yhttp-auth 9.3.0__tar.gz → 9.3.2__tar.gz

{yhttp_auth-9.3.0/yhttp_auth.egg-info → yhttp_auth-9.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: yhttp-auth
-Version: 9.3.0
+Version: 9.3.2
 Summary: A very micro http framework.
 Home-page: http://github.com/yhttp/yhttp-auth
 Author: Vahid Mardani
@@ -22,7 +22,7 @@ Classifier: Topic :: Software Development :: Libraries
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: yhttp<8,>=7.16.4
+Requires-Dist: yhttp<8,>=7.20.1
 Requires-Dist: pyjwt
 Requires-Dist: redis
 Dynamic: author

{yhttp_auth-9.3.0 → yhttp_auth-9.3.2}/setup.py

@@ -18,7 +18,7 @@ with open(
 
 
 dependencies = [
-    'yhttp >= 7.16.4, < 8',
+    'yhttp >= 7.20.1, < 8',
     'pyjwt',
     'redis',
 ]

{yhttp_auth-9.3.0 → yhttp_auth-9.3.2}/tests/test_accesstoken.py

@@ -13,6 +13,7 @@ def test_accesstoken(app, httpreq, redis):
     domain: example.com
     accesstoken:
       maxage: 30
+      leeway: 4
     refreshtoken:
       enabled: false
     ''')
@@ -65,7 +66,7 @@ def test_accesstoken(app, httpreq, redis):
         assert status == 201
         assert response.cookies['yhttp-accesstoken'] == \
             f'{accesstoken_expected}; ' \
-            'Domain=example.com; HttpOnly; Max-Age=30; Path=/; ' \
+            'Domain=example.com; HttpOnly; Max-Age=34; Path=/; ' \
             'SameSite=Strict'
         assert 'yhttp-refreshtoken' not in response.cookies
         accesstoken = response.cookies['yhttp-accesstoken'].split(';', 1)[0]

{yhttp_auth-9.3.0 → yhttp_auth-9.3.2}/tests/test_csrftoken.py

@@ -11,6 +11,8 @@ def test_csrftoken(app, httpreq, redis, mocker):
     domain: example.com
     csrftoken:
       size: 32
+      cookie:
+        path: /red
     ''')
     app.ready()
     mocker.patch(

{yhttp_auth-9.3.0 → yhttp_auth-9.3.2}/tests/test_oauth2.py

@@ -21,6 +21,8 @@ def test_oauth2_state(app, httpreq, redis, mocker):
     domain: example.com
     csrftoken:
       size: 32
+      cookie:
+        path: /red
     ''')
     app.ready()
     mocker.patch(

{yhttp_auth-9.3.0 → yhttp_auth-9.3.2}/tests/test_refreshtoken.py

@@ -15,10 +15,13 @@ def test_refreshtoken(app, httpreq, redis):
     domain: example.com
     accesstoken:
       maxage: 30
+      leeway: 4
     refreshtoken:
       enabled: true
       maxage: 3600
-      path: /tokens
+      leeway: 20
+      cookie:
+        path: /tokens
     ''')
     app.ready()
 
@@ -66,11 +69,11 @@ def test_refreshtoken(app, httpreq, redis):
         assert status == 201
         assert response.cookies['yhttp-accesstoken'] == \
             f'{accesstoken_expected}; ' \
-            'Domain=example.com; HttpOnly; Max-Age=30; Path=/; ' \
+            'Domain=example.com; HttpOnly; Max-Age=34; Path=/; ' \
             'SameSite=Strict'
         assert response.cookies['yhttp-refreshtoken'] == \
             f'{refreshtoken_expected}; ' \
-            'Domain=example.com; HttpOnly; Max-Age=3600; Path=/tokens; ' \
+            'Domain=example.com; HttpOnly; Max-Age=3620; Path=/tokens; ' \
             'SameSite=Strict'
         accesstoken = response.cookies['yhttp-accesstoken'].split(';', 1)[0]
         refreshtoken = response.cookies['yhttp-refreshtoken'].split(';', 1)[0]
@@ -94,7 +97,7 @@ def test_refreshtoken(app, httpreq, redis):
              cookies={
                  'yhttp-refreshtoken': refreshtoken,
              })
-        assert status == 401
+        assert status == 201
 
         when(title='Try to refresh token with access token but without the '
                    'refreshtoken',
@@ -135,7 +138,7 @@ def test_refreshtoken(app, httpreq, redis):
                  'yhttp-accesstoken': accesstoken,
                  'yhttp-refreshtoken': bob_refreshtoken,
              })
-        assert status == 401
+        assert status == 201
 
         when(title='Try to refresh the access-token',
              path='/tokens',
@@ -147,11 +150,11 @@ def test_refreshtoken(app, httpreq, redis):
         assert status == 201
         assert response.cookies['yhttp-accesstoken'] == \
             f'{accesstoken_expected}; ' \
-            'Domain=example.com; HttpOnly; Max-Age=30; Path=/; ' \
+            'Domain=example.com; HttpOnly; Max-Age=34; Path=/; ' \
             'SameSite=Strict'
         assert response.cookies['yhttp-refreshtoken'] == \
             f'{refreshtoken_expected}; ' \
-            'Domain=example.com; HttpOnly; Max-Age=3600; Path=/tokens; ' \
+            'Domain=example.com; HttpOnly; Max-Age=3620; Path=/tokens; ' \
             'SameSite=Strict'
         accesstoken = response.cookies['yhttp-accesstoken'].split(';', 1)[0]
 

{yhttp_auth-9.3.0 → yhttp_auth-9.3.2}/yhttp/ext/auth/__init__.py

@@ -4,4 +4,4 @@ from .exceptions import AuthException, TokenDecodeError, TokenExpiredError, \
     TokenMissmatchError, TokenMissingError, HeaderMissingError, BlacklistError
 
 
-__version__ = '9.3.0'
+__version__ = '9.3.2'

{yhttp_auth-9.3.0 → yhttp_auth-9.3.2}/yhttp/ext/auth/authenticator.py

@@ -93,7 +93,7 @@ class Authenticator:
             httponly=settings.cookie.httponly,
             domain=self._settings.domain,
             samesite=settings.cookie.samesite,
-            path=settings.cookie.path or req.path,
+            path=settings.cookie.path,
             expires='Thu, 01 Jan 1970 00:00:00 GMT'
         )
 
@@ -135,11 +135,11 @@ class Authenticator:
             httponly=settings.cookie.httponly,
             domain=self._settings.domain,
             samesite=settings.cookie.samesite,
-            path=settings.cookie.path or req.path,
+            path=settings.cookie.path,
         )
 
         if hasattr(settings, 'maxage'):
-            entry['max-age'] = settings.maxage
+            entry['max-age'] = settings.maxage + settings.leeway
         elif hasattr(settings.cookie, 'maxage'):
             entry['max-age'] = settings.cookie.maxage
 
@@ -183,21 +183,11 @@ class Authenticator:
         )
 
     def session_refresh(self, req):
-        # ensure the access token (even expired) but not invalid
-        accesstoken = self.token_fromcookie(
-            req,
-            AccessToken,
-            verifyexp=False
-        )
-
         refreshtoken = self.token_fromcookie(
             req,
             RefreshToken
         )
 
-        if refreshtoken.id != accesstoken.id:
-            raise TokenMissmatchError()
-
         accesstoken = AccessToken.create_from(refreshtoken)
         self.session_new(req, accesstoken)
 

{yhttp_auth-9.3.0 → yhttp_auth-9.3.2/yhttp_auth.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: yhttp-auth
-Version: 9.3.0
+Version: 9.3.2
 Summary: A very micro http framework.
 Home-page: http://github.com/yhttp/yhttp-auth
 Author: Vahid Mardani
@@ -22,7 +22,7 @@ Classifier: Topic :: Software Development :: Libraries
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: yhttp<8,>=7.16.4
+Requires-Dist: yhttp<8,>=7.20.1
 Requires-Dist: pyjwt
 Requires-Dist: redis
 Dynamic: author

yhttp_auth-9.3.2/yhttp_auth.egg-info/requires.txt

@@ -0,0 +1,3 @@
+yhttp<8,>=7.20.1
+pyjwt
+redis

yhttp_auth-9.3.0/yhttp_auth.egg-info/requires.txt

@@ -1,3 +0,0 @@
-yhttp<8,>=7.16.4
-pyjwt
-redis