fastapi-multiauth 0.1.0__py3-none-any.whl

fastapi_multiauth/__init__.py

@@ -0,0 +1,42 @@
+"""Composable authentication sources for FastAPI using Security().
+
+The OAuth 2.0 / OIDC login-flow helpers live in the :mod:`fastapi_multiauth.oauth`
+namespace — they are a distinct concern from the request-time auth sources
+exported here, and require the ``oauth`` extra. Import them explicitly::
+
+    from fastapi_multiauth import oauth
+
+    redirect = oauth.oauth_build_authorization_redirect(...)
+"""
+
+from . import oauth
+from .abc import AuthSource
+from .exceptions import ForbiddenError, UnauthorizedError
+from .jwt import JWTValidator
+from .sources import (
+    APIKeyCookieAuth,
+    APIKeyHeaderAuth,
+    APIKeyQueryAuth,
+    HTTPBasicAuth,
+    HTTPBearerAuth,
+    MultiAuth,
+)
+from .utils import hash_token, verify_token_hash
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "APIKeyCookieAuth",
+    "APIKeyHeaderAuth",
+    "APIKeyQueryAuth",
+    "AuthSource",
+    "ForbiddenError",
+    "HTTPBasicAuth",
+    "HTTPBearerAuth",
+    "JWTValidator",
+    "MultiAuth",
+    "UnauthorizedError",
+    "hash_token",
+    "oauth",
+    "verify_token_hash",
+]

fastapi_multiauth/_http.py

@@ -0,0 +1,44 @@
+"""Shared HTTP transport hygiene for the OAuth and JWT modules."""
+
+import json
+from typing import Any
+from urllib.parse import urlsplit
+
+import httpx
+
+_LOOPBACK_HOSTS = frozenset({"localhost", "127.0.0.1", "::1"})
+
+DEFAULT_TIMEOUT = 10.0
+"""Default timeout (seconds) applied to every HTTP call made by this library."""
+
+
+def _require_https(url: str, description: str) -> str:
+    """Reject non-string URLs and URLs that would send credentials over plaintext HTTP."""
+    if not isinstance(url, str):
+        raise ValueError(f"{description} must be a string URL (got {url!r})")
+    parsed = urlsplit(url)
+    if parsed.scheme == "https":
+        return url
+    if parsed.scheme == "http" and parsed.hostname in _LOOPBACK_HOSTS:
+        return url
+    raise ValueError(f"{description} must use https:// (got {url!r})")
+
+
+async def _get_json(
+    url: str,
+    *,
+    timeout: float,
+    error_cls: type[Exception],
+    description: str,
+    headers: dict[str, str] | None = None,
+) -> Any:
+    """GET *url* and decode the JSON body, mapping failures to *error_cls*."""
+    async with httpx.AsyncClient(timeout=timeout) as client:
+        try:
+            resp = await client.get(url, headers=headers)
+            resp.raise_for_status()
+            return resp.json()
+        except httpx.HTTPError as exc:
+            raise error_cls(f"failed to fetch {description}: {exc}") from exc
+        except json.JSONDecodeError as exc:
+            raise error_cls(f"{description} is not valid JSON") from exc

fastapi_multiauth/_imports.py

@@ -0,0 +1,9 @@
+"""Optional dependency helpers."""
+
+
+def require_extra(package: str, extra: str) -> None:
+    """Raise *ImportError* with an actionable install instruction."""
+    raise ImportError(
+        f"'{package}' is required to use this feature. "
+        f"Install it with: pip install fastapi-multiauth[{extra}]"
+    )

fastapi_multiauth/abc.py

@@ -0,0 +1,220 @@
+"""Abstract base classes for authentication sources."""
+
+import copy
+import inspect
+from abc import ABC, abstractmethod
+from typing import Annotated, Any, Callable, TypeVar
+
+from fastapi import Depends, HTTPException, Request
+from fastapi.security import SecurityScopes
+from fastapi.security.base import SecurityBase
+
+from fastapi_multiauth.exceptions import UnauthorizedError
+from fastapi_multiauth.utils import add_challenge, challenge_headers, ensure_async
+
+_V = TypeVar("_V", bound="ValidatedAuthSource")
+
+
+def _reject_scopes_kwarg(kwargs: dict[str, Any]) -> None:
+    """Reject ``scopes`` as a validator kwarg."""
+    if "scopes" in kwargs:
+        raise ValueError(
+            "'scopes' is a reserved validator kwarg: security scopes declared "
+            "on the route via Security(..., scopes=[...]) are injected "
+            "automatically. Use a different keyword name."
+        )
+
+
+def _accepts_scopes(fn: Callable[..., Any]) -> bool:
+    """Return whether *fn* declares a ``scopes`` parameter."""
+    try:
+        parameters = inspect.signature(fn).parameters
+    except (TypeError, ValueError):
+        return False
+    param = parameters.get("scopes")
+    return param is not None and param.kind in (
+        inspect.Parameter.POSITIONAL_OR_KEYWORD,
+        inspect.Parameter.KEYWORD_ONLY,
+    )
+
+
+def _unenforceable_scopes_error(owner: object, scopes: list[str]) -> RuntimeError:
+    """Error for scopes declared on a route that this source cannot check."""
+    return RuntimeError(
+        f"{type(owner).__name__} cannot enforce the security scopes "
+        f"{scopes!r} declared on this route: its validator does not "
+        "declare a 'scopes' parameter. Add one to the validator (or "
+        "override authenticate_scoped()), or remove scopes=... from "
+        "Security()."
+    )
+
+
+def _scope_kwargs(
+    owner: object, accepts_scopes: bool, scopes: list[str]
+) -> dict[str, Any]:
+    """Return the ``scopes`` kwarg for a validator, failing closed when unsupported."""
+    if accepts_scopes:
+        return {"scopes": scopes}
+    if scopes:
+        raise _unenforceable_scopes_error(owner, scopes)
+    return {}
+
+
+class _DocOnlyScheme(SecurityBase):
+    """Inert stand-in for a ``fastapi.security`` scheme.
+
+    Carries the scheme's OpenAPI metadata but never executes its parsing, so
+    there is no second authentication path diverging from ``extract()``.
+    """
+
+    def __init__(self, scheme: Any) -> None:
+        self.model = scheme.model
+        self.scheme_name = scheme.scheme_name
+
+    async def __call__(self, request: Request) -> None:  # noqa: ARG002
+        return None
+
+
+class AuthSource(ABC):
+    """Abstract base class for authentication sources.
+
+    Subclasses implement :meth:`extract` and :meth:`authenticate`; both
+    ``Security(source)`` and ``MultiAuth`` route through that pair via
+    :meth:`dispatch`.
+    """
+
+    scheme: SecurityBase | None
+
+    def __init__(self, scheme: Any = None) -> None:
+        """Set up the FastAPI dependency signature.
+
+        Args:
+            scheme: Optional ``fastapi.security`` scheme; only its OpenAPI
+                metadata is used, extraction always goes through :meth:`extract`.
+        """
+        self.scheme = _DocOnlyScheme(scheme) if scheme is not None else None
+
+        parameters = [
+            inspect.Parameter(
+                "request",
+                inspect.Parameter.POSITIONAL_OR_KEYWORD,
+                annotation=Request,
+            ),
+            inspect.Parameter(
+                "security_scopes",
+                inspect.Parameter.POSITIONAL_OR_KEYWORD,
+                annotation=SecurityScopes,
+            ),
+        ]
+        if self.scheme is not None:
+            # Declared only so the scheme is registered in OpenAPI; the
+            # extracted value is ignored in favor of extract().
+            parameters.append(
+                inspect.Parameter(
+                    "credentials",
+                    inspect.Parameter.POSITIONAL_OR_KEYWORD,
+                    annotation=Annotated[Any, Depends(self.scheme)],
+                    default=None,
+                )
+            )
+        self.__signature__ = inspect.Signature(parameters, return_annotation=Any)
+
+    @abstractmethod
+    async def extract(self, request: Request) -> str | None:
+        """Extract the raw credential from the request without validating.
+
+        Must return ``None`` — never an empty string — when the credential is
+        absent, empty, or does not belong to this source.
+        """
+
+    @abstractmethod
+    async def authenticate(self, credential: str) -> Any:
+        """Validate a credential and return the authenticated identity."""
+
+    def www_authenticate(self) -> str | None:
+        """Challenge value for the ``WWW-Authenticate`` header on 401 responses.
+
+        Returns ``None`` when the source has no HTTP auth scheme (cookies, API keys).
+        """
+        return None
+
+    async def authenticate_scoped(self, credential: str, scopes: list[str]) -> Any:
+        """Validate a credential, enforcing the scopes declared on the route."""
+        if scopes:  # fail closed: plain authenticate() cannot check scopes
+            raise _unenforceable_scopes_error(self, scopes)
+        return await self.authenticate(credential)
+
+    async def _authenticate_with_challenge(
+        self, credential: str, scopes: list[str]
+    ) -> Any:
+        """Authenticate, attaching this source's challenge to any 401 raised."""
+        try:
+            return await self.authenticate_scoped(credential, scopes)
+        except HTTPException as exc:
+            add_challenge(exc, self.www_authenticate())
+            raise
+
+    async def dispatch(self, request: Request, scopes: list[str]) -> Any:
+        """Extract the credential, then authenticate it with the route scopes.
+
+        Raises:
+            UnauthorizedError: When no credential is present. This source's
+                ``WWW-Authenticate`` challenge is attached to any 401 raised.
+        """
+        credential = await self.extract(request)
+        if credential is None:
+            raise UnauthorizedError(headers=challenge_headers(self.www_authenticate()))
+        return await self._authenticate_with_challenge(credential, scopes)
+
+    async def __call__(self, **kwargs: Any) -> Any:
+        """FastAPI dependency dispatch."""
+        return await self.dispatch(kwargs["request"], kwargs["security_scopes"].scopes)
+
+
+class ValidatedAuthSource(AuthSource):
+    """Base for sources whose credential is checked by a user-supplied validator.
+
+    Owns the shared validator plumbing (sync/async normalization, scope and
+    kwargs forwarding, :meth:`require`). Subclasses implement :meth:`extract`.
+    """
+
+    def __init__(
+        self,
+        validator: Callable[..., Any],
+        scheme: Any = None,
+        /,
+        **kwargs: Any,
+    ) -> None:
+        """Bind the validator and its forwarded kwargs.
+
+        Args:
+            validator: Sync or async callable returning the identity.
+            scheme: Optional ``fastapi.security`` scheme for OpenAPI.
+            **kwargs: Extra keyword arguments forwarded to the validator on
+                every call. ``scopes`` is reserved (injected from the route).
+        """
+        _reject_scopes_kwarg(kwargs)
+        self._validator = ensure_async(validator)
+        self._accepts_scopes = _accepts_scopes(validator)
+        self._kwargs = kwargs
+        super().__init__(scheme)
+
+    async def _call_validator(self, *args: Any, scopes: list[str]) -> Any:
+        """Invoke the validator with scope and configured kwargs forwarding."""
+        extra = _scope_kwargs(self, self._accepts_scopes, scopes)
+        return await self._validator(*args, **extra, **self._kwargs)
+
+    async def authenticate(self, credential: str) -> Any:
+        """Validate a credential and return the identity (no route scopes)."""
+        return await self.authenticate_scoped(credential, [])
+
+    async def authenticate_scoped(self, credential: str, scopes: list[str]) -> Any:
+        """Validate a credential, forwarding route-declared scopes to the validator."""
+        return await self._call_validator(credential, scopes=scopes)
+
+    def require(self: _V, **kwargs: Any) -> _V:
+        """Return a copy of this source with additional (or overriding) validator kwargs."""
+        _reject_scopes_kwarg(kwargs)
+        clone = copy.copy(self)
+        clone._kwargs = {**self._kwargs, **kwargs}
+        return clone

fastapi_multiauth/exceptions.py

@@ -0,0 +1,66 @@
+"""Exceptions raised by authentication sources and OAuth helpers."""
+
+from fastapi import HTTPException, status
+
+
+class UnauthorizedError(HTTPException):
+    """HTTP 401 — authentication credentials were missing or invalid.
+
+    Raise from a validator (or any ``HTTPException``) to reject a credential.
+    """
+
+    def __init__(
+        self,
+        detail: str = "Unauthorized",
+        headers: dict[str, str] | None = None,
+    ) -> None:
+        """Initialize the exception.
+
+        Args:
+            detail: Human-readable message returned in the response body.
+            headers: Extra response headers (e.g. ``WWW-Authenticate``).
+        """
+        super().__init__(
+            status_code=status.HTTP_401_UNAUTHORIZED, detail=detail, headers=headers
+        )
+
+
+class ForbiddenError(HTTPException):
+    """HTTP 403 — the identity is authenticated but lacks permission.
+
+    Keep 401 (:class:`UnauthorizedError`) for absent or invalid credentials.
+    """
+
+    def __init__(
+        self,
+        detail: str = "Forbidden",
+        headers: dict[str, str] | None = None,
+    ) -> None:
+        """Initialize the exception.
+
+        Args:
+            detail: Human-readable message returned in the response body.
+            headers: Extra response headers.
+        """
+        super().__init__(
+            status_code=status.HTTP_403_FORBIDDEN, detail=detail, headers=headers
+        )
+
+
+class OAuthError(Exception):
+    """Base class for OAuth flow errors.
+
+    Not an ``HTTPException``: the route decides the HTTP outcome of a failed flow.
+    """
+
+
+class OAuthDiscoveryError(OAuthError):
+    """Raised when the OIDC discovery document cannot be fetched or is invalid."""
+
+
+class OAuthExchangeError(OAuthError):
+    """Raised when the OAuth authorization code exchange fails."""
+
+
+class OAuthUserinfoError(OAuthError):
+    """Raised when the userinfo endpoint cannot be reached or returns garbage."""

fastapi_multiauth/jwt.py

@@ -0,0 +1,260 @@
+"""JWT validation built on PyJWT, for use as a ``HTTPBearerAuth`` validator."""
+
+import logging
+import time
+from collections.abc import Sequence
+from typing import Any, Callable
+
+import anyio
+from fastapi import HTTPException, status
+
+from ._http import DEFAULT_TIMEOUT, _get_json, _require_https
+from ._imports import require_extra
+from .exceptions import ForbiddenError, UnauthorizedError
+from .utils import ensure_async
+
+logger = logging.getLogger("fastapi_multiauth.jwt")
+
+_MIN_SECRET_BYTES = 32
+
+# Inferred "alg" for JWKS entries that omit it (e.g. some Entra/ADFS setups).
+_KTY_DEFAULT_ALG = {"RSA": "RS256"}
+_CRV_DEFAULT_ALG = {"P-256": "ES256", "P-384": "ES384", "P-521": "ES512"}
+
+
+class _JWKSFetchError(Exception):
+    """JWKS endpoint unreachable or returned an unusable document."""
+
+
+def _import_pyjwt() -> Any:
+    try:
+        import jwt as pyjwt
+    except ImportError:  # pragma: no cover
+        require_extra("pyjwt", "jwt")
+    return pyjwt
+
+
+def _default_alg(entry: dict[str, Any]) -> str | None:
+    """Best-effort default algorithm for a JWKS entry without ``alg``."""
+    kty = entry.get("kty")
+    if kty == "EC":
+        return _CRV_DEFAULT_ALG.get(entry.get("crv", ""))
+    return _KTY_DEFAULT_ALG.get(kty or "")
+
+
+class JWTValidator:
+    """Validate JWTs — plug directly into :class:`~fastapi_multiauth.HTTPBearerAuth`.
+
+    Requires the ``jwt`` extra. Configure exactly one of ``secret`` (symmetric
+    ``HS*``) or ``jwks_url`` (asymmetric, against the provider's JWKS).
+
+    Args:
+        secret: Symmetric key for ``HS*`` validation (at least 32 bytes).
+        jwks_url: HTTPS URL of the provider's JWKS document.
+        algorithms: Accepted signature algorithms. Defaults to ``["HS256"]``
+            in secret mode and ``["RS256", "ES256"]`` in JWKS mode. Symmetric
+            algorithms are rejected in JWKS mode (key-confusion risk).
+        audience: Expected ``aud`` claim value(s). Unset → ``aud`` not checked.
+        issuer: Expected ``iss`` claim value. Unset → ``iss`` not checked.
+        leeway: Clock-skew tolerance in seconds for time-based claims.
+        required_claims: Claims that must be present (default ``("exp",)``).
+        scopes_claim: Claim holding granted scopes — a space-separated string
+            (``scope``) or a list (``scp``, ``roles``). A valid token missing
+            a route-declared scope raises a 403.
+        claims_to_identity: Optional sync or async hook mapping verified claims
+            to a domain object. Defaults to returning the claims.
+        jwks_cache_ttl: JWKS cache lifetime in seconds (default 1 h).
+        jwks_refresh_cooldown: Minimum interval in seconds between JWKS fetch
+            attempts (default 30 s).
+        timeout: Timeout in seconds for the JWKS request.
+    """
+
+    def __init__(
+        self,
+        *,
+        secret: str | None = None,
+        jwks_url: str | None = None,
+        algorithms: Sequence[str] | None = None,
+        audience: str | Sequence[str] | None = None,
+        issuer: str | None = None,
+        leeway: float = 0.0,
+        required_claims: Sequence[str] = ("exp",),
+        scopes_claim: str = "scope",
+        claims_to_identity: Callable[[dict[str, Any]], Any] | None = None,
+        jwks_cache_ttl: float = 3600.0,
+        jwks_refresh_cooldown: float = 30.0,
+        timeout: float = DEFAULT_TIMEOUT,
+    ) -> None:
+        self._jwt = _import_pyjwt()
+        if (secret is None) == (jwks_url is None):
+            raise ValueError("provide exactly one of 'secret' or 'jwks_url'")
+        if secret is not None:
+            if len(secret.encode()) < _MIN_SECRET_BYTES:
+                raise ValueError(
+                    f"secret must be at least {_MIN_SECRET_BYTES} bytes of "
+                    "high-entropy material (e.g. secrets.token_urlsafe(32))"
+                )
+            self._algorithms = list(algorithms or ["HS256"])
+        else:
+            _require_https(jwks_url or "", "jwks_url")
+            self._algorithms = list(algorithms or ["RS256", "ES256"])
+            if any(alg.upper().startswith("HS") for alg in self._algorithms):
+                raise ValueError(
+                    "symmetric (HS*) algorithms cannot be used with jwks_url: "
+                    "a public JWKS key must never double as an HMAC secret "
+                    "(key-confusion attack)"
+                )
+        self._secret = secret
+        self._jwks_url = jwks_url
+        self._audience = audience
+        self._issuer = issuer
+        self._leeway = leeway
+        self._decode_options = {
+            "require": list(required_claims),
+            "verify_aud": audience is not None,
+            "verify_iss": issuer is not None,
+        }
+        self._scopes_claim = scopes_claim
+        self._claims_to_identity = (
+            ensure_async(claims_to_identity) if claims_to_identity else None
+        )
+        self._jwks_cache_ttl = jwks_cache_ttl
+        self._jwks_refresh_cooldown = jwks_refresh_cooldown
+        self._timeout = timeout
+        self._keys: dict[str, Any] = {}
+        self._fetched_at = 0.0
+        self._attempted_at = float("-inf")
+        self._refresh_lock = anyio.Lock()
+
+    async def __call__(self, token: str, scopes: list[str] | None = None) -> Any:
+        """Verify *token* and return the identity.
+
+        Raises:
+            UnauthorizedError: Invalid/expired signature or claims (401).
+            ForbiddenError: Valid token missing route-required scopes (403).
+            HTTPException: 503 when the JWKS cannot be fetched and no keys
+                are cached — the token cannot be checked either way.
+        """
+        if self._secret is not None:
+            key: Any = self._secret
+        else:
+            key = (await self._resolve_jwks_key(token)).key
+        try:
+            claims = self._jwt.decode(
+                token,
+                key=key,
+                algorithms=self._algorithms,
+                audience=self._audience,
+                issuer=self._issuer,
+                leeway=self._leeway,
+                options=self._decode_options,
+            )
+        except self._jwt.InvalidTokenError:
+            raise UnauthorizedError() from None
+        if scopes:
+            missing = set(scopes) - self._granted_scopes(claims)
+            if missing:
+                raise ForbiddenError("Insufficient scope")
+        if self._claims_to_identity is not None:
+            return await self._claims_to_identity(claims)
+        return claims
+
+    def _granted_scopes(self, claims: dict[str, Any]) -> set[str]:
+        """Read the configured scopes claim: space-separated string or list."""
+        value = claims.get(self._scopes_claim)
+        if isinstance(value, str):
+            return set(value.split())
+        if isinstance(value, (list, tuple)):
+            return {str(item) for item in value}
+        return set()
+
+    def _lookup_key(self, kid: str | None) -> Any | None:
+        if kid is not None:
+            return self._keys.get(kid)
+        if len(self._keys) == 1:
+            return next(iter(self._keys.values()))
+        return None
+
+    def _cache_stale(self) -> bool:
+        return (
+            not self._keys or time.monotonic() - self._fetched_at > self._jwks_cache_ttl
+        )
+
+    async def _resolve_jwks_key(self, token: str) -> Any:
+        """Resolve the verification key for *token* from the cached JWKS."""
+        try:
+            header = self._jwt.get_unverified_header(token)
+        except self._jwt.InvalidTokenError:
+            raise UnauthorizedError() from None
+        kid = header.get("kid")
+        if self._cache_stale():
+            await self._refresh_jwks()
+        key = self._lookup_key(kid)
+        if key is None:
+            # Unknown kid: the provider may have rotated keys. The refresh is
+            # rate-limited so unauthenticated junk can't force fetch storms.
+            await self._refresh_jwks(force=True)
+            key = self._lookup_key(kid)
+        if key is None:
+            raise UnauthorizedError()
+        return key
+
+    @staticmethod
+    def _unavailable() -> HTTPException:
+        return HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Authentication temporarily unavailable",
+        )
+
+    async def _refresh_jwks(self, force: bool = False) -> None:
+        """Refetch the JWKS, coalescing concurrent and repeated refreshes.
+
+        At most one attempt per ``jwks_refresh_cooldown``; a failed fetch falls
+        back on cached keys, or surfaces as a 503 when the cache is empty.
+        """
+        async with self._refresh_lock:
+            # Re-check after acquiring: another request may just have tried.
+            if time.monotonic() - self._attempted_at < self._jwks_refresh_cooldown:
+                if not self._keys:
+                    raise self._unavailable()
+                return
+            if not force and not self._cache_stale():
+                return
+            self._attempted_at = time.monotonic()
+            try:
+                await self._fetch_jwks()
+            except _JWKSFetchError as exc:
+                logger.warning("JWKS refresh failed: %s", exc)
+                if not self._keys:
+                    raise self._unavailable() from exc
+                # Stale fallback: keep validating with the cached keys.
+
+    async def _fetch_jwks(self) -> None:
+        document = await _get_json(
+            self._jwks_url or "",
+            timeout=self._timeout,
+            error_cls=_JWKSFetchError,
+            description="JWKS document",
+        )
+        if not isinstance(document, dict) or not isinstance(document.get("keys"), list):
+            raise _JWKSFetchError("JWKS document has no 'keys' list")
+        keys: dict[str, Any] = {}
+        for entry in document["keys"]:
+            if not isinstance(entry, dict):
+                continue
+            if entry.get("use") not in (None, "sig"):
+                continue
+            if "alg" not in entry:
+                alg = _default_alg(entry)
+                if alg is None:
+                    continue
+                entry = {**entry, "alg": alg}
+            try:
+                key = self._jwt.PyJWK(entry)
+            except (self._jwt.exceptions.PyJWTError, KeyError):
+                # Unsupported or malformed entry: one broken key in the
+                # provider's JWKS must not take down every login.
+                continue
+            keys[entry.get("kid") or ""] = key
+        self._keys = keys
+        self._fetched_at = time.monotonic()

fastapi_multiauth/oauth/__init__.py

@@ -0,0 +1,43 @@
+"""OAuth 2.0 / OIDC login-flow helpers (the ``oauth`` extra).
+
+These obtain a credential through the browser authorization-code flow — a
+distinct concern from the request-time auth sources in the top-level package.
+``client`` holds the network operations (discovery, code exchange, userinfo);
+``utils`` holds the pure helpers (state, PKCE, the authorization redirect).
+"""
+
+from ..exceptions import (
+    OAuthDiscoveryError,
+    OAuthError,
+    OAuthExchangeError,
+    OAuthUserinfoError,
+)
+from .client import (
+    OIDCEndpoints,
+    oauth_exchange_code,
+    oauth_fetch_userinfo,
+    oauth_resolve_provider_urls,
+)
+from .utils import (
+    oauth_build_authorization_redirect,
+    oauth_decode_state,
+    oauth_encode_state,
+    oauth_generate_pkce_pair,
+    oauth_generate_state_token,
+)
+
+__all__ = [
+    "OAuthDiscoveryError",
+    "OAuthError",
+    "OAuthExchangeError",
+    "OAuthUserinfoError",
+    "OIDCEndpoints",
+    "oauth_build_authorization_redirect",
+    "oauth_decode_state",
+    "oauth_encode_state",
+    "oauth_exchange_code",
+    "oauth_fetch_userinfo",
+    "oauth_generate_pkce_pair",
+    "oauth_generate_state_token",
+    "oauth_resolve_provider_urls",
+]