infrahub-server 1.1.9__tar.gz → 1.2.0__tar.gz

infrahub_server-1.2.0/PKG-INFO

@@ -0,0 +1,138 @@
+Metadata-Version: 2.1
+Name: infrahub-server
+Version: 1.2.0
+Summary: Infrahub is taking a new approach to Infrastructure Management by providing a new generation of datastore to organize and control all the data that defines how an infrastructure should run.
+Home-page: https://opsmill.com
+License: AGPL-3.0-only
+Author: OpsMill
+Author-email: info@opsmill.com
+Requires-Python: >=3.10,<3.13
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: GNU Affero General Public License v3
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Requires-Dist: Jinja2 (>=3,<4)
+Requires-Dist: aio-pika (>=9.4,<9.5)
+Requires-Dist: aiodataloader (==0.4.0)
+Requires-Dist: asgi-correlation-id (==4.2.0)
+Requires-Dist: authlib (==1.3.2)
+Requires-Dist: bcrypt (>=4.1,<4.2)
+Requires-Dist: boto3 (==1.34.129)
+Requires-Dist: dulwich (>=0.22.7,<0.23.0)
+Requires-Dist: email-validator (>=2.1,<2.2)
+Requires-Dist: fastapi (>=0.115,<0.116)
+Requires-Dist: fastapi-storages (>=0.3,<0.4)
+Requires-Dist: gitpython (>=3,<4)
+Requires-Dist: graphene (>=3.4,<3.5)
+Requires-Dist: gunicorn (>=23.0.0,<24.0.0)
+Requires-Dist: lunr (>=0.7.0.post1,<0.8.0)
+Requires-Dist: nats-py (>=2.7.2,<3.0.0)
+Requires-Dist: neo4j (>=5.28,<5.29)
+Requires-Dist: neo4j-rust-ext (>=5.28,<5.29)
+Requires-Dist: netaddr (==1.3.0)
+Requires-Dist: numpy (>=1.24.2,<2.0.0) ; python_version >= "3.9" and python_version < "3.12"
+Requires-Dist: numpy (>=1.26.2,<2.0.0) ; python_version >= "3.12"
+Requires-Dist: opentelemetry-exporter-otlp-proto-grpc (==1.28.1)
+Requires-Dist: opentelemetry-exporter-otlp-proto-http (==1.28.1)
+Requires-Dist: opentelemetry-instrumentation-aio-pika (==0.49b1)
+Requires-Dist: opentelemetry-instrumentation-fastapi (==0.49b1)
+Requires-Dist: prefect (==3.2.11)
+Requires-Dist: prefect-redis (==0.2.2)
+Requires-Dist: pyarrow (>=14,<15)
+Requires-Dist: pydantic (>=2.10,<2.11)
+Requires-Dist: pydantic-settings (>=2.8,<2.9)
+Requires-Dist: pyjwt (>=2.8,<2.9)
+Requires-Dist: pytest (>=7.4,<7.5)
+Requires-Dist: python-multipart (==0.0.18)
+Requires-Dist: pyyaml (>=6,<7)
+Requires-Dist: redis[hiredis] (>=5.0.0,<6.0.0)
+Requires-Dist: rich (>=13,<14)
+Requires-Dist: starlette-exporter (>=0.23,<0.24)
+Requires-Dist: structlog (==24.1.0)
+Requires-Dist: toml (>=0.10,<0.11)
+Requires-Dist: typer (==0.12.5)
+Requires-Dist: ujson (>=5,<6)
+Requires-Dist: uvicorn[standard] (>=0.32,<0.33)
+Requires-Dist: whenever (==0.7.2)
+Project-URL: Documentation, https://docs.infrahub.app/
+Project-URL: Repository, https://github.com/opsmill/infrahub
+Description-Content-Type: text/markdown
+
+<h1 align="center">
+  <a href=""><img src="docs/static/img/infrahub-hori.svg" alt="Infrahub" width="350"></a>
+</h1>
+<h3 align="center">Simplify Infrastructure Automation</h2>
+
+<p align="center">
+<a href="https://www.linkedin.com/company/opsmill">
+<img src="https://img.shields.io/badge/linkedin-blue?logo=linkedin"/>
+</a>
+<a href="https://discord.gg/opsmill">
+<img src="https://img.shields.io/badge/Discord-7289DA?&logo=discord&logoColor=white"/>
+</a>
+</p>
+
+Infrahub from [OpsMill](https://opsmill.com) is taking a new approach to Infrastructure Management by providing a new generation of datastore to organize and control all the data that defines how an infrastructure should run. Infrahub offers a central hub to manage the data, templates and playbooks that powers your infrastructure by combining the version control and branch management capabilities similar to Git with the flexible data model and UI of a graph database.
+
+If you just want to try Infrahub out, you can use our [Always-On Sandbox](https://demo.infrahub.app/) to get started.
+
+![infrahub screenshot](docs/docs/media/infrahub-readme.gif)
+
+## Why Use Infrahub?
+
+**Unified Source of Truth** - Infrahub is a single source of truth for all your infrastructure and network data. It provides a unified view of your infrastructure, allowing you to manage your infrastructure in a more efficient and effective way. Infrahub allows unidirectional and bi-directional [data synchronization](https://docs.infrahub.app/sync/sync/) between other internal systems and Infrahub. The data can be accessed via WebUI, API and SDK, along with SSO and RBAC for access control.
+
+**Flexible Schema** - Infrahub provides a flexible schema for your infrastructure data and related business information, allowing you to define your own data model and customize it to your needs. Get started quickly with our [schema library](https://github.com/opsmill/schema-library) or build your own.
+
+**Version Control** - Infrahub provides a version control system for your infrastructure data, allowing you to track changes and revert to previous versions if needed. Immutable history of all changes to the data and artifacts is maintained, allowing you to audit and review changes to your infrastructure.
+
+**CI Pipeline and Validation** - Infrahub provides a CI pipeline and validation system for your infrastructure data, allowing you to ensure that your infrastructure is always in a valid state. Infrahub was designed with infrastructure-as-code workflows in mind, removing fragility and complexity of combining together multiple tools and projects to achieve the same goal.
+
+## Infrahub Use Cases
+
+**Service Catalog** - Infrahub acts as the underlying system to provide infrastructure-as-a-service, allowing you to manage your services and lifecycle them as the services evolve.
+
+**Infrastructure Automation** - Provide infrastructure and network automation workflows with Infrahub rendering configurations and artifacts via Jinja2 and python,then passing to deployment tools such as [Nornir](https://www.opsmill.com/simplifying-network-automation-workflows-with-infrahub-nornir-and-jinja2/), [Ansible](https://docs.infrahub.app/ansible/ansible/), Terraform, or vendor-specific tools.
+
+**Inventory Management** - Infrahub serves as a centralized inventory system for your infrastructure, allowing you to manage your inventory and track changes to your infrastructure. It provides a WebUI and API for other teams to self-service the information needed to allow the organization to operate.
+
+**DCIM and IPAM** - Infrahub provides centralized DCIM and IPAM systems for your infrastructure, capable of handling complex cases such as overlapping IP addresses and VLANs, automation-friendly, branch-aware allocation of resources via Infrahub's [Resource Manager](https://docs.infrahub.app/python-sdk/guides/resource-manager), and more.
+
+## Quick Start
+
+[Always-On Sandbox](https://demo.infrahub.app/) - Instantly login to the UI of a demo environment of Infrahub with sample data pre-loaded.
+
+[Getting Started Environment & Tutorial](https://opsmill.instruqt.com/pages/labs) - It spins up an instance of Infrahub on our cloud, provides a browser, terminal, code editor and walks you through the basic concepts:
+
+- Branching and version control
+- Flexible schema
+- Unified storage
+
+For longer term tests, you can deploy a local instance of Infrahub by referring to our guide: [Installing Infrahub](https://docs.infrahub.app/guides/installation)
+
+## Documentation
+
+If you'd like to learn more about Infrahub, please refer to the following resources:
+
+- [Infrahub Overview](https://docs.infrahub.app/overview/)
+- [Infrahub Documentation](https://docs.infrahub.app/)
+- [FAQ](https://docs.infrahub.app/faq/)
+
+## Support and Community
+
+If you need help, support for the community version of Infrahub is provided on [![Join our Discord server](https://img.shields.io/badge/Discord-7289DA?logo=discord&logoColor=white)](https://discord.gg/opsmill) or via [filing an issue on GitHub](https://github.com/opsmill/infrahub/issues).
+
+## Contributing
+
+To help our community with the creation of contributions, please view our [CONTRIBUTING](./CONTRIBUTING.md) page.
+
+<a  href="https://github.com/opsmill/infrahub/graphs/contributors">
+<img  src="https://contrib.rocks/image?repo=opsmill/infrahub" />
+</a>
+
+## Security
+
+[View our SECURITY](https://github.com/opsmill/infrahub?tab=security-ov-file) policy to find the latest information.
+

infrahub_server-1.2.0/backend/infrahub/api/artifact.py

@@ -0,0 +1,106 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from fastapi import APIRouter, Body, Depends, Request, Response
+from pydantic import BaseModel, Field
+
+from infrahub.api.dependencies import (
+    BranchParams,
+    get_branch_params,
+    get_context,
+    get_current_user,
+    get_db,
+    get_permission_manager,
+)
+from infrahub.core import registry
+from infrahub.core.account import ObjectPermission
+from infrahub.core.constants import GLOBAL_BRANCH_NAME, InfrahubKind, PermissionAction
+from infrahub.core.protocols import CoreArtifactDefinition
+from infrahub.database import InfrahubDatabase  # noqa: TC001
+from infrahub.exceptions import NodeNotFoundError
+from infrahub.git.models import RequestArtifactDefinitionGenerate
+from infrahub.log import get_logger
+from infrahub.permissions.constants import PermissionDecisionFlag
+from infrahub.workflows.catalogue import REQUEST_ARTIFACT_DEFINITION_GENERATE
+
+if TYPE_CHECKING:
+    from infrahub.auth import AccountSession
+    from infrahub.context import InfrahubContext
+    from infrahub.permissions import PermissionManager
+    from infrahub.services import InfrahubServices
+
+log = get_logger()
+router = APIRouter(prefix="/artifact")
+
+
+class ArtifactGeneratePayload(BaseModel):
+    nodes: list[str] = Field(default_factory=list)
+
+
+class ArtifactGenerateResponse(BaseModel):
+    nodes: list[str]
+
+
+@router.get("/{artifact_id:str}")
+async def get_artifact(
+    artifact_id: str,
+    db: InfrahubDatabase = Depends(get_db),
+    branch_params: BranchParams = Depends(get_branch_params),
+    _: AccountSession = Depends(get_current_user),
+) -> Response:
+    artifact = await registry.manager.get_one(db=db, id=artifact_id, branch=branch_params.branch, at=branch_params.at)
+    if not artifact:
+        raise NodeNotFoundError(
+            branch_name=branch_params.branch.name, node_type=InfrahubKind.ARTIFACT, identifier=artifact_id
+        )
+
+    return Response(
+        content=registry.storage.retrieve(identifier=artifact.storage_id.value),
+        headers={"Content-Type": artifact.content_type.value.value},
+    )
+
+
+@router.post("/generate/{artifact_definition_id:str}")
+async def generate_artifact(
+    request: Request,
+    artifact_definition_id: str,
+    payload: ArtifactGeneratePayload = Body(
+        ArtifactGeneratePayload(),  # noqa: B008
+        description="Payload of the request, can be used to limit the scope of the query to a specific list of hosts",
+    ),
+    db: InfrahubDatabase = Depends(get_db),
+    branch_params: BranchParams = Depends(get_branch_params),
+    permission_manager: PermissionManager = Depends(get_permission_manager),
+    context: InfrahubContext = Depends(get_context),
+) -> None:
+    permission_decision = (
+        PermissionDecisionFlag.ALLOW_DEFAULT
+        if branch_params.branch.name in (GLOBAL_BRANCH_NAME, registry.default_branch)
+        else PermissionDecisionFlag.ALLOW_OTHER
+    )
+    permissions = [
+        ObjectPermission(namespace="Core", name="Artifact", action=action.value, decision=permission_decision)
+        for action in (PermissionAction.CREATE, PermissionAction.UPDATE)
+    ]
+    permission_manager.raise_for_permissions(permissions=permissions)
+
+    # Verify that the artifact definition exists for the requested branch
+    artifact_definition = await registry.manager.get_one_by_id_or_default_filter(
+        db=db,
+        id=artifact_definition_id,
+        kind=CoreArtifactDefinition,
+        branch=branch_params.branch,
+    )
+
+    service: InfrahubServices = request.app.state.service
+    model = RequestArtifactDefinitionGenerate(
+        artifact_definition_id=artifact_definition.id,
+        artifact_definition_name=artifact_definition.name.value,
+        branch=branch_params.branch.name,
+        limit=payload.nodes,
+    )
+
+    await service.workflow.submit_workflow(
+        workflow=REQUEST_ARTIFACT_DEFINITION_GENERATE, context=context, parameters={"model": model}
+    )

infrahub_server-1.2.0/backend/infrahub/api/dependencies.py

@@ -0,0 +1,143 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, AsyncIterator
+
+from fastapi import Depends, Query, Request
+from fastapi.security import APIKeyHeader, HTTPAuthorizationCredentials, HTTPBearer
+from pydantic import BaseModel, ConfigDict
+
+from infrahub import config
+from infrahub.auth import AccountSession, authentication_token, validate_jwt_access_token, validate_jwt_refresh_token
+from infrahub.context import InfrahubContext
+from infrahub.core.branch import Branch  # noqa: TC001
+from infrahub.core.registry import registry
+from infrahub.core.timestamp import Timestamp
+from infrahub.database import InfrahubDatabase  # noqa: TC001
+from infrahub.exceptions import AuthorizationError
+from infrahub.permissions import PermissionManager
+
+if TYPE_CHECKING:
+    from neo4j import AsyncSession
+
+    from infrahub.models import RefreshTokenData
+
+jwt_scheme = HTTPBearer(auto_error=False)
+api_key_scheme = APIKeyHeader(name="X-INFRAHUB-KEY", auto_error=False)
+
+
+async def cookie_auth_scheme(request: Request) -> str | None:
+    return request.cookies.get("access_token")  # Replace with the actual name of your JWT cookie
+
+
+class BranchParams(BaseModel):
+    branch: Branch
+    at: Timestamp
+
+    model_config = ConfigDict(arbitrary_types_allowed=True)
+
+
+async def get_session(request: Request) -> AsyncIterator[AsyncSession]:
+    session = request.app.state.db.session(database=config.SETTINGS.database.database_name)
+    try:
+        yield session
+    finally:
+        await session.close()
+
+
+async def get_db(request: Request) -> InfrahubDatabase:
+    return request.app.state.db.start_session()
+
+
+async def get_access_token(
+    request: Request, jwt_header: HTTPAuthorizationCredentials = Depends(jwt_scheme)
+) -> AccountSession:
+    if jwt_header:
+        return await validate_jwt_access_token(token=jwt_header.credentials)
+    if token := request.cookies.get("access_token"):
+        return await validate_jwt_access_token(token=token)
+
+    raise AuthorizationError("A JWT access token is required to perform this operation.")
+
+
+async def get_refresh_token(
+    request: Request,
+    db: InfrahubDatabase = Depends(get_db),
+    jwt_header: HTTPAuthorizationCredentials | None = Depends(jwt_scheme),
+) -> RefreshTokenData:
+    token = None
+
+    # Check for token in header
+    if jwt_header:
+        token = jwt_header.credentials
+
+    # If no auth header, try to get the token from the cookie
+    if not token:
+        token = request.cookies.get("refresh_token")
+
+    # If still no token, raise an error
+    if not token:
+        raise AuthorizationError("A JWT refresh token is required to perform this operation.")
+
+    return await validate_jwt_refresh_token(db=db, token=token)
+
+
+async def get_branch_params(
+    db: InfrahubDatabase = Depends(get_db),
+    branch_name: str | None = Query(None, alias="branch", description="Name of the branch to use for the query"),
+    at: str | None = Query(None, description="Time to use for the query, in absolute or relative format"),
+) -> BranchParams:
+    branch = await registry.get_branch(db=db, branch=branch_name)
+
+    return BranchParams(branch=branch, at=Timestamp(at))
+
+
+async def get_branch_dep(
+    db: InfrahubDatabase = Depends(get_db),
+    branch_name: str | None = Query(None, alias="branch", description="Name of the branch to use for the query"),
+) -> Branch:
+    return await registry.get_branch(db=db, branch=branch_name)
+
+
+async def get_current_user(
+    request: Request,
+    jwt_header: HTTPAuthorizationCredentials = Depends(jwt_scheme),
+    db: InfrahubDatabase = Depends(get_db),
+    api_key: str = Depends(api_key_scheme),
+) -> AccountSession:
+    """Return current user"""
+    jwt_token = None
+    if jwt_header:
+        jwt_token = jwt_header.credentials
+
+    if not jwt_token:
+        jwt_token = request.cookies.get("access_token")
+
+    account_session = await authentication_token(db=db, jwt_token=jwt_token, api_key=api_key)
+
+    if (
+        account_session.authenticated
+        or request.url.path.startswith("/graphql")
+        or (config.SETTINGS.main.allow_anonymous_access and request.method.lower() in ["get", "options"])
+    ):
+        return account_session
+
+    raise AuthorizationError("Authentication is required")
+
+
+async def get_permission_manager(
+    db: InfrahubDatabase = Depends(get_db),
+    branch_params: BranchParams = Depends(get_branch_params),
+    account_session: AccountSession = Depends(get_current_user),
+) -> PermissionManager:
+    """Return a `PermissionManager` for an account session based on a branch."""
+    permission_manager = PermissionManager(account_session=account_session)
+    await permission_manager.load_permissions(db=db, branch=branch_params.branch)
+
+    return permission_manager
+
+
+async def get_context(
+    branch: Branch = Depends(get_branch_dep),
+    account_session: AccountSession = Depends(get_current_user),
+) -> InfrahubContext:
+    return InfrahubContext.init(branch=branch, account=account_session)

infrahub_server-1.2.0/backend/infrahub/api/diff/validation_models.py

@@ -0,0 +1,35 @@
+from typing import Any
+
+from pydantic import BaseModel, ConfigDict, field_validator, model_validator
+
+from infrahub.core.branch import Branch
+from infrahub.core.timestamp import Timestamp
+
+
+class DiffQueryValidated(BaseModel):
+    model_config = ConfigDict(arbitrary_types_allowed=True)
+    branch: Branch
+    time_from: str | None = None
+    time_to: str | None = None
+    branch_only: bool
+
+    @field_validator("time_from", "time_to", mode="before")
+    @classmethod
+    def validate_time(cls, value: str | None) -> str | None:
+        if not value:
+            return None
+        Timestamp(value)
+        return value
+
+    @model_validator(mode="before")
+    @classmethod
+    def validate_time_from_if_required(cls, values: dict[str, Any]) -> dict[str, Any]:
+        branch: Branch | None = values.get("branch")
+        time_from: Timestamp | None = values.get("time_from")
+        if getattr(branch, "is_default", False) and not time_from:
+            branch_name = getattr(branch, "name", "")
+            raise ValueError(f"time_from is mandatory when diffing on the default branch `{branch_name}`.")
+        time_to: Timestamp | None = values.get("time_to")
+        if time_to and time_from and time_to < time_from:
+            raise ValueError("time_from and time_to are not a valid time range")
+        return values

infrahub_server-1.2.0/backend/infrahub/api/oauth2.py

@@ -0,0 +1,146 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+from urllib.parse import urljoin
+
+import ujson
+from authlib.integrations.httpx_client import AsyncOAuth2Client
+from fastapi import APIRouter, Depends, Request, Response
+from fastapi.responses import JSONResponse, RedirectResponse
+from opentelemetry import trace
+
+from infrahub import config, models
+from infrahub.api.dependencies import get_db
+from infrahub.auth import signin_sso_account
+from infrahub.exceptions import GatewayError, ProcessingError
+from infrahub.log import get_logger
+from infrahub.message_bus.types import KVTTL
+
+if TYPE_CHECKING:
+    import httpx
+
+    from infrahub.database import InfrahubDatabase
+    from infrahub.services import InfrahubServices
+
+
+log = get_logger()
+router = APIRouter(prefix="/oauth2")
+
+
+def _get_redirect_url(request: Request, provider_name: str) -> str:
+    """Return public redirect URL."""
+    base_url = config.SETTINGS.main.public_url or str(request.base_url)
+    return urljoin(base_url, f"auth/oauth2/{provider_name}/callback")
+
+
+@router.get("/{provider_name:str}/authorize")
+async def authorize(request: Request, provider_name: str, final_url: str | None = None) -> Response:
+    provider = config.SETTINGS.security.get_oauth2_provider(provider=provider_name)
+
+    with trace.get_tracer(__name__).start_as_current_span("sso_oauth2_client_configuration") as span:
+        span.set_attribute("provider_name", provider_name)
+        span.set_attribute("scopes", provider.scopes)
+
+        client = AsyncOAuth2Client(
+            client_id=provider.client_id,
+            client_secret=provider.client_secret,
+            scope=provider.scopes,
+        )
+
+    redirect_uri = _get_redirect_url(request=request, provider_name=provider_name)
+    final_url = final_url or config.SETTINGS.main.public_url or str(request.base_url)
+
+    authorization_uri, state = client.create_authorization_url(
+        url=provider.authorization_url, redirect_uri=redirect_uri, scope=provider.scopes, final_url=final_url
+    )
+
+    service: InfrahubServices = request.app.state.service
+
+    await service.cache.set(
+        key=f"security:oauth2:provider:{provider_name}:state:{state}", value=final_url, expires=KVTTL.TWO_HOURS
+    )
+
+    if config.SETTINGS.dev.frontend_redirect_sso:
+        return JSONResponse(content={"url": authorization_uri})
+
+    return RedirectResponse(url=authorization_uri)
+
+
+@router.get("/{provider_name:str}/token")
+async def token(
+    request: Request,
+    response: Response,
+    provider_name: str,
+    state: str,
+    code: str,
+    db: InfrahubDatabase = Depends(get_db),
+) -> models.UserTokenWithUrl:
+    provider = config.SETTINGS.security.get_oauth2_provider(provider=provider_name)
+
+    service: InfrahubServices = request.app.state.service
+
+    cache_key = f"security:oauth2:provider:{provider_name}:state:{state}"
+    stored_final_url = await service.cache.get(key=cache_key)
+    await service.cache.delete(key=cache_key)
+
+    if not stored_final_url:
+        raise ProcessingError(message="Invalid 'state' parameter")
+
+    token_data = {
+        "code": code,
+        "client_id": provider.client_id,
+        "client_secret": provider.client_secret,
+        "redirect_uri": _get_redirect_url(request=request, provider_name=provider_name),
+        "grant_type": "authorization_code",
+    }
+
+    token_response = await service.http.post(provider.token_url, data=token_data)
+    _validate_response(response=token_response)
+
+    with trace.get_tracer(__name__).start_as_current_span("sso_token_request") as span:
+        span.set_attribute("token_request_data", ujson.dumps(token_response.json()))
+        payload = token_response.json()
+
+    headers = {"Authorization": f"{payload.get('token_type')} {payload.get('access_token')}"}
+    if provider.userinfo_method == config.UserInfoMethod.GET:
+        userinfo_response = await service.http.get(provider.userinfo_url, headers=headers)
+    else:
+        userinfo_response = await service.http.post(provider.userinfo_url, headers=headers)
+
+    _validate_response(response=userinfo_response)
+    user_info = userinfo_response.json()
+    sso_groups = user_info.get("groups", [])
+    if not sso_groups and config.SETTINGS.security.sso_user_default_group:
+        sso_groups = [config.SETTINGS.security.sso_user_default_group]
+
+    with trace.get_tracer(__name__).start_as_current_span("signin_sso_account") as span:
+        span.set_attribute("account_name", ujson.dumps(userinfo_response.json()))
+        span.set_attribute("sso_groups", sso_groups)
+        user_token = await signin_sso_account(db=db, account_name=user_info["name"], sso_groups=sso_groups)
+
+    response.set_cookie(
+        "access_token", user_token.access_token, httponly=True, max_age=config.SETTINGS.security.access_token_lifetime
+    )
+    response.set_cookie(
+        "refresh_token",
+        user_token.refresh_token,
+        httponly=True,
+        max_age=config.SETTINGS.security.refresh_token_lifetime,
+    )
+
+    return models.UserTokenWithUrl(
+        access_token=user_token.access_token, refresh_token=user_token.refresh_token, final_url=stored_final_url
+    )
+
+
+def _validate_response(response: httpx.Response) -> None:
+    if 200 <= response.status_code <= 299:
+        return
+
+    log.error(
+        "Invalid response from the OAuth provider",
+        url=response.url,
+        status_code=response.status_code,
+        body=response.json(),
+    )
+    raise GatewayError(message="Invalid response from Authentication provider")