plain.oauth 0.28.0__tar.gz → 0.29.0__tar.gz

{plain_oauth-0.28.0 → plain_oauth-0.29.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plain.oauth
-Version: 0.28.0
+Version: 0.29.0
 Summary: Let users log in with OAuth providers.
 Author-email: Dave Gaeddert <dave.gaeddert@dropseed.dev>
 License-Expression: BSD-3-Clause

{plain_oauth-0.28.0 → plain_oauth-0.29.0}/plain/oauth/CHANGELOG.md

@@ -1,5 +1,17 @@
 # plain-oauth changelog
 
+## [0.29.0](https://github.com/dropseed/plain/releases/plain-oauth@0.29.0) (2025-10-02)
+
+### What's changed
+
+- Removed direct access to `request.user` and `request.session` attributes in favor of using `get_request_user()` and `get_request_session()` functions ([154ee10](https://github.com/dropseed/plain/commit/154ee10375))
+- Removed dependency on `AuthenticationMiddleware` from test settings ([154ee10](https://github.com/dropseed/plain/commit/154ee10375))
+
+### Upgrade instructions
+
+- If you have custom OAuth providers or views that access `request.user`, update them to use `get_request_user(request)` from `plain.auth`
+- If you have custom OAuth providers that access `request.session`, update them to use `get_request_session(request)` from `plain.sessions`
+
 ## [0.28.0](https://github.com/dropseed/plain/releases/plain-oauth@0.28.0) (2025-09-30)
 
 ### What's changed

{plain_oauth-0.28.0 → plain_oauth-0.29.0}/plain/oauth/providers.py

@@ -4,8 +4,10 @@ from typing import Any
 from urllib.parse import urlencode
 
 from plain.auth import login as auth_login
+from plain.auth.requests import get_request_user
 from plain.http import Request, Response, ResponseRedirect
 from plain.runtime import settings
+from plain.sessions import get_request_session
 from plain.urls import reverse
 from plain.utils.cache import add_never_cache_headers
 from plain.utils.crypto import get_random_string
@@ -111,8 +113,9 @@ class OAuthProvider:
         except KeyError as e:
             raise OAuthStateMissingError() from e
 
-        expected_state = request.session.pop(SESSION_STATE_KEY)
-        request.session.save()  # Make sure the pop is saved (won't save on an exception)
+        session = get_request_session(request)
+        expected_state = session.pop(SESSION_STATE_KEY)
+        session.save()  # Make sure the pop is saved (won't save on an exception)
         if not secrets.compare_digest(state, expected_state):
             raise OAuthStateMismatchError()
 
@@ -122,15 +125,17 @@ class OAuthProvider:
         authorization_url = self.get_authorization_url(request=request)
         authorization_params = self.get_authorization_url_params(request=request)
 
+        session = get_request_session(request)
+
         if "state" in authorization_params:
             # Store the state in the session so we can check on callback
-            request.session[SESSION_STATE_KEY] = authorization_params["state"]
+            session[SESSION_STATE_KEY] = authorization_params["state"]
 
         # Store next url in session so we can get it on the callback request
         if redirect_to:
-            request.session[SESSION_NEXT_KEY] = redirect_to
+            session[SESSION_NEXT_KEY] = redirect_to
         elif "next" in request.data:
-            request.session[SESSION_NEXT_KEY] = request.data["next"]
+            session[SESSION_NEXT_KEY] = request.data["next"]
 
         # Sort authorization params for consistency
         sorted_authorization_params = sorted(authorization_params.items())
@@ -159,9 +164,10 @@ class OAuthProvider:
         )
         oauth_user = self.get_oauth_user(oauth_token=oauth_token)
 
-        if request.user:
+        user = get_request_user(request)
+        if user:
             connection = OAuthConnection.connect(
-                user=request.user,
+                user=user,
                 provider_key=self.provider_key,
                 oauth_token=oauth_token,
                 oauth_user=oauth_user,
@@ -185,7 +191,8 @@ class OAuthProvider:
         auth_login(request=request, user=user)
 
     def get_login_redirect_url(self, *, request: Request) -> str:
-        return request.session.pop(SESSION_NEXT_KEY, "/")
+        session = get_request_session(request)
+        return session.pop(SESSION_NEXT_KEY, "/")
 
     def get_disconnect_redirect_url(self, *, request: Request) -> str:
         return request.data.get("next", "/")

{plain_oauth-0.28.0 → plain_oauth-0.29.0}/plain/oauth/views.py

@@ -1,5 +1,6 @@
 import logging
 
+from plain.auth.requests import get_request_user
 from plain.auth.views import AuthViewMixin
 from plain.http import ResponseRedirect
 from plain.views import TemplateView, View
@@ -16,7 +17,7 @@ class OAuthLoginView(View):
     def post(self):
         request = self.request
         provider = self.url_kwargs["provider"]
-        if request.user:
+        if get_request_user(request):
             return ResponseRedirect("/")
 
         provider_instance = get_oauth_provider_instance(provider_key=provider)

{plain_oauth-0.28.0 → plain_oauth-0.29.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "plain.oauth"
-version = "0.28.0"
+version = "0.29.0"
 description = "Let users log in with OAuth providers."
 authors = [{name = "Dave Gaeddert", email = "dave.gaeddert@dropseed.dev"}]
 license = "BSD-3-Clause"

{plain_oauth-0.28.0 → plain_oauth-0.29.0}/tests/app/settings.py

@@ -11,7 +11,6 @@ INSTALLED_PACKAGES = [
 ]
 MIDDLEWARE = [
     "plain.sessions.middleware.SessionMiddleware",
-    "plain.auth.middleware.AuthenticationMiddleware",
 ]
 AUTH_LOGIN_URL = "login"
 AUTH_USER_MODEL = "users.User"

{plain_oauth-0.28.0 → plain_oauth-0.29.0}/tests/app/templates/index.html

@@ -1,11 +1,11 @@
 {% extends "base.html" %}
 
 {% block content %}
-Hello {{ request.user }}!
+Hello {{ user }}!
 
 <h2>Existing connections</h2>
 <ul>
-    {% for connection in request.user.oauth_connections.query.all() %}
+    {% for connection in user.oauth_connections.query.all() %}
     <li>
         {{ connection.provider_key }} [ID: {{ connection.provider_user_id }}]
         <form action="{{ url('oauth:disconnect', connection.provider_key) }}" method="post">

{plain_oauth-0.28.0 → plain_oauth-0.29.0}/tests/app/urls.py

@@ -7,6 +7,7 @@ from plain.views import TemplateView
 
 class LoggedInView(AuthViewMixin, TemplateView):
     template_name = "index.html"
+    login_required = True
 
     def get_template_context(self):
         context = super().get_template_context()