oauthlib 3.2.2__tar.gz → 3.3.1__tar.gz

{oauthlib-3.2.2 → oauthlib-3.3.1}/CHANGELOG.rst

@@ -1,6 +1,36 @@
 Changelog
 =========
 
+3.3.1 (2025-06-19):
+------------------
+OAuth2.0 Client:
+* #906: fix regression of expires_in parsing when float in string.
+
+
+3.3.0 (2025-06-17):
+------------------
+OAuth2.0 Provider:
+* OIDC: #879 Changed in how ui_locales is parsed
+* RFC8628: Added OAuth2.0 Device Authorization Grant support
+* PKCE: #876, #893 Fixed `create_code_verifier` length
+* OIDC: Pre-configured OIDC server to use Refresh Token by default
+
+OAuth2.0 Common:
+* OAuth2Error: Allow 0 to be a valid state
+
+OAuth2.0 Client:
+* #745: expires_at is forced to be an int
+* #899: expires_at clarification
+
+General:
+* Removed Python 3.5, 3.6, 3.7 support
+* #859, #883: Added Python 3.12, 3.13 Support
+* Added dependency-review GitHub Action
+* Updated various references of license (SPDX identifier..)
+* Added GitHub Action for lint, replaced bandy with ruff, removed isort...
+* Migrated to GitHub Actions from Travis
+* Added Security Policy
+
 3.2.2 (2022-10-17)
 ------------------
 OAuth2.0 Provider:

{oauthlib-3.2.2 → oauthlib-3.3.1}/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2019 The OAuthlib Community
+Copyright (c) The OAuthlib Community
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
@@ -11,14 +11,14 @@ modification, are permitted provided that the following conditions are met:
        notice, this list of conditions and the following disclaimer in the
        documentation and/or other materials provided with the distribution.
 
-    3. Neither the name of this project nor the names of its contributors may
-       be used to endorse or promote products derived from this software without
-       specific prior written permission.
+    3. Neither the name of the copyright holder nor the names of its
+       contributors may be used to endorse or promote products derived from this
+       software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER

{oauthlib-3.2.2/oauthlib.egg-info → oauthlib-3.3.1}/PKG-INFO

@@ -1,50 +1,65 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: oauthlib
-Version: 3.2.2
+Version: 3.3.1
 Summary: A generic, spec-compliant, thorough implementation of the OAuth request-signing logic
 Home-page: https://github.com/oauthlib/oauthlib
 Author: The OAuthlib Community
-Author-email: idan@gazit.me
-Maintainer: Ib Lundgren
-Maintainer-email: ib.lundgren@gmail.com
-License: BSD
+Maintainer: Jonathan Huot
+Maintainer-email: jonathan.huot@gmail.com
+License: BSD-3-Clause
 Platform: any
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Web Environment
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved
-Classifier: License :: OSI Approved :: BSD License
 Classifier: Operating System :: MacOS
 Classifier: Operating System :: POSIX
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.6
-Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Programming Language :: Python :: Implementation
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.6
+Requires-Python: >=3.8
 Description-Content-Type: text/x-rst
+License-File: LICENSE
 Provides-Extra: rsa
+Requires-Dist: cryptography>=3.0.0; extra == "rsa"
 Provides-Extra: signedtoken
+Requires-Dist: cryptography>=3.0.0; extra == "signedtoken"
+Requires-Dist: pyjwt<3,>=2.0.0; extra == "signedtoken"
 Provides-Extra: signals
-License-File: LICENSE
+Requires-Dist: blinker>=1.4.0; extra == "signals"
+Dynamic: author
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: license-file
+Dynamic: maintainer
+Dynamic: maintainer-email
+Dynamic: platform
+Dynamic: provides-extra
+Dynamic: requires-python
+Dynamic: summary
 
 OAuthLib - Python Framework for OAuth1 & OAuth2
 ===============================================
 
 *A generic, spec-compliant, thorough implementation of the OAuth request-signing
-logic for Python 3.6+.*
+logic for Python 3.8+*
 
-.. image:: https://app.travis-ci.com/oauthlib/oauthlib.svg?branch=master
-  :target: https://app.travis-ci.com/oauthlib/oauthlib
-  :alt: Travis
+.. image:: https://github.com/oauthlib/oauthlib/actions/workflows/python-build.yml/badge.svg
+  :target: https://github.com/oauthlib/oauthlib/actions
+  :alt: GitHub Actions
 .. image:: https://coveralls.io/repos/oauthlib/oauthlib/badge.svg?branch=master
   :target: https://coveralls.io/r/oauthlib/oauthlib
   :alt: Coveralls
@@ -113,7 +128,9 @@ Which web frameworks are supported?
 
 The following packages provide OAuth support using OAuthLib.
 
-- For Django there is `django-oauth-toolkit`_, which includes `Django REST framework`_ support.
+- For Django there is:
+  - `django-oauth-toolkit`_, which includes `Django REST framework`_ support.
+  - `django-allauth`_, which includes `Django REST framework`_ as well as `Django Ninja`_ support.
 - For Flask there is `flask-oauthlib`_ and `Flask-Dance`_.
 - For Pyramid there is `pyramid-oauthlib`_.
 - For Bottle there is `bottle-oauthlib`_.
@@ -127,6 +144,8 @@ please open a Pull Request, updating the documentation.
 .. _`Flask-Dance`: https://github.com/singingwolfboy/flask-dance
 .. _`pyramid-oauthlib`: https://github.com/tilgovi/pyramid-oauthlib
 .. _`bottle-oauthlib`: https://github.com/thomsonreuters/bottle-oauthlib
+.. _`django-allauth`: https://allauth.org/
+.. _`Django Ninja`: https://django-ninja.dev/
 
 Using OAuthLib? Please get in touch!
 ------------------------------------
@@ -148,7 +167,7 @@ have the pleasure to run into each other, please send a docs pull request =)
 License
 -------
 
-OAuthLib is yours to use and abuse according to the terms of the BSD license.
+OAuthLib is yours to use and abuse according to the terms of the BSD-3-Clause license.
 Check the LICENSE file for full details.
 
 Credits

{oauthlib-3.2.2 → oauthlib-3.3.1}/README.rst

@@ -2,11 +2,11 @@ OAuthLib - Python Framework for OAuth1 & OAuth2
 ===============================================
 
 *A generic, spec-compliant, thorough implementation of the OAuth request-signing
-logic for Python 3.6+.*
+logic for Python 3.8+*
 
-.. image:: https://app.travis-ci.com/oauthlib/oauthlib.svg?branch=master
-  :target: https://app.travis-ci.com/oauthlib/oauthlib
-  :alt: Travis
+.. image:: https://github.com/oauthlib/oauthlib/actions/workflows/python-build.yml/badge.svg
+  :target: https://github.com/oauthlib/oauthlib/actions
+  :alt: GitHub Actions
 .. image:: https://coveralls.io/repos/oauthlib/oauthlib/badge.svg?branch=master
   :target: https://coveralls.io/r/oauthlib/oauthlib
   :alt: Coveralls
@@ -75,7 +75,9 @@ Which web frameworks are supported?
 
 The following packages provide OAuth support using OAuthLib.
 
-- For Django there is `django-oauth-toolkit`_, which includes `Django REST framework`_ support.
+- For Django there is:
+  - `django-oauth-toolkit`_, which includes `Django REST framework`_ support.
+  - `django-allauth`_, which includes `Django REST framework`_ as well as `Django Ninja`_ support.
 - For Flask there is `flask-oauthlib`_ and `Flask-Dance`_.
 - For Pyramid there is `pyramid-oauthlib`_.
 - For Bottle there is `bottle-oauthlib`_.
@@ -89,6 +91,8 @@ please open a Pull Request, updating the documentation.
 .. _`Flask-Dance`: https://github.com/singingwolfboy/flask-dance
 .. _`pyramid-oauthlib`: https://github.com/tilgovi/pyramid-oauthlib
 .. _`bottle-oauthlib`: https://github.com/thomsonreuters/bottle-oauthlib
+.. _`django-allauth`: https://allauth.org/
+.. _`Django Ninja`: https://django-ninja.dev/
 
 Using OAuthLib? Please get in touch!
 ------------------------------------
@@ -110,7 +114,7 @@ have the pleasure to run into each other, please send a docs pull request =)
 License
 -------
 
-OAuthLib is yours to use and abuse according to the terms of the BSD license.
+OAuthLib is yours to use and abuse according to the terms of the BSD-3-Clause license.
 Check the LICENSE file for full details.
 
 Credits

{oauthlib-3.2.2 → oauthlib-3.3.1}/oauthlib/__init__.py

@@ -5,30 +5,30 @@
     A generic, spec-compliant, thorough implementation of the OAuth
     request-signing logic.
 
-    :copyright: (c) 2019 by The OAuthlib Community
-    :license: BSD, see LICENSE for details.
+    :copyright: (c) The OAuthlib Community
+    :license: BSD-3-Clause, see LICENSE for details.
 """
 import logging
 from logging import NullHandler
 
 __author__ = 'The OAuthlib Community'
-__version__ = '3.2.2'
+__version__ = '3.3.1'
 
 logging.getLogger('oauthlib').addHandler(NullHandler())
 
 _DEBUG = False
 
 def set_debug(debug_val):
-	"""Set value of debug flag
-	
+    """Set value of debug flag
+
     :param debug_val: Value to set. Must be a bool value.
-	"""
-	global _DEBUG
-	_DEBUG = debug_val
+    """
+    global _DEBUG  # noqa: PLW0603
+    _DEBUG = debug_val
 
 def get_debug():
-	"""Get debug mode value. 
-	
-	:return: `True` if debug mode is on, `False` otherwise
-	"""
-	return _DEBUG	
+    """Get debug mode value.
+
+    :return: `True` if debug mode is on, `False` otherwise
+    """
+    return _DEBUG

{oauthlib-3.2.2 → oauthlib-3.3.1}/oauthlib/common.py

@@ -34,7 +34,7 @@ INVALID_HEX_PATTERN = re.compile(r'%[^0-9A-Fa-f]|%[0-9A-Fa-f][^0-9A-Fa-f]')
 
 always_safe = ('ABCDEFGHIJKLMNOPQRSTUVWXYZ'
                'abcdefghijklmnopqrstuvwxyz'
-               '0123456789' '_.-')
+               '0123456789_.-')
 
 log = logging.getLogger('oauthlib')
 
@@ -198,7 +198,7 @@ def generate_token(length=30, chars=UNICODE_ASCII_CHARACTER_SET):
 
 
 def generate_signed_token(private_pem, request):
-    import jwt
+    import jwt  # noqa: PLC0415
 
     now = datetime.datetime.utcnow()
 
@@ -216,7 +216,7 @@ def generate_signed_token(private_pem, request):
 
 
 def verify_signed_token(public_pem, token):
-    import jwt
+    import jwt  # noqa: PLC0415
 
     return jwt.decode(token, public_pem, algorithms=['RS256'])
 
@@ -316,7 +316,7 @@ class CaseInsensitiveDict(dict):
         return super().__getitem__(key)
 
     def get(self, k, default=None):
-        return self[k] if k in self else default
+        return self[k] if k in self else default  # noqa: SIM401
 
     def __setitem__(self, k, v):
         super().__setitem__(k, v)
@@ -346,7 +346,8 @@ class Request:
     def __init__(self, uri, http_method='GET', body=None, headers=None,
                  encoding='utf-8'):
         # Convert to unicode using encoding if given, else assume unicode
-        encode = lambda x: to_unicode(x, encoding) if encoding else x
+        def encode(x):
+            return to_unicode(x, encoding) if encoding else x
 
         self.uri = encode(uri)
         self.http_method = encode(http_method)

{oauthlib-3.2.2 → oauthlib-3.3.1}/oauthlib/oauth1/rfc5849/__init__.py

@@ -121,7 +121,8 @@ class Client:
         :param timestamp: Use this timestamp instead of using current. (Mainly for testing)
         """
         # Convert to unicode using encoding if given, else assume unicode
-        encode = lambda x: to_unicode(x, encoding) if encoding else x
+        def encode(x):
+            return to_unicode(x, encoding) if encoding else x
 
         self.client_key = encode(client_key)
         self.client_secret = encode(client_secret)
@@ -219,7 +220,7 @@ class Client:
         content_type = request.headers.get('Content-Type', None)
         content_type_eligible = content_type and content_type.find('application/x-www-form-urlencoded') < 0
         if request.body is not None and content_type_eligible:
-            params.append(('oauth_body_hash', base64.b64encode(hashlib.sha1(request.body.encode('utf-8')).digest()).decode('utf-8')))
+            params.append(('oauth_body_hash', base64.b64encode(hashlib.sha1(request.body.encode('utf-8')).digest()).decode('utf-8')))  # noqa: S324
 
         return params
 

{oauthlib-3.2.2 → oauthlib-3.3.1}/oauthlib/oauth1/rfc5849/endpoints/base.py

@@ -69,12 +69,10 @@ class BaseEndpoint:
     def _create_request(self, uri, http_method, body, headers):
         # Only include body data from x-www-form-urlencoded requests
         headers = CaseInsensitiveDict(headers or {})
-        if ("Content-Type" in headers and
-                CONTENT_TYPE_FORM_URLENCODED in headers["Content-Type"]):
+        if "Content-Type" in headers and CONTENT_TYPE_FORM_URLENCODED in headers["Content-Type"]:  # noqa: SIM108
             request = Request(uri, http_method, body, headers)
         else:
             request = Request(uri, http_method, '', headers)
-
         signature_type, params, oauth_params = (
             self._get_signature_type_and_params(request))
 
@@ -129,8 +127,7 @@ class BaseEndpoint:
         # Considerations section (`Section 4`_) before deciding on which
         # method to support.
         # .. _`Section 4`: https://tools.ietf.org/html/rfc5849#section-4
-        if (not request.signature_method in
-                self.request_validator.allowed_signature_methods):
+        if (request.signature_method not in self.request_validator.allowed_signature_methods):
             raise errors.InvalidSignatureMethodError(
                 description="Invalid signature, {} not in {!r}.".format(
                     request.signature_method,
@@ -180,9 +177,7 @@ class BaseEndpoint:
 
     def _check_signature(self, request, is_token_request=False):
         # ---- RSA Signature verification ----
-        if request.signature_method == SIGNATURE_RSA_SHA1 or \
-           request.signature_method == SIGNATURE_RSA_SHA256 or \
-           request.signature_method == SIGNATURE_RSA_SHA512:
+        if request.signature_method in {SIGNATURE_RSA_SHA1, SIGNATURE_RSA_SHA256, SIGNATURE_RSA_SHA512}:
             # RSA-based signature method
 
             # The server verifies the signature per `[RFC3447] section 8.2.2`_

{oauthlib-3.2.2 → oauthlib-3.3.1}/oauthlib/oauth1/rfc5849/signature.py

@@ -45,6 +45,7 @@ import warnings
 from oauthlib.common import extract_params, safe_string_equals, urldecode
 
 from . import utils
+import contextlib
 
 log = logging.getLogger(__name__)
 
@@ -188,10 +189,9 @@ def base_string_uri(uri: str, host: str = None) -> str:
         raise ValueError('missing host')
 
     # NOTE: Try guessing if we're dealing with IP or hostname
-    try:
+    with contextlib.suppress(ValueError):
         hostname = ipaddress.ip_address(hostname)
-    except ValueError:
-        pass
+
 
     if isinstance(hostname, ipaddress.IPv6Address):
         hostname = f"[{hostname}]"
@@ -568,7 +568,7 @@ def _get_jwt_rsa_algorithm(hash_algorithm_name: str):
         # Not in cache: instantiate a new RSAAlgorithm
 
         # PyJWT has some nice pycrypto/cryptography abstractions
-        import jwt.algorithms as jwt_algorithms
+        import jwt.algorithms as jwt_algorithms  # noqa: PLC0415
         m = {
             'SHA-1': jwt_algorithms.hashes.SHA1,
             'SHA-256': jwt_algorithms.hashes.SHA256,

{oauthlib-3.2.2 → oauthlib-3.3.1}/oauthlib/oauth1/rfc5849/utils.py

@@ -30,7 +30,8 @@ def filter_params(target):
 
 def filter_oauth_params(params):
     """Removes all non oauth parameters from a dict or a list of params."""
-    is_oauth = lambda kv: kv[0].startswith("oauth_")
+    def is_oauth(kv):
+        return kv[0].startswith('oauth_')
     if isinstance(params, dict):
         return list(filter(is_oauth, list(params.items())))
     else:
@@ -59,7 +60,7 @@ def unescape(u):
     return unquote(u)
 
 
-def parse_keqv_list(l):
+def parse_keqv_list(l):  # noqa: E741
     """A unicode-safe version of urllib2.parse_keqv_list"""
     # With Python 2.6, parse_http_list handles unicode fine
     return urllib2.parse_keqv_list(l)

oauthlib-3.3.1/oauthlib/oauth2/__init__.py

@@ -0,0 +1,70 @@
+"""
+oauthlib.oauth2
+~~~~~~~~~~~~~~
+
+This module is a wrapper for the most recent implementation of OAuth 2.0 Client
+and Server classes.
+"""
+
+from .rfc6749.clients import (
+    BackendApplicationClient,
+    Client,
+    LegacyApplicationClient,
+    MobileApplicationClient,
+    ServiceApplicationClient,
+    WebApplicationClient,
+)
+from .rfc6749.endpoints import (
+    AuthorizationEndpoint,
+    BackendApplicationServer,
+    IntrospectEndpoint,
+    LegacyApplicationServer,
+    MetadataEndpoint,
+    MobileApplicationServer,
+    ResourceEndpoint,
+    RevocationEndpoint,
+    Server,
+    TokenEndpoint,
+    WebApplicationServer,
+)
+from .rfc6749.errors import (
+    AccessDeniedError,
+    FatalClientError,
+    InsecureTransportError,
+    InvalidClientError,
+    InvalidClientIdError,
+    InvalidGrantError,
+    InvalidRedirectURIError,
+    InvalidRequestError,
+    InvalidRequestFatalError,
+    InvalidScopeError,
+    MismatchingRedirectURIError,
+    MismatchingStateError,
+    MissingClientIdError,
+    MissingCodeError,
+    MissingRedirectURIError,
+    MissingResponseTypeError,
+    MissingTokenError,
+    MissingTokenTypeError,
+    OAuth2Error,
+    ServerError,
+    TemporarilyUnavailableError,
+    TokenExpiredError,
+    UnauthorizedClientError,
+    UnsupportedGrantTypeError,
+    UnsupportedResponseTypeError,
+    UnsupportedTokenTypeError,
+)
+from .rfc6749.grant_types import (
+    AuthorizationCodeGrant,
+    ClientCredentialsGrant,
+    ImplicitGrant,
+    RefreshTokenGrant,
+    ResourceOwnerPasswordCredentialsGrant,
+)
+from .rfc6749.request_validator import RequestValidator
+from .rfc6749.tokens import BearerToken, OAuth2Token
+from .rfc6749.utils import is_secure_transport
+from .rfc8628.clients import DeviceClient
+from oauthlib.oauth2.rfc8628.endpoints import DeviceAuthorizationEndpoint, DeviceApplicationServer
+from oauthlib.oauth2.rfc8628.grant_types import DeviceCodeGrant

{oauthlib-3.2.2 → oauthlib-3.3.1}/oauthlib/oauth2/rfc6749/clients/base.py

@@ -8,17 +8,16 @@ for consuming OAuth 2.0 RFC6749.
 """
 import base64
 import hashlib
-import re
-import secrets
 import time
 import warnings
 
-from oauthlib.common import generate_token
+from oauthlib.common import UNICODE_ASCII_CHARACTER_SET, generate_token
 from oauthlib.oauth2.rfc6749 import tokens
 from oauthlib.oauth2.rfc6749.errors import (
     InsecureTransportError, TokenExpiredError,
 )
 from oauthlib.oauth2.rfc6749.parameters import (
+    parse_expires,
     parse_token_response, prepare_token_request,
     prepare_token_revocation_request,
 )
@@ -207,7 +206,7 @@ class Client:
 
         case_insensitive_token_types = {
             k.lower(): v for k, v in self.token_types.items()}
-        if not self.token_type.lower() in case_insensitive_token_types:
+        if self.token_type.lower() not in case_insensitive_token_types:
             raise ValueError("Unsupported token type: %s" % self.token_type)
 
         if not (self.access_token or self.token.get('access_token')):
@@ -466,7 +465,7 @@ class Client:
         return uri, headers, body
 
     def create_code_verifier(self, length):
-        """Create PKCE **code_verifier** used in computing **code_challenge**. 
+        """Create PKCE **code_verifier** used in computing **code_challenge**.
         See `RFC7636 Section 4.1`_
 
         :param length: REQUIRED. The length of the code_verifier.
@@ -491,11 +490,7 @@ class Client:
         if not length <= 128:
             raise ValueError("Length must be less than or equal to 128")
 
-        allowed_characters = re.compile('^[A-Zaa-z0-9-._~]')
-        code_verifier = secrets.token_urlsafe(length)
-
-        if not re.search(allowed_characters, code_verifier):
-            raise ValueError("code_verifier contains invalid characters")
+        code_verifier = generate_token(length, UNICODE_ASCII_CHARACTER_SET + "-._~")
 
         self.code_verifier = code_verifier
 
@@ -530,10 +525,10 @@ class Client:
         """
         code_challenge = None
 
-        if code_verifier == None:
+        if code_verifier is None:
             raise ValueError("Invalid code_verifier")
 
-        if code_challenge_method == None:
+        if code_challenge_method is None:
             code_challenge_method = "plain"
             self.code_challenge_method = code_challenge_method
             code_challenge = code_verifier
@@ -587,15 +582,13 @@ class Client:
         if 'token_type' in response:
             self.token_type = response.get('token_type')
 
-        if 'expires_in' in response:
-            self.expires_in = response.get('expires_in')
-            self._expires_at = time.time() + int(self.expires_in)
-
-        if 'expires_at' in response:
-            try:
-                self._expires_at = int(response.get('expires_at'))
-            except:
-                self._expires_at = None
+        vin, vat, v_at = parse_expires(response)
+        if vin:
+            self.expires_in = vin
+        if vat:
+            self.expires_at = vat
+        if v_at:
+            self._expires_at = v_at
 
         if 'mac_key' in response:
             self.mac_key = response.get('mac_key')

{oauthlib-3.2.2 → oauthlib-3.3.1}/oauthlib/oauth2/rfc6749/clients/mobile_application.py

@@ -43,7 +43,7 @@ class MobileApplicationClient(Client):
     redirection URI, it may be exposed to the resource owner and other
     applications residing on the same device.
     """
-    
+
     response_type = 'token'
 
     def prepare_request_uri(self, uri, redirect_uri=None, scope=None,

{oauthlib-3.2.2 → oauthlib-3.3.1}/oauthlib/oauth2/rfc6749/clients/service_application.py

@@ -91,7 +91,7 @@ class ServiceApplicationClient(Client):
                          ``https://provider.com/oauth2/token``.
 
         :param expires_at: A unix expiration timestamp for the JWT. Defaults
-                           to an hour from now, i.e. ``time.time() + 3600``.
+                           to an hour from now, i.e. ``round(time.time()) + 3600``.
 
         :param issued_at: A unix timestamp of when the JWT was created.
                           Defaults to now, i.e. ``time.time()``.
@@ -149,7 +149,7 @@ class ServiceApplicationClient(Client):
 
         .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1
         """
-        import jwt
+        import jwt  # noqa: PLC0415
 
         key = private_key or self.private_key
         if not key:

{oauthlib-3.2.2 → oauthlib-3.3.1}/oauthlib/oauth2/rfc6749/clients/web_application.py

@@ -33,7 +33,7 @@ class WebApplicationClient(Client):
     browser) and capable of receiving incoming requests (via redirection)
     from the authorization server.
     """
-    
+
     grant_type = 'authorization_code'
 
     def __init__(self, client_id, code=None, **kwargs):
@@ -62,8 +62,8 @@ class WebApplicationClient(Client):
                         to the client.  The parameter SHOULD be used for preventing
                         cross-site request forgery as described in `Section 10.12`_.
 
-        :param code_challenge: OPTIONAL. PKCE parameter. REQUIRED if PKCE is enforced. 
-                        A challenge derived from the code_verifier that is sent in the 
+        :param code_challenge: OPTIONAL. PKCE parameter. REQUIRED if PKCE is enforced.
+                        A challenge derived from the code_verifier that is sent in the
                         authorization request, to be verified against later.
 
         :param code_challenge_method: OPTIONAL. PKCE parameter. A method that was used to derive code challenge.

{oauthlib-3.2.2 → oauthlib-3.3.1}/oauthlib/oauth2/rfc6749/endpoints/base.py

@@ -32,7 +32,7 @@ class BaseEndpoint:
         if valid_request_methods is not None:
             valid_request_methods = [x.upper() for x in valid_request_methods]
         self._valid_request_methods = valid_request_methods
-    
+
 
     @property
     def available(self):
@@ -40,7 +40,7 @@ class BaseEndpoint:
 
     @available.setter
     def available(self, available):
-        self._available = available       
+        self._available = available
 
     @property
     def catch_errors(self):

{oauthlib-3.2.2 → oauthlib-3.3.1}/oauthlib/oauth2/rfc6749/endpoints/introspect.py

@@ -74,7 +74,7 @@ class IntrospectEndpoint(BaseEndpoint):
             request
         )
         if claims is None:
-            return resp_headers, json.dumps(dict(active=False)), 200
+            return resp_headers, json.dumps({'active': False}), 200
         if "active" in claims:
             claims.pop("active")
         return resp_headers, json.dumps(dict(active=True, **claims)), 200

{oauthlib-3.2.2 → oauthlib-3.3.1}/oauthlib/oauth2/rfc6749/endpoints/metadata.py

@@ -38,9 +38,9 @@ class MetadataEndpoint(BaseEndpoint):
    """
 
     def __init__(self, endpoints, claims={}, raise_errors=True):
-        assert isinstance(claims, dict)
+        assert isinstance(claims, dict)  # noqa: S101
         for endpoint in endpoints:
-            assert isinstance(endpoint, BaseEndpoint)
+            assert isinstance(endpoint, BaseEndpoint)  # noqa: S101
 
         BaseEndpoint.__init__(self)
         self.raise_errors = raise_errors