plain.oauth 0.27.0__tar.gz → 0.29.0__tar.gz

{plain_oauth-0.27.0 → plain_oauth-0.29.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plain.oauth
-Version: 0.27.0
+Version: 0.29.0
 Summary: Let users log in with OAuth providers.
 Author-email: Dave Gaeddert <dave.gaeddert@dropseed.dev>
 License-Expression: BSD-3-Clause

{plain_oauth-0.27.0 → plain_oauth-0.29.0}/plain/oauth/CHANGELOG.md

@@ -1,5 +1,28 @@
 # plain-oauth changelog
 
+## [0.29.0](https://github.com/dropseed/plain/releases/plain-oauth@0.29.0) (2025-10-02)
+
+### What's changed
+
+- Removed direct access to `request.user` and `request.session` attributes in favor of using `get_request_user()` and `get_request_session()` functions ([154ee10](https://github.com/dropseed/plain/commit/154ee10375))
+- Removed dependency on `AuthenticationMiddleware` from test settings ([154ee10](https://github.com/dropseed/plain/commit/154ee10375))
+
+### Upgrade instructions
+
+- If you have custom OAuth providers or views that access `request.user`, update them to use `get_request_user(request)` from `plain.auth`
+- If you have custom OAuth providers that access `request.session`, update them to use `get_request_session(request)` from `plain.sessions`
+
+## [0.28.0](https://github.com/dropseed/plain/releases/plain-oauth@0.28.0) (2025-09-30)
+
+### What's changed
+
+- `HttpRequest` has been renamed to `Request` throughout the OAuth provider classes ([cd46ff2](https://github.com/dropseed/plain/commit/cd46ff2003))
+
+### Upgrade instructions
+
+- If you have custom OAuth providers that override methods like `get_authorization_url_params`, `get_oauth_token`, `get_callback_url`, or any other methods that accept a request parameter, update the type hint from `HttpRequest` to `Request`
+- Update any imports of `HttpRequest` in custom OAuth provider code to import `Request` instead from `plain.http`
+
 ## [0.27.0](https://github.com/dropseed/plain/releases/plain-oauth@0.27.0) (2025-09-25)
 
 ### What's changed

{plain_oauth-0.27.0 → plain_oauth-0.29.0}/plain/oauth/providers.py

@@ -4,8 +4,10 @@ from typing import Any
 from urllib.parse import urlencode
 
 from plain.auth import login as auth_login
-from plain.http import HttpRequest, Response, ResponseRedirect
+from plain.auth.requests import get_request_user
+from plain.http import Request, Response, ResponseRedirect
 from plain.runtime import settings
+from plain.sessions import get_request_session
 from plain.urls import reverse
 from plain.utils.cache import add_never_cache_headers
 from plain.utils.crypto import get_random_string
@@ -65,7 +67,7 @@ class OAuthProvider:
         self.client_secret = client_secret
         self.scope = scope
 
-    def get_authorization_url_params(self, *, request: HttpRequest) -> dict:
+    def get_authorization_url_params(self, *, request: Request) -> dict:
         return {
             "redirect_uri": self.get_callback_url(request=request),
             "client_id": self.get_client_id(),
@@ -77,13 +79,13 @@ class OAuthProvider:
     def refresh_oauth_token(self, *, oauth_token: OAuthToken) -> OAuthToken:
         raise NotImplementedError()
 
-    def get_oauth_token(self, *, code: str, request: HttpRequest) -> OAuthToken:
+    def get_oauth_token(self, *, code: str, request: Request) -> OAuthToken:
         raise NotImplementedError()
 
     def get_oauth_user(self, *, oauth_token: OAuthToken) -> OAuthUser:
         raise NotImplementedError()
 
-    def get_authorization_url(self, *, request: HttpRequest) -> str:
+    def get_authorization_url(self, *, request: Request) -> str:
         return self.authorization_url
 
     def get_client_id(self) -> str:
@@ -95,14 +97,14 @@ class OAuthProvider:
     def get_scope(self) -> str:
         return self.scope
 
-    def get_callback_url(self, *, request: HttpRequest) -> str:
+    def get_callback_url(self, *, request: Request) -> str:
         url = reverse("oauth:callback", provider=self.provider_key)
         return request.build_absolute_uri(url)
 
     def generate_state(self) -> str:
         return get_random_string(length=32)
 
-    def check_request_state(self, *, request: HttpRequest) -> None:
+    def check_request_state(self, *, request: Request) -> None:
         if error := request.query_params.get("error"):
             raise OAuthError(error)
 
@@ -111,26 +113,29 @@ class OAuthProvider:
         except KeyError as e:
             raise OAuthStateMissingError() from e
 
-        expected_state = request.session.pop(SESSION_STATE_KEY)
-        request.session.save()  # Make sure the pop is saved (won't save on an exception)
+        session = get_request_session(request)
+        expected_state = session.pop(SESSION_STATE_KEY)
+        session.save()  # Make sure the pop is saved (won't save on an exception)
         if not secrets.compare_digest(state, expected_state):
             raise OAuthStateMismatchError()
 
     def handle_login_request(
-        self, *, request: HttpRequest, redirect_to: str = ""
+        self, *, request: Request, redirect_to: str = ""
     ) -> Response:
         authorization_url = self.get_authorization_url(request=request)
         authorization_params = self.get_authorization_url_params(request=request)
 
+        session = get_request_session(request)
+
         if "state" in authorization_params:
             # Store the state in the session so we can check on callback
-            request.session[SESSION_STATE_KEY] = authorization_params["state"]
+            session[SESSION_STATE_KEY] = authorization_params["state"]
 
         # Store next url in session so we can get it on the callback request
         if redirect_to:
-            request.session[SESSION_NEXT_KEY] = redirect_to
+            session[SESSION_NEXT_KEY] = redirect_to
         elif "next" in request.data:
-            request.session[SESSION_NEXT_KEY] = request.data["next"]
+            session[SESSION_NEXT_KEY] = request.data["next"]
 
         # Sort authorization params for consistency
         sorted_authorization_params = sorted(authorization_params.items())
@@ -138,11 +143,11 @@ class OAuthProvider:
         return self.get_redirect_response(redirect_url)
 
     def handle_connect_request(
-        self, *, request: HttpRequest, redirect_to: str = ""
+        self, *, request: Request, redirect_to: str = ""
     ) -> Response:
         return self.handle_login_request(request=request, redirect_to=redirect_to)
 
-    def handle_disconnect_request(self, *, request: HttpRequest) -> Response:
+    def handle_disconnect_request(self, *, request: Request) -> Response:
         provider_user_id = request.data["provider_user_id"]
         connection = OAuthConnection.query.get(
             provider_key=self.provider_key, provider_user_id=provider_user_id
@@ -151,7 +156,7 @@ class OAuthProvider:
         redirect_url = self.get_disconnect_redirect_url(request=request)
         return self.get_redirect_response(redirect_url)
 
-    def handle_callback_request(self, *, request: HttpRequest) -> Response:
+    def handle_callback_request(self, *, request: Request) -> Response:
         self.check_request_state(request=request)
 
         oauth_token = self.get_oauth_token(
@@ -159,9 +164,10 @@ class OAuthProvider:
         )
         oauth_user = self.get_oauth_user(oauth_token=oauth_token)
 
-        if request.user:
+        user = get_request_user(request)
+        if user:
             connection = OAuthConnection.connect(
-                user=request.user,
+                user=user,
                 provider_key=self.provider_key,
                 oauth_token=oauth_token,
                 oauth_user=oauth_user,
@@ -181,13 +187,14 @@ class OAuthProvider:
         redirect_url = self.get_login_redirect_url(request=request)
         return self.get_redirect_response(redirect_url)
 
-    def login(self, *, request: HttpRequest, user: Any) -> None:
+    def login(self, *, request: Request, user: Any) -> None:
         auth_login(request=request, user=user)
 
-    def get_login_redirect_url(self, *, request: HttpRequest) -> str:
-        return request.session.pop(SESSION_NEXT_KEY, "/")
+    def get_login_redirect_url(self, *, request: Request) -> str:
+        session = get_request_session(request)
+        return session.pop(SESSION_NEXT_KEY, "/")
 
-    def get_disconnect_redirect_url(self, *, request: HttpRequest) -> str:
+    def get_disconnect_redirect_url(self, *, request: Request) -> str:
         return request.data.get("next", "/")
 
     def get_redirect_response(self, redirect_url: str) -> Response:

{plain_oauth-0.27.0 → plain_oauth-0.29.0}/plain/oauth/views.py

@@ -1,5 +1,6 @@
 import logging
 
+from plain.auth.requests import get_request_user
 from plain.auth.views import AuthViewMixin
 from plain.http import ResponseRedirect
 from plain.views import TemplateView, View
@@ -16,7 +17,7 @@ class OAuthLoginView(View):
     def post(self):
         request = self.request
         provider = self.url_kwargs["provider"]
-        if request.user:
+        if get_request_user(request):
             return ResponseRedirect("/")
 
         provider_instance = get_oauth_provider_instance(provider_key=provider)

{plain_oauth-0.27.0 → plain_oauth-0.29.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "plain.oauth"
-version = "0.27.0"
+version = "0.29.0"
 description = "Let users log in with OAuth providers."
 authors = [{name = "Dave Gaeddert", email = "dave.gaeddert@dropseed.dev"}]
 license = "BSD-3-Clause"

{plain_oauth-0.27.0 → plain_oauth-0.29.0}/tests/app/settings.py

@@ -11,7 +11,6 @@ INSTALLED_PACKAGES = [
 ]
 MIDDLEWARE = [
     "plain.sessions.middleware.SessionMiddleware",
-    "plain.auth.middleware.AuthenticationMiddleware",
 ]
 AUTH_LOGIN_URL = "login"
 AUTH_USER_MODEL = "users.User"

{plain_oauth-0.27.0 → plain_oauth-0.29.0}/tests/app/templates/index.html

@@ -1,11 +1,11 @@
 {% extends "base.html" %}
 
 {% block content %}
-Hello {{ request.user }}!
+Hello {{ user }}!
 
 <h2>Existing connections</h2>
 <ul>
-    {% for connection in request.user.oauth_connections.query.all() %}
+    {% for connection in user.oauth_connections.query.all() %}
     <li>
         {{ connection.provider_key }} [ID: {{ connection.provider_user_id }}]
         <form action="{{ url('oauth:disconnect', connection.provider_key) }}" method="post">

{plain_oauth-0.27.0 → plain_oauth-0.29.0}/tests/app/urls.py

@@ -7,6 +7,7 @@ from plain.views import TemplateView
 
 class LoggedInView(AuthViewMixin, TemplateView):
     template_name = "index.html"
+    login_required = True
 
     def get_template_context(self):
         context = super().get_template_context()