mage-ai 0.9.44__py3-none-any.whl → 0.9.46__py3-none-any.whl

mage_ai/api/resources/UserResource.py

@@ -176,37 +176,38 @@ class UserResource(DatabaseResource):
             payload['password_hash'] = create_bcrypt_hash(password, password_salt)
             payload['password_salt'] = password_salt
 
-        role_ids = [int(i) for i in payload.get('role_ids') or []]
-        # Need to call roles_new directly on the model or else the resource will
-        # cache the result because of the collective loader.
-        role_mapping = index_by(lambda x: x.id, self.model.roles_new or [])
-
-        role_ids_create = []
-        role_ids_delete = []
-
-        for role_id in role_ids:
-            if role_id not in role_mapping:
-                role_ids_create.append(role_id)
-
-        for role_id in role_mapping.keys():
-            if role_id not in role_ids:
-                role_ids_delete.append(role_id)
-
-        if role_ids_create:
-            db_connection.session.bulk_save_objects(
-                [UserRole(
-                    role_id=role_id,
-                    user_id=self.id,
-                ) for role_id in role_ids_create],
-                return_defaults=True,
-            )
-
-        if role_ids_delete:
-            delete_statement = UserRole.__table__.delete().where(
-                UserRole.role_id.in_(role_ids_delete),
-                UserRole.user_id == self.id,
-            )
-            db_connection.session.execute(delete_statement)
+        if 'role_ids' in payload:
+            role_ids = [int(i) for i in payload.get('role_ids') or []]
+            # Need to call roles_new directly on the model or else the resource will
+            # cache the result because of the collective loader.
+            role_mapping = index_by(lambda x: x.id, self.model.roles_new or [])
+
+            role_ids_create = []
+            role_ids_delete = []
+
+            for role_id in role_ids:
+                if role_id not in role_mapping:
+                    role_ids_create.append(role_id)
+
+            for role_id in role_mapping.keys():
+                if role_id not in role_ids:
+                    role_ids_delete.append(role_id)
+
+            if role_ids_create:
+                db_connection.session.bulk_save_objects(
+                    [UserRole(
+                        role_id=role_id,
+                        user_id=self.id,
+                    ) for role_id in role_ids_create],
+                    return_defaults=True,
+                )
+
+            if role_ids_delete:
+                delete_statement = UserRole.__table__.delete().where(
+                    UserRole.role_id.in_(role_ids_delete),
+                    UserRole.user_id == self.id,
+                )
+                db_connection.session.execute(delete_statement)
 
         return super().update(ignore_keys(payload, [
             'owner',

mage_ai/api/resources/mixins/spark.py

@@ -1,19 +1,26 @@
+from typing import Dict
+
 from mage_ai.api.errors import ApiError
-from mage_ai.services.spark.api.local import LocalAPI
+from mage_ai.services.spark.api.base import BaseAPI
+from mage_ai.services.spark.api.service import API
 from mage_ai.services.spark.models.applications import Application
 
 
 class SparkApplicationChild:
+    @classmethod
+    def build_api(self) -> BaseAPI:
+        return API.build()
+
     @classmethod
     async def get_application_id(self, **kwargs) -> str:
         application_id = None
         parent_model = kwargs.get('parent_model')
         if parent_model and isinstance(parent_model, Application):
-            application_id = parent_model.id
+            application_id = parent_model.calculated_id()
         else:
-            models = await LocalAPI().applications()
+            models = await self.build_api().applications()
             if models and len(models) >= 1:
-                application_id = models[0].id
+                application_id = models[0].calculated_id()
 
         if not application_id:
             error = ApiError(ApiError.RESOURCE_NOT_FOUND)
@@ -22,3 +29,17 @@ class SparkApplicationChild:
             raise error
 
         return application_id
+
+    @classmethod
+    def application_calculated_id_from_query(self, query: Dict = None) -> str:
+        if not query:
+            return None
+
+        application_id = query.get('application_id', [])
+        if application_id:
+            application_id = application_id[0]
+
+        if application_id:
+            application_id = Application.load(id=application_id).calculated_id()
+
+        return application_id

mage_ai/authentication/oauth/constants.py

@@ -9,6 +9,8 @@ GITHUB_STATE = '1337'
 OAUTH_PROVIDER_ACTIVE_DIRECTORY = 'active_directory'
 OAUTH_PROVIDER_GITHUB = 'github'
 OAUTH_PROVIDER_GHE = 'ghe'
+OAUTH_PROVIDER_GOOGLE = 'google'
+OAUTH_PROVIDER_OKTA = 'okta'
 
 GHE_CLIENT_ID_ENV_VAR = 'GHE_CLIENT_ID'
 GHE_CLIENT_SECRET_ENV_VAR = 'GHE_CLIENT_SECRET'
@@ -20,6 +22,8 @@ VALID_OAUTH_PROVIDERS = [
     OAUTH_PROVIDER_ACTIVE_DIRECTORY,
     OAUTH_PROVIDER_GHE,
     OAUTH_PROVIDER_GITHUB,
+    OAUTH_PROVIDER_GOOGLE,
+    OAUTH_PROVIDER_OKTA,
 ]
 
 

mage_ai/authentication/oauth2.py

@@ -1,4 +1,3 @@
-import os
 import secrets
 from datetime import datetime, timedelta
 from typing import Dict
@@ -10,10 +9,9 @@ from mage_ai.orchestration.db.models.oauth import (
     Oauth2Application,
     User,
 )
-from mage_ai.settings import MAGE_ACCESS_TOKEN_EXPIRY_TIME
+from mage_ai.settings import JWT_SECRET, MAGE_ACCESS_TOKEN_EXPIRY_TIME
 
 JWT_ALGORITHM = 'HS256'
-JWT_SECRET = os.getenv('JWT_SECRET', 'materia')
 
 
 def generate_access_token(

mage_ai/authentication/permissions/constants.py

@@ -17,6 +17,9 @@ class EntityName(str, Enum):
     Chart = 'Chart'
     ClientPage = 'ClientPage'
     Cluster = 'Cluster'
+    ComputeCluster = 'ComputeCluster'
+    ComputeConnection = 'ComputeConnection'
+    ComputeService = 'ComputeService'
     CustomTemplate = 'CustomTemplate'
     DataProvider = 'DataProvider'
     Database = 'Database'
@@ -33,6 +36,7 @@ class EntityName(str, Enum):
     GitCustomBranch = 'GitCustomBranch'
     GitFile = 'GitFile'
     GlobalDataProduct = 'GlobalDataProduct'
+    GlobalHook = 'GlobalHook'
     IntegrationDestination = 'IntegrationDestination'
     IntegrationSource = 'IntegrationSource'
     IntegrationSourceStream = 'IntegrationSourceStream'

mage_ai/authentication/providers/active_directory.py

@@ -0,0 +1,136 @@
+import json
+import uuid
+from typing import Awaitable, Dict
+from urllib.parse import quote_plus
+
+import aiohttp
+
+from mage_ai.authentication.oauth.constants import (
+    ACTIVE_DIRECTORY_CLIENT_ID as ACTIVE_DIRECTORY_MAGE_CLIENT_ID,
+)
+from mage_ai.authentication.oauth.constants import OAUTH_PROVIDER_ACTIVE_DIRECTORY
+from mage_ai.authentication.providers.oauth import OauthProvider
+from mage_ai.authentication.providers.sso import SsoProvider
+from mage_ai.authentication.providers.utils import get_base_url
+from mage_ai.settings import ACTIVE_DIRECTORY_DIRECTORY_ID
+from mage_ai.settings.sso import (
+    ACTIVE_DIRECTORY_CLIENT_ID,
+    ACTIVE_DIRECTORY_CLIENT_SECRET,
+)
+
+
+class ADProvider(SsoProvider, OauthProvider):
+    provider = OAUTH_PROVIDER_ACTIVE_DIRECTORY
+
+    def __init__(self):
+        self.__validate()
+
+    def __validate(self):
+        if not ACTIVE_DIRECTORY_DIRECTORY_ID:
+            raise Exception(
+                'AD directory id is empty. '
+                'Make sure the ACTIVE_DIRECTORY_DIRECTORY_ID environment variable is set.')
+        if ACTIVE_DIRECTORY_CLIENT_ID and not ACTIVE_DIRECTORY_CLIENT_SECRET:
+            raise Exception(
+                'AD client secret is empty. '
+                'Make sure the ACTIVE_DIRECTORY_CLIENT_SECRET environment variable is set.')
+
+    def get_auth_url_response(self, redirect_uri: str = None, **kwargs) -> Dict:
+        """
+        For active directory, the user can set up the Oauth provider in two different ways. They
+        can either just set the ACTIVE_DIRECTORY_DIRECTORY_ID which will use the Mage application we
+        set up in Azure. They can additionally set the ACTIVE_DIRECTORY_CLIENT_ID and
+        ACTIVE_DIRECTORY_CLIENT_SECRET which will use their own Mage application in Azure.
+        """
+        ad_directory_id = ACTIVE_DIRECTORY_DIRECTORY_ID
+        if ACTIVE_DIRECTORY_CLIENT_ID:
+            base_url = get_base_url(redirect_uri)
+            redirect_uri_query = dict(
+                provider=self.provider,
+                redirect_uri=redirect_uri,
+            )
+            query = dict(
+                client_id=ACTIVE_DIRECTORY_CLIENT_ID,
+                redirect_uri=quote_plus(
+                    f'{base_url}/oauth',
+                ),
+                response_type='code',
+                scope='User.Read',
+                state=uuid.uuid4().hex,
+            )
+            query_strings = []
+            for k, v in query.items():
+                query_strings.append(f'{k}={v}')
+
+            return dict(
+                url=f"https://login.microsoftonline.com/{ad_directory_id}/oauth2/v2.0/authorize?{'&'.join(query_strings)}",  # noqa: E501
+                redirect_query_params=redirect_uri_query,
+            )
+        else:
+            from requests.models import PreparedRequest
+
+            req = PreparedRequest()
+            req.prepare_url(redirect_uri, dict(provider=self.provider))
+            query = dict(
+                client_id=ACTIVE_DIRECTORY_MAGE_CLIENT_ID,
+                redirect_uri=f'https://api.mage.ai/v1/oauth/{self.provider}',
+                response_type='code',
+                scope='User.Read',
+                state=quote_plus(
+                    json.dumps(
+                        dict(
+                            redirect_uri=req.url,
+                            tenant_id=ad_directory_id,
+                        )
+                    )
+                ),
+            )
+            query_strings = []
+            for k, v in query.items():
+                query_strings.append(f'{k}={v}')
+
+            return dict(
+                url=f"https://login.microsoftonline.com/{ad_directory_id}/oauth2/v2.0/authorize?{'&'.join(query_strings)}",  # noqa: E501
+            )
+
+    async def get_access_token_response(self, code: str, **kwargs) -> Awaitable[Dict]:
+        base_url = get_base_url(kwargs.get('redirect_uri'))
+
+        async with aiohttp.ClientSession() as session:
+            async with session.post(
+                'https://login.microsoftonline.com/organizations/oauth2/v2.0/token',
+                headers={
+                    'Accept': 'application/json',
+                },
+                data=dict(
+                    client_id=ACTIVE_DIRECTORY_CLIENT_ID,
+                    client_secret=ACTIVE_DIRECTORY_CLIENT_SECRET,
+                    code=code,
+                    grant_type='authorization_code',
+                    redirect_uri=f'{base_url}/oauth',
+                    tenant=ACTIVE_DIRECTORY_DIRECTORY_ID,
+                ),
+                timeout=20,
+            ) as response:
+                data = await response.json()
+
+        return data
+
+    async def get_user_info(self, access_token: str = None, **kwargs) -> Awaitable[Dict]:
+        if access_token is None:
+            raise Exception('Access token is required to fetch user info.')
+        async with aiohttp.ClientSession() as session:
+            async with session.get(
+                'https://graph.microsoft.com/v1.0/me',
+                headers={
+                    'Content-Type': 'application\\json',
+                    'Authorization': f'Bearer {access_token}',
+                },
+                timeout=10,
+            ) as response:
+                userinfo_resp = await response.json()
+
+        return dict(
+            email=userinfo_resp.get('userPrincipalName'),
+            username=userinfo_resp.get('userPrincipalName'),
+        )

mage_ai/authentication/providers/constants.py

@@ -0,0 +1,17 @@
+from mage_ai.authentication.oauth.constants import (
+    OAUTH_PROVIDER_ACTIVE_DIRECTORY,
+    OAUTH_PROVIDER_GHE,
+    OAUTH_PROVIDER_GOOGLE,
+    OAUTH_PROVIDER_OKTA,
+)
+from mage_ai.authentication.providers.active_directory import ADProvider
+from mage_ai.authentication.providers.ghe import GHEProvider
+from mage_ai.authentication.providers.google import GoogleProvider
+from mage_ai.authentication.providers.okta import OktaProvider
+
+NAME_TO_PROVIDER = {
+    OAUTH_PROVIDER_ACTIVE_DIRECTORY: ADProvider,
+    OAUTH_PROVIDER_GHE: GHEProvider,
+    OAUTH_PROVIDER_GOOGLE: GoogleProvider,
+    OAUTH_PROVIDER_OKTA: OktaProvider,
+}

mage_ai/authentication/providers/ghe.py

@@ -0,0 +1,81 @@
+import os
+import urllib.parse
+import uuid
+from typing import Awaitable, Dict
+
+import aiohttp
+
+from mage_ai.authentication.oauth.constants import (
+    GHE_CLIENT_ID_ENV_VAR,
+    GHE_CLIENT_SECRET_ENV_VAR,
+    OAUTH_PROVIDER_GHE,
+    get_ghe_hostname,
+)
+from mage_ai.authentication.providers.oauth import OauthProvider
+from mage_ai.authentication.providers.utils import get_base_url
+
+
+class GHEProvider(OauthProvider):
+    provider = OAUTH_PROVIDER_GHE
+
+    def __init__(self):
+        self.hostname = get_ghe_hostname()
+        self.client_id = os.getenv(GHE_CLIENT_ID_ENV_VAR)
+        self.client_secret = os.getenv(GHE_CLIENT_SECRET_ENV_VAR)
+        self.__validate()
+
+    def __validate(self):
+        if not self.hostname:
+            raise Exception(
+                'GHE hostname is empty. '
+                'Make sure the GHE_HOSTNAME environment variable is set.')
+        if not self.client_id:
+            raise Exception(
+                'GHE client id is empty. '
+                'Make sure the GHE_CLIENT_ID environment variable is set.')
+        if not self.client_secret:
+            raise Exception(
+                'GHE client secret is empty. '
+                'Make sure the GHE_CLIENT_SECRET environment variable is set.')
+
+    def get_auth_url_response(self, redirect_uri: str = None, **kwargs) -> Dict:
+        base_url = get_base_url(redirect_uri)
+        redirect_uri_query = dict(
+            provider=self.provider,
+            redirect_uri=redirect_uri,
+        )
+        query = dict(
+            client_id=self.client_id,
+            redirect_uri=urllib.parse.quote_plus(
+                f'{base_url}/oauth',
+            ),
+            scope='repo',
+            state=uuid.uuid4().hex,
+        )
+        query_strings = []
+        for k, v in query.items():
+            query_strings.append(f'{k}={v}')
+
+        return dict(
+            url=f"{self.hostname}/login/oauth/authorize?{'&'.join(query_strings)}",
+            redirect_query_params=redirect_uri_query,
+        )
+
+    async def get_access_token_response(self, code: str, **kwargs) -> Awaitable[Dict]:
+        data = dict()
+        async with aiohttp.ClientSession() as session:
+            async with session.post(
+                f'{self.hostname}/login/oauth/access_token',
+                headers={
+                    'Accept': 'application/json',
+                },
+                data=dict(
+                    client_id=self.client_id,
+                    client_secret=self.client_secret,
+                    code=code,
+                ),
+                timeout=20,
+            ) as response:
+                data = await response.json()
+
+        return data

mage_ai/authentication/providers/google.py

@@ -0,0 +1,86 @@
+import urllib.parse
+import uuid
+from typing import Awaitable, Dict
+
+import aiohttp
+
+from mage_ai.authentication.oauth.constants import OAUTH_PROVIDER_GOOGLE
+from mage_ai.authentication.providers.oauth import OauthProvider
+from mage_ai.authentication.providers.sso import SsoProvider
+from mage_ai.authentication.providers.utils import get_base_url
+from mage_ai.settings.sso import GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
+
+
+class GoogleProvider(SsoProvider, OauthProvider):
+    provider = OAUTH_PROVIDER_GOOGLE
+
+    def __init__(self):
+        if not GOOGLE_CLIENT_ID:
+            raise Exception(
+                'Google client id is empty. '
+                'Make sure the GOOGLE_CLIENT_ID environment variable is set.')
+        if not GOOGLE_CLIENT_SECRET:
+            raise Exception(
+                'Google client secret is empty. '
+                'Make sure the GOOGLE_CLIENT_SECRET environment variable is set.')
+
+    def get_auth_url_response(self, redirect_uri: str = None, **kwargs) -> Dict:
+        base_url = get_base_url(redirect_uri)
+        redirect_uri_query = dict(
+            provider=self.provider,
+            redirect_uri=redirect_uri,
+        )
+        query = dict(
+            client_id=GOOGLE_CLIENT_ID,
+            prompt='select_account',
+            redirect_uri=urllib.parse.quote_plus(
+                f'{base_url}/oauth',
+            ),
+            response_type='code',
+            scope='https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile',  # noqa: E501
+            state=uuid.uuid4().hex,
+        )
+        query_strings = []
+        for k, v in query.items():
+            query_strings.append(f'{k}={v}')
+
+        return dict(
+            url=f"https://accounts.google.com/o/oauth2/v2/auth?{'&'.join(query_strings)}",
+            redirect_query_params=redirect_uri_query,
+        )
+
+    async def get_access_token_response(self, code: str, **kwargs) -> Awaitable[Dict]:
+        base_url = get_base_url(kwargs.get('redirect_uri'))
+
+        data = dict()
+        async with aiohttp.ClientSession() as session:
+            async with session.post(
+                'https://oauth2.googleapis.com/token',
+                data=dict(
+                    code=code,
+                    client_id=GOOGLE_CLIENT_ID,
+                    client_secret=GOOGLE_CLIENT_SECRET,
+                    redirect_uri=f'{base_url}/oauth',
+                    grant_type='authorization_code',
+                ),
+                timeout=20,
+            ) as response:
+                data = await response.json()
+
+        return data
+
+    async def get_user_info(self, access_token: str = None, **kwargs) -> Awaitable[Dict]:
+        if access_token is None:
+            raise Exception('Access token is required to fetch user info.')
+        async with aiohttp.ClientSession() as session:
+            async with session.get(
+                'https://www.googleapis.com/oauth2/v3/userinfo',
+                params=dict(access_token=access_token),
+                timeout=10,
+            ) as response:
+                userinfo_resp = await response.json()
+
+        return dict(
+            email=userinfo_resp.get('email'),
+            username=userinfo_resp.get('email'),
+        )

mage_ai/authentication/providers/oauth.py

@@ -0,0 +1,60 @@
+from abc import ABC, abstractmethod
+from typing import Awaitable, Dict
+
+
+class OauthProvider(ABC):
+    """
+    Base class for oauth authentication. This provider will be used for oauth authentication flows.
+    The current oauth for Mage is as follows:
+
+    1. Mage client will make a request to the server to get the auth url to get the authorization
+       code for the provider. (get_auth_url_response)
+    2. Mage client redirects to the auth url and the user will sign in to the provider and grant
+       Mage access to the user's profile.
+    3. The provider will redirect back to the Mage oauth route (/oauth) with the authorization code.
+    4. Mage client will make another request to the server with the authorization code to get the
+       access token. The server will make a request to the provider with the authorization code
+       and return the access token. (get_access_token_response)
+    5. Mage client will redirect to the redirect uri with the access token and provider in the
+       query params.
+    """
+
+    @abstractmethod
+    def get_auth_url_response(self, **kwargs) -> Dict:
+        """
+        This method should construct the auth url to start the oauth flow.
+
+        Kwargs:
+            redirect_uri (str): the redirect uri to be used after the oauth provider returns
+
+        Returns:
+            Dict: a dict with the following keys:
+                url: auth url to redirect to start oauth flow
+                redirect_query_params (optional): query params to be added to the redirect url
+                    after the oauth provider returns the authorization code. This is used when
+                    the provider expects an exact redirect_uri match and query params cannot
+                    be included in the url.
+        """
+        pass
+
+    @abstractmethod
+    async def get_access_token_response(self, code: str, **kwargs) -> Awaitable[Dict]:
+        """
+        This method should call the oauth provider with the authorization code and return
+        a dictionary containing an access token for the user.
+
+        Args:
+            code (str): the authorization code returned by the oauth provider
+
+        Kwargs:
+            redirect_uri (str): the redirect uri to be used after the access token is fetched
+
+        Returns:
+            Dict: a dict with the following keys:
+                url: auth url to redirect to start oauth flow
+                redirect_query_params (optional): query params to be added to the redirect url
+                    after the oauth provider returns the authorization code. This is used when
+                    the provider expects an exact redirect_uri match and query params cannot
+                    be included in the url.
+        """
+        pass

mage_ai/authentication/providers/okta.py

@@ -0,0 +1,101 @@
+import urllib.parse
+import uuid
+from typing import Awaitable, Dict
+
+import aiohttp
+from aiohttp import BasicAuth
+
+from mage_ai.authentication.oauth.constants import OAUTH_PROVIDER_OKTA
+from mage_ai.authentication.providers.oauth import OauthProvider
+from mage_ai.authentication.providers.sso import SsoProvider
+from mage_ai.authentication.providers.utils import get_base_url
+from mage_ai.settings.sso import OKTA_CLIENT_ID, OKTA_CLIENT_SECRET, OKTA_DOMAIN_URL
+
+
+class OktaProvider(SsoProvider, OauthProvider):
+    provider = OAUTH_PROVIDER_OKTA
+
+    def __init__(self):
+        self.hostname = OKTA_DOMAIN_URL
+        self.__validate()
+
+        if not self.hostname.startswith('https'):
+            self.hostname = f'https://{self.hostname}'
+
+    def __validate(self):
+        if not self.hostname:
+            raise Exception(
+                'Okta hostname is empty. '
+                'Make sure the OKTA_DOMAIN_URL environment variable is set.')
+        if not OKTA_CLIENT_ID:
+            raise Exception(
+                'Okta client id is empty. '
+                'Make sure the OKTA_CLIENT_ID environment variable is set.')
+        if not OKTA_CLIENT_SECRET:
+            raise Exception(
+                'Okta client secret is empty. '
+                'Make sure the OKTA_CLIENT_SECRET environment variable is set.')
+
+    def get_auth_url_response(self, redirect_uri: str = None, **kwargs) -> Dict:
+        base_url = get_base_url(redirect_uri)
+        redirect_uri_query = dict(
+            provider=self.provider,
+            redirect_uri=redirect_uri,
+        )
+        query = dict(
+            client_id=OKTA_CLIENT_ID,
+            redirect_uri=urllib.parse.quote_plus(
+                f'{base_url}/oauth',
+            ),
+            response_mode='query',
+            response_type='code',
+            scope='openid email profile',
+            state=uuid.uuid4().hex,
+        )
+        query_strings = []
+        for k, v in query.items():
+            query_strings.append(f'{k}={v}')
+
+        return dict(
+            url=f"{self.hostname}/oauth2/default/v1/authorize?{'&'.join(query_strings)}",
+            redirect_query_params=redirect_uri_query,
+        )
+
+    async def get_access_token_response(self, code: str, **kwargs) -> Awaitable[Dict]:
+        base_url = get_base_url(kwargs.get('redirect_uri'))
+        data = dict()
+        async with aiohttp.ClientSession() as session:
+            async with session.post(
+                f'{self.hostname}/oauth2/default/v1/token',
+                headers={
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                data=dict(
+                    grant_type='authorization_code',
+                    code=code,
+                    redirect_uri=f'{base_url}/oauth',
+                ),
+                auth=BasicAuth(OKTA_CLIENT_ID, OKTA_CLIENT_SECRET),
+                timeout=20,
+            ) as response:
+                data = await response.json()
+
+        return data
+
+    async def get_user_info(self, access_token: str = None, **kwargs) -> Awaitable[Dict]:
+        if access_token is None:
+            raise Exception('Access token is required to fetch user info.')
+        async with aiohttp.ClientSession() as session:
+            async with session.get(
+                f'{self.hostname}/oauth2/default/v1/userinfo',
+                headers={
+                    'Authorization': f'Bearer {access_token}'
+                },
+                timeout=10,
+            ) as response:
+                userinfo_resp = await response.json()
+
+        return dict(
+            email=userinfo_resp.get('email'),
+            username=userinfo_resp.get('sub'),
+        )