oauthlib 3.3.0__tar.gz → 3.3.1__tar.gz

{oauthlib-3.3.0 → oauthlib-3.3.1}/CHANGELOG.rst

@@ -1,6 +1,12 @@
 Changelog
 =========
 
+3.3.1 (2025-06-19):
+------------------
+OAuth2.0 Client:
+* #906: fix regression of expires_in parsing when float in string.
+
+
 3.3.0 (2025-06-17):
 ------------------
 OAuth2.0 Provider:

{oauthlib-3.3.0/oauthlib.egg-info → oauthlib-3.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oauthlib
-Version: 3.3.0
+Version: 3.3.1
 Summary: A generic, spec-compliant, thorough implementation of the OAuth request-signing logic
 Home-page: https://github.com/oauthlib/oauthlib
 Author: The OAuthlib Community

{oauthlib-3.3.0 → oauthlib-3.3.1}/oauthlib/__init__.py

@@ -12,7 +12,7 @@ import logging
 from logging import NullHandler
 
 __author__ = 'The OAuthlib Community'
-__version__ = '3.3.0'
+__version__ = '3.3.1'
 
 logging.getLogger('oauthlib').addHandler(NullHandler())
 

{oauthlib-3.3.0 → oauthlib-3.3.1}/oauthlib/oauth2/rfc6749/parameters.py

@@ -476,7 +476,7 @@ def parse_expires(params):
     """Parse `expires_in`, `expires_at` fields from params
 
     Parse following these rules:
-    - `expires_in` must be either blank or a valid integer.
+    - `expires_in` must be either integer, float or None. If a float, it is converted into an integer.
     - `expires_at` is not in specification so it does its best to:
       - convert into a int, else
       - convert into a float, else
@@ -495,14 +495,16 @@ def parse_expires(params):
     if 'expires_in' in params:
         if isinstance(params.get('expires_in'), int):
             expires_in = params.get('expires_in')
+        elif isinstance(params.get('expires_in'), float):
+            expires_in = int(params.get('expires_in'))
         elif isinstance(params.get('expires_in'), str):
             try:
                 # Attempt to convert to int
                 expires_in = int(params.get('expires_in'))
             except ValueError:
-                raise ValueError("expires_int must be an int")
+                raise ValueError("expires_in must be an int")
         elif params.get('expires_in') is not None:
-            raise ValueError("expires_int must be an int")
+            raise ValueError("expires_in must be an int")
 
     if 'expires_at' in params:
         if isinstance(params.get('expires_at'), (float, int)):

{oauthlib-3.3.0 → oauthlib-3.3.1/oauthlib.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oauthlib
-Version: 3.3.0
+Version: 3.3.1
 Summary: A generic, spec-compliant, thorough implementation of the OAuth request-signing logic
 Home-page: https://github.com/oauthlib/oauthlib
 Author: The OAuthlib Community

{oauthlib-3.3.0 → oauthlib-3.3.1}/oauthlib.egg-info/SOURCES.txt

@@ -4,9 +4,6 @@ MANIFEST.in
 README.rst
 setup.cfg
 setup.py
-examples/__init__.py
-examples/device_code_flow.py
-examples/skeleton_oauth2_web_application_server.py
 oauthlib/__init__.py
 oauthlib/common.py
 oauthlib/signals.py

{oauthlib-3.3.0 → oauthlib-3.3.1}/oauthlib.egg-info/top_level.txt

@@ -1,2 +1 @@
-examples
 oauthlib

{oauthlib-3.3.0 → oauthlib-3.3.1}/setup.py

@@ -33,7 +33,7 @@ setup(
     url='https://github.com/oauthlib/oauthlib',
     platforms='any',
     license='BSD-3-Clause',
-    packages=find_packages(exclude=('docs', 'tests', 'tests.*')),
+    packages=find_packages(exclude=('docs', 'examples', 'tests', 'tests.*')),
     python_requires='>=3.8',
     extras_require={
         'rsa': rsa_require,

{oauthlib-3.3.0 → oauthlib-3.3.1}/tests/oauth2/rfc6749/clients/test_web_application.py

@@ -262,3 +262,24 @@ class WebApplicationClientTest(TestCase):
         with self.assertWarns(DeprecationWarning), self.assertRaises(ValueError):
             client.prepare_request_body(client_id='different_client_id')
             # testing the exact exception message in Python2&Python3 is a pain
+
+    def test_expires_in_as_str(self):
+        """
+        see regression issue #906
+        """
+
+        client = WebApplicationClient(
+            client_id="dummy",
+            token={"access_token": "xyz", "expires_in": "3600"}
+        )
+        self.assertIsNotNone(client)
+        client = WebApplicationClient(
+            client_id="dummy",
+            token={"access_token": "xyz", "expires_in": 3600}
+        )
+        self.assertIsNotNone(client)
+        client = WebApplicationClient(
+            client_id="dummy",
+            token={"access_token": "xyz", "expires_in": 3600.12}
+        )
+        self.assertIsNotNone(client)

{oauthlib-3.3.0 → oauthlib-3.3.1}/tests/oauth2/rfc6749/test_parameters.py

@@ -312,6 +312,11 @@ class ParameterTests(TestCase):
                 ('expires_in and expires_at float', (3600, 200.42), (3600, 200.42, 200.42)),
                 ('expires_in and expires_at str-int', (3600, "200"), (3600, 200, 200)),
                 ('expires_in and expires_at str-float', (3600, "200.42"), (3600, 200.42, 200.42)),
+                ('expires_in float only', (3600.12, None), (3600, 4600, 4600)),
+                ('expires_in float and expires_at', (3600.12, 200), (3600, 200, 200)),
+                ('expires_in float and expires_at float', (3600.12, 200.42), (3600, 200.42, 200.42)),
+                ('expires_in float and expires_at str-int', (3600.12, "200"), (3600, 200, 200)),
+                ('expires_in float and expires_at str-float', (3600.12, "200.42"), (3600, 200.42, 200.42)),
                 ('expires_in str only', ("3600", None), (3600, 4600, 4600)),
                 ('expires_in str and expires_at', ("3600", 200), (3600, 200, 200)),
                 ('expires_in str and expires_at float', ("3600", 200.42), (3600, 200.42, 200.42)),

oauthlib-3.3.0/examples/device_code_flow.py

@@ -1,260 +0,0 @@
-import enum
-import json
-import datetime
-from datetime import timedelta
-
-from oauthlib.oauth2 import RequestValidator, Server, DeviceApplicationServer
-from oauthlib.oauth2.rfc8628 import errors as device_flow_errors
-from oauthlib.oauth2.rfc8628.errors import AccessDenied, AuthorizationPendingError, ExpiredTokenError, SlowDownError
-
-
-"""
-A pseudocode implementation of the device flow code under an Oauth2 provider.
-
-This example is not concerned with openid in any way.
-
-This example is also not a 1:1 pseudocode implementation. Please refer to the rfc
-for the full details.
-https://datatracker.ietf.org/doc/html/rfc8628
-
-This module is just acting as a way to demonstrate the main pieces
-needed in oauthlib to implement the flow
-
-
-We also assume you already have the /token & /login endpoint in your provider.
-
-Your provider will also need the following endpoints(which will be discussed
-in the example below):
-  - /device_authorization (part of rfc)
-  - /device (part of rfc)
-  - /approve-deny (up to your implementation, this is an example)
-"""
-
-
-"""
-Device flow pseudocode implementation step by step:
-    0. Providing some way to represent the device flow session
-
-    Some python object to represent the current state of the device during
-    the device flow. This, for example, could be an object that persists
-    and represents the device in a database
-"""
-
-
-class Device:
-    class DeviceFlowStatus(enum.Enum):
-        AUTHORIZED = "Authorized"
-        AUTHORIZATION_PENDING = "Authorization_pending"
-        EXPIRED = "Expired"
-        DENIED = "Denied"
-
-    # https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
-    # https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
-    id = ...  # if Device is representing a database object, this will be the id of that row
-    device_code = ...
-    user_code = ...
-    scope = ...
-    interval = ...  # in seconds, default is 5
-    expires = ...  # seconds
-    status = ...  # DeviceFlowStatus with AUTHORIZATION_PENDING as the default
-
-    client_id = ...
-    last_checked = ...  # datetime
-
-
-"""
-    1. User goes on their device(client) and the client sends a request to /device_authorization
-    against the provider:
-    https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
-    https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
-
-
-    POST /device_authorization HTTP/1.1
-      Host: server.example.com
-      Content-Type: application/x-www-form-urlencoded
-
-      client_id=1406020730&scope=example_scope
-
-      Response:
-      HTTP/1.1 200 OK
-      Content-Type: application/json
-      Cache-Control: no-store
-
-      {
-        "device_code": "GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS",
-        "user_code": "WDJB-MJHT",
-        "verification_uri": "https://example.com/device",
-        "verification_uri_complete":
-            "https://example.com/device?user_code=WDJB-MJHT",
-        "expires_in": 1800,
-        "interval": 5
-      }
-"""
-
-
-class DeviceAuthorizationEndpoint:
-    @staticmethod
-    def create_device_authorization_response(request):
-        server = DeviceApplicationServer(interval=5, verification_uri="https://example.com/device")
-        return server.create_device_authorization_response(request)
-
-    def post(self, request):
-        headers, data, status = self.create_device_authorization_response(request)
-        device_response = ...
-
-        # Create an instance of examples.device_flow.Device` using `request` and `data`that encapsulates
-        # https://datatracker.ietf.org/doc/html/rfc8628#section-3.1 &
-        # https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
-
-        return device_response
-
-
-"""
-    2. Client presents the information to the user
-    (There's a section on non visual capable devices as well
-    https://datatracker.ietf.org/doc/html/rfc8628#section-5.7)
-          +-------------------------------------------------+
-            |                                                 |
-            |  Scan the QR code or, using     +------------+  |
-            |  a browser on another device,   |[_]..  . [_]|  |
-            |  visit:                         | .  ..   . .|  |
-            |  https://example.com/device     | . .  . ....|  |
-            |                                 |.   . . .   |  |
-            |  And enter the code:            |[_]. ... .  |  |
-            |  WDJB-MJHT                      +------------+  |
-            |                                                 |
-            +-------------------------------------------------+
-"""
-# The implementation for step 2 is up to the owner of device.
-
-
-""""
-    3 (The browser flow). User goes to https://example.com/device where they're presented with a
-    form to fill in the user code.
-
-    Implement that endpoint on your provider and follow the logic in the rfc.
-
-    Making use of the errors in `oauthlib.oauth2.rfc8628.errors`
-
-    raise AccessDenied/AuthorizationPendingError/ExpiredTokenError where appropriate making use of
-    `examples.device_flow.Device` to get and update current state of the device during the session
-
-    If the user isn't logged in(after inputting the user-code), they should be redirected to the provider's /login
-    endpoint and redirected back to an /approve-deny endpoint(The name and implementation of /approve-deny is up
-    to the owner of the provider, this is just an example).
-    They should then see an "approve" or "deny" button to authorize the device.
-
-    Again, using `examples.device_flow.Device` to update the status appropriately during the session.
-"""
-# /device and /approve-deny is up to the owner of the provider to implement. Again, make sure to
-# keep referring to the rfc when implementing.
-
-
-"""
-4 (The polling flow)
-    https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
-    https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
-
-
-    Right after step 2, the device polls the /token endpoint every "interval" amount of seconds
-    to check if user has approved or denied the request.
-
-    When grant type is `urn:ietf:params:oauth:grant-type:device_code`,
-    `oauthlib.oauth2.rfc8628.grant_types.device_code.DeviceCodeGrant` will be the handler
-    that handles token generation.
-"""
-
-
-# This is purely for illustrative purposes
-# to demonstrate rate limiting on the token endpoint for the device flow.
-# It is up to as the provider to decide how you want
-# to rate limit the device during polling.
-def rate_limit(func, rate="1/5s"):
-    def wrapper():
-        # some logic to ensure client device is rate limited by a minimum
-        # of 1 request every 5 seconds during device polling
-        # https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
-
-        # use device_code to retrieve device
-        device = Device
-
-        # get the time in seconds since the device polled the /token endpoint
-        now = datetime.datetime.now(tz=datetime.UTC)
-        diff = now - timedelta(device.last_checked)
-        total_seconds_since_last_device_poll = diff.total_seconds()
-
-        device.last_checked = now
-
-        # for illustrative purposes. 1/5s means 1 request every 5 seconds.
-        # so if `total_seconds_since_last_device_poll` is 4 seconds, this will
-        # raise an error
-        if total_seconds_since_last_device_poll < rate:
-            raise device_flow_errors.SlowDownError()
-
-        result = func()
-        return result
-
-    return wrapper
-
-
-class ExampleRequestValidator(RequestValidator):
-    # All the other methods that need to be implemented...
-    # see examples.skeleton_oauth2_web_application_server.SkeletonValidator
-    # for a more complete example.
-
-    # Here our main concern is this method:
-    def create_token_response(self): ...
-
-
-class ServerSetupForTokenEndpoint:
-    def __init__(self):
-        validator = ExampleRequestValidator
-        self.server = Server(validator)
-
-
-# You should already have the /token endpoint implemented in your provider.
-class TokenEndpoint(ServerSetupForTokenEndpoint):
-    def default_flow_token_response(self, request):
-        url, headers, body, status = self.server.create_token_response(request)
-        access_token = json.loads(body).get("access_token")
-
-        # return access_token in a http response
-        return access_token
-
-    @rate_limit  # this will raise the SlowDownError
-    def device_flow_token_response(self, request, device_code):
-        """
-        Following the rfc, this will route the device request accordingly and raise
-        required errors.
-
-        Remember that unlike other auth flows, the device if polling this endpoint once
-        every "interval" amount of seconds.
-        """
-        # using device_code arg to retrieve the correct device object instance
-        device = Device
-
-        if device.status == device.DeviceFlowStatus.AUTHORIZATION_PENDING:
-            raise AuthorizationPendingError()
-
-        # If user clicked "deny" in the /approve-deny page endpoint.
-        # the device gets set to 'authorized' in /approve-deny and /device checks
-        # if someone tries to input a code for a user code that's already been authorized
-        if device.status == device.DeviceFlowStatus.DENIED:
-            raise AccessDenied()
-
-        url, headers, body, status = self.server.create_token_response(request)
-
-        access_token = json.loads(body).get("access_token")
-
-        device.status = device.EXPIRED
-
-        # return access_token in a http response
-        return access_token
-
-    # Example of how token endpoint could handle the token creation depending on
-    # the grant type during a POST to /token.
-    def post(self, request):
-        params = request.POST
-        if params.get("grant_type") == "urn:ietf:params:oauth:grant-type:device_code":
-            return self.device_flow_token_response(request, params["device_code"])
-        return self.default_flow_token_response(request)

oauthlib-3.3.0/examples/skeleton_oauth2_web_application_server.py

@@ -1,114 +0,0 @@
-# Skeleton for an OAuth 2 Web Application Server which is an OAuth
-# provider configured for Authorization Code, Refresh Token grants and
-# for dispensing Bearer Tokens.
-
-# This example is meant to act as a supplement to the documentation,
-# see https://oauthlib.readthedocs.io/en/latest/.
-
-from oauthlib.oauth2 import RequestValidator, WebApplicationServer
-
-
-class SkeletonValidator(RequestValidator):
-
-    # Ordered roughly in order of appearance in the authorization grant flow
-
-    # Pre- and post-authorization.
-
-    def validate_client_id(self, client_id, request, *args, **kwargs):
-        # Simple validity check, does client exist? Not banned?
-        pass
-
-    def validate_redirect_uri(self, client_id, redirect_uri, request, *args, **kwargs):
-        # Is the client allowed to use the supplied redirect_uri? i.e. has
-        # the client previously registered this EXACT redirect uri.
-        pass
-
-    def get_default_redirect_uri(self, client_id, request, *args, **kwargs):
-        # The redirect used if none has been supplied.
-        # Prefer your clients to pre register a redirect uri rather than
-        # supplying one on each authorization request.
-        pass
-
-    def validate_scopes(self, client_id, scopes, client, request, *args, **kwargs):
-        # Is the client allowed to access the requested scopes?
-        pass
-
-    def get_default_scopes(self, client_id, request, *args, **kwargs):
-        # Scopes a client will authorize for if none are supplied in the
-        # authorization request.
-        pass
-
-    def validate_response_type(self, client_id, response_type, client, request, *args, **kwargs):
-        # Clients should only be allowed to use one type of response type, the
-        # one associated with their one allowed grant type.
-        # In this case it must be "code".
-        pass
-
-    # Post-authorization
-
-    def save_authorization_code(self, client_id, code, request, *args, **kwargs):
-        # Remember to associate it with request.scopes, request.redirect_uri
-        # request.client and request.user (the last is passed in
-        # post_authorization credentials, i.e. { 'user': request.user}.
-        pass
-
-    # Token request
-
-    def client_authentication_required(self, request, *args, **kwargs):
-        # Check if the client provided authentication information that needs to
-        # be validated, e.g. HTTP Basic auth
-        pass
-
-    def authenticate_client(self, request, *args, **kwargs):
-        # Whichever authentication method suits you, HTTP Basic might work
-        pass
-
-    def authenticate_client_id(self, client_id, request, *args, **kwargs):
-        # The client_id must match an existing public (non-confidential) client
-        pass
-
-    def validate_code(self, client_id, code, client, request, *args, **kwargs):
-        # Validate the code belongs to the client. Add associated scopes
-        # and user to request.scopes and request.user.
-        pass
-
-    def confirm_redirect_uri(self, client_id, code, redirect_uri, client, request, *args, **kwargs):
-        # You did save the redirect uri with the authorization code right?
-        pass
-
-    def validate_grant_type(self, client_id, grant_type, client, request, *args, **kwargs):
-        # Clients should only be allowed to use one type of grant.
-        # In this case, it must be "authorization_code" or "refresh_token"
-        pass
-
-    def save_bearer_token(self, token, request, *args, **kwargs):
-        # Remember to associate it with request.scopes, request.user and
-        # request.client. The two former will be set when you validate
-        # the authorization code. Don't forget to save both the
-        # access_token and the refresh_token and set expiration for the
-        # access_token to now + expires_in seconds.
-        pass
-
-    def invalidate_authorization_code(self, client_id, code, request, *args, **kwargs):
-        # Authorization codes are use once, invalidate it when a Bearer token
-        # has been acquired.
-        pass
-
-    # Protected resource request
-
-    def validate_bearer_token(self, token, scopes, request):
-        # Remember to check expiration and scope membership
-        pass
-
-    # Token refresh request
-
-    def get_original_scopes(self, refresh_token, request, *args, **kwargs):
-        # Obtain the token associated with the given refresh_token and
-        # return its scopes, these will be passed on to the refreshed
-        # access token if the client did not specify a scope during the
-        # request.
-        pass
-
-
-validator = SkeletonValidator()
-server = WebApplicationServer(validator)