reauth 0.2.0__tar.gz → 0.2.2__tar.gz

{reauth-0.2.0 → reauth-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: reauth
-Version: 0.2.0
+Version: 0.2.2
 Summary: The authentication toolkit for Python
 Project-URL: Documentation, https://frankie567.github.io/reauth/
 Project-URL: Source, https://github.com/frankie567/reauth

{reauth-0.2.0 → reauth-0.2.2}/reauth/__init__.py

@@ -2,6 +2,6 @@
 
 from reauth.logging import configure_logger, get_logger
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"
 
 __all__ = ["__version__", "configure_logger", "get_logger"]

{reauth-0.2.0 → reauth-0.2.2}/reauth/authentication_session.py

@@ -212,7 +212,8 @@ class AuthenticationSessionService(abc.ABC):
         authentication_session.identity_id = identity_id
         authentication_session.amr.append(factor.AMR)
         authentication_session.used_factors.append(factor.identifier)
-        authentication_session.step += 1
+        previous_step = authentication_session.step
+        authentication_session.step += factor.advance_by
         await self.update(authentication_session)
 
         logger.info(
@@ -222,6 +223,8 @@ class AuthenticationSessionService(abc.ABC):
                 "identity_id": identity_id,
                 "factor_identifier": factor.identifier,
                 "factor_amr": str(factor.AMR),
+                "previous_step": previous_step,
+                "advance_by": factor.advance_by,
                 "step": authentication_session.step,
             },
         )

{reauth-0.2.0 → reauth-0.2.2}/reauth/factors/backup_codes.py

@@ -68,6 +68,7 @@ class BackupCodesFactor(FactorBase[BackupCodesEnrollment], abc.ABC):
         chars: str = DEFAULT_CHARS,
         identifier: str = "backup_codes",
         step: int = 1,
+        advance_by: int = 1,
     ) -> None:
         """
         Initialize the backup codes factor.
@@ -79,8 +80,10 @@ class BackupCodesFactor(FactorBase[BackupCodesEnrollment], abc.ABC):
             chars: Character set for code generation (default: excludes ambiguous chars).
             identifier: Unique identifier for the factor (default: "backup_codes").
             step: Authentication step at which this factor can be used (default: 1).
+            advance_by: Number of steps to advance after successful verification
+                (default: 1).
         """
-        super().__init__(identifier=identifier, step=step)
+        super().__init__(identifier=identifier, step=step, advance_by=advance_by)
         self.hash_secret = hash_secret
         self.code_length = code_length
         self.code_count = code_count

{reauth-0.2.0 → reauth-0.2.2}/reauth/factors/base.py

@@ -6,6 +6,8 @@ from reauth.logging import get_logger
 
 logger = get_logger(__name__)
 
+_ADVANCE_BY_VALUE_ERROR = "advance_by must be at least 1"
+
 
 class FactorEnrollment(typing.Protocol):
     """
@@ -22,7 +24,7 @@ class FactorBase[ENROLLMENT: FactorEnrollment](abc.ABC):
 
     AMR: typing.ClassVar[AuthenticationMethodReference]
 
-    def __init__(self, *, identifier: str, step: int = 0) -> None:
+    def __init__(self, *, identifier: str, step: int = 0, advance_by: int = 1) -> None:
         """
         Initialize the factor base.
 
@@ -32,17 +34,27 @@ class FactorBase[ENROLLMENT: FactorEnrollment](abc.ABC):
             step: The authentication step at which this factor can be used.
                 Factors are only available when the session's current step matches this value.
                 Defaults to 0 (can be first factor).
+            advance_by: The number of steps to advance the authentication session after
+                this factor is successfully verified. Defaults to 1.
+
+        Raises:
+            ValueError: If advance_by is less than 1.
         """
+        if advance_by < 1:
+            raise ValueError(_ADVANCE_BY_VALUE_ERROR)
+
         logger.debug(
             "Factor initialized",
             extra={
                 "identifier": identifier,
                 "step": step,
+                "advance_by": advance_by,
                 "amr": str(self.AMR),
             },
         )
         self.identifier = identifier
         self.step = step
+        self.advance_by = advance_by
 
     @abc.abstractmethod
     async def get_enrollment(self, identity_id: typing.Any) -> ENROLLMENT | None:

{reauth-0.2.0 → reauth-0.2.2}/reauth/factors/email_otp.py

@@ -77,8 +77,9 @@ class EmailOTPFactor(FactorBase[EmailOTPEnrollment], abc.ABC):
         lifetime: datetime.timedelta = datetime.timedelta(minutes=10),
         identifier: str = "email_otp",
         step: int = 0,
+        advance_by: int = 1,
     ) -> None:
-        super().__init__(identifier=identifier, step=step)
+        super().__init__(identifier=identifier, step=step, advance_by=advance_by)
         self.hash_secret = hash_secret
         self.code_length = code_length
         self.lifetime = lifetime

{reauth-0.2.0 → reauth-0.2.2}/reauth/factors/hotp.py

@@ -97,8 +97,9 @@ class HOTPFactor(FactorBase[HOTPEnrollment], abc.ABC):
         look_ahead: int = 5,
         identifier: str = "hotp",
         step: int = 1,
+        advance_by: int = 1,
     ) -> None:
-        super().__init__(identifier=identifier, step=step)
+        super().__init__(identifier=identifier, step=step, advance_by=advance_by)
         self.code_length = code_length
         self.algorithm: HOTPAlgorithm = algorithm
         self.look_ahead = look_ahead

{reauth-0.2.0 → reauth-0.2.2}/reauth/factors/oauth2/apple.py

@@ -23,8 +23,6 @@ class AppleOAuth2Factor(OIDCFactorBase, abc.ABC):
         - Apple: https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret
     """
 
-    DISCOVERY_ENDPOINT = "https://appleid.apple.com/.well-known/openid-configuration"
-
     def __init__(
         self,
         *,
@@ -35,11 +33,14 @@ class AppleOAuth2Factor(OIDCFactorBase, abc.ABC):
         key_value: str,
         state_service: OAuth2StateService,
         step: int = 0,
+        advance_by: int = 1,
     ) -> None:
         super().__init__(
             identifier=identifier,
             step=step,
+            advance_by=advance_by,
             client_id=client_id,
+            discovery_endpoint="https://appleid.apple.com/.well-known/openid-configuration",
             state_service=state_service,
         )
         self.team_id = team_id

{reauth-0.2.0 → reauth-0.2.2}/reauth/factors/oauth2/base.py

@@ -220,8 +220,9 @@ class OAuth2Factor[EXTRA](FactorBase[OAuth2Enrollment], abc.ABC):
         client_id: str,
         state_service: OAuth2StateService,
         step: int = 0,
+        advance_by: int = 1,
     ) -> None:
-        super().__init__(identifier=identifier, step=step)
+        super().__init__(identifier=identifier, step=step, advance_by=advance_by)
         self.client_id = client_id
         self.state_service = state_service
 

{reauth-0.2.0 → reauth-0.2.2}/reauth/factors/oauth2/github.py

@@ -88,10 +88,12 @@ class GitHubOAuth2Factor(OAuth2Factor[GitHubOAuth2Extra], abc.ABC):
         client_secret: str,
         state_service: OAuth2StateService,
         step: int = 0,
+        advance_by: int = 1,
     ) -> None:
         super().__init__(
             identifier=identifier,
             step=step,
+            advance_by=advance_by,
             client_id=client_id,
             state_service=state_service,
         )

{reauth-0.2.0 → reauth-0.2.2}/reauth/factors/oauth2/google.py

@@ -12,8 +12,6 @@ class GoogleOAuth2Factor(OIDCFactor, abc.ABC):
         - Google: https://developers.google.com/identity/openid-connect/openid-connect
     """
 
-    DISCOVERY_ENDPOINT = "https://accounts.google.com/.well-known/openid-configuration"
-
     def __init__(
         self,
         *,
@@ -22,11 +20,14 @@ class GoogleOAuth2Factor(OIDCFactor, abc.ABC):
         client_secret: str,
         state_service: OAuth2StateService,
         step: int = 0,
+        advance_by: int = 1,
     ) -> None:
         super().__init__(
             identifier=identifier,
             step=step,
+            advance_by=advance_by,
             client_id=client_id,
             client_secret=client_secret,
+            discovery_endpoint="https://accounts.google.com/.well-known/openid-configuration",
             state_service=state_service,
         )

{reauth-0.2.0 → reauth-0.2.2}/reauth/factors/oauth2/oidc.py

@@ -308,22 +308,24 @@ class OIDCFactorBase(OAuth2Factor[OIDCExtraParams], abc.ABC):
         - OpenID Connect Core 1.0: https://openid.net/specs/openid-connect-core-1_0.html
     """
 
-    DISCOVERY_ENDPOINT: typing.ClassVar[str]
-
     def __init__(
         self,
         *,
         identifier: str,
         client_id: str,
+        discovery_endpoint: str,
         state_service: OAuth2StateService,
         step: int = 0,
+        advance_by: int = 1,
     ) -> None:
         super().__init__(
             identifier=identifier,
             step=step,
+            advance_by=advance_by,
             client_id=client_id,
             state_service=state_service,
         )
+        self.discovery_endpoint = discovery_endpoint
         self._discovery_document: dict[str, typing.Any] | None = None
         self._jwks: jwt.PyJWKSet | None = None
         self._client = httpx.AsyncClient()
@@ -561,7 +563,7 @@ class OIDCFactorBase(OAuth2Factor[OIDCExtraParams], abc.ABC):
 
         client = self._get_client()
         try:
-            response = await client.get(self.DISCOVERY_ENDPOINT)
+            response = await client.get(self.discovery_endpoint)
             response.raise_for_status()
         except httpx.HTTPError as e:
             raise DiscoveryDocumentException() from e
@@ -608,14 +610,18 @@ class OIDCFactor(OIDCFactorBase):
         identifier: str,
         client_id: str,
         client_secret: str,
+        discovery_endpoint: str,
         state_service: OAuth2StateService,
         step: int = 0,
+        advance_by: int = 1,
     ) -> None:
         super().__init__(
             identifier=identifier,
             client_id=client_id,
+            discovery_endpoint=discovery_endpoint,
             state_service=state_service,
             step=step,
+            advance_by=advance_by,
         )
         self._client_secret = client_secret
 
@@ -657,15 +663,19 @@ class PrivateKeyJWTOIDCFactor(OIDCFactorBase):
         client_id: str,
         jwks: jwt.PyJWKSet,
         kid: str,
+        discovery_endpoint: str,
         state_service: OAuth2StateService,
         assertion_lifetime: int = 60,
         step: int = 0,
+        advance_by: int = 1,
     ) -> None:
         super().__init__(
             identifier=identifier,
             client_id=client_id,
+            discovery_endpoint=discovery_endpoint,
             state_service=state_service,
             step=step,
+            advance_by=advance_by,
         )
         self._signing_jwks = jwks
         self._kid = kid

{reauth-0.2.0 → reauth-0.2.2}/reauth/factors/totp.py

@@ -109,8 +109,9 @@ class TOTPFactor(FactorBase[TOTPEnrollment], abc.ABC):
         drift_tolerance: int = 1,
         identifier: str = "totp",
         step: int = 1,
+        advance_by: int = 1,
     ) -> None:
-        super().__init__(identifier=identifier, step=step)
+        super().__init__(identifier=identifier, step=step, advance_by=advance_by)
         self.code_length = code_length
         self.algorithm: TOTPAlgorithm = algorithm
         self.time_step = time_step

{reauth-0.2.0 → reauth-0.2.2}/tests/factors/oauth2/test_oidc.py

@@ -136,8 +136,6 @@ def _create_token_response(
 class SQLAlchemyOIDCFactor(OIDCFactor):
     """Concrete implementation of OIDCFactor using SQLAlchemy for testing."""
 
-    DISCOVERY_ENDPOINT = DISCOVERY_ENDPOINT
-
     def __init__(
         self,
         connection: AsyncConnection,
@@ -149,6 +147,7 @@ class SQLAlchemyOIDCFactor(OIDCFactor):
             identifier="oidc",
             client_id="test-client-id",
             client_secret="test-client-secret",
+            discovery_endpoint=DISCOVERY_ENDPOINT,
             state_service=state_service,
         )
 
@@ -654,8 +653,6 @@ class TestOIDCFactorExchangeCode:
 
 
 class _PrivateKeyJWTFactor(PrivateKeyJWTOIDCFactor):
-    DISCOVERY_ENDPOINT = DISCOVERY_ENDPOINT
-
     async def insert(self, enrollment: OAuth2Enrollment) -> int:
         raise NotImplementedError()
 
@@ -686,6 +683,7 @@ class TestPrivateKeyJWTOIDCFactorGetRequestAuthentication:
             client_id="test-client-id",
             jwks=get_private_jwks_from_rsa_key(rsa_key, "sign-key-1"),
             kid="sign-key-1",
+            discovery_endpoint=DISCOVERY_ENDPOINT,
             state_service=oauth2_state_service,
         )
 
@@ -719,6 +717,7 @@ class TestPrivateKeyJWTOIDCFactorGetRequestAuthentication:
             client_id="test-client-id",
             jwks=get_private_jwks_from_rsa_key(rsa_key, "sign-key-1"),
             kid="unknown-key",
+            discovery_endpoint=DISCOVERY_ENDPOINT,
             state_service=oauth2_state_service,
         )
 

{reauth-0.2.0 → reauth-0.2.2}/tests/test_authentication_session.py

@@ -69,6 +69,20 @@ class DummyPasswordFactor(FactorBase[DummyPasswordFactorEnrollment]):
         return DummyPasswordFactorEnrollment(id=1, identity_id=identity_id)
 
 
+class DummySSOFactor(FactorBase[DummyPasswordFactorEnrollment]):
+    AMR = AuthenticationMethodReference.OAUTH2
+
+    def __init__(self) -> None:
+        super().__init__(identifier="dummy_sso", step=0, advance_by=2)
+
+    async def get_enrollment(
+        self, identity_id: int
+    ) -> DummyPasswordFactorEnrollment | None:
+        if identity_id != 1:
+            return None
+        return DummyPasswordFactorEnrollment(id=1, identity_id=identity_id)
+
+
 @dataclasses.dataclass
 class DummyMFAFactorEnrollment:
     id: int | None
@@ -363,6 +377,30 @@ class TestAdvance:
         assert updated_session.id == session.id
         assert updated_session.amr == [AuthenticationMethodReference.PWD]
         assert updated_session.used_factors == ["dummy_password"]
+        assert updated_session.step == 1
+
+    async def test_factor_can_skip_next_step(
+        self,
+        sqlalchemy_connection: AsyncConnection,
+        mfa_factor: DummyMFAFactor,
+    ) -> None:
+        trusted_factor = DummySSOFactor()
+        authentication_session_service = SQLAlchemyAuthenticationSession(
+            connection=sqlalchemy_connection,
+            hash_secret="test_secret",
+            factors={trusted_factor, mfa_factor},
+        )
+        _token, session = await authentication_session_service.start()
+
+        updated_session = await authentication_session_service.advance(
+            session, 1, trusted_factor
+        )
+
+        assert updated_session.step == 2
+        assert (
+            await authentication_session_service.get_available_factors(updated_session)
+            == set()
+        )
 
     async def test_identity_one_factor_enrolled(
         self,