fastapi-identity-model 0.2.2__tar.gz → 0.2.3__tar.gz

{fastapi_identity_model-0.2.2 → fastapi_identity_model-0.2.3}/.gitignore

@@ -3,6 +3,9 @@ __pycache__/
 *.py[cod]
 *$py.class
 
+# Local scratch/working artifacts — never committed
+scratch_artifacts/
+
 # C extensions
 *.so
 

{fastapi_identity_model-0.2.2 → fastapi_identity_model-0.2.3}/CHANGELOG.md

@@ -8,6 +8,21 @@ inserted below the marker.
 
 <!-- psr: next release -->
 
+## v0.2.3 (2026-09-04)
+
+### Bug Fixes
+
+- **fastapi**: Don't reflect provider/library error internals from the RP callback
+  ([#622](https://github.com/jamescrowley321/identity-model/pull/622),
+  [`2480587`](https://github.com/jamescrowley321/identity-model/commit/2480587a1ef28837ce9b36f928dcd8cef26e07cd))
+
+### Testing
+
+- **fastapi**: Cover the two genericized error branches
+  ([#622](https://github.com/jamescrowley321/identity-model/pull/622),
+  [`2480587`](https://github.com/jamescrowley321/identity-model/commit/2480587a1ef28837ce9b36f928dcd8cef26e07cd))
+
+
 ## v0.2.2 (2026-08-22)
 
 ### Bug Fixes

{fastapi_identity_model-0.2.2 → fastapi_identity_model-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fastapi-identity-model
-Version: 0.2.2
+Version: 0.2.3
 Summary: FastAPI OIDC/OAuth2 middleware and relying-party router, built on py-identity-model
 Project-URL: Homepage, https://github.com/jamescrowley321/identity-model
 Project-URL: Repository, https://github.com/jamescrowley321/identity-model

{fastapi_identity_model-0.2.2 → fastapi_identity_model-0.2.3}/fastapi_identity_model/rp.py

@@ -103,9 +103,13 @@ async def _discover(settings: OIDCSettings) -> DiscoveryDocumentResponse:
         DiscoveryDocumentRequest(address=settings.discovery_url),
     )
     if not disco.is_successful:
+        # Log the provider's specific error for operators; return a generic
+        # detail so the callback endpoint cannot be probed for upstream
+        # internals (mirrors the resource-server middleware's F-18 posture).
+        logger.warning("OIDC discovery failed: %s", disco.error)
         raise HTTPException(
             status_code=status.HTTP_502_BAD_GATEWAY,
-            detail=f"OIDC discovery failed: {disco.error}",
+            detail="Identity provider discovery failed",
         )
     # OIDC Discovery 1.0 §4.3: the document's issuer MUST match the URL the
     # document was retrieved from (issuer mix-up defense). The library only
@@ -114,12 +118,14 @@ async def _discover(settings: OIDCSettings) -> DiscoveryDocumentResponse:
     # document at "https://op/.well-known/openid-configuration".
     expected = _expected_issuer(settings.discovery_url)
     if (disco.issuer or "").rstrip("/") != expected:
+        logger.warning(
+            "Discovery document issuer mismatch: expected %r, got %r",
+            expected,
+            disco.issuer,
+        )
         raise HTTPException(
             status_code=status.HTTP_502_BAD_GATEWAY,
-            detail=(
-                f"Discovery document issuer mismatch: expected '{expected}', "
-                f"got '{disco.issuer}'"
-            ),
+            detail="Identity provider configuration error",
         )
     return disco
 
@@ -181,9 +187,10 @@ async def _exchange_code(
         ),
     )
     if not tok.is_successful or not tok.token:
+        logger.warning("Token exchange failed: %s", tok.error)
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"Token exchange failed: {tok.error}",
+            detail="Authorization code exchange failed",
         )
     return tok.token
 
@@ -210,9 +217,10 @@ async def _validate_id_token(
             disco_doc_address=settings.discovery_url,
         )
     except PyIdentityModelException as exc:
+        logger.info("ID token validation failed: %s", exc)
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
-            detail=f"ID token validation failed: {exc}",
+            detail="ID token validation failed",
         ) from exc
 
     # Nonce binding is the RP's responsibility — the library does not check it.
@@ -278,14 +286,19 @@ async def _callback(  # noqa: PLR0913  # request-scoped args + the router's buil
     try:
         cb = parse_authorize_callback_response(callback_url)
     except PyIdentityModelException as exc:
+        logger.info("Malformed authorization callback: %s", exc)
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"Malformed authorization callback: {exc}",
+            detail="Malformed authorization response",
         ) from exc
     if not cb.is_successful:
+        # ``cb.error`` is the provider's OAuth 2.0 ``error`` param, but it can
+        # carry an attacker-influenced ``error_description``; log it, return a
+        # generic detail rather than reflecting it to the browser.
+        logger.info("Authorization error from provider: %s", cb.error)
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"Authorization error: {cb.error}",
+            detail="Authorization request failed",
         )
     if not validate_authorize_callback_state(cb, flow["state"]).is_valid:
         raise HTTPException(

{fastapi_identity_model-0.2.2 → fastapi_identity_model-0.2.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fastapi-identity-model"
-version = "0.2.2"
+version = "0.2.3"
 description = "FastAPI OIDC/OAuth2 middleware and relying-party router, built on py-identity-model"
 authors = [{ name = "jamescrowley321", email = "jamescrowley151@gmail.com" }]
 requires-python = ">=3.12"

{fastapi_identity_model-0.2.2 → fastapi_identity_model-0.2.3}/tests/test_rp.py

@@ -1,3 +1,4 @@
+import logging
 from types import SimpleNamespace
 from unittest.mock import AsyncMock
 from urllib.parse import parse_qs, urlparse
@@ -8,7 +9,7 @@ import pytest
 from starlette.middleware.sessions import SessionMiddleware
 
 from fastapi_identity_model import OIDCSettings, build_oidc_router, rp
-from py_identity_model import TokenValidationException
+from py_identity_model import AuthorizeCallbackException, TokenValidationException
 
 
 pytestmark = pytest.mark.unit
@@ -183,15 +184,20 @@ async def test_callback_missing_code(monkeypatch):
     assert "missing code" in resp.json()["detail"]
 
 
-async def test_login_discovery_failure(monkeypatch):
+async def test_login_discovery_failure(monkeypatch, caplog):
     _patch(monkeypatch, disco=SimpleNamespace(is_successful=False, error="down"))
-    async with _client(_app()) as client:
-        resp = await client.get("/auth/login")
+    with caplog.at_level(logging.WARNING, logger="fastapi_identity_model"):
+        async with _client(_app()) as client:
+            resp = await client.get("/auth/login")
     assert resp.status_code == 502
-    assert "discovery failed" in resp.json()["detail"].lower()
+    # Generic client detail — the provider's specific error must not be echoed
+    # to the browser (#601), but IS logged server-side for operators.
+    assert resp.json()["detail"] == "Identity provider discovery failed"
+    assert "down" not in resp.json()["detail"]
+    assert "down" in caplog.text
 
 
-async def test_login_rejects_discovery_issuer_mismatch(monkeypatch):
+async def test_login_rejects_discovery_issuer_mismatch(monkeypatch, caplog):
     # OIDC Discovery 1.0 §4.3: a document whose issuer does not match the
     # URL it was retrieved from must be rejected (issuer mix-up defense).
     mismatched = SimpleNamespace(
@@ -203,10 +209,15 @@ async def test_login_rejects_discovery_issuer_mismatch(monkeypatch):
         issuer="https://op/INVALID",
     )
     _patch(monkeypatch, disco=mismatched)
-    async with _client(_app()) as client:
-        resp = await client.get("/auth/login")
+    with caplog.at_level(logging.WARNING, logger="fastapi_identity_model"):
+        async with _client(_app()) as client:
+            resp = await client.get("/auth/login")
     assert resp.status_code == 502
-    assert "issuer mismatch" in resp.json()["detail"].lower()
+    # The mismatched issuer value is not reflected to the client (#601)...
+    assert resp.json()["detail"] == "Identity provider configuration error"
+    assert "INVALID" not in resp.json()["detail"]
+    # ...but the expected/got pair is logged for operators.
+    assert "INVALID" in caplog.text
 
 
 async def test_fetch_userinfo_disabled_skips_userinfo(monkeypatch):
@@ -224,26 +235,84 @@ async def test_fetch_userinfo_disabled_skips_userinfo(monkeypatch):
     rp.get_userinfo.assert_not_called()
 
 
-async def test_callback_token_exchange_failure(monkeypatch):
+async def test_callback_token_exchange_failure(monkeypatch, caplog):
     _patch(monkeypatch)
     async with _client(_app()) as client:
         state, _ = await _login(client)
         rp.request_authorization_code_token.return_value = SimpleNamespace(
             is_successful=False, error="invalid_grant", token=None
         )
-        resp = await client.get(f"/auth/callback?code=abc&state={state}")
+        with caplog.at_level(logging.WARNING, logger="fastapi_identity_model"):
+            resp = await client.get(f"/auth/callback?code=abc&state={state}")
     assert resp.status_code == 400
-    assert "Token exchange failed" in resp.json()["detail"]
+    # The provider's grant error is logged, not reflected to the client (#601).
+    assert resp.json()["detail"] == "Authorization code exchange failed"
+    assert "invalid_grant" not in resp.json()["detail"]
+    assert "invalid_grant" in caplog.text
 
 
-async def test_callback_invalid_id_token(monkeypatch):
+async def test_callback_invalid_id_token(monkeypatch, caplog):
     _patch(monkeypatch)
     async with _client(_app()) as client:
         state, _ = await _login(client)
         rp.validate_token.side_effect = TokenValidationException("bad iss")
-        resp = await client.get(f"/auth/callback?code=abc&state={state}")
+        with caplog.at_level(logging.INFO, logger="fastapi_identity_model"):
+            resp = await client.get(f"/auth/callback?code=abc&state={state}")
     assert resp.status_code == 401
-    assert "ID token validation failed" in resp.json()["detail"]
+    # Generic detail — the specific validation cause ("bad iss") is logged, not
+    # returned, so the callback can't be used as a validation-stage oracle (#601).
+    assert resp.json()["detail"] == "ID token validation failed"
+    assert "bad iss" not in resp.json()["detail"]
+    assert "bad iss" in caplog.text
+
+
+async def test_callback_malformed_response_detail_is_generic(monkeypatch, caplog):
+    # A parse failure must return a generic detail: the library's exception
+    # text (which can carry attacker-influenced callback contents) is logged
+    # server-side, never reflected to the browser (#601).
+    secret = "parse-cause-4c2e9a-do-not-leak"
+
+    def _raise(_url):
+        raise AuthorizeCallbackException(secret)
+
+    _patch(monkeypatch)
+    monkeypatch.setattr(rp, "parse_authorize_callback_response", _raise)
+    async with _client(_app()) as client:
+        state, _ = await _login(client)
+        with caplog.at_level(logging.INFO, logger="fastapi_identity_model"):
+            resp = await client.get(f"/auth/callback?code=abc&state={state}")
+    assert resp.status_code == 400
+    # Generic detail — pre-#622 this reflected f"...: {exc}"; the parser's
+    # exception text must not appear anywhere in the response body.
+    assert resp.json()["detail"] == "Malformed authorization response"
+    assert secret not in resp.text
+    # ...but the real cause IS logged for operators.
+    assert secret in caplog.text
+
+
+async def test_callback_provider_error_detail_is_generic(monkeypatch, caplog):
+    # A provider error response (?error=...) must return a generic detail:
+    # neither the provider's error code nor the attacker-controllable
+    # error_description is reflected to the browser (#601).
+    secret = "err-desc-secret-8b7c1d-do-not-leak"
+    _patch(monkeypatch)
+    async with _client(_app()) as client:
+        state, _ = await _login(client)
+        with caplog.at_level(logging.INFO, logger="fastapi_identity_model"):
+            resp = await client.get(
+                f"/auth/callback?state={state}"
+                f"&error=access_denied&error_description={secret}"
+            )
+    assert resp.status_code == 400
+    # Generic detail — pre-#622 this reflected f"Authorization error: {cb.error}".
+    assert resp.json()["detail"] == "Authorization request failed"
+    # Neither the error code nor the attacker-influenced description leaks to
+    # the client...
+    assert "access_denied" not in resp.text
+    assert secret not in resp.text
+    # ...but the error code IS logged for operators (the description is not).
+    assert "access_denied" in caplog.text
+    assert secret not in caplog.text
 
 
 async def test_callback_nonce_mismatch(monkeypatch):