drf-react-by-schema-oauth 0.1.0__py3-none-any.whl

drf_react_by_schema_oauth/__init__.py

@@ -0,0 +1,18 @@
+"""
+drf-react-by-schema-oauth
+=========================
+
+OAuth 2.1 authorization server and resource server for
+`drf-react-by-schema <https://gitlab.com/eita/drf-react-by-schema>`_ projects.
+
+Adding the ``oauth2_provider`` app and this package's ``DrbsOAuthConfig`` to
+``INSTALLED_APPS``, including this package's URLs and running ``migrate`` turns
+a DRF project into a standard OAuth 2.1 provider with PKCE and Dynamic Client
+Registration, with no React/SPA changes required.
+"""
+
+__version__ = "0.1.0"
+
+from .settings import SCOPE_READ, SCOPE_WRITE  # noqa: E402
+
+__all__ = ["__version__", "SCOPE_READ", "SCOPE_WRITE"]

drf_react_by_schema_oauth/apps.py

@@ -0,0 +1,29 @@
+from django.apps import AppConfig
+from django.core.exceptions import ImproperlyConfigured
+
+
+class DrbsOAuthConfig(AppConfig):
+    """AppConfig for the OAuth 2.1 provider.
+
+    ``name`` is the import module (``drf_react_by_schema_oauth``); the Django
+    **app label** is kept as ``drbs_oauth`` per the frozen interface contract.
+    """
+
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "drf_react_by_schema_oauth"
+    label = "drbs_oauth"
+
+    def ready(self):
+        # django-oauth-toolkit ships the AS models and views we build on. Fail
+        # loudly and early if the consumer forgot to install/enable it.
+        from django.apps import apps
+
+        try:
+            apps.get_app_config("oauth2_provider")
+        except LookupError as exc:
+            raise ImproperlyConfigured(
+                "drf-react-by-schema-oauth requires django-oauth-toolkit. Add "
+                "'oauth2_provider' to INSTALLED_APPS *before* "
+                "'drf_react_by_schema_oauth', and make sure the "
+                "'django-oauth-toolkit' package is installed."
+            ) from exc

drf_react_by_schema_oauth/authentication.py

@@ -0,0 +1,23 @@
+"""DRF authentication backed by django-oauth-toolkit.
+
+The class is exposed under the frozen import path
+``drf_react_by_schema_oauth.authentication.OAuth2Authentication`` and is a thin
+subclass of DOT's implementation, so the same Bearer token authenticates both
+``/mcp`` and ``/api/...`` once it is listed in a view's
+``authentication_classes`` (or ``REST_FRAMEWORK["DEFAULT_AUTHENTICATION_CLASSES"]``).
+"""
+
+from oauth2_provider.contrib.rest_framework import (
+    OAuth2Authentication as DotOAuth2Authentication,
+)
+
+
+class OAuth2Authentication(DotOAuth2Authentication):
+    """Authenticate ``Authorization: Bearer <token>`` via DOT.
+
+    On success it returns ``(user, access_token)``; DRF exposes the token as
+    ``request.auth``, which :class:`drf_react_by_schema_oauth.permissions.HasScope`
+    and DOT's own permission classes read.
+    """
+
+    www_authenticate_realm = "drbs"

drf_react_by_schema_oauth/dcr.py

@@ -0,0 +1,206 @@
+"""Dynamic Client Registration (RFC 7591).
+
+``POST /o/register/`` registers a **public** OAuth client (no client secret)
+that uses the authorization-code grant with PKCE. Redirect URIs are restricted
+to loopback by default (RFC 8252); see ``DRBS_OAUTH["DCR_ALLOWED_REDIRECTS"]``.
+"""
+
+import json
+import time
+from urllib.parse import urlsplit
+
+from django.http import JsonResponse
+from django.utils.decorators import method_decorator
+from django.views import View
+from django.views.decorators.csrf import csrf_exempt
+
+from .settings import get_scopes, get_setting
+
+# Public clients only, authorization-code + refresh-token, code responses.
+TOKEN_ENDPOINT_AUTH_METHOD = "none"
+ALLOWED_GRANT_TYPES = {"authorization_code", "refresh_token"}
+REQUIRED_GRANT_TYPE = "authorization_code"
+ALLOWED_RESPONSE_TYPES = {"code"}
+
+
+def _error(status, code, description):
+    return JsonResponse(
+        {"error": code, "error_description": description}, status=status
+    )
+
+
+def _is_loopback_host(host):
+    if not host:
+        return False
+    host = host.lower()
+    if host in ("localhost", "::1"):
+        return True
+    # IPv4 loopback: 127.0.0.0/8
+    parts = host.split(".")
+    if len(parts) == 4 and parts[0] == "127":
+        try:
+            return all(0 <= int(p) <= 255 for p in parts)
+        except ValueError:
+            return False
+    return False
+
+
+def _matches_allowed(uri, allowed_prefixes):
+    """True if ``uri``'s scheme+host (and port, when pinned) matches an entry.
+
+    Comparison is component-wise (not string-prefix) so ``http://localhost``
+    does not accidentally allow ``http://localhost.evil.com``. When the allowed
+    entry does not pin a port, any port is accepted (RFC 8252 loopback).
+    """
+    parsed = urlsplit(uri)
+    for prefix in allowed_prefixes:
+        allowed = urlsplit(prefix)
+        if parsed.scheme != allowed.scheme:
+            continue
+        if (parsed.hostname or "").lower() != (allowed.hostname or "").lower():
+            continue
+        if allowed.port is not None and parsed.port != allowed.port:
+            continue
+        return True
+    return False
+
+
+def validate_redirect_uri(uri, allowed_prefixes):
+    """Validate a single registration ``redirect_uri``.
+
+    Returns ``(ok, message)``. Rejects wildcards, non-http(s) schemes, missing
+    hosts, fragments, plain ``http`` on non-loopback hosts, and any URI not
+    matching ``DCR_ALLOWED_REDIRECTS``.
+    """
+    if not isinstance(uri, str) or not uri:
+        return False, "must be a non-empty string"
+    if "*" in uri:
+        return False, "wildcards are not allowed"
+
+    parsed = urlsplit(uri)
+    if parsed.scheme not in ("http", "https"):
+        return False, "scheme must be http or https"
+    if not parsed.netloc or not parsed.hostname:
+        return False, "must include a host"
+    if parsed.fragment:
+        return False, "must not contain a fragment"
+    if parsed.scheme == "http" and not _is_loopback_host(parsed.hostname):
+        return False, "plain http is only allowed for loopback hosts"
+    if not _matches_allowed(uri, allowed_prefixes):
+        return False, "is not an allowed redirect target"
+
+    return True, ""
+
+
+@method_decorator(csrf_exempt, name="dispatch")
+class DynamicClientRegistrationView(View):
+    """RFC 7591 client registration endpoint (public clients, PKCE)."""
+
+    http_method_names = ["post"]
+
+    def post(self, request, *args, **kwargs):
+        if not get_setting("DCR_ENABLED"):
+            return _error(
+                403, "access_denied", "Dynamic Client Registration is disabled."
+            )
+
+        try:
+            payload = json.loads(request.body or b"{}")
+        except (ValueError, TypeError):
+            return _error(
+                400, "invalid_client_metadata", "Request body must be valid JSON."
+            )
+        if not isinstance(payload, dict):
+            return _error(
+                400, "invalid_client_metadata", "Request body must be a JSON object."
+            )
+
+        redirect_uris = payload.get("redirect_uris")
+        if not isinstance(redirect_uris, list) or not redirect_uris:
+            return _error(
+                400,
+                "invalid_redirect_uri",
+                "'redirect_uris' is required and must be a non-empty array.",
+            )
+        allowed_prefixes = list(get_setting("DCR_ALLOWED_REDIRECTS"))
+        for uri in redirect_uris:
+            ok, message = validate_redirect_uri(uri, allowed_prefixes)
+            if not ok:
+                return _error(
+                    400, "invalid_redirect_uri", f"Invalid redirect_uri {uri!r}: {message}."
+                )
+
+        auth_method = payload.get("token_endpoint_auth_method", TOKEN_ENDPOINT_AUTH_METHOD)
+        if auth_method != TOKEN_ENDPOINT_AUTH_METHOD:
+            return _error(
+                400,
+                "invalid_client_metadata",
+                "Only public clients are supported "
+                "(token_endpoint_auth_method must be 'none').",
+            )
+
+        grant_types = payload.get("grant_types", ["authorization_code", "refresh_token"])
+        if (
+            not isinstance(grant_types, list)
+            or not set(grant_types) <= ALLOWED_GRANT_TYPES
+            or REQUIRED_GRANT_TYPE not in grant_types
+        ):
+            return _error(
+                400,
+                "invalid_client_metadata",
+                "'grant_types' must be a subset of "
+                "['authorization_code', 'refresh_token'] including "
+                "'authorization_code'.",
+            )
+
+        response_types = payload.get("response_types", ["code"])
+        if not isinstance(response_types, list) or not set(response_types) <= ALLOWED_RESPONSE_TYPES:
+            return _error(
+                400,
+                "invalid_client_metadata",
+                "'response_types' must be a subset of ['code'].",
+            )
+
+        allowed_scopes = list(get_scopes().keys())
+        requested_scope = payload.get("scope")
+        if requested_scope:
+            scopes = str(requested_scope).split()
+            if not set(scopes) <= set(allowed_scopes):
+                return _error(
+                    400,
+                    "invalid_client_metadata",
+                    f"'scope' must be a subset of {allowed_scopes}.",
+                )
+        else:
+            scopes = allowed_scopes
+
+        client_name = payload.get("client_name") or "Dynamic Client"
+
+        from oauth2_provider.models import get_application_model
+
+        Application = get_application_model()
+        application = Application(
+            name=client_name,
+            client_type=Application.CLIENT_PUBLIC,
+            authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
+            redirect_uris=" ".join(redirect_uris),
+            user=None,
+            skip_authorization=False,
+        )
+        application.save()
+
+        response = JsonResponse(
+            {
+                "client_id": application.client_id,
+                "client_id_issued_at": int(time.time()),
+                "redirect_uris": redirect_uris,
+                "token_endpoint_auth_method": TOKEN_ENDPOINT_AUTH_METHOD,
+                "grant_types": grant_types,
+                "response_types": response_types,
+                "client_name": client_name,
+                "scope": " ".join(scopes),
+            },
+            status=201,
+        )
+        response["Cache-Control"] = "no-store"
+        return response

drf_react_by_schema_oauth/metadata.py

@@ -0,0 +1,100 @@
+"""Authorization Server Metadata (RFC 8414) and Protected Resource Metadata.
+
+The AS metadata document is served by :class:`~drf_react_by_schema_oauth.views.AuthorizationServerMetadataView`.
+:func:`build_protected_resource_metadata` is a helper consumed by the resource
+server (``drf-react-by-schema-mcp``) to serve RFC 9728 documents.
+"""
+
+from django.urls import reverse
+
+from .settings import get_scopes, get_setting
+
+# RFC 8414 / OAuth 2.1 fixed values for this provider.
+RESPONSE_TYPES_SUPPORTED = ["code"]
+RESPONSE_MODES_SUPPORTED = ["query"]
+GRANT_TYPES_SUPPORTED = ["authorization_code", "refresh_token"]
+TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED = ["none"]
+CODE_CHALLENGE_METHODS_SUPPORTED = ["S256"]
+
+
+def _absolute(request, url_name):
+    return request.build_absolute_uri(reverse(url_name))
+
+
+def get_issuer(request):
+    """Return the canonical issuer identifier.
+
+    ``DRBS_OAUTH["ISSUER"]`` wins when set; otherwise fall back to the request
+    origin (``scheme://host``). Setting ``ISSUER`` in production pins the value
+    regardless of proxy/Host header noise.
+    """
+    configured = get_setting("ISSUER")
+    if configured:
+        return configured.rstrip("/")
+    return request.build_absolute_uri("/").rstrip("/")
+
+
+def build_authorization_server_metadata(request, *, issuer=None, scopes=None):
+    """Return the RFC 8414 metadata document for this authorization server.
+
+    ``issuer`` defaults to :func:`get_issuer`; ``scopes`` defaults to the keys
+    of the resolved ``DRBS_OAUTH["SCOPES"]``.
+    """
+    if issuer is None:
+        issuer = get_issuer(request)
+    if scopes is None:
+        scopes = list(get_scopes().keys())
+
+    return {
+        "issuer": issuer,
+        "authorization_endpoint": _absolute(request, "oauth2_provider:authorize"),
+        "token_endpoint": _absolute(request, "oauth2_provider:token"),
+        "revocation_endpoint": _absolute(request, "oauth2_provider:revoke-token"),
+        "introspection_endpoint": _absolute(request, "oauth2_provider:introspect"),
+        "registration_endpoint": _absolute(request, "dcr-register"),
+        "scopes_supported": list(scopes),
+        "response_types_supported": list(RESPONSE_TYPES_SUPPORTED),
+        "response_modes_supported": list(RESPONSE_MODES_SUPPORTED),
+        "grant_types_supported": list(GRANT_TYPES_SUPPORTED),
+        "token_endpoint_auth_methods_supported": list(
+            TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED
+        ),
+        "code_challenge_methods_supported": list(CODE_CHALLENGE_METHODS_SUPPORTED),
+    }
+
+
+def build_protected_resource_metadata(
+    resource,
+    authorization_servers,
+    *,
+    scopes_supported=None,
+    bearer_methods_supported=None,
+    resource_name=None,
+    resource_documentation=None,
+    resource_policy_uri=None,
+    resource_tos_uri=None,
+):
+    """Build an RFC 9728 Protected Resource Metadata document.
+
+    ``resource`` is the protected resource identifier (e.g. ``https://host/mcp``)
+    and ``authorization_servers`` is a list of AS issuer identifiers (usually a
+    single entry — this package's issuer). Optional keyword arguments are only
+    included when provided.
+    """
+    data = {
+        "resource": resource,
+        "authorization_servers": list(authorization_servers),
+    }
+    if scopes_supported is not None:
+        data["scopes_supported"] = list(scopes_supported)
+    if bearer_methods_supported is not None:
+        data["bearer_methods_supported"] = list(bearer_methods_supported)
+    if resource_name is not None:
+        data["resource_name"] = resource_name
+    if resource_documentation is not None:
+        data["resource_documentation"] = resource_documentation
+    if resource_policy_uri is not None:
+        data["resource_policy_uri"] = resource_policy_uri
+    if resource_tos_uri is not None:
+        data["resource_tos_uri"] = resource_tos_uri
+    return data

drf_react_by_schema_oauth/permissions.py

@@ -0,0 +1,61 @@
+"""DRF permissions mapping OAuth scopes to HTTP methods.
+
+The class is exposed under the frozen import path
+``drf_react_by_schema_oauth.permissions.HasScope``.
+"""
+
+from rest_framework.permissions import SAFE_METHODS, BasePermission
+
+from .settings import SCOPE_READ, SCOPE_WRITE
+
+
+class HasScope(BasePermission):
+    """Require the OAuth token to carry the scope needed for the request.
+
+    Default mapping (when the view defines no ``required_scopes``):
+
+    * safe methods (``GET``/``HEAD``/``OPTIONS``/``TRACE``) require ``read``;
+    * unsafe methods (``POST``/``PUT``/``PATCH``/``DELETE``) require ``write``.
+
+    A view may set ``required_scopes = ["read", "write", ...]`` to require an
+    explicit set instead.
+
+    The permission is **composable and additive**:
+
+    * unauthenticated requests are denied (so it can be the only permission);
+    * requests authenticated by a **non-OAuth** class (Django session, JWT, …)
+      are *not* scope-checked here — they keep being governed by the project's
+      own DRF permissions;
+    * requests authenticated by ``OAuth2Authentication`` are checked against
+      their token's scopes.
+
+    This lets a project add OAuth to existing endpoints (accepting Bearer
+    tokens) without breaking its SPA's session/JWT authentication.
+    """
+
+    message = "The token does not grant the scope required for this request."
+
+    def get_required_scopes(self, request, view):
+        explicit = getattr(view, "required_scopes", None)
+        if explicit is not None:
+            return list(explicit)
+        if request.method in SAFE_METHODS:
+            return [SCOPE_READ]
+        return [SCOPE_WRITE]
+
+    def has_permission(self, request, view):
+        user = getattr(request, "user", None)
+        if user is None or not user.is_authenticated:
+            return False
+
+        token = getattr(request, "auth", None)
+        # Only an OAuth2 access token carries `scope`. A non-OAuth
+        # authentication (session/JWT) is left to the project's permissions.
+        if token is None or not hasattr(token, "scope"):
+            return True
+
+        required = self.get_required_scopes(request, view)
+        if not required:
+            return True
+        # Checks expiry and that the token's scopes are a superset of required.
+        return token.is_valid(required)

drf_react_by_schema_oauth/settings.py

@@ -0,0 +1,52 @@
+"""``DRBS_OAUTH`` settings resolution.
+
+Consumers configure the package through a single ``DRBS_OAUTH`` dict in their
+Django settings. Every key is optional; :data:`DEFAULTS` holds the fallbacks and
+:func:`get_setting` resolves a key at call time (so tests and ``override_settings``
+behave correctly).
+"""
+
+from django.conf import settings
+
+# Frozen scope names (see PLAN §3).
+SCOPE_READ = "read"
+SCOPE_WRITE = "write"
+
+DEFAULTS = {
+    # Canonical public base URL of the authorization server. When unset it is
+    # derived from the request origin; set it in production to avoid trusting
+    # the Host header / proxy scheme (RFC 8414 `issuer` must be stable).
+    "ISSUER": None,
+    "SCOPES": {
+        SCOPE_READ: "Read access to the API.",
+        SCOPE_WRITE: "Write access to the API.",
+    },
+    "DCR_ENABLED": True,
+    # Loopback-only by default (RFC 8252 / opencode). Entries are scheme+host
+    # prefixes; the DCR view matches redirect URIs against them.
+    "DCR_ALLOWED_REDIRECTS": [
+        "http://127.0.0.1",
+        "http://localhost",
+        "http://[::1]",
+    ],
+    "AUDIENCE": None,
+    "LOGIN_TEMPLATE": None,
+    "CONSENT_TEMPLATE": None,
+    "ACCESS_TOKEN_TTL": None,
+    "REFRESH_TOKEN_TTL": None,
+}
+
+
+def get_setting(name):
+    """Return ``DRBS_OAUTH[name]`` or its default. Raises for unknown keys."""
+    if name not in DEFAULTS:
+        raise KeyError(f"Unknown DRBS_OAUTH setting: {name!r}")
+    user = getattr(settings, "DRBS_OAUTH", None) or {}
+    if name in user:
+        return user[name]
+    return DEFAULTS[name]
+
+
+def get_scopes():
+    """Return the ``{scope_name: description}`` mapping for DOT."""
+    return dict(get_setting("SCOPES"))

drf_react_by_schema_oauth/templates/drbs_oauth/authorize.html

@@ -0,0 +1,45 @@
+{% load i18n %}<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>{% trans "Authorize" %}</title>
+  <style>
+    body { font-family: system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
+           background: #f5f5f5; margin: 0; padding: 40px 16px; }
+    .card { max-width: 460px; margin: 0 auto; background: #fff;
+            border: 1px solid #e5e5e5; border-radius: 8px; padding: 24px 28px;
+            box-shadow: 0 1px 3px rgba(0,0,0,.06); }
+    h1 { font-size: 1.25rem; margin: 0 0 12px; }
+    .actions { display: flex; gap: 12px; margin-top: 20px; }
+    .actions button { flex: 1; padding: 10px; border-radius: 6px;
+            font-size: 1rem; cursor: pointer; }
+    .deny { background: #fff; border: 1px solid #ccc; color: #333; }
+    .allow { background: #0b6bcb; border: 0; color: #fff; }
+    .errors { color: #b00020; margin: 8px 0; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    {% if not error %}
+      <h1>{% blocktrans with name=application.name %}Authorize {{ name }}?{% endblocktrans %}</h1>
+      <p>{% trans "The application is requesting the following permissions:" %}</p>
+      <ul>
+        {% for scope in scopes_descriptions %}<li>{{ scope }}</li>{% endfor %}
+      </ul>
+      <form id="authorizationForm" method="post">
+        {% csrf_token %}
+        {% for field in form %}{% if field.is_hidden %}{{ field }}{% endif %}{% endfor %}
+        <div class="errors">{{ form.errors }}{{ form.non_field_errors }}</div>
+        <div class="actions">
+          <button type="submit" class="deny">{% trans "Cancel" %}</button>
+          <button type="submit" name="allow" value="Authorize" class="allow">{% trans "Authorize" %}</button>
+        </div>
+      </form>
+    {% else %}
+      <h1>{% trans "Error" %}: {{ error.error }}</h1>
+      <p>{{ error.description }}</p>
+    {% endif %}
+  </div>
+</body>
+</html>

drf_react_by_schema_oauth/templates/drbs_oauth/login.html

@@ -0,0 +1,40 @@
+{% load i18n %}<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>{% trans "Sign in" %}</title>
+  <style>
+    body { font-family: system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
+           background: #f5f5f5; margin: 0; padding: 40px 16px; }
+    .card { max-width: 380px; margin: 0 auto; background: #fff;
+            border: 1px solid #e5e5e5; border-radius: 8px; padding: 24px 28px;
+            box-shadow: 0 1px 3px rgba(0,0,0,.06); }
+    h1 { font-size: 1.25rem; margin: 0 0 16px; }
+    label { display: block; font-weight: 600; margin: 12px 0 4px; }
+    input[type=text], input[type=password] { width: 100%; padding: 8px 10px;
+            border: 1px solid #ccc; border-radius: 6px; box-sizing: border-box; }
+    button { margin-top: 18px; width: 100%; padding: 10px; border: 0;
+             border-radius: 6px; background: #0b6bcb; color: #fff;
+             font-size: 1rem; cursor: pointer; }
+    .errors { color: #b00020; margin: 8px 0; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <h1>{% trans "Sign in" %}</h1>
+    {% if form.errors %}
+      <p class="errors">{% trans "Your username and password did not match." %}</p>
+    {% endif %}
+    <form method="post">
+      {% csrf_token %}
+      <label for="id_username">{% trans "Username" %}</label>
+      {{ form.username }}
+      <label for="id_password">{% trans "Password" %}</label>
+      {{ form.password }}
+      {% if next %}<input type="hidden" name="next" value="{{ next }}">{% endif %}
+      <button type="submit">{% trans "Sign in" %}</button>
+    </form>
+  </div>
+</body>
+</html>

drf_react_by_schema_oauth/tests/helpers.py

@@ -0,0 +1,41 @@
+"""Shared factories for the auth/scope/flow tests."""
+
+from datetime import timedelta
+
+from django.contrib.auth import get_user_model
+from django.utils import timezone
+from oauth2_provider.models import get_access_token_model, get_application_model
+
+User = get_user_model()
+Application = get_application_model()
+AccessToken = get_access_token_model()
+
+
+def make_user(username="testuser", password="pw"):
+    return User.objects.create_user(username=username, password=password)
+
+
+def make_application(user=None, name="test-client", redirect_uris="http://localhost/cb"):
+    return Application.objects.create(
+        name=name,
+        user=user,
+        client_type=Application.CLIENT_PUBLIC,
+        authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
+        redirect_uris=redirect_uris,
+    )
+
+
+def make_token(user, scope="read", token="tok", expires_in=3600):
+    """Create a DOT access token. ``expires_in=None`` yields an expired token."""
+    application = make_application(user)
+    if expires_in is None:
+        expires = timezone.now() - timedelta(seconds=1)
+    else:
+        expires = timezone.now() + timedelta(seconds=expires_in)
+    return AccessToken.objects.create(
+        user=user,
+        application=application,
+        token=token,
+        scope=scope,
+        expires=expires,
+    )

drf_react_by_schema_oauth/tests/test_apps.py

@@ -0,0 +1,24 @@
+from unittest.mock import patch
+
+from django.apps import apps
+from django.core.exceptions import ImproperlyConfigured
+from django.test import SimpleTestCase
+
+
+class AppConfigGuardTests(SimpleTestCase):
+    def test_ready_raises_when_dot_is_missing(self):
+        config = apps.get_app_config("drbs_oauth")
+        with patch("django.apps.apps.get_app_config", side_effect=LookupError):
+            with self.assertRaises(ImproperlyConfigured) as ctx:
+                config.ready()
+        self.assertIn("django-oauth-toolkit", str(ctx.exception))
+
+    def test_ready_is_quiet_when_dot_present(self):
+        config = apps.get_app_config("drbs_oauth")
+        # No exception when oauth2_provider is installed (the normal case).
+        config.ready()
+
+    def test_label_is_frozen(self):
+        config = apps.get_app_config("drbs_oauth")
+        self.assertEqual(config.label, "drbs_oauth")
+        self.assertEqual(config.name, "drf_react_by_schema_oauth")