oidcauthlib 3.0.4__tar.gz → 3.0.6__tar.gz

{oidcauthlib-3.0.4/oidcauthlib.egg-info → oidcauthlib-3.0.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oidcauthlib
-Version: 3.0.4
+Version: 3.0.6
 Summary: oidcauthlib
 Home-page: https://github.com/icanbwell/oidc-auth-lib
 Author: Imran Qureshi

oidcauthlib-3.0.6/VERSION

@@ -0,0 +1 @@
+3.0.6

{oidcauthlib-3.0.4 → oidcauthlib-3.0.6}/oidcauthlib/auth/auth_manager.py

@@ -33,6 +33,7 @@ from oidcauthlib.utilities.logger.log_levels import SRC_LOG_LEVELS
 from oidcauthlib.utilities.logger.logging_transport import (
     LoggingTransport,
 )
+from oidcauthlib.utilities.url_validator import validate_url
 
 logger = logging.getLogger(__name__)
 logger.setLevel(SRC_LOG_LEVELS["AUTH"])
@@ -199,9 +200,12 @@ class AuthManager:
         }
 
         if auth_config.authorization_endpoint and auth_config.token_endpoint:
+            validate_url(auth_config.authorization_endpoint)
+            validate_url(auth_config.token_endpoint)
             register_kwargs["authorize_url"] = auth_config.authorization_endpoint
             register_kwargs["access_token_url"] = auth_config.token_endpoint
         elif auth_config.well_known_uri:
+            validate_url(auth_config.well_known_uri)
             register_kwargs["server_metadata_url"] = auth_config.well_known_uri
         else:
             raise ValueError(

{oidcauthlib-3.0.4 → oidcauthlib-3.0.6}/oidcauthlib/auth/dcr/dcr_client.py

@@ -46,7 +46,16 @@ class DcrClient:
         if contacts:
             payload["contacts"] = contacts
 
-        logger.info("Performing DCR at '%s'", registration_url)
+        logger.info(
+            "DCR: Sending registration request to '%s' with payload keys: %s",
+            registration_url,
+            sorted(payload.keys()),
+        )
+        logger.debug(
+            "DCR: Full registration payload for '%s': %s",
+            registration_url,
+            payload,
+        )
 
         async with httpx.AsyncClient(timeout=self._timeout_seconds) as client:
             response = await client.post(
@@ -57,6 +66,12 @@ class DcrClient:
             try:
                 response.raise_for_status()
             except httpx.HTTPStatusError as e:
+                logger.error(
+                    "DCR: Registration failed at '%s' — HTTP %s. Response body: %s",
+                    registration_url,
+                    e.response.status_code,
+                    e.response.text[:500],
+                )
                 raise ValueError(
                     f"DCR registration failed at '{registration_url}' "
                     f"with status {e.response.status_code}"
@@ -65,14 +80,27 @@ class DcrClient:
 
         if "client_id" not in dcr_response:
             response_keys: list[str] = sorted(dcr_response.keys())
+            logger.error(
+                "DCR: Response from '%s' missing 'client_id'. Keys present: %s",
+                registration_url,
+                response_keys,
+            )
             raise ValueError(
                 f"DCR response from '{registration_url}' missing 'client_id'. "
                 f"Response keys: {response_keys}"
             )
 
         logger.info(
-            "DCR successful at '%s': client_id=%s",
+            "DCR: Registration successful at '%s' — client_id=%s, "
+            "has_secret=%s, expires_at=%s",
             registration_url,
             dcr_response["client_id"],
+            "client_secret" in dcr_response,
+            dcr_response.get("client_secret_expires_at", "not_set"),
+        )
+        logger.debug(
+            "DCR: Full response from '%s': %s",
+            registration_url,
+            {k: v for k, v in dcr_response.items() if k != "client_secret"},
         )
         return dcr_response

{oidcauthlib-3.0.4 → oidcauthlib-3.0.6}/oidcauthlib/auth/dcr/dcr_manager.py

@@ -52,9 +52,20 @@ class DcrManager:
         contacts: list[str] | None = None,
     ) -> DcrRegistration | None:
         if client_id:
+            logger.info(
+                "DCR: Skipping registration for '%s' — client_id already "
+                "provided (client_id=%s)",
+                auth_provider,
+                client_id,
+            )
             return None
 
         if not registration_url:
+            logger.error(
+                "DCR: No registration_url and no client_id for '%s' — "
+                "cannot resolve credentials",
+                auth_provider,
+            )
             raise ValueError(
                 f"registration_url is required for DCR when client_id is not "
                 f"provided (auth_provider='{auth_provider}')"
@@ -62,19 +73,42 @@ class DcrManager:
 
         validate_url(registration_url)
 
+        logger.info(
+            "DCR: Resolving credentials for '%s' via registration_url='%s'",
+            auth_provider,
+            registration_url,
+        )
+
         cached = await self._find_cached(
             auth_provider=auth_provider,
             registration_url=registration_url,
         )
 
         if cached and not self._is_expired(cached):
-            logger.debug(
-                "Using cached DCR credentials for '%s' (client_id=%s)",
+            logger.info(
+                "DCR: Using cached credentials for '%s' — client_id=%s, expires_at=%s",
                 auth_provider,
                 cached.client_id,
+                cached.client_secret_expires_at or "never",
             )
             return cached
 
+        if cached and self._is_expired(cached):
+            logger.info(
+                "DCR: Cached credentials for '%s' are expired "
+                "(client_id=%s, expired_at=%s) — re-registering",
+                auth_provider,
+                cached.client_id,
+                cached.client_secret_expires_at,
+            )
+        else:
+            logger.info(
+                "DCR: No cached credentials found for '%s' — performing "
+                "new registration at '%s'",
+                auth_provider,
+                registration_url,
+            )
+
         dcr_response = await self._dcr_client.register(
             registration_url=registration_url,
             redirect_uri=self._redirect_uri,
@@ -84,11 +118,17 @@ class DcrManager:
             contacts=contacts,
         )
 
-        return await self._persist(
+        registration = await self._persist(
             auth_provider=auth_provider,
             registration_url=registration_url,
             dcr_response=dcr_response,
         )
+        logger.info(
+            "DCR: Persisted credentials for '%s' — client_id=%s",
+            auth_provider,
+            registration.client_id,
+        )
+        return registration
 
     async def _find_cached(
         self,
@@ -96,6 +136,13 @@ class DcrManager:
         auth_provider: str,
         registration_url: str,
     ) -> DcrRegistration | None:
+        logger.debug(
+            "DCR: Querying cache for auth_provider='%s', "
+            "registration_url='%s', collection='%s'",
+            auth_provider,
+            registration_url,
+            self._collection_name,
+        )
         results = await self._repository.find_many(
             collection_name=self._collection_name,
             model_class=DcrRegistration,
@@ -104,6 +151,19 @@ class DcrManager:
                 "registration_url": registration_url,
             },
         )
+        if results:
+            logger.debug(
+                "DCR: Cache hit for '%s' — found %d result(s), client_id=%s",
+                auth_provider,
+                len(results),
+                results[0].client_id,
+            )
+        else:
+            logger.debug(
+                "DCR: Cache miss for '%s' at '%s'",
+                auth_provider,
+                registration_url,
+            )
         return results[0] if results else None
 
     @staticmethod

{oidcauthlib-3.0.4 → oidcauthlib-3.0.6}/oidcauthlib/auth/well_known_configuration/well_known_configuration_cache.py

@@ -20,6 +20,7 @@ from oidcauthlib.utilities.environment.oidc_environment_variables import (
 )
 from oidcauthlib.utilities.logger.log_levels import SRC_LOG_LEVELS
 from oidcauthlib.open_telemetry.attribute_names import OidcOpenTelemetryAttributeNames
+from oidcauthlib.utilities.url_validator import validate_url
 
 logger = logging.getLogger(__name__)
 logger.setLevel(SRC_LOG_LEVELS["AUTH"])
@@ -249,6 +250,7 @@ class WellKnownConfigurationCache:
                 span.set_attribute(
                     OidcOpenTelemetryAttributeNames.WELL_KNOWN_URI, well_known_uri
                 )
+                validate_url(well_known_uri)
                 async with httpx.AsyncClient() as client:
                     try:
                         logger.info(
@@ -465,6 +467,7 @@ class WellKnownConfigurationCache:
         Security:
             - Keys are not logged; only counts are logged to avoid PII/token leakage.
         """
+        validate_url(jwks_uri)
         async with httpx.AsyncClient() as client:
             try:
                 logger.info(f"Fetching JWKS from {jwks_uri}")

{oidcauthlib-3.0.4 → oidcauthlib-3.0.6}/oidcauthlib/utilities/url_validator.py

@@ -3,10 +3,15 @@
 Validates URLs before making HTTP requests to prevent Server-Side Request
 Forgery (SSRF) attacks.  Enforces HTTPS-only, rejects private/reserved IP
 ranges, and resolves hostnames to verify the target is not internal.
+
+Set the ``AUTH_ALLOW_HTTP_URLS`` environment variable to ``true`` to relax
+HTTPS-only enforcement and private-IP blocking for local development
+(e.g. Docker Compose with ``http://keycloak:8080``).
 """
 
 import ipaddress
 import logging
+import os
 import socket
 from urllib.parse import urlparse
 
@@ -59,13 +64,23 @@ def _is_private_ip(addr: str) -> bool:
     return any(ip in network for network in _BLOCKED_NETWORKS)
 
 
+def _env_allow_http() -> bool:
+    """Return True when AUTH_ALLOW_HTTP_URLS is set to a truthy value."""
+    return os.environ.get("AUTH_ALLOW_HTTP_URLS", "").lower() in (
+        "true",
+        "1",
+        "yes",
+    )
+
+
 def validate_url(url: str, *, allow_http: bool = False) -> str:
     """Validate a URL for safe outbound HTTP requests.
 
     Args:
         url: The URL to validate.
         allow_http: If True, permit ``http://`` in addition to ``https://``.
-            Defaults to False (HTTPS only).
+            Defaults to False (HTTPS only).  Also enabled globally by the
+            ``AUTH_ALLOW_HTTP_URLS`` environment variable.
 
     Returns:
         The validated URL (unchanged).
@@ -73,6 +88,8 @@ def validate_url(url: str, *, allow_http: bool = False) -> str:
     Raises:
         ValueError: If the URL fails any validation check.
     """
+    allow_http = allow_http or _env_allow_http()
+
     parsed = urlparse(url)
 
     # --- scheme ---
@@ -80,7 +97,8 @@ def validate_url(url: str, *, allow_http: bool = False) -> str:
     if parsed.scheme not in allowed_schemes:
         raise ValueError(
             f"URL scheme must be {' or '.join(sorted(allowed_schemes))}, "
-            f"got '{parsed.scheme}' in '{url}'"
+            f"got '{parsed.scheme}' in '{url}'. "
+            f"Set AUTH_ALLOW_HTTP_URLS=true to allow http:// URLs."
         )
 
     # --- hostname ---
@@ -98,15 +116,19 @@ def validate_url(url: str, *, allow_http: bool = False) -> str:
         raise ValueError(f"URL must use a hostname, not a raw IP address: '{hostname}'")
 
     # --- resolve DNS and check all IPs ---
-    try:
-        addr_infos = socket.getaddrinfo(hostname, parsed.port or 443)
-    except socket.gaierror as exc:
-        raise ValueError(f"Cannot resolve hostname '{hostname}': {exc}") from exc
-
-    for _family, _type, _proto, _canonname, sockaddr in addr_infos:
-        ip_str = str(sockaddr[0])
-        if _is_private_ip(ip_str):
-            raise ValueError(f"URL '{url}' resolves to blocked IP {ip_str}")
+    # When allow_http is enabled (local development), skip the private-IP
+    # check because Docker-internal hostnames (e.g. keycloak) resolve to
+    # RFC 1918 addresses on the container network.
+    if not allow_http:
+        try:
+            addr_infos = socket.getaddrinfo(hostname, parsed.port or 443)
+        except socket.gaierror as exc:
+            raise ValueError(f"Cannot resolve hostname '{hostname}': {exc}") from exc
+
+        for _family, _type, _proto, _canonname, sockaddr in addr_infos:
+            ip_str = str(sockaddr[0])
+            if _is_private_ip(ip_str):
+                raise ValueError(f"URL '{url}' resolves to blocked IP {ip_str}")
 
     logger.debug("URL validated: %s", url)
     return url

{oidcauthlib-3.0.4 → oidcauthlib-3.0.6/oidcauthlib.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oidcauthlib
-Version: 3.0.4
+Version: 3.0.6
 Summary: oidcauthlib
 Home-page: https://github.com/icanbwell/oidc-auth-lib
 Author: Imran Qureshi

{oidcauthlib-3.0.4 → oidcauthlib-3.0.6}/tests/auth/test_auth_manager.py

@@ -4,8 +4,7 @@ import pytest
 import httpx
 import respx
 from unittest.mock import patch
-
-from typing import Any, Dict, List, Optional, override
+from typing import Any, Dict, Generator, List, Optional, override
 
 from oidcauthlib.auth.auth_manager import AuthManager
 from oidcauthlib.auth.auth_helper import AuthHelper
@@ -188,6 +187,16 @@ def well_known_manager(
     )
 
 
+_PATCH_VALIDATE = "oidcauthlib.auth.auth_manager.validate_url"
+
+
+@pytest.fixture(autouse=True)
+def _bypass_url_validation() -> Generator[None, None, None]:
+    """Skip DNS resolution in validate_url for unit tests with fake hostnames."""
+    with patch(_PATCH_VALIDATE, side_effect=lambda url, **kw: url):
+        yield
+
+
 # ---------------- Tests -----------------
 @pytest.mark.asyncio
 async def test_init_memory_cache(

{oidcauthlib-3.0.4 → oidcauthlib-3.0.6}/tests/auth/test_register_dynamic_provider.py

@@ -1,5 +1,5 @@
 from typing import Any, AsyncGenerator
-from unittest.mock import AsyncMock, MagicMock
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
 from simple_container.container.interfaces import IContainer
@@ -10,6 +10,15 @@ from oidcauthlib.auth.dcr.dcr_registration import DcrRegistration
 
 pytestmark = pytest.mark.asyncio
 
+_PATCH_VALIDATE = "oidcauthlib.auth.auth_manager.validate_url"
+
+
+@pytest.fixture(autouse=True)
+def _bypass_url_validation() -> Any:
+    """Skip DNS resolution in validate_url for unit tests with fake hostnames."""
+    with patch(_PATCH_VALIDATE, side_effect=lambda url, **kw: url):
+        yield
+
 
 @pytest.fixture(scope="function")
 async def test_container() -> AsyncGenerator[None, None]:

{oidcauthlib-3.0.4 → oidcauthlib-3.0.6}/tests/auth/well_known_configuration/test_well_known_configuration_cache.py

@@ -1,4 +1,7 @@
 import asyncio
+from typing import Any
+from unittest.mock import patch
+
 import respx
 import httpx
 import pytest
@@ -16,6 +19,15 @@ from oidcauthlib.utilities.environment.oidc_environment_variables import (
     OidcEnvironmentVariables,
 )
 
+_PATCH_VALIDATE = "oidcauthlib.auth.well_known_configuration.well_known_configuration_cache.validate_url"
+
+
+@pytest.fixture(autouse=True)
+def _bypass_url_validation() -> Any:
+    """Skip DNS resolution in validate_url for unit tests with fake hostnames."""
+    with patch(_PATCH_VALIDATE, side_effect=lambda url, **kw: url):
+        yield
+
 
 @pytest.mark.asyncio
 async def test_get_async_caches_on_first_call(test_container: IContainer) -> None:

{oidcauthlib-3.0.4 → oidcauthlib-3.0.6}/tests/utilities/test_url_validator.py

@@ -126,6 +126,33 @@ class TestDNSRebindingProtection:
                 validate_url("https://some-external-host.com/register")
 
 
+class TestEnvVarAllowHttp:
+    """AUTH_ALLOW_HTTP_URLS env var globally enables allow_http."""
+
+    def test_env_var_allows_http(self) -> None:
+        with patch.dict("os.environ", {"AUTH_ALLOW_HTTP_URLS": "true"}):
+            assert (
+                validate_url(
+                    "http://keycloak:8080/realms/test/.well-known/openid-configuration"
+                )
+                == "http://keycloak:8080/realms/test/.well-known/openid-configuration"
+            )
+
+    def test_env_var_skips_private_ip_check(self) -> None:
+        with patch.dict("os.environ", {"AUTH_ALLOW_HTTP_URLS": "true"}):
+            with patch(
+                "oidcauthlib.utilities.url_validator.socket.getaddrinfo"
+            ) as mock_gai:
+                mock_gai.return_value = [(2, 1, 6, "", ("172.18.0.5", 8080))]
+                validate_url("http://keycloak:8080/realms/test")
+                mock_gai.assert_not_called()
+
+    def test_env_var_false_keeps_https_only(self) -> None:
+        with patch.dict("os.environ", {"AUTH_ALLOW_HTTP_URLS": "false"}):
+            with pytest.raises(ValueError, match="AUTH_ALLOW_HTTP_URLS"):
+                validate_url("http://example.com/register")
+
+
 class TestPublicHostnamesAccepted:
     @pytest.mark.parametrize(
         "ip",

oidcauthlib-3.0.4/VERSION

@@ -1 +0,0 @@
-3.0.4