Improve oauthlib.oauth2.rfc6749 (#13793)

This commit is contained in:
Semyon Moroz
2025-04-07 16:02:09 +04:00
committed by GitHub
parent 1552ada465
commit a69621f655
21 changed files with 334 additions and 163 deletions
@@ -1,9 +1,15 @@
from _typeshed import Incomplete
from .base import Client as Client
from .base import Client
class BackendApplicationClient(Client):
grant_type: str
def prepare_request_body(
self, body: str = "", scope: Incomplete | None = None, include_client_id: bool = False, **kwargs
): ...
self,
body: str = "",
scope: str | set[object] | tuple[object] | list[object] | None = None,
include_client_id: bool = False,
*,
code_verifier: str | None = None,
client_id: str | None = None,
client_secret: str | None = None,
**kwargs,
) -> str: ...
@@ -27,7 +27,7 @@ class Client:
state_generator: Callable[[], str]
state: str | None
redirect_url: str | None
code: Incomplete
code: str | None
expires_in: ConvertibleToInt | None
code_verifier: str | None
code_challenge: str | None
@@ -1,10 +1,42 @@
from _typeshed import Incomplete
from collections.abc import Callable
from .base import Client as Client
from .base import Client, _TokenPlacement
class LegacyApplicationClient(Client):
grant_type: str
def __init__(self, client_id, **kwargs) -> None: ...
def __init__(
self,
client_id: str,
*,
default_token_placement: _TokenPlacement = "auth_header",
token_type: str = "Bearer",
access_token: str | None = None,
refresh_token: str | None = None,
mac_key: str | bytes | bytearray | None = None,
mac_algorithm: str | None = None,
token: dict[str, Incomplete] | None = None,
scope: str | set[object] | tuple[object] | list[object] | None = None,
state: str | None = None,
redirect_url: str | None = None,
state_generator: Callable[[], str] = ...,
code_verifier: str | None = None,
code_challenge: str | None = None,
code_challenge_method: str | None = None,
**kwargs,
) -> None: ...
def prepare_request_body(
self, username, password, body: str = "", scope: Incomplete | None = None, include_client_id: bool = False, **kwargs
): ...
self,
username: str,
password: str,
body: str = "",
scope: str | set[object] | tuple[object] | list[object] | None = None,
include_client_id: bool = False,
*,
code_verifier: str | None = None,
client_id: str | None = None,
client_secret: str | None = None,
code: str | None = None,
redirect_uri: str | None = None,
**kwargs,
) -> str: ...
@@ -1,17 +1,18 @@
from _typeshed import Incomplete
from typing import Any
from oauthlib.oauth2.rfc6749.tokens import OAuth2Token
from .base import Client as Client
from .base import Client
class MobileApplicationClient(Client):
response_type: str
def prepare_request_uri(
self,
uri,
redirect_uri: Incomplete | None = None,
scope: Incomplete | None = None,
state: Incomplete | None = None,
redirect_uri: str | None = None,
scope: str | set[object] | tuple[object] | list[object] | None = None,
state: str | None = None,
**kwargs,
): ...
token: Any
def parse_request_uri_response(self, uri, state: Incomplete | None = None, scope: Incomplete | None = None): ...
) -> str: ...
token: OAuth2Token
def parse_request_uri_response(
self, uri: str, state: str | None = None, scope: str | set[object] | tuple[object] | list[object] | None = None
) -> OAuth2Token: ...
@@ -1,34 +1,56 @@
from _typeshed import Incomplete
from typing import Any
from collections.abc import Callable
from .base import Client as Client
from .base import Client, _TokenPlacement
class ServiceApplicationClient(Client):
grant_type: str
private_key: Any
subject: Any
issuer: Any
audience: Any
private_key: str | None
subject: str | None
issuer: str | None
audience: str | None
def __init__(
self,
client_id,
private_key: Incomplete | None = None,
subject: Incomplete | None = None,
issuer: Incomplete | None = None,
audience: Incomplete | None = None,
client_id: str,
private_key: str | None = None,
subject: str | None = None,
issuer: str | None = None,
audience: str | None = None,
*,
default_token_placement: _TokenPlacement = "auth_header",
token_type: str = "Bearer",
access_token: str | None = None,
refresh_token: str | None = None,
mac_key: str | bytes | bytearray | None = None,
mac_algorithm: str | None = None,
token: dict[str, Incomplete] | None = None,
scope: str | set[object] | tuple[object] | list[object] | None = None,
state: str | None = None,
redirect_url: str | None = None,
state_generator: Callable[[], str] = ...,
code_verifier: str | None = None,
code_challenge: str | None = None,
code_challenge_method: str | None = None,
**kwargs,
) -> None: ...
def prepare_request_body(
self,
private_key: Incomplete | None = None,
subject: Incomplete | None = None,
issuer: Incomplete | None = None,
audience: Incomplete | None = None,
expires_at: Incomplete | None = None,
issued_at: Incomplete | None = None,
extra_claims: Incomplete | None = None,
private_key: str | None = None,
subject: str | None = None,
issuer: str | None = None,
audience: str | None = None,
expires_at: float | None = None,
issued_at: float | None = None,
extra_claims: dict[str, Incomplete] | None = None,
body: str = "",
scope: Incomplete | None = None,
scope: str | set[object] | tuple[object] | list[object] | None = None,
include_client_id: bool = False,
*,
not_before: int | None = None,
jwt_id: str | None = None,
client_id: str | None = None,
client_secret: str | None = None,
code: str | None = None,
redirect_uri: str | None = None,
**kwargs,
): ...
) -> str: ...
@@ -1,29 +1,53 @@
from _typeshed import Incomplete
from typing import Any
from collections.abc import Callable
from .base import Client as Client
from .base import Client, _TokenPlacement
class WebApplicationClient(Client):
grant_type: str
code: Any
def __init__(self, client_id, code: Incomplete | None = None, **kwargs) -> None: ...
code: str | None
def __init__(
self,
client_id: str,
code: str | None = None,
*,
default_token_placement: _TokenPlacement = "auth_header",
token_type: str = "Bearer",
access_token: str | None = None,
refresh_token: str | None = None,
mac_key: str | bytes | bytearray | None = None,
mac_algorithm: str | None = None,
token: dict[str, Incomplete] | None = None,
scope: str | set[object] | tuple[object] | list[object] | None = None,
state: str | None = None,
redirect_url: str | None = None,
state_generator: Callable[[], str] = ...,
code_verifier: str | None = None,
code_challenge: str | None = None,
code_challenge_method: str | None = None,
**kwargs,
) -> None: ...
def prepare_request_uri(
self,
uri,
redirect_uri: Incomplete | None = None,
scope: Incomplete | None = None,
state: Incomplete | None = None,
uri: str,
redirect_uri: str | None = None,
scope: str | set[object] | tuple[object] | list[object] | None = None,
state: str | None = None,
code_challenge: str | None = None,
code_challenge_method: str | None = "plain",
**kwargs,
): ...
) -> str: ...
def prepare_request_body(
self,
code: Incomplete | None = None,
redirect_uri: Incomplete | None = None,
code: str | None = None,
redirect_uri: str | None = None,
body: str = "",
include_client_id: bool = True,
code_verifier: str | None = None,
*,
scope: str | set[object] | tuple[object] | list[object] | None = None,
client_id: str | None = None,
client_secret: str | None = None,
**kwargs,
): ...
def parse_request_uri_response(self, uri, state: Incomplete | None = None): ...
) -> str: ...
def parse_request_uri_response(self, uri: str, state: str | None = None) -> dict[str, str]: ...
@@ -1,12 +1,14 @@
from _typeshed import Incomplete
from typing import Any
from logging import Logger
from .base import BaseEndpoint as BaseEndpoint
from oauthlib.common import _HTTPMethod
log: Any
from .base import BaseEndpoint
log: Logger
class AuthorizationEndpoint(BaseEndpoint):
def __init__(self, default_response_type, default_token_type, response_types) -> None: ...
def __init__(self, default_response_type, default_token_type, response_types: dict[str, Incomplete]) -> None: ...
@property
def response_types(self): ...
@property
@@ -17,13 +19,13 @@ class AuthorizationEndpoint(BaseEndpoint):
def default_token_type(self): ...
def create_authorization_response(
self,
uri,
http_method: str = "GET",
body: Incomplete | None = None,
headers: Incomplete | None = None,
uri: str,
http_method: _HTTPMethod = "GET",
body: str | None = None,
headers: dict[str, str] | None = None,
scopes: Incomplete | None = None,
credentials: Incomplete | None = None,
credentials: dict[str, Incomplete] | None = None,
): ...
def validate_authorization_request(
self, uri, http_method: str = "GET", body: Incomplete | None = None, headers: Incomplete | None = None
self, uri: str, http_method: _HTTPMethod = "GET", body: str | None = None, headers: dict[str, str] | None = None
): ...
@@ -1,20 +1,24 @@
from typing import Any
from _typeshed import Incomplete
from collections.abc import Callable, Sequence
from logging import Logger
log: Any
log: Logger
class BaseEndpoint:
def __init__(self) -> None: ...
@property
def valid_request_methods(self): ...
def valid_request_methods(self) -> Sequence[str] | None: ...
@valid_request_methods.setter
def valid_request_methods(self, valid_request_methods) -> None: ...
def valid_request_methods(self, valid_request_methods: Sequence[str] | None) -> None: ...
@property
def available(self): ...
def available(self) -> bool: ...
@available.setter
def available(self, available) -> None: ...
def available(self, available: bool) -> None: ...
@property
def catch_errors(self): ...
def catch_errors(self) -> bool: ...
@catch_errors.setter
def catch_errors(self, catch_errors) -> None: ...
def catch_errors(self, catch_errors: bool) -> None: ...
def catch_errors_and_unavailability(f): ...
def catch_errors_and_unavailability(
f: Callable[..., tuple[dict[str, Incomplete], str, int]],
) -> Callable[..., tuple[dict[str, Incomplete], str, int]]: ...
@@ -1,9 +1,12 @@
from _typeshed import Incomplete
from logging import Logger
from typing import Any
from .base import BaseEndpoint as BaseEndpoint
from oauthlib.common import Request, _HTTPMethod
log: Any
from .base import BaseEndpoint
log: Logger
class IntrospectEndpoint(BaseEndpoint):
valid_token_types: Any
@@ -12,6 +15,6 @@ class IntrospectEndpoint(BaseEndpoint):
supported_token_types: Any
def __init__(self, request_validator, supported_token_types: Incomplete | None = None) -> None: ...
def create_introspect_response(
self, uri, http_method: str = "POST", body: Incomplete | None = None, headers: Incomplete | None = None
self, uri: str, http_method: _HTTPMethod = "POST", body: str | None = None, headers: dict[str, str] | None = None
): ...
def validate_introspect_request(self, request) -> None: ...
def validate_introspect_request(self, request: Request) -> None: ...
@@ -1,9 +1,9 @@
from _typeshed import Incomplete
from logging import Logger
from typing import Any
from .base import BaseEndpoint as BaseEndpoint
from .base import BaseEndpoint
log: Any
log: Logger
class MetadataEndpoint(BaseEndpoint):
raise_errors: Any
@@ -12,7 +12,7 @@ class MetadataEndpoint(BaseEndpoint):
claims: Any
def __init__(self, endpoints, claims={}, raise_errors: bool = True) -> None: ...
def create_metadata_response(
self, uri, http_method: str = "GET", body: Incomplete | None = None, headers: Incomplete | None = None
self, uri: str, http_method: str = "GET", body: str | None = None, headers: dict[str, str] | None = None
): ...
def validate_metadata(
self, array, key, is_required: bool = False, is_list: bool = False, is_url: bool = False, is_issuer: bool = False
@@ -1,11 +1,11 @@
from _typeshed import Incomplete
from typing import Any
from .authorization import AuthorizationEndpoint as AuthorizationEndpoint
from .introspect import IntrospectEndpoint as IntrospectEndpoint
from .resource import ResourceEndpoint as ResourceEndpoint
from .revocation import RevocationEndpoint as RevocationEndpoint
from .token import TokenEndpoint as TokenEndpoint
from .authorization import AuthorizationEndpoint
from .introspect import IntrospectEndpoint
from .resource import ResourceEndpoint
from .revocation import RevocationEndpoint
from .token import TokenEndpoint
class Server(AuthorizationEndpoint, IntrospectEndpoint, TokenEndpoint, ResourceEndpoint, RevocationEndpoint):
auth_grant: Any
@@ -1,9 +1,11 @@
from _typeshed import Incomplete
from typing import Any
from logging import Logger
from .base import BaseEndpoint as BaseEndpoint
from oauthlib.common import Request, _HTTPMethod
log: Any
from .base import BaseEndpoint
log: Logger
class ResourceEndpoint(BaseEndpoint):
def __init__(self, default_token, token_types) -> None: ...
@@ -16,9 +18,9 @@ class ResourceEndpoint(BaseEndpoint):
def verify_request(
self,
uri,
http_method: str = "GET",
body: Incomplete | None = None,
headers: Incomplete | None = None,
http_method: _HTTPMethod = "GET",
body: str | None = None,
headers: dict[str, str] | None = None,
scopes: Incomplete | None = None,
): ...
def find_token_type(self, request): ...
def find_token_type(self, request: Request): ...
@@ -1,9 +1,12 @@
from _typeshed import Incomplete
from logging import Logger
from typing import Any
from .base import BaseEndpoint as BaseEndpoint
from oauthlib.common import Request, _HTTPMethod
log: Any
from .base import BaseEndpoint
log: Logger
class RevocationEndpoint(BaseEndpoint):
valid_token_types: Any
@@ -15,6 +18,6 @@ class RevocationEndpoint(BaseEndpoint):
self, request_validator, supported_token_types: Incomplete | None = None, enable_jsonp: bool = False
) -> None: ...
def create_revocation_response(
self, uri, http_method: str = "POST", body: Incomplete | None = None, headers: Incomplete | None = None
self, uri: str, http_method: _HTTPMethod = "POST", body: str | None = None, headers: dict[str, str] | None = None
): ...
def validate_revocation_request(self, request) -> None: ...
def validate_revocation_request(self, request: Request) -> None: ...
@@ -1,12 +1,14 @@
from _typeshed import Incomplete
from typing import Any
from logging import Logger
from .base import BaseEndpoint as BaseEndpoint
from oauthlib.common import Request, _HTTPMethod
log: Any
from .base import BaseEndpoint
log: Logger
class TokenEndpoint(BaseEndpoint):
valid_request_methods: Any
valid_request_methods: tuple[str]
def __init__(self, default_grant_type, default_token_type, grant_types) -> None: ...
@property
def grant_types(self): ...
@@ -18,12 +20,12 @@ class TokenEndpoint(BaseEndpoint):
def default_token_type(self): ...
def create_token_response(
self,
uri,
http_method: str = "POST",
body: Incomplete | None = None,
headers: Incomplete | None = None,
uri: str,
http_method: _HTTPMethod = "POST",
body: str | None = None,
headers: dict[str, str] | None = None,
credentials: Incomplete | None = None,
grant_type_for_scope: Incomplete | None = None,
claims: Incomplete | None = None,
): ...
def validate_token_request(self, request) -> None: ...
def validate_token_request(self, request: Request) -> None: ...
@@ -1,18 +1,24 @@
from typing import Any
from _typeshed import Incomplete
from logging import Logger
from .base import GrantTypeBase as GrantTypeBase
from oauthlib.common import Request
log: Any
from ..tokens import TokenBase
from .base import GrantTypeBase
def code_challenge_method_s256(verifier, challenge): ...
def code_challenge_method_plain(verifier, challenge): ...
log: Logger
def code_challenge_method_s256(verifier: str, challenge: str) -> bool: ...
def code_challenge_method_plain(verifier: str, challenge: str) -> bool: ...
class AuthorizationCodeGrant(GrantTypeBase):
default_response_mode: str
response_types: Any
def create_authorization_code(self, request): ...
def create_authorization_response(self, request, token_handler): ...
def create_token_response(self, request, token_handler): ...
def validate_authorization_request(self, request): ...
def validate_token_request(self, request) -> None: ...
def validate_code_challenge(self, challenge, challenge_method, verifier): ...
response_types: list[str]
def create_authorization_code(self, request: Request) -> dict[str, str]: ...
def create_authorization_response(
self, request: Request, token_handler: TokenBase
) -> tuple[dict[str, str], None, int | None]: ...
def create_token_response(self, request: Request, token_handler: TokenBase) -> tuple[dict[str, str], str, int | None]: ...
def validate_authorization_request(self, request: Request) -> tuple[Incomplete, dict[str, Incomplete]]: ...
def validate_token_request(self, request: Request) -> None: ...
def validate_code_challenge(self, challenge: str, challenge_method: str, verifier: str) -> bool: ...
@@ -1,32 +1,68 @@
from _typeshed import Incomplete
from typing import Any
from collections.abc import Callable, Iterable
from itertools import chain
from logging import Logger
from typing import TypeVar
from typing_extensions import TypeAlias
log: Any
from oauthlib.common import Request
from ..request_validator import RequestValidator
from ..tokens import TokenBase
log: Logger
_T = TypeVar("_T")
_AuthValidator: TypeAlias = Callable[[Request], dict[str, Incomplete]]
_TokenValidator: TypeAlias = Callable[[Request], None]
_CodeModifier: TypeAlias = Callable[[dict[str, str], TokenBase | None, Request | None], dict[str, str]]
_TokenModifier: TypeAlias = Callable[[dict[str, Incomplete], TokenBase | None, Request | None], dict[str, Incomplete]]
class ValidatorsContainer:
pre_auth: Any
post_auth: Any
pre_token: Any
post_token: Any
def __init__(self, post_auth, post_token, pre_auth, pre_token) -> None: ...
pre_auth: Iterable[_AuthValidator]
post_auth: Iterable[_AuthValidator]
pre_token: Iterable[_TokenValidator]
post_token: Iterable[_TokenValidator]
def __init__(
self,
post_auth: Iterable[_AuthValidator],
post_token: Iterable[_TokenValidator],
pre_auth: Iterable[_AuthValidator],
pre_token: Iterable[_TokenValidator],
) -> None: ...
@property
def all_pre(self): ...
def all_pre(self) -> chain[_AuthValidator | _TokenValidator]: ...
@property
def all_post(self): ...
def all_post(self) -> chain[_AuthValidator | _TokenValidator]: ...
class GrantTypeBase:
error_uri: Any
request_validator: Any
error_uri: str | None
request_validator: RequestValidator | None
default_response_mode: str
refresh_token: bool
response_types: Any
def __init__(self, request_validator: Incomplete | None = None, **kwargs) -> None: ...
def register_response_type(self, response_type) -> None: ...
def register_code_modifier(self, modifier) -> None: ...
def register_token_modifier(self, modifier) -> None: ...
def create_authorization_response(self, request, token_handler) -> None: ...
def create_token_response(self, request, token_handler) -> None: ...
def add_token(self, token, token_handler, request): ...
def validate_grant_type(self, request) -> None: ...
def validate_scopes(self, request) -> None: ...
def prepare_authorization_response(self, request, token, headers, body, status): ...
response_types: list[str]
def __init__(
self,
request_validator: RequestValidator | None = None,
*,
post_auth: Iterable[_AuthValidator] | None = None,
post_token: Iterable[_TokenValidator] | None = None,
pre_auth: Iterable[_AuthValidator] | None = None,
pre_token: Iterable[_TokenValidator] | None = None,
**kwargs,
) -> None: ...
def register_response_type(self, response_type: str) -> None: ...
def register_code_modifier(self, modifier: _CodeModifier) -> None: ...
def register_token_modifier(self, modifier: _TokenModifier) -> None: ...
def create_authorization_response(
self, request: Request, token_handler: TokenBase
) -> tuple[dict[str, str], str | None, int | None]: ...
def create_token_response(
self, request: Request, token_handler: TokenBase
) -> tuple[dict[str, str], str | None, int | None]: ...
def add_token(self, token: dict[str, _T], token_handler: TokenBase, request: Request) -> dict[str, _T]: ...
def validate_grant_type(self, request: Request) -> None: ...
def validate_scopes(self, request: Request) -> None: ...
def prepare_authorization_response(
self, request: Request, token: dict[str, Incomplete], headers: dict[str, str], body: str | None, status: int | None
) -> tuple[dict[str, str], str | None, int | None]: ...
@@ -1,9 +1,12 @@
from typing import Any
from logging import Logger
from .base import GrantTypeBase as GrantTypeBase
from oauthlib.common import Request
log: Any
from ..tokens import TokenBase
from .base import GrantTypeBase
log: Logger
class ClientCredentialsGrant(GrantTypeBase):
def create_token_response(self, request, token_handler): ...
def validate_token_request(self, request) -> None: ...
def create_token_response(self, request: Request, token_handler: TokenBase) -> tuple[dict[str, str], str, int | None]: ...
def validate_token_request(self, request: Request) -> None: ...
@@ -1,13 +1,19 @@
from typing import Any
from _typeshed import Incomplete
from logging import Logger
from .base import GrantTypeBase as GrantTypeBase
from oauthlib.common import Request
log: Any
from ..tokens import TokenBase
from .base import GrantTypeBase
log: Logger
class ImplicitGrant(GrantTypeBase):
response_types: Any
response_types: list[str]
grant_allows_refresh_token: bool
def create_authorization_response(self, request, token_handler): ...
def create_token_response(self, request, token_handler): ...
def validate_authorization_request(self, request): ...
def validate_token_request(self, request): ...
def create_authorization_response(
self, request: Request, token_handler: TokenBase
) -> tuple[dict[str, str], str | None, int]: ...
def create_token_response(self, request: Request, token_handler: TokenBase) -> tuple[dict[str, str], str | None, int]: ...
def validate_authorization_request(self, request: Request) -> tuple[Incomplete, dict[str, Incomplete]]: ...
def validate_token_request(self, request: Request) -> tuple[Incomplete, dict[str, Incomplete]]: ...
@@ -1,11 +1,25 @@
from _typeshed import Incomplete
from typing import Any
from collections.abc import Iterable
from logging import Logger
from .base import GrantTypeBase as GrantTypeBase
from oauthlib.common import Request
log: Any
from ..request_validator import RequestValidator
from ..tokens import TokenBase
from .base import GrantTypeBase, _AuthValidator, _TokenValidator
log: Logger
class RefreshTokenGrant(GrantTypeBase):
def __init__(self, request_validator: Incomplete | None = None, issue_new_refresh_tokens: bool = True, **kwargs) -> None: ...
def create_token_response(self, request, token_handler): ...
def validate_token_request(self, request) -> None: ...
def __init__(
self,
request_validator: RequestValidator | None = None,
issue_new_refresh_tokens: bool = True,
*,
post_auth: Iterable[_AuthValidator] | None = None,
post_token: Iterable[_TokenValidator] | None = None,
pre_auth: Iterable[_AuthValidator] | None = None,
pre_token: Iterable[_TokenValidator] | None = None,
**kwargs,
) -> None: ...
def create_token_response(self, request: Request, token_handler: TokenBase) -> tuple[dict[str, str], str, int | None]: ...
def validate_token_request(self, request: Request) -> None: ...
@@ -1,9 +1,12 @@
from typing import Any
from logging import Logger
from .base import GrantTypeBase as GrantTypeBase
from oauthlib.common import Request
log: Any
from ..tokens import TokenBase
from .base import GrantTypeBase
log: Logger
class ResourceOwnerPasswordCredentialsGrant(GrantTypeBase):
def create_token_response(self, request, token_handler): ...
def validate_token_request(self, request) -> None: ...
def create_token_response(self, request: Request, token_handler: TokenBase) -> tuple[dict[str, str], str, int | None]: ...
def validate_token_request(self, request: Request) -> None: ...
@@ -24,6 +24,8 @@ def prepare_token_request(
scope: str | set[object] | tuple[object] | list[object] | None = None,
client_id: str | None = None,
client_secret: str | None = None,
code: str | None = None,
redirect_uri: str | None = None,
**kwargs,
) -> str: ...
def prepare_token_revocation_request(