = cast(Callable[[Dict[str, Any]], None], self.on_verification)
-            handler(data)
-
-    async def acall_handler(self, data: Dict[str, Any]) -> None:
-        if is_async(self.on_verification):
-            handler = cast(
-                Callable[[Dict[str, Any]], Coroutine[None, None, None]],
-                self.on_verification,
+            exchange_request = next(flow)
+            while True:
+                response = yield exchange_request
+                response.read()
+                try:
+                    exchange_request = flow.send(response)
+                except StopIteration as e:
+                    data = e.value
+                    break
+
+            result = _parse_token_exchange_response(data)
+            token_auth_strategy = OAuthTokenAuthStrategy(
+                self.client_id, self.client_secret, **result
             )
-            await handler(data)
-        else:
-            if run_sync is None:
-                raise RuntimeError(
-                    "AnyIO support for OAuth Device Callback should be installed "
-                    "with `pip install githubkit[auth-oauth-device]`"
-                )
-            handler = cast(Callable[[Dict[str, Any]], None], self.on_verification)
-            await run_sync(handler, data)
+            self._token_auth_strategy = token_auth_strategy
+
+        auth = token_auth_strategy.get_auth_flow(self.github)
+        yield from auth.sync_auth_flow(request)
+
+    async def async_auth_flow(
+        self, request: httpx.Request
+    ) -> AsyncGenerator[httpx.Request, httpx.Response]:
+        # exchange token for the first time
+        if (token_auth_strategy := self._token_auth_strategy) is None:
+            flow = exchange_web_flow_code(
+                self.github,
+                self.client_id,
+                self.client_secret,
+                self.code,
+                self.redirect_uri,
+            )
+            exchange_request = next(flow)
+            while True:
+                response = yield exchange_request
+                await response.aread()
+                try:
+                    exchange_request = flow.send(response)
+                except StopIteration as e:
+                    data = e.value
+                    break
+
+            result = _parse_token_exchange_response(data)
+            token_auth_strategy = OAuthTokenAuthStrategy(
+                self.client_id, self.client_secret, **result
+            )
+            self._token_auth_strategy = token_auth_strategy
+
+        auth = token_auth_strategy.get_auth_flow(self.github)
+        flow = auth.async_auth_flow(request)
+        request = await anext(flow)
+        while True:
+            response = yield request
+            try:
+                request = await flow.asend(response)
+            except StopAsyncIteration:
+                break
+
+
+@dataclass
+class OAuthDeviceAuth(httpx.Auth):
+    """OAuth Device Flow Hook Authentication
+
+    This auth flow wraps the OAuth token auth flow.
+    """
+
+    github: "GitHubCore"
+    auth_strategy: "OAuthDeviceAuthStrategy"
+
+    @property
+    def client_id(self) -> str:
+        return self.auth_strategy.client_id
+
+    @property
+    def on_verification(self) -> Callable[[Any], Any]:
+        return self.auth_strategy.on_verification
+
+    @property
+    def scopes(self) -> Optional[List[str]]:
+        return self.auth_strategy.scopes
+
+    @property
+    def _token_auth_strategy(self) -> Optional["OAuthTokenAuthStrategy"]:
+        return self.auth_strategy._token_auth
+
+    @_token_auth_strategy.setter
+    def _token_auth_strategy(self, value: Optional["OAuthTokenAuthStrategy"]) -> None:
+        self.auth_strategy._token_auth = value
 
     def sync_auth_flow(
         self, request: httpx.Request
@@ -310,7 +449,10 @@ class OAuthDeviceAuth(httpx.Auth):
         if require_bypass(request.url):
             yield request
             return
-        if not (token := self._token):
+
+        # exchange token for the first time
+        if (auth_strategy := self._token_auth_strategy) is None:
+            # create device code
             flow = create_device_code(self.github, self.client_id, self.scopes)
             create_request = next(flow)
             while True:
@@ -322,17 +464,17 @@ class OAuthDeviceAuth(httpx.Auth):
                     data = e.value
                     break
 
-            device_code = data["device_code"]
-            expire_time = datetime.now(timezone.utc) + timedelta(
-                seconds=int(data["expires_in"])
-            )
-            interval = int(data["interval"])
-            self.call_handler(data)
+            result = _parse_create_device_code_response(data)
+            _call_handler(self.on_verification, data)
 
+            # loop to wait for user verification
             while True:
-                if datetime.now(timezone.utc) > expire_time:
+                # device code expired
+                if datetime.now(timezone.utc) > result["expire_time"]:
                     raise AuthExpiredError("Device code expired.")
-                flow = exchange_device_code(self.github, self.client_id, device_code)
+                flow = exchange_device_code(
+                    self.github, self.client_id, result["device_code"]
+                )
                 auth_request = next(flow)
                 while True:
                     response = yield auth_request
@@ -342,13 +484,19 @@ class OAuthDeviceAuth(httpx.Auth):
                     except StopIteration as e:
                         data = e.value
                         break
+
                 if "error" in data:
-                    sleep(interval)
+                    sleep(result["interval"])
                     continue
-                token = self._parse_response_data(data)
+
+                # exchange token successfully
+                result = _parse_token_exchange_response(data)
+                auth_strategy = OAuthTokenAuthStrategy(self.client_id, None, **result)
+                self._token_auth_strategy = auth_strategy
                 break
-        request.headers["Authorization"] = f"token {token}"
-        yield request
+
+        auth = auth_strategy.get_auth_flow(self.github)
+        yield from auth.sync_auth_flow(request)
 
     async def async_auth_flow(
         self, request: httpx.Request
@@ -356,12 +504,16 @@ class OAuthDeviceAuth(httpx.Auth):
         if require_bypass(request.url):
             yield request
             return
+
         if anyio is None:
             raise RuntimeError(
                 "AnyIO support for OAuth Device Flow should be installed "
                 "with `pip install githubkit[auth-oauth-device]`"
             )
-        if not (token := self._token):
+
+        # exchange token for the first time
+        if (auth_strategy := self._token_auth_strategy) is None:
+            # create device code
             flow = create_device_code(self.github, self.client_id, self.scopes)
             create_request = next(flow)
             while True:
@@ -373,17 +525,17 @@ class OAuthDeviceAuth(httpx.Auth):
                     data = e.value
                     break
 
-            device_code = data["device_code"]
-            expire_time = datetime.now(timezone.utc) + timedelta(
-                seconds=int(data["expires_in"])
-            )
-            interval = int(data["interval"])
-            await self.acall_handler(data)
+            result = _parse_create_device_code_response(data)
+            await _async_call_handler(self.on_verification, data)
 
+            # loop to wait for user verification
             while True:
-                if datetime.now(timezone.utc) > expire_time:
+                # device code expired
+                if datetime.now(timezone.utc) > result["expire_time"]:
                     raise AuthExpiredError("Device code expired.")
-                flow = exchange_device_code(self.github, self.client_id, device_code)
+                flow = exchange_device_code(
+                    self.github, self.client_id, result["device_code"]
+                )
                 auth_request = next(flow)
                 while True:
                     response = yield auth_request
@@ -393,13 +545,26 @@ class OAuthDeviceAuth(httpx.Auth):
                     except StopIteration as e:
                         data = e.value
                         break
+
                 if "error" in data:
-                    await anyio.sleep(interval)
+                    await anyio.sleep(result["interval"])
                     continue
-                token = self._parse_response_data(data)
+
+                result = _parse_token_exchange_response(data)
+                auth_strategy = OAuthTokenAuthStrategy(self.client_id, None, **result)
+                self._token_auth_strategy = auth_strategy
+                break
+
+        auth = auth_strategy.get_auth_flow(self.github)
+        flow = auth.async_auth_flow(request)
+        request = await anext(flow)
+        while True:
+            response = yield request
+            await response.aread()
+            try:
+                request = await flow.asend(response)
+            except StopAsyncIteration:
                 break
-        request.headers["Authorization"] = f"token {token}"
-        yield request
 
 
 @dataclass
@@ -420,30 +585,277 @@ class OAuthAppAuthStrategy(BaseAuthStrategy):
         return httpx.BasicAuth(self.client_id, self.client_secret)
 
 
+@dataclass
+class OAuthTokenAuthStrategy(BaseAuthStrategy):
+    """OAuth Token Authentication"""
+
+    client_id: str
+    client_secret: Optional[str] = None  # client secret is optional in device flow
+    token: Optional[str] = None
+    expire_time: Optional[datetime] = None
+    refresh_token: Optional[str] = None
+    refresh_token_expire_time: Optional[datetime] = None
+
+    def __post_init__(self):
+        # either token or refresh_token should be provided
+        if not self.token and not self.refresh_token:
+            raise AuthCredentialError(
+                "Either token or refresh_token should be provided."
+            )
+        # when both token and refresh_token are provided, expire_time should be provided
+        if self.token and self.refresh_token and not self.expire_time:
+            raise AuthCredentialError(
+                "expire_time should be provided "
+                "when both token and refresh_token are provided."
+            )
+
+    def get_auth_flow(self, github: "GitHubCore") -> httpx.Auth:
+        return OAuthTokenAuth(github, self)
+
+
 @dataclass
 class OAuthWebAuthStrategy(BaseAuthStrategy):
-    """OAuth Web Flow Authentication"""
+    """OAuth Web Flow Authentication
+
+    Note that this auth strategy is one-time use only.
+    The code will expire after token exchange.
+    """
 
     client_id: str
     client_secret: str
     code: str
     redirect_uri: Optional[str] = None
 
+    _token_auth: Optional[OAuthTokenAuthStrategy] = field(
+        default=None, init=False, repr=False
+    )
+
+    @property
+    def token(self) -> str:
+        if self._token_auth is None:
+            raise RuntimeError("Token is not exchanged yet.")
+        return cast(str, self._token_auth.token)
+
+    @property
+    def expire_time(self) -> Optional[datetime]:
+        if self._token_auth is None:
+            raise RuntimeError("Token is not exchanged yet.")
+        return self._token_auth.expire_time
+
+    @property
+    def refresh_token(self) -> Optional[str]:
+        if self._token_auth is None:
+            raise RuntimeError("Token is not exchanged yet.")
+        return self._token_auth.refresh_token
+
+    @property
+    def refresh_token_expire_time(self) -> Optional[datetime]:
+        if self._token_auth is None:
+            raise RuntimeError("Token is not exchanged yet.")
+        return self._token_auth.refresh_token_expire_time
+
+    def exchange_token(self, github: "GitHubCore") -> OAuthTokenAuthStrategy:
+        if self._token_auth is not None:
+            return self._token_auth
+
+        flow = exchange_web_flow_code(
+            github, self.client_id, self.client_secret, self.code, self.redirect_uri
+        )
+        with github:
+            with github.get_sync_client() as client:
+                exchange_request = next(flow)
+                while True:
+                    response = client.send(exchange_request)
+                    response.read()
+                    try:
+                        exchange_request = flow.send(response)
+                    except StopIteration as e:
+                        data = e.value
+                        break
+
+        result = _parse_token_exchange_response(data)
+        auth = OAuthTokenAuthStrategy(self.client_id, self.client_secret, **result)
+        self._token_auth = auth
+        return auth
+
+    async def async_exchange_token(
+        self, github: "GitHubCore"
+    ) -> OAuthTokenAuthStrategy:
+        if self._token_auth is not None:
+            return self._token_auth
+
+        flow = exchange_web_flow_code(
+            github, self.client_id, self.client_secret, self.code, self.redirect_uri
+        )
+        async with github:
+            async with github.get_async_client() as client:
+                exchange_request = next(flow)
+                while True:
+                    response = await client.send(exchange_request)
+                    await response.aread()
+                    try:
+                        exchange_request = flow.send(response)
+                    except StopIteration as e:
+                        data = e.value
+                        break
+
+        result = _parse_token_exchange_response(data)
+        auth = OAuthTokenAuthStrategy(self.client_id, self.client_secret, **result)
+        self._token_auth = auth
+        return auth
+
     def as_oauth_app(self) -> OAuthAppAuthStrategy:
         return OAuthAppAuthStrategy(self.client_id, self.client_secret)
 
     def get_auth_flow(self, github: "GitHubCore") -> httpx.Auth:
-        return OAuthWebAuth(
-            github, self.client_id, self.client_secret, self.code, self.redirect_uri
-        )
+        # use web auth flow to exchange token for the first time
+        if self._token_auth is None:
+            return OAuthWebAuth(github, self)
+
+        return self._token_auth.get_auth_flow(github)
 
 
 @dataclass
 class OAuthDeviceAuthStrategy(BaseAuthStrategy):
-    """OAuth Device Flow Authentication"""
+    """OAuth Device Flow Authentication
+
+    Note that this auth strategy instance is only for single device.
+    If you want to create new device auth, you should create a new instance.
+    """
 
     client_id: str
-    on_verification: Callable
+    on_verification: Callable[[Any], Any]
+    scopes: Optional[List[str]] = None
+
+    _token_auth: Optional[OAuthTokenAuthStrategy] = field(
+        default=None, init=False, repr=False
+    )
+
+    @property
+    def token(self) -> str:
+        if self._token_auth is None:
+            raise RuntimeError("Token is not exchanged yet.")
+        return cast(str, self._token_auth.token)
+
+    @property
+    def expire_time(self) -> Optional[datetime]:
+        if self._token_auth is None:
+            raise RuntimeError("Token is not exchanged yet.")
+        return self._token_auth.expire_time
+
+    @property
+    def refresh_token(self) -> Optional[str]:
+        if self._token_auth is None:
+            raise RuntimeError("Token is not exchanged yet.")
+        return self._token_auth.refresh_token
+
+    @property
+    def refresh_token_expire_time(self) -> Optional[datetime]:
+        if self._token_auth is None:
+            raise RuntimeError("Token is not exchanged yet.")
+        return self._token_auth.refresh_token_expire_time
+
+    def exchange_token(self, github: "GitHubCore") -> OAuthTokenAuthStrategy:
+        if self._token_auth is not None:
+            return self._token_auth
+
+        flow = create_device_code(github, self.client_id, self.scopes)
+        with github:
+            with github.get_sync_client() as client:
+                create_request = next(flow)
+                while True:
+                    response = client.send(create_request)
+                    response.read()
+                    try:
+                        create_request = flow.send(response)
+                    except StopIteration as e:
+                        data = e.value
+                        break
+
+                result = _parse_create_device_code_response(data)
+                _call_handler(self.on_verification, data)
+
+                while True:
+                    if datetime.now(timezone.utc) > result["expire_time"]:
+                        raise AuthExpiredError("Device code expired.")
+                    flow = exchange_device_code(
+                        github, self.client_id, result["device_code"]
+                    )
+                    auth_request = next(flow)
+                    while True:
+                        response = client.send(auth_request)
+                        response.read()
+                        try:
+                            auth_request = flow.send(response)
+                        except StopIteration as e:
+                            data = e.value
+                            break
+
+                    if "error" in data:
+                        sleep(result["interval"])
+                        continue
+
+                    result = _parse_token_exchange_response(data)
+                    auth = OAuthTokenAuthStrategy(self.client_id, None, **result)
+                    self._token_auth = auth
+                    return auth
+
+    async def async_exchange_token(
+        self, github: "GitHubCore"
+    ) -> OAuthTokenAuthStrategy:
+        if self._token_auth is not None:
+            return self._token_auth
+
+        if anyio is None:
+            raise RuntimeError(
+                "AnyIO support for OAuth Device Flow should be installed "
+                "with `pip install githubkit[auth-oauth-device]`"
+            )
+
+        flow = create_device_code(github, self.client_id, self.scopes)
+        async with github:
+            async with github.get_async_client() as client:
+                create_request = next(flow)
+                while True:
+                    response = await client.send(create_request)
+                    await response.aread()
+                    try:
+                        create_request = flow.send(response)
+                    except StopIteration as e:
+                        data = e.value
+                        break
+
+                result = _parse_create_device_code_response(data)
+                await _async_call_handler(self.on_verification, data)
+
+                while True:
+                    if datetime.now(timezone.utc) > result["expire_time"]:
+                        raise AuthExpiredError("Device code expired.")
+                    flow = exchange_device_code(
+                        github, self.client_id, result["device_code"]
+                    )
+                    auth_request = next(flow)
+                    while True:
+                        response = await client.send(auth_request)
+                        await response.aread()
+                        try:
+                            auth_request = flow.send(response)
+                        except StopIteration as e:
+                            data = e.value
+                            break
+
+                    if "error" in data:
+                        await anyio.sleep(result["interval"])
+                        continue
+
+                    result = _parse_token_exchange_response(data)
+                    auth = OAuthTokenAuthStrategy(self.client_id, None, **result)
+                    self._token_auth = auth
+                    return auth
 
     def get_auth_flow(self, github: "GitHubCore") -> httpx.Auth:
-        return OAuthDeviceAuth(github, self.client_id, self.on_verification)
+        # use device auth flow to exchange token for the first time
+        if self._token_auth is None:
+            return OAuthDeviceAuth(github, self)
+
+        return self._token_auth.get_auth_flow(github)