simple-module-oidc 0.0.43__tar.gz → 0.0.44__tar.gz

{simple_module_oidc-0.0.43 → simple_module_oidc-0.0.44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_oidc
-Version: 0.0.43
+Version: 0.0.44
 Summary: Generic OIDC authentication provider for simple_module — native Microsoft Entra ID, Auth0, Okta, Keycloak, and any OpenID Connect identity provider
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -21,10 +21,10 @@ Requires-Python: >=3.12
 Requires-Dist: cryptography>=42
 Requires-Dist: httpx<0.29,>=0.27
 Requires-Dist: pyjwt[crypto]<3,>=2.8
-Requires-Dist: simple-module-auth==0.0.43
-Requires-Dist: simple-module-core==0.0.43
-Requires-Dist: simple-module-db==0.0.43
-Requires-Dist: simple-module-hosting==0.0.43
+Requires-Dist: simple-module-auth==0.0.44
+Requires-Dist: simple-module-core==0.0.44
+Requires-Dist: simple-module-db==0.0.44
+Requires-Dist: simple-module-hosting==0.0.44
 Description-Content-Type: text/markdown
 
 # simple_module_oidc

simple_module_oidc-0.0.44/oidc/core/__init__.py

@@ -0,0 +1,4 @@
+"""What the OIDC provider builds on.
+
+Constants, settings, presets, app state and the app-free runtime.
+"""

{simple_module_oidc-0.0.43/oidc → simple_module_oidc-0.0.44/oidc/core}/runtime.py

@@ -4,10 +4,10 @@ import logging
 
 from fastapi import HTTPException, Request
 
-from oidc.client import OIDCClient
-from oidc.constants import SESSION_USER_KEY
-from oidc.discovery import fetch_metadata
-from oidc.jwks import JWKSCache
+from oidc.core.constants import SESSION_USER_KEY
+from oidc.identity.client import OIDCClient
+from oidc.identity.discovery import fetch_metadata
+from oidc.identity.jwks import JWKSCache
 
 logger = logging.getLogger(__name__)
 _DISCOVERY_SUFFIX = "/.well-known/openid-configuration"

{simple_module_oidc-0.0.43/oidc → simple_module_oidc-0.0.44/oidc/core}/settings.py

@@ -17,8 +17,8 @@ from simple_module_core.redirect_safety import non_empty_redirect
 from simple_module_core.settings_base import DbBackedSettings
 from simple_module_core.stored_settings import field_error
 
-from oidc.constants import DEFAULT_LOGIN_REDIRECT_URL
-from oidc.presets import get_preset
+from oidc.core.constants import DEFAULT_LOGIN_REDIRECT_URL
+from oidc.core.presets import get_preset
 
 # Sentinel for "unset by the user" so the preset can supply a default while still
 # letting an explicit empty/other value win.

{simple_module_oidc-0.0.43/oidc → simple_module_oidc-0.0.44/oidc/core}/state.py

@@ -7,10 +7,10 @@ from dataclasses import dataclass, field
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
-    from oidc.client import OIDCClient
-    from oidc.discovery import OidcMetadata
-    from oidc.jwks import JWKSCache
-    from oidc.settings import OidcSettings
+    from oidc.core.settings import OidcSettings
+    from oidc.identity.client import OIDCClient
+    from oidc.identity.discovery import OidcMetadata
+    from oidc.identity.jwks import JWKSCache
 
 
 @dataclass

simple_module_oidc-0.0.44/oidc/identity/__init__.py

@@ -0,0 +1,5 @@
+"""The auth provider.
+
+Discovery, OIDC client, token renewal and encryption, JWKS, the user directory
+and its cache persistence.
+"""

{simple_module_oidc-0.0.43/oidc → simple_module_oidc-0.0.44/oidc/identity}/provider.py

@@ -12,18 +12,22 @@ from auth.oidc_common.tenant import trusted_tenant, without_tenant_roles
 from simple_module_hosting.session import SESSION_EXPIRES_AT_KEY, session_has_expired
 from starlette.requests import Request
 
-from oidc.constants import LOGIN_PATH, LOGOUT_PATH, SESSION_USER_KEY
-from oidc.persistence import CachePersistence
-from oidc.renewal import SessionRenewal
+from oidc.core.constants import LOGIN_PATH, LOGOUT_PATH, SESSION_USER_KEY
+from oidc.identity.persistence import CachePersistence
+from oidc.identity.renewal import SessionRenewal
 
 if TYPE_CHECKING:
-    from oidc.jwks import JWKSCache
-    from oidc.settings import OidcSettings
-    from oidc.state import OidcState
+    from oidc.core.settings import OidcSettings
+    from oidc.core.state import OidcState
+    from oidc.identity.jwks import JWKSCache
 
 logger = logging.getLogger(__name__)
 
 
+class IdentityUnavailableError(Exception):
+    """The user cache could not record the signed-in identity."""
+
+
 class OidcAuthProvider(CachePersistence, SessionRenewal):
     """Generic OIDC authentication with issuer-scoped identities."""
 
@@ -113,6 +117,23 @@ class OidcAuthProvider(CachePersistence, SessionRenewal):
         logger.info("OIDC bearer token from a client not in api_allowed_client_ids")
         return False
 
+    async def sign_in_from_claims(
+        self, request: Request, claims: dict[str, Any]
+    ) -> tuple[UserContext, tuple[str, str]]:
+        """Turn verified ID-token claims into a browser sign-in.
+
+        Returns the session ``UserContext`` and the ``(issuer, subject)``
+        identity to pin the session to. The caller has already validated the
+        token, nonce and expiry. Raises ``ValueError`` when the claims carry no
+        usable identity and ``IdentityUnavailableError`` when the user cache
+        refuses it.
+        """
+        identity = self._identity(claims)
+        cache_id = await self._upsert_user_cache(request, claims)
+        if cache_id is None:
+            raise IdentityUnavailableError("OIDC identity unavailable")
+        return self._claims_to_user_context(claims, cache_id=cache_id), identity
+
     def _claims_to_user_context(
         self,
         claims: dict[str, Any],

{simple_module_oidc-0.0.43/oidc → simple_module_oidc-0.0.44/oidc/identity}/renewal.py

@@ -3,14 +3,14 @@
 from auth.oidc_common.renewal import refresh_session
 from auth.oidc_common.session import SessionKeys, accept_authority, authority_marker
 
-from oidc.constants import (
+from oidc.core.constants import (
     SESSION_IDENTITY_KEY,
     SESSION_REFRESH_RETRY_AT_KEY,
     SESSION_REFRESH_TOKEN_KEY,
     SESSION_USER_KEY,
 )
-from oidc.runtime import require_client
-from oidc.tokens import open_refresh_token, store_refresh_token
+from oidc.core.runtime import require_client
+from oidc.identity.tokens import open_refresh_token, store_refresh_token
 
 _KEYS = SessionKeys(
     SESSION_USER_KEY,

{simple_module_oidc-0.0.43/oidc → simple_module_oidc-0.0.44/oidc/identity}/tokens.py

@@ -2,7 +2,7 @@
 
 from auth.oidc_common.tokens import provider_tokens
 
-from oidc.constants import SESSION_REFRESH_TOKEN_KEY
+from oidc.core.constants import SESSION_REFRESH_TOKEN_KEY
 
 _TOKENS = provider_tokens(info=b"oidc-refresh-token", session_key=SESSION_REFRESH_TOKEN_KEY)
 seal_refresh_token = _TOKENS.seal_refresh_token

simple_module_oidc-0.0.44/oidc/jwks.py

@@ -0,0 +1,11 @@
+"""Moved to :mod:`oidc.identity.jwks`; this alias goes in 0.0.46 (module layout)."""
+
+from __future__ import annotations
+
+import importlib
+import sys
+
+from simple_module_core.deprecation import deprecated_module
+
+deprecated_module("oidc.jwks", remove_in="0.0.46", use="oidc.identity.jwks")
+sys.modules[__name__] = importlib.import_module("oidc.identity.jwks")

{simple_module_oidc-0.0.43 → simple_module_oidc-0.0.44}/oidc/module.py

@@ -11,7 +11,7 @@ from simple_module_core.module import ModuleBase, ModuleMeta
 from simple_module_core.module_settings import register_module_settings
 from simple_module_core.user_directory import set_user_directory
 
-from oidc.constants import (
+from oidc.core.constants import (
     _MODULE_AUTH,
     _MODULE_SETTINGS,
     AUTH_CALLBACK_PATH,
@@ -36,10 +36,10 @@ class OidcModule(ModuleBase):
     _is_auth_provider = True
 
     def register_settings(self, app: FastAPI) -> None:
-        from oidc.directory import OidcDirectory
-        from oidc.provider import OidcAuthProvider
-        from oidc.settings import OidcSettings
-        from oidc.state import OidcState
+        from oidc.core.settings import OidcSettings
+        from oidc.core.state import OidcState
+        from oidc.identity.directory import OidcDirectory
+        from oidc.identity.provider import OidcAuthProvider
 
         register_module_settings(
             app,
@@ -67,8 +67,8 @@ class OidcModule(ModuleBase):
         )
 
     def register_routes(self, api_router: APIRouter, view_router: APIRouter) -> None:
-        from oidc.endpoints.api import router as api
-        from oidc.endpoints.views import router as views
+        from oidc.web.endpoints.api import router as api
+        from oidc.web.endpoints.views import router as views
 
         api_router.include_router(api)
         view_router.include_router(views)
@@ -79,7 +79,7 @@ class OidcModule(ModuleBase):
         registry.add_exact(LOGOUT_PATH, methods={"POST"})
 
     async def on_startup(self, app: FastAPI) -> None:
-        from oidc.runtime import initialize
+        from oidc.core.runtime import initialize
 
         await initialize(app)
 

simple_module_oidc-0.0.44/oidc/provider.py

@@ -0,0 +1,11 @@
+"""Moved to :mod:`oidc.identity.provider`; this alias goes in 0.0.46 (module layout)."""
+
+from __future__ import annotations
+
+import importlib
+import sys
+
+from simple_module_core.deprecation import deprecated_module
+
+deprecated_module("oidc.provider", remove_in="0.0.46", use="oidc.identity.provider")
+sys.modules[__name__] = importlib.import_module("oidc.identity.provider")

simple_module_oidc-0.0.44/oidc/settings.py

@@ -0,0 +1,11 @@
+"""Moved to :mod:`oidc.core.settings`; this alias goes in 0.0.46 (module layout)."""
+
+from __future__ import annotations
+
+import importlib
+import sys
+
+from simple_module_core.deprecation import deprecated_module
+
+deprecated_module("oidc.settings", remove_in="0.0.46", use="oidc.core.settings")
+sys.modules[__name__] = importlib.import_module("oidc.core.settings")

simple_module_oidc-0.0.44/oidc/web/__init__.py

@@ -0,0 +1 @@
+"""The HTTP side: the REST and Inertia endpoints."""

{simple_module_oidc-0.0.43/oidc → simple_module_oidc-0.0.44/oidc/web}/endpoints/api.py

@@ -10,15 +10,16 @@ from auth.oidc_common.session import sign_in, stale_callback
 from fastapi import APIRouter, HTTPException, Request
 from starlette.responses import RedirectResponse
 
-from oidc.constants import (
+from oidc.core.constants import (
     SESSION_IDENTITY_KEY,
     SESSION_NONCE_KEY,
     SESSION_STATE_KEY,
     SESSION_USER_KEY,
     SESSION_VERIFIER_KEY,
 )
-from oidc.runtime import require_client
-from oidc.tokens import store_refresh_token
+from oidc.core.runtime import require_client
+from oidc.identity.provider import IdentityUnavailableError
+from oidc.identity.tokens import store_refresh_token
 
 logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/auth", tags=["oidc-auth"])
@@ -97,13 +98,11 @@ async def oidc_callback(request: Request):
         raise HTTPException(status_code=401, detail="Invalid ID token expiry")
     provider = request.app.state.auth.auth_provider
     try:
-        identity = provider._identity(claims)
+        user_ctx, identity = await provider.sign_in_from_claims(request, claims)
     except ValueError:
         raise HTTPException(status_code=401, detail="Missing OIDC identity") from None
-    cache_id = await provider._upsert_user_cache(request, claims)
-    if cache_id is None:
-        raise HTTPException(status_code=503, detail="OIDC identity unavailable")
-    user_ctx = provider._claims_to_user_context(claims, cache_id=cache_id)
+    except IdentityUnavailableError:
+        raise HTTPException(status_code=503, detail="OIDC identity unavailable") from None
     next_url = sign_in(
         request,
         user=user_ctx,

{simple_module_oidc-0.0.43/oidc → simple_module_oidc-0.0.44/oidc/web}/endpoints/views.py

@@ -8,10 +8,15 @@ from simple_module_hosting.inertia_deps import InertiaDep, is_inertia_request
 from simple_module_inertia.response import location
 from starlette.responses import RedirectResponse
 
-from oidc.constants import _PAGE_LOGGED_OUT, _PAGE_LOGIN, LOGGED_OUT_PATH, SESSION_REFRESH_TOKEN_KEY
-from oidc.renewal import _KEYS
-from oidc.runtime import is_signed_in
-from oidc.tokens import open_refresh_token
+from oidc.core.constants import (
+    _PAGE_LOGGED_OUT,
+    _PAGE_LOGIN,
+    LOGGED_OUT_PATH,
+    SESSION_REFRESH_TOKEN_KEY,
+)
+from oidc.core.runtime import is_signed_in
+from oidc.identity.renewal import _KEYS
+from oidc.identity.tokens import open_refresh_token
 
 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["oidc-views"])

{simple_module_oidc-0.0.43 → simple_module_oidc-0.0.44}/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@simple-module/oidc",
   "private": true,
-  "version": "0.0.43",
+  "version": "0.0.44",
   "type": "module",
   "dependencies": {}
 }

{simple_module_oidc-0.0.43 → simple_module_oidc-0.0.44}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_oidc"
-version = "0.0.43"
+version = "0.0.44"
 description = "Generic OIDC authentication provider for simple_module — native Microsoft Entra ID, Auth0, Okta, Keycloak, and any OpenID Connect identity provider"
 readme = "README.md"
 license = "MIT"
@@ -20,10 +20,10 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.43",
-    "simple_module_db==0.0.43",
-    "simple_module_hosting==0.0.43",
-    "simple_module_auth==0.0.43",
+    "simple_module_core==0.0.44",
+    "simple_module_db==0.0.44",
+    "simple_module_hosting==0.0.44",
+    "simple_module_auth==0.0.44",
     "PyJWT[crypto]>=2.8,<3",
     "cryptography>=42",
     "httpx>=0.27,<0.29",

{simple_module_oidc-0.0.43 → simple_module_oidc-0.0.44}/tests/conftest.py

@@ -6,7 +6,7 @@ import httpx
 import pytest
 from cryptography.hazmat.primitives.asymmetric import rsa
 from jwt.algorithms import RSAAlgorithm
-from oidc.settings import OidcSettings
+from oidc.core.settings import OidcSettings
 from oidc_flow_helpers import _AUDIENCE, _KID, _PRIVATE_KEY
 from simple_module_core.discovery import discover_modules
 from simple_module_db.base import all_module_bases

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/core/module}/test_oidc_boot.py

@@ -5,11 +5,11 @@ from types import SimpleNamespace
 
 import httpx
 import pytest
+from oidc.core.runtime import require_client
+from oidc.core.settings import OidcSettings
+from oidc.core.state import OidcState
+from oidc.identity.provider import OidcAuthProvider
 from oidc.module import OidcModule
-from oidc.provider import OidcAuthProvider
-from oidc.runtime import require_client
-from oidc.settings import OidcSettings
-from oidc.state import OidcState
 from starlette.requests import Request
 
 

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/core/module}/test_oidc_module.py

@@ -16,7 +16,7 @@ def test_oidc_module_meta():
 
 
 def test_oidc_provider_satisfies_protocol():
-    from oidc.provider import OidcAuthProvider
+    from oidc.identity.provider import OidcAuthProvider
 
     provider = OidcAuthProvider()
     assert isinstance(provider, AuthProvider)

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/core/runtime}/test_oidc_settings_runtime.py

@@ -1,9 +1,9 @@
 """OIDC policy uses hydrated settings even without the Settings UI (#192)."""
 
-from oidc.settings import OidcSettings
-from settings.invalidation import reload_package
-from settings.service import SettingService
-from settings.store import SettingsStore
+from oidc.core.settings import OidcSettings
+from settings.core.invalidation import reload_package
+from settings.core.service import SettingService
+from settings.module_settings.store import SettingsStore
 from simple_module_core.module_settings import module_settings_registry
 
 

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/core/settings}/test_oidc_settings_presets.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import pytest
-from oidc.settings import OidcSettings
+from oidc.core.settings import OidcSettings
 from pydantic import ValidationError
 
 
@@ -111,7 +111,7 @@ def test_roles_claim_path_is_seeded_from_env_for_the_first_admin():
     import subprocess
     import sys
 
-    code = "from oidc.settings import OidcSettings; print(OidcSettings().roles_claim_path)"
+    code = "from oidc.core.settings import OidcSettings; print(OidcSettings().roles_claim_path)"
     env = {**os.environ, "SM_OIDC_ROLES_CLAIM_PATH": "realm_access.roles"}
     out = subprocess.run(
         [sys.executable, "-c", code], env=env, capture_output=True, text=True, check=True

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/identity/client}/test_oidc_client.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import pytest
-from oidc.client import OIDCClient
+from oidc.identity.client import OIDCClient
 
 
 @pytest.fixture

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/identity/discovery}/test_oidc_discovery.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import pytest
-from oidc.discovery import OidcMetadata, fetch_metadata
+from oidc.identity.discovery import OidcMetadata, fetch_metadata
 
 _ENTRA_DOC = {
     "issuer": "https://login.microsoftonline.com/tid/v2.0",

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/identity/jwks}/test_oidc_jwks.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import time
 
 import pytest
-from oidc.jwks import JWKSCache
+from oidc.identity.jwks import JWKSCache
 from oidc_flow_helpers import make_jwks_response, sign_token
 
 

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/identity/jwks}/test_oidc_jwks_resilience.py

@@ -6,7 +6,7 @@ from types import SimpleNamespace
 
 import httpx
 import pytest
-from oidc.jwks import JWKSCache
+from oidc.identity.jwks import JWKSCache
 from oidc_flow_helpers import make_jwks_response, sign_token
 
 

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/identity/persistence}/test_oidc_cache_persistence.py

@@ -4,9 +4,9 @@ from datetime import UTC, datetime, timedelta
 from types import SimpleNamespace
 
 import pytest
+from oidc.core.settings import OidcSettings
+from oidc.identity.provider import OidcAuthProvider
 from oidc.models import OidcUserCache
-from oidc.provider import OidcAuthProvider
-from oidc.settings import OidcSettings
 from simple_module_db import independent_session
 from sqlalchemy import event, select
 from starlette.requests import Request
@@ -145,7 +145,7 @@ async def test_failed_cache_never_falls_back_to_external_subject(cache_request,
     def broken(*args):
         raise RuntimeError("database unavailable")
 
-    monkeypatch.setattr("oidc.persistence.independent_session", broken)
+    monkeypatch.setattr("oidc.identity.persistence.independent_session", broken)
     assert await OidcAuthProvider()._upsert_user_cache(cache_request, CLAIMS) is None
 
 

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/identity/provider}/test_oidc_jwt_policy.py

@@ -5,7 +5,7 @@ import time
 import jwt
 import pytest
 from cryptography.hazmat.primitives.asymmetric import rsa
-from oidc.jwks import JWKSCache
+from oidc.identity.jwks import JWKSCache
 
 
 @pytest.fixture

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/identity/provider}/test_oidc_legacy_authority.py

@@ -4,9 +4,9 @@ import time
 
 import pytest
 from auth.contracts.schemas import UserContext
-from oidc.jwks import JWKSCache
-from oidc.provider import OidcAuthProvider
-from oidc.settings import OidcSettings
+from oidc.core.settings import OidcSettings
+from oidc.identity.jwks import JWKSCache
+from oidc.identity.provider import OidcAuthProvider
 from starlette.requests import Request
 
 

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/identity/provider}/test_oidc_provider.py

@@ -7,8 +7,8 @@ from unittest.mock import MagicMock
 import pytest
 from auth.contracts.provider import AuthProvider
 from auth.contracts.schemas import UserContext
-from oidc.provider import OidcAuthProvider
-from oidc.settings import OidcSettings
+from oidc.core.settings import OidcSettings
+from oidc.identity.provider import OidcAuthProvider
 
 
 @pytest.fixture

simple_module_oidc-0.0.44/tests/identity/provider/test_oidc_sign_in_from_claims.py

@@ -0,0 +1,39 @@
+"""``sign_in_from_claims`` is the public seam the login callback uses (#848)."""
+
+from unittest.mock import AsyncMock
+
+import pytest
+from oidc.core.settings import OidcSettings
+from oidc.identity.provider import IdentityUnavailableError, OidcAuthProvider
+from starlette.requests import Request
+
+CLAIMS = {"iss": "https://idp.test", "sub": "subject", "email": "a@b.test"}
+
+
+@pytest.fixture
+def provider(monkeypatch):
+    provider = OidcAuthProvider(OidcSettings(client_id="app"))
+    monkeypatch.setattr(provider, "_upsert_user_cache", AsyncMock(return_value="cache-1"))
+    return provider
+
+
+async def test_returns_context_and_identity(provider):
+    request = Request({"type": "http"})
+    ctx, identity = await provider.sign_in_from_claims(request, CLAIMS)
+    assert identity == ("https://idp.test", "subject")
+    assert (
+        ctx.to_session_dict()
+        == provider._claims_to_user_context(CLAIMS, cache_id="cache-1").to_session_dict()
+    )
+    provider._upsert_user_cache.assert_awaited_once_with(request, CLAIMS)
+
+
+async def test_missing_identity_raises_value_error(provider):
+    with pytest.raises(ValueError):
+        await provider.sign_in_from_claims(Request({"type": "http"}), {"email": "a@b.test"})
+
+
+async def test_cache_refusal_raises(provider):
+    provider._upsert_user_cache.return_value = None
+    with pytest.raises(IdentityUnavailableError):
+        await provider.sign_in_from_claims(Request({"type": "http"}), CLAIMS)

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/identity/provider}/test_oidc_tenant_resolver.py

@@ -6,8 +6,8 @@ Lives apart from ``test_oidc_provider.py`` because that file overrides the
 
 from __future__ import annotations
 
-from oidc.provider import OidcAuthProvider
-from oidc.settings import OidcSettings
+from oidc.core.settings import OidcSettings
+from oidc.identity.provider import OidcAuthProvider
 from starlette.requests import Request
 
 _USER_ID = "11111111-1111-1111-1111-111111111111"

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/identity/renewal}/test_oidc_refresh.py

@@ -7,10 +7,10 @@ from urllib.parse import parse_qs
 import httpx
 import pytest
 from auth.contracts.schemas import UserContext
-from oidc.client import OIDCClient
-from oidc.provider import OidcAuthProvider
-from oidc.settings import OidcSettings
-from oidc.tokens import open_refresh_token, seal_refresh_token
+from oidc.core.settings import OidcSettings
+from oidc.identity.client import OIDCClient
+from oidc.identity.provider import OidcAuthProvider
+from oidc.identity.tokens import open_refresh_token, seal_refresh_token
 from starlette.requests import Request
 
 
@@ -203,7 +203,7 @@ async def test_session_deadline_never_slides(refresh_session, monkeypatch):
 
 
 async def test_refresh_sealing_is_provider_scoped(refresh_session):
-    from keycloak.tokens import open_refresh_token as open_keycloak_token
+    from keycloak.identity.tokens import open_refresh_token as open_keycloak_token
 
     _, request = refresh_session
     sealed = request.session["oidc_refresh_token"]

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/identity/renewal}/test_oidc_session_transaction.py

@@ -8,10 +8,10 @@ from unittest.mock import AsyncMock
 import httpx
 import pytest
 from fastapi import HTTPException
-from oidc.endpoints import api
-from oidc.provider import OidcAuthProvider
-from oidc.settings import OidcSettings
-from oidc.tokens import open_refresh_token
+from oidc.core.settings import OidcSettings
+from oidc.identity.provider import OidcAuthProvider
+from oidc.identity.tokens import open_refresh_token
+from oidc.web.endpoints import api
 from simple_module_hosting.csrf import get_csrf_token
 from simple_module_hosting.session import SessionMiddleware, preserve_across_sign_in
 from starlette.requests import Request

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/web/endpoints}/test_oidc_authorization.py

@@ -5,9 +5,9 @@ from unittest.mock import AsyncMock
 
 import pytest
 from auth.contracts.schemas import UserContext
-from oidc.provider import OidcAuthProvider
-from oidc.settings import OidcSettings
-from oidc.state import OidcState
+from oidc.core.settings import OidcSettings
+from oidc.core.state import OidcState
+from oidc.identity.provider import OidcAuthProvider
 from starlette.requests import Request
 
 

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/web/endpoints}/test_oidc_authorization_query.py

@@ -3,8 +3,8 @@
 from urllib.parse import parse_qs, urlsplit
 
 import pytest
-from oidc.client import OIDCClient
-from oidc.discovery import OidcMetadata
+from oidc.identity.client import OIDCClient
+from oidc.identity.discovery import OidcMetadata
 
 
 @pytest.mark.parametrize("query", ["", "?tenant=alpha", "?tenant=alpha&policy=a%2Bb"])

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/web/endpoints}/test_oidc_endpoint_auth.py

@@ -6,11 +6,11 @@ from urllib.parse import parse_qs
 
 import httpx
 import pytest
-from oidc.constants import SESSION_REFRESH_TOKEN_KEY
-from oidc.runtime import initialize
-from oidc.settings import OidcSettings
-from oidc.state import OidcState
-from oidc.tokens import seal_refresh_token
+from oidc.core.constants import SESSION_REFRESH_TOKEN_KEY
+from oidc.core.runtime import initialize
+from oidc.core.settings import OidcSettings
+from oidc.core.state import OidcState
+from oidc.identity.tokens import seal_refresh_token
 from starlette.requests import Request
 
 _DOC = {
@@ -131,7 +131,7 @@ def _logout_request(app, session):
 async def test_logout_revokes_before_clearing_even_on_failure(
     endpoint_app, basic, failure, httpx_mock, caplog
 ):
-    from oidc.endpoints.views import logout
+    from oidc.web.endpoints.views import logout
 
     session = {SESSION_REFRESH_TOKEN_KEY: seal_refresh_token(endpoint_app, "private-refresh")}
     calls = []
@@ -167,7 +167,7 @@ async def test_logout_revokes_before_clearing_even_on_failure(
     indirect=["endpoint_app"],
 )
 async def test_logout_skips_unavailable_revocation(endpoint_app, token, httpx_mock):
-    from oidc.endpoints.views import logout
+    from oidc.web.endpoints.views import logout
 
     session = {}
     if token:
@@ -203,7 +203,7 @@ async def test_revocation_uses_its_own_advertised_auth_method(endpoint_app, http
 async def test_revocation_total_time_is_capped(endpoint_app, monkeypatch):
     import asyncio
 
-    from oidc import client as client_module
+    from oidc.identity import client as client_module
 
     async def hang(*args, **kwargs):
         await asyncio.Event().wait()  # an IdP that never answers

{simple_module_oidc-0.0.43/tests → simple_module_oidc-0.0.44/tests/web/endpoints}/test_oidc_logout.py

@@ -73,7 +73,7 @@ async def test_logout_drops_the_sessions_shared_renewal_outcome(oidc_app, flow_c
     import time
 
     from auth.models import RefreshOutcome
-    from oidc.renewal import _KEYS
+    from oidc.identity.renewal import _KEYS
     from simple_module_db import independent_session
     from sqlmodel import select