oidcauthlib 3.0.7__tar.gz → 3.0.9__tar.gz

{oidcauthlib-3.0.7/oidcauthlib.egg-info → oidcauthlib-3.0.9}/PKG-INFO

@@ -1,13 +1,14 @@
 Metadata-Version: 2.4
 Name: oidcauthlib
-Version: 3.0.7
+Version: 3.0.9
 Summary: oidcauthlib
 Author-email: Imran Qureshi <imran.qureshi@bwell.com>
-License-Expression: Apache-2.0
+License: Apache-2.0
 Project-URL: Homepage, https://github.com/icanbwell/oidc-auth-lib
 Classifier: Development Status :: 4 - Beta
 Classifier: Programming Language :: Python :: 3
 Classifier: Operating System :: OS Independent
+Classifier: License :: OSI Approved :: Apache Software License
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE

oidcauthlib-3.0.9/VERSION

@@ -0,0 +1 @@
+3.0.9

{oidcauthlib-3.0.7 → oidcauthlib-3.0.9}/oidcauthlib/auth/auth_manager.py

@@ -38,6 +38,7 @@ from oidcauthlib.utilities.url_validator import validate_url
 
 logger = logging.getLogger(__name__)
 logger.setLevel(SRC_LOG_LEVELS["AUTH"])
+OAUTH_STATE_CACHE_TTL_SECONDS: int = int(os.getenv("OAUTH_STATE_CACHE_TTL_SECONDS", "300"))
 
 
 class AuthManager:
@@ -273,7 +274,11 @@ class AuthManager:
         if "nonce" in rv:
             state_data["nonce"] = rv["nonce"]
         cache_key = f"_state_{auth_provider}_{state}"
-        await self.cache.set(cache_key, json.dumps({"data": state_data}))
+        await self.cache.set(
+            cache_key,
+            json.dumps({"data": state_data}),
+            expires=OAUTH_STATE_CACHE_TTL_SECONDS,
+        )
         logger.debug(f"Saved OAuth state to cache key={cache_key} data={state_data}")
         return cast(str, rv["url"])
 

{oidcauthlib-3.0.7 → oidcauthlib-3.0.9}/oidcauthlib/auth/cache/oauth_memory_cache.py

@@ -14,11 +14,10 @@ class OAuthMemoryCache(OAuthCache):
     def id(self) -> uuid.UUID:
         return self.id_
 
-    _cache: dict[str, str] = {}
-
     def __init__(self) -> None:
         """Initialize the AuthCache."""
         self.id_ = uuid.uuid4()
+        self._cache: dict[str, str] = {}
 
     @override
     async def delete(self, key: str) -> None:

{oidcauthlib-3.0.7 → oidcauthlib-3.0.9}/oidcauthlib/auth/fastapi_auth_manager.py

@@ -143,15 +143,20 @@ class FastAPIAuthManager(AuthManager):
         # Retrieve state data saved by create_authorization_url
         cache_key = f"_state_{auth_provider}_{state}"
         cached_value = await self.cache.get(cache_key)
-        if cached_value:
-            state_data = json.loads(cached_value).get("data", {})
-            await self.cache.delete(cache_key)
-        else:
-            logger.warning(
-                "No cached state data found for key=%s — token exchange may fail (missing code_verifier/redirect_uri)",
+        if not cached_value:
+            from authlib.integrations.base_client import OAuthError
+
+            logger.error(
+                "No cached state data found for key=%s — aborting token exchange "
+                "(missing code_verifier/redirect_uri makes this a security risk)",
                 cache_key,
             )
-            state_data = {}
+            raise OAuthError(
+                error="invalid_state",
+                description="OAuth state validation failed: no cached state data found. "
+                "The state may have expired or was already consumed.",
+            )
+        state_data = json.loads(cached_value).get("data", {})
 
         # Build params for fetch_access_token
         params: Dict[str, Any] = {"code": code, "state": state}
@@ -163,6 +168,10 @@ class FastAPIAuthManager(AuthManager):
 
         token = await client.fetch_access_token(**params)  # type: ignore[no-untyped-call]
 
+        # Delete the cache entry only after a successful token exchange so the
+        # user can retry the callback if the exchange fails transiently.
+        await self.cache.delete(cache_key)
+
         # Parse id_token if present (OpenID Connect).
         # parse_id_token requires jwks_uri in server_metadata to verify the
         # signature.  When the provider was registered with explicit endpoints

{oidcauthlib-3.0.7 → oidcauthlib-3.0.9}/oidcauthlib/auth/well_known_configuration/well_known_configuration_cache.py

@@ -247,6 +247,7 @@ class WellKnownConfigurationCache:
                             await self.well_known_store.put(
                                 key=well_known_uri,
                                 value=well_known_configuration_cache_result.model_dump(),
+                                ttl=self.environment_variables.well_known_cache_ttl_seconds,
                             )
                             logger.info(f"Cached OIDC discovery document for {well_known_uri}")
                         return well_known_configuration_cache_result

{oidcauthlib-3.0.7 → oidcauthlib-3.0.9}/oidcauthlib/utilities/environment/oidc_environment_variables.py

@@ -196,6 +196,26 @@ class OidcEnvironmentVariables(AbstractEnvironmentVariables):
         except ValueError:
             raise ValueError("MAX_MONGO_INLINE_SIZE_KB must be a positive integer representing bytes")
 
+    @property
+    def well_known_cache_ttl_seconds(self) -> int:
+        """TTL in seconds for well-known configuration entries in the persistent store.
+
+        Controls how long OIDC discovery documents (including JWKS keys) are
+        cached in MongoDB before expiring. This ensures key rotations by
+        identity providers are picked up within a bounded window.
+
+        Set via WELL_KNOWN_CACHE_TTL_SECONDS environment variable.
+        Defaults to 3600 seconds (1 hour).
+
+        Returns:
+            TTL in seconds
+        """
+        try:
+            ttl = int(os.environ.get("WELL_KNOWN_CACHE_TTL_SECONDS", "3600"))
+            return ttl
+        except ValueError:
+            raise ValueError("WELL_KNOWN_CACHE_TTL_SECONDS must be a positive integer representing seconds")
+
     @property
     def well_known_config_http_timeout_seconds(self) -> int:
         """HTTP timeout in seconds for fetching well-known configurations.

{oidcauthlib-3.0.7 → oidcauthlib-3.0.9/oidcauthlib.egg-info}/PKG-INFO

@@ -1,13 +1,14 @@
 Metadata-Version: 2.4
 Name: oidcauthlib
-Version: 3.0.7
+Version: 3.0.9
 Summary: oidcauthlib
 Author-email: Imran Qureshi <imran.qureshi@bwell.com>
-License-Expression: Apache-2.0
+License: Apache-2.0
 Project-URL: Homepage, https://github.com/icanbwell/oidc-auth-lib
 Classifier: Development Status :: 4 - Beta
 Classifier: Programming Language :: Python :: 3
 Classifier: Operating System :: OS Independent
+Classifier: License :: OSI Approved :: Apache Software License
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE

{oidcauthlib-3.0.7 → oidcauthlib-3.0.9}/pyproject.toml

@@ -7,7 +7,7 @@ name = "oidcauthlib"
 dynamic = ["version"]
 description = "oidcauthlib"
 readme = "README.md"
-license = "Apache-2.0"
+license = { text = "Apache-2.0" }
 requires-python = ">=3.12"
 authors = [
     { name = "Imran Qureshi", email = "imran.qureshi@bwell.com" },
@@ -16,6 +16,7 @@ classifiers = [
     "Development Status :: 4 - Beta",
     "Programming Language :: Python :: 3",
     "Operating System :: OS Independent",
+    "License :: OSI Approved :: Apache Software License",
 ]
 dependencies = [
     "httpx>=0.27.2",

oidcauthlib-3.0.7/VERSION

@@ -1 +0,0 @@
-3.0.7