oidcauthlib 3.0.3__tar.gz → 3.0.5__tar.gz

{oidcauthlib-3.0.3/oidcauthlib.egg-info → oidcauthlib-3.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oidcauthlib
-Version: 3.0.3
+Version: 3.0.5
 Summary: oidcauthlib
 Home-page: https://github.com/icanbwell/oidc-auth-lib
 Author: Imran Qureshi

oidcauthlib-3.0.5/VERSION

@@ -0,0 +1 @@
+3.0.5

{oidcauthlib-3.0.3 → oidcauthlib-3.0.5}/oidcauthlib/auth/dcr/dcr_client.py

@@ -46,7 +46,16 @@ class DcrClient:
         if contacts:
             payload["contacts"] = contacts
 
-        logger.info("Performing DCR at '%s'", registration_url)
+        logger.info(
+            "DCR: Sending registration request to '%s' with payload keys: %s",
+            registration_url,
+            sorted(payload.keys()),
+        )
+        logger.debug(
+            "DCR: Full registration payload for '%s': %s",
+            registration_url,
+            payload,
+        )
 
         async with httpx.AsyncClient(timeout=self._timeout_seconds) as client:
             response = await client.post(
@@ -57,6 +66,12 @@ class DcrClient:
             try:
                 response.raise_for_status()
             except httpx.HTTPStatusError as e:
+                logger.error(
+                    "DCR: Registration failed at '%s' — HTTP %s. Response body: %s",
+                    registration_url,
+                    e.response.status_code,
+                    e.response.text[:500],
+                )
                 raise ValueError(
                     f"DCR registration failed at '{registration_url}' "
                     f"with status {e.response.status_code}"
@@ -65,14 +80,27 @@ class DcrClient:
 
         if "client_id" not in dcr_response:
             response_keys: list[str] = sorted(dcr_response.keys())
+            logger.error(
+                "DCR: Response from '%s' missing 'client_id'. Keys present: %s",
+                registration_url,
+                response_keys,
+            )
             raise ValueError(
                 f"DCR response from '{registration_url}' missing 'client_id'. "
                 f"Response keys: {response_keys}"
             )
 
         logger.info(
-            "DCR successful at '%s': client_id=%s",
+            "DCR: Registration successful at '%s' — client_id=%s, "
+            "has_secret=%s, expires_at=%s",
             registration_url,
             dcr_response["client_id"],
+            "client_secret" in dcr_response,
+            dcr_response.get("client_secret_expires_at", "not_set"),
+        )
+        logger.debug(
+            "DCR: Full response from '%s': %s",
+            registration_url,
+            {k: v for k, v in dcr_response.items() if k != "client_secret"},
         )
         return dcr_response

{oidcauthlib-3.0.3 → oidcauthlib-3.0.5}/oidcauthlib/auth/dcr/dcr_manager.py

@@ -52,9 +52,20 @@ class DcrManager:
         contacts: list[str] | None = None,
     ) -> DcrRegistration | None:
         if client_id:
+            logger.info(
+                "DCR: Skipping registration for '%s' — client_id already "
+                "provided (client_id=%s)",
+                auth_provider,
+                client_id,
+            )
             return None
 
         if not registration_url:
+            logger.error(
+                "DCR: No registration_url and no client_id for '%s' — "
+                "cannot resolve credentials",
+                auth_provider,
+            )
             raise ValueError(
                 f"registration_url is required for DCR when client_id is not "
                 f"provided (auth_provider='{auth_provider}')"
@@ -62,19 +73,43 @@ class DcrManager:
 
         validate_url(registration_url)
 
+        logger.info(
+            "DCR: Resolving credentials for '%s' via registration_url='%s'",
+            auth_provider,
+            registration_url,
+        )
+
         cached = await self._find_cached(
             auth_provider=auth_provider,
             registration_url=registration_url,
         )
 
         if cached and not self._is_expired(cached):
-            logger.debug(
-                "Using cached DCR credentials for '%s' (client_id=%s)",
+            logger.info(
+                "DCR: Using cached credentials for '%s' — client_id=%s, "
+                "expires_at=%s",
                 auth_provider,
                 cached.client_id,
+                cached.client_secret_expires_at or "never",
             )
             return cached
 
+        if cached and self._is_expired(cached):
+            logger.info(
+                "DCR: Cached credentials for '%s' are expired "
+                "(client_id=%s, expired_at=%s) — re-registering",
+                auth_provider,
+                cached.client_id,
+                cached.client_secret_expires_at,
+            )
+        else:
+            logger.info(
+                "DCR: No cached credentials found for '%s' — performing "
+                "new registration at '%s'",
+                auth_provider,
+                registration_url,
+            )
+
         dcr_response = await self._dcr_client.register(
             registration_url=registration_url,
             redirect_uri=self._redirect_uri,
@@ -84,11 +119,17 @@ class DcrManager:
             contacts=contacts,
         )
 
-        return await self._persist(
+        registration = await self._persist(
             auth_provider=auth_provider,
             registration_url=registration_url,
             dcr_response=dcr_response,
         )
+        logger.info(
+            "DCR: Persisted credentials for '%s' — client_id=%s",
+            auth_provider,
+            registration.client_id,
+        )
+        return registration
 
     async def _find_cached(
         self,
@@ -96,6 +137,13 @@ class DcrManager:
         auth_provider: str,
         registration_url: str,
     ) -> DcrRegistration | None:
+        logger.debug(
+            "DCR: Querying cache for auth_provider='%s', "
+            "registration_url='%s', collection='%s'",
+            auth_provider,
+            registration_url,
+            self._collection_name,
+        )
         results = await self._repository.find_many(
             collection_name=self._collection_name,
             model_class=DcrRegistration,
@@ -104,6 +152,20 @@ class DcrManager:
                 "registration_url": registration_url,
             },
         )
+        if results:
+            logger.debug(
+                "DCR: Cache hit for '%s' — found %d result(s), "
+                "client_id=%s",
+                auth_provider,
+                len(results),
+                results[0].client_id,
+            )
+        else:
+            logger.debug(
+                "DCR: Cache miss for '%s' at '%s'",
+                auth_provider,
+                registration_url,
+            )
         return results[0] if results else None
 
     @staticmethod

oidcauthlib-3.0.5/oidcauthlib/auth/well_known_configuration/auth_server_metadata.py

@@ -0,0 +1,18 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class AuthServerMetadata:
+    """Parsed OAuth 2.0 Authorization Server Metadata (RFC 8414) or
+    OpenID Connect Discovery metadata.
+
+    Contains the subset of fields needed to configure an OAuth client:
+    authorization and token endpoints (required), plus optional registration
+    endpoint, issuer, and supported scopes.
+    """
+
+    authorization_endpoint: str
+    token_endpoint: str
+    registration_endpoint: str | None = None
+    issuer: str | None = None
+    scopes_supported: list[str] | None = None

oidcauthlib-3.0.5/oidcauthlib/auth/well_known_configuration/auth_server_metadata_discovery.py

@@ -0,0 +1,112 @@
+import logging
+from typing import Protocol, Any
+from urllib.parse import urlparse
+
+import httpx
+
+from oidcauthlib.auth.well_known_configuration.auth_server_metadata import (
+    AuthServerMetadata,
+)
+from oidcauthlib.utilities.logger.log_levels import SRC_LOG_LEVELS
+
+logger = logging.getLogger(__name__)
+logger.setLevel(SRC_LOG_LEVELS["AUTH"])
+
+_DISCOVERY_TIMEOUT = httpx.Timeout(10.0)
+
+
+class AuthServerMetadataDiscoveryProtocol(Protocol):
+    """Protocol for discovering OAuth authorization server metadata from a resource URL."""
+
+    async def discover(self, *, resource_url: str) -> AuthServerMetadata | None: ...
+
+
+class AuthServerMetadataDiscovery:
+    """Discovers OAuth authorization server metadata from a resource server URL.
+
+    Implements RFC 8414 (OAuth 2.0 Authorization Server Metadata) with a
+    fallback to OpenID Connect Discovery.  Given a resource URL, extracts
+    the origin (scheme + host + port) and attempts to fetch:
+
+    1. ``{origin}/.well-known/oauth-authorization-server`` (RFC 8414)
+    2. ``{origin}/.well-known/openid-configuration`` (OIDC Discovery)
+
+    Returns an ``AuthServerMetadata`` with the discovered endpoints, or
+    ``None`` if neither well-known URL returns valid metadata.
+    """
+
+    @staticmethod
+    def _extract_base_url(url: str) -> str:
+        parsed = urlparse(url)
+        port_suffix = f":{parsed.port}" if parsed.port else ""
+        return f"{parsed.scheme}://{parsed.hostname}{port_suffix}"
+
+    @staticmethod
+    def _parse_metadata(metadata: dict[str, Any]) -> AuthServerMetadata | None:
+        authorization_endpoint = metadata.get("authorization_endpoint")
+        token_endpoint = metadata.get("token_endpoint")
+        if not authorization_endpoint or not token_endpoint:
+            logger.warning(
+                "Discovered metadata missing required endpoints "
+                "(authorization_endpoint=%s, token_endpoint=%s)",
+                authorization_endpoint,
+                token_endpoint,
+            )
+            return None
+
+        scopes: list[str] | None = None
+        scopes_supported = metadata.get("scopes_supported")
+        if isinstance(scopes_supported, list):
+            scopes = [s for s in scopes_supported if isinstance(s, str)]
+
+        return AuthServerMetadata(
+            authorization_endpoint=authorization_endpoint,
+            token_endpoint=token_endpoint,
+            registration_endpoint=metadata.get("registration_endpoint"),
+            issuer=metadata.get("issuer"),
+            scopes_supported=scopes,
+        )
+
+    async def discover(self, *, resource_url: str) -> AuthServerMetadata | None:
+        """Discover OAuth authorization server metadata for a resource URL.
+
+        Args:
+            resource_url: The URL of the resource server (e.g. an MCP server).
+
+        Returns:
+            AuthServerMetadata if discovery succeeds, None otherwise.
+        """
+        base_url = self._extract_base_url(resource_url)
+
+        well_known_urls = [
+            f"{base_url}/.well-known/oauth-authorization-server",
+            f"{base_url}/.well-known/openid-configuration",
+        ]
+
+        async with httpx.AsyncClient(timeout=_DISCOVERY_TIMEOUT) as client:
+            for url in well_known_urls:
+                try:
+                    response = await client.get(url)
+                    if response.status_code != 200:
+                        logger.debug(
+                            "Discovery fetch %s returned status %s, skipping",
+                            url,
+                            response.status_code,
+                        )
+                        continue
+                    metadata = response.json()
+                    result = self._parse_metadata(metadata)
+                    if result is not None:
+                        logger.info(
+                            "Discovered auth server metadata from %s for resource %s",
+                            url,
+                            resource_url,
+                        )
+                        return result
+                except httpx.TimeoutException:
+                    logger.debug("Discovery fetch %s timed out", url)
+                except (httpx.HTTPError, ValueError) as e:
+                    logger.debug("Discovery fetch %s failed: %s", url, e)
+
+        logger.info("No auth server metadata discovered for resource %s", resource_url)
+        return None

{oidcauthlib-3.0.3 → oidcauthlib-3.0.5/oidcauthlib.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oidcauthlib
-Version: 3.0.3
+Version: 3.0.5
 Summary: oidcauthlib
 Home-page: https://github.com/icanbwell/oidc-auth-lib
 Author: Imran Qureshi

{oidcauthlib-3.0.3 → oidcauthlib-3.0.5}/oidcauthlib.egg-info/SOURCES.txt

@@ -53,6 +53,8 @@ oidcauthlib/auth/repository/mongo/mongo_repository.py
 oidcauthlib/auth/routers/__init__.py
 oidcauthlib/auth/routers/auth_router.py
 oidcauthlib/auth/well_known_configuration/__init__.py
+oidcauthlib/auth/well_known_configuration/auth_server_metadata.py
+oidcauthlib/auth/well_known_configuration/auth_server_metadata_discovery.py
 oidcauthlib/auth/well_known_configuration/well_known_configuration_cache.py
 oidcauthlib/auth/well_known_configuration/well_known_configuration_cache_result.py
 oidcauthlib/auth/well_known_configuration/well_known_configuration_manager.py
@@ -115,6 +117,7 @@ tests/auth/repository/mongo/__init__.py
 tests/auth/repository/mongo/test_mongo_repository.py
 tests/auth/repository/mongo/test_mongo_repository_real.py
 tests/auth/well_known_configuration/__init__.py
+tests/auth/well_known_configuration/test_auth_server_metadata_discovery.py
 tests/auth/well_known_configuration/test_well_known_configuration_cache.py
 tests/auth/well_known_configuration/test_well_known_configuration_manager.py
 tests/storage/__init__.py

oidcauthlib-3.0.5/tests/auth/well_known_configuration/test_auth_server_metadata_discovery.py

@@ -0,0 +1,184 @@
+"""Tests for AuthServerMetadataDiscovery — RFC 8414 and OIDC Discovery."""
+
+import httpx
+import pytest
+import respx
+
+from oidcauthlib.auth.well_known_configuration.auth_server_metadata_discovery import (
+    AuthServerMetadataDiscovery,
+)
+
+_BASE = "https://mcp.example.com"
+_RESOURCE_URL = f"{_BASE}/v1/mcp"
+_RFC8414_URL = f"{_BASE}/.well-known/oauth-authorization-server"
+_OIDC_URL = f"{_BASE}/.well-known/openid-configuration"
+
+_VALID_METADATA = {
+    "issuer": "https://auth.example.com",
+    "authorization_endpoint": "https://auth.example.com/authorize",
+    "token_endpoint": "https://auth.example.com/token",
+    "registration_endpoint": "https://auth.example.com/register",
+    "scopes_supported": ["openid", "profile", "email"],
+}
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_rfc8414_success() -> None:
+    """RFC 8414 endpoint returns valid metadata."""
+    respx.get(_RFC8414_URL).mock(return_value=httpx.Response(200, json=_VALID_METADATA))
+
+    discovery = AuthServerMetadataDiscovery()
+    result = await discovery.discover(resource_url=_RESOURCE_URL)
+
+    assert result is not None
+    assert result.authorization_endpoint == "https://auth.example.com/authorize"
+    assert result.token_endpoint == "https://auth.example.com/token"
+    assert result.registration_endpoint == "https://auth.example.com/register"
+    assert result.issuer == "https://auth.example.com"
+    assert result.scopes_supported == ["openid", "profile", "email"]
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_rfc8414_fails_oidc_succeeds() -> None:
+    """RFC 8414 returns 404, falls back to OIDC Discovery."""
+    respx.get(_RFC8414_URL).mock(return_value=httpx.Response(404))
+    respx.get(_OIDC_URL).mock(return_value=httpx.Response(200, json=_VALID_METADATA))
+
+    discovery = AuthServerMetadataDiscovery()
+    result = await discovery.discover(resource_url=_RESOURCE_URL)
+
+    assert result is not None
+    assert result.authorization_endpoint == "https://auth.example.com/authorize"
+    assert result.token_endpoint == "https://auth.example.com/token"
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_both_endpoints_fail() -> None:
+    """Both well-known endpoints return errors — returns None."""
+    respx.get(_RFC8414_URL).mock(return_value=httpx.Response(404))
+    respx.get(_OIDC_URL).mock(return_value=httpx.Response(500))
+
+    discovery = AuthServerMetadataDiscovery()
+    result = await discovery.discover(resource_url=_RESOURCE_URL)
+
+    assert result is None
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_malformed_json() -> None:
+    """Endpoint returns non-JSON — returns None."""
+    respx.get(_RFC8414_URL).mock(return_value=httpx.Response(200, text="not json"))
+    respx.get(_OIDC_URL).mock(return_value=httpx.Response(200, text="also not json"))
+
+    discovery = AuthServerMetadataDiscovery()
+    result = await discovery.discover(resource_url=_RESOURCE_URL)
+
+    assert result is None
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_missing_required_endpoints() -> None:
+    """Metadata without authorization_endpoint or token_endpoint — returns None."""
+    respx.get(_RFC8414_URL).mock(
+        return_value=httpx.Response(200, json={"issuer": "https://auth.example.com"})
+    )
+    respx.get(_OIDC_URL).mock(return_value=httpx.Response(404))
+
+    discovery = AuthServerMetadataDiscovery()
+    result = await discovery.discover(resource_url=_RESOURCE_URL)
+
+    assert result is None
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_network_timeout() -> None:
+    """Network timeout — returns None."""
+    respx.get(_RFC8414_URL).mock(side_effect=httpx.ConnectTimeout("timeout"))
+    respx.get(_OIDC_URL).mock(side_effect=httpx.ConnectTimeout("timeout"))
+
+    discovery = AuthServerMetadataDiscovery()
+    result = await discovery.discover(resource_url=_RESOURCE_URL)
+
+    assert result is None
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_no_scopes_in_metadata() -> None:
+    """Metadata without scopes_supported — scopes_supported is None."""
+    metadata = {
+        "authorization_endpoint": "https://auth.example.com/authorize",
+        "token_endpoint": "https://auth.example.com/token",
+    }
+    respx.get(_RFC8414_URL).mock(return_value=httpx.Response(200, json=metadata))
+
+    discovery = AuthServerMetadataDiscovery()
+    result = await discovery.discover(resource_url=_RESOURCE_URL)
+
+    assert result is not None
+    assert result.scopes_supported is None
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_url_with_port() -> None:
+    """Resource URL with custom port — base URL preserves port."""
+    url = "https://mcp.example.com:8443/v1/mcp"
+    respx.get(
+        "https://mcp.example.com:8443/.well-known/oauth-authorization-server"
+    ).mock(return_value=httpx.Response(200, json=_VALID_METADATA))
+
+    discovery = AuthServerMetadataDiscovery()
+    result = await discovery.discover(resource_url=url)
+
+    assert result is not None
+    assert result.authorization_endpoint == "https://auth.example.com/authorize"
+
+
+class TestExtractBaseUrl:
+    def test_strips_path(self) -> None:
+        assert (
+            AuthServerMetadataDiscovery._extract_base_url(
+                "https://mcp.example.com/v1/mcp"
+            )
+            == "https://mcp.example.com"
+        )
+
+    def test_preserves_port(self) -> None:
+        assert (
+            AuthServerMetadataDiscovery._extract_base_url(
+                "https://mcp.example.com:8443/v1/mcp"
+            )
+            == "https://mcp.example.com:8443"
+        )
+
+    def test_no_path(self) -> None:
+        assert (
+            AuthServerMetadataDiscovery._extract_base_url("https://mcp.example.com")
+            == "https://mcp.example.com"
+        )
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_no_registration_endpoint() -> None:
+    """Metadata without registration_endpoint — registration_endpoint is None."""
+    metadata = {
+        "authorization_endpoint": "https://auth.example.com/authorize",
+        "token_endpoint": "https://auth.example.com/token",
+        "issuer": "https://auth.example.com",
+    }
+    respx.get(_RFC8414_URL).mock(return_value=httpx.Response(200, json=metadata))
+
+    discovery = AuthServerMetadataDiscovery()
+    result = await discovery.discover(resource_url=_RESOURCE_URL)
+
+    assert result is not None
+    assert result.registration_endpoint is None
+    assert result.issuer == "https://auth.example.com"

oidcauthlib-3.0.3/VERSION

@@ -1 +0,0 @@
-3.0.3