oauthlib 3.2.1__tar.gz → 3.3.0__tar.gz

{oauthlib-3.2.1 → oauthlib-3.3.0}/CHANGELOG.rst

@@ -1,11 +1,39 @@
 Changelog
 =========
 
+3.3.0 (2025-06-17):
+------------------
+OAuth2.0 Provider:
+* OIDC: #879 Changed in how ui_locales is parsed
+* RFC8628: Added OAuth2.0 Device Authorization Grant support
+* PKCE: #876, #893 Fixed `create_code_verifier` length
+* OIDC: Pre-configured OIDC server to use Refresh Token by default
+
+OAuth2.0 Common:
+* OAuth2Error: Allow 0 to be a valid state
+
+OAuth2.0 Client:
+* #745: expires_at is forced to be an int
+* #899: expires_at clarification
+
+General:
+* Removed Python 3.5, 3.6, 3.7 support
+* #859, #883: Added Python 3.12, 3.13 Support
+* Added dependency-review GitHub Action
+* Updated various references of license (SPDX identifier..)
+* Added GitHub Action for lint, replaced bandy with ruff, removed isort...
+* Migrated to GitHub Actions from Travis
+* Added Security Policy
+
+3.2.2 (2022-10-17)
+------------------
+OAuth2.0 Provider:
+* CVE-2022-36087
+
 3.2.1 (2022-09-09)
 ------------------
 OAuth2.0 Provider:
 * #803: Metadata endpoint support of non-HTTPS
-* CVE-2022-36087
 
 OAuth1.0:
 * #818: Allow IPv6 being parsed by signature

{oauthlib-3.2.1 → oauthlib-3.3.0}/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2019 The OAuthlib Community
+Copyright (c) The OAuthlib Community
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
@@ -11,14 +11,14 @@ modification, are permitted provided that the following conditions are met:
        notice, this list of conditions and the following disclaimer in the
        documentation and/or other materials provided with the distribution.
 
-    3. Neither the name of this project nor the names of its contributors may
-       be used to endorse or promote products derived from this software without
-       specific prior written permission.
+    3. Neither the name of the copyright holder nor the names of its
+       contributors may be used to endorse or promote products derived from this
+       software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER

{oauthlib-3.2.1/oauthlib.egg-info → oauthlib-3.3.0}/PKG-INFO

@@ -1,50 +1,65 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: oauthlib
-Version: 3.2.1
+Version: 3.3.0
 Summary: A generic, spec-compliant, thorough implementation of the OAuth request-signing logic
 Home-page: https://github.com/oauthlib/oauthlib
 Author: The OAuthlib Community
-Author-email: idan@gazit.me
-Maintainer: Ib Lundgren
-Maintainer-email: ib.lundgren@gmail.com
-License: BSD
+Maintainer: Jonathan Huot
+Maintainer-email: jonathan.huot@gmail.com
+License: BSD-3-Clause
 Platform: any
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Web Environment
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved
-Classifier: License :: OSI Approved :: BSD License
 Classifier: Operating System :: MacOS
 Classifier: Operating System :: POSIX
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.6
-Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Programming Language :: Python :: Implementation
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.6
+Requires-Python: >=3.8
 Description-Content-Type: text/x-rst
+License-File: LICENSE
 Provides-Extra: rsa
+Requires-Dist: cryptography>=3.0.0; extra == "rsa"
 Provides-Extra: signedtoken
+Requires-Dist: cryptography>=3.0.0; extra == "signedtoken"
+Requires-Dist: pyjwt<3,>=2.0.0; extra == "signedtoken"
 Provides-Extra: signals
-License-File: LICENSE
+Requires-Dist: blinker>=1.4.0; extra == "signals"
+Dynamic: author
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: license-file
+Dynamic: maintainer
+Dynamic: maintainer-email
+Dynamic: platform
+Dynamic: provides-extra
+Dynamic: requires-python
+Dynamic: summary
 
 OAuthLib - Python Framework for OAuth1 & OAuth2
 ===============================================
 
 *A generic, spec-compliant, thorough implementation of the OAuth request-signing
-logic for Python 3.6+.*
+logic for Python 3.8+*
 
-.. image:: https://app.travis-ci.com/oauthlib/oauthlib.svg?branch=master
-  :target: https://app.travis-ci.com/oauthlib/oauthlib
-  :alt: Travis
+.. image:: https://github.com/oauthlib/oauthlib/actions/workflows/python-build.yml/badge.svg
+  :target: https://github.com/oauthlib/oauthlib/actions
+  :alt: GitHub Actions
 .. image:: https://coveralls.io/repos/oauthlib/oauthlib/badge.svg?branch=master
   :target: https://coveralls.io/r/oauthlib/oauthlib
   :alt: Coveralls
@@ -113,7 +128,9 @@ Which web frameworks are supported?
 
 The following packages provide OAuth support using OAuthLib.
 
-- For Django there is `django-oauth-toolkit`_, which includes `Django REST framework`_ support.
+- For Django there is:
+  - `django-oauth-toolkit`_, which includes `Django REST framework`_ support.
+  - `django-allauth`_, which includes `Django REST framework`_ as well as `Django Ninja`_ support.
 - For Flask there is `flask-oauthlib`_ and `Flask-Dance`_.
 - For Pyramid there is `pyramid-oauthlib`_.
 - For Bottle there is `bottle-oauthlib`_.
@@ -127,6 +144,8 @@ please open a Pull Request, updating the documentation.
 .. _`Flask-Dance`: https://github.com/singingwolfboy/flask-dance
 .. _`pyramid-oauthlib`: https://github.com/tilgovi/pyramid-oauthlib
 .. _`bottle-oauthlib`: https://github.com/thomsonreuters/bottle-oauthlib
+.. _`django-allauth`: https://allauth.org/
+.. _`Django Ninja`: https://django-ninja.dev/
 
 Using OAuthLib? Please get in touch!
 ------------------------------------
@@ -148,7 +167,7 @@ have the pleasure to run into each other, please send a docs pull request =)
 License
 -------
 
-OAuthLib is yours to use and abuse according to the terms of the BSD license.
+OAuthLib is yours to use and abuse according to the terms of the BSD-3-Clause license.
 Check the LICENSE file for full details.
 
 Credits
@@ -173,5 +192,3 @@ details.
 .. _`supported features`: https://oauthlib.readthedocs.io/en/latest/feature_matrix.html
 
 For a full changelog see ``CHANGELOG.rst``.
-
-

{oauthlib-3.2.1 → oauthlib-3.3.0}/README.rst

@@ -2,11 +2,11 @@ OAuthLib - Python Framework for OAuth1 & OAuth2
 ===============================================
 
 *A generic, spec-compliant, thorough implementation of the OAuth request-signing
-logic for Python 3.6+.*
+logic for Python 3.8+*
 
-.. image:: https://app.travis-ci.com/oauthlib/oauthlib.svg?branch=master
-  :target: https://app.travis-ci.com/oauthlib/oauthlib
-  :alt: Travis
+.. image:: https://github.com/oauthlib/oauthlib/actions/workflows/python-build.yml/badge.svg
+  :target: https://github.com/oauthlib/oauthlib/actions
+  :alt: GitHub Actions
 .. image:: https://coveralls.io/repos/oauthlib/oauthlib/badge.svg?branch=master
   :target: https://coveralls.io/r/oauthlib/oauthlib
   :alt: Coveralls
@@ -75,7 +75,9 @@ Which web frameworks are supported?
 
 The following packages provide OAuth support using OAuthLib.
 
-- For Django there is `django-oauth-toolkit`_, which includes `Django REST framework`_ support.
+- For Django there is:
+  - `django-oauth-toolkit`_, which includes `Django REST framework`_ support.
+  - `django-allauth`_, which includes `Django REST framework`_ as well as `Django Ninja`_ support.
 - For Flask there is `flask-oauthlib`_ and `Flask-Dance`_.
 - For Pyramid there is `pyramid-oauthlib`_.
 - For Bottle there is `bottle-oauthlib`_.
@@ -89,6 +91,8 @@ please open a Pull Request, updating the documentation.
 .. _`Flask-Dance`: https://github.com/singingwolfboy/flask-dance
 .. _`pyramid-oauthlib`: https://github.com/tilgovi/pyramid-oauthlib
 .. _`bottle-oauthlib`: https://github.com/thomsonreuters/bottle-oauthlib
+.. _`django-allauth`: https://allauth.org/
+.. _`Django Ninja`: https://django-ninja.dev/
 
 Using OAuthLib? Please get in touch!
 ------------------------------------
@@ -110,7 +114,7 @@ have the pleasure to run into each other, please send a docs pull request =)
 License
 -------
 
-OAuthLib is yours to use and abuse according to the terms of the BSD license.
+OAuthLib is yours to use and abuse according to the terms of the BSD-3-Clause license.
 Check the LICENSE file for full details.
 
 Credits

oauthlib-3.3.0/examples/device_code_flow.py

@@ -0,0 +1,260 @@
+import enum
+import json
+import datetime
+from datetime import timedelta
+
+from oauthlib.oauth2 import RequestValidator, Server, DeviceApplicationServer
+from oauthlib.oauth2.rfc8628 import errors as device_flow_errors
+from oauthlib.oauth2.rfc8628.errors import AccessDenied, AuthorizationPendingError, ExpiredTokenError, SlowDownError
+
+
+"""
+A pseudocode implementation of the device flow code under an Oauth2 provider.
+
+This example is not concerned with openid in any way.
+
+This example is also not a 1:1 pseudocode implementation. Please refer to the rfc
+for the full details.
+https://datatracker.ietf.org/doc/html/rfc8628
+
+This module is just acting as a way to demonstrate the main pieces
+needed in oauthlib to implement the flow
+
+
+We also assume you already have the /token & /login endpoint in your provider.
+
+Your provider will also need the following endpoints(which will be discussed
+in the example below):
+  - /device_authorization (part of rfc)
+  - /device (part of rfc)
+  - /approve-deny (up to your implementation, this is an example)
+"""
+
+
+"""
+Device flow pseudocode implementation step by step:
+    0. Providing some way to represent the device flow session
+
+    Some python object to represent the current state of the device during
+    the device flow. This, for example, could be an object that persists
+    and represents the device in a database
+"""
+
+
+class Device:
+    class DeviceFlowStatus(enum.Enum):
+        AUTHORIZED = "Authorized"
+        AUTHORIZATION_PENDING = "Authorization_pending"
+        EXPIRED = "Expired"
+        DENIED = "Denied"
+
+    # https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+    # https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
+    id = ...  # if Device is representing a database object, this will be the id of that row
+    device_code = ...
+    user_code = ...
+    scope = ...
+    interval = ...  # in seconds, default is 5
+    expires = ...  # seconds
+    status = ...  # DeviceFlowStatus with AUTHORIZATION_PENDING as the default
+
+    client_id = ...
+    last_checked = ...  # datetime
+
+
+"""
+    1. User goes on their device(client) and the client sends a request to /device_authorization
+    against the provider:
+    https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
+    https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+
+
+    POST /device_authorization HTTP/1.1
+      Host: server.example.com
+      Content-Type: application/x-www-form-urlencoded
+
+      client_id=1406020730&scope=example_scope
+
+      Response:
+      HTTP/1.1 200 OK
+      Content-Type: application/json
+      Cache-Control: no-store
+
+      {
+        "device_code": "GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS",
+        "user_code": "WDJB-MJHT",
+        "verification_uri": "https://example.com/device",
+        "verification_uri_complete":
+            "https://example.com/device?user_code=WDJB-MJHT",
+        "expires_in": 1800,
+        "interval": 5
+      }
+"""
+
+
+class DeviceAuthorizationEndpoint:
+    @staticmethod
+    def create_device_authorization_response(request):
+        server = DeviceApplicationServer(interval=5, verification_uri="https://example.com/device")
+        return server.create_device_authorization_response(request)
+
+    def post(self, request):
+        headers, data, status = self.create_device_authorization_response(request)
+        device_response = ...
+
+        # Create an instance of examples.device_flow.Device` using `request` and `data`that encapsulates
+        # https://datatracker.ietf.org/doc/html/rfc8628#section-3.1 &
+        # https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+
+        return device_response
+
+
+"""
+    2. Client presents the information to the user
+    (There's a section on non visual capable devices as well
+    https://datatracker.ietf.org/doc/html/rfc8628#section-5.7)
+          +-------------------------------------------------+
+            |                                                 |
+            |  Scan the QR code or, using     +------------+  |
+            |  a browser on another device,   |[_]..  . [_]|  |
+            |  visit:                         | .  ..   . .|  |
+            |  https://example.com/device     | . .  . ....|  |
+            |                                 |.   . . .   |  |
+            |  And enter the code:            |[_]. ... .  |  |
+            |  WDJB-MJHT                      +------------+  |
+            |                                                 |
+            +-------------------------------------------------+
+"""
+# The implementation for step 2 is up to the owner of device.
+
+
+""""
+    3 (The browser flow). User goes to https://example.com/device where they're presented with a
+    form to fill in the user code.
+
+    Implement that endpoint on your provider and follow the logic in the rfc.
+
+    Making use of the errors in `oauthlib.oauth2.rfc8628.errors`
+
+    raise AccessDenied/AuthorizationPendingError/ExpiredTokenError where appropriate making use of
+    `examples.device_flow.Device` to get and update current state of the device during the session
+
+    If the user isn't logged in(after inputting the user-code), they should be redirected to the provider's /login
+    endpoint and redirected back to an /approve-deny endpoint(The name and implementation of /approve-deny is up
+    to the owner of the provider, this is just an example).
+    They should then see an "approve" or "deny" button to authorize the device.
+
+    Again, using `examples.device_flow.Device` to update the status appropriately during the session.
+"""
+# /device and /approve-deny is up to the owner of the provider to implement. Again, make sure to
+# keep referring to the rfc when implementing.
+
+
+"""
+4 (The polling flow)
+    https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
+    https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
+
+
+    Right after step 2, the device polls the /token endpoint every "interval" amount of seconds
+    to check if user has approved or denied the request.
+
+    When grant type is `urn:ietf:params:oauth:grant-type:device_code`,
+    `oauthlib.oauth2.rfc8628.grant_types.device_code.DeviceCodeGrant` will be the handler
+    that handles token generation.
+"""
+
+
+# This is purely for illustrative purposes
+# to demonstrate rate limiting on the token endpoint for the device flow.
+# It is up to as the provider to decide how you want
+# to rate limit the device during polling.
+def rate_limit(func, rate="1/5s"):
+    def wrapper():
+        # some logic to ensure client device is rate limited by a minimum
+        # of 1 request every 5 seconds during device polling
+        # https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+
+        # use device_code to retrieve device
+        device = Device
+
+        # get the time in seconds since the device polled the /token endpoint
+        now = datetime.datetime.now(tz=datetime.UTC)
+        diff = now - timedelta(device.last_checked)
+        total_seconds_since_last_device_poll = diff.total_seconds()
+
+        device.last_checked = now
+
+        # for illustrative purposes. 1/5s means 1 request every 5 seconds.
+        # so if `total_seconds_since_last_device_poll` is 4 seconds, this will
+        # raise an error
+        if total_seconds_since_last_device_poll < rate:
+            raise device_flow_errors.SlowDownError()
+
+        result = func()
+        return result
+
+    return wrapper
+
+
+class ExampleRequestValidator(RequestValidator):
+    # All the other methods that need to be implemented...
+    # see examples.skeleton_oauth2_web_application_server.SkeletonValidator
+    # for a more complete example.
+
+    # Here our main concern is this method:
+    def create_token_response(self): ...
+
+
+class ServerSetupForTokenEndpoint:
+    def __init__(self):
+        validator = ExampleRequestValidator
+        self.server = Server(validator)
+
+
+# You should already have the /token endpoint implemented in your provider.
+class TokenEndpoint(ServerSetupForTokenEndpoint):
+    def default_flow_token_response(self, request):
+        url, headers, body, status = self.server.create_token_response(request)
+        access_token = json.loads(body).get("access_token")
+
+        # return access_token in a http response
+        return access_token
+
+    @rate_limit  # this will raise the SlowDownError
+    def device_flow_token_response(self, request, device_code):
+        """
+        Following the rfc, this will route the device request accordingly and raise
+        required errors.
+
+        Remember that unlike other auth flows, the device if polling this endpoint once
+        every "interval" amount of seconds.
+        """
+        # using device_code arg to retrieve the correct device object instance
+        device = Device
+
+        if device.status == device.DeviceFlowStatus.AUTHORIZATION_PENDING:
+            raise AuthorizationPendingError()
+
+        # If user clicked "deny" in the /approve-deny page endpoint.
+        # the device gets set to 'authorized' in /approve-deny and /device checks
+        # if someone tries to input a code for a user code that's already been authorized
+        if device.status == device.DeviceFlowStatus.DENIED:
+            raise AccessDenied()
+
+        url, headers, body, status = self.server.create_token_response(request)
+
+        access_token = json.loads(body).get("access_token")
+
+        device.status = device.EXPIRED
+
+        # return access_token in a http response
+        return access_token
+
+    # Example of how token endpoint could handle the token creation depending on
+    # the grant type during a POST to /token.
+    def post(self, request):
+        params = request.POST
+        if params.get("grant_type") == "urn:ietf:params:oauth:grant-type:device_code":
+            return self.device_flow_token_response(request, params["device_code"])
+        return self.default_flow_token_response(request)

oauthlib-3.3.0/examples/skeleton_oauth2_web_application_server.py

@@ -0,0 +1,114 @@
+# Skeleton for an OAuth 2 Web Application Server which is an OAuth
+# provider configured for Authorization Code, Refresh Token grants and
+# for dispensing Bearer Tokens.
+
+# This example is meant to act as a supplement to the documentation,
+# see https://oauthlib.readthedocs.io/en/latest/.
+
+from oauthlib.oauth2 import RequestValidator, WebApplicationServer
+
+
+class SkeletonValidator(RequestValidator):
+
+    # Ordered roughly in order of appearance in the authorization grant flow
+
+    # Pre- and post-authorization.
+
+    def validate_client_id(self, client_id, request, *args, **kwargs):
+        # Simple validity check, does client exist? Not banned?
+        pass
+
+    def validate_redirect_uri(self, client_id, redirect_uri, request, *args, **kwargs):
+        # Is the client allowed to use the supplied redirect_uri? i.e. has
+        # the client previously registered this EXACT redirect uri.
+        pass
+
+    def get_default_redirect_uri(self, client_id, request, *args, **kwargs):
+        # The redirect used if none has been supplied.
+        # Prefer your clients to pre register a redirect uri rather than
+        # supplying one on each authorization request.
+        pass
+
+    def validate_scopes(self, client_id, scopes, client, request, *args, **kwargs):
+        # Is the client allowed to access the requested scopes?
+        pass
+
+    def get_default_scopes(self, client_id, request, *args, **kwargs):
+        # Scopes a client will authorize for if none are supplied in the
+        # authorization request.
+        pass
+
+    def validate_response_type(self, client_id, response_type, client, request, *args, **kwargs):
+        # Clients should only be allowed to use one type of response type, the
+        # one associated with their one allowed grant type.
+        # In this case it must be "code".
+        pass
+
+    # Post-authorization
+
+    def save_authorization_code(self, client_id, code, request, *args, **kwargs):
+        # Remember to associate it with request.scopes, request.redirect_uri
+        # request.client and request.user (the last is passed in
+        # post_authorization credentials, i.e. { 'user': request.user}.
+        pass
+
+    # Token request
+
+    def client_authentication_required(self, request, *args, **kwargs):
+        # Check if the client provided authentication information that needs to
+        # be validated, e.g. HTTP Basic auth
+        pass
+
+    def authenticate_client(self, request, *args, **kwargs):
+        # Whichever authentication method suits you, HTTP Basic might work
+        pass
+
+    def authenticate_client_id(self, client_id, request, *args, **kwargs):
+        # The client_id must match an existing public (non-confidential) client
+        pass
+
+    def validate_code(self, client_id, code, client, request, *args, **kwargs):
+        # Validate the code belongs to the client. Add associated scopes
+        # and user to request.scopes and request.user.
+        pass
+
+    def confirm_redirect_uri(self, client_id, code, redirect_uri, client, request, *args, **kwargs):
+        # You did save the redirect uri with the authorization code right?
+        pass
+
+    def validate_grant_type(self, client_id, grant_type, client, request, *args, **kwargs):
+        # Clients should only be allowed to use one type of grant.
+        # In this case, it must be "authorization_code" or "refresh_token"
+        pass
+
+    def save_bearer_token(self, token, request, *args, **kwargs):
+        # Remember to associate it with request.scopes, request.user and
+        # request.client. The two former will be set when you validate
+        # the authorization code. Don't forget to save both the
+        # access_token and the refresh_token and set expiration for the
+        # access_token to now + expires_in seconds.
+        pass
+
+    def invalidate_authorization_code(self, client_id, code, request, *args, **kwargs):
+        # Authorization codes are use once, invalidate it when a Bearer token
+        # has been acquired.
+        pass
+
+    # Protected resource request
+
+    def validate_bearer_token(self, token, scopes, request):
+        # Remember to check expiration and scope membership
+        pass
+
+    # Token refresh request
+
+    def get_original_scopes(self, refresh_token, request, *args, **kwargs):
+        # Obtain the token associated with the given refresh_token and
+        # return its scopes, these will be passed on to the refreshed
+        # access token if the client did not specify a scope during the
+        # request.
+        pass
+
+
+validator = SkeletonValidator()
+server = WebApplicationServer(validator)

{oauthlib-3.2.1 → oauthlib-3.3.0}/oauthlib/__init__.py

@@ -5,30 +5,30 @@
     A generic, spec-compliant, thorough implementation of the OAuth
     request-signing logic.
 
-    :copyright: (c) 2019 by The OAuthlib Community
-    :license: BSD, see LICENSE for details.
+    :copyright: (c) The OAuthlib Community
+    :license: BSD-3-Clause, see LICENSE for details.
 """
 import logging
 from logging import NullHandler
 
 __author__ = 'The OAuthlib Community'
-__version__ = '3.2.1'
+__version__ = '3.3.0'
 
 logging.getLogger('oauthlib').addHandler(NullHandler())
 
 _DEBUG = False
 
 def set_debug(debug_val):
-	"""Set value of debug flag
-	
+    """Set value of debug flag
+
     :param debug_val: Value to set. Must be a bool value.
-	"""
-	global _DEBUG
-	_DEBUG = debug_val
+    """
+    global _DEBUG  # noqa: PLW0603
+    _DEBUG = debug_val
 
 def get_debug():
-	"""Get debug mode value. 
-	
-	:return: `True` if debug mode is on, `False` otherwise
-	"""
-	return _DEBUG	
+    """Get debug mode value.
+
+    :return: `True` if debug mode is on, `False` otherwise
+    """
+    return _DEBUG