oidcauthlib 3.0.7__tar.gz → 3.0.8__tar.gz

{oidcauthlib-3.0.7/oidcauthlib.egg-info → oidcauthlib-3.0.8}/PKG-INFO

@@ -1,13 +1,14 @@
 Metadata-Version: 2.4
 Name: oidcauthlib
-Version: 3.0.7
+Version: 3.0.8
 Summary: oidcauthlib
 Author-email: Imran Qureshi <imran.qureshi@bwell.com>
-License-Expression: Apache-2.0
+License: Apache-2.0
 Project-URL: Homepage, https://github.com/icanbwell/oidc-auth-lib
 Classifier: Development Status :: 4 - Beta
 Classifier: Programming Language :: Python :: 3
 Classifier: Operating System :: OS Independent
+Classifier: License :: OSI Approved :: Apache Software License
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE

oidcauthlib-3.0.8/VERSION

@@ -0,0 +1 @@
+3.0.8

{oidcauthlib-3.0.7 → oidcauthlib-3.0.8}/oidcauthlib/auth/auth_manager.py

@@ -38,6 +38,7 @@ from oidcauthlib.utilities.url_validator import validate_url
 
 logger = logging.getLogger(__name__)
 logger.setLevel(SRC_LOG_LEVELS["AUTH"])
+OAUTH_STATE_CACHE_TTL_SECONDS: int = int(os.getenv("OAUTH_STATE_CACHE_TTL_SECONDS", "300"))
 
 
 class AuthManager:
@@ -273,7 +274,11 @@ class AuthManager:
         if "nonce" in rv:
             state_data["nonce"] = rv["nonce"]
         cache_key = f"_state_{auth_provider}_{state}"
-        await self.cache.set(cache_key, json.dumps({"data": state_data}))
+        await self.cache.set(
+            cache_key,
+            json.dumps({"data": state_data}),
+            expires=OAUTH_STATE_CACHE_TTL_SECONDS,
+        )
         logger.debug(f"Saved OAuth state to cache key={cache_key} data={state_data}")
         return cast(str, rv["url"])
 

{oidcauthlib-3.0.7 → oidcauthlib-3.0.8}/oidcauthlib/auth/cache/oauth_memory_cache.py

@@ -14,11 +14,10 @@ class OAuthMemoryCache(OAuthCache):
     def id(self) -> uuid.UUID:
         return self.id_
 
-    _cache: dict[str, str] = {}
-
     def __init__(self) -> None:
         """Initialize the AuthCache."""
         self.id_ = uuid.uuid4()
+        self._cache: dict[str, str] = {}
 
     @override
     async def delete(self, key: str) -> None:

{oidcauthlib-3.0.7 → oidcauthlib-3.0.8}/oidcauthlib/auth/fastapi_auth_manager.py

@@ -143,15 +143,20 @@ class FastAPIAuthManager(AuthManager):
         # Retrieve state data saved by create_authorization_url
         cache_key = f"_state_{auth_provider}_{state}"
         cached_value = await self.cache.get(cache_key)
-        if cached_value:
-            state_data = json.loads(cached_value).get("data", {})
-            await self.cache.delete(cache_key)
-        else:
-            logger.warning(
-                "No cached state data found for key=%s — token exchange may fail (missing code_verifier/redirect_uri)",
+        if not cached_value:
+            from authlib.integrations.base_client import OAuthError
+
+            logger.error(
+                "No cached state data found for key=%s — aborting token exchange "
+                "(missing code_verifier/redirect_uri makes this a security risk)",
                 cache_key,
             )
-            state_data = {}
+            raise OAuthError(
+                error="invalid_state",
+                description="OAuth state validation failed: no cached state data found. "
+                "The state may have expired or was already consumed.",
+            )
+        state_data = json.loads(cached_value).get("data", {})
 
         # Build params for fetch_access_token
         params: Dict[str, Any] = {"code": code, "state": state}
@@ -163,6 +168,10 @@ class FastAPIAuthManager(AuthManager):
 
         token = await client.fetch_access_token(**params)  # type: ignore[no-untyped-call]
 
+        # Delete the cache entry only after a successful token exchange so the
+        # user can retry the callback if the exchange fails transiently.
+        await self.cache.delete(cache_key)
+
         # Parse id_token if present (OpenID Connect).
         # parse_id_token requires jwks_uri in server_metadata to verify the
         # signature.  When the provider was registered with explicit endpoints

{oidcauthlib-3.0.7 → oidcauthlib-3.0.8/oidcauthlib.egg-info}/PKG-INFO

@@ -1,13 +1,14 @@
 Metadata-Version: 2.4
 Name: oidcauthlib
-Version: 3.0.7
+Version: 3.0.8
 Summary: oidcauthlib
 Author-email: Imran Qureshi <imran.qureshi@bwell.com>
-License-Expression: Apache-2.0
+License: Apache-2.0
 Project-URL: Homepage, https://github.com/icanbwell/oidc-auth-lib
 Classifier: Development Status :: 4 - Beta
 Classifier: Programming Language :: Python :: 3
 Classifier: Operating System :: OS Independent
+Classifier: License :: OSI Approved :: Apache Software License
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE

{oidcauthlib-3.0.7 → oidcauthlib-3.0.8}/pyproject.toml

@@ -7,7 +7,7 @@ name = "oidcauthlib"
 dynamic = ["version"]
 description = "oidcauthlib"
 readme = "README.md"
-license = "Apache-2.0"
+license = { text = "Apache-2.0" }
 requires-python = ">=3.12"
 authors = [
     { name = "Imran Qureshi", email = "imran.qureshi@bwell.com" },
@@ -16,6 +16,7 @@ classifiers = [
     "Development Status :: 4 - Beta",
     "Programming Language :: Python :: 3",
     "Operating System :: OS Independent",
+    "License :: OSI Approved :: Apache Software License",
 ]
 dependencies = [
     "httpx>=0.27.2",

oidcauthlib-3.0.7/VERSION

@@ -1 +0,0 @@
-3.0.7