interloper-api 0.23.1__tar.gz → 0.24.1__tar.gz

{interloper_api-0.23.1 → interloper_api-0.24.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: interloper-api
-Version: 0.23.1
+Version: 0.24.1
 Summary: Interloper FastAPI routes
 Author: Guillaume Onfroy
 Author-email: Guillaume Onfroy <guillaume@digitlcloud.com>

{interloper_api-0.23.1 → interloper_api-0.24.1}/pyproject.toml

@@ -3,7 +3,7 @@
 # ###############
 [project]
 name = "interloper-api"
-version = "0.23.1"
+version = "0.24.1"
 description = "Interloper FastAPI routes"
 readme = "README.md"
 authors = [{ name = "Guillaume Onfroy", email = "guillaume@digitlcloud.com" }]

{interloper_api-0.23.1 → interloper_api-0.24.1}/src/interloper_api/routes/oauth.py

@@ -6,10 +6,11 @@ encoding, parameter names), so the exchange is performed generically —
 adding a provider is an ``interloper.oauth_providers`` entry point, not a
 new route.
 
-The connector *app* credentials (``client_id`` / ``client_secret`` /
+The in-house *OAuth* credentials (``client_id`` / ``client_secret`` /
 ``redirect_uri``) are read from provider-scoped environment variables
-(``<PROVIDER>_CLIENT_ID``, …) and injected into the token response so they
-can be stored alongside the tokens.
+(``INTERLOPER_<PROVIDER>_CLIENT_ID``, …) and used to perform the exchange. They are
+never returned to the browser; connections resolve them from the same env
+at runtime (see ``OAuthCredentialField``).
 
 The ``GET /providers`` endpoint returns metadata for all providers that
 have credentials configured, so the frontend knows which "Sign in with X"
@@ -42,14 +43,14 @@ router = APIRouter(prefix="/oauth", tags=["oauth"])
 
 
 class _ProviderConfig:
-    """Connector app credentials resolved from environment variables."""
+    """In-house OAuth credentials resolved from environment variables."""
 
     def __init__(self, key: str, *, env_prefix: str | None = None) -> None:
         prefix = (env_prefix or key).upper()
         self.key = key
-        self.client_id = os.environ.get(f"{prefix}_CLIENT_ID", "")
-        self.client_secret = os.environ.get(f"{prefix}_CLIENT_SECRET", "")
-        self.redirect_uri = os.environ.get(f"{prefix}_REDIRECT_URI", "")
+        self.client_id = os.environ.get(f"INTERLOPER_{prefix}_CLIENT_ID", "")
+        self.client_secret = os.environ.get(f"INTERLOPER_{prefix}_CLIENT_SECRET", "")
+        self.redirect_uri = os.environ.get(f"INTERLOPER_{prefix}_REDIRECT_URI", "")
 
     @property
     def configured(self) -> bool:
@@ -76,11 +77,11 @@ async def _exchange(
     Args:
         client: The HTTP client to use.
         spec: The provider's token-exchange spec.
-        cfg: The connector app credentials.
+        cfg: The in-house OAuth credentials.
         code: The authorization code.
 
     Returns:
-        The provider's raw token response (e.g. ``refresh_token``). The app
+        The provider's raw token response (e.g. ``refresh_token``). The OAuth
         credentials are *not* injected: they are the in-house per-provider
         values resolved from env at runtime, so the secret never leaves the
         server.
@@ -165,7 +166,7 @@ async def exchange_token(
     """Exchange an authorization code for tokens. Requires authentication.
 
     Returns only the provider's token response (e.g. ``refresh_token``); the
-    in-house app credentials are never included — connections resolve them
+    in-house OAuth credentials are never included — connections resolve them
     from env at runtime.
     """
     spec = providers().get(provider)