Improve oauthlib.openid.connect.core (#13966)

This commit is contained in:
Semyon Moroz
2025-05-13 10:28:14 +00:00
committed by GitHub
parent 2f9bd24716
commit 3b038caa9b
11 changed files with 201 additions and 109 deletions
@@ -1,36 +1,53 @@
from _typeshed import Incomplete
from collections.abc import Callable
from typing import Any
from oauthlib.common import Request
from oauthlib.oauth2.rfc6749.endpoints import (
AuthorizationEndpoint as AuthorizationEndpoint,
IntrospectEndpoint as IntrospectEndpoint,
ResourceEndpoint as ResourceEndpoint,
RevocationEndpoint as RevocationEndpoint,
TokenEndpoint as TokenEndpoint,
AuthorizationEndpoint,
IntrospectEndpoint,
ResourceEndpoint,
RevocationEndpoint,
TokenEndpoint,
)
from oauthlib.oauth2.rfc6749.grant_types import (
AuthorizationCodeGrant as OAuth2AuthorizationCodeGrant,
ClientCredentialsGrant,
ImplicitGrant as OAuth2ImplicitGrant,
RefreshTokenGrant,
ResourceOwnerPasswordCredentialsGrant,
)
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator
from oauthlib.oauth2.rfc6749.tokens import BearerToken
from .userinfo import UserInfoEndpoint as UserInfoEndpoint
from ..grant_types import AuthorizationCodeGrant, HybridGrant, ImplicitGrant
from ..grant_types.dispatchers import (
AuthorizationCodeGrantDispatcher,
AuthorizationTokenGrantDispatcher,
ImplicitTokenGrantDispatcher,
)
from ..tokens import JWTToken
from .userinfo import UserInfoEndpoint
class Server(AuthorizationEndpoint, IntrospectEndpoint, TokenEndpoint, ResourceEndpoint, RevocationEndpoint, UserInfoEndpoint):
auth_grant: Any
implicit_grant: Any
password_grant: Any
credentials_grant: Any
refresh_grant: Any
openid_connect_auth: Any
openid_connect_implicit: Any
openid_connect_hybrid: Any
bearer: Any
jwt: Any
auth_grant_choice: Any
implicit_grant_choice: Any
token_grant_choice: Any
auth_grant: OAuth2AuthorizationCodeGrant
implicit_grant: OAuth2ImplicitGrant
password_grant: ResourceOwnerPasswordCredentialsGrant
credentials_grant: ClientCredentialsGrant
refresh_grant: RefreshTokenGrant
openid_connect_auth: AuthorizationCodeGrant
openid_connect_implicit: ImplicitGrant
openid_connect_hybrid: HybridGrant
bearer: BearerToken
jwt: JWTToken
auth_grant_choice: AuthorizationCodeGrantDispatcher
implicit_grant_choice: ImplicitTokenGrantDispatcher
token_grant_choice: AuthorizationTokenGrantDispatcher
def __init__(
self,
request_validator,
token_expires_in: Incomplete | None = None,
token_generator: Incomplete | None = None,
refresh_token_generator: Incomplete | None = None,
*args,
**kwargs,
request_validator: OAuth2RequestValidator,
token_expires_in: int | Callable[[Request], int] | None = None,
token_generator: Callable[[Request], str] | None = None,
refresh_token_generator: Callable[[Request], str] | None = None,
*args: Any, # actually, these are not used
**kwargs: Any, # actually, these are not used
) -> None: ...
@@ -1,16 +1,22 @@
from _typeshed import Incomplete
from collections.abc import Mapping
from logging import Logger
from typing import Any
from oauthlib.oauth2.rfc6749.endpoints.base import BaseEndpoint as BaseEndpoint
from oauthlib.common import Request, _HTTPMethod
from oauthlib.oauth2.rfc6749.endpoints.base import BaseEndpoint
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator
from oauthlib.oauth2.rfc6749.tokens import BearerToken
log: Logger
class UserInfoEndpoint(BaseEndpoint):
bearer: Any
request_validator: Any
def __init__(self, request_validator) -> None: ...
bearer: BearerToken
request_validator: OAuth2RequestValidator
def __init__(self, request_validator: OAuth2RequestValidator) -> None: ...
def create_userinfo_response(
self, uri, http_method: str = "GET", body: Incomplete | None = None, headers: Incomplete | None = None
): ...
def validate_userinfo_request(self, request) -> None: ...
self,
uri: str,
http_method: _HTTPMethod = "GET",
body: str | dict[str, str] | list[tuple[str, str]] | None = None,
headers: Mapping[str, str] | None = None,
) -> tuple[dict[str, str], str, int]: ...
def validate_userinfo_request(self, request: Request) -> None: ...
@@ -1,6 +1,4 @@
from _typeshed import Incomplete
from oauthlib.oauth2.rfc6749.errors import FatalClientError as FatalClientError, OAuth2Error as OAuth2Error
from oauthlib.oauth2.rfc6749.errors import FatalClientError, OAuth2Error
class FatalOpenIDClientError(FatalClientError): ...
class OpenIDClientError(OAuth2Error): ...
@@ -50,4 +48,4 @@ class InsufficientScopeError(OAuth2Error):
status_code: int
description: str
def raise_from_error(error, params: Incomplete | None = None) -> None: ...
def raise_from_error(error: object, params: dict[str, str] | None = None) -> None: ...
@@ -1,12 +1,25 @@
from _typeshed import Incomplete
from collections.abc import Iterable
from logging import Logger
from typing import Any
from .base import GrantTypeBase as GrantTypeBase
from oauthlib.common import Request
from oauthlib.oauth2.rfc6749.grant_types.authorization_code import AuthorizationCodeGrant as OAuth2AuthorizationCodeGrant
from oauthlib.oauth2.rfc6749.grant_types.base import _AuthValidator, _TokenValidator
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator
from .base import GrantTypeBase
log: Logger
class AuthorizationCodeGrant(GrantTypeBase):
proxy_target: Any
def __init__(self, request_validator: Incomplete | None = None, **kwargs) -> None: ...
def add_id_token(self, token, token_handler, request): ... # type: ignore[override]
proxy_target: OAuth2AuthorizationCodeGrant
def __init__(
self,
request_validator: OAuth2RequestValidator | None = None,
*,
post_auth: Iterable[_AuthValidator] | None = None,
post_token: Iterable[_TokenValidator] | None = None,
pre_auth: Iterable[_AuthValidator] | None = None,
pre_token: Iterable[_TokenValidator] | None = None,
**kwargs,
) -> None: ...
def add_id_token(self, token, token_handler, request: Request): ... # type: ignore[override]
@@ -1,14 +1,20 @@
from _hashlib import HASH
from _typeshed import Incomplete
from collections.abc import Callable
from logging import Logger
from oauthlib.common import Request
log: Logger
class GrantTypeBase:
def __getattr__(self, attr: str): ...
def __setattr__(self, attr: str, value) -> None: ...
def validate_authorization_request(self, request): ...
def id_token_hash(self, value, hashfunc=...): ...
def add_id_token(self, token, token_handler, request, nonce: Incomplete | None = None): ...
def openid_authorization_validator(self, request): ...
def validate_authorization_request(self, request: Request): ...
def id_token_hash(
self, value: str, hashfunc: Callable[..., HASH] = ... # Arguments: ReadableBuffer (string) and bool (usedforsecurity)
) -> str: ...
def add_id_token(self, token, token_handler, request: Request, nonce: Incomplete | None = None): ...
def openid_authorization_validator(self, request: Request): ...
OpenIDConnectBase = GrantTypeBase
@@ -1,32 +1,37 @@
from _typeshed import Incomplete
from logging import Logger
from typing import Any
from oauthlib.common import Request
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator
log: Logger
class Dispatcher:
default_grant: Any
oidc_grant: Any
default_grant: Incomplete | None
oidc_grant: Incomplete | None
class AuthorizationCodeGrantDispatcher(Dispatcher):
default_grant: Any
oidc_grant: Any
default_grant: Incomplete | None
oidc_grant: Incomplete | None
def __init__(self, default_grant: Incomplete | None = None, oidc_grant: Incomplete | None = None) -> None: ...
def create_authorization_response(self, request, token_handler): ...
def validate_authorization_request(self, request): ...
def create_authorization_response(self, request: Request, token_handler): ...
def validate_authorization_request(self, request: Request): ...
class ImplicitTokenGrantDispatcher(Dispatcher):
default_grant: Any
oidc_grant: Any
default_grant: Incomplete | None
oidc_grant: Incomplete | None
def __init__(self, default_grant: Incomplete | None = None, oidc_grant: Incomplete | None = None) -> None: ...
def create_authorization_response(self, request, token_handler): ...
def validate_authorization_request(self, request): ...
def create_authorization_response(self, request: Request, token_handler): ...
def validate_authorization_request(self, request: Request): ...
class AuthorizationTokenGrantDispatcher(Dispatcher):
default_grant: Any
oidc_grant: Any
request_validator: Any
default_grant: Incomplete | None
oidc_grant: Incomplete | None
request_validator: OAuth2RequestValidator
def __init__(
self, request_validator, default_grant: Incomplete | None = None, oidc_grant: Incomplete | None = None
self,
request_validator: OAuth2RequestValidator,
default_grant: Incomplete | None = None,
oidc_grant: Incomplete | None = None,
) -> None: ...
def create_token_response(self, request, token_handler): ...
def create_token_response(self, request: Request, token_handler): ...
@@ -1,17 +1,29 @@
from _typeshed import Incomplete
from collections.abc import Iterable
from logging import Logger
from typing import Any
from oauthlib.common import Request
from oauthlib.oauth2.rfc6749.errors import InvalidRequestError as InvalidRequestError
from oauthlib.oauth2.rfc6749.grant_types.authorization_code import AuthorizationCodeGrant as OAuth2AuthorizationCodeGrant
from oauthlib.oauth2.rfc6749.grant_types.base import _AuthValidator, _TokenValidator
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator
from ..request_validator import RequestValidator as RequestValidator
from .base import GrantTypeBase as GrantTypeBase
from ..request_validator import RequestValidator
from .base import GrantTypeBase
log: Logger
class HybridGrant(GrantTypeBase):
request_validator: Any
proxy_target: Any
def __init__(self, request_validator: Incomplete | None = None, **kwargs) -> None: ...
def add_id_token(self, token, token_handler, request): ... # type: ignore[override]
def openid_authorization_validator(self, request): ...
request_validator: OAuth2RequestValidator | RequestValidator
proxy_target: OAuth2AuthorizationCodeGrant
def __init__(
self,
request_validator: OAuth2RequestValidator | RequestValidator | None = None,
*,
post_auth: Iterable[_AuthValidator] | None = None,
post_token: Iterable[_TokenValidator] | None = None,
pre_auth: Iterable[_AuthValidator] | None = None,
pre_token: Iterable[_TokenValidator] | None = None,
**kwargs,
) -> None: ...
def add_id_token(self, token, token_handler, request: Request): ... # type: ignore[override]
def openid_authorization_validator(self, request: Request): ...
@@ -1,13 +1,26 @@
from _typeshed import Incomplete
from collections.abc import Iterable
from logging import Logger
from typing import Any
from .base import GrantTypeBase as GrantTypeBase
from oauthlib.common import Request
from oauthlib.oauth2.rfc6749.grant_types.base import _AuthValidator, _TokenValidator
from oauthlib.oauth2.rfc6749.grant_types.implicit import ImplicitGrant as OAuth2ImplicitGrant
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator
from .base import GrantTypeBase
log: Logger
class ImplicitGrant(GrantTypeBase):
proxy_target: Any
def __init__(self, request_validator: Incomplete | None = None, **kwargs) -> None: ...
def add_id_token(self, token, token_handler, request): ... # type: ignore[override]
def openid_authorization_validator(self, request): ...
proxy_target: OAuth2ImplicitGrant
def __init__(
self,
request_validator: OAuth2RequestValidator | None = None,
*,
post_auth: Iterable[_AuthValidator] | None = None,
post_token: Iterable[_TokenValidator] | None = None,
pre_auth: Iterable[_AuthValidator] | None = None,
pre_token: Iterable[_TokenValidator] | None = None,
**kwargs,
) -> None: ...
def add_id_token(self, token, token_handler, request: Request): ... # type: ignore[override]
def openid_authorization_validator(self, request: Request): ...
@@ -1,11 +1,25 @@
from _typeshed import Incomplete
from collections.abc import Iterable
from logging import Logger
from oauthlib.common import Request
from oauthlib.oauth2.rfc6749.grant_types.base import _AuthValidator, _TokenValidator
from oauthlib.oauth2.rfc6749.grant_types.refresh_token import RefreshTokenGrant as OAuth2RefreshTokenGrant
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator
from .base import GrantTypeBase
log: Logger
class RefreshTokenGrant(GrantTypeBase):
proxy_target: Incomplete
def __init__(self, request_validator: Incomplete | None = None, **kwargs) -> None: ...
def add_id_token(self, token, token_handler, request): ... # type: ignore[override]
proxy_target: OAuth2RefreshTokenGrant
def __init__(
self,
request_validator: OAuth2RequestValidator | None = None,
*,
post_auth: Iterable[_AuthValidator] | None = None,
post_token: Iterable[_TokenValidator] | None = None,
pre_auth: Iterable[_AuthValidator] | None = None,
pre_token: Iterable[_TokenValidator] | None = None,
**kwargs,
) -> None: ...
def add_id_token(self, token, token_handler, request: Request): ... # type: ignore[override]
@@ -1,18 +1,24 @@
from _typeshed import Incomplete
from collections.abc import Callable
from logging import Logger
from oauthlib.common import Request
from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator
log: Logger
class RequestValidator(OAuth2RequestValidator):
def get_authorization_code_scopes(self, client_id, code, redirect_uri, request) -> None: ...
def get_authorization_code_nonce(self, client_id, code, redirect_uri, request) -> None: ...
def get_jwt_bearer_token(self, token, token_handler, request) -> None: ...
def get_id_token(self, token, token_handler, request) -> None: ...
def finalize_id_token(self, id_token, token, token_handler, request) -> None: ...
def validate_jwt_bearer_token(self, token, scopes, request) -> None: ...
def validate_id_token(self, token, scopes, request) -> None: ...
def validate_silent_authorization(self, request) -> None: ...
def validate_silent_login(self, request) -> None: ...
def validate_user_match(self, id_token_hint, scopes, claims, request) -> None: ...
def get_userinfo_claims(self, request) -> None: ...
def get_authorization_code_scopes(self, client_id: str, code: str, redirect_uri: str, request) -> list[str]: ...
def get_authorization_code_nonce(self, client_id: str, code: str, redirect_uri: str, request) -> str: ...
def get_jwt_bearer_token(self, token: dict[str, Incomplete], token_handler, request: Request) -> str: ...
def get_id_token(self, token: dict[str, Incomplete], token_handler, request: Request) -> str: ...
def finalize_id_token(
self, id_token: dict[str, Incomplete], token: dict[str, Incomplete], token_handler: Callable[..., str], request: Request
) -> str: ...
def validate_jwt_bearer_token(self, token: str, scopes, request: Request) -> bool: ...
def validate_id_token(self, token: str, scopes, request: Request) -> bool: ...
def validate_silent_authorization(self, request: Request) -> bool: ...
def validate_silent_login(self, request: Request) -> bool: ...
def validate_user_match(self, id_token_hint: str, scopes, claims: dict[str, Incomplete], request: Request) -> bool: ...
def get_userinfo_claims(self, request: Request) -> dict[str, Incomplete] | str: ...
def refresh_id_token(self, request: Request) -> bool: ...
@@ -1,20 +1,22 @@
from _typeshed import Incomplete
from typing import Any
from collections.abc import Callable
from oauthlib.common import Request
from oauthlib.oauth2.rfc6749.tokens import TokenBase as TokenBase
from .request_validator import RequestValidator
class JWTToken(TokenBase):
request_validator: Any
token_generator: Any
refresh_token_generator: Any
expires_in: Any
request_validator: RequestValidator
token_generator: Callable[[Request], str] | Callable[[Request, bool], str]
refresh_token_generator: Callable[[Request], str] | Callable[[Request, bool], str]
expires_in: int | Callable[[Request], int]
def __init__(
self,
request_validator: Incomplete | None = None,
token_generator: Incomplete | None = None,
expires_in: Incomplete | None = None,
refresh_token_generator: Incomplete | None = None,
request_validator: RequestValidator | None = None,
token_generator: Callable[[Request], str] | None = None,
expires_in: int | Callable[[Request], int] | None = None,
refresh_token_generator: Callable[[Request], str] | None = None,
) -> None: ...
def create_token(self, request, refresh_token: bool = False): ...
def validate_request(self, request): ...
def estimate_type(self, request): ...
def create_token(self, request: Request, refresh_token: bool = False): ...
def validate_request(self, request: Request): ...
def estimate_type(self, request: Request): ...