udata 9.1.5.dev31504__py2.py3-none-any.whl → 9.1.5.dev31515__py2.py3-none-any.whl

udata/api/commands.py

@@ -4,6 +4,7 @@ import os
 import click
 from flask import current_app, json
 from flask_restx import schemas
+from werkzeug.security import gen_salt
 
 from udata.api import api
 from udata.api.oauth2 import OAuth2Client
@@ -77,12 +78,15 @@ def validate():
 @click.option(
     "-r", "--response-types", multiple=True, default=["code"], help="Client's response types"
 )
-def create_oauth_client(client_name, user_email, uri, grant_types, scope, response_types):
+@click.option("-p", "--public", is_flag=True, help="Public client (SPA)")
+def create_oauth_client(client_name, user_email, uri, grant_types, scope, response_types, public):
     """Creates an OAuth2Client instance in DB"""
     user = User.objects(email=user_email).first()
     if user is None:
         exit_with_error("No matching user to email")
 
+    client_secret = gen_salt(50) if not public else None
+
     client = OAuth2Client.objects.create(
         name=client_name,
         owner=user,
@@ -90,11 +94,15 @@ def create_oauth_client(client_name, user_email, uri, grant_types, scope, respon
         scope=scope,
         response_types=response_types,
         redirect_uris=uri,
+        secret=client_secret,
     )
 
     click.echo(f"New OAuth client: {client.name}")
     click.echo(f"Client's ID {client.id}")
-    click.echo(f"Client's secret {client.secret}")
+    if public:
+        click.echo("Client is public and has no secret.")
+    else:
+        click.echo(f"Client's secret {client.secret}")
     click.echo(f"Client's grant_types {client.grant_types}")
     click.echo(f"Client's response_types {client.response_types}")
     click.echo(f"Client's URI {client.redirect_uris}")

udata/api/oauth2.py

@@ -32,7 +32,6 @@ from bson import ObjectId
 from flask import current_app, render_template, request
 from flask_security.utils import verify_password
 from werkzeug.exceptions import Unauthorized
-from werkzeug.security import gen_salt
 
 from udata.app import csrf
 from udata.auth import current_user, login_required, login_user
@@ -60,7 +59,7 @@ SCOPES = {"default": _("Default scope"), "admin": _("System administrator rights
 
 
 class OAuth2Client(ClientMixin, db.Datetimed, db.Document):
-    secret = db.StringField(default=lambda: gen_salt(50))
+    secret = db.StringField(default=None)
 
     name = db.StringField(required=True)
     description = db.StringField()
@@ -209,7 +208,7 @@ class OAuth2Code(db.Document):
 
 
 class AuthorizationCodeGrant(grants.AuthorizationCodeGrant):
-    TOKEN_ENDPOINT_AUTH_METHODS = ["client_secret_basic", "client_secret_post"]
+    TOKEN_ENDPOINT_AUTH_METHODS = ["none", "client_secret_basic", "client_secret_post"]
 
     def save_authorization_code(self, code, request):
         code_challenge = request.data.get("code_challenge")
@@ -265,6 +264,8 @@ class RefreshTokenGrant(grants.RefreshTokenGrant):
 
 
 class RevokeToken(RevocationEndpoint):
+    CLIENT_AUTH_METHODS = ["none", "client_secret_basic"]
+
     def query_token(self, token_string, token_type_hint):
         qs = OAuth2Token.objects()
         if token_type_hint == "access_token":

udata/tests/api/test_auth_api.py

@@ -59,6 +59,7 @@ def oauth(app, request):
         name="test-client",
         owner=UserFactory(),
         redirect_uris=["https://test.org/callback"],
+        secret="suchs3cr3t",
     )
     kwargs.update(custom_kwargs)
     return OAuth2Client.objects.create(**kwargs)
@@ -456,6 +457,93 @@ class APIAuthTest:
         assert response.content_type == "application/json"
         assert response.json == {"success": True}
 
+    @pytest.mark.oauth(secret=None)
+    def test_s256_code_challenge_success_no_client_secret(self, client, oauth):
+        """Authenticate through an OAuth client that has no secret associated (public client)"""
+        code_verifier = generate_token(48)
+        code_challenge = create_s256_code_challenge(code_verifier)
+
+        client.login()
+
+        response = client.post(
+            url_for(
+                "oauth.authorize",
+                response_type="code",
+                client_id=oauth.client_id,
+                code_challenge=code_challenge,
+                code_challenge_method="S256",
+            ),
+            {
+                "scope": "default",
+                "accept": "",
+            },
+        )
+        assert "code=" in response.location
+
+        params = dict(url_decode(urlparse.urlparse(response.location).query))
+        code = params["code"]
+
+        response = client.post(
+            url_for("oauth.token"),
+            {
+                "grant_type": "authorization_code",
+                "code": code,
+                "code_verifier": code_verifier,
+                "client_id": oauth.client_id,
+            },
+        )
+
+        assert200(response)
+        assert response.content_type == "application/json"
+        assert "access_token" in response.json
+
+        token = response.json["access_token"]
+
+        response = client.post(
+            url_for("api.fake"), headers={"Authorization": " ".join(["Bearer", token])}
+        )
+
+        assert200(response)
+        assert response.content_type == "application/json"
+        assert response.json == {"success": True}
+
+    def test_s256_code_challenge_missing_client_secret(self, client, oauth):
+        """Fail authentication through an OAuth client with missing secret"""
+        code_verifier = generate_token(48)
+        code_challenge = create_s256_code_challenge(code_verifier)
+
+        client.login()
+
+        response = client.post(
+            url_for(
+                "oauth.authorize",
+                response_type="code",
+                client_id=oauth.client_id,
+                code_challenge=code_challenge,
+                code_challenge_method="S256",
+            ),
+            {
+                "scope": "default",
+                "accept": "",
+            },
+        )
+        assert "code=" in response.location
+
+        params = dict(url_decode(urlparse.urlparse(response.location).query))
+        code = params["code"]
+
+        response = client.post(
+            url_for("oauth.token"),
+            {
+                "grant_type": "authorization_code",
+                "code": code,
+                "code_verifier": code_verifier,
+                "client_id": oauth.client_id,
+            },
+        )
+
+        assert401(response)
+
     def test_authorization_multiple_grant_token(self, client, oauth):
         for i in range(3):
             client.login()

{udata-9.1.5.dev31504.dist-info → udata-9.1.5.dev31515.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: udata
-Version: 9.1.5.dev31504
+Version: 9.1.5.dev31515
 Summary: Open data portal
 Home-page: https://github.com/opendatateam/udata
 Author: Opendata Team
@@ -140,6 +140,7 @@ It is collectively taken care of by members of the
 
 ## Current (in progress)
 
+- Allow OAuth clients without secrets [#3138](https://github.com/opendatateam/udata/pull/3138)
 - Add a `archived` button for datasets and reuses on frontend admin [#3104](https://github.com/opendatateam/udata/pull/3104)
 - **breaking change** Return all the reuses available to a user on the /reuses endpoint, including the private and deleted ones they own [#3140](https://github.com/opendatateam/udata/pull/3140).
 - Fix undelete reuse and dataservices [#3141](https://github.com/opendatateam/udata/pull/3141)

{udata-9.1.5.dev31504.dist-info → udata-9.1.5.dev31515.dist-info}/RECORD

@@ -26,10 +26,10 @@ udata/wsgi.py,sha256=MY8en9K9eDluvJYUxTdzqSDoYaDgCVZ69ZcUvxAvgqA,77
 udata/admin/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 udata/admin/views.py,sha256=00fI1O55apOlwIc0li2BdvEEGMd5l5isd5A_eHvzu3Y,331
 udata/api/__init__.py,sha256=p2FcJ1I4k4HERFvYYQNitO23FnfBc-kXpMlWb7u__RM,10644
-udata/api/commands.py,sha256=SwZYuANyGoI-lplWg18d0Ej8e7znmIA5EUKIU0jBA6U,3227
+udata/api/commands.py,sha256=LJ4u-yhGij7QuH7OR92u3n7BEptqWMjDwMnG8pqdBxo,3523
 udata/api/errors.py,sha256=P_UigBf6HAL73LbXKULagmp5Cuw-H1Ms6LmXxOmFIeg,211
 udata/api/fields.py,sha256=BO2bHPWN6CT2bNpEkkosBGVUSV383nl8MUed_wlxLmw,4176
-udata/api/oauth2.py,sha256=4emtZKqVoNrWBNQsg1AEW-K5BMcQabMp7GCY3sF6EO4,12013
+udata/api/oauth2.py,sha256=_sHQjcj67y601vXVhw6DAGJeZcj8itSx1myhsnFcNk4,12025
 udata/api/parsers.py,sha256=iQEwgMwdVz_gXlVZYaRCGrUFWvcf7_8uCIxw7Iw-hpw,1405
 udata/api/signals.py,sha256=t8s7tF1KYeAygqbR4GdA76_UYvthAsyRbJaqsMmFsK4,162
 udata/auth/__init__.py,sha256=RRMYs8rYIwXncx3Z62NFtVhuQzxQrFQpC1lBhl68WJI,1992
@@ -598,7 +598,7 @@ udata/tests/test_uris.py,sha256=MxafZ0SyzSNRomVpZnH1ChzWaHOi1MQiXe1gmKnBc6o,8517
 udata/tests/test_utils.py,sha256=3BGnlvw-GOE6tLHQteo-uUeYuzq4rsjePOuytFGkpOg,7967
 udata/tests/api/__init__.py,sha256=y4sL7LD1-KwONHF0q_Rhk2W6BmGUlp7Uz2JnX3e27sk,1218
 udata/tests/api/test_activities_api.py,sha256=RjDDeNle3T-ydVnh6BRypqxAE_244-DXaKkuUCT0HVU,2823
-udata/tests/api/test_auth_api.py,sha256=buWlvWOKLhEH-hS_bDyHePyyitRg8fX86hYy2Euo6AY,23200
+udata/tests/api/test_auth_api.py,sha256=OMRlY0OQt60j5N4A-N3HdWTuffOjRlFHkz5a3jJFieI,25987
 udata/tests/api/test_base_api.py,sha256=2w_vz0eEuq3P3aN-ByvxGc3VZAo7XtgatFfcrzf2uEU,2244
 udata/tests/api/test_contact_points.py,sha256=pyakkKnM4lH_asuEoXq9lQyJC9to6ZxSp4QQrHh1c1U,1041
 udata/tests/api/test_dataservices_api.py,sha256=SoiAOv3q0z41iEYXkZwnvr9KzULtfD_MlIQkLcfdf-E,15337
@@ -697,9 +697,9 @@ udata/translations/pt/LC_MESSAGES/udata.mo,sha256=WpPzAqVd2Onv_kz45ULUySKPLrpjcc
 udata/translations/pt/LC_MESSAGES/udata.po,sha256=18Op9RUITewoDRewlOdYzzq6gjsf1lsvepACV1d7zxs,44976
 udata/translations/sr/LC_MESSAGES/udata.mo,sha256=NIYRNhVoETZUvIvWm3cCW7DtMBAnS2vXzZjMF5ZzD_c,28500
 udata/translations/sr/LC_MESSAGES/udata.po,sha256=rQB-4V4WJ7bURj6g2j653vItr5TMHadcLQxec7_fDmg,51545
-udata-9.1.5.dev31504.dist-info/LICENSE,sha256=V8j_M8nAz8PvAOZQocyRDX7keai8UJ9skgmnwqETmdY,34520
-udata-9.1.5.dev31504.dist-info/METADATA,sha256=Gb-WpN-DaXnNzJ7rQhx0kM687zUBsoa7TEqvBDDiuoM,130642
-udata-9.1.5.dev31504.dist-info/WHEEL,sha256=DZajD4pwLWue70CAfc7YaxT1wLUciNBvN_TTcvXpltE,110
-udata-9.1.5.dev31504.dist-info/entry_points.txt,sha256=3SKiqVy4HUqxf6iWspgMqH8d88Htk6KoLbG1BU-UddQ,451
-udata-9.1.5.dev31504.dist-info/top_level.txt,sha256=39OCg-VWFWOq4gCKnjKNu-s3OwFlZIu_dVH8Gl6ndHw,12
-udata-9.1.5.dev31504.dist-info/RECORD,,
+udata-9.1.5.dev31515.dist-info/LICENSE,sha256=V8j_M8nAz8PvAOZQocyRDX7keai8UJ9skgmnwqETmdY,34520
+udata-9.1.5.dev31515.dist-info/METADATA,sha256=o0DNHKHXEyq3K4H2-5D3AeNBdxE1w7BvjSYs1fW-KP8,130737
+udata-9.1.5.dev31515.dist-info/WHEEL,sha256=DZajD4pwLWue70CAfc7YaxT1wLUciNBvN_TTcvXpltE,110
+udata-9.1.5.dev31515.dist-info/entry_points.txt,sha256=3SKiqVy4HUqxf6iWspgMqH8d88Htk6KoLbG1BU-UddQ,451
+udata-9.1.5.dev31515.dist-info/top_level.txt,sha256=39OCg-VWFWOq4gCKnjKNu-s3OwFlZIu_dVH8Gl6ndHw,12
+udata-9.1.5.dev31515.dist-info/RECORD,,