?????????? ????????? - ??????????????? - /home/agenciai/public_html/cd38d8/oauthlib.tar
???????
__pycache__/uri_validate.cpython-39.opt-1.pyc 0000644 00000007302 15125174063 0015022 0 ustar 00 a �#/d� � @ sp d Z ddlZdZdZdZde� Zde� ZdZd Z d e� Z d e� Z d e� Z d e� Z de� ZdZde� Zde� Zde� Zde� Zde� Zde� Zde� Zde� Zde� Zde� Zde� Zde� Zd e� Z d e� Z d Z d e� Z d e� Z d e� Z!d!e� Z"d"e� Z#d#e� Z$d$e� Z%d%e� Z&d&e� Z'd'd(� Z(d)d*� Z)d+d,� Z*dS )-a Regex for URIs These regex are directly derived from the collected ABNF in RFC3986 (except for DIGIT, ALPHA and HEXDIG, defined by RFC2234). They should be processed with re.VERBOSE. Thanks Mark Nottingham for this code - https://gist.github.com/138549 � Nz [\x30-\x39]z[\x41-\x5A\x61-\x7A]z[\x30-\x39A-Fa-f]z %% %(HEXDIG)s %(HEXDIG)sz-(?: %(ALPHA)s | %(DIGIT)s | \- | \. | _ | ~ )z#(?: : | / | \? | \# | \[ | \] | @ )zI(?: ! | \$ | & | ' | \( | \) | \* | \+ | , | ; | = )z?(?: %(unreserved)s | %(pct_encoded)s | %(sub_delims)s | : | @ )z%(?: %(gen_delims)s | %(sub_delims)s )z5%(ALPHA)s (?: %(ALPHA)s | %(DIGIT)s | \+ | \- | \. )*z�(?: %(DIGIT)s | [\x31-\x39] %(DIGIT)s | 1 %(DIGIT)s{2} | 2 [\x30-\x34] %(DIGIT)s | 25 [\x30-\x35] ) z@%(dec_octet)s \. %(dec_octet)s \. %(dec_octet)s \. %(dec_octet)sz#([A-Fa-f0-9:]+[:$])[A-Fa-f0-9]{1,4}z;v %(HEXDIG)s+ \. (?: %(unreserved)s | %(sub_delims)s | : )+z+\[ (?: %(IPv6address)s | %(IPvFuture)s ) \]z8(?: %(unreserved)s | %(pct_encoded)s | %(sub_delims)s )*z;(?: %(unreserved)s | %(pct_encoded)s | %(sub_delims)s | : )z5(?: %(IP_literal)s | %(IPv4address)s | %(reg_name)s )z(?: %(DIGIT)s )*z.(?: %(userinfo)s @)? %(host)s (?: : %(port)s)?z %(pchar)s*z %(pchar)s+z<(?: %(unreserved)s | %(pct_encoded)s | %(sub_delims)s | @ )+z(?: / %(segment)s )*z,/ (?: %(segment_nz)s (?: / %(segment)s )* )?z&%(segment_nz_nc)s (?: / %(segment)s )*z#%(segment_nz)s (?: / %(segment)s )*� z�(?: %(path_abempty)s | %(path_absolute)s | %(path_noscheme)s | %(path_rootless)s | %(path_empty)s ) z(?: %(pchar)s | / | \? )*z�(?: (?: // %(authority)s %(path_abempty)s ) | %(path_absolute)s | %(path_rootless)s | %(path_empty)s ) z�(?: (?: // %(authority)s %(path_abempty)s ) | %(path_absolute)s | %(path_noscheme)s | %(path_empty)s ) z:%(relative_part)s (?: \? %(query)s)? (?: \# %(fragment)s)?zM^(?: %(scheme)s : %(hier_part)s (?: \? %(query)s )? (?: \# %(fragment)s )? )$z"^(?: %(URI)s | %(relative_ref)s )$z6^(?: %(scheme)s : %(hier_part)s (?: \? %(query)s )? )$c C s t �t| t j�S �N)�re�match�URI�VERBOSE�Zuri� r �9/usr/lib/python3.9/site-packages/oauthlib/uri_validate.py�is_uri� s r c C s t �t| t j�S r )r r � URI_referencer r r r r �is_uri_reference� s r c C s t �t| t j�S r )r r � absolute_URIr r r r r �is_absolute_uri� s r )+�__doc__r ZDIGITZALPHAZHEXDIG�localsZ pct_encodedZ unreservedZ gen_delimsZ sub_delimsZpcharZreserved�schemeZ dec_octetZ IPv4addressZ IPv6addressZ IPvFutureZ IP_literalZreg_name�userinfo�host�portZ authorityZsegmentZ segment_nzZ segment_nz_ncZ path_abemptyZ path_absoluteZ path_noschemeZ path_rootlessZ path_empty�path�query�fragmentZ hier_partZ relative_partZ relative_refr r r r r r r r r r �<module> sb � � � � __pycache__/signals.cpython-39.opt-1.pyc 0000644 00000003540 15125174063 0014012 0 ustar 00 a \��`� � @ s` d Z dZzddlmZ dZW n. eyJ G dd� d�ZG dd� d�ZY n0 e� Ze�d �Zd S ) z� Implements signals based on blinker if available, otherwise falls silently back to a noop. Shamelessly stolen from flask.signals: https://github.com/mitsuhiko/flask/blob/master/flask/signals.py F� )� NamespaceTc @ s e Zd Zddd�ZdS )r Nc C s t ||�S �N)� _FakeSignal��self�name�doc� r �4/usr/lib/python3.9/site-packages/oauthlib/signals.py�signal s zNamespace.signal)N)�__name__� __module__� __qualname__r r r r r r s r c @ sD e Zd ZdZd dd�Zdd� Zdd� Ze Z Z Z Z Z Z [dS ) r a If blinker is unavailable, create a fake class with the same interface that allows sending of signals but will fail with an error on anything else. Instead of doing anything on send, it will just ignore the arguments and do nothing instead. Nc C s || _ || _d S r )r �__doc__r r r r �__init__ s z_FakeSignal.__init__c O s t d��d S )NzOsignalling support is unavailable because the blinker library is not installed.)� RuntimeError)r �args�kwargsr r r �_fail s z_FakeSignal._failc O s d S r r )�a�kwr r r �<lambda> � z_FakeSignal.<lambda>)N) r r r r r r �sendZconnectZ disconnectZhas_receivers_forZ receivers_forZtemporarily_connected_toZ connected_tor r r r r s �r z scope-changedN) r Zsignals_availableZblinkerr � ImportErrorr Z_signalsr Z scope_changedr r r r �<module> s __pycache__/common.cpython-39.pyc 0000644 00000032055 15125174063 0012706 0 ustar 00 a \��`n4 � @ s� d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z m Z m Z ddlmZ z ddlmZ ddlmZ W n* ey� ddlmZ ddlmZ Y n0 d Zd Ze�d ej�Ze�d �Z d Z e� d�Z d:dd�Z dd� Z dd� Z dd� Z dd� Z!e"e �e"d�B Z#dd � Z$d d � Z%d d � Z&d!d"� Z'd#efd$d%�Z(d&d'� Z)d(d)� Z*d#efd*d+�Z+d,d-� Z,d;d/d0�Z-d1d2� Z.d<d4d5�Z/G d6d7� d7e0�Z1G d8d9� d9�Z2dS )=z| oauthlib.common ~~~~~~~~~~~~~~ This module provides data structures and utilities common to all implementations of OAuth. � N)�quote�unquote� urlencode� )� get_debug)�randbits)� SystemRandom)� getrandbitsZ>abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789z_ !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}z&([^&;]*(?:password|token)[^=]*=)[^&;]+z&%[^0-9A-Fa-f]|%[0-9A-Fa-f][^0-9A-Fa-f]zAABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.-Zoauthlib� /c C s: t | t�r| �d�n| } t| |�} t | t�r6| �d�} | S �N�utf-8)� isinstance�str�encode�_quote�bytes�decode)�s�safe� r �3/usr/lib/python3.9/site-packages/oauthlib/common.pyr - s r c C s t | �} t| t�r | �d�} | S r )�_unquoter r r )r r r r r 7 s r c C s, t | �}t|�}t|t�r |S |�d�S d S r )�encode_params_utf8� _urlencoder r r )�paramsZ utf8_params� urlencodedr r r r A s r c C sL g }| D ]>\}}|� t|t�r(|�d�n|t|t�r>|�d�n|f� q|S )ziEnsures that all parameters in a list of 2-element tuples are encoded to bytestrings using UTF-8 r )�appendr r r )r Zencoded�k�vr r r r J s �r c C sL g }| D ]>\}}|� t|t�r(|�d�n|t|t�r>|�d�n|f� q|S )zfEnsures that all parameters in a list of 2-element tuples are decoded to unicode using UTF-8. r )r r r r )r Zdecodedr r r r r �decode_params_utf8V s �r z=&;:%+~,*@!()/?'$c C sT | r,t | �tks,d}t|t | �t | f ��t�| �r>td��tj| dd�}t|�S )a� Decode a query string in x-www-form-urlencoded format into a sequence of two-element tuples. Unlike urlparse.parse_qsl(..., strict_parsing=True) urldecode will enforce correct formatting of the query string by validation. If validation fails a ValueError will be raised. urllib.parse_qsl will only raise errors if any of name-value pairs omits the equals sign. z�Error trying to decode a non urlencoded string. Found invalid characters: %s in the string: '%s'. Please ensure the request/response body is x-www-form-urlencoded.z%Invalid hex encoding in query string.T��keep_blank_values)�setr � ValueError�INVALID_HEX_PATTERN�search�urlparse� parse_qslr )�query�errorr r r r � urldecodee s r* c C s� t | ttf�r4z t| �}W q� ty0 d}Y q�0 njt| d�r�z t| � W n* ty` d}Y q� tyt d}Y q�0 tt | t�r�| � � n| �}t |�}nd}|S )a* Extract parameters and return them as a list of 2-tuples. Will successfully extract parameters from urlencoded query strings, dicts, or lists of 2-tuples. Empty strings/dicts/lists will return an empty list of parameters. Any other input will result in a return value of None. N�__iter__) r r r r* r# �hasattr�dict� TypeError�list�itemsr )�rawr r r r �extract_params� s r2 c C s t t td��t� �S )a� Generate pseudorandom nonce that is unlikely to repeat. Per `section 3.3`_ of the OAuth 1 RFC 5849 spec. Per `section 3.2.1`_ of the MAC Access Authentication spec. A random 64-bit number is appended to the epoch timestamp for both randomness and to decrease the likelihood of collisions. .. _`section 3.2.1`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-3.2.1 .. _`section 3.3`: https://tools.ietf.org/html/rfc5849#section-3.3 �@ )r r �generate_timestampr r r r �generate_nonce� s r5 c C s t tt�� ��S )aD Get seconds since epoch (UTC). Per `section 3.3`_ of the OAuth 1 RFC 5849 spec. Per `section 3.2.1`_ of the MAC Access Authentication spec. .. _`section 3.2.1`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-3.2.1 .. _`section 3.3`: https://tools.ietf.org/html/rfc5849#section-3.3 )r �int�timer r r r r4 � s r4 � c s$ t � �d�� �fdd�t| �D ��S )aX Generates a non-guessable OAuth token OAuth (1 and 2) does not specify the format of tokens except that they should be strings of random characters. Tokens should not be guessable and entropy when generating the random characters is important. Which is why SystemRandom is used instead of the default random.choice method. � c 3 s | ]}�� � �V qd S �N)�choice)�.0�x��charsZrandr r � <genexpr>� � z!generate_token.<locals>.<genexpr>)r �join�range��lengthr? r r> r �generate_token� s rF c C sT dd l }tj�� }|j|tj|jd� d�}|�|j� |�|| d�}t |d�}|S )Nr )Zseconds)�scopeZexp�RS256�UTF-8) �jwt�datetimeZutcnowrG Z timedeltaZ expires_in�update�claimsr � to_unicode)Z private_pemZrequestrJ ZnowrM �tokenr r r �generate_signed_token� s � rP c C s dd l }|j|| dgd�S )Nr rH )Z algorithms)rJ r )Z public_pemrO rJ r r r �verify_signed_token� s rQ c C s t | |�S )z�Generates an OAuth client_id OAuth 2 specify the format of client_id in https://tools.ietf.org/html/rfc6749#appendix-A. )rF rD r r r �generate_client_id� s rR c C s2 t |t�r|�� }tj| dd�}|�|� t|�S )z)Extend a query with a list of two-tuples.Tr )r r- r0 r& r' �extendr )r( r Z queryparamsr r r �add_params_to_qs� s rT Fc C sF t � | �\}}}}}}|r&t||�}n t||�}t �||||||f�S )z5Add a list of two-tuples to the uri query components.)r& rT � urlunparse) �urir �fragmentZschZnet�pathZparr( Zfrar r r �add_params_to_uri� s rY c C sH t | �t |�krdS d}t| |�D ] \}}|t|�t|�A O }q"|dkS )a Near-constant time string comparison. Used in order to avoid timing attacks on sensitive information such as secret keys during request verification (`rootLabs`_). .. _`rootLabs`: http://rdist.root.org/2010/01/07/timing-independent-array-comparison/ Fr )�len�zip�ord)�a�b�resultr= �yr r r �safe_string_equals� s ra rI c s� t | t�r| S t | t�r$t| � d�S t| d�r�z t| � W n4 tyL Y nH tyn � fdd�| D � Y S 0 t| d�r�| �� } � fdd�| D �S | S )z:Convert a number of different types of objects to unicode.��encodingr+ c 3 s | ]}t |� �V qd S r: �rN )r< �irb r r r@ rA z to_unicode.<locals>.<genexpr>r0 c s" i | ]\}}t |� �t |� ��qS r rd )r< r r rb r r � <dictcomp>$ rA z to_unicode.<locals>.<dictcomp>)r r r r, r- r. r# r0 )�datarc r rb r rN s rN c sb e Zd ZdZi Zdd� Zdd� Z� fdd�Z� fdd �Zdd d �Z � fd d�Z � fdd�Z � Z S )�CaseInsensitiveDictz3Basic case insensitive dict with strings only keys.c C s* dd� |D �| _ |D ]}|| | |< qd S )Nc S s i | ]}|� � |�qS r )�lower)r< r r r r rf 0 rA z0CaseInsensitiveDict.__init__.<locals>.<dictcomp>)�proxy)�selfrg r r r r �__init__/ s z CaseInsensitiveDict.__init__c C s |� � | jv S r: )ri rj )rk r r r r � __contains__4 s z CaseInsensitiveDict.__contains__c s* | j |�� }t� �|� | j |�� = d S r: )rj ri �super� __delitem__�rk r �key�� __class__r r ro 7 s z CaseInsensitiveDict.__delitem__c s | j |�� }t� �|�S r: )rj ri rn � __getitem__rp rr r r rt < s z CaseInsensitiveDict.__getitem__Nc C s || v r| | S |S r: r )rk r �defaultr r r �get@ s zCaseInsensitiveDict.getc s t � �||� || j|�� < d S r: )rn � __setitem__rj ri )rk r r rr r r rw C s z CaseInsensitiveDict.__setitem__c s8 t � j|i |�� t|i |��D ]}|| j|�� < q d S r: )rn rL r- rj ri )rk �args�kwargsr rr r r rL G s zCaseInsensitiveDict.update)N) �__name__� __module__� __qualname__�__doc__rj rl rm ro rt rv rw rL � __classcell__r r rr r rh ) s rh c @ sN e Zd ZdZddd�Zdd� Zd d � Zed d � �Zed d� �Z edd� �Z dS )�Requesta: A malleable representation of a signable HTTP request. Body argument may contain any data, but parameters will only be decoded if they are one of: * urlencoded query string * dict * list of 2-tuples Anything else will be treated as raw body data to be passed through unmolested. �GETNr c s� � fdd�}||�| _ ||�| _t||p*i ��| _||�| _t| j�| _g | _i | _d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d� | _ | j � t t | j ��� | j � t | jp�g �� d S )Nc s � rt | � �S | S r: rd )r= rb r r �<lambda>_ rA z"Request.__init__.<locals>.<lambda>) Z access_tokenZclientZ client_idZ client_secret�codeZcode_challengeZcode_challenge_methodZ code_verifierZextra_credentialsZ grant_typeZ redirect_uriZ refresh_tokenZ request_tokenZ response_typerG Zscopes�staterO �userZtoken_type_hintZ response_modeZnonceZdisplay�promptrM Zmax_ageZ ui_localesZ id_token_hintZ login_hintZ acr_values)rV � http_methodrh �headers�bodyr2 � decoded_bodyZ oauth_paramsZ validator_log�_paramsrL r- r* � uri_query)rk rV r� r� r� rc r r rb r rl \ sR �"zRequest.__init__c C s || j v r| j | S t|��d S r: )r� �AttributeError)rk �namer r r � __getattr__� s zRequest.__getattr__c C sR t � s dS | j}| j�� }|r.t�dt|��}d|v r>d|d< d�| j| j ||�S )Nz <oauthlib.Request SANITIZED>z <SANITIZED>Z Authorizationz <SANITIZED>zF<oauthlib.Request url="{}", http_method="{}", headers="{}", body="{}">) r r� r� �copy�SANITIZE_PATTERN�subr �formatrV r� )rk r� r� r r r �__repr__� s �zRequest.__repr__c C s t � | j�jS r: )r& rV r( �rk r r r r� � s zRequest.uri_queryc C s | j s g S tj| j ddd�S )NT)r! �strict_parsing)r� r& r' r� r r r �uri_query_params� s �zRequest.uri_query_paramsc C sP t �t�}dd� | jpg | j D �}|D ]}|| d7 < q(dd� |�� D �S )Nc s s | ]}|d V qdS )r Nr )r< �pr r r r@ � s �z+Request.duplicate_params.<locals>.<genexpr>r c S s g | ]\}}|d kr|�qS )r r )r< r �cr r r � <listcomp>� rA z,Request.duplicate_params.<locals>.<listcomp>)� collections� defaultdictr6 r� r� r0 )rk Z seen_keysZall_keysr r r r �duplicate_params� s �zRequest.duplicate_params)r� NNr ) rz r{ r| r} rl r� r� �propertyr� r� r� r r r r r M s � 2 r )r )F)rI )3r} r� rK Zlogging�rer7 � urllib.parse�parser& r r r r r r r9 r Zsecretsr r � ImportErrorZrandomr ZUNICODE_ASCII_CHARACTER_SETZCLIENT_ID_CHARACTER_SET�compile� IGNORECASEr� r$ Z always_safeZ getLogger�logr r r" r r* r2 r5 r4 rF rP rQ rR rT rY ra rN r- rh r r r r r �<module> sP ! $ __pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000001701 15125174063 0014106 0 ustar 00 a \��`� � @ sJ d Z ddlZddlmZ dZdZe�d��e� � dadd � Zd d � Z dS ) z� oauthlib ~~~~~~~~ A generic, spec-compliant, thorough implementation of the OAuth request-signing logic. :copyright: (c) 2019 by The OAuthlib Community :license: BSD, see LICENSE for details. � N)� NullHandlerzThe OAuthlib Communityz3.1.1ZoauthlibFc C s | a dS )zUSet value of debug flag :param debug_val: Value to set. Must be a bool value. N��_DEBUG)Z debug_val� r �5/usr/lib/python3.9/site-packages/oauthlib/__init__.py� set_debug s r c C s t S )zRGet debug mode value. :return: `True` if debug mode is on, `False` otherwise r r r r r � get_debug s r ) �__doc__Zloggingr � __author__� __version__Z getLoggerZ addHandlerr r r r r r r �<module> s __pycache__/uri_validate.cpython-39.pyc 0000644 00000007302 15125174063 0014063 0 ustar 00 a �#/d� � @ sp d Z ddlZdZdZdZde� Zde� ZdZd Z d e� Z d e� Z d e� Z d e� Z de� ZdZde� Zde� Zde� Zde� Zde� Zde� Zde� Zde� Zde� Zde� Zde� Zde� Zd e� Z d e� Z d Z d e� Z d e� Z d e� Z!d!e� Z"d"e� Z#d#e� Z$d$e� Z%d%e� Z&d&e� Z'd'd(� Z(d)d*� Z)d+d,� Z*dS )-a Regex for URIs These regex are directly derived from the collected ABNF in RFC3986 (except for DIGIT, ALPHA and HEXDIG, defined by RFC2234). They should be processed with re.VERBOSE. Thanks Mark Nottingham for this code - https://gist.github.com/138549 � Nz [\x30-\x39]z[\x41-\x5A\x61-\x7A]z[\x30-\x39A-Fa-f]z %% %(HEXDIG)s %(HEXDIG)sz-(?: %(ALPHA)s | %(DIGIT)s | \- | \. | _ | ~ )z#(?: : | / | \? | \# | \[ | \] | @ )zI(?: ! | \$ | & | ' | \( | \) | \* | \+ | , | ; | = )z?(?: %(unreserved)s | %(pct_encoded)s | %(sub_delims)s | : | @ )z%(?: %(gen_delims)s | %(sub_delims)s )z5%(ALPHA)s (?: %(ALPHA)s | %(DIGIT)s | \+ | \- | \. )*z�(?: %(DIGIT)s | [\x31-\x39] %(DIGIT)s | 1 %(DIGIT)s{2} | 2 [\x30-\x34] %(DIGIT)s | 25 [\x30-\x35] ) z@%(dec_octet)s \. %(dec_octet)s \. %(dec_octet)s \. %(dec_octet)sz#([A-Fa-f0-9:]+[:$])[A-Fa-f0-9]{1,4}z;v %(HEXDIG)s+ \. (?: %(unreserved)s | %(sub_delims)s | : )+z+\[ (?: %(IPv6address)s | %(IPvFuture)s ) \]z8(?: %(unreserved)s | %(pct_encoded)s | %(sub_delims)s )*z;(?: %(unreserved)s | %(pct_encoded)s | %(sub_delims)s | : )z5(?: %(IP_literal)s | %(IPv4address)s | %(reg_name)s )z(?: %(DIGIT)s )*z.(?: %(userinfo)s @)? %(host)s (?: : %(port)s)?z %(pchar)s*z %(pchar)s+z<(?: %(unreserved)s | %(pct_encoded)s | %(sub_delims)s | @ )+z(?: / %(segment)s )*z,/ (?: %(segment_nz)s (?: / %(segment)s )* )?z&%(segment_nz_nc)s (?: / %(segment)s )*z#%(segment_nz)s (?: / %(segment)s )*� z�(?: %(path_abempty)s | %(path_absolute)s | %(path_noscheme)s | %(path_rootless)s | %(path_empty)s ) z(?: %(pchar)s | / | \? )*z�(?: (?: // %(authority)s %(path_abempty)s ) | %(path_absolute)s | %(path_rootless)s | %(path_empty)s ) z�(?: (?: // %(authority)s %(path_abempty)s ) | %(path_absolute)s | %(path_noscheme)s | %(path_empty)s ) z:%(relative_part)s (?: \? %(query)s)? (?: \# %(fragment)s)?zM^(?: %(scheme)s : %(hier_part)s (?: \? %(query)s )? (?: \# %(fragment)s )? )$z"^(?: %(URI)s | %(relative_ref)s )$z6^(?: %(scheme)s : %(hier_part)s (?: \? %(query)s )? )$c C s t �t| t j�S �N)�re�match�URI�VERBOSE�Zuri� r �9/usr/lib/python3.9/site-packages/oauthlib/uri_validate.py�is_uri� s r c C s t �t| t j�S r )r r � URI_referencer r r r r �is_uri_reference� s r c C s t �t| t j�S r )r r � absolute_URIr r r r r �is_absolute_uri� s r )+�__doc__r ZDIGITZALPHAZHEXDIG�localsZ pct_encodedZ unreservedZ gen_delimsZ sub_delimsZpcharZreserved�schemeZ dec_octetZ IPv4addressZ IPv6addressZ IPvFutureZ IP_literalZreg_name�userinfo�host�portZ authorityZsegmentZ segment_nzZ segment_nz_ncZ path_abemptyZ path_absoluteZ path_noschemeZ path_rootlessZ path_empty�path�query�fragmentZ hier_partZ relative_partZ relative_refr r r r r r r r r r �<module> sb � � � � __pycache__/common.cpython-39.opt-1.pyc 0000644 00000032055 15125174063 0013645 0 ustar 00 a \��`n4 � @ s� d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z m Z m Z ddlmZ z ddlmZ ddlmZ W n* ey� ddlmZ ddlmZ Y n0 d Zd Ze�d ej�Ze�d �Z d Z e� d�Z d:dd�Z dd� Z dd� Z dd� Z dd� Z!e"e �e"d�B Z#dd � Z$d d � Z%d d � Z&d!d"� Z'd#efd$d%�Z(d&d'� Z)d(d)� Z*d#efd*d+�Z+d,d-� Z,d;d/d0�Z-d1d2� Z.d<d4d5�Z/G d6d7� d7e0�Z1G d8d9� d9�Z2dS )=z| oauthlib.common ~~~~~~~~~~~~~~ This module provides data structures and utilities common to all implementations of OAuth. � N)�quote�unquote� urlencode� )� get_debug)�randbits)� SystemRandom)� getrandbitsZ>abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789z_ !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}z&([^&;]*(?:password|token)[^=]*=)[^&;]+z&%[^0-9A-Fa-f]|%[0-9A-Fa-f][^0-9A-Fa-f]zAABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.-Zoauthlib� /c C s: t | t�r| �d�n| } t| |�} t | t�r6| �d�} | S �N�utf-8)� isinstance�str�encode�_quote�bytes�decode)�s�safe� r �3/usr/lib/python3.9/site-packages/oauthlib/common.pyr - s r c C s t | �} t| t�r | �d�} | S r )�_unquoter r r )r r r r r 7 s r c C s, t | �}t|�}t|t�r |S |�d�S d S r )�encode_params_utf8� _urlencoder r r )�paramsZ utf8_params� urlencodedr r r r A s r c C sL g }| D ]>\}}|� t|t�r(|�d�n|t|t�r>|�d�n|f� q|S )ziEnsures that all parameters in a list of 2-element tuples are encoded to bytestrings using UTF-8 r )�appendr r r )r Zencoded�k�vr r r r J s �r c C sL g }| D ]>\}}|� t|t�r(|�d�n|t|t�r>|�d�n|f� q|S )zfEnsures that all parameters in a list of 2-element tuples are decoded to unicode using UTF-8. r )r r r r )r Zdecodedr r r r r �decode_params_utf8V s �r z=&;:%+~,*@!()/?'$c C sT | r,t | �tks,d}t|t | �t | f ��t�| �r>td��tj| dd�}t|�S )a� Decode a query string in x-www-form-urlencoded format into a sequence of two-element tuples. Unlike urlparse.parse_qsl(..., strict_parsing=True) urldecode will enforce correct formatting of the query string by validation. If validation fails a ValueError will be raised. urllib.parse_qsl will only raise errors if any of name-value pairs omits the equals sign. z�Error trying to decode a non urlencoded string. Found invalid characters: %s in the string: '%s'. Please ensure the request/response body is x-www-form-urlencoded.z%Invalid hex encoding in query string.T��keep_blank_values)�setr � ValueError�INVALID_HEX_PATTERN�search�urlparse� parse_qslr )�query�errorr r r r � urldecodee s r* c C s� t | ttf�r4z t| �}W q� ty0 d}Y q�0 njt| d�r�z t| � W n* ty` d}Y q� tyt d}Y q�0 tt | t�r�| � � n| �}t |�}nd}|S )a* Extract parameters and return them as a list of 2-tuples. Will successfully extract parameters from urlencoded query strings, dicts, or lists of 2-tuples. Empty strings/dicts/lists will return an empty list of parameters. Any other input will result in a return value of None. N�__iter__) r r r r* r# �hasattr�dict� TypeError�list�itemsr )�rawr r r r �extract_params� s r2 c C s t t td��t� �S )a� Generate pseudorandom nonce that is unlikely to repeat. Per `section 3.3`_ of the OAuth 1 RFC 5849 spec. Per `section 3.2.1`_ of the MAC Access Authentication spec. A random 64-bit number is appended to the epoch timestamp for both randomness and to decrease the likelihood of collisions. .. _`section 3.2.1`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-3.2.1 .. _`section 3.3`: https://tools.ietf.org/html/rfc5849#section-3.3 �@ )r r �generate_timestampr r r r �generate_nonce� s r5 c C s t tt�� ��S )aD Get seconds since epoch (UTC). Per `section 3.3`_ of the OAuth 1 RFC 5849 spec. Per `section 3.2.1`_ of the MAC Access Authentication spec. .. _`section 3.2.1`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-3.2.1 .. _`section 3.3`: https://tools.ietf.org/html/rfc5849#section-3.3 )r �int�timer r r r r4 � s r4 � c s$ t � �d�� �fdd�t| �D ��S )aX Generates a non-guessable OAuth token OAuth (1 and 2) does not specify the format of tokens except that they should be strings of random characters. Tokens should not be guessable and entropy when generating the random characters is important. Which is why SystemRandom is used instead of the default random.choice method. � c 3 s | ]}�� � �V qd S �N)�choice)�.0�x��charsZrandr r � <genexpr>� � z!generate_token.<locals>.<genexpr>)r �join�range��lengthr? r r> r �generate_token� s rF c C sT dd l }tj�� }|j|tj|jd� d�}|�|j� |�|| d�}t |d�}|S )Nr )Zseconds)�scopeZexp�RS256�UTF-8) �jwt�datetimeZutcnowrG Z timedeltaZ expires_in�update�claimsr � to_unicode)Z private_pemZrequestrJ ZnowrM �tokenr r r �generate_signed_token� s � rP c C s dd l }|j|| dgd�S )Nr rH )Z algorithms)rJ r )Z public_pemrO rJ r r r �verify_signed_token� s rQ c C s t | |�S )z�Generates an OAuth client_id OAuth 2 specify the format of client_id in https://tools.ietf.org/html/rfc6749#appendix-A. )rF rD r r r �generate_client_id� s rR c C s2 t |t�r|�� }tj| dd�}|�|� t|�S )z)Extend a query with a list of two-tuples.Tr )r r- r0 r& r' �extendr )r( r Z queryparamsr r r �add_params_to_qs� s rT Fc C sF t � | �\}}}}}}|r&t||�}n t||�}t �||||||f�S )z5Add a list of two-tuples to the uri query components.)r& rT � urlunparse) �urir �fragmentZschZnet�pathZparr( Zfrar r r �add_params_to_uri� s rY c C sH t | �t |�krdS d}t| |�D ] \}}|t|�t|�A O }q"|dkS )a Near-constant time string comparison. Used in order to avoid timing attacks on sensitive information such as secret keys during request verification (`rootLabs`_). .. _`rootLabs`: http://rdist.root.org/2010/01/07/timing-independent-array-comparison/ Fr )�len�zip�ord)�a�b�resultr= �yr r r �safe_string_equals� s ra rI c s� t | t�r| S t | t�r$t| � d�S t| d�r�z t| � W n4 tyL Y nH tyn � fdd�| D � Y S 0 t| d�r�| �� } � fdd�| D �S | S )z:Convert a number of different types of objects to unicode.��encodingr+ c 3 s | ]}t |� �V qd S r: �rN )r< �irb r r r@ rA z to_unicode.<locals>.<genexpr>r0 c s" i | ]\}}t |� �t |� ��qS r rd )r< r r rb r r � <dictcomp>$ rA z to_unicode.<locals>.<dictcomp>)r r r r, r- r. r# r0 )�datarc r rb r rN s rN c sb e Zd ZdZi Zdd� Zdd� Z� fdd�Z� fdd �Zdd d �Z � fd d�Z � fdd�Z � Z S )�CaseInsensitiveDictz3Basic case insensitive dict with strings only keys.c C s* dd� |D �| _ |D ]}|| | |< qd S )Nc S s i | ]}|� � |�qS r )�lower)r< r r r r rf 0 rA z0CaseInsensitiveDict.__init__.<locals>.<dictcomp>)�proxy)�selfrg r r r r �__init__/ s z CaseInsensitiveDict.__init__c C s |� � | jv S r: )ri rj )rk r r r r � __contains__4 s z CaseInsensitiveDict.__contains__c s* | j |�� }t� �|� | j |�� = d S r: )rj ri �super� __delitem__�rk r �key�� __class__r r ro 7 s z CaseInsensitiveDict.__delitem__c s | j |�� }t� �|�S r: )rj ri rn � __getitem__rp rr r r rt < s z CaseInsensitiveDict.__getitem__Nc C s || v r| | S |S r: r )rk r �defaultr r r �get@ s zCaseInsensitiveDict.getc s t � �||� || j|�� < d S r: )rn � __setitem__rj ri )rk r r rr r r rw C s z CaseInsensitiveDict.__setitem__c s8 t � j|i |�� t|i |��D ]}|| j|�� < q d S r: )rn rL r- rj ri )rk �args�kwargsr rr r r rL G s zCaseInsensitiveDict.update)N) �__name__� __module__� __qualname__�__doc__rj rl rm ro rt rv rw rL � __classcell__r r rr r rh ) s rh c @ sN e Zd ZdZddd�Zdd� Zd d � Zed d � �Zed d� �Z edd� �Z dS )�Requesta: A malleable representation of a signable HTTP request. Body argument may contain any data, but parameters will only be decoded if they are one of: * urlencoded query string * dict * list of 2-tuples Anything else will be treated as raw body data to be passed through unmolested. �GETNr c s� � fdd�}||�| _ ||�| _t||p*i ��| _||�| _t| j�| _g | _i | _d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d� | _ | j � t t | j ��� | j � t | jp�g �� d S )Nc s � rt | � �S | S r: rd )r= rb r r �<lambda>_ rA z"Request.__init__.<locals>.<lambda>) Z access_tokenZclientZ client_idZ client_secret�codeZcode_challengeZcode_challenge_methodZ code_verifierZextra_credentialsZ grant_typeZ redirect_uriZ refresh_tokenZ request_tokenZ response_typerG Zscopes�staterO �userZtoken_type_hintZ response_modeZnonceZdisplay�promptrM Zmax_ageZ ui_localesZ id_token_hintZ login_hintZ acr_values)rV � http_methodrh �headers�bodyr2 � decoded_bodyZ oauth_paramsZ validator_log�_paramsrL r- r* � uri_query)rk rV r� r� r� rc r r rb r rl \ sR �"zRequest.__init__c C s || j v r| j | S t|��d S r: )r� �AttributeError)rk �namer r r � __getattr__� s zRequest.__getattr__c C sR t � s dS | j}| j�� }|r.t�dt|��}d|v r>d|d< d�| j| j ||�S )Nz <oauthlib.Request SANITIZED>z <SANITIZED>Z Authorizationz <SANITIZED>zF<oauthlib.Request url="{}", http_method="{}", headers="{}", body="{}">) r r� r� �copy�SANITIZE_PATTERN�subr �formatrV r� )rk r� r� r r r �__repr__� s �zRequest.__repr__c C s t � | j�jS r: )r& rV r( �rk r r r r� � s zRequest.uri_queryc C s | j s g S tj| j ddd�S )NT)r! �strict_parsing)r� r& r' r� r r r �uri_query_params� s �zRequest.uri_query_paramsc C sP t �t�}dd� | jpg | j D �}|D ]}|| d7 < q(dd� |�� D �S )Nc s s | ]}|d V qdS )r Nr )r< �pr r r r@ � s �z+Request.duplicate_params.<locals>.<genexpr>r c S s g | ]\}}|d kr|�qS )r r )r< r �cr r r � <listcomp>� rA z,Request.duplicate_params.<locals>.<listcomp>)� collections� defaultdictr6 r� r� r0 )rk Z seen_keysZall_keysr r r r �duplicate_params� s �zRequest.duplicate_params)r� NNr ) rz r{ r| r} rl r� r� �propertyr� r� r� r r r r r M s � 2 r )r )F)rI )3r} r� rK Zlogging�rer7 � urllib.parse�parser& r r r r r r r9 r Zsecretsr r � ImportErrorZrandomr ZUNICODE_ASCII_CHARACTER_SETZCLIENT_ID_CHARACTER_SET�compile� IGNORECASEr� r$ Z always_safeZ getLogger�logr r r" r r* r2 r5 r4 rF rP rQ rR rT rY ra rN r- rh r r r r r �<module> sP ! $ __pycache__/__init__.cpython-39.pyc 0000644 00000001701 15125174063 0013147 0 ustar 00 a \��`� � @ sJ d Z ddlZddlmZ dZdZe�d��e� � dadd � Zd d � Z dS ) z� oauthlib ~~~~~~~~ A generic, spec-compliant, thorough implementation of the OAuth request-signing logic. :copyright: (c) 2019 by The OAuthlib Community :license: BSD, see LICENSE for details. � N)� NullHandlerzThe OAuthlib Communityz3.1.1ZoauthlibFc C s | a dS )zUSet value of debug flag :param debug_val: Value to set. Must be a bool value. N��_DEBUG)Z debug_val� r �5/usr/lib/python3.9/site-packages/oauthlib/__init__.py� set_debug s r c C s t S )zRGet debug mode value. :return: `True` if debug mode is on, `False` otherwise r r r r r � get_debug s r ) �__doc__Zloggingr � __author__� __version__Z getLoggerZ addHandlerr r r r r r r �<module> s __pycache__/signals.cpython-39.pyc 0000644 00000003540 15125174063 0013053 0 ustar 00 a \��`� � @ s` d Z dZzddlmZ dZW n. eyJ G dd� d�ZG dd� d�ZY n0 e� Ze�d �Zd S ) z� Implements signals based on blinker if available, otherwise falls silently back to a noop. Shamelessly stolen from flask.signals: https://github.com/mitsuhiko/flask/blob/master/flask/signals.py F� )� NamespaceTc @ s e Zd Zddd�ZdS )r Nc C s t ||�S �N)� _FakeSignal��self�name�doc� r �4/usr/lib/python3.9/site-packages/oauthlib/signals.py�signal s zNamespace.signal)N)�__name__� __module__� __qualname__r r r r r r s r c @ sD e Zd ZdZd dd�Zdd� Zdd� Ze Z Z Z Z Z Z [dS ) r a If blinker is unavailable, create a fake class with the same interface that allows sending of signals but will fail with an error on anything else. Instead of doing anything on send, it will just ignore the arguments and do nothing instead. Nc C s || _ || _d S r )r �__doc__r r r r �__init__ s z_FakeSignal.__init__c O s t d��d S )NzOsignalling support is unavailable because the blinker library is not installed.)� RuntimeError)r �args�kwargsr r r �_fail s z_FakeSignal._failc O s d S r r )�a�kwr r r �<lambda> � z_FakeSignal.<lambda>)N) r r r r r r �sendZconnectZ disconnectZhas_receivers_forZ receivers_forZtemporarily_connected_toZ connected_tor r r r r s �r z scope-changedN) r Zsignals_availableZblinkerr � ImportErrorr Z_signalsr Z scope_changedr r r r �<module> s openid/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000000540 15125174063 0015364 0 ustar 00 a \��`� � @ s$ d Z ddlmZmZ ddlmZ dS )z! oauthlib.openid ~~~~~~~~~~~~~~ � )�Server�UserInfoEndpoint)�RequestValidatorN)�__doc__Zconnect.core.endpointsr r Z connect.core.request_validatorr � r r �</usr/lib/python3.9/site-packages/oauthlib/openid/__init__.py�<module> s openid/__pycache__/__init__.cpython-39.pyc 0000644 00000000540 15125174063 0014425 0 ustar 00 a \��`� � @ s$ d Z ddlmZmZ ddlmZ dS )z! oauthlib.openid ~~~~~~~~~~~~~~ � )�Server�UserInfoEndpoint)�RequestValidatorN)�__doc__Zconnect.core.endpointsr r Z connect.core.request_validatorr � r r �</usr/lib/python3.9/site-packages/oauthlib/openid/__init__.py�<module> s openid/connect/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000000237 15125174063 0017020 0 ustar 00 a \��` � @ s d S )N� r r r �D/usr/lib/python3.9/site-packages/oauthlib/openid/connect/__init__.py�<module> � openid/connect/__pycache__/__init__.cpython-39.pyc 0000644 00000000237 15125174063 0016061 0 ustar 00 a \��` � @ s d S )N� r r r �D/usr/lib/python3.9/site-packages/oauthlib/openid/connect/__init__.py�<module> � openid/connect/core/exceptions.py 0000644 00000011266 15125174063 0013150 0 ustar 00 """ oauthlib.oauth2.rfc6749.errors ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Error used both by OAuth 2 clients and providers to represent the spec defined error responses for all four core grant types. """ from oauthlib.oauth2.rfc6749.errors import FatalClientError, OAuth2Error class FatalOpenIDClientError(FatalClientError): pass class OpenIDClientError(OAuth2Error): pass class InteractionRequired(OpenIDClientError): """ The Authorization Server requires End-User interaction to proceed. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User interaction. """ error = 'interaction_required' status_code = 401 class LoginRequired(OpenIDClientError): """ The Authorization Server requires End-User authentication. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User authentication. """ error = 'login_required' status_code = 401 class AccountSelectionRequired(OpenIDClientError): """ The End-User is REQUIRED to select a session at the Authorization Server. The End-User MAY be authenticated at the Authorization Server with different associated accounts, but the End-User did not select a session. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface to prompt for a session to use. """ error = 'account_selection_required' class ConsentRequired(OpenIDClientError): """ The Authorization Server requires End-User consent. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User consent. """ error = 'consent_required' status_code = 401 class InvalidRequestURI(OpenIDClientError): """ The request_uri in the Authorization Request returns an error or contains invalid data. """ error = 'invalid_request_uri' description = 'The request_uri in the Authorization Request returns an ' \ 'error or contains invalid data.' class InvalidRequestObject(OpenIDClientError): """ The request parameter contains an invalid Request Object. """ error = 'invalid_request_object' description = 'The request parameter contains an invalid Request Object.' class RequestNotSupported(OpenIDClientError): """ The OP does not support use of the request parameter. """ error = 'request_not_supported' description = 'The request parameter is not supported.' class RequestURINotSupported(OpenIDClientError): """ The OP does not support use of the request_uri parameter. """ error = 'request_uri_not_supported' description = 'The request_uri parameter is not supported.' class RegistrationNotSupported(OpenIDClientError): """ The OP does not support use of the registration parameter. """ error = 'registration_not_supported' description = 'The registration parameter is not supported.' class InvalidTokenError(OAuth2Error): """ The access token provided is expired, revoked, malformed, or invalid for other reasons. The resource SHOULD respond with the HTTP 401 (Unauthorized) status code. The client MAY request a new access token and retry the protected resource request. """ error = 'invalid_token' status_code = 401 description = ("The access token provided is expired, revoked, malformed, " "or invalid for other reasons.") class InsufficientScopeError(OAuth2Error): """ The request requires higher privileges than provided by the access token. The resource server SHOULD respond with the HTTP 403 (Forbidden) status code and MAY include the "scope" attribute with the scope necessary to access the protected resource. """ error = 'insufficient_scope' status_code = 403 description = ("The request requires higher privileges than provided by " "the access token.") def raise_from_error(error, params=None): import inspect import sys kwargs = { 'description': params.get('error_description'), 'uri': params.get('error_uri'), 'state': params.get('state') } for _, cls in inspect.getmembers(sys.modules[__name__], inspect.isclass): if cls.error == error: raise cls(**kwargs) openid/connect/core/__pycache__/request_validator.cpython-39.opt-1.pyc 0000644 00000033562 15125174063 0021755 0 ustar 00 a \��`�4 � @ s6 d Z ddlZddlmZ e�e�ZG dd� de�ZdS )z_ oauthlib.openid.connect.core.request_validator ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�RequestValidatorc @ sd e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dS )r c C s t d��dS )az Extracts scopes from saved authorization code. The scopes returned by this method is used to route token requests based on scopes passed to Authorization Code requests. With that the token endpoint knows when to include OpenIDConnect id_token in token response only based on authorization code scopes. Only code param should be sufficient to retrieve grant code from any storage you are using, `client_id` and `redirect_uri` can have a blank value `""` don't forget to check it before using those values in a select query if a database is used. :param client_id: Unicode client identifier :param code: Unicode authorization code grant :param redirect_uri: Unicode absolute URI :return: A list of scope Method is used by: - Authorization Token Grant Dispatcher �&Subclasses must implement this method.N��NotImplementedError��selfZ client_id�codeZ redirect_uri�request� r �R/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/request_validator.py� get_authorization_code_scopes s z.RequestValidator.get_authorization_code_scopesc C s t d��dS )ao Extracts nonce from saved authorization code. If present in the Authentication Request, Authorization Servers MUST include a nonce Claim in the ID Token with the Claim Value being the nonce value sent in the Authentication Request. Authorization Servers SHOULD perform no other processing on nonce values used. The nonce value is a case-sensitive string. Only code param should be sufficient to retrieve grant code from any storage you are using. However, `client_id` and `redirect_uri` have been validated and can be used also. :param client_id: Unicode client identifier :param code: Unicode authorization code grant :param redirect_uri: Unicode absolute URI :return: Unicode nonce Method is used by: - Authorization Token Grant Dispatcher r Nr r r r r � get_authorization_code_nonce( s z-RequestValidator.get_authorization_code_noncec C s t d��dS )a Get JWT Bearer token or OpenID Connect ID token If using OpenID Connect this SHOULD call `oauthlib.oauth2.RequestValidator.get_id_token` :param token: A Bearer token dict :param token_handler: the token handler (BearerToken class) :param request: OAuthlib request. :type request: oauthlib.common.Request :return: The JWT Bearer token or OpenID Connect ID token (a JWS signed JWT) Method is used by JWT Bearer and OpenID Connect tokens: - JWTToken.create_token r Nr �r �token� token_handlerr r r r �get_jwt_bearer_token@ s z%RequestValidator.get_jwt_bearer_tokenc C s dS )a8 Get OpenID Connect ID token This method is OPTIONAL and is NOT RECOMMENDED. `finalize_id_token` SHOULD be implemented instead. However, if you want a full control over the minting of the `id_token`, you MAY want to override `get_id_token` instead of using `finalize_id_token`. In the OpenID Connect workflows when an ID Token is requested this method is called. Subclasses should implement the construction, signing and optional encryption of the ID Token as described in the OpenID Connect spec. In addition to the standard OAuth2 request properties, the request may also contain these OIDC specific properties which are useful to this method: - nonce, if workflow is implicit or hybrid and it was provided - claims, if provided to the original Authorization Code request The token parameter is a dict which may contain an ``access_token`` entry, in which case the resulting ID Token *should* include a calculated ``at_hash`` claim. Similarly, when the request parameter has a ``code`` property defined, the ID Token *should* include a calculated ``c_hash`` claim. http://openid.net/specs/openid-connect-core-1_0.html (sections `3.1.3.6`_, `3.2.2.10`_, `3.3.2.11`_) .. _`3.1.3.6`: http://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken .. _`3.2.2.10`: http://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDToken .. _`3.3.2.11`: http://openid.net/specs/openid-connect-core-1_0.html#HybridIDToken :param token: A Bearer token dict :param token_handler: the token handler (BearerToken class) :param request: OAuthlib request. :type request: oauthlib.common.Request :return: The ID Token (a JWS signed JWT) Nr r r r r � get_id_tokenP s %z RequestValidator.get_id_tokenc C s t d��dS )a� Finalize OpenID Connect ID token & Sign or Encrypt. In the OpenID Connect workflows when an ID Token is requested this method is called. Subclasses should implement the construction, signing and optional encryption of the ID Token as described in the OpenID Connect spec. The `id_token` parameter is a dict containing a couple of OIDC technical fields related to the specification. Prepopulated attributes are: - `aud`, equals to `request.client_id`. - `iat`, equals to current time. - `nonce`, if present, is equals to the `nonce` from the authorization request. - `at_hash`, hash of `access_token`, if relevant. - `c_hash`, hash of `code`, if relevant. This method MUST provide required fields as below: - `iss`, REQUIRED. Issuer Identifier for the Issuer of the response. - `sub`, REQUIRED. Subject Identifier - `exp`, REQUIRED. Expiration time on or after which the ID Token MUST NOT be accepted by the RP when performing authentication with the OP. Additionals claims must be added, note that `request.scope` should be used to determine the list of claims. More information can be found at `OpenID Connect Core#Claims`_ .. _`OpenID Connect Core#Claims`: https://openid.net/specs/openid-connect-core-1_0.html#Claims :param id_token: A dict containing technical fields of id_token :param token: A Bearer token dict :param token_handler: the token handler (BearerToken class) :param request: OAuthlib request. :type request: oauthlib.common.Request :return: The ID Token (a JWS signed JWT or JWE encrypted JWT) r Nr )r Zid_tokenr r r r r r �finalize_id_tokenw s )z"RequestValidator.finalize_id_tokenc C s t d��dS )ag Ensure the JWT Bearer token or OpenID Connect ID token are valids and authorized access to scopes. If using OpenID Connect this SHOULD call `oauthlib.oauth2.RequestValidator.get_id_token` If not using OpenID Connect this can `return None` to avoid 5xx rather 401/3 response. OpenID connect core 1.0 describe how to validate an id_token: - http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation - http://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDTValidation - http://openid.net/specs/openid-connect-core-1_0.html#HybridIDTValidation - http://openid.net/specs/openid-connect-core-1_0.html#HybridIDTValidation2 :param token: Unicode Bearer token :param scopes: List of scopes (defined by you) :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is indirectly used by all core OpenID connect JWT token issuing grant types: - Authorization Code Grant - Implicit Grant - Hybrid Grant r Nr �r r �scopesr r r r �validate_jwt_bearer_token� s z*RequestValidator.validate_jwt_bearer_tokenc C s t d��dS )a� Ensure the id token is valid and authorized access to scopes. OpenID connect core 1.0 describe how to validate an id_token: - http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation - http://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDTValidation - http://openid.net/specs/openid-connect-core-1_0.html#HybridIDTValidation - http://openid.net/specs/openid-connect-core-1_0.html#HybridIDTValidation2 :param token: Unicode Bearer token :param scopes: List of scopes (defined by you) :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is indirectly used by all core OpenID connect JWT token issuing grant types: - Authorization Code Grant - Implicit Grant - Hybrid Grant r Nr r r r r �validate_id_token� s z"RequestValidator.validate_id_tokenc C s t d��dS )a� Ensure the logged in user has authorized silent OpenID authorization. Silent OpenID authorization allows access tokens and id tokens to be granted to clients without any user prompt or interaction. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - OpenIDConnectAuthCode - OpenIDConnectImplicit - OpenIDConnectHybrid r Nr �r r r r r � validate_silent_authorization� s z.RequestValidator.validate_silent_authorizationc C s t d��dS )a� Ensure session user has authorized silent OpenID login. If no user is logged in or has not authorized silent login, this method should return False. If the user is logged in but associated with multiple accounts and not selected which one to link to the token then this method should raise an oauthlib.oauth2.AccountSelectionRequired error. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - OpenIDConnectAuthCode - OpenIDConnectImplicit - OpenIDConnectHybrid r Nr r r r r �validate_silent_login� s z&RequestValidator.validate_silent_loginc C s t d��dS )ab Ensure client supplied user id hint matches session user. If the sub claim or id_token_hint is supplied then the session user must match the given ID. :param id_token_hint: User identifier string. :param scopes: List of OAuth 2 scopes and OpenID claims (strings). :param claims: OpenID Connect claims dict. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - OpenIDConnectAuthCode - OpenIDConnectImplicit - OpenIDConnectHybrid r Nr )r Z id_token_hintr Zclaimsr r r r �validate_user_match� s z$RequestValidator.validate_user_matchc C s dS )aM Return the UserInfo claims in JSON or Signed or Encrypted. The UserInfo Claims MUST be returned as the members of a JSON object unless a signed or encrypted response was requested during Client Registration. The Claims defined in Section 5.1 can be returned, as can additional Claims not specified there. For privacy reasons, OpenID Providers MAY elect to not return values for some requested Claims. If a Claim is not returned, that Claim Name SHOULD be omitted from the JSON object representing the Claims; it SHOULD NOT be present with a null or empty string value. The sub (subject) Claim MUST always be returned in the UserInfo Response. Upon receipt of the UserInfo Request, the UserInfo Endpoint MUST return the JSON Serialization of the UserInfo Response as in Section 13.3 in the HTTP response body unless a different format was specified during Registration [OpenID.Registration]. If the UserInfo Response is signed and/or encrypted, then the Claims are returned in a JWT and the content-type MUST be application/jwt. The response MAY be encrypted without also being signed. If both signing and encryption are requested, the response MUST be signed then encrypted, with the result being a Nested JWT, as defined in [JWT]. If signed, the UserInfo Response SHOULD contain the Claims iss (issuer) and aud (audience) as members. The iss value SHOULD be the OP's Issuer Identifier URL. The aud value SHOULD be or include the RP's Client ID value. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: Claims as a dict OR JWT/JWS/JWE as a string Method is used by: UserInfoEndpoint Nr r r r r �get_userinfo_claims s z$RequestValidator.get_userinfo_claimsN)�__name__� __module__� __qualname__r r r r r r r r r r r r r r r r s '+r )�__doc__ZloggingZ)oauthlib.oauth2.rfc6749.request_validatorr ZOAuth2RequestValidatorZ getLoggerr �logr r r r �<module> s openid/connect/core/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000000244 15125174063 0017746 0 ustar 00 a \��` � @ s d S )N� r r r �I/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/__init__.py�<module> � openid/connect/core/__pycache__/request_validator.cpython-39.pyc 0000644 00000033562 15125174063 0021016 0 ustar 00 a \��`�4 � @ s6 d Z ddlZddlmZ e�e�ZG dd� de�ZdS )z_ oauthlib.openid.connect.core.request_validator ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�RequestValidatorc @ sd e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dS )r c C s t d��dS )az Extracts scopes from saved authorization code. The scopes returned by this method is used to route token requests based on scopes passed to Authorization Code requests. With that the token endpoint knows when to include OpenIDConnect id_token in token response only based on authorization code scopes. Only code param should be sufficient to retrieve grant code from any storage you are using, `client_id` and `redirect_uri` can have a blank value `""` don't forget to check it before using those values in a select query if a database is used. :param client_id: Unicode client identifier :param code: Unicode authorization code grant :param redirect_uri: Unicode absolute URI :return: A list of scope Method is used by: - Authorization Token Grant Dispatcher �&Subclasses must implement this method.N��NotImplementedError��selfZ client_id�codeZ redirect_uri�request� r �R/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/request_validator.py� get_authorization_code_scopes s z.RequestValidator.get_authorization_code_scopesc C s t d��dS )ao Extracts nonce from saved authorization code. If present in the Authentication Request, Authorization Servers MUST include a nonce Claim in the ID Token with the Claim Value being the nonce value sent in the Authentication Request. Authorization Servers SHOULD perform no other processing on nonce values used. The nonce value is a case-sensitive string. Only code param should be sufficient to retrieve grant code from any storage you are using. However, `client_id` and `redirect_uri` have been validated and can be used also. :param client_id: Unicode client identifier :param code: Unicode authorization code grant :param redirect_uri: Unicode absolute URI :return: Unicode nonce Method is used by: - Authorization Token Grant Dispatcher r Nr r r r r � get_authorization_code_nonce( s z-RequestValidator.get_authorization_code_noncec C s t d��dS )a Get JWT Bearer token or OpenID Connect ID token If using OpenID Connect this SHOULD call `oauthlib.oauth2.RequestValidator.get_id_token` :param token: A Bearer token dict :param token_handler: the token handler (BearerToken class) :param request: OAuthlib request. :type request: oauthlib.common.Request :return: The JWT Bearer token or OpenID Connect ID token (a JWS signed JWT) Method is used by JWT Bearer and OpenID Connect tokens: - JWTToken.create_token r Nr �r �token� token_handlerr r r r �get_jwt_bearer_token@ s z%RequestValidator.get_jwt_bearer_tokenc C s dS )a8 Get OpenID Connect ID token This method is OPTIONAL and is NOT RECOMMENDED. `finalize_id_token` SHOULD be implemented instead. However, if you want a full control over the minting of the `id_token`, you MAY want to override `get_id_token` instead of using `finalize_id_token`. In the OpenID Connect workflows when an ID Token is requested this method is called. Subclasses should implement the construction, signing and optional encryption of the ID Token as described in the OpenID Connect spec. In addition to the standard OAuth2 request properties, the request may also contain these OIDC specific properties which are useful to this method: - nonce, if workflow is implicit or hybrid and it was provided - claims, if provided to the original Authorization Code request The token parameter is a dict which may contain an ``access_token`` entry, in which case the resulting ID Token *should* include a calculated ``at_hash`` claim. Similarly, when the request parameter has a ``code`` property defined, the ID Token *should* include a calculated ``c_hash`` claim. http://openid.net/specs/openid-connect-core-1_0.html (sections `3.1.3.6`_, `3.2.2.10`_, `3.3.2.11`_) .. _`3.1.3.6`: http://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken .. _`3.2.2.10`: http://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDToken .. _`3.3.2.11`: http://openid.net/specs/openid-connect-core-1_0.html#HybridIDToken :param token: A Bearer token dict :param token_handler: the token handler (BearerToken class) :param request: OAuthlib request. :type request: oauthlib.common.Request :return: The ID Token (a JWS signed JWT) Nr r r r r � get_id_tokenP s %z RequestValidator.get_id_tokenc C s t d��dS )a� Finalize OpenID Connect ID token & Sign or Encrypt. In the OpenID Connect workflows when an ID Token is requested this method is called. Subclasses should implement the construction, signing and optional encryption of the ID Token as described in the OpenID Connect spec. The `id_token` parameter is a dict containing a couple of OIDC technical fields related to the specification. Prepopulated attributes are: - `aud`, equals to `request.client_id`. - `iat`, equals to current time. - `nonce`, if present, is equals to the `nonce` from the authorization request. - `at_hash`, hash of `access_token`, if relevant. - `c_hash`, hash of `code`, if relevant. This method MUST provide required fields as below: - `iss`, REQUIRED. Issuer Identifier for the Issuer of the response. - `sub`, REQUIRED. Subject Identifier - `exp`, REQUIRED. Expiration time on or after which the ID Token MUST NOT be accepted by the RP when performing authentication with the OP. Additionals claims must be added, note that `request.scope` should be used to determine the list of claims. More information can be found at `OpenID Connect Core#Claims`_ .. _`OpenID Connect Core#Claims`: https://openid.net/specs/openid-connect-core-1_0.html#Claims :param id_token: A dict containing technical fields of id_token :param token: A Bearer token dict :param token_handler: the token handler (BearerToken class) :param request: OAuthlib request. :type request: oauthlib.common.Request :return: The ID Token (a JWS signed JWT or JWE encrypted JWT) r Nr )r Zid_tokenr r r r r r �finalize_id_tokenw s )z"RequestValidator.finalize_id_tokenc C s t d��dS )ag Ensure the JWT Bearer token or OpenID Connect ID token are valids and authorized access to scopes. If using OpenID Connect this SHOULD call `oauthlib.oauth2.RequestValidator.get_id_token` If not using OpenID Connect this can `return None` to avoid 5xx rather 401/3 response. OpenID connect core 1.0 describe how to validate an id_token: - http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation - http://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDTValidation - http://openid.net/specs/openid-connect-core-1_0.html#HybridIDTValidation - http://openid.net/specs/openid-connect-core-1_0.html#HybridIDTValidation2 :param token: Unicode Bearer token :param scopes: List of scopes (defined by you) :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is indirectly used by all core OpenID connect JWT token issuing grant types: - Authorization Code Grant - Implicit Grant - Hybrid Grant r Nr �r r �scopesr r r r �validate_jwt_bearer_token� s z*RequestValidator.validate_jwt_bearer_tokenc C s t d��dS )a� Ensure the id token is valid and authorized access to scopes. OpenID connect core 1.0 describe how to validate an id_token: - http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation - http://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDTValidation - http://openid.net/specs/openid-connect-core-1_0.html#HybridIDTValidation - http://openid.net/specs/openid-connect-core-1_0.html#HybridIDTValidation2 :param token: Unicode Bearer token :param scopes: List of scopes (defined by you) :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is indirectly used by all core OpenID connect JWT token issuing grant types: - Authorization Code Grant - Implicit Grant - Hybrid Grant r Nr r r r r �validate_id_token� s z"RequestValidator.validate_id_tokenc C s t d��dS )a� Ensure the logged in user has authorized silent OpenID authorization. Silent OpenID authorization allows access tokens and id tokens to be granted to clients without any user prompt or interaction. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - OpenIDConnectAuthCode - OpenIDConnectImplicit - OpenIDConnectHybrid r Nr �r r r r r � validate_silent_authorization� s z.RequestValidator.validate_silent_authorizationc C s t d��dS )a� Ensure session user has authorized silent OpenID login. If no user is logged in or has not authorized silent login, this method should return False. If the user is logged in but associated with multiple accounts and not selected which one to link to the token then this method should raise an oauthlib.oauth2.AccountSelectionRequired error. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - OpenIDConnectAuthCode - OpenIDConnectImplicit - OpenIDConnectHybrid r Nr r r r r �validate_silent_login� s z&RequestValidator.validate_silent_loginc C s t d��dS )ab Ensure client supplied user id hint matches session user. If the sub claim or id_token_hint is supplied then the session user must match the given ID. :param id_token_hint: User identifier string. :param scopes: List of OAuth 2 scopes and OpenID claims (strings). :param claims: OpenID Connect claims dict. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - OpenIDConnectAuthCode - OpenIDConnectImplicit - OpenIDConnectHybrid r Nr )r Z id_token_hintr Zclaimsr r r r �validate_user_match� s z$RequestValidator.validate_user_matchc C s dS )aM Return the UserInfo claims in JSON or Signed or Encrypted. The UserInfo Claims MUST be returned as the members of a JSON object unless a signed or encrypted response was requested during Client Registration. The Claims defined in Section 5.1 can be returned, as can additional Claims not specified there. For privacy reasons, OpenID Providers MAY elect to not return values for some requested Claims. If a Claim is not returned, that Claim Name SHOULD be omitted from the JSON object representing the Claims; it SHOULD NOT be present with a null or empty string value. The sub (subject) Claim MUST always be returned in the UserInfo Response. Upon receipt of the UserInfo Request, the UserInfo Endpoint MUST return the JSON Serialization of the UserInfo Response as in Section 13.3 in the HTTP response body unless a different format was specified during Registration [OpenID.Registration]. If the UserInfo Response is signed and/or encrypted, then the Claims are returned in a JWT and the content-type MUST be application/jwt. The response MAY be encrypted without also being signed. If both signing and encryption are requested, the response MUST be signed then encrypted, with the result being a Nested JWT, as defined in [JWT]. If signed, the UserInfo Response SHOULD contain the Claims iss (issuer) and aud (audience) as members. The iss value SHOULD be the OP's Issuer Identifier URL. The aud value SHOULD be or include the RP's Client ID value. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: Claims as a dict OR JWT/JWS/JWE as a string Method is used by: UserInfoEndpoint Nr r r r r �get_userinfo_claims s z$RequestValidator.get_userinfo_claimsN)�__name__� __module__� __qualname__r r r r r r r r r r r r r r r r s '+r )�__doc__ZloggingZ)oauthlib.oauth2.rfc6749.request_validatorr ZOAuth2RequestValidatorZ getLoggerr �logr r r r �<module> s openid/connect/core/__pycache__/tokens.cpython-39.opt-1.pyc 0000644 00000003177 15125174063 0017522 0 ustar 00 a \��`< � @ s, d Z ddlmZmZmZ G dd� de�ZdS )z� authlib.openid.connect.core.tokens ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module contains methods for adding JWT tokens to requests. � )� TokenBase�random_token_generator�get_token_from_headerc @ s4 e Zd ZdZd dd�Zd dd�Zdd � Zd d � ZdS )�JWTToken)�request_validator�token_generator�refresh_token_generator� expires_inNc C s* || _ |p t| _|p| j| _|p"d| _d S )Ni )r r r r r )�selfr r r r � r �G/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/tokens.py�__init__ s �zJWTToken.__init__Fc C s2 t | j�r| �|�}n| j}||_| j�dd|�S )z2Create a JWT Token, using requestvalidator method.N)�callabler r Zget_jwt_bearer_token)r �requestZ refresh_tokenr r r r � create_token s zJWTToken.create_tokenc C s t |�}| j�||j|�S )N)r r Zvalidate_jwt_bearer_tokenZscopes�r r �tokenr r r �validate_request% s �zJWTToken.validate_requestc C s, t |�}|r(|�d�r(|�d�dv r(dS dS )NZey�.)� � � r )r � startswith�countr r r r � estimate_type* s zJWTToken.estimate_type)NNNN)F)�__name__� __module__� __qualname__� __slots__r r r r r r r r r s � r N)�__doc__Z oauthlib.oauth2.rfc6749.tokensr r r r r r r r �<module> s openid/connect/core/__pycache__/exceptions.cpython-39.opt-1.pyc 0000644 00000013504 15125174063 0020373 0 ustar 00 a \��`� � @ s� d Z ddlmZmZ G dd� de�ZG dd� de�ZG dd� de�ZG d d � d e�ZG d d � d e�ZG d d� de�Z G dd� de�Z G dd� de�Z G dd� de�Z G dd� de�Z G dd� de�ZG dd� de�ZG dd � d e�Zd d d �Zd S )!z� oauthlib.oauth2.rfc6749.errors ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Error used both by OAuth 2 clients and providers to represent the spec defined error responses for all four core grant types. � )�FatalClientError� OAuth2Errorc @ s e Zd ZdS )�FatalOpenIDClientErrorN��__name__� __module__� __qualname__� r r �K/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/exceptions.pyr s r c @ s e Zd ZdS )�OpenIDClientErrorNr r r r r r s r c @ s e Zd ZdZdZdZdS )�InteractionRequireda, The Authorization Server requires End-User interaction to proceed. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User interaction. Zinteraction_required� N�r r r �__doc__�error� status_coder r r r r s r c @ s e Zd ZdZdZdZdS )� LoginRequireda' The Authorization Server requires End-User authentication. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User authentication. Zlogin_requiredr Nr r r r r r s r c @ s e Zd ZdZdZdS )�AccountSelectionRequireda� The End-User is REQUIRED to select a session at the Authorization Server. The End-User MAY be authenticated at the Authorization Server with different associated accounts, but the End-User did not select a session. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface to prompt for a session to use. Zaccount_selection_requiredN)r r r r r r r r r r + s r c @ s e Zd ZdZdZdZdS )�ConsentRequireda The Authorization Server requires End-User consent. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User consent. Zconsent_requiredr Nr r r r r r 9 s r c @ s e Zd ZdZdZdZdS )�InvalidRequestURIze The request_uri in the Authorization Request returns an error or contains invalid data. Zinvalid_request_urizWThe request_uri in the Authorization Request returns an error or contains invalid data.N�r r r r r � descriptionr r r r r E s r c @ s e Zd ZdZdZdZdS )�InvalidRequestObjectzC The request parameter contains an invalid Request Object. Zinvalid_request_objectz9The request parameter contains an invalid Request Object.Nr r r r r r O s r c @ s e Zd ZdZdZdZdS )�RequestNotSupportedz? The OP does not support use of the request parameter. Zrequest_not_supportedz'The request parameter is not supported.Nr r r r r r W s r c @ s e Zd ZdZdZdZdS )�RequestURINotSupportedzC The OP does not support use of the request_uri parameter. Zrequest_uri_not_supportedz+The request_uri parameter is not supported.Nr r r r r r _ s r c @ s e Zd ZdZdZdZdS )�RegistrationNotSupportedzD The OP does not support use of the registration parameter. Zregistration_not_supportedz,The registration parameter is not supported.Nr r r r r r g s r c @ s e Zd ZdZdZdZdZdS )�InvalidTokenErrora The access token provided is expired, revoked, malformed, or invalid for other reasons. The resource SHOULD respond with the HTTP 401 (Unauthorized) status code. The client MAY request a new access token and retry the protected resource request. Z invalid_tokenr zWThe access token provided is expired, revoked, malformed, or invalid for other reasons.N�r r r r r r r r r r r r o s r c @ s e Zd ZdZdZdZdZdS )�InsufficientScopeErrora The request requires higher privileges than provided by the access token. The resource server SHOULD respond with the HTTP 403 (Forbidden) status code and MAY include the "scope" attribute with the scope necessary to access the protected resource. Zinsufficient_scopei� zIThe request requires higher privileges than provided by the access token.Nr r r r r r } s r Nc C sh dd l }dd l}|�d�|�d�|�d�d�}|�|jt |j�D ] \}}|j| krB|f i |���qBd S )Nr Zerror_descriptionZ error_uri�state)r Zurir )�inspect�sys�getZ getmembers�modulesr Zisclassr )r �paramsr r! �kwargs�_�clsr r r �raise_from_error� s � r( )N)r Z oauthlib.oauth2.rfc6749.errorsr r r r r r r r r r r r r r r r( r r r r �<module> s openid/connect/core/__pycache__/exceptions.cpython-39.pyc 0000644 00000013504 15125174063 0017434 0 ustar 00 a \��`� � @ s� d Z ddlmZmZ G dd� de�ZG dd� de�ZG dd� de�ZG d d � d e�ZG d d � d e�ZG d d� de�Z G dd� de�Z G dd� de�Z G dd� de�Z G dd� de�Z G dd� de�ZG dd� de�ZG dd � d e�Zd d d �Zd S )!z� oauthlib.oauth2.rfc6749.errors ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Error used both by OAuth 2 clients and providers to represent the spec defined error responses for all four core grant types. � )�FatalClientError� OAuth2Errorc @ s e Zd ZdS )�FatalOpenIDClientErrorN��__name__� __module__� __qualname__� r r �K/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/exceptions.pyr s r c @ s e Zd ZdS )�OpenIDClientErrorNr r r r r r s r c @ s e Zd ZdZdZdZdS )�InteractionRequireda, The Authorization Server requires End-User interaction to proceed. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User interaction. Zinteraction_required� N�r r r �__doc__�error� status_coder r r r r s r c @ s e Zd ZdZdZdZdS )� LoginRequireda' The Authorization Server requires End-User authentication. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User authentication. Zlogin_requiredr Nr r r r r r s r c @ s e Zd ZdZdZdS )�AccountSelectionRequireda� The End-User is REQUIRED to select a session at the Authorization Server. The End-User MAY be authenticated at the Authorization Server with different associated accounts, but the End-User did not select a session. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface to prompt for a session to use. Zaccount_selection_requiredN)r r r r r r r r r r + s r c @ s e Zd ZdZdZdZdS )�ConsentRequireda The Authorization Server requires End-User consent. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User consent. Zconsent_requiredr Nr r r r r r 9 s r c @ s e Zd ZdZdZdZdS )�InvalidRequestURIze The request_uri in the Authorization Request returns an error or contains invalid data. Zinvalid_request_urizWThe request_uri in the Authorization Request returns an error or contains invalid data.N�r r r r r � descriptionr r r r r E s r c @ s e Zd ZdZdZdZdS )�InvalidRequestObjectzC The request parameter contains an invalid Request Object. Zinvalid_request_objectz9The request parameter contains an invalid Request Object.Nr r r r r r O s r c @ s e Zd ZdZdZdZdS )�RequestNotSupportedz? The OP does not support use of the request parameter. Zrequest_not_supportedz'The request parameter is not supported.Nr r r r r r W s r c @ s e Zd ZdZdZdZdS )�RequestURINotSupportedzC The OP does not support use of the request_uri parameter. Zrequest_uri_not_supportedz+The request_uri parameter is not supported.Nr r r r r r _ s r c @ s e Zd ZdZdZdZdS )�RegistrationNotSupportedzD The OP does not support use of the registration parameter. Zregistration_not_supportedz,The registration parameter is not supported.Nr r r r r r g s r c @ s e Zd ZdZdZdZdZdS )�InvalidTokenErrora The access token provided is expired, revoked, malformed, or invalid for other reasons. The resource SHOULD respond with the HTTP 401 (Unauthorized) status code. The client MAY request a new access token and retry the protected resource request. Z invalid_tokenr zWThe access token provided is expired, revoked, malformed, or invalid for other reasons.N�r r r r r r r r r r r r o s r c @ s e Zd ZdZdZdZdZdS )�InsufficientScopeErrora The request requires higher privileges than provided by the access token. The resource server SHOULD respond with the HTTP 403 (Forbidden) status code and MAY include the "scope" attribute with the scope necessary to access the protected resource. Zinsufficient_scopei� zIThe request requires higher privileges than provided by the access token.Nr r r r r r } s r Nc C sh dd l }dd l}|�d�|�d�|�d�d�}|�|jt |j�D ] \}}|j| krB|f i |���qBd S )Nr Zerror_descriptionZ error_uri�state)r Zurir )�inspect�sys�getZ getmembers�modulesr Zisclassr )r �paramsr r! �kwargs�_�clsr r r �raise_from_error� s � r( )N)r Z oauthlib.oauth2.rfc6749.errorsr r r r r r r r r r r r r r r r( r r r r �<module> s openid/connect/core/__pycache__/tokens.cpython-39.pyc 0000644 00000003177 15125174063 0016563 0 ustar 00 a \��`< � @ s, d Z ddlmZmZmZ G dd� de�ZdS )z� authlib.openid.connect.core.tokens ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module contains methods for adding JWT tokens to requests. � )� TokenBase�random_token_generator�get_token_from_headerc @ s4 e Zd ZdZd dd�Zd dd�Zdd � Zd d � ZdS )�JWTToken)�request_validator�token_generator�refresh_token_generator� expires_inNc C s* || _ |p t| _|p| j| _|p"d| _d S )Ni )r r r r r )�selfr r r r � r �G/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/tokens.py�__init__ s �zJWTToken.__init__Fc C s2 t | j�r| �|�}n| j}||_| j�dd|�S )z2Create a JWT Token, using requestvalidator method.N)�callabler r Zget_jwt_bearer_token)r �requestZ refresh_tokenr r r r � create_token s zJWTToken.create_tokenc C s t |�}| j�||j|�S )N)r r Zvalidate_jwt_bearer_tokenZscopes�r r �tokenr r r �validate_request% s �zJWTToken.validate_requestc C s, t |�}|r(|�d�r(|�d�dv r(dS dS )NZey�.)� � � r )r � startswith�countr r r r � estimate_type* s zJWTToken.estimate_type)NNNN)F)�__name__� __module__� __qualname__� __slots__r r r r r r r r r s � r N)�__doc__Z oauthlib.oauth2.rfc6749.tokensr r r r r r r r �<module> s openid/connect/core/__pycache__/__init__.cpython-39.pyc 0000644 00000000244 15125174063 0017007 0 ustar 00 a \��` � @ s d S )N� r r r �I/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/__init__.py�<module> � openid/connect/core/endpoints/__pycache__/pre_configured.cpython-39.pyc 0000644 00000006740 15125174063 0022255 0 ustar 00 a \��`2 � @ s� d Z ddlmZmZmZmZmZ ddlmZ m Z m Z m Z mZ ddlmZ ddlmZmZm Z ddlmZmZmZ ddlmZ d d lmZ G d d � d eeeeee�Zd S )z� oauthlib.openid.connect.core.endpoints.pre_configured ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various endpoints needed for providing OpenID Connect servers. � )�AuthorizationEndpoint�IntrospectEndpoint�ResourceEndpoint�RevocationEndpoint� TokenEndpoint)�AuthorizationCodeGrant�ClientCredentialsGrant� ImplicitGrant�RefreshTokenGrant�%ResourceOwnerPasswordCredentialsGrant)� BearerToken� )r � HybridGrantr )� AuthorizationCodeGrantDispatcher�!AuthorizationTokenGrantDispatcher� ImplicitTokenGrantDispatcher)�JWTToken� )�UserInfoEndpointc @ s e Zd ZdZddd�ZdS )�Serverz<An all-in-one endpoint featuring all four major grant types.Nc O sF t |�| _t|�| _t|�| _t|�| _t|�| _ t |�| _ t |�| _ t|�| _t||||�| _t||||�| _t| j| j d�| _t| j| j d�| _tj| d| j| j| j | j | j| j| j| jd�| jd� t|| j| j d�| _t j| d| j| j| j| j d�| jd� t j| d| j| jd �d � t �| |� t �| |� t �| |� d S ) a� Construct a new all-grants-in-one server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. )Z default_grantZ oidc_grant�code)r �tokenZid_tokenzid_token tokenz code tokenz code id_tokenzcode id_token tokenZnone)Zdefault_response_typeZresponse_types�default_token_type�authorization_code)r �passwordZclient_credentialsZ refresh_token)Zdefault_grant_type� grant_typesr �Bearer)r ZJWT)Z default_tokenZ token_typesN)!� OAuth2AuthorizationCodeGrantZ auth_grant�OAuth2ImplicitGrantZimplicit_grantr Zpassword_grantr Zcredentials_grantr Z refresh_grantr Zopenid_connect_authr Zopenid_connect_implicitr Zopenid_connect_hybridr Zbearerr Zjwtr Zauth_grant_choicer Zimplicit_grant_choicer �__init__r Ztoken_grant_choicer r r r r )�selfZrequest_validatorZtoken_expires_inZtoken_generatorZrefresh_token_generator�args�kwargs� r# �Y/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/endpoints/pre_configured.pyr ! sZ � ��� � �� � zServer.__init__)NNN)�__name__� __module__� __qualname__�__doc__r r# r# r# r$ r s �r N) r( Z!oauthlib.oauth2.rfc6749.endpointsr r r r r Z#oauthlib.oauth2.rfc6749.grant_typesr r r r r r r Z oauthlib.oauth2.rfc6749.tokensr r r Zgrant_types.dispatchersr r r �tokensr �userinfor r r# r# r# r$ �<module> s � openid/connect/core/endpoints/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000000661 15125174063 0021754 0 ustar 00 a \��`� � @ s d Z ddlmZ ddlmZ dS )z� oauthlib.oopenid.core ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OpenID Connect � )�Server)�UserInfoEndpointN)�__doc__Zpre_configuredr �userinfor � r r �S/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/endpoints/__init__.py�<module> s openid/connect/core/endpoints/__pycache__/pre_configured.cpython-39.opt-1.pyc 0000644 00000006740 15125174063 0023214 0 ustar 00 a \��`2 � @ s� d Z ddlmZmZmZmZmZ ddlmZ m Z m Z m Z mZ ddlmZ ddlmZmZm Z ddlmZmZmZ ddlmZ d d lmZ G d d � d eeeeee�Zd S )z� oauthlib.openid.connect.core.endpoints.pre_configured ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various endpoints needed for providing OpenID Connect servers. � )�AuthorizationEndpoint�IntrospectEndpoint�ResourceEndpoint�RevocationEndpoint� TokenEndpoint)�AuthorizationCodeGrant�ClientCredentialsGrant� ImplicitGrant�RefreshTokenGrant�%ResourceOwnerPasswordCredentialsGrant)� BearerToken� )r � HybridGrantr )� AuthorizationCodeGrantDispatcher�!AuthorizationTokenGrantDispatcher� ImplicitTokenGrantDispatcher)�JWTToken� )�UserInfoEndpointc @ s e Zd ZdZddd�ZdS )�Serverz<An all-in-one endpoint featuring all four major grant types.Nc O sF t |�| _t|�| _t|�| _t|�| _t|�| _ t |�| _ t |�| _ t|�| _t||||�| _t||||�| _t| j| j d�| _t| j| j d�| _tj| d| j| j| j | j | j| j| j| jd�| jd� t|| j| j d�| _t j| d| j| j| j| j d�| jd� t j| d| j| jd �d � t �| |� t �| |� t �| |� d S ) a� Construct a new all-grants-in-one server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. )Z default_grantZ oidc_grant�code)r �tokenZid_tokenzid_token tokenz code tokenz code id_tokenzcode id_token tokenZnone)Zdefault_response_typeZresponse_types�default_token_type�authorization_code)r �passwordZclient_credentialsZ refresh_token)Zdefault_grant_type� grant_typesr �Bearer)r ZJWT)Z default_tokenZ token_typesN)!� OAuth2AuthorizationCodeGrantZ auth_grant�OAuth2ImplicitGrantZimplicit_grantr Zpassword_grantr Zcredentials_grantr Z refresh_grantr Zopenid_connect_authr Zopenid_connect_implicitr Zopenid_connect_hybridr Zbearerr Zjwtr Zauth_grant_choicer Zimplicit_grant_choicer �__init__r Ztoken_grant_choicer r r r r )�selfZrequest_validatorZtoken_expires_inZtoken_generatorZrefresh_token_generator�args�kwargs� r# �Y/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/endpoints/pre_configured.pyr ! sZ � ��� � �� � zServer.__init__)NNN)�__name__� __module__� __qualname__�__doc__r r# r# r# r$ r s �r N) r( Z!oauthlib.oauth2.rfc6749.endpointsr r r r r Z#oauthlib.oauth2.rfc6749.grant_typesr r r r r r r Z oauthlib.oauth2.rfc6749.tokensr r r Zgrant_types.dispatchersr r r �tokensr �userinfor r r# r# r# r$ �<module> s � openid/connect/core/endpoints/__pycache__/userinfo.cpython-39.opt-1.pyc 0000644 00000007414 15125174063 0022052 0 ustar 00 a \��` � @ sf d Z ddlZddlZddlmZ ddlmZ ddlmZm Z ddl m Z e� e �ZG dd� de�ZdS ) z� oauthlib.openid.connect.core.endpoints.userinfo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of userinfo endpoint. � N)�Request)�errors)� BaseEndpoint� catch_errors_and_unavailability)� BearerTokenc @ s. e Zd ZdZdd� Zed dd��Zdd � ZdS ) �UserInfoEndpointz,Authorizes access to userinfo resource. c C s$ t |d d d �| _|| _t�| � d S )N)r �bearer�request_validatorr �__init__)�selfr � r �S/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/endpoints/userinfo.pyr s zUserInfoEndpoint.__init__�GETNc C s� t ||||�}dg|_| �|� | j�|�}|du rLt�d|� tjdd��t |t �r�ddi}d|vr~t�d |� tjdd��t � |�}n0t |t �r�dd i}|}nt�d |� tjdd��t�d |� ||d fS )ap Validate BearerToken and return userinfo from RequestValidator The UserInfo Endpoint MUST return a content-type header to indicate which format is being returned. The content-type of the HTTP response MUST be application/json if the response body is a text JSON object; the response body SHOULD be encoded using UTF-8. �openidNz!Userinfo MUST have claims for %r.i� )Z status_codez Content-Typezapplication/json�subz Userinfo MUST have "sub" for %r.zapplication/jwtz(Userinfo return unknown response for %r.z Userinfo access valid for %r.�� )r �scopes�validate_userinfo_requestr Zget_userinfo_claims�log�errorr Z ServerError� isinstance�dict�json�dumps�str�debug)r ZuriZ http_method�bodyZheaders�requestZclaimsZ resp_headersr r r �create_userinfo_response s, � � z)UserInfoEndpoint.create_userinfo_responsec C s* | j �|�st�� �d|jvr&t�� �dS )a� Ensure the request is valid. 5.3.1. UserInfo Request The Client sends the UserInfo Request using either HTTP GET or HTTP POST. The Access Token obtained from an OpenID Connect Authentication Request MUST be sent as a Bearer Token, per Section 2 of OAuth 2.0 Bearer Token Usage [RFC6750]. It is RECOMMENDED that the request use the HTTP GET method and the Access Token be sent using the Authorization header field. The following is a non-normative example of a UserInfo Request: GET /userinfo HTTP/1.1 Host: server.example.com Authorization: Bearer SlAV32hkKG 5.3.3. UserInfo Error Response When an error condition occurs, the UserInfo Endpoint returns an Error Response as defined in Section 3 of OAuth 2.0 Bearer Token Usage [RFC6750]. (HTTP errors unrelated to RFC 6750 are returned to the User Agent using the appropriate HTTP status code.) The following is a non-normative example of a UserInfo Error Response: HTTP/1.1 401 Unauthorized WWW-Authenticate: Bearer error="invalid_token", error_description="The Access Token expired" r N)r Zvalidate_requestr ZInvalidTokenErrorr ZInsufficientScopeError)r r r r r r B s z*UserInfoEndpoint.validate_userinfo_request)r NN)�__name__� __module__� __qualname__�__doc__r r r r r r r r r s %r )r" r ZloggingZoauthlib.commonr Zoauthlib.oauth2.rfc6749r Z&oauthlib.oauth2.rfc6749.endpoints.baser r Z oauthlib.oauth2.rfc6749.tokensr Z getLoggerr r r r r r r �<module> s openid/connect/core/endpoints/__pycache__/__init__.cpython-39.pyc 0000644 00000000661 15125174063 0021015 0 ustar 00 a \��`� � @ s d Z ddlmZ ddlmZ dS )z� oauthlib.oopenid.core ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OpenID Connect � )�Server)�UserInfoEndpointN)�__doc__Zpre_configuredr �userinfor � r r �S/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/endpoints/__init__.py�<module> s openid/connect/core/endpoints/__pycache__/userinfo.cpython-39.pyc 0000644 00000007414 15125174063 0021113 0 ustar 00 a \��` � @ sf d Z ddlZddlZddlmZ ddlmZ ddlmZm Z ddl m Z e� e �ZG dd� de�ZdS ) z� oauthlib.openid.connect.core.endpoints.userinfo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of userinfo endpoint. � N)�Request)�errors)� BaseEndpoint� catch_errors_and_unavailability)� BearerTokenc @ s. e Zd ZdZdd� Zed dd��Zdd � ZdS ) �UserInfoEndpointz,Authorizes access to userinfo resource. c C s$ t |d d d �| _|| _t�| � d S )N)r �bearer�request_validatorr �__init__)�selfr � r �S/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/endpoints/userinfo.pyr s zUserInfoEndpoint.__init__�GETNc C s� t ||||�}dg|_| �|� | j�|�}|du rLt�d|� tjdd��t |t �r�ddi}d|vr~t�d |� tjdd��t � |�}n0t |t �r�dd i}|}nt�d |� tjdd��t�d |� ||d fS )ap Validate BearerToken and return userinfo from RequestValidator The UserInfo Endpoint MUST return a content-type header to indicate which format is being returned. The content-type of the HTTP response MUST be application/json if the response body is a text JSON object; the response body SHOULD be encoded using UTF-8. �openidNz!Userinfo MUST have claims for %r.i� )Z status_codez Content-Typezapplication/json�subz Userinfo MUST have "sub" for %r.zapplication/jwtz(Userinfo return unknown response for %r.z Userinfo access valid for %r.�� )r �scopes�validate_userinfo_requestr Zget_userinfo_claims�log�errorr Z ServerError� isinstance�dict�json�dumps�str�debug)r ZuriZ http_method�bodyZheaders�requestZclaimsZ resp_headersr r r �create_userinfo_response s, � � z)UserInfoEndpoint.create_userinfo_responsec C s* | j �|�st�� �d|jvr&t�� �dS )a� Ensure the request is valid. 5.3.1. UserInfo Request The Client sends the UserInfo Request using either HTTP GET or HTTP POST. The Access Token obtained from an OpenID Connect Authentication Request MUST be sent as a Bearer Token, per Section 2 of OAuth 2.0 Bearer Token Usage [RFC6750]. It is RECOMMENDED that the request use the HTTP GET method and the Access Token be sent using the Authorization header field. The following is a non-normative example of a UserInfo Request: GET /userinfo HTTP/1.1 Host: server.example.com Authorization: Bearer SlAV32hkKG 5.3.3. UserInfo Error Response When an error condition occurs, the UserInfo Endpoint returns an Error Response as defined in Section 3 of OAuth 2.0 Bearer Token Usage [RFC6750]. (HTTP errors unrelated to RFC 6750 are returned to the User Agent using the appropriate HTTP status code.) The following is a non-normative example of a UserInfo Error Response: HTTP/1.1 401 Unauthorized WWW-Authenticate: Bearer error="invalid_token", error_description="The Access Token expired" r N)r Zvalidate_requestr ZInvalidTokenErrorr ZInsufficientScopeError)r r r r r r B s z*UserInfoEndpoint.validate_userinfo_request)r NN)�__name__� __module__� __qualname__�__doc__r r r r r r r r r s %r )r" r ZloggingZoauthlib.commonr Zoauthlib.oauth2.rfc6749r Z&oauthlib.oauth2.rfc6749.endpoints.baser r Z oauthlib.oauth2.rfc6749.tokensr Z getLoggerr r r r r r r �<module> s openid/connect/core/endpoints/pre_configured.py 0000644 00000012462 15125174063 0015764 0 ustar 00 """ oauthlib.openid.connect.core.endpoints.pre_configured ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various endpoints needed for providing OpenID Connect servers. """ from oauthlib.oauth2.rfc6749.endpoints import ( AuthorizationEndpoint, IntrospectEndpoint, ResourceEndpoint, RevocationEndpoint, TokenEndpoint, ) from oauthlib.oauth2.rfc6749.grant_types import ( AuthorizationCodeGrant as OAuth2AuthorizationCodeGrant, ClientCredentialsGrant, ImplicitGrant as OAuth2ImplicitGrant, RefreshTokenGrant, ResourceOwnerPasswordCredentialsGrant, ) from oauthlib.oauth2.rfc6749.tokens import BearerToken from ..grant_types import AuthorizationCodeGrant, HybridGrant, ImplicitGrant from ..grant_types.dispatchers import ( AuthorizationCodeGrantDispatcher, AuthorizationTokenGrantDispatcher, ImplicitTokenGrantDispatcher, ) from ..tokens import JWTToken from .userinfo import UserInfoEndpoint class Server(AuthorizationEndpoint, IntrospectEndpoint, TokenEndpoint, ResourceEndpoint, RevocationEndpoint, UserInfoEndpoint): """An all-in-one endpoint featuring all four major grant types.""" def __init__(self, request_validator, token_expires_in=None, token_generator=None, refresh_token_generator=None, *args, **kwargs): """Construct a new all-grants-in-one server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. """ self.auth_grant = OAuth2AuthorizationCodeGrant(request_validator) self.implicit_grant = OAuth2ImplicitGrant(request_validator) self.password_grant = ResourceOwnerPasswordCredentialsGrant( request_validator) self.credentials_grant = ClientCredentialsGrant(request_validator) self.refresh_grant = RefreshTokenGrant(request_validator) self.openid_connect_auth = AuthorizationCodeGrant(request_validator) self.openid_connect_implicit = ImplicitGrant(request_validator) self.openid_connect_hybrid = HybridGrant(request_validator) self.bearer = BearerToken(request_validator, token_generator, token_expires_in, refresh_token_generator) self.jwt = JWTToken(request_validator, token_generator, token_expires_in, refresh_token_generator) self.auth_grant_choice = AuthorizationCodeGrantDispatcher(default_grant=self.auth_grant, oidc_grant=self.openid_connect_auth) self.implicit_grant_choice = ImplicitTokenGrantDispatcher(default_grant=self.implicit_grant, oidc_grant=self.openid_connect_implicit) # See http://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#Combinations for valid combinations # internally our AuthorizationEndpoint will ensure they can appear in any order for any valid combination AuthorizationEndpoint.__init__(self, default_response_type='code', response_types={ 'code': self.auth_grant_choice, 'token': self.implicit_grant_choice, 'id_token': self.openid_connect_implicit, 'id_token token': self.openid_connect_implicit, 'code token': self.openid_connect_hybrid, 'code id_token': self.openid_connect_hybrid, 'code id_token token': self.openid_connect_hybrid, 'none': self.auth_grant }, default_token_type=self.bearer) self.token_grant_choice = AuthorizationTokenGrantDispatcher(request_validator, default_grant=self.auth_grant, oidc_grant=self.openid_connect_auth) TokenEndpoint.__init__(self, default_grant_type='authorization_code', grant_types={ 'authorization_code': self.token_grant_choice, 'password': self.password_grant, 'client_credentials': self.credentials_grant, 'refresh_token': self.refresh_grant, }, default_token_type=self.bearer) ResourceEndpoint.__init__(self, default_token='Bearer', token_types={'Bearer': self.bearer, 'JWT': self.jwt}) RevocationEndpoint.__init__(self, request_validator) IntrospectEndpoint.__init__(self, request_validator) UserInfoEndpoint.__init__(self, request_validator) openid/connect/core/endpoints/userinfo.py 0000644 00000007407 15125174063 0014626 0 ustar 00 """ oauthlib.openid.connect.core.endpoints.userinfo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of userinfo endpoint. """ import json import logging from oauthlib.common import Request from oauthlib.oauth2.rfc6749 import errors from oauthlib.oauth2.rfc6749.endpoints.base import ( BaseEndpoint, catch_errors_and_unavailability, ) from oauthlib.oauth2.rfc6749.tokens import BearerToken log = logging.getLogger(__name__) class UserInfoEndpoint(BaseEndpoint): """Authorizes access to userinfo resource. """ def __init__(self, request_validator): self.bearer = BearerToken(request_validator, None, None, None) self.request_validator = request_validator BaseEndpoint.__init__(self) @catch_errors_and_unavailability def create_userinfo_response(self, uri, http_method='GET', body=None, headers=None): """Validate BearerToken and return userinfo from RequestValidator The UserInfo Endpoint MUST return a content-type header to indicate which format is being returned. The content-type of the HTTP response MUST be application/json if the response body is a text JSON object; the response body SHOULD be encoded using UTF-8. """ request = Request(uri, http_method, body, headers) request.scopes = ["openid"] self.validate_userinfo_request(request) claims = self.request_validator.get_userinfo_claims(request) if claims is None: log.error('Userinfo MUST have claims for %r.', request) raise errors.ServerError(status_code=500) if isinstance(claims, dict): resp_headers = { 'Content-Type': 'application/json' } if "sub" not in claims: log.error('Userinfo MUST have "sub" for %r.', request) raise errors.ServerError(status_code=500) body = json.dumps(claims) elif isinstance(claims, str): resp_headers = { 'Content-Type': 'application/jwt' } body = claims else: log.error('Userinfo return unknown response for %r.', request) raise errors.ServerError(status_code=500) log.debug('Userinfo access valid for %r.', request) return resp_headers, body, 200 def validate_userinfo_request(self, request): """Ensure the request is valid. 5.3.1. UserInfo Request The Client sends the UserInfo Request using either HTTP GET or HTTP POST. The Access Token obtained from an OpenID Connect Authentication Request MUST be sent as a Bearer Token, per Section 2 of OAuth 2.0 Bearer Token Usage [RFC6750]. It is RECOMMENDED that the request use the HTTP GET method and the Access Token be sent using the Authorization header field. The following is a non-normative example of a UserInfo Request: GET /userinfo HTTP/1.1 Host: server.example.com Authorization: Bearer SlAV32hkKG 5.3.3. UserInfo Error Response When an error condition occurs, the UserInfo Endpoint returns an Error Response as defined in Section 3 of OAuth 2.0 Bearer Token Usage [RFC6750]. (HTTP errors unrelated to RFC 6750 are returned to the User Agent using the appropriate HTTP status code.) The following is a non-normative example of a UserInfo Error Response: HTTP/1.1 401 Unauthorized WWW-Authenticate: Bearer error="invalid_token", error_description="The Access Token expired" """ if not self.bearer.validate_request(request): raise errors.InvalidTokenError() if "openid" not in request.scopes: raise errors.InsufficientScopeError() openid/connect/core/endpoints/__init__.py 0000644 00000000345 15125174063 0014525 0 ustar 00 """ oauthlib.oopenid.core ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OpenID Connect """ from .pre_configured import Server from .userinfo import UserInfoEndpoint openid/connect/core/grant_types/hybrid.py 0000644 00000005266 15125174063 0014612 0 ustar 00 """ oauthlib.openid.connect.core.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ """ import logging from oauthlib.oauth2.rfc6749.errors import InvalidRequestError from oauthlib.oauth2.rfc6749.grant_types.authorization_code import ( AuthorizationCodeGrant as OAuth2AuthorizationCodeGrant, ) from ..request_validator import RequestValidator from .base import GrantTypeBase log = logging.getLogger(__name__) class HybridGrant(GrantTypeBase): def __init__(self, request_validator=None, **kwargs): self.request_validator = request_validator or RequestValidator() self.proxy_target = OAuth2AuthorizationCodeGrant( request_validator=request_validator, **kwargs) # All hybrid response types should be fragment-encoded. self.proxy_target.default_response_mode = "fragment" self.register_response_type('code id_token') self.register_response_type('code token') self.register_response_type('code id_token token') self.custom_validators.post_auth.append( self.openid_authorization_validator) # Hybrid flows can return the id_token from the authorization # endpoint as part of the 'code' response self.register_code_modifier(self.add_token) self.register_code_modifier(self.add_id_token) self.register_token_modifier(self.add_id_token) def add_id_token(self, token, token_handler, request): return super().add_id_token(token, token_handler, request, nonce=request.nonce) def openid_authorization_validator(self, request): """Additional validation when following the Authorization Code flow. """ request_info = super().openid_authorization_validator(request) if not request_info: # returns immediately if OAuth2.0 return request_info # REQUIRED if the Response Type of the request is `code # id_token` or `code id_token token` and OPTIONAL when the # Response Type of the request is `code token`. It is a string # value used to associate a Client session with an ID Token, # and to mitigate replay attacks. The value is passed through # unmodified from the Authentication Request to the ID # Token. Sufficient entropy MUST be present in the `nonce` # values used to prevent attackers from guessing values. For # implementation notes, see Section 15.5.2. if request.response_type in ["code id_token", "code id_token token"]: if not request.nonce: raise InvalidRequestError( request=request, description='Request is missing mandatory nonce parameter.' ) return request_info openid/connect/core/grant_types/__pycache__/authorization_code.cpython-39.pyc 0000644 00000003150 15125174063 0023500 0 ustar 00 a \��`� � @ sB d Z ddlZddlmZ ddlmZ e�e�Z G dd� de�ZdS )zS oauthlib.openid.connect.core.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�AuthorizationCodeGrant� )� GrantTypeBasec s& e Zd Zddd�Z� fdd�Z� ZS )r Nc K s4 t f d|i|��| _| jj�| j� | �| j� d S )N�request_validator)� OAuth2AuthorizationCodeGrantZ proxy_targetZcustom_validatorsZ post_auth�appendZ openid_authorization_validatorZregister_token_modifier� add_id_token)�selfr �kwargs� r �_/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/grant_types/authorization_code.py�__init__ s ���z AuthorizationCodeGrant.__init__c s@ |j rd|j vr|S | j�|j|j|j|�}t� j||||d�S )z� Construct an initial version of id_token, and let the request_validator sign or encrypt it. The authorization_code version of this method is used to retrieve the nonce accordingly to the code storage. Zopenid)�nonce)Zscopesr Z get_authorization_code_nonceZ client_id�codeZ redirect_uri�superr )r �tokenZ token_handlerZrequestr �� __class__r r r s �z#AuthorizationCodeGrant.add_id_token)N)�__name__� __module__� __qualname__r r � __classcell__r r r r r s r ) �__doc__ZloggingZ6oauthlib.oauth2.rfc6749.grant_types.authorization_coder r �baser Z getLoggerr �logr r r r �<module> s openid/connect/core/grant_types/__pycache__/implicit.cpython-39.pyc 0000644 00000003333 15125174063 0021423 0 ustar 00 a \��`� � @ sN d Z ddlZddlmZ ddlmZ ddlmZ e� e �Z G dd� de�ZdS ) zS oauthlib.openid.connect.core.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�InvalidRequestError)� ImplicitGrant� )� GrantTypeBasec s2 e Zd Zddd�Z� fdd�Z� fdd�Z� ZS ) r Nc K sH t f d|i|��| _| �d� | �d� | jj�| j� | �| j� d S )N�request_validatorZid_tokenzid_token token) �OAuth2ImplicitGrantZ proxy_targetZregister_response_typeZcustom_validatorsZ post_auth�append� openid_authorization_validatorZregister_token_modifier� add_id_token)�selfr �kwargs� r �U/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/grant_types/implicit.py�__init__ s �� �zImplicitGrant.__init__c s. d|vr|j r|j |d< t� j||||jd�S )N�state)�nonce)r �superr r )r �tokenZ token_handler�request�� __class__r r r s zImplicitGrant.add_id_tokenc s* t � �|�}|s|S |js&t|dd��|S )z@Additional validation when following the implicit flow. z-Request is missing mandatory nonce parameter.)r � description)r r r r )r r Z request_infor r r r ! s �z,ImplicitGrant.openid_authorization_validator)N)�__name__� __module__� __qualname__r r r � __classcell__r r r r r s r ) �__doc__ZloggingZ oauthlib.oauth2.rfc6749.errorsr Z,oauthlib.oauth2.rfc6749.grant_types.implicitr r �baser Z getLoggerr �logr r r r �<module> s openid/connect/core/grant_types/__pycache__/base.cpython-39.opt-1.pyc 0000644 00000031242 15125174063 0021462 0 ustar 00 a \��`< � @ s` d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZm Z e� e �Z G dd� d�Z e ZdS )� N)�loads)�ConsentRequired�InvalidRequestError� LoginRequiredc sT e Zd Zdd� Z� fdd�Zdd� Zdd� Zejfd d �Z dd d �Z dd� Z � Z S )� GrantTypeBasec C s t | j|�S )N)�getattr� proxy_target)�self�attr� r �Q/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/grant_types/base.py� __getattr__ s zGrantTypeBase.__getattr__c s6 ddh}||v r t | j||� ntt| ��||� d S )NZ refresh_tokenZresponse_types)�setattrr �super�OpenIDConnectBase� __setattr__)r r �valueZ proxied_attrs�� __class__r r r s zGrantTypeBase.__setattr__c C s | j �|�S )z�Validates the OpenID Connect authorization request parameters. :returns: (list of scopes, dict of request info) )r � validate_authorization_request)r �requestr r r r s z,GrantTypeBase.validate_authorization_requestc C sX |j rTt|j t�sTzt|j �|_ W n0 tyR } ztddd��W Y d }~n d }~0 0 d S )NzMalformed claims parameterzDhttp://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter)� descriptionZuri)�claims� isinstance�dictr � Exceptionr )r r �exr r r �_inflate_claims% s �z GrantTypeBase._inflate_claimsc C s8 ||� � ��� }t|�d }t�|d|� ��� �d�S )aa Its value is the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the access_token value, where the hash algorithm used is the hash algorithm used in the alg Header Parameter of the ID Token's JOSE Header. For instance, if the alg is RS256, hash the access_token value with SHA-256, then take the left-most 128 bits and base64url-encode them. For instance, if the alg is HS512, hash the code value with SHA-512, then take the left-most 256 bits and base64url-encode them. The c_hash value is a case-sensitive string. Example of hash from OIDC specification (bound to a JWS using RS256): code: Qcb0Orv1zh30vL1MPRsbm-diHiMwcLyZvn1arpZv-Jxf_11jnpEX3Tgfvk c_hash: LDktKdoQak3Pk0cnXxCltA � N�=)�encode�digest�len�base64Zurlsafe_b64encode�decode�rstrip)r r Zhashfuncr! Z left_mostr r r � id_token_hash1 s zGrantTypeBase.id_token_hashNc C s� |j rd|j vr|S |jr(d|jvr(|S | j�|||�}|rH||d< |S i }|j|d< tt�� �|d< |durv||d< d|v r�| �|d �|d< d |v r�| �|d �|d < | j�||||�|d< |S ) a Construct an initial version of id_token, and let the request_validator sign or encrypt it. The initial version can contain the fields below, accordingly to the spec: - aud - iat - nonce - at_hash - c_hash �openid�id_tokenZaudZiatN�nonceZ access_tokenZat_hash�codeZc_hash) �scopesZ response_type�request_validatorZ get_id_tokenZ client_id�int�timer& Zfinalize_id_token)r �tokenZ token_handlerr r) r( r r r � add_id_tokenK s& zGrantTypeBase.add_id_tokenc C s� |j rd|j vri S |jr |jng }t|d�r:|�� �� }t|�}d|v r�t|�dkrfd}t||d��| j� |�s|t |d��| j� |�s�t |d��| � |� | j�|j|j |j|�s�d}t ||d��|j|j||jr�|j�� ng |j|j|jd �}|S ) a Perform OpenID Connect specific authorization request validation. nonce OPTIONAL. String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values display OPTIONAL. ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User. The defined values are: page - The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode. popup - The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over. touch - The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface. wap - The Authorization Server SHOULD display the authentication and consent UI consistent with a "feature phone" type display. The Authorization Server MAY also attempt to detect the capabilities of the User Agent and present an appropriate display. prompt OPTIONAL. Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. The defined values are: none - The Authorization Server MUST NOT display any authentication or consent user interface pages. An error is returned if an End-User is not already authenticated or the Client does not have pre-configured consent for the requested Claims or does not fulfill other conditions for processing the request. The error code will typically be login_required, interaction_required, or another code defined in Section 3.1.2.6. This can be used as a method to check for existing authentication and/or consent. login - The Authorization Server SHOULD prompt the End-User for reauthentication. If it cannot reauthenticate the End-User, it MUST return an error, typically login_required. consent - The Authorization Server SHOULD prompt the End-User for consent before returning information to the Client. If it cannot obtain consent, it MUST return an error, typically consent_required. select_account - The Authorization Server SHOULD prompt the End-User to select a user account. This enables an End-User who has multiple accounts at the Authorization Server to select amongst the multiple accounts that they might have current sessions for. If it cannot obtain an account selection choice made by the End-User, it MUST return an error, typically account_selection_required. The prompt parameter can be used by the Client to make sure that the End-User is still present for the current session or to bring attention to the request. If this parameter contains none with any other value, an error is returned. max_age OPTIONAL. Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. If the elapsed time is greater than this value, the OP MUST attempt to actively re-authenticate the End-User. (The max_age request parameter corresponds to the OpenID 2.0 PAPE [OpenID.PAPE] max_auth_age request parameter.) When max_age is used, the ID Token returned MUST include an auth_time Claim Value. ui_locales OPTIONAL. End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value "fr-CA fr en" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation). An error SHOULD NOT result if some or all of the requested locales are not supported by the OpenID Provider. id_token_hint OPTIONAL. ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response; otherwise, it SHOULD return an error, such as login_required. When possible, an id_token_hint SHOULD be present when prompt=none is used and an invalid_request error MAY be returned if it is not; however, the server SHOULD respond successfully when possible, even if it is not present. The Authorization Server need not be listed as an audience of the ID Token when it is used as an id_token_hint value. If the ID Token received by the RP from the OP is encrypted, to use it as an id_token_hint, the Client MUST decrypt the signed ID Token contained within the encrypted ID Token. The Client MAY re-encrypt the signed ID token to the Authentication Server using a key that enables the server to decrypt the ID Token, and use the re-encrypted ID token as the id_token_hint value. login_hint OPTIONAL. Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary). This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier) and then wants to pass that value as a hint to the discovered authorization service. It is RECOMMENDED that the hint value match the value used for discovery. This value MAY also be a phone number in the format specified for the phone_number Claim. The use of this parameter is left to the OP's discretion. acr_values OPTIONAL. Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference. The Authentication Context Class satisfied by the authentication performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a Voluntary Claim by this parameter. r' �splitZnone� z4Prompt none is mutually exclusive with other values.)r r )r z1Session user does not match client supplied user.)�displayr) �prompt� ui_locales� id_token_hint� login_hintr )r+ r4 �hasattr�stripr1 �setr" r r, Zvalidate_silent_loginr Z validate_silent_authorizationr r Zvalidate_user_matchr6 r r3 r) r5 r7 )r r r4 �msgZ request_infor r r � openid_authorization_validator� s< � � z,GrantTypeBase.openid_authorization_validator)N) �__name__� __module__� __qualname__r r r r �hashlibZsha256r& r0 r< � __classcell__r r r r r s Hr )r# r@ Zloggingr. Zjsonr Z oauthlib.oauth2.rfc6749.errorsr r r Z getLoggerr= �logr r r r r r �<module> s : openid/connect/core/grant_types/__pycache__/hybrid.cpython-39.opt-1.pyc 0000644 00000003732 15125174063 0022034 0 ustar 00 a \��`� � @ sZ d Z ddlZddlmZ ddlmZ ddlmZ ddl m Z e� e �Z G d d � d e �ZdS ) zS oauthlib.openid.connect.core.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�InvalidRequestError)�AuthorizationCodeGrant� )�RequestValidator� )� GrantTypeBasec s2 e Zd Zddd�Z� fdd�Z� fdd�Z� ZS ) � HybridGrantNc K s~ |pt � | _tf d|i|��| _d| j_| �d� | �d� | �d� | jj�| j � | � | j � | � | j � | � | j � d S )N�request_validator�fragment� code id_tokenz code token�code id_token token)r r � OAuth2AuthorizationCodeGrantZ proxy_targetZdefault_response_modeZregister_response_typeZcustom_validatorsZ post_auth�append� openid_authorization_validatorZregister_code_modifierZ add_token� add_id_tokenZregister_token_modifier)�selfr �kwargs� r �S/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/grant_types/hybrid.py�__init__ s �� � zHybridGrant.__init__c s t � j||||jd�S )N)�nonce)�superr r )r �tokenZ token_handler�request�� __class__r r r & s zHybridGrant.add_id_tokenc s4 t � �|�}|s|S |jdv r0|js0t|dd��|S )zJAdditional validation when following the Authorization Code flow. )r r z-Request is missing mandatory nonce parameter.)r � description)r r Z response_typer r )r r Z request_infor r r r ) s �z*HybridGrant.openid_authorization_validator)N)�__name__� __module__� __qualname__r r r � __classcell__r r r r r s r )�__doc__ZloggingZ oauthlib.oauth2.rfc6749.errorsr Z6oauthlib.oauth2.rfc6749.grant_types.authorization_coder r r r �baser Z getLoggerr �logr r r r r �<module> s openid/connect/core/grant_types/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000001156 15125174063 0022310 0 ustar 00 a \��`} � @ sL d Z ddlmZ ddlmZ ddlmZmZmZ ddl m Z ddl m Z dS )zS oauthlib.openid.connect.core.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � )�AuthorizationCodeGrant)� GrantTypeBase)� AuthorizationCodeGrantDispatcher�!AuthorizationTokenGrantDispatcher� ImplicitTokenGrantDispatcher)� HybridGrant)� ImplicitGrantN) �__doc__Zauthorization_coder �baser Z dispatchersr r r Zhybridr Zimplicitr � r r �U/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/grant_types/__init__.py�<module> s openid/connect/core/grant_types/__pycache__/dispatchers.cpython-39.pyc 0000644 00000010154 15125174063 0022121 0 ustar 00 a \��`� � @ sT d dl Z e �e�ZG dd� d�ZG dd� de�ZG dd� de�ZG dd � d e�ZdS ) � Nc @ s e Zd ZdZdZdS )� DispatcherN)�__name__� __module__� __qualname__� default_grant� oidc_grant� r r �X/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/grant_types/dispatchers.pyr s r c @ s2 e Zd ZdZd dd�Zdd� Zdd� Zd d � ZdS ) � AuthorizationCodeGrantDispatcherz� This is an adapter class that will route simple Authorization Code requests, those that have `response_type=code` and a scope including `openid` to either the `default_grant` or the `oidc_grant` based on the scopes requested. Nc C s || _ || _d S �N�r r ��selfr r r r r �__init__ s z)AuthorizationCodeGrantDispatcher.__init__c C s, | j }|jr d|jv r | j}t�d|� |S )N�openid�!Selecting handler for request %r.)r �scopesr �log�debug�r �request�handlerr r r �_handler_for_request s z5AuthorizationCodeGrantDispatcher._handler_for_requestc C s | � |��||�S �z/Read scope and route to the designated handler.�r � create_authorization_response�r r � token_handlerr r r r s z>AuthorizationCodeGrantDispatcher.create_authorization_responsec C s | � |��|�S r �r � validate_authorization_request�r r r r r r # s z?AuthorizationCodeGrantDispatcher.validate_authorization_request)NN�r r r �__doc__r r r r r r r r r s r c @ s2 e Zd ZdZd dd�Zdd� Zdd� Zd d � ZdS ) � ImplicitTokenGrantDispatcherz� This is an adapter class that will route simple Authorization requests, those that have `id_token` in `response_type` and a scope including `openid` to either the `default_grant` or the `oidc_grant` based on the scopes requested. Nc C s || _ || _d S r r r r r r r / s z%ImplicitTokenGrantDispatcher.__init__c C s6 | j }|jr&d|jv r&d|jv r&| j}t�d|� |S )Nr Zid_tokenr )r r Z response_typer r r r r r r r 3 s z1ImplicitTokenGrantDispatcher._handler_for_requestc C s | � |��||�S r r r r r r r < s z:ImplicitTokenGrantDispatcher.create_authorization_responsec C s | � |��|�S r r r r r r r @ s z;ImplicitTokenGrantDispatcher.validate_authorization_request)NNr! r r r r r# ( s r# c @ s* e Zd ZdZd dd�Zdd� Zdd� ZdS ) �!AuthorizationTokenGrantDispatcherz� This is an adapter class that will route simple Token requests, those that authorization_code have a scope including 'openid' to either the default_grant or the oidc_grant based on the scopes requested. Nc C s || _ || _|| _d S r )r r �request_validator)r r% r r r r r r J s z*AuthorizationTokenGrantDispatcher.__init__c C sl | j }d}t|j�}|�dd �}|�dd �}|�dd �}|rN| j�||||�}d|v r\| j}t�d|� |S )Nr � client_id�code� redirect_urir r ) r �dictZ decoded_body�getr% Z get_authorization_code_scopesr r r )r r r r � parametersr& r' r( r r r r O s z6AuthorizationTokenGrantDispatcher._handler_for_requestc C s | � |�}|�||�S r )r �create_token_response)r r r r r r r r, b s z7AuthorizationTokenGrantDispatcher.create_token_response)NN)r r r r" r r r, r r r r r$ E s r$ )ZloggingZ getLoggerr r r r r# r$ r r r r �<module> s openid/connect/core/grant_types/__pycache__/authorization_code.cpython-39.opt-1.pyc 0000644 00000003150 15125174063 0024437 0 ustar 00 a \��`� � @ sB d Z ddlZddlmZ ddlmZ e�e�Z G dd� de�ZdS )zS oauthlib.openid.connect.core.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�AuthorizationCodeGrant� )� GrantTypeBasec s& e Zd Zddd�Z� fdd�Z� ZS )r Nc K s4 t f d|i|��| _| jj�| j� | �| j� d S )N�request_validator)� OAuth2AuthorizationCodeGrantZ proxy_targetZcustom_validatorsZ post_auth�appendZ openid_authorization_validatorZregister_token_modifier� add_id_token)�selfr �kwargs� r �_/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/grant_types/authorization_code.py�__init__ s ���z AuthorizationCodeGrant.__init__c s@ |j rd|j vr|S | j�|j|j|j|�}t� j||||d�S )z� Construct an initial version of id_token, and let the request_validator sign or encrypt it. The authorization_code version of this method is used to retrieve the nonce accordingly to the code storage. Zopenid)�nonce)Zscopesr Z get_authorization_code_nonceZ client_id�codeZ redirect_uri�superr )r �tokenZ token_handlerZrequestr �� __class__r r r s �z#AuthorizationCodeGrant.add_id_token)N)�__name__� __module__� __qualname__r r � __classcell__r r r r r s r ) �__doc__ZloggingZ6oauthlib.oauth2.rfc6749.grant_types.authorization_coder r �baser Z getLoggerr �logr r r r �<module> s openid/connect/core/grant_types/__pycache__/hybrid.cpython-39.pyc 0000644 00000003732 15125174063 0021075 0 ustar 00 a \��`� � @ sZ d Z ddlZddlmZ ddlmZ ddlmZ ddl m Z e� e �Z G d d � d e �ZdS ) zS oauthlib.openid.connect.core.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�InvalidRequestError)�AuthorizationCodeGrant� )�RequestValidator� )� GrantTypeBasec s2 e Zd Zddd�Z� fdd�Z� fdd�Z� ZS ) � HybridGrantNc K s~ |pt � | _tf d|i|��| _d| j_| �d� | �d� | �d� | jj�| j � | � | j � | � | j � | � | j � d S )N�request_validator�fragment� code id_tokenz code token�code id_token token)r r � OAuth2AuthorizationCodeGrantZ proxy_targetZdefault_response_modeZregister_response_typeZcustom_validatorsZ post_auth�append� openid_authorization_validatorZregister_code_modifierZ add_token� add_id_tokenZregister_token_modifier)�selfr �kwargs� r �S/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/grant_types/hybrid.py�__init__ s �� � zHybridGrant.__init__c s t � j||||jd�S )N)�nonce)�superr r )r �tokenZ token_handler�request�� __class__r r r & s zHybridGrant.add_id_tokenc s4 t � �|�}|s|S |jdv r0|js0t|dd��|S )zJAdditional validation when following the Authorization Code flow. )r r z-Request is missing mandatory nonce parameter.)r � description)r r Z response_typer r )r r Z request_infor r r r ) s �z*HybridGrant.openid_authorization_validator)N)�__name__� __module__� __qualname__r r r � __classcell__r r r r r s r )�__doc__ZloggingZ oauthlib.oauth2.rfc6749.errorsr Z6oauthlib.oauth2.rfc6749.grant_types.authorization_coder r r r �baser Z getLoggerr �logr r r r r �<module> s openid/connect/core/grant_types/__pycache__/dispatchers.cpython-39.opt-1.pyc 0000644 00000010154 15125174063 0023060 0 ustar 00 a \��`� � @ sT d dl Z e �e�ZG dd� d�ZG dd� de�ZG dd� de�ZG dd � d e�ZdS ) � Nc @ s e Zd ZdZdZdS )� DispatcherN)�__name__� __module__� __qualname__� default_grant� oidc_grant� r r �X/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/grant_types/dispatchers.pyr s r c @ s2 e Zd ZdZd dd�Zdd� Zdd� Zd d � ZdS ) � AuthorizationCodeGrantDispatcherz� This is an adapter class that will route simple Authorization Code requests, those that have `response_type=code` and a scope including `openid` to either the `default_grant` or the `oidc_grant` based on the scopes requested. Nc C s || _ || _d S �N�r r ��selfr r r r r �__init__ s z)AuthorizationCodeGrantDispatcher.__init__c C s, | j }|jr d|jv r | j}t�d|� |S )N�openid�!Selecting handler for request %r.)r �scopesr �log�debug�r �request�handlerr r r �_handler_for_request s z5AuthorizationCodeGrantDispatcher._handler_for_requestc C s | � |��||�S �z/Read scope and route to the designated handler.�r � create_authorization_response�r r � token_handlerr r r r s z>AuthorizationCodeGrantDispatcher.create_authorization_responsec C s | � |��|�S r �r � validate_authorization_request�r r r r r r # s z?AuthorizationCodeGrantDispatcher.validate_authorization_request)NN�r r r �__doc__r r r r r r r r r s r c @ s2 e Zd ZdZd dd�Zdd� Zdd� Zd d � ZdS ) � ImplicitTokenGrantDispatcherz� This is an adapter class that will route simple Authorization requests, those that have `id_token` in `response_type` and a scope including `openid` to either the `default_grant` or the `oidc_grant` based on the scopes requested. Nc C s || _ || _d S r r r r r r r / s z%ImplicitTokenGrantDispatcher.__init__c C s6 | j }|jr&d|jv r&d|jv r&| j}t�d|� |S )Nr Zid_tokenr )r r Z response_typer r r r r r r r 3 s z1ImplicitTokenGrantDispatcher._handler_for_requestc C s | � |��||�S r r r r r r r < s z:ImplicitTokenGrantDispatcher.create_authorization_responsec C s | � |��|�S r r r r r r r @ s z;ImplicitTokenGrantDispatcher.validate_authorization_request)NNr! r r r r r# ( s r# c @ s* e Zd ZdZd dd�Zdd� Zdd� ZdS ) �!AuthorizationTokenGrantDispatcherz� This is an adapter class that will route simple Token requests, those that authorization_code have a scope including 'openid' to either the default_grant or the oidc_grant based on the scopes requested. Nc C s || _ || _|| _d S r )r r �request_validator)r r% r r r r r r J s z*AuthorizationTokenGrantDispatcher.__init__c C sl | j }d}t|j�}|�dd �}|�dd �}|�dd �}|rN| j�||||�}d|v r\| j}t�d|� |S )Nr � client_id�code� redirect_urir r ) r �dictZ decoded_body�getr% Z get_authorization_code_scopesr r r )r r r r � parametersr& r' r( r r r r O s z6AuthorizationTokenGrantDispatcher._handler_for_requestc C s | � |�}|�||�S r )r �create_token_response)r r r r r r r r, b s z7AuthorizationTokenGrantDispatcher.create_token_response)NN)r r r r" r r r, r r r r r$ E s r$ )ZloggingZ getLoggerr r r r r# r$ r r r r �<module> s openid/connect/core/grant_types/__pycache__/base.cpython-39.pyc 0000644 00000031242 15125174063 0020523 0 ustar 00 a \��`< � @ s` d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZm Z e� e �Z G dd� d�Z e ZdS )� N)�loads)�ConsentRequired�InvalidRequestError� LoginRequiredc sT e Zd Zdd� Z� fdd�Zdd� Zdd� Zejfd d �Z dd d �Z dd� Z � Z S )� GrantTypeBasec C s t | j|�S )N)�getattr� proxy_target)�self�attr� r �Q/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/grant_types/base.py� __getattr__ s zGrantTypeBase.__getattr__c s6 ddh}||v r t | j||� ntt| ��||� d S )NZ refresh_tokenZresponse_types)�setattrr �super�OpenIDConnectBase� __setattr__)r r �valueZ proxied_attrs�� __class__r r r s zGrantTypeBase.__setattr__c C s | j �|�S )z�Validates the OpenID Connect authorization request parameters. :returns: (list of scopes, dict of request info) )r � validate_authorization_request)r �requestr r r r s z,GrantTypeBase.validate_authorization_requestc C sX |j rTt|j t�sTzt|j �|_ W n0 tyR } ztddd��W Y d }~n d }~0 0 d S )NzMalformed claims parameterzDhttp://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter)� descriptionZuri)�claims� isinstance�dictr � Exceptionr )r r �exr r r �_inflate_claims% s �z GrantTypeBase._inflate_claimsc C s8 ||� � ��� }t|�d }t�|d|� ��� �d�S )aa Its value is the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the access_token value, where the hash algorithm used is the hash algorithm used in the alg Header Parameter of the ID Token's JOSE Header. For instance, if the alg is RS256, hash the access_token value with SHA-256, then take the left-most 128 bits and base64url-encode them. For instance, if the alg is HS512, hash the code value with SHA-512, then take the left-most 256 bits and base64url-encode them. The c_hash value is a case-sensitive string. Example of hash from OIDC specification (bound to a JWS using RS256): code: Qcb0Orv1zh30vL1MPRsbm-diHiMwcLyZvn1arpZv-Jxf_11jnpEX3Tgfvk c_hash: LDktKdoQak3Pk0cnXxCltA � N�=)�encode�digest�len�base64Zurlsafe_b64encode�decode�rstrip)r r Zhashfuncr! Z left_mostr r r � id_token_hash1 s zGrantTypeBase.id_token_hashNc C s� |j rd|j vr|S |jr(d|jvr(|S | j�|||�}|rH||d< |S i }|j|d< tt�� �|d< |durv||d< d|v r�| �|d �|d< d |v r�| �|d �|d < | j�||||�|d< |S ) a Construct an initial version of id_token, and let the request_validator sign or encrypt it. The initial version can contain the fields below, accordingly to the spec: - aud - iat - nonce - at_hash - c_hash �openid�id_tokenZaudZiatN�nonceZ access_tokenZat_hash�codeZc_hash) �scopesZ response_type�request_validatorZ get_id_tokenZ client_id�int�timer& Zfinalize_id_token)r �tokenZ token_handlerr r) r( r r r � add_id_tokenK s& zGrantTypeBase.add_id_tokenc C s� |j rd|j vri S |jr |jng }t|d�r:|�� �� }t|�}d|v r�t|�dkrfd}t||d��| j� |�s|t |d��| j� |�s�t |d��| � |� | j�|j|j |j|�s�d}t ||d��|j|j||jr�|j�� ng |j|j|jd �}|S ) a Perform OpenID Connect specific authorization request validation. nonce OPTIONAL. String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values display OPTIONAL. ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User. The defined values are: page - The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode. popup - The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over. touch - The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface. wap - The Authorization Server SHOULD display the authentication and consent UI consistent with a "feature phone" type display. The Authorization Server MAY also attempt to detect the capabilities of the User Agent and present an appropriate display. prompt OPTIONAL. Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. The defined values are: none - The Authorization Server MUST NOT display any authentication or consent user interface pages. An error is returned if an End-User is not already authenticated or the Client does not have pre-configured consent for the requested Claims or does not fulfill other conditions for processing the request. The error code will typically be login_required, interaction_required, or another code defined in Section 3.1.2.6. This can be used as a method to check for existing authentication and/or consent. login - The Authorization Server SHOULD prompt the End-User for reauthentication. If it cannot reauthenticate the End-User, it MUST return an error, typically login_required. consent - The Authorization Server SHOULD prompt the End-User for consent before returning information to the Client. If it cannot obtain consent, it MUST return an error, typically consent_required. select_account - The Authorization Server SHOULD prompt the End-User to select a user account. This enables an End-User who has multiple accounts at the Authorization Server to select amongst the multiple accounts that they might have current sessions for. If it cannot obtain an account selection choice made by the End-User, it MUST return an error, typically account_selection_required. The prompt parameter can be used by the Client to make sure that the End-User is still present for the current session or to bring attention to the request. If this parameter contains none with any other value, an error is returned. max_age OPTIONAL. Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. If the elapsed time is greater than this value, the OP MUST attempt to actively re-authenticate the End-User. (The max_age request parameter corresponds to the OpenID 2.0 PAPE [OpenID.PAPE] max_auth_age request parameter.) When max_age is used, the ID Token returned MUST include an auth_time Claim Value. ui_locales OPTIONAL. End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value "fr-CA fr en" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation). An error SHOULD NOT result if some or all of the requested locales are not supported by the OpenID Provider. id_token_hint OPTIONAL. ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response; otherwise, it SHOULD return an error, such as login_required. When possible, an id_token_hint SHOULD be present when prompt=none is used and an invalid_request error MAY be returned if it is not; however, the server SHOULD respond successfully when possible, even if it is not present. The Authorization Server need not be listed as an audience of the ID Token when it is used as an id_token_hint value. If the ID Token received by the RP from the OP is encrypted, to use it as an id_token_hint, the Client MUST decrypt the signed ID Token contained within the encrypted ID Token. The Client MAY re-encrypt the signed ID token to the Authentication Server using a key that enables the server to decrypt the ID Token, and use the re-encrypted ID token as the id_token_hint value. login_hint OPTIONAL. Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary). This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier) and then wants to pass that value as a hint to the discovered authorization service. It is RECOMMENDED that the hint value match the value used for discovery. This value MAY also be a phone number in the format specified for the phone_number Claim. The use of this parameter is left to the OP's discretion. acr_values OPTIONAL. Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference. The Authentication Context Class satisfied by the authentication performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a Voluntary Claim by this parameter. r' �splitZnone� z4Prompt none is mutually exclusive with other values.)r r )r z1Session user does not match client supplied user.)�displayr) �prompt� ui_locales� id_token_hint� login_hintr )r+ r4 �hasattr�stripr1 �setr" r r, Zvalidate_silent_loginr Z validate_silent_authorizationr r Zvalidate_user_matchr6 r r3 r) r5 r7 )r r r4 �msgZ request_infor r r � openid_authorization_validator� s< � � z,GrantTypeBase.openid_authorization_validator)N) �__name__� __module__� __qualname__r r r r �hashlibZsha256r& r0 r< � __classcell__r r r r r s Hr )r# r@ Zloggingr. Zjsonr Z oauthlib.oauth2.rfc6749.errorsr r r Z getLoggerr= �logr r r r r r �<module> s : openid/connect/core/grant_types/__pycache__/implicit.cpython-39.opt-1.pyc 0000644 00000003333 15125174063 0022362 0 ustar 00 a \��`� � @ sN d Z ddlZddlmZ ddlmZ ddlmZ e� e �Z G dd� de�ZdS ) zS oauthlib.openid.connect.core.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�InvalidRequestError)� ImplicitGrant� )� GrantTypeBasec s2 e Zd Zddd�Z� fdd�Z� fdd�Z� ZS ) r Nc K sH t f d|i|��| _| �d� | �d� | jj�| j� | �| j� d S )N�request_validatorZid_tokenzid_token token) �OAuth2ImplicitGrantZ proxy_targetZregister_response_typeZcustom_validatorsZ post_auth�append� openid_authorization_validatorZregister_token_modifier� add_id_token)�selfr �kwargs� r �U/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/grant_types/implicit.py�__init__ s �� �zImplicitGrant.__init__c s. d|vr|j r|j |d< t� j||||jd�S )N�state)�nonce)r �superr r )r �tokenZ token_handler�request�� __class__r r r s zImplicitGrant.add_id_tokenc s* t � �|�}|s|S |js&t|dd��|S )z@Additional validation when following the implicit flow. z-Request is missing mandatory nonce parameter.)r � description)r r r r )r r Z request_infor r r r ! s �z,ImplicitGrant.openid_authorization_validator)N)�__name__� __module__� __qualname__r r r � __classcell__r r r r r s r ) �__doc__ZloggingZ oauthlib.oauth2.rfc6749.errorsr Z,oauthlib.oauth2.rfc6749.grant_types.implicitr r �baser Z getLoggerr �logr r r r �<module> s openid/connect/core/grant_types/__pycache__/__init__.cpython-39.pyc 0000644 00000001156 15125174063 0021351 0 ustar 00 a \��`} � @ sL d Z ddlmZ ddlmZ ddlmZmZmZ ddl m Z ddl m Z dS )zS oauthlib.openid.connect.core.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � )�AuthorizationCodeGrant)� GrantTypeBase)� AuthorizationCodeGrantDispatcher�!AuthorizationTokenGrantDispatcher� ImplicitTokenGrantDispatcher)� HybridGrant)� ImplicitGrantN) �__doc__Zauthorization_coder �baser Z dispatchersr r r Zhybridr Zimplicitr � r r �U/usr/lib/python3.9/site-packages/oauthlib/openid/connect/core/grant_types/__init__.py�<module> s openid/connect/core/grant_types/authorization_code.py 0000644 00000002641 15125174063 0017215 0 ustar 00 """ oauthlib.openid.connect.core.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ """ import logging from oauthlib.oauth2.rfc6749.grant_types.authorization_code import ( AuthorizationCodeGrant as OAuth2AuthorizationCodeGrant, ) from .base import GrantTypeBase log = logging.getLogger(__name__) class AuthorizationCodeGrant(GrantTypeBase): def __init__(self, request_validator=None, **kwargs): self.proxy_target = OAuth2AuthorizationCodeGrant( request_validator=request_validator, **kwargs) self.custom_validators.post_auth.append( self.openid_authorization_validator) self.register_token_modifier(self.add_id_token) def add_id_token(self, token, token_handler, request): """ Construct an initial version of id_token, and let the request_validator sign or encrypt it. The authorization_code version of this method is used to retrieve the nonce accordingly to the code storage. """ # Treat it as normal OAuth 2 auth code request if openid is not present if not request.scopes or 'openid' not in request.scopes: return token nonce = self.request_validator.get_authorization_code_nonce( request.client_id, request.code, request.redirect_uri, request ) return super().add_id_token(token, token_handler, request, nonce=nonce) openid/connect/core/grant_types/base.py 0000644 00000036032 15125174063 0014236 0 ustar 00 import base64 import hashlib import logging import time from json import loads from oauthlib.oauth2.rfc6749.errors import ( ConsentRequired, InvalidRequestError, LoginRequired, ) log = logging.getLogger(__name__) class GrantTypeBase: # Just proxy the majority of method calls through to the # proxy_target grant type handler, which will usually be either # the standard OAuth2 AuthCode or Implicit grant types. def __getattr__(self, attr): return getattr(self.proxy_target, attr) def __setattr__(self, attr, value): proxied_attrs = {'refresh_token', 'response_types'} if attr in proxied_attrs: setattr(self.proxy_target, attr, value) else: super(OpenIDConnectBase, self).__setattr__(attr, value) def validate_authorization_request(self, request): """Validates the OpenID Connect authorization request parameters. :returns: (list of scopes, dict of request info) """ return self.proxy_target.validate_authorization_request(request) def _inflate_claims(self, request): # this may be called multiple times in a single request so make sure we only de-serialize the claims once if request.claims and not isinstance(request.claims, dict): # specific claims are requested during the Authorization Request and may be requested for inclusion # in either the id_token or the UserInfo endpoint response # see http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter try: request.claims = loads(request.claims) except Exception as ex: raise InvalidRequestError(description="Malformed claims parameter", uri="http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter") def id_token_hash(self, value, hashfunc=hashlib.sha256): """ Its value is the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the access_token value, where the hash algorithm used is the hash algorithm used in the alg Header Parameter of the ID Token's JOSE Header. For instance, if the alg is RS256, hash the access_token value with SHA-256, then take the left-most 128 bits and base64url-encode them. For instance, if the alg is HS512, hash the code value with SHA-512, then take the left-most 256 bits and base64url-encode them. The c_hash value is a case-sensitive string. Example of hash from OIDC specification (bound to a JWS using RS256): code: Qcb0Orv1zh30vL1MPRsbm-diHiMwcLyZvn1arpZv-Jxf_11jnpEX3Tgfvk c_hash: LDktKdoQak3Pk0cnXxCltA """ digest = hashfunc(value.encode()).digest() left_most = len(digest) // 2 return base64.urlsafe_b64encode(digest[:left_most]).decode().rstrip("=") def add_id_token(self, token, token_handler, request, nonce=None): """ Construct an initial version of id_token, and let the request_validator sign or encrypt it. The initial version can contain the fields below, accordingly to the spec: - aud - iat - nonce - at_hash - c_hash """ # Treat it as normal OAuth 2 auth code request if openid is not present if not request.scopes or 'openid' not in request.scopes: return token # Only add an id token on auth/token step if asked for. if request.response_type and 'id_token' not in request.response_type: return token # Implementation mint its own id_token without help. id_token = self.request_validator.get_id_token(token, token_handler, request) if id_token: token['id_token'] = id_token return token # Fallback for asking some help from oauthlib framework. # Start with technicals fields bound to the specification. id_token = {} id_token['aud'] = request.client_id id_token['iat'] = int(time.time()) # nonce is REQUIRED when response_type value is: # - id_token token (Implicit) # - id_token (Implicit) # - code id_token (Hybrid) # - code id_token token (Hybrid) # # nonce is OPTIONAL when response_type value is: # - code (Authorization Code) # - code token (Hybrid) if nonce is not None: id_token["nonce"] = nonce # at_hash is REQUIRED when response_type value is: # - id_token token (Implicit) # - code id_token token (Hybrid) # # at_hash is OPTIONAL when: # - code (Authorization code) # - code id_token (Hybrid) # - code token (Hybrid) # # at_hash MAY NOT be used when: # - id_token (Implicit) if "access_token" in token: id_token["at_hash"] = self.id_token_hash(token["access_token"]) # c_hash is REQUIRED when response_type value is: # - code id_token (Hybrid) # - code id_token token (Hybrid) # # c_hash is OPTIONAL for others. if "code" in token: id_token["c_hash"] = self.id_token_hash(token["code"]) # Call request_validator to complete/sign/encrypt id_token token['id_token'] = self.request_validator.finalize_id_token(id_token, token, token_handler, request) return token def openid_authorization_validator(self, request): """Perform OpenID Connect specific authorization request validation. nonce OPTIONAL. String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values display OPTIONAL. ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User. The defined values are: page - The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode. popup - The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over. touch - The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface. wap - The Authorization Server SHOULD display the authentication and consent UI consistent with a "feature phone" type display. The Authorization Server MAY also attempt to detect the capabilities of the User Agent and present an appropriate display. prompt OPTIONAL. Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. The defined values are: none - The Authorization Server MUST NOT display any authentication or consent user interface pages. An error is returned if an End-User is not already authenticated or the Client does not have pre-configured consent for the requested Claims or does not fulfill other conditions for processing the request. The error code will typically be login_required, interaction_required, or another code defined in Section 3.1.2.6. This can be used as a method to check for existing authentication and/or consent. login - The Authorization Server SHOULD prompt the End-User for reauthentication. If it cannot reauthenticate the End-User, it MUST return an error, typically login_required. consent - The Authorization Server SHOULD prompt the End-User for consent before returning information to the Client. If it cannot obtain consent, it MUST return an error, typically consent_required. select_account - The Authorization Server SHOULD prompt the End-User to select a user account. This enables an End-User who has multiple accounts at the Authorization Server to select amongst the multiple accounts that they might have current sessions for. If it cannot obtain an account selection choice made by the End-User, it MUST return an error, typically account_selection_required. The prompt parameter can be used by the Client to make sure that the End-User is still present for the current session or to bring attention to the request. If this parameter contains none with any other value, an error is returned. max_age OPTIONAL. Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. If the elapsed time is greater than this value, the OP MUST attempt to actively re-authenticate the End-User. (The max_age request parameter corresponds to the OpenID 2.0 PAPE [OpenID.PAPE] max_auth_age request parameter.) When max_age is used, the ID Token returned MUST include an auth_time Claim Value. ui_locales OPTIONAL. End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value "fr-CA fr en" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation). An error SHOULD NOT result if some or all of the requested locales are not supported by the OpenID Provider. id_token_hint OPTIONAL. ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response; otherwise, it SHOULD return an error, such as login_required. When possible, an id_token_hint SHOULD be present when prompt=none is used and an invalid_request error MAY be returned if it is not; however, the server SHOULD respond successfully when possible, even if it is not present. The Authorization Server need not be listed as an audience of the ID Token when it is used as an id_token_hint value. If the ID Token received by the RP from the OP is encrypted, to use it as an id_token_hint, the Client MUST decrypt the signed ID Token contained within the encrypted ID Token. The Client MAY re-encrypt the signed ID token to the Authentication Server using a key that enables the server to decrypt the ID Token, and use the re-encrypted ID token as the id_token_hint value. login_hint OPTIONAL. Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary). This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier) and then wants to pass that value as a hint to the discovered authorization service. It is RECOMMENDED that the hint value match the value used for discovery. This value MAY also be a phone number in the format specified for the phone_number Claim. The use of this parameter is left to the OP's discretion. acr_values OPTIONAL. Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference. The Authentication Context Class satisfied by the authentication performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a Voluntary Claim by this parameter. """ # Treat it as normal OAuth 2 auth code request if openid is not present if not request.scopes or 'openid' not in request.scopes: return {} prompt = request.prompt if request.prompt else [] if hasattr(prompt, 'split'): prompt = prompt.strip().split() prompt = set(prompt) if 'none' in prompt: if len(prompt) > 1: msg = "Prompt none is mutually exclusive with other values." raise InvalidRequestError(request=request, description=msg) if not self.request_validator.validate_silent_login(request): raise LoginRequired(request=request) if not self.request_validator.validate_silent_authorization(request): raise ConsentRequired(request=request) self._inflate_claims(request) if not self.request_validator.validate_user_match( request.id_token_hint, request.scopes, request.claims, request): msg = "Session user does not match client supplied user." raise LoginRequired(request=request, description=msg) request_info = { 'display': request.display, 'nonce': request.nonce, 'prompt': prompt, 'ui_locales': request.ui_locales.split() if request.ui_locales else [], 'id_token_hint': request.id_token_hint, 'login_hint': request.login_hint, 'claims': request.claims } return request_info OpenIDConnectBase = GrantTypeBase openid/connect/core/grant_types/implicit.py 0000644 00000003663 15125174063 0015142 0 ustar 00 """ oauthlib.openid.connect.core.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ """ import logging from oauthlib.oauth2.rfc6749.errors import InvalidRequestError from oauthlib.oauth2.rfc6749.grant_types.implicit import ( ImplicitGrant as OAuth2ImplicitGrant, ) from .base import GrantTypeBase log = logging.getLogger(__name__) class ImplicitGrant(GrantTypeBase): def __init__(self, request_validator=None, **kwargs): self.proxy_target = OAuth2ImplicitGrant( request_validator=request_validator, **kwargs) self.register_response_type('id_token') self.register_response_type('id_token token') self.custom_validators.post_auth.append( self.openid_authorization_validator) self.register_token_modifier(self.add_id_token) def add_id_token(self, token, token_handler, request): if 'state' not in token and request.state: token['state'] = request.state return super().add_id_token(token, token_handler, request, nonce=request.nonce) def openid_authorization_validator(self, request): """Additional validation when following the implicit flow. """ request_info = super().openid_authorization_validator(request) if not request_info: # returns immediately if OAuth2.0 return request_info # REQUIRED. String value used to associate a Client session with an ID # Token, and to mitigate replay attacks. The value is passed through # unmodified from the Authentication Request to the ID Token. # Sufficient entropy MUST be present in the nonce values used to # prevent attackers from guessing values. For implementation notes, see # Section 15.5.2. if not request.nonce: raise InvalidRequestError( request=request, description='Request is missing mandatory nonce parameter.' ) return request_info openid/connect/core/grant_types/dispatchers.py 0000644 00000007613 15125174063 0015640 0 ustar 00 import logging log = logging.getLogger(__name__) class Dispatcher: default_grant = None oidc_grant = None class AuthorizationCodeGrantDispatcher(Dispatcher): """ This is an adapter class that will route simple Authorization Code requests, those that have `response_type=code` and a scope including `openid` to either the `default_grant` or the `oidc_grant` based on the scopes requested. """ def __init__(self, default_grant=None, oidc_grant=None): self.default_grant = default_grant self.oidc_grant = oidc_grant def _handler_for_request(self, request): handler = self.default_grant if request.scopes and "openid" in request.scopes: handler = self.oidc_grant log.debug('Selecting handler for request %r.', handler) return handler def create_authorization_response(self, request, token_handler): """Read scope and route to the designated handler.""" return self._handler_for_request(request).create_authorization_response(request, token_handler) def validate_authorization_request(self, request): """Read scope and route to the designated handler.""" return self._handler_for_request(request).validate_authorization_request(request) class ImplicitTokenGrantDispatcher(Dispatcher): """ This is an adapter class that will route simple Authorization requests, those that have `id_token` in `response_type` and a scope including `openid` to either the `default_grant` or the `oidc_grant` based on the scopes requested. """ def __init__(self, default_grant=None, oidc_grant=None): self.default_grant = default_grant self.oidc_grant = oidc_grant def _handler_for_request(self, request): handler = self.default_grant if request.scopes and "openid" in request.scopes and 'id_token' in request.response_type: handler = self.oidc_grant log.debug('Selecting handler for request %r.', handler) return handler def create_authorization_response(self, request, token_handler): """Read scope and route to the designated handler.""" return self._handler_for_request(request).create_authorization_response(request, token_handler) def validate_authorization_request(self, request): """Read scope and route to the designated handler.""" return self._handler_for_request(request).validate_authorization_request(request) class AuthorizationTokenGrantDispatcher(Dispatcher): """ This is an adapter class that will route simple Token requests, those that authorization_code have a scope including 'openid' to either the default_grant or the oidc_grant based on the scopes requested. """ def __init__(self, request_validator, default_grant=None, oidc_grant=None): self.default_grant = default_grant self.oidc_grant = oidc_grant self.request_validator = request_validator def _handler_for_request(self, request): handler = self.default_grant scopes = () parameters = dict(request.decoded_body) client_id = parameters.get('client_id', None) code = parameters.get('code', None) redirect_uri = parameters.get('redirect_uri', None) # If code is not pressent fallback to `default_grant` which will # raise an error for the missing `code` in `create_token_response` step. if code: scopes = self.request_validator.get_authorization_code_scopes(client_id, code, redirect_uri, request) if 'openid' in scopes: handler = self.oidc_grant log.debug('Selecting handler for request %r.', handler) return handler def create_token_response(self, request, token_handler): """Read scope and route to the designated handler.""" handler = self._handler_for_request(request) return handler.create_token_response(request, token_handler) openid/connect/core/grant_types/__init__.py 0000644 00000000575 15125174063 0015066 0 ustar 00 """ oauthlib.openid.connect.core.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ """ from .authorization_code import AuthorizationCodeGrant from .base import GrantTypeBase from .dispatchers import ( AuthorizationCodeGrantDispatcher, AuthorizationTokenGrantDispatcher, ImplicitTokenGrantDispatcher, ) from .hybrid import HybridGrant from .implicit import ImplicitGrant openid/connect/core/request_validator.py 0000644 00000032210 15125174064 0014515 0 ustar 00 """ oauthlib.openid.connect.core.request_validator ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ """ import logging from oauthlib.oauth2.rfc6749.request_validator import ( RequestValidator as OAuth2RequestValidator, ) log = logging.getLogger(__name__) class RequestValidator(OAuth2RequestValidator): def get_authorization_code_scopes(self, client_id, code, redirect_uri, request): """ Extracts scopes from saved authorization code. The scopes returned by this method is used to route token requests based on scopes passed to Authorization Code requests. With that the token endpoint knows when to include OpenIDConnect id_token in token response only based on authorization code scopes. Only code param should be sufficient to retrieve grant code from any storage you are using, `client_id` and `redirect_uri` can have a blank value `""` don't forget to check it before using those values in a select query if a database is used. :param client_id: Unicode client identifier :param code: Unicode authorization code grant :param redirect_uri: Unicode absolute URI :return: A list of scope Method is used by: - Authorization Token Grant Dispatcher """ raise NotImplementedError('Subclasses must implement this method.') def get_authorization_code_nonce(self, client_id, code, redirect_uri, request): """ Extracts nonce from saved authorization code. If present in the Authentication Request, Authorization Servers MUST include a nonce Claim in the ID Token with the Claim Value being the nonce value sent in the Authentication Request. Authorization Servers SHOULD perform no other processing on nonce values used. The nonce value is a case-sensitive string. Only code param should be sufficient to retrieve grant code from any storage you are using. However, `client_id` and `redirect_uri` have been validated and can be used also. :param client_id: Unicode client identifier :param code: Unicode authorization code grant :param redirect_uri: Unicode absolute URI :return: Unicode nonce Method is used by: - Authorization Token Grant Dispatcher """ raise NotImplementedError('Subclasses must implement this method.') def get_jwt_bearer_token(self, token, token_handler, request): """Get JWT Bearer token or OpenID Connect ID token If using OpenID Connect this SHOULD call `oauthlib.oauth2.RequestValidator.get_id_token` :param token: A Bearer token dict :param token_handler: the token handler (BearerToken class) :param request: OAuthlib request. :type request: oauthlib.common.Request :return: The JWT Bearer token or OpenID Connect ID token (a JWS signed JWT) Method is used by JWT Bearer and OpenID Connect tokens: - JWTToken.create_token """ raise NotImplementedError('Subclasses must implement this method.') def get_id_token(self, token, token_handler, request): """Get OpenID Connect ID token This method is OPTIONAL and is NOT RECOMMENDED. `finalize_id_token` SHOULD be implemented instead. However, if you want a full control over the minting of the `id_token`, you MAY want to override `get_id_token` instead of using `finalize_id_token`. In the OpenID Connect workflows when an ID Token is requested this method is called. Subclasses should implement the construction, signing and optional encryption of the ID Token as described in the OpenID Connect spec. In addition to the standard OAuth2 request properties, the request may also contain these OIDC specific properties which are useful to this method: - nonce, if workflow is implicit or hybrid and it was provided - claims, if provided to the original Authorization Code request The token parameter is a dict which may contain an ``access_token`` entry, in which case the resulting ID Token *should* include a calculated ``at_hash`` claim. Similarly, when the request parameter has a ``code`` property defined, the ID Token *should* include a calculated ``c_hash`` claim. http://openid.net/specs/openid-connect-core-1_0.html (sections `3.1.3.6`_, `3.2.2.10`_, `3.3.2.11`_) .. _`3.1.3.6`: http://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken .. _`3.2.2.10`: http://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDToken .. _`3.3.2.11`: http://openid.net/specs/openid-connect-core-1_0.html#HybridIDToken :param token: A Bearer token dict :param token_handler: the token handler (BearerToken class) :param request: OAuthlib request. :type request: oauthlib.common.Request :return: The ID Token (a JWS signed JWT) """ return None def finalize_id_token(self, id_token, token, token_handler, request): """Finalize OpenID Connect ID token & Sign or Encrypt. In the OpenID Connect workflows when an ID Token is requested this method is called. Subclasses should implement the construction, signing and optional encryption of the ID Token as described in the OpenID Connect spec. The `id_token` parameter is a dict containing a couple of OIDC technical fields related to the specification. Prepopulated attributes are: - `aud`, equals to `request.client_id`. - `iat`, equals to current time. - `nonce`, if present, is equals to the `nonce` from the authorization request. - `at_hash`, hash of `access_token`, if relevant. - `c_hash`, hash of `code`, if relevant. This method MUST provide required fields as below: - `iss`, REQUIRED. Issuer Identifier for the Issuer of the response. - `sub`, REQUIRED. Subject Identifier - `exp`, REQUIRED. Expiration time on or after which the ID Token MUST NOT be accepted by the RP when performing authentication with the OP. Additionals claims must be added, note that `request.scope` should be used to determine the list of claims. More information can be found at `OpenID Connect Core#Claims`_ .. _`OpenID Connect Core#Claims`: https://openid.net/specs/openid-connect-core-1_0.html#Claims :param id_token: A dict containing technical fields of id_token :param token: A Bearer token dict :param token_handler: the token handler (BearerToken class) :param request: OAuthlib request. :type request: oauthlib.common.Request :return: The ID Token (a JWS signed JWT or JWE encrypted JWT) """ raise NotImplementedError('Subclasses must implement this method.') def validate_jwt_bearer_token(self, token, scopes, request): """Ensure the JWT Bearer token or OpenID Connect ID token are valids and authorized access to scopes. If using OpenID Connect this SHOULD call `oauthlib.oauth2.RequestValidator.get_id_token` If not using OpenID Connect this can `return None` to avoid 5xx rather 401/3 response. OpenID connect core 1.0 describe how to validate an id_token: - http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation - http://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDTValidation - http://openid.net/specs/openid-connect-core-1_0.html#HybridIDTValidation - http://openid.net/specs/openid-connect-core-1_0.html#HybridIDTValidation2 :param token: Unicode Bearer token :param scopes: List of scopes (defined by you) :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is indirectly used by all core OpenID connect JWT token issuing grant types: - Authorization Code Grant - Implicit Grant - Hybrid Grant """ raise NotImplementedError('Subclasses must implement this method.') def validate_id_token(self, token, scopes, request): """Ensure the id token is valid and authorized access to scopes. OpenID connect core 1.0 describe how to validate an id_token: - http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation - http://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDTValidation - http://openid.net/specs/openid-connect-core-1_0.html#HybridIDTValidation - http://openid.net/specs/openid-connect-core-1_0.html#HybridIDTValidation2 :param token: Unicode Bearer token :param scopes: List of scopes (defined by you) :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is indirectly used by all core OpenID connect JWT token issuing grant types: - Authorization Code Grant - Implicit Grant - Hybrid Grant """ raise NotImplementedError('Subclasses must implement this method.') def validate_silent_authorization(self, request): """Ensure the logged in user has authorized silent OpenID authorization. Silent OpenID authorization allows access tokens and id tokens to be granted to clients without any user prompt or interaction. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - OpenIDConnectAuthCode - OpenIDConnectImplicit - OpenIDConnectHybrid """ raise NotImplementedError('Subclasses must implement this method.') def validate_silent_login(self, request): """Ensure session user has authorized silent OpenID login. If no user is logged in or has not authorized silent login, this method should return False. If the user is logged in but associated with multiple accounts and not selected which one to link to the token then this method should raise an oauthlib.oauth2.AccountSelectionRequired error. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - OpenIDConnectAuthCode - OpenIDConnectImplicit - OpenIDConnectHybrid """ raise NotImplementedError('Subclasses must implement this method.') def validate_user_match(self, id_token_hint, scopes, claims, request): """Ensure client supplied user id hint matches session user. If the sub claim or id_token_hint is supplied then the session user must match the given ID. :param id_token_hint: User identifier string. :param scopes: List of OAuth 2 scopes and OpenID claims (strings). :param claims: OpenID Connect claims dict. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - OpenIDConnectAuthCode - OpenIDConnectImplicit - OpenIDConnectHybrid """ raise NotImplementedError('Subclasses must implement this method.') def get_userinfo_claims(self, request): """Return the UserInfo claims in JSON or Signed or Encrypted. The UserInfo Claims MUST be returned as the members of a JSON object unless a signed or encrypted response was requested during Client Registration. The Claims defined in Section 5.1 can be returned, as can additional Claims not specified there. For privacy reasons, OpenID Providers MAY elect to not return values for some requested Claims. If a Claim is not returned, that Claim Name SHOULD be omitted from the JSON object representing the Claims; it SHOULD NOT be present with a null or empty string value. The sub (subject) Claim MUST always be returned in the UserInfo Response. Upon receipt of the UserInfo Request, the UserInfo Endpoint MUST return the JSON Serialization of the UserInfo Response as in Section 13.3 in the HTTP response body unless a different format was specified during Registration [OpenID.Registration]. If the UserInfo Response is signed and/or encrypted, then the Claims are returned in a JWT and the content-type MUST be application/jwt. The response MAY be encrypted without also being signed. If both signing and encryption are requested, the response MUST be signed then encrypted, with the result being a Nested JWT, as defined in [JWT]. If signed, the UserInfo Response SHOULD contain the Claims iss (issuer) and aud (audience) as members. The iss value SHOULD be the OP's Issuer Identifier URL. The aud value SHOULD be or include the RP's Client ID value. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: Claims as a dict OR JWT/JWS/JWE as a string Method is used by: UserInfoEndpoint """ openid/connect/core/tokens.py 0000644 00000003074 15125174064 0012271 0 ustar 00 """ authlib.openid.connect.core.tokens ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module contains methods for adding JWT tokens to requests. """ from oauthlib.oauth2.rfc6749.tokens import TokenBase, random_token_generator, get_token_from_header class JWTToken(TokenBase): __slots__ = ( 'request_validator', 'token_generator', 'refresh_token_generator', 'expires_in' ) def __init__(self, request_validator=None, token_generator=None, expires_in=None, refresh_token_generator=None): self.request_validator = request_validator self.token_generator = token_generator or random_token_generator self.refresh_token_generator = ( refresh_token_generator or self.token_generator ) self.expires_in = expires_in or 3600 def create_token(self, request, refresh_token=False): """Create a JWT Token, using requestvalidator method.""" if callable(self.expires_in): expires_in = self.expires_in(request) else: expires_in = self.expires_in request.expires_in = expires_in return self.request_validator.get_jwt_bearer_token(None, None, request) def validate_request(self, request): token = get_token_from_header(request) return self.request_validator.validate_jwt_bearer_token( token, request.scopes, request) def estimate_type(self, request): token = get_token_from_header(request) if token and token.startswith('ey') and token.count('.') in (2, 4): return 10 return 0 openid/connect/core/__init__.py 0000644 00000000000 15125174064 0012507 0 ustar 00 openid/connect/__init__.py 0000644 00000000000 15125174064 0011557 0 ustar 00 openid/__init__.py 0000644 00000000242 15125174064 0010136 0 ustar 00 """ oauthlib.openid ~~~~~~~~~~~~~~ """ from .connect.core.endpoints import Server, UserInfoEndpoint from .connect.core.request_validator import RequestValidator oauth2/rfc6749/__pycache__/request_validator.cpython-39.opt-1.pyc 0000644 00000070403 15125174064 0020420 0 ustar 00 a \��`�l � @ s( d Z ddlZe�e�ZG dd� d�ZdS )zU oauthlib.oauth2.rfc6749.request_validator ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � Nc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z d7S )8�RequestValidatorc O s dS )a< Determine if client authentication is required for current request. According to the rfc6749, client authentication is required in the following cases: - Resource Owner Password Credentials Grant, when Client type is Confidential or when Client was issued client credentials or whenever Client provided client authentication, see `Section 4.3.2`_. - Authorization Code Grant, when Client type is Confidential or when Client was issued client credentials or whenever Client provided client authentication, see `Section 4.1.3`_. - Refresh Token Grant, when Client type is Confidential or when Client was issued client credentials or whenever Client provided client authentication, see `Section 6`_ :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Resource Owner Password Credentials Grant - Refresh Token Grant .. _`Section 4.3.2`: https://tools.ietf.org/html/rfc6749#section-4.3.2 .. _`Section 4.1.3`: https://tools.ietf.org/html/rfc6749#section-4.1.3 .. _`Section 6`: https://tools.ietf.org/html/rfc6749#section-6 T� ��self�request�args�kwargsr r �M/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/request_validator.py� client_authentication_required s z/RequestValidator.client_authentication_requiredc O s t d��dS )a� Authenticate client through means outside the OAuth 2 spec. Means of authentication is negotiated beforehand and may for example be `HTTP Basic Authentication Scheme`_ which utilizes the Authorization header. Headers may be accesses through request.headers and parameters found in both body and query can be obtained by direct attribute access, i.e. request.client_id for client_id in the URL query. The authentication process is required to contain the identification of the client (i.e. search the database based on the client_id). In case the client doesn't exist based on the received client_id, this method has to return False and the HTTP response created by the library will contain 'invalid_client' message. After the client identification succeeds, this method needs to set the client on the request, i.e. request.client = client. A client object's class must contain the 'client_id' attribute and the 'client_id' must have a value. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Resource Owner Password Credentials Grant (may be disabled) - Client Credentials Grant - Refresh Token Grant .. _`HTTP Basic Authentication Scheme`: https://tools.ietf.org/html/rfc1945#section-11.1 �&Subclasses must implement this method.N��NotImplementedErrorr r r r �authenticate_client) s "z$RequestValidator.authenticate_clientc O s t d��dS )a` Ensure client_id belong to a non-confidential client. A non-confidential client is one that is not required to authenticate through other means, such as using HTTP Basic. Note, while not strictly necessary it can often be very convenient to set request.client to the client object associated with the given client_id. :param client_id: Unicode client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant r Nr �r � client_idr r r r r r �authenticate_client_idM s z'RequestValidator.authenticate_client_idc O s t d��dS )a� Ensure that the authorization process represented by this authorization code began with this 'redirect_uri'. If the client specifies a redirect_uri when obtaining code then that redirect URI must be bound to the code and verified equal in this method, according to RFC 6749 section 4.1.3. Do not compare against the client's allowed redirect URIs, but against the URI used when the code was saved. :param client_id: Unicode client identifier. :param code: Unicode authorization_code. :param redirect_uri: Unicode absolute URI. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant (during token request) r Nr )r r �code� redirect_uri�clientr r r r r r �confirm_redirect_uria s z%RequestValidator.confirm_redirect_uric O s t d��dS )a\ Get the default redirect URI for the client. :param client_id: Unicode client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: The default redirect URI for the client Method is used by: - Authorization Code Grant - Implicit Grant r Nr r r r r �get_default_redirect_uriy s z)RequestValidator.get_default_redirect_uric O s t d��dS )a� Get the default scopes for the client. :param client_id: Unicode client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: List of default scopes Method is used by all core grant types: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant - Client Credentials grant r Nr r r r r �get_default_scopes� s z#RequestValidator.get_default_scopesc O s t d��dS )a/ Get the list of scopes associated with the refresh token. :param refresh_token: Unicode refresh token. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: List of scopes. Method is used by: - Refresh token grant r Nr )r � refresh_tokenr r r r r r �get_original_scopes� s z$RequestValidator.get_original_scopesc O s dS )aO Check if requested scopes are within a scope of the refresh token. When access tokens are refreshed the scope of the new token needs to be within the scope of the original token. This is ensured by checking that all requested scopes strings are on the list returned by the get_original_scopes. If this check fails, is_within_original_scope is called. The method can be used in situations where returning all valid scopes from the get_original_scopes is not practical. :param request_scopes: A list of scopes that were requested by client. :param refresh_token: Unicode refresh_token. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Refresh token grant Fr )r Zrequest_scopesr r r r r r r �is_within_original_scope� s z)RequestValidator.is_within_original_scopec O s t d��dS )a Introspect an access or refresh token. Called once the introspect request is validated. This method should verify the *token* and either return a dictionary with the list of claims associated, or `None` in case the token is unknown. Below the list of registered claims you should be interested in: - scope : space-separated list of scopes - client_id : client identifier - username : human-readable identifier for the resource owner - token_type : type of the token - exp : integer timestamp indicating when this token will expire - iat : integer timestamp indicating when this token was issued - nbf : integer timestamp indicating when it can be "not-before" used - sub : subject of the token - identifier of the resource owner - aud : list of string identifiers representing the intended audience - iss : string representing issuer of this token - jti : string identifier for the token Note that most of them are coming directly from JWT RFC. More details can be found in `Introspect Claims`_ or `_JWT Claims`_. The implementation can use *token_type_hint* to improve lookup efficency, but must fallback to other types to be compliant with RFC. The dict of claims is added to request.token after this method. :param token: The token string. :param token_type_hint: access_token or refresh_token. :param request: OAuthlib request. :type request: oauthlib.common.Request Method is used by: - Introspect Endpoint (all grants are compatible) .. _`Introspect Claims`: https://tools.ietf.org/html/rfc7662#section-2.2 .. _`JWT Claims`: https://tools.ietf.org/html/rfc7519#section-4 r Nr �r �tokenZtoken_type_hintr r r r r r �introspect_token� s 'z!RequestValidator.introspect_tokenc O s t d��dS )aH Invalidate an authorization code after use. :param client_id: Unicode client identifier. :param code: The authorization code grant (request.code). :param request: OAuthlib request. :type request: oauthlib.common.Request Method is used by: - Authorization Code Grant r Nr �r r r r r r r r r � invalidate_authorization_code� s z.RequestValidator.invalidate_authorization_codec O s t d��dS )a* Revoke an access or refresh token. :param token: The token string. :param token_type_hint: access_token or refresh_token. :param request: OAuthlib request. :type request: oauthlib.common.Request Method is used by: - Revocation Endpoint r Nr r r r r � revoke_token� s z RequestValidator.revoke_tokenc C s dS )a� Determine whether to rotate the refresh token. Default, yes. When access tokens are refreshed the old refresh token can be kept or replaced with a new one (rotated). Return True to rotate and and False for keeping original. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Refresh Token Grant Tr )r r r r r �rotate_refresh_token� s z%RequestValidator.rotate_refresh_tokenc O s t d��dS )ao Persist the authorization_code. The code should at minimum be stored with: - the client_id (``client_id``) - the redirect URI used (``request.redirect_uri``) - a resource owner / user (``request.user``) - the authorized scopes (``request.scopes``) To support PKCE, you MUST associate the code with: - Code Challenge (``request.code_challenge``) and - Code Challenge Method (``request.code_challenge_method``) To support OIDC, you MUST associate the code with: - nonce, if present (``code["nonce"]``) The ``code`` argument is actually a dictionary, containing at least a ``code`` key with the actual authorization code: ``{'code': 'sdf345jsdf0934f'}`` It may also have a ``claims`` parameter which, when present, will be a dict deserialized from JSON as described at http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter This value should be saved in this method and used again in ``.validate_code``. :param client_id: Unicode client identifier. :param code: A dict of the authorization code grant and, optionally, state. :param request: OAuthlib request. :type request: oauthlib.common.Request Method is used by: - Authorization Code Grant r Nr r r r r �save_authorization_code s "z(RequestValidator.save_authorization_codec O s | j ||g|�R i |��S )z�Persist the token with a token type specific method. Currently, only save_bearer_token is supported. :param token: A (Bearer) token dict. :param request: OAuthlib request. :type request: oauthlib.common.Request )�save_bearer_token�r r r r r r r r � save_token1 s zRequestValidator.save_tokenc O s t d��dS )a� Persist the Bearer token. The Bearer token should at minimum be associated with: - a client and it's client_id, if available - a resource owner / user (request.user) - authorized scopes (request.scopes) - an expiration time - a refresh token, if issued - a claims document, if present in request.claims The Bearer token dict may hold a number of items:: { 'token_type': 'Bearer', 'access_token': 'askfjh234as9sd8', 'expires_in': 3600, 'scope': 'string of space separated authorized scopes', 'refresh_token': '23sdf876234', # if issued 'state': 'given_by_client', # if supplied by client (implicit ONLY) } Note that while "scope" is a string-separated list of authorized scopes, the original list is still available in request.scopes. The token dict is passed as a reference so any changes made to the dictionary will go back to the user. If additional information must return to the client user, and it is only possible to get this information after writing the token to storage, it should be added to the token dictionary. If the token dictionary must be modified but the changes should not go back to the user, a copy of the dictionary must be made before making the changes. Also note that if an Authorization Code grant request included a valid claims parameter (for OpenID Connect) then the request.claims property will contain the claims dict, which should be saved for later use when generating the id_token and/or UserInfo response content. :param token: A Bearer token dict. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: The default redirect URI for the client Method is used by all core grant types issuing Bearer tokens: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant (might not associate a client) - Client Credentials grant r Nr r$ r r r r# < s 0z"RequestValidator.save_bearer_tokenc C s t d��dS )am Ensure the Bearer token is valid and authorized access to scopes. :param token: A string of random characters. :param scopes: A list of scopes associated with the protected resource. :param request: OAuthlib request. :type request: oauthlib.common.Request A key to OAuth 2 security and restricting impact of leaked tokens is the short expiration time of tokens, *always ensure the token has not expired!*. Two different approaches to scope validation: 1) all(scopes). The token must be authorized access to all scopes associated with the resource. For example, the token has access to ``read-only`` and ``images``, thus the client can view images but not upload new. Allows for fine grained access control through combining various scopes. 2) any(scopes). The token must be authorized access to one of the scopes associated with the resource. For example, token has access to ``read-only-images``. Allows for fine grained, although arguably less convenient, access control. A powerful way to use scopes would mimic UNIX ACLs and see a scope as a group with certain privileges. For a restful API these might map to HTTP verbs instead of read, write and execute. Note, the request.user attribute can be set to the resource owner associated with this token. Similarly the request.client and request.scopes attribute can be set to associated client object and authorized scopes. If you then use a decorator such as the one provided for django these attributes will be made available in all protected views as keyword arguments. :param token: Unicode Bearer token :param scopes: List of scopes (defined by you) :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is indirectly used by all core Bearer token issuing grant types: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant - Client Credentials Grant r Nr )r r �scopesr r r r �validate_bearer_tokenn s 2z&RequestValidator.validate_bearer_tokenc O s t d��dS )a� Ensure client_id belong to a valid and active client. Note, while not strictly necessary it can often be very convenient to set request.client to the client object associated with the given client_id. :param client_id: Unicode client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Implicit Grant r Nr r r r r �validate_client_id� s z#RequestValidator.validate_client_idc O s t d��dS )a� Verify that the authorization_code is valid and assigned to the given client. Before returning true, set the following based on the information stored with the code in 'save_authorization_code': - request.user - request.scopes - request.claims (if given) OBS! The request.user attribute should be set to the resource owner associated with this authorization code. Similarly request.scopes must also be set. The request.claims property, if it was given, should assigned a dict. If PKCE is enabled (see 'is_pkce_required' and 'save_authorization_code') you MUST set the following based on the information stored: - request.code_challenge - request.code_challenge_method :param client_id: Unicode client identifier. :param code: Unicode authorization code. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant r Nr )r r r r r r r r r r � validate_code� s z RequestValidator.validate_codec O s t d��dS )aW Ensure client is authorized to use the grant_type requested. :param client_id: Unicode client identifier. :param grant_type: Unicode grant type, i.e. authorization_code, password. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Resource Owner Password Credentials Grant - Client Credentials Grant - Refresh Token Grant r Nr )r r Z grant_typer r r r r r r �validate_grant_type� s z$RequestValidator.validate_grant_typec O s t d��dS )a, Ensure client is authorized to redirect to the redirect_uri requested. All clients should register the absolute URIs of all URIs they intend to redirect to. The registration is outside of the scope of oauthlib. :param client_id: Unicode client identifier. :param redirect_uri: Unicode absolute URI. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Implicit Grant r Nr )r r r r r r r r r �validate_redirect_uri� s z&RequestValidator.validate_redirect_uric O s t d��dS )a� Ensure the Bearer token is valid and authorized access to scopes. OBS! The request.user attribute should be set to the resource owner associated with this refresh token. :param refresh_token: Unicode refresh token. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant (indirectly by issuing refresh tokens) - Resource Owner Password Credentials Grant (also indirectly) - Refresh Token Grant r Nr )r r r r r r r r r �validate_refresh_token� s z'RequestValidator.validate_refresh_tokenc O s t d��dS )a� Ensure client is authorized to use the response_type requested. :param client_id: Unicode client identifier. :param response_type: Unicode response type, i.e. code, token. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Implicit Grant r Nr )r r Z response_typer r r r r r r �validate_response_type s z'RequestValidator.validate_response_typec O s t d��dS )aL Ensure the client is authorized access to requested scopes. :param client_id: Unicode client identifier. :param scopes: List of scopes (defined by you). :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by all core grant types: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant - Client Credentials Grant r Nr )r r r& r r r r r r r �validate_scopes s z RequestValidator.validate_scopesc O s t d��dS )a� Ensure the username and password is valid. OBS! The validation should also set the user attribute of the request to a valid resource owner, i.e. request.user = username or similar. If not set you will be unable to associate a token with a user in the persistance method used (commonly, save_bearer_token). :param username: Unicode username. :param password: Unicode password. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Resource Owner Password Credentials Grant r Nr )r �username�passwordr r r r r r r � validate_user. s z RequestValidator.validate_userc C s dS )a� Determine if current request requires PKCE. Default, False. This is called for both "authorization" and "token" requests. Override this method by ``return True`` to enable PKCE for everyone. You might want to enable it only for public clients. Note that PKCE can also be used in addition of a client authentication. OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. This specification describes the attack as well as a technique to mitigate against the threat through the use of Proof Key for Code Exchange (PKCE, pronounced "pixy"). See `RFC7636`_. :param client_id: Client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant .. _`RFC7636`: https://tools.ietf.org/html/rfc7636 Fr )r r r r r r �is_pkce_requiredB s z!RequestValidator.is_pkce_requiredc C s dS )a/ Is called for every "token" requests. When the server issues the authorization code in the authorization response, it MUST associate the ``code_challenge`` and ``code_challenge_method`` values with the authorization code so it can be verified later. Typically, the ``code_challenge`` and ``code_challenge_method`` values are stored in encrypted form in the ``code`` itself but could alternatively be stored on the server associated with the code. The server MUST NOT include the ``code_challenge`` value in client requests in a form that other entities can extract. Return the ``code_challenge`` associated to the code. If ``None`` is returned, code is considered to not be associated to any challenges. :param code: Authorization code. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: code_challenge string Method is used by: - Authorization Code Grant - when PKCE is active Nr �r r r r r r �get_code_challenge\ s z#RequestValidator.get_code_challengec C s t d��dS )aK Is called during the "token" request processing, when a ``code_verifier`` and a ``code_challenge`` has been provided. See ``.get_code_challenge``. Must return ``plain`` or ``S256``. You can return a custom value if you have implemented your own ``AuthorizationCodeGrant`` class. :param code: Authorization code. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: code_challenge_method string Method is used by: - Authorization Code Grant - when PKCE is active r Nr r3 r r r �get_code_challenge_methody s z*RequestValidator.get_code_challenge_methodN) �__name__� __module__� __qualname__r r r r r r r r r r r r! r" r% r# r' r( r) r* r+ r, r- r. r1 r2 r4 r5 r r r r r s6 $ ) $ 24! r )�__doc__ZloggingZ getLoggerr6 �logr r r r r �<module> s oauth2/rfc6749/__pycache__/parameters.cpython-39.opt-1.pyc 0000644 00000037137 15125174064 0017035 0 ustar 00 a \��`F � @ s� d Z ddlZddlZddlZddlmZ ddlmZm Z ddl m Z ddl m Z mZmZmZmZmZ ddlmZ ddlmZmZmZ dd d �Zdd d�Zd dd�Zd dd�Z d dd�Z d dd�Z dd� Z dS ) z� oauthlib.oauth2.rfc6749.parameters ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module contains methods related to `Section 4`_ of the OAuth 2 RFC. .. _`Section 4`: https://tools.ietf.org/html/rfc6749#section-4 � N)�add_params_to_qs�add_params_to_uri)� scope_changed� )�InsecureTransportError�MismatchingStateError�MissingCodeError�MissingTokenError�MissingTokenTypeError�raise_from_error)� OAuth2Token)�is_secure_transport� list_to_scope� scope_to_listc K s� t | �st� �d|fd|fg}|r0|�d|f� |rF|�dt|�f� |rX|�d|f� |D ]"}|| r\|�t|�|| f� q\t| |�S )ap Prepare the authorization grant request URI. The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the ``application/x-www-form-urlencoded`` format as defined by [`W3C.REC-html401-19991224`_]: :param uri: :param client_id: The client identifier as described in `Section 2.2`_. :param response_type: To indicate which OAuth 2 grant/flow is required, "code" and "token". :param redirect_uri: The client provided URI to redirect back to after authorization as described in `Section 3.1.2`_. :param scope: The scope of the access request as described by `Section 3.3`_. :param state: An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. :param kwargs: Extra arguments to embed in the grant/authorization URL. An example of an authorization code grant authorization URL: .. code-block:: http GET /authorize?response_type=code&client_id=s6BhdRkqt3&state=xyz &redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb HTTP/1.1 Host: server.example.com .. _`W3C.REC-html401-19991224`: https://tools.ietf.org/html/rfc6749#ref-W3C.REC-html401-19991224 .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 � response_type� client_id� redirect_uri�scope�state)r r �appendr �strr ) �urir r r r r �kwargs�params�k� r �F/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/parameters.py�prepare_grant_uri s '�r � Tc K s� d| fg}d|v r"t |d �|d< |�dd�}|rH|durH|�d|f� |�dd�}|durj|�d|f� |D ]"}|| rn|�t|�|| f� qnt||�S )a� Prepare the access token request. The client makes a request to the token endpoint by adding the following parameters using the ``application/x-www-form-urlencoded`` format in the HTTP request entity-body: :param grant_type: To indicate grant type being used, i.e. "password", "authorization_code" or "client_credentials". :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra parameters. Default ''. :param include_client_id: `True` (default) to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. :type include_client_id: Boolean :param client_id: Unicode client identifier. Will only appear if `include_client_id` is True. * :param client_secret: Unicode client secret. Will only appear if set to a value that is not `None`. Invoking this function with an empty string will send an empty `client_secret` value to the server. * :param code: If using authorization_code grant, pass the previously obtained authorization code as the ``code`` argument. * :param redirect_uri: If the "redirect_uri" parameter was included in the authorization request as described in `Section 4.1.1`_, and their values MUST be identical. * :param kwargs: Extra arguments to embed in the request body. Parameters marked with a `*` above are not explicit arguments in the function signature, but are specially documented arguments for items appearing in the generic `**kwargs` keyworded input. An example of an authorization code token request body: .. code-block:: http grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA &redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb .. _`Section 4.1.1`: https://tools.ietf.org/html/rfc6749#section-4.1.1 � grant_typer r N� client_secret)r �popr r r )r �bodyZinclude_client_idr r r r r r r r �prepare_token_requestT s 2 r# � access_tokenc K s� t | �st� �d|fg}|r*|�d|f� |D ]"}|| r.|�t|�|| f� q.ddi}|r||�d|f� t| |�||fS | |t||�fS dS )ad Prepare a token revocation request. The client constructs the request by including the following parameters using the ``application/x-www-form-urlencoded`` format in the HTTP request entity-body: :param token: REQUIRED. The token that the client wants to get revoked. :param token_type_hint: OPTIONAL. A hint about the type of the token submitted for revocation. Clients MAY pass this parameter in order to help the authorization server to optimize the token lookup. If the server is unable to locate the token using the given hint, it MUST extend its search across all of its supported token types. An authorization server MAY ignore this parameter, particularly if it is able to detect the token type automatically. This specification defines two values for `token_type_hint`: * access_token: An access token as defined in [RFC6749], `Section 1.4`_ * refresh_token: A refresh token as defined in [RFC6749], `Section 1.5`_ Specific implementations, profiles, and extensions of this specification MAY define other values for this parameter using the registry defined in `Section 4.1.2`_. .. _`Section 1.4`: https://tools.ietf.org/html/rfc6749#section-1.4 .. _`Section 1.5`: https://tools.ietf.org/html/rfc6749#section-1.5 .. _`Section 4.1.2`: https://tools.ietf.org/html/rfc7009#section-4.1.2 �token�token_type_hintz Content-Typez!application/x-www-form-urlencoded�callbackN)r r r r r r ) �urlr% r& r' r" r r r Zheadersr r r � prepare_token_revocation_request� s % r) c C sn t | �st� �t�| �j}tt�|��}|rB|�dd�|krBt� �d|v rZt|�d�|� d|vrjt d��|S )aZ Parse authorization grant response URI into a dict. If the resource owner grants the access request, the authorization server issues an authorization code and delivers it to the client by adding the following parameters to the query component of the redirection URI using the ``application/x-www-form-urlencoded`` format: **code** REQUIRED. The authorization code generated by the authorization server. The authorization code MUST expire shortly after it is issued to mitigate the risk of leaks. A maximum authorization code lifetime of 10 minutes is RECOMMENDED. The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code. The authorization code is bound to the client identifier and redirection URI. **state** REQUIRED if the "state" parameter was present in the client authorization request. The exact value received from the client. :param uri: The full redirect URL back to the client. :param state: The state parameter from the authorization request. For example, the authorization server redirects the user-agent by sending the following HTTP response: .. code-block:: http HTTP/1.1 302 Found Location: https://client.example.com/cb?code=SplxlOBeZQQYbYS6WxSbIA &state=xyz r N�error�codez#Missing code parameter in response.) r r �urlparse�query�dict� parse_qsl�getr r r )r r r- r r r r �!parse_authorization_code_response� s & r1 c C s� t | �st� �t�| �j}ttj|dd��}dD ] }||v r0t|| �||< q0d|v rft|d �|d< d|v r�t�� t|d � |d< |r�|� dd�|kr�t d ��t ||d �}t |� |S ) a� Parse the implicit token response URI into a dict. If the resource owner grants the access request, the authorization server issues an access token and delivers it to the client by adding the following parameters to the fragment component of the redirection URI using the ``application/x-www-form-urlencoded`` format: **access_token** REQUIRED. The access token issued by the authorization server. **token_type** REQUIRED. The type of the token issued as described in Section 7.1. Value is case insensitive. **expires_in** RECOMMENDED. The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. **scope** OPTIONAL, if identical to the scope requested by the client, otherwise REQUIRED. The scope of the access token as described by Section 3.3. **state** REQUIRED if the "state" parameter was present in the client authorization request. The exact value received from the client. :param uri: :param state: :param scope: Similar to the authorization code response, but with a full token provided in the URL fragment: .. code-block:: http HTTP/1.1 302 Found Location: http://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA &state=xyz&token_type=example&expires_in=3600 T)�keep_blank_values�� expires_inr r4 � expires_atr Nz'Mismatching or missing state in params.�� old_scope) r r r, �fragmentr. r/ �intr �timer0 � ValueErrorr �validate_token_parameters)r r r r8 r �keyr r r �parse_implicit_response s - r> c C s� zt �| �}W nB tyP tt�| ��}dD ] }||v r.t|| �||< q.Y n0 d|v rjt|d �|d< d|v r�|d du r�|�d� nt � � t|d � |d< t ||d�}t |� |S )a� Parse the JSON token response body into a dict. The authorization server issues an access token and optional refresh token, and constructs the response by adding the following parameters to the entity body of the HTTP response with a 200 (OK) status code: access_token REQUIRED. The access token issued by the authorization server. token_type REQUIRED. The type of the token issued as described in `Section 7.1`_. Value is case insensitive. expires_in RECOMMENDED. The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. refresh_token OPTIONAL. The refresh token which can be used to obtain new access tokens using the same authorization grant as described in `Section 6`_. scope OPTIONAL, if identical to the scope requested by the client, otherwise REQUIRED. The scope of the access token as described by `Section 3.3`_. The parameters are included in the entity body of the HTTP response using the "application/json" media type as defined by [`RFC4627`_]. The parameters are serialized into a JSON structure by adding each parameter at the highest structure level. Parameter names and string values are included as JSON strings. Numerical values are included as JSON numbers. The order of parameters does not matter and can vary. :param body: The full json encoded response body. :param scope: The scope requested during authorization. For example: .. code-block:: http HTTP/1.1 200 OK Content-Type: application/json Cache-Control: no-store Pragma: no-cache { "access_token":"2YotnFZFEjr1zCsicMWpAA", "token_type":"example", "expires_in":3600, "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA", "example_parameter":"example_value" } .. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1 .. _`Section 6`: https://tools.ietf.org/html/rfc6749#section-6 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`RFC4627`: https://tools.ietf.org/html/rfc4627 r3 r r4 Nr5 r6 ) �json�loadsr; r. r, r/ r9 r r! r: r r< )r" r r r= r r r �parse_token_responseV s < rA c C s� d| v rt | �d�| � d| vr*tdd��d| vrDtj�d�rDt� �| jr�dj| j| j d�}tj || j | j d � tj�d d �s�t |�}| |_| j |_| j |_|�d S ) zCEnsures token presence, token type, expiration and scope in params.r* r$ z Missing access token parameter.)� description� token_typeZOAUTHLIB_STRICT_TOKEN_TYPEz*Scope has changed from "{old}" to "{new}".)�old�new)�messagerD rE ZOAUTHLIB_RELAX_TOKEN_SCOPEN)r r0 r �os�environr r �formatr7 r �sendZ old_scopesZscopes�Warningr% Z new_scope)r rF �wr r r r< � s$ �r< )NNN)r T)r$ Nr )N)NN)N) �__doc__r? rG r: � urllib.parse�parser, Zoauthlib.commonr r Zoauthlib.signalsr �errorsr r r r r r �tokensr Zutilsr r r r r# r) r1 r> rA r< r r r r �<module> s( � ; K � : 8 E W oauth2/rfc6749/__pycache__/errors.cpython-39.pyc 0000644 00000035520 15125174064 0015241 0 ustar 00 a \��`�2 � @ sJ d Z ddlZddlmZmZ G dd� de�ZG dd� de�ZG dd � d e�ZG d d � d e�Z G d d � d e�Z G dd� de�Z G dd� de�Z G dd� de�Z G dd� de �ZG dd� de�ZG dd� de�ZG dd� de�ZG d d � d e�ZG d d � d e�ZG d d!� d!e�ZG d"d#� d#e�ZG d$d%� d%e�ZG d&d'� d'e�ZG d(d)� d)e�ZG d*d+� d+e�ZG d,d-� d-e�ZG d.d/� d/e�ZG d0d1� d1e�Z G d2d3� d3e�Z G d4d5� d5e �Z G d6d7� d7e�Z G d8d9� d9e�Z G d:d;� d;e�Z!G d<d=� d=e�Z"G d>d?� d?e�Z#G d@dA� dAe�Z$G dBdC� dCe�Z%G dDdE� dEe�Z&G dFdG� dGe�Z'dJdHdI�Z(dS )Kz� oauthlib.oauth2.rfc6749.errors ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Error used both by OAuth 2 clients and providers to represent the spec defined error responses for all four core grant types. � N)�add_params_to_uri� urlencodec sb e Zd ZdZdZdZd� fdd� Zdd� Zedd � �Z ed d � �Z ed d � �Z edd� �Z � Z S )� OAuth2ErrorN� � c s� |dur|| _ d�| j| j �}|r2|dt|� 7 }t� �|� || _|| _|rT|| _|r�|j | _ |j | _ |j | _ |j | _ |j | _ |j| _|s�|j| _n$d| _ d| _ d| _ d| _ d| _ d| _dS )a0 :param description: A human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred. Values for the "error_description" parameter MUST NOT include characters outside the set x20-21 / x23-5B / x5D-7E. :param uri: A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error. Values for the "error_uri" parameter MUST conform to the URI- Reference syntax, and thus MUST NOT include characters outside the set x21 / x23-5B / x5D-7E. :param state: A CSRF protection value received from the client. :param status_code: :param request: OAuthlib request. :type request: oauthlib.common.Request Nz({}) {}� )� description�format�error�repr�super�__init__�uri�state� status_codeZ redirect_uriZ client_idZscopesZ response_type� response_modeZ grant_type)�selfr r r r Zrequest�message�� __class__� �B/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/errors.pyr s2 zOAuth2Error.__init__c C s | j dk}t|| j|�S )N�fragment)r r � twotuples)r r r r r r �in_uriI s zOAuth2Error.in_uric C sR d| j fg}| jr"|�d| jf� | jr8|�d| jf� | jrN|�d| jf� |S )Nr �error_description� error_urir )r r �appendr r )r r r r r r M s zOAuth2Error.twotuplesc C s t | j�S �N)r r �r r r r � urlencodedX s zOAuth2Error.urlencodedc C s t �t| j��S r )�json�dumps�dictr r r r r r! \ s zOAuth2Error.jsonc C s\ | j dkrXdd�| j�g}| jr2|�d�| j�� | jrJ|�d�| j�� dd�|�iS i S )N� ZBearerz error="{}"zerror_description="{}"zerror_uri="{}"zWWW-Authenticatez, )r r r r r r �join)r Z authvaluesr r r �headers` s �zOAuth2Error.headers)NNNNN)�__name__� __module__� __qualname__r r r r r �propertyr r r! r& � __classcell__r r r r r s �7 r c @ s e Zd ZdZdS )�TokenExpiredErrorZ token_expiredN�r' r( r) r r r r r r, v s r, c @ s e Zd ZdZdZdS )�InsecureTransportErrorZinsecure_transportzOAuth 2 MUST utilize https.N�r' r( r) r r r r r r r. z s r. c @ s e Zd ZdZdZdS )�MismatchingStateErrorZmismatching_statez6CSRF Warning! State not equal in request and response.Nr/ r r r r r0 s r0 c @ s e Zd ZdZdS )�MissingCodeErrorZ missing_codeNr- r r r r r1 � s r1 c @ s e Zd ZdZdS )�MissingTokenErrorZ missing_tokenNr- r r r r r2 � s r2 c @ s e Zd ZdZdS )�MissingTokenTypeErrorZmissing_token_typeNr- r r r r r3 � s r3 c @ s e Zd ZdZdS )�FatalClientErrora� Errors during authorization where user should not be redirected back. If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI. Instead the user should be informed of the error by the provider itself. N)r' r( r) �__doc__r r r r r4 � s r4 c @ s e Zd ZdZdZdS )�InvalidRequestFatalErrorz� For fatal errors, the request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. �invalid_requestN�r' r( r) r5 r r r r r r6 � s r6 c @ s e Zd ZdZdS )�InvalidRedirectURIErrorzInvalid redirect URI.N�r' r( r) r r r r r r9 � s r9 c @ s e Zd ZdZdS )�MissingRedirectURIErrorzMissing redirect URI.Nr: r r r r r; � s r; c @ s e Zd ZdZdS )�MismatchingRedirectURIErrorzMismatching redirect URI.Nr: r r r r r< � s r< c @ s e Zd ZdZdS )�InvalidClientIdErrorz"Invalid client_id parameter value.Nr: r r r r r= � s r= c @ s e Zd ZdZdS )�MissingClientIdErrorz Missing client_id parameter.Nr: r r r r r> � s r> c @ s e Zd ZdZdZdS )�InvalidRequestErrorz� The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. r7 Nr8 r r r r r? � s r? c @ s e Zd ZdZdS )�MissingResponseTypeErrorz Missing response_type parameter.Nr: r r r r r@ � s r@ c @ s e Zd ZdZdZdS )�MissingCodeChallengeErrora� If the server requires Proof Key for Code Exchange (PKCE) by OAuth public clients and the client does not send the "code_challenge" in the request, the authorization endpoint MUST return the authorization error response with the "error" value set to "invalid_request". The "error_description" or the response of "error_uri" SHOULD explain the nature of error, e.g., code challenge required. zCode challenge required.N�r' r( r) r5 r r r r r rA � s rA c @ s e Zd ZdZdZdS )�MissingCodeVerifierErrorzr The request to the token endpoint, when PKCE is enabled, has the parameter `code_verifier` REQUIRED. zCode verifier required.NrB r r r r rC � s rC c @ s e Zd ZdZdZdS )�AccessDeniedErrorzH The resource owner or authorization server denied the request. Z access_deniedNr8 r r r r rD � s rD c @ s e Zd ZdZdZdS )� UnsupportedResponseTypeErrorzj The authorization server does not support obtaining an authorization code using this method. Zunsupported_response_typeNr8 r r r r rE � s rE c @ s e Zd ZdZdZdS )�#UnsupportedCodeChallengeMethodErrorad If the server supporting PKCE does not support the requested transformation, the authorization endpoint MUST return the authorization error response with "error" value set to "invalid_request". The "error_description" or the response of "error_uri" SHOULD explain the nature of error, e.g., transform algorithm not supported. z"Transform algorithm not supported.NrB r r r r rF � s rF c @ s e Zd ZdZdZdS )�InvalidScopeErrorz� The requested scope is invalid, unknown, or malformed, or exceeds the scope granted by the resource owner. https://tools.ietf.org/html/rfc6749#section-5.2 Z invalid_scopeNr8 r r r r rG � s rG c @ s e Zd ZdZdZdS )� ServerErrora The authorization server encountered an unexpected condition that prevented it from fulfilling the request. (This error code is needed because a 500 Internal Server Error HTTP status code cannot be returned to the client via a HTTP redirect.) Z server_errorNr8 r r r r rH s rH c @ s e Zd ZdZdZdS )�TemporarilyUnavailableErrora The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server. (This error code is needed because a 503 Service Unavailable HTTP status code cannot be returned to the client via a HTTP redirect.) Ztemporarily_unavailableNr8 r r r r rI s rI c @ s e Zd ZdZdZdZdS )�InvalidClientErroraG Client authentication failed (e.g. unknown client, no client authentication included, or unsupported authentication method). The authorization server MAY return an HTTP 401 (Unauthorized) status code to indicate which HTTP authentication schemes are supported. If the client attempted to authenticate via the "Authorization" request header field, the authorization server MUST respond with an HTTP 401 (Unauthorized) status code, and include the "WWW-Authenticate" response header field matching the authentication scheme used by the client. Zinvalid_clientr$ N�r' r( r) r5 r r r r r r rJ s rJ c @ s e Zd ZdZdZdZdS )�InvalidGrantErrora7 The provided authorization grant (e.g. authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client. https://tools.ietf.org/html/rfc6749#section-5.2 Z invalid_grantr NrK r r r r rL & s rL c @ s e Zd ZdZdZdS )�UnauthorizedClientErrorz^ The authenticated client is not authorized to use this authorization grant type. Zunauthorized_clientNr8 r r r r rM 3 s rM c @ s e Zd ZdZdZdS )�UnsupportedGrantTypeErrorzX The authorization grant type is not supported by the authorization server. Zunsupported_grant_typeNr8 r r r r rN ; s rN c @ s e Zd ZdZdZdS )�UnsupportedTokenTypeErrorz� The authorization server does not support the hint of the presented token type. I.e. the client tried to revoke an access token on a server not supporting this feature. Zunsupported_token_typeNr8 r r r r rO C s rO c @ s e Zd ZdZdZdZdZdS )�InvalidTokenErrora The access token provided is expired, revoked, malformed, or invalid for other reasons. The resource SHOULD respond with the HTTP 401 (Unauthorized) status code. The client MAY request a new access token and retry the protected resource request. Z invalid_tokenr$ zWThe access token provided is expired, revoked, malformed, or invalid for other reasons.N�r' r( r) r5 r r r r r r r rP L s rP c @ s e Zd ZdZdZdZdZdS )�InsufficientScopeErrora The request requires higher privileges than provided by the access token. The resource server SHOULD respond with the HTTP 403 (Forbidden) status code and MAY include the "scope" attribute with the scope necessary to access the protected resource. Zinsufficient_scopei� zIThe request requires higher privileges than provided by the access token.NrQ r r r r rR Z s rR c @ s e Zd ZdZdZdS )�ConsentRequireda The Authorization Server requires End-User consent. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User consent. Zconsent_requiredNr8 r r r r rS h s rS c @ s e Zd ZdZdZdS )� LoginRequireda' The Authorization Server requires End-User authentication. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User authentication. Zlogin_requiredNr8 r r r r rT s s rT c s e Zd ZdZ� fdd�Z� ZS )�CustomOAuth2Errorz� This error is a placeholder for all custom errors not described by the RFC. Some of the popular OAuth2 providers are using custom errors. c s || _ t� j|i |�� d S r )r r r )r r �args�kwargsr r r r � s zCustomOAuth2Error.__init__)r' r( r) r5 r r+ r r r r rU ~ s rU c C sz dd l }dd l}|�d�|�d�|�d�d�}|�|jt |j�D ] \}}|j| krB|f i |���qBtf d| i|���d S )Nr r r r )r r r r ) �inspect�sys�getZ getmembers�modulesr' Zisclassr rU )r �paramsrX rY rW �_�clsr r r �raise_from_error� s � r_ )N))r5 r! Zoauthlib.commonr r � Exceptionr r, r. r0 r1 r2 r3 r4 r6 r9 r; r< r= r> r? r@ rA rC rD rE rF rG rH rI rJ rL rM rN rO rP rR rS rT rU r_ r r r r �<module> sJ i oauth2/rfc6749/__pycache__/errors.cpython-39.opt-1.pyc 0000644 00000035520 15125174064 0016200 0 ustar 00 a \��`�2 � @ sJ d Z ddlZddlmZmZ G dd� de�ZG dd� de�ZG dd � d e�ZG d d � d e�Z G d d � d e�Z G dd� de�Z G dd� de�Z G dd� de�Z G dd� de �ZG dd� de�ZG dd� de�ZG dd� de�ZG d d � d e�ZG d d � d e�ZG d d!� d!e�ZG d"d#� d#e�ZG d$d%� d%e�ZG d&d'� d'e�ZG d(d)� d)e�ZG d*d+� d+e�ZG d,d-� d-e�ZG d.d/� d/e�ZG d0d1� d1e�Z G d2d3� d3e�Z G d4d5� d5e �Z G d6d7� d7e�Z G d8d9� d9e�Z G d:d;� d;e�Z!G d<d=� d=e�Z"G d>d?� d?e�Z#G d@dA� dAe�Z$G dBdC� dCe�Z%G dDdE� dEe�Z&G dFdG� dGe�Z'dJdHdI�Z(dS )Kz� oauthlib.oauth2.rfc6749.errors ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Error used both by OAuth 2 clients and providers to represent the spec defined error responses for all four core grant types. � N)�add_params_to_uri� urlencodec sb e Zd ZdZdZdZd� fdd� Zdd� Zedd � �Z ed d � �Z ed d � �Z edd� �Z � Z S )� OAuth2ErrorN� � c s� |dur|| _ d�| j| j �}|r2|dt|� 7 }t� �|� || _|| _|rT|| _|r�|j | _ |j | _ |j | _ |j | _ |j | _ |j| _|s�|j| _n$d| _ d| _ d| _ d| _ d| _ d| _dS )a0 :param description: A human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred. Values for the "error_description" parameter MUST NOT include characters outside the set x20-21 / x23-5B / x5D-7E. :param uri: A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error. Values for the "error_uri" parameter MUST conform to the URI- Reference syntax, and thus MUST NOT include characters outside the set x21 / x23-5B / x5D-7E. :param state: A CSRF protection value received from the client. :param status_code: :param request: OAuthlib request. :type request: oauthlib.common.Request Nz({}) {}� )� description�format�error�repr�super�__init__�uri�state� status_codeZ redirect_uriZ client_idZscopesZ response_type� response_modeZ grant_type)�selfr r r r Zrequest�message�� __class__� �B/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/errors.pyr s2 zOAuth2Error.__init__c C s | j dk}t|| j|�S )N�fragment)r r � twotuples)r r r r r r �in_uriI s zOAuth2Error.in_uric C sR d| j fg}| jr"|�d| jf� | jr8|�d| jf� | jrN|�d| jf� |S )Nr �error_description� error_urir )r r �appendr r )r r r r r r M s zOAuth2Error.twotuplesc C s t | j�S �N)r r �r r r r � urlencodedX s zOAuth2Error.urlencodedc C s t �t| j��S r )�json�dumps�dictr r r r r r! \ s zOAuth2Error.jsonc C s\ | j dkrXdd�| j�g}| jr2|�d�| j�� | jrJ|�d�| j�� dd�|�iS i S )N� ZBearerz error="{}"zerror_description="{}"zerror_uri="{}"zWWW-Authenticatez, )r r r r r r �join)r Z authvaluesr r r �headers` s �zOAuth2Error.headers)NNNNN)�__name__� __module__� __qualname__r r r r r �propertyr r r! r& � __classcell__r r r r r s �7 r c @ s e Zd ZdZdS )�TokenExpiredErrorZ token_expiredN�r' r( r) r r r r r r, v s r, c @ s e Zd ZdZdZdS )�InsecureTransportErrorZinsecure_transportzOAuth 2 MUST utilize https.N�r' r( r) r r r r r r r. z s r. c @ s e Zd ZdZdZdS )�MismatchingStateErrorZmismatching_statez6CSRF Warning! State not equal in request and response.Nr/ r r r r r0 s r0 c @ s e Zd ZdZdS )�MissingCodeErrorZ missing_codeNr- r r r r r1 � s r1 c @ s e Zd ZdZdS )�MissingTokenErrorZ missing_tokenNr- r r r r r2 � s r2 c @ s e Zd ZdZdS )�MissingTokenTypeErrorZmissing_token_typeNr- r r r r r3 � s r3 c @ s e Zd ZdZdS )�FatalClientErrora� Errors during authorization where user should not be redirected back. If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI. Instead the user should be informed of the error by the provider itself. N)r' r( r) �__doc__r r r r r4 � s r4 c @ s e Zd ZdZdZdS )�InvalidRequestFatalErrorz� For fatal errors, the request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. �invalid_requestN�r' r( r) r5 r r r r r r6 � s r6 c @ s e Zd ZdZdS )�InvalidRedirectURIErrorzInvalid redirect URI.N�r' r( r) r r r r r r9 � s r9 c @ s e Zd ZdZdS )�MissingRedirectURIErrorzMissing redirect URI.Nr: r r r r r; � s r; c @ s e Zd ZdZdS )�MismatchingRedirectURIErrorzMismatching redirect URI.Nr: r r r r r< � s r< c @ s e Zd ZdZdS )�InvalidClientIdErrorz"Invalid client_id parameter value.Nr: r r r r r= � s r= c @ s e Zd ZdZdS )�MissingClientIdErrorz Missing client_id parameter.Nr: r r r r r> � s r> c @ s e Zd ZdZdZdS )�InvalidRequestErrorz� The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. r7 Nr8 r r r r r? � s r? c @ s e Zd ZdZdS )�MissingResponseTypeErrorz Missing response_type parameter.Nr: r r r r r@ � s r@ c @ s e Zd ZdZdZdS )�MissingCodeChallengeErrora� If the server requires Proof Key for Code Exchange (PKCE) by OAuth public clients and the client does not send the "code_challenge" in the request, the authorization endpoint MUST return the authorization error response with the "error" value set to "invalid_request". The "error_description" or the response of "error_uri" SHOULD explain the nature of error, e.g., code challenge required. zCode challenge required.N�r' r( r) r5 r r r r r rA � s rA c @ s e Zd ZdZdZdS )�MissingCodeVerifierErrorzr The request to the token endpoint, when PKCE is enabled, has the parameter `code_verifier` REQUIRED. zCode verifier required.NrB r r r r rC � s rC c @ s e Zd ZdZdZdS )�AccessDeniedErrorzH The resource owner or authorization server denied the request. Z access_deniedNr8 r r r r rD � s rD c @ s e Zd ZdZdZdS )� UnsupportedResponseTypeErrorzj The authorization server does not support obtaining an authorization code using this method. Zunsupported_response_typeNr8 r r r r rE � s rE c @ s e Zd ZdZdZdS )�#UnsupportedCodeChallengeMethodErrorad If the server supporting PKCE does not support the requested transformation, the authorization endpoint MUST return the authorization error response with "error" value set to "invalid_request". The "error_description" or the response of "error_uri" SHOULD explain the nature of error, e.g., transform algorithm not supported. z"Transform algorithm not supported.NrB r r r r rF � s rF c @ s e Zd ZdZdZdS )�InvalidScopeErrorz� The requested scope is invalid, unknown, or malformed, or exceeds the scope granted by the resource owner. https://tools.ietf.org/html/rfc6749#section-5.2 Z invalid_scopeNr8 r r r r rG � s rG c @ s e Zd ZdZdZdS )� ServerErrora The authorization server encountered an unexpected condition that prevented it from fulfilling the request. (This error code is needed because a 500 Internal Server Error HTTP status code cannot be returned to the client via a HTTP redirect.) Z server_errorNr8 r r r r rH s rH c @ s e Zd ZdZdZdS )�TemporarilyUnavailableErrora The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server. (This error code is needed because a 503 Service Unavailable HTTP status code cannot be returned to the client via a HTTP redirect.) Ztemporarily_unavailableNr8 r r r r rI s rI c @ s e Zd ZdZdZdZdS )�InvalidClientErroraG Client authentication failed (e.g. unknown client, no client authentication included, or unsupported authentication method). The authorization server MAY return an HTTP 401 (Unauthorized) status code to indicate which HTTP authentication schemes are supported. If the client attempted to authenticate via the "Authorization" request header field, the authorization server MUST respond with an HTTP 401 (Unauthorized) status code, and include the "WWW-Authenticate" response header field matching the authentication scheme used by the client. Zinvalid_clientr$ N�r' r( r) r5 r r r r r r rJ s rJ c @ s e Zd ZdZdZdZdS )�InvalidGrantErrora7 The provided authorization grant (e.g. authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client. https://tools.ietf.org/html/rfc6749#section-5.2 Z invalid_grantr NrK r r r r rL & s rL c @ s e Zd ZdZdZdS )�UnauthorizedClientErrorz^ The authenticated client is not authorized to use this authorization grant type. Zunauthorized_clientNr8 r r r r rM 3 s rM c @ s e Zd ZdZdZdS )�UnsupportedGrantTypeErrorzX The authorization grant type is not supported by the authorization server. Zunsupported_grant_typeNr8 r r r r rN ; s rN c @ s e Zd ZdZdZdS )�UnsupportedTokenTypeErrorz� The authorization server does not support the hint of the presented token type. I.e. the client tried to revoke an access token on a server not supporting this feature. Zunsupported_token_typeNr8 r r r r rO C s rO c @ s e Zd ZdZdZdZdZdS )�InvalidTokenErrora The access token provided is expired, revoked, malformed, or invalid for other reasons. The resource SHOULD respond with the HTTP 401 (Unauthorized) status code. The client MAY request a new access token and retry the protected resource request. Z invalid_tokenr$ zWThe access token provided is expired, revoked, malformed, or invalid for other reasons.N�r' r( r) r5 r r r r r r r rP L s rP c @ s e Zd ZdZdZdZdZdS )�InsufficientScopeErrora The request requires higher privileges than provided by the access token. The resource server SHOULD respond with the HTTP 403 (Forbidden) status code and MAY include the "scope" attribute with the scope necessary to access the protected resource. Zinsufficient_scopei� zIThe request requires higher privileges than provided by the access token.NrQ r r r r rR Z s rR c @ s e Zd ZdZdZdS )�ConsentRequireda The Authorization Server requires End-User consent. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User consent. Zconsent_requiredNr8 r r r r rS h s rS c @ s e Zd ZdZdZdS )� LoginRequireda' The Authorization Server requires End-User authentication. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User authentication. Zlogin_requiredNr8 r r r r rT s s rT c s e Zd ZdZ� fdd�Z� ZS )�CustomOAuth2Errorz� This error is a placeholder for all custom errors not described by the RFC. Some of the popular OAuth2 providers are using custom errors. c s || _ t� j|i |�� d S r )r r r )r r �args�kwargsr r r r � s zCustomOAuth2Error.__init__)r' r( r) r5 r r+ r r r r rU ~ s rU c C sz dd l }dd l}|�d�|�d�|�d�d�}|�|jt |j�D ] \}}|j| krB|f i |���qBtf d| i|���d S )Nr r r r )r r r r ) �inspect�sys�getZ getmembers�modulesr' Zisclassr rU )r �paramsrX rY rW �_�clsr r r �raise_from_error� s � r_ )N))r5 r! Zoauthlib.commonr r � Exceptionr r, r. r0 r1 r2 r3 r4 r6 r9 r; r< r= r> r? r@ rA rC rD rE rF rG rH rI rJ rL rM rN rO rP rR rS rT rU r_ r r r r �<module> sJ i oauth2/rfc6749/__pycache__/parameters.cpython-39.pyc 0000644 00000037137 15125174064 0016076 0 ustar 00 a \��`F � @ s� d Z ddlZddlZddlZddlmZ ddlmZm Z ddl m Z ddl m Z mZmZmZmZmZ ddlmZ ddlmZmZmZ dd d �Zdd d�Zd dd�Zd dd�Z d dd�Z d dd�Z dd� Z dS ) z� oauthlib.oauth2.rfc6749.parameters ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module contains methods related to `Section 4`_ of the OAuth 2 RFC. .. _`Section 4`: https://tools.ietf.org/html/rfc6749#section-4 � N)�add_params_to_qs�add_params_to_uri)� scope_changed� )�InsecureTransportError�MismatchingStateError�MissingCodeError�MissingTokenError�MissingTokenTypeError�raise_from_error)� OAuth2Token)�is_secure_transport� list_to_scope� scope_to_listc K s� t | �st� �d|fd|fg}|r0|�d|f� |rF|�dt|�f� |rX|�d|f� |D ]"}|| r\|�t|�|| f� q\t| |�S )ap Prepare the authorization grant request URI. The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the ``application/x-www-form-urlencoded`` format as defined by [`W3C.REC-html401-19991224`_]: :param uri: :param client_id: The client identifier as described in `Section 2.2`_. :param response_type: To indicate which OAuth 2 grant/flow is required, "code" and "token". :param redirect_uri: The client provided URI to redirect back to after authorization as described in `Section 3.1.2`_. :param scope: The scope of the access request as described by `Section 3.3`_. :param state: An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. :param kwargs: Extra arguments to embed in the grant/authorization URL. An example of an authorization code grant authorization URL: .. code-block:: http GET /authorize?response_type=code&client_id=s6BhdRkqt3&state=xyz &redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb HTTP/1.1 Host: server.example.com .. _`W3C.REC-html401-19991224`: https://tools.ietf.org/html/rfc6749#ref-W3C.REC-html401-19991224 .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 � response_type� client_id� redirect_uri�scope�state)r r �appendr �strr ) �urir r r r r �kwargs�params�k� r �F/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/parameters.py�prepare_grant_uri s '�r � Tc K s� d| fg}d|v r"t |d �|d< |�dd�}|rH|durH|�d|f� |�dd�}|durj|�d|f� |D ]"}|| rn|�t|�|| f� qnt||�S )a� Prepare the access token request. The client makes a request to the token endpoint by adding the following parameters using the ``application/x-www-form-urlencoded`` format in the HTTP request entity-body: :param grant_type: To indicate grant type being used, i.e. "password", "authorization_code" or "client_credentials". :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra parameters. Default ''. :param include_client_id: `True` (default) to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. :type include_client_id: Boolean :param client_id: Unicode client identifier. Will only appear if `include_client_id` is True. * :param client_secret: Unicode client secret. Will only appear if set to a value that is not `None`. Invoking this function with an empty string will send an empty `client_secret` value to the server. * :param code: If using authorization_code grant, pass the previously obtained authorization code as the ``code`` argument. * :param redirect_uri: If the "redirect_uri" parameter was included in the authorization request as described in `Section 4.1.1`_, and their values MUST be identical. * :param kwargs: Extra arguments to embed in the request body. Parameters marked with a `*` above are not explicit arguments in the function signature, but are specially documented arguments for items appearing in the generic `**kwargs` keyworded input. An example of an authorization code token request body: .. code-block:: http grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA &redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb .. _`Section 4.1.1`: https://tools.ietf.org/html/rfc6749#section-4.1.1 � grant_typer r N� client_secret)r �popr r r )r �bodyZinclude_client_idr r r r r r r r �prepare_token_requestT s 2 r# � access_tokenc K s� t | �st� �d|fg}|r*|�d|f� |D ]"}|| r.|�t|�|| f� q.ddi}|r||�d|f� t| |�||fS | |t||�fS dS )ad Prepare a token revocation request. The client constructs the request by including the following parameters using the ``application/x-www-form-urlencoded`` format in the HTTP request entity-body: :param token: REQUIRED. The token that the client wants to get revoked. :param token_type_hint: OPTIONAL. A hint about the type of the token submitted for revocation. Clients MAY pass this parameter in order to help the authorization server to optimize the token lookup. If the server is unable to locate the token using the given hint, it MUST extend its search across all of its supported token types. An authorization server MAY ignore this parameter, particularly if it is able to detect the token type automatically. This specification defines two values for `token_type_hint`: * access_token: An access token as defined in [RFC6749], `Section 1.4`_ * refresh_token: A refresh token as defined in [RFC6749], `Section 1.5`_ Specific implementations, profiles, and extensions of this specification MAY define other values for this parameter using the registry defined in `Section 4.1.2`_. .. _`Section 1.4`: https://tools.ietf.org/html/rfc6749#section-1.4 .. _`Section 1.5`: https://tools.ietf.org/html/rfc6749#section-1.5 .. _`Section 4.1.2`: https://tools.ietf.org/html/rfc7009#section-4.1.2 �token�token_type_hintz Content-Typez!application/x-www-form-urlencoded�callbackN)r r r r r r ) �urlr% r& r' r" r r r Zheadersr r r � prepare_token_revocation_request� s % r) c C sn t | �st� �t�| �j}tt�|��}|rB|�dd�|krBt� �d|v rZt|�d�|� d|vrjt d��|S )aZ Parse authorization grant response URI into a dict. If the resource owner grants the access request, the authorization server issues an authorization code and delivers it to the client by adding the following parameters to the query component of the redirection URI using the ``application/x-www-form-urlencoded`` format: **code** REQUIRED. The authorization code generated by the authorization server. The authorization code MUST expire shortly after it is issued to mitigate the risk of leaks. A maximum authorization code lifetime of 10 minutes is RECOMMENDED. The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code. The authorization code is bound to the client identifier and redirection URI. **state** REQUIRED if the "state" parameter was present in the client authorization request. The exact value received from the client. :param uri: The full redirect URL back to the client. :param state: The state parameter from the authorization request. For example, the authorization server redirects the user-agent by sending the following HTTP response: .. code-block:: http HTTP/1.1 302 Found Location: https://client.example.com/cb?code=SplxlOBeZQQYbYS6WxSbIA &state=xyz r N�error�codez#Missing code parameter in response.) r r �urlparse�query�dict� parse_qsl�getr r r )r r r- r r r r �!parse_authorization_code_response� s & r1 c C s� t | �st� �t�| �j}ttj|dd��}dD ] }||v r0t|| �||< q0d|v rft|d �|d< d|v r�t�� t|d � |d< |r�|� dd�|kr�t d ��t ||d �}t |� |S ) a� Parse the implicit token response URI into a dict. If the resource owner grants the access request, the authorization server issues an access token and delivers it to the client by adding the following parameters to the fragment component of the redirection URI using the ``application/x-www-form-urlencoded`` format: **access_token** REQUIRED. The access token issued by the authorization server. **token_type** REQUIRED. The type of the token issued as described in Section 7.1. Value is case insensitive. **expires_in** RECOMMENDED. The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. **scope** OPTIONAL, if identical to the scope requested by the client, otherwise REQUIRED. The scope of the access token as described by Section 3.3. **state** REQUIRED if the "state" parameter was present in the client authorization request. The exact value received from the client. :param uri: :param state: :param scope: Similar to the authorization code response, but with a full token provided in the URL fragment: .. code-block:: http HTTP/1.1 302 Found Location: http://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA &state=xyz&token_type=example&expires_in=3600 T)�keep_blank_values�� expires_inr r4 � expires_atr Nz'Mismatching or missing state in params.�� old_scope) r r r, �fragmentr. r/ �intr �timer0 � ValueErrorr �validate_token_parameters)r r r r8 r �keyr r r �parse_implicit_response s - r> c C s� zt �| �}W nB tyP tt�| ��}dD ] }||v r.t|| �||< q.Y n0 d|v rjt|d �|d< d|v r�|d du r�|�d� nt � � t|d � |d< t ||d�}t |� |S )a� Parse the JSON token response body into a dict. The authorization server issues an access token and optional refresh token, and constructs the response by adding the following parameters to the entity body of the HTTP response with a 200 (OK) status code: access_token REQUIRED. The access token issued by the authorization server. token_type REQUIRED. The type of the token issued as described in `Section 7.1`_. Value is case insensitive. expires_in RECOMMENDED. The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. refresh_token OPTIONAL. The refresh token which can be used to obtain new access tokens using the same authorization grant as described in `Section 6`_. scope OPTIONAL, if identical to the scope requested by the client, otherwise REQUIRED. The scope of the access token as described by `Section 3.3`_. The parameters are included in the entity body of the HTTP response using the "application/json" media type as defined by [`RFC4627`_]. The parameters are serialized into a JSON structure by adding each parameter at the highest structure level. Parameter names and string values are included as JSON strings. Numerical values are included as JSON numbers. The order of parameters does not matter and can vary. :param body: The full json encoded response body. :param scope: The scope requested during authorization. For example: .. code-block:: http HTTP/1.1 200 OK Content-Type: application/json Cache-Control: no-store Pragma: no-cache { "access_token":"2YotnFZFEjr1zCsicMWpAA", "token_type":"example", "expires_in":3600, "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA", "example_parameter":"example_value" } .. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1 .. _`Section 6`: https://tools.ietf.org/html/rfc6749#section-6 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`RFC4627`: https://tools.ietf.org/html/rfc4627 r3 r r4 Nr5 r6 ) �json�loadsr; r. r, r/ r9 r r! r: r r< )r" r r r= r r r �parse_token_responseV s < rA c C s� d| v rt | �d�| � d| vr*tdd��d| vrDtj�d�rDt� �| jr�dj| j| j d�}tj || j | j d � tj�d d �s�t |�}| |_| j |_| j |_|�d S ) zCEnsures token presence, token type, expiration and scope in params.r* r$ z Missing access token parameter.)� description� token_typeZOAUTHLIB_STRICT_TOKEN_TYPEz*Scope has changed from "{old}" to "{new}".)�old�new)�messagerD rE ZOAUTHLIB_RELAX_TOKEN_SCOPEN)r r0 r �os�environr r �formatr7 r �sendZ old_scopesZscopes�Warningr% Z new_scope)r rF �wr r r r< � s$ �r< )NNN)r T)r$ Nr )N)NN)N) �__doc__r? rG r: � urllib.parse�parser, Zoauthlib.commonr r Zoauthlib.signalsr �errorsr r r r r r �tokensr Zutilsr r r r r# r) r1 r> rA r< r r r r �<module> s( � ; K � : 8 E W oauth2/rfc6749/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000001173 15125174064 0016420 0 ustar 00 a \��`� � @ sJ d Z ddlZddlZddlmZmZ ddlmZmZm Z m Z e� e �Z dS )z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N� )� BaseEndpoint� catch_errors_and_unavailability)�FatalClientError� OAuth2Error� ServerError�TemporarilyUnavailableError)�__doc__� functoolsZloggingZendpoints.baser r �errorsr r r r Z getLogger�__name__�log� r r �D/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/__init__.py�<module> s oauth2/rfc6749/__pycache__/request_validator.cpython-39.pyc 0000644 00000070403 15125174064 0017461 0 ustar 00 a \��`�l � @ s( d Z ddlZe�e�ZG dd� d�ZdS )zU oauthlib.oauth2.rfc6749.request_validator ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � Nc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z d7S )8�RequestValidatorc O s dS )a< Determine if client authentication is required for current request. According to the rfc6749, client authentication is required in the following cases: - Resource Owner Password Credentials Grant, when Client type is Confidential or when Client was issued client credentials or whenever Client provided client authentication, see `Section 4.3.2`_. - Authorization Code Grant, when Client type is Confidential or when Client was issued client credentials or whenever Client provided client authentication, see `Section 4.1.3`_. - Refresh Token Grant, when Client type is Confidential or when Client was issued client credentials or whenever Client provided client authentication, see `Section 6`_ :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Resource Owner Password Credentials Grant - Refresh Token Grant .. _`Section 4.3.2`: https://tools.ietf.org/html/rfc6749#section-4.3.2 .. _`Section 4.1.3`: https://tools.ietf.org/html/rfc6749#section-4.1.3 .. _`Section 6`: https://tools.ietf.org/html/rfc6749#section-6 T� ��self�request�args�kwargsr r �M/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/request_validator.py� client_authentication_required s z/RequestValidator.client_authentication_requiredc O s t d��dS )a� Authenticate client through means outside the OAuth 2 spec. Means of authentication is negotiated beforehand and may for example be `HTTP Basic Authentication Scheme`_ which utilizes the Authorization header. Headers may be accesses through request.headers and parameters found in both body and query can be obtained by direct attribute access, i.e. request.client_id for client_id in the URL query. The authentication process is required to contain the identification of the client (i.e. search the database based on the client_id). In case the client doesn't exist based on the received client_id, this method has to return False and the HTTP response created by the library will contain 'invalid_client' message. After the client identification succeeds, this method needs to set the client on the request, i.e. request.client = client. A client object's class must contain the 'client_id' attribute and the 'client_id' must have a value. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Resource Owner Password Credentials Grant (may be disabled) - Client Credentials Grant - Refresh Token Grant .. _`HTTP Basic Authentication Scheme`: https://tools.ietf.org/html/rfc1945#section-11.1 �&Subclasses must implement this method.N��NotImplementedErrorr r r r �authenticate_client) s "z$RequestValidator.authenticate_clientc O s t d��dS )a` Ensure client_id belong to a non-confidential client. A non-confidential client is one that is not required to authenticate through other means, such as using HTTP Basic. Note, while not strictly necessary it can often be very convenient to set request.client to the client object associated with the given client_id. :param client_id: Unicode client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant r Nr �r � client_idr r r r r r �authenticate_client_idM s z'RequestValidator.authenticate_client_idc O s t d��dS )a� Ensure that the authorization process represented by this authorization code began with this 'redirect_uri'. If the client specifies a redirect_uri when obtaining code then that redirect URI must be bound to the code and verified equal in this method, according to RFC 6749 section 4.1.3. Do not compare against the client's allowed redirect URIs, but against the URI used when the code was saved. :param client_id: Unicode client identifier. :param code: Unicode authorization_code. :param redirect_uri: Unicode absolute URI. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant (during token request) r Nr )r r �code� redirect_uri�clientr r r r r r �confirm_redirect_uria s z%RequestValidator.confirm_redirect_uric O s t d��dS )a\ Get the default redirect URI for the client. :param client_id: Unicode client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: The default redirect URI for the client Method is used by: - Authorization Code Grant - Implicit Grant r Nr r r r r �get_default_redirect_uriy s z)RequestValidator.get_default_redirect_uric O s t d��dS )a� Get the default scopes for the client. :param client_id: Unicode client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: List of default scopes Method is used by all core grant types: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant - Client Credentials grant r Nr r r r r �get_default_scopes� s z#RequestValidator.get_default_scopesc O s t d��dS )a/ Get the list of scopes associated with the refresh token. :param refresh_token: Unicode refresh token. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: List of scopes. Method is used by: - Refresh token grant r Nr )r � refresh_tokenr r r r r r �get_original_scopes� s z$RequestValidator.get_original_scopesc O s dS )aO Check if requested scopes are within a scope of the refresh token. When access tokens are refreshed the scope of the new token needs to be within the scope of the original token. This is ensured by checking that all requested scopes strings are on the list returned by the get_original_scopes. If this check fails, is_within_original_scope is called. The method can be used in situations where returning all valid scopes from the get_original_scopes is not practical. :param request_scopes: A list of scopes that were requested by client. :param refresh_token: Unicode refresh_token. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Refresh token grant Fr )r Zrequest_scopesr r r r r r r �is_within_original_scope� s z)RequestValidator.is_within_original_scopec O s t d��dS )a Introspect an access or refresh token. Called once the introspect request is validated. This method should verify the *token* and either return a dictionary with the list of claims associated, or `None` in case the token is unknown. Below the list of registered claims you should be interested in: - scope : space-separated list of scopes - client_id : client identifier - username : human-readable identifier for the resource owner - token_type : type of the token - exp : integer timestamp indicating when this token will expire - iat : integer timestamp indicating when this token was issued - nbf : integer timestamp indicating when it can be "not-before" used - sub : subject of the token - identifier of the resource owner - aud : list of string identifiers representing the intended audience - iss : string representing issuer of this token - jti : string identifier for the token Note that most of them are coming directly from JWT RFC. More details can be found in `Introspect Claims`_ or `_JWT Claims`_. The implementation can use *token_type_hint* to improve lookup efficency, but must fallback to other types to be compliant with RFC. The dict of claims is added to request.token after this method. :param token: The token string. :param token_type_hint: access_token or refresh_token. :param request: OAuthlib request. :type request: oauthlib.common.Request Method is used by: - Introspect Endpoint (all grants are compatible) .. _`Introspect Claims`: https://tools.ietf.org/html/rfc7662#section-2.2 .. _`JWT Claims`: https://tools.ietf.org/html/rfc7519#section-4 r Nr �r �tokenZtoken_type_hintr r r r r r �introspect_token� s 'z!RequestValidator.introspect_tokenc O s t d��dS )aH Invalidate an authorization code after use. :param client_id: Unicode client identifier. :param code: The authorization code grant (request.code). :param request: OAuthlib request. :type request: oauthlib.common.Request Method is used by: - Authorization Code Grant r Nr �r r r r r r r r r � invalidate_authorization_code� s z.RequestValidator.invalidate_authorization_codec O s t d��dS )a* Revoke an access or refresh token. :param token: The token string. :param token_type_hint: access_token or refresh_token. :param request: OAuthlib request. :type request: oauthlib.common.Request Method is used by: - Revocation Endpoint r Nr r r r r � revoke_token� s z RequestValidator.revoke_tokenc C s dS )a� Determine whether to rotate the refresh token. Default, yes. When access tokens are refreshed the old refresh token can be kept or replaced with a new one (rotated). Return True to rotate and and False for keeping original. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Refresh Token Grant Tr )r r r r r �rotate_refresh_token� s z%RequestValidator.rotate_refresh_tokenc O s t d��dS )ao Persist the authorization_code. The code should at minimum be stored with: - the client_id (``client_id``) - the redirect URI used (``request.redirect_uri``) - a resource owner / user (``request.user``) - the authorized scopes (``request.scopes``) To support PKCE, you MUST associate the code with: - Code Challenge (``request.code_challenge``) and - Code Challenge Method (``request.code_challenge_method``) To support OIDC, you MUST associate the code with: - nonce, if present (``code["nonce"]``) The ``code`` argument is actually a dictionary, containing at least a ``code`` key with the actual authorization code: ``{'code': 'sdf345jsdf0934f'}`` It may also have a ``claims`` parameter which, when present, will be a dict deserialized from JSON as described at http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter This value should be saved in this method and used again in ``.validate_code``. :param client_id: Unicode client identifier. :param code: A dict of the authorization code grant and, optionally, state. :param request: OAuthlib request. :type request: oauthlib.common.Request Method is used by: - Authorization Code Grant r Nr r r r r �save_authorization_code s "z(RequestValidator.save_authorization_codec O s | j ||g|�R i |��S )z�Persist the token with a token type specific method. Currently, only save_bearer_token is supported. :param token: A (Bearer) token dict. :param request: OAuthlib request. :type request: oauthlib.common.Request )�save_bearer_token�r r r r r r r r � save_token1 s zRequestValidator.save_tokenc O s t d��dS )a� Persist the Bearer token. The Bearer token should at minimum be associated with: - a client and it's client_id, if available - a resource owner / user (request.user) - authorized scopes (request.scopes) - an expiration time - a refresh token, if issued - a claims document, if present in request.claims The Bearer token dict may hold a number of items:: { 'token_type': 'Bearer', 'access_token': 'askfjh234as9sd8', 'expires_in': 3600, 'scope': 'string of space separated authorized scopes', 'refresh_token': '23sdf876234', # if issued 'state': 'given_by_client', # if supplied by client (implicit ONLY) } Note that while "scope" is a string-separated list of authorized scopes, the original list is still available in request.scopes. The token dict is passed as a reference so any changes made to the dictionary will go back to the user. If additional information must return to the client user, and it is only possible to get this information after writing the token to storage, it should be added to the token dictionary. If the token dictionary must be modified but the changes should not go back to the user, a copy of the dictionary must be made before making the changes. Also note that if an Authorization Code grant request included a valid claims parameter (for OpenID Connect) then the request.claims property will contain the claims dict, which should be saved for later use when generating the id_token and/or UserInfo response content. :param token: A Bearer token dict. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: The default redirect URI for the client Method is used by all core grant types issuing Bearer tokens: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant (might not associate a client) - Client Credentials grant r Nr r$ r r r r# < s 0z"RequestValidator.save_bearer_tokenc C s t d��dS )am Ensure the Bearer token is valid and authorized access to scopes. :param token: A string of random characters. :param scopes: A list of scopes associated with the protected resource. :param request: OAuthlib request. :type request: oauthlib.common.Request A key to OAuth 2 security and restricting impact of leaked tokens is the short expiration time of tokens, *always ensure the token has not expired!*. Two different approaches to scope validation: 1) all(scopes). The token must be authorized access to all scopes associated with the resource. For example, the token has access to ``read-only`` and ``images``, thus the client can view images but not upload new. Allows for fine grained access control through combining various scopes. 2) any(scopes). The token must be authorized access to one of the scopes associated with the resource. For example, token has access to ``read-only-images``. Allows for fine grained, although arguably less convenient, access control. A powerful way to use scopes would mimic UNIX ACLs and see a scope as a group with certain privileges. For a restful API these might map to HTTP verbs instead of read, write and execute. Note, the request.user attribute can be set to the resource owner associated with this token. Similarly the request.client and request.scopes attribute can be set to associated client object and authorized scopes. If you then use a decorator such as the one provided for django these attributes will be made available in all protected views as keyword arguments. :param token: Unicode Bearer token :param scopes: List of scopes (defined by you) :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is indirectly used by all core Bearer token issuing grant types: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant - Client Credentials Grant r Nr )r r �scopesr r r r �validate_bearer_tokenn s 2z&RequestValidator.validate_bearer_tokenc O s t d��dS )a� Ensure client_id belong to a valid and active client. Note, while not strictly necessary it can often be very convenient to set request.client to the client object associated with the given client_id. :param client_id: Unicode client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Implicit Grant r Nr r r r r �validate_client_id� s z#RequestValidator.validate_client_idc O s t d��dS )a� Verify that the authorization_code is valid and assigned to the given client. Before returning true, set the following based on the information stored with the code in 'save_authorization_code': - request.user - request.scopes - request.claims (if given) OBS! The request.user attribute should be set to the resource owner associated with this authorization code. Similarly request.scopes must also be set. The request.claims property, if it was given, should assigned a dict. If PKCE is enabled (see 'is_pkce_required' and 'save_authorization_code') you MUST set the following based on the information stored: - request.code_challenge - request.code_challenge_method :param client_id: Unicode client identifier. :param code: Unicode authorization code. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant r Nr )r r r r r r r r r r � validate_code� s z RequestValidator.validate_codec O s t d��dS )aW Ensure client is authorized to use the grant_type requested. :param client_id: Unicode client identifier. :param grant_type: Unicode grant type, i.e. authorization_code, password. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Resource Owner Password Credentials Grant - Client Credentials Grant - Refresh Token Grant r Nr )r r Z grant_typer r r r r r r �validate_grant_type� s z$RequestValidator.validate_grant_typec O s t d��dS )a, Ensure client is authorized to redirect to the redirect_uri requested. All clients should register the absolute URIs of all URIs they intend to redirect to. The registration is outside of the scope of oauthlib. :param client_id: Unicode client identifier. :param redirect_uri: Unicode absolute URI. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Implicit Grant r Nr )r r r r r r r r r �validate_redirect_uri� s z&RequestValidator.validate_redirect_uric O s t d��dS )a� Ensure the Bearer token is valid and authorized access to scopes. OBS! The request.user attribute should be set to the resource owner associated with this refresh token. :param refresh_token: Unicode refresh token. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant (indirectly by issuing refresh tokens) - Resource Owner Password Credentials Grant (also indirectly) - Refresh Token Grant r Nr )r r r r r r r r r �validate_refresh_token� s z'RequestValidator.validate_refresh_tokenc O s t d��dS )a� Ensure client is authorized to use the response_type requested. :param client_id: Unicode client identifier. :param response_type: Unicode response type, i.e. code, token. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Implicit Grant r Nr )r r Z response_typer r r r r r r �validate_response_type s z'RequestValidator.validate_response_typec O s t d��dS )aL Ensure the client is authorized access to requested scopes. :param client_id: Unicode client identifier. :param scopes: List of scopes (defined by you). :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by all core grant types: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant - Client Credentials Grant r Nr )r r r& r r r r r r r �validate_scopes s z RequestValidator.validate_scopesc O s t d��dS )a� Ensure the username and password is valid. OBS! The validation should also set the user attribute of the request to a valid resource owner, i.e. request.user = username or similar. If not set you will be unable to associate a token with a user in the persistance method used (commonly, save_bearer_token). :param username: Unicode username. :param password: Unicode password. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Resource Owner Password Credentials Grant r Nr )r �username�passwordr r r r r r r � validate_user. s z RequestValidator.validate_userc C s dS )a� Determine if current request requires PKCE. Default, False. This is called for both "authorization" and "token" requests. Override this method by ``return True`` to enable PKCE for everyone. You might want to enable it only for public clients. Note that PKCE can also be used in addition of a client authentication. OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. This specification describes the attack as well as a technique to mitigate against the threat through the use of Proof Key for Code Exchange (PKCE, pronounced "pixy"). See `RFC7636`_. :param client_id: Client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant .. _`RFC7636`: https://tools.ietf.org/html/rfc7636 Fr )r r r r r r �is_pkce_requiredB s z!RequestValidator.is_pkce_requiredc C s dS )a/ Is called for every "token" requests. When the server issues the authorization code in the authorization response, it MUST associate the ``code_challenge`` and ``code_challenge_method`` values with the authorization code so it can be verified later. Typically, the ``code_challenge`` and ``code_challenge_method`` values are stored in encrypted form in the ``code`` itself but could alternatively be stored on the server associated with the code. The server MUST NOT include the ``code_challenge`` value in client requests in a form that other entities can extract. Return the ``code_challenge`` associated to the code. If ``None`` is returned, code is considered to not be associated to any challenges. :param code: Authorization code. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: code_challenge string Method is used by: - Authorization Code Grant - when PKCE is active Nr �r r r r r r �get_code_challenge\ s z#RequestValidator.get_code_challengec C s t d��dS )aK Is called during the "token" request processing, when a ``code_verifier`` and a ``code_challenge`` has been provided. See ``.get_code_challenge``. Must return ``plain`` or ``S256``. You can return a custom value if you have implemented your own ``AuthorizationCodeGrant`` class. :param code: Authorization code. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: code_challenge_method string Method is used by: - Authorization Code Grant - when PKCE is active r Nr r3 r r r �get_code_challenge_methody s z*RequestValidator.get_code_challenge_methodN) �__name__� __module__� __qualname__r r r r r r r r r r r r! r" r% r# r' r( r) r* r+ r, r- r. r1 r2 r4 r5 r r r r r s6 $ ) $ 24! r )�__doc__ZloggingZ getLoggerr6 �logr r r r r �<module> s oauth2/rfc6749/__pycache__/tokens.cpython-39.opt-1.pyc 0000644 00000023322 15125174064 0016164 0 ustar 00 a \��`Y+ � @ s� d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl m Z m Z ddl mZ G d d � d e�Zd d d�Zdd� Zd!dd�Zd"dd�Zd#dd�Zdd� Zdd� ZG d d � d �ZG d d � d e�ZdS )$z� oauthlib.oauth2.rfc6749.tokens ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module contains methods for adding two types of access tokens to requests. - Bearer https://tools.ietf.org/html/rfc6750 - MAC https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01 � N)� b2a_base64)�urlparse)�common)�add_params_to_qs�add_params_to_uri� )�utilsc sr e Zd Zd� fdd� Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z � Z S )� OAuth2TokenNc sn t � �|� d | _d|v r6|d r6tt�|d ��| _|d urbtt�|��| _| jd u rj| j| _n| j| _d S )N�scope)�super�__init__� _new_scope�setr Z scope_to_list� _old_scope)�self�params� old_scope�� __class__� �B/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/tokens.pyr s zOAuth2Token.__init__c C s | j | jkS �N)r r �r r r r � scope_changed& s zOAuth2Token.scope_changedc C s t �| j�S r )r � list_to_scoper r r r r r * s zOAuth2Token.old_scopec C s t | j�S r )�listr r r r r � old_scopes. s zOAuth2Token.old_scopesc C s t �| j�S r )r r r r r r r r 2 s zOAuth2Token.scopec C s t | j�S r )r r r r r r �scopes6 s zOAuth2Token.scopesc C s t | j| j �S r )r r r r r r r �missing_scopes: s zOAuth2Token.missing_scopesc C s t | j| j �S r )r r r r r r r �additional_scopes> s z OAuth2Token.additional_scopes)N) �__name__� __module__� __qualname__r �propertyr r r r r r r � __classcell__r r r r r s r � � hmac-sha-1c C s: |� � }t�|�\} } |�� dkr*tj} n |�� dkr>tj} ntd��| dkrj|pfd�t� | �t � � �}nt � � }t � � }t |�\}}}}}}|r�|d | }n|}|dur�| dkr�|�d�}t| |��� �dd � �d�}nd }g }| dkr�|�|� n|�|� |�|� |�|� � � |�|� |�| � |�| � | dk�rN|�|� |�|�pZd � d �|�d }t|t��r�|�d�}t�||�d�| �}t|�� �dd � �d�}g }|�d | � | dk�r�|�d | � |�d| � |�r�|�d| � |�r|�d| � |�d| � |�p&i }d�|�|d< |S )a_ Add an `MAC Access Authentication`_ signature to headers. Unlike OAuth 1, this HMAC signature does not require inclusion of the request payload/body, neither does it use a combination of client_secret and token_secret but rather a mac_key provided together with the access token. Currently two algorithms are supported, "hmac-sha-1" and "hmac-sha-256", `extension algorithms`_ are not supported. Example MAC Authorization header, linebreaks added for clarity Authorization: MAC id="h480djs93hd8", nonce="1336363200:dj83hs9s", mac="bhCQXTVyfj5cmA9uKkPFx1zeOXM=" .. _`MAC Access Authentication`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01 .. _`extension algorithms`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-7.1 :param token: :param uri: Request URI. :param key: MAC given provided by token endpoint. :param http_method: HTTP Request method. :param nonce: :param headers: Request headers as a dictionary. :param body: :param ext: :param hash_algorithm: HMAC algorithm provided by token endpoint. :param issue_time: Time when the MAC credentials were issued (datetime). :param draft: MAC authentication specification version. :return: headers dictionary with the authorization field added. r& z hmac-sha-256zunknown hash algorithmr z{}:{}�?Nzutf-8���r% � z MAC id="%s"zts="%s"z nonce="%s"z bodyhash="%s"zext="%s"zmac="%s"z, � Authorization)�upperr Z host_from_uri�lower�hashlibZsha1Zsha256� ValueError�formatZ generate_ager Zgenerate_nonceZgenerate_timestampr �encoder �digest�decode�append�join� isinstance�str�hmac�new)�token�uri�keyZ http_methodZnonce�headers�body�extZhash_algorithmZ issue_timeZdraft�host�port�h�tsZschZnet�pathZpar�queryZfraZ request_uriZbodyhash�baseZ base_string�sign�headerr r r �prepare_mac_headerC sf ( � rH c C s t |d| fg�S )a Add a `Bearer Token`_ to the request URI. Not recommended, use only if client can't use authorization header or body. http://www.example.com/path?access_token=h480djs93hd8 .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750 :param token: :param uri: � access_token)r )r9 r: r r r �prepare_bearer_uri� s rJ c C s |pi }d| |d< |S )z�Add a `Bearer Token`_ to the request URI. Recommended method of passing bearer tokens. Authorization: Bearer h480djs93hd8 .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750 :param token: :param headers: z Bearer %sr* r )r9 r< r r r �prepare_bearer_headers� s rK c C s t |d| fg�S )z�Add a `Bearer Token`_ to the request body. access_token=h480djs93hd8 .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750 :param token: :param body: rI )r )r9 r= r r r �prepare_bearer_body� s rL Fc C s t �� S )zp :param request: OAuthlib request. :type request: oauthlib.common.Request :param refresh_token: )r Zgenerate_token)�request� refresh_tokenr r r �random_token_generator� s rO c s � �fdd�}|S )z :param private_pem: c s � | _ t��| �S r )Zclaimsr Zgenerate_signed_token)rM ��kwargs� private_pemr r �signed_token_generator� s z6signed_token_generator.<locals>.signed_token_generatorr )rR rQ rS r rP r rS � s rS c C sN d}d| j v rD| j �d��� }t|�dkrJ|d �� dkrJ|d }n| j}|S )z� Helper function to extract a token from the request header. :param request: OAuthlib request. :type request: oauthlib.common.Request :return: Return the token or None if the Authorization header is malformed. Nr* � r �bearerr )r< �get�split�lenr, rI )rM r9 Z split_headerr r r �get_token_from_header� s rY c @ s& e Zd Zd dd�Zdd� Zdd� ZdS ) � TokenBaseFc C s t d��d S )N�&Subclasses must implement this method.��NotImplementedError)r rM rN r r r �__call__ s zTokenBase.__call__c C s t d��dS ��b :param request: OAuthlib request. :type request: oauthlib.common.Request r[ Nr\ �r rM r r r �validate_request s zTokenBase.validate_requestc C s t d��dS r_ r\ ra r r r � estimate_type s zTokenBase.estimate_typeN)F)r r! r" r^ rb rc r r r r rZ s rZ c @ s4 e Zd ZdZd dd�Zd dd�Zdd � Zd d � ZdS )� BearerToken)�request_validator�token_generator�refresh_token_generator� expires_inNc C s* || _ |p t| _|p| j| _|p"d| _d S )Ni )re rO rf rg rh )r re rf rh rg r r r r s �zBearerToken.__init__Fc K s� d|v rt �dt� t| j�r*| �|�}n| j}||_| �|�|dd�}|jdurbd�|j�|d< |r�|jr�| j � |�s�|j|d< n| � |�|d< |� |j p�i � t|�S ) z� Create a BearerToken, by default without refresh token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param refresh_token: Z save_tokenzx`save_token` has been deprecated, it was not called internally.If you do, call `request_validator.save_token()` instead.ZBearer)rI rh � token_typeN� r rN )�warnings�warn�DeprecationWarning�callablerh rf r r4 rN re Zrotate_refresh_tokenrg �updateZextra_credentialsr )r rM rN rQ rh r9 r r r � create_token& s, � � � zBearerToken.create_tokenc C s t |�}| j�||j|�S )r` )rY re Zvalidate_bearer_tokenr )r rM r9 r r r rb P s �z BearerToken.validate_requestc C s: |j �dd��d�d �� dkr$dS |jdur2dS dS dS ) r` r* r% rj r rU � N� )r< rV rW r, rI ra r r r rc Y s zBearerToken.estimate_type)NNNN)F)r r! r" � __slots__r rp rb rc r r r r rd s � * rd )NNNr% r& Nr )N)r% )F)�__doc__r- r7 rk Zbinasciir � urllib.parser Zoauthlibr Zoauthlib.commonr r r% r �dictr rH rJ rK rL rO rS rY rZ rd r r r r �<module> s2 . � m oauth2/rfc6749/__pycache__/utils.cpython-39.pyc 0000644 00000005416 15125174064 0015066 0 ustar 00 a \��`� � @ sl d Z ddlZddlZddlmZmZ ddlmZ dd� Zdd� Z d d � Z d d � Z d d� Z dd� Z dd� ZdS )zp oauthlib.utils ~~~~~~~~~~~~~~ This module contains utility methods used by various parts of the OAuth 2 spec. � N)�quote�urlparse)� urldecodec C sJ t | t�s| du r| S t | tttf�r:d�dd� | D ��S td| ��dS )z5Convert a list of scopes to a space separated string.N� c S s g | ] }t |��qS � ��str��.0�sr r �A/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/utils.py� <listcomp> � z!list_to_scope.<locals>.<listcomp>z8Invalid scope (%s), must be string, tuple, set, or list.)� isinstancer �set�tuple�list�join� ValueError��scoper r r � list_to_scope s r c C s< t | tttf�r dd� | D �S | du r*dS | �� �d�S dS )z5Convert a space separated string to a list of scopes.c S s g | ] }t |��qS r r r r r r r r z!scope_to_list.<locals>.<listcomp>Nr )r r r r �strip�splitr r r r � scope_to_list s r c C s. t tt| �j��}d|v r*t|d �|d< |S )Nr )�dictr r �queryr )�uri�paramsr r r �params_from_uri" s r c C sN ddd�}t | �\}}}}}}d|v r8|�dd�\}}n|�|�� �}||fS )zuExtract hostname and port from URI. Will use default port for HTTP and HTTPS if none is present in the URI. Z80Z443)ZHTTPZHTTPS�:� )r r �get�upper) r Z default_portsZsch�netloc�pathZparr Zfra�portr r r � host_from_uri) s �r' c C s$ t | t�std��t| �d�dd�S )ztEscape a string in an OAuth-compatible fashion. TODO: verify whether this can in fact be used for OAuth 2 z#Only unicode objects are escapable.zutf-8� ~)�safe)r r r r �encode)�ur r r �escape< s r, c C s8 t j �� | }|j|j|jd d d d }t|�S )z9Generate a age parameter for MAC authentication draft 00.� i i@B )�datetimeZnowZ microsecondsZsecondsZdaysr )Z issue_timeZtdZager r r � generate_ageG s ��r/ c C s t j�d�rdS | �� �d�S )z Check if the uri is over ssl.ZOAUTHLIB_INSECURE_TRANSPORTTzhttps://)�os�environr" �lower� startswith)r r r r �is_secure_transportO s r4 )�__doc__r. r0 � urllib.parser r Zoauthlib.commonr r r r r' r, r/ r4 r r r r �<module> s oauth2/rfc6749/__pycache__/utils.cpython-39.opt-1.pyc 0000644 00000005416 15125174064 0016025 0 ustar 00 a \��`� � @ sl d Z ddlZddlZddlmZmZ ddlmZ dd� Zdd� Z d d � Z d d � Z d d� Z dd� Z dd� ZdS )zp oauthlib.utils ~~~~~~~~~~~~~~ This module contains utility methods used by various parts of the OAuth 2 spec. � N)�quote�urlparse)� urldecodec C sJ t | t�s| du r| S t | tttf�r:d�dd� | D ��S td| ��dS )z5Convert a list of scopes to a space separated string.N� c S s g | ] }t |��qS � ��str��.0�sr r �A/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/utils.py� <listcomp> � z!list_to_scope.<locals>.<listcomp>z8Invalid scope (%s), must be string, tuple, set, or list.)� isinstancer �set�tuple�list�join� ValueError��scoper r r � list_to_scope s r c C s< t | tttf�r dd� | D �S | du r*dS | �� �d�S dS )z5Convert a space separated string to a list of scopes.c S s g | ] }t |��qS r r r r r r r r z!scope_to_list.<locals>.<listcomp>Nr )r r r r �strip�splitr r r r � scope_to_list s r c C s. t tt| �j��}d|v r*t|d �|d< |S )Nr )�dictr r �queryr )�uri�paramsr r r �params_from_uri" s r c C sN ddd�}t | �\}}}}}}d|v r8|�dd�\}}n|�|�� �}||fS )zuExtract hostname and port from URI. Will use default port for HTTP and HTTPS if none is present in the URI. Z80Z443)ZHTTPZHTTPS�:� )r r �get�upper) r Z default_portsZsch�netloc�pathZparr Zfra�portr r r � host_from_uri) s �r' c C s$ t | t�std��t| �d�dd�S )ztEscape a string in an OAuth-compatible fashion. TODO: verify whether this can in fact be used for OAuth 2 z#Only unicode objects are escapable.zutf-8� ~)�safe)r r r r �encode)�ur r r �escape< s r, c C s8 t j �� | }|j|j|jd d d d }t|�S )z9Generate a age parameter for MAC authentication draft 00.� i i@B )�datetimeZnowZ microsecondsZsecondsZdaysr )Z issue_timeZtdZager r r � generate_ageG s ��r/ c C s t j�d�rdS | �� �d�S )z Check if the uri is over ssl.ZOAUTHLIB_INSECURE_TRANSPORTTzhttps://)�os�environr" �lower� startswith)r r r r �is_secure_transportO s r4 )�__doc__r. r0 � urllib.parser r Zoauthlib.commonr r r r r' r, r/ r4 r r r r �<module> s oauth2/rfc6749/__pycache__/tokens.cpython-39.pyc 0000644 00000023322 15125174064 0015225 0 ustar 00 a \��`Y+ � @ s� d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl m Z m Z ddl mZ G d d � d e�Zd d d�Zdd� Zd!dd�Zd"dd�Zd#dd�Zdd� Zdd� ZG d d � d �ZG d d � d e�ZdS )$z� oauthlib.oauth2.rfc6749.tokens ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module contains methods for adding two types of access tokens to requests. - Bearer https://tools.ietf.org/html/rfc6750 - MAC https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01 � N)� b2a_base64)�urlparse)�common)�add_params_to_qs�add_params_to_uri� )�utilsc sr e Zd Zd� fdd� Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z � Z S )� OAuth2TokenNc sn t � �|� d | _d|v r6|d r6tt�|d ��| _|d urbtt�|��| _| jd u rj| j| _n| j| _d S )N�scope)�super�__init__� _new_scope�setr Z scope_to_list� _old_scope)�self�params� old_scope�� __class__� �B/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/tokens.pyr s zOAuth2Token.__init__c C s | j | jkS �N)r r �r r r r � scope_changed& s zOAuth2Token.scope_changedc C s t �| j�S r )r � list_to_scoper r r r r r * s zOAuth2Token.old_scopec C s t | j�S r )�listr r r r r � old_scopes. s zOAuth2Token.old_scopesc C s t �| j�S r )r r r r r r r r 2 s zOAuth2Token.scopec C s t | j�S r )r r r r r r �scopes6 s zOAuth2Token.scopesc C s t | j| j �S r )r r r r r r r �missing_scopes: s zOAuth2Token.missing_scopesc C s t | j| j �S r )r r r r r r r �additional_scopes> s z OAuth2Token.additional_scopes)N) �__name__� __module__� __qualname__r �propertyr r r r r r r � __classcell__r r r r r s r � � hmac-sha-1c C s: |� � }t�|�\} } |�� dkr*tj} n |�� dkr>tj} ntd��| dkrj|pfd�t� | �t � � �}nt � � }t � � }t |�\}}}}}}|r�|d | }n|}|dur�| dkr�|�d�}t| |��� �dd � �d�}nd }g }| dkr�|�|� n|�|� |�|� |�|� � � |�|� |�| � |�| � | dk�rN|�|� |�|�pZd � d �|�d }t|t��r�|�d�}t�||�d�| �}t|�� �dd � �d�}g }|�d | � | dk�r�|�d | � |�d| � |�r�|�d| � |�r|�d| � |�d| � |�p&i }d�|�|d< |S )a_ Add an `MAC Access Authentication`_ signature to headers. Unlike OAuth 1, this HMAC signature does not require inclusion of the request payload/body, neither does it use a combination of client_secret and token_secret but rather a mac_key provided together with the access token. Currently two algorithms are supported, "hmac-sha-1" and "hmac-sha-256", `extension algorithms`_ are not supported. Example MAC Authorization header, linebreaks added for clarity Authorization: MAC id="h480djs93hd8", nonce="1336363200:dj83hs9s", mac="bhCQXTVyfj5cmA9uKkPFx1zeOXM=" .. _`MAC Access Authentication`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01 .. _`extension algorithms`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-7.1 :param token: :param uri: Request URI. :param key: MAC given provided by token endpoint. :param http_method: HTTP Request method. :param nonce: :param headers: Request headers as a dictionary. :param body: :param ext: :param hash_algorithm: HMAC algorithm provided by token endpoint. :param issue_time: Time when the MAC credentials were issued (datetime). :param draft: MAC authentication specification version. :return: headers dictionary with the authorization field added. r& z hmac-sha-256zunknown hash algorithmr z{}:{}�?Nzutf-8���r% � z MAC id="%s"zts="%s"z nonce="%s"z bodyhash="%s"zext="%s"zmac="%s"z, � Authorization)�upperr Z host_from_uri�lower�hashlibZsha1Zsha256� ValueError�formatZ generate_ager Zgenerate_nonceZgenerate_timestampr �encoder �digest�decode�append�join� isinstance�str�hmac�new)�token�uri�keyZ http_methodZnonce�headers�body�extZhash_algorithmZ issue_timeZdraft�host�port�h�tsZschZnet�pathZpar�queryZfraZ request_uriZbodyhash�baseZ base_string�sign�headerr r r �prepare_mac_headerC sf ( � rH c C s t |d| fg�S )a Add a `Bearer Token`_ to the request URI. Not recommended, use only if client can't use authorization header or body. http://www.example.com/path?access_token=h480djs93hd8 .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750 :param token: :param uri: � access_token)r )r9 r: r r r �prepare_bearer_uri� s rJ c C s |pi }d| |d< |S )z�Add a `Bearer Token`_ to the request URI. Recommended method of passing bearer tokens. Authorization: Bearer h480djs93hd8 .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750 :param token: :param headers: z Bearer %sr* r )r9 r< r r r �prepare_bearer_headers� s rK c C s t |d| fg�S )z�Add a `Bearer Token`_ to the request body. access_token=h480djs93hd8 .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750 :param token: :param body: rI )r )r9 r= r r r �prepare_bearer_body� s rL Fc C s t �� S )zp :param request: OAuthlib request. :type request: oauthlib.common.Request :param refresh_token: )r Zgenerate_token)�request� refresh_tokenr r r �random_token_generator� s rO c s � �fdd�}|S )z :param private_pem: c s � | _ t��| �S r )Zclaimsr Zgenerate_signed_token)rM ��kwargs� private_pemr r �signed_token_generator� s z6signed_token_generator.<locals>.signed_token_generatorr )rR rQ rS r rP r rS � s rS c C sN d}d| j v rD| j �d��� }t|�dkrJ|d �� dkrJ|d }n| j}|S )z� Helper function to extract a token from the request header. :param request: OAuthlib request. :type request: oauthlib.common.Request :return: Return the token or None if the Authorization header is malformed. Nr* � r �bearerr )r< �get�split�lenr, rI )rM r9 Z split_headerr r r �get_token_from_header� s rY c @ s& e Zd Zd dd�Zdd� Zdd� ZdS ) � TokenBaseFc C s t d��d S )N�&Subclasses must implement this method.��NotImplementedError)r rM rN r r r �__call__ s zTokenBase.__call__c C s t d��dS ��b :param request: OAuthlib request. :type request: oauthlib.common.Request r[ Nr\ �r rM r r r �validate_request s zTokenBase.validate_requestc C s t d��dS r_ r\ ra r r r � estimate_type s zTokenBase.estimate_typeN)F)r r! r" r^ rb rc r r r r rZ s rZ c @ s4 e Zd ZdZd dd�Zd dd�Zdd � Zd d � ZdS )� BearerToken)�request_validator�token_generator�refresh_token_generator� expires_inNc C s* || _ |p t| _|p| j| _|p"d| _d S )Ni )re rO rf rg rh )r re rf rh rg r r r r s �zBearerToken.__init__Fc K s� d|v rt �dt� t| j�r*| �|�}n| j}||_| �|�|dd�}|jdurbd�|j�|d< |r�|jr�| j � |�s�|j|d< n| � |�|d< |� |j p�i � t|�S ) z� Create a BearerToken, by default without refresh token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param refresh_token: Z save_tokenzx`save_token` has been deprecated, it was not called internally.If you do, call `request_validator.save_token()` instead.ZBearer)rI rh � token_typeN� r rN )�warnings�warn�DeprecationWarning�callablerh rf r r4 rN re Zrotate_refresh_tokenrg �updateZextra_credentialsr )r rM rN rQ rh r9 r r r � create_token& s, � � � zBearerToken.create_tokenc C s t |�}| j�||j|�S )r` )rY re Zvalidate_bearer_tokenr )r rM r9 r r r rb P s �z BearerToken.validate_requestc C s: |j �dd��d�d �� dkr$dS |jdur2dS dS dS ) r` r* r% rj r rU � N� )r< rV rW r, rI ra r r r rc Y s zBearerToken.estimate_type)NNNN)F)r r! r" � __slots__r rp rb rc r r r r rd s � * rd )NNNr% r& Nr )N)r% )F)�__doc__r- r7 rk Zbinasciir � urllib.parser Zoauthlibr Zoauthlib.commonr r r% r �dictr rH rJ rK rL rO rS rY rZ rd r r r r �<module> s2 . � m oauth2/rfc6749/__pycache__/__init__.cpython-39.pyc 0000644 00000001173 15125174064 0015461 0 ustar 00 a \��`� � @ sJ d Z ddlZddlZddlmZmZ ddlmZmZm Z m Z e� e �Z dS )z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N� )� BaseEndpoint� catch_errors_and_unavailability)�FatalClientError� OAuth2Error� ServerError�TemporarilyUnavailableError)�__doc__� functoolsZloggingZendpoints.baser r �errorsr r r r Z getLogger�__name__�log� r r �D/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/__init__.py�<module> s oauth2/rfc6749/endpoints/__pycache__/revocation.cpython-39.pyc 0000644 00000012022 15125174064 0020071 0 ustar 00 a \��`\ � @ sR d Z ddlZddlmZ ddlmZ ddlmZmZ e� e �Z G dd � d e�Z dS ) z� oauthlib.oauth2.rfc6749.endpoint.revocation ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ An implementation of the OAuth 2 `Token Revocation`_ spec (draft 11). .. _`Token Revocation`: https://tools.ietf.org/html/draft-ietf-oauth-revocation-11 � N)�Request� )� OAuth2Error� )� BaseEndpoint� catch_errors_and_unavailabilityc @ s8 e Zd ZdZdZdZd dd�Zedd d ��Zd d � Z dS )�RevocationEndpointz�Token revocation endpoint. Endpoint used by authenticated clients to revoke access and refresh tokens. Commonly this will be part of the Authorization Endpoint. )Z access_tokenZ refresh_token)�POSTNFc C s& t �| � || _|p| j| _|| _d S )N)r �__init__�request_validator�valid_token_types�supported_token_types� enable_jsonp)�selfr r r � r �P/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/revocation.pyr s �zRevocationEndpoint.__init__r c C s� dddd�}t ||||d�}z| �|� t�d|� W nj ty� } zRt�d||� |j}| jrt|jrtd�|j|�}|� |j � |||j fW Y d }~S d }~0 0 | j � |j|j|� d }| jr�|jr�|jd }i |d fS ) a� Revoke supplied access or refresh token. The authorization server responds with HTTP status code 200 if the token has been revoked sucessfully or if the client submitted an invalid token. Note: invalid tokens do not cause an error response since the client cannot handle such an error in a reasonable way. Moreover, the purpose of the revocation request, invalidating the particular token, is already achieved. The content of the response body is ignored by the client as all necessary information is conveyed in the response code. An invalid token type hint value is ignored by the authorization server and does not influence the revocation response. zapplication/jsonzno-storezno-cache)z Content-Typez Cache-ControlZPragma)� http_method�body�headersz Token revocation valid for %r.z)Client error during validation of %r. %r.z{}({});N� z();�� )r �validate_revocation_request�log�debugr Zjsonr �callback�format�updater Z status_coder Z revoke_token�tokenZtoken_type_hint) r Zurir r r Z resp_headers�request�eZ response_bodyr r r �create_revocation_response& s0 �� " � z-RevocationEndpoint.create_revocation_responsec C s6 | � |� | �|� | �|� | �|� | �|� dS )a Ensure the request is valid. The client constructs the request by including the following parameters using the "application/x-www-form-urlencoded" format in the HTTP request entity-body: token (REQUIRED). The token that the client wants to get revoked. token_type_hint (OPTIONAL). A hint about the type of the token submitted for revocation. Clients MAY pass this parameter in order to help the authorization server to optimize the token lookup. If the server is unable to locate the token using the given hint, it MUST extend its search accross all of its supported token types. An authorization server MAY ignore this parameter, particularly if it is able to detect the token type automatically. This specification defines two such values: * access_token: An Access Token as defined in [RFC6749], `section 1.4`_ * refresh_token: A Refresh Token as defined in [RFC6749], `section 1.5`_ Specific implementations, profiles, and extensions of this specification MAY define other values for this parameter using the registry defined in `Section 4.1.2`_. The client also includes its authentication credentials as described in `Section 2.3`_. of [`RFC6749`_]. .. _`section 1.4`: https://tools.ietf.org/html/rfc6749#section-1.4 .. _`section 1.5`: https://tools.ietf.org/html/rfc6749#section-1.5 .. _`section 2.3`: https://tools.ietf.org/html/rfc6749#section-2.3 .. _`Section 4.1.2`: https://tools.ietf.org/html/draft-ietf-oauth-revocation-11#section-4.1.2 .. _`RFC6749`: https://tools.ietf.org/html/rfc6749 N)Z_raise_on_bad_methodZ_raise_on_bad_post_requestZ_raise_on_missing_tokenZ_raise_on_invalid_clientZ_raise_on_unsupported_token)r r r r r r U s % z.RevocationEndpoint.validate_revocation_request)NF)r NN) �__name__� __module__� __qualname__�__doc__r Zvalid_request_methodsr r r r r r r r r s � � .r ) r$ ZloggingZoauthlib.commonr �errorsr �baser r Z getLoggerr! r r r r r r �<module> s oauth2/rfc6749/endpoints/__pycache__/resource.cpython-39.opt-1.pyc 0000644 00000007426 15125174064 0020522 0 ustar 00 a \��`� � @ sF d Z ddlZddlmZ ddlmZmZ e�e�Z G dd� de�Z dS )z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N)�Request� )� BaseEndpoint� catch_errors_and_unavailabilityc @ sR e Zd ZdZdd� Zedd� �Zedd� �Zedd � �Ze dd d ��Z dd� Z d S )�ResourceEndpointa� Authorizes access to protected resources. The client accesses protected resources by presenting the access token to the resource server. The resource server MUST validate the access token and ensure that it has not expired and that its scope covers the requested resource. The methods used by the resource server to validate the access token (as well as any error responses) are beyond the scope of this specification but generally involve an interaction or coordination between the resource server and the authorization server:: # For most cases, returning a 403 should suffice. The method in which the client utilizes the access token to authenticate with the resource server depends on the type of access token issued by the authorization server. Typically, it involves using the HTTP "Authorization" request header field [RFC2617] with an authentication scheme defined by the specification of the access token type used, such as [RFC6750]:: # Access tokens may also be provided in query and body https://example.com/protected?access_token=kjfch2345sdf # Query access_token=sdf23409df # Body c C s t �| � || _|| _d S �N)r �__init__�_tokens�_default_token)�self� default_tokenZ token_types� r �N/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/resource.pyr , s zResourceEndpoint.__init__c C s | j S r )r �r r r r r 1 s z ResourceEndpoint.default_tokenc C s | j �| j�S r )�tokens�getr r r r r �default_token_type_handler5 s z+ResourceEndpoint.default_token_type_handlerc C s | j S r )r r r r r r 9 s zResourceEndpoint.tokens�GETNc C sP t ||||�}| �|�|_||_| j�|j| j�}t�d|j|� |� |�|fS )z0Validate client, code etc, return body + headersz(Dispatching token_type %s request to %r.) r �find_token_type� token_type�scopesr r r �log�debugZvalidate_request)r ZuriZ http_method�bodyZheadersr �requestZtoken_type_handlerr r r �verify_request= s ��z ResourceEndpoint.verify_requestc s8 t � fdd�| j�� D �dd�}t|�r4|d d S dS )a> Token type identification. RFC 6749 does not provide a method for easily differentiating between different token types during protected resource access. We estimate the most likely token type (if any) by asking each known token type to give an estimation based on the request. c 3 s | ]\}}|� � �|fV qd S r )Z estimate_type)�.0�n�t�r r r � <genexpr>R s �z3ResourceEndpoint.find_token_type.<locals>.<genexpr>T)�reverser r N)�sortedr �items�len)r r Z estimatesr r r r J s ��z ResourceEndpoint.find_token_type)r NNN) �__name__� __module__� __qualname__�__doc__r �propertyr r r r r r r r r r r s � r ) r( ZloggingZoauthlib.commonr �baser r Z getLoggerr% r r r r r r �<module> s oauth2/rfc6749/endpoints/__pycache__/resource.cpython-39.pyc 0000644 00000007426 15125174064 0017563 0 ustar 00 a \��`� � @ sF d Z ddlZddlmZ ddlmZmZ e�e�Z G dd� de�Z dS )z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N)�Request� )� BaseEndpoint� catch_errors_and_unavailabilityc @ sR e Zd ZdZdd� Zedd� �Zedd� �Zedd � �Ze dd d ��Z dd� Z d S )�ResourceEndpointa� Authorizes access to protected resources. The client accesses protected resources by presenting the access token to the resource server. The resource server MUST validate the access token and ensure that it has not expired and that its scope covers the requested resource. The methods used by the resource server to validate the access token (as well as any error responses) are beyond the scope of this specification but generally involve an interaction or coordination between the resource server and the authorization server:: # For most cases, returning a 403 should suffice. The method in which the client utilizes the access token to authenticate with the resource server depends on the type of access token issued by the authorization server. Typically, it involves using the HTTP "Authorization" request header field [RFC2617] with an authentication scheme defined by the specification of the access token type used, such as [RFC6750]:: # Access tokens may also be provided in query and body https://example.com/protected?access_token=kjfch2345sdf # Query access_token=sdf23409df # Body c C s t �| � || _|| _d S �N)r �__init__�_tokens�_default_token)�self� default_tokenZ token_types� r �N/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/resource.pyr , s zResourceEndpoint.__init__c C s | j S r )r �r r r r r 1 s z ResourceEndpoint.default_tokenc C s | j �| j�S r )�tokens�getr r r r r �default_token_type_handler5 s z+ResourceEndpoint.default_token_type_handlerc C s | j S r )r r r r r r 9 s zResourceEndpoint.tokens�GETNc C sP t ||||�}| �|�|_||_| j�|j| j�}t�d|j|� |� |�|fS )z0Validate client, code etc, return body + headersz(Dispatching token_type %s request to %r.) r �find_token_type� token_type�scopesr r r �log�debugZvalidate_request)r ZuriZ http_method�bodyZheadersr �requestZtoken_type_handlerr r r �verify_request= s ��z ResourceEndpoint.verify_requestc s8 t � fdd�| j�� D �dd�}t|�r4|d d S dS )a> Token type identification. RFC 6749 does not provide a method for easily differentiating between different token types during protected resource access. We estimate the most likely token type (if any) by asking each known token type to give an estimation based on the request. c 3 s | ]\}}|� � �|fV qd S r )Z estimate_type)�.0�n�t�r r r � <genexpr>R s �z3ResourceEndpoint.find_token_type.<locals>.<genexpr>T)�reverser r N)�sortedr �items�len)r r Z estimatesr r r r J s ��z ResourceEndpoint.find_token_type)r NNN) �__name__� __module__� __qualname__�__doc__r �propertyr r r r r r r r r r r s � r ) r( ZloggingZoauthlib.commonr �baser r Z getLoggerr% r r r r r r �<module> s oauth2/rfc6749/endpoints/__pycache__/introspect.cpython-39.pyc 0000644 00000011723 15125174064 0020121 0 ustar 00 a \��`w � @ sZ d Z ddlZddlZddlmZ ddlmZ ddlmZm Z e� e �Z G dd � d e�Z dS ) z� oauthlib.oauth2.rfc6749.endpoint.introspect ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ An implementation of the OAuth 2.0 `Token Introspection`. .. _`Token Introspection`: https://tools.ietf.org/html/rfc7662 � N)�Request� )� OAuth2Error� )� BaseEndpoint� catch_errors_and_unavailabilityc @ s8 e Zd ZdZdZdZd dd�Zed dd ��Zd d � Z dS )�IntrospectEndpointa� Introspect token endpoint. This endpoint defines a method to query an OAuth 2.0 authorization server to determine the active state of an OAuth 2.0 token and to determine meta-information about this token. OAuth 2.0 deployments can use this method to convey information about the authorization context of the token from the authorization server to the protected resource. To prevent the values of access tokens from leaking into server-side logs via query parameters, an authorization server offering token introspection MAY disallow the use of HTTP GET on the introspection endpoint and instead require the HTTP POST method to be used at the introspection endpoint. )Z access_tokenZ refresh_token)�POSTNc C s t �| � || _|p| j| _d S )N)r �__init__�request_validator�valid_token_types�supported_token_types)�selfr r � r �P/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/introspect.pyr ) s �zIntrospectEndpoint.__init__r c C s� dddd�}t ||||�}z| �|� t�d|� W nL ty� } z4t�d||� |�|j� ||j|jfW Y d}~S d}~0 0 | j � |j |j |�}|du r�|t� tdd ��d fS d |v r�|�d � |t� tf d d i|���d fS ) a* Create introspect valid or invalid response If the authorization server is unable to determine the state of the token without additional information, it SHOULD return an introspection response indicating the token is not active as described in Section 2.2. zapplication/jsonzno-storezno-cache)z Content-Typez Cache-ControlZPragmaz Token introspect valid for %r.z)Client error during validation of %r. %r.NF)�active�� r T)r �validate_introspect_request�log�debugr �update�headers�jsonZ status_coder Zintrospect_token�tokenZtoken_type_hint�dumps�dict�pop) r ZuriZ http_method�bodyr Z resp_headers�request�eZclaimsr r r �create_introspect_response/ s, � $� z-IntrospectEndpoint.create_introspect_responsec C s6 | � |� | �|� | �|� | �|� | �|� dS )a� Ensure the request is valid. The protected resource calls the introspection endpoint using an HTTP POST request with parameters sent as "application/x-www-form-urlencoded". token REQUIRED. The string value of the token. token_type_hint OPTIONAL. A hint about the type of the token submitted for introspection. The protected resource MAY pass this parameter to help the authorization server optimize the token lookup. If the server is unable to locate the token using the given hint, it MUST extend its search across all of its supported token types. An authorization server MAY ignore this parameter, particularly if it is able to detect the token type automatically. * access_token: An Access Token as defined in [`RFC6749`], `section 1.4`_ * refresh_token: A Refresh Token as defined in [`RFC6749`], `section 1.5`_ The introspection endpoint MAY accept other OPTIONAL parameters to provide further context to the query. For instance, an authorization server may desire to know the IP address of the client accessing the protected resource to determine if the correct client is likely to be presenting the token. The definition of this or any other parameters are outside the scope of this specification, to be defined by service documentation or extensions to this specification. .. _`section 1.4`: http://tools.ietf.org/html/rfc6749#section-1.4 .. _`section 1.5`: http://tools.ietf.org/html/rfc6749#section-1.5 .. _`RFC6749`: http://tools.ietf.org/html/rfc6749 N)Z_raise_on_bad_methodZ_raise_on_bad_post_requestZ_raise_on_missing_tokenZ_raise_on_invalid_clientZ_raise_on_unsupported_token)r r r r r r R s $ z.IntrospectEndpoint.validate_introspect_request)N)r NN) �__name__� __module__� __qualname__�__doc__r Zvalid_request_methodsr r r r r r r r r s � "r )r$ r ZloggingZoauthlib.commonr �errorsr �baser r Z getLoggerr! r r r r r r �<module> s oauth2/rfc6749/endpoints/__pycache__/base.cpython-39.opt-1.pyc 0000644 00000010502 15125174064 0017572 0 ustar 00 a \��`" � @ s\ d Z ddlZddlZddlmZmZmZmZmZm Z m Z e� e �Z G dd� d�Zdd� ZdS ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N� )�FatalClientError�InvalidClientError�InvalidRequestError� OAuth2Error� ServerError�TemporarilyUnavailableError�UnsupportedTokenTypeErrorc @ s� e Zd Zdd� Zedd� �Zejdd� �Zedd� �Zejdd� �Zed d � �Zejd d � �Zd d � Z dd� Z dd� Z dd� Z dd� Z dS )� BaseEndpointc C s d| _ d| _d | _d S )NTF)� _available� _catch_errors�_valid_request_methods��self� r �J/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/base.py�__init__ s zBaseEndpoint.__init__c C s | j S �N�r r r r r �valid_request_methods s z"BaseEndpoint.valid_request_methodsc C s |d urdd� |D �}|| _ d S )Nc S s g | ] }|� � �qS r )�upper)�.0�xr r r � <listcomp>! � z6BaseEndpoint.valid_request_methods.<locals>.<listcomp>r )r r r r r r s c C s | j S r �r r r r r � available% s zBaseEndpoint.availablec C s || _ d S r r )r r r r r r ) s c C s | j S r �r r r r r � catch_errors- s zBaseEndpoint.catch_errorsc C s || _ d S r r )r r r r r r 1 s c C s |j st|dd��dS )z Raise error on missing token.zMissing token parameter.��request� descriptionN)�tokenr �r r r r r �_raise_on_missing_token5 s �z$BaseEndpoint._raise_on_missing_tokenc C sZ | j �|�r0| j �|�sVt�d|� t|d��n&| j �|j|�sVt�d|� t|d��dS )z&Raise on failed client authentication.z!Client authentication failed, %r.�r N)Zrequest_validatorZ client_authentication_requiredZauthenticate_client�log�debugr Zauthenticate_client_idZ client_idr# r r r �_raise_on_invalid_client: s z%BaseEndpoint._raise_on_invalid_clientc C s, |j r(|j | jv r(|j | jvr(t|d��dS )z Raise on unsupported tokens.r% N)Ztoken_type_hintZvalid_token_typesZsupported_token_typesr r# r r r �_raise_on_unsupported_tokenD s � �z(BaseEndpoint._raise_on_unsupported_tokenc C s< | j d u rtd��|j�� | j vr8t|d|j�� d��d S )Nz0Configure "valid_request_methods" property firstz Unsupported request method %sr )r � ValueError� http_methodr r r# r r r �_raise_on_bad_methodK s �z!BaseEndpoint._raise_on_bad_methodc C s, |j �� dkr(|jpd}|r(t|dd��dS )z/Raise if invalid POST request received ZPOST� z$URL query parameters are not allowedr N)r+ r Z uri_queryr )r r Z query_paramsr r r �_raise_on_bad_post_requestR s �z'BaseEndpoint._raise_on_bad_post_requestN)�__name__� __module__� __qualname__r �propertyr �setterr r r$ r( r) r, r. r r r r r s$ r c s t �� �� fdd��}|S )Nc s� | j s&t� }t�d| � i |jdfS | jr�z� | |g|�R i |��W S tyZ � Y q� tyl � Y q� ty� } z,t � }t� d| � i |jdfW Y d }~S d }~0 0 n� | |g|�R i |��S d S )Nz*Endpoint unavailable, ignoring request %s.i� z.Exception caught while processing request, %s.i� ) r r r& �infoZjsonr r r � Exceptionr Zwarning)ZendpointZuri�args�kwargs�e�error��fr r �wrapper\ s$ �$z0catch_errors_and_unavailability.<locals>.wrapper)� functools�wraps)r; r< r r: r � catch_errors_and_unavailability[ s r? )�__doc__r= Zlogging�errorsr r r r r r r Z getLoggerr/ r& r r? r r r r �<module> s $ H oauth2/rfc6749/endpoints/__pycache__/pre_configured.cpython-39.pyc 0000644 00000020107 15125174064 0020716 0 ustar 00 a \��`�. � @ s� d Z ddlmZmZmZmZmZ ddlmZ ddl m Z ddl m Z ddl mZ ddlmZ dd lmZ G d d � d e e eee�ZG d d � d e e eee�ZG dd� de e ee�ZG dd� dee ee�ZG dd� dee ee�ZdS )z� oauthlib.oauth2.rfc6749.endpoints.pre_configured ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various endpoints needed for providing OAuth 2.0 RFC6749 servers. � )�AuthorizationCodeGrant�ClientCredentialsGrant� ImplicitGrant�RefreshTokenGrant�%ResourceOwnerPasswordCredentialsGrant)� BearerToken� )�AuthorizationEndpoint)�IntrospectEndpoint)�ResourceEndpoint)�RevocationEndpoint)� TokenEndpointc @ s e Zd ZdZddd�ZdS )�Serverz<An all-in-one endpoint featuring all four major grant types.Nc O s� t |�| _t|�| _t|�| _t|�| _t|�| _ t ||||�| _ t j | d| j| j| jd�| j d� tj | d| j| j| j| j d�| j d� tj | dd| j id� t� | |� t� | |� d S ) a� Construct a new all-grants-in-one server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. �code)r �tokenZnone�Zdefault_response_typeZresponse_types�default_token_type�authorization_code)r �password�client_credentials� refresh_token�Zdefault_grant_type� grant_typesr �Bearer�Z default_tokenZ token_typesN)r � auth_grantr �implicit_grantr �password_grantr �credentials_grantr � refresh_grantr �bearerr �__init__r r r r )�self�request_validator�token_expires_in�token_generator�refresh_token_generator�args�kwargs� r) �T/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/pre_configured.pyr! s< � ������ zServer.__init__)NNN��__name__� __module__� __qualname__�__doc__r! r) r) r) r* r s �r c @ s e Zd ZdZddd�ZdS )�WebApplicationServerzLAn all-in-one endpoint featuring Authorization code grant and Bearer tokens.Nc K s� t |�| _t|�| _t||||�| _tj| dd| ji| jd� tj| d| j| jd�| jd� t j| dd| jid� t �| |� t �| |� dS ) a� Construct a new web application server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. r r r )r r r r r N) r r r r r r r r! r r r r �r" r# r% r$ r& r( r) r) r* r! N s( ����� z WebApplicationServer.__init__)NNNr+ r) r) r) r* r0 I s �r0 c @ s e Zd ZdZddd�ZdS )�MobileApplicationServerzGAn all-in-one endpoint featuring Implicit code grant and Bearer tokens.Nc K sr t |�| _t||||�| _tj| dd| ji| jd� tj| dd| jid� tj| |dgd� tj| |dgd� dS )a� Construct a new implicit grant server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. r r r r � access_token�Zsupported_token_typesN) r r r r r r! r r r r1 r) r) r* r! u s$ ������z MobileApplicationServer.__init__)NNNr+ r) r) r) r* r2 p s �r2 c @ s e Zd ZdZddd�ZdS )�LegacyApplicationServerz]An all-in-one endpoint featuring Resource Owner Password Credentials grant and Bearer tokens.Nc K st t |�| _t|�| _t||||�| _tj| d| j| jd�| jd� tj| dd| jid� t �| |� t �| |� dS )a Construct a resource owner password credentials grant server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. r )r r r r r N) r r r r r r r r! r r r r1 r) r) r* r! � s$ � ���� z LegacyApplicationServer.__init__)NNNr+ r) r) r) r* r5 � s �r5 c @ s e Zd ZdZddd�ZdS )�BackendApplicationServerzLAn all-in-one endpoint featuring Client Credentials grant and Bearer tokens.Nc K sr t |�| _t||||�| _tj| dd| ji| jd� tj| dd| jid� tj| |dgd� tj| |dgd� dS )a� Construct a client credentials grant server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. r r r r r3 r4 N) r r r r r r! r r r r1 r) r) r* r! � s$ ������z!BackendApplicationServer.__init__)NNNr+ r) r) r) r* r6 � s �r6 N)r/ r r r r r r �tokensr Z authorizationr Z introspectr �resourcer Z revocationr r r r r0 r2 r5 r6 r) r) r) r* �<module> s, �5�'�#�%� oauth2/rfc6749/endpoints/__pycache__/token.cpython-39.opt-1.pyc 0000644 00000010325 15125174064 0020003 0 ustar 00 a \��`� � @ sR d Z ddlZddlmZ ddlmZ ddlmZmZ e� e �Z G dd� de�Z dS ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N)�Request)�utils� )� BaseEndpoint� catch_errors_and_unavailabilityc @ sb e Zd ZdZdZdd� Zedd� �Zedd� �Zed d � �Z ed d � �Z e ddd��Z dd� Z dS )� TokenEndpointa� Token issuing endpoint. The token endpoint is used by the client to obtain an access token by presenting its authorization grant or refresh token. The token endpoint is used with every authorization grant except for the implicit grant type (since an access token is issued directly). The means through which the client obtains the location of the token endpoint are beyond the scope of this specification, but the location is typically provided in the service documentation. The endpoint URI MAY include an "application/x-www-form-urlencoded" formatted (per `Appendix B`_) query component, which MUST be retained when adding additional query parameters. The endpoint URI MUST NOT include a fragment component:: https://example.com/path?query=component # OK https://example.com/path?query=component#fragment # Not OK Since requests to the token endpoint result in the transmission of clear-text credentials (in the HTTP request and response), the authorization server MUST require the use of TLS as described in Section 1.6 when sending requests to the token endpoint:: # We will deny any request which URI schema is not with https The client MUST use the HTTP "POST" method when making access token requests:: # HTTP method is currently not enforced Parameters sent without a value MUST be treated as if they were omitted from the request. The authorization server MUST ignore unrecognized request parameters. Request and response parameters MUST NOT be included more than once:: # Delegated to each grant type. .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B )�POSTc C s t �| � || _|| _|| _d S �N)r �__init__� _grant_types�_default_token_type�_default_grant_type)�self�default_grant_type�default_token_type� grant_types� r �K/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/token.pyr ? s zTokenEndpoint.__init__c C s | j S r )r �r r r r r E s zTokenEndpoint.grant_typesc C s | j S r )r r r r r r I s z TokenEndpoint.default_grant_typec C s | j �| j�S r )r �getr r r r r �default_grant_type_handlerM s z(TokenEndpoint.default_grant_type_handlerc C s | j S r )r r r r r r Q s z TokenEndpoint.default_token_typer Nc C sr t ||||d�}| �|� t�|j�|_||_|r8||_|rB||_| j � |j| j �} t � d|j| � | �|| j�S )z7Extract grant_type and route to the designated handler.)� http_method�body�headersz(Dispatching grant_type %s request to %r.)r �validate_token_requestr Z scope_to_listZscopeZscopesZextra_credentialsZ grant_type�claimsr r r �log�debug�create_token_responser ) r Zurir r r Z credentialsZgrant_type_for_scoper �requestZgrant_type_handlerr r r r U s& � ���z#TokenEndpoint.create_token_responsec C s | � |� | �|� d S r )Z_raise_on_bad_methodZ_raise_on_bad_post_request)r r r r r r u s z$TokenEndpoint.validate_token_request)r NNNNN)�__name__� __module__� __qualname__�__doc__Zvalid_request_methodsr �propertyr r r r r r r r r r r r s" ) � r ) r# ZloggingZoauthlib.commonr Zoauthlib.oauth2.rfc6749r �baser r Z getLoggerr r r r r r r �<module> s oauth2/rfc6749/endpoints/__pycache__/authorization.cpython-39.opt-1.pyc 0000644 00000011000 15125174064 0021552 0 ustar 00 a \��`� � @ sR d Z ddlZddlmZ ddlmZ ddlmZmZ e� e �Z G dd� de�Z dS ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N)�Request)�utils� )� BaseEndpoint� catch_errors_and_unavailabilityc @ sd e Zd ZdZdd� Zedd� �Zedd� �Zedd � �Zed d � �Z e ddd��Z e ddd��Z d S )�AuthorizationEndpointaa Authorization endpoint - used by the client to obtain authorization from the resource owner via user-agent redirection. The authorization endpoint is used to interact with the resource owner and obtain an authorization grant. The authorization server MUST first verify the identity of the resource owner. The way in which the authorization server authenticates the resource owner (e.g. username and password login, session cookies) is beyond the scope of this specification. The endpoint URI MAY include an "application/x-www-form-urlencoded" formatted (per `Appendix B`_) query component, which MUST be retained when adding additional query parameters. The endpoint URI MUST NOT include a fragment component:: https://example.com/path?query=component # OK https://example.com/path?query=component#fragment # Not OK Since requests to the authorization endpoint result in user authentication and the transmission of clear-text credentials (in the HTTP response), the authorization server MUST require the use of TLS as described in Section 1.6 when sending requests to the authorization endpoint:: # We will deny any request which URI schema is not with https The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint, and MAY support the use of the "POST" method as well:: # HTTP method is currently not enforced Parameters sent without a value MUST be treated as if they were omitted from the request. The authorization server MUST ignore unrecognized request parameters. Request and response parameters MUST NOT be included more than once:: # Enforced through the design of oauthlib.common.Request .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B c C s t �| � || _|| _|| _d S �N)r �__init__�_response_types�_default_response_type�_default_token_type)�self�default_response_type�default_token_type�response_types� r �S/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/authorization.pyr > s z AuthorizationEndpoint.__init__c C s | j S r )r �r r r r r E s z$AuthorizationEndpoint.response_typesc C s | j S r )r r r r r r I s z+AuthorizationEndpoint.default_response_typec C s | j �| j�S r )r �getr r r r r � default_response_type_handlerM s z3AuthorizationEndpoint.default_response_type_handlerc C s | j S r )r r r r r r Q s z(AuthorizationEndpoint.default_token_type�GETNc C sn t ||||d�}||_d|_|p"i �� D ]\}} t||| � q(| j�|j| j�} t � d|j| � | � || j �S )�:Extract response_type and route to the designated handler.�� http_method�body�headersNz+Dispatching response_type %s request to %r.) r �scopes�user�items�setattrr r � response_typer �log�debug� create_authorization_responser ) r �urir r r r Z credentials�request�k�v�response_type_handlerr r r r# U s ����z3AuthorizationEndpoint.create_authorization_responsec C s: t ||||d�}t�|j�|_| j�|j| j�}|� |�S )r r ) r r Z scope_to_listZscoper r r r r � validate_authorization_request)r r$ r r r r% r( r r r r) g s ��z4AuthorizationEndpoint.validate_authorization_request)r NNNN)r NN) �__name__� __module__� __qualname__�__doc__r �propertyr r r r r r# r) r r r r r s$ * � �r ) r- ZloggingZoauthlib.commonr Zoauthlib.oauth2.rfc6749r �baser r Z getLoggerr* r! r r r r r �<module> s oauth2/rfc6749/endpoints/__pycache__/metadata.cpython-39.opt-1.pyc 0000644 00000021054 15125174064 0020444 0 ustar 00 a \��`�( � @ s� d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z m Z ddl m Z dd l mZ dd lmZ e�e�ZG d d � d e �ZdS ) z� oauthlib.oauth2.rfc6749.endpoint.metadata ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ An implementation of the `OAuth 2.0 Authorization Server Metadata`. .. _`OAuth 2.0 Authorization Server Metadata`: https://tools.ietf.org/html/rfc8414 � N� )� grant_types� )�AuthorizationEndpoint)� BaseEndpoint� catch_errors_and_unavailability)�IntrospectEndpoint)�RevocationEndpoint)� TokenEndpointc @ s^ e Zd ZdZi dfdd�Zeddd��Zdd d �Zd d � Zdd� Z dd� Z dd� Z dd� Z dS )�MetadataEndpointa� OAuth2.0 Authorization Server Metadata endpoint. This specification generalizes the metadata format defined by `OpenID Connect Discovery 1.0` in a way that is compatible with OpenID Connect Discovery while being applicable to a wider set of OAuth 2.0 use cases. This is intentionally parallel to the way that OAuth 2.0 Dynamic Client Registration Protocol [`RFC7591`_] generalized the dynamic client registration mechanisms defined by OpenID Connect Dynamic Client Registration 1.0 in a way that is compatible with it. .. _`OpenID Connect Discovery 1.0`: https://openid.net/specs/openid-connect-discovery-1_0.html .. _`RFC7591`: https://tools.ietf.org/html/rfc7591 Tc C s4 |D ]}qt �| � || _|| _|| _| �� | _d S )N)r �__init__� raise_errors� endpoints�initial_claims�validate_metadata_server�claims)�selfr r r �endpoint� r �N/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/metadata.pyr ( s zMetadataEndpoint.__init__�GETNc C s ddi}|t �| j�dfS )z!Create metadata response z Content-Typezapplication/json�� )�json�dumpsr )r ZuriZ http_method�bodyZheadersr r r �create_metadata_response3 s �z)MetadataEndpoint.create_metadata_responseFc C s | j s d S ||vr&|r$td�|���n�|r�|| �d�sLtd�||| ���d|| v spd|| v spd|| v r�td�||| ���n~|r�|| �d�s�td �||| ���nV|�rt|| t�s�td �||| ���|| D ]$}t|t�s�td �||| |���q�d S ) Nz key {} is a mandatory metadata.�httpsz key {}: {} must be an HTTPS URL�?�&�#z8key {}: {} must not contain query or fragment components�httpzkey {}: {} must be an URLzkey {}: {} must be an Arrayz/array {}: {} must contains only string (not {}))r � ValueError�format� startswith� isinstance�list�str)r Zarray�key� is_required�is_list�is_url� is_issuer�elemr r r �validate_metadata= s& $ z"MetadataEndpoint.validate_metadatac C sX | j �|j �� � |�dddg� | j|ddd� | j|ddd� | j|dddd� d S ) z� If the token endpoint is used in the grant type, the value of this parameter MUST be the same as the value of the "grant_type" parameter passed to the token endpoint defined in the grant type definition. Z%token_endpoint_auth_methods_supported�client_secret_post�client_secret_basicT�r) Z0token_endpoint_auth_signing_alg_values_supportedZtoken_endpoint�r( r* N)� _grant_types�extend�keys� setdefaultr- �r r r r r r �validate_metadata_tokenV s z(MetadataEndpoint.validate_metadata_tokenc C s� |� dttdd� |j�� ��� |� dddg� d|d v rH| j�d� | j|dd d d � | j|dd d � d |d v r�|jd }t|t j �s�t |d �r�|j }|� dt|j �� �� | j|dd d � | j|dd d d� d S )NZresponse_types_supportedc S s | dkS )NZnoner )�xr r r �<lambda>f � zBMetadataEndpoint.validate_metadata_authorization.<locals>.<lambda>Zresponse_modes_supported�query�fragment�tokenZimplicitT)r( r) r0 �code� default_grantZ code_challenge_methods_supportedZauthorization_endpointr1 )r5 r% �filterZ_response_typesr4 r2 �appendr- r$ r ZAuthorizationCodeGrant�hasattrr? Z_code_challenge_methods)r r r Z code_grantr r r � validate_metadata_authorizationd s" � �z0MetadataEndpoint.validate_metadata_authorizationc C sF |� dddg� | j|ddd� | j|ddd� | j|dddd� d S ) NZ*revocation_endpoint_auth_methods_supportedr. r/ Tr0 Z5revocation_endpoint_auth_signing_alg_values_supportedZrevocation_endpointr1 �r5 r- r6 r r r � validate_metadata_revocation{ s �z-MetadataEndpoint.validate_metadata_revocationc C sF |� dddg� | j|ddd� | j|ddd� | j|dddd� d S ) NZ-introspection_endpoint_auth_methods_supportedr. r/ Tr0 Z8introspection_endpoint_auth_signing_alg_values_supportedZintrospection_endpointr1 rD r6 r r r � validate_metadata_introspection� s �z0MetadataEndpoint.validate_metadata_introspectionc C s t �| j�}| j|dddd� | j|ddd� | j|ddd� | j|ddd� | j|d dd� | j|d dd� | j|d dd� g | _| jD ]\}t|t�r�| �||� t|t �r�| � ||� t|t �r�| � ||� t|t �r�| �||� q�|�d | j� | j|d dd� |S ) a� Authorization servers can have metadata describing their configuration. The following authorization server metadata values are used by this specification. More details can be found in `RFC8414 section 2`_ : issuer REQUIRED authorization_endpoint URL of the authorization server's authorization endpoint [`RFC6749#Authorization`_]. This is REQUIRED unless no grant types are supported that use the authorization endpoint. token_endpoint URL of the authorization server's token endpoint [`RFC6749#Token`_]. This is REQUIRED unless only the implicit grant type is supported. scopes_supported RECOMMENDED. response_types_supported REQUIRED. Other OPTIONAL fields: jwks_uri, registration_endpoint, response_modes_supported grant_types_supported OPTIONAL. JSON array containing a list of the OAuth 2.0 grant type values that this authorization server supports. The array values used are the same as those used with the "grant_types" parameter defined by "OAuth 2.0 Dynamic Client Registration Protocol" [`RFC7591`_]. If omitted, the default value is "["authorization_code", "implicit"]". token_endpoint_auth_methods_supported token_endpoint_auth_signing_alg_values_supported service_documentation ui_locales_supported op_policy_uri op_tos_uri revocation_endpoint revocation_endpoint_auth_methods_supported revocation_endpoint_auth_signing_alg_values_supported introspection_endpoint introspection_endpoint_auth_methods_supported introspection_endpoint_auth_signing_alg_values_supported code_challenge_methods_supported Additional authorization server metadata parameters MAY also be used. Some are defined by other specifications, such as OpenID Connect Discovery 1.0 [`OpenID.Discovery`_]. .. _`RFC8414 section 2`: https://tools.ietf.org/html/rfc8414#section-2 .. _`RFC6749#Authorization`: https://tools.ietf.org/html/rfc6749#section-3.1 .. _`RFC6749#Token`: https://tools.ietf.org/html/rfc6749#section-3.2 .. _`RFC7591`: https://tools.ietf.org/html/rfc7591 .. _`OpenID.Discovery`: https://openid.net/specs/openid-connect-discovery-1_0.html ZissuerT)r( r+ Zjwks_uri)r* Zscopes_supportedr0 Zservice_documentationZui_locales_supportedZ op_policy_uriZ op_tos_uriZgrant_types_supported)�copy�deepcopyr r- r2 r r$ r r7 r rC r rE r rF r5 r6 r r r r � s* J z)MetadataEndpoint.validate_metadata_server)r NN)FFFF) �__name__� __module__� __qualname__�__doc__r r r r- r7 rC rE rF r r r r r r s � r )rL rG r Zlogging� r Z authorizationr �baser r Z introspectr Z revocationr r= r Z getLoggerrI �logr r r r r �<module> s oauth2/rfc6749/endpoints/__pycache__/authorization.cpython-39.pyc 0000644 00000011000 15125174064 0020613 0 ustar 00 a \��`� � @ sR d Z ddlZddlmZ ddlmZ ddlmZmZ e� e �Z G dd� de�Z dS ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N)�Request)�utils� )� BaseEndpoint� catch_errors_and_unavailabilityc @ sd e Zd ZdZdd� Zedd� �Zedd� �Zedd � �Zed d � �Z e ddd��Z e ddd��Z d S )�AuthorizationEndpointaa Authorization endpoint - used by the client to obtain authorization from the resource owner via user-agent redirection. The authorization endpoint is used to interact with the resource owner and obtain an authorization grant. The authorization server MUST first verify the identity of the resource owner. The way in which the authorization server authenticates the resource owner (e.g. username and password login, session cookies) is beyond the scope of this specification. The endpoint URI MAY include an "application/x-www-form-urlencoded" formatted (per `Appendix B`_) query component, which MUST be retained when adding additional query parameters. The endpoint URI MUST NOT include a fragment component:: https://example.com/path?query=component # OK https://example.com/path?query=component#fragment # Not OK Since requests to the authorization endpoint result in user authentication and the transmission of clear-text credentials (in the HTTP response), the authorization server MUST require the use of TLS as described in Section 1.6 when sending requests to the authorization endpoint:: # We will deny any request which URI schema is not with https The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint, and MAY support the use of the "POST" method as well:: # HTTP method is currently not enforced Parameters sent without a value MUST be treated as if they were omitted from the request. The authorization server MUST ignore unrecognized request parameters. Request and response parameters MUST NOT be included more than once:: # Enforced through the design of oauthlib.common.Request .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B c C s t �| � || _|| _|| _d S �N)r �__init__�_response_types�_default_response_type�_default_token_type)�self�default_response_type�default_token_type�response_types� r �S/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/authorization.pyr > s z AuthorizationEndpoint.__init__c C s | j S r )r �r r r r r E s z$AuthorizationEndpoint.response_typesc C s | j S r )r r r r r r I s z+AuthorizationEndpoint.default_response_typec C s | j �| j�S r )r �getr r r r r � default_response_type_handlerM s z3AuthorizationEndpoint.default_response_type_handlerc C s | j S r )r r r r r r Q s z(AuthorizationEndpoint.default_token_type�GETNc C sn t ||||d�}||_d|_|p"i �� D ]\}} t||| � q(| j�|j| j�} t � d|j| � | � || j �S )�:Extract response_type and route to the designated handler.�� http_method�body�headersNz+Dispatching response_type %s request to %r.) r �scopes�user�items�setattrr r � response_typer �log�debug� create_authorization_responser ) r �urir r r r Z credentials�request�k�v�response_type_handlerr r r r# U s ����z3AuthorizationEndpoint.create_authorization_responsec C s: t ||||d�}t�|j�|_| j�|j| j�}|� |�S )r r ) r r Z scope_to_listZscoper r r r r � validate_authorization_request)r r$ r r r r% r( r r r r) g s ��z4AuthorizationEndpoint.validate_authorization_request)r NNNN)r NN) �__name__� __module__� __qualname__�__doc__r �propertyr r r r r r# r) r r r r r s$ * � �r ) r- ZloggingZoauthlib.commonr Zoauthlib.oauth2.rfc6749r �baser r Z getLoggerr* r! r r r r r �<module> s oauth2/rfc6749/endpoints/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000001471 15125174064 0020424 0 ustar 00 a \��`) � @ sl d Z ddlmZ ddlmZ ddlmZ ddlmZm Z m Z m Z m Z ddl mZ ddlmZ ddlmZ d S ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � )�AuthorizationEndpoint)�IntrospectEndpoint)�MetadataEndpoint)�BackendApplicationServer�LegacyApplicationServer�MobileApplicationServer�Server�WebApplicationServer)�ResourceEndpoint)�RevocationEndpoint)� TokenEndpointN)�__doc__Z authorizationr Z introspectr �metadatar Zpre_configuredr r r r r �resourcer Z revocationr �tokenr � r r �N/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/__init__.py�<module> s oauth2/rfc6749/endpoints/__pycache__/pre_configured.cpython-39.opt-1.pyc 0000644 00000020107 15125174064 0021655 0 ustar 00 a \��`�. � @ s� d Z ddlmZmZmZmZmZ ddlmZ ddl m Z ddl m Z ddl mZ ddlmZ dd lmZ G d d � d e e eee�ZG d d � d e e eee�ZG dd� de e ee�ZG dd� dee ee�ZG dd� dee ee�ZdS )z� oauthlib.oauth2.rfc6749.endpoints.pre_configured ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various endpoints needed for providing OAuth 2.0 RFC6749 servers. � )�AuthorizationCodeGrant�ClientCredentialsGrant� ImplicitGrant�RefreshTokenGrant�%ResourceOwnerPasswordCredentialsGrant)� BearerToken� )�AuthorizationEndpoint)�IntrospectEndpoint)�ResourceEndpoint)�RevocationEndpoint)� TokenEndpointc @ s e Zd ZdZddd�ZdS )�Serverz<An all-in-one endpoint featuring all four major grant types.Nc O s� t |�| _t|�| _t|�| _t|�| _t|�| _ t ||||�| _ t j | d| j| j| jd�| j d� tj | d| j| j| j| j d�| j d� tj | dd| j id� t� | |� t� | |� d S ) a� Construct a new all-grants-in-one server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. �code)r �tokenZnone�Zdefault_response_typeZresponse_types�default_token_type�authorization_code)r �password�client_credentials� refresh_token�Zdefault_grant_type� grant_typesr �Bearer�Z default_tokenZ token_typesN)r � auth_grantr �implicit_grantr �password_grantr �credentials_grantr � refresh_grantr �bearerr �__init__r r r r )�self�request_validator�token_expires_in�token_generator�refresh_token_generator�args�kwargs� r) �T/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/pre_configured.pyr! s< � ������ zServer.__init__)NNN��__name__� __module__� __qualname__�__doc__r! r) r) r) r* r s �r c @ s e Zd ZdZddd�ZdS )�WebApplicationServerzLAn all-in-one endpoint featuring Authorization code grant and Bearer tokens.Nc K s� t |�| _t|�| _t||||�| _tj| dd| ji| jd� tj| d| j| jd�| jd� t j| dd| jid� t �| |� t �| |� dS ) a� Construct a new web application server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. r r r )r r r r r N) r r r r r r r r! r r r r �r" r# r% r$ r& r( r) r) r* r! N s( ����� z WebApplicationServer.__init__)NNNr+ r) r) r) r* r0 I s �r0 c @ s e Zd ZdZddd�ZdS )�MobileApplicationServerzGAn all-in-one endpoint featuring Implicit code grant and Bearer tokens.Nc K sr t |�| _t||||�| _tj| dd| ji| jd� tj| dd| jid� tj| |dgd� tj| |dgd� dS )a� Construct a new implicit grant server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. r r r r � access_token�Zsupported_token_typesN) r r r r r r! r r r r1 r) r) r* r! u s$ ������z MobileApplicationServer.__init__)NNNr+ r) r) r) r* r2 p s �r2 c @ s e Zd ZdZddd�ZdS )�LegacyApplicationServerz]An all-in-one endpoint featuring Resource Owner Password Credentials grant and Bearer tokens.Nc K st t |�| _t|�| _t||||�| _tj| d| j| jd�| jd� tj| dd| jid� t �| |� t �| |� dS )a Construct a resource owner password credentials grant server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. r )r r r r r N) r r r r r r r r! r r r r1 r) r) r* r! � s$ � ���� z LegacyApplicationServer.__init__)NNNr+ r) r) r) r* r5 � s �r5 c @ s e Zd ZdZddd�ZdS )�BackendApplicationServerzLAn all-in-one endpoint featuring Client Credentials grant and Bearer tokens.Nc K sr t |�| _t||||�| _tj| dd| ji| jd� tj| dd| jid� tj| |dgd� tj| |dgd� dS )a� Construct a client credentials grant server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. r r r r r3 r4 N) r r r r r r! r r r r1 r) r) r* r! � s$ ������z!BackendApplicationServer.__init__)NNNr+ r) r) r) r* r6 � s �r6 N)r/ r r r r r r �tokensr Z authorizationr Z introspectr �resourcer Z revocationr r r r r0 r2 r5 r6 r) r) r) r* �<module> s, �5�'�#�%� oauth2/rfc6749/endpoints/__pycache__/metadata.cpython-39.pyc 0000644 00000021125 15125174064 0017504 0 ustar 00 a \��`�( � @ s� d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z m Z ddl m Z dd l mZ dd lmZ e�e�ZG d d � d e �ZdS ) z� oauthlib.oauth2.rfc6749.endpoint.metadata ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ An implementation of the `OAuth 2.0 Authorization Server Metadata`. .. _`OAuth 2.0 Authorization Server Metadata`: https://tools.ietf.org/html/rfc8414 � N� )� grant_types� )�AuthorizationEndpoint)� BaseEndpoint� catch_errors_and_unavailability)�IntrospectEndpoint)�RevocationEndpoint)� TokenEndpointc @ s^ e Zd ZdZi dfdd�Zeddd��Zdd d �Zd d � Zdd� Z dd� Z dd� Z dd� Z dS )�MetadataEndpointa� OAuth2.0 Authorization Server Metadata endpoint. This specification generalizes the metadata format defined by `OpenID Connect Discovery 1.0` in a way that is compatible with OpenID Connect Discovery while being applicable to a wider set of OAuth 2.0 use cases. This is intentionally parallel to the way that OAuth 2.0 Dynamic Client Registration Protocol [`RFC7591`_] generalized the dynamic client registration mechanisms defined by OpenID Connect Dynamic Client Registration 1.0 in a way that is compatible with it. .. _`OpenID Connect Discovery 1.0`: https://openid.net/specs/openid-connect-discovery-1_0.html .. _`RFC7591`: https://tools.ietf.org/html/rfc7591 Tc C sP t |t�sJ �|D ]}t |t�sJ �qt�| � || _|| _|| _| �� | _d S )N) � isinstance�dictr �__init__� raise_errors� endpoints�initial_claims�validate_metadata_server�claims)�selfr r r �endpoint� r �N/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/metadata.pyr ( s zMetadataEndpoint.__init__�GETNc C s ddi}|t �| j�dfS )z!Create metadata response z Content-Typezapplication/json�� )�json�dumpsr )r ZuriZ http_method�bodyZheadersr r r �create_metadata_response3 s �z)MetadataEndpoint.create_metadata_responseFc C s | j s d S ||vr&|r$td�|���n�|r�|| �d�sLtd�||| ���d|| v spd|| v spd|| v r�td�||| ���n~|r�|| �d�s�td �||| ���nV|�rt|| t�s�td �||| ���|| D ]$}t|t�s�td �||| |���q�d S ) Nz key {} is a mandatory metadata.�httpsz key {}: {} must be an HTTPS URL�?�&�#z8key {}: {} must not contain query or fragment components�httpzkey {}: {} must be an URLzkey {}: {} must be an Arrayz/array {}: {} must contains only string (not {}))r � ValueError�format� startswithr �list�str)r Zarray�key� is_required�is_list�is_url� is_issuer�elemr r r �validate_metadata= s& $ z"MetadataEndpoint.validate_metadatac C sX | j �|j �� � |�dddg� | j|ddd� | j|ddd� | j|dddd� d S ) z� If the token endpoint is used in the grant type, the value of this parameter MUST be the same as the value of the "grant_type" parameter passed to the token endpoint defined in the grant type definition. Z%token_endpoint_auth_methods_supported�client_secret_post�client_secret_basicT�r* Z0token_endpoint_auth_signing_alg_values_supportedZtoken_endpoint�r) r+ N)� _grant_types�extend�keys� setdefaultr. �r r r r r r �validate_metadata_tokenV s z(MetadataEndpoint.validate_metadata_tokenc C s� |� dttdd� |j�� ��� |� dddg� d|d v rH| j�d� | j|dd d d � | j|dd d � d |d v r�|jd }t|t j �s�t |d �r�|j }|� dt|j �� �� | j|dd d � | j|dd d d� d S )NZresponse_types_supportedc S s | dkS )NZnoner )�xr r r �<lambda>f � zBMetadataEndpoint.validate_metadata_authorization.<locals>.<lambda>Zresponse_modes_supported�query�fragment�tokenZimplicitT)r) r* r1 �code� default_grantZ code_challenge_methods_supportedZauthorization_endpointr2 )r6 r& �filterZ_response_typesr5 r3 �appendr. r r ZAuthorizationCodeGrant�hasattrr@ Z_code_challenge_methods)r r r Z code_grantr r r � validate_metadata_authorizationd s" � �z0MetadataEndpoint.validate_metadata_authorizationc C sF |� dddg� | j|ddd� | j|ddd� | j|dddd� d S ) NZ*revocation_endpoint_auth_methods_supportedr/ r0 Tr1 Z5revocation_endpoint_auth_signing_alg_values_supportedZrevocation_endpointr2 �r6 r. r7 r r r � validate_metadata_revocation{ s �z-MetadataEndpoint.validate_metadata_revocationc C sF |� dddg� | j|ddd� | j|ddd� | j|dddd� d S ) NZ-introspection_endpoint_auth_methods_supportedr/ r0 Tr1 Z8introspection_endpoint_auth_signing_alg_values_supportedZintrospection_endpointr2 rE r7 r r r � validate_metadata_introspection� s �z0MetadataEndpoint.validate_metadata_introspectionc C s t �| j�}| j|dddd� | j|ddd� | j|ddd� | j|ddd� | j|d dd� | j|d dd� | j|d dd� g | _| jD ]\}t|t�r�| �||� t|t �r�| � ||� t|t �r�| � ||� t|t �r�| �||� q�|�d | j� | j|d dd� |S ) a� Authorization servers can have metadata describing their configuration. The following authorization server metadata values are used by this specification. More details can be found in `RFC8414 section 2`_ : issuer REQUIRED authorization_endpoint URL of the authorization server's authorization endpoint [`RFC6749#Authorization`_]. This is REQUIRED unless no grant types are supported that use the authorization endpoint. token_endpoint URL of the authorization server's token endpoint [`RFC6749#Token`_]. This is REQUIRED unless only the implicit grant type is supported. scopes_supported RECOMMENDED. response_types_supported REQUIRED. Other OPTIONAL fields: jwks_uri, registration_endpoint, response_modes_supported grant_types_supported OPTIONAL. JSON array containing a list of the OAuth 2.0 grant type values that this authorization server supports. The array values used are the same as those used with the "grant_types" parameter defined by "OAuth 2.0 Dynamic Client Registration Protocol" [`RFC7591`_]. If omitted, the default value is "["authorization_code", "implicit"]". token_endpoint_auth_methods_supported token_endpoint_auth_signing_alg_values_supported service_documentation ui_locales_supported op_policy_uri op_tos_uri revocation_endpoint revocation_endpoint_auth_methods_supported revocation_endpoint_auth_signing_alg_values_supported introspection_endpoint introspection_endpoint_auth_methods_supported introspection_endpoint_auth_signing_alg_values_supported code_challenge_methods_supported Additional authorization server metadata parameters MAY also be used. Some are defined by other specifications, such as OpenID Connect Discovery 1.0 [`OpenID.Discovery`_]. .. _`RFC8414 section 2`: https://tools.ietf.org/html/rfc8414#section-2 .. _`RFC6749#Authorization`: https://tools.ietf.org/html/rfc6749#section-3.1 .. _`RFC6749#Token`: https://tools.ietf.org/html/rfc6749#section-3.2 .. _`RFC7591`: https://tools.ietf.org/html/rfc7591 .. _`OpenID.Discovery`: https://openid.net/specs/openid-connect-discovery-1_0.html ZissuerT)r) r, Zjwks_uri)r+ Zscopes_supportedr1 Zservice_documentationZui_locales_supportedZ op_policy_uriZ op_tos_uriZgrant_types_supported)�copy�deepcopyr r. r3 r r r r8 r rD r rF r rG r6 r7 r r r r � s* J z)MetadataEndpoint.validate_metadata_server)r NN)FFFF) �__name__� __module__� __qualname__�__doc__r r r r. r8 rD rF rG r r r r r r s � r )rM rH r Zlogging� r Z authorizationr �baser r Z introspectr Z revocationr r> r Z getLoggerrJ �logr r r r r �<module> s oauth2/rfc6749/endpoints/__pycache__/token.cpython-39.pyc 0000644 00000010325 15125174064 0017044 0 ustar 00 a \��`� � @ sR d Z ddlZddlmZ ddlmZ ddlmZmZ e� e �Z G dd� de�Z dS ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N)�Request)�utils� )� BaseEndpoint� catch_errors_and_unavailabilityc @ sb e Zd ZdZdZdd� Zedd� �Zedd� �Zed d � �Z ed d � �Z e ddd��Z dd� Z dS )� TokenEndpointa� Token issuing endpoint. The token endpoint is used by the client to obtain an access token by presenting its authorization grant or refresh token. The token endpoint is used with every authorization grant except for the implicit grant type (since an access token is issued directly). The means through which the client obtains the location of the token endpoint are beyond the scope of this specification, but the location is typically provided in the service documentation. The endpoint URI MAY include an "application/x-www-form-urlencoded" formatted (per `Appendix B`_) query component, which MUST be retained when adding additional query parameters. The endpoint URI MUST NOT include a fragment component:: https://example.com/path?query=component # OK https://example.com/path?query=component#fragment # Not OK Since requests to the token endpoint result in the transmission of clear-text credentials (in the HTTP request and response), the authorization server MUST require the use of TLS as described in Section 1.6 when sending requests to the token endpoint:: # We will deny any request which URI schema is not with https The client MUST use the HTTP "POST" method when making access token requests:: # HTTP method is currently not enforced Parameters sent without a value MUST be treated as if they were omitted from the request. The authorization server MUST ignore unrecognized request parameters. Request and response parameters MUST NOT be included more than once:: # Delegated to each grant type. .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B )�POSTc C s t �| � || _|| _|| _d S �N)r �__init__� _grant_types�_default_token_type�_default_grant_type)�self�default_grant_type�default_token_type� grant_types� r �K/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/token.pyr ? s zTokenEndpoint.__init__c C s | j S r )r �r r r r r E s zTokenEndpoint.grant_typesc C s | j S r )r r r r r r I s z TokenEndpoint.default_grant_typec C s | j �| j�S r )r �getr r r r r �default_grant_type_handlerM s z(TokenEndpoint.default_grant_type_handlerc C s | j S r )r r r r r r Q s z TokenEndpoint.default_token_typer Nc C sr t ||||d�}| �|� t�|j�|_||_|r8||_|rB||_| j � |j| j �} t � d|j| � | �|| j�S )z7Extract grant_type and route to the designated handler.)� http_method�body�headersz(Dispatching grant_type %s request to %r.)r �validate_token_requestr Z scope_to_listZscopeZscopesZextra_credentialsZ grant_type�claimsr r r �log�debug�create_token_responser ) r Zurir r r Z credentialsZgrant_type_for_scoper �requestZgrant_type_handlerr r r r U s& � ���z#TokenEndpoint.create_token_responsec C s | � |� | �|� d S r )Z_raise_on_bad_methodZ_raise_on_bad_post_request)r r r r r r u s z$TokenEndpoint.validate_token_request)r NNNNN)�__name__� __module__� __qualname__�__doc__Zvalid_request_methodsr �propertyr r r r r r r r r r r r s" ) � r ) r# ZloggingZoauthlib.commonr Zoauthlib.oauth2.rfc6749r �baser r Z getLoggerr r r r r r r �<module> s oauth2/rfc6749/endpoints/__pycache__/base.cpython-39.pyc 0000644 00000010502 15125174064 0016633 0 ustar 00 a \��`" � @ s\ d Z ddlZddlZddlmZmZmZmZmZm Z m Z e� e �Z G dd� d�Zdd� ZdS ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N� )�FatalClientError�InvalidClientError�InvalidRequestError� OAuth2Error� ServerError�TemporarilyUnavailableError�UnsupportedTokenTypeErrorc @ s� e Zd Zdd� Zedd� �Zejdd� �Zedd� �Zejdd� �Zed d � �Zejd d � �Zd d � Z dd� Z dd� Z dd� Z dd� Z dS )� BaseEndpointc C s d| _ d| _d | _d S )NTF)� _available� _catch_errors�_valid_request_methods��self� r �J/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/base.py�__init__ s zBaseEndpoint.__init__c C s | j S �N�r r r r r �valid_request_methods s z"BaseEndpoint.valid_request_methodsc C s |d urdd� |D �}|| _ d S )Nc S s g | ] }|� � �qS r )�upper)�.0�xr r r � <listcomp>! � z6BaseEndpoint.valid_request_methods.<locals>.<listcomp>r )r r r r r r s c C s | j S r �r r r r r � available% s zBaseEndpoint.availablec C s || _ d S r r )r r r r r r ) s c C s | j S r �r r r r r � catch_errors- s zBaseEndpoint.catch_errorsc C s || _ d S r r )r r r r r r 1 s c C s |j st|dd��dS )z Raise error on missing token.zMissing token parameter.��request� descriptionN)�tokenr �r r r r r �_raise_on_missing_token5 s �z$BaseEndpoint._raise_on_missing_tokenc C sZ | j �|�r0| j �|�sVt�d|� t|d��n&| j �|j|�sVt�d|� t|d��dS )z&Raise on failed client authentication.z!Client authentication failed, %r.�r N)Zrequest_validatorZ client_authentication_requiredZauthenticate_client�log�debugr Zauthenticate_client_idZ client_idr# r r r �_raise_on_invalid_client: s z%BaseEndpoint._raise_on_invalid_clientc C s, |j r(|j | jv r(|j | jvr(t|d��dS )z Raise on unsupported tokens.r% N)Ztoken_type_hintZvalid_token_typesZsupported_token_typesr r# r r r �_raise_on_unsupported_tokenD s � �z(BaseEndpoint._raise_on_unsupported_tokenc C s< | j d u rtd��|j�� | j vr8t|d|j�� d��d S )Nz0Configure "valid_request_methods" property firstz Unsupported request method %sr )r � ValueError� http_methodr r r# r r r �_raise_on_bad_methodK s �z!BaseEndpoint._raise_on_bad_methodc C s, |j �� dkr(|jpd}|r(t|dd��dS )z/Raise if invalid POST request received ZPOST� z$URL query parameters are not allowedr N)r+ r Z uri_queryr )r r Z query_paramsr r r �_raise_on_bad_post_requestR s �z'BaseEndpoint._raise_on_bad_post_requestN)�__name__� __module__� __qualname__r �propertyr �setterr r r$ r( r) r, r. r r r r r s$ r c s t �� �� fdd��}|S )Nc s� | j s&t� }t�d| � i |jdfS | jr�z� | |g|�R i |��W S tyZ � Y q� tyl � Y q� ty� } z,t � }t� d| � i |jdfW Y d }~S d }~0 0 n� | |g|�R i |��S d S )Nz*Endpoint unavailable, ignoring request %s.i� z.Exception caught while processing request, %s.i� ) r r r& �infoZjsonr r r � Exceptionr Zwarning)ZendpointZuri�args�kwargs�e�error��fr r �wrapper\ s$ �$z0catch_errors_and_unavailability.<locals>.wrapper)� functools�wraps)r; r< r r: r � catch_errors_and_unavailability[ s r? )�__doc__r= Zlogging�errorsr r r r r r r Z getLoggerr/ r& r r? r r r r �<module> s $ H oauth2/rfc6749/endpoints/__pycache__/revocation.cpython-39.opt-1.pyc 0000644 00000012022 15125174064 0021030 0 ustar 00 a \��`\ � @ sR d Z ddlZddlmZ ddlmZ ddlmZmZ e� e �Z G dd � d e�Z dS ) z� oauthlib.oauth2.rfc6749.endpoint.revocation ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ An implementation of the OAuth 2 `Token Revocation`_ spec (draft 11). .. _`Token Revocation`: https://tools.ietf.org/html/draft-ietf-oauth-revocation-11 � N)�Request� )� OAuth2Error� )� BaseEndpoint� catch_errors_and_unavailabilityc @ s8 e Zd ZdZdZdZd dd�Zedd d ��Zd d � Z dS )�RevocationEndpointz�Token revocation endpoint. Endpoint used by authenticated clients to revoke access and refresh tokens. Commonly this will be part of the Authorization Endpoint. )Z access_tokenZ refresh_token)�POSTNFc C s& t �| � || _|p| j| _|| _d S )N)r �__init__�request_validator�valid_token_types�supported_token_types� enable_jsonp)�selfr r r � r �P/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/revocation.pyr s �zRevocationEndpoint.__init__r c C s� dddd�}t ||||d�}z| �|� t�d|� W nj ty� } zRt�d||� |j}| jrt|jrtd�|j|�}|� |j � |||j fW Y d }~S d }~0 0 | j � |j|j|� d }| jr�|jr�|jd }i |d fS ) a� Revoke supplied access or refresh token. The authorization server responds with HTTP status code 200 if the token has been revoked sucessfully or if the client submitted an invalid token. Note: invalid tokens do not cause an error response since the client cannot handle such an error in a reasonable way. Moreover, the purpose of the revocation request, invalidating the particular token, is already achieved. The content of the response body is ignored by the client as all necessary information is conveyed in the response code. An invalid token type hint value is ignored by the authorization server and does not influence the revocation response. zapplication/jsonzno-storezno-cache)z Content-Typez Cache-ControlZPragma)� http_method�body�headersz Token revocation valid for %r.z)Client error during validation of %r. %r.z{}({});N� z();�� )r �validate_revocation_request�log�debugr Zjsonr �callback�format�updater Z status_coder Z revoke_token�tokenZtoken_type_hint) r Zurir r r Z resp_headers�request�eZ response_bodyr r r �create_revocation_response& s0 �� " � z-RevocationEndpoint.create_revocation_responsec C s6 | � |� | �|� | �|� | �|� | �|� dS )a Ensure the request is valid. The client constructs the request by including the following parameters using the "application/x-www-form-urlencoded" format in the HTTP request entity-body: token (REQUIRED). The token that the client wants to get revoked. token_type_hint (OPTIONAL). A hint about the type of the token submitted for revocation. Clients MAY pass this parameter in order to help the authorization server to optimize the token lookup. If the server is unable to locate the token using the given hint, it MUST extend its search accross all of its supported token types. An authorization server MAY ignore this parameter, particularly if it is able to detect the token type automatically. This specification defines two such values: * access_token: An Access Token as defined in [RFC6749], `section 1.4`_ * refresh_token: A Refresh Token as defined in [RFC6749], `section 1.5`_ Specific implementations, profiles, and extensions of this specification MAY define other values for this parameter using the registry defined in `Section 4.1.2`_. The client also includes its authentication credentials as described in `Section 2.3`_. of [`RFC6749`_]. .. _`section 1.4`: https://tools.ietf.org/html/rfc6749#section-1.4 .. _`section 1.5`: https://tools.ietf.org/html/rfc6749#section-1.5 .. _`section 2.3`: https://tools.ietf.org/html/rfc6749#section-2.3 .. _`Section 4.1.2`: https://tools.ietf.org/html/draft-ietf-oauth-revocation-11#section-4.1.2 .. _`RFC6749`: https://tools.ietf.org/html/rfc6749 N)Z_raise_on_bad_methodZ_raise_on_bad_post_requestZ_raise_on_missing_tokenZ_raise_on_invalid_clientZ_raise_on_unsupported_token)r r r r r r U s % z.RevocationEndpoint.validate_revocation_request)NF)r NN) �__name__� __module__� __qualname__�__doc__r Zvalid_request_methodsr r r r r r r r r s � � .r ) r$ ZloggingZoauthlib.commonr �errorsr �baser r Z getLoggerr! r r r r r r �<module> s oauth2/rfc6749/endpoints/__pycache__/__init__.cpython-39.pyc 0000644 00000001471 15125174064 0017465 0 ustar 00 a \��`) � @ sl d Z ddlmZ ddlmZ ddlmZ ddlmZm Z m Z m Z m Z ddl mZ ddlmZ ddlmZ d S ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � )�AuthorizationEndpoint)�IntrospectEndpoint)�MetadataEndpoint)�BackendApplicationServer�LegacyApplicationServer�MobileApplicationServer�Server�WebApplicationServer)�ResourceEndpoint)�RevocationEndpoint)� TokenEndpointN)�__doc__Z authorizationr Z introspectr �metadatar Zpre_configuredr r r r r �resourcer Z revocationr �tokenr � r r �N/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/__init__.py�<module> s oauth2/rfc6749/endpoints/__pycache__/introspect.cpython-39.opt-1.pyc 0000644 00000011723 15125174064 0021060 0 ustar 00 a \��`w � @ sZ d Z ddlZddlZddlmZ ddlmZ ddlmZm Z e� e �Z G dd � d e�Z dS ) z� oauthlib.oauth2.rfc6749.endpoint.introspect ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ An implementation of the OAuth 2.0 `Token Introspection`. .. _`Token Introspection`: https://tools.ietf.org/html/rfc7662 � N)�Request� )� OAuth2Error� )� BaseEndpoint� catch_errors_and_unavailabilityc @ s8 e Zd ZdZdZdZd dd�Zed dd ��Zd d � Z dS )�IntrospectEndpointa� Introspect token endpoint. This endpoint defines a method to query an OAuth 2.0 authorization server to determine the active state of an OAuth 2.0 token and to determine meta-information about this token. OAuth 2.0 deployments can use this method to convey information about the authorization context of the token from the authorization server to the protected resource. To prevent the values of access tokens from leaking into server-side logs via query parameters, an authorization server offering token introspection MAY disallow the use of HTTP GET on the introspection endpoint and instead require the HTTP POST method to be used at the introspection endpoint. )Z access_tokenZ refresh_token)�POSTNc C s t �| � || _|p| j| _d S )N)r �__init__�request_validator�valid_token_types�supported_token_types)�selfr r � r �P/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/endpoints/introspect.pyr ) s �zIntrospectEndpoint.__init__r c C s� dddd�}t ||||�}z| �|� t�d|� W nL ty� } z4t�d||� |�|j� ||j|jfW Y d}~S d}~0 0 | j � |j |j |�}|du r�|t� tdd ��d fS d |v r�|�d � |t� tf d d i|���d fS ) a* Create introspect valid or invalid response If the authorization server is unable to determine the state of the token without additional information, it SHOULD return an introspection response indicating the token is not active as described in Section 2.2. zapplication/jsonzno-storezno-cache)z Content-Typez Cache-ControlZPragmaz Token introspect valid for %r.z)Client error during validation of %r. %r.NF)�active�� r T)r �validate_introspect_request�log�debugr �update�headers�jsonZ status_coder Zintrospect_token�tokenZtoken_type_hint�dumps�dict�pop) r ZuriZ http_method�bodyr Z resp_headers�request�eZclaimsr r r �create_introspect_response/ s, � $� z-IntrospectEndpoint.create_introspect_responsec C s6 | � |� | �|� | �|� | �|� | �|� dS )a� Ensure the request is valid. The protected resource calls the introspection endpoint using an HTTP POST request with parameters sent as "application/x-www-form-urlencoded". token REQUIRED. The string value of the token. token_type_hint OPTIONAL. A hint about the type of the token submitted for introspection. The protected resource MAY pass this parameter to help the authorization server optimize the token lookup. If the server is unable to locate the token using the given hint, it MUST extend its search across all of its supported token types. An authorization server MAY ignore this parameter, particularly if it is able to detect the token type automatically. * access_token: An Access Token as defined in [`RFC6749`], `section 1.4`_ * refresh_token: A Refresh Token as defined in [`RFC6749`], `section 1.5`_ The introspection endpoint MAY accept other OPTIONAL parameters to provide further context to the query. For instance, an authorization server may desire to know the IP address of the client accessing the protected resource to determine if the correct client is likely to be presenting the token. The definition of this or any other parameters are outside the scope of this specification, to be defined by service documentation or extensions to this specification. .. _`section 1.4`: http://tools.ietf.org/html/rfc6749#section-1.4 .. _`section 1.5`: http://tools.ietf.org/html/rfc6749#section-1.5 .. _`RFC6749`: http://tools.ietf.org/html/rfc6749 N)Z_raise_on_bad_methodZ_raise_on_bad_post_requestZ_raise_on_missing_tokenZ_raise_on_invalid_clientZ_raise_on_unsupported_token)r r r r r r R s $ z.IntrospectEndpoint.validate_introspect_request)N)r NN) �__name__� __module__� __qualname__�__doc__r Zvalid_request_methodsr r r r r r r r r s � "r )r$ r ZloggingZoauthlib.commonr �errorsr �baser r Z getLoggerr! r r r r r r �<module> s oauth2/rfc6749/endpoints/revocation.py 0000644 00000012134 15125174064 0013606 0 ustar 00 """ oauthlib.oauth2.rfc6749.endpoint.revocation ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ An implementation of the OAuth 2 `Token Revocation`_ spec (draft 11). .. _`Token Revocation`: https://tools.ietf.org/html/draft-ietf-oauth-revocation-11 """ import logging from oauthlib.common import Request from ..errors import OAuth2Error from .base import BaseEndpoint, catch_errors_and_unavailability log = logging.getLogger(__name__) class RevocationEndpoint(BaseEndpoint): """Token revocation endpoint. Endpoint used by authenticated clients to revoke access and refresh tokens. Commonly this will be part of the Authorization Endpoint. """ valid_token_types = ('access_token', 'refresh_token') valid_request_methods = ('POST',) def __init__(self, request_validator, supported_token_types=None, enable_jsonp=False): BaseEndpoint.__init__(self) self.request_validator = request_validator self.supported_token_types = ( supported_token_types or self.valid_token_types) self.enable_jsonp = enable_jsonp @catch_errors_and_unavailability def create_revocation_response(self, uri, http_method='POST', body=None, headers=None): """Revoke supplied access or refresh token. The authorization server responds with HTTP status code 200 if the token has been revoked sucessfully or if the client submitted an invalid token. Note: invalid tokens do not cause an error response since the client cannot handle such an error in a reasonable way. Moreover, the purpose of the revocation request, invalidating the particular token, is already achieved. The content of the response body is ignored by the client as all necessary information is conveyed in the response code. An invalid token type hint value is ignored by the authorization server and does not influence the revocation response. """ resp_headers = { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'Pragma': 'no-cache', } request = Request( uri, http_method=http_method, body=body, headers=headers) try: self.validate_revocation_request(request) log.debug('Token revocation valid for %r.', request) except OAuth2Error as e: log.debug('Client error during validation of %r. %r.', request, e) response_body = e.json if self.enable_jsonp and request.callback: response_body = '{}({});'.format(request.callback, response_body) resp_headers.update(e.headers) return resp_headers, response_body, e.status_code self.request_validator.revoke_token(request.token, request.token_type_hint, request) response_body = '' if self.enable_jsonp and request.callback: response_body = request.callback + '();' return {}, response_body, 200 def validate_revocation_request(self, request): """Ensure the request is valid. The client constructs the request by including the following parameters using the "application/x-www-form-urlencoded" format in the HTTP request entity-body: token (REQUIRED). The token that the client wants to get revoked. token_type_hint (OPTIONAL). A hint about the type of the token submitted for revocation. Clients MAY pass this parameter in order to help the authorization server to optimize the token lookup. If the server is unable to locate the token using the given hint, it MUST extend its search accross all of its supported token types. An authorization server MAY ignore this parameter, particularly if it is able to detect the token type automatically. This specification defines two such values: * access_token: An Access Token as defined in [RFC6749], `section 1.4`_ * refresh_token: A Refresh Token as defined in [RFC6749], `section 1.5`_ Specific implementations, profiles, and extensions of this specification MAY define other values for this parameter using the registry defined in `Section 4.1.2`_. The client also includes its authentication credentials as described in `Section 2.3`_. of [`RFC6749`_]. .. _`section 1.4`: https://tools.ietf.org/html/rfc6749#section-1.4 .. _`section 1.5`: https://tools.ietf.org/html/rfc6749#section-1.5 .. _`section 2.3`: https://tools.ietf.org/html/rfc6749#section-2.3 .. _`Section 4.1.2`: https://tools.ietf.org/html/draft-ietf-oauth-revocation-11#section-4.1.2 .. _`RFC6749`: https://tools.ietf.org/html/rfc6749 """ self._raise_on_bad_method(request) self._raise_on_bad_post_request(request) self._raise_on_missing_token(request) self._raise_on_invalid_client(request) self._raise_on_unsupported_token(request) oauth2/rfc6749/endpoints/base.py 0000644 00000010042 15125174064 0012343 0 ustar 00 """ oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. """ import functools import logging from ..errors import ( FatalClientError, InvalidClientError, InvalidRequestError, OAuth2Error, ServerError, TemporarilyUnavailableError, UnsupportedTokenTypeError, ) log = logging.getLogger(__name__) class BaseEndpoint: def __init__(self): self._available = True self._catch_errors = False self._valid_request_methods = None @property def valid_request_methods(self): return self._valid_request_methods @valid_request_methods.setter def valid_request_methods(self, valid_request_methods): if valid_request_methods is not None: valid_request_methods = [x.upper() for x in valid_request_methods] self._valid_request_methods = valid_request_methods @property def available(self): return self._available @available.setter def available(self, available): self._available = available @property def catch_errors(self): return self._catch_errors @catch_errors.setter def catch_errors(self, catch_errors): self._catch_errors = catch_errors def _raise_on_missing_token(self, request): """Raise error on missing token.""" if not request.token: raise InvalidRequestError(request=request, description='Missing token parameter.') def _raise_on_invalid_client(self, request): """Raise on failed client authentication.""" if self.request_validator.client_authentication_required(request): if not self.request_validator.authenticate_client(request): log.debug('Client authentication failed, %r.', request) raise InvalidClientError(request=request) elif not self.request_validator.authenticate_client_id(request.client_id, request): log.debug('Client authentication failed, %r.', request) raise InvalidClientError(request=request) def _raise_on_unsupported_token(self, request): """Raise on unsupported tokens.""" if (request.token_type_hint and request.token_type_hint in self.valid_token_types and request.token_type_hint not in self.supported_token_types): raise UnsupportedTokenTypeError(request=request) def _raise_on_bad_method(self, request): if self.valid_request_methods is None: raise ValueError('Configure "valid_request_methods" property first') if request.http_method.upper() not in self.valid_request_methods: raise InvalidRequestError(request=request, description=('Unsupported request method %s' % request.http_method.upper())) def _raise_on_bad_post_request(self, request): """Raise if invalid POST request received """ if request.http_method.upper() == 'POST': query_params = request.uri_query or "" if query_params: raise InvalidRequestError(request=request, description=('URL query parameters are not allowed')) def catch_errors_and_unavailability(f): @functools.wraps(f) def wrapper(endpoint, uri, *args, **kwargs): if not endpoint.available: e = TemporarilyUnavailableError() log.info('Endpoint unavailable, ignoring request %s.' % uri) return {}, e.json, 503 if endpoint.catch_errors: try: return f(endpoint, uri, *args, **kwargs) except OAuth2Error: raise except FatalClientError: raise except Exception as e: error = ServerError() log.warning( 'Exception caught while processing request, %s.' % e) return {}, error.json, 500 else: return f(endpoint, uri, *args, **kwargs) return wrapper oauth2/rfc6749/endpoints/pre_configured.py 0000644 00000027262 15125174064 0014440 0 ustar 00 """ oauthlib.oauth2.rfc6749.endpoints.pre_configured ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various endpoints needed for providing OAuth 2.0 RFC6749 servers. """ from ..grant_types import ( AuthorizationCodeGrant, ClientCredentialsGrant, ImplicitGrant, RefreshTokenGrant, ResourceOwnerPasswordCredentialsGrant, ) from ..tokens import BearerToken from .authorization import AuthorizationEndpoint from .introspect import IntrospectEndpoint from .resource import ResourceEndpoint from .revocation import RevocationEndpoint from .token import TokenEndpoint class Server(AuthorizationEndpoint, IntrospectEndpoint, TokenEndpoint, ResourceEndpoint, RevocationEndpoint): """An all-in-one endpoint featuring all four major grant types.""" def __init__(self, request_validator, token_expires_in=None, token_generator=None, refresh_token_generator=None, *args, **kwargs): """Construct a new all-grants-in-one server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. """ self.auth_grant = AuthorizationCodeGrant(request_validator) self.implicit_grant = ImplicitGrant(request_validator) self.password_grant = ResourceOwnerPasswordCredentialsGrant( request_validator) self.credentials_grant = ClientCredentialsGrant(request_validator) self.refresh_grant = RefreshTokenGrant(request_validator) self.bearer = BearerToken(request_validator, token_generator, token_expires_in, refresh_token_generator) AuthorizationEndpoint.__init__(self, default_response_type='code', response_types={ 'code': self.auth_grant, 'token': self.implicit_grant, 'none': self.auth_grant }, default_token_type=self.bearer) TokenEndpoint.__init__(self, default_grant_type='authorization_code', grant_types={ 'authorization_code': self.auth_grant, 'password': self.password_grant, 'client_credentials': self.credentials_grant, 'refresh_token': self.refresh_grant, }, default_token_type=self.bearer) ResourceEndpoint.__init__(self, default_token='Bearer', token_types={'Bearer': self.bearer}) RevocationEndpoint.__init__(self, request_validator) IntrospectEndpoint.__init__(self, request_validator) class WebApplicationServer(AuthorizationEndpoint, IntrospectEndpoint, TokenEndpoint, ResourceEndpoint, RevocationEndpoint): """An all-in-one endpoint featuring Authorization code grant and Bearer tokens.""" def __init__(self, request_validator, token_generator=None, token_expires_in=None, refresh_token_generator=None, **kwargs): """Construct a new web application server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. """ self.auth_grant = AuthorizationCodeGrant(request_validator) self.refresh_grant = RefreshTokenGrant(request_validator) self.bearer = BearerToken(request_validator, token_generator, token_expires_in, refresh_token_generator) AuthorizationEndpoint.__init__(self, default_response_type='code', response_types={'code': self.auth_grant}, default_token_type=self.bearer) TokenEndpoint.__init__(self, default_grant_type='authorization_code', grant_types={ 'authorization_code': self.auth_grant, 'refresh_token': self.refresh_grant, }, default_token_type=self.bearer) ResourceEndpoint.__init__(self, default_token='Bearer', token_types={'Bearer': self.bearer}) RevocationEndpoint.__init__(self, request_validator) IntrospectEndpoint.__init__(self, request_validator) class MobileApplicationServer(AuthorizationEndpoint, IntrospectEndpoint, ResourceEndpoint, RevocationEndpoint): """An all-in-one endpoint featuring Implicit code grant and Bearer tokens.""" def __init__(self, request_validator, token_generator=None, token_expires_in=None, refresh_token_generator=None, **kwargs): """Construct a new implicit grant server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. """ self.implicit_grant = ImplicitGrant(request_validator) self.bearer = BearerToken(request_validator, token_generator, token_expires_in, refresh_token_generator) AuthorizationEndpoint.__init__(self, default_response_type='token', response_types={ 'token': self.implicit_grant}, default_token_type=self.bearer) ResourceEndpoint.__init__(self, default_token='Bearer', token_types={'Bearer': self.bearer}) RevocationEndpoint.__init__(self, request_validator, supported_token_types=['access_token']) IntrospectEndpoint.__init__(self, request_validator, supported_token_types=['access_token']) class LegacyApplicationServer(TokenEndpoint, IntrospectEndpoint, ResourceEndpoint, RevocationEndpoint): """An all-in-one endpoint featuring Resource Owner Password Credentials grant and Bearer tokens.""" def __init__(self, request_validator, token_generator=None, token_expires_in=None, refresh_token_generator=None, **kwargs): """Construct a resource owner password credentials grant server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. """ self.password_grant = ResourceOwnerPasswordCredentialsGrant( request_validator) self.refresh_grant = RefreshTokenGrant(request_validator) self.bearer = BearerToken(request_validator, token_generator, token_expires_in, refresh_token_generator) TokenEndpoint.__init__(self, default_grant_type='password', grant_types={ 'password': self.password_grant, 'refresh_token': self.refresh_grant, }, default_token_type=self.bearer) ResourceEndpoint.__init__(self, default_token='Bearer', token_types={'Bearer': self.bearer}) RevocationEndpoint.__init__(self, request_validator) IntrospectEndpoint.__init__(self, request_validator) class BackendApplicationServer(TokenEndpoint, IntrospectEndpoint, ResourceEndpoint, RevocationEndpoint): """An all-in-one endpoint featuring Client Credentials grant and Bearer tokens.""" def __init__(self, request_validator, token_generator=None, token_expires_in=None, refresh_token_generator=None, **kwargs): """Construct a client credentials grant server. :param request_validator: An implementation of oauthlib.oauth2.RequestValidator. :param token_expires_in: An int or a function to generate a token expiration offset (in seconds) given a oauthlib.common.Request object. :param token_generator: A function to generate a token from a request. :param refresh_token_generator: A function to generate a token from a request for the refresh token. :param kwargs: Extra parameters to pass to authorization-, token-, resource-, and revocation-endpoint constructors. """ self.credentials_grant = ClientCredentialsGrant(request_validator) self.bearer = BearerToken(request_validator, token_generator, token_expires_in, refresh_token_generator) TokenEndpoint.__init__(self, default_grant_type='client_credentials', grant_types={ 'client_credentials': self.credentials_grant}, default_token_type=self.bearer) ResourceEndpoint.__init__(self, default_token='Bearer', token_types={'Bearer': self.bearer}) RevocationEndpoint.__init__(self, request_validator, supported_token_types=['access_token']) IntrospectEndpoint.__init__(self, request_validator, supported_token_types=['access_token']) oauth2/rfc6749/endpoints/token.py 0000644 00000010763 15125174064 0012563 0 ustar 00 """ oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. """ import logging from oauthlib.common import Request from oauthlib.oauth2.rfc6749 import utils from .base import BaseEndpoint, catch_errors_and_unavailability log = logging.getLogger(__name__) class TokenEndpoint(BaseEndpoint): """Token issuing endpoint. The token endpoint is used by the client to obtain an access token by presenting its authorization grant or refresh token. The token endpoint is used with every authorization grant except for the implicit grant type (since an access token is issued directly). The means through which the client obtains the location of the token endpoint are beyond the scope of this specification, but the location is typically provided in the service documentation. The endpoint URI MAY include an "application/x-www-form-urlencoded" formatted (per `Appendix B`_) query component, which MUST be retained when adding additional query parameters. The endpoint URI MUST NOT include a fragment component:: https://example.com/path?query=component # OK https://example.com/path?query=component#fragment # Not OK Since requests to the token endpoint result in the transmission of clear-text credentials (in the HTTP request and response), the authorization server MUST require the use of TLS as described in Section 1.6 when sending requests to the token endpoint:: # We will deny any request which URI schema is not with https The client MUST use the HTTP "POST" method when making access token requests:: # HTTP method is currently not enforced Parameters sent without a value MUST be treated as if they were omitted from the request. The authorization server MUST ignore unrecognized request parameters. Request and response parameters MUST NOT be included more than once:: # Delegated to each grant type. .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B """ valid_request_methods = ('POST',) def __init__(self, default_grant_type, default_token_type, grant_types): BaseEndpoint.__init__(self) self._grant_types = grant_types self._default_token_type = default_token_type self._default_grant_type = default_grant_type @property def grant_types(self): return self._grant_types @property def default_grant_type(self): return self._default_grant_type @property def default_grant_type_handler(self): return self.grant_types.get(self.default_grant_type) @property def default_token_type(self): return self._default_token_type @catch_errors_and_unavailability def create_token_response(self, uri, http_method='POST', body=None, headers=None, credentials=None, grant_type_for_scope=None, claims=None): """Extract grant_type and route to the designated handler.""" request = Request( uri, http_method=http_method, body=body, headers=headers) self.validate_token_request(request) # 'scope' is an allowed Token Request param in both the "Resource Owner Password Credentials Grant" # and "Client Credentials Grant" flows # https://tools.ietf.org/html/rfc6749#section-4.3.2 # https://tools.ietf.org/html/rfc6749#section-4.4.2 request.scopes = utils.scope_to_list(request.scope) request.extra_credentials = credentials if grant_type_for_scope: request.grant_type = grant_type_for_scope # OpenID Connect claims, if provided. The server using oauthlib might choose # to implement the claims parameter of the Authorization Request. In this case # it should retrieve those claims and pass them via the claims argument here, # as a dict. if claims: request.claims = claims grant_type_handler = self.grant_types.get(request.grant_type, self.default_grant_type_handler) log.debug('Dispatching grant_type %s request to %r.', request.grant_type, grant_type_handler) return grant_type_handler.create_token_response( request, self.default_token_type) def validate_token_request(self, request): self._raise_on_bad_method(request) self._raise_on_bad_post_request(request) oauth2/rfc6749/endpoints/authorization.py 0000644 00000010750 15125174064 0014337 0 ustar 00 """ oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. """ import logging from oauthlib.common import Request from oauthlib.oauth2.rfc6749 import utils from .base import BaseEndpoint, catch_errors_and_unavailability log = logging.getLogger(__name__) class AuthorizationEndpoint(BaseEndpoint): """Authorization endpoint - used by the client to obtain authorization from the resource owner via user-agent redirection. The authorization endpoint is used to interact with the resource owner and obtain an authorization grant. The authorization server MUST first verify the identity of the resource owner. The way in which the authorization server authenticates the resource owner (e.g. username and password login, session cookies) is beyond the scope of this specification. The endpoint URI MAY include an "application/x-www-form-urlencoded" formatted (per `Appendix B`_) query component, which MUST be retained when adding additional query parameters. The endpoint URI MUST NOT include a fragment component:: https://example.com/path?query=component # OK https://example.com/path?query=component#fragment # Not OK Since requests to the authorization endpoint result in user authentication and the transmission of clear-text credentials (in the HTTP response), the authorization server MUST require the use of TLS as described in Section 1.6 when sending requests to the authorization endpoint:: # We will deny any request which URI schema is not with https The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint, and MAY support the use of the "POST" method as well:: # HTTP method is currently not enforced Parameters sent without a value MUST be treated as if they were omitted from the request. The authorization server MUST ignore unrecognized request parameters. Request and response parameters MUST NOT be included more than once:: # Enforced through the design of oauthlib.common.Request .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B """ def __init__(self, default_response_type, default_token_type, response_types): BaseEndpoint.__init__(self) self._response_types = response_types self._default_response_type = default_response_type self._default_token_type = default_token_type @property def response_types(self): return self._response_types @property def default_response_type(self): return self._default_response_type @property def default_response_type_handler(self): return self.response_types.get(self.default_response_type) @property def default_token_type(self): return self._default_token_type @catch_errors_and_unavailability def create_authorization_response(self, uri, http_method='GET', body=None, headers=None, scopes=None, credentials=None): """Extract response_type and route to the designated handler.""" request = Request( uri, http_method=http_method, body=body, headers=headers) request.scopes = scopes # TODO: decide whether this should be a required argument request.user = None # TODO: explain this in docs for k, v in (credentials or {}).items(): setattr(request, k, v) response_type_handler = self.response_types.get( request.response_type, self.default_response_type_handler) log.debug('Dispatching response_type %s request to %r.', request.response_type, response_type_handler) return response_type_handler.create_authorization_response( request, self.default_token_type) @catch_errors_and_unavailability def validate_authorization_request(self, uri, http_method='GET', body=None, headers=None): """Extract response_type and route to the designated handler.""" request = Request( uri, http_method=http_method, body=body, headers=headers) request.scopes = utils.scope_to_list(request.scope) response_type_handler = self.response_types.get( request.response_type, self.default_response_type_handler) return response_type_handler.validate_authorization_request(request) oauth2/rfc6749/endpoints/resource.py 0000644 00000006260 15125174064 0013267 0 ustar 00 """ oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. """ import logging from oauthlib.common import Request from .base import BaseEndpoint, catch_errors_and_unavailability log = logging.getLogger(__name__) class ResourceEndpoint(BaseEndpoint): """Authorizes access to protected resources. The client accesses protected resources by presenting the access token to the resource server. The resource server MUST validate the access token and ensure that it has not expired and that its scope covers the requested resource. The methods used by the resource server to validate the access token (as well as any error responses) are beyond the scope of this specification but generally involve an interaction or coordination between the resource server and the authorization server:: # For most cases, returning a 403 should suffice. The method in which the client utilizes the access token to authenticate with the resource server depends on the type of access token issued by the authorization server. Typically, it involves using the HTTP "Authorization" request header field [RFC2617] with an authentication scheme defined by the specification of the access token type used, such as [RFC6750]:: # Access tokens may also be provided in query and body https://example.com/protected?access_token=kjfch2345sdf # Query access_token=sdf23409df # Body """ def __init__(self, default_token, token_types): BaseEndpoint.__init__(self) self._tokens = token_types self._default_token = default_token @property def default_token(self): return self._default_token @property def default_token_type_handler(self): return self.tokens.get(self.default_token) @property def tokens(self): return self._tokens @catch_errors_and_unavailability def verify_request(self, uri, http_method='GET', body=None, headers=None, scopes=None): """Validate client, code etc, return body + headers""" request = Request(uri, http_method, body, headers) request.token_type = self.find_token_type(request) request.scopes = scopes token_type_handler = self.tokens.get(request.token_type, self.default_token_type_handler) log.debug('Dispatching token_type %s request to %r.', request.token_type, token_type_handler) return token_type_handler.validate_request(request), request def find_token_type(self, request): """Token type identification. RFC 6749 does not provide a method for easily differentiating between different token types during protected resource access. We estimate the most likely token type (if any) by asking each known token type to give an estimation based on the request. """ estimates = sorted(((t.estimate_type(request), n) for n, t in self.tokens.items()), reverse=True) return estimates[0][1] if len(estimates) else None oauth2/rfc6749/endpoints/metadata.py 0000644 00000024343 15125174064 0013222 0 ustar 00 """ oauthlib.oauth2.rfc6749.endpoint.metadata ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ An implementation of the `OAuth 2.0 Authorization Server Metadata`. .. _`OAuth 2.0 Authorization Server Metadata`: https://tools.ietf.org/html/rfc8414 """ import copy import json import logging from .. import grant_types from .authorization import AuthorizationEndpoint from .base import BaseEndpoint, catch_errors_and_unavailability from .introspect import IntrospectEndpoint from .revocation import RevocationEndpoint from .token import TokenEndpoint log = logging.getLogger(__name__) class MetadataEndpoint(BaseEndpoint): """OAuth2.0 Authorization Server Metadata endpoint. This specification generalizes the metadata format defined by `OpenID Connect Discovery 1.0` in a way that is compatible with OpenID Connect Discovery while being applicable to a wider set of OAuth 2.0 use cases. This is intentionally parallel to the way that OAuth 2.0 Dynamic Client Registration Protocol [`RFC7591`_] generalized the dynamic client registration mechanisms defined by OpenID Connect Dynamic Client Registration 1.0 in a way that is compatible with it. .. _`OpenID Connect Discovery 1.0`: https://openid.net/specs/openid-connect-discovery-1_0.html .. _`RFC7591`: https://tools.ietf.org/html/rfc7591 """ def __init__(self, endpoints, claims={}, raise_errors=True): assert isinstance(claims, dict) for endpoint in endpoints: assert isinstance(endpoint, BaseEndpoint) BaseEndpoint.__init__(self) self.raise_errors = raise_errors self.endpoints = endpoints self.initial_claims = claims self.claims = self.validate_metadata_server() @catch_errors_and_unavailability def create_metadata_response(self, uri, http_method='GET', body=None, headers=None): """Create metadata response """ headers = { 'Content-Type': 'application/json' } return headers, json.dumps(self.claims), 200 def validate_metadata(self, array, key, is_required=False, is_list=False, is_url=False, is_issuer=False): if not self.raise_errors: return if key not in array: if is_required: raise ValueError("key {} is a mandatory metadata.".format(key)) elif is_issuer: if not array[key].startswith("https"): raise ValueError("key {}: {} must be an HTTPS URL".format(key, array[key])) if "?" in array[key] or "&" in array[key] or "#" in array[key]: raise ValueError("key {}: {} must not contain query or fragment components".format(key, array[key])) elif is_url: if not array[key].startswith("http"): raise ValueError("key {}: {} must be an URL".format(key, array[key])) elif is_list: if not isinstance(array[key], list): raise ValueError("key {}: {} must be an Array".format(key, array[key])) for elem in array[key]: if not isinstance(elem, str): raise ValueError("array {}: {} must contains only string (not {})".format(key, array[key], elem)) def validate_metadata_token(self, claims, endpoint): """ If the token endpoint is used in the grant type, the value of this parameter MUST be the same as the value of the "grant_type" parameter passed to the token endpoint defined in the grant type definition. """ self._grant_types.extend(endpoint._grant_types.keys()) claims.setdefault("token_endpoint_auth_methods_supported", ["client_secret_post", "client_secret_basic"]) self.validate_metadata(claims, "token_endpoint_auth_methods_supported", is_list=True) self.validate_metadata(claims, "token_endpoint_auth_signing_alg_values_supported", is_list=True) self.validate_metadata(claims, "token_endpoint", is_required=True, is_url=True) def validate_metadata_authorization(self, claims, endpoint): claims.setdefault("response_types_supported", list(filter(lambda x: x != "none", endpoint._response_types.keys()))) claims.setdefault("response_modes_supported", ["query", "fragment"]) # The OAuth2.0 Implicit flow is defined as a "grant type" but it is not # using the "token" endpoint, as such, we have to add it explicitly to # the list of "grant_types_supported" when enabled. if "token" in claims["response_types_supported"]: self._grant_types.append("implicit") self.validate_metadata(claims, "response_types_supported", is_required=True, is_list=True) self.validate_metadata(claims, "response_modes_supported", is_list=True) if "code" in claims["response_types_supported"]: code_grant = endpoint._response_types["code"] if not isinstance(code_grant, grant_types.AuthorizationCodeGrant) and hasattr(code_grant, "default_grant"): code_grant = code_grant.default_grant claims.setdefault("code_challenge_methods_supported", list(code_grant._code_challenge_methods.keys())) self.validate_metadata(claims, "code_challenge_methods_supported", is_list=True) self.validate_metadata(claims, "authorization_endpoint", is_required=True, is_url=True) def validate_metadata_revocation(self, claims, endpoint): claims.setdefault("revocation_endpoint_auth_methods_supported", ["client_secret_post", "client_secret_basic"]) self.validate_metadata(claims, "revocation_endpoint_auth_methods_supported", is_list=True) self.validate_metadata(claims, "revocation_endpoint_auth_signing_alg_values_supported", is_list=True) self.validate_metadata(claims, "revocation_endpoint", is_required=True, is_url=True) def validate_metadata_introspection(self, claims, endpoint): claims.setdefault("introspection_endpoint_auth_methods_supported", ["client_secret_post", "client_secret_basic"]) self.validate_metadata(claims, "introspection_endpoint_auth_methods_supported", is_list=True) self.validate_metadata(claims, "introspection_endpoint_auth_signing_alg_values_supported", is_list=True) self.validate_metadata(claims, "introspection_endpoint", is_required=True, is_url=True) def validate_metadata_server(self): """ Authorization servers can have metadata describing their configuration. The following authorization server metadata values are used by this specification. More details can be found in `RFC8414 section 2`_ : issuer REQUIRED authorization_endpoint URL of the authorization server's authorization endpoint [`RFC6749#Authorization`_]. This is REQUIRED unless no grant types are supported that use the authorization endpoint. token_endpoint URL of the authorization server's token endpoint [`RFC6749#Token`_]. This is REQUIRED unless only the implicit grant type is supported. scopes_supported RECOMMENDED. response_types_supported REQUIRED. Other OPTIONAL fields: jwks_uri, registration_endpoint, response_modes_supported grant_types_supported OPTIONAL. JSON array containing a list of the OAuth 2.0 grant type values that this authorization server supports. The array values used are the same as those used with the "grant_types" parameter defined by "OAuth 2.0 Dynamic Client Registration Protocol" [`RFC7591`_]. If omitted, the default value is "["authorization_code", "implicit"]". token_endpoint_auth_methods_supported token_endpoint_auth_signing_alg_values_supported service_documentation ui_locales_supported op_policy_uri op_tos_uri revocation_endpoint revocation_endpoint_auth_methods_supported revocation_endpoint_auth_signing_alg_values_supported introspection_endpoint introspection_endpoint_auth_methods_supported introspection_endpoint_auth_signing_alg_values_supported code_challenge_methods_supported Additional authorization server metadata parameters MAY also be used. Some are defined by other specifications, such as OpenID Connect Discovery 1.0 [`OpenID.Discovery`_]. .. _`RFC8414 section 2`: https://tools.ietf.org/html/rfc8414#section-2 .. _`RFC6749#Authorization`: https://tools.ietf.org/html/rfc6749#section-3.1 .. _`RFC6749#Token`: https://tools.ietf.org/html/rfc6749#section-3.2 .. _`RFC7591`: https://tools.ietf.org/html/rfc7591 .. _`OpenID.Discovery`: https://openid.net/specs/openid-connect-discovery-1_0.html """ claims = copy.deepcopy(self.initial_claims) self.validate_metadata(claims, "issuer", is_required=True, is_issuer=True) self.validate_metadata(claims, "jwks_uri", is_url=True) self.validate_metadata(claims, "scopes_supported", is_list=True) self.validate_metadata(claims, "service_documentation", is_url=True) self.validate_metadata(claims, "ui_locales_supported", is_list=True) self.validate_metadata(claims, "op_policy_uri", is_url=True) self.validate_metadata(claims, "op_tos_uri", is_url=True) self._grant_types = [] for endpoint in self.endpoints: if isinstance(endpoint, TokenEndpoint): self.validate_metadata_token(claims, endpoint) if isinstance(endpoint, AuthorizationEndpoint): self.validate_metadata_authorization(claims, endpoint) if isinstance(endpoint, RevocationEndpoint): self.validate_metadata_revocation(claims, endpoint) if isinstance(endpoint, IntrospectEndpoint): self.validate_metadata_introspection(claims, endpoint) # "grant_types_supported" is a combination of all OAuth2 grant types # allowed in the current provider implementation. claims.setdefault("grant_types_supported", self._grant_types) self.validate_metadata(claims, "grant_types_supported", is_list=True) return claims oauth2/rfc6749/endpoints/introspect.py 0000644 00000011567 15125174064 0013640 0 ustar 00 """ oauthlib.oauth2.rfc6749.endpoint.introspect ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ An implementation of the OAuth 2.0 `Token Introspection`. .. _`Token Introspection`: https://tools.ietf.org/html/rfc7662 """ import json import logging from oauthlib.common import Request from ..errors import OAuth2Error from .base import BaseEndpoint, catch_errors_and_unavailability log = logging.getLogger(__name__) class IntrospectEndpoint(BaseEndpoint): """Introspect token endpoint. This endpoint defines a method to query an OAuth 2.0 authorization server to determine the active state of an OAuth 2.0 token and to determine meta-information about this token. OAuth 2.0 deployments can use this method to convey information about the authorization context of the token from the authorization server to the protected resource. To prevent the values of access tokens from leaking into server-side logs via query parameters, an authorization server offering token introspection MAY disallow the use of HTTP GET on the introspection endpoint and instead require the HTTP POST method to be used at the introspection endpoint. """ valid_token_types = ('access_token', 'refresh_token') valid_request_methods = ('POST',) def __init__(self, request_validator, supported_token_types=None): BaseEndpoint.__init__(self) self.request_validator = request_validator self.supported_token_types = ( supported_token_types or self.valid_token_types) @catch_errors_and_unavailability def create_introspect_response(self, uri, http_method='POST', body=None, headers=None): """Create introspect valid or invalid response If the authorization server is unable to determine the state of the token without additional information, it SHOULD return an introspection response indicating the token is not active as described in Section 2.2. """ resp_headers = { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'Pragma': 'no-cache', } request = Request(uri, http_method, body, headers) try: self.validate_introspect_request(request) log.debug('Token introspect valid for %r.', request) except OAuth2Error as e: log.debug('Client error during validation of %r. %r.', request, e) resp_headers.update(e.headers) return resp_headers, e.json, e.status_code claims = self.request_validator.introspect_token( request.token, request.token_type_hint, request ) if claims is None: return resp_headers, json.dumps(dict(active=False)), 200 if "active" in claims: claims.pop("active") return resp_headers, json.dumps(dict(active=True, **claims)), 200 def validate_introspect_request(self, request): """Ensure the request is valid. The protected resource calls the introspection endpoint using an HTTP POST request with parameters sent as "application/x-www-form-urlencoded". token REQUIRED. The string value of the token. token_type_hint OPTIONAL. A hint about the type of the token submitted for introspection. The protected resource MAY pass this parameter to help the authorization server optimize the token lookup. If the server is unable to locate the token using the given hint, it MUST extend its search across all of its supported token types. An authorization server MAY ignore this parameter, particularly if it is able to detect the token type automatically. * access_token: An Access Token as defined in [`RFC6749`], `section 1.4`_ * refresh_token: A Refresh Token as defined in [`RFC6749`], `section 1.5`_ The introspection endpoint MAY accept other OPTIONAL parameters to provide further context to the query. For instance, an authorization server may desire to know the IP address of the client accessing the protected resource to determine if the correct client is likely to be presenting the token. The definition of this or any other parameters are outside the scope of this specification, to be defined by service documentation or extensions to this specification. .. _`section 1.4`: http://tools.ietf.org/html/rfc6749#section-1.4 .. _`section 1.5`: http://tools.ietf.org/html/rfc6749#section-1.5 .. _`RFC6749`: http://tools.ietf.org/html/rfc6749 """ self._raise_on_bad_method(request) self._raise_on_bad_post_request(request) self._raise_on_missing_token(request) self._raise_on_invalid_client(request) self._raise_on_unsupported_token(request) oauth2/rfc6749/endpoints/__init__.py 0000644 00000001051 15125174064 0013170 0 ustar 00 """ oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. """ from .authorization import AuthorizationEndpoint from .introspect import IntrospectEndpoint from .metadata import MetadataEndpoint from .pre_configured import ( BackendApplicationServer, LegacyApplicationServer, MobileApplicationServer, Server, WebApplicationServer, ) from .resource import ResourceEndpoint from .revocation import RevocationEndpoint from .token import TokenEndpoint oauth2/rfc6749/grant_types/__pycache__/refresh_token.cpython-39.pyc 0000644 00000010710 15125174064 0021114 0 ustar 00 a \��`� � @ sN d Z ddlZddlZddlmZmZ ddlmZ e�e �Z G dd� de�Z dS ) zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N� )�errors�utils� )� GrantTypeBasec s2 e Zd ZdZd � fdd� Zdd� Zdd � Z� ZS ) �RefreshTokenGrantzi`Refresh token grant`_ .. _`Refresh token grant`: https://tools.ietf.org/html/rfc6749#section-6 NTc s t � j|fd|i|�� d S )N�issue_new_refresh_tokens)�super�__init__)�self�request_validatorr �kwargs�� __class__� �U/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/refresh_token.pyr s ���zRefreshTokenGrant.__init__c C s� | � � }zt�d|� | �|� W nL tjyn } z2t�d|� |�|j� ||j|j fW Y d}~S d}~0 0 |j || j d�}| j D ] }||�}q�| j �||� t�d|j|j|� |t�|�dfS )a� Create a new access token from a refresh_token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. If valid and authorized, the authorization server issues an access token as described in `Section 5.1`_. If the request failed verification or is invalid, the authorization server returns an error response as described in `Section 5.2`_. The authorization server MAY issue a new refresh token, in which case the client MUST discard the old refresh token and replace it with the new refresh token. The authorization server MAY revoke the old refresh token after issuing a new refresh token to the client. If a new refresh token is issued, the refresh token scope MUST be identical to that of the refresh token included by the client in the request. .. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1 .. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2 z%Validating refresh token request, %r.z"Client error in token request, %s.N)� refresh_tokenz+Issuing new token to client id %r (%r), %r.�� )Z_get_default_headers�log�debug�validate_token_requestr Z OAuth2Error�update�headers�jsonZ status_codeZ create_tokenr Z_token_modifiersr Z save_token� client_id�client�dumps)r �requestZ token_handlerr �e�token�modifierr r r �create_token_response s$ $� �z'RefreshTokenGrant.create_token_responsec s� |j dkrtj|d��| jjD ] }||� q |jdu rDtjd|d��| j�|�r�t � d|� | j� |�s�t � d|� tj |d��n(| j� |j|�s�t � d|� tj |d��| �|� t � d |j|j� | j�|j|j|�s�t � d |j|j� tj|d��t�| j�|j|��� |j�rtt�|j�|_t� fd d �|jD ���sz| j�|j|j|��szt � d |j|j� tj|d��n� |_| jjD ]}||� �q�dS )zb :param request: OAuthlib request. :type request: oauthlib.common.Request r )r Nz Missing refresh token parameter.)� descriptionr zAuthenticating client, %r.z$Invalid client (%r), denying access.z!Client authentication failed, %r.z*Validating refresh token %s for client %r.z)Invalid refresh token, %s, for client %r.c 3 s | ]}|� v V qd S )Nr )�.0�s�Zoriginal_scopesr r � <genexpr>} � z;RefreshTokenGrant.validate_token_request.<locals>.<genexpr>z+Refresh token %s lack requested scopes, %r.) Z grant_typer ZUnsupportedGrantTypeErrorZcustom_validatorsZ pre_tokenr ZInvalidRequestErrorr Z client_authentication_requiredr r Zauthenticate_clientZInvalidClientErrorZauthenticate_client_idr Zvalidate_grant_typer Zvalidate_refresh_tokenZInvalidGrantErrorr Z scope_to_listZget_original_scopesZscopeZscopes�allZis_within_original_scopeZInvalidScopeErrorZ post_token)r r Z validatorr r% r r J s^ � � �� �� ��� z(RefreshTokenGrant.validate_token_request)NT)�__name__� __module__� __qualname__�__doc__r r! r � __classcell__r r r r r s �-r ) r, r Zlogging� r r �baser Z getLoggerr) r r r r r r �<module> s oauth2/rfc6749/grant_types/__pycache__/resource_owner_password_credentials.cpython-39.opt-1.pyc 0000644 00000017051 15125174064 0026562 0 ustar 00 a \��`D! � @ sJ d Z ddlZddlZddlmZ ddlmZ e�e�Z G dd� de�Z dS ) zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N� )�errors� )� GrantTypeBasec @ s e Zd ZdZdd� Zdd� ZdS )�%ResourceOwnerPasswordCredentialsGranta! `Resource Owner Password Credentials Grant`_ The resource owner password credentials grant type is suitable in cases where the resource owner has a trust relationship with the client, such as the device operating system or a highly privileged application. The authorization server should take special care when enabling this grant type and only allow it when other flows are not viable. This grant type is suitable for clients capable of obtaining the resource owner's credentials (username and password, typically using an interactive form). It is also used to migrate existing clients using direct authentication schemes such as HTTP Basic or Digest authentication to OAuth by converting the stored credentials to an access token:: +----------+ | Resource | | Owner | | | +----------+ v | Resource Owner (A) Password Credentials | v +---------+ +---------------+ | |>--(B)---- Resource Owner ------->| | | | Password Credentials | Authorization | | Client | | Server | | |<--(C)---- Access Token ---------<| | | | (w/ Optional Refresh Token) | | +---------+ +---------------+ Figure 5: Resource Owner Password Credentials Flow The flow illustrated in Figure 5 includes the following steps: (A) The resource owner provides the client with its username and password. (B) The client requests an access token from the authorization server's token endpoint by including the credentials received from the resource owner. When making the request, the client authenticates with the authorization server. (C) The authorization server authenticates the client and validates the resource owner credentials, and if valid, issues an access token. .. _`Resource Owner Password Credentials Grant`: https://tools.ietf.org/html/rfc6749#section-4.3 c C s. | � � }z�| j�|�rHt�d|� | j�|�spt�d|� tj|d��n(| j�|j |�spt�d|� tj|d��t�d|� | � |� W nL tj y� } z2t�d|� |� |j � ||j|jfW Y d}~S d}~0 0 |�|| j�}| jD ] }||�}q�| j�||� t�d||j |j|j� |t�|�dfS ) a� Return token or error in json format. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. If the access token request is valid and authorized, the authorization server issues an access token and optional refresh token as described in `Section 5.1`_. If the request failed client authentication or is invalid, the authorization server returns an error response as described in `Section 5.2`_. .. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1 .. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2 zAuthenticating client, %r.z!Client authentication failed, %r.��requestz$Validating access token request, %r.z"Client error in token request, %s.Nz6Issuing token %r to client id %r (%r) and username %s.�� )Z_get_default_headers�request_validatorZ client_authentication_required�log�debugZauthenticate_clientr ZInvalidClientErrorZauthenticate_client_id� client_id�validate_token_requestZ OAuth2Error�update�headers�jsonZ status_codeZ create_tokenZ refresh_tokenZ_token_modifiersZ save_token�client�username�dumps)�selfr Z token_handlerr �e�token�modifier� r �k/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py�create_token_responseE s0 $ �z;ResourceOwnerPasswordCredentialsGrant.create_token_responsec C s | j jD ] }||� qdD ]"}t||d�stjd| |d��qdD ] }||jv rBtjd| |d��qB|jdksztj|d��t� d |j � | j � |j |j |j|�s�tjd |d��nt|jd �s�td ��t� d |j� | �|� |jr�|jp�|jj|_| �|� | j jD ]}||� �qdS )a� :param request: OAuthlib request. :type request: oauthlib.common.Request The client makes a request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format per Appendix B with a character encoding of UTF-8 in the HTTP request entity-body: grant_type REQUIRED. Value MUST be set to "password". username REQUIRED. The resource owner username. password REQUIRED. The resource owner password. scope OPTIONAL. The scope of the access request as described by `Section 3.3`_. If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in `Section 3.2.1`_. The authorization server MUST: o require client authentication for confidential clients or for any client that was issued client credentials (or with other authentication requirements), o authenticate the client if client authentication is included, and o validate the resource owner password credentials using its existing password validation algorithm. Since this access token request utilizes the resource owner's password, the authorization server MUST protect the endpoint against brute force attacks (e.g., using rate-limitation or generating alerts). .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 )� grant_typer �passwordNz Request is missing %s parameter.r )r r r ZscopezDuplicate %s parameter.)� descriptionr r zValidating username %s.zInvalid credentials given.r zUValidate user must set the request.client.client_id attribute in authenticate_client.z Authorizing access to user %r.)Zcustom_validatorsZ pre_token�getattrr ZInvalidRequestErrorZduplicate_paramsr ZUnsupportedGrantTypeErrorr r r r Z validate_userr r ZInvalidGrantError�hasattr�NotImplementedError�userZvalidate_grant_typer Zvalidate_scopesZ post_token)r r Z validatorZparamr r r r r s< / � �� � z<ResourceOwnerPasswordCredentialsGrant.validate_token_requestN)�__name__� __module__� __qualname__�__doc__r r r r r r r s 5-r ) r& r Zlogging� r �baser Z getLoggerr# r r r r r r �<module> s oauth2/rfc6749/grant_types/__pycache__/authorization_code.cpython-39.pyc 0000644 00000043437 15125174064 0022164 0 ustar 00 a \��`Ye � @ sv d Z ddlZddlZddlZddlZddlmZ ddlmZ ddl m Z e� e �Z dd � Zd d � ZG d d � d e �ZdS )zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�common� )�errors� )� GrantTypeBasec C s& t �t�| �� ��� ��� �d�|kS )a0 If the "code_challenge_method" from `Section 4.3`_ was "S256", the received "code_verifier" is hashed by SHA-256, base64url-encoded, and then compared to the "code_challenge", i.e.: BASE64URL-ENCODE(SHA256(ASCII(code_verifier))) == code_challenge How to implement a base64url-encoding function without padding, based upon the standard base64-encoding function that uses padding. To be concrete, example C# code implementing these functions is shown below. Similar code could be used in other languages. static string base64urlencode(byte [] arg) { string s = Convert.ToBase64String(arg); // Regular base64 encoder s = s.Split('=')[0]; // Remove any trailing '='s s = s.Replace('+', '-'); // 62nd char of encoding s = s.Replace('/', '_'); // 63rd char of encoding return s; } In python urlsafe_b64encode is already replacing '+' and '/', but preserve the trailing '='. So we have to remove it. .. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3 �=)�base64Zurlsafe_b64encode�hashlibZsha256�encode�digest�decode�rstrip��verifier� challenge� r �Z/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py�code_challenge_method_s256 s ���r c C s | |kS )z� If the "code_challenge_method" from `Section 4.3`_ was "plain", they are compared directly, i.e.: code_verifier == code_challenge. .. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3 r r r r r �code_challenge_method_plain4 s r c @ sT e Zd ZdZdZdgZeed�Zdd� Z dd� Z d d � Z d d � Z d d� Z dd� ZdS )�AuthorizationCodeGranta� `Authorization Code Grant`_ The authorization code grant type is used to obtain both access tokens and refresh tokens and is optimized for confidential clients. Since this is a redirection-based flow, the client must be capable of interacting with the resource owner's user-agent (typically a web browser) and capable of receiving incoming requests (via redirection) from the authorization server:: +----------+ | Resource | | Owner | | | +----------+ ^ | (B) +----|-----+ Client Identifier +---------------+ | -+----(A)-- & Redirection URI ---->| | | User- | | Authorization | | Agent -+----(B)-- User authenticates --->| Server | | | | | | -+----(C)-- Authorization Code ---<| | +-|----|---+ +---------------+ | | ^ v (A) (C) | | | | | | ^ v | | +---------+ | | | |>---(D)-- Authorization Code ---------' | | Client | & Redirection URI | | | | | |<---(E)----- Access Token -------------------' +---------+ (w/ Optional Refresh Token) Note: The lines illustrating steps (A), (B), and (C) are broken into two parts as they pass through the user-agent. Figure 3: Authorization Code Flow The flow illustrated in Figure 3 includes the following steps: (A) The client initiates the flow by directing the resource owner's user-agent to the authorization endpoint. The client includes its client identifier, requested scope, local state, and a redirection URI to which the authorization server will send the user-agent back once access is granted (or denied). (B) The authorization server authenticates the resource owner (via the user-agent) and establishes whether the resource owner grants or denies the client's access request. (C) Assuming the resource owner grants access, the authorization server redirects the user-agent back to the client using the redirection URI provided earlier (in the request or during client registration). The redirection URI includes an authorization code and any local state provided by the client earlier. (D) The client requests an access token from the authorization server's token endpoint by including the authorization code received in the previous step. When making the request, the client authenticates with the authorization server. The client includes the redirection URI used to obtain the authorization code for verification. (E) The authorization server authenticates the client, validates the authorization code, and ensures that the redirection URI received matches the URI used to redirect the client in step (C). If valid, the authorization server responds back with an access token and, optionally, a refresh token. OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. A technique to mitigate against the threat through the use of Proof Key for Code Exchange (PKCE, pronounced "pixy") is implemented in the current oauthlib implementation. .. _`Authorization Code Grant`: https://tools.ietf.org/html/rfc6749#section-4.1 .. _`PKCE`: https://tools.ietf.org/html/rfc7636 �query�code)�plainZS256c C s8 dt �� i}t|d�r&|jr&|j|d< t�d||� |S )z� Generates an authorization grant represented as a dictionary. :param request: OAuthlib request. :type request: oauthlib.common.Request r �statez3Created authorization code grant %r for request %r.)r Zgenerate_token�hasattrr �log�debug)�self�request�grantr r r �create_authorization_code� s �z0AuthorizationCodeGrant.create_authorization_codec C s z| � |� t�d|� W n� tjyP } z t�d||� � W Y d}~nrd}~0 tjy� } zPt�d||� |jpx| j|_tj |j|j |j dkd�}d|iddfW Y d}~S d}~0 0 | � |�}| j D ]}||||�}q�t�d ||� | j�|j||� | �||i dd�S ) ag The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: response_type REQUIRED. Value MUST be set to "code" for standard OAuth2 authorization flow. For OpenID Connect it must be one of "code token", "code id_token", or "code token id_token" - we essentially test that "code" appears in the response_type. client_id REQUIRED. The client identifier as described in `Section 2.2`_. redirect_uri OPTIONAL. As described in `Section 3.1.2`_. scope OPTIONAL. The scope of the access request as described by `Section 3.3`_. state RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. The client directs the resource owner to the constructed URI using an HTTP redirection response, or by other means available to it via the user-agent. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. :returns: headers, body, status :raises: FatalClientError on invalid redirect URI or client id. A few examples:: >>> from your_validator import your_validator >>> request = Request('https://example.com/authorize?client_id=valid' ... '&redirect_uri=http%3A%2F%2Fclient.com%2F') >>> from oauthlib.common import Request >>> from oauthlib.oauth2 import AuthorizationCodeGrant, BearerToken >>> token = BearerToken(your_validator) >>> grant = AuthorizationCodeGrant(your_validator) >>> request.scopes = ['authorized', 'in', 'some', 'form'] >>> grant.create_authorization_response(request, token) (u'http://client.com/?error=invalid_request&error_description=Missing+response_type+parameter.', None, None, 400) >>> request = Request('https://example.com/authorize?client_id=valid' ... '&redirect_uri=http%3A%2F%2Fclient.com%2F' ... '&response_type=code') >>> request.scopes = ['authorized', 'in', 'some', 'form'] >>> grant.create_authorization_response(request, token) (u'http://client.com/?code=u3F05aEObJuP2k7DordviIgW5wl52N', None, None, 200) >>> # If the client id or redirect uri fails validation >>> grant.create_authorization_response(request, token) Traceback (most recent call last): File "<stdin>", line 1, in <module> File "oauthlib/oauth2/rfc6749/grant_types.py", line 515, in create_authorization_response >>> grant.create_authorization_response(request, token) File "oauthlib/oauth2/rfc6749/grant_types.py", line 591, in validate_authorization_request oauthlib.oauth2.rfc6749.errors.InvalidClientIdError .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 z6Pre resource owner authorization validation ok for %r.z/Fatal client error during validation of %r. %r.N�)Client error during validation of %r. %r.�fragment)r" ZLocationi. zSaving grant %r for %r.)� validate_authorization_requestr r r ZFatalClientError� OAuth2Error� redirect_uriZ error_urir Zadd_params_to_uriZ twotuplesZ response_moder Z_code_modifiers�request_validatorZsave_authorization_code� client_idZ prepare_authorization_response)r r � token_handler�er% r �modifierr r r � create_authorization_response� s8 E ���$ � �z4AuthorizationCodeGrant.create_authorization_responsec C s� | � � }z| �|� t�d|� W nN tjyp } z4t�d||� |�|j� ||j|j fW Y d}~S d}~0 0 |j || j d�}| j D ]}||||�}q�| j �||� | j �|j|j|� |t�|�dfS )a� Validate the authorization code. The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code. The authorization code is bound to the client identifier and redirection URI. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. z#Token request validation ok for %r.r! N)� refresh_token�� )Z_get_default_headers�validate_token_requestr r r r$ �update�headers�jsonZ status_codeZ create_tokenr, Z_token_modifiersr& Z save_tokenZ invalidate_authorization_coder' r �dumps)r r r( r0 r) �tokenr* r r r �create_token_response s $ �z,AuthorizationCodeGrant.create_token_responsec C s� dD ]J}z |j }W n ty2 tjd|d��Y n0 ||v rtjd| |d��q|jsbtj|d��| j�|j|�s~tj|d��t � d|j |j� | � |� i }| j jD ]}|�||�� q�|jdu r�tj|d��n d|jvr�|jd kr�tj|d��| j�|j|j|j|��s*t � d |j|j� tj|d��| j�|j|�d u �rX|jdu �rXtj|d��|jdu�r�|j|d < |jdu �r�d |_|j| jv�r�tj|d��|j|d< | � |� |�|j|j |j|j |d�� | j j D ]}|�||�� �q�|j |fS )a� Check the authorization request for normal and fatal errors. A normal error could be a missing response_type parameter or the client attempting to access scope it is not allowed to ask authorization for. Normal errors can safely be included in the redirection URI and sent back to the client. Fatal errors occur when the client_id or redirect_uri is invalid or missing. These must be caught by the provider and handled, how this is done is outside of the scope of OAuthLib but showing an error page describing the issue is a good idea. :param request: OAuthlib request. :type request: oauthlib.common.Request )r' � response_typer% Zscoper z Unable to parse query string�� descriptionr �Duplicate %s parameter.�r z,Validating redirection uri %s for client %s.Nr Znonez4Client %s is not authorized to use response_type %s.T�code_challenger �code_challenge_method)r' r% r5 r r ) �duplicate_params� ValueErrorr ZInvalidRequestFatalErrorr' ZMissingClientIdErrorr& Zvalidate_client_idZInvalidClientIdErrorr r r% Z_handle_redirects�custom_validatorsZpre_authr/ r5 ZMissingResponseTypeErrorZ UnsupportedResponseTypeErrorZvalidate_response_type�clientZUnauthorizedClientError�is_pkce_requiredr: ZMissingCodeChallengeErrorr; �_code_challenge_methodsZ#UnsupportedCodeChallengeMethodErrorZvalidate_scopesr Z post_auth�scopes)r r �paramr< Z request_info� validatorr r r r# ; sf � �� � z5AuthorizationCodeGrant.validate_authorization_requestc C s� |j dvrtj|d��| jjD ] }||� q |jdu rDtjd|d��dD ] }||jv rHtjd| |d��qH| j� |�r�| j� |�s�t � d|� tj |d��n(| j�|j|�s�t � d|� tj |d��t|jd �s�td ��|jp�|jj|_| �|� | j�|j|j|j|��s.t � d |j|j|j� tj|d��| j�|j|�}|du�r�|jdu �r`tj|d��| j�|j|�}|du �r�tj|d d ��|| jv�r�tj d� |�|d��| � |||j��st � d� tj|d��n<| j� |j|�du �r|jdu �r tj|d��tj|dd ��dD ]$}t ||d�du �rt � d|� �q|j!du �r�d|_"| j�#|j|�|_!t � d|j!� |j!�s�tj$|d��nd|_"t � d|j!� | j�%|j|j|j!|j|��s�t � d|j!|j|j� tj&|d��| jj'D ]}||� �q�dS )zb :param request: OAuthlib request. :type request: oauthlib.common.Request )Zauthorization_codeZopenidr9 NzMissing code parameter.r6 )r' � grant_typer% r8 z!Client authentication failed, %r.r' z[Authenticate client must set the request.client.client_id attribute in authenticate_client.z4Client, %r (%r), is not allowed access to scopes %r.zChallenge method not found)r r7 z*code_challenge_method {} is not supported.z)request provided a invalid code_verifier.TzChallenge not found)�userrB z*request.%s was not set on code validation.z Using default redirect_uri %s.Fz Using provided redirect_uri %sz-Redirect_uri (%r) invalid for client %r (%r).)(rE r ZUnsupportedGrantTypeErrorr> Z pre_tokenr ZInvalidRequestErrorr< r& Z client_authentication_requiredZauthenticate_clientr r ZInvalidClientErrorZauthenticate_client_idr' r r? �NotImplementedErrorZvalidate_grant_typeZ validate_coderB ZInvalidGrantErrorZget_code_challengeZ code_verifierZMissingCodeVerifierErrorZget_code_challenge_methodrA Z ServerError�format�validate_code_challenger@ �getattrr% Zusing_default_redirect_uriZget_default_redirect_uriZMissingRedirectURIErrorZconfirm_redirect_uriZMismatchingRedirectURIErrorZ post_token)r r rD rC r �challenge_method�attrr r r r. � s� � � � � �� �� � z-AuthorizationCodeGrant.validate_token_requestc C s* || j v r| j | ||�S td| ��d S )NzUnknown challenge_method %s)rA rG )r r rK r r r r rI s z.AuthorizationCodeGrant.validate_code_challengeN)�__name__� __module__� __qualname__�__doc__Zdefault_response_modeZresponse_typesr r rA r r+ r4 r# r. rI r r r r r @ s S�k"unr )rP r r r1 ZloggingZoauthlibr � r �baser Z getLoggerrM r r r r r r r r �<module> s " oauth2/rfc6749/grant_types/__pycache__/implicit.cpython-39.pyc 0000644 00000031040 15125174064 0020067 0 ustar 00 a \��`�A � @ sN d Z ddlZddlmZ ddlmZ ddlmZ e�e �Z G dd � d e�Z dS ) zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�common� )�errors� )� GrantTypeBasec @ sD e Zd ZdZdgZdZdd� Zdd� Zdd � Zd d � Z dd d�Z d S )� ImplicitGranta� `Implicit Grant`_ The implicit grant type is used to obtain access tokens (it does not support the issuance of refresh tokens) and is optimized for public clients known to operate a particular redirection URI. These clients are typically implemented in a browser using a scripting language such as JavaScript. Unlike the authorization code grant type, in which the client makes separate requests for authorization and for an access token, the client receives the access token as the result of the authorization request. The implicit grant type does not include client authentication, and relies on the presence of the resource owner and the registration of the redirection URI. Because the access token is encoded into the redirection URI, it may be exposed to the resource owner and other applications residing on the same device:: +----------+ | Resource | | Owner | | | +----------+ ^ | (B) +----|-----+ Client Identifier +---------------+ | -+----(A)-- & Redirection URI --->| | | User- | | Authorization | | Agent -|----(B)-- User authenticates -->| Server | | | | | | |<---(C)--- Redirection URI ----<| | | | with Access Token +---------------+ | | in Fragment | | +---------------+ | |----(D)--- Redirection URI ---->| Web-Hosted | | | without Fragment | Client | | | | Resource | | (F) |<---(E)------- Script ---------<| | | | +---------------+ +-|--------+ | | (A) (G) Access Token | | ^ v +---------+ | | | Client | | | +---------+ Note: The lines illustrating steps (A) and (B) are broken into two parts as they pass through the user-agent. Figure 4: Implicit Grant Flow The flow illustrated in Figure 4 includes the following steps: (A) The client initiates the flow by directing the resource owner's user-agent to the authorization endpoint. The client includes its client identifier, requested scope, local state, and a redirection URI to which the authorization server will send the user-agent back once access is granted (or denied). (B) The authorization server authenticates the resource owner (via the user-agent) and establishes whether the resource owner grants or denies the client's access request. (C) Assuming the resource owner grants access, the authorization server redirects the user-agent back to the client using the redirection URI provided earlier. The redirection URI includes the access token in the URI fragment. (D) The user-agent follows the redirection instructions by making a request to the web-hosted client resource (which does not include the fragment per [RFC2616]). The user-agent retains the fragment information locally. (E) The web-hosted client resource returns a web page (typically an HTML document with an embedded script) capable of accessing the full redirection URI including the fragment retained by the user-agent, and extracting the access token (and other parameters) contained in the fragment. (F) The user-agent executes the script provided by the web-hosted client resource locally, which extracts the access token. (G) The user-agent passes the access token to the client. See `Section 10.3`_ and `Section 10.16`_ for important security considerations when using the implicit grant. .. _`Implicit Grant`: https://tools.ietf.org/html/rfc6749#section-4.2 .. _`Section 10.3`: https://tools.ietf.org/html/rfc6749#section-10.3 .. _`Section 10.16`: https://tools.ietf.org/html/rfc6749#section-10.16 �tokenFc C s | � ||�S )aM Create an authorization response. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: response_type REQUIRED. Value MUST be set to "token" for standard OAuth2 implicit flow or "id_token token" or just "id_token" for OIDC implicit flow client_id REQUIRED. The client identifier as described in `Section 2.2`_. redirect_uri OPTIONAL. As described in `Section 3.1.2`_. scope OPTIONAL. The scope of the access request as described by `Section 3.3`_. state RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. The authorization server validates the request to ensure that all required parameters are present and valid. The authorization server MUST verify that the redirection URI to which it will redirect the access token matches a redirection URI registered by the client as described in `Section 3.1.2`_. .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B )�create_token_response)�self�request� token_handler� r �P/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/implicit.py� create_authorization_responsev s -z+ImplicitGrant.create_authorization_responsec C s z| � |� W n� tjyD } z t�d||� � W Y d}~nZd}~0 tjy� } z8t�d||� dtj|j|j dd�iddfW Y d}~S d}~0 0 d|j � � v r�|j |d d �}ni }|j dur�|j |d < | jD ]}||||�}q�d|j � � v �r| j�||� | �||i dd�S ) a� Return token or error embedded in the URI fragment. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. If the resource owner grants the access request, the authorization server issues an access token and delivers it to the client by adding the following parameters to the fragment component of the redirection URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: access_token REQUIRED. The access token issued by the authorization server. token_type REQUIRED. The type of the token issued as described in `Section 7.1`_. Value is case insensitive. expires_in RECOMMENDED. The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. scope OPTIONAL, if identical to the scope requested by the client; otherwise, REQUIRED. The scope of the access token as described by `Section 3.3`_. state REQUIRED if the "state" parameter was present in the client authorization request. The exact value received from the client. The authorization server MUST NOT issue a refresh token. .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1 z/Fatal client error during validation of %r. %r.Nz)Client error during validation of %r. %r.ZLocationT)�fragmenti. r F)Z refresh_token�state)�validate_token_requestr ZFatalClientError�log�debugZ OAuth2Errorr Zadd_params_to_uri� redirect_uriZ twotuples� response_type�splitZ create_tokenr Z_token_modifiers�request_validatorZ save_tokenZ prepare_authorization_response)r r r �er �modifierr r r r � s4 ,��� �z#ImplicitGrant.create_token_responsec C s | � |�S )zb :param request: OAuthlib request. :type request: oauthlib.common.Request )r )r r r r r � validate_authorization_request� s z,ImplicitGrant.validate_authorization_requestc C s` dD ]J}z |j }W n ty2 tjd|d��Y n0 ||v rtjd| |d��q|jsbtj|d��| j�|j|�s~tj|d��| � |� | � || j j �}|j du r�tj|d��n"t|j �� ��| j�s�tj|d��t�d|j|j� | j�|j|j |j|��s t�d|j|j � tj|d��| �|� |�|j|j|j |j |d �� | � || j j |�}|j |fS ) aC Check the token request for normal and fatal errors. :param request: OAuthlib request. :type request: oauthlib.common.Request This method is very similar to validate_authorization_request in the AuthorizationCodeGrant but differ in a few subtle areas. A normal error could be a missing response_type parameter or the client attempting to access scope it is not allowed to ask authorization for. Normal errors can safely be included in the redirection URI and sent back to the client. Fatal errors occur when the client_id or redirect_uri is invalid or missing. These must be caught by the provider and handled, how this is done is outside of the scope of OAuthLib but showing an error page describing the issue is a good idea. )� client_idr r Zscoper z Unable to parse query string)� descriptionr zDuplicate %s parameter.)r Nz9Validating use of response_type token for client %r (%r).z4Client %s is not authorized to use response_type %s.)r r r r r ) �duplicate_params� ValueErrorr ZInvalidRequestFatalErrorr ZMissingClientIdErrorr Zvalidate_client_idZInvalidClientIdErrorZ_handle_redirects�_run_custom_validatorsZcustom_validatorsZall_prer ZMissingResponseTypeError�setr �issubset�response_typesZ UnsupportedResponseTypeErrorr r ZclientZvalidate_response_typeZUnauthorizedClientErrorZvalidate_scopes�updater r Zall_postZscopes)r r Zparamr � request_infor r r r sX � � �� ��z$ImplicitGrant.validate_token_requestNc C s< |d u r i n|� � }|D ] }||�}|d ur|�|� q|S )N)�copyr$ )r r Z validationsr% Z validator�resultr r r r k s z$ImplicitGrant._run_custom_validators)N) �__name__� __module__� __qualname__�__doc__r# Zgrant_allows_refresh_tokenr r r r r r r r r r s b/Zh �r ) r+ ZloggingZoauthlibr � r �baser Z getLoggerr( r r r r r r �<module> s oauth2/rfc6749/grant_types/__pycache__/base.cpython-39.opt-1.pyc 0000644 00000021010 15125174064 0020122 0 ustar 00 a \��`�' � @ sv d Z ddlZddlmZ ddlmZ ddlmZmZ ddl m Z ddl m Z e� e�ZG d d � d �ZG d d � d �ZdS ) zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�chain)�add_params_to_uri)�errors�utils)�is_absolute_uri� )�RequestValidatorc @ s0 e Zd ZdZdd� Zedd� �Zedd� �ZdS ) �ValidatorsContainera� Container object for holding custom validator callables to be invoked as part of the grant type `validate_authorization_request()` or `validate_authorization_request()` methods on the various grant types. Authorization validators must be callables that take a request object and return a dict, which may contain items to be added to the `request_info` returned from the grant_type after validation. Token validators must be callables that take a request object and return None. Both authorization validators and token validators may raise OAuth2 exceptions if validation conditions fail. Authorization validators added to `pre_auth` will be run BEFORE the standard validations (but after the critical ones that raise fatal errors) as part of `validate_authorization_request()` Authorization validators added to `post_auth` will be run AFTER the standard validations as part of `validate_authorization_request()` Token validators added to `pre_token` will be run BEFORE the standard validations as part of `validate_token_request()` Token validators added to `post_token` will be run AFTER the standard validations as part of `validate_token_request()` For example: >>> def my_auth_validator(request): ... return {'myval': True} >>> auth_code_grant = AuthorizationCodeGrant(request_validator) >>> auth_code_grant.custom_validators.pre_auth.append(my_auth_validator) >>> def my_token_validator(request): ... if not request.everything_okay: ... raise errors.OAuth2Error("uh-oh") >>> auth_code_grant.custom_validators.post_token.append(my_token_validator) c C s || _ || _|| _|| _d S �N)�pre_auth� post_auth� pre_token� post_token)�selfr r r r � r �L/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/base.py�__init__: s z ValidatorsContainer.__init__c C s t | j| j�S r )r r r �r r r r �all_preA s zValidatorsContainer.all_prec C s t | j| j�S r )r r r r r r r �all_postE s z ValidatorsContainer.all_postN)�__name__� __module__� __qualname__�__doc__r �propertyr r r r r r r s ( r c @ s� e Zd ZdZdZdZdZdgZd dd�Zdd� Z d d � Z d d � Z d d� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � ZdS ) � GrantTypeBaseN�fragmentT�codec K sT |pt � | _| j| _| j| _| �|� g | _g | _|�� D ]\}}t| ||� q:d S r ) r �request_validator�response_types� refresh_token�_setup_custom_validators�_code_modifiers�_token_modifiers�items�setattr)r r �kwargs�kw�valr r r r Q s zGrantTypeBase.__init__c C st |� dg �}|� dg �}|� dg �}|� dg �}t| d�s`|sB|rXd�| jj�}t|��d\}}t||||�| _d S )Nr r r r Z validate_authorization_requestzK{} does not support authorization validators. Use token validators instead.)r r )�get�hasattr�format� __class__r � ValueErrorr Zcustom_validators)r r& r r r r �msgr r r r! ^ s ��z&GrantTypeBase._setup_custom_validatorsc C s | j �|� d S r )r �append)r � response_typer r r �register_response_typem s z$GrantTypeBase.register_response_typec C s | j �|� d S r )r" r/ �r �modifierr r r �register_code_modifierp s z$GrantTypeBase.register_code_modifierc C s | j �|� d S r )r# r/ r2 r r r �register_token_modifiers s z%GrantTypeBase.register_token_modifierc C s t d��dS �z� :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. z&Subclasses must implement this method.N��NotImplementedError�r �request� token_handlerr r r � create_authorization_responsev s z+GrantTypeBase.create_authorization_responsec C s t d��dS r6 r7 r9 r r r �create_token_response s z#GrantTypeBase.create_token_responsec C s& |j dvr|S |�|j|dd�� |S )z� :param token: :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. :param request: OAuthlib request. :type request: oauthlib.common.Request )�tokenz code tokenzid_token tokenzcode id_token tokenF)r )r0 �updateZ create_token)r r> r; r: r r r � add_token� s zGrantTypeBase.add_tokenc C sH t |dd�}| j�||j|j|�sDt�d|j|j|j� tj |d��dS )�b :param request: OAuthlib request. :type request: oauthlib.common.Request � client_idNz2Unauthorized from %r (%r) access to grant type %s.�r: ) �getattrr �validate_grant_typeZ grant_type�client�log�debugrB r ZUnauthorizedClientError)r r: rB r r r rE � s � �z!GrantTypeBase.validate_grant_typec C sh |j s*t�|j�p&t�| j�|j|��|_ t�d|j |j|j � | j� |j|j |j |�sdt j |d��dS )rA z2Validating access to scopes %r for client %r (%r).rC N) Zscopesr Z scope_to_listZscoper Zget_default_scopesrB rG rH rF �validate_scopesr ZInvalidScopeError�r r: r r r rI � s � � �z GrantTypeBase.validate_scopesc C s� |j p | j|_ |j dvr2t�d|j | j� | j|_ |�� }|jdkrd|�dd�}|r`d|fg}ng }|j dkr�t|j|dd�|d < |||fS |j d kr�t|j|d d�|d < |||fS t d ��dS ) a Place token according to response mode. Base classes can define a default response mode for their authorization response by overriding the static `default_response_mode` member. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token: :param headers: :param body: :param status: )�queryr z+Overriding invalid response mode %s with %sZnone�stateNrK F)r ZLocationr Tz1Subclasses must set a valid default_response_mode) Z response_mode�default_response_moderG rH r$ r0 r) r � redirect_urir8 )r r: r> Zheaders�body�statusZ token_itemsrL r r r � prepare_authorization_response� s2 � � � �z,GrantTypeBase.prepare_authorization_responsec C s dddd�S )z+Create default headers for grant responses.zapplication/jsonzno-storezno-cache)z Content-Typez Cache-ControlZPragmar r r r r �_get_default_headers� s �z"GrantTypeBase._get_default_headersc C s� |j d urVd|_t�d|j � t|j �s4tj|d��| j�|j |j |�s�tj |d��nN| j� |j |�|_ d|_t�d|j � |j s�tj |d��t|j �s�tj|d��d S )NFz Using provided redirect_uri %srC Tz Using default redirect_uri %s.) rN Zusing_default_redirect_urirG rH r r ZInvalidRedirectURIErrorr Zvalidate_redirect_urirB ZMismatchingRedirectURIErrorZget_default_redirect_uriZMissingRedirectURIErrorrJ r r r �_handle_redirects� s$ �� z GrantTypeBase._handle_redirects)N)r r r Z error_urir rM r r r r! r1 r4 r5 r< r= r@ rE rI rQ rR rS r r r r r J s$ *r )r Zlogging� itertoolsr Zoauthlib.commonr Zoauthlib.oauth2.rfc6749r r Zoauthlib.uri_validater r r Z getLoggerr rG r r r r r r �<module> s 9 oauth2/rfc6749/grant_types/__pycache__/refresh_token.cpython-39.opt-1.pyc 0000644 00000010710 15125174064 0022053 0 ustar 00 a \��`� � @ sN d Z ddlZddlZddlmZmZ ddlmZ e�e �Z G dd� de�Z dS ) zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N� )�errors�utils� )� GrantTypeBasec s2 e Zd ZdZd � fdd� Zdd� Zdd � Z� ZS ) �RefreshTokenGrantzi`Refresh token grant`_ .. _`Refresh token grant`: https://tools.ietf.org/html/rfc6749#section-6 NTc s t � j|fd|i|�� d S )N�issue_new_refresh_tokens)�super�__init__)�self�request_validatorr �kwargs�� __class__� �U/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/refresh_token.pyr s ���zRefreshTokenGrant.__init__c C s� | � � }zt�d|� | �|� W nL tjyn } z2t�d|� |�|j� ||j|j fW Y d}~S d}~0 0 |j || j d�}| j D ] }||�}q�| j �||� t�d|j|j|� |t�|�dfS )a� Create a new access token from a refresh_token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. If valid and authorized, the authorization server issues an access token as described in `Section 5.1`_. If the request failed verification or is invalid, the authorization server returns an error response as described in `Section 5.2`_. The authorization server MAY issue a new refresh token, in which case the client MUST discard the old refresh token and replace it with the new refresh token. The authorization server MAY revoke the old refresh token after issuing a new refresh token to the client. If a new refresh token is issued, the refresh token scope MUST be identical to that of the refresh token included by the client in the request. .. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1 .. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2 z%Validating refresh token request, %r.z"Client error in token request, %s.N)� refresh_tokenz+Issuing new token to client id %r (%r), %r.�� )Z_get_default_headers�log�debug�validate_token_requestr Z OAuth2Error�update�headers�jsonZ status_codeZ create_tokenr Z_token_modifiersr Z save_token� client_id�client�dumps)r �requestZ token_handlerr �e�token�modifierr r r �create_token_response s$ $� �z'RefreshTokenGrant.create_token_responsec s� |j dkrtj|d��| jjD ] }||� q |jdu rDtjd|d��| j�|�r�t � d|� | j� |�s�t � d|� tj |d��n(| j� |j|�s�t � d|� tj |d��| �|� t � d |j|j� | j�|j|j|�s�t � d |j|j� tj|d��t�| j�|j|��� |j�rtt�|j�|_t� fd d �|jD ���sz| j�|j|j|��szt � d |j|j� tj|d��n� |_| jjD ]}||� �q�dS )zb :param request: OAuthlib request. :type request: oauthlib.common.Request r )r Nz Missing refresh token parameter.)� descriptionr zAuthenticating client, %r.z$Invalid client (%r), denying access.z!Client authentication failed, %r.z*Validating refresh token %s for client %r.z)Invalid refresh token, %s, for client %r.c 3 s | ]}|� v V qd S )Nr )�.0�s�Zoriginal_scopesr r � <genexpr>} � z;RefreshTokenGrant.validate_token_request.<locals>.<genexpr>z+Refresh token %s lack requested scopes, %r.) Z grant_typer ZUnsupportedGrantTypeErrorZcustom_validatorsZ pre_tokenr ZInvalidRequestErrorr Z client_authentication_requiredr r Zauthenticate_clientZInvalidClientErrorZauthenticate_client_idr Zvalidate_grant_typer Zvalidate_refresh_tokenZInvalidGrantErrorr Z scope_to_listZget_original_scopesZscopeZscopes�allZis_within_original_scopeZInvalidScopeErrorZ post_token)r r Z validatorr r% r r J s^ � � �� �� ��� z(RefreshTokenGrant.validate_token_request)NT)�__name__� __module__� __qualname__�__doc__r r! r � __classcell__r r r r r s �-r ) r, r Zlogging� r r �baser Z getLoggerr) r r r r r r �<module> s oauth2/rfc6749/grant_types/__pycache__/resource_owner_password_credentials.cpython-39.pyc 0000644 00000017051 15125174064 0025623 0 ustar 00 a \��`D! � @ sJ d Z ddlZddlZddlmZ ddlmZ e�e�Z G dd� de�Z dS ) zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N� )�errors� )� GrantTypeBasec @ s e Zd ZdZdd� Zdd� ZdS )�%ResourceOwnerPasswordCredentialsGranta! `Resource Owner Password Credentials Grant`_ The resource owner password credentials grant type is suitable in cases where the resource owner has a trust relationship with the client, such as the device operating system or a highly privileged application. The authorization server should take special care when enabling this grant type and only allow it when other flows are not viable. This grant type is suitable for clients capable of obtaining the resource owner's credentials (username and password, typically using an interactive form). It is also used to migrate existing clients using direct authentication schemes such as HTTP Basic or Digest authentication to OAuth by converting the stored credentials to an access token:: +----------+ | Resource | | Owner | | | +----------+ v | Resource Owner (A) Password Credentials | v +---------+ +---------------+ | |>--(B)---- Resource Owner ------->| | | | Password Credentials | Authorization | | Client | | Server | | |<--(C)---- Access Token ---------<| | | | (w/ Optional Refresh Token) | | +---------+ +---------------+ Figure 5: Resource Owner Password Credentials Flow The flow illustrated in Figure 5 includes the following steps: (A) The resource owner provides the client with its username and password. (B) The client requests an access token from the authorization server's token endpoint by including the credentials received from the resource owner. When making the request, the client authenticates with the authorization server. (C) The authorization server authenticates the client and validates the resource owner credentials, and if valid, issues an access token. .. _`Resource Owner Password Credentials Grant`: https://tools.ietf.org/html/rfc6749#section-4.3 c C s. | � � }z�| j�|�rHt�d|� | j�|�spt�d|� tj|d��n(| j�|j |�spt�d|� tj|d��t�d|� | � |� W nL tj y� } z2t�d|� |� |j � ||j|jfW Y d}~S d}~0 0 |�|| j�}| jD ] }||�}q�| j�||� t�d||j |j|j� |t�|�dfS ) a� Return token or error in json format. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. If the access token request is valid and authorized, the authorization server issues an access token and optional refresh token as described in `Section 5.1`_. If the request failed client authentication or is invalid, the authorization server returns an error response as described in `Section 5.2`_. .. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1 .. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2 zAuthenticating client, %r.z!Client authentication failed, %r.��requestz$Validating access token request, %r.z"Client error in token request, %s.Nz6Issuing token %r to client id %r (%r) and username %s.�� )Z_get_default_headers�request_validatorZ client_authentication_required�log�debugZauthenticate_clientr ZInvalidClientErrorZauthenticate_client_id� client_id�validate_token_requestZ OAuth2Error�update�headers�jsonZ status_codeZ create_tokenZ refresh_tokenZ_token_modifiersZ save_token�client�username�dumps)�selfr Z token_handlerr �e�token�modifier� r �k/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py�create_token_responseE s0 $ �z;ResourceOwnerPasswordCredentialsGrant.create_token_responsec C s | j jD ] }||� qdD ]"}t||d�stjd| |d��qdD ] }||jv rBtjd| |d��qB|jdksztj|d��t� d |j � | j � |j |j |j|�s�tjd |d��nt|jd �s�td ��t� d |j� | �|� |jr�|jp�|jj|_| �|� | j jD ]}||� �qdS )a� :param request: OAuthlib request. :type request: oauthlib.common.Request The client makes a request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format per Appendix B with a character encoding of UTF-8 in the HTTP request entity-body: grant_type REQUIRED. Value MUST be set to "password". username REQUIRED. The resource owner username. password REQUIRED. The resource owner password. scope OPTIONAL. The scope of the access request as described by `Section 3.3`_. If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in `Section 3.2.1`_. The authorization server MUST: o require client authentication for confidential clients or for any client that was issued client credentials (or with other authentication requirements), o authenticate the client if client authentication is included, and o validate the resource owner password credentials using its existing password validation algorithm. Since this access token request utilizes the resource owner's password, the authorization server MUST protect the endpoint against brute force attacks (e.g., using rate-limitation or generating alerts). .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 )� grant_typer �passwordNz Request is missing %s parameter.r )r r r ZscopezDuplicate %s parameter.)� descriptionr r zValidating username %s.zInvalid credentials given.r zUValidate user must set the request.client.client_id attribute in authenticate_client.z Authorizing access to user %r.)Zcustom_validatorsZ pre_token�getattrr ZInvalidRequestErrorZduplicate_paramsr ZUnsupportedGrantTypeErrorr r r r Z validate_userr r ZInvalidGrantError�hasattr�NotImplementedError�userZvalidate_grant_typer Zvalidate_scopesZ post_token)r r Z validatorZparamr r r r r s< / � �� � z<ResourceOwnerPasswordCredentialsGrant.validate_token_requestN)�__name__� __module__� __qualname__�__doc__r r r r r r r s 5-r ) r& r Zlogging� r �baser Z getLoggerr# r r r r r r �<module> s oauth2/rfc6749/grant_types/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000001116 15125174064 0020754 0 ustar 00 a \��`p � @ sD d Z ddlmZ ddlmZ ddlmZ ddlmZ ddl m Z dS )zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � )�AuthorizationCodeGrant)�ClientCredentialsGrant)� ImplicitGrant)�RefreshTokenGrant)�%ResourceOwnerPasswordCredentialsGrantN) �__doc__Zauthorization_coder Zclient_credentialsr Zimplicitr Z refresh_tokenr Z#resource_owner_password_credentialsr � r r �P/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/__init__.py�<module> s oauth2/rfc6749/grant_types/__pycache__/authorization_code.cpython-39.opt-1.pyc 0000644 00000043437 15125174064 0023123 0 ustar 00 a \��`Ye � @ sv d Z ddlZddlZddlZddlZddlmZ ddlmZ ddl m Z e� e �Z dd � Zd d � ZG d d � d e �ZdS )zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�common� )�errors� )� GrantTypeBasec C s& t �t�| �� ��� ��� �d�|kS )a0 If the "code_challenge_method" from `Section 4.3`_ was "S256", the received "code_verifier" is hashed by SHA-256, base64url-encoded, and then compared to the "code_challenge", i.e.: BASE64URL-ENCODE(SHA256(ASCII(code_verifier))) == code_challenge How to implement a base64url-encoding function without padding, based upon the standard base64-encoding function that uses padding. To be concrete, example C# code implementing these functions is shown below. Similar code could be used in other languages. static string base64urlencode(byte [] arg) { string s = Convert.ToBase64String(arg); // Regular base64 encoder s = s.Split('=')[0]; // Remove any trailing '='s s = s.Replace('+', '-'); // 62nd char of encoding s = s.Replace('/', '_'); // 63rd char of encoding return s; } In python urlsafe_b64encode is already replacing '+' and '/', but preserve the trailing '='. So we have to remove it. .. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3 �=)�base64Zurlsafe_b64encode�hashlibZsha256�encode�digest�decode�rstrip��verifier� challenge� r �Z/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py�code_challenge_method_s256 s ���r c C s | |kS )z� If the "code_challenge_method" from `Section 4.3`_ was "plain", they are compared directly, i.e.: code_verifier == code_challenge. .. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3 r r r r r �code_challenge_method_plain4 s r c @ sT e Zd ZdZdZdgZeed�Zdd� Z dd� Z d d � Z d d � Z d d� Z dd� ZdS )�AuthorizationCodeGranta� `Authorization Code Grant`_ The authorization code grant type is used to obtain both access tokens and refresh tokens and is optimized for confidential clients. Since this is a redirection-based flow, the client must be capable of interacting with the resource owner's user-agent (typically a web browser) and capable of receiving incoming requests (via redirection) from the authorization server:: +----------+ | Resource | | Owner | | | +----------+ ^ | (B) +----|-----+ Client Identifier +---------------+ | -+----(A)-- & Redirection URI ---->| | | User- | | Authorization | | Agent -+----(B)-- User authenticates --->| Server | | | | | | -+----(C)-- Authorization Code ---<| | +-|----|---+ +---------------+ | | ^ v (A) (C) | | | | | | ^ v | | +---------+ | | | |>---(D)-- Authorization Code ---------' | | Client | & Redirection URI | | | | | |<---(E)----- Access Token -------------------' +---------+ (w/ Optional Refresh Token) Note: The lines illustrating steps (A), (B), and (C) are broken into two parts as they pass through the user-agent. Figure 3: Authorization Code Flow The flow illustrated in Figure 3 includes the following steps: (A) The client initiates the flow by directing the resource owner's user-agent to the authorization endpoint. The client includes its client identifier, requested scope, local state, and a redirection URI to which the authorization server will send the user-agent back once access is granted (or denied). (B) The authorization server authenticates the resource owner (via the user-agent) and establishes whether the resource owner grants or denies the client's access request. (C) Assuming the resource owner grants access, the authorization server redirects the user-agent back to the client using the redirection URI provided earlier (in the request or during client registration). The redirection URI includes an authorization code and any local state provided by the client earlier. (D) The client requests an access token from the authorization server's token endpoint by including the authorization code received in the previous step. When making the request, the client authenticates with the authorization server. The client includes the redirection URI used to obtain the authorization code for verification. (E) The authorization server authenticates the client, validates the authorization code, and ensures that the redirection URI received matches the URI used to redirect the client in step (C). If valid, the authorization server responds back with an access token and, optionally, a refresh token. OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. A technique to mitigate against the threat through the use of Proof Key for Code Exchange (PKCE, pronounced "pixy") is implemented in the current oauthlib implementation. .. _`Authorization Code Grant`: https://tools.ietf.org/html/rfc6749#section-4.1 .. _`PKCE`: https://tools.ietf.org/html/rfc7636 �query�code)�plainZS256c C s8 dt �� i}t|d�r&|jr&|j|d< t�d||� |S )z� Generates an authorization grant represented as a dictionary. :param request: OAuthlib request. :type request: oauthlib.common.Request r �statez3Created authorization code grant %r for request %r.)r Zgenerate_token�hasattrr �log�debug)�self�request�grantr r r �create_authorization_code� s �z0AuthorizationCodeGrant.create_authorization_codec C s z| � |� t�d|� W n� tjyP } z t�d||� � W Y d}~nrd}~0 tjy� } zPt�d||� |jpx| j|_tj |j|j |j dkd�}d|iddfW Y d}~S d}~0 0 | � |�}| j D ]}||||�}q�t�d ||� | j�|j||� | �||i dd�S ) ag The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: response_type REQUIRED. Value MUST be set to "code" for standard OAuth2 authorization flow. For OpenID Connect it must be one of "code token", "code id_token", or "code token id_token" - we essentially test that "code" appears in the response_type. client_id REQUIRED. The client identifier as described in `Section 2.2`_. redirect_uri OPTIONAL. As described in `Section 3.1.2`_. scope OPTIONAL. The scope of the access request as described by `Section 3.3`_. state RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. The client directs the resource owner to the constructed URI using an HTTP redirection response, or by other means available to it via the user-agent. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. :returns: headers, body, status :raises: FatalClientError on invalid redirect URI or client id. A few examples:: >>> from your_validator import your_validator >>> request = Request('https://example.com/authorize?client_id=valid' ... '&redirect_uri=http%3A%2F%2Fclient.com%2F') >>> from oauthlib.common import Request >>> from oauthlib.oauth2 import AuthorizationCodeGrant, BearerToken >>> token = BearerToken(your_validator) >>> grant = AuthorizationCodeGrant(your_validator) >>> request.scopes = ['authorized', 'in', 'some', 'form'] >>> grant.create_authorization_response(request, token) (u'http://client.com/?error=invalid_request&error_description=Missing+response_type+parameter.', None, None, 400) >>> request = Request('https://example.com/authorize?client_id=valid' ... '&redirect_uri=http%3A%2F%2Fclient.com%2F' ... '&response_type=code') >>> request.scopes = ['authorized', 'in', 'some', 'form'] >>> grant.create_authorization_response(request, token) (u'http://client.com/?code=u3F05aEObJuP2k7DordviIgW5wl52N', None, None, 200) >>> # If the client id or redirect uri fails validation >>> grant.create_authorization_response(request, token) Traceback (most recent call last): File "<stdin>", line 1, in <module> File "oauthlib/oauth2/rfc6749/grant_types.py", line 515, in create_authorization_response >>> grant.create_authorization_response(request, token) File "oauthlib/oauth2/rfc6749/grant_types.py", line 591, in validate_authorization_request oauthlib.oauth2.rfc6749.errors.InvalidClientIdError .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 z6Pre resource owner authorization validation ok for %r.z/Fatal client error during validation of %r. %r.N�)Client error during validation of %r. %r.�fragment)r" ZLocationi. zSaving grant %r for %r.)� validate_authorization_requestr r r ZFatalClientError� OAuth2Error� redirect_uriZ error_urir Zadd_params_to_uriZ twotuplesZ response_moder Z_code_modifiers�request_validatorZsave_authorization_code� client_idZ prepare_authorization_response)r r � token_handler�er% r �modifierr r r � create_authorization_response� s8 E ���$ � �z4AuthorizationCodeGrant.create_authorization_responsec C s� | � � }z| �|� t�d|� W nN tjyp } z4t�d||� |�|j� ||j|j fW Y d}~S d}~0 0 |j || j d�}| j D ]}||||�}q�| j �||� | j �|j|j|� |t�|�dfS )a� Validate the authorization code. The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code. The authorization code is bound to the client identifier and redirection URI. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. z#Token request validation ok for %r.r! N)� refresh_token�� )Z_get_default_headers�validate_token_requestr r r r$ �update�headers�jsonZ status_codeZ create_tokenr, Z_token_modifiersr& Z save_tokenZ invalidate_authorization_coder' r �dumps)r r r( r0 r) �tokenr* r r r �create_token_response s $ �z,AuthorizationCodeGrant.create_token_responsec C s� dD ]J}z |j }W n ty2 tjd|d��Y n0 ||v rtjd| |d��q|jsbtj|d��| j�|j|�s~tj|d��t � d|j |j� | � |� i }| j jD ]}|�||�� q�|jdu r�tj|d��n d|jvr�|jd kr�tj|d��| j�|j|j|j|��s*t � d |j|j� tj|d��| j�|j|�d u �rX|jdu �rXtj|d��|jdu�r�|j|d < |jdu �r�d |_|j| jv�r�tj|d��|j|d< | � |� |�|j|j |j|j |d�� | j j D ]}|�||�� �q�|j |fS )a� Check the authorization request for normal and fatal errors. A normal error could be a missing response_type parameter or the client attempting to access scope it is not allowed to ask authorization for. Normal errors can safely be included in the redirection URI and sent back to the client. Fatal errors occur when the client_id or redirect_uri is invalid or missing. These must be caught by the provider and handled, how this is done is outside of the scope of OAuthLib but showing an error page describing the issue is a good idea. :param request: OAuthlib request. :type request: oauthlib.common.Request )r' � response_typer% Zscoper z Unable to parse query string�� descriptionr �Duplicate %s parameter.�r z,Validating redirection uri %s for client %s.Nr Znonez4Client %s is not authorized to use response_type %s.T�code_challenger �code_challenge_method)r' r% r5 r r ) �duplicate_params� ValueErrorr ZInvalidRequestFatalErrorr' ZMissingClientIdErrorr& Zvalidate_client_idZInvalidClientIdErrorr r r% Z_handle_redirects�custom_validatorsZpre_authr/ r5 ZMissingResponseTypeErrorZ UnsupportedResponseTypeErrorZvalidate_response_type�clientZUnauthorizedClientError�is_pkce_requiredr: ZMissingCodeChallengeErrorr; �_code_challenge_methodsZ#UnsupportedCodeChallengeMethodErrorZvalidate_scopesr Z post_auth�scopes)r r �paramr< Z request_info� validatorr r r r# ; sf � �� � z5AuthorizationCodeGrant.validate_authorization_requestc C s� |j dvrtj|d��| jjD ] }||� q |jdu rDtjd|d��dD ] }||jv rHtjd| |d��qH| j� |�r�| j� |�s�t � d|� tj |d��n(| j�|j|�s�t � d|� tj |d��t|jd �s�td ��|jp�|jj|_| �|� | j�|j|j|j|��s.t � d |j|j|j� tj|d��| j�|j|�}|du�r�|jdu �r`tj|d��| j�|j|�}|du �r�tj|d d ��|| jv�r�tj d� |�|d��| � |||j��st � d� tj|d��n<| j� |j|�du �r|jdu �r tj|d��tj|dd ��dD ]$}t ||d�du �rt � d|� �q|j!du �r�d|_"| j�#|j|�|_!t � d|j!� |j!�s�tj$|d��nd|_"t � d|j!� | j�%|j|j|j!|j|��s�t � d|j!|j|j� tj&|d��| jj'D ]}||� �q�dS )zb :param request: OAuthlib request. :type request: oauthlib.common.Request )Zauthorization_codeZopenidr9 NzMissing code parameter.r6 )r' � grant_typer% r8 z!Client authentication failed, %r.r' z[Authenticate client must set the request.client.client_id attribute in authenticate_client.z4Client, %r (%r), is not allowed access to scopes %r.zChallenge method not found)r r7 z*code_challenge_method {} is not supported.z)request provided a invalid code_verifier.TzChallenge not found)�userrB z*request.%s was not set on code validation.z Using default redirect_uri %s.Fz Using provided redirect_uri %sz-Redirect_uri (%r) invalid for client %r (%r).)(rE r ZUnsupportedGrantTypeErrorr> Z pre_tokenr ZInvalidRequestErrorr< r& Z client_authentication_requiredZauthenticate_clientr r ZInvalidClientErrorZauthenticate_client_idr' r r? �NotImplementedErrorZvalidate_grant_typeZ validate_coderB ZInvalidGrantErrorZget_code_challengeZ code_verifierZMissingCodeVerifierErrorZget_code_challenge_methodrA Z ServerError�format�validate_code_challenger@ �getattrr% Zusing_default_redirect_uriZget_default_redirect_uriZMissingRedirectURIErrorZconfirm_redirect_uriZMismatchingRedirectURIErrorZ post_token)r r rD rC r �challenge_method�attrr r r r. � s� � � � � �� �� � z-AuthorizationCodeGrant.validate_token_requestc C s* || j v r| j | ||�S td| ��d S )NzUnknown challenge_method %s)rA rG )r r rK r r r r rI s z.AuthorizationCodeGrant.validate_code_challengeN)�__name__� __module__� __qualname__�__doc__Zdefault_response_modeZresponse_typesr r rA r r+ r4 r# r. rI r r r r r @ s S�k"unr )rP r r r1 ZloggingZoauthlibr � r �baser Z getLoggerrM r r r r r r r r �<module> s " oauth2/rfc6749/grant_types/__pycache__/client_credentials.cpython-39.opt-1.pyc 0000644 00000011213 15125174064 0023047 0 ustar 00 a \��`� � @ sJ d Z ddlZddlZddlmZ ddlmZ e�e�Z G dd� de�Z dS ) zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N� )�errors� )� GrantTypeBasec @ s e Zd ZdZdd� Zdd� ZdS )�ClientCredentialsGranta� `Client Credentials Grant`_ The client can request an access token using only its client credentials (or other supported means of authentication) when the client is requesting access to the protected resources under its control, or those of another resource owner that have been previously arranged with the authorization server (the method of which is beyond the scope of this specification). The client credentials grant type MUST only be used by confidential clients:: +---------+ +---------------+ : : : : : :>-- A - Client Authentication --->: Authorization : : Client : : Server : : :<-- B ---- Access Token ---------<: : : : : : +---------+ +---------------+ Figure 6: Client Credentials Flow The flow illustrated in Figure 6 includes the following steps: (A) The client authenticates with the authorization server and requests an access token from the token endpoint. (B) The authorization server authenticates the client, and if valid, issues an access token. .. _`Client Credentials Grant`: https://tools.ietf.org/html/rfc6749#section-4.4 c C s� | � � }zt�d|� | �|� W nL tjyn } z2t�d|� |�|j� ||j|j fW Y d}~S d}~0 0 |j |dd�}| j D ] }||�}q�| j � ||� t�d|j|j|� |t�|�dfS )a Return token or error in JSON format. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. If the access token request is valid and authorized, the authorization server issues an access token as described in `Section 5.1`_. A refresh token SHOULD NOT be included. If the request failed client authentication or is invalid, the authorization server returns an error response as described in `Section 5.2`_. .. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1 .. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2 z$Validating access token request, %r.z"Client error in token request. %s.NF)Z refresh_tokenz'Issuing token to client id %r (%r), %r.�� )Z_get_default_headers�log�debug�validate_token_requestr Z OAuth2Error�update�headers�jsonZ status_codeZ create_tokenZ_token_modifiers�request_validatorZ save_token� client_id�client�dumps)�self�requestZ token_handlerr �e�token�modifier� r �Z/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/client_credentials.py�create_token_response1 s $ �z,ClientCredentialsGrant.create_token_responsec C s� | j jD ] }||� qt|dd�s0tjd|d��|jdksFtj|d��dD ] }||jv rJtjd| |d��qJt� d |� | j � |�s�t� d |� tj |d��nt |jd �s�td ��| �|� |jp�|jj|_t� d |j� | �|� | j jD ] }||� q�dS )zb :param request: OAuthlib request. :type request: oauthlib.common.Request � grant_typeNz Request is missing grant type.)r Zclient_credentials)r ZscopezDuplicate %s parameter.)� descriptionr zAuthenticating client, %r.z!Client authentication failed, %r.r z[Authenticate client must set the request.client.client_id attribute in authenticate_client.z Authorizing access to client %r.)Zcustom_validatorsZ pre_token�getattrr ZInvalidRequestErrorr ZUnsupportedGrantTypeErrorZduplicate_paramsr r r Zauthenticate_clientZInvalidClientError�hasattrr �NotImplementedErrorZvalidate_grant_typer Zvalidate_scopesZ post_token)r r Z validatorZparamr r r r V s2 � � z-ClientCredentialsGrant.validate_token_requestN)�__name__� __module__� __qualname__�__doc__r r r r r r r s !%r ) r" r Zlogging� r �baser Z getLoggerr r r r r r r �<module> s oauth2/rfc6749/grant_types/__pycache__/base.cpython-39.pyc 0000644 00000021010 15125174064 0017163 0 ustar 00 a \��`�' � @ sv d Z ddlZddlmZ ddlmZ ddlmZmZ ddl m Z ddl m Z e� e�ZG d d � d �ZG d d � d �ZdS ) zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�chain)�add_params_to_uri)�errors�utils)�is_absolute_uri� )�RequestValidatorc @ s0 e Zd ZdZdd� Zedd� �Zedd� �ZdS ) �ValidatorsContainera� Container object for holding custom validator callables to be invoked as part of the grant type `validate_authorization_request()` or `validate_authorization_request()` methods on the various grant types. Authorization validators must be callables that take a request object and return a dict, which may contain items to be added to the `request_info` returned from the grant_type after validation. Token validators must be callables that take a request object and return None. Both authorization validators and token validators may raise OAuth2 exceptions if validation conditions fail. Authorization validators added to `pre_auth` will be run BEFORE the standard validations (but after the critical ones that raise fatal errors) as part of `validate_authorization_request()` Authorization validators added to `post_auth` will be run AFTER the standard validations as part of `validate_authorization_request()` Token validators added to `pre_token` will be run BEFORE the standard validations as part of `validate_token_request()` Token validators added to `post_token` will be run AFTER the standard validations as part of `validate_token_request()` For example: >>> def my_auth_validator(request): ... return {'myval': True} >>> auth_code_grant = AuthorizationCodeGrant(request_validator) >>> auth_code_grant.custom_validators.pre_auth.append(my_auth_validator) >>> def my_token_validator(request): ... if not request.everything_okay: ... raise errors.OAuth2Error("uh-oh") >>> auth_code_grant.custom_validators.post_token.append(my_token_validator) c C s || _ || _|| _|| _d S �N)�pre_auth� post_auth� pre_token� post_token)�selfr r r r � r �L/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/base.py�__init__: s z ValidatorsContainer.__init__c C s t | j| j�S r )r r r �r r r r �all_preA s zValidatorsContainer.all_prec C s t | j| j�S r )r r r r r r r �all_postE s z ValidatorsContainer.all_postN)�__name__� __module__� __qualname__�__doc__r �propertyr r r r r r r s ( r c @ s� e Zd ZdZdZdZdZdgZd dd�Zdd� Z d d � Z d d � Z d d� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � ZdS ) � GrantTypeBaseN�fragmentT�codec K sT |pt � | _| j| _| j| _| �|� g | _g | _|�� D ]\}}t| ||� q:d S r ) r �request_validator�response_types� refresh_token�_setup_custom_validators�_code_modifiers�_token_modifiers�items�setattr)r r �kwargs�kw�valr r r r Q s zGrantTypeBase.__init__c C st |� dg �}|� dg �}|� dg �}|� dg �}t| d�s`|sB|rXd�| jj�}t|��d\}}t||||�| _d S )Nr r r r Z validate_authorization_requestzK{} does not support authorization validators. Use token validators instead.)r r )�get�hasattr�format� __class__r � ValueErrorr Zcustom_validators)r r& r r r r �msgr r r r! ^ s ��z&GrantTypeBase._setup_custom_validatorsc C s | j �|� d S r )r �append)r � response_typer r r �register_response_typem s z$GrantTypeBase.register_response_typec C s | j �|� d S r )r" r/ �r �modifierr r r �register_code_modifierp s z$GrantTypeBase.register_code_modifierc C s | j �|� d S r )r# r/ r2 r r r �register_token_modifiers s z%GrantTypeBase.register_token_modifierc C s t d��dS �z� :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. z&Subclasses must implement this method.N��NotImplementedError�r �request� token_handlerr r r � create_authorization_responsev s z+GrantTypeBase.create_authorization_responsec C s t d��dS r6 r7 r9 r r r �create_token_response s z#GrantTypeBase.create_token_responsec C s& |j dvr|S |�|j|dd�� |S )z� :param token: :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. :param request: OAuthlib request. :type request: oauthlib.common.Request )�tokenz code tokenzid_token tokenzcode id_token tokenF)r )r0 �updateZ create_token)r r> r; r: r r r � add_token� s zGrantTypeBase.add_tokenc C sH t |dd�}| j�||j|j|�sDt�d|j|j|j� tj |d��dS )�b :param request: OAuthlib request. :type request: oauthlib.common.Request � client_idNz2Unauthorized from %r (%r) access to grant type %s.�r: ) �getattrr �validate_grant_typeZ grant_type�client�log�debugrB r ZUnauthorizedClientError)r r: rB r r r rE � s � �z!GrantTypeBase.validate_grant_typec C sh |j s*t�|j�p&t�| j�|j|��|_ t�d|j |j|j � | j� |j|j |j |�sdt j |d��dS )rA z2Validating access to scopes %r for client %r (%r).rC N) Zscopesr Z scope_to_listZscoper Zget_default_scopesrB rG rH rF �validate_scopesr ZInvalidScopeError�r r: r r r rI � s � � �z GrantTypeBase.validate_scopesc C s� |j p | j|_ |j dvr2t�d|j | j� | j|_ |�� }|jdkrd|�dd�}|r`d|fg}ng }|j dkr�t|j|dd�|d < |||fS |j d kr�t|j|d d�|d < |||fS t d ��dS ) a Place token according to response mode. Base classes can define a default response mode for their authorization response by overriding the static `default_response_mode` member. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token: :param headers: :param body: :param status: )�queryr z+Overriding invalid response mode %s with %sZnone�stateNrK F)r ZLocationr Tz1Subclasses must set a valid default_response_mode) Z response_mode�default_response_moderG rH r$ r0 r) r � redirect_urir8 )r r: r> Zheaders�body�statusZ token_itemsrL r r r � prepare_authorization_response� s2 � � � �z,GrantTypeBase.prepare_authorization_responsec C s dddd�S )z+Create default headers for grant responses.zapplication/jsonzno-storezno-cache)z Content-Typez Cache-ControlZPragmar r r r r �_get_default_headers� s �z"GrantTypeBase._get_default_headersc C s� |j d urVd|_t�d|j � t|j �s4tj|d��| j�|j |j |�s�tj |d��nN| j� |j |�|_ d|_t�d|j � |j s�tj |d��t|j �s�tj|d��d S )NFz Using provided redirect_uri %srC Tz Using default redirect_uri %s.) rN Zusing_default_redirect_urirG rH r r ZInvalidRedirectURIErrorr Zvalidate_redirect_urirB ZMismatchingRedirectURIErrorZget_default_redirect_uriZMissingRedirectURIErrorrJ r r r �_handle_redirects� s$ �� z GrantTypeBase._handle_redirects)N)r r r Z error_urir rM r r r r! r1 r4 r5 r< r= r@ rE rI rQ rR rS r r r r r J s$ *r )r Zlogging� itertoolsr Zoauthlib.commonr Zoauthlib.oauth2.rfc6749r r Zoauthlib.uri_validater r r Z getLoggerr rG r r r r r r �<module> s 9 oauth2/rfc6749/grant_types/__pycache__/implicit.cpython-39.opt-1.pyc 0000644 00000031040 15125174064 0021026 0 ustar 00 a \��`�A � @ sN d Z ddlZddlmZ ddlmZ ddlmZ e�e �Z G dd � d e�Z dS ) zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N)�common� )�errors� )� GrantTypeBasec @ sD e Zd ZdZdgZdZdd� Zdd� Zdd � Zd d � Z dd d�Z d S )� ImplicitGranta� `Implicit Grant`_ The implicit grant type is used to obtain access tokens (it does not support the issuance of refresh tokens) and is optimized for public clients known to operate a particular redirection URI. These clients are typically implemented in a browser using a scripting language such as JavaScript. Unlike the authorization code grant type, in which the client makes separate requests for authorization and for an access token, the client receives the access token as the result of the authorization request. The implicit grant type does not include client authentication, and relies on the presence of the resource owner and the registration of the redirection URI. Because the access token is encoded into the redirection URI, it may be exposed to the resource owner and other applications residing on the same device:: +----------+ | Resource | | Owner | | | +----------+ ^ | (B) +----|-----+ Client Identifier +---------------+ | -+----(A)-- & Redirection URI --->| | | User- | | Authorization | | Agent -|----(B)-- User authenticates -->| Server | | | | | | |<---(C)--- Redirection URI ----<| | | | with Access Token +---------------+ | | in Fragment | | +---------------+ | |----(D)--- Redirection URI ---->| Web-Hosted | | | without Fragment | Client | | | | Resource | | (F) |<---(E)------- Script ---------<| | | | +---------------+ +-|--------+ | | (A) (G) Access Token | | ^ v +---------+ | | | Client | | | +---------+ Note: The lines illustrating steps (A) and (B) are broken into two parts as they pass through the user-agent. Figure 4: Implicit Grant Flow The flow illustrated in Figure 4 includes the following steps: (A) The client initiates the flow by directing the resource owner's user-agent to the authorization endpoint. The client includes its client identifier, requested scope, local state, and a redirection URI to which the authorization server will send the user-agent back once access is granted (or denied). (B) The authorization server authenticates the resource owner (via the user-agent) and establishes whether the resource owner grants or denies the client's access request. (C) Assuming the resource owner grants access, the authorization server redirects the user-agent back to the client using the redirection URI provided earlier. The redirection URI includes the access token in the URI fragment. (D) The user-agent follows the redirection instructions by making a request to the web-hosted client resource (which does not include the fragment per [RFC2616]). The user-agent retains the fragment information locally. (E) The web-hosted client resource returns a web page (typically an HTML document with an embedded script) capable of accessing the full redirection URI including the fragment retained by the user-agent, and extracting the access token (and other parameters) contained in the fragment. (F) The user-agent executes the script provided by the web-hosted client resource locally, which extracts the access token. (G) The user-agent passes the access token to the client. See `Section 10.3`_ and `Section 10.16`_ for important security considerations when using the implicit grant. .. _`Implicit Grant`: https://tools.ietf.org/html/rfc6749#section-4.2 .. _`Section 10.3`: https://tools.ietf.org/html/rfc6749#section-10.3 .. _`Section 10.16`: https://tools.ietf.org/html/rfc6749#section-10.16 �tokenFc C s | � ||�S )aM Create an authorization response. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: response_type REQUIRED. Value MUST be set to "token" for standard OAuth2 implicit flow or "id_token token" or just "id_token" for OIDC implicit flow client_id REQUIRED. The client identifier as described in `Section 2.2`_. redirect_uri OPTIONAL. As described in `Section 3.1.2`_. scope OPTIONAL. The scope of the access request as described by `Section 3.3`_. state RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. The authorization server validates the request to ensure that all required parameters are present and valid. The authorization server MUST verify that the redirection URI to which it will redirect the access token matches a redirection URI registered by the client as described in `Section 3.1.2`_. .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B )�create_token_response)�self�request� token_handler� r �P/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/implicit.py� create_authorization_responsev s -z+ImplicitGrant.create_authorization_responsec C s z| � |� W n� tjyD } z t�d||� � W Y d}~nZd}~0 tjy� } z8t�d||� dtj|j|j dd�iddfW Y d}~S d}~0 0 d|j � � v r�|j |d d �}ni }|j dur�|j |d < | jD ]}||||�}q�d|j � � v �r| j�||� | �||i dd�S ) a� Return token or error embedded in the URI fragment. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. If the resource owner grants the access request, the authorization server issues an access token and delivers it to the client by adding the following parameters to the fragment component of the redirection URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: access_token REQUIRED. The access token issued by the authorization server. token_type REQUIRED. The type of the token issued as described in `Section 7.1`_. Value is case insensitive. expires_in RECOMMENDED. The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. scope OPTIONAL, if identical to the scope requested by the client; otherwise, REQUIRED. The scope of the access token as described by `Section 3.3`_. state REQUIRED if the "state" parameter was present in the client authorization request. The exact value received from the client. The authorization server MUST NOT issue a refresh token. .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1 z/Fatal client error during validation of %r. %r.Nz)Client error during validation of %r. %r.ZLocationT)�fragmenti. r F)Z refresh_token�state)�validate_token_requestr ZFatalClientError�log�debugZ OAuth2Errorr Zadd_params_to_uri� redirect_uriZ twotuples� response_type�splitZ create_tokenr Z_token_modifiers�request_validatorZ save_tokenZ prepare_authorization_response)r r r �er �modifierr r r r � s4 ,��� �z#ImplicitGrant.create_token_responsec C s | � |�S )zb :param request: OAuthlib request. :type request: oauthlib.common.Request )r )r r r r r � validate_authorization_request� s z,ImplicitGrant.validate_authorization_requestc C s` dD ]J}z |j }W n ty2 tjd|d��Y n0 ||v rtjd| |d��q|jsbtj|d��| j�|j|�s~tj|d��| � |� | � || j j �}|j du r�tj|d��n"t|j �� ��| j�s�tj|d��t�d|j|j� | j�|j|j |j|��s t�d|j|j � tj|d��| �|� |�|j|j|j |j |d �� | � || j j |�}|j |fS ) aC Check the token request for normal and fatal errors. :param request: OAuthlib request. :type request: oauthlib.common.Request This method is very similar to validate_authorization_request in the AuthorizationCodeGrant but differ in a few subtle areas. A normal error could be a missing response_type parameter or the client attempting to access scope it is not allowed to ask authorization for. Normal errors can safely be included in the redirection URI and sent back to the client. Fatal errors occur when the client_id or redirect_uri is invalid or missing. These must be caught by the provider and handled, how this is done is outside of the scope of OAuthLib but showing an error page describing the issue is a good idea. )� client_idr r Zscoper z Unable to parse query string)� descriptionr zDuplicate %s parameter.)r Nz9Validating use of response_type token for client %r (%r).z4Client %s is not authorized to use response_type %s.)r r r r r ) �duplicate_params� ValueErrorr ZInvalidRequestFatalErrorr ZMissingClientIdErrorr Zvalidate_client_idZInvalidClientIdErrorZ_handle_redirects�_run_custom_validatorsZcustom_validatorsZall_prer ZMissingResponseTypeError�setr �issubset�response_typesZ UnsupportedResponseTypeErrorr r ZclientZvalidate_response_typeZUnauthorizedClientErrorZvalidate_scopes�updater r Zall_postZscopes)r r Zparamr � request_infor r r r sX � � �� ��z$ImplicitGrant.validate_token_requestNc C s< |d u r i n|� � }|D ] }||�}|d ur|�|� q|S )N)�copyr$ )r r Z validationsr% Z validator�resultr r r r k s z$ImplicitGrant._run_custom_validators)N) �__name__� __module__� __qualname__�__doc__r# Zgrant_allows_refresh_tokenr r r r r r r r r r s b/Zh �r ) r+ ZloggingZoauthlibr � r �baser Z getLoggerr( r r r r r r �<module> s oauth2/rfc6749/grant_types/__pycache__/client_credentials.cpython-39.pyc 0000644 00000011213 15125174064 0022110 0 ustar 00 a \��`� � @ sJ d Z ddlZddlZddlmZ ddlmZ e�e�Z G dd� de�Z dS ) zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � N� )�errors� )� GrantTypeBasec @ s e Zd ZdZdd� Zdd� ZdS )�ClientCredentialsGranta� `Client Credentials Grant`_ The client can request an access token using only its client credentials (or other supported means of authentication) when the client is requesting access to the protected resources under its control, or those of another resource owner that have been previously arranged with the authorization server (the method of which is beyond the scope of this specification). The client credentials grant type MUST only be used by confidential clients:: +---------+ +---------------+ : : : : : :>-- A - Client Authentication --->: Authorization : : Client : : Server : : :<-- B ---- Access Token ---------<: : : : : : +---------+ +---------------+ Figure 6: Client Credentials Flow The flow illustrated in Figure 6 includes the following steps: (A) The client authenticates with the authorization server and requests an access token from the token endpoint. (B) The authorization server authenticates the client, and if valid, issues an access token. .. _`Client Credentials Grant`: https://tools.ietf.org/html/rfc6749#section-4.4 c C s� | � � }zt�d|� | �|� W nL tjyn } z2t�d|� |�|j� ||j|j fW Y d}~S d}~0 0 |j |dd�}| j D ] }||�}q�| j � ||� t�d|j|j|� |t�|�dfS )a Return token or error in JSON format. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. If the access token request is valid and authorized, the authorization server issues an access token as described in `Section 5.1`_. A refresh token SHOULD NOT be included. If the request failed client authentication or is invalid, the authorization server returns an error response as described in `Section 5.2`_. .. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1 .. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2 z$Validating access token request, %r.z"Client error in token request. %s.NF)Z refresh_tokenz'Issuing token to client id %r (%r), %r.�� )Z_get_default_headers�log�debug�validate_token_requestr Z OAuth2Error�update�headers�jsonZ status_codeZ create_tokenZ_token_modifiers�request_validatorZ save_token� client_id�client�dumps)�self�requestZ token_handlerr �e�token�modifier� r �Z/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/client_credentials.py�create_token_response1 s $ �z,ClientCredentialsGrant.create_token_responsec C s� | j jD ] }||� qt|dd�s0tjd|d��|jdksFtj|d��dD ] }||jv rJtjd| |d��qJt� d |� | j � |�s�t� d |� tj |d��nt |jd �s�td ��| �|� |jp�|jj|_t� d |j� | �|� | j jD ] }||� q�dS )zb :param request: OAuthlib request. :type request: oauthlib.common.Request � grant_typeNz Request is missing grant type.)r Zclient_credentials)r ZscopezDuplicate %s parameter.)� descriptionr zAuthenticating client, %r.z!Client authentication failed, %r.r z[Authenticate client must set the request.client.client_id attribute in authenticate_client.z Authorizing access to client %r.)Zcustom_validatorsZ pre_token�getattrr ZInvalidRequestErrorr ZUnsupportedGrantTypeErrorZduplicate_paramsr r r Zauthenticate_clientZInvalidClientError�hasattrr �NotImplementedErrorZvalidate_grant_typer Zvalidate_scopesZ post_token)r r Z validatorZparamr r r r V s2 � � z-ClientCredentialsGrant.validate_token_requestN)�__name__� __module__� __qualname__�__doc__r r r r r r r s !%r ) r" r Zlogging� r �baser Z getLoggerr r r r r r r �<module> s oauth2/rfc6749/grant_types/__pycache__/__init__.cpython-39.pyc 0000644 00000001116 15125174064 0020015 0 ustar 00 a \��`p � @ sD d Z ddlmZ ddlmZ ddlmZ ddlmZ ddl m Z dS )zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ � )�AuthorizationCodeGrant)�ClientCredentialsGrant)� ImplicitGrant)�RefreshTokenGrant)�%ResourceOwnerPasswordCredentialsGrantN) �__doc__Zauthorization_coder Zclient_credentialsr Zimplicitr Z refresh_tokenr Z#resource_owner_password_credentialsr � r r �P/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/grant_types/__init__.py�<module> s oauth2/rfc6749/grant_types/client_credentials.py 0000644 00000011727 15125174064 0015633 0 ustar 00 """ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ """ import json import logging from .. import errors from .base import GrantTypeBase log = logging.getLogger(__name__) class ClientCredentialsGrant(GrantTypeBase): """`Client Credentials Grant`_ The client can request an access token using only its client credentials (or other supported means of authentication) when the client is requesting access to the protected resources under its control, or those of another resource owner that have been previously arranged with the authorization server (the method of which is beyond the scope of this specification). The client credentials grant type MUST only be used by confidential clients:: +---------+ +---------------+ : : : : : :>-- A - Client Authentication --->: Authorization : : Client : : Server : : :<-- B ---- Access Token ---------<: : : : : : +---------+ +---------------+ Figure 6: Client Credentials Flow The flow illustrated in Figure 6 includes the following steps: (A) The client authenticates with the authorization server and requests an access token from the token endpoint. (B) The authorization server authenticates the client, and if valid, issues an access token. .. _`Client Credentials Grant`: https://tools.ietf.org/html/rfc6749#section-4.4 """ def create_token_response(self, request, token_handler): """Return token or error in JSON format. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. If the access token request is valid and authorized, the authorization server issues an access token as described in `Section 5.1`_. A refresh token SHOULD NOT be included. If the request failed client authentication or is invalid, the authorization server returns an error response as described in `Section 5.2`_. .. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1 .. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2 """ headers = self._get_default_headers() try: log.debug('Validating access token request, %r.', request) self.validate_token_request(request) except errors.OAuth2Error as e: log.debug('Client error in token request. %s.', e) headers.update(e.headers) return headers, e.json, e.status_code token = token_handler.create_token(request, refresh_token=False) for modifier in self._token_modifiers: token = modifier(token) self.request_validator.save_token(token, request) log.debug('Issuing token to client id %r (%r), %r.', request.client_id, request.client, token) return headers, json.dumps(token), 200 def validate_token_request(self, request): """ :param request: OAuthlib request. :type request: oauthlib.common.Request """ for validator in self.custom_validators.pre_token: validator(request) if not getattr(request, 'grant_type', None): raise errors.InvalidRequestError('Request is missing grant type.', request=request) if not request.grant_type == 'client_credentials': raise errors.UnsupportedGrantTypeError(request=request) for param in ('grant_type', 'scope'): if param in request.duplicate_params: raise errors.InvalidRequestError(description='Duplicate %s parameter.' % param, request=request) log.debug('Authenticating client, %r.', request) if not self.request_validator.authenticate_client(request): log.debug('Client authentication failed, %r.', request) raise errors.InvalidClientError(request=request) else: if not hasattr(request.client, 'client_id'): raise NotImplementedError('Authenticate client must set the ' 'request.client.client_id attribute ' 'in authenticate_client.') # Ensure client is authorized use of this grant type self.validate_grant_type(request) request.client_id = request.client_id or request.client.client_id log.debug('Authorizing access to client %r.', request.client_id) self.validate_scopes(request) for validator in self.custom_validators.post_token: validator(request) oauth2/rfc6749/grant_types/authorization_code.py 0000644 00000062531 15125174064 0015671 0 ustar 00 """ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ """ import base64 import hashlib import json import logging from oauthlib import common from .. import errors from .base import GrantTypeBase log = logging.getLogger(__name__) def code_challenge_method_s256(verifier, challenge): """ If the "code_challenge_method" from `Section 4.3`_ was "S256", the received "code_verifier" is hashed by SHA-256, base64url-encoded, and then compared to the "code_challenge", i.e.: BASE64URL-ENCODE(SHA256(ASCII(code_verifier))) == code_challenge How to implement a base64url-encoding function without padding, based upon the standard base64-encoding function that uses padding. To be concrete, example C# code implementing these functions is shown below. Similar code could be used in other languages. static string base64urlencode(byte [] arg) { string s = Convert.ToBase64String(arg); // Regular base64 encoder s = s.Split('=')[0]; // Remove any trailing '='s s = s.Replace('+', '-'); // 62nd char of encoding s = s.Replace('/', '_'); // 63rd char of encoding return s; } In python urlsafe_b64encode is already replacing '+' and '/', but preserve the trailing '='. So we have to remove it. .. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3 """ return base64.urlsafe_b64encode( hashlib.sha256(verifier.encode()).digest() ).decode().rstrip('=') == challenge def code_challenge_method_plain(verifier, challenge): """ If the "code_challenge_method" from `Section 4.3`_ was "plain", they are compared directly, i.e.: code_verifier == code_challenge. .. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3 """ return verifier == challenge class AuthorizationCodeGrant(GrantTypeBase): """`Authorization Code Grant`_ The authorization code grant type is used to obtain both access tokens and refresh tokens and is optimized for confidential clients. Since this is a redirection-based flow, the client must be capable of interacting with the resource owner's user-agent (typically a web browser) and capable of receiving incoming requests (via redirection) from the authorization server:: +----------+ | Resource | | Owner | | | +----------+ ^ | (B) +----|-----+ Client Identifier +---------------+ | -+----(A)-- & Redirection URI ---->| | | User- | | Authorization | | Agent -+----(B)-- User authenticates --->| Server | | | | | | -+----(C)-- Authorization Code ---<| | +-|----|---+ +---------------+ | | ^ v (A) (C) | | | | | | ^ v | | +---------+ | | | |>---(D)-- Authorization Code ---------' | | Client | & Redirection URI | | | | | |<---(E)----- Access Token -------------------' +---------+ (w/ Optional Refresh Token) Note: The lines illustrating steps (A), (B), and (C) are broken into two parts as they pass through the user-agent. Figure 3: Authorization Code Flow The flow illustrated in Figure 3 includes the following steps: (A) The client initiates the flow by directing the resource owner's user-agent to the authorization endpoint. The client includes its client identifier, requested scope, local state, and a redirection URI to which the authorization server will send the user-agent back once access is granted (or denied). (B) The authorization server authenticates the resource owner (via the user-agent) and establishes whether the resource owner grants or denies the client's access request. (C) Assuming the resource owner grants access, the authorization server redirects the user-agent back to the client using the redirection URI provided earlier (in the request or during client registration). The redirection URI includes an authorization code and any local state provided by the client earlier. (D) The client requests an access token from the authorization server's token endpoint by including the authorization code received in the previous step. When making the request, the client authenticates with the authorization server. The client includes the redirection URI used to obtain the authorization code for verification. (E) The authorization server authenticates the client, validates the authorization code, and ensures that the redirection URI received matches the URI used to redirect the client in step (C). If valid, the authorization server responds back with an access token and, optionally, a refresh token. OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. A technique to mitigate against the threat through the use of Proof Key for Code Exchange (PKCE, pronounced "pixy") is implemented in the current oauthlib implementation. .. _`Authorization Code Grant`: https://tools.ietf.org/html/rfc6749#section-4.1 .. _`PKCE`: https://tools.ietf.org/html/rfc7636 """ default_response_mode = 'query' response_types = ['code'] # This dict below is private because as RFC mention it: # "S256" is Mandatory To Implement (MTI) on the server. # _code_challenge_methods = { 'plain': code_challenge_method_plain, 'S256': code_challenge_method_s256 } def create_authorization_code(self, request): """ Generates an authorization grant represented as a dictionary. :param request: OAuthlib request. :type request: oauthlib.common.Request """ grant = {'code': common.generate_token()} if hasattr(request, 'state') and request.state: grant['state'] = request.state log.debug('Created authorization code grant %r for request %r.', grant, request) return grant def create_authorization_response(self, request, token_handler): """ The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: response_type REQUIRED. Value MUST be set to "code" for standard OAuth2 authorization flow. For OpenID Connect it must be one of "code token", "code id_token", or "code token id_token" - we essentially test that "code" appears in the response_type. client_id REQUIRED. The client identifier as described in `Section 2.2`_. redirect_uri OPTIONAL. As described in `Section 3.1.2`_. scope OPTIONAL. The scope of the access request as described by `Section 3.3`_. state RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. The client directs the resource owner to the constructed URI using an HTTP redirection response, or by other means available to it via the user-agent. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. :returns: headers, body, status :raises: FatalClientError on invalid redirect URI or client id. A few examples:: >>> from your_validator import your_validator >>> request = Request('https://example.com/authorize?client_id=valid' ... '&redirect_uri=http%3A%2F%2Fclient.com%2F') >>> from oauthlib.common import Request >>> from oauthlib.oauth2 import AuthorizationCodeGrant, BearerToken >>> token = BearerToken(your_validator) >>> grant = AuthorizationCodeGrant(your_validator) >>> request.scopes = ['authorized', 'in', 'some', 'form'] >>> grant.create_authorization_response(request, token) (u'http://client.com/?error=invalid_request&error_description=Missing+response_type+parameter.', None, None, 400) >>> request = Request('https://example.com/authorize?client_id=valid' ... '&redirect_uri=http%3A%2F%2Fclient.com%2F' ... '&response_type=code') >>> request.scopes = ['authorized', 'in', 'some', 'form'] >>> grant.create_authorization_response(request, token) (u'http://client.com/?code=u3F05aEObJuP2k7DordviIgW5wl52N', None, None, 200) >>> # If the client id or redirect uri fails validation >>> grant.create_authorization_response(request, token) Traceback (most recent call last): File "<stdin>", line 1, in <module> File "oauthlib/oauth2/rfc6749/grant_types.py", line 515, in create_authorization_response >>> grant.create_authorization_response(request, token) File "oauthlib/oauth2/rfc6749/grant_types.py", line 591, in validate_authorization_request oauthlib.oauth2.rfc6749.errors.InvalidClientIdError .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 """ try: self.validate_authorization_request(request) log.debug('Pre resource owner authorization validation ok for %r.', request) # If the request fails due to a missing, invalid, or mismatching # redirection URI, or if the client identifier is missing or invalid, # the authorization server SHOULD inform the resource owner of the # error and MUST NOT automatically redirect the user-agent to the # invalid redirection URI. except errors.FatalClientError as e: log.debug('Fatal client error during validation of %r. %r.', request, e) raise # If the resource owner denies the access request or if the request # fails for reasons other than a missing or invalid redirection URI, # the authorization server informs the client by adding the following # parameters to the query component of the redirection URI using the # "application/x-www-form-urlencoded" format, per Appendix B: # https://tools.ietf.org/html/rfc6749#appendix-B except errors.OAuth2Error as e: log.debug('Client error during validation of %r. %r.', request, e) request.redirect_uri = request.redirect_uri or self.error_uri redirect_uri = common.add_params_to_uri( request.redirect_uri, e.twotuples, fragment=request.response_mode == "fragment") return {'Location': redirect_uri}, None, 302 grant = self.create_authorization_code(request) for modifier in self._code_modifiers: grant = modifier(grant, token_handler, request) log.debug('Saving grant %r for %r.', grant, request) self.request_validator.save_authorization_code( request.client_id, grant, request) return self.prepare_authorization_response( request, grant, {}, None, 302) def create_token_response(self, request, token_handler): """Validate the authorization code. The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code. The authorization code is bound to the client identifier and redirection URI. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. """ headers = self._get_default_headers() try: self.validate_token_request(request) log.debug('Token request validation ok for %r.', request) except errors.OAuth2Error as e: log.debug('Client error during validation of %r. %r.', request, e) headers.update(e.headers) return headers, e.json, e.status_code token = token_handler.create_token(request, refresh_token=self.refresh_token) for modifier in self._token_modifiers: token = modifier(token, token_handler, request) self.request_validator.save_token(token, request) self.request_validator.invalidate_authorization_code( request.client_id, request.code, request) return headers, json.dumps(token), 200 def validate_authorization_request(self, request): """Check the authorization request for normal and fatal errors. A normal error could be a missing response_type parameter or the client attempting to access scope it is not allowed to ask authorization for. Normal errors can safely be included in the redirection URI and sent back to the client. Fatal errors occur when the client_id or redirect_uri is invalid or missing. These must be caught by the provider and handled, how this is done is outside of the scope of OAuthLib but showing an error page describing the issue is a good idea. :param request: OAuthlib request. :type request: oauthlib.common.Request """ # First check for fatal errors # If the request fails due to a missing, invalid, or mismatching # redirection URI, or if the client identifier is missing or invalid, # the authorization server SHOULD inform the resource owner of the # error and MUST NOT automatically redirect the user-agent to the # invalid redirection URI. # First check duplicate parameters for param in ('client_id', 'response_type', 'redirect_uri', 'scope', 'state'): try: duplicate_params = request.duplicate_params except ValueError: raise errors.InvalidRequestFatalError(description='Unable to parse query string', request=request) if param in duplicate_params: raise errors.InvalidRequestFatalError(description='Duplicate %s parameter.' % param, request=request) # REQUIRED. The client identifier as described in Section 2.2. # https://tools.ietf.org/html/rfc6749#section-2.2 if not request.client_id: raise errors.MissingClientIdError(request=request) if not self.request_validator.validate_client_id(request.client_id, request): raise errors.InvalidClientIdError(request=request) # OPTIONAL. As described in Section 3.1.2. # https://tools.ietf.org/html/rfc6749#section-3.1.2 log.debug('Validating redirection uri %s for client %s.', request.redirect_uri, request.client_id) # OPTIONAL. As described in Section 3.1.2. # https://tools.ietf.org/html/rfc6749#section-3.1.2 self._handle_redirects(request) # Then check for normal errors. # If the resource owner denies the access request or if the request # fails for reasons other than a missing or invalid redirection URI, # the authorization server informs the client by adding the following # parameters to the query component of the redirection URI using the # "application/x-www-form-urlencoded" format, per Appendix B. # https://tools.ietf.org/html/rfc6749#appendix-B # Note that the correct parameters to be added are automatically # populated through the use of specific exceptions. request_info = {} for validator in self.custom_validators.pre_auth: request_info.update(validator(request)) # REQUIRED. if request.response_type is None: raise errors.MissingResponseTypeError(request=request) # Value MUST be set to "code" or one of the OpenID authorization code including # response_types "code token", "code id_token", "code token id_token" elif not 'code' in request.response_type and request.response_type != 'none': raise errors.UnsupportedResponseTypeError(request=request) if not self.request_validator.validate_response_type(request.client_id, request.response_type, request.client, request): log.debug('Client %s is not authorized to use response_type %s.', request.client_id, request.response_type) raise errors.UnauthorizedClientError(request=request) # OPTIONAL. Validate PKCE request or reply with "error"/"invalid_request" # https://tools.ietf.org/html/rfc6749#section-4.4.1 if self.request_validator.is_pkce_required(request.client_id, request) is True: if request.code_challenge is None: raise errors.MissingCodeChallengeError(request=request) if request.code_challenge is not None: request_info["code_challenge"] = request.code_challenge # OPTIONAL, defaults to "plain" if not present in the request. if request.code_challenge_method is None: request.code_challenge_method = "plain" if request.code_challenge_method not in self._code_challenge_methods: raise errors.UnsupportedCodeChallengeMethodError(request=request) request_info["code_challenge_method"] = request.code_challenge_method # OPTIONAL. The scope of the access request as described by Section 3.3 # https://tools.ietf.org/html/rfc6749#section-3.3 self.validate_scopes(request) request_info.update({ 'client_id': request.client_id, 'redirect_uri': request.redirect_uri, 'response_type': request.response_type, 'state': request.state, 'request': request }) for validator in self.custom_validators.post_auth: request_info.update(validator(request)) return request.scopes, request_info def validate_token_request(self, request): """ :param request: OAuthlib request. :type request: oauthlib.common.Request """ # REQUIRED. Value MUST be set to "authorization_code". if request.grant_type not in ('authorization_code', 'openid'): raise errors.UnsupportedGrantTypeError(request=request) for validator in self.custom_validators.pre_token: validator(request) if request.code is None: raise errors.InvalidRequestError( description='Missing code parameter.', request=request) for param in ('client_id', 'grant_type', 'redirect_uri'): if param in request.duplicate_params: raise errors.InvalidRequestError(description='Duplicate %s parameter.' % param, request=request) if self.request_validator.client_authentication_required(request): # If the client type is confidential or the client was issued client # credentials (or assigned other authentication requirements), the # client MUST authenticate with the authorization server as described # in Section 3.2.1. # https://tools.ietf.org/html/rfc6749#section-3.2.1 if not self.request_validator.authenticate_client(request): log.debug('Client authentication failed, %r.', request) raise errors.InvalidClientError(request=request) elif not self.request_validator.authenticate_client_id(request.client_id, request): # REQUIRED, if the client is not authenticating with the # authorization server as described in Section 3.2.1. # https://tools.ietf.org/html/rfc6749#section-3.2.1 log.debug('Client authentication failed, %r.', request) raise errors.InvalidClientError(request=request) if not hasattr(request.client, 'client_id'): raise NotImplementedError('Authenticate client must set the ' 'request.client.client_id attribute ' 'in authenticate_client.') request.client_id = request.client_id or request.client.client_id # Ensure client is authorized use of this grant type self.validate_grant_type(request) # REQUIRED. The authorization code received from the # authorization server. if not self.request_validator.validate_code(request.client_id, request.code, request.client, request): log.debug('Client, %r (%r), is not allowed access to scopes %r.', request.client_id, request.client, request.scopes) raise errors.InvalidGrantError(request=request) # OPTIONAL. Validate PKCE code_verifier challenge = self.request_validator.get_code_challenge(request.code, request) if challenge is not None: if request.code_verifier is None: raise errors.MissingCodeVerifierError(request=request) challenge_method = self.request_validator.get_code_challenge_method(request.code, request) if challenge_method is None: raise errors.InvalidGrantError(request=request, description="Challenge method not found") if challenge_method not in self._code_challenge_methods: raise errors.ServerError( description="code_challenge_method {} is not supported.".format(challenge_method), request=request ) if not self.validate_code_challenge(challenge, challenge_method, request.code_verifier): log.debug('request provided a invalid code_verifier.') raise errors.InvalidGrantError(request=request) elif self.request_validator.is_pkce_required(request.client_id, request) is True: if request.code_verifier is None: raise errors.MissingCodeVerifierError(request=request) raise errors.InvalidGrantError(request=request, description="Challenge not found") for attr in ('user', 'scopes'): if getattr(request, attr, None) is None: log.debug('request.%s was not set on code validation.', attr) # REQUIRED, if the "redirect_uri" parameter was included in the # authorization request as described in Section 4.1.1, and their # values MUST be identical. if request.redirect_uri is None: request.using_default_redirect_uri = True request.redirect_uri = self.request_validator.get_default_redirect_uri( request.client_id, request) log.debug('Using default redirect_uri %s.', request.redirect_uri) if not request.redirect_uri: raise errors.MissingRedirectURIError(request=request) else: request.using_default_redirect_uri = False log.debug('Using provided redirect_uri %s', request.redirect_uri) if not self.request_validator.confirm_redirect_uri(request.client_id, request.code, request.redirect_uri, request.client, request): log.debug('Redirect_uri (%r) invalid for client %r (%r).', request.redirect_uri, request.client_id, request.client) raise errors.MismatchingRedirectURIError(request=request) for validator in self.custom_validators.post_token: validator(request) def validate_code_challenge(self, challenge, challenge_method, verifier): if challenge_method in self._code_challenge_methods: return self._code_challenge_methods[challenge_method](verifier, challenge) raise NotImplementedError('Unknown challenge_method %s' % challenge_method) oauth2/rfc6749/grant_types/base.py 0000644 00000023745 15125174064 0012715 0 ustar 00 """ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ """ import logging from itertools import chain from oauthlib.common import add_params_to_uri from oauthlib.oauth2.rfc6749 import errors, utils from oauthlib.uri_validate import is_absolute_uri from ..request_validator import RequestValidator log = logging.getLogger(__name__) class ValidatorsContainer: """ Container object for holding custom validator callables to be invoked as part of the grant type `validate_authorization_request()` or `validate_authorization_request()` methods on the various grant types. Authorization validators must be callables that take a request object and return a dict, which may contain items to be added to the `request_info` returned from the grant_type after validation. Token validators must be callables that take a request object and return None. Both authorization validators and token validators may raise OAuth2 exceptions if validation conditions fail. Authorization validators added to `pre_auth` will be run BEFORE the standard validations (but after the critical ones that raise fatal errors) as part of `validate_authorization_request()` Authorization validators added to `post_auth` will be run AFTER the standard validations as part of `validate_authorization_request()` Token validators added to `pre_token` will be run BEFORE the standard validations as part of `validate_token_request()` Token validators added to `post_token` will be run AFTER the standard validations as part of `validate_token_request()` For example: >>> def my_auth_validator(request): ... return {'myval': True} >>> auth_code_grant = AuthorizationCodeGrant(request_validator) >>> auth_code_grant.custom_validators.pre_auth.append(my_auth_validator) >>> def my_token_validator(request): ... if not request.everything_okay: ... raise errors.OAuth2Error("uh-oh") >>> auth_code_grant.custom_validators.post_token.append(my_token_validator) """ def __init__(self, post_auth, post_token, pre_auth, pre_token): self.pre_auth = pre_auth self.post_auth = post_auth self.pre_token = pre_token self.post_token = post_token @property def all_pre(self): return chain(self.pre_auth, self.pre_token) @property def all_post(self): return chain(self.post_auth, self.post_token) class GrantTypeBase: error_uri = None request_validator = None default_response_mode = 'fragment' refresh_token = True response_types = ['code'] def __init__(self, request_validator=None, **kwargs): self.request_validator = request_validator or RequestValidator() # Transforms class variables into instance variables: self.response_types = self.response_types self.refresh_token = self.refresh_token self._setup_custom_validators(kwargs) self._code_modifiers = [] self._token_modifiers = [] for kw, val in kwargs.items(): setattr(self, kw, val) def _setup_custom_validators(self, kwargs): post_auth = kwargs.get('post_auth', []) post_token = kwargs.get('post_token', []) pre_auth = kwargs.get('pre_auth', []) pre_token = kwargs.get('pre_token', []) if not hasattr(self, 'validate_authorization_request'): if post_auth or pre_auth: msg = ("{} does not support authorization validators. Use " "token validators instead.").format(self.__class__.__name__) raise ValueError(msg) # Using tuples here because they can't be appended to: post_auth, pre_auth = (), () self.custom_validators = ValidatorsContainer(post_auth, post_token, pre_auth, pre_token) def register_response_type(self, response_type): self.response_types.append(response_type) def register_code_modifier(self, modifier): self._code_modifiers.append(modifier) def register_token_modifier(self, modifier): self._token_modifiers.append(modifier) def create_authorization_response(self, request, token_handler): """ :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. """ raise NotImplementedError('Subclasses must implement this method.') def create_token_response(self, request, token_handler): """ :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. """ raise NotImplementedError('Subclasses must implement this method.') def add_token(self, token, token_handler, request): """ :param token: :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. :param request: OAuthlib request. :type request: oauthlib.common.Request """ # Only add a hybrid access token on auth step if asked for if not request.response_type in ["token", "code token", "id_token token", "code id_token token"]: return token token.update(token_handler.create_token(request, refresh_token=False)) return token def validate_grant_type(self, request): """ :param request: OAuthlib request. :type request: oauthlib.common.Request """ client_id = getattr(request, 'client_id', None) if not self.request_validator.validate_grant_type(client_id, request.grant_type, request.client, request): log.debug('Unauthorized from %r (%r) access to grant type %s.', request.client_id, request.client, request.grant_type) raise errors.UnauthorizedClientError(request=request) def validate_scopes(self, request): """ :param request: OAuthlib request. :type request: oauthlib.common.Request """ if not request.scopes: request.scopes = utils.scope_to_list(request.scope) or utils.scope_to_list( self.request_validator.get_default_scopes(request.client_id, request)) log.debug('Validating access to scopes %r for client %r (%r).', request.scopes, request.client_id, request.client) if not self.request_validator.validate_scopes(request.client_id, request.scopes, request.client, request): raise errors.InvalidScopeError(request=request) def prepare_authorization_response(self, request, token, headers, body, status): """Place token according to response mode. Base classes can define a default response mode for their authorization response by overriding the static `default_response_mode` member. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token: :param headers: :param body: :param status: """ request.response_mode = request.response_mode or self.default_response_mode if request.response_mode not in ('query', 'fragment'): log.debug('Overriding invalid response mode %s with %s', request.response_mode, self.default_response_mode) request.response_mode = self.default_response_mode token_items = token.items() if request.response_type == 'none': state = token.get('state', None) if state: token_items = [('state', state)] else: token_items = [] if request.response_mode == 'query': headers['Location'] = add_params_to_uri( request.redirect_uri, token_items, fragment=False) return headers, body, status if request.response_mode == 'fragment': headers['Location'] = add_params_to_uri( request.redirect_uri, token_items, fragment=True) return headers, body, status raise NotImplementedError( 'Subclasses must set a valid default_response_mode') def _get_default_headers(self): """Create default headers for grant responses.""" return { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'Pragma': 'no-cache', } def _handle_redirects(self, request): if request.redirect_uri is not None: request.using_default_redirect_uri = False log.debug('Using provided redirect_uri %s', request.redirect_uri) if not is_absolute_uri(request.redirect_uri): raise errors.InvalidRedirectURIError(request=request) # The authorization server MUST verify that the redirection URI # to which it will redirect the access token matches a # redirection URI registered by the client as described in # Section 3.1.2. # https://tools.ietf.org/html/rfc6749#section-3.1.2 if not self.request_validator.validate_redirect_uri( request.client_id, request.redirect_uri, request): raise errors.MismatchingRedirectURIError(request=request) else: request.redirect_uri = self.request_validator.get_default_redirect_uri( request.client_id, request) request.using_default_redirect_uri = True log.debug('Using default redirect_uri %s.', request.redirect_uri) if not request.redirect_uri: raise errors.MissingRedirectURIError(request=request) if not is_absolute_uri(request.redirect_uri): raise errors.InvalidRedirectURIError(request=request) oauth2/rfc6749/grant_types/implicit.py 0000644 00000040724 15125174064 0013611 0 ustar 00 """ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ """ import logging from oauthlib import common from .. import errors from .base import GrantTypeBase log = logging.getLogger(__name__) class ImplicitGrant(GrantTypeBase): """`Implicit Grant`_ The implicit grant type is used to obtain access tokens (it does not support the issuance of refresh tokens) and is optimized for public clients known to operate a particular redirection URI. These clients are typically implemented in a browser using a scripting language such as JavaScript. Unlike the authorization code grant type, in which the client makes separate requests for authorization and for an access token, the client receives the access token as the result of the authorization request. The implicit grant type does not include client authentication, and relies on the presence of the resource owner and the registration of the redirection URI. Because the access token is encoded into the redirection URI, it may be exposed to the resource owner and other applications residing on the same device:: +----------+ | Resource | | Owner | | | +----------+ ^ | (B) +----|-----+ Client Identifier +---------------+ | -+----(A)-- & Redirection URI --->| | | User- | | Authorization | | Agent -|----(B)-- User authenticates -->| Server | | | | | | |<---(C)--- Redirection URI ----<| | | | with Access Token +---------------+ | | in Fragment | | +---------------+ | |----(D)--- Redirection URI ---->| Web-Hosted | | | without Fragment | Client | | | | Resource | | (F) |<---(E)------- Script ---------<| | | | +---------------+ +-|--------+ | | (A) (G) Access Token | | ^ v +---------+ | | | Client | | | +---------+ Note: The lines illustrating steps (A) and (B) are broken into two parts as they pass through the user-agent. Figure 4: Implicit Grant Flow The flow illustrated in Figure 4 includes the following steps: (A) The client initiates the flow by directing the resource owner's user-agent to the authorization endpoint. The client includes its client identifier, requested scope, local state, and a redirection URI to which the authorization server will send the user-agent back once access is granted (or denied). (B) The authorization server authenticates the resource owner (via the user-agent) and establishes whether the resource owner grants or denies the client's access request. (C) Assuming the resource owner grants access, the authorization server redirects the user-agent back to the client using the redirection URI provided earlier. The redirection URI includes the access token in the URI fragment. (D) The user-agent follows the redirection instructions by making a request to the web-hosted client resource (which does not include the fragment per [RFC2616]). The user-agent retains the fragment information locally. (E) The web-hosted client resource returns a web page (typically an HTML document with an embedded script) capable of accessing the full redirection URI including the fragment retained by the user-agent, and extracting the access token (and other parameters) contained in the fragment. (F) The user-agent executes the script provided by the web-hosted client resource locally, which extracts the access token. (G) The user-agent passes the access token to the client. See `Section 10.3`_ and `Section 10.16`_ for important security considerations when using the implicit grant. .. _`Implicit Grant`: https://tools.ietf.org/html/rfc6749#section-4.2 .. _`Section 10.3`: https://tools.ietf.org/html/rfc6749#section-10.3 .. _`Section 10.16`: https://tools.ietf.org/html/rfc6749#section-10.16 """ response_types = ['token'] grant_allows_refresh_token = False def create_authorization_response(self, request, token_handler): """Create an authorization response. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: response_type REQUIRED. Value MUST be set to "token" for standard OAuth2 implicit flow or "id_token token" or just "id_token" for OIDC implicit flow client_id REQUIRED. The client identifier as described in `Section 2.2`_. redirect_uri OPTIONAL. As described in `Section 3.1.2`_. scope OPTIONAL. The scope of the access request as described by `Section 3.3`_. state RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. The authorization server validates the request to ensure that all required parameters are present and valid. The authorization server MUST verify that the redirection URI to which it will redirect the access token matches a redirection URI registered by the client as described in `Section 3.1.2`_. .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B """ return self.create_token_response(request, token_handler) def create_token_response(self, request, token_handler): """Return token or error embedded in the URI fragment. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. If the resource owner grants the access request, the authorization server issues an access token and delivers it to the client by adding the following parameters to the fragment component of the redirection URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: access_token REQUIRED. The access token issued by the authorization server. token_type REQUIRED. The type of the token issued as described in `Section 7.1`_. Value is case insensitive. expires_in RECOMMENDED. The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. scope OPTIONAL, if identical to the scope requested by the client; otherwise, REQUIRED. The scope of the access token as described by `Section 3.3`_. state REQUIRED if the "state" parameter was present in the client authorization request. The exact value received from the client. The authorization server MUST NOT issue a refresh token. .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1 """ try: self.validate_token_request(request) # If the request fails due to a missing, invalid, or mismatching # redirection URI, or if the client identifier is missing or invalid, # the authorization server SHOULD inform the resource owner of the # error and MUST NOT automatically redirect the user-agent to the # invalid redirection URI. except errors.FatalClientError as e: log.debug('Fatal client error during validation of %r. %r.', request, e) raise # If the resource owner denies the access request or if the request # fails for reasons other than a missing or invalid redirection URI, # the authorization server informs the client by adding the following # parameters to the fragment component of the redirection URI using the # "application/x-www-form-urlencoded" format, per Appendix B: # https://tools.ietf.org/html/rfc6749#appendix-B except errors.OAuth2Error as e: log.debug('Client error during validation of %r. %r.', request, e) return {'Location': common.add_params_to_uri(request.redirect_uri, e.twotuples, fragment=True)}, None, 302 # In OIDC implicit flow it is possible to have a request_type that does not include the access_token! # "id_token token" - return the access token and the id token # "id_token" - don't return the access token if "token" in request.response_type.split(): token = token_handler.create_token(request, refresh_token=False) else: token = {} if request.state is not None: token['state'] = request.state for modifier in self._token_modifiers: token = modifier(token, token_handler, request) # In OIDC implicit flow it is possible to have a request_type that does # not include the access_token! In this case there is no need to save a token. if "token" in request.response_type.split(): self.request_validator.save_token(token, request) return self.prepare_authorization_response( request, token, {}, None, 302) def validate_authorization_request(self, request): """ :param request: OAuthlib request. :type request: oauthlib.common.Request """ return self.validate_token_request(request) def validate_token_request(self, request): """Check the token request for normal and fatal errors. :param request: OAuthlib request. :type request: oauthlib.common.Request This method is very similar to validate_authorization_request in the AuthorizationCodeGrant but differ in a few subtle areas. A normal error could be a missing response_type parameter or the client attempting to access scope it is not allowed to ask authorization for. Normal errors can safely be included in the redirection URI and sent back to the client. Fatal errors occur when the client_id or redirect_uri is invalid or missing. These must be caught by the provider and handled, how this is done is outside of the scope of OAuthLib but showing an error page describing the issue is a good idea. """ # First check for fatal errors # If the request fails due to a missing, invalid, or mismatching # redirection URI, or if the client identifier is missing or invalid, # the authorization server SHOULD inform the resource owner of the # error and MUST NOT automatically redirect the user-agent to the # invalid redirection URI. # First check duplicate parameters for param in ('client_id', 'response_type', 'redirect_uri', 'scope', 'state'): try: duplicate_params = request.duplicate_params except ValueError: raise errors.InvalidRequestFatalError(description='Unable to parse query string', request=request) if param in duplicate_params: raise errors.InvalidRequestFatalError(description='Duplicate %s parameter.' % param, request=request) # REQUIRED. The client identifier as described in Section 2.2. # https://tools.ietf.org/html/rfc6749#section-2.2 if not request.client_id: raise errors.MissingClientIdError(request=request) if not self.request_validator.validate_client_id(request.client_id, request): raise errors.InvalidClientIdError(request=request) # OPTIONAL. As described in Section 3.1.2. # https://tools.ietf.org/html/rfc6749#section-3.1.2 self._handle_redirects(request) # Then check for normal errors. request_info = self._run_custom_validators(request, self.custom_validators.all_pre) # If the resource owner denies the access request or if the request # fails for reasons other than a missing or invalid redirection URI, # the authorization server informs the client by adding the following # parameters to the fragment component of the redirection URI using the # "application/x-www-form-urlencoded" format, per Appendix B. # https://tools.ietf.org/html/rfc6749#appendix-B # Note that the correct parameters to be added are automatically # populated through the use of specific exceptions # REQUIRED. if request.response_type is None: raise errors.MissingResponseTypeError(request=request) # Value MUST be one of our registered types: "token" by default or if using OIDC "id_token" or "id_token token" elif not set(request.response_type.split()).issubset(self.response_types): raise errors.UnsupportedResponseTypeError(request=request) log.debug('Validating use of response_type token for client %r (%r).', request.client_id, request.client) if not self.request_validator.validate_response_type(request.client_id, request.response_type, request.client, request): log.debug('Client %s is not authorized to use response_type %s.', request.client_id, request.response_type) raise errors.UnauthorizedClientError(request=request) # OPTIONAL. The scope of the access request as described by Section 3.3 # https://tools.ietf.org/html/rfc6749#section-3.3 self.validate_scopes(request) request_info.update({ 'client_id': request.client_id, 'redirect_uri': request.redirect_uri, 'response_type': request.response_type, 'state': request.state, 'request': request, }) request_info = self._run_custom_validators( request, self.custom_validators.all_post, request_info ) return request.scopes, request_info def _run_custom_validators(self, request, validations, request_info=None): # Make a copy so we don't modify the existing request_info dict request_info = {} if request_info is None else request_info.copy() # For implicit grant, auth_validators and token_validators are # basically equivalent since the token is returned from the # authorization endpoint. for validator in validations: result = validator(request) if result is not None: request_info.update(result) return request_info oauth2/rfc6749/grant_types/resource_owner_password_credentials.py 0000644 00000020504 15125174064 0021331 0 ustar 00 """ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ """ import json import logging from .. import errors from .base import GrantTypeBase log = logging.getLogger(__name__) class ResourceOwnerPasswordCredentialsGrant(GrantTypeBase): """`Resource Owner Password Credentials Grant`_ The resource owner password credentials grant type is suitable in cases where the resource owner has a trust relationship with the client, such as the device operating system or a highly privileged application. The authorization server should take special care when enabling this grant type and only allow it when other flows are not viable. This grant type is suitable for clients capable of obtaining the resource owner's credentials (username and password, typically using an interactive form). It is also used to migrate existing clients using direct authentication schemes such as HTTP Basic or Digest authentication to OAuth by converting the stored credentials to an access token:: +----------+ | Resource | | Owner | | | +----------+ v | Resource Owner (A) Password Credentials | v +---------+ +---------------+ | |>--(B)---- Resource Owner ------->| | | | Password Credentials | Authorization | | Client | | Server | | |<--(C)---- Access Token ---------<| | | | (w/ Optional Refresh Token) | | +---------+ +---------------+ Figure 5: Resource Owner Password Credentials Flow The flow illustrated in Figure 5 includes the following steps: (A) The resource owner provides the client with its username and password. (B) The client requests an access token from the authorization server's token endpoint by including the credentials received from the resource owner. When making the request, the client authenticates with the authorization server. (C) The authorization server authenticates the client and validates the resource owner credentials, and if valid, issues an access token. .. _`Resource Owner Password Credentials Grant`: https://tools.ietf.org/html/rfc6749#section-4.3 """ def create_token_response(self, request, token_handler): """Return token or error in json format. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. If the access token request is valid and authorized, the authorization server issues an access token and optional refresh token as described in `Section 5.1`_. If the request failed client authentication or is invalid, the authorization server returns an error response as described in `Section 5.2`_. .. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1 .. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2 """ headers = self._get_default_headers() try: if self.request_validator.client_authentication_required(request): log.debug('Authenticating client, %r.', request) if not self.request_validator.authenticate_client(request): log.debug('Client authentication failed, %r.', request) raise errors.InvalidClientError(request=request) elif not self.request_validator.authenticate_client_id(request.client_id, request): log.debug('Client authentication failed, %r.', request) raise errors.InvalidClientError(request=request) log.debug('Validating access token request, %r.', request) self.validate_token_request(request) except errors.OAuth2Error as e: log.debug('Client error in token request, %s.', e) headers.update(e.headers) return headers, e.json, e.status_code token = token_handler.create_token(request, self.refresh_token) for modifier in self._token_modifiers: token = modifier(token) self.request_validator.save_token(token, request) log.debug('Issuing token %r to client id %r (%r) and username %s.', token, request.client_id, request.client, request.username) return headers, json.dumps(token), 200 def validate_token_request(self, request): """ :param request: OAuthlib request. :type request: oauthlib.common.Request The client makes a request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format per Appendix B with a character encoding of UTF-8 in the HTTP request entity-body: grant_type REQUIRED. Value MUST be set to "password". username REQUIRED. The resource owner username. password REQUIRED. The resource owner password. scope OPTIONAL. The scope of the access request as described by `Section 3.3`_. If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in `Section 3.2.1`_. The authorization server MUST: o require client authentication for confidential clients or for any client that was issued client credentials (or with other authentication requirements), o authenticate the client if client authentication is included, and o validate the resource owner password credentials using its existing password validation algorithm. Since this access token request utilizes the resource owner's password, the authorization server MUST protect the endpoint against brute force attacks (e.g., using rate-limitation or generating alerts). .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 """ for validator in self.custom_validators.pre_token: validator(request) for param in ('grant_type', 'username', 'password'): if not getattr(request, param, None): raise errors.InvalidRequestError( 'Request is missing %s parameter.' % param, request=request) for param in ('grant_type', 'username', 'password', 'scope'): if param in request.duplicate_params: raise errors.InvalidRequestError(description='Duplicate %s parameter.' % param, request=request) # This error should rarely (if ever) occur if requests are routed to # grant type handlers based on the grant_type parameter. if not request.grant_type == 'password': raise errors.UnsupportedGrantTypeError(request=request) log.debug('Validating username %s.', request.username) if not self.request_validator.validate_user(request.username, request.password, request.client, request): raise errors.InvalidGrantError( 'Invalid credentials given.', request=request) else: if not hasattr(request.client, 'client_id'): raise NotImplementedError( 'Validate user must set the ' 'request.client.client_id attribute ' 'in authenticate_client.') log.debug('Authorizing access to user %r.', request.user) # Ensure client is authorized use of this grant type self.validate_grant_type(request) if request.client: request.client_id = request.client_id or request.client.client_id self.validate_scopes(request) for validator in self.custom_validators.post_token: validator(request) oauth2/rfc6749/grant_types/refresh_token.py 0000644 00000013260 15125174064 0014630 0 ustar 00 """ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ """ import json import logging from .. import errors, utils from .base import GrantTypeBase log = logging.getLogger(__name__) class RefreshTokenGrant(GrantTypeBase): """`Refresh token grant`_ .. _`Refresh token grant`: https://tools.ietf.org/html/rfc6749#section-6 """ def __init__(self, request_validator=None, issue_new_refresh_tokens=True, **kwargs): super().__init__( request_validator, issue_new_refresh_tokens=issue_new_refresh_tokens, **kwargs) def create_token_response(self, request, token_handler): """Create a new access token from a refresh_token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param token_handler: A token handler instance, for example of type oauthlib.oauth2.BearerToken. If valid and authorized, the authorization server issues an access token as described in `Section 5.1`_. If the request failed verification or is invalid, the authorization server returns an error response as described in `Section 5.2`_. The authorization server MAY issue a new refresh token, in which case the client MUST discard the old refresh token and replace it with the new refresh token. The authorization server MAY revoke the old refresh token after issuing a new refresh token to the client. If a new refresh token is issued, the refresh token scope MUST be identical to that of the refresh token included by the client in the request. .. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1 .. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2 """ headers = self._get_default_headers() try: log.debug('Validating refresh token request, %r.', request) self.validate_token_request(request) except errors.OAuth2Error as e: log.debug('Client error in token request, %s.', e) headers.update(e.headers) return headers, e.json, e.status_code token = token_handler.create_token(request, refresh_token=self.issue_new_refresh_tokens) for modifier in self._token_modifiers: token = modifier(token) self.request_validator.save_token(token, request) log.debug('Issuing new token to client id %r (%r), %r.', request.client_id, request.client, token) return headers, json.dumps(token), 200 def validate_token_request(self, request): """ :param request: OAuthlib request. :type request: oauthlib.common.Request """ # REQUIRED. Value MUST be set to "refresh_token". if request.grant_type != 'refresh_token': raise errors.UnsupportedGrantTypeError(request=request) for validator in self.custom_validators.pre_token: validator(request) if request.refresh_token is None: raise errors.InvalidRequestError( description='Missing refresh token parameter.', request=request) # Because refresh tokens are typically long-lasting credentials used to # request additional access tokens, the refresh token is bound to the # client to which it was issued. If the client type is confidential or # the client was issued client credentials (or assigned other # authentication requirements), the client MUST authenticate with the # authorization server as described in Section 3.2.1. # https://tools.ietf.org/html/rfc6749#section-3.2.1 if self.request_validator.client_authentication_required(request): log.debug('Authenticating client, %r.', request) if not self.request_validator.authenticate_client(request): log.debug('Invalid client (%r), denying access.', request) raise errors.InvalidClientError(request=request) elif not self.request_validator.authenticate_client_id(request.client_id, request): log.debug('Client authentication failed, %r.', request) raise errors.InvalidClientError(request=request) # Ensure client is authorized use of this grant type self.validate_grant_type(request) # REQUIRED. The refresh token issued to the client. log.debug('Validating refresh token %s for client %r.', request.refresh_token, request.client) if not self.request_validator.validate_refresh_token( request.refresh_token, request.client, request): log.debug('Invalid refresh token, %s, for client %r.', request.refresh_token, request.client) raise errors.InvalidGrantError(request=request) original_scopes = utils.scope_to_list( self.request_validator.get_original_scopes( request.refresh_token, request)) if request.scope: request.scopes = utils.scope_to_list(request.scope) if (not all(s in original_scopes for s in request.scopes) and not self.request_validator.is_within_original_scope( request.scopes, request.refresh_token, request)): log.debug('Refresh token %s lack requested scopes, %r.', request.refresh_token, request.scopes) raise errors.InvalidScopeError(request=request) else: request.scopes = original_scopes for validator in self.custom_validators.post_token: validator(request) oauth2/rfc6749/grant_types/__init__.py 0000644 00000000560 15125174064 0013530 0 ustar 00 """ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ """ from .authorization_code import AuthorizationCodeGrant from .client_credentials import ClientCredentialsGrant from .implicit import ImplicitGrant from .refresh_token import RefreshTokenGrant from .resource_owner_password_credentials import ( ResourceOwnerPasswordCredentialsGrant, ) oauth2/rfc6749/request_validator.py 0000644 00000066305 15125174064 0013200 0 ustar 00 """ oauthlib.oauth2.rfc6749.request_validator ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ """ import logging log = logging.getLogger(__name__) class RequestValidator: def client_authentication_required(self, request, *args, **kwargs): """Determine if client authentication is required for current request. According to the rfc6749, client authentication is required in the following cases: - Resource Owner Password Credentials Grant, when Client type is Confidential or when Client was issued client credentials or whenever Client provided client authentication, see `Section 4.3.2`_. - Authorization Code Grant, when Client type is Confidential or when Client was issued client credentials or whenever Client provided client authentication, see `Section 4.1.3`_. - Refresh Token Grant, when Client type is Confidential or when Client was issued client credentials or whenever Client provided client authentication, see `Section 6`_ :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Resource Owner Password Credentials Grant - Refresh Token Grant .. _`Section 4.3.2`: https://tools.ietf.org/html/rfc6749#section-4.3.2 .. _`Section 4.1.3`: https://tools.ietf.org/html/rfc6749#section-4.1.3 .. _`Section 6`: https://tools.ietf.org/html/rfc6749#section-6 """ return True def authenticate_client(self, request, *args, **kwargs): """Authenticate client through means outside the OAuth 2 spec. Means of authentication is negotiated beforehand and may for example be `HTTP Basic Authentication Scheme`_ which utilizes the Authorization header. Headers may be accesses through request.headers and parameters found in both body and query can be obtained by direct attribute access, i.e. request.client_id for client_id in the URL query. The authentication process is required to contain the identification of the client (i.e. search the database based on the client_id). In case the client doesn't exist based on the received client_id, this method has to return False and the HTTP response created by the library will contain 'invalid_client' message. After the client identification succeeds, this method needs to set the client on the request, i.e. request.client = client. A client object's class must contain the 'client_id' attribute and the 'client_id' must have a value. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Resource Owner Password Credentials Grant (may be disabled) - Client Credentials Grant - Refresh Token Grant .. _`HTTP Basic Authentication Scheme`: https://tools.ietf.org/html/rfc1945#section-11.1 """ raise NotImplementedError('Subclasses must implement this method.') def authenticate_client_id(self, client_id, request, *args, **kwargs): """Ensure client_id belong to a non-confidential client. A non-confidential client is one that is not required to authenticate through other means, such as using HTTP Basic. Note, while not strictly necessary it can often be very convenient to set request.client to the client object associated with the given client_id. :param client_id: Unicode client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant """ raise NotImplementedError('Subclasses must implement this method.') def confirm_redirect_uri(self, client_id, code, redirect_uri, client, request, *args, **kwargs): """Ensure that the authorization process represented by this authorization code began with this 'redirect_uri'. If the client specifies a redirect_uri when obtaining code then that redirect URI must be bound to the code and verified equal in this method, according to RFC 6749 section 4.1.3. Do not compare against the client's allowed redirect URIs, but against the URI used when the code was saved. :param client_id: Unicode client identifier. :param code: Unicode authorization_code. :param redirect_uri: Unicode absolute URI. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant (during token request) """ raise NotImplementedError('Subclasses must implement this method.') def get_default_redirect_uri(self, client_id, request, *args, **kwargs): """Get the default redirect URI for the client. :param client_id: Unicode client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: The default redirect URI for the client Method is used by: - Authorization Code Grant - Implicit Grant """ raise NotImplementedError('Subclasses must implement this method.') def get_default_scopes(self, client_id, request, *args, **kwargs): """Get the default scopes for the client. :param client_id: Unicode client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: List of default scopes Method is used by all core grant types: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant - Client Credentials grant """ raise NotImplementedError('Subclasses must implement this method.') def get_original_scopes(self, refresh_token, request, *args, **kwargs): """Get the list of scopes associated with the refresh token. :param refresh_token: Unicode refresh token. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: List of scopes. Method is used by: - Refresh token grant """ raise NotImplementedError('Subclasses must implement this method.') def is_within_original_scope(self, request_scopes, refresh_token, request, *args, **kwargs): """Check if requested scopes are within a scope of the refresh token. When access tokens are refreshed the scope of the new token needs to be within the scope of the original token. This is ensured by checking that all requested scopes strings are on the list returned by the get_original_scopes. If this check fails, is_within_original_scope is called. The method can be used in situations where returning all valid scopes from the get_original_scopes is not practical. :param request_scopes: A list of scopes that were requested by client. :param refresh_token: Unicode refresh_token. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Refresh token grant """ return False def introspect_token(self, token, token_type_hint, request, *args, **kwargs): """Introspect an access or refresh token. Called once the introspect request is validated. This method should verify the *token* and either return a dictionary with the list of claims associated, or `None` in case the token is unknown. Below the list of registered claims you should be interested in: - scope : space-separated list of scopes - client_id : client identifier - username : human-readable identifier for the resource owner - token_type : type of the token - exp : integer timestamp indicating when this token will expire - iat : integer timestamp indicating when this token was issued - nbf : integer timestamp indicating when it can be "not-before" used - sub : subject of the token - identifier of the resource owner - aud : list of string identifiers representing the intended audience - iss : string representing issuer of this token - jti : string identifier for the token Note that most of them are coming directly from JWT RFC. More details can be found in `Introspect Claims`_ or `_JWT Claims`_. The implementation can use *token_type_hint* to improve lookup efficency, but must fallback to other types to be compliant with RFC. The dict of claims is added to request.token after this method. :param token: The token string. :param token_type_hint: access_token or refresh_token. :param request: OAuthlib request. :type request: oauthlib.common.Request Method is used by: - Introspect Endpoint (all grants are compatible) .. _`Introspect Claims`: https://tools.ietf.org/html/rfc7662#section-2.2 .. _`JWT Claims`: https://tools.ietf.org/html/rfc7519#section-4 """ raise NotImplementedError('Subclasses must implement this method.') def invalidate_authorization_code(self, client_id, code, request, *args, **kwargs): """Invalidate an authorization code after use. :param client_id: Unicode client identifier. :param code: The authorization code grant (request.code). :param request: OAuthlib request. :type request: oauthlib.common.Request Method is used by: - Authorization Code Grant """ raise NotImplementedError('Subclasses must implement this method.') def revoke_token(self, token, token_type_hint, request, *args, **kwargs): """Revoke an access or refresh token. :param token: The token string. :param token_type_hint: access_token or refresh_token. :param request: OAuthlib request. :type request: oauthlib.common.Request Method is used by: - Revocation Endpoint """ raise NotImplementedError('Subclasses must implement this method.') def rotate_refresh_token(self, request): """Determine whether to rotate the refresh token. Default, yes. When access tokens are refreshed the old refresh token can be kept or replaced with a new one (rotated). Return True to rotate and and False for keeping original. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Refresh Token Grant """ return True def save_authorization_code(self, client_id, code, request, *args, **kwargs): """Persist the authorization_code. The code should at minimum be stored with: - the client_id (``client_id``) - the redirect URI used (``request.redirect_uri``) - a resource owner / user (``request.user``) - the authorized scopes (``request.scopes``) To support PKCE, you MUST associate the code with: - Code Challenge (``request.code_challenge``) and - Code Challenge Method (``request.code_challenge_method``) To support OIDC, you MUST associate the code with: - nonce, if present (``code["nonce"]``) The ``code`` argument is actually a dictionary, containing at least a ``code`` key with the actual authorization code: ``{'code': 'sdf345jsdf0934f'}`` It may also have a ``claims`` parameter which, when present, will be a dict deserialized from JSON as described at http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter This value should be saved in this method and used again in ``.validate_code``. :param client_id: Unicode client identifier. :param code: A dict of the authorization code grant and, optionally, state. :param request: OAuthlib request. :type request: oauthlib.common.Request Method is used by: - Authorization Code Grant """ raise NotImplementedError('Subclasses must implement this method.') def save_token(self, token, request, *args, **kwargs): """Persist the token with a token type specific method. Currently, only save_bearer_token is supported. :param token: A (Bearer) token dict. :param request: OAuthlib request. :type request: oauthlib.common.Request """ return self.save_bearer_token(token, request, *args, **kwargs) def save_bearer_token(self, token, request, *args, **kwargs): """Persist the Bearer token. The Bearer token should at minimum be associated with: - a client and it's client_id, if available - a resource owner / user (request.user) - authorized scopes (request.scopes) - an expiration time - a refresh token, if issued - a claims document, if present in request.claims The Bearer token dict may hold a number of items:: { 'token_type': 'Bearer', 'access_token': 'askfjh234as9sd8', 'expires_in': 3600, 'scope': 'string of space separated authorized scopes', 'refresh_token': '23sdf876234', # if issued 'state': 'given_by_client', # if supplied by client (implicit ONLY) } Note that while "scope" is a string-separated list of authorized scopes, the original list is still available in request.scopes. The token dict is passed as a reference so any changes made to the dictionary will go back to the user. If additional information must return to the client user, and it is only possible to get this information after writing the token to storage, it should be added to the token dictionary. If the token dictionary must be modified but the changes should not go back to the user, a copy of the dictionary must be made before making the changes. Also note that if an Authorization Code grant request included a valid claims parameter (for OpenID Connect) then the request.claims property will contain the claims dict, which should be saved for later use when generating the id_token and/or UserInfo response content. :param token: A Bearer token dict. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: The default redirect URI for the client Method is used by all core grant types issuing Bearer tokens: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant (might not associate a client) - Client Credentials grant """ raise NotImplementedError('Subclasses must implement this method.') def validate_bearer_token(self, token, scopes, request): """Ensure the Bearer token is valid and authorized access to scopes. :param token: A string of random characters. :param scopes: A list of scopes associated with the protected resource. :param request: OAuthlib request. :type request: oauthlib.common.Request A key to OAuth 2 security and restricting impact of leaked tokens is the short expiration time of tokens, *always ensure the token has not expired!*. Two different approaches to scope validation: 1) all(scopes). The token must be authorized access to all scopes associated with the resource. For example, the token has access to ``read-only`` and ``images``, thus the client can view images but not upload new. Allows for fine grained access control through combining various scopes. 2) any(scopes). The token must be authorized access to one of the scopes associated with the resource. For example, token has access to ``read-only-images``. Allows for fine grained, although arguably less convenient, access control. A powerful way to use scopes would mimic UNIX ACLs and see a scope as a group with certain privileges. For a restful API these might map to HTTP verbs instead of read, write and execute. Note, the request.user attribute can be set to the resource owner associated with this token. Similarly the request.client and request.scopes attribute can be set to associated client object and authorized scopes. If you then use a decorator such as the one provided for django these attributes will be made available in all protected views as keyword arguments. :param token: Unicode Bearer token :param scopes: List of scopes (defined by you) :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is indirectly used by all core Bearer token issuing grant types: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant - Client Credentials Grant """ raise NotImplementedError('Subclasses must implement this method.') def validate_client_id(self, client_id, request, *args, **kwargs): """Ensure client_id belong to a valid and active client. Note, while not strictly necessary it can often be very convenient to set request.client to the client object associated with the given client_id. :param client_id: Unicode client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Implicit Grant """ raise NotImplementedError('Subclasses must implement this method.') def validate_code(self, client_id, code, client, request, *args, **kwargs): """Verify that the authorization_code is valid and assigned to the given client. Before returning true, set the following based on the information stored with the code in 'save_authorization_code': - request.user - request.scopes - request.claims (if given) OBS! The request.user attribute should be set to the resource owner associated with this authorization code. Similarly request.scopes must also be set. The request.claims property, if it was given, should assigned a dict. If PKCE is enabled (see 'is_pkce_required' and 'save_authorization_code') you MUST set the following based on the information stored: - request.code_challenge - request.code_challenge_method :param client_id: Unicode client identifier. :param code: Unicode authorization code. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant """ raise NotImplementedError('Subclasses must implement this method.') def validate_grant_type(self, client_id, grant_type, client, request, *args, **kwargs): """Ensure client is authorized to use the grant_type requested. :param client_id: Unicode client identifier. :param grant_type: Unicode grant type, i.e. authorization_code, password. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Resource Owner Password Credentials Grant - Client Credentials Grant - Refresh Token Grant """ raise NotImplementedError('Subclasses must implement this method.') def validate_redirect_uri(self, client_id, redirect_uri, request, *args, **kwargs): """Ensure client is authorized to redirect to the redirect_uri requested. All clients should register the absolute URIs of all URIs they intend to redirect to. The registration is outside of the scope of oauthlib. :param client_id: Unicode client identifier. :param redirect_uri: Unicode absolute URI. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Implicit Grant """ raise NotImplementedError('Subclasses must implement this method.') def validate_refresh_token(self, refresh_token, client, request, *args, **kwargs): """Ensure the Bearer token is valid and authorized access to scopes. OBS! The request.user attribute should be set to the resource owner associated with this refresh token. :param refresh_token: Unicode refresh token. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant (indirectly by issuing refresh tokens) - Resource Owner Password Credentials Grant (also indirectly) - Refresh Token Grant """ raise NotImplementedError('Subclasses must implement this method.') def validate_response_type(self, client_id, response_type, client, request, *args, **kwargs): """Ensure client is authorized to use the response_type requested. :param client_id: Unicode client identifier. :param response_type: Unicode response type, i.e. code, token. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Implicit Grant """ raise NotImplementedError('Subclasses must implement this method.') def validate_scopes(self, client_id, scopes, client, request, *args, **kwargs): """Ensure the client is authorized access to requested scopes. :param client_id: Unicode client identifier. :param scopes: List of scopes (defined by you). :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by all core grant types: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant - Client Credentials Grant """ raise NotImplementedError('Subclasses must implement this method.') def validate_user(self, username, password, client, request, *args, **kwargs): """Ensure the username and password is valid. OBS! The validation should also set the user attribute of the request to a valid resource owner, i.e. request.user = username or similar. If not set you will be unable to associate a token with a user in the persistance method used (commonly, save_bearer_token). :param username: Unicode username. :param password: Unicode password. :param client: Client object set by you, see ``.authenticate_client``. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Resource Owner Password Credentials Grant """ raise NotImplementedError('Subclasses must implement this method.') def is_pkce_required(self, client_id, request): """Determine if current request requires PKCE. Default, False. This is called for both "authorization" and "token" requests. Override this method by ``return True`` to enable PKCE for everyone. You might want to enable it only for public clients. Note that PKCE can also be used in addition of a client authentication. OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. This specification describes the attack as well as a technique to mitigate against the threat through the use of Proof Key for Code Exchange (PKCE, pronounced "pixy"). See `RFC7636`_. :param client_id: Client identifier. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant .. _`RFC7636`: https://tools.ietf.org/html/rfc7636 """ return False def get_code_challenge(self, code, request): """Is called for every "token" requests. When the server issues the authorization code in the authorization response, it MUST associate the ``code_challenge`` and ``code_challenge_method`` values with the authorization code so it can be verified later. Typically, the ``code_challenge`` and ``code_challenge_method`` values are stored in encrypted form in the ``code`` itself but could alternatively be stored on the server associated with the code. The server MUST NOT include the ``code_challenge`` value in client requests in a form that other entities can extract. Return the ``code_challenge`` associated to the code. If ``None`` is returned, code is considered to not be associated to any challenges. :param code: Authorization code. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: code_challenge string Method is used by: - Authorization Code Grant - when PKCE is active """ return None def get_code_challenge_method(self, code, request): """Is called during the "token" request processing, when a ``code_verifier`` and a ``code_challenge`` has been provided. See ``.get_code_challenge``. Must return ``plain`` or ``S256``. You can return a custom value if you have implemented your own ``AuthorizationCodeGrant`` class. :param code: Authorization code. :param request: OAuthlib request. :type request: oauthlib.common.Request :rtype: code_challenge_method string Method is used by: - Authorization Code Grant - when PKCE is active """ raise NotImplementedError('Subclasses must implement this method.') oauth2/rfc6749/clients/__pycache__/backend_application.cpython-39.pyc 0000644 00000006607 15125174064 0021344 0 ustar 00 a \��`� � @ s0 d Z ddlmZ ddlmZ G dd� de�ZdS )z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � )�prepare_token_request� )�Clientc @ s e Zd ZdZdZddd�ZdS ) �BackendApplicationClienta� A public client utilizing the client credentials grant workflow. The client can request an access token using only its client credentials (or other supported means of authentication) when the client is requesting access to the protected resources under its control, or those of another resource owner which has been previously arranged with the authorization server (the method of which is beyond the scope of this specification). The client credentials grant type MUST only be used by confidential clients. Since the client authentication is used as the authorization grant, no additional authorization request is needed. Zclient_credentials� NFc K s< | j |d< ||d< |du r | jn|}t| jf||d�|��S )a� Add the client credentials to the request body. The client makes a request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format per `Appendix B`_ in the HTTP request entity-body: :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param scope: The scope of the access request as described by `Section 3.3`_. :param include_client_id: `True` to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. False otherwise (default). :type include_client_id: Boolean :param kwargs: Extra credentials to include in the token request. The client MUST authenticate with the authorization server as described in `Section 3.2.1`_. The prepared body will include all provided credentials as well as the ``grant_type`` parameter set to ``client_credentials``:: >>> from oauthlib.oauth2 import BackendApplicationClient >>> client = BackendApplicationClient('your_id') >>> client.prepare_request_body(scope=['hello', 'world']) 'grant_type=client_credentials&scope=hello+world' .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 � client_id�include_client_idN)�body�scope)r r r � grant_type)�selfr r r �kwargs� r �W/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/backend_application.py�prepare_request_body! s % ��z-BackendApplicationClient.prepare_request_body)r NF)�__name__� __module__� __qualname__�__doc__r r r r r r r s �r N)r � parametersr �baser r r r r r �<module> s oauth2/rfc6749/clients/__pycache__/base.cpython-39.opt-1.pyc 0000644 00000046462 15125174064 0017246 0 ustar 00 a \��` V � @ s� d Z ddlZddlZddlmZ ddlmZ ddlmZm Z ddl m Z m Z m Z ddlmZ dZd Zd Zd d iZG d d� d�ZdS )z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming OAuth 2.0 RFC6749. � N)�generate_token)�tokens)�InsecureTransportError�TokenExpiredError)�parse_token_response�prepare_token_request� prepare_token_revocation_request)�is_secure_transportZ auth_header�query�bodyz Content-Typez!application/x-www-form-urlencodedc @ s� e Zd ZdZdZedddddddddef dd�Zedd� �Z d d � Z d d � Z d d� Z d*dd�Z d+dd�Zd,dd�Zd-dd�Zd.dd�Zd/d d �Zd0d d �Zd1d d!�Zdddedfd"d#�Zd$d%� Zd&d'� Zd(d)� ZdS )2�Clienta� Base OAuth2 client responsible for access token management. This class also acts as a generic interface providing methods common to all client types such as ``prepare_authorization_request`` and ``prepare_token_revocation_request``. The ``prepare_x_request`` methods are the recommended way of interacting with clients (as opposed to the abstract prepare uri/body/etc methods). They are recommended over the older set because they are easier to use (more consistent) and add a few additional security checks, such as HTTPS and state checking. Some of these methods require further implementation only provided by the specific purpose clients such as :py:class:`oauthlib.oauth2.MobileApplicationClient` and thus you should always seek to use the client class matching the OAuth workflow you need. For Python, this is usually :py:class:`oauthlib.oauth2.WebApplicationClient`. � refresh_token�BearerNc K sn || _ || _|| _|| _|| _|| _|| _|p0i | _| | _| | _ | | _ | | _ d| _ d| _ d| _| �| j� dS )as Initialize a client with commonly used attributes. :param client_id: Client identifier given by the OAuth provider upon registration. :param default_token_placement: Tokens can be supplied in the Authorization header (default), the URL query component (``query``) or the request body (``body``). :param token_type: OAuth 2 token type. Defaults to Bearer. Change this if you specify the ``access_token`` parameter and know it is of a different token type, such as a MAC, JWT or SAML token. Can also be supplied as ``token_type`` inside the ``token`` dict parameter. :param access_token: An access token (string) used to authenticate requests to protected resources. Can also be supplied inside the ``token`` dict parameter. :param refresh_token: A refresh token (string) used to refresh expired tokens. Can also be supplied inside the ``token`` dict parameter. :param mac_key: Encryption key used with MAC tokens. :param mac_algorithm: Hashing algorithm for MAC tokens. :param token: A dict of token attributes such as ``access_token``, ``token_type`` and ``expires_at``. :param scope: A list of default scopes to request authorization for. :param state: A CSRF protection string used during authorization. :param redirect_url: The redirection endpoint on the client side to which the user returns after authorization. :param state_generator: A no argument state generation callable. Defaults to :py:meth:`oauthlib.common.generate_token`. N)� client_id�default_token_placement� token_type� access_tokenr �mac_key� mac_algorithm�token�scope�state_generator�state� redirect_url�code� expires_in� _expires_at�populate_token_attributes)�selfr r r r r r r r r r r r �kwargs� r �H/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/base.py�__init__4 s 4 zClient.__init__c C s | j | jd�S )aO Supported token types and their respective methods Additional tokens can be supported by extending this dictionary. The Bearer token spec is stable and safe to use. The MAC token spec is not yet stable and support for MAC tokens is experimental and currently matching version 00 of the spec. )r ZMAC)�_add_bearer_token�_add_mac_token)r r r r! � token_typesy s �zClient.token_typesc O s t d��dS )z,Abstract method used to create request URIs.�*Must be implemented by inheriting classes.N��NotImplementedError�r �argsr r r r! �prepare_request_uri� s zClient.prepare_request_uric O s t d��dS )z.Abstract method used to create request bodies.r& Nr' r) r r r! �prepare_request_body� s zClient.prepare_request_bodyc O s t d��dS )z4Abstract method used to parse redirection responses.r& Nr' r) r r r! �parse_request_uri_response� s z!Client.parse_request_uri_response�GETc K s� t |�st� �|p| j}dd� | j�� D �}| j�� |vrHtd| j ��| jsb| j � d�sbtd��| j r|| j t � � k r|t � �|| j�� |||||fi |��S )ac Add token to the request uri, body or authorization header. The access token type provides the client with the information required to successfully utilize the access token to make a protected resource request (along with type-specific attributes). The client MUST NOT use an access token if it does not understand the token type. For example, the "bearer" token type defined in [`I-D.ietf-oauth-v2-bearer`_] is utilized by simply including the access token string in the request: .. code-block:: http GET /resource/1 HTTP/1.1 Host: example.com Authorization: Bearer mF_9.B5f-4.1JqM while the "mac" token type defined in [`I-D.ietf-oauth-v2-http-mac`_] is utilized by issuing a MAC key together with the access token which is used to sign certain components of the HTTP requests: .. code-block:: http GET /resource/1 HTTP/1.1 Host: example.com Authorization: MAC id="h480djs93hd8", nonce="274312:dj83hs9s", mac="kDZvddkndxvhGRXZhvuDjEWhGeE=" .. _`I-D.ietf-oauth-v2-bearer`: https://tools.ietf.org/html/rfc6749#section-12.2 .. _`I-D.ietf-oauth-v2-http-mac`: https://tools.ietf.org/html/rfc6749#section-12.2 c S s i | ]\}}|� � |�qS r )�lower)�.0�k�vr r r! � <dictcomp>� s z$Client.add_token.<locals>.<dictcomp>zUnsupported token type: %sr zMissing access token.)r r r r% �itemsr r/ � ValueErrorr r �getr �timer )r �uri� http_methodr �headers�token_placementr Z case_insensitive_token_typesr r r! � add_token� s" # ���zClient.add_tokenc K sb t |�st� �|p| �� | _|p$| j| _|du r6| jn|}| j|f| j|| jd�|��}|tdfS )a> Prepare the authorization request. This is the first step in many OAuth flows in which the user is redirected to a certain authorization URL. This method adds required parameters to the authorization URL. :param authorization_url: Provider authorization endpoint URL. :param state: CSRF protection string. Will be automatically created if not provided. The generated state is available via the ``state`` attribute. Clients should verify that the state is unchanged and present in the authorization response. This verification is done automatically if using the ``authorization_response`` parameter with ``prepare_token_request``. :param redirect_url: Redirect URL to which the user will be returned after authorization. Must be provided unless previously setup with the provider. If provided then it must also be provided in the token request. :param scope: List of scopes to request. Must be equal to or a subset of the scopes granted when obtaining the refresh token. If none is provided, the ones provided in the constructor are used. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). N)� redirect_urir r � )r r r r r r r+ �FORM_ENC_HEADERS)r Zauthorization_urlr r r r Zauth_urlr r r! � prepare_authorization_request� s ���z$Client.prepare_authorization_requestr> c K sX t |�st� �|p| j}|r*| j||d� |p2| j| _| jf || jd�|��}|t|fS )a� Prepare a token creation request. Note that these requests usually require client authentication, either by including client_id or a set of provider specific authentication credentials. :param token_url: Provider token creation endpoint URL. :param authorization_response: The full redirection URL string, i.e. the location to which the user was redirected after successfull authorization. Used to mine credentials needed to obtain a token in this step, such as authorization code. :param redirect_url: The redirect_url supplied with the authorization request (if there was one). :param state: :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). )r )r r= )r r r r- r r, r? )r � token_urlZauthorization_responser r r r r r r! r � s � ��z Client.prepare_token_requestc K sB t |�st� �|du r | jn|}| jf |||d�|��}|t|fS )a� Prepare an access token refresh request. Expired access tokens can be replaced by new access tokens without going through the OAuth dance if the client obtained a refresh token. This refresh token and authentication credentials can be used to obtain a new access token, and possibly a new refresh token. :param token_url: Provider token refresh endpoint URL. :param refresh_token: Refresh token string. :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param scope: List of scopes to request. Must be equal to or a subset of the scopes granted when obtaining the refresh token. If none is provided, the ones provided in the constructor are used. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). N)r r r )r r r �prepare_refresh_bodyr? )r rA r r r r r r r! � prepare_refresh_token_request s ��z$Client.prepare_refresh_token_requestr c K s( t |�st� �t||f|||d�|��S )aB Prepare a token revocation request. :param revocation_url: Provider token revocation endpoint URL. :param token: The access or refresh token to be revoked (string). :param token_type_hint: ``"access_token"`` (default) or ``"refresh_token"``. This is optional and if you wish to not pass it you must provide ``token_type_hint=None``. :param body: :param callback: A jsonp callback such as ``package.callback`` to be invoked upon receiving the response. Not that it should not include a () suffix. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). Note that JSONP request may use GET requests as the parameters will be added to the request URL query as opposed to the request body. An example of a revocation request .. code-block: http POST /revoke HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW token=45ghiukldjahdnhzdauz&token_type_hint=refresh_token An example of a jsonp revocation request .. code-block: http GET /revoke?token=agabcdefddddafdd&callback=package.myCallback HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW and an error response .. code-block: http package.myCallback({"error":"unsupported_token_type"}); Note that these requests usually require client credentials, client_id in the case for public clients and provider specific authentication credentials for confidential clients. )�token_type_hintr �callback)r r r )r Zrevocation_urlr rD r rE r r r r! r @ s 6��z'Client.prepare_token_revocation_requestc K s2 |du r| j n|}t||d�| _| �| j� | jS )aj Parse the JSON response body. If the access token request is valid and authorized, the authorization server issues an access token as described in `Section 5.1`_. A refresh token SHOULD NOT be included. If the request failed client authentication or is invalid, the authorization server returns an error response as described in `Section 5.2`_. :param body: The response body from the token request. :param scope: Scopes originally requested. If none is provided, the ones provided in the constructor are used. :return: Dictionary of token parameters. :raises: Warning if scope has changed. OAuth2Error if response is invalid. These response are json encoded and could easily be parsed without the assistance of OAuthLib. However, there are a few subtle issues to be aware of regarding the response which are helpfully addressed through the raising of various errors. A successful response should always contain **access_token** The access token issued by the authorization server. Often a random string. **token_type** The type of the token issued as described in `Section 7.1`_. Commonly ``Bearer``. While it is not mandated it is recommended that the provider include **expires_in** The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. **scope** Providers may supply this in all responses but are required to only if it has changed since the authorization request. .. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1 .. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2 .. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1 N)r )r r r r )r r r r r r r! �parse_request_body_response} s / z"Client.parse_request_body_responsec K s6 |p| j }|du r| jn|}t| jf|||d�|��S )a� Prepare an access token request, using a refresh token. If the authorization server issued a refresh token to the client, the client makes a refresh request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format in the HTTP request entity-body: grant_type REQUIRED. Value MUST be set to "refresh_token". refresh_token REQUIRED. The refresh token issued to the client. scope OPTIONAL. The scope of the access request as described by Section 3.3. The requested scope MUST NOT include any scope not originally granted by the resource owner, and if omitted is treated as equal to the scope originally granted by the resource owner. Note that if none is provided, the ones provided in the constructor are used if any. N)r r r )r r r �refresh_token_key)r r r r r r r r! rB � s ��zClient.prepare_refresh_bodyc C sZ |t krt�| j|�}n8|tkr0t�| j|�}n |tkrHt�| j|�}ntd��|||fS )zDAdd a bearer token to the request uri, body or authorization header.�Invalid token placement.) � AUTH_HEADERr Zprepare_bearer_headersr � URI_QUERYZprepare_bearer_uri�BODYZprepare_bearer_bodyr5 )r r8 r9 r r: r; r r r! r# � s zClient._add_bearer_tokenc K sB |t krtd��tj| j|| j|f|||| jd�|��}|||fS )z�Add a MAC token to the request authorization header. Warning: MAC token support is experimental as the spec is not yet stable. rH )r: r �extZhash_algorithm)rI r5 r Zprepare_mac_headerr r r )r r8 r9 r r: r; rL r r r r! r$ � s ���zClient._add_mac_tokenc C s t �dt� | �|�S )Nz=Please switch to the public method populate_token_attributes.)�warnings�warn�DeprecationWarningr �r Zresponser r r! �_populate_attributes� s �zClient._populate_attributesc C s d|v r|� d�| _dS )z2Add attributes from an auth code response to self.r N)r6 r rP r r r! �populate_code_attributes� s z Client.populate_code_attributesc C s� d|v r|� d�| _d|v r(|� d�| _d|v r<|� d�| _d|v rd|� d�| _t�� t| j� | _d|v r|t|� d��| _d|v r�|� d�| _d|v r�|� d�| _ dS ) z6Add attributes from a token exchange response to self.r r r r Z expires_atr r N) r6 r r r r r7 �intr r r rP r r r! r � s z Client.populate_token_attributes)r. NNN)NNN)NNNr> )Nr> N)r r> N)N)r> NN)r. NNN)�__name__� __module__� __qualname__�__doc__rG rI r r" �propertyr% r+ r, r- r< r@ r rC r rF rB r# r$ rQ rR r r r r r! r sX � E � 6 � + � ( � # � = 4 � � r )rW r7 rM Zoauthlib.commonr Zoauthlib.oauth2.rfc6749r Z oauthlib.oauth2.rfc6749.errorsr r Z"oauthlib.oauth2.rfc6749.parametersr r r Z oauthlib.oauth2.rfc6749.utilsr rI rJ rK r? r r r r r! �<module> s � oauth2/rfc6749/clients/__pycache__/service_application.cpython-39.opt-1.pyc 0000644 00000016042 15125174064 0022346 0 ustar 00 a \��`� � @ sD d Z ddlZddlmZ ddlmZ ddlmZ G dd � d e�ZdS ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N)� to_unicode� )�prepare_token_request� )�Clientc s0 e Zd ZdZdZd � fdd� Zd dd �Z� ZS ) �ServiceApplicationClienta� A public client utilizing the JWT bearer grant. JWT bearer tokes can be used to request an access token when a client wishes to utilize an existing trust relationship, expressed through the semantics of (and digital signature or keyed message digest calculated over) the JWT, without a direct user approval step at the authorization server. This grant type does not involve an authorization step. It may be used by both public and confidential clients. z+urn:ietf:params:oauth:grant-type:jwt-bearerNc s0 t � j|fi |�� || _|| _|| _|| _dS )ac Initalize a JWT client with defaults for implicit use later. :param client_id: Client identifier given by the OAuth provider upon registration. :param private_key: Private key used for signing and encrypting. Must be given as a string. :param subject: The principal that is the subject of the JWT, i.e. which user is the token requested on behalf of. For example, ``foo@example.com. :param issuer: The JWT MUST contain an "iss" (issuer) claim that contains a unique identifier for the entity that issued the JWT. For example, ``your-client@provider.com``. :param audience: A value identifying the authorization server as an intended audience, e.g. ``https://provider.com/oauth2/token``. :param kwargs: Additional arguments to pass to base client, such as state and token. See ``Client.__init__.__doc__`` for details. N)�super�__init__� private_key�subject�issuer�audience)�self� client_idr r r r �kwargs�� __class__� �W/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/service_application.pyr s z!ServiceApplicationClient.__init__� Fc K s ddl } |p| j} | s td��|p&| j|p.| j|p6| jt|pFt�� d �t|pTt�� �d�}dD ] }|| du r`td| ��q`d| v r�| �d�|d < d | v r�| �d �|d < |� |p�i � | � || d �}t |�}| j | d < | | d< | du r�| j n| } t| jf||| d�| ��S )a� Create and add a JWT assertion to the request body. :param private_key: Private key used for signing and encrypting. Must be given as a string. :param subject: (sub) The principal that is the subject of the JWT, i.e. which user is the token requested on behalf of. For example, ``foo@example.com. :param issuer: (iss) The JWT MUST contain an "iss" (issuer) claim that contains a unique identifier for the entity that issued the JWT. For example, ``your-client@provider.com``. :param audience: (aud) A value identifying the authorization server as an intended audience, e.g. ``https://provider.com/oauth2/token``. :param expires_at: A unix expiration timestamp for the JWT. Defaults to an hour from now, i.e. ``time.time() + 3600``. :param issued_at: A unix timestamp of when the JWT was created. Defaults to now, i.e. ``time.time()``. :param extra_claims: A dict of additional claims to include in the JWT. :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param scope: The scope of the access request. :param include_client_id: `True` to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. False otherwise (default). :type include_client_id: Boolean :param not_before: A unix timestamp after which the JWT may be used. Not included unless provided. * :param jwt_id: A unique JWT token identifier. Not included unless provided. * :param kwargs: Extra credentials to include in the token request. Parameters marked with a `*` above are not explicit arguments in the function signature, but are specially documented arguments for items appearing in the generic `**kwargs` keyworded input. The "scope" parameter may be used, as defined in the Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants [I-D.ietf-oauth-assertions] specification, to indicate the requested scope. Authentication of the client is optional, as described in `Section 3.2.1`_ of OAuth 2.0 [RFC6749] and consequently, the "client_id" is only needed when a form of client authentication that relies on the parameter is used. The following non-normative example demonstrates an Access Token Request with a JWT as an authorization grant (with extra line breaks for display purposes only): .. code-block: http POST /token.oauth2 HTTP/1.1 Host: as.example.com Content-Type: application/x-www-form-urlencoded grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer &assertion=eyJhbGciOiJFUzI1NiJ9. eyJpc3Mi[...omitted for brevity...]. J9l-ZhwP[...omitted for brevity...] .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 r Nz>An encryption key must be supplied to make JWT token requests.i )�iss�aud�subZexpZiat)r r r z)Claim must include %s but none was given.Z not_beforeZnbfZjwt_idZjtiZRS256r �include_client_id)�body� assertion�scope)�jwtr � ValueErrorr r r �int�time�pop�update�encoder r r r � grant_type)r r r r r Z expires_atZ issued_atZ extra_claimsr r r r r �keyZclaim�attrr r r r �prepare_request_body@ s@ X � � ��z-ServiceApplicationClient.prepare_request_body)NNNN) NNNNNNNr NF)�__name__� __module__� __qualname__�__doc__r$ r r' � __classcell__r r r r r s �! �r ) r+ r Zoauthlib.commonr � parametersr �baser r r r r r �<module> s oauth2/rfc6749/clients/__pycache__/web_application.cpython-39.pyc 0000644 00000024744 15125174064 0020534 0 ustar 00 a \��`w) � @ s@ d Z ddlZddlmZmZmZ ddlmZ G dd� de�ZdS ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N� )�!parse_authorization_code_response�prepare_grant_uri�prepare_token_request� )�Clientc sD e Zd ZdZdZd� fdd� Zddd�Zdd d �Zdd d �Z� Z S )�WebApplicationClienta> A client utilizing the authorization code grant workflow. A web application is a confidential client running on a web server. Resource owners access the client via an HTML user interface rendered in a user-agent on the device used by the resource owner. The client credentials as well as any access token issued to the client are stored on the web server and are not exposed to or accessible by the resource owner. The authorization code grant type is used to obtain both access tokens and refresh tokens and is optimized for confidential clients. As a redirection-based flow, the client must be capable of interacting with the resource owner's user-agent (typically a web browser) and capable of receiving incoming requests (via redirection) from the authorization server. Zauthorization_codeNc s t � j|fi |�� || _d S )N)�super�__init__�code)�self� client_idr �kwargs�� __class__� �S/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/web_application.pyr ' s z WebApplicationClient.__init__c K s0 |du r| j n|}t|| jdf|||d�|��S )a~ Prepare the authorization code request URI The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: :param redirect_uri: OPTIONAL. The redirect URI must be an absolute URI and it should have been registerd with the OAuth provider prior to use. As described in `Section 3.1.2`_. :param scope: OPTIONAL. The scope of the access request as described by Section 3.3`_. These may be any string but are commonly URIs or various categories such as ``videos`` or ``documents``. :param state: RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. :param kwargs: Extra arguments to include in the request URI. In addition to supplied parameters, OAuthLib will append the ``client_id`` that was provided in the constructor as well as the mandatory ``response_type`` argument, set to ``code``:: >>> from oauthlib.oauth2 import WebApplicationClient >>> client = WebApplicationClient('your_id') >>> client.prepare_request_uri('https://example.com') 'https://example.com?client_id=your_id&response_type=code' >>> client.prepare_request_uri('https://example.com', redirect_uri='https://a.b/callback') 'https://example.com?client_id=your_id&response_type=code&redirect_uri=https%3A%2F%2Fa.b%2Fcallback' >>> client.prepare_request_uri('https://example.com', scope=['profile', 'pictures']) 'https://example.com?client_id=your_id&response_type=code&scope=profile+pictures' >>> client.prepare_request_uri('https://example.com', foo='bar') 'https://example.com?client_id=your_id&response_type=code&foo=bar' .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 Nr )� redirect_uri�scope�state)r r r )r �urir r r r r r r �prepare_request_uri+ s - ��z(WebApplicationClient.prepare_request_uri� Tc K s` |p| j }d|v r4t�dt� |d | jkr4td��| j|d< ||d< t| jf|||d�|��S )a7 Prepare the access token request body. The client makes a request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format in the HTTP request entity-body: :param code: REQUIRED. The authorization code received from the authorization server. :param redirect_uri: REQUIRED, if the "redirect_uri" parameter was included in the authorization request as described in `Section 4.1.1`_, and their values MUST be identical. :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param include_client_id: `True` (default) to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. :type include_client_id: Boolean :param kwargs: Extra parameters to include in the token request. In addition OAuthLib will add the ``grant_type`` parameter set to ``authorization_code``. If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in `Section 3.2.1`_:: >>> from oauthlib.oauth2 import WebApplicationClient >>> client = WebApplicationClient('your_id') >>> client.prepare_request_body(code='sh35ksdf09sf') 'grant_type=authorization_code&code=sh35ksdf09sf' >>> client.prepare_request_body(code='sh35ksdf09sf', foo='bar') 'grant_type=authorization_code&code=sh35ksdf09sf&foo=bar' `Section 3.2.1` also states: In the "authorization_code" "grant_type" request to the token endpoint, an unauthenticated client MUST send its "client_id" to prevent itself from inadvertently accepting a code intended for a client with a different "client_id". This protects the client from substitution of the authentication code. (It provides no additional security for the protected resource.) .. _`Section 4.1.1`: https://tools.ietf.org/html/rfc6749#section-4.1.1 .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 r z�`client_id` has been deprecated in favor of `include_client_id`, a boolean value which will include the already configured `self.client_id`.zO`client_id` was supplied as an argument, but it does not match `self.client_id`�include_client_id)r �bodyr )r �warnings�warn�DeprecationWarningr � ValueErrorr � grant_type)r r r r r r r r r �prepare_request_body\ s 4 � ��z)WebApplicationClient.prepare_request_bodyc C s t ||d�}| �|� |S )aa Parse the URI query for code and state. If the resource owner grants the access request, the authorization server issues an authorization code and delivers it to the client by adding the following parameters to the query component of the redirection URI using the "application/x-www-form-urlencoded" format: :param uri: The callback URI that resulted from the user being redirected back from the provider to you, the client. :param state: The state provided in the authorization request. **code** The authorization code generated by the authorization server. The authorization code MUST expire shortly after it is issued to mitigate the risk of leaks. A maximum authorization code lifetime of 10 minutes is RECOMMENDED. The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code. The authorization code is bound to the client identifier and redirection URI. **state** If the "state" parameter was present in the authorization request. This method is mainly intended to enforce strict state checking with the added benefit of easily extracting parameters from the URI:: >>> from oauthlib.oauth2 import WebApplicationClient >>> client = WebApplicationClient('your_id') >>> uri = 'https://example.com/callback?code=sdfkjh345&state=sfetw45' >>> client.parse_request_uri_response(uri, state='sfetw45') {'state': 'sfetw45', 'code': 'sdfkjh345'} >>> client.parse_request_uri_response(uri, state='other') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "oauthlib/oauth2/rfc6749/__init__.py", line 357, in parse_request_uri_response back from the provider to you, the client. File "oauthlib/oauth2/rfc6749/parameters.py", line 153, in parse_authorization_code_response raise MismatchingStateError() oauthlib.oauth2.rfc6749.errors.MismatchingStateError )r )r Zpopulate_code_attributes)r r r Zresponser r r �parse_request_uri_response� s , z/WebApplicationClient.parse_request_uri_response)N)NNN)NNr T)N) �__name__� __module__� __qualname__�__doc__r r r r r! � __classcell__r r r r r s � 1 � Cr ) r% r � parametersr r r �baser r r r r r �<module> s oauth2/rfc6749/clients/__pycache__/backend_application.cpython-39.opt-1.pyc 0000644 00000006607 15125174064 0022303 0 ustar 00 a \��`� � @ s0 d Z ddlmZ ddlmZ G dd� de�ZdS )z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � )�prepare_token_request� )�Clientc @ s e Zd ZdZdZddd�ZdS ) �BackendApplicationClienta� A public client utilizing the client credentials grant workflow. The client can request an access token using only its client credentials (or other supported means of authentication) when the client is requesting access to the protected resources under its control, or those of another resource owner which has been previously arranged with the authorization server (the method of which is beyond the scope of this specification). The client credentials grant type MUST only be used by confidential clients. Since the client authentication is used as the authorization grant, no additional authorization request is needed. Zclient_credentials� NFc K s< | j |d< ||d< |du r | jn|}t| jf||d�|��S )a� Add the client credentials to the request body. The client makes a request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format per `Appendix B`_ in the HTTP request entity-body: :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param scope: The scope of the access request as described by `Section 3.3`_. :param include_client_id: `True` to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. False otherwise (default). :type include_client_id: Boolean :param kwargs: Extra credentials to include in the token request. The client MUST authenticate with the authorization server as described in `Section 3.2.1`_. The prepared body will include all provided credentials as well as the ``grant_type`` parameter set to ``client_credentials``:: >>> from oauthlib.oauth2 import BackendApplicationClient >>> client = BackendApplicationClient('your_id') >>> client.prepare_request_body(scope=['hello', 'world']) 'grant_type=client_credentials&scope=hello+world' .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 � client_id�include_client_idN)�body�scope)r r r � grant_type)�selfr r r �kwargs� r �W/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/backend_application.py�prepare_request_body! s % ��z-BackendApplicationClient.prepare_request_body)r NF)�__name__� __module__� __qualname__�__doc__r r r r r r r s �r N)r � parametersr �baser r r r r r �<module> s oauth2/rfc6749/clients/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000001350 15125174064 0020056 0 ustar 00 a \��`� � @ s\ d Z ddlmZ ddlmZmZmZmZ ddlm Z ddl m Z ddl m Z ddlmZ dS ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming OAuth 2.0 RFC6749. � )�BackendApplicationClient)� AUTH_HEADER�BODY� URI_QUERY�Client)�LegacyApplicationClient)�MobileApplicationClient)�ServiceApplicationClient)�WebApplicationClientN)�__doc__Zbackend_applicationr �baser r r r Zlegacy_applicationr Zmobile_applicationr Zservice_applicationr Zweb_applicationr � r r �L/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/__init__.py�<module> s oauth2/rfc6749/clients/__pycache__/mobile_application.cpython-39.pyc 0000644 00000021703 15125174064 0021216 0 ustar 00 a \��`�" � @ s4 d Z ddlmZmZ ddlmZ G dd� de�ZdS )z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � )�parse_implicit_response�prepare_grant_uri� )�Clientc @ s( e Zd ZdZdZddd�Zd dd�ZdS ) �MobileApplicationClientah A public client utilizing the implicit code grant workflow. A user-agent-based application is a public client in which the client code is downloaded from a web server and executes within a user-agent (e.g. web browser) on the device used by the resource owner. Protocol data and credentials are easily accessible (and often visible) to the resource owner. Since such applications reside within the user-agent, they can make seamless use of the user-agent capabilities when requesting authorization. The implicit grant type is used to obtain access tokens (it does not support the issuance of refresh tokens) and is optimized for public clients known to operate a particular redirection URI. These clients are typically implemented in a browser using a scripting language such as JavaScript. As a redirection-based flow, the client must be capable of interacting with the resource owner's user-agent (typically a web browser) and capable of receiving incoming requests (via redirection) from the authorization server. Unlike the authorization code grant type in which the client makes separate requests for authorization and access token, the client receives the access token as the result of the authorization request. The implicit grant type does not include client authentication, and relies on the presence of the resource owner and the registration of the redirection URI. Because the access token is encoded into the redirection URI, it may be exposed to the resource owner and other applications residing on the same device. �tokenNc K s2 |du r| j n|}t|| j| jf|||d�|��S )a� Prepare the implicit grant request URI. The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: :param redirect_uri: OPTIONAL. The redirect URI must be an absolute URI and it should have been registerd with the OAuth provider prior to use. As described in `Section 3.1.2`_. :param scope: OPTIONAL. The scope of the access request as described by Section 3.3`_. These may be any string but are commonly URIs or various categories such as ``videos`` or ``documents``. :param state: RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. :param kwargs: Extra arguments to include in the request URI. In addition to supplied parameters, OAuthLib will append the ``client_id`` that was provided in the constructor as well as the mandatory ``response_type`` argument, set to ``token``:: >>> from oauthlib.oauth2 import MobileApplicationClient >>> client = MobileApplicationClient('your_id') >>> client.prepare_request_uri('https://example.com') 'https://example.com?client_id=your_id&response_type=token' >>> client.prepare_request_uri('https://example.com', redirect_uri='https://a.b/callback') 'https://example.com?client_id=your_id&response_type=token&redirect_uri=https%3A%2F%2Fa.b%2Fcallback' >>> client.prepare_request_uri('https://example.com', scope=['profile', 'pictures']) 'https://example.com?client_id=your_id&response_type=token&scope=profile+pictures' >>> client.prepare_request_uri('https://example.com', foo='bar') 'https://example.com?client_id=your_id&response_type=token&foo=bar' .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 N)� redirect_uri�state�scope)r r Z client_id� response_type)�self�urir r r �kwargs� r �V/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/mobile_application.py�prepare_request_uri1 s -��z+MobileApplicationClient.prepare_request_uric C s4 |du r| j n|}t|||d�| _| �| j� | jS )a� Parse the response URI fragment. If the resource owner grants the access request, the authorization server issues an access token and delivers it to the client by adding the following parameters to the fragment component of the redirection URI using the "application/x-www-form-urlencoded" format: :param uri: The callback URI that resulted from the user being redirected back from the provider to you, the client. :param state: The state provided in the authorization request. :param scope: The scopes provided in the authorization request. :return: Dictionary of token parameters. :raises: OAuth2Error if response is invalid. A successful response should always contain **access_token** The access token issued by the authorization server. Often a random string. **token_type** The type of the token issued as described in `Section 7.1`_. Commonly ``Bearer``. **state** If you provided the state parameter in the authorization phase, then the provider is required to include that exact state value in the response. While it is not mandated it is recommended that the provider include **expires_in** The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. **scope** Providers may supply this in all responses but are required to only if it has changed since the authorization request. A few example responses can be seen below:: >>> response_uri = 'https://example.com/callback#access_token=sdlfkj452&state=ss345asyht&token_type=Bearer&scope=hello+world' >>> from oauthlib.oauth2 import MobileApplicationClient >>> client = MobileApplicationClient('your_id') >>> client.parse_request_uri_response(response_uri) { 'access_token': 'sdlfkj452', 'token_type': 'Bearer', 'state': 'ss345asyht', 'scope': [u'hello', u'world'] } >>> client.parse_request_uri_response(response_uri, state='other') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "oauthlib/oauth2/rfc6749/__init__.py", line 598, in parse_request_uri_response **scope** File "oauthlib/oauth2/rfc6749/parameters.py", line 197, in parse_implicit_response raise ValueError("Mismatching or missing state in params.") ValueError: Mismatching or missing state in params. >>> def alert_scope_changed(message, old, new): ... print(message, old, new) ... >>> oauthlib.signals.scope_changed.connect(alert_scope_changed) >>> client.parse_request_body_response(response_body, scope=['other']) ('Scope has changed from "other" to "hello world".', ['other'], ['hello', 'world']) .. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 N)r r )r r r Zpopulate_token_attributes)r r r r r r r �parse_request_uri_responseb s I z2MobileApplicationClient.parse_request_uri_response)NNN)NN)�__name__� __module__� __qualname__�__doc__r r r r r r r r s � 1r N)r � parametersr r �baser r r r r r �<module> s oauth2/rfc6749/clients/__pycache__/web_application.cpython-39.opt-1.pyc 0000644 00000024744 15125174064 0021473 0 ustar 00 a \��`w) � @ s@ d Z ddlZddlmZmZmZ ddlmZ G dd� de�ZdS ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N� )�!parse_authorization_code_response�prepare_grant_uri�prepare_token_request� )�Clientc sD e Zd ZdZdZd� fdd� Zddd�Zdd d �Zdd d �Z� Z S )�WebApplicationClienta> A client utilizing the authorization code grant workflow. A web application is a confidential client running on a web server. Resource owners access the client via an HTML user interface rendered in a user-agent on the device used by the resource owner. The client credentials as well as any access token issued to the client are stored on the web server and are not exposed to or accessible by the resource owner. The authorization code grant type is used to obtain both access tokens and refresh tokens and is optimized for confidential clients. As a redirection-based flow, the client must be capable of interacting with the resource owner's user-agent (typically a web browser) and capable of receiving incoming requests (via redirection) from the authorization server. Zauthorization_codeNc s t � j|fi |�� || _d S )N)�super�__init__�code)�self� client_idr �kwargs�� __class__� �S/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/web_application.pyr ' s z WebApplicationClient.__init__c K s0 |du r| j n|}t|| jdf|||d�|��S )a~ Prepare the authorization code request URI The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: :param redirect_uri: OPTIONAL. The redirect URI must be an absolute URI and it should have been registerd with the OAuth provider prior to use. As described in `Section 3.1.2`_. :param scope: OPTIONAL. The scope of the access request as described by Section 3.3`_. These may be any string but are commonly URIs or various categories such as ``videos`` or ``documents``. :param state: RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. :param kwargs: Extra arguments to include in the request URI. In addition to supplied parameters, OAuthLib will append the ``client_id`` that was provided in the constructor as well as the mandatory ``response_type`` argument, set to ``code``:: >>> from oauthlib.oauth2 import WebApplicationClient >>> client = WebApplicationClient('your_id') >>> client.prepare_request_uri('https://example.com') 'https://example.com?client_id=your_id&response_type=code' >>> client.prepare_request_uri('https://example.com', redirect_uri='https://a.b/callback') 'https://example.com?client_id=your_id&response_type=code&redirect_uri=https%3A%2F%2Fa.b%2Fcallback' >>> client.prepare_request_uri('https://example.com', scope=['profile', 'pictures']) 'https://example.com?client_id=your_id&response_type=code&scope=profile+pictures' >>> client.prepare_request_uri('https://example.com', foo='bar') 'https://example.com?client_id=your_id&response_type=code&foo=bar' .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 Nr )� redirect_uri�scope�state)r r r )r �urir r r r r r r �prepare_request_uri+ s - ��z(WebApplicationClient.prepare_request_uri� Tc K s` |p| j }d|v r4t�dt� |d | jkr4td��| j|d< ||d< t| jf|||d�|��S )a7 Prepare the access token request body. The client makes a request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format in the HTTP request entity-body: :param code: REQUIRED. The authorization code received from the authorization server. :param redirect_uri: REQUIRED, if the "redirect_uri" parameter was included in the authorization request as described in `Section 4.1.1`_, and their values MUST be identical. :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param include_client_id: `True` (default) to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. :type include_client_id: Boolean :param kwargs: Extra parameters to include in the token request. In addition OAuthLib will add the ``grant_type`` parameter set to ``authorization_code``. If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in `Section 3.2.1`_:: >>> from oauthlib.oauth2 import WebApplicationClient >>> client = WebApplicationClient('your_id') >>> client.prepare_request_body(code='sh35ksdf09sf') 'grant_type=authorization_code&code=sh35ksdf09sf' >>> client.prepare_request_body(code='sh35ksdf09sf', foo='bar') 'grant_type=authorization_code&code=sh35ksdf09sf&foo=bar' `Section 3.2.1` also states: In the "authorization_code" "grant_type" request to the token endpoint, an unauthenticated client MUST send its "client_id" to prevent itself from inadvertently accepting a code intended for a client with a different "client_id". This protects the client from substitution of the authentication code. (It provides no additional security for the protected resource.) .. _`Section 4.1.1`: https://tools.ietf.org/html/rfc6749#section-4.1.1 .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 r z�`client_id` has been deprecated in favor of `include_client_id`, a boolean value which will include the already configured `self.client_id`.zO`client_id` was supplied as an argument, but it does not match `self.client_id`�include_client_id)r �bodyr )r �warnings�warn�DeprecationWarningr � ValueErrorr � grant_type)r r r r r r r r r �prepare_request_body\ s 4 � ��z)WebApplicationClient.prepare_request_bodyc C s t ||d�}| �|� |S )aa Parse the URI query for code and state. If the resource owner grants the access request, the authorization server issues an authorization code and delivers it to the client by adding the following parameters to the query component of the redirection URI using the "application/x-www-form-urlencoded" format: :param uri: The callback URI that resulted from the user being redirected back from the provider to you, the client. :param state: The state provided in the authorization request. **code** The authorization code generated by the authorization server. The authorization code MUST expire shortly after it is issued to mitigate the risk of leaks. A maximum authorization code lifetime of 10 minutes is RECOMMENDED. The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code. The authorization code is bound to the client identifier and redirection URI. **state** If the "state" parameter was present in the authorization request. This method is mainly intended to enforce strict state checking with the added benefit of easily extracting parameters from the URI:: >>> from oauthlib.oauth2 import WebApplicationClient >>> client = WebApplicationClient('your_id') >>> uri = 'https://example.com/callback?code=sdfkjh345&state=sfetw45' >>> client.parse_request_uri_response(uri, state='sfetw45') {'state': 'sfetw45', 'code': 'sdfkjh345'} >>> client.parse_request_uri_response(uri, state='other') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "oauthlib/oauth2/rfc6749/__init__.py", line 357, in parse_request_uri_response back from the provider to you, the client. File "oauthlib/oauth2/rfc6749/parameters.py", line 153, in parse_authorization_code_response raise MismatchingStateError() oauthlib.oauth2.rfc6749.errors.MismatchingStateError )r )r Zpopulate_code_attributes)r r r Zresponser r r �parse_request_uri_response� s , z/WebApplicationClient.parse_request_uri_response)N)NNN)NNr T)N) �__name__� __module__� __qualname__�__doc__r r r r r! � __classcell__r r r r r s � 1 � Cr ) r% r � parametersr r r �baser r r r r r �<module> s oauth2/rfc6749/clients/__pycache__/legacy_application.cpython-39.opt-1.pyc 0000644 00000010400 15125174064 0022142 0 ustar 00 a \��`� � @ s0 d Z ddlmZ ddlmZ G dd� de�ZdS )z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � )�prepare_token_request� )�Clientc s. e Zd ZdZdZ� fdd�Zd dd �Z� ZS ) �LegacyApplicationClienta A public client using the resource owner password and username directly. The resource owner password credentials grant type is suitable in cases where the resource owner has a trust relationship with the client, such as the device operating system or a highly privileged application. The authorization server should take special care when enabling this grant type, and only allow it when other flows are not viable. The grant type is suitable for clients capable of obtaining the resource owner's credentials (username and password, typically using an interactive form). It is also used to migrate existing clients using direct authentication schemes such as HTTP Basic or Digest authentication to OAuth by converting the stored credentials to an access token. The method through which the client obtains the resource owner credentials is beyond the scope of this specification. The client MUST discard the credentials once an access token has been obtained. �passwordc s t � j|fi |�� d S )N)�super�__init__)�self� client_id�kwargs�� __class__� �V/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/legacy_application.pyr & s z LegacyApplicationClient.__init__� NFc K s@ | j |d< ||d< |du r | jn|}t| jf||||d�|��S )a/ Add the resource owner password and username to the request body. The client makes a request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format per `Appendix B`_ in the HTTP request entity-body: :param username: The resource owner username. :param password: The resource owner password. :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param scope: The scope of the access request as described by `Section 3.3`_. :param include_client_id: `True` to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. False otherwise (default). :type include_client_id: Boolean :param kwargs: Extra credentials to include in the token request. If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in `Section 3.2.1`_. The prepared body will include all provided credentials as well as the ``grant_type`` parameter set to ``password``:: >>> from oauthlib.oauth2 import LegacyApplicationClient >>> client = LegacyApplicationClient('your_id') >>> client.prepare_request_body(username='foo', password='bar', scope=['hello', 'world']) 'grant_type=password&username=foo&scope=hello+world&password=bar' .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 r �include_client_idN)�body�usernamer �scope)r r r � grant_type)r r r r r r r r r r �prepare_request_body) s ' ��z,LegacyApplicationClient.prepare_request_body)r NF)�__name__� __module__� __qualname__�__doc__r r r � __classcell__r r r r r s �r N)r � parametersr �baser r r r r r �<module> s oauth2/rfc6749/clients/__pycache__/service_application.cpython-39.pyc 0000644 00000016042 15125174064 0021407 0 ustar 00 a \��`� � @ sD d Z ddlZddlmZ ddlmZ ddlmZ G dd � d e�ZdS ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � N)� to_unicode� )�prepare_token_request� )�Clientc s0 e Zd ZdZdZd � fdd� Zd dd �Z� ZS ) �ServiceApplicationClienta� A public client utilizing the JWT bearer grant. JWT bearer tokes can be used to request an access token when a client wishes to utilize an existing trust relationship, expressed through the semantics of (and digital signature or keyed message digest calculated over) the JWT, without a direct user approval step at the authorization server. This grant type does not involve an authorization step. It may be used by both public and confidential clients. z+urn:ietf:params:oauth:grant-type:jwt-bearerNc s0 t � j|fi |�� || _|| _|| _|| _dS )ac Initalize a JWT client with defaults for implicit use later. :param client_id: Client identifier given by the OAuth provider upon registration. :param private_key: Private key used for signing and encrypting. Must be given as a string. :param subject: The principal that is the subject of the JWT, i.e. which user is the token requested on behalf of. For example, ``foo@example.com. :param issuer: The JWT MUST contain an "iss" (issuer) claim that contains a unique identifier for the entity that issued the JWT. For example, ``your-client@provider.com``. :param audience: A value identifying the authorization server as an intended audience, e.g. ``https://provider.com/oauth2/token``. :param kwargs: Additional arguments to pass to base client, such as state and token. See ``Client.__init__.__doc__`` for details. N)�super�__init__� private_key�subject�issuer�audience)�self� client_idr r r r �kwargs�� __class__� �W/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/service_application.pyr s z!ServiceApplicationClient.__init__� Fc K s ddl } |p| j} | s td��|p&| j|p.| j|p6| jt|pFt�� d �t|pTt�� �d�}dD ] }|| du r`td| ��q`d| v r�| �d�|d < d | v r�| �d �|d < |� |p�i � | � || d �}t |�}| j | d < | | d< | du r�| j n| } t| jf||| d�| ��S )a� Create and add a JWT assertion to the request body. :param private_key: Private key used for signing and encrypting. Must be given as a string. :param subject: (sub) The principal that is the subject of the JWT, i.e. which user is the token requested on behalf of. For example, ``foo@example.com. :param issuer: (iss) The JWT MUST contain an "iss" (issuer) claim that contains a unique identifier for the entity that issued the JWT. For example, ``your-client@provider.com``. :param audience: (aud) A value identifying the authorization server as an intended audience, e.g. ``https://provider.com/oauth2/token``. :param expires_at: A unix expiration timestamp for the JWT. Defaults to an hour from now, i.e. ``time.time() + 3600``. :param issued_at: A unix timestamp of when the JWT was created. Defaults to now, i.e. ``time.time()``. :param extra_claims: A dict of additional claims to include in the JWT. :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param scope: The scope of the access request. :param include_client_id: `True` to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. False otherwise (default). :type include_client_id: Boolean :param not_before: A unix timestamp after which the JWT may be used. Not included unless provided. * :param jwt_id: A unique JWT token identifier. Not included unless provided. * :param kwargs: Extra credentials to include in the token request. Parameters marked with a `*` above are not explicit arguments in the function signature, but are specially documented arguments for items appearing in the generic `**kwargs` keyworded input. The "scope" parameter may be used, as defined in the Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants [I-D.ietf-oauth-assertions] specification, to indicate the requested scope. Authentication of the client is optional, as described in `Section 3.2.1`_ of OAuth 2.0 [RFC6749] and consequently, the "client_id" is only needed when a form of client authentication that relies on the parameter is used. The following non-normative example demonstrates an Access Token Request with a JWT as an authorization grant (with extra line breaks for display purposes only): .. code-block: http POST /token.oauth2 HTTP/1.1 Host: as.example.com Content-Type: application/x-www-form-urlencoded grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer &assertion=eyJhbGciOiJFUzI1NiJ9. eyJpc3Mi[...omitted for brevity...]. J9l-ZhwP[...omitted for brevity...] .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 r Nz>An encryption key must be supplied to make JWT token requests.i )�iss�aud�subZexpZiat)r r r z)Claim must include %s but none was given.Z not_beforeZnbfZjwt_idZjtiZRS256r �include_client_id)�body� assertion�scope)�jwtr � ValueErrorr r r �int�time�pop�update�encoder r r r � grant_type)r r r r r Z expires_atZ issued_atZ extra_claimsr r r r r �keyZclaim�attrr r r r �prepare_request_body@ s@ X � � ��z-ServiceApplicationClient.prepare_request_body)NNNN) NNNNNNNr NF)�__name__� __module__� __qualname__�__doc__r$ r r' � __classcell__r r r r r s �! �r ) r+ r Zoauthlib.commonr � parametersr �baser r r r r r �<module> s oauth2/rfc6749/clients/__pycache__/mobile_application.cpython-39.opt-1.pyc 0000644 00000021703 15125174064 0022155 0 ustar 00 a \��`�" � @ s4 d Z ddlmZmZ ddlmZ G dd� de�ZdS )z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � )�parse_implicit_response�prepare_grant_uri� )�Clientc @ s( e Zd ZdZdZddd�Zd dd�ZdS ) �MobileApplicationClientah A public client utilizing the implicit code grant workflow. A user-agent-based application is a public client in which the client code is downloaded from a web server and executes within a user-agent (e.g. web browser) on the device used by the resource owner. Protocol data and credentials are easily accessible (and often visible) to the resource owner. Since such applications reside within the user-agent, they can make seamless use of the user-agent capabilities when requesting authorization. The implicit grant type is used to obtain access tokens (it does not support the issuance of refresh tokens) and is optimized for public clients known to operate a particular redirection URI. These clients are typically implemented in a browser using a scripting language such as JavaScript. As a redirection-based flow, the client must be capable of interacting with the resource owner's user-agent (typically a web browser) and capable of receiving incoming requests (via redirection) from the authorization server. Unlike the authorization code grant type in which the client makes separate requests for authorization and access token, the client receives the access token as the result of the authorization request. The implicit grant type does not include client authentication, and relies on the presence of the resource owner and the registration of the redirection URI. Because the access token is encoded into the redirection URI, it may be exposed to the resource owner and other applications residing on the same device. �tokenNc K s2 |du r| j n|}t|| j| jf|||d�|��S )a� Prepare the implicit grant request URI. The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: :param redirect_uri: OPTIONAL. The redirect URI must be an absolute URI and it should have been registerd with the OAuth provider prior to use. As described in `Section 3.1.2`_. :param scope: OPTIONAL. The scope of the access request as described by Section 3.3`_. These may be any string but are commonly URIs or various categories such as ``videos`` or ``documents``. :param state: RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. :param kwargs: Extra arguments to include in the request URI. In addition to supplied parameters, OAuthLib will append the ``client_id`` that was provided in the constructor as well as the mandatory ``response_type`` argument, set to ``token``:: >>> from oauthlib.oauth2 import MobileApplicationClient >>> client = MobileApplicationClient('your_id') >>> client.prepare_request_uri('https://example.com') 'https://example.com?client_id=your_id&response_type=token' >>> client.prepare_request_uri('https://example.com', redirect_uri='https://a.b/callback') 'https://example.com?client_id=your_id&response_type=token&redirect_uri=https%3A%2F%2Fa.b%2Fcallback' >>> client.prepare_request_uri('https://example.com', scope=['profile', 'pictures']) 'https://example.com?client_id=your_id&response_type=token&scope=profile+pictures' >>> client.prepare_request_uri('https://example.com', foo='bar') 'https://example.com?client_id=your_id&response_type=token&foo=bar' .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 N)� redirect_uri�state�scope)r r Z client_id� response_type)�self�urir r r �kwargs� r �V/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/mobile_application.py�prepare_request_uri1 s -��z+MobileApplicationClient.prepare_request_uric C s4 |du r| j n|}t|||d�| _| �| j� | jS )a� Parse the response URI fragment. If the resource owner grants the access request, the authorization server issues an access token and delivers it to the client by adding the following parameters to the fragment component of the redirection URI using the "application/x-www-form-urlencoded" format: :param uri: The callback URI that resulted from the user being redirected back from the provider to you, the client. :param state: The state provided in the authorization request. :param scope: The scopes provided in the authorization request. :return: Dictionary of token parameters. :raises: OAuth2Error if response is invalid. A successful response should always contain **access_token** The access token issued by the authorization server. Often a random string. **token_type** The type of the token issued as described in `Section 7.1`_. Commonly ``Bearer``. **state** If you provided the state parameter in the authorization phase, then the provider is required to include that exact state value in the response. While it is not mandated it is recommended that the provider include **expires_in** The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. **scope** Providers may supply this in all responses but are required to only if it has changed since the authorization request. A few example responses can be seen below:: >>> response_uri = 'https://example.com/callback#access_token=sdlfkj452&state=ss345asyht&token_type=Bearer&scope=hello+world' >>> from oauthlib.oauth2 import MobileApplicationClient >>> client = MobileApplicationClient('your_id') >>> client.parse_request_uri_response(response_uri) { 'access_token': 'sdlfkj452', 'token_type': 'Bearer', 'state': 'ss345asyht', 'scope': [u'hello', u'world'] } >>> client.parse_request_uri_response(response_uri, state='other') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "oauthlib/oauth2/rfc6749/__init__.py", line 598, in parse_request_uri_response **scope** File "oauthlib/oauth2/rfc6749/parameters.py", line 197, in parse_implicit_response raise ValueError("Mismatching or missing state in params.") ValueError: Mismatching or missing state in params. >>> def alert_scope_changed(message, old, new): ... print(message, old, new) ... >>> oauthlib.signals.scope_changed.connect(alert_scope_changed) >>> client.parse_request_body_response(response_body, scope=['other']) ('Scope has changed from "other" to "hello world".', ['other'], ['hello', 'world']) .. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 N)r r )r r r Zpopulate_token_attributes)r r r r r r r �parse_request_uri_responseb s I z2MobileApplicationClient.parse_request_uri_response)NNN)NN)�__name__� __module__� __qualname__�__doc__r r r r r r r r s � 1r N)r � parametersr r �baser r r r r r �<module> s oauth2/rfc6749/clients/__pycache__/base.cpython-39.pyc 0000644 00000046462 15125174064 0016307 0 ustar 00 a \��` V � @ s� d Z ddlZddlZddlmZ ddlmZ ddlmZm Z ddl m Z m Z m Z ddlmZ dZd Zd Zd d iZG d d� d�ZdS )z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming OAuth 2.0 RFC6749. � N)�generate_token)�tokens)�InsecureTransportError�TokenExpiredError)�parse_token_response�prepare_token_request� prepare_token_revocation_request)�is_secure_transportZ auth_header�query�bodyz Content-Typez!application/x-www-form-urlencodedc @ s� e Zd ZdZdZedddddddddef dd�Zedd� �Z d d � Z d d � Z d d� Z d*dd�Z d+dd�Zd,dd�Zd-dd�Zd.dd�Zd/d d �Zd0d d �Zd1d d!�Zdddedfd"d#�Zd$d%� Zd&d'� Zd(d)� ZdS )2�Clienta� Base OAuth2 client responsible for access token management. This class also acts as a generic interface providing methods common to all client types such as ``prepare_authorization_request`` and ``prepare_token_revocation_request``. The ``prepare_x_request`` methods are the recommended way of interacting with clients (as opposed to the abstract prepare uri/body/etc methods). They are recommended over the older set because they are easier to use (more consistent) and add a few additional security checks, such as HTTPS and state checking. Some of these methods require further implementation only provided by the specific purpose clients such as :py:class:`oauthlib.oauth2.MobileApplicationClient` and thus you should always seek to use the client class matching the OAuth workflow you need. For Python, this is usually :py:class:`oauthlib.oauth2.WebApplicationClient`. � refresh_token�BearerNc K sn || _ || _|| _|| _|| _|| _|| _|p0i | _| | _| | _ | | _ | | _ d| _ d| _ d| _| �| j� dS )as Initialize a client with commonly used attributes. :param client_id: Client identifier given by the OAuth provider upon registration. :param default_token_placement: Tokens can be supplied in the Authorization header (default), the URL query component (``query``) or the request body (``body``). :param token_type: OAuth 2 token type. Defaults to Bearer. Change this if you specify the ``access_token`` parameter and know it is of a different token type, such as a MAC, JWT or SAML token. Can also be supplied as ``token_type`` inside the ``token`` dict parameter. :param access_token: An access token (string) used to authenticate requests to protected resources. Can also be supplied inside the ``token`` dict parameter. :param refresh_token: A refresh token (string) used to refresh expired tokens. Can also be supplied inside the ``token`` dict parameter. :param mac_key: Encryption key used with MAC tokens. :param mac_algorithm: Hashing algorithm for MAC tokens. :param token: A dict of token attributes such as ``access_token``, ``token_type`` and ``expires_at``. :param scope: A list of default scopes to request authorization for. :param state: A CSRF protection string used during authorization. :param redirect_url: The redirection endpoint on the client side to which the user returns after authorization. :param state_generator: A no argument state generation callable. Defaults to :py:meth:`oauthlib.common.generate_token`. N)� client_id�default_token_placement� token_type� access_tokenr �mac_key� mac_algorithm�token�scope�state_generator�state� redirect_url�code� expires_in� _expires_at�populate_token_attributes)�selfr r r r r r r r r r r r �kwargs� r �H/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/base.py�__init__4 s 4 zClient.__init__c C s | j | jd�S )aO Supported token types and their respective methods Additional tokens can be supported by extending this dictionary. The Bearer token spec is stable and safe to use. The MAC token spec is not yet stable and support for MAC tokens is experimental and currently matching version 00 of the spec. )r ZMAC)�_add_bearer_token�_add_mac_token)r r r r! � token_typesy s �zClient.token_typesc O s t d��dS )z,Abstract method used to create request URIs.�*Must be implemented by inheriting classes.N��NotImplementedError�r �argsr r r r! �prepare_request_uri� s zClient.prepare_request_uric O s t d��dS )z.Abstract method used to create request bodies.r& Nr' r) r r r! �prepare_request_body� s zClient.prepare_request_bodyc O s t d��dS )z4Abstract method used to parse redirection responses.r& Nr' r) r r r! �parse_request_uri_response� s z!Client.parse_request_uri_response�GETc K s� t |�st� �|p| j}dd� | j�� D �}| j�� |vrHtd| j ��| jsb| j � d�sbtd��| j r|| j t � � k r|t � �|| j�� |||||fi |��S )ac Add token to the request uri, body or authorization header. The access token type provides the client with the information required to successfully utilize the access token to make a protected resource request (along with type-specific attributes). The client MUST NOT use an access token if it does not understand the token type. For example, the "bearer" token type defined in [`I-D.ietf-oauth-v2-bearer`_] is utilized by simply including the access token string in the request: .. code-block:: http GET /resource/1 HTTP/1.1 Host: example.com Authorization: Bearer mF_9.B5f-4.1JqM while the "mac" token type defined in [`I-D.ietf-oauth-v2-http-mac`_] is utilized by issuing a MAC key together with the access token which is used to sign certain components of the HTTP requests: .. code-block:: http GET /resource/1 HTTP/1.1 Host: example.com Authorization: MAC id="h480djs93hd8", nonce="274312:dj83hs9s", mac="kDZvddkndxvhGRXZhvuDjEWhGeE=" .. _`I-D.ietf-oauth-v2-bearer`: https://tools.ietf.org/html/rfc6749#section-12.2 .. _`I-D.ietf-oauth-v2-http-mac`: https://tools.ietf.org/html/rfc6749#section-12.2 c S s i | ]\}}|� � |�qS r )�lower)�.0�k�vr r r! � <dictcomp>� s z$Client.add_token.<locals>.<dictcomp>zUnsupported token type: %sr zMissing access token.)r r r r% �itemsr r/ � ValueErrorr r �getr �timer )r �uri� http_methodr �headers�token_placementr Z case_insensitive_token_typesr r r! � add_token� s" # ���zClient.add_tokenc K sb t |�st� �|p| �� | _|p$| j| _|du r6| jn|}| j|f| j|| jd�|��}|tdfS )a> Prepare the authorization request. This is the first step in many OAuth flows in which the user is redirected to a certain authorization URL. This method adds required parameters to the authorization URL. :param authorization_url: Provider authorization endpoint URL. :param state: CSRF protection string. Will be automatically created if not provided. The generated state is available via the ``state`` attribute. Clients should verify that the state is unchanged and present in the authorization response. This verification is done automatically if using the ``authorization_response`` parameter with ``prepare_token_request``. :param redirect_url: Redirect URL to which the user will be returned after authorization. Must be provided unless previously setup with the provider. If provided then it must also be provided in the token request. :param scope: List of scopes to request. Must be equal to or a subset of the scopes granted when obtaining the refresh token. If none is provided, the ones provided in the constructor are used. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). N)� redirect_urir r � )r r r r r r r+ �FORM_ENC_HEADERS)r Zauthorization_urlr r r r Zauth_urlr r r! � prepare_authorization_request� s ���z$Client.prepare_authorization_requestr> c K sX t |�st� �|p| j}|r*| j||d� |p2| j| _| jf || jd�|��}|t|fS )a� Prepare a token creation request. Note that these requests usually require client authentication, either by including client_id or a set of provider specific authentication credentials. :param token_url: Provider token creation endpoint URL. :param authorization_response: The full redirection URL string, i.e. the location to which the user was redirected after successfull authorization. Used to mine credentials needed to obtain a token in this step, such as authorization code. :param redirect_url: The redirect_url supplied with the authorization request (if there was one). :param state: :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). )r )r r= )r r r r- r r, r? )r � token_urlZauthorization_responser r r r r r r! r � s � ��z Client.prepare_token_requestc K sB t |�st� �|du r | jn|}| jf |||d�|��}|t|fS )a� Prepare an access token refresh request. Expired access tokens can be replaced by new access tokens without going through the OAuth dance if the client obtained a refresh token. This refresh token and authentication credentials can be used to obtain a new access token, and possibly a new refresh token. :param token_url: Provider token refresh endpoint URL. :param refresh_token: Refresh token string. :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param scope: List of scopes to request. Must be equal to or a subset of the scopes granted when obtaining the refresh token. If none is provided, the ones provided in the constructor are used. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). N)r r r )r r r �prepare_refresh_bodyr? )r rA r r r r r r r! � prepare_refresh_token_request s ��z$Client.prepare_refresh_token_requestr c K s( t |�st� �t||f|||d�|��S )aB Prepare a token revocation request. :param revocation_url: Provider token revocation endpoint URL. :param token: The access or refresh token to be revoked (string). :param token_type_hint: ``"access_token"`` (default) or ``"refresh_token"``. This is optional and if you wish to not pass it you must provide ``token_type_hint=None``. :param body: :param callback: A jsonp callback such as ``package.callback`` to be invoked upon receiving the response. Not that it should not include a () suffix. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). Note that JSONP request may use GET requests as the parameters will be added to the request URL query as opposed to the request body. An example of a revocation request .. code-block: http POST /revoke HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW token=45ghiukldjahdnhzdauz&token_type_hint=refresh_token An example of a jsonp revocation request .. code-block: http GET /revoke?token=agabcdefddddafdd&callback=package.myCallback HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW and an error response .. code-block: http package.myCallback({"error":"unsupported_token_type"}); Note that these requests usually require client credentials, client_id in the case for public clients and provider specific authentication credentials for confidential clients. )�token_type_hintr �callback)r r r )r Zrevocation_urlr rD r rE r r r r! r @ s 6��z'Client.prepare_token_revocation_requestc K s2 |du r| j n|}t||d�| _| �| j� | jS )aj Parse the JSON response body. If the access token request is valid and authorized, the authorization server issues an access token as described in `Section 5.1`_. A refresh token SHOULD NOT be included. If the request failed client authentication or is invalid, the authorization server returns an error response as described in `Section 5.2`_. :param body: The response body from the token request. :param scope: Scopes originally requested. If none is provided, the ones provided in the constructor are used. :return: Dictionary of token parameters. :raises: Warning if scope has changed. OAuth2Error if response is invalid. These response are json encoded and could easily be parsed without the assistance of OAuthLib. However, there are a few subtle issues to be aware of regarding the response which are helpfully addressed through the raising of various errors. A successful response should always contain **access_token** The access token issued by the authorization server. Often a random string. **token_type** The type of the token issued as described in `Section 7.1`_. Commonly ``Bearer``. While it is not mandated it is recommended that the provider include **expires_in** The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. **scope** Providers may supply this in all responses but are required to only if it has changed since the authorization request. .. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1 .. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2 .. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1 N)r )r r r r )r r r r r r r! �parse_request_body_response} s / z"Client.parse_request_body_responsec K s6 |p| j }|du r| jn|}t| jf|||d�|��S )a� Prepare an access token request, using a refresh token. If the authorization server issued a refresh token to the client, the client makes a refresh request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format in the HTTP request entity-body: grant_type REQUIRED. Value MUST be set to "refresh_token". refresh_token REQUIRED. The refresh token issued to the client. scope OPTIONAL. The scope of the access request as described by Section 3.3. The requested scope MUST NOT include any scope not originally granted by the resource owner, and if omitted is treated as equal to the scope originally granted by the resource owner. Note that if none is provided, the ones provided in the constructor are used if any. N)r r r )r r r �refresh_token_key)r r r r r r r r! rB � s ��zClient.prepare_refresh_bodyc C sZ |t krt�| j|�}n8|tkr0t�| j|�}n |tkrHt�| j|�}ntd��|||fS )zDAdd a bearer token to the request uri, body or authorization header.�Invalid token placement.) � AUTH_HEADERr Zprepare_bearer_headersr � URI_QUERYZprepare_bearer_uri�BODYZprepare_bearer_bodyr5 )r r8 r9 r r: r; r r r! r# � s zClient._add_bearer_tokenc K sB |t krtd��tj| j|| j|f|||| jd�|��}|||fS )z�Add a MAC token to the request authorization header. Warning: MAC token support is experimental as the spec is not yet stable. rH )r: r �extZhash_algorithm)rI r5 r Zprepare_mac_headerr r r )r r8 r9 r r: r; rL r r r r! r$ � s ���zClient._add_mac_tokenc C s t �dt� | �|�S )Nz=Please switch to the public method populate_token_attributes.)�warnings�warn�DeprecationWarningr �r Zresponser r r! �_populate_attributes� s �zClient._populate_attributesc C s d|v r|� d�| _dS )z2Add attributes from an auth code response to self.r N)r6 r rP r r r! �populate_code_attributes� s z Client.populate_code_attributesc C s� d|v r|� d�| _d|v r(|� d�| _d|v r<|� d�| _d|v rd|� d�| _t�� t| j� | _d|v r|t|� d��| _d|v r�|� d�| _d|v r�|� d�| _ dS ) z6Add attributes from a token exchange response to self.r r r r Z expires_atr r N) r6 r r r r r7 �intr r r rP r r r! r � s z Client.populate_token_attributes)r. NNN)NNN)NNNr> )Nr> N)r r> N)N)r> NN)r. NNN)�__name__� __module__� __qualname__�__doc__rG rI r r" �propertyr% r+ r, r- r< r@ r rC r rF rB r# r$ rQ rR r r r r r! r sX � E � 6 � + � ( � # � = 4 � � r )rW r7 rM Zoauthlib.commonr Zoauthlib.oauth2.rfc6749r Z oauthlib.oauth2.rfc6749.errorsr r Z"oauthlib.oauth2.rfc6749.parametersr r r Z oauthlib.oauth2.rfc6749.utilsr rI rJ rK r? r r r r r! �<module> s � oauth2/rfc6749/clients/__pycache__/__init__.cpython-39.pyc 0000644 00000001350 15125174064 0017117 0 ustar 00 a \��`� � @ s\ d Z ddlmZ ddlmZmZmZmZ ddlm Z ddl m Z ddl m Z ddlmZ dS ) z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming OAuth 2.0 RFC6749. � )�BackendApplicationClient)� AUTH_HEADER�BODY� URI_QUERY�Client)�LegacyApplicationClient)�MobileApplicationClient)�ServiceApplicationClient)�WebApplicationClientN)�__doc__Zbackend_applicationr �baser r r r Zlegacy_applicationr Zmobile_applicationr Zservice_applicationr Zweb_applicationr � r r �L/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/__init__.py�<module> s oauth2/rfc6749/clients/__pycache__/legacy_application.cpython-39.pyc 0000644 00000010400 15125174064 0021203 0 ustar 00 a \��`� � @ s0 d Z ddlmZ ddlmZ G dd� de�ZdS )z� oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. � )�prepare_token_request� )�Clientc s. e Zd ZdZdZ� fdd�Zd dd �Z� ZS ) �LegacyApplicationClienta A public client using the resource owner password and username directly. The resource owner password credentials grant type is suitable in cases where the resource owner has a trust relationship with the client, such as the device operating system or a highly privileged application. The authorization server should take special care when enabling this grant type, and only allow it when other flows are not viable. The grant type is suitable for clients capable of obtaining the resource owner's credentials (username and password, typically using an interactive form). It is also used to migrate existing clients using direct authentication schemes such as HTTP Basic or Digest authentication to OAuth by converting the stored credentials to an access token. The method through which the client obtains the resource owner credentials is beyond the scope of this specification. The client MUST discard the credentials once an access token has been obtained. �passwordc s t � j|fi |�� d S )N)�super�__init__)�self� client_id�kwargs�� __class__� �V/usr/lib/python3.9/site-packages/oauthlib/oauth2/rfc6749/clients/legacy_application.pyr & s z LegacyApplicationClient.__init__� NFc K s@ | j |d< ||d< |du r | jn|}t| jf||||d�|��S )a/ Add the resource owner password and username to the request body. The client makes a request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format per `Appendix B`_ in the HTTP request entity-body: :param username: The resource owner username. :param password: The resource owner password. :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param scope: The scope of the access request as described by `Section 3.3`_. :param include_client_id: `True` to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. False otherwise (default). :type include_client_id: Boolean :param kwargs: Extra credentials to include in the token request. If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in `Section 3.2.1`_. The prepared body will include all provided credentials as well as the ``grant_type`` parameter set to ``password``:: >>> from oauthlib.oauth2 import LegacyApplicationClient >>> client = LegacyApplicationClient('your_id') >>> client.prepare_request_body(username='foo', password='bar', scope=['hello', 'world']) 'grant_type=password&username=foo&scope=hello+world&password=bar' .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 r �include_client_idN)�body�usernamer �scope)r r r � grant_type)r r r r r r r r r r �prepare_request_body) s ' ��z,LegacyApplicationClient.prepare_request_body)r NF)�__name__� __module__� __qualname__�__doc__r r r � __classcell__r r r r r s �r N)r � parametersr �baser r r r r r �<module> s oauth2/rfc6749/clients/base.py 0000644 00000053036 15125174064 0012013 0 ustar 00 # -*- coding: utf-8 -*- """ oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming OAuth 2.0 RFC6749. """ import time import warnings from oauthlib.common import generate_token from oauthlib.oauth2.rfc6749 import tokens from oauthlib.oauth2.rfc6749.errors import ( InsecureTransportError, TokenExpiredError, ) from oauthlib.oauth2.rfc6749.parameters import ( parse_token_response, prepare_token_request, prepare_token_revocation_request, ) from oauthlib.oauth2.rfc6749.utils import is_secure_transport AUTH_HEADER = 'auth_header' URI_QUERY = 'query' BODY = 'body' FORM_ENC_HEADERS = { 'Content-Type': 'application/x-www-form-urlencoded' } class Client: """Base OAuth2 client responsible for access token management. This class also acts as a generic interface providing methods common to all client types such as ``prepare_authorization_request`` and ``prepare_token_revocation_request``. The ``prepare_x_request`` methods are the recommended way of interacting with clients (as opposed to the abstract prepare uri/body/etc methods). They are recommended over the older set because they are easier to use (more consistent) and add a few additional security checks, such as HTTPS and state checking. Some of these methods require further implementation only provided by the specific purpose clients such as :py:class:`oauthlib.oauth2.MobileApplicationClient` and thus you should always seek to use the client class matching the OAuth workflow you need. For Python, this is usually :py:class:`oauthlib.oauth2.WebApplicationClient`. """ refresh_token_key = 'refresh_token' def __init__(self, client_id, default_token_placement=AUTH_HEADER, token_type='Bearer', access_token=None, refresh_token=None, mac_key=None, mac_algorithm=None, token=None, scope=None, state=None, redirect_url=None, state_generator=generate_token, **kwargs): """Initialize a client with commonly used attributes. :param client_id: Client identifier given by the OAuth provider upon registration. :param default_token_placement: Tokens can be supplied in the Authorization header (default), the URL query component (``query``) or the request body (``body``). :param token_type: OAuth 2 token type. Defaults to Bearer. Change this if you specify the ``access_token`` parameter and know it is of a different token type, such as a MAC, JWT or SAML token. Can also be supplied as ``token_type`` inside the ``token`` dict parameter. :param access_token: An access token (string) used to authenticate requests to protected resources. Can also be supplied inside the ``token`` dict parameter. :param refresh_token: A refresh token (string) used to refresh expired tokens. Can also be supplied inside the ``token`` dict parameter. :param mac_key: Encryption key used with MAC tokens. :param mac_algorithm: Hashing algorithm for MAC tokens. :param token: A dict of token attributes such as ``access_token``, ``token_type`` and ``expires_at``. :param scope: A list of default scopes to request authorization for. :param state: A CSRF protection string used during authorization. :param redirect_url: The redirection endpoint on the client side to which the user returns after authorization. :param state_generator: A no argument state generation callable. Defaults to :py:meth:`oauthlib.common.generate_token`. """ self.client_id = client_id self.default_token_placement = default_token_placement self.token_type = token_type self.access_token = access_token self.refresh_token = refresh_token self.mac_key = mac_key self.mac_algorithm = mac_algorithm self.token = token or {} self.scope = scope self.state_generator = state_generator self.state = state self.redirect_url = redirect_url self.code = None self.expires_in = None self._expires_at = None self.populate_token_attributes(self.token) @property def token_types(self): """Supported token types and their respective methods Additional tokens can be supported by extending this dictionary. The Bearer token spec is stable and safe to use. The MAC token spec is not yet stable and support for MAC tokens is experimental and currently matching version 00 of the spec. """ return { 'Bearer': self._add_bearer_token, 'MAC': self._add_mac_token } def prepare_request_uri(self, *args, **kwargs): """Abstract method used to create request URIs.""" raise NotImplementedError("Must be implemented by inheriting classes.") def prepare_request_body(self, *args, **kwargs): """Abstract method used to create request bodies.""" raise NotImplementedError("Must be implemented by inheriting classes.") def parse_request_uri_response(self, *args, **kwargs): """Abstract method used to parse redirection responses.""" raise NotImplementedError("Must be implemented by inheriting classes.") def add_token(self, uri, http_method='GET', body=None, headers=None, token_placement=None, **kwargs): """Add token to the request uri, body or authorization header. The access token type provides the client with the information required to successfully utilize the access token to make a protected resource request (along with type-specific attributes). The client MUST NOT use an access token if it does not understand the token type. For example, the "bearer" token type defined in [`I-D.ietf-oauth-v2-bearer`_] is utilized by simply including the access token string in the request: .. code-block:: http GET /resource/1 HTTP/1.1 Host: example.com Authorization: Bearer mF_9.B5f-4.1JqM while the "mac" token type defined in [`I-D.ietf-oauth-v2-http-mac`_] is utilized by issuing a MAC key together with the access token which is used to sign certain components of the HTTP requests: .. code-block:: http GET /resource/1 HTTP/1.1 Host: example.com Authorization: MAC id="h480djs93hd8", nonce="274312:dj83hs9s", mac="kDZvddkndxvhGRXZhvuDjEWhGeE=" .. _`I-D.ietf-oauth-v2-bearer`: https://tools.ietf.org/html/rfc6749#section-12.2 .. _`I-D.ietf-oauth-v2-http-mac`: https://tools.ietf.org/html/rfc6749#section-12.2 """ if not is_secure_transport(uri): raise InsecureTransportError() token_placement = token_placement or self.default_token_placement case_insensitive_token_types = { k.lower(): v for k, v in self.token_types.items()} if not self.token_type.lower() in case_insensitive_token_types: raise ValueError("Unsupported token type: %s" % self.token_type) if not (self.access_token or self.token.get('access_token')): raise ValueError("Missing access token.") if self._expires_at and self._expires_at < time.time(): raise TokenExpiredError() return case_insensitive_token_types[self.token_type.lower()](uri, http_method, body, headers, token_placement, **kwargs) def prepare_authorization_request(self, authorization_url, state=None, redirect_url=None, scope=None, **kwargs): """Prepare the authorization request. This is the first step in many OAuth flows in which the user is redirected to a certain authorization URL. This method adds required parameters to the authorization URL. :param authorization_url: Provider authorization endpoint URL. :param state: CSRF protection string. Will be automatically created if not provided. The generated state is available via the ``state`` attribute. Clients should verify that the state is unchanged and present in the authorization response. This verification is done automatically if using the ``authorization_response`` parameter with ``prepare_token_request``. :param redirect_url: Redirect URL to which the user will be returned after authorization. Must be provided unless previously setup with the provider. If provided then it must also be provided in the token request. :param scope: List of scopes to request. Must be equal to or a subset of the scopes granted when obtaining the refresh token. If none is provided, the ones provided in the constructor are used. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). """ if not is_secure_transport(authorization_url): raise InsecureTransportError() self.state = state or self.state_generator() self.redirect_url = redirect_url or self.redirect_url # do not assign scope to self automatically anymore scope = self.scope if scope is None else scope auth_url = self.prepare_request_uri( authorization_url, redirect_uri=self.redirect_url, scope=scope, state=self.state, **kwargs) return auth_url, FORM_ENC_HEADERS, '' def prepare_token_request(self, token_url, authorization_response=None, redirect_url=None, state=None, body='', **kwargs): """Prepare a token creation request. Note that these requests usually require client authentication, either by including client_id or a set of provider specific authentication credentials. :param token_url: Provider token creation endpoint URL. :param authorization_response: The full redirection URL string, i.e. the location to which the user was redirected after successfull authorization. Used to mine credentials needed to obtain a token in this step, such as authorization code. :param redirect_url: The redirect_url supplied with the authorization request (if there was one). :param state: :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). """ if not is_secure_transport(token_url): raise InsecureTransportError() state = state or self.state if authorization_response: self.parse_request_uri_response( authorization_response, state=state) self.redirect_url = redirect_url or self.redirect_url body = self.prepare_request_body(body=body, redirect_uri=self.redirect_url, **kwargs) return token_url, FORM_ENC_HEADERS, body def prepare_refresh_token_request(self, token_url, refresh_token=None, body='', scope=None, **kwargs): """Prepare an access token refresh request. Expired access tokens can be replaced by new access tokens without going through the OAuth dance if the client obtained a refresh token. This refresh token and authentication credentials can be used to obtain a new access token, and possibly a new refresh token. :param token_url: Provider token refresh endpoint URL. :param refresh_token: Refresh token string. :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param scope: List of scopes to request. Must be equal to or a subset of the scopes granted when obtaining the refresh token. If none is provided, the ones provided in the constructor are used. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). """ if not is_secure_transport(token_url): raise InsecureTransportError() # do not assign scope to self automatically anymore scope = self.scope if scope is None else scope body = self.prepare_refresh_body(body=body, refresh_token=refresh_token, scope=scope, **kwargs) return token_url, FORM_ENC_HEADERS, body def prepare_token_revocation_request(self, revocation_url, token, token_type_hint="access_token", body='', callback=None, **kwargs): """Prepare a token revocation request. :param revocation_url: Provider token revocation endpoint URL. :param token: The access or refresh token to be revoked (string). :param token_type_hint: ``"access_token"`` (default) or ``"refresh_token"``. This is optional and if you wish to not pass it you must provide ``token_type_hint=None``. :param body: :param callback: A jsonp callback such as ``package.callback`` to be invoked upon receiving the response. Not that it should not include a () suffix. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). Note that JSONP request may use GET requests as the parameters will be added to the request URL query as opposed to the request body. An example of a revocation request .. code-block: http POST /revoke HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW token=45ghiukldjahdnhzdauz&token_type_hint=refresh_token An example of a jsonp revocation request .. code-block: http GET /revoke?token=agabcdefddddafdd&callback=package.myCallback HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW and an error response .. code-block: http package.myCallback({"error":"unsupported_token_type"}); Note that these requests usually require client credentials, client_id in the case for public clients and provider specific authentication credentials for confidential clients. """ if not is_secure_transport(revocation_url): raise InsecureTransportError() return prepare_token_revocation_request(revocation_url, token, token_type_hint=token_type_hint, body=body, callback=callback, **kwargs) def parse_request_body_response(self, body, scope=None, **kwargs): """Parse the JSON response body. If the access token request is valid and authorized, the authorization server issues an access token as described in `Section 5.1`_. A refresh token SHOULD NOT be included. If the request failed client authentication or is invalid, the authorization server returns an error response as described in `Section 5.2`_. :param body: The response body from the token request. :param scope: Scopes originally requested. If none is provided, the ones provided in the constructor are used. :return: Dictionary of token parameters. :raises: Warning if scope has changed. OAuth2Error if response is invalid. These response are json encoded and could easily be parsed without the assistance of OAuthLib. However, there are a few subtle issues to be aware of regarding the response which are helpfully addressed through the raising of various errors. A successful response should always contain **access_token** The access token issued by the authorization server. Often a random string. **token_type** The type of the token issued as described in `Section 7.1`_. Commonly ``Bearer``. While it is not mandated it is recommended that the provider include **expires_in** The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. **scope** Providers may supply this in all responses but are required to only if it has changed since the authorization request. .. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1 .. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2 .. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1 """ scope = self.scope if scope is None else scope self.token = parse_token_response(body, scope=scope) self.populate_token_attributes(self.token) return self.token def prepare_refresh_body(self, body='', refresh_token=None, scope=None, **kwargs): """Prepare an access token request, using a refresh token. If the authorization server issued a refresh token to the client, the client makes a refresh request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format in the HTTP request entity-body: grant_type REQUIRED. Value MUST be set to "refresh_token". refresh_token REQUIRED. The refresh token issued to the client. scope OPTIONAL. The scope of the access request as described by Section 3.3. The requested scope MUST NOT include any scope not originally granted by the resource owner, and if omitted is treated as equal to the scope originally granted by the resource owner. Note that if none is provided, the ones provided in the constructor are used if any. """ refresh_token = refresh_token or self.refresh_token scope = self.scope if scope is None else scope return prepare_token_request(self.refresh_token_key, body=body, scope=scope, refresh_token=refresh_token, **kwargs) def _add_bearer_token(self, uri, http_method='GET', body=None, headers=None, token_placement=None): """Add a bearer token to the request uri, body or authorization header.""" if token_placement == AUTH_HEADER: headers = tokens.prepare_bearer_headers(self.access_token, headers) elif token_placement == URI_QUERY: uri = tokens.prepare_bearer_uri(self.access_token, uri) elif token_placement == BODY: body = tokens.prepare_bearer_body(self.access_token, body) else: raise ValueError("Invalid token placement.") return uri, headers, body def _add_mac_token(self, uri, http_method='GET', body=None, headers=None, token_placement=AUTH_HEADER, ext=None, **kwargs): """Add a MAC token to the request authorization header. Warning: MAC token support is experimental as the spec is not yet stable. """ if token_placement != AUTH_HEADER: raise ValueError("Invalid token placement.") headers = tokens.prepare_mac_header(self.access_token, uri, self.mac_key, http_method, headers=headers, body=body, ext=ext, hash_algorithm=self.mac_algorithm, **kwargs) return uri, headers, body def _populate_attributes(self, response): warnings.warn("Please switch to the public method " "populate_token_attributes.", DeprecationWarning) return self.populate_token_attributes(response) def populate_code_attributes(self, response): """Add attributes from an auth code response to self.""" if 'code' in response: self.code = response.get('code') def populate_token_attributes(self, response): """Add attributes from a token exchange response to self.""" if 'access_token' in response: self.access_token = response.get('access_token') if 'refresh_token' in response: self.refresh_token = response.get('refresh_token') if 'token_type' in response: self.token_type = response.get('token_type') if 'expires_in' in response: self.expires_in = response.get('expires_in') self._expires_at = time.time() + int(self.expires_in) if 'expires_at' in response: self._expires_at = int(response.get('expires_at')) if 'mac_key' in response: self.mac_key = response.get('mac_key') if 'mac_algorithm' in response: self.mac_algorithm = response.get('mac_algorithm') oauth2/rfc6749/clients/mobile_application.py 0000644 00000021255 15125174064 0014731 0 ustar 00 # -*- coding: utf-8 -*- """ oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. """ from ..parameters import parse_implicit_response, prepare_grant_uri from .base import Client class MobileApplicationClient(Client): """A public client utilizing the implicit code grant workflow. A user-agent-based application is a public client in which the client code is downloaded from a web server and executes within a user-agent (e.g. web browser) on the device used by the resource owner. Protocol data and credentials are easily accessible (and often visible) to the resource owner. Since such applications reside within the user-agent, they can make seamless use of the user-agent capabilities when requesting authorization. The implicit grant type is used to obtain access tokens (it does not support the issuance of refresh tokens) and is optimized for public clients known to operate a particular redirection URI. These clients are typically implemented in a browser using a scripting language such as JavaScript. As a redirection-based flow, the client must be capable of interacting with the resource owner's user-agent (typically a web browser) and capable of receiving incoming requests (via redirection) from the authorization server. Unlike the authorization code grant type in which the client makes separate requests for authorization and access token, the client receives the access token as the result of the authorization request. The implicit grant type does not include client authentication, and relies on the presence of the resource owner and the registration of the redirection URI. Because the access token is encoded into the redirection URI, it may be exposed to the resource owner and other applications residing on the same device. """ response_type = 'token' def prepare_request_uri(self, uri, redirect_uri=None, scope=None, state=None, **kwargs): """Prepare the implicit grant request URI. The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: :param redirect_uri: OPTIONAL. The redirect URI must be an absolute URI and it should have been registerd with the OAuth provider prior to use. As described in `Section 3.1.2`_. :param scope: OPTIONAL. The scope of the access request as described by Section 3.3`_. These may be any string but are commonly URIs or various categories such as ``videos`` or ``documents``. :param state: RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. :param kwargs: Extra arguments to include in the request URI. In addition to supplied parameters, OAuthLib will append the ``client_id`` that was provided in the constructor as well as the mandatory ``response_type`` argument, set to ``token``:: >>> from oauthlib.oauth2 import MobileApplicationClient >>> client = MobileApplicationClient('your_id') >>> client.prepare_request_uri('https://example.com') 'https://example.com?client_id=your_id&response_type=token' >>> client.prepare_request_uri('https://example.com', redirect_uri='https://a.b/callback') 'https://example.com?client_id=your_id&response_type=token&redirect_uri=https%3A%2F%2Fa.b%2Fcallback' >>> client.prepare_request_uri('https://example.com', scope=['profile', 'pictures']) 'https://example.com?client_id=your_id&response_type=token&scope=profile+pictures' >>> client.prepare_request_uri('https://example.com', foo='bar') 'https://example.com?client_id=your_id&response_type=token&foo=bar' .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 """ scope = self.scope if scope is None else scope return prepare_grant_uri(uri, self.client_id, self.response_type, redirect_uri=redirect_uri, state=state, scope=scope, **kwargs) def parse_request_uri_response(self, uri, state=None, scope=None): """Parse the response URI fragment. If the resource owner grants the access request, the authorization server issues an access token and delivers it to the client by adding the following parameters to the fragment component of the redirection URI using the "application/x-www-form-urlencoded" format: :param uri: The callback URI that resulted from the user being redirected back from the provider to you, the client. :param state: The state provided in the authorization request. :param scope: The scopes provided in the authorization request. :return: Dictionary of token parameters. :raises: OAuth2Error if response is invalid. A successful response should always contain **access_token** The access token issued by the authorization server. Often a random string. **token_type** The type of the token issued as described in `Section 7.1`_. Commonly ``Bearer``. **state** If you provided the state parameter in the authorization phase, then the provider is required to include that exact state value in the response. While it is not mandated it is recommended that the provider include **expires_in** The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. **scope** Providers may supply this in all responses but are required to only if it has changed since the authorization request. A few example responses can be seen below:: >>> response_uri = 'https://example.com/callback#access_token=sdlfkj452&state=ss345asyht&token_type=Bearer&scope=hello+world' >>> from oauthlib.oauth2 import MobileApplicationClient >>> client = MobileApplicationClient('your_id') >>> client.parse_request_uri_response(response_uri) { 'access_token': 'sdlfkj452', 'token_type': 'Bearer', 'state': 'ss345asyht', 'scope': [u'hello', u'world'] } >>> client.parse_request_uri_response(response_uri, state='other') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "oauthlib/oauth2/rfc6749/__init__.py", line 598, in parse_request_uri_response **scope** File "oauthlib/oauth2/rfc6749/parameters.py", line 197, in parse_implicit_response raise ValueError("Mismatching or missing state in params.") ValueError: Mismatching or missing state in params. >>> def alert_scope_changed(message, old, new): ... print(message, old, new) ... >>> oauthlib.signals.scope_changed.connect(alert_scope_changed) >>> client.parse_request_body_response(response_body, scope=['other']) ('Scope has changed from "other" to "hello world".', ['other'], ['hello', 'world']) .. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 """ scope = self.scope if scope is None else scope self.token = parse_implicit_response(uri, state=state, scope=scope) self.populate_token_attributes(self.token) return self.token oauth2/rfc6749/clients/backend_application.py 0000644 00000006227 15125174064 0015053 0 ustar 00 # -*- coding: utf-8 -*- """ oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. """ from ..parameters import prepare_token_request from .base import Client class BackendApplicationClient(Client): """A public client utilizing the client credentials grant workflow. The client can request an access token using only its client credentials (or other supported means of authentication) when the client is requesting access to the protected resources under its control, or those of another resource owner which has been previously arranged with the authorization server (the method of which is beyond the scope of this specification). The client credentials grant type MUST only be used by confidential clients. Since the client authentication is used as the authorization grant, no additional authorization request is needed. """ grant_type = 'client_credentials' def prepare_request_body(self, body='', scope=None, include_client_id=False, **kwargs): """Add the client credentials to the request body. The client makes a request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format per `Appendix B`_ in the HTTP request entity-body: :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param scope: The scope of the access request as described by `Section 3.3`_. :param include_client_id: `True` to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. False otherwise (default). :type include_client_id: Boolean :param kwargs: Extra credentials to include in the token request. The client MUST authenticate with the authorization server as described in `Section 3.2.1`_. The prepared body will include all provided credentials as well as the ``grant_type`` parameter set to ``client_credentials``:: >>> from oauthlib.oauth2 import BackendApplicationClient >>> client = BackendApplicationClient('your_id') >>> client.prepare_request_body(scope=['hello', 'world']) 'grant_type=client_credentials&scope=hello+world' .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 """ kwargs['client_id'] = self.client_id kwargs['include_client_id'] = include_client_id scope = self.scope if scope is None else scope return prepare_token_request(self.grant_type, body=body, scope=scope, **kwargs) oauth2/rfc6749/clients/web_application.py 0000644 00000024567 15125174064 0014250 0 ustar 00 # -*- coding: utf-8 -*- """ oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. """ import warnings from ..parameters import ( parse_authorization_code_response, prepare_grant_uri, prepare_token_request, ) from .base import Client class WebApplicationClient(Client): """A client utilizing the authorization code grant workflow. A web application is a confidential client running on a web server. Resource owners access the client via an HTML user interface rendered in a user-agent on the device used by the resource owner. The client credentials as well as any access token issued to the client are stored on the web server and are not exposed to or accessible by the resource owner. The authorization code grant type is used to obtain both access tokens and refresh tokens and is optimized for confidential clients. As a redirection-based flow, the client must be capable of interacting with the resource owner's user-agent (typically a web browser) and capable of receiving incoming requests (via redirection) from the authorization server. """ grant_type = 'authorization_code' def __init__(self, client_id, code=None, **kwargs): super().__init__(client_id, **kwargs) self.code = code def prepare_request_uri(self, uri, redirect_uri=None, scope=None, state=None, **kwargs): """Prepare the authorization code request URI The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the "application/x-www-form-urlencoded" format, per `Appendix B`_: :param redirect_uri: OPTIONAL. The redirect URI must be an absolute URI and it should have been registerd with the OAuth provider prior to use. As described in `Section 3.1.2`_. :param scope: OPTIONAL. The scope of the access request as described by Section 3.3`_. These may be any string but are commonly URIs or various categories such as ``videos`` or ``documents``. :param state: RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. :param kwargs: Extra arguments to include in the request URI. In addition to supplied parameters, OAuthLib will append the ``client_id`` that was provided in the constructor as well as the mandatory ``response_type`` argument, set to ``code``:: >>> from oauthlib.oauth2 import WebApplicationClient >>> client = WebApplicationClient('your_id') >>> client.prepare_request_uri('https://example.com') 'https://example.com?client_id=your_id&response_type=code' >>> client.prepare_request_uri('https://example.com', redirect_uri='https://a.b/callback') 'https://example.com?client_id=your_id&response_type=code&redirect_uri=https%3A%2F%2Fa.b%2Fcallback' >>> client.prepare_request_uri('https://example.com', scope=['profile', 'pictures']) 'https://example.com?client_id=your_id&response_type=code&scope=profile+pictures' >>> client.prepare_request_uri('https://example.com', foo='bar') 'https://example.com?client_id=your_id&response_type=code&foo=bar' .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 """ scope = self.scope if scope is None else scope return prepare_grant_uri(uri, self.client_id, 'code', redirect_uri=redirect_uri, scope=scope, state=state, **kwargs) def prepare_request_body(self, code=None, redirect_uri=None, body='', include_client_id=True, **kwargs): """Prepare the access token request body. The client makes a request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format in the HTTP request entity-body: :param code: REQUIRED. The authorization code received from the authorization server. :param redirect_uri: REQUIRED, if the "redirect_uri" parameter was included in the authorization request as described in `Section 4.1.1`_, and their values MUST be identical. :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param include_client_id: `True` (default) to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. :type include_client_id: Boolean :param kwargs: Extra parameters to include in the token request. In addition OAuthLib will add the ``grant_type`` parameter set to ``authorization_code``. If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in `Section 3.2.1`_:: >>> from oauthlib.oauth2 import WebApplicationClient >>> client = WebApplicationClient('your_id') >>> client.prepare_request_body(code='sh35ksdf09sf') 'grant_type=authorization_code&code=sh35ksdf09sf' >>> client.prepare_request_body(code='sh35ksdf09sf', foo='bar') 'grant_type=authorization_code&code=sh35ksdf09sf&foo=bar' `Section 3.2.1` also states: In the "authorization_code" "grant_type" request to the token endpoint, an unauthenticated client MUST send its "client_id" to prevent itself from inadvertently accepting a code intended for a client with a different "client_id". This protects the client from substitution of the authentication code. (It provides no additional security for the protected resource.) .. _`Section 4.1.1`: https://tools.ietf.org/html/rfc6749#section-4.1.1 .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 """ code = code or self.code if 'client_id' in kwargs: warnings.warn("`client_id` has been deprecated in favor of " "`include_client_id`, a boolean value which will " "include the already configured `self.client_id`.", DeprecationWarning) if kwargs['client_id'] != self.client_id: raise ValueError("`client_id` was supplied as an argument, but " "it does not match `self.client_id`") kwargs['client_id'] = self.client_id kwargs['include_client_id'] = include_client_id return prepare_token_request(self.grant_type, code=code, body=body, redirect_uri=redirect_uri, **kwargs) def parse_request_uri_response(self, uri, state=None): """Parse the URI query for code and state. If the resource owner grants the access request, the authorization server issues an authorization code and delivers it to the client by adding the following parameters to the query component of the redirection URI using the "application/x-www-form-urlencoded" format: :param uri: The callback URI that resulted from the user being redirected back from the provider to you, the client. :param state: The state provided in the authorization request. **code** The authorization code generated by the authorization server. The authorization code MUST expire shortly after it is issued to mitigate the risk of leaks. A maximum authorization code lifetime of 10 minutes is RECOMMENDED. The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code. The authorization code is bound to the client identifier and redirection URI. **state** If the "state" parameter was present in the authorization request. This method is mainly intended to enforce strict state checking with the added benefit of easily extracting parameters from the URI:: >>> from oauthlib.oauth2 import WebApplicationClient >>> client = WebApplicationClient('your_id') >>> uri = 'https://example.com/callback?code=sdfkjh345&state=sfetw45' >>> client.parse_request_uri_response(uri, state='sfetw45') {'state': 'sfetw45', 'code': 'sdfkjh345'} >>> client.parse_request_uri_response(uri, state='other') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "oauthlib/oauth2/rfc6749/__init__.py", line 357, in parse_request_uri_response back from the provider to you, the client. File "oauthlib/oauth2/rfc6749/parameters.py", line 153, in parse_authorization_code_response raise MismatchingStateError() oauthlib.oauth2.rfc6749.errors.MismatchingStateError """ response = parse_authorization_code_response(uri, state=state) self.populate_code_attributes(response) return response oauth2/rfc6749/clients/service_application.py 0000644 00000017202 15125174064 0015117 0 ustar 00 # -*- coding: utf-8 -*- """ oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. """ import time from oauthlib.common import to_unicode from ..parameters import prepare_token_request from .base import Client class ServiceApplicationClient(Client): """A public client utilizing the JWT bearer grant. JWT bearer tokes can be used to request an access token when a client wishes to utilize an existing trust relationship, expressed through the semantics of (and digital signature or keyed message digest calculated over) the JWT, without a direct user approval step at the authorization server. This grant type does not involve an authorization step. It may be used by both public and confidential clients. """ grant_type = 'urn:ietf:params:oauth:grant-type:jwt-bearer' def __init__(self, client_id, private_key=None, subject=None, issuer=None, audience=None, **kwargs): """Initalize a JWT client with defaults for implicit use later. :param client_id: Client identifier given by the OAuth provider upon registration. :param private_key: Private key used for signing and encrypting. Must be given as a string. :param subject: The principal that is the subject of the JWT, i.e. which user is the token requested on behalf of. For example, ``foo@example.com. :param issuer: The JWT MUST contain an "iss" (issuer) claim that contains a unique identifier for the entity that issued the JWT. For example, ``your-client@provider.com``. :param audience: A value identifying the authorization server as an intended audience, e.g. ``https://provider.com/oauth2/token``. :param kwargs: Additional arguments to pass to base client, such as state and token. See ``Client.__init__.__doc__`` for details. """ super().__init__(client_id, **kwargs) self.private_key = private_key self.subject = subject self.issuer = issuer self.audience = audience def prepare_request_body(self, private_key=None, subject=None, issuer=None, audience=None, expires_at=None, issued_at=None, extra_claims=None, body='', scope=None, include_client_id=False, **kwargs): """Create and add a JWT assertion to the request body. :param private_key: Private key used for signing and encrypting. Must be given as a string. :param subject: (sub) The principal that is the subject of the JWT, i.e. which user is the token requested on behalf of. For example, ``foo@example.com. :param issuer: (iss) The JWT MUST contain an "iss" (issuer) claim that contains a unique identifier for the entity that issued the JWT. For example, ``your-client@provider.com``. :param audience: (aud) A value identifying the authorization server as an intended audience, e.g. ``https://provider.com/oauth2/token``. :param expires_at: A unix expiration timestamp for the JWT. Defaults to an hour from now, i.e. ``time.time() + 3600``. :param issued_at: A unix timestamp of when the JWT was created. Defaults to now, i.e. ``time.time()``. :param extra_claims: A dict of additional claims to include in the JWT. :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param scope: The scope of the access request. :param include_client_id: `True` to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. False otherwise (default). :type include_client_id: Boolean :param not_before: A unix timestamp after which the JWT may be used. Not included unless provided. * :param jwt_id: A unique JWT token identifier. Not included unless provided. * :param kwargs: Extra credentials to include in the token request. Parameters marked with a `*` above are not explicit arguments in the function signature, but are specially documented arguments for items appearing in the generic `**kwargs` keyworded input. The "scope" parameter may be used, as defined in the Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants [I-D.ietf-oauth-assertions] specification, to indicate the requested scope. Authentication of the client is optional, as described in `Section 3.2.1`_ of OAuth 2.0 [RFC6749] and consequently, the "client_id" is only needed when a form of client authentication that relies on the parameter is used. The following non-normative example demonstrates an Access Token Request with a JWT as an authorization grant (with extra line breaks for display purposes only): .. code-block: http POST /token.oauth2 HTTP/1.1 Host: as.example.com Content-Type: application/x-www-form-urlencoded grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer &assertion=eyJhbGciOiJFUzI1NiJ9. eyJpc3Mi[...omitted for brevity...]. J9l-ZhwP[...omitted for brevity...] .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 """ import jwt key = private_key or self.private_key if not key: raise ValueError('An encryption key must be supplied to make JWT' ' token requests.') claim = { 'iss': issuer or self.issuer, 'aud': audience or self.audience, 'sub': subject or self.subject, 'exp': int(expires_at or time.time() + 3600), 'iat': int(issued_at or time.time()), } for attr in ('iss', 'aud', 'sub'): if claim[attr] is None: raise ValueError( 'Claim must include %s but none was given.' % attr) if 'not_before' in kwargs: claim['nbf'] = kwargs.pop('not_before') if 'jwt_id' in kwargs: claim['jti'] = kwargs.pop('jwt_id') claim.update(extra_claims or {}) assertion = jwt.encode(claim, key, 'RS256') assertion = to_unicode(assertion) kwargs['client_id'] = self.client_id kwargs['include_client_id'] = include_client_id scope = self.scope if scope is None else scope return prepare_token_request(self.grant_type, body=body, assertion=assertion, scope=scope, **kwargs) oauth2/rfc6749/clients/legacy_application.py 0000644 00000007677 15125174064 0014742 0 ustar 00 # -*- coding: utf-8 -*- """ oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. """ from ..parameters import prepare_token_request from .base import Client class LegacyApplicationClient(Client): """A public client using the resource owner password and username directly. The resource owner password credentials grant type is suitable in cases where the resource owner has a trust relationship with the client, such as the device operating system or a highly privileged application. The authorization server should take special care when enabling this grant type, and only allow it when other flows are not viable. The grant type is suitable for clients capable of obtaining the resource owner's credentials (username and password, typically using an interactive form). It is also used to migrate existing clients using direct authentication schemes such as HTTP Basic or Digest authentication to OAuth by converting the stored credentials to an access token. The method through which the client obtains the resource owner credentials is beyond the scope of this specification. The client MUST discard the credentials once an access token has been obtained. """ grant_type = 'password' def __init__(self, client_id, **kwargs): super().__init__(client_id, **kwargs) def prepare_request_body(self, username, password, body='', scope=None, include_client_id=False, **kwargs): """Add the resource owner password and username to the request body. The client makes a request to the token endpoint by adding the following parameters using the "application/x-www-form-urlencoded" format per `Appendix B`_ in the HTTP request entity-body: :param username: The resource owner username. :param password: The resource owner password. :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra paramters. Default ''. :param scope: The scope of the access request as described by `Section 3.3`_. :param include_client_id: `True` to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. False otherwise (default). :type include_client_id: Boolean :param kwargs: Extra credentials to include in the token request. If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in `Section 3.2.1`_. The prepared body will include all provided credentials as well as the ``grant_type`` parameter set to ``password``:: >>> from oauthlib.oauth2 import LegacyApplicationClient >>> client = LegacyApplicationClient('your_id') >>> client.prepare_request_body(username='foo', password='bar', scope=['hello', 'world']) 'grant_type=password&username=foo&scope=hello+world&password=bar' .. _`Appendix B`: https://tools.ietf.org/html/rfc6749#appendix-B .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`Section 3.2.1`: https://tools.ietf.org/html/rfc6749#section-3.2.1 """ kwargs['client_id'] = self.client_id kwargs['include_client_id'] = include_client_id scope = self.scope if scope is None else scope return prepare_token_request(self.grant_type, body=body, username=username, password=password, scope=scope, **kwargs) oauth2/rfc6749/clients/__init__.py 0000644 00000000770 15125174064 0012635 0 ustar 00 # -*- coding: utf-8 -*- """ oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming OAuth 2.0 RFC6749. """ from .backend_application import BackendApplicationClient from .base import AUTH_HEADER, BODY, URI_QUERY, Client from .legacy_application import LegacyApplicationClient from .mobile_application import MobileApplicationClient from .service_application import ServiceApplicationClient from .web_application import WebApplicationClient oauth2/rfc6749/parameters.py 0000644 00000043020 15125174064 0011573 0 ustar 00 """ oauthlib.oauth2.rfc6749.parameters ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module contains methods related to `Section 4`_ of the OAuth 2 RFC. .. _`Section 4`: https://tools.ietf.org/html/rfc6749#section-4 """ import json import os import time import urllib.parse as urlparse from oauthlib.common import add_params_to_qs, add_params_to_uri from oauthlib.signals import scope_changed from .errors import ( InsecureTransportError, MismatchingStateError, MissingCodeError, MissingTokenError, MissingTokenTypeError, raise_from_error, ) from .tokens import OAuth2Token from .utils import is_secure_transport, list_to_scope, scope_to_list def prepare_grant_uri(uri, client_id, response_type, redirect_uri=None, scope=None, state=None, **kwargs): """Prepare the authorization grant request URI. The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the ``application/x-www-form-urlencoded`` format as defined by [`W3C.REC-html401-19991224`_]: :param uri: :param client_id: The client identifier as described in `Section 2.2`_. :param response_type: To indicate which OAuth 2 grant/flow is required, "code" and "token". :param redirect_uri: The client provided URI to redirect back to after authorization as described in `Section 3.1.2`_. :param scope: The scope of the access request as described by `Section 3.3`_. :param state: An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in `Section 10.12`_. :param kwargs: Extra arguments to embed in the grant/authorization URL. An example of an authorization code grant authorization URL: .. code-block:: http GET /authorize?response_type=code&client_id=s6BhdRkqt3&state=xyz &redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb HTTP/1.1 Host: server.example.com .. _`W3C.REC-html401-19991224`: https://tools.ietf.org/html/rfc6749#ref-W3C.REC-html401-19991224 .. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2 .. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12 """ if not is_secure_transport(uri): raise InsecureTransportError() params = [(('response_type', response_type)), (('client_id', client_id))] if redirect_uri: params.append(('redirect_uri', redirect_uri)) if scope: params.append(('scope', list_to_scope(scope))) if state: params.append(('state', state)) for k in kwargs: if kwargs[k]: params.append((str(k), kwargs[k])) return add_params_to_uri(uri, params) def prepare_token_request(grant_type, body='', include_client_id=True, **kwargs): """Prepare the access token request. The client makes a request to the token endpoint by adding the following parameters using the ``application/x-www-form-urlencoded`` format in the HTTP request entity-body: :param grant_type: To indicate grant type being used, i.e. "password", "authorization_code" or "client_credentials". :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra parameters. Default ''. :param include_client_id: `True` (default) to send the `client_id` in the body of the upstream request. This is required if the client is not authenticating with the authorization server as described in `Section 3.2.1`_. :type include_client_id: Boolean :param client_id: Unicode client identifier. Will only appear if `include_client_id` is True. * :param client_secret: Unicode client secret. Will only appear if set to a value that is not `None`. Invoking this function with an empty string will send an empty `client_secret` value to the server. * :param code: If using authorization_code grant, pass the previously obtained authorization code as the ``code`` argument. * :param redirect_uri: If the "redirect_uri" parameter was included in the authorization request as described in `Section 4.1.1`_, and their values MUST be identical. * :param kwargs: Extra arguments to embed in the request body. Parameters marked with a `*` above are not explicit arguments in the function signature, but are specially documented arguments for items appearing in the generic `**kwargs` keyworded input. An example of an authorization code token request body: .. code-block:: http grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA &redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb .. _`Section 4.1.1`: https://tools.ietf.org/html/rfc6749#section-4.1.1 """ params = [('grant_type', grant_type)] if 'scope' in kwargs: kwargs['scope'] = list_to_scope(kwargs['scope']) # pull the `client_id` out of the kwargs. client_id = kwargs.pop('client_id', None) if include_client_id: if client_id is not None: params.append(('client_id', client_id)) # the kwargs iteration below only supports including boolean truth (truthy) # values, but some servers may require an empty string for `client_secret` client_secret = kwargs.pop('client_secret', None) if client_secret is not None: params.append(('client_secret', client_secret)) # this handles: `code`, `redirect_uri`, and other undocumented params for k in kwargs: if kwargs[k]: params.append((str(k), kwargs[k])) return add_params_to_qs(body, params) def prepare_token_revocation_request(url, token, token_type_hint="access_token", callback=None, body='', **kwargs): """Prepare a token revocation request. The client constructs the request by including the following parameters using the ``application/x-www-form-urlencoded`` format in the HTTP request entity-body: :param token: REQUIRED. The token that the client wants to get revoked. :param token_type_hint: OPTIONAL. A hint about the type of the token submitted for revocation. Clients MAY pass this parameter in order to help the authorization server to optimize the token lookup. If the server is unable to locate the token using the given hint, it MUST extend its search across all of its supported token types. An authorization server MAY ignore this parameter, particularly if it is able to detect the token type automatically. This specification defines two values for `token_type_hint`: * access_token: An access token as defined in [RFC6749], `Section 1.4`_ * refresh_token: A refresh token as defined in [RFC6749], `Section 1.5`_ Specific implementations, profiles, and extensions of this specification MAY define other values for this parameter using the registry defined in `Section 4.1.2`_. .. _`Section 1.4`: https://tools.ietf.org/html/rfc6749#section-1.4 .. _`Section 1.5`: https://tools.ietf.org/html/rfc6749#section-1.5 .. _`Section 4.1.2`: https://tools.ietf.org/html/rfc7009#section-4.1.2 """ if not is_secure_transport(url): raise InsecureTransportError() params = [('token', token)] if token_type_hint: params.append(('token_type_hint', token_type_hint)) for k in kwargs: if kwargs[k]: params.append((str(k), kwargs[k])) headers = {'Content-Type': 'application/x-www-form-urlencoded'} if callback: params.append(('callback', callback)) return add_params_to_uri(url, params), headers, body else: return url, headers, add_params_to_qs(body, params) def parse_authorization_code_response(uri, state=None): """Parse authorization grant response URI into a dict. If the resource owner grants the access request, the authorization server issues an authorization code and delivers it to the client by adding the following parameters to the query component of the redirection URI using the ``application/x-www-form-urlencoded`` format: **code** REQUIRED. The authorization code generated by the authorization server. The authorization code MUST expire shortly after it is issued to mitigate the risk of leaks. A maximum authorization code lifetime of 10 minutes is RECOMMENDED. The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code. The authorization code is bound to the client identifier and redirection URI. **state** REQUIRED if the "state" parameter was present in the client authorization request. The exact value received from the client. :param uri: The full redirect URL back to the client. :param state: The state parameter from the authorization request. For example, the authorization server redirects the user-agent by sending the following HTTP response: .. code-block:: http HTTP/1.1 302 Found Location: https://client.example.com/cb?code=SplxlOBeZQQYbYS6WxSbIA &state=xyz """ if not is_secure_transport(uri): raise InsecureTransportError() query = urlparse.urlparse(uri).query params = dict(urlparse.parse_qsl(query)) if state and params.get('state', None) != state: raise MismatchingStateError() if 'error' in params: raise_from_error(params.get('error'), params) if not 'code' in params: raise MissingCodeError("Missing code parameter in response.") return params def parse_implicit_response(uri, state=None, scope=None): """Parse the implicit token response URI into a dict. If the resource owner grants the access request, the authorization server issues an access token and delivers it to the client by adding the following parameters to the fragment component of the redirection URI using the ``application/x-www-form-urlencoded`` format: **access_token** REQUIRED. The access token issued by the authorization server. **token_type** REQUIRED. The type of the token issued as described in Section 7.1. Value is case insensitive. **expires_in** RECOMMENDED. The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. **scope** OPTIONAL, if identical to the scope requested by the client, otherwise REQUIRED. The scope of the access token as described by Section 3.3. **state** REQUIRED if the "state" parameter was present in the client authorization request. The exact value received from the client. :param uri: :param state: :param scope: Similar to the authorization code response, but with a full token provided in the URL fragment: .. code-block:: http HTTP/1.1 302 Found Location: http://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA &state=xyz&token_type=example&expires_in=3600 """ if not is_secure_transport(uri): raise InsecureTransportError() fragment = urlparse.urlparse(uri).fragment params = dict(urlparse.parse_qsl(fragment, keep_blank_values=True)) for key in ('expires_in',): if key in params: # cast things to int params[key] = int(params[key]) if 'scope' in params: params['scope'] = scope_to_list(params['scope']) if 'expires_in' in params: params['expires_at'] = time.time() + int(params['expires_in']) if state and params.get('state', None) != state: raise ValueError("Mismatching or missing state in params.") params = OAuth2Token(params, old_scope=scope) validate_token_parameters(params) return params def parse_token_response(body, scope=None): """Parse the JSON token response body into a dict. The authorization server issues an access token and optional refresh token, and constructs the response by adding the following parameters to the entity body of the HTTP response with a 200 (OK) status code: access_token REQUIRED. The access token issued by the authorization server. token_type REQUIRED. The type of the token issued as described in `Section 7.1`_. Value is case insensitive. expires_in RECOMMENDED. The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. refresh_token OPTIONAL. The refresh token which can be used to obtain new access tokens using the same authorization grant as described in `Section 6`_. scope OPTIONAL, if identical to the scope requested by the client, otherwise REQUIRED. The scope of the access token as described by `Section 3.3`_. The parameters are included in the entity body of the HTTP response using the "application/json" media type as defined by [`RFC4627`_]. The parameters are serialized into a JSON structure by adding each parameter at the highest structure level. Parameter names and string values are included as JSON strings. Numerical values are included as JSON numbers. The order of parameters does not matter and can vary. :param body: The full json encoded response body. :param scope: The scope requested during authorization. For example: .. code-block:: http HTTP/1.1 200 OK Content-Type: application/json Cache-Control: no-store Pragma: no-cache { "access_token":"2YotnFZFEjr1zCsicMWpAA", "token_type":"example", "expires_in":3600, "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA", "example_parameter":"example_value" } .. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1 .. _`Section 6`: https://tools.ietf.org/html/rfc6749#section-6 .. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3 .. _`RFC4627`: https://tools.ietf.org/html/rfc4627 """ try: params = json.loads(body) except ValueError: # Fall back to URL-encoded string, to support old implementations, # including (at time of writing) Facebook. See: # https://github.com/oauthlib/oauthlib/issues/267 params = dict(urlparse.parse_qsl(body)) for key in ('expires_in',): if key in params: # cast things to int params[key] = int(params[key]) if 'scope' in params: params['scope'] = scope_to_list(params['scope']) if 'expires_in' in params: if params['expires_in'] is None: params.pop('expires_in') else: params['expires_at'] = time.time() + int(params['expires_in']) params = OAuth2Token(params, old_scope=scope) validate_token_parameters(params) return params def validate_token_parameters(params): """Ensures token presence, token type, expiration and scope in params.""" if 'error' in params: raise_from_error(params.get('error'), params) if not 'access_token' in params: raise MissingTokenError(description="Missing access token parameter.") if not 'token_type' in params: if os.environ.get('OAUTHLIB_STRICT_TOKEN_TYPE'): raise MissingTokenTypeError() # If the issued access token scope is different from the one requested by # the client, the authorization server MUST include the "scope" response # parameter to inform the client of the actual scope granted. # https://tools.ietf.org/html/rfc6749#section-3.3 if params.scope_changed: message = 'Scope has changed from "{old}" to "{new}".'.format( old=params.old_scope, new=params.scope, ) scope_changed.send(message=message, old=params.old_scopes, new=params.scopes) if not os.environ.get('OAUTHLIB_RELAX_TOKEN_SCOPE', None): w = Warning(message) w.token = params w.old_scope = params.old_scopes w.new_scope = params.scopes raise w oauth2/rfc6749/errors.py 0000644 00000031277 15125174064 0010757 0 ustar 00 """ oauthlib.oauth2.rfc6749.errors ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Error used both by OAuth 2 clients and providers to represent the spec defined error responses for all four core grant types. """ import json from oauthlib.common import add_params_to_uri, urlencode class OAuth2Error(Exception): error = None status_code = 400 description = '' def __init__(self, description=None, uri=None, state=None, status_code=None, request=None): """ :param description: A human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred. Values for the "error_description" parameter MUST NOT include characters outside the set x20-21 / x23-5B / x5D-7E. :param uri: A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error. Values for the "error_uri" parameter MUST conform to the URI- Reference syntax, and thus MUST NOT include characters outside the set x21 / x23-5B / x5D-7E. :param state: A CSRF protection value received from the client. :param status_code: :param request: OAuthlib request. :type request: oauthlib.common.Request """ if description is not None: self.description = description message = '({}) {}'.format(self.error, self.description) if request: message += ' ' + repr(request) super().__init__(message) self.uri = uri self.state = state if status_code: self.status_code = status_code if request: self.redirect_uri = request.redirect_uri self.client_id = request.client_id self.scopes = request.scopes self.response_type = request.response_type self.response_mode = request.response_mode self.grant_type = request.grant_type if not state: self.state = request.state else: self.redirect_uri = None self.client_id = None self.scopes = None self.response_type = None self.response_mode = None self.grant_type = None def in_uri(self, uri): fragment = self.response_mode == "fragment" return add_params_to_uri(uri, self.twotuples, fragment) @property def twotuples(self): error = [('error', self.error)] if self.description: error.append(('error_description', self.description)) if self.uri: error.append(('error_uri', self.uri)) if self.state: error.append(('state', self.state)) return error @property def urlencoded(self): return urlencode(self.twotuples) @property def json(self): return json.dumps(dict(self.twotuples)) @property def headers(self): if self.status_code == 401: """ https://tools.ietf.org/html/rfc6750#section-3 All challenges defined by this specification MUST use the auth-scheme value "Bearer". This scheme MUST be followed by one or more auth-param values. """ authvalues = [ "Bearer", 'error="{}"'.format(self.error) ] if self.description: authvalues.append('error_description="{}"'.format(self.description)) if self.uri: authvalues.append('error_uri="{}"'.format(self.uri)) return {"WWW-Authenticate": ", ".join(authvalues)} return {} class TokenExpiredError(OAuth2Error): error = 'token_expired' class InsecureTransportError(OAuth2Error): error = 'insecure_transport' description = 'OAuth 2 MUST utilize https.' class MismatchingStateError(OAuth2Error): error = 'mismatching_state' description = 'CSRF Warning! State not equal in request and response.' class MissingCodeError(OAuth2Error): error = 'missing_code' class MissingTokenError(OAuth2Error): error = 'missing_token' class MissingTokenTypeError(OAuth2Error): error = 'missing_token_type' class FatalClientError(OAuth2Error): """ Errors during authorization where user should not be redirected back. If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI. Instead the user should be informed of the error by the provider itself. """ pass class InvalidRequestFatalError(FatalClientError): """ For fatal errors, the request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. """ error = 'invalid_request' class InvalidRedirectURIError(InvalidRequestFatalError): description = 'Invalid redirect URI.' class MissingRedirectURIError(InvalidRequestFatalError): description = 'Missing redirect URI.' class MismatchingRedirectURIError(InvalidRequestFatalError): description = 'Mismatching redirect URI.' class InvalidClientIdError(InvalidRequestFatalError): description = 'Invalid client_id parameter value.' class MissingClientIdError(InvalidRequestFatalError): description = 'Missing client_id parameter.' class InvalidRequestError(OAuth2Error): """ The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. """ error = 'invalid_request' class MissingResponseTypeError(InvalidRequestError): description = 'Missing response_type parameter.' class MissingCodeChallengeError(InvalidRequestError): """ If the server requires Proof Key for Code Exchange (PKCE) by OAuth public clients and the client does not send the "code_challenge" in the request, the authorization endpoint MUST return the authorization error response with the "error" value set to "invalid_request". The "error_description" or the response of "error_uri" SHOULD explain the nature of error, e.g., code challenge required. """ description = 'Code challenge required.' class MissingCodeVerifierError(InvalidRequestError): """ The request to the token endpoint, when PKCE is enabled, has the parameter `code_verifier` REQUIRED. """ description = 'Code verifier required.' class AccessDeniedError(OAuth2Error): """ The resource owner or authorization server denied the request. """ error = 'access_denied' class UnsupportedResponseTypeError(OAuth2Error): """ The authorization server does not support obtaining an authorization code using this method. """ error = 'unsupported_response_type' class UnsupportedCodeChallengeMethodError(InvalidRequestError): """ If the server supporting PKCE does not support the requested transformation, the authorization endpoint MUST return the authorization error response with "error" value set to "invalid_request". The "error_description" or the response of "error_uri" SHOULD explain the nature of error, e.g., transform algorithm not supported. """ description = 'Transform algorithm not supported.' class InvalidScopeError(OAuth2Error): """ The requested scope is invalid, unknown, or malformed, or exceeds the scope granted by the resource owner. https://tools.ietf.org/html/rfc6749#section-5.2 """ error = 'invalid_scope' class ServerError(OAuth2Error): """ The authorization server encountered an unexpected condition that prevented it from fulfilling the request. (This error code is needed because a 500 Internal Server Error HTTP status code cannot be returned to the client via a HTTP redirect.) """ error = 'server_error' class TemporarilyUnavailableError(OAuth2Error): """ The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server. (This error code is needed because a 503 Service Unavailable HTTP status code cannot be returned to the client via a HTTP redirect.) """ error = 'temporarily_unavailable' class InvalidClientError(FatalClientError): """ Client authentication failed (e.g. unknown client, no client authentication included, or unsupported authentication method). The authorization server MAY return an HTTP 401 (Unauthorized) status code to indicate which HTTP authentication schemes are supported. If the client attempted to authenticate via the "Authorization" request header field, the authorization server MUST respond with an HTTP 401 (Unauthorized) status code, and include the "WWW-Authenticate" response header field matching the authentication scheme used by the client. """ error = 'invalid_client' status_code = 401 class InvalidGrantError(OAuth2Error): """ The provided authorization grant (e.g. authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client. https://tools.ietf.org/html/rfc6749#section-5.2 """ error = 'invalid_grant' status_code = 400 class UnauthorizedClientError(OAuth2Error): """ The authenticated client is not authorized to use this authorization grant type. """ error = 'unauthorized_client' class UnsupportedGrantTypeError(OAuth2Error): """ The authorization grant type is not supported by the authorization server. """ error = 'unsupported_grant_type' class UnsupportedTokenTypeError(OAuth2Error): """ The authorization server does not support the hint of the presented token type. I.e. the client tried to revoke an access token on a server not supporting this feature. """ error = 'unsupported_token_type' class InvalidTokenError(OAuth2Error): """ The access token provided is expired, revoked, malformed, or invalid for other reasons. The resource SHOULD respond with the HTTP 401 (Unauthorized) status code. The client MAY request a new access token and retry the protected resource request. """ error = 'invalid_token' status_code = 401 description = ("The access token provided is expired, revoked, malformed, " "or invalid for other reasons.") class InsufficientScopeError(OAuth2Error): """ The request requires higher privileges than provided by the access token. The resource server SHOULD respond with the HTTP 403 (Forbidden) status code and MAY include the "scope" attribute with the scope necessary to access the protected resource. """ error = 'insufficient_scope' status_code = 403 description = ("The request requires higher privileges than provided by " "the access token.") class ConsentRequired(OAuth2Error): """ The Authorization Server requires End-User consent. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User consent. """ error = 'consent_required' class LoginRequired(OAuth2Error): """ The Authorization Server requires End-User authentication. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User authentication. """ error = 'login_required' class CustomOAuth2Error(OAuth2Error): """ This error is a placeholder for all custom errors not described by the RFC. Some of the popular OAuth2 providers are using custom errors. """ def __init__(self, error, *args, **kwargs): self.error = error super().__init__(*args, **kwargs) def raise_from_error(error, params=None): import inspect import sys kwargs = { 'description': params.get('error_description'), 'uri': params.get('error_uri'), 'state': params.get('state') } for _, cls in inspect.getmembers(sys.modules[__name__], inspect.isclass): if cls.error == error: raise cls(**kwargs) raise CustomOAuth2Error(error=error, **kwargs) oauth2/rfc6749/tokens.py 0000644 00000025531 15125174064 0010742 0 ustar 00 """ oauthlib.oauth2.rfc6749.tokens ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module contains methods for adding two types of access tokens to requests. - Bearer https://tools.ietf.org/html/rfc6750 - MAC https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01 """ import hashlib import hmac import warnings from binascii import b2a_base64 from urllib.parse import urlparse from oauthlib import common from oauthlib.common import add_params_to_qs, add_params_to_uri from . import utils class OAuth2Token(dict): def __init__(self, params, old_scope=None): super().__init__(params) self._new_scope = None if 'scope' in params and params['scope']: self._new_scope = set(utils.scope_to_list(params['scope'])) if old_scope is not None: self._old_scope = set(utils.scope_to_list(old_scope)) if self._new_scope is None: # the rfc says that if the scope hasn't changed, it's optional # in params so set the new scope to the old scope self._new_scope = self._old_scope else: self._old_scope = self._new_scope @property def scope_changed(self): return self._new_scope != self._old_scope @property def old_scope(self): return utils.list_to_scope(self._old_scope) @property def old_scopes(self): return list(self._old_scope) @property def scope(self): return utils.list_to_scope(self._new_scope) @property def scopes(self): return list(self._new_scope) @property def missing_scopes(self): return list(self._old_scope - self._new_scope) @property def additional_scopes(self): return list(self._new_scope - self._old_scope) def prepare_mac_header(token, uri, key, http_method, nonce=None, headers=None, body=None, ext='', hash_algorithm='hmac-sha-1', issue_time=None, draft=0): """Add an `MAC Access Authentication`_ signature to headers. Unlike OAuth 1, this HMAC signature does not require inclusion of the request payload/body, neither does it use a combination of client_secret and token_secret but rather a mac_key provided together with the access token. Currently two algorithms are supported, "hmac-sha-1" and "hmac-sha-256", `extension algorithms`_ are not supported. Example MAC Authorization header, linebreaks added for clarity Authorization: MAC id="h480djs93hd8", nonce="1336363200:dj83hs9s", mac="bhCQXTVyfj5cmA9uKkPFx1zeOXM=" .. _`MAC Access Authentication`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01 .. _`extension algorithms`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-7.1 :param token: :param uri: Request URI. :param key: MAC given provided by token endpoint. :param http_method: HTTP Request method. :param nonce: :param headers: Request headers as a dictionary. :param body: :param ext: :param hash_algorithm: HMAC algorithm provided by token endpoint. :param issue_time: Time when the MAC credentials were issued (datetime). :param draft: MAC authentication specification version. :return: headers dictionary with the authorization field added. """ http_method = http_method.upper() host, port = utils.host_from_uri(uri) if hash_algorithm.lower() == 'hmac-sha-1': h = hashlib.sha1 elif hash_algorithm.lower() == 'hmac-sha-256': h = hashlib.sha256 else: raise ValueError('unknown hash algorithm') if draft == 0: nonce = nonce or '{}:{}'.format(utils.generate_age(issue_time), common.generate_nonce()) else: ts = common.generate_timestamp() nonce = common.generate_nonce() sch, net, path, par, query, fra = urlparse(uri) if query: request_uri = path + '?' + query else: request_uri = path # Hash the body/payload if body is not None and draft == 0: body = body.encode('utf-8') bodyhash = b2a_base64(h(body).digest())[:-1].decode('utf-8') else: bodyhash = '' # Create the normalized base string base = [] if draft == 0: base.append(nonce) else: base.append(ts) base.append(nonce) base.append(http_method.upper()) base.append(request_uri) base.append(host) base.append(port) if draft == 0: base.append(bodyhash) base.append(ext or '') base_string = '\n'.join(base) + '\n' # hmac struggles with unicode strings - http://bugs.python.org/issue5285 if isinstance(key, str): key = key.encode('utf-8') sign = hmac.new(key, base_string.encode('utf-8'), h) sign = b2a_base64(sign.digest())[:-1].decode('utf-8') header = [] header.append('MAC id="%s"' % token) if draft != 0: header.append('ts="%s"' % ts) header.append('nonce="%s"' % nonce) if bodyhash: header.append('bodyhash="%s"' % bodyhash) if ext: header.append('ext="%s"' % ext) header.append('mac="%s"' % sign) headers = headers or {} headers['Authorization'] = ', '.join(header) return headers def prepare_bearer_uri(token, uri): """Add a `Bearer Token`_ to the request URI. Not recommended, use only if client can't use authorization header or body. http://www.example.com/path?access_token=h480djs93hd8 .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750 :param token: :param uri: """ return add_params_to_uri(uri, [(('access_token', token))]) def prepare_bearer_headers(token, headers=None): """Add a `Bearer Token`_ to the request URI. Recommended method of passing bearer tokens. Authorization: Bearer h480djs93hd8 .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750 :param token: :param headers: """ headers = headers or {} headers['Authorization'] = 'Bearer %s' % token return headers def prepare_bearer_body(token, body=''): """Add a `Bearer Token`_ to the request body. access_token=h480djs93hd8 .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750 :param token: :param body: """ return add_params_to_qs(body, [(('access_token', token))]) def random_token_generator(request, refresh_token=False): """ :param request: OAuthlib request. :type request: oauthlib.common.Request :param refresh_token: """ return common.generate_token() def signed_token_generator(private_pem, **kwargs): """ :param private_pem: """ def signed_token_generator(request): request.claims = kwargs return common.generate_signed_token(private_pem, request) return signed_token_generator def get_token_from_header(request): """ Helper function to extract a token from the request header. :param request: OAuthlib request. :type request: oauthlib.common.Request :return: Return the token or None if the Authorization header is malformed. """ token = None if 'Authorization' in request.headers: split_header = request.headers.get('Authorization').split() if len(split_header) == 2 and split_header[0].lower() == 'bearer': token = split_header[1] else: token = request.access_token return token class TokenBase: def __call__(self, request, refresh_token=False): raise NotImplementedError('Subclasses must implement this method.') def validate_request(self, request): """ :param request: OAuthlib request. :type request: oauthlib.common.Request """ raise NotImplementedError('Subclasses must implement this method.') def estimate_type(self, request): """ :param request: OAuthlib request. :type request: oauthlib.common.Request """ raise NotImplementedError('Subclasses must implement this method.') class BearerToken(TokenBase): __slots__ = ( 'request_validator', 'token_generator', 'refresh_token_generator', 'expires_in' ) def __init__(self, request_validator=None, token_generator=None, expires_in=None, refresh_token_generator=None): self.request_validator = request_validator self.token_generator = token_generator or random_token_generator self.refresh_token_generator = ( refresh_token_generator or self.token_generator ) self.expires_in = expires_in or 3600 def create_token(self, request, refresh_token=False, **kwargs): """ Create a BearerToken, by default without refresh token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param refresh_token: """ if "save_token" in kwargs: warnings.warn("`save_token` has been deprecated, it was not called internally." "If you do, call `request_validator.save_token()` instead.", DeprecationWarning) if callable(self.expires_in): expires_in = self.expires_in(request) else: expires_in = self.expires_in request.expires_in = expires_in token = { 'access_token': self.token_generator(request), 'expires_in': expires_in, 'token_type': 'Bearer', } # If provided, include - this is optional in some cases https://tools.ietf.org/html/rfc6749#section-3.3 but # there is currently no mechanism to coordinate issuing a token for only a subset of the requested scopes so # all tokens issued are for the entire set of requested scopes. if request.scopes is not None: token['scope'] = ' '.join(request.scopes) if refresh_token: if (request.refresh_token and not self.request_validator.rotate_refresh_token(request)): token['refresh_token'] = request.refresh_token else: token['refresh_token'] = self.refresh_token_generator(request) token.update(request.extra_credentials or {}) return OAuth2Token(token) def validate_request(self, request): """ :param request: OAuthlib request. :type request: oauthlib.common.Request """ token = get_token_from_header(request) return self.request_validator.validate_bearer_token( token, request.scopes, request) def estimate_type(self, request): """ :param request: OAuthlib request. :type request: oauthlib.common.Request """ if request.headers.get('Authorization', '').split(' ')[0].lower() == 'bearer': return 9 elif request.access_token is not None: return 5 else: return 0 oauth2/rfc6749/utils.py 0000644 00000004237 15125174064 0010577 0 ustar 00 """ oauthlib.utils ~~~~~~~~~~~~~~ This module contains utility methods used by various parts of the OAuth 2 spec. """ import datetime import os from urllib.parse import quote, urlparse from oauthlib.common import urldecode def list_to_scope(scope): """Convert a list of scopes to a space separated string.""" if isinstance(scope, str) or scope is None: return scope elif isinstance(scope, (set, tuple, list)): return " ".join([str(s) for s in scope]) else: raise ValueError("Invalid scope (%s), must be string, tuple, set, or list." % scope) def scope_to_list(scope): """Convert a space separated string to a list of scopes.""" if isinstance(scope, (tuple, list, set)): return [str(s) for s in scope] elif scope is None: return None else: return scope.strip().split(" ") def params_from_uri(uri): params = dict(urldecode(urlparse(uri).query)) if 'scope' in params: params['scope'] = scope_to_list(params['scope']) return params def host_from_uri(uri): """Extract hostname and port from URI. Will use default port for HTTP and HTTPS if none is present in the URI. """ default_ports = { 'HTTP': '80', 'HTTPS': '443', } sch, netloc, path, par, query, fra = urlparse(uri) if ':' in netloc: netloc, port = netloc.split(':', 1) else: port = default_ports.get(sch.upper()) return netloc, port def escape(u): """Escape a string in an OAuth-compatible fashion. TODO: verify whether this can in fact be used for OAuth 2 """ if not isinstance(u, str): raise ValueError('Only unicode objects are escapable.') return quote(u.encode('utf-8'), safe=b'~') def generate_age(issue_time): """Generate a age parameter for MAC authentication draft 00.""" td = datetime.datetime.now() - issue_time age = (td.microseconds + (td.seconds + td.days * 24 * 3600) * 10 ** 6) / 10 ** 6 return str(age) def is_secure_transport(uri): """Check if the uri is over ssl.""" if os.environ.get('OAUTHLIB_INSECURE_TRANSPORT'): return True return uri.lower().startswith('https://') oauth2/rfc6749/__init__.py 0000644 00000000624 15125174064 0011172 0 ustar 00 """ oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming and providing OAuth 2.0 RFC6749. """ import functools import logging from .endpoints.base import BaseEndpoint, catch_errors_and_unavailability from .errors import ( FatalClientError, OAuth2Error, ServerError, TemporarilyUnavailableError, ) log = logging.getLogger(__name__) oauth2/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000004067 15125174064 0015321 0 ustar 00 a \��` � @ s d Z ddlmZmZmZmZmZmZ ddlm Z m Z m Z m Z m Z mZmZmZmZmZmZ ddlmZmZmZmZmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z. ddl/m0Z0m1Z1m2Z2m3Z3m4Z4 ddl5m6Z6 ddl7m8Z8m9Z9 ddl:m;Z; d S ) z� oauthlib.oauth2 ~~~~~~~~~~~~~~ This module is a wrapper for the most recent implementation of OAuth 2.0 Client and Server classes. � )�BackendApplicationClient�Client�LegacyApplicationClient�MobileApplicationClient�ServiceApplicationClient�WebApplicationClient) �AuthorizationEndpoint�BackendApplicationServer�IntrospectEndpoint�LegacyApplicationServer�MetadataEndpoint�MobileApplicationServer�ResourceEndpoint�RevocationEndpoint�Server� TokenEndpoint�WebApplicationServer)�AccessDeniedError�FatalClientError�InsecureTransportError�InvalidClientError�InvalidClientIdError�InvalidGrantError�InvalidRedirectURIError�InvalidRequestError�InvalidRequestFatalError�InvalidScopeError�MismatchingRedirectURIError�MismatchingStateError�MissingClientIdError�MissingCodeError�MissingRedirectURIError�MissingResponseTypeError�MissingTokenError�MissingTokenTypeError� OAuth2Error� ServerError�TemporarilyUnavailableError�TokenExpiredError�UnauthorizedClientError�UnsupportedGrantTypeError� UnsupportedResponseTypeError�UnsupportedTokenTypeError)�AuthorizationCodeGrant�ClientCredentialsGrant� ImplicitGrant�RefreshTokenGrant�%ResourceOwnerPasswordCredentialsGrant)�RequestValidator)� BearerToken� OAuth2Token)�is_secure_transportN)<�__doc__Zrfc6749.clientsr r r r r r Zrfc6749.endpointsr r r r r r r r r r r Zrfc6749.errorsr r r r r r r r r r r r r r r! r" r# r$ r% r& r' r( r) r* r+ r, Zrfc6749.grant_typesr- r. r/ r0 r1 Zrfc6749.request_validatorr2 Zrfc6749.tokensr3 r4 Z rfc6749.utilsr5 � r7 r7 �</usr/lib/python3.9/site-packages/oauthlib/oauth2/__init__.py�<module> s 4p oauth2/__pycache__/__init__.cpython-39.pyc 0000644 00000004067 15125174064 0014362 0 ustar 00 a \��` � @ s d Z ddlmZmZmZmZmZmZ ddlm Z m Z m Z m Z m Z mZmZmZmZmZmZ ddlmZmZmZmZmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z. ddl/m0Z0m1Z1m2Z2m3Z3m4Z4 ddl5m6Z6 ddl7m8Z8m9Z9 ddl:m;Z; d S ) z� oauthlib.oauth2 ~~~~~~~~~~~~~~ This module is a wrapper for the most recent implementation of OAuth 2.0 Client and Server classes. � )�BackendApplicationClient�Client�LegacyApplicationClient�MobileApplicationClient�ServiceApplicationClient�WebApplicationClient) �AuthorizationEndpoint�BackendApplicationServer�IntrospectEndpoint�LegacyApplicationServer�MetadataEndpoint�MobileApplicationServer�ResourceEndpoint�RevocationEndpoint�Server� TokenEndpoint�WebApplicationServer)�AccessDeniedError�FatalClientError�InsecureTransportError�InvalidClientError�InvalidClientIdError�InvalidGrantError�InvalidRedirectURIError�InvalidRequestError�InvalidRequestFatalError�InvalidScopeError�MismatchingRedirectURIError�MismatchingStateError�MissingClientIdError�MissingCodeError�MissingRedirectURIError�MissingResponseTypeError�MissingTokenError�MissingTokenTypeError� OAuth2Error� ServerError�TemporarilyUnavailableError�TokenExpiredError�UnauthorizedClientError�UnsupportedGrantTypeError� UnsupportedResponseTypeError�UnsupportedTokenTypeError)�AuthorizationCodeGrant�ClientCredentialsGrant� ImplicitGrant�RefreshTokenGrant�%ResourceOwnerPasswordCredentialsGrant)�RequestValidator)� BearerToken� OAuth2Token)�is_secure_transportN)<�__doc__Zrfc6749.clientsr r r r r r Zrfc6749.endpointsr r r r r r r r r r r Zrfc6749.errorsr r r r r r r r r r r r r r r! r" r# r$ r% r& r' r( r) r* r+ r, Zrfc6749.grant_typesr- r. r/ r0 r1 Zrfc6749.request_validatorr2 Zrfc6749.tokensr3 r4 Z rfc6749.utilsr5 � r7 r7 �</usr/lib/python3.9/site-packages/oauthlib/oauth2/__init__.py�<module> s 4p oauth2/__init__.py 0000644 00000003023 15125174064 0010062 0 ustar 00 """ oauthlib.oauth2 ~~~~~~~~~~~~~~ This module is a wrapper for the most recent implementation of OAuth 2.0 Client and Server classes. """ from .rfc6749.clients import ( BackendApplicationClient, Client, LegacyApplicationClient, MobileApplicationClient, ServiceApplicationClient, WebApplicationClient, ) from .rfc6749.endpoints import ( AuthorizationEndpoint, BackendApplicationServer, IntrospectEndpoint, LegacyApplicationServer, MetadataEndpoint, MobileApplicationServer, ResourceEndpoint, RevocationEndpoint, Server, TokenEndpoint, WebApplicationServer, ) from .rfc6749.errors import ( AccessDeniedError, FatalClientError, InsecureTransportError, InvalidClientError, InvalidClientIdError, InvalidGrantError, InvalidRedirectURIError, InvalidRequestError, InvalidRequestFatalError, InvalidScopeError, MismatchingRedirectURIError, MismatchingStateError, MissingClientIdError, MissingCodeError, MissingRedirectURIError, MissingResponseTypeError, MissingTokenError, MissingTokenTypeError, OAuth2Error, ServerError, TemporarilyUnavailableError, TokenExpiredError, UnauthorizedClientError, UnsupportedGrantTypeError, UnsupportedResponseTypeError, UnsupportedTokenTypeError, ) from .rfc6749.grant_types import ( AuthorizationCodeGrant, ClientCredentialsGrant, ImplicitGrant, RefreshTokenGrant, ResourceOwnerPasswordCredentialsGrant, ) from .rfc6749.request_validator import RequestValidator from .rfc6749.tokens import BearerToken, OAuth2Token from .rfc6749.utils import is_secure_transport uri_validate.py 0000644 00000013740 15125174064 0007600 0 ustar 00 """ Regex for URIs These regex are directly derived from the collected ABNF in RFC3986 (except for DIGIT, ALPHA and HEXDIG, defined by RFC2234). They should be processed with re.VERBOSE. Thanks Mark Nottingham for this code - https://gist.github.com/138549 """ import re # basics DIGIT = r"[\x30-\x39]" ALPHA = r"[\x41-\x5A\x61-\x7A]" HEXDIG = r"[\x30-\x39A-Fa-f]" # pct-encoded = "%" HEXDIG HEXDIG pct_encoded = r" %% %(HEXDIG)s %(HEXDIG)s" % locals() # unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~" unreserved = r"(?: %(ALPHA)s | %(DIGIT)s | \- | \. | _ | ~ )" % locals() # gen-delims = ":" / "/" / "?" / "#" / "[" / "]" / "@" gen_delims = r"(?: : | / | \? | \# | \[ | \] | @ )" # sub-delims = "!" / "$" / "&" / "'" / "(" / ")" # / "*" / "+" / "," / ";" / "=" sub_delims = r"""(?: ! | \$ | & | ' | \( | \) | \* | \+ | , | ; | = )""" # pchar = unreserved / pct-encoded / sub-delims / ":" / "@" pchar = r"(?: %(unreserved)s | %(pct_encoded)s | %(sub_delims)s | : | @ )" % locals( ) # reserved = gen-delims / sub-delims reserved = r"(?: %(gen_delims)s | %(sub_delims)s )" % locals() # scheme # scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) scheme = r"%(ALPHA)s (?: %(ALPHA)s | %(DIGIT)s | \+ | \- | \. )*" % locals() # authority # dec-octet = DIGIT ; 0-9 # / %x31-39 DIGIT ; 10-99 # / "1" 2DIGIT ; 100-199 # / "2" %x30-34 DIGIT ; 200-249 # / "25" %x30-35 ; 250-255 dec_octet = r"""(?: %(DIGIT)s | [\x31-\x39] %(DIGIT)s | 1 %(DIGIT)s{2} | 2 [\x30-\x34] %(DIGIT)s | 25 [\x30-\x35] ) """ % locals() # IPv4address = dec-octet "." dec-octet "." dec-octet "." dec-octet IPv4address = r"%(dec_octet)s \. %(dec_octet)s \. %(dec_octet)s \. %(dec_octet)s" % locals( ) # IPv6address IPv6address = r"([A-Fa-f0-9:]+[:$])[A-Fa-f0-9]{1,4}" # IPvFuture = "v" 1*HEXDIG "." 1*( unreserved / sub-delims / ":" ) IPvFuture = r"v %(HEXDIG)s+ \. (?: %(unreserved)s | %(sub_delims)s | : )+" % locals() # IP-literal = "[" ( IPv6address / IPvFuture ) "]" IP_literal = r"\[ (?: %(IPv6address)s | %(IPvFuture)s ) \]" % locals() # reg-name = *( unreserved / pct-encoded / sub-delims ) reg_name = r"(?: %(unreserved)s | %(pct_encoded)s | %(sub_delims)s )*" % locals() # userinfo = *( unreserved / pct-encoded / sub-delims / ":" ) userinfo = r"(?: %(unreserved)s | %(pct_encoded)s | %(sub_delims)s | : )" % locals( ) # host = IP-literal / IPv4address / reg-name host = r"(?: %(IP_literal)s | %(IPv4address)s | %(reg_name)s )" % locals() # port = *DIGIT port = r"(?: %(DIGIT)s )*" % locals() # authority = [ userinfo "@" ] host [ ":" port ] authority = r"(?: %(userinfo)s @)? %(host)s (?: : %(port)s)?" % locals() # Path # segment = *pchar segment = r"%(pchar)s*" % locals() # segment-nz = 1*pchar segment_nz = r"%(pchar)s+" % locals() # segment-nz-nc = 1*( unreserved / pct-encoded / sub-delims / "@" ) # ; non-zero-length segment without any colon ":" segment_nz_nc = r"(?: %(unreserved)s | %(pct_encoded)s | %(sub_delims)s | @ )+" % locals() # path-abempty = *( "/" segment ) path_abempty = r"(?: / %(segment)s )*" % locals() # path-absolute = "/" [ segment-nz *( "/" segment ) ] path_absolute = r"/ (?: %(segment_nz)s (?: / %(segment)s )* )?" % locals() # path-noscheme = segment-nz-nc *( "/" segment ) path_noscheme = r"%(segment_nz_nc)s (?: / %(segment)s )*" % locals() # path-rootless = segment-nz *( "/" segment ) path_rootless = r"%(segment_nz)s (?: / %(segment)s )*" % locals() # path-empty = 0<pchar> path_empty = r"" # FIXME # path = path-abempty ; begins with "/" or is empty # / path-absolute ; begins with "/" but not "//" # / path-noscheme ; begins with a non-colon segment # / path-rootless ; begins with a segment # / path-empty ; zero characters path = r"""(?: %(path_abempty)s | %(path_absolute)s | %(path_noscheme)s | %(path_rootless)s | %(path_empty)s ) """ % locals() ### Query and Fragment # query = *( pchar / "/" / "?" ) query = r"(?: %(pchar)s | / | \? )*" % locals() # fragment = *( pchar / "/" / "?" ) fragment = r"(?: %(pchar)s | / | \? )*" % locals() # URIs # hier-part = "//" authority path-abempty # / path-absolute # / path-rootless # / path-empty hier_part = r"""(?: (?: // %(authority)s %(path_abempty)s ) | %(path_absolute)s | %(path_rootless)s | %(path_empty)s ) """ % locals() # relative-part = "//" authority path-abempty # / path-absolute # / path-noscheme # / path-empty relative_part = r"""(?: (?: // %(authority)s %(path_abempty)s ) | %(path_absolute)s | %(path_noscheme)s | %(path_empty)s ) """ % locals() # relative-ref = relative-part [ "?" query ] [ "#" fragment ] relative_ref = r"%(relative_part)s (?: \? %(query)s)? (?: \# %(fragment)s)?" % locals( ) # URI = scheme ":" hier-part [ "?" query ] [ "#" fragment ] URI = r"^(?: %(scheme)s : %(hier_part)s (?: \? %(query)s )? (?: \# %(fragment)s )? )$" % locals( ) # URI-reference = URI / relative-ref URI_reference = r"^(?: %(URI)s | %(relative_ref)s )$" % locals() # absolute-URI = scheme ":" hier-part [ "?" query ] absolute_URI = r"^(?: %(scheme)s : %(hier_part)s (?: \? %(query)s )? )$" % locals( ) def is_uri(uri): return re.match(URI, uri, re.VERBOSE) def is_uri_reference(uri): return re.match(URI_reference, uri, re.VERBOSE) def is_absolute_uri(uri): return re.match(absolute_URI, uri, re.VERBOSE) signals.py 0000644 00000002721 15125174064 0006565 0 ustar 00 """ Implements signals based on blinker if available, otherwise falls silently back to a noop. Shamelessly stolen from flask.signals: https://github.com/mitsuhiko/flask/blob/master/flask/signals.py """ signals_available = False try: from blinker import Namespace signals_available = True except ImportError: # noqa class Namespace: def signal(self, name, doc=None): return _FakeSignal(name, doc) class _FakeSignal: """If blinker is unavailable, create a fake class with the same interface that allows sending of signals but will fail with an error on anything else. Instead of doing anything on send, it will just ignore the arguments and do nothing instead. """ def __init__(self, name, doc=None): self.name = name self.__doc__ = doc def _fail(self, *args, **kwargs): raise RuntimeError('signalling support is unavailable ' 'because the blinker library is ' 'not installed.') send = lambda *a, **kw: None connect = disconnect = has_receivers_for = receivers_for = \ temporarily_connected_to = connected_to = _fail del _fail # The namespace for code signals. If you are not oauthlib code, do # not put signals in here. Create your own namespace instead. _signals = Namespace() # Core signals. scope_changed = _signals.signal('scope-changed') oauth1/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000002122 15125174064 0015306 0 ustar 00 a �#/d� � @ s� d Z ddlmZ ddlmZmZmZmZmZ ddlmZm Z ddlm Z ddl m Z ddl mZmZ ddl mZmZ dd l mZmZ dd lmZmZmZmZmZ d S ) z� oauthlib.oauth1 ~~~~~~~~~~~~~~ This module is a wrapper for the most recent implementation of OAuth 1.0 Client and Server classes. � )�Client)�SIGNATURE_HMAC�SIGNATURE_HMAC_SHA1�SIGNATURE_HMAC_SHA256�SIGNATURE_HMAC_SHA512�SIGNATURE_PLAINTEXT)�SIGNATURE_TYPE_AUTH_HEADER�SIGNATURE_TYPE_QUERY)�SIGNATURE_TYPE_BODY)�RequestValidator)�RequestTokenEndpoint�AuthorizationEndpoint)�AccessTokenEndpoint�ResourceEndpoint)�SignatureOnlyEndpoint�WebApplicationServer)�InsecureTransportError�InvalidClientError�InvalidRequestError�InvalidSignatureMethodError� OAuth1ErrorN)�__doc__Zrfc5849r r r r r r r r r Zrfc5849.request_validatorr Zrfc5849.endpointsr r r r r r Zrfc5849.errorsr r r r r � r r �</usr/lib/python3.9/site-packages/oauthlib/oauth1/__init__.py�<module> s oauth1/__pycache__/__init__.cpython-39.pyc 0000644 00000002122 15125174064 0014347 0 ustar 00 a �#/d� � @ s� d Z ddlmZ ddlmZmZmZmZmZ ddlmZm Z ddlm Z ddl m Z ddl mZmZ ddl mZmZ dd l mZmZ dd lmZmZmZmZmZ d S ) z� oauthlib.oauth1 ~~~~~~~~~~~~~~ This module is a wrapper for the most recent implementation of OAuth 1.0 Client and Server classes. � )�Client)�SIGNATURE_HMAC�SIGNATURE_HMAC_SHA1�SIGNATURE_HMAC_SHA256�SIGNATURE_HMAC_SHA512�SIGNATURE_PLAINTEXT)�SIGNATURE_TYPE_AUTH_HEADER�SIGNATURE_TYPE_QUERY)�SIGNATURE_TYPE_BODY)�RequestValidator)�RequestTokenEndpoint�AuthorizationEndpoint)�AccessTokenEndpoint�ResourceEndpoint)�SignatureOnlyEndpoint�WebApplicationServer)�InsecureTransportError�InvalidClientError�InvalidRequestError�InvalidSignatureMethodError� OAuth1ErrorN)�__doc__Zrfc5849r r r r r r r r r Zrfc5849.request_validatorr Zrfc5849.endpointsr r r r r r Zrfc5849.errorsr r r r r � r r �</usr/lib/python3.9/site-packages/oauthlib/oauth1/__init__.py�<module> s oauth1/rfc5849/__pycache__/request_validator.cpython-39.opt-1.pyc 0000644 00000101145 15125174064 0020415 0 ustar 00 a \��` y � @ s& d Z ddlmZmZ G dd� d�ZdS )z� oauthlib.oauth1.rfc5849 ~~~~~~~~~~~~~~ This module is an implementation of various logic needed for signing and checking OAuth 1.0 RFC 5849 requests. � )�SIGNATURE_METHODS�utilsc @ s� e Zd ZdZdd� Zedd� �Zedd� �Zedd � �Zed d � �Z ed d � �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zed&d'� �Zed(d)� �Zed*d+� �Zd,d-� Zd.d/� Zd0d1� Z d2d3� Z d4d5� Z d6d7� Z d8d9� Z d:d;� Z!d<d=� Z"d>d?� Z#d@dA� Z$dWdCdD�Z%dEdF� Z&dGdH� Z'dXdIdJ�Z(dKdL� Z)dMdN� Z*dOdP� Z+dQdR� Z,dSdT� Z-dUdV� Z.dBS )Y�RequestValidatora� A validator/datastore interaction base class for OAuth 1 providers. OAuth providers should inherit from RequestValidator and implement the methods and properties outlined below. Further details are provided in the documentation for each method and property. Methods used to check the format of input parameters. Common tests include length, character set, membership, range or pattern. These tests are referred to as `whitelisting or blacklisting`_. Whitelisting is better but blacklisting can be usefull to spot malicious activity. The following have methods a default implementation: - check_client_key - check_request_token - check_access_token - check_nonce - check_verifier - check_realms The methods above default to whitelist input parameters, checking that they are alphanumerical and between a minimum and maximum length. Rather than overloading the methods a few properties can be used to configure these methods. * @safe_characters -> (character set) * @client_key_length -> (min, max) * @request_token_length -> (min, max) * @access_token_length -> (min, max) * @nonce_length -> (min, max) * @verifier_length -> (min, max) * @realms -> [list, of, realms] Methods used to validate/invalidate input parameters. These checks usually hit either persistent or temporary storage such as databases or the filesystem. See each methods documentation for detailed usage. The following methods must be implemented: - validate_client_key - validate_request_token - validate_access_token - validate_timestamp_and_nonce - validate_redirect_uri - validate_requested_realms - validate_realms - validate_verifier - invalidate_request_token Methods used to retrieve sensitive information from storage. The following methods must be implemented: - get_client_secret - get_request_token_secret - get_access_token_secret - get_rsa_key - get_realms - get_default_realms - get_redirect_uri Methods used to save credentials. The following methods must be implemented: - save_request_token - save_verifier - save_access_token Methods used to verify input parameters. This methods are used during authorizing request token by user (AuthorizationEndpoint), to check if parameters are valid. During token authorization request is not signed, thus 'validation' methods can not be used. The following methods must be implemented: - verify_realms - verify_request_token To prevent timing attacks it is necessary to not exit early even if the client key or resource owner key is invalid. Instead dummy values should be used during the remaining verification process. It is very important that the dummy client and token are valid input parameters to the methods get_client_secret, get_rsa_key and get_(access/request)_token_secret and that the running time of those methods when given a dummy value remain equivalent to the running time when given a valid client/resource owner. The following properties must be implemented: * @dummy_client * @dummy_request_token * @dummy_access_token Example implementations have been provided, note that the database used is a simple dictionary and serves only an illustrative purpose. Use whichever database suits your project and how to access it is entirely up to you. The methods are introduced in an order which should make understanding their use more straightforward and as such it could be worth reading what follows in chronological order. .. _`whitelisting or blacklisting`: https://www.schneier.com/blog/archives/2011/01/whitelisting_vs.html c C s d S �N� ��selfr r �M/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/request_validator.py�__init__n s zRequestValidator.__init__c C s t S r )r r r r r �allowed_signature_methodsq s z*RequestValidator.allowed_signature_methodsc C s t tj�S r )�setr ZUNICODE_ASCII_CHARACTER_SETr r r r �safe_charactersu s z RequestValidator.safe_charactersc C s dS �N)� � r r r r r �client_key_lengthy s z"RequestValidator.client_key_lengthc C s dS r r r r r r �request_token_length} s z%RequestValidator.request_token_lengthc C s dS r r r r r r �access_token_length� s z$RequestValidator.access_token_lengthc C s dS )NiX r r r r r �timestamp_lifetime� s z#RequestValidator.timestamp_lifetimec C s dS r r r r r r � nonce_length� s z RequestValidator.nonce_lengthc C s dS r r r r r r �verifier_length� s z RequestValidator.verifier_lengthc C s g S r r r r r r �realms� s zRequestValidator.realmsc C s dS )NTr r r r r � enforce_ssl� s z RequestValidator.enforce_sslc C s4 | j \}}t|�| jko2|t|� ko.|kS S )zCheck that the client key only contains safe characters and is no shorter than lower and no longer than upper. )r r r �len)r � client_key�lower�upperr r r �check_client_key� s �z!RequestValidator.check_client_keyc C s4 | j \}}t|�| jko2|t|� ko.|kS S )z�Checks that the request token contains only safe characters and is no shorter than lower and no longer than upper. )r r r r �r � request_tokenr r r r r �check_request_token� s �z$RequestValidator.check_request_tokenc C s4 | j \}}t|�| jko2|t|� ko.|kS S )z{Checks that the token contains only safe characters and is no shorter than lower and no longer than upper. )r r r r r r r r �check_access_token� s �z#RequestValidator.check_access_tokenc C s4 | j \}}t|�| jko2|t|� ko.|kS S )z�Checks that the nonce only contains only safe characters and is no shorter than lower and no longer than upper. )r r r r )r �noncer r r r r � check_nonce� s �z RequestValidator.check_noncec C s4 | j \}}t|�| jko2|t|� ko.|kS S )z~Checks that the verifier contains only safe characters and is no shorter than lower and no longer than upper. )r r r r )r �verifierr r r r r �check_verifier� s �z RequestValidator.check_verifierc s t � fdd�|D ��S )z4Check that the realm is one of a set allowed realms.c 3 s | ]}|� j v V qd S r )r )�.0�rr r r � <genexpr>� � z0RequestValidator.check_realms.<locals>.<genexpr>)�all)r r r r r � check_realms� s z RequestValidator.check_realmsc C s d� t| �|�}t|�S )z� Returns a NotImplementedError for a function that should be implemented. :param fn: name of the function z)Missing function implementation in {}: {})�format�type�NotImplementedError)r �fn�mr r r �_subclass_must_implement� s z)RequestValidator._subclass_must_implementc C s | � d��dS )aT Dummy client used when an invalid client key is supplied. :returns: The dummy client key string. The dummy client should be associated with either a client secret, a rsa key or both depending on which signature methods are supported. Providers should make sure that get_client_secret(dummy_client) get_rsa_key(dummy_client) return a valid secret or key for the dummy client. This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint � dummy_clientN�r1 r r r r r2 � s z RequestValidator.dummy_clientc C s | � d��dS )am Dummy request token used when an invalid token was supplied. :returns: The dummy request token string. The dummy request token should be associated with a request token secret such that get_request_token_secret(.., dummy_request_token) returns a valid secret. This method is used by * AccessTokenEndpoint �dummy_request_tokenNr3 r r r r r4 � s z$RequestValidator.dummy_request_tokenc C s | � d��dS )ae Dummy access token used when an invalid token was supplied. :returns: The dummy access token string. The dummy access token should be associated with an access token secret such that get_access_token_secret(.., dummy_access_token) returns a valid secret. This method is used by * ResourceEndpoint �dummy_access_tokenNr3 r r r r r5 � s z#RequestValidator.dummy_access_tokenc C s | � d��dS )a� Retrieves the client secret associated with the client key. :param client_key: The client/consumer key. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The client secret as a string. This method must allow the use of a dummy client_key value. Fetching the secret using the dummy key must take the same amount of time as fetching a secret for a valid client:: # Unlikely to be near constant time as it uses two database # lookups for a valid client, and only one for an invalid. from your_datastore import ClientSecret if ClientSecret.has(client_key): return ClientSecret.get(client_key) else: return 'dummy' # Aim to mimic number of latency inducing operations no matter # whether the client is valid or not. from your_datastore import ClientSecret return ClientSecret.get(client_key, 'dummy') Note that the returned key must be in plaintext. This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint �get_client_secretNr3 �r r �requestr r r r6 s "z"RequestValidator.get_client_secretc C s | � d��dS )a� Retrieves the shared secret associated with the request token. :param client_key: The client/consumer key. :param token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The token secret as a string. This method must allow the use of a dummy values and the running time must be roughly equivalent to that of the running time of valid values:: # Unlikely to be near constant time as it uses two database # lookups for a valid client, and only one for an invalid. from your_datastore import RequestTokenSecret if RequestTokenSecret.has(client_key): return RequestTokenSecret.get((client_key, request_token)) else: return 'dummy' # Aim to mimic number of latency inducing operations no matter # whether the client is valid or not. from your_datastore import RequestTokenSecret return ClientSecret.get((client_key, request_token), 'dummy') Note that the returned key must be in plaintext. This method is used by * AccessTokenEndpoint �get_request_token_secretNr3 �r r �tokenr8 r r r r9 ) s z)RequestValidator.get_request_token_secretc C s | � d��dS )a� Retrieves the shared secret associated with the access token. :param client_key: The client/consumer key. :param token: The access token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The token secret as a string. This method must allow the use of a dummy values and the running time must be roughly equivalent to that of the running time of valid values:: # Unlikely to be near constant time as it uses two database # lookups for a valid client, and only one for an invalid. from your_datastore import AccessTokenSecret if AccessTokenSecret.has(client_key): return AccessTokenSecret.get((client_key, request_token)) else: return 'dummy' # Aim to mimic number of latency inducing operations no matter # whether the client is valid or not. from your_datastore import AccessTokenSecret return ClientSecret.get((client_key, request_token), 'dummy') Note that the returned key must be in plaintext. This method is used by * ResourceEndpoint �get_access_token_secretNr3 r: r r r r< J s z(RequestValidator.get_access_token_secretc C s | � d��dS )a� Get the default realms for a client. :param client_key: The client/consumer key. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The list of default realms associated with the client. The list of default realms will be set during client registration and is outside the scope of OAuthLib. This method is used by * RequestTokenEndpoint �get_default_realmsNr3 r7 r r r r= k s z#RequestValidator.get_default_realmsc C s | � d��dS )ae Get realms associated with a request token. :param token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The list of realms associated with the request token. This method is used by * AuthorizationEndpoint * AccessTokenEndpoint � get_realmsNr3 �r r; r8 r r r r> | s zRequestValidator.get_realmsc C s | � d��dS )a& Get the redirect URI associated with a request token. :param token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The redirect URI associated with the request token. It may be desirable to return a custom URI if the redirect is set to "oob". In this case, the user will be redirected to the returned URI and at that endpoint the verifier can be displayed. This method is used by * AuthorizationEndpoint �get_redirect_uriNr3 r? r r r r@ � s z!RequestValidator.get_redirect_uric C s | � d��dS )a� Retrieves a previously stored client provided RSA key. :param client_key: The client/consumer key. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The rsa public key as a string. This method must allow the use of a dummy client_key value. Fetching the rsa key using the dummy key must take the same amount of time as fetching a key for a valid client. The dummy key must also be of the same bit length as client keys. Note that the key must be returned in plaintext. This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint � get_rsa_keyNr3 r7 r r r rA � s z RequestValidator.get_rsa_keyc C s | � d��dS )aK Invalidates a used request token. :param client_key: The client/consumer key. :param request_token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: None Per `Section 2.3`__ of the spec: "The server MUST (...) ensure that the temporary credentials have not expired or been used before." .. _`Section 2.3`: https://tools.ietf.org/html/rfc5849#section-2.3 This method should ensure that provided token won't validate anymore. It can be simply removing RequestToken from storage or setting specific flag that makes it invalid (note that such flag should be also validated during request token validation). This method is used by * AccessTokenEndpoint �invalidate_request_tokenNr3 )r r r r8 r r r rB � s z)RequestValidator.invalidate_request_tokenc C s | � d��dS )a+ Validates that supplied client key is a registered and valid client. :param client_key: The client/consumer key. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False Note that if the dummy client is supplied it should validate in same or nearly the same amount of time as a valid one. Ensure latency inducing tasks are mimiced even for dummy clients. For example, use:: from your_datastore import Client try: return Client.exists(client_key, access_token) except DoesNotExist: return False Rather than:: from your_datastore import Client if access_token == self.dummy_access_token: return False else: return Client.exists(client_key, access_token) This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint �validate_client_keyNr3 r7 r r r rC � s #z$RequestValidator.validate_client_keyc C s | � d��dS )a Validates that supplied request token is registered and valid. :param client_key: The client/consumer key. :param token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False Note that if the dummy request_token is supplied it should validate in the same nearly the same amount of time as a valid one. Ensure latency inducing tasks are mimiced even for dummy clients. For example, use:: from your_datastore import RequestToken try: return RequestToken.exists(client_key, access_token) except DoesNotExist: return False Rather than:: from your_datastore import RequestToken if access_token == self.dummy_access_token: return False else: return RequestToken.exists(client_key, access_token) This method is used by * AccessTokenEndpoint �validate_request_tokenNr3 r: r r r rD � s !z'RequestValidator.validate_request_tokenc C s | � d��dS )a Validates that supplied access token is registered and valid. :param client_key: The client/consumer key. :param token: The access token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False Note that if the dummy access token is supplied it should validate in the same or nearly the same amount of time as a valid one. Ensure latency inducing tasks are mimiced even for dummy clients. For example, use:: from your_datastore import AccessToken try: return AccessToken.exists(client_key, access_token) except DoesNotExist: return False Rather than:: from your_datastore import AccessToken if access_token == self.dummy_access_token: return False else: return AccessToken.exists(client_key, access_token) This method is used by * ResourceEndpoint �validate_access_tokenNr3 r: r r r rE s !z&RequestValidator.validate_access_tokenNc C s | � d��dS )a9 Validates that the nonce has not been used before. :param client_key: The client/consumer key. :param timestamp: The ``oauth_timestamp`` parameter. :param nonce: The ``oauth_nonce`` parameter. :param request_token: Request token string, if any. :param access_token: Access token string, if any. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False Per `Section 3.3`_ of the spec. "A nonce is a random string, uniquely generated by the client to allow the server to verify that a request has never been made before and helps prevent replay attacks when requests are made over a non-secure channel. The nonce value MUST be unique across all requests with the same timestamp, client credentials, and token combinations." .. _`Section 3.3`: https://tools.ietf.org/html/rfc5849#section-3.3 One of the first validation checks that will be made is for the validity of the nonce and timestamp, which are associated with a client key and possibly a token. If invalid then immediately fail the request by returning False. If the nonce/timestamp pair has been used before and you may just have detected a replay attack. Therefore it is an essential part of OAuth security that you not allow nonce/timestamp reuse. Note that this validation check is done before checking the validity of the client and token.:: nonces_and_timestamps_database = [ (u'foo', 1234567890, u'rannoMstrInghere', u'bar') ] def validate_timestamp_and_nonce(self, client_key, timestamp, nonce, request_token=None, access_token=None): return ((client_key, timestamp, nonce, request_token or access_token) not in self.nonces_and_timestamps_database) This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint � validate_timestamp_and_nonceNr3 )r r Z timestampr" r8 r Z access_tokenr r r rF ; s 1z-RequestValidator.validate_timestamp_and_noncec C s | � d��dS )a Validates the client supplied redirection URI. :param client_key: The client/consumer key. :param redirect_uri: The URI the client which to redirect back to after authorization is successful. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False It is highly recommended that OAuth providers require their clients to register all redirection URIs prior to using them in requests and register them as absolute URIs. See `CWE-601`_ for more information about open redirection attacks. By requiring registration of all redirection URIs it should be straightforward for the provider to verify whether the supplied redirect_uri is valid or not. Alternatively per `Section 2.1`_ of the spec: "If the client is unable to receive callbacks or a callback URI has been established via other means, the parameter value MUST be set to "oob" (case sensitive), to indicate an out-of-band configuration." .. _`CWE-601`: http://cwe.mitre.org/top25/index.html#CWE-601 .. _`Section 2.1`: https://tools.ietf.org/html/rfc5849#section-2.1 This method is used by * RequestTokenEndpoint �validate_redirect_uriNr3 )r r Z redirect_urir8 r r r rG n s z&RequestValidator.validate_redirect_uric C s | � d��dS )aT Validates that the client may request access to the realm. :param client_key: The client/consumer key. :param realms: The list of realms that client is requesting access to. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False This method is invoked when obtaining a request token and should tie a realm to the request token and after user authorization this realm restriction should transfer to the access token. This method is used by * RequestTokenEndpoint �validate_requested_realmsNr3 )r r r r8 r r r rH � s z*RequestValidator.validate_requested_realmsc C s | � d��dS )aR Validates access to the request realm. :param client_key: The client/consumer key. :param token: A request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :param uri: The URI the realms is protecting. :param realms: A list of realms that must have been granted to the access token. :returns: True or False How providers choose to use the realm parameter is outside the OAuth specification but it is commonly used to restrict access to a subset of protected resources such as "photos". realms is a convenience parameter which can be used to provide a per view method pre-defined list of allowed realms. Can be as simple as:: from your_datastore import RequestToken request_token = RequestToken.get(token, None) if not request_token: return False return set(request_token.realms).issuperset(set(realms)) This method is used by * ResourceEndpoint �validate_realmsNr3 )r r r; r8 Zurir r r r rI � s !z RequestValidator.validate_realmsc C s | � d��dS )a� Validates a verification code. :param client_key: The client/consumer key. :param token: A request token string. :param verifier: The authorization verifier string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False OAuth providers issue a verification code to clients after the resource owner authorizes access. This code is used by the client to obtain token credentials and the provider must verify that the verifier is valid and associated with the client as well as the resource owner. Verifier validation should be done in near constant time (to avoid verifier enumeration). To achieve this we need a constant time string comparison which is provided by OAuthLib in ``oauthlib.common.safe_string_equals``:: from your_datastore import Verifier correct_verifier = Verifier.get(client_key, request_token) from oauthlib.common import safe_string_equals return safe_string_equals(verifier, correct_verifier) This method is used by * AccessTokenEndpoint �validate_verifierNr3 )r r r; r$ r8 r r r rJ � s z"RequestValidator.validate_verifierc C s | � d��dS )a) Verify that the given OAuth1 request token is valid. :param token: A request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False This method is used only in AuthorizationEndpoint to check whether the oauth_token given in the authorization URL is valid or not. This request is not signed and thus similar ``validate_request_token`` method can not be used. This method is used by * AuthorizationEndpoint �verify_request_tokenNr3 r? r r r rK � s z%RequestValidator.verify_request_tokenc C s | � d��dS )a� Verify authorized realms to see if they match those given to token. :param token: An access token string. :param realms: A list of realms the client attempts to access. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False This prevents the list of authorized realms sent by the client during the authorization step to be altered to include realms outside what was bound with the request token. Can be as simple as:: valid_realms = self.get_realms(token) return all((r in valid_realms for r in realms)) This method is used by * AuthorizationEndpoint � verify_realmsNr3 )r r; r r8 r r r rL � s z RequestValidator.verify_realmsc C s | � d��dS )a� Save an OAuth1 access token. :param token: A dict with token credentials. :param request: OAuthlib request. :type request: oauthlib.common.Request The token dictionary will at minimum include * ``oauth_token`` the access token string. * ``oauth_token_secret`` the token specific secret used in signing. * ``oauth_authorized_realms`` a space separated list of realms. Client key can be obtained from ``request.client_key``. The list of realms (not joined string) can be obtained from ``request.realm``. This method is used by * AccessTokenEndpoint �save_access_tokenNr3 r? r r r rM s z"RequestValidator.save_access_tokenc C s | � d��dS )a) Save an OAuth1 request token. :param token: A dict with token credentials. :param request: OAuthlib request. :type request: oauthlib.common.Request The token dictionary will at minimum include * ``oauth_token`` the request token string. * ``oauth_token_secret`` the token specific secret used in signing. * ``oauth_callback_confirmed`` the string ``true``. Client key can be obtained from ``request.client_key``. This method is used by * RequestTokenEndpoint �save_request_tokenNr3 r? r r r rN ) s z#RequestValidator.save_request_tokenc C s | � d��dS )ai Associate an authorization verifier with a request token. :param token: A request token string. :param verifier A dictionary containing the oauth_verifier and oauth_token :param request: OAuthlib request. :type request: oauthlib.common.Request We need to associate verifiers with tokens for validation during the access token request. Note that unlike save_x_token token here is the ``oauth_token`` token string from the request token saved previously. This method is used by * AuthorizationEndpoint � save_verifierNr3 )r r; r$ r8 r r r rO > s z RequestValidator.save_verifier)NN)NN)/�__name__� __module__� __qualname__�__doc__r �propertyr r r r r r r r r r r r r! r# r% r+ r1 r2 r4 r5 r6 r9 r< r= r> r@ rA rB rC rD rE rF rG rH rI rJ rK rL rM rN rO r r r r r sv a $!!%#$ � 3" � # r N)rS � r r r r r r r �<module> s oauth1/rfc5849/__pycache__/parameters.cpython-39.opt-1.pyc 0000644 00000006322 15125174064 0017024 0 ustar 00 a \��`� � @ s\ d Z ddlmZmZ ddlmZmZ ddlmZ ej ddd��Z d d � Z d d � Z d d� Z dS )z� oauthlib.parameters ~~~~~~~~~~~~~~~~~~~ This module contains methods related to `section 3.5`_ of the OAuth 1.0a spec. .. _`section 3.5`: https://tools.ietf.org/html/rfc5849#section-3.5 � )�urlparse� urlunparse)�extract_params� urlencode� )�utilsNc C s� |pi }g }| D ]2\}}t �|�}t �|�}d�||�}|�|� qd�|�} |r^d| | } d| } i } | �|� | | d< | S )a **Prepare the Authorization header.** Per `section 3.5.1`_ of the spec. Protocol parameters can be transmitted using the HTTP "Authorization" header field as defined by `RFC2617`_ with the auth-scheme name set to "OAuth" (case insensitive). For example:: Authorization: OAuth realm="Example", oauth_consumer_key="0685bd9184jfhq22", oauth_token="ad180jjd733klru7", oauth_signature_method="HMAC-SHA1", oauth_signature="wOJIO9A2W5mFwDgiDvZbTSMK%2FPY%3D", oauth_timestamp="137131200", oauth_nonce="4572616e48616d6d65724c61686176", oauth_version="1.0" .. _`section 3.5.1`: https://tools.ietf.org/html/rfc5849#section-3.5.1 .. _`RFC2617`: https://tools.ietf.org/html/rfc2617 z{}="{}"z, z realm="%s", zOAuth %sZ Authorization)r �escape�format�append�join�update) � oauth_paramsZheadersZrealmZ%authorization_header_parameters_partsZoauth_parameter_name�valueZ escaped_nameZ escaped_value�partZ authorization_header_parametersZauthorization_headerZ full_headers� r �F/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/parameters.py�prepare_headers s& �� r c C s& t |�}|�| � |jdd� d� |S )a> Append OAuth params to an existing set of parameters. Both params and oauth_params is must be lists of 2-tuples. Per `section 3.5.2`_ and `3.5.3`_ of the spec. .. _`section 3.5.2`: https://tools.ietf.org/html/rfc5849#section-3.5.2 .. _`3.5.3`: https://tools.ietf.org/html/rfc5849#section-3.5.3 c S s | d � d�S )Nr Zoauth_)� startswith)�ir r r �<lambda>i � z _append_params.<locals>.<lambda>)�key)�list�extend�sort)r �paramsZmergedr r r �_append_paramsX s r c C s t | |�S )z�Prepare the Form-Encoded Body. Per `section 3.5.2`_ of the spec. .. _`section 3.5.2`: https://tools.ietf.org/html/rfc5849#section-3.5.2 )r )r �bodyr r r �prepare_form_encoded_bodym s r c C s> t |�\}}}}}}tt| t|�p$g ��}t||||||f�S )z�Prepare the Request URI Query. Per `section 3.5.3`_ of the spec. .. _`section 3.5.3`: https://tools.ietf.org/html/rfc5849#section-3.5.3 )r r r r r )r ZuriZschZnet�pathZpar�queryZfrar r r �prepare_request_uri_queryy s �r! )NN)�__doc__� urllib.parser r Zoauthlib.commonr r � r Z filter_paramsr r r r! r r r r �<module> s E oauth1/rfc5849/__pycache__/signature.cpython-39.pyc 0000644 00000041664 15125174064 0015733 0 ustar 00 a �#/d|y � @ s� d Z ddlZddlZddlZddlZddlZddlZddlmZm Z m Z ddl m Z ddlmZ e�e�Zeeeed�dd�ZdKeeed �d d �ZdLdd�Zed�dd�Zeeeed�dd�ZdMed�dd�Zdd� ZdNd d �Zd d � Z d d!� Z dOd"d#�Z d$d%� Z ed&�d'd(�Z dPeed)�d*d+�Z!i Z"ed�d,d-�Z#d.d/� Z$eeed0�d1d2�Z%eed3�d4d5�Z&d6d7� Z'ed8�d9d:�Z(d;d<� Z)ed&�d=d>�Z*ed8�d?d@�Z+ed&�dAdB�Z,ed8�dCdD�Z-dEdF� Z.dGdH� Z/dQdIdJ�Z0dS )Ra� This module is an implementation of `section 3.4`_ of RFC 5849. **Usage** Steps for signing a request: 1. Collect parameters from the request using ``collect_parameters``. 2. Normalize those parameters using ``normalize_parameters``. 3. Create the *base string URI* using ``base_string_uri``. 4. Create the *signature base string* from the above three components using ``signature_base_string``. 5. Pass the *signature base string* and the client credentials to one of the sign-with-client functions. The HMAC-based signing functions needs client credentials with secrets. The RSA-based signing functions needs client credentials with an RSA private key. To verify a request, pass the request and credentials to one of the verify functions. The HMAC-based signing functions needs the shared secrets. The RSA-based verify functions needs the RSA public key. **Scope** All of the functions in this module should be considered internal to OAuthLib, since they are not imported into the "oauthlib.oauth1" module. Programs using OAuthLib should not use directly invoke any of the functions in this module. **Deprecated functions** The "sign_" methods that are not "_with_client" have been deprecated. They may be removed in a future release. Since they are all internal functions, this should have no impact on properly behaving programs. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 � N)�extract_params�safe_string_equals� urldecode� )�utils)� http_method� base_str_uri�%normalized_encoded_request_parameters�returnc C s> t �| �� �}|d7 }|t �|�7 }|d7 }|t �|�7 }|S )a� Construct the signature base string. The *signature base string* is the value that is calculated and signed by the client. It is also independently calculated by the server to verify the signature, and therefore must produce the exact same value at both ends or the signature won't verify. The rules for calculating the *signature base string* are defined in section 3.4.1.1`_ of RFC 5849. .. _`section 3.4.1.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.1 �&)r �escape�upper)r r r � base_string� r �E/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/signature.py�signature_base_string7 s r )�uri�hostr c C st t | t�std��t�| �}|j}|j}|j}|j}|j}|sFtd��|sNd}|� � }|durf|� � }|dur�|� � }|� d|� �}t�|�}|j}|j}|du r�td��zt � |�}W n ty� Y n0 t |t j �r�d|� d�}nt |t j �r�|� }|du�r$d | k �rd k�s$n td ��||fd v �r8|}n|�rN|� d |� �}n|}t�||||ddf�} | �dd�S )a� Calculates the _base string URI_. The *base string URI* is one of the components that make up the *signature base string*. The ``host`` is optional. If provided, it is used to override any host and port values in the ``uri``. The value for ``host`` is usually extracted from the "Host" request header from the HTTP request. Its value may be just the hostname, or the hostname followed by a colon and a TCP/IP port number (hostname:port). If a value for the``host`` is provided but it does not contain a port number, the default port number is used (i.e. if the ``uri`` contained a port number, it will be discarded). The rules for calculating the *base string URI* are defined in section 3.4.1.2`_ of RFC 5849. .. _`section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2 :param uri: URI :param host: hostname with optional port number, separated by a colon :return: base string URI zuri must be a string.zmissing scheme�/Nz://z missing host�[�]r i�� zport out of range))�http�P )�httpsi� �:� � z%20)� isinstance�str� ValueError�urlparse�scheme�hostname�port�path�params�lower� ipaddressZ ip_addressZ IPv6AddressZ IPv4Address� urlunparse�replace) r r �outputr! r" r# r$ r% �netloc�vr r r �base_string_urij sP $r- r TFc s� |du r g }|pi }g }| r*|� t| �� |rpdd� |�� D �}|�d�}|durp|� � fdd�t�|�D �� t|�pzg }|� |� g } |D ]*\} } | �d�r�t�| �} | � | | f� q�|r�t t dd � | ��} | S ) a� Gather the request parameters from all the parameter sources. This function is used to extract all the parameters, which are then passed to ``normalize_parameters`` to produce one of the components that make up the *signature base string*. Parameters starting with `oauth_` will be unescaped. Body parameters must be supplied as a dict, a list of 2-tuples, or a form encoded query string. Headers must be supplied as a dict. The rules where the parameters must be sourced from are defined in `section 3.4.1.3.1`_ of RFC 5849. .. _`Sec 3.4.1.3.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.1 Nc S s i | ]\}}|� � |�qS r )r& ��.0�kr, r r r � <dictcomp> � z&collect_parameters.<locals>.<dictcomp>Z authorizationc s g | ]}� s|d dkr|�qS )r Zrealmr )r/ �i�� with_realmr r � <listcomp>! s �z&collect_parameters.<locals>.<listcomp>Zoauth_c S s | d dkS )Nr Zoauth_signaturer )r3 r r r �<lambda>? r2 z$collect_parameters.<locals>.<lambda>) �extendr �items�getr Zparse_authorization_headerr � startswithZunescape�append�list�filter) Z uri_query�bodyZheadersZexclude_oauth_signaturer5 r% Z headers_lowerZauthorization_headerZ bodyparamsZunescaped_paramsr0 r, r r4 r �collect_parameters� s2 � �r@ )r c C s. dd� | D �}|� � dd� |D �}d�|�S )aV Calculate the normalized request parameters. The *normalized request parameters* is one of the components that make up the *signature base string*. The rules for parameter normalization are defined in `section 3.4.1.3.2`_ of RFC 5849. .. _`Sec 3.4.1.3.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.2 c S s$ g | ] \}}t �|�t �|�f�qS r �r r r. r r r r6 [ r2 z(normalize_parameters.<locals>.<listcomp>c S s g | ]\}}d � ||��qS )z{}={})�formatr. r r r r6 e r2 r )�sort�join)r% Z key_valuesZparameter_partsr r r �normalize_parametersE s rE )�hash_algorithm_name� sig_base_str� client_secret�resource_owner_secretc C s� |}t �|pd�}|d7 }|t �|p&d�7 }tjtjtjd�}|| }|�d�}|�d�} t�|| |�} t � | � � �dd� � d�S )a] **HMAC-SHA256** The "HMAC-SHA256" signature method uses the HMAC-SHA256 signature algorithm as defined in `RFC4634`_:: digest = HMAC-SHA256 (key, text) Per `section 3.4.2`_ of the spec. .. _`RFC4634`: https://tools.ietf.org/html/rfc4634 .. _`section 3.4.2`: https://tools.ietf.org/html/rfc5849#section-3.4.2 r r )�SHA-1�SHA-256�SHA-512�utf-8N���) r r �hashlibZsha1Zsha256Zsha512�encode�hmac�new�binascii� b2a_base64�digest�decode) rF rG rH rI �text�key�m�hash_algZkey_utf8Z text_utf8� signaturer r r � _sign_hmaco s � r\ �rF c C sP t |j�}t|j�}t|j||�}t| |||�}t||j�}|sLt � d|� |S )a Verify a HMAC-SHA1 signature. Per `section 3.4`_ of the spec. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri attribute MUST be an absolute URI whose netloc part identifies the origin server or gateway on which the resource resides. Any Host item of the request argument's headers dict attribute will be ignored. .. _`RFC2616 section 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2 z-Verify HMAC failed: signature base string: %s) rE r% r- r r r r\ r r[ �log�debug) rF �requestrH rI � norm_params�bs_urirG r[ �matchr r r � _verify_hmac� s �� rd c C s t d| |j|j�S �NrJ �r\ rH rI �rG �clientr r r �sign_hmac_sha1_with_client� s �ri c C s t d| ||�S re �rd �r` rH rI r r r �verify_hmac_sha1� s rl c C s2 t �dt� t| t�r | �d�n| } td| ||�S )aU Deprecated function for calculating a HMAC-SHA1 signature. This function has been replaced by invoking ``sign_hmac`` with "SHA-1" as the hash algorithm name. This function was invoked by sign_hmac_sha1_with_client and test_signatures.py, but does any application invoke it directly? If not, it can be removed. z8use sign_hmac_sha1_with_client instead of sign_hmac_sha1�asciirJ ��warnings�warn�DeprecationWarningr �bytesrV r\ �r rH rI r r r �sign_hmac_sha1� s �� ��rt c C s t d| |j|j�S �NrK rf rg r r r � sign_hmac_sha256_with_client� s �rv c C s t d| ||�S ru rj rk r r r �verify_hmac_sha256� s �rw c C s2 t �dt� t| t�r | �d�n| } td| ||�S )a[ Deprecated function for calculating a HMAC-SHA256 signature. This function has been replaced by invoking ``sign_hmac`` with "SHA-256" as the hash algorithm name. This function was invoked by sign_hmac_sha256_with_client and test_signatures.py, but does any application invoke it directly? If not, it can be removed. z<use sign_hmac_sha256_with_client instead of sign_hmac_sha256rm rK rn rs r r r �sign_hmac_sha256� s � � ��rx )rG c C s t d| |j|j�S �NrL rf rg r r r � sign_hmac_sha512_with_client s �rz )rH rI c C s t d| ||�S ry rj rk r r r �verify_hmac_sha512! s �r{ c C s | t v rt | S dS dS )z� Obtains an RSAAlgorithm object that implements RSA with the hash algorithm. This method maintains the ``_jwt_rsa`` cache. Returns a jwt.algorithm.RSAAlgorithm. N)�_jwt_rsar] r r r �_get_jwt_rsa_algorithm- s r} c C s t |t�r|�d�}| �|�S )a$ Prepare a PEM encoded key (public or private), by invoking the `prepare_key` method on alg with the keystr. The keystr should be a string or bytes. If the keystr is bytes, it is decoded as UTF-8 before being passed to prepare_key. Otherwise, it is passed directly. rM )r rr rV Z prepare_key)�algZkeystrr r r �_prepare_key_plusI s r )rF rG �rsa_private_keyc C s` t d��t| �}|s(t d|jj d ��|�d�}t||�}|�||�}t�|�dd� � d�S )a Calculate the signature for an RSA-based signature method. The ``alg`` is used to calculate the digest over the signature base string. For the "RSA_SHA1" signature method, the alg must be SHA-1. While OAuth 1.0a only defines the RSA-SHA1 signature method, this function can be used for other non-standard signature methods that only differ from RSA-SHA1 by the digest algorithm. Signing for the RSA-SHA1 signature method is defined in `section 3.4.3`_ of RFC 5849. The RSASSA-PKCS1-v1_5 signature algorithm used defined by `RFC3447, Section 8.2`_ (also known as PKCS#1), with the `alg` as the hash function for EMSA-PKCS1-v1_5. To use this method, the client MUST have established client credentials with the server that included its RSA public key (in a manner that is beyond the scope of this specification). .. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3 .. _`RFC3447, Section 8.2`: https://tools.ietf.org/html/rfc3447#section-8.2 zInvalid signature method.z&rsa_private_key required for RSA with z signature methodrm NrN ) r r} rZ �namerP r �signrS rT rV )rF rG r� r~ rY rX �sr r r � _sign_rsaW s �� r� )rF �rsa_public_keyc C s� z~t |j�}t|j�}t|j||�}t�|j� d��}t | �}t ||�}|� |� d�||�} | szt �d|jj d | � | W S ty� Y dS 0 dS )a� Verify a base64 encoded signature for a RSA-based signature method. The ``alg`` is used to calculate the digest over the signature base string. For the "RSA_SHA1" signature method, the alg must be SHA-1. While OAuth 1.0a only defines the RSA-SHA1 signature method, this function can be used for other non-standard signature methods that only differ from RSA-SHA1 by the digest algorithm. Verification for the RSA-SHA1 signature method is defined in `section 3.4.3`_ of RFC 5849. .. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3 To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri attribute MUST be an absolute URI whose netloc part identifies the origin server or gateway on which the resource resides. Any Host item of the request argument's headers dict attribute will be ignored. .. _`RFC2616 Sec 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2 rm zVerify failed: RSA with z: signature base string=%sFN)rE r% r- r r r rS Z a2b_base64r[ rP r} r Zverifyr^ r_ rZ r� � UnicodeError) rF r` r� ra rb rG Zsigr~ rX Z verify_okr r r � _verify_rsa� s& � �� r� c C s t d��d S �Nz8RSA-SHA1 is deprecated, use a stronger hash or HMAC-SHA1�r rg r r r �sign_rsa_sha1_with_client� s r� )r� c C s t d��d S r� r� �r` r� r r r �verify_rsa_sha1� s r� c C s t d��d S r� r� )r r� r r r � sign_rsa_sha1� s r� c C s t d| |j�S ru �r� Zrsa_keyrg r r r �sign_rsa_sha256_with_client� s r� c C s t d| |�S ru �r� r� r r r �verify_rsa_sha256� s r� c C s t d| |j�S ry r� rg r r r �sign_rsa_sha512_with_client� s r� c C s t d| |�S ry r� r� r r r �verify_rsa_sha512 s r� c C s t |j|j�S )N)�sign_plaintextrH rI )Z_signature_base_stringrh r r r �sign_plaintext_with_client s r� c C s, t �| p d�}|d7 }|t �|p"d�7 }|S )a� Sign a request using plaintext. Per `section 3.4.4`_ of the spec. The "PLAINTEXT" method does not employ a signature algorithm. It MUST be used with a transport-layer mechanism such as TLS or SSL (or sent over a secure channel with equivalent protections). It does not utilize the signature base string or the "oauth_timestamp" and "oauth_nonce" parameters. .. _`section 3.4.4`: https://tools.ietf.org/html/rfc5849#section-3.4.4 r r rA )rH rI r[ r r r r� s r� c C s( t ||�}t|| j�}|s$t�d� |S )z�Verify a PLAINTEXT signature. Per `section 3.4`_ of the spec. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 zVerify PLAINTEXT failed)r� r r[ r^ r_ )r` rH rI r[ rc r r r �verify_plaintext/ s r� )N)r NNTF)NN)NN)NN)NN)NN)1�__doc__rS rO rQ r' Zloggingro Zoauthlib.commonr r r � urllib.parse�parser r r Z getLogger�__name__r^ r r r- r@ rE r\ rd ri rl rt rv rw rx rz r{ r| r} r r� r� r� r� r� r� r� r� r� r� r� r� r r r r �<module> sz $ � 3 � W*� C �! �� � ?� Q# oauth1/rfc5849/__pycache__/errors.cpython-39.pyc 0000644 00000006244 15125174064 0015241 0 ustar 00 a \��`� � @ sh d Z ddlmZmZ G dd� de�ZG dd� de�ZG dd� de�ZG d d � d e�ZG d d � d e�Z d S )z� oauthlib.oauth1.rfc5849.errors ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Error used both by OAuth 1 clients and provicers to represent the spec defined error responses for all four core grant types. � )�add_params_to_uri� urlencodec sF e Zd ZdZdZd � fdd� Zdd� Zedd � �Zed d � �Z � Z S ) � OAuth1ErrorN� � c sL |p| j | _ d�| j| j �}|r0|dt|� 7 }t� �|� || _|| _dS )a� description: A human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred. Values for the "error_description" parameter MUST NOT include characters outside the set x20-21 / x23-5B / x5D-7E. uri: A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error. Values for the "error_uri" parameter MUST conform to the URI- Reference syntax, and thus MUST NOT include characters outside the set x21 / x23-5B / x5D-7E. state: A CSRF protection value received from the client. request: Oauthlib Request object z({}) {}� N)� description�format�error�repr�super�__init__�uri� status_code)�selfr r r Zrequest�message�� __class__� �B/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/errors.pyr s zOAuth1Error.__init__c C s t || j�S �N)r � twotuples)r r r r r �in_uri- s zOAuth1Error.in_uric C s< d| j fg}| jr"|�d| jf� | jr8|�d| jf� |S )Nr Zerror_descriptionZ error_uri)r r �appendr )r r r r r r 0 s zOAuth1Error.twotuplesc C s t | j�S r )r r )r r r r � urlencoded9 s zOAuth1Error.urlencoded)NNr N) �__name__� __module__� __qualname__r r r r �propertyr r � __classcell__r r r r r s � r c @ s e Zd ZdZdZdS )�InsecureTransportErrorZinsecure_transport_protocolz%Only HTTPS connections are permitted.N)r r r r r r r r r r > s r c @ s e Zd ZdZdS )�InvalidSignatureMethodErrorZinvalid_signature_methodN�r r r r r r r r r! C s r! c @ s e Zd ZdZdS )�InvalidRequestErrorZinvalid_requestNr" r r r r r# G s r# c @ s e Zd ZdZdS )�InvalidClientErrorZinvalid_clientNr" r r r r r$ K s r$ N) �__doc__Zoauthlib.commonr r � Exceptionr r r! r# r$ r r r r �<module> s 3 oauth1/rfc5849/__pycache__/errors.cpython-39.opt-1.pyc 0000644 00000006244 15125174064 0016200 0 ustar 00 a \��`� � @ sh d Z ddlmZmZ G dd� de�ZG dd� de�ZG dd� de�ZG d d � d e�ZG d d � d e�Z d S )z� oauthlib.oauth1.rfc5849.errors ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Error used both by OAuth 1 clients and provicers to represent the spec defined error responses for all four core grant types. � )�add_params_to_uri� urlencodec sF e Zd ZdZdZd � fdd� Zdd� Zedd � �Zed d � �Z � Z S ) � OAuth1ErrorN� � c sL |p| j | _ d�| j| j �}|r0|dt|� 7 }t� �|� || _|| _dS )a� description: A human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred. Values for the "error_description" parameter MUST NOT include characters outside the set x20-21 / x23-5B / x5D-7E. uri: A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error. Values for the "error_uri" parameter MUST conform to the URI- Reference syntax, and thus MUST NOT include characters outside the set x21 / x23-5B / x5D-7E. state: A CSRF protection value received from the client. request: Oauthlib Request object z({}) {}� N)� description�format�error�repr�super�__init__�uri� status_code)�selfr r r Zrequest�message�� __class__� �B/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/errors.pyr s zOAuth1Error.__init__c C s t || j�S �N)r � twotuples)r r r r r �in_uri- s zOAuth1Error.in_uric C s< d| j fg}| jr"|�d| jf� | jr8|�d| jf� |S )Nr Zerror_descriptionZ error_uri)r r �appendr )r r r r r r 0 s zOAuth1Error.twotuplesc C s t | j�S r )r r )r r r r � urlencoded9 s zOAuth1Error.urlencoded)NNr N) �__name__� __module__� __qualname__r r r r �propertyr r � __classcell__r r r r r s � r c @ s e Zd ZdZdZdS )�InsecureTransportErrorZinsecure_transport_protocolz%Only HTTPS connections are permitted.N)r r r r r r r r r r > s r c @ s e Zd ZdZdS )�InvalidSignatureMethodErrorZinvalid_signature_methodN�r r r r r r r r r! C s r! c @ s e Zd ZdZdS )�InvalidRequestErrorZinvalid_requestNr" r r r r r# G s r# c @ s e Zd ZdZdS )�InvalidClientErrorZinvalid_clientNr" r r r r r$ K s r$ N) �__doc__Zoauthlib.commonr r � Exceptionr r r! r# r$ r r r r �<module> s 3 oauth1/rfc5849/__pycache__/parameters.cpython-39.pyc 0000644 00000006322 15125174064 0016065 0 ustar 00 a \��`� � @ s\ d Z ddlmZmZ ddlmZmZ ddlmZ ej ddd��Z d d � Z d d � Z d d� Z dS )z� oauthlib.parameters ~~~~~~~~~~~~~~~~~~~ This module contains methods related to `section 3.5`_ of the OAuth 1.0a spec. .. _`section 3.5`: https://tools.ietf.org/html/rfc5849#section-3.5 � )�urlparse� urlunparse)�extract_params� urlencode� )�utilsNc C s� |pi }g }| D ]2\}}t �|�}t �|�}d�||�}|�|� qd�|�} |r^d| | } d| } i } | �|� | | d< | S )a **Prepare the Authorization header.** Per `section 3.5.1`_ of the spec. Protocol parameters can be transmitted using the HTTP "Authorization" header field as defined by `RFC2617`_ with the auth-scheme name set to "OAuth" (case insensitive). For example:: Authorization: OAuth realm="Example", oauth_consumer_key="0685bd9184jfhq22", oauth_token="ad180jjd733klru7", oauth_signature_method="HMAC-SHA1", oauth_signature="wOJIO9A2W5mFwDgiDvZbTSMK%2FPY%3D", oauth_timestamp="137131200", oauth_nonce="4572616e48616d6d65724c61686176", oauth_version="1.0" .. _`section 3.5.1`: https://tools.ietf.org/html/rfc5849#section-3.5.1 .. _`RFC2617`: https://tools.ietf.org/html/rfc2617 z{}="{}"z, z realm="%s", zOAuth %sZ Authorization)r �escape�format�append�join�update) � oauth_paramsZheadersZrealmZ%authorization_header_parameters_partsZoauth_parameter_name�valueZ escaped_nameZ escaped_value�partZ authorization_header_parametersZauthorization_headerZ full_headers� r �F/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/parameters.py�prepare_headers s& �� r c C s& t |�}|�| � |jdd� d� |S )a> Append OAuth params to an existing set of parameters. Both params and oauth_params is must be lists of 2-tuples. Per `section 3.5.2`_ and `3.5.3`_ of the spec. .. _`section 3.5.2`: https://tools.ietf.org/html/rfc5849#section-3.5.2 .. _`3.5.3`: https://tools.ietf.org/html/rfc5849#section-3.5.3 c S s | d � d�S )Nr Zoauth_)� startswith)�ir r r �<lambda>i � z _append_params.<locals>.<lambda>)�key)�list�extend�sort)r �paramsZmergedr r r �_append_paramsX s r c C s t | |�S )z�Prepare the Form-Encoded Body. Per `section 3.5.2`_ of the spec. .. _`section 3.5.2`: https://tools.ietf.org/html/rfc5849#section-3.5.2 )r )r �bodyr r r �prepare_form_encoded_bodym s r c C s> t |�\}}}}}}tt| t|�p$g ��}t||||||f�S )z�Prepare the Request URI Query. Per `section 3.5.3`_ of the spec. .. _`section 3.5.3`: https://tools.ietf.org/html/rfc5849#section-3.5.3 )r r r r r )r ZuriZschZnet�pathZpar�queryZfrar r r �prepare_request_uri_queryy s �r! )NN)�__doc__� urllib.parser r Zoauthlib.commonr r � r Z filter_paramsr r r r! r r r r �<module> s E oauth1/rfc5849/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000024330 15125174064 0016417 0 ustar 00 a �#/d�A � @ s� d Z ddlZddlZddlZddlmZ ddlmZm Z m Z m Z m Z ddl mZmZ e�e�ZdZdZdZeZd Zd Zd ZeZd ZeeeeeeefZ d Z dZ dZ dZ G dd� d�Z!dS )a� oauthlib.oauth1.rfc5849 ~~~~~~~~~~~~~~ This module is an implementation of various logic needed for signing and checking OAuth 1.0 RFC 5849 requests. It supports all three standard signature methods defined in RFC 5849: - HMAC-SHA1 - RSA-SHA1 - PLAINTEXT It also supports signature methods that are not defined in RFC 5849. These are based on the standard ones but replace SHA-1 with the more secure SHA-256: - HMAC-SHA256 - RSA-SHA256 � N)�Request�generate_nonce�generate_timestamp� to_unicode� urlencode� )� parameters� signaturez HMAC-SHA1z HMAC-SHA256z HMAC-SHA512zRSA-SHA1z RSA-SHA256z RSA-SHA512Z PLAINTEXTZ AUTH_HEADERZQUERYZBODY�!application/x-www-form-urlencodedc @ s� e Zd ZdZeejeeje ej e ej e ejeejeejiZedd� �Zddddeedddddddf dd�Zdd � Zd d � Zd d � Zddd�Zddd�Z dS )�Clientz2A client used to sign OAuth 1.0 RFC 5849 requests.c C s || j |< d S �N)�SIGNATURE_METHODS)�clsZ method_nameZmethod_callback� r �D/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/__init__.py�register_signature_methodY s z Client.register_signature_methodN�utf-8c s� � fdd�}||�| _ ||�| _||�| _||�| _||�| _||�| _||�| _||�| _|| �| _|| �| _ |� �| _ || �| _ || �| _ ||�| _ dS )a� Create an OAuth 1 client. :param client_key: Client key (consumer key), mandatory. :param resource_owner_key: Resource owner key (oauth token). :param resource_owner_secret: Resource owner secret (oauth token secret). :param callback_uri: Callback used when obtaining request token. :param signature_method: SIGNATURE_HMAC, SIGNATURE_RSA or SIGNATURE_PLAINTEXT. :param signature_type: SIGNATURE_TYPE_AUTH_HEADER (default), SIGNATURE_TYPE_QUERY or SIGNATURE_TYPE_BODY depending on where you want to embed the oauth credentials. :param rsa_key: RSA key used with SIGNATURE_RSA. :param verifier: Verifier used when obtaining an access token. :param realm: Realm (scope) to which access is being requested. :param encoding: If you provide non-unicode input you may use this to have oauthlib automatically convert. :param decoding: If you wish that the returned uri, headers and body from sign be encoded back from unicode, then set decoding to your preferred encoding, i.e. utf-8. :param nonce: Use this nonce instead of generating one. (Mainly for testing) :param timestamp: Use this timestamp instead of using current. (Mainly for testing) c s � rt | � �S | S r )r )�x��encodingr r �<lambda>~ � z!Client.__init__.<locals>.<lambda>N)� client_key� client_secret�resource_owner_key�resource_owner_secret�signature_method�signature_type� callback_uri�rsa_key�verifier�realmr �decoding�nonce� timestamp)�selfr r r r r r r r r r! r r" r# r$ �encoder r r �__init__] s ! zClient.__init__c C sp t | ��� }|d rdnd |d< |d r,dnd |d< |d r@dnd |d< d�dd� |�� D ��}d�| jj|�S ) Nr z****r r z, c s s | ]\}}d � ||�V qdS )z{}={}N)�format)�.0�k�vr r r � <genexpr>� r z"Client.__repr__.<locals>.<genexpr>z<{} {}>)�vars�copy�join�itemsr( � __class__�__name__)r% �attrsZ attribute_strr r r �__repr__� s ��zClient.__repr__c C s� | j tkrt�| j| j�S | �|�\}}}tjt�|�j ||d�}t � d� |�� t� |�}t�||�dd��}t � d� |�� t � d� |�� t�|j||�}t � d� |�� | j | jvr�td��| j| j || �} t � d � | �� | S ) aw Get an OAuth signature to be used in signing a request To satisfy `section 3.4.1.2`_ item 2, if the request argument's headers dict attribute contains a Host item, its value will replace any netloc part of the request argument's uri attribute value. .. _`section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2 )Z uri_query�body�headerszCollected params: {}ZHostNzNormalized params: {}zNormalized URI: {}z"Signing: signature base string: {}zInvalid signature method.z Signature: {})r �SIGNATURE_PLAINTEXTr Zsign_plaintextr r �_renderZcollect_parameters�urlparse�query�log�debugr( Znormalize_parametersZbase_string_uri�getZsignature_base_string� http_methodr � ValueError) r% �request�urir6 r5 Zcollected_paramsZnormalized_paramsZnormalized_uriZ base_stringZsigr r r �get_oauth_signature� s0 � � � zClient.get_oauth_signaturec C s� | j du rt� n| j }| jdu r&t� n| j}d|fd|fdd| jfd| jfg}| jrd|�d| jf� | jrz|�d| jf� | j r�|�d | j f� |j � d d�}|o�|� d �d k }|j dur�|r�|�d t�t�|j �d���� ��d�f� |S )zMGet the basic OAuth parameters to be used in generating a signature. NZ oauth_nonceZoauth_timestamp)Z oauth_versionz1.0Zoauth_signature_methodZoauth_consumer_keyZ oauth_tokenZoauth_callbackZoauth_verifier� Content-Typer r Zoauth_body_hashr )r# r r$ r r r r �appendr r r6 r= �findr5 �base64Z b64encode�hashlibZsha1r& �digest�decode)r% r@ r# r$ �params� content_typeZcontent_type_eligibler r r �get_oauth_params� s2 ����� ,zClient.get_oauth_paramsFc C s� |j |j|j }}}| jtkr6tj|j|j|d�}n^| jtkrp|j durpt� |j|j �}|rft |�}d|d< n$| jt kr�t� |j|j �}ntd��|||fS )a Render a signed request according to signature type Returns a 3-tuple containing the request URI, headers, and body. If the formencode argument is True and the body contains parameters, it is escaped and returned as a valid formencoded string. )r! Nr rC z!Unknown signature type specified.)rA r6 r5 r �SIGNATURE_TYPE_AUTH_HEADERr Zprepare_headers� oauth_params�SIGNATURE_TYPE_BODY� decoded_bodyZprepare_form_encoded_bodyr �SIGNATURE_TYPE_QUERYZprepare_request_uri_queryr? )r% r@ � formencoder! rA r6 r5 r r r r8 � s$ �� �zClient._render�GETc C sp t ||||| jd�}|j�dd�}|o.|�d�}|tk} |jdu} |rT| rTtd��nh| rf| sftd��nV| s�| r�td�|pzdt���n8| j t kr�| r�| r�|r�td ��n|� � d v r�| r�td ��| � |�|_ |j �d | �|�f� | j|d |p�| jd�\}}}| j�rft�d| j� |�| j�}|�r.|�| j�n|}i } |�� D ]"\} } | �| j�| | �| j�< �q>| }|||fS )aF Sign a request Signs an HTTP request with the specified parts. Returns a 3-tuple of the signed request's URI, headers, and body. Note that http_method is not returned as it is unaffected by the OAuth signing process. Also worth noting is that duplicate parameters will be included in the signature, regardless of where they are specified (query, body). The body argument may be a dict, a list of 2-tuples, or a formencoded string. The Content-Type header must be 'application/x-www-form-urlencoded' if it is present. If the body argument is not one of the above, it will be returned verbatim as it is unaffected by the OAuth signing process. Attempting to sign a request with non-formencoded data using the OAuth body signature type is invalid and will raise an exception. If the body does contain parameters, it will be returned as a properly- formatted formencoded string. Body may not be included if the http_method is either GET or HEAD as this changes the semantic meaning of the request. All string data MUST be unicode or be encoded with the same encoding scheme supplied to the Client constructor, default utf-8. This includes strings inside body dicts, for example. r rC Nz multipart/z?Headers indicate a multipart body but body contains parameters.z?Headers indicate a formencoded body but body was not decodable.zEBody contains parameters but Content-Type header was {} instead of {}znot setz=Body signatures may only be used with form-urlencoded content)rS ZHEADz*GET/HEAD requests should not include body.Zoauth_signatureT)rR r! z%Encoding URI, headers and body to %s.)r r r6 r= � startswith� CONTENT_TYPE_FORM_URLENCODEDrP r? r( r rO �upperrL rN rD rB r8 r! r" r; r< r& r0 )r% rA r> r5 r6 r! r@ rK Z multipartZshould_have_paramsZ has_paramsZ new_headersr* r+ r r r �sign sd � ���� ���� �� z Client.sign)FN)rS NNN) r2 � __module__� __qualname__�__doc__�SIGNATURE_HMAC_SHA1r Zsign_hmac_sha1_with_client�SIGNATURE_HMAC_SHA256Z sign_hmac_sha256_with_client�SIGNATURE_HMAC_SHA512Z sign_hmac_sha512_with_client�SIGNATURE_RSA_SHA1Zsign_rsa_sha1_with_client�SIGNATURE_RSA_SHA256Zsign_rsa_sha256_with_client�SIGNATURE_RSA_SHA512Zsign_rsa_sha512_with_clientr7 Zsign_plaintext_with_clientr � classmethodr rM r' r4 rB rL r8 rW r r r r r J s4 � � 2 )# %r )"rZ rF rG Zlogging� urllib.parse�parser9 Zoauthlib.commonr r r r r � r r Z getLoggerr2 r; r[ r\ r] ZSIGNATURE_HMACr^ r_ r` Z SIGNATURE_RSAr7 r rM rQ rO rU r r r r r �<module> s: � oauth1/rfc5849/__pycache__/request_validator.cpython-39.pyc 0000644 00000101145 15125174064 0017456 0 ustar 00 a \��` y � @ s& d Z ddlmZmZ G dd� d�ZdS )z� oauthlib.oauth1.rfc5849 ~~~~~~~~~~~~~~ This module is an implementation of various logic needed for signing and checking OAuth 1.0 RFC 5849 requests. � )�SIGNATURE_METHODS�utilsc @ s� e Zd ZdZdd� Zedd� �Zedd� �Zedd � �Zed d � �Z ed d � �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zed&d'� �Zed(d)� �Zed*d+� �Zd,d-� Zd.d/� Zd0d1� Z d2d3� Z d4d5� Z d6d7� Z d8d9� Z d:d;� Z!d<d=� Z"d>d?� Z#d@dA� Z$dWdCdD�Z%dEdF� Z&dGdH� Z'dXdIdJ�Z(dKdL� Z)dMdN� Z*dOdP� Z+dQdR� Z,dSdT� Z-dUdV� Z.dBS )Y�RequestValidatora� A validator/datastore interaction base class for OAuth 1 providers. OAuth providers should inherit from RequestValidator and implement the methods and properties outlined below. Further details are provided in the documentation for each method and property. Methods used to check the format of input parameters. Common tests include length, character set, membership, range or pattern. These tests are referred to as `whitelisting or blacklisting`_. Whitelisting is better but blacklisting can be usefull to spot malicious activity. The following have methods a default implementation: - check_client_key - check_request_token - check_access_token - check_nonce - check_verifier - check_realms The methods above default to whitelist input parameters, checking that they are alphanumerical and between a minimum and maximum length. Rather than overloading the methods a few properties can be used to configure these methods. * @safe_characters -> (character set) * @client_key_length -> (min, max) * @request_token_length -> (min, max) * @access_token_length -> (min, max) * @nonce_length -> (min, max) * @verifier_length -> (min, max) * @realms -> [list, of, realms] Methods used to validate/invalidate input parameters. These checks usually hit either persistent or temporary storage such as databases or the filesystem. See each methods documentation for detailed usage. The following methods must be implemented: - validate_client_key - validate_request_token - validate_access_token - validate_timestamp_and_nonce - validate_redirect_uri - validate_requested_realms - validate_realms - validate_verifier - invalidate_request_token Methods used to retrieve sensitive information from storage. The following methods must be implemented: - get_client_secret - get_request_token_secret - get_access_token_secret - get_rsa_key - get_realms - get_default_realms - get_redirect_uri Methods used to save credentials. The following methods must be implemented: - save_request_token - save_verifier - save_access_token Methods used to verify input parameters. This methods are used during authorizing request token by user (AuthorizationEndpoint), to check if parameters are valid. During token authorization request is not signed, thus 'validation' methods can not be used. The following methods must be implemented: - verify_realms - verify_request_token To prevent timing attacks it is necessary to not exit early even if the client key or resource owner key is invalid. Instead dummy values should be used during the remaining verification process. It is very important that the dummy client and token are valid input parameters to the methods get_client_secret, get_rsa_key and get_(access/request)_token_secret and that the running time of those methods when given a dummy value remain equivalent to the running time when given a valid client/resource owner. The following properties must be implemented: * @dummy_client * @dummy_request_token * @dummy_access_token Example implementations have been provided, note that the database used is a simple dictionary and serves only an illustrative purpose. Use whichever database suits your project and how to access it is entirely up to you. The methods are introduced in an order which should make understanding their use more straightforward and as such it could be worth reading what follows in chronological order. .. _`whitelisting or blacklisting`: https://www.schneier.com/blog/archives/2011/01/whitelisting_vs.html c C s d S �N� ��selfr r �M/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/request_validator.py�__init__n s zRequestValidator.__init__c C s t S r )r r r r r �allowed_signature_methodsq s z*RequestValidator.allowed_signature_methodsc C s t tj�S r )�setr ZUNICODE_ASCII_CHARACTER_SETr r r r �safe_charactersu s z RequestValidator.safe_charactersc C s dS �N)� � r r r r r �client_key_lengthy s z"RequestValidator.client_key_lengthc C s dS r r r r r r �request_token_length} s z%RequestValidator.request_token_lengthc C s dS r r r r r r �access_token_length� s z$RequestValidator.access_token_lengthc C s dS )NiX r r r r r �timestamp_lifetime� s z#RequestValidator.timestamp_lifetimec C s dS r r r r r r � nonce_length� s z RequestValidator.nonce_lengthc C s dS r r r r r r �verifier_length� s z RequestValidator.verifier_lengthc C s g S r r r r r r �realms� s zRequestValidator.realmsc C s dS )NTr r r r r � enforce_ssl� s z RequestValidator.enforce_sslc C s4 | j \}}t|�| jko2|t|� ko.|kS S )zCheck that the client key only contains safe characters and is no shorter than lower and no longer than upper. )r r r �len)r � client_key�lower�upperr r r �check_client_key� s �z!RequestValidator.check_client_keyc C s4 | j \}}t|�| jko2|t|� ko.|kS S )z�Checks that the request token contains only safe characters and is no shorter than lower and no longer than upper. )r r r r �r � request_tokenr r r r r �check_request_token� s �z$RequestValidator.check_request_tokenc C s4 | j \}}t|�| jko2|t|� ko.|kS S )z{Checks that the token contains only safe characters and is no shorter than lower and no longer than upper. )r r r r r r r r �check_access_token� s �z#RequestValidator.check_access_tokenc C s4 | j \}}t|�| jko2|t|� ko.|kS S )z�Checks that the nonce only contains only safe characters and is no shorter than lower and no longer than upper. )r r r r )r �noncer r r r r � check_nonce� s �z RequestValidator.check_noncec C s4 | j \}}t|�| jko2|t|� ko.|kS S )z~Checks that the verifier contains only safe characters and is no shorter than lower and no longer than upper. )r r r r )r �verifierr r r r r �check_verifier� s �z RequestValidator.check_verifierc s t � fdd�|D ��S )z4Check that the realm is one of a set allowed realms.c 3 s | ]}|� j v V qd S r )r )�.0�rr r r � <genexpr>� � z0RequestValidator.check_realms.<locals>.<genexpr>)�all)r r r r r � check_realms� s z RequestValidator.check_realmsc C s d� t| �|�}t|�S )z� Returns a NotImplementedError for a function that should be implemented. :param fn: name of the function z)Missing function implementation in {}: {})�format�type�NotImplementedError)r �fn�mr r r �_subclass_must_implement� s z)RequestValidator._subclass_must_implementc C s | � d��dS )aT Dummy client used when an invalid client key is supplied. :returns: The dummy client key string. The dummy client should be associated with either a client secret, a rsa key or both depending on which signature methods are supported. Providers should make sure that get_client_secret(dummy_client) get_rsa_key(dummy_client) return a valid secret or key for the dummy client. This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint � dummy_clientN�r1 r r r r r2 � s z RequestValidator.dummy_clientc C s | � d��dS )am Dummy request token used when an invalid token was supplied. :returns: The dummy request token string. The dummy request token should be associated with a request token secret such that get_request_token_secret(.., dummy_request_token) returns a valid secret. This method is used by * AccessTokenEndpoint �dummy_request_tokenNr3 r r r r r4 � s z$RequestValidator.dummy_request_tokenc C s | � d��dS )ae Dummy access token used when an invalid token was supplied. :returns: The dummy access token string. The dummy access token should be associated with an access token secret such that get_access_token_secret(.., dummy_access_token) returns a valid secret. This method is used by * ResourceEndpoint �dummy_access_tokenNr3 r r r r r5 � s z#RequestValidator.dummy_access_tokenc C s | � d��dS )a� Retrieves the client secret associated with the client key. :param client_key: The client/consumer key. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The client secret as a string. This method must allow the use of a dummy client_key value. Fetching the secret using the dummy key must take the same amount of time as fetching a secret for a valid client:: # Unlikely to be near constant time as it uses two database # lookups for a valid client, and only one for an invalid. from your_datastore import ClientSecret if ClientSecret.has(client_key): return ClientSecret.get(client_key) else: return 'dummy' # Aim to mimic number of latency inducing operations no matter # whether the client is valid or not. from your_datastore import ClientSecret return ClientSecret.get(client_key, 'dummy') Note that the returned key must be in plaintext. This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint �get_client_secretNr3 �r r �requestr r r r6 s "z"RequestValidator.get_client_secretc C s | � d��dS )a� Retrieves the shared secret associated with the request token. :param client_key: The client/consumer key. :param token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The token secret as a string. This method must allow the use of a dummy values and the running time must be roughly equivalent to that of the running time of valid values:: # Unlikely to be near constant time as it uses two database # lookups for a valid client, and only one for an invalid. from your_datastore import RequestTokenSecret if RequestTokenSecret.has(client_key): return RequestTokenSecret.get((client_key, request_token)) else: return 'dummy' # Aim to mimic number of latency inducing operations no matter # whether the client is valid or not. from your_datastore import RequestTokenSecret return ClientSecret.get((client_key, request_token), 'dummy') Note that the returned key must be in plaintext. This method is used by * AccessTokenEndpoint �get_request_token_secretNr3 �r r �tokenr8 r r r r9 ) s z)RequestValidator.get_request_token_secretc C s | � d��dS )a� Retrieves the shared secret associated with the access token. :param client_key: The client/consumer key. :param token: The access token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The token secret as a string. This method must allow the use of a dummy values and the running time must be roughly equivalent to that of the running time of valid values:: # Unlikely to be near constant time as it uses two database # lookups for a valid client, and only one for an invalid. from your_datastore import AccessTokenSecret if AccessTokenSecret.has(client_key): return AccessTokenSecret.get((client_key, request_token)) else: return 'dummy' # Aim to mimic number of latency inducing operations no matter # whether the client is valid or not. from your_datastore import AccessTokenSecret return ClientSecret.get((client_key, request_token), 'dummy') Note that the returned key must be in plaintext. This method is used by * ResourceEndpoint �get_access_token_secretNr3 r: r r r r< J s z(RequestValidator.get_access_token_secretc C s | � d��dS )a� Get the default realms for a client. :param client_key: The client/consumer key. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The list of default realms associated with the client. The list of default realms will be set during client registration and is outside the scope of OAuthLib. This method is used by * RequestTokenEndpoint �get_default_realmsNr3 r7 r r r r= k s z#RequestValidator.get_default_realmsc C s | � d��dS )ae Get realms associated with a request token. :param token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The list of realms associated with the request token. This method is used by * AuthorizationEndpoint * AccessTokenEndpoint � get_realmsNr3 �r r; r8 r r r r> | s zRequestValidator.get_realmsc C s | � d��dS )a& Get the redirect URI associated with a request token. :param token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The redirect URI associated with the request token. It may be desirable to return a custom URI if the redirect is set to "oob". In this case, the user will be redirected to the returned URI and at that endpoint the verifier can be displayed. This method is used by * AuthorizationEndpoint �get_redirect_uriNr3 r? r r r r@ � s z!RequestValidator.get_redirect_uric C s | � d��dS )a� Retrieves a previously stored client provided RSA key. :param client_key: The client/consumer key. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The rsa public key as a string. This method must allow the use of a dummy client_key value. Fetching the rsa key using the dummy key must take the same amount of time as fetching a key for a valid client. The dummy key must also be of the same bit length as client keys. Note that the key must be returned in plaintext. This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint � get_rsa_keyNr3 r7 r r r rA � s z RequestValidator.get_rsa_keyc C s | � d��dS )aK Invalidates a used request token. :param client_key: The client/consumer key. :param request_token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: None Per `Section 2.3`__ of the spec: "The server MUST (...) ensure that the temporary credentials have not expired or been used before." .. _`Section 2.3`: https://tools.ietf.org/html/rfc5849#section-2.3 This method should ensure that provided token won't validate anymore. It can be simply removing RequestToken from storage or setting specific flag that makes it invalid (note that such flag should be also validated during request token validation). This method is used by * AccessTokenEndpoint �invalidate_request_tokenNr3 )r r r r8 r r r rB � s z)RequestValidator.invalidate_request_tokenc C s | � d��dS )a+ Validates that supplied client key is a registered and valid client. :param client_key: The client/consumer key. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False Note that if the dummy client is supplied it should validate in same or nearly the same amount of time as a valid one. Ensure latency inducing tasks are mimiced even for dummy clients. For example, use:: from your_datastore import Client try: return Client.exists(client_key, access_token) except DoesNotExist: return False Rather than:: from your_datastore import Client if access_token == self.dummy_access_token: return False else: return Client.exists(client_key, access_token) This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint �validate_client_keyNr3 r7 r r r rC � s #z$RequestValidator.validate_client_keyc C s | � d��dS )a Validates that supplied request token is registered and valid. :param client_key: The client/consumer key. :param token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False Note that if the dummy request_token is supplied it should validate in the same nearly the same amount of time as a valid one. Ensure latency inducing tasks are mimiced even for dummy clients. For example, use:: from your_datastore import RequestToken try: return RequestToken.exists(client_key, access_token) except DoesNotExist: return False Rather than:: from your_datastore import RequestToken if access_token == self.dummy_access_token: return False else: return RequestToken.exists(client_key, access_token) This method is used by * AccessTokenEndpoint �validate_request_tokenNr3 r: r r r rD � s !z'RequestValidator.validate_request_tokenc C s | � d��dS )a Validates that supplied access token is registered and valid. :param client_key: The client/consumer key. :param token: The access token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False Note that if the dummy access token is supplied it should validate in the same or nearly the same amount of time as a valid one. Ensure latency inducing tasks are mimiced even for dummy clients. For example, use:: from your_datastore import AccessToken try: return AccessToken.exists(client_key, access_token) except DoesNotExist: return False Rather than:: from your_datastore import AccessToken if access_token == self.dummy_access_token: return False else: return AccessToken.exists(client_key, access_token) This method is used by * ResourceEndpoint �validate_access_tokenNr3 r: r r r rE s !z&RequestValidator.validate_access_tokenNc C s | � d��dS )a9 Validates that the nonce has not been used before. :param client_key: The client/consumer key. :param timestamp: The ``oauth_timestamp`` parameter. :param nonce: The ``oauth_nonce`` parameter. :param request_token: Request token string, if any. :param access_token: Access token string, if any. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False Per `Section 3.3`_ of the spec. "A nonce is a random string, uniquely generated by the client to allow the server to verify that a request has never been made before and helps prevent replay attacks when requests are made over a non-secure channel. The nonce value MUST be unique across all requests with the same timestamp, client credentials, and token combinations." .. _`Section 3.3`: https://tools.ietf.org/html/rfc5849#section-3.3 One of the first validation checks that will be made is for the validity of the nonce and timestamp, which are associated with a client key and possibly a token. If invalid then immediately fail the request by returning False. If the nonce/timestamp pair has been used before and you may just have detected a replay attack. Therefore it is an essential part of OAuth security that you not allow nonce/timestamp reuse. Note that this validation check is done before checking the validity of the client and token.:: nonces_and_timestamps_database = [ (u'foo', 1234567890, u'rannoMstrInghere', u'bar') ] def validate_timestamp_and_nonce(self, client_key, timestamp, nonce, request_token=None, access_token=None): return ((client_key, timestamp, nonce, request_token or access_token) not in self.nonces_and_timestamps_database) This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint � validate_timestamp_and_nonceNr3 )r r Z timestampr" r8 r Z access_tokenr r r rF ; s 1z-RequestValidator.validate_timestamp_and_noncec C s | � d��dS )a Validates the client supplied redirection URI. :param client_key: The client/consumer key. :param redirect_uri: The URI the client which to redirect back to after authorization is successful. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False It is highly recommended that OAuth providers require their clients to register all redirection URIs prior to using them in requests and register them as absolute URIs. See `CWE-601`_ for more information about open redirection attacks. By requiring registration of all redirection URIs it should be straightforward for the provider to verify whether the supplied redirect_uri is valid or not. Alternatively per `Section 2.1`_ of the spec: "If the client is unable to receive callbacks or a callback URI has been established via other means, the parameter value MUST be set to "oob" (case sensitive), to indicate an out-of-band configuration." .. _`CWE-601`: http://cwe.mitre.org/top25/index.html#CWE-601 .. _`Section 2.1`: https://tools.ietf.org/html/rfc5849#section-2.1 This method is used by * RequestTokenEndpoint �validate_redirect_uriNr3 )r r Z redirect_urir8 r r r rG n s z&RequestValidator.validate_redirect_uric C s | � d��dS )aT Validates that the client may request access to the realm. :param client_key: The client/consumer key. :param realms: The list of realms that client is requesting access to. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False This method is invoked when obtaining a request token and should tie a realm to the request token and after user authorization this realm restriction should transfer to the access token. This method is used by * RequestTokenEndpoint �validate_requested_realmsNr3 )r r r r8 r r r rH � s z*RequestValidator.validate_requested_realmsc C s | � d��dS )aR Validates access to the request realm. :param client_key: The client/consumer key. :param token: A request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :param uri: The URI the realms is protecting. :param realms: A list of realms that must have been granted to the access token. :returns: True or False How providers choose to use the realm parameter is outside the OAuth specification but it is commonly used to restrict access to a subset of protected resources such as "photos". realms is a convenience parameter which can be used to provide a per view method pre-defined list of allowed realms. Can be as simple as:: from your_datastore import RequestToken request_token = RequestToken.get(token, None) if not request_token: return False return set(request_token.realms).issuperset(set(realms)) This method is used by * ResourceEndpoint �validate_realmsNr3 )r r r; r8 Zurir r r r rI � s !z RequestValidator.validate_realmsc C s | � d��dS )a� Validates a verification code. :param client_key: The client/consumer key. :param token: A request token string. :param verifier: The authorization verifier string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False OAuth providers issue a verification code to clients after the resource owner authorizes access. This code is used by the client to obtain token credentials and the provider must verify that the verifier is valid and associated with the client as well as the resource owner. Verifier validation should be done in near constant time (to avoid verifier enumeration). To achieve this we need a constant time string comparison which is provided by OAuthLib in ``oauthlib.common.safe_string_equals``:: from your_datastore import Verifier correct_verifier = Verifier.get(client_key, request_token) from oauthlib.common import safe_string_equals return safe_string_equals(verifier, correct_verifier) This method is used by * AccessTokenEndpoint �validate_verifierNr3 )r r r; r$ r8 r r r rJ � s z"RequestValidator.validate_verifierc C s | � d��dS )a) Verify that the given OAuth1 request token is valid. :param token: A request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False This method is used only in AuthorizationEndpoint to check whether the oauth_token given in the authorization URL is valid or not. This request is not signed and thus similar ``validate_request_token`` method can not be used. This method is used by * AuthorizationEndpoint �verify_request_tokenNr3 r? r r r rK � s z%RequestValidator.verify_request_tokenc C s | � d��dS )a� Verify authorized realms to see if they match those given to token. :param token: An access token string. :param realms: A list of realms the client attempts to access. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False This prevents the list of authorized realms sent by the client during the authorization step to be altered to include realms outside what was bound with the request token. Can be as simple as:: valid_realms = self.get_realms(token) return all((r in valid_realms for r in realms)) This method is used by * AuthorizationEndpoint � verify_realmsNr3 )r r; r r8 r r r rL � s z RequestValidator.verify_realmsc C s | � d��dS )a� Save an OAuth1 access token. :param token: A dict with token credentials. :param request: OAuthlib request. :type request: oauthlib.common.Request The token dictionary will at minimum include * ``oauth_token`` the access token string. * ``oauth_token_secret`` the token specific secret used in signing. * ``oauth_authorized_realms`` a space separated list of realms. Client key can be obtained from ``request.client_key``. The list of realms (not joined string) can be obtained from ``request.realm``. This method is used by * AccessTokenEndpoint �save_access_tokenNr3 r? r r r rM s z"RequestValidator.save_access_tokenc C s | � d��dS )a) Save an OAuth1 request token. :param token: A dict with token credentials. :param request: OAuthlib request. :type request: oauthlib.common.Request The token dictionary will at minimum include * ``oauth_token`` the request token string. * ``oauth_token_secret`` the token specific secret used in signing. * ``oauth_callback_confirmed`` the string ``true``. Client key can be obtained from ``request.client_key``. This method is used by * RequestTokenEndpoint �save_request_tokenNr3 r? r r r rN ) s z#RequestValidator.save_request_tokenc C s | � d��dS )ai Associate an authorization verifier with a request token. :param token: A request token string. :param verifier A dictionary containing the oauth_verifier and oauth_token :param request: OAuthlib request. :type request: oauthlib.common.Request We need to associate verifiers with tokens for validation during the access token request. Note that unlike save_x_token token here is the ``oauth_token`` token string from the request token saved previously. This method is used by * AuthorizationEndpoint � save_verifierNr3 )r r; r$ r8 r r r rO > s z RequestValidator.save_verifier)NN)NN)/�__name__� __module__� __qualname__�__doc__r �propertyr r r r r r r r r r r r r! r# r% r+ r1 r2 r4 r5 r6 r9 r< r= r> r@ rA rB rC rD rE rF rG rH rI rJ rK rL rM rN rO r r r r r sv a $!!%#$ � 3" � # r N)rS � r r r r r r r �<module> s oauth1/rfc5849/__pycache__/signature.cpython-39.opt-1.pyc 0000644 00000041664 15125174064 0016672 0 ustar 00 a �#/d|y � @ s� d Z ddlZddlZddlZddlZddlZddlZddlmZm Z m Z ddl m Z ddlmZ e�e�Zeeeed�dd�ZdKeeed �d d �ZdLdd�Zed�dd�Zeeeed�dd�ZdMed�dd�Zdd� ZdNd d �Zd d � Z d d!� Z dOd"d#�Z d$d%� Z ed&�d'd(�Z dPeed)�d*d+�Z!i Z"ed�d,d-�Z#d.d/� Z$eeed0�d1d2�Z%eed3�d4d5�Z&d6d7� Z'ed8�d9d:�Z(d;d<� Z)ed&�d=d>�Z*ed8�d?d@�Z+ed&�dAdB�Z,ed8�dCdD�Z-dEdF� Z.dGdH� Z/dQdIdJ�Z0dS )Ra� This module is an implementation of `section 3.4`_ of RFC 5849. **Usage** Steps for signing a request: 1. Collect parameters from the request using ``collect_parameters``. 2. Normalize those parameters using ``normalize_parameters``. 3. Create the *base string URI* using ``base_string_uri``. 4. Create the *signature base string* from the above three components using ``signature_base_string``. 5. Pass the *signature base string* and the client credentials to one of the sign-with-client functions. The HMAC-based signing functions needs client credentials with secrets. The RSA-based signing functions needs client credentials with an RSA private key. To verify a request, pass the request and credentials to one of the verify functions. The HMAC-based signing functions needs the shared secrets. The RSA-based verify functions needs the RSA public key. **Scope** All of the functions in this module should be considered internal to OAuthLib, since they are not imported into the "oauthlib.oauth1" module. Programs using OAuthLib should not use directly invoke any of the functions in this module. **Deprecated functions** The "sign_" methods that are not "_with_client" have been deprecated. They may be removed in a future release. Since they are all internal functions, this should have no impact on properly behaving programs. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 � N)�extract_params�safe_string_equals� urldecode� )�utils)� http_method� base_str_uri�%normalized_encoded_request_parameters�returnc C s> t �| �� �}|d7 }|t �|�7 }|d7 }|t �|�7 }|S )a� Construct the signature base string. The *signature base string* is the value that is calculated and signed by the client. It is also independently calculated by the server to verify the signature, and therefore must produce the exact same value at both ends or the signature won't verify. The rules for calculating the *signature base string* are defined in section 3.4.1.1`_ of RFC 5849. .. _`section 3.4.1.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.1 �&)r �escape�upper)r r r � base_string� r �E/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/signature.py�signature_base_string7 s r )�uri�hostr c C st t | t�std��t�| �}|j}|j}|j}|j}|j}|sFtd��|sNd}|� � }|durf|� � }|dur�|� � }|� d|� �}t�|�}|j}|j}|du r�td��zt � |�}W n ty� Y n0 t |t j �r�d|� d�}nt |t j �r�|� }|du�r$d | k �rd k�s$n td ��||fd v �r8|}n|�rN|� d |� �}n|}t�||||ddf�} | �dd�S )a� Calculates the _base string URI_. The *base string URI* is one of the components that make up the *signature base string*. The ``host`` is optional. If provided, it is used to override any host and port values in the ``uri``. The value for ``host`` is usually extracted from the "Host" request header from the HTTP request. Its value may be just the hostname, or the hostname followed by a colon and a TCP/IP port number (hostname:port). If a value for the``host`` is provided but it does not contain a port number, the default port number is used (i.e. if the ``uri`` contained a port number, it will be discarded). The rules for calculating the *base string URI* are defined in section 3.4.1.2`_ of RFC 5849. .. _`section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2 :param uri: URI :param host: hostname with optional port number, separated by a colon :return: base string URI zuri must be a string.zmissing scheme�/Nz://z missing host�[�]r i�� zport out of range))�http�P )�httpsi� �:� � z%20)� isinstance�str� ValueError�urlparse�scheme�hostname�port�path�params�lower� ipaddressZ ip_addressZ IPv6AddressZ IPv4Address� urlunparse�replace) r r �outputr! r" r# r$ r% �netloc�vr r r �base_string_urij sP $r- r TFc s� |du r g }|pi }g }| r*|� t| �� |rpdd� |�� D �}|�d�}|durp|� � fdd�t�|�D �� t|�pzg }|� |� g } |D ]*\} } | �d�r�t�| �} | � | | f� q�|r�t t dd � | ��} | S ) a� Gather the request parameters from all the parameter sources. This function is used to extract all the parameters, which are then passed to ``normalize_parameters`` to produce one of the components that make up the *signature base string*. Parameters starting with `oauth_` will be unescaped. Body parameters must be supplied as a dict, a list of 2-tuples, or a form encoded query string. Headers must be supplied as a dict. The rules where the parameters must be sourced from are defined in `section 3.4.1.3.1`_ of RFC 5849. .. _`Sec 3.4.1.3.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.1 Nc S s i | ]\}}|� � |�qS r )r& ��.0�kr, r r r � <dictcomp> � z&collect_parameters.<locals>.<dictcomp>Z authorizationc s g | ]}� s|d dkr|�qS )r Zrealmr )r/ �i�� with_realmr r � <listcomp>! s �z&collect_parameters.<locals>.<listcomp>Zoauth_c S s | d dkS )Nr Zoauth_signaturer )r3 r r r �<lambda>? r2 z$collect_parameters.<locals>.<lambda>) �extendr �items�getr Zparse_authorization_headerr � startswithZunescape�append�list�filter) Z uri_query�bodyZheadersZexclude_oauth_signaturer5 r% Z headers_lowerZauthorization_headerZ bodyparamsZunescaped_paramsr0 r, r r4 r �collect_parameters� s2 � �r@ )r c C s. dd� | D �}|� � dd� |D �}d�|�S )aV Calculate the normalized request parameters. The *normalized request parameters* is one of the components that make up the *signature base string*. The rules for parameter normalization are defined in `section 3.4.1.3.2`_ of RFC 5849. .. _`Sec 3.4.1.3.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.2 c S s$ g | ] \}}t �|�t �|�f�qS r �r r r. r r r r6 [ r2 z(normalize_parameters.<locals>.<listcomp>c S s g | ]\}}d � ||��qS )z{}={})�formatr. r r r r6 e r2 r )�sort�join)r% Z key_valuesZparameter_partsr r r �normalize_parametersE s rE )�hash_algorithm_name� sig_base_str� client_secret�resource_owner_secretc C s� |}t �|pd�}|d7 }|t �|p&d�7 }tjtjtjd�}|| }|�d�}|�d�} t�|| |�} t � | � � �dd� � d�S )a] **HMAC-SHA256** The "HMAC-SHA256" signature method uses the HMAC-SHA256 signature algorithm as defined in `RFC4634`_:: digest = HMAC-SHA256 (key, text) Per `section 3.4.2`_ of the spec. .. _`RFC4634`: https://tools.ietf.org/html/rfc4634 .. _`section 3.4.2`: https://tools.ietf.org/html/rfc5849#section-3.4.2 r r )�SHA-1�SHA-256�SHA-512�utf-8N���) r r �hashlibZsha1Zsha256Zsha512�encode�hmac�new�binascii� b2a_base64�digest�decode) rF rG rH rI �text�key�m�hash_algZkey_utf8Z text_utf8� signaturer r r � _sign_hmaco s � r\ �rF c C sP t |j�}t|j�}t|j||�}t| |||�}t||j�}|sLt � d|� |S )a Verify a HMAC-SHA1 signature. Per `section 3.4`_ of the spec. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri attribute MUST be an absolute URI whose netloc part identifies the origin server or gateway on which the resource resides. Any Host item of the request argument's headers dict attribute will be ignored. .. _`RFC2616 section 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2 z-Verify HMAC failed: signature base string: %s) rE r% r- r r r r\ r r[ �log�debug) rF �requestrH rI � norm_params�bs_urirG r[ �matchr r r � _verify_hmac� s �� rd c C s t d| |j|j�S �NrJ �r\ rH rI �rG �clientr r r �sign_hmac_sha1_with_client� s �ri c C s t d| ||�S re �rd �r` rH rI r r r �verify_hmac_sha1� s rl c C s2 t �dt� t| t�r | �d�n| } td| ||�S )aU Deprecated function for calculating a HMAC-SHA1 signature. This function has been replaced by invoking ``sign_hmac`` with "SHA-1" as the hash algorithm name. This function was invoked by sign_hmac_sha1_with_client and test_signatures.py, but does any application invoke it directly? If not, it can be removed. z8use sign_hmac_sha1_with_client instead of sign_hmac_sha1�asciirJ ��warnings�warn�DeprecationWarningr �bytesrV r\ �r rH rI r r r �sign_hmac_sha1� s �� ��rt c C s t d| |j|j�S �NrK rf rg r r r � sign_hmac_sha256_with_client� s �rv c C s t d| ||�S ru rj rk r r r �verify_hmac_sha256� s �rw c C s2 t �dt� t| t�r | �d�n| } td| ||�S )a[ Deprecated function for calculating a HMAC-SHA256 signature. This function has been replaced by invoking ``sign_hmac`` with "SHA-256" as the hash algorithm name. This function was invoked by sign_hmac_sha256_with_client and test_signatures.py, but does any application invoke it directly? If not, it can be removed. z<use sign_hmac_sha256_with_client instead of sign_hmac_sha256rm rK rn rs r r r �sign_hmac_sha256� s � � ��rx )rG c C s t d| |j|j�S �NrL rf rg r r r � sign_hmac_sha512_with_client s �rz )rH rI c C s t d| ||�S ry rj rk r r r �verify_hmac_sha512! s �r{ c C s | t v rt | S dS dS )z� Obtains an RSAAlgorithm object that implements RSA with the hash algorithm. This method maintains the ``_jwt_rsa`` cache. Returns a jwt.algorithm.RSAAlgorithm. N)�_jwt_rsar] r r r �_get_jwt_rsa_algorithm- s r} c C s t |t�r|�d�}| �|�S )a$ Prepare a PEM encoded key (public or private), by invoking the `prepare_key` method on alg with the keystr. The keystr should be a string or bytes. If the keystr is bytes, it is decoded as UTF-8 before being passed to prepare_key. Otherwise, it is passed directly. rM )r rr rV Z prepare_key)�algZkeystrr r r �_prepare_key_plusI s r )rF rG �rsa_private_keyc C s` t d��t| �}|s(t d|jj d ��|�d�}t||�}|�||�}t�|�dd� � d�S )a Calculate the signature for an RSA-based signature method. The ``alg`` is used to calculate the digest over the signature base string. For the "RSA_SHA1" signature method, the alg must be SHA-1. While OAuth 1.0a only defines the RSA-SHA1 signature method, this function can be used for other non-standard signature methods that only differ from RSA-SHA1 by the digest algorithm. Signing for the RSA-SHA1 signature method is defined in `section 3.4.3`_ of RFC 5849. The RSASSA-PKCS1-v1_5 signature algorithm used defined by `RFC3447, Section 8.2`_ (also known as PKCS#1), with the `alg` as the hash function for EMSA-PKCS1-v1_5. To use this method, the client MUST have established client credentials with the server that included its RSA public key (in a manner that is beyond the scope of this specification). .. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3 .. _`RFC3447, Section 8.2`: https://tools.ietf.org/html/rfc3447#section-8.2 zInvalid signature method.z&rsa_private_key required for RSA with z signature methodrm NrN ) r r} rZ �namerP r �signrS rT rV )rF rG r� r~ rY rX �sr r r � _sign_rsaW s �� r� )rF �rsa_public_keyc C s� z~t |j�}t|j�}t|j||�}t�|j� d��}t | �}t ||�}|� |� d�||�} | szt �d|jj d | � | W S ty� Y dS 0 dS )a� Verify a base64 encoded signature for a RSA-based signature method. The ``alg`` is used to calculate the digest over the signature base string. For the "RSA_SHA1" signature method, the alg must be SHA-1. While OAuth 1.0a only defines the RSA-SHA1 signature method, this function can be used for other non-standard signature methods that only differ from RSA-SHA1 by the digest algorithm. Verification for the RSA-SHA1 signature method is defined in `section 3.4.3`_ of RFC 5849. .. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3 To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri attribute MUST be an absolute URI whose netloc part identifies the origin server or gateway on which the resource resides. Any Host item of the request argument's headers dict attribute will be ignored. .. _`RFC2616 Sec 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2 rm zVerify failed: RSA with z: signature base string=%sFN)rE r% r- r r r rS Z a2b_base64r[ rP r} r Zverifyr^ r_ rZ r� � UnicodeError) rF r` r� ra rb rG Zsigr~ rX Z verify_okr r r � _verify_rsa� s& � �� r� c C s t d��d S �Nz8RSA-SHA1 is deprecated, use a stronger hash or HMAC-SHA1�r rg r r r �sign_rsa_sha1_with_client� s r� )r� c C s t d��d S r� r� �r` r� r r r �verify_rsa_sha1� s r� c C s t d��d S r� r� )r r� r r r � sign_rsa_sha1� s r� c C s t d| |j�S ru �r� Zrsa_keyrg r r r �sign_rsa_sha256_with_client� s r� c C s t d| |�S ru �r� r� r r r �verify_rsa_sha256� s r� c C s t d| |j�S ry r� rg r r r �sign_rsa_sha512_with_client� s r� c C s t d| |�S ry r� r� r r r �verify_rsa_sha512 s r� c C s t |j|j�S )N)�sign_plaintextrH rI )Z_signature_base_stringrh r r r �sign_plaintext_with_client s r� c C s, t �| p d�}|d7 }|t �|p"d�7 }|S )a� Sign a request using plaintext. Per `section 3.4.4`_ of the spec. The "PLAINTEXT" method does not employ a signature algorithm. It MUST be used with a transport-layer mechanism such as TLS or SSL (or sent over a secure channel with equivalent protections). It does not utilize the signature base string or the "oauth_timestamp" and "oauth_nonce" parameters. .. _`section 3.4.4`: https://tools.ietf.org/html/rfc5849#section-3.4.4 r r rA )rH rI r[ r r r r� s r� c C s( t ||�}t|| j�}|s$t�d� |S )z�Verify a PLAINTEXT signature. Per `section 3.4`_ of the spec. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 zVerify PLAINTEXT failed)r� r r[ r^ r_ )r` rH rI r[ rc r r r �verify_plaintext/ s r� )N)r NNTF)NN)NN)NN)NN)NN)1�__doc__rS rO rQ r' Zloggingro Zoauthlib.commonr r r � urllib.parse�parser r r Z getLogger�__name__r^ r r r- r@ rE r\ rd ri rl rt rv rw rx rz r{ r| r} r r� r� r� r� r� r� r� r� r� r� r� r� r r r r �<module> sz $ � 3 � W*� C �! �� � ?� Q# oauth1/rfc5849/__pycache__/utils.cpython-39.pyc 0000644 00000005365 15125174064 0015070 0 ustar 00 a \��`5 � @ s` d Z ddlmZ ddlmZmZ dZdd� Zdd� Z d d � Z d d � Z d d� Z dd� Z dd� ZdS )zn oauthlib.utils ~~~~~~~~~~~~~~ This module contains utility methods used by various parts of the OAuth spec. � N)�quote�unquoteZ>abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789c s � fdd�}� j |_ |S )z�Decorator which filters params to remove non-oauth_* parameters Assumes the decorated method takes a params dict or list of tuples as its first argument. c s t | �} � | g|�R i |��S )N)�filter_oauth_params)�params�args�kwargs��target� �A/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/utils.py�wrapper s z filter_params.<locals>.wrapper)�__doc__)r r r r r � filter_params s r c C s: dd� }t | t�r(tt|t| �� ���S tt|| ��S dS )zARemoves all non oauth parameters from a dict or a list of params.c S s | d � d�S )Nr Zoauth_)� startswith)Zkvr r r �<lambda>! � z%filter_oauth_params.<locals>.<lambda>N)� isinstance�dict�list�filter�items)r Zis_oauthr r r r s r c C s. t | t�s"tdd�| t| �� ��t| dd�S )z�Escape a unicode string in an OAuth-compatible fashion. Per `section 3.6`_ of the spec. .. _`section 3.6`: https://tools.ietf.org/html/rfc5849#section-3.6 z$Only unicode objects are escapable. zGot {!r} of type {}.� ~)�safe)r �str� ValueError�format�typer ��ur r r �escape( s �r c C s t | t�std��t| �S )Nz%Only unicode objects are unescapable.)r r r r r r r r �unescape8 s r c C s t �| �S )z1A unicode-safe version of urllib2.parse_keqv_list)�urllib2�parse_keqv_list)�lr r r r" > s r" c C s t �| �S )z1A unicode-safe version of urllib2.parse_http_list)r! �parse_http_listr r r r r$ D s r$ c C sl d� � }| dt|�� � � �|�r`t| t|�d� �}ztt|��� �W S ttfy^ Y n0 td��dS )z;Parse an OAuth authorization header into a list of 2-tupleszOAuth Nz Malformed authorization header) �lower�lenr r$ r r" r � IndexErrorr )Zauthorization_headerZ auth_schemer r r r �parse_authorization_headerJ s r( )r Zurllib.requestZrequestr! Zoauthlib.commonr r ZUNICODE_ASCII_CHARACTER_SETr r r r r" r$ r( r r r r �<module> s oauth1/rfc5849/__pycache__/utils.cpython-39.opt-1.pyc 0000644 00000005365 15125174064 0016027 0 ustar 00 a \��`5 � @ s` d Z ddlmZ ddlmZmZ dZdd� Zdd� Z d d � Z d d � Z d d� Z dd� Z dd� ZdS )zn oauthlib.utils ~~~~~~~~~~~~~~ This module contains utility methods used by various parts of the OAuth spec. � N)�quote�unquoteZ>abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789c s � fdd�}� j |_ |S )z�Decorator which filters params to remove non-oauth_* parameters Assumes the decorated method takes a params dict or list of tuples as its first argument. c s t | �} � | g|�R i |��S )N)�filter_oauth_params)�params�args�kwargs��target� �A/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/utils.py�wrapper s z filter_params.<locals>.wrapper)�__doc__)r r r r r � filter_params s r c C s: dd� }t | t�r(tt|t| �� ���S tt|| ��S dS )zARemoves all non oauth parameters from a dict or a list of params.c S s | d � d�S )Nr Zoauth_)� startswith)Zkvr r r �<lambda>! � z%filter_oauth_params.<locals>.<lambda>N)� isinstance�dict�list�filter�items)r Zis_oauthr r r r s r c C s. t | t�s"tdd�| t| �� ��t| dd�S )z�Escape a unicode string in an OAuth-compatible fashion. Per `section 3.6`_ of the spec. .. _`section 3.6`: https://tools.ietf.org/html/rfc5849#section-3.6 z$Only unicode objects are escapable. zGot {!r} of type {}.� ~)�safe)r �str� ValueError�format�typer ��ur r r �escape( s �r c C s t | t�std��t| �S )Nz%Only unicode objects are unescapable.)r r r r r r r r �unescape8 s r c C s t �| �S )z1A unicode-safe version of urllib2.parse_keqv_list)�urllib2�parse_keqv_list)�lr r r r" > s r" c C s t �| �S )z1A unicode-safe version of urllib2.parse_http_list)r! �parse_http_listr r r r r$ D s r$ c C sl d� � }| dt|�� � � �|�r`t| t|�d� �}ztt|��� �W S ttfy^ Y n0 td��dS )z;Parse an OAuth authorization header into a list of 2-tupleszOAuth Nz Malformed authorization header) �lower�lenr r$ r r" r � IndexErrorr )Zauthorization_headerZ auth_schemer r r r �parse_authorization_headerJ s r( )r Zurllib.requestZrequestr! Zoauthlib.commonr r ZUNICODE_ASCII_CHARACTER_SETr r r r r" r$ r( r r r r �<module> s oauth1/rfc5849/__pycache__/__init__.cpython-39.pyc 0000644 00000024330 15125174064 0015460 0 ustar 00 a �#/d�A � @ s� d Z ddlZddlZddlZddlmZ ddlmZm Z m Z m Z m Z ddl mZmZ e�e�ZdZdZdZeZd Zd Zd ZeZd ZeeeeeeefZ d Z dZ dZ dZ G dd� d�Z!dS )a� oauthlib.oauth1.rfc5849 ~~~~~~~~~~~~~~ This module is an implementation of various logic needed for signing and checking OAuth 1.0 RFC 5849 requests. It supports all three standard signature methods defined in RFC 5849: - HMAC-SHA1 - RSA-SHA1 - PLAINTEXT It also supports signature methods that are not defined in RFC 5849. These are based on the standard ones but replace SHA-1 with the more secure SHA-256: - HMAC-SHA256 - RSA-SHA256 � N)�Request�generate_nonce�generate_timestamp� to_unicode� urlencode� )� parameters� signaturez HMAC-SHA1z HMAC-SHA256z HMAC-SHA512zRSA-SHA1z RSA-SHA256z RSA-SHA512Z PLAINTEXTZ AUTH_HEADERZQUERYZBODY�!application/x-www-form-urlencodedc @ s� e Zd ZdZeejeeje ej e ej e ejeejeejiZedd� �Zddddeedddddddf dd�Zdd � Zd d � Zd d � Zddd�Zddd�Z dS )�Clientz2A client used to sign OAuth 1.0 RFC 5849 requests.c C s || j |< d S �N)�SIGNATURE_METHODS)�clsZ method_nameZmethod_callback� r �D/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/__init__.py�register_signature_methodY s z Client.register_signature_methodN�utf-8c s� � fdd�}||�| _ ||�| _||�| _||�| _||�| _||�| _||�| _||�| _|| �| _|| �| _ |� �| _ || �| _ || �| _ ||�| _ dS )a� Create an OAuth 1 client. :param client_key: Client key (consumer key), mandatory. :param resource_owner_key: Resource owner key (oauth token). :param resource_owner_secret: Resource owner secret (oauth token secret). :param callback_uri: Callback used when obtaining request token. :param signature_method: SIGNATURE_HMAC, SIGNATURE_RSA or SIGNATURE_PLAINTEXT. :param signature_type: SIGNATURE_TYPE_AUTH_HEADER (default), SIGNATURE_TYPE_QUERY or SIGNATURE_TYPE_BODY depending on where you want to embed the oauth credentials. :param rsa_key: RSA key used with SIGNATURE_RSA. :param verifier: Verifier used when obtaining an access token. :param realm: Realm (scope) to which access is being requested. :param encoding: If you provide non-unicode input you may use this to have oauthlib automatically convert. :param decoding: If you wish that the returned uri, headers and body from sign be encoded back from unicode, then set decoding to your preferred encoding, i.e. utf-8. :param nonce: Use this nonce instead of generating one. (Mainly for testing) :param timestamp: Use this timestamp instead of using current. (Mainly for testing) c s � rt | � �S | S r )r )�x��encodingr r �<lambda>~ � z!Client.__init__.<locals>.<lambda>N)� client_key� client_secret�resource_owner_key�resource_owner_secret�signature_method�signature_type� callback_uri�rsa_key�verifier�realmr �decoding�nonce� timestamp)�selfr r r r r r r r r r! r r" r# r$ �encoder r r �__init__] s ! zClient.__init__c C sp t | ��� }|d rdnd |d< |d r,dnd |d< |d r@dnd |d< d�dd� |�� D ��}d�| jj|�S ) Nr z****r r z, c s s | ]\}}d � ||�V qdS )z{}={}N)�format)�.0�k�vr r r � <genexpr>� r z"Client.__repr__.<locals>.<genexpr>z<{} {}>)�vars�copy�join�itemsr( � __class__�__name__)r% �attrsZ attribute_strr r r �__repr__� s ��zClient.__repr__c C s� | j tkrt�| j| j�S | �|�\}}}tjt�|�j ||d�}t � d� |�� t� |�}t�||�dd��}t � d� |�� t � d� |�� t�|j||�}t � d� |�� | j | jvr�td��| j| j || �} t � d � | �� | S ) aw Get an OAuth signature to be used in signing a request To satisfy `section 3.4.1.2`_ item 2, if the request argument's headers dict attribute contains a Host item, its value will replace any netloc part of the request argument's uri attribute value. .. _`section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2 )Z uri_query�body�headerszCollected params: {}ZHostNzNormalized params: {}zNormalized URI: {}z"Signing: signature base string: {}zInvalid signature method.z Signature: {})r �SIGNATURE_PLAINTEXTr Zsign_plaintextr r �_renderZcollect_parameters�urlparse�query�log�debugr( Znormalize_parametersZbase_string_uri�getZsignature_base_string� http_methodr � ValueError) r% �request�urir6 r5 Zcollected_paramsZnormalized_paramsZnormalized_uriZ base_stringZsigr r r �get_oauth_signature� s0 � � � zClient.get_oauth_signaturec C s� | j du rt� n| j }| jdu r&t� n| j}d|fd|fdd| jfd| jfg}| jrd|�d| jf� | jrz|�d| jf� | j r�|�d | j f� |j � d d�}|o�|� d �d k }|j dur�|r�|�d t�t�|j �d���� ��d�f� |S )zMGet the basic OAuth parameters to be used in generating a signature. NZ oauth_nonceZoauth_timestamp)Z oauth_versionz1.0Zoauth_signature_methodZoauth_consumer_keyZ oauth_tokenZoauth_callbackZoauth_verifier� Content-Typer r Zoauth_body_hashr )r# r r$ r r r r �appendr r r6 r= �findr5 �base64Z b64encode�hashlibZsha1r& �digest�decode)r% r@ r# r$ �params� content_typeZcontent_type_eligibler r r �get_oauth_params� s2 ����� ,zClient.get_oauth_paramsFc C s� |j |j|j }}}| jtkr6tj|j|j|d�}n^| jtkrp|j durpt� |j|j �}|rft |�}d|d< n$| jt kr�t� |j|j �}ntd��|||fS )a Render a signed request according to signature type Returns a 3-tuple containing the request URI, headers, and body. If the formencode argument is True and the body contains parameters, it is escaped and returned as a valid formencoded string. )r! Nr rC z!Unknown signature type specified.)rA r6 r5 r �SIGNATURE_TYPE_AUTH_HEADERr Zprepare_headers� oauth_params�SIGNATURE_TYPE_BODY� decoded_bodyZprepare_form_encoded_bodyr �SIGNATURE_TYPE_QUERYZprepare_request_uri_queryr? )r% r@ � formencoder! rA r6 r5 r r r r8 � s$ �� �zClient._render�GETc C sp t ||||| jd�}|j�dd�}|o.|�d�}|tk} |jdu} |rT| rTtd��nh| rf| sftd��nV| s�| r�td�|pzdt���n8| j t kr�| r�| r�|r�td ��n|� � d v r�| r�td ��| � |�|_ |j �d | �|�f� | j|d |p�| jd�\}}}| j�rft�d| j� |�| j�}|�r.|�| j�n|}i } |�� D ]"\} } | �| j�| | �| j�< �q>| }|||fS )aF Sign a request Signs an HTTP request with the specified parts. Returns a 3-tuple of the signed request's URI, headers, and body. Note that http_method is not returned as it is unaffected by the OAuth signing process. Also worth noting is that duplicate parameters will be included in the signature, regardless of where they are specified (query, body). The body argument may be a dict, a list of 2-tuples, or a formencoded string. The Content-Type header must be 'application/x-www-form-urlencoded' if it is present. If the body argument is not one of the above, it will be returned verbatim as it is unaffected by the OAuth signing process. Attempting to sign a request with non-formencoded data using the OAuth body signature type is invalid and will raise an exception. If the body does contain parameters, it will be returned as a properly- formatted formencoded string. Body may not be included if the http_method is either GET or HEAD as this changes the semantic meaning of the request. All string data MUST be unicode or be encoded with the same encoding scheme supplied to the Client constructor, default utf-8. This includes strings inside body dicts, for example. r rC Nz multipart/z?Headers indicate a multipart body but body contains parameters.z?Headers indicate a formencoded body but body was not decodable.zEBody contains parameters but Content-Type header was {} instead of {}znot setz=Body signatures may only be used with form-urlencoded content)rS ZHEADz*GET/HEAD requests should not include body.Zoauth_signatureT)rR r! z%Encoding URI, headers and body to %s.)r r r6 r= � startswith� CONTENT_TYPE_FORM_URLENCODEDrP r? r( r rO �upperrL rN rD rB r8 r! r" r; r< r& r0 )r% rA r> r5 r6 r! r@ rK Z multipartZshould_have_paramsZ has_paramsZ new_headersr* r+ r r r �sign sd � ���� ���� �� z Client.sign)FN)rS NNN) r2 � __module__� __qualname__�__doc__�SIGNATURE_HMAC_SHA1r Zsign_hmac_sha1_with_client�SIGNATURE_HMAC_SHA256Z sign_hmac_sha256_with_client�SIGNATURE_HMAC_SHA512Z sign_hmac_sha512_with_client�SIGNATURE_RSA_SHA1Zsign_rsa_sha1_with_client�SIGNATURE_RSA_SHA256Zsign_rsa_sha256_with_client�SIGNATURE_RSA_SHA512Zsign_rsa_sha512_with_clientr7 Zsign_plaintext_with_clientr � classmethodr rM r' r4 rB rL r8 rW r r r r r J s4 � � 2 )# %r )"rZ rF rG Zlogging� urllib.parse�parser9 Zoauthlib.commonr r r r r � r r Z getLoggerr2 r; r[ r\ r] ZSIGNATURE_HMACr^ r_ r` Z SIGNATURE_RSAr7 r rM rQ rO rU r r r r r �<module> s: � oauth1/rfc5849/endpoints/__pycache__/resource.cpython-39.opt-1.pyc 0000644 00000007676 15125174064 0020530 0 ustar 00 a \��`� � @ sB d Z ddlZddlmZ ddlmZ e�e�ZG dd� de�Z dS ) z� oauthlib.oauth1.rfc5849.endpoints.resource ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of the resource protection provider logic of OAuth 1.0 RFC 5849. � N� )�errors� )� BaseEndpointc @ s e Zd ZdZddd�ZdS )�ResourceEndpointa! An endpoint responsible for protecting resources. Typical use is to instantiate with a request validator and invoke the ``validate_protected_resource_request`` in a decorator around a view function. If the request is valid, invoke and return the response of the view. If invalid create and return an error response directly from the decorator. See :doc:`/oauth1/validator` for details on which validator methods to implement for this endpoint. An example decorator:: from functools import wraps from your_validator import your_validator from oauthlib.oauth1 import ResourceEndpoint endpoint = ResourceEndpoint(your_validator) def require_oauth(realms=None): def decorator(f): @wraps(f) def wrapper(request, *args, **kwargs): v, r = provider.validate_protected_resource_request( request.url, http_method=request.method, body=request.data, headers=request.headers, realms=realms or []) if v: return f(*args, **kwargs) else: return abort(403) �GETNc C s� z| � ||||�}W n tjy* Y dS 0 z| �|� | �|� W n tjy` d|f Y S 0 |jspd|fS | j�|j�s�d|fS | jj|j |j |j ||jd�s�d|fS | j� |j |�}|s�| jj |_ | j�|j |j|�}|s�| jj|_| jj|j |j||j|d�} | �|�} ||jd< ||jd< | |jd< | |jd< t||| | f�} | �s�t�d � t�d |� t�d |� t�d | � t�d | � | |fS )a� Create a request token response, with a new request token if valid. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :param realms: A list of realms the resource is protected under. This will be supplied to the ``validate_realms`` method of the request validator. :returns: A tuple of 2 elements. 1. True if valid, False otherwise. 2. An oauthlib.common.Request object. )FNF)Z access_token)�uri�realmsZclientZresource_ownerZrealmZ signaturez&[Failure] request verification failed.zValid client: %szValid token: %szValid realm: %szValid signature: %s)Z_create_requestr Z OAuth1ErrorZ_check_transport_securityZ_check_mandatory_parametersZresource_owner_keyZrequest_validatorZcheck_access_tokenZ validate_timestamp_and_nonceZ client_keyZ timestampZnonceZvalidate_client_keyZ dummy_clientZvalidate_access_tokenZdummy_access_tokenZvalidate_realmsr Z_check_signatureZ validator_log�all�log�info) �selfr Z http_method�bodyZheadersr ZrequestZ valid_clientZvalid_resource_ownerZ valid_realmZvalid_signature�v� r �N/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/resource.py�#validate_protected_resource_request5 sb �� � � � � z4ResourceEndpoint.validate_protected_resource_request)r NNN)�__name__� __module__� __qualname__�__doc__r r r r r r s " �r ) r Zlogging� r �baser Z getLoggerr r r r r r r �<module> s oauth1/rfc5849/endpoints/__pycache__/resource.cpython-39.pyc 0000644 00000007676 15125174064 0017571 0 ustar 00 a \��`� � @ sB d Z ddlZddlmZ ddlmZ e�e�ZG dd� de�Z dS ) z� oauthlib.oauth1.rfc5849.endpoints.resource ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of the resource protection provider logic of OAuth 1.0 RFC 5849. � N� )�errors� )� BaseEndpointc @ s e Zd ZdZddd�ZdS )�ResourceEndpointa! An endpoint responsible for protecting resources. Typical use is to instantiate with a request validator and invoke the ``validate_protected_resource_request`` in a decorator around a view function. If the request is valid, invoke and return the response of the view. If invalid create and return an error response directly from the decorator. See :doc:`/oauth1/validator` for details on which validator methods to implement for this endpoint. An example decorator:: from functools import wraps from your_validator import your_validator from oauthlib.oauth1 import ResourceEndpoint endpoint = ResourceEndpoint(your_validator) def require_oauth(realms=None): def decorator(f): @wraps(f) def wrapper(request, *args, **kwargs): v, r = provider.validate_protected_resource_request( request.url, http_method=request.method, body=request.data, headers=request.headers, realms=realms or []) if v: return f(*args, **kwargs) else: return abort(403) �GETNc C s� z| � ||||�}W n tjy* Y dS 0 z| �|� | �|� W n tjy` d|f Y S 0 |jspd|fS | j�|j�s�d|fS | jj|j |j |j ||jd�s�d|fS | j� |j |�}|s�| jj |_ | j�|j |j|�}|s�| jj|_| jj|j |j||j|d�} | �|�} ||jd< ||jd< | |jd< | |jd< t||| | f�} | �s�t�d � t�d |� t�d |� t�d | � t�d | � | |fS )a� Create a request token response, with a new request token if valid. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :param realms: A list of realms the resource is protected under. This will be supplied to the ``validate_realms`` method of the request validator. :returns: A tuple of 2 elements. 1. True if valid, False otherwise. 2. An oauthlib.common.Request object. )FNF)Z access_token)�uri�realmsZclientZresource_ownerZrealmZ signaturez&[Failure] request verification failed.zValid client: %szValid token: %szValid realm: %szValid signature: %s)Z_create_requestr Z OAuth1ErrorZ_check_transport_securityZ_check_mandatory_parametersZresource_owner_keyZrequest_validatorZcheck_access_tokenZ validate_timestamp_and_nonceZ client_keyZ timestampZnonceZvalidate_client_keyZ dummy_clientZvalidate_access_tokenZdummy_access_tokenZvalidate_realmsr Z_check_signatureZ validator_log�all�log�info) �selfr Z http_method�bodyZheadersr ZrequestZ valid_clientZvalid_resource_ownerZ valid_realmZvalid_signature�v� r �N/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/resource.py�#validate_protected_resource_request5 sb �� � � � � z4ResourceEndpoint.validate_protected_resource_request)r NNN)�__name__� __module__� __qualname__�__doc__r r r r r r s " �r ) r Zlogging� r �baser Z getLoggerr r r r r r r �<module> s oauth1/rfc5849/endpoints/__pycache__/base.cpython-39.opt-1.pyc 0000644 00000013500 15125174064 0017572 0 ustar 00 a �#/d�* � @ sr d Z ddlZddlmZmZmZ ddlmZmZm Z m Z m Z m Z m Z mZmZmZmZmZmZmZ G dd� d�ZdS )z� oauthlib.oauth1.rfc5849.endpoints.base ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for signing and checking OAuth 1.0 RFC 5849 requests. � N)�CaseInsensitiveDict�Request�generate_token� )� CONTENT_TYPE_FORM_URLENCODED�SIGNATURE_HMAC_SHA1�SIGNATURE_HMAC_SHA256�SIGNATURE_HMAC_SHA512�SIGNATURE_RSA_SHA1�SIGNATURE_RSA_SHA256�SIGNATURE_RSA_SHA512�SIGNATURE_PLAINTEXT�SIGNATURE_TYPE_AUTH_HEADER�SIGNATURE_TYPE_BODY�SIGNATURE_TYPE_QUERY�errors� signature�utilsc @ s@ e Zd Zddd�Zdd� Zdd� Zdd � Zd d � Zdd d�ZdS )� BaseEndpointNc C s || _ |p t| _d S )N)�request_validatorr �token_generator)�selfr r � r �J/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/base.py�__init__ s zBaseEndpoint.__init__c C s� t j|jddd�}t j|jdd�}t j|jdd�}g }|�|� |�|� |�|� ttdd� t|t � |�ft |t � |�ft |t � |�ff��}t |�dkr�d d � |D �}tjd d �|�fd ��z|d \}}} W n ty� tjdd ��Y n0 ||| fS )z�Extracts parameters from query, headers and body. Signature type is set to the source in which parameters were found. FT)�headers�exclude_oauth_signatureZ with_realm)�bodyr )� uri_queryr c S s | d S )Nr r )�sr r r �<lambda>- � z=BaseEndpoint._get_signature_type_and_params.<locals>.<lambda>� c S s g | ] }|d �qS )r r )�.0r r r r � <listcomp>7 r! z?BaseEndpoint._get_signature_type_and_params.<locals>.<listcomp>zFoauth_ params must come from only 1 signaturetype but were found in %sz, �� descriptionr �#Missing mandatory OAuth parameters.)r Zcollect_parametersr r r �extend�list�filterr r Zfilter_oauth_paramsr r �lenr �InvalidRequestError�join� IndexError) r �requestZ header_paramsZ body_paramsZ query_params�paramsZ!signature_types_with_oauth_paramsZ found_types�signature_type� oauth_paramsr r r � _get_signature_type_and_params sP ��� ���� ��� � z+BaseEndpoint._get_signature_type_and_paramsc C s& t |pi �}d|v r0t|d v r0t||||�}nt||d|�}| �|�\}}}tt|��t|�krntjdd��t|�}|�d�|_ |�d�|_ |�d�|_ |�d�|_ |�d �|_ |�d �|_|�d �|_|�d �|_t|��d �|_||_dd� |D �|_d |j�dd�v �r"dd� |jD �|_|S )Nz Content-Type� zDuplicate OAuth1 entries.r% �oauth_signatureZoauth_consumer_keyZ oauth_tokenZ oauth_nonceZoauth_timestampZoauth_callbackZoauth_verifierZoauth_signature_method�realmc S s g | ]\}}|d kr||f�qS )r5 r �r# �k�vr r r r$ f r! z0BaseEndpoint._create_request.<locals>.<listcomp>Z Authorizationc S s g | ]\}}|d kr||f�qS )r6 r r7 r r r r$ i s �)r r r r3 r+ �dictr r, �getr � client_key�resource_owner_key�nonce� timestampZ redirect_uriZverifier�signature_methodr6 r2 r0 r ) r �uriZ http_methodr r r/ r1 r0 r2 r r r �_create_requestF s: ��� �z BaseEndpoint._create_requestc C s$ | j jr |j�� �d�s t�� �d S )Nzhttps://)r Z enforce_sslrA �lower� startswithr ZInsecureTransportError)r r/ r r r �_check_transport_securityn s �z&BaseEndpoint._check_transport_securityc C s$ t |j|j|j|j|jf�s(tjdd��|j| jj vrPtj d� |j| jj �d��d|j v rt|j d dkrttjdd��t |j�dkr�tjdd��zt|j�}W n ty� tjd d��Y n.0 tt�� | �| jjkr�tjd | jj d��| j�|j��stjd d��| j�|j��s tjd d��d S ) Nr' r% z"Invalid signature, {} not in {!r}.Z oauth_versionz1.0zInvalid OAuth version.� zInvalid timestamp sizez Timestamp must be an integer.zCTimestamp given is invalid, differ from allowed by over %s seconds.zInvalid client key format.zInvalid nonce format.)�allr r< r> r? r@ r r, r Zallowed_signature_methodsZInvalidSignatureMethodError�formatr2 r+ �int� ValueError�abs�timeZtimestamp_lifetimeZcheck_client_keyZ check_nonce)r r/ �tsr r r �_check_mandatory_parameterst s\ �� ��� ��� � ����z(BaseEndpoint._check_mandatory_parametersFc C s� |j tttfv rtd��n�| j�|j|�}d }|jrb|rN| j� |j|j|�}n| j� |j|j|�}|j t kr|t � |||�}nR|j tkr�t �|||�}n8|j tkr�t �|||�}n |j tkr�t �|||�}nd}|S )Nz)Using RSA-SHA is deprecated, use HMAC-SHAF)r@ r r r rJ r Zget_client_secretr< r= Zget_request_token_secretZget_access_token_secretr r Zverify_hmac_sha1r Zverify_hmac_sha256r Zverify_hmac_sha512r Zverify_plaintext)r r/ Zis_token_requestZ client_secretZresource_owner_secretZvalid_signaturer r r �_check_signature� sN � ����� � � � �z BaseEndpoint._check_signature)N)F) �__name__� __module__� __qualname__r r3 rB rE rN rO r r r r r s *(Br )�__doc__rL Zoauthlib.commonr r r r4 r r r r r r r r r r r r r r r r r r r �<module> s @ oauth1/rfc5849/endpoints/__pycache__/pre_configured.cpython-39.pyc 0000644 00000001311 15125174064 0020711 0 ustar 00 a \��` � @ s2 d dl mZmZmZmZ G dd� deeee�ZdS )� )�AccessTokenEndpoint�AuthorizationEndpoint�RequestTokenEndpoint�ResourceEndpointc @ s e Zd Zdd� ZdS )�WebApplicationServerc C s4 t �| |� t�| |� t�| |� t�| |� d S )N)r �__init__r r r )�selfZrequest_validator� r �T/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/pre_configured.pyr s z WebApplicationServer.__init__N)�__name__� __module__� __qualname__r r r r r r s r N)� r r r r r r r r r �<module> s � oauth1/rfc5849/endpoints/__pycache__/access_token.cpython-39.opt-1.pyc 0000644 00000014242 15125174064 0021325 0 ustar 00 a \��`�$ � @ sN d Z ddlZddlmZ ddlmZ ddlmZ e�e �Z G dd � d e�Z dS ) aR oauthlib.oauth1.rfc5849.endpoints.access_token ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of the access token provider logic of OAuth 1.0 RFC 5849. It validates the correctness of access token requests, creates and persists tokens as well as create the proper response to be returned to the client. � N)� urlencode� )�errors� )� BaseEndpointc @ s* e Zd ZdZdd� Zd dd�Zdd � ZdS ) �AccessTokenEndpointa� An endpoint responsible for providing OAuth 1 access tokens. Typical use is to instantiate with a request validator and invoke the ``create_access_token_response`` from a view function. The tuple returned has all information necessary (body, status, headers) to quickly form and return a proper response. See :doc:`/oauth1/validator` for details on which validator methods to implement for this endpoint. c C sR | j �|j|�|_| �� | �� d�|j�d�}|�|� | j �||� t|� � �S )aH Create and save a new access token. Similar to OAuth 2, indication of granted scopes will be included as a space separated list in ``oauth_authorized_realms``. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The token as an urlencoded string. � )Z oauth_tokenZoauth_token_secretZoauth_authorized_realms) �request_validatorZ get_realms�resource_owner_keyZrealmsZtoken_generator�join�updateZsave_access_tokenr �items)�self�request� credentials�token� r �R/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/access_token.py�create_access_token s � � z'AccessTokenEndpoint.create_access_token�GETNc C s� ddi}zb| � ||||�}| �|�\}} |r\| �||p8i �} | j�|j|j|� || dfW S i ddfW S W n4 tjy� } z|| j | j fW Y d} ~ S d} ~ 0 0 dS )a Create an access token response, with a new request token if valid. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :param credentials: A list of extra credentials to include in the token. :returns: A tuple of 3 elements. 1. A dict of headers to set on the response. 2. The response body as a string. 3. The response status code as an integer. An example of a valid request:: >>> from your_validator import your_validator >>> from oauthlib.oauth1 import AccessTokenEndpoint >>> endpoint = AccessTokenEndpoint(your_validator) >>> h, b, s = endpoint.create_access_token_response( ... 'https://your.provider/access_token?foo=bar', ... headers={ ... 'Authorization': 'OAuth oauth_token=234lsdkf....' ... }, ... credentials={ ... 'my_specific': 'argument', ... }) >>> h {'Content-Type': 'application/x-www-form-urlencoded'} >>> b 'oauth_token=lsdkfol23w54jlksdef&oauth_token_secret=qwe089234lkjsdf&oauth_authorized_realms=movies+pics&my_specific=argument' >>> s 200 An response to invalid request would have a different body and status:: >>> b 'error=invalid_request&description=missing+resource+owner+key' >>> s 400 The same goes for an an unauthorized request: >>> b '' >>> s 401 z Content-Typez!application/x-www-form-urlencoded�� Ni� ) Z_create_request� validate_access_token_requestr r Zinvalidate_request_token� client_keyr r Z OAuth1ErrorZ urlencodedZ status_code) r ZuriZ http_method�bodyZheadersr Z resp_headersr ZvalidZprocessed_requestr �er r r � create_access_token_response6 s" 0�� z0AccessTokenEndpoint.create_access_token_responsec C sx | � |� | �|� |js&tjdd��| j�|j�s@tjdd��|jsRtjdd��| j�|j�sltjdd��| jj |j |j |j ||jd�s�d|fS | j� |j |�}|s�| jj|_ | j�|j |j|�}|s�| jj|_| j�|j |j|j|�}| j|dd �}||jd < ||jd < ||jd < ||jd < t||||f�}|�spt�d� t�d|� t�d|� t�d|� t�d|� ||fS )aJ Validate an access token request. :param request: OAuthlib request. :type request: oauthlib.common.Request :raises: OAuth1Error if the request is invalid. :returns: A tuple of 2 elements. 1. The validation result (True or False). 2. The request object. zMissing resource owner.)� descriptionz"Invalid resource owner key format.zMissing verifier.zInvalid verifier format.)Z request_tokenFT)Zis_token_requestZclientZresource_owner�verifierZ signaturez&[Failure] request verification failed.zValid client:, %szValid token:, %szValid verifier:, %szValid signature:, %s)Z_check_transport_securityZ_check_mandatory_parametersr r ZInvalidRequestErrorr Zcheck_request_tokenr Zcheck_verifierZ validate_timestamp_and_noncer Z timestampZnonceZvalidate_client_keyZ dummy_clientZvalidate_request_tokenZdummy_request_tokenZvalidate_verifierZ_check_signatureZ validator_log�all�log�info)r r Z valid_clientZvalid_resource_ownerZvalid_verifierZvalid_signature�vr r r r w sp ������ � � � � z1AccessTokenEndpoint.validate_access_token_request)r NNN)�__name__� __module__� __qualname__�__doc__r r r r r r r r s � Ar ) r% ZloggingZoauthlib.commonr � r �baser Z getLoggerr" r r r r r r �<module> s oauth1/rfc5849/endpoints/__pycache__/authorization.cpython-39.opt-1.pyc 0000644 00000013772 15125174064 0021573 0 ustar 00 a \��`D � @ sH d Z ddlmZ ddlmZ ddlmZ ddlmZ G dd � d e�Z d S ) z� oauthlib.oauth1.rfc5849.endpoints.authorization ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for signing and checking OAuth 1.0 RFC 5849 requests. � )� urlencode)�add_params_to_uri� )�errors� )� BaseEndpointc @ s, e Zd ZdZdd� Zd dd�Zd dd �ZdS ) �AuthorizationEndpointa An endpoint responsible for letting authenticated users authorize access to their protected resources to a client. Typical use would be to have two views, one for displaying the authorization form and one to process said form on submission. The first view will want to utilize ``get_realms_and_credentials`` to fetch requested realms and useful client credentials, such as name and description, to be used when creating the authorization form. During form processing you can use ``create_authorization_response`` to validate the request, create a verifier as well as prepare the final redirection URI used to send the user back to the client. See :doc:`/oauth1/validator` for details on which validator methods to implement for this endpoint. c C s0 |j | �� d�}|�|� | j�|j ||� |S )z�Create and save a new request token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param credentials: A dict of extra token credentials. :returns: The verifier as a dict. )Z oauth_tokenZoauth_verifier)�resource_owner_keyZtoken_generator�update�request_validatorZ save_verifier)�self�request� credentials�verifier� r �S/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/authorization.py�create_verifier% s � �z%AuthorizationEndpoint.create_verifier�GETNc C s� | j ||||d�}|js"t�d��| j�|j|�s:t�� �||_|jrf| j�|j|j|�sftjdd��| � ||pri �}| j� |j|�} | dkr�ddi} t |�} | | dfS t | |� � �} d | id d fS d S ) ax Create an authorization response, with a new request token if valid. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :param credentials: A list of credentials to include in the verifier. :returns: A tuple of 3 elements. 1. A dict of headers to set on the response. 2. The response body as a string. 3. The response status code as an integer. If the callback URI tied to the current token is "oob", a response with a 200 status code will be returned. In this case, it may be desirable to modify the response to better display the verifier to the client. An example of an authorization request:: >>> from your_validator import your_validator >>> from oauthlib.oauth1 import AuthorizationEndpoint >>> endpoint = AuthorizationEndpoint(your_validator) >>> h, b, s = endpoint.create_authorization_response( ... 'https://your.provider/authorize?oauth_token=...', ... credentials={ ... 'extra': 'argument', ... }) >>> h {'Location': 'https://the.client/callback?oauth_verifier=...&extra=argument'} >>> b None >>> s 302 An example of a request with an "oob" callback:: >>> from your_validator import your_validator >>> from oauthlib.oauth1 import AuthorizationEndpoint >>> endpoint = AuthorizationEndpoint(your_validator) >>> h, b, s = endpoint.create_authorization_response( ... 'https://your.provider/authorize?foo=bar', ... credentials={ ... 'extra': 'argument', ... }) >>> h {'Content-Type': 'application/x-www-form-urlencoded'} >>> b 'oauth_verifier=...&extra=argument' >>> s 200 �� http_method�body�headersz(Missing mandatory parameter oauth_token.zEUser granted access to realms outside of what the client may request.)� descriptionZoobz Content-Typez!application/x-www-form-urlencoded�� ZLocationNi. )�_create_requestr r ZInvalidRequestErrorr �verify_request_token�InvalidClientError�realmsZ verify_realmsr Zget_redirect_urir r �items) r �urir r r r r r r Z redirect_uriZresponse_headersZ response_bodyZpopulated_redirectr r r � create_authorization_response6 s> 4 ��� ���� �z3AuthorizationEndpoint.create_authorization_responsec C sH | j ||||d�}| j�|j|�s*t�� �| j�|j|�}|d|jifS )a Fetch realms and credentials for the presented request token. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :returns: A tuple of 2 elements. 1. A list of request realms. 2. A dict of credentials which may be useful in creating the authorization form. r r )r r r r r r Z get_realms)r r r r r r r r r r �get_realms_and_credentials� s ���z0AuthorizationEndpoint.get_realms_and_credentials)r NNNN)r NN)�__name__� __module__� __qualname__�__doc__r r r! r r r r r s � R �r N) r% � urllib.parser Zoauthlib.commonr � r �baser r r r r r �<module> s oauth1/rfc5849/endpoints/__pycache__/request_token.cpython-39.pyc 0000644 00000013765 15125174064 0020626 0 ustar 00 a \��`M$ � @ sN d Z ddlZddlmZ ddlmZ ddlmZ e�e �Z G dd � d e�Z dS ) aV oauthlib.oauth1.rfc5849.endpoints.request_token ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of the request token provider logic of OAuth 1.0 RFC 5849. It validates the correctness of request token requests, creates and persists tokens as well as create the proper response to be returned to the client. � N)� urlencode� )�errors� )� BaseEndpointc @ s* e Zd ZdZdd� Zd dd�Zdd � ZdS ) �RequestTokenEndpointa� An endpoint responsible for providing OAuth 1 request tokens. Typical use is to instantiate with a request validator and invoke the ``create_request_token_response`` from a view function. The tuple returned has all information necessary (body, status, headers) to quickly form and return a proper response. See :doc:`/oauth1/validator` for details on which validator methods to implement for this endpoint. c C s8 | � � | � � dd�}|�|� | j�||� t|�� �S )z�Create and save a new request token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param credentials: A dict of extra token credentials. :returns: The token as an urlencoded string. �true)Z oauth_tokenZoauth_token_secretZoauth_callback_confirmed)Ztoken_generator�update�request_validatorZsave_request_tokenr �items)�self�request� credentials�token� r �S/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/request_token.py�create_request_token s � z)RequestTokenEndpoint.create_request_token�GETNc C s� ddi}zN| � ||||�}| �|�\}} |rH| �||p8i �} || dfW S i ddfW S W n4 tjy� } z|| j| jfW Y d} ~ S d} ~ 0 0 dS )a Create a request token response, with a new request token if valid. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :param credentials: A list of extra credentials to include in the token. :returns: A tuple of 3 elements. 1. A dict of headers to set on the response. 2. The response body as a string. 3. The response status code as an integer. An example of a valid request:: >>> from your_validator import your_validator >>> from oauthlib.oauth1 import RequestTokenEndpoint >>> endpoint = RequestTokenEndpoint(your_validator) >>> h, b, s = endpoint.create_request_token_response( ... 'https://your.provider/request_token?foo=bar', ... headers={ ... 'Authorization': 'OAuth realm=movies user, oauth_....' ... }, ... credentials={ ... 'my_specific': 'argument', ... }) >>> h {'Content-Type': 'application/x-www-form-urlencoded'} >>> b 'oauth_token=lsdkfol23w54jlksdef&oauth_token_secret=qwe089234lkjsdf&oauth_callback_confirmed=true&my_specific=argument' >>> s 200 An response to invalid request would have a different body and status:: >>> b 'error=invalid_request&description=missing+callback+uri' >>> s 400 The same goes for an an unauthorized request: >>> b '' >>> s 401 z Content-Typez!application/x-www-form-urlencoded�� Ni� )Z_create_request� validate_request_token_requestr r Z OAuth1ErrorZ urlencodedZ status_code) r ZuriZ http_method�bodyZheadersr Z resp_headersr ZvalidZprocessed_requestr �er r r � create_request_token_response1 s 0� z2RequestTokenEndpoint.create_request_token_responsec C sz | � |� | �|� |jr*|j�d�|_n| j�|j|�|_| j�|j�sdt j d� |j| jj�d��|j svt j dd��| jj |j|j|j||jd�s�d|fS | j�|j|�}|s�| jj|_| j�|j|j|�}| j�|j|j |�}|j s�td��| �|�}||jd< ||jd < ||jd < ||jd < t||||f�}|�srt�d � t�d |� t�d|� t�d|� t�d|� ||fS )aJ Validate a request token request. :param request: OAuthlib request. :type request: oauthlib.common.Request :raises: OAuth1Error if the request is invalid. :returns: A tuple of 2 elements. 1. The validation result (True or False). 2. The request object. � z#Invalid realm {}. Allowed are {!r}.)� descriptionzMissing callback URI.)Z request_tokenFzKRedirect URI must either be provided or set to a default during validation.Zclient�realm�callbackZ signaturez&[Failure] request verification failed.zValid client: %s.zValid realm: %s.zValid callback: %s.zValid signature: %s.)Z_check_transport_securityZ_check_mandatory_parametersr �splitZrealmsr Zget_default_realmsZ client_keyZ check_realmsr ZInvalidRequestError�formatZ redirect_uriZ validate_timestamp_and_nonceZ timestampZnonceZresource_owner_keyZvalidate_client_keyZ dummy_clientZvalidate_requested_realmsZvalidate_redirect_uri�NotImplementedErrorZ_check_signatureZ validator_log�all�log�info)r r Z valid_clientZ valid_realmZvalid_redirectZvalid_signature�vr r r r n s` � ���� � � � z3RequestTokenEndpoint.validate_request_token_request)r NNN)�__name__� __module__� __qualname__�__doc__r r r r r r r r s � =r ) r' ZloggingZoauthlib.commonr � r �baser Z getLoggerr$ r! r r r r r �<module> s oauth1/rfc5849/endpoints/__pycache__/authorization.cpython-39.pyc 0000644 00000013772 15125174064 0020634 0 ustar 00 a \��`D � @ sH d Z ddlmZ ddlmZ ddlmZ ddlmZ G dd � d e�Z d S ) z� oauthlib.oauth1.rfc5849.endpoints.authorization ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for signing and checking OAuth 1.0 RFC 5849 requests. � )� urlencode)�add_params_to_uri� )�errors� )� BaseEndpointc @ s, e Zd ZdZdd� Zd dd�Zd dd �ZdS ) �AuthorizationEndpointa An endpoint responsible for letting authenticated users authorize access to their protected resources to a client. Typical use would be to have two views, one for displaying the authorization form and one to process said form on submission. The first view will want to utilize ``get_realms_and_credentials`` to fetch requested realms and useful client credentials, such as name and description, to be used when creating the authorization form. During form processing you can use ``create_authorization_response`` to validate the request, create a verifier as well as prepare the final redirection URI used to send the user back to the client. See :doc:`/oauth1/validator` for details on which validator methods to implement for this endpoint. c C s0 |j | �� d�}|�|� | j�|j ||� |S )z�Create and save a new request token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param credentials: A dict of extra token credentials. :returns: The verifier as a dict. )Z oauth_tokenZoauth_verifier)�resource_owner_keyZtoken_generator�update�request_validatorZ save_verifier)�self�request� credentials�verifier� r �S/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/authorization.py�create_verifier% s � �z%AuthorizationEndpoint.create_verifier�GETNc C s� | j ||||d�}|js"t�d��| j�|j|�s:t�� �||_|jrf| j�|j|j|�sftjdd��| � ||pri �}| j� |j|�} | dkr�ddi} t |�} | | dfS t | |� � �} d | id d fS d S ) ax Create an authorization response, with a new request token if valid. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :param credentials: A list of credentials to include in the verifier. :returns: A tuple of 3 elements. 1. A dict of headers to set on the response. 2. The response body as a string. 3. The response status code as an integer. If the callback URI tied to the current token is "oob", a response with a 200 status code will be returned. In this case, it may be desirable to modify the response to better display the verifier to the client. An example of an authorization request:: >>> from your_validator import your_validator >>> from oauthlib.oauth1 import AuthorizationEndpoint >>> endpoint = AuthorizationEndpoint(your_validator) >>> h, b, s = endpoint.create_authorization_response( ... 'https://your.provider/authorize?oauth_token=...', ... credentials={ ... 'extra': 'argument', ... }) >>> h {'Location': 'https://the.client/callback?oauth_verifier=...&extra=argument'} >>> b None >>> s 302 An example of a request with an "oob" callback:: >>> from your_validator import your_validator >>> from oauthlib.oauth1 import AuthorizationEndpoint >>> endpoint = AuthorizationEndpoint(your_validator) >>> h, b, s = endpoint.create_authorization_response( ... 'https://your.provider/authorize?foo=bar', ... credentials={ ... 'extra': 'argument', ... }) >>> h {'Content-Type': 'application/x-www-form-urlencoded'} >>> b 'oauth_verifier=...&extra=argument' >>> s 200 �� http_method�body�headersz(Missing mandatory parameter oauth_token.zEUser granted access to realms outside of what the client may request.)� descriptionZoobz Content-Typez!application/x-www-form-urlencoded�� ZLocationNi. )�_create_requestr r ZInvalidRequestErrorr �verify_request_token�InvalidClientError�realmsZ verify_realmsr Zget_redirect_urir r �items) r �urir r r r r r r Z redirect_uriZresponse_headersZ response_bodyZpopulated_redirectr r r � create_authorization_response6 s> 4 ��� ���� �z3AuthorizationEndpoint.create_authorization_responsec C sH | j ||||d�}| j�|j|�s*t�� �| j�|j|�}|d|jifS )a Fetch realms and credentials for the presented request token. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :returns: A tuple of 2 elements. 1. A list of request realms. 2. A dict of credentials which may be useful in creating the authorization form. r r )r r r r r r Z get_realms)r r r r r r r r r r �get_realms_and_credentials� s ���z0AuthorizationEndpoint.get_realms_and_credentials)r NNNN)r NN)�__name__� __module__� __qualname__�__doc__r r r! r r r r r s � R �r N) r% � urllib.parser Zoauthlib.commonr � r �baser r r r r r �<module> s oauth1/rfc5849/endpoints/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000001047 15125174064 0020422 0 ustar 00 a \��`G � @ sX d dl mZ d dlmZ d dlmZ d dlmZ d dlm Z d dl m Z d dl m Z dS ) � )�AccessTokenEndpoint)�AuthorizationEndpoint)� BaseEndpoint)�RequestTokenEndpoint)�ResourceEndpoint)�SignatureOnlyEndpoint)�WebApplicationServerN)Z access_tokenr Z authorizationr �baser Z request_tokenr �resourcer Zsignature_onlyr Zpre_configuredr � r r �N/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/__init__.py�<module> s oauth1/rfc5849/endpoints/__pycache__/signature_only.cpython-39.pyc 0000644 00000004346 15125174064 0020773 0 ustar 00 a \��`� � @ sB d Z ddlZddlmZ ddlmZ e�e�ZG dd� de�Z dS ) z� oauthlib.oauth1.rfc5849.endpoints.signature_only ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of the signing logic of OAuth 1.0 RFC 5849. � N� )�errors� )� BaseEndpointc @ s e Zd ZdZddd�ZdS )�SignatureOnlyEndpointz>An endpoint only responsible for verifying an oauth signature.�GETNc C sF z| � ||||�}W n6 tjyJ } z t�d| � W Y d}~dS d}~0 0 z| �|� | �|� W n< tjy� } z"t�d| � d|fW Y d}~S d}~0 0 | j�|j |j |j |�s�t� d� d|fS | j� |j |�}|� s�| jj|_ | �|�}||jd< ||jd< t||f�} | �s>t�d� t�d |� t�d |� | |fS ) a� Validate a signed OAuth request. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :returns: A tuple of 2 elements. 1. True if valid, False otherwise. 2. An oauthlib.common.Request object. z.Exception caught while validating request, %s.N)FNFz.[Failure] verification failed: timestamp/nonceZclientZ signaturez&[Failure] request verification failed.zValid client: %szValid signature: %s)Z_create_requestr Z OAuth1Error�log�infoZ_check_transport_securityZ_check_mandatory_parametersZrequest_validatorZ validate_timestamp_and_nonceZ client_keyZ timestampZnonce�debugZvalidate_client_keyZ dummy_clientZ_check_signatureZ validator_log�all) �selfZuriZ http_method�bodyZheadersZrequest�errZ valid_clientZvalid_signature�v� r �T/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/signature_only.py�validate_request sD � � � � z&SignatureOnlyEndpoint.validate_request)r NN)�__name__� __module__� __qualname__�__doc__r r r r r r s �r ) r Zlogging� r �baser Z getLoggerr r r r r r r �<module> s oauth1/rfc5849/endpoints/__pycache__/access_token.cpython-39.pyc 0000644 00000014242 15125174065 0020367 0 ustar 00 a \��`�$ � @ sN d Z ddlZddlmZ ddlmZ ddlmZ e�e �Z G dd � d e�Z dS ) aR oauthlib.oauth1.rfc5849.endpoints.access_token ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of the access token provider logic of OAuth 1.0 RFC 5849. It validates the correctness of access token requests, creates and persists tokens as well as create the proper response to be returned to the client. � N)� urlencode� )�errors� )� BaseEndpointc @ s* e Zd ZdZdd� Zd dd�Zdd � ZdS ) �AccessTokenEndpointa� An endpoint responsible for providing OAuth 1 access tokens. Typical use is to instantiate with a request validator and invoke the ``create_access_token_response`` from a view function. The tuple returned has all information necessary (body, status, headers) to quickly form and return a proper response. See :doc:`/oauth1/validator` for details on which validator methods to implement for this endpoint. c C sR | j �|j|�|_| �� | �� d�|j�d�}|�|� | j �||� t|� � �S )aH Create and save a new access token. Similar to OAuth 2, indication of granted scopes will be included as a space separated list in ``oauth_authorized_realms``. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The token as an urlencoded string. � )Z oauth_tokenZoauth_token_secretZoauth_authorized_realms) �request_validatorZ get_realms�resource_owner_keyZrealmsZtoken_generator�join�updateZsave_access_tokenr �items)�self�request� credentials�token� r �R/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/access_token.py�create_access_token s � � z'AccessTokenEndpoint.create_access_token�GETNc C s� ddi}zb| � ||||�}| �|�\}} |r\| �||p8i �} | j�|j|j|� || dfW S i ddfW S W n4 tjy� } z|| j | j fW Y d} ~ S d} ~ 0 0 dS )a Create an access token response, with a new request token if valid. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :param credentials: A list of extra credentials to include in the token. :returns: A tuple of 3 elements. 1. A dict of headers to set on the response. 2. The response body as a string. 3. The response status code as an integer. An example of a valid request:: >>> from your_validator import your_validator >>> from oauthlib.oauth1 import AccessTokenEndpoint >>> endpoint = AccessTokenEndpoint(your_validator) >>> h, b, s = endpoint.create_access_token_response( ... 'https://your.provider/access_token?foo=bar', ... headers={ ... 'Authorization': 'OAuth oauth_token=234lsdkf....' ... }, ... credentials={ ... 'my_specific': 'argument', ... }) >>> h {'Content-Type': 'application/x-www-form-urlencoded'} >>> b 'oauth_token=lsdkfol23w54jlksdef&oauth_token_secret=qwe089234lkjsdf&oauth_authorized_realms=movies+pics&my_specific=argument' >>> s 200 An response to invalid request would have a different body and status:: >>> b 'error=invalid_request&description=missing+resource+owner+key' >>> s 400 The same goes for an an unauthorized request: >>> b '' >>> s 401 z Content-Typez!application/x-www-form-urlencoded�� Ni� ) Z_create_request� validate_access_token_requestr r Zinvalidate_request_token� client_keyr r Z OAuth1ErrorZ urlencodedZ status_code) r ZuriZ http_method�bodyZheadersr Z resp_headersr ZvalidZprocessed_requestr �er r r � create_access_token_response6 s" 0�� z0AccessTokenEndpoint.create_access_token_responsec C sx | � |� | �|� |js&tjdd��| j�|j�s@tjdd��|jsRtjdd��| j�|j�sltjdd��| jj |j |j |j ||jd�s�d|fS | j� |j |�}|s�| jj|_ | j�|j |j|�}|s�| jj|_| j�|j |j|j|�}| j|dd �}||jd < ||jd < ||jd < ||jd < t||||f�}|�spt�d� t�d|� t�d|� t�d|� t�d|� ||fS )aJ Validate an access token request. :param request: OAuthlib request. :type request: oauthlib.common.Request :raises: OAuth1Error if the request is invalid. :returns: A tuple of 2 elements. 1. The validation result (True or False). 2. The request object. zMissing resource owner.)� descriptionz"Invalid resource owner key format.zMissing verifier.zInvalid verifier format.)Z request_tokenFT)Zis_token_requestZclientZresource_owner�verifierZ signaturez&[Failure] request verification failed.zValid client:, %szValid token:, %szValid verifier:, %szValid signature:, %s)Z_check_transport_securityZ_check_mandatory_parametersr r ZInvalidRequestErrorr Zcheck_request_tokenr Zcheck_verifierZ validate_timestamp_and_noncer Z timestampZnonceZvalidate_client_keyZ dummy_clientZvalidate_request_tokenZdummy_request_tokenZvalidate_verifierZ_check_signatureZ validator_log�all�log�info)r r Z valid_clientZvalid_resource_ownerZvalid_verifierZvalid_signature�vr r r r w sp ������ � � � � z1AccessTokenEndpoint.validate_access_token_request)r NNN)�__name__� __module__� __qualname__�__doc__r r r r r r r r s � Ar ) r% ZloggingZoauthlib.commonr � r �baser Z getLoggerr" r r r r r r �<module> s oauth1/rfc5849/endpoints/__pycache__/signature_only.cpython-39.opt-1.pyc 0000644 00000004346 15125174065 0021733 0 ustar 00 a \��`� � @ sB d Z ddlZddlmZ ddlmZ e�e�ZG dd� de�Z dS ) z� oauthlib.oauth1.rfc5849.endpoints.signature_only ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of the signing logic of OAuth 1.0 RFC 5849. � N� )�errors� )� BaseEndpointc @ s e Zd ZdZddd�ZdS )�SignatureOnlyEndpointz>An endpoint only responsible for verifying an oauth signature.�GETNc C sF z| � ||||�}W n6 tjyJ } z t�d| � W Y d}~dS d}~0 0 z| �|� | �|� W n< tjy� } z"t�d| � d|fW Y d}~S d}~0 0 | j�|j |j |j |�s�t� d� d|fS | j� |j |�}|� s�| jj|_ | �|�}||jd< ||jd< t||f�} | �s>t�d� t�d |� t�d |� | |fS ) a� Validate a signed OAuth request. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :returns: A tuple of 2 elements. 1. True if valid, False otherwise. 2. An oauthlib.common.Request object. z.Exception caught while validating request, %s.N)FNFz.[Failure] verification failed: timestamp/nonceZclientZ signaturez&[Failure] request verification failed.zValid client: %szValid signature: %s)Z_create_requestr Z OAuth1Error�log�infoZ_check_transport_securityZ_check_mandatory_parametersZrequest_validatorZ validate_timestamp_and_nonceZ client_keyZ timestampZnonce�debugZvalidate_client_keyZ dummy_clientZ_check_signatureZ validator_log�all) �selfZuriZ http_method�bodyZheadersZrequest�errZ valid_clientZvalid_signature�v� r �T/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/signature_only.py�validate_request sD � � � � z&SignatureOnlyEndpoint.validate_request)r NN)�__name__� __module__� __qualname__�__doc__r r r r r r s �r ) r Zlogging� r �baser Z getLoggerr r r r r r r �<module> s oauth1/rfc5849/endpoints/__pycache__/pre_configured.cpython-39.opt-1.pyc 0000644 00000001311 15125174065 0021651 0 ustar 00 a \��` � @ s2 d dl mZmZmZmZ G dd� deeee�ZdS )� )�AccessTokenEndpoint�AuthorizationEndpoint�RequestTokenEndpoint�ResourceEndpointc @ s e Zd Zdd� ZdS )�WebApplicationServerc C s4 t �| |� t�| |� t�| |� t�| |� d S )N)r �__init__r r r )�selfZrequest_validator� r �T/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/pre_configured.pyr s z WebApplicationServer.__init__N)�__name__� __module__� __qualname__r r r r r r s r N)� r r r r r r r r r �<module> s � oauth1/rfc5849/endpoints/__pycache__/request_token.cpython-39.opt-1.pyc 0000644 00000013765 15125174065 0021566 0 ustar 00 a \��`M$ � @ sN d Z ddlZddlmZ ddlmZ ddlmZ e�e �Z G dd � d e�Z dS ) aV oauthlib.oauth1.rfc5849.endpoints.request_token ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of the request token provider logic of OAuth 1.0 RFC 5849. It validates the correctness of request token requests, creates and persists tokens as well as create the proper response to be returned to the client. � N)� urlencode� )�errors� )� BaseEndpointc @ s* e Zd ZdZdd� Zd dd�Zdd � ZdS ) �RequestTokenEndpointa� An endpoint responsible for providing OAuth 1 request tokens. Typical use is to instantiate with a request validator and invoke the ``create_request_token_response`` from a view function. The tuple returned has all information necessary (body, status, headers) to quickly form and return a proper response. See :doc:`/oauth1/validator` for details on which validator methods to implement for this endpoint. c C s8 | � � | � � dd�}|�|� | j�||� t|�� �S )z�Create and save a new request token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param credentials: A dict of extra token credentials. :returns: The token as an urlencoded string. �true)Z oauth_tokenZoauth_token_secretZoauth_callback_confirmed)Ztoken_generator�update�request_validatorZsave_request_tokenr �items)�self�request� credentials�token� r �S/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/request_token.py�create_request_token s � z)RequestTokenEndpoint.create_request_token�GETNc C s� ddi}zN| � ||||�}| �|�\}} |rH| �||p8i �} || dfW S i ddfW S W n4 tjy� } z|| j| jfW Y d} ~ S d} ~ 0 0 dS )a Create a request token response, with a new request token if valid. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :param credentials: A list of extra credentials to include in the token. :returns: A tuple of 3 elements. 1. A dict of headers to set on the response. 2. The response body as a string. 3. The response status code as an integer. An example of a valid request:: >>> from your_validator import your_validator >>> from oauthlib.oauth1 import RequestTokenEndpoint >>> endpoint = RequestTokenEndpoint(your_validator) >>> h, b, s = endpoint.create_request_token_response( ... 'https://your.provider/request_token?foo=bar', ... headers={ ... 'Authorization': 'OAuth realm=movies user, oauth_....' ... }, ... credentials={ ... 'my_specific': 'argument', ... }) >>> h {'Content-Type': 'application/x-www-form-urlencoded'} >>> b 'oauth_token=lsdkfol23w54jlksdef&oauth_token_secret=qwe089234lkjsdf&oauth_callback_confirmed=true&my_specific=argument' >>> s 200 An response to invalid request would have a different body and status:: >>> b 'error=invalid_request&description=missing+callback+uri' >>> s 400 The same goes for an an unauthorized request: >>> b '' >>> s 401 z Content-Typez!application/x-www-form-urlencoded�� Ni� )Z_create_request� validate_request_token_requestr r Z OAuth1ErrorZ urlencodedZ status_code) r ZuriZ http_method�bodyZheadersr Z resp_headersr ZvalidZprocessed_requestr �er r r � create_request_token_response1 s 0� z2RequestTokenEndpoint.create_request_token_responsec C sz | � |� | �|� |jr*|j�d�|_n| j�|j|�|_| j�|j�sdt j d� |j| jj�d��|j svt j dd��| jj |j|j|j||jd�s�d|fS | j�|j|�}|s�| jj|_| j�|j|j|�}| j�|j|j |�}|j s�td��| �|�}||jd< ||jd < ||jd < ||jd < t||||f�}|�srt�d � t�d |� t�d|� t�d|� t�d|� ||fS )aJ Validate a request token request. :param request: OAuthlib request. :type request: oauthlib.common.Request :raises: OAuth1Error if the request is invalid. :returns: A tuple of 2 elements. 1. The validation result (True or False). 2. The request object. � z#Invalid realm {}. Allowed are {!r}.)� descriptionzMissing callback URI.)Z request_tokenFzKRedirect URI must either be provided or set to a default during validation.Zclient�realm�callbackZ signaturez&[Failure] request verification failed.zValid client: %s.zValid realm: %s.zValid callback: %s.zValid signature: %s.)Z_check_transport_securityZ_check_mandatory_parametersr �splitZrealmsr Zget_default_realmsZ client_keyZ check_realmsr ZInvalidRequestError�formatZ redirect_uriZ validate_timestamp_and_nonceZ timestampZnonceZresource_owner_keyZvalidate_client_keyZ dummy_clientZvalidate_requested_realmsZvalidate_redirect_uri�NotImplementedErrorZ_check_signatureZ validator_log�all�log�info)r r Z valid_clientZ valid_realmZvalid_redirectZvalid_signature�vr r r r n s` � ���� � � � z3RequestTokenEndpoint.validate_request_token_request)r NNN)�__name__� __module__� __qualname__�__doc__r r r r r r r r s � =r ) r' ZloggingZoauthlib.commonr � r �baser Z getLoggerr$ r! r r r r r �<module> s oauth1/rfc5849/endpoints/__pycache__/base.cpython-39.pyc 0000644 00000013500 15125174065 0016634 0 ustar 00 a �#/d�* � @ sr d Z ddlZddlmZmZmZ ddlmZmZm Z m Z m Z m Z m Z mZmZmZmZmZmZmZ G dd� d�ZdS )z� oauthlib.oauth1.rfc5849.endpoints.base ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for signing and checking OAuth 1.0 RFC 5849 requests. � N)�CaseInsensitiveDict�Request�generate_token� )� CONTENT_TYPE_FORM_URLENCODED�SIGNATURE_HMAC_SHA1�SIGNATURE_HMAC_SHA256�SIGNATURE_HMAC_SHA512�SIGNATURE_RSA_SHA1�SIGNATURE_RSA_SHA256�SIGNATURE_RSA_SHA512�SIGNATURE_PLAINTEXT�SIGNATURE_TYPE_AUTH_HEADER�SIGNATURE_TYPE_BODY�SIGNATURE_TYPE_QUERY�errors� signature�utilsc @ s@ e Zd Zddd�Zdd� Zdd� Zdd � Zd d � Zdd d�ZdS )� BaseEndpointNc C s || _ |p t| _d S )N)�request_validatorr �token_generator)�selfr r � r �J/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/base.py�__init__ s zBaseEndpoint.__init__c C s� t j|jddd�}t j|jdd�}t j|jdd�}g }|�|� |�|� |�|� ttdd� t|t � |�ft |t � |�ft |t � |�ff��}t |�dkr�d d � |D �}tjd d �|�fd ��z|d \}}} W n ty� tjdd ��Y n0 ||| fS )z�Extracts parameters from query, headers and body. Signature type is set to the source in which parameters were found. FT)�headers�exclude_oauth_signatureZ with_realm)�bodyr )� uri_queryr c S s | d S )Nr r )�sr r r �<lambda>- � z=BaseEndpoint._get_signature_type_and_params.<locals>.<lambda>� c S s g | ] }|d �qS )r r )�.0r r r r � <listcomp>7 r! z?BaseEndpoint._get_signature_type_and_params.<locals>.<listcomp>zFoauth_ params must come from only 1 signaturetype but were found in %sz, �� descriptionr �#Missing mandatory OAuth parameters.)r Zcollect_parametersr r r �extend�list�filterr r Zfilter_oauth_paramsr r �lenr �InvalidRequestError�join� IndexError) r �requestZ header_paramsZ body_paramsZ query_params�paramsZ!signature_types_with_oauth_paramsZ found_types�signature_type� oauth_paramsr r r � _get_signature_type_and_params sP ��� ���� ��� � z+BaseEndpoint._get_signature_type_and_paramsc C s& t |pi �}d|v r0t|d v r0t||||�}nt||d|�}| �|�\}}}tt|��t|�krntjdd��t|�}|�d�|_ |�d�|_ |�d�|_ |�d�|_ |�d �|_ |�d �|_|�d �|_|�d �|_t|��d �|_||_dd� |D �|_d |j�dd�v �r"dd� |jD �|_|S )Nz Content-Type� zDuplicate OAuth1 entries.r% �oauth_signatureZoauth_consumer_keyZ oauth_tokenZ oauth_nonceZoauth_timestampZoauth_callbackZoauth_verifierZoauth_signature_method�realmc S s g | ]\}}|d kr||f�qS )r5 r �r# �k�vr r r r$ f r! z0BaseEndpoint._create_request.<locals>.<listcomp>Z Authorizationc S s g | ]\}}|d kr||f�qS )r6 r r7 r r r r$ i s �)r r r r3 r+ �dictr r, �getr � client_key�resource_owner_key�nonce� timestampZ redirect_uriZverifier�signature_methodr6 r2 r0 r ) r �uriZ http_methodr r r/ r1 r0 r2 r r r �_create_requestF s: ��� �z BaseEndpoint._create_requestc C s$ | j jr |j�� �d�s t�� �d S )Nzhttps://)r Z enforce_sslrA �lower� startswithr ZInsecureTransportError)r r/ r r r �_check_transport_securityn s �z&BaseEndpoint._check_transport_securityc C s$ t |j|j|j|j|jf�s(tjdd��|j| jj vrPtj d� |j| jj �d��d|j v rt|j d dkrttjdd��t |j�dkr�tjdd��zt|j�}W n ty� tjd d��Y n.0 tt�� | �| jjkr�tjd | jj d��| j�|j��stjd d��| j�|j��s tjd d��d S ) Nr' r% z"Invalid signature, {} not in {!r}.Z oauth_versionz1.0zInvalid OAuth version.� zInvalid timestamp sizez Timestamp must be an integer.zCTimestamp given is invalid, differ from allowed by over %s seconds.zInvalid client key format.zInvalid nonce format.)�allr r< r> r? r@ r r, r Zallowed_signature_methodsZInvalidSignatureMethodError�formatr2 r+ �int� ValueError�abs�timeZtimestamp_lifetimeZcheck_client_keyZ check_nonce)r r/ �tsr r r �_check_mandatory_parameterst s\ �� ��� ��� � ����z(BaseEndpoint._check_mandatory_parametersFc C s� |j tttfv rtd��n�| j�|j|�}d }|jrb|rN| j� |j|j|�}n| j� |j|j|�}|j t kr|t � |||�}nR|j tkr�t �|||�}n8|j tkr�t �|||�}n |j tkr�t �|||�}nd}|S )Nz)Using RSA-SHA is deprecated, use HMAC-SHAF)r@ r r r rJ r Zget_client_secretr< r= Zget_request_token_secretZget_access_token_secretr r Zverify_hmac_sha1r Zverify_hmac_sha256r Zverify_hmac_sha512r Zverify_plaintext)r r/ Zis_token_requestZ client_secretZresource_owner_secretZvalid_signaturer r r �_check_signature� sN � ����� � � � �z BaseEndpoint._check_signature)N)F) �__name__� __module__� __qualname__r r3 rB rE rN rO r r r r r s *(Br )�__doc__rL Zoauthlib.commonr r r r4 r r r r r r r r r r r r r r r r r r r �<module> s @ oauth1/rfc5849/endpoints/__pycache__/__init__.cpython-39.pyc 0000644 00000001047 15125174065 0017464 0 ustar 00 a \��`G � @ sX d dl mZ d dlmZ d dlmZ d dlmZ d dlm Z d dl m Z d dl m Z dS ) � )�AccessTokenEndpoint)�AuthorizationEndpoint)� BaseEndpoint)�RequestTokenEndpoint)�ResourceEndpoint)�SignatureOnlyEndpoint)�WebApplicationServerN)Z access_tokenr Z authorizationr �baser Z request_tokenr �resourcer Zsignature_onlyr Zpre_configuredr � r r �N/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/__init__.py�<module> s oauth1/rfc5849/endpoints/base.py 0000644 00000025221 15125174065 0012350 0 ustar 00 # -*- coding: utf-8 -*- """ oauthlib.oauth1.rfc5849.endpoints.base ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for signing and checking OAuth 1.0 RFC 5849 requests. """ import time from oauthlib.common import CaseInsensitiveDict, Request, generate_token from .. import ( CONTENT_TYPE_FORM_URLENCODED, SIGNATURE_HMAC_SHA1, SIGNATURE_HMAC_SHA256, SIGNATURE_HMAC_SHA512, SIGNATURE_RSA_SHA1, SIGNATURE_RSA_SHA256, SIGNATURE_RSA_SHA512, SIGNATURE_PLAINTEXT, SIGNATURE_TYPE_AUTH_HEADER, SIGNATURE_TYPE_BODY, SIGNATURE_TYPE_QUERY, errors, signature, utils) class BaseEndpoint: def __init__(self, request_validator, token_generator=None): self.request_validator = request_validator self.token_generator = token_generator or generate_token def _get_signature_type_and_params(self, request): """Extracts parameters from query, headers and body. Signature type is set to the source in which parameters were found. """ # Per RFC5849, only the Authorization header may contain the 'realm' # optional parameter. header_params = signature.collect_parameters(headers=request.headers, exclude_oauth_signature=False, with_realm=True) body_params = signature.collect_parameters(body=request.body, exclude_oauth_signature=False) query_params = signature.collect_parameters(uri_query=request.uri_query, exclude_oauth_signature=False) params = [] params.extend(header_params) params.extend(body_params) params.extend(query_params) signature_types_with_oauth_params = list(filter(lambda s: s[2], ( (SIGNATURE_TYPE_AUTH_HEADER, params, utils.filter_oauth_params(header_params)), (SIGNATURE_TYPE_BODY, params, utils.filter_oauth_params(body_params)), (SIGNATURE_TYPE_QUERY, params, utils.filter_oauth_params(query_params)) ))) if len(signature_types_with_oauth_params) > 1: found_types = [s[0] for s in signature_types_with_oauth_params] raise errors.InvalidRequestError( description=('oauth_ params must come from only 1 signature' 'type but were found in %s', ', '.join(found_types))) try: signature_type, params, oauth_params = signature_types_with_oauth_params[ 0] except IndexError: raise errors.InvalidRequestError( description='Missing mandatory OAuth parameters.') return signature_type, params, oauth_params def _create_request(self, uri, http_method, body, headers): # Only include body data from x-www-form-urlencoded requests headers = CaseInsensitiveDict(headers or {}) if ("Content-Type" in headers and CONTENT_TYPE_FORM_URLENCODED in headers["Content-Type"]): request = Request(uri, http_method, body, headers) else: request = Request(uri, http_method, '', headers) signature_type, params, oauth_params = ( self._get_signature_type_and_params(request)) # The server SHOULD return a 400 (Bad Request) status code when # receiving a request with duplicated protocol parameters. if len(dict(oauth_params)) != len(oauth_params): raise errors.InvalidRequestError( description='Duplicate OAuth1 entries.') oauth_params = dict(oauth_params) request.signature = oauth_params.get('oauth_signature') request.client_key = oauth_params.get('oauth_consumer_key') request.resource_owner_key = oauth_params.get('oauth_token') request.nonce = oauth_params.get('oauth_nonce') request.timestamp = oauth_params.get('oauth_timestamp') request.redirect_uri = oauth_params.get('oauth_callback') request.verifier = oauth_params.get('oauth_verifier') request.signature_method = oauth_params.get('oauth_signature_method') request.realm = dict(params).get('realm') request.oauth_params = oauth_params # Parameters to Client depend on signature method which may vary # for each request. Note that HMAC-SHA1 and PLAINTEXT share parameters request.params = [(k, v) for k, v in params if k != "oauth_signature"] if 'realm' in request.headers.get('Authorization', ''): request.params = [(k, v) for k, v in request.params if k != "realm"] return request def _check_transport_security(self, request): # TODO: move into oauthlib.common from oauth2.utils if (self.request_validator.enforce_ssl and not request.uri.lower().startswith("https://")): raise errors.InsecureTransportError() def _check_mandatory_parameters(self, request): # The server SHOULD return a 400 (Bad Request) status code when # receiving a request with missing parameters. if not all((request.signature, request.client_key, request.nonce, request.timestamp, request.signature_method)): raise errors.InvalidRequestError( description='Missing mandatory OAuth parameters.') # OAuth does not mandate a particular signature method, as each # implementation can have its own unique requirements. Servers are # free to implement and document their own custom methods. # Recommending any particular method is beyond the scope of this # specification. Implementers should review the Security # Considerations section (`Section 4`_) before deciding on which # method to support. # .. _`Section 4`: https://tools.ietf.org/html/rfc5849#section-4 if (not request.signature_method in self.request_validator.allowed_signature_methods): raise errors.InvalidSignatureMethodError( description="Invalid signature, {} not in {!r}.".format( request.signature_method, self.request_validator.allowed_signature_methods)) # Servers receiving an authenticated request MUST validate it by: # If the "oauth_version" parameter is present, ensuring its value is # "1.0". if ('oauth_version' in request.oauth_params and request.oauth_params['oauth_version'] != '1.0'): raise errors.InvalidRequestError( description='Invalid OAuth version.') # The timestamp value MUST be a positive integer. Unless otherwise # specified by the server's documentation, the timestamp is expressed # in the number of seconds since January 1, 1970 00:00:00 GMT. if len(request.timestamp) != 10: raise errors.InvalidRequestError( description='Invalid timestamp size') try: ts = int(request.timestamp) except ValueError: raise errors.InvalidRequestError( description='Timestamp must be an integer.') else: # To avoid the need to retain an infinite number of nonce values for # future checks, servers MAY choose to restrict the time period after # which a request with an old timestamp is rejected. if abs(time.time() - ts) > self.request_validator.timestamp_lifetime: raise errors.InvalidRequestError( description=('Timestamp given is invalid, differ from ' 'allowed by over %s seconds.' % ( self.request_validator.timestamp_lifetime))) # Provider specific validation of parameters, used to enforce # restrictions such as character set and length. if not self.request_validator.check_client_key(request.client_key): raise errors.InvalidRequestError( description='Invalid client key format.') if not self.request_validator.check_nonce(request.nonce): raise errors.InvalidRequestError( description='Invalid nonce format.') def _check_signature(self, request, is_token_request=False): # ---- RSA-SHA is not allowed ------ if request.signature_method in (SIGNATURE_RSA_SHA1, SIGNATURE_RSA_SHA256, SIGNATURE_RSA_SHA512): raise ValueError("Using RSA-SHA is deprecated, use HMAC-SHA") # ---- HMAC or Plaintext Signature verification ---- else: # Non-RSA based signature method # Servers receiving an authenticated request MUST validate it by: # Recalculating the request signature independently as described in # `Section 3.4`_ and comparing it to the value received from the # client via the "oauth_signature" parameter. # .. _`Section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 client_secret = self.request_validator.get_client_secret( request.client_key, request) resource_owner_secret = None if request.resource_owner_key: if is_token_request: resource_owner_secret = \ self.request_validator.get_request_token_secret( request.client_key, request.resource_owner_key, request) else: resource_owner_secret = \ self.request_validator.get_access_token_secret( request.client_key, request.resource_owner_key, request) if request.signature_method == SIGNATURE_HMAC_SHA1: valid_signature = signature.verify_hmac_sha1( request, client_secret, resource_owner_secret) elif request.signature_method == SIGNATURE_HMAC_SHA256: valid_signature = signature.verify_hmac_sha256( request, client_secret, resource_owner_secret) elif request.signature_method == SIGNATURE_HMAC_SHA512: valid_signature = signature.verify_hmac_sha512( request, client_secret, resource_owner_secret) elif request.signature_method == SIGNATURE_PLAINTEXT: valid_signature = signature.verify_plaintext( request, client_secret, resource_owner_secret) else: valid_signature = False return valid_signature oauth1/rfc5849/endpoints/signature_only.py 0000644 00000006377 15125174065 0014513 0 ustar 00 # -*- coding: utf-8 -*- """ oauthlib.oauth1.rfc5849.endpoints.signature_only ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of the signing logic of OAuth 1.0 RFC 5849. """ import logging from .. import errors from .base import BaseEndpoint log = logging.getLogger(__name__) class SignatureOnlyEndpoint(BaseEndpoint): """An endpoint only responsible for verifying an oauth signature.""" def validate_request(self, uri, http_method='GET', body=None, headers=None): """Validate a signed OAuth request. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :returns: A tuple of 2 elements. 1. True if valid, False otherwise. 2. An oauthlib.common.Request object. """ try: request = self._create_request(uri, http_method, body, headers) except errors.OAuth1Error as err: log.info( 'Exception caught while validating request, %s.' % err) return False, None try: self._check_transport_security(request) self._check_mandatory_parameters(request) except errors.OAuth1Error as err: log.info( 'Exception caught while validating request, %s.' % err) return False, request if not self.request_validator.validate_timestamp_and_nonce( request.client_key, request.timestamp, request.nonce, request): log.debug('[Failure] verification failed: timestamp/nonce') return False, request # The server SHOULD return a 401 (Unauthorized) status code when # receiving a request with invalid client credentials. # Note: This is postponed in order to avoid timing attacks, instead # a dummy client is assigned and used to maintain near constant # time request verification. # # Note that early exit would enable client enumeration valid_client = self.request_validator.validate_client_key( request.client_key, request) if not valid_client: request.client_key = self.request_validator.dummy_client valid_signature = self._check_signature(request) # log the results to the validator_log # this lets us handle internal reporting and analysis request.validator_log['client'] = valid_client request.validator_log['signature'] = valid_signature # We delay checking validity until the very end, using dummy values for # calculations and fetching secrets/keys to ensure the flow of every # request remains almost identical regardless of whether valid values # have been supplied. This ensures near constant time execution and # prevents malicious users from guessing sensitive information v = all((valid_client, valid_signature)) if not v: log.info("[Failure] request verification failed.") log.info("Valid client: %s", valid_client) log.info("Valid signature: %s", valid_signature) return v, request oauth1/rfc5849/endpoints/pre_configured.py 0000644 00000001037 15125174065 0014430 0 ustar 00 from . import ( AccessTokenEndpoint, AuthorizationEndpoint, RequestTokenEndpoint, ResourceEndpoint, ) class WebApplicationServer(RequestTokenEndpoint, AuthorizationEndpoint, AccessTokenEndpoint, ResourceEndpoint): def __init__(self, request_validator): RequestTokenEndpoint.__init__(self, request_validator) AuthorizationEndpoint.__init__(self, request_validator) AccessTokenEndpoint.__init__(self, request_validator) ResourceEndpoint.__init__(self, request_validator) oauth1/rfc5849/endpoints/request_token.py 0000644 00000022115 15125174065 0014325 0 ustar 00 # -*- coding: utf-8 -*- """ oauthlib.oauth1.rfc5849.endpoints.request_token ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of the request token provider logic of OAuth 1.0 RFC 5849. It validates the correctness of request token requests, creates and persists tokens as well as create the proper response to be returned to the client. """ import logging from oauthlib.common import urlencode from .. import errors from .base import BaseEndpoint log = logging.getLogger(__name__) class RequestTokenEndpoint(BaseEndpoint): """An endpoint responsible for providing OAuth 1 request tokens. Typical use is to instantiate with a request validator and invoke the ``create_request_token_response`` from a view function. The tuple returned has all information necessary (body, status, headers) to quickly form and return a proper response. See :doc:`/oauth1/validator` for details on which validator methods to implement for this endpoint. """ def create_request_token(self, request, credentials): """Create and save a new request token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param credentials: A dict of extra token credentials. :returns: The token as an urlencoded string. """ token = { 'oauth_token': self.token_generator(), 'oauth_token_secret': self.token_generator(), 'oauth_callback_confirmed': 'true' } token.update(credentials) self.request_validator.save_request_token(token, request) return urlencode(token.items()) def create_request_token_response(self, uri, http_method='GET', body=None, headers=None, credentials=None): """Create a request token response, with a new request token if valid. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :param credentials: A list of extra credentials to include in the token. :returns: A tuple of 3 elements. 1. A dict of headers to set on the response. 2. The response body as a string. 3. The response status code as an integer. An example of a valid request:: >>> from your_validator import your_validator >>> from oauthlib.oauth1 import RequestTokenEndpoint >>> endpoint = RequestTokenEndpoint(your_validator) >>> h, b, s = endpoint.create_request_token_response( ... 'https://your.provider/request_token?foo=bar', ... headers={ ... 'Authorization': 'OAuth realm=movies user, oauth_....' ... }, ... credentials={ ... 'my_specific': 'argument', ... }) >>> h {'Content-Type': 'application/x-www-form-urlencoded'} >>> b 'oauth_token=lsdkfol23w54jlksdef&oauth_token_secret=qwe089234lkjsdf&oauth_callback_confirmed=true&my_specific=argument' >>> s 200 An response to invalid request would have a different body and status:: >>> b 'error=invalid_request&description=missing+callback+uri' >>> s 400 The same goes for an an unauthorized request: >>> b '' >>> s 401 """ resp_headers = {'Content-Type': 'application/x-www-form-urlencoded'} try: request = self._create_request(uri, http_method, body, headers) valid, processed_request = self.validate_request_token_request( request) if valid: token = self.create_request_token(request, credentials or {}) return resp_headers, token, 200 else: return {}, None, 401 except errors.OAuth1Error as e: return resp_headers, e.urlencoded, e.status_code def validate_request_token_request(self, request): """Validate a request token request. :param request: OAuthlib request. :type request: oauthlib.common.Request :raises: OAuth1Error if the request is invalid. :returns: A tuple of 2 elements. 1. The validation result (True or False). 2. The request object. """ self._check_transport_security(request) self._check_mandatory_parameters(request) if request.realm: request.realms = request.realm.split(' ') else: request.realms = self.request_validator.get_default_realms( request.client_key, request) if not self.request_validator.check_realms(request.realms): raise errors.InvalidRequestError( description='Invalid realm {}. Allowed are {!r}.'.format( request.realms, self.request_validator.realms)) if not request.redirect_uri: raise errors.InvalidRequestError( description='Missing callback URI.') if not self.request_validator.validate_timestamp_and_nonce( request.client_key, request.timestamp, request.nonce, request, request_token=request.resource_owner_key): return False, request # The server SHOULD return a 401 (Unauthorized) status code when # receiving a request with invalid client credentials. # Note: This is postponed in order to avoid timing attacks, instead # a dummy client is assigned and used to maintain near constant # time request verification. # # Note that early exit would enable client enumeration valid_client = self.request_validator.validate_client_key( request.client_key, request) if not valid_client: request.client_key = self.request_validator.dummy_client # Note that `realm`_ is only used in authorization headers and how # it should be interepreted is not included in the OAuth spec. # However they could be seen as a scope or realm to which the # client has access and as such every client should be checked # to ensure it is authorized access to that scope or realm. # .. _`realm`: https://tools.ietf.org/html/rfc2617#section-1.2 # # Note that early exit would enable client realm access enumeration. # # The require_realm indicates this is the first step in the OAuth # workflow where a client requests access to a specific realm. # This first step (obtaining request token) need not require a realm # and can then be identified by checking the require_resource_owner # flag and abscence of realm. # # Clients obtaining an access token will not supply a realm and it will # not be checked. Instead the previously requested realm should be # transferred from the request token to the access token. # # Access to protected resources will always validate the realm but note # that the realm is now tied to the access token and not provided by # the client. valid_realm = self.request_validator.validate_requested_realms( request.client_key, request.realms, request) # Callback is normally never required, except for requests for # a Temporary Credential as described in `Section 2.1`_ # .._`Section 2.1`: https://tools.ietf.org/html/rfc5849#section-2.1 valid_redirect = self.request_validator.validate_redirect_uri( request.client_key, request.redirect_uri, request) if not request.redirect_uri: raise NotImplementedError('Redirect URI must either be provided ' 'or set to a default during validation.') valid_signature = self._check_signature(request) # log the results to the validator_log # this lets us handle internal reporting and analysis request.validator_log['client'] = valid_client request.validator_log['realm'] = valid_realm request.validator_log['callback'] = valid_redirect request.validator_log['signature'] = valid_signature # We delay checking validity until the very end, using dummy values for # calculations and fetching secrets/keys to ensure the flow of every # request remains almost identical regardless of whether valid values # have been supplied. This ensures near constant time execution and # prevents malicious users from guessing sensitive information v = all((valid_client, valid_realm, valid_redirect, valid_signature)) if not v: log.info("[Failure] request verification failed.") log.info("Valid client: %s.", valid_client) log.info("Valid realm: %s.", valid_realm) log.info("Valid callback: %s.", valid_redirect) log.info("Valid signature: %s.", valid_signature) return v, request oauth1/rfc5849/endpoints/authorization.py 0000644 00000015104 15125174065 0014335 0 ustar 00 # -*- coding: utf-8 -*- """ oauthlib.oauth1.rfc5849.endpoints.authorization ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for signing and checking OAuth 1.0 RFC 5849 requests. """ from urllib.parse import urlencode from oauthlib.common import add_params_to_uri from .. import errors from .base import BaseEndpoint class AuthorizationEndpoint(BaseEndpoint): """An endpoint responsible for letting authenticated users authorize access to their protected resources to a client. Typical use would be to have two views, one for displaying the authorization form and one to process said form on submission. The first view will want to utilize ``get_realms_and_credentials`` to fetch requested realms and useful client credentials, such as name and description, to be used when creating the authorization form. During form processing you can use ``create_authorization_response`` to validate the request, create a verifier as well as prepare the final redirection URI used to send the user back to the client. See :doc:`/oauth1/validator` for details on which validator methods to implement for this endpoint. """ def create_verifier(self, request, credentials): """Create and save a new request token. :param request: OAuthlib request. :type request: oauthlib.common.Request :param credentials: A dict of extra token credentials. :returns: The verifier as a dict. """ verifier = { 'oauth_token': request.resource_owner_key, 'oauth_verifier': self.token_generator(), } verifier.update(credentials) self.request_validator.save_verifier( request.resource_owner_key, verifier, request) return verifier def create_authorization_response(self, uri, http_method='GET', body=None, headers=None, realms=None, credentials=None): """Create an authorization response, with a new request token if valid. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :param credentials: A list of credentials to include in the verifier. :returns: A tuple of 3 elements. 1. A dict of headers to set on the response. 2. The response body as a string. 3. The response status code as an integer. If the callback URI tied to the current token is "oob", a response with a 200 status code will be returned. In this case, it may be desirable to modify the response to better display the verifier to the client. An example of an authorization request:: >>> from your_validator import your_validator >>> from oauthlib.oauth1 import AuthorizationEndpoint >>> endpoint = AuthorizationEndpoint(your_validator) >>> h, b, s = endpoint.create_authorization_response( ... 'https://your.provider/authorize?oauth_token=...', ... credentials={ ... 'extra': 'argument', ... }) >>> h {'Location': 'https://the.client/callback?oauth_verifier=...&extra=argument'} >>> b None >>> s 302 An example of a request with an "oob" callback:: >>> from your_validator import your_validator >>> from oauthlib.oauth1 import AuthorizationEndpoint >>> endpoint = AuthorizationEndpoint(your_validator) >>> h, b, s = endpoint.create_authorization_response( ... 'https://your.provider/authorize?foo=bar', ... credentials={ ... 'extra': 'argument', ... }) >>> h {'Content-Type': 'application/x-www-form-urlencoded'} >>> b 'oauth_verifier=...&extra=argument' >>> s 200 """ request = self._create_request(uri, http_method=http_method, body=body, headers=headers) if not request.resource_owner_key: raise errors.InvalidRequestError( 'Missing mandatory parameter oauth_token.') if not self.request_validator.verify_request_token( request.resource_owner_key, request): raise errors.InvalidClientError() request.realms = realms if (request.realms and not self.request_validator.verify_realms( request.resource_owner_key, request.realms, request)): raise errors.InvalidRequestError( description=('User granted access to realms outside of ' 'what the client may request.')) verifier = self.create_verifier(request, credentials or {}) redirect_uri = self.request_validator.get_redirect_uri( request.resource_owner_key, request) if redirect_uri == 'oob': response_headers = { 'Content-Type': 'application/x-www-form-urlencoded'} response_body = urlencode(verifier) return response_headers, response_body, 200 else: populated_redirect = add_params_to_uri( redirect_uri, verifier.items()) return {'Location': populated_redirect}, None, 302 def get_realms_and_credentials(self, uri, http_method='GET', body=None, headers=None): """Fetch realms and credentials for the presented request token. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :returns: A tuple of 2 elements. 1. A list of request realms. 2. A dict of credentials which may be useful in creating the authorization form. """ request = self._create_request(uri, http_method=http_method, body=body, headers=headers) if not self.request_validator.verify_request_token( request.resource_owner_key, request): raise errors.InvalidClientError() realms = self.request_validator.get_realms( request.resource_owner_key, request) return realms, {'resource_owner_key': request.resource_owner_key} oauth1/rfc5849/endpoints/access_token.py 0000644 00000022203 15125174065 0014074 0 ustar 00 # -*- coding: utf-8 -*- """ oauthlib.oauth1.rfc5849.endpoints.access_token ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of the access token provider logic of OAuth 1.0 RFC 5849. It validates the correctness of access token requests, creates and persists tokens as well as create the proper response to be returned to the client. """ import logging from oauthlib.common import urlencode from .. import errors from .base import BaseEndpoint log = logging.getLogger(__name__) class AccessTokenEndpoint(BaseEndpoint): """An endpoint responsible for providing OAuth 1 access tokens. Typical use is to instantiate with a request validator and invoke the ``create_access_token_response`` from a view function. The tuple returned has all information necessary (body, status, headers) to quickly form and return a proper response. See :doc:`/oauth1/validator` for details on which validator methods to implement for this endpoint. """ def create_access_token(self, request, credentials): """Create and save a new access token. Similar to OAuth 2, indication of granted scopes will be included as a space separated list in ``oauth_authorized_realms``. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The token as an urlencoded string. """ request.realms = self.request_validator.get_realms( request.resource_owner_key, request) token = { 'oauth_token': self.token_generator(), 'oauth_token_secret': self.token_generator(), # Backport the authorized scopes indication used in OAuth2 'oauth_authorized_realms': ' '.join(request.realms) } token.update(credentials) self.request_validator.save_access_token(token, request) return urlencode(token.items()) def create_access_token_response(self, uri, http_method='GET', body=None, headers=None, credentials=None): """Create an access token response, with a new request token if valid. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :param credentials: A list of extra credentials to include in the token. :returns: A tuple of 3 elements. 1. A dict of headers to set on the response. 2. The response body as a string. 3. The response status code as an integer. An example of a valid request:: >>> from your_validator import your_validator >>> from oauthlib.oauth1 import AccessTokenEndpoint >>> endpoint = AccessTokenEndpoint(your_validator) >>> h, b, s = endpoint.create_access_token_response( ... 'https://your.provider/access_token?foo=bar', ... headers={ ... 'Authorization': 'OAuth oauth_token=234lsdkf....' ... }, ... credentials={ ... 'my_specific': 'argument', ... }) >>> h {'Content-Type': 'application/x-www-form-urlencoded'} >>> b 'oauth_token=lsdkfol23w54jlksdef&oauth_token_secret=qwe089234lkjsdf&oauth_authorized_realms=movies+pics&my_specific=argument' >>> s 200 An response to invalid request would have a different body and status:: >>> b 'error=invalid_request&description=missing+resource+owner+key' >>> s 400 The same goes for an an unauthorized request: >>> b '' >>> s 401 """ resp_headers = {'Content-Type': 'application/x-www-form-urlencoded'} try: request = self._create_request(uri, http_method, body, headers) valid, processed_request = self.validate_access_token_request( request) if valid: token = self.create_access_token(request, credentials or {}) self.request_validator.invalidate_request_token( request.client_key, request.resource_owner_key, request) return resp_headers, token, 200 else: return {}, None, 401 except errors.OAuth1Error as e: return resp_headers, e.urlencoded, e.status_code def validate_access_token_request(self, request): """Validate an access token request. :param request: OAuthlib request. :type request: oauthlib.common.Request :raises: OAuth1Error if the request is invalid. :returns: A tuple of 2 elements. 1. The validation result (True or False). 2. The request object. """ self._check_transport_security(request) self._check_mandatory_parameters(request) if not request.resource_owner_key: raise errors.InvalidRequestError( description='Missing resource owner.') if not self.request_validator.check_request_token( request.resource_owner_key): raise errors.InvalidRequestError( description='Invalid resource owner key format.') if not request.verifier: raise errors.InvalidRequestError( description='Missing verifier.') if not self.request_validator.check_verifier(request.verifier): raise errors.InvalidRequestError( description='Invalid verifier format.') if not self.request_validator.validate_timestamp_and_nonce( request.client_key, request.timestamp, request.nonce, request, request_token=request.resource_owner_key): return False, request # The server SHOULD return a 401 (Unauthorized) status code when # receiving a request with invalid client credentials. # Note: This is postponed in order to avoid timing attacks, instead # a dummy client is assigned and used to maintain near constant # time request verification. # # Note that early exit would enable client enumeration valid_client = self.request_validator.validate_client_key( request.client_key, request) if not valid_client: request.client_key = self.request_validator.dummy_client # The server SHOULD return a 401 (Unauthorized) status code when # receiving a request with invalid or expired token. # Note: This is postponed in order to avoid timing attacks, instead # a dummy token is assigned and used to maintain near constant # time request verification. # # Note that early exit would enable resource owner enumeration valid_resource_owner = self.request_validator.validate_request_token( request.client_key, request.resource_owner_key, request) if not valid_resource_owner: request.resource_owner_key = self.request_validator.dummy_request_token # The server MUST verify (Section 3.2) the validity of the request, # ensure that the resource owner has authorized the provisioning of # token credentials to the client, and ensure that the temporary # credentials have not expired or been used before. The server MUST # also verify the verification code received from the client. # .. _`Section 3.2`: https://tools.ietf.org/html/rfc5849#section-3.2 # # Note that early exit would enable resource owner authorization # verifier enumertion. valid_verifier = self.request_validator.validate_verifier( request.client_key, request.resource_owner_key, request.verifier, request) valid_signature = self._check_signature(request, is_token_request=True) # log the results to the validator_log # this lets us handle internal reporting and analysis request.validator_log['client'] = valid_client request.validator_log['resource_owner'] = valid_resource_owner request.validator_log['verifier'] = valid_verifier request.validator_log['signature'] = valid_signature # We delay checking validity until the very end, using dummy values for # calculations and fetching secrets/keys to ensure the flow of every # request remains almost identical regardless of whether valid values # have been supplied. This ensures near constant time execution and # prevents malicious users from guessing sensitive information v = all((valid_client, valid_resource_owner, valid_verifier, valid_signature)) if not v: log.info("[Failure] request verification failed.") log.info("Valid client:, %s", valid_client) log.info("Valid token:, %s", valid_resource_owner) log.info("Valid verifier:, %s", valid_verifier) log.info("Valid signature:, %s", valid_signature) return v, request oauth1/rfc5849/endpoints/resource.py 0000644 00000016320 15125174065 0013265 0 ustar 00 # -*- coding: utf-8 -*- """ oauthlib.oauth1.rfc5849.endpoints.resource ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of the resource protection provider logic of OAuth 1.0 RFC 5849. """ import logging from .. import errors from .base import BaseEndpoint log = logging.getLogger(__name__) class ResourceEndpoint(BaseEndpoint): """An endpoint responsible for protecting resources. Typical use is to instantiate with a request validator and invoke the ``validate_protected_resource_request`` in a decorator around a view function. If the request is valid, invoke and return the response of the view. If invalid create and return an error response directly from the decorator. See :doc:`/oauth1/validator` for details on which validator methods to implement for this endpoint. An example decorator:: from functools import wraps from your_validator import your_validator from oauthlib.oauth1 import ResourceEndpoint endpoint = ResourceEndpoint(your_validator) def require_oauth(realms=None): def decorator(f): @wraps(f) def wrapper(request, *args, **kwargs): v, r = provider.validate_protected_resource_request( request.url, http_method=request.method, body=request.data, headers=request.headers, realms=realms or []) if v: return f(*args, **kwargs) else: return abort(403) """ def validate_protected_resource_request(self, uri, http_method='GET', body=None, headers=None, realms=None): """Create a request token response, with a new request token if valid. :param uri: The full URI of the token request. :param http_method: A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc. :param body: The request body as a string. :param headers: The request headers as a dict. :param realms: A list of realms the resource is protected under. This will be supplied to the ``validate_realms`` method of the request validator. :returns: A tuple of 2 elements. 1. True if valid, False otherwise. 2. An oauthlib.common.Request object. """ try: request = self._create_request(uri, http_method, body, headers) except errors.OAuth1Error: return False, None try: self._check_transport_security(request) self._check_mandatory_parameters(request) except errors.OAuth1Error: return False, request if not request.resource_owner_key: return False, request if not self.request_validator.check_access_token( request.resource_owner_key): return False, request if not self.request_validator.validate_timestamp_and_nonce( request.client_key, request.timestamp, request.nonce, request, access_token=request.resource_owner_key): return False, request # The server SHOULD return a 401 (Unauthorized) status code when # receiving a request with invalid client credentials. # Note: This is postponed in order to avoid timing attacks, instead # a dummy client is assigned and used to maintain near constant # time request verification. # # Note that early exit would enable client enumeration valid_client = self.request_validator.validate_client_key( request.client_key, request) if not valid_client: request.client_key = self.request_validator.dummy_client # The server SHOULD return a 401 (Unauthorized) status code when # receiving a request with invalid or expired token. # Note: This is postponed in order to avoid timing attacks, instead # a dummy token is assigned and used to maintain near constant # time request verification. # # Note that early exit would enable resource owner enumeration valid_resource_owner = self.request_validator.validate_access_token( request.client_key, request.resource_owner_key, request) if not valid_resource_owner: request.resource_owner_key = self.request_validator.dummy_access_token # Note that `realm`_ is only used in authorization headers and how # it should be interepreted is not included in the OAuth spec. # However they could be seen as a scope or realm to which the # client has access and as such every client should be checked # to ensure it is authorized access to that scope or realm. # .. _`realm`: https://tools.ietf.org/html/rfc2617#section-1.2 # # Note that early exit would enable client realm access enumeration. # # The require_realm indicates this is the first step in the OAuth # workflow where a client requests access to a specific realm. # This first step (obtaining request token) need not require a realm # and can then be identified by checking the require_resource_owner # flag and abscence of realm. # # Clients obtaining an access token will not supply a realm and it will # not be checked. Instead the previously requested realm should be # transferred from the request token to the access token. # # Access to protected resources will always validate the realm but note # that the realm is now tied to the access token and not provided by # the client. valid_realm = self.request_validator.validate_realms(request.client_key, request.resource_owner_key, request, uri=request.uri, realms=realms) valid_signature = self._check_signature(request) # log the results to the validator_log # this lets us handle internal reporting and analysis request.validator_log['client'] = valid_client request.validator_log['resource_owner'] = valid_resource_owner request.validator_log['realm'] = valid_realm request.validator_log['signature'] = valid_signature # We delay checking validity until the very end, using dummy values for # calculations and fetching secrets/keys to ensure the flow of every # request remains almost identical regardless of whether valid values # have been supplied. This ensures near constant time execution and # prevents malicious users from guessing sensitive information v = all((valid_client, valid_resource_owner, valid_realm, valid_signature)) if not v: log.info("[Failure] request verification failed.") log.info("Valid client: %s", valid_client) log.info("Valid token: %s", valid_resource_owner) log.info("Valid realm: %s", valid_realm) log.info("Valid signature: %s", valid_signature) return v, request oauth1/rfc5849/endpoints/__init__.py 0000644 00000000507 15125174065 0013175 0 ustar 00 from .access_token import AccessTokenEndpoint from .authorization import AuthorizationEndpoint from .base import BaseEndpoint from .request_token import RequestTokenEndpoint from .resource import ResourceEndpoint from .signature_only import SignatureOnlyEndpoint from .pre_configured import WebApplicationServer # isort:skip oauth1/rfc5849/request_validator.py 0000644 00000074414 15125174065 0013200 0 ustar 00 """ oauthlib.oauth1.rfc5849 ~~~~~~~~~~~~~~ This module is an implementation of various logic needed for signing and checking OAuth 1.0 RFC 5849 requests. """ from . import SIGNATURE_METHODS, utils class RequestValidator: """A validator/datastore interaction base class for OAuth 1 providers. OAuth providers should inherit from RequestValidator and implement the methods and properties outlined below. Further details are provided in the documentation for each method and property. Methods used to check the format of input parameters. Common tests include length, character set, membership, range or pattern. These tests are referred to as `whitelisting or blacklisting`_. Whitelisting is better but blacklisting can be usefull to spot malicious activity. The following have methods a default implementation: - check_client_key - check_request_token - check_access_token - check_nonce - check_verifier - check_realms The methods above default to whitelist input parameters, checking that they are alphanumerical and between a minimum and maximum length. Rather than overloading the methods a few properties can be used to configure these methods. * @safe_characters -> (character set) * @client_key_length -> (min, max) * @request_token_length -> (min, max) * @access_token_length -> (min, max) * @nonce_length -> (min, max) * @verifier_length -> (min, max) * @realms -> [list, of, realms] Methods used to validate/invalidate input parameters. These checks usually hit either persistent or temporary storage such as databases or the filesystem. See each methods documentation for detailed usage. The following methods must be implemented: - validate_client_key - validate_request_token - validate_access_token - validate_timestamp_and_nonce - validate_redirect_uri - validate_requested_realms - validate_realms - validate_verifier - invalidate_request_token Methods used to retrieve sensitive information from storage. The following methods must be implemented: - get_client_secret - get_request_token_secret - get_access_token_secret - get_rsa_key - get_realms - get_default_realms - get_redirect_uri Methods used to save credentials. The following methods must be implemented: - save_request_token - save_verifier - save_access_token Methods used to verify input parameters. This methods are used during authorizing request token by user (AuthorizationEndpoint), to check if parameters are valid. During token authorization request is not signed, thus 'validation' methods can not be used. The following methods must be implemented: - verify_realms - verify_request_token To prevent timing attacks it is necessary to not exit early even if the client key or resource owner key is invalid. Instead dummy values should be used during the remaining verification process. It is very important that the dummy client and token are valid input parameters to the methods get_client_secret, get_rsa_key and get_(access/request)_token_secret and that the running time of those methods when given a dummy value remain equivalent to the running time when given a valid client/resource owner. The following properties must be implemented: * @dummy_client * @dummy_request_token * @dummy_access_token Example implementations have been provided, note that the database used is a simple dictionary and serves only an illustrative purpose. Use whichever database suits your project and how to access it is entirely up to you. The methods are introduced in an order which should make understanding their use more straightforward and as such it could be worth reading what follows in chronological order. .. _`whitelisting or blacklisting`: https://www.schneier.com/blog/archives/2011/01/whitelisting_vs.html """ def __init__(self): pass @property def allowed_signature_methods(self): return SIGNATURE_METHODS @property def safe_characters(self): return set(utils.UNICODE_ASCII_CHARACTER_SET) @property def client_key_length(self): return 20, 30 @property def request_token_length(self): return 20, 30 @property def access_token_length(self): return 20, 30 @property def timestamp_lifetime(self): return 600 @property def nonce_length(self): return 20, 30 @property def verifier_length(self): return 20, 30 @property def realms(self): return [] @property def enforce_ssl(self): return True def check_client_key(self, client_key): """Check that the client key only contains safe characters and is no shorter than lower and no longer than upper. """ lower, upper = self.client_key_length return (set(client_key) <= self.safe_characters and lower <= len(client_key) <= upper) def check_request_token(self, request_token): """Checks that the request token contains only safe characters and is no shorter than lower and no longer than upper. """ lower, upper = self.request_token_length return (set(request_token) <= self.safe_characters and lower <= len(request_token) <= upper) def check_access_token(self, request_token): """Checks that the token contains only safe characters and is no shorter than lower and no longer than upper. """ lower, upper = self.access_token_length return (set(request_token) <= self.safe_characters and lower <= len(request_token) <= upper) def check_nonce(self, nonce): """Checks that the nonce only contains only safe characters and is no shorter than lower and no longer than upper. """ lower, upper = self.nonce_length return (set(nonce) <= self.safe_characters and lower <= len(nonce) <= upper) def check_verifier(self, verifier): """Checks that the verifier contains only safe characters and is no shorter than lower and no longer than upper. """ lower, upper = self.verifier_length return (set(verifier) <= self.safe_characters and lower <= len(verifier) <= upper) def check_realms(self, realms): """Check that the realm is one of a set allowed realms.""" return all(r in self.realms for r in realms) def _subclass_must_implement(self, fn): """ Returns a NotImplementedError for a function that should be implemented. :param fn: name of the function """ m = "Missing function implementation in {}: {}".format(type(self), fn) return NotImplementedError(m) @property def dummy_client(self): """Dummy client used when an invalid client key is supplied. :returns: The dummy client key string. The dummy client should be associated with either a client secret, a rsa key or both depending on which signature methods are supported. Providers should make sure that get_client_secret(dummy_client) get_rsa_key(dummy_client) return a valid secret or key for the dummy client. This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint """ raise self._subclass_must_implement("dummy_client") @property def dummy_request_token(self): """Dummy request token used when an invalid token was supplied. :returns: The dummy request token string. The dummy request token should be associated with a request token secret such that get_request_token_secret(.., dummy_request_token) returns a valid secret. This method is used by * AccessTokenEndpoint """ raise self._subclass_must_implement("dummy_request_token") @property def dummy_access_token(self): """Dummy access token used when an invalid token was supplied. :returns: The dummy access token string. The dummy access token should be associated with an access token secret such that get_access_token_secret(.., dummy_access_token) returns a valid secret. This method is used by * ResourceEndpoint """ raise self._subclass_must_implement("dummy_access_token") def get_client_secret(self, client_key, request): """Retrieves the client secret associated with the client key. :param client_key: The client/consumer key. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The client secret as a string. This method must allow the use of a dummy client_key value. Fetching the secret using the dummy key must take the same amount of time as fetching a secret for a valid client:: # Unlikely to be near constant time as it uses two database # lookups for a valid client, and only one for an invalid. from your_datastore import ClientSecret if ClientSecret.has(client_key): return ClientSecret.get(client_key) else: return 'dummy' # Aim to mimic number of latency inducing operations no matter # whether the client is valid or not. from your_datastore import ClientSecret return ClientSecret.get(client_key, 'dummy') Note that the returned key must be in plaintext. This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint """ raise self._subclass_must_implement('get_client_secret') def get_request_token_secret(self, client_key, token, request): """Retrieves the shared secret associated with the request token. :param client_key: The client/consumer key. :param token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The token secret as a string. This method must allow the use of a dummy values and the running time must be roughly equivalent to that of the running time of valid values:: # Unlikely to be near constant time as it uses two database # lookups for a valid client, and only one for an invalid. from your_datastore import RequestTokenSecret if RequestTokenSecret.has(client_key): return RequestTokenSecret.get((client_key, request_token)) else: return 'dummy' # Aim to mimic number of latency inducing operations no matter # whether the client is valid or not. from your_datastore import RequestTokenSecret return ClientSecret.get((client_key, request_token), 'dummy') Note that the returned key must be in plaintext. This method is used by * AccessTokenEndpoint """ raise self._subclass_must_implement('get_request_token_secret') def get_access_token_secret(self, client_key, token, request): """Retrieves the shared secret associated with the access token. :param client_key: The client/consumer key. :param token: The access token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The token secret as a string. This method must allow the use of a dummy values and the running time must be roughly equivalent to that of the running time of valid values:: # Unlikely to be near constant time as it uses two database # lookups for a valid client, and only one for an invalid. from your_datastore import AccessTokenSecret if AccessTokenSecret.has(client_key): return AccessTokenSecret.get((client_key, request_token)) else: return 'dummy' # Aim to mimic number of latency inducing operations no matter # whether the client is valid or not. from your_datastore import AccessTokenSecret return ClientSecret.get((client_key, request_token), 'dummy') Note that the returned key must be in plaintext. This method is used by * ResourceEndpoint """ raise self._subclass_must_implement("get_access_token_secret") def get_default_realms(self, client_key, request): """Get the default realms for a client. :param client_key: The client/consumer key. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The list of default realms associated with the client. The list of default realms will be set during client registration and is outside the scope of OAuthLib. This method is used by * RequestTokenEndpoint """ raise self._subclass_must_implement("get_default_realms") def get_realms(self, token, request): """Get realms associated with a request token. :param token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The list of realms associated with the request token. This method is used by * AuthorizationEndpoint * AccessTokenEndpoint """ raise self._subclass_must_implement("get_realms") def get_redirect_uri(self, token, request): """Get the redirect URI associated with a request token. :param token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The redirect URI associated with the request token. It may be desirable to return a custom URI if the redirect is set to "oob". In this case, the user will be redirected to the returned URI and at that endpoint the verifier can be displayed. This method is used by * AuthorizationEndpoint """ raise self._subclass_must_implement("get_redirect_uri") def get_rsa_key(self, client_key, request): """Retrieves a previously stored client provided RSA key. :param client_key: The client/consumer key. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: The rsa public key as a string. This method must allow the use of a dummy client_key value. Fetching the rsa key using the dummy key must take the same amount of time as fetching a key for a valid client. The dummy key must also be of the same bit length as client keys. Note that the key must be returned in plaintext. This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint """ raise self._subclass_must_implement("get_rsa_key") def invalidate_request_token(self, client_key, request_token, request): """Invalidates a used request token. :param client_key: The client/consumer key. :param request_token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: None Per `Section 2.3`__ of the spec: "The server MUST (...) ensure that the temporary credentials have not expired or been used before." .. _`Section 2.3`: https://tools.ietf.org/html/rfc5849#section-2.3 This method should ensure that provided token won't validate anymore. It can be simply removing RequestToken from storage or setting specific flag that makes it invalid (note that such flag should be also validated during request token validation). This method is used by * AccessTokenEndpoint """ raise self._subclass_must_implement("invalidate_request_token") def validate_client_key(self, client_key, request): """Validates that supplied client key is a registered and valid client. :param client_key: The client/consumer key. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False Note that if the dummy client is supplied it should validate in same or nearly the same amount of time as a valid one. Ensure latency inducing tasks are mimiced even for dummy clients. For example, use:: from your_datastore import Client try: return Client.exists(client_key, access_token) except DoesNotExist: return False Rather than:: from your_datastore import Client if access_token == self.dummy_access_token: return False else: return Client.exists(client_key, access_token) This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint """ raise self._subclass_must_implement("validate_client_key") def validate_request_token(self, client_key, token, request): """Validates that supplied request token is registered and valid. :param client_key: The client/consumer key. :param token: The request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False Note that if the dummy request_token is supplied it should validate in the same nearly the same amount of time as a valid one. Ensure latency inducing tasks are mimiced even for dummy clients. For example, use:: from your_datastore import RequestToken try: return RequestToken.exists(client_key, access_token) except DoesNotExist: return False Rather than:: from your_datastore import RequestToken if access_token == self.dummy_access_token: return False else: return RequestToken.exists(client_key, access_token) This method is used by * AccessTokenEndpoint """ raise self._subclass_must_implement("validate_request_token") def validate_access_token(self, client_key, token, request): """Validates that supplied access token is registered and valid. :param client_key: The client/consumer key. :param token: The access token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False Note that if the dummy access token is supplied it should validate in the same or nearly the same amount of time as a valid one. Ensure latency inducing tasks are mimiced even for dummy clients. For example, use:: from your_datastore import AccessToken try: return AccessToken.exists(client_key, access_token) except DoesNotExist: return False Rather than:: from your_datastore import AccessToken if access_token == self.dummy_access_token: return False else: return AccessToken.exists(client_key, access_token) This method is used by * ResourceEndpoint """ raise self._subclass_must_implement("validate_access_token") def validate_timestamp_and_nonce(self, client_key, timestamp, nonce, request, request_token=None, access_token=None): """Validates that the nonce has not been used before. :param client_key: The client/consumer key. :param timestamp: The ``oauth_timestamp`` parameter. :param nonce: The ``oauth_nonce`` parameter. :param request_token: Request token string, if any. :param access_token: Access token string, if any. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False Per `Section 3.3`_ of the spec. "A nonce is a random string, uniquely generated by the client to allow the server to verify that a request has never been made before and helps prevent replay attacks when requests are made over a non-secure channel. The nonce value MUST be unique across all requests with the same timestamp, client credentials, and token combinations." .. _`Section 3.3`: https://tools.ietf.org/html/rfc5849#section-3.3 One of the first validation checks that will be made is for the validity of the nonce and timestamp, which are associated with a client key and possibly a token. If invalid then immediately fail the request by returning False. If the nonce/timestamp pair has been used before and you may just have detected a replay attack. Therefore it is an essential part of OAuth security that you not allow nonce/timestamp reuse. Note that this validation check is done before checking the validity of the client and token.:: nonces_and_timestamps_database = [ (u'foo', 1234567890, u'rannoMstrInghere', u'bar') ] def validate_timestamp_and_nonce(self, client_key, timestamp, nonce, request_token=None, access_token=None): return ((client_key, timestamp, nonce, request_token or access_token) not in self.nonces_and_timestamps_database) This method is used by * AccessTokenEndpoint * RequestTokenEndpoint * ResourceEndpoint * SignatureOnlyEndpoint """ raise self._subclass_must_implement("validate_timestamp_and_nonce") def validate_redirect_uri(self, client_key, redirect_uri, request): """Validates the client supplied redirection URI. :param client_key: The client/consumer key. :param redirect_uri: The URI the client which to redirect back to after authorization is successful. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False It is highly recommended that OAuth providers require their clients to register all redirection URIs prior to using them in requests and register them as absolute URIs. See `CWE-601`_ for more information about open redirection attacks. By requiring registration of all redirection URIs it should be straightforward for the provider to verify whether the supplied redirect_uri is valid or not. Alternatively per `Section 2.1`_ of the spec: "If the client is unable to receive callbacks or a callback URI has been established via other means, the parameter value MUST be set to "oob" (case sensitive), to indicate an out-of-band configuration." .. _`CWE-601`: http://cwe.mitre.org/top25/index.html#CWE-601 .. _`Section 2.1`: https://tools.ietf.org/html/rfc5849#section-2.1 This method is used by * RequestTokenEndpoint """ raise self._subclass_must_implement("validate_redirect_uri") def validate_requested_realms(self, client_key, realms, request): """Validates that the client may request access to the realm. :param client_key: The client/consumer key. :param realms: The list of realms that client is requesting access to. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False This method is invoked when obtaining a request token and should tie a realm to the request token and after user authorization this realm restriction should transfer to the access token. This method is used by * RequestTokenEndpoint """ raise self._subclass_must_implement("validate_requested_realms") def validate_realms(self, client_key, token, request, uri=None, realms=None): """Validates access to the request realm. :param client_key: The client/consumer key. :param token: A request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :param uri: The URI the realms is protecting. :param realms: A list of realms that must have been granted to the access token. :returns: True or False How providers choose to use the realm parameter is outside the OAuth specification but it is commonly used to restrict access to a subset of protected resources such as "photos". realms is a convenience parameter which can be used to provide a per view method pre-defined list of allowed realms. Can be as simple as:: from your_datastore import RequestToken request_token = RequestToken.get(token, None) if not request_token: return False return set(request_token.realms).issuperset(set(realms)) This method is used by * ResourceEndpoint """ raise self._subclass_must_implement("validate_realms") def validate_verifier(self, client_key, token, verifier, request): """Validates a verification code. :param client_key: The client/consumer key. :param token: A request token string. :param verifier: The authorization verifier string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False OAuth providers issue a verification code to clients after the resource owner authorizes access. This code is used by the client to obtain token credentials and the provider must verify that the verifier is valid and associated with the client as well as the resource owner. Verifier validation should be done in near constant time (to avoid verifier enumeration). To achieve this we need a constant time string comparison which is provided by OAuthLib in ``oauthlib.common.safe_string_equals``:: from your_datastore import Verifier correct_verifier = Verifier.get(client_key, request_token) from oauthlib.common import safe_string_equals return safe_string_equals(verifier, correct_verifier) This method is used by * AccessTokenEndpoint """ raise self._subclass_must_implement("validate_verifier") def verify_request_token(self, token, request): """Verify that the given OAuth1 request token is valid. :param token: A request token string. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False This method is used only in AuthorizationEndpoint to check whether the oauth_token given in the authorization URL is valid or not. This request is not signed and thus similar ``validate_request_token`` method can not be used. This method is used by * AuthorizationEndpoint """ raise self._subclass_must_implement("verify_request_token") def verify_realms(self, token, realms, request): """Verify authorized realms to see if they match those given to token. :param token: An access token string. :param realms: A list of realms the client attempts to access. :param request: OAuthlib request. :type request: oauthlib.common.Request :returns: True or False This prevents the list of authorized realms sent by the client during the authorization step to be altered to include realms outside what was bound with the request token. Can be as simple as:: valid_realms = self.get_realms(token) return all((r in valid_realms for r in realms)) This method is used by * AuthorizationEndpoint """ raise self._subclass_must_implement("verify_realms") def save_access_token(self, token, request): """Save an OAuth1 access token. :param token: A dict with token credentials. :param request: OAuthlib request. :type request: oauthlib.common.Request The token dictionary will at minimum include * ``oauth_token`` the access token string. * ``oauth_token_secret`` the token specific secret used in signing. * ``oauth_authorized_realms`` a space separated list of realms. Client key can be obtained from ``request.client_key``. The list of realms (not joined string) can be obtained from ``request.realm``. This method is used by * AccessTokenEndpoint """ raise self._subclass_must_implement("save_access_token") def save_request_token(self, token, request): """Save an OAuth1 request token. :param token: A dict with token credentials. :param request: OAuthlib request. :type request: oauthlib.common.Request The token dictionary will at minimum include * ``oauth_token`` the request token string. * ``oauth_token_secret`` the token specific secret used in signing. * ``oauth_callback_confirmed`` the string ``true``. Client key can be obtained from ``request.client_key``. This method is used by * RequestTokenEndpoint """ raise self._subclass_must_implement("save_request_token") def save_verifier(self, token, verifier, request): """Associate an authorization verifier with a request token. :param token: A request token string. :param verifier A dictionary containing the oauth_verifier and oauth_token :param request: OAuthlib request. :type request: oauthlib.common.Request We need to associate verifiers with tokens for validation during the access token request. Note that unlike save_x_token token here is the ``oauth_token`` token string from the request token saved previously. This method is used by * AuthorizationEndpoint """ raise self._subclass_must_implement("save_verifier") oauth1/rfc5849/parameters.py 0000644 00000011302 15125174065 0011571 0 ustar 00 """ oauthlib.parameters ~~~~~~~~~~~~~~~~~~~ This module contains methods related to `section 3.5`_ of the OAuth 1.0a spec. .. _`section 3.5`: https://tools.ietf.org/html/rfc5849#section-3.5 """ from urllib.parse import urlparse, urlunparse from oauthlib.common import extract_params, urlencode from . import utils # TODO: do we need filter_params now that oauth_params are handled by Request? # We can easily pass in just oauth protocol params. @utils.filter_params def prepare_headers(oauth_params, headers=None, realm=None): """**Prepare the Authorization header.** Per `section 3.5.1`_ of the spec. Protocol parameters can be transmitted using the HTTP "Authorization" header field as defined by `RFC2617`_ with the auth-scheme name set to "OAuth" (case insensitive). For example:: Authorization: OAuth realm="Example", oauth_consumer_key="0685bd9184jfhq22", oauth_token="ad180jjd733klru7", oauth_signature_method="HMAC-SHA1", oauth_signature="wOJIO9A2W5mFwDgiDvZbTSMK%2FPY%3D", oauth_timestamp="137131200", oauth_nonce="4572616e48616d6d65724c61686176", oauth_version="1.0" .. _`section 3.5.1`: https://tools.ietf.org/html/rfc5849#section-3.5.1 .. _`RFC2617`: https://tools.ietf.org/html/rfc2617 """ headers = headers or {} # Protocol parameters SHALL be included in the "Authorization" header # field as follows: authorization_header_parameters_parts = [] for oauth_parameter_name, value in oauth_params: # 1. Parameter names and values are encoded per Parameter Encoding # (`Section 3.6`_) # # .. _`Section 3.6`: https://tools.ietf.org/html/rfc5849#section-3.6 escaped_name = utils.escape(oauth_parameter_name) escaped_value = utils.escape(value) # 2. Each parameter's name is immediately followed by an "=" character # (ASCII code 61), a """ character (ASCII code 34), the parameter # value (MAY be empty), and another """ character (ASCII code 34). part = '{}="{}"'.format(escaped_name, escaped_value) authorization_header_parameters_parts.append(part) # 3. Parameters are separated by a "," character (ASCII code 44) and # OPTIONAL linear whitespace per `RFC2617`_. # # .. _`RFC2617`: https://tools.ietf.org/html/rfc2617 authorization_header_parameters = ', '.join( authorization_header_parameters_parts) # 4. The OPTIONAL "realm" parameter MAY be added and interpreted per # `RFC2617 section 1.2`_. # # .. _`RFC2617 section 1.2`: https://tools.ietf.org/html/rfc2617#section-1.2 if realm: # NOTE: realm should *not* be escaped authorization_header_parameters = ('realm="%s", ' % realm + authorization_header_parameters) # the auth-scheme name set to "OAuth" (case insensitive). authorization_header = 'OAuth %s' % authorization_header_parameters # contribute the Authorization header to the given headers full_headers = {} full_headers.update(headers) full_headers['Authorization'] = authorization_header return full_headers def _append_params(oauth_params, params): """Append OAuth params to an existing set of parameters. Both params and oauth_params is must be lists of 2-tuples. Per `section 3.5.2`_ and `3.5.3`_ of the spec. .. _`section 3.5.2`: https://tools.ietf.org/html/rfc5849#section-3.5.2 .. _`3.5.3`: https://tools.ietf.org/html/rfc5849#section-3.5.3 """ merged = list(params) merged.extend(oauth_params) # The request URI / entity-body MAY include other request-specific # parameters, in which case, the protocol parameters SHOULD be appended # following the request-specific parameters, properly separated by an "&" # character (ASCII code 38) merged.sort(key=lambda i: i[0].startswith('oauth_')) return merged def prepare_form_encoded_body(oauth_params, body): """Prepare the Form-Encoded Body. Per `section 3.5.2`_ of the spec. .. _`section 3.5.2`: https://tools.ietf.org/html/rfc5849#section-3.5.2 """ # append OAuth params to the existing body return _append_params(oauth_params, body) def prepare_request_uri_query(oauth_params, uri): """Prepare the Request URI Query. Per `section 3.5.3`_ of the spec. .. _`section 3.5.3`: https://tools.ietf.org/html/rfc5849#section-3.5.3 """ # append OAuth params to the existing set of query components sch, net, path, par, query, fra = urlparse(uri) query = urlencode( _append_params(oauth_params, extract_params(query) or [])) return urlunparse((sch, net, path, par, query, fra)) oauth1/rfc5849/signature.py 0000644 00000074574 15125174065 0011453 0 ustar 00 """ This module is an implementation of `section 3.4`_ of RFC 5849. **Usage** Steps for signing a request: 1. Collect parameters from the request using ``collect_parameters``. 2. Normalize those parameters using ``normalize_parameters``. 3. Create the *base string URI* using ``base_string_uri``. 4. Create the *signature base string* from the above three components using ``signature_base_string``. 5. Pass the *signature base string* and the client credentials to one of the sign-with-client functions. The HMAC-based signing functions needs client credentials with secrets. The RSA-based signing functions needs client credentials with an RSA private key. To verify a request, pass the request and credentials to one of the verify functions. The HMAC-based signing functions needs the shared secrets. The RSA-based verify functions needs the RSA public key. **Scope** All of the functions in this module should be considered internal to OAuthLib, since they are not imported into the "oauthlib.oauth1" module. Programs using OAuthLib should not use directly invoke any of the functions in this module. **Deprecated functions** The "sign_" methods that are not "_with_client" have been deprecated. They may be removed in a future release. Since they are all internal functions, this should have no impact on properly behaving programs. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 """ import binascii import hashlib import hmac import ipaddress import logging import warnings from oauthlib.common import extract_params, safe_string_equals, urldecode import urllib.parse as urlparse from . import utils log = logging.getLogger(__name__) # ==== Common functions ========================================== def signature_base_string( http_method: str, base_str_uri: str, normalized_encoded_request_parameters: str) -> str: """ Construct the signature base string. The *signature base string* is the value that is calculated and signed by the client. It is also independently calculated by the server to verify the signature, and therefore must produce the exact same value at both ends or the signature won't verify. The rules for calculating the *signature base string* are defined in section 3.4.1.1`_ of RFC 5849. .. _`section 3.4.1.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.1 """ # The signature base string is constructed by concatenating together, # in order, the following HTTP request elements: # 1. The HTTP request method in uppercase. For example: "HEAD", # "GET", "POST", etc. If the request uses a custom HTTP method, it # MUST be encoded (`Section 3.6`_). # # .. _`Section 3.6`: https://tools.ietf.org/html/rfc5849#section-3.6 base_string = utils.escape(http_method.upper()) # 2. An "&" character (ASCII code 38). base_string += '&' # 3. The base string URI from `Section 3.4.1.2`_, after being encoded # (`Section 3.6`_). # # .. _`Section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2 # .. _`Section 3.6`: https://tools.ietf.org/html/rfc5849#section-3.6 base_string += utils.escape(base_str_uri) # 4. An "&" character (ASCII code 38). base_string += '&' # 5. The request parameters as normalized in `Section 3.4.1.3.2`_, after # being encoded (`Section 3.6`). # # .. _`Sec 3.4.1.3.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.2 # .. _`Section 3.6`: https://tools.ietf.org/html/rfc5849#section-3.6 base_string += utils.escape(normalized_encoded_request_parameters) return base_string def base_string_uri(uri: str, host: str = None) -> str: """ Calculates the _base string URI_. The *base string URI* is one of the components that make up the *signature base string*. The ``host`` is optional. If provided, it is used to override any host and port values in the ``uri``. The value for ``host`` is usually extracted from the "Host" request header from the HTTP request. Its value may be just the hostname, or the hostname followed by a colon and a TCP/IP port number (hostname:port). If a value for the``host`` is provided but it does not contain a port number, the default port number is used (i.e. if the ``uri`` contained a port number, it will be discarded). The rules for calculating the *base string URI* are defined in section 3.4.1.2`_ of RFC 5849. .. _`section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2 :param uri: URI :param host: hostname with optional port number, separated by a colon :return: base string URI """ if not isinstance(uri, str): raise ValueError('uri must be a string.') # FIXME: urlparse does not support unicode output = urlparse.urlparse(uri) scheme = output.scheme hostname = output.hostname port = output.port path = output.path params = output.params # The scheme, authority, and path of the request resource URI `RFC3986` # are included by constructing an "http" or "https" URI representing # the request resource (without the query or fragment) as follows: # # .. _`RFC3986`: https://tools.ietf.org/html/rfc3986 if not scheme: raise ValueError('missing scheme') # Per `RFC 2616 section 5.1.2`_: # # Note that the absolute path cannot be empty; if none is present in # the original URI, it MUST be given as "/" (the server root). # # .. _`RFC 2616 5.1.2`: https://tools.ietf.org/html/rfc2616#section-5.1.2 if not path: path = '/' # 1. The scheme and host MUST be in lowercase. scheme = scheme.lower() # Note: if ``host`` is used, it will be converted to lowercase below if hostname is not None: hostname = hostname.lower() # 2. The host and port values MUST match the content of the HTTP # request "Host" header field. if host is not None: # NOTE: override value in uri with provided host # Host argument is equal to netloc. It means it's missing scheme. # Add it back, before parsing. host = host.lower() host = f"{scheme}://{host}" output = urlparse.urlparse(host) hostname = output.hostname port = output.port # 3. The port MUST be included if it is not the default port for the # scheme, and MUST be excluded if it is the default. Specifically, # the port MUST be excluded when making an HTTP request `RFC2616`_ # to port 80 or when making an HTTPS request `RFC2818`_ to port 443. # All other non-default port numbers MUST be included. # # .. _`RFC2616`: https://tools.ietf.org/html/rfc2616 # .. _`RFC2818`: https://tools.ietf.org/html/rfc2818 if hostname is None: raise ValueError('missing host') # NOTE: Try guessing if we're dealing with IP or hostname try: hostname = ipaddress.ip_address(hostname) except ValueError: pass if isinstance(hostname, ipaddress.IPv6Address): hostname = f"[{hostname}]" elif isinstance(hostname, ipaddress.IPv4Address): hostname = f"{hostname}" if port is not None and not (0 < port <= 65535): raise ValueError('port out of range') # 16-bit unsigned ints if (scheme, port) in (('http', 80), ('https', 443)): netloc = hostname # default port for scheme: exclude port num elif port: netloc = f"{hostname}:{port}" # use hostname:port else: netloc = hostname v = urlparse.urlunparse((scheme, netloc, path, params, '', '')) # RFC 5849 does not specify which characters are encoded in the # "base string URI", nor how they are encoded - which is very bad, since # the signatures won't match if there are any differences. Fortunately, # most URIs only use characters that are clearly not encoded (e.g. digits # and A-Z, a-z), so have avoided any differences between implementations. # # The example from its section 3.4.1.2 illustrates that spaces in # the path are percent encoded. But it provides no guidance as to what other # characters (if any) must be encoded (nor how); nor if characters in the # other components are to be encoded or not. # # This implementation **assumes** that **only** the space is percent-encoded # and it is done to the entire value (not just to spaces in the path). # # This code may need to be changed if it is discovered that other characters # are expected to be encoded. # # Note: the "base string URI" returned by this function will be encoded # again before being concatenated into the "signature base string". So any # spaces in the URI will actually appear in the "signature base string" # as "%2520" (the "%20" further encoded according to section 3.6). return v.replace(' ', '%20') def collect_parameters(uri_query='', body=None, headers=None, exclude_oauth_signature=True, with_realm=False): """ Gather the request parameters from all the parameter sources. This function is used to extract all the parameters, which are then passed to ``normalize_parameters`` to produce one of the components that make up the *signature base string*. Parameters starting with `oauth_` will be unescaped. Body parameters must be supplied as a dict, a list of 2-tuples, or a form encoded query string. Headers must be supplied as a dict. The rules where the parameters must be sourced from are defined in `section 3.4.1.3.1`_ of RFC 5849. .. _`Sec 3.4.1.3.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.1 """ if body is None: body = [] headers = headers or {} params = [] # The parameters from the following sources are collected into a single # list of name/value pairs: # * The query component of the HTTP request URI as defined by # `RFC3986, Section 3.4`_. The query component is parsed into a list # of name/value pairs by treating it as an # "application/x-www-form-urlencoded" string, separating the names # and values and decoding them as defined by W3C.REC-html40-19980424 # `W3C-HTML-4.0`_, Section 17.13.4. # # .. _`RFC3986, Sec 3.4`: https://tools.ietf.org/html/rfc3986#section-3.4 # .. _`W3C-HTML-4.0`: https://www.w3.org/TR/1998/REC-html40-19980424/ if uri_query: params.extend(urldecode(uri_query)) # * The OAuth HTTP "Authorization" header field (`Section 3.5.1`_) if # present. The header's content is parsed into a list of name/value # pairs excluding the "realm" parameter if present. The parameter # values are decoded as defined by `Section 3.5.1`_. # # .. _`Section 3.5.1`: https://tools.ietf.org/html/rfc5849#section-3.5.1 if headers: headers_lower = {k.lower(): v for k, v in headers.items()} authorization_header = headers_lower.get('authorization') if authorization_header is not None: params.extend([i for i in utils.parse_authorization_header( authorization_header) if with_realm or i[0] != 'realm']) # * The HTTP request entity-body, but only if all of the following # conditions are met: # * The entity-body is single-part. # # * The entity-body follows the encoding requirements of the # "application/x-www-form-urlencoded" content-type as defined by # W3C.REC-html40-19980424 `W3C-HTML-4.0`_. # * The HTTP request entity-header includes the "Content-Type" # header field set to "application/x-www-form-urlencoded". # # .. _`W3C-HTML-4.0`: https://www.w3.org/TR/1998/REC-html40-19980424/ # TODO: enforce header param inclusion conditions bodyparams = extract_params(body) or [] params.extend(bodyparams) # ensure all oauth params are unescaped unescaped_params = [] for k, v in params: if k.startswith('oauth_'): v = utils.unescape(v) unescaped_params.append((k, v)) # The "oauth_signature" parameter MUST be excluded from the signature # base string if present. if exclude_oauth_signature: unescaped_params = list(filter(lambda i: i[0] != 'oauth_signature', unescaped_params)) return unescaped_params def normalize_parameters(params) -> str: """ Calculate the normalized request parameters. The *normalized request parameters* is one of the components that make up the *signature base string*. The rules for parameter normalization are defined in `section 3.4.1.3.2`_ of RFC 5849. .. _`Sec 3.4.1.3.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.2 """ # The parameters collected in `Section 3.4.1.3`_ are normalized into a # single string as follows: # # .. _`Section 3.4.1.3`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3 # 1. First, the name and value of each parameter are encoded # (`Section 3.6`_). # # .. _`Section 3.6`: https://tools.ietf.org/html/rfc5849#section-3.6 key_values = [(utils.escape(k), utils.escape(v)) for k, v in params] # 2. The parameters are sorted by name, using ascending byte value # ordering. If two or more parameters share the same name, they # are sorted by their value. key_values.sort() # 3. The name of each parameter is concatenated to its corresponding # value using an "=" character (ASCII code 61) as a separator, even # if the value is empty. parameter_parts = ['{}={}'.format(k, v) for k, v in key_values] # 4. The sorted name/value pairs are concatenated together into a # single string by using an "&" character (ASCII code 38) as # separator. return '&'.join(parameter_parts) # ==== Common functions for HMAC-based signature methods ========= def _sign_hmac(hash_algorithm_name: str, sig_base_str: str, client_secret: str, resource_owner_secret: str): """ **HMAC-SHA256** The "HMAC-SHA256" signature method uses the HMAC-SHA256 signature algorithm as defined in `RFC4634`_:: digest = HMAC-SHA256 (key, text) Per `section 3.4.2`_ of the spec. .. _`RFC4634`: https://tools.ietf.org/html/rfc4634 .. _`section 3.4.2`: https://tools.ietf.org/html/rfc5849#section-3.4.2 """ # The HMAC-SHA256 function variables are used in following way: # text is set to the value of the signature base string from # `Section 3.4.1.1`_. # # .. _`Section 3.4.1.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.1 text = sig_base_str # key is set to the concatenated values of: # 1. The client shared-secret, after being encoded (`Section 3.6`_). # # .. _`Section 3.6`: https://tools.ietf.org/html/rfc5849#section-3.6 key = utils.escape(client_secret or '') # 2. An "&" character (ASCII code 38), which MUST be included # even when either secret is empty. key += '&' # 3. The token shared-secret, after being encoded (`Section 3.6`_). # # .. _`Section 3.6`: https://tools.ietf.org/html/rfc5849#section-3.6 key += utils.escape(resource_owner_secret or '') # Get the hashing algorithm to use m = { 'SHA-1': hashlib.sha1, 'SHA-256': hashlib.sha256, 'SHA-512': hashlib.sha512, } hash_alg = m[hash_algorithm_name] # Calculate the signature # FIXME: HMAC does not support unicode! key_utf8 = key.encode('utf-8') text_utf8 = text.encode('utf-8') signature = hmac.new(key_utf8, text_utf8, hash_alg) # digest is used to set the value of the "oauth_signature" protocol # parameter, after the result octet string is base64-encoded # per `RFC2045, Section 6.8`. # # .. _`RFC2045, Sec 6.8`: https://tools.ietf.org/html/rfc2045#section-6.8 return binascii.b2a_base64(signature.digest())[:-1].decode('utf-8') def _verify_hmac(hash_algorithm_name: str, request, client_secret=None, resource_owner_secret=None): """Verify a HMAC-SHA1 signature. Per `section 3.4`_ of the spec. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri attribute MUST be an absolute URI whose netloc part identifies the origin server or gateway on which the resource resides. Any Host item of the request argument's headers dict attribute will be ignored. .. _`RFC2616 section 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2 """ norm_params = normalize_parameters(request.params) bs_uri = base_string_uri(request.uri) sig_base_str = signature_base_string(request.http_method, bs_uri, norm_params) signature = _sign_hmac(hash_algorithm_name, sig_base_str, client_secret, resource_owner_secret) match = safe_string_equals(signature, request.signature) if not match: log.debug('Verify HMAC failed: signature base string: %s', sig_base_str) return match # ==== HMAC-SHA1 ================================================= def sign_hmac_sha1_with_client(sig_base_str, client): return _sign_hmac('SHA-1', sig_base_str, client.client_secret, client.resource_owner_secret) def verify_hmac_sha1(request, client_secret=None, resource_owner_secret=None): return _verify_hmac('SHA-1', request, client_secret, resource_owner_secret) def sign_hmac_sha1(base_string, client_secret, resource_owner_secret): """ Deprecated function for calculating a HMAC-SHA1 signature. This function has been replaced by invoking ``sign_hmac`` with "SHA-1" as the hash algorithm name. This function was invoked by sign_hmac_sha1_with_client and test_signatures.py, but does any application invoke it directly? If not, it can be removed. """ warnings.warn('use sign_hmac_sha1_with_client instead of sign_hmac_sha1', DeprecationWarning) # For some unknown reason, the original implementation assumed base_string # could either be bytes or str. The signature base string calculating # function always returned a str, so the new ``sign_rsa`` only expects that. base_string = base_string.decode('ascii') \ if isinstance(base_string, bytes) else base_string return _sign_hmac('SHA-1', base_string, client_secret, resource_owner_secret) # ==== HMAC-SHA256 =============================================== def sign_hmac_sha256_with_client(sig_base_str, client): return _sign_hmac('SHA-256', sig_base_str, client.client_secret, client.resource_owner_secret) def verify_hmac_sha256(request, client_secret=None, resource_owner_secret=None): return _verify_hmac('SHA-256', request, client_secret, resource_owner_secret) def sign_hmac_sha256(base_string, client_secret, resource_owner_secret): """ Deprecated function for calculating a HMAC-SHA256 signature. This function has been replaced by invoking ``sign_hmac`` with "SHA-256" as the hash algorithm name. This function was invoked by sign_hmac_sha256_with_client and test_signatures.py, but does any application invoke it directly? If not, it can be removed. """ warnings.warn( 'use sign_hmac_sha256_with_client instead of sign_hmac_sha256', DeprecationWarning) # For some unknown reason, the original implementation assumed base_string # could either be bytes or str. The signature base string calculating # function always returned a str, so the new ``sign_rsa`` only expects that. base_string = base_string.decode('ascii') \ if isinstance(base_string, bytes) else base_string return _sign_hmac('SHA-256', base_string, client_secret, resource_owner_secret) # ==== HMAC-SHA512 =============================================== def sign_hmac_sha512_with_client(sig_base_str: str, client): return _sign_hmac('SHA-512', sig_base_str, client.client_secret, client.resource_owner_secret) def verify_hmac_sha512(request, client_secret: str = None, resource_owner_secret: str = None): return _verify_hmac('SHA-512', request, client_secret, resource_owner_secret) # ==== Common functions for RSA-based signature methods ========== _jwt_rsa = {} # cache of RSA-hash implementations from PyJWT jwt.algorithms def _get_jwt_rsa_algorithm(hash_algorithm_name: str): """ Obtains an RSAAlgorithm object that implements RSA with the hash algorithm. This method maintains the ``_jwt_rsa`` cache. Returns a jwt.algorithm.RSAAlgorithm. """ if hash_algorithm_name in _jwt_rsa: # Found in cache: return it return _jwt_rsa[hash_algorithm_name] else: # Not in cache: instantiate a new RSAAlgorithm # PyJWT has some nice pycrypto/cryptography abstractions # import jwt.algorithms as jwt_algorithms #m = { # 'SHA-256': jwt_algorithms.hashes.SHA256, # 'SHA-512': jwt_algorithms.hashes.SHA512, #} #v = jwt_algorithms.RSAAlgorithm(m[hash_algorithm_name]) #_jwt_rsa[hash_algorithm_name] = v # populate cache #return v return None def _prepare_key_plus(alg, keystr): """ Prepare a PEM encoded key (public or private), by invoking the `prepare_key` method on alg with the keystr. The keystr should be a string or bytes. If the keystr is bytes, it is decoded as UTF-8 before being passed to prepare_key. Otherwise, it is passed directly. """ if isinstance(keystr, bytes): keystr = keystr.decode('utf-8') return alg.prepare_key(keystr) def _sign_rsa(hash_algorithm_name: str, sig_base_str: str, rsa_private_key: str): """ Calculate the signature for an RSA-based signature method. The ``alg`` is used to calculate the digest over the signature base string. For the "RSA_SHA1" signature method, the alg must be SHA-1. While OAuth 1.0a only defines the RSA-SHA1 signature method, this function can be used for other non-standard signature methods that only differ from RSA-SHA1 by the digest algorithm. Signing for the RSA-SHA1 signature method is defined in `section 3.4.3`_ of RFC 5849. The RSASSA-PKCS1-v1_5 signature algorithm used defined by `RFC3447, Section 8.2`_ (also known as PKCS#1), with the `alg` as the hash function for EMSA-PKCS1-v1_5. To use this method, the client MUST have established client credentials with the server that included its RSA public key (in a manner that is beyond the scope of this specification). .. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3 .. _`RFC3447, Section 8.2`: https://tools.ietf.org/html/rfc3447#section-8.2 """ # Get the implementation of RSA-hash raise ValueError('Invalid signature method.') alg = _get_jwt_rsa_algorithm(hash_algorithm_name) # Check private key if not rsa_private_key: raise ValueError('rsa_private_key required for RSA with ' + alg.hash_alg.name + ' signature method') # Convert the "signature base string" into a sequence of bytes (M) # # The signature base string, by definition, only contain printable US-ASCII # characters. So encoding it as 'ascii' will always work. It will raise a # ``UnicodeError`` if it can't encode the value, which will never happen # if the signature base string was created correctly. Therefore, using # 'ascii' encoding provides an extra level of error checking. m = sig_base_str.encode('ascii') # Perform signing: S = RSASSA-PKCS1-V1_5-SIGN (K, M) key = _prepare_key_plus(alg, rsa_private_key) s = alg.sign(m, key) # base64-encoded per RFC2045 section 6.8. # # 1. While b2a_base64 implements base64 defined by RFC 3548. As used here, # it is the same as base64 defined by RFC 2045. # 2. b2a_base64 includes a "\n" at the end of its result ([:-1] removes it) # 3. b2a_base64 produces a binary string. Use decode to produce a str. # It should only contain only printable US-ASCII characters. return binascii.b2a_base64(s)[:-1].decode('ascii') def _verify_rsa(hash_algorithm_name: str, request, rsa_public_key: str): """ Verify a base64 encoded signature for a RSA-based signature method. The ``alg`` is used to calculate the digest over the signature base string. For the "RSA_SHA1" signature method, the alg must be SHA-1. While OAuth 1.0a only defines the RSA-SHA1 signature method, this function can be used for other non-standard signature methods that only differ from RSA-SHA1 by the digest algorithm. Verification for the RSA-SHA1 signature method is defined in `section 3.4.3`_ of RFC 5849. .. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3 To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri attribute MUST be an absolute URI whose netloc part identifies the origin server or gateway on which the resource resides. Any Host item of the request argument's headers dict attribute will be ignored. .. _`RFC2616 Sec 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2 """ try: # Calculate the *signature base string* of the actual received request norm_params = normalize_parameters(request.params) bs_uri = base_string_uri(request.uri) sig_base_str = signature_base_string( request.http_method, bs_uri, norm_params) # Obtain the signature that was received in the request sig = binascii.a2b_base64(request.signature.encode('ascii')) # Get the implementation of RSA-with-hash algorithm to use alg = _get_jwt_rsa_algorithm(hash_algorithm_name) # Verify the received signature was produced by the private key # corresponding to the `rsa_public_key`, signing exact same # *signature base string*. # # RSASSA-PKCS1-V1_5-VERIFY ((n, e), M, S) key = _prepare_key_plus(alg, rsa_public_key) # The signature base string only contain printable US-ASCII characters. # The ``encode`` method with the default "strict" error handling will # raise a ``UnicodeError`` if it can't encode the value. So using # "ascii" will always work. verify_ok = alg.verify(sig_base_str.encode('ascii'), key, sig) if not verify_ok: log.debug('Verify failed: RSA with ' + alg.hash_alg.name + ': signature base string=%s' + sig_base_str) return verify_ok except UnicodeError: # A properly encoded signature will only contain printable US-ASCII # characters. The ``encode`` method with the default "strict" error # handling will raise a ``UnicodeError`` if it can't decode the value. # So using "ascii" will work with all valid signatures. But an # incorrectly or maliciously produced signature could contain other # bytes. # # This implementation treats that situation as equivalent to the # signature verification having failed. # # Note: simply changing the encode to use 'utf-8' will not remove this # case, since an incorrect or malicious request can contain bytes which # are invalid as UTF-8. return False # ==== RSA-SHA1 DEPRECATED ================================================ def sign_rsa_sha1_with_client(sig_base_str, client): raise ValueError("RSA-SHA1 is deprecated, use a stronger hash or HMAC-SHA1") def verify_rsa_sha1(request, rsa_public_key: str): raise ValueError("RSA-SHA1 is deprecated, use a stronger hash or HMAC-SHA1") def sign_rsa_sha1(base_string, rsa_private_key): raise ValueError("RSA-SHA1 is deprecated, use a stronger hash or HMAC-SHA1") # ==== RSA-SHA256 ================================================ def sign_rsa_sha256_with_client(sig_base_str: str, client): return _sign_rsa('SHA-256', sig_base_str, client.rsa_key) def verify_rsa_sha256(request, rsa_public_key: str): return _verify_rsa('SHA-256', request, rsa_public_key) # ==== RSA-SHA512 ================================================ def sign_rsa_sha512_with_client(sig_base_str: str, client): return _sign_rsa('SHA-512', sig_base_str, client.rsa_key) def verify_rsa_sha512(request, rsa_public_key: str): return _verify_rsa('SHA-512', request, rsa_public_key) # ==== PLAINTEXT ================================================= def sign_plaintext_with_client(_signature_base_string, client): # _signature_base_string is not used because the signature with PLAINTEXT # is just the secret: it isn't a real signature. return sign_plaintext(client.client_secret, client.resource_owner_secret) def sign_plaintext(client_secret, resource_owner_secret): """Sign a request using plaintext. Per `section 3.4.4`_ of the spec. The "PLAINTEXT" method does not employ a signature algorithm. It MUST be used with a transport-layer mechanism such as TLS or SSL (or sent over a secure channel with equivalent protections). It does not utilize the signature base string or the "oauth_timestamp" and "oauth_nonce" parameters. .. _`section 3.4.4`: https://tools.ietf.org/html/rfc5849#section-3.4.4 """ # The "oauth_signature" protocol parameter is set to the concatenated # value of: # 1. The client shared-secret, after being encoded (`Section 3.6`_). # # .. _`Section 3.6`: https://tools.ietf.org/html/rfc5849#section-3.6 signature = utils.escape(client_secret or '') # 2. An "&" character (ASCII code 38), which MUST be included even # when either secret is empty. signature += '&' # 3. The token shared-secret, after being encoded (`Section 3.6`_). # # .. _`Section 3.6`: https://tools.ietf.org/html/rfc5849#section-3.6 signature += utils.escape(resource_owner_secret or '') return signature def verify_plaintext(request, client_secret=None, resource_owner_secret=None): """Verify a PLAINTEXT signature. Per `section 3.4`_ of the spec. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 """ signature = sign_plaintext(client_secret, resource_owner_secret) match = safe_string_equals(signature, request.signature) if not match: log.debug('Verify PLAINTEXT failed') return match oauth1/rfc5849/errors.py 0000644 00000004652 15125174065 0010754 0 ustar 00 """ oauthlib.oauth1.rfc5849.errors ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Error used both by OAuth 1 clients and provicers to represent the spec defined error responses for all four core grant types. """ from oauthlib.common import add_params_to_uri, urlencode class OAuth1Error(Exception): error = None description = '' def __init__(self, description=None, uri=None, status_code=400, request=None): """ description: A human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred. Values for the "error_description" parameter MUST NOT include characters outside the set x20-21 / x23-5B / x5D-7E. uri: A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error. Values for the "error_uri" parameter MUST conform to the URI- Reference syntax, and thus MUST NOT include characters outside the set x21 / x23-5B / x5D-7E. state: A CSRF protection value received from the client. request: Oauthlib Request object """ self.description = description or self.description message = '({}) {}'.format(self.error, self.description) if request: message += ' ' + repr(request) super().__init__(message) self.uri = uri self.status_code = status_code def in_uri(self, uri): return add_params_to_uri(uri, self.twotuples) @property def twotuples(self): error = [('error', self.error)] if self.description: error.append(('error_description', self.description)) if self.uri: error.append(('error_uri', self.uri)) return error @property def urlencoded(self): return urlencode(self.twotuples) class InsecureTransportError(OAuth1Error): error = 'insecure_transport_protocol' description = 'Only HTTPS connections are permitted.' class InvalidSignatureMethodError(OAuth1Error): error = 'invalid_signature_method' class InvalidRequestError(OAuth1Error): error = 'invalid_request' class InvalidClientError(OAuth1Error): error = 'invalid_client' oauth1/rfc5849/utils.py 0000644 00000005065 15125174065 0010577 0 ustar 00 """ oauthlib.utils ~~~~~~~~~~~~~~ This module contains utility methods used by various parts of the OAuth spec. """ import urllib.request as urllib2 from oauthlib.common import quote, unquote UNICODE_ASCII_CHARACTER_SET = ('abcdefghijklmnopqrstuvwxyz' 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' '0123456789') def filter_params(target): """Decorator which filters params to remove non-oauth_* parameters Assumes the decorated method takes a params dict or list of tuples as its first argument. """ def wrapper(params, *args, **kwargs): params = filter_oauth_params(params) return target(params, *args, **kwargs) wrapper.__doc__ = target.__doc__ return wrapper def filter_oauth_params(params): """Removes all non oauth parameters from a dict or a list of params.""" is_oauth = lambda kv: kv[0].startswith("oauth_") if isinstance(params, dict): return list(filter(is_oauth, list(params.items()))) else: return list(filter(is_oauth, params)) def escape(u): """Escape a unicode string in an OAuth-compatible fashion. Per `section 3.6`_ of the spec. .. _`section 3.6`: https://tools.ietf.org/html/rfc5849#section-3.6 """ if not isinstance(u, str): raise ValueError('Only unicode objects are escapable. ' + 'Got {!r} of type {}.'.format(u, type(u))) # Letters, digits, and the characters '_.-' are already treated as safe # by urllib.quote(). We need to add '~' to fully support rfc5849. return quote(u, safe=b'~') def unescape(u): if not isinstance(u, str): raise ValueError('Only unicode objects are unescapable.') return unquote(u) def parse_keqv_list(l): """A unicode-safe version of urllib2.parse_keqv_list""" # With Python 2.6, parse_http_list handles unicode fine return urllib2.parse_keqv_list(l) def parse_http_list(u): """A unicode-safe version of urllib2.parse_http_list""" # With Python 2.6, parse_http_list handles unicode fine return urllib2.parse_http_list(u) def parse_authorization_header(authorization_header): """Parse an OAuth authorization header into a list of 2-tuples""" auth_scheme = 'OAuth '.lower() if authorization_header[:len(auth_scheme)].lower().startswith(auth_scheme): items = parse_http_list(authorization_header[len(auth_scheme):]) try: return list(parse_keqv_list(items).items()) except (IndexError, ValueError): pass raise ValueError('Malformed authorization header') oauth1/rfc5849/__init__.py 0000644 00000040734 15125174065 0011200 0 ustar 00 """ oauthlib.oauth1.rfc5849 ~~~~~~~~~~~~~~ This module is an implementation of various logic needed for signing and checking OAuth 1.0 RFC 5849 requests. It supports all three standard signature methods defined in RFC 5849: - HMAC-SHA1 - RSA-SHA1 - PLAINTEXT It also supports signature methods that are not defined in RFC 5849. These are based on the standard ones but replace SHA-1 with the more secure SHA-256: - HMAC-SHA256 - RSA-SHA256 """ import base64 import hashlib import logging import urllib.parse as urlparse from oauthlib.common import ( Request, generate_nonce, generate_timestamp, to_unicode, urlencode, ) from . import parameters, signature log = logging.getLogger(__name__) # Available signature methods # # Note: SIGNATURE_HMAC and SIGNATURE_RSA are kept for backward compatibility # with previous versions of this library, when it the only HMAC-based and # RSA-based signature methods were HMAC-SHA1 and RSA-SHA1. But now that it # supports other hashing algorithms besides SHA1, explicitly identifying which # hashing algorithm is being used is recommended. # # Note: if additional values are defined here, don't forget to update the # imports in "../__init__.py" so they are available outside this module. SIGNATURE_HMAC_SHA1 = "HMAC-SHA1" SIGNATURE_HMAC_SHA256 = "HMAC-SHA256" SIGNATURE_HMAC_SHA512 = "HMAC-SHA512" SIGNATURE_HMAC = SIGNATURE_HMAC_SHA1 # deprecated variable for HMAC-SHA1 SIGNATURE_RSA_SHA1 = "RSA-SHA1" SIGNATURE_RSA_SHA256 = "RSA-SHA256" SIGNATURE_RSA_SHA512 = "RSA-SHA512" SIGNATURE_RSA = SIGNATURE_RSA_SHA1 # deprecated variable for RSA-SHA1 SIGNATURE_PLAINTEXT = "PLAINTEXT" SIGNATURE_METHODS = ( SIGNATURE_HMAC_SHA1, SIGNATURE_HMAC_SHA256, SIGNATURE_HMAC_SHA512, SIGNATURE_RSA_SHA1, SIGNATURE_RSA_SHA256, SIGNATURE_RSA_SHA512, SIGNATURE_PLAINTEXT ) SIGNATURE_TYPE_AUTH_HEADER = 'AUTH_HEADER' SIGNATURE_TYPE_QUERY = 'QUERY' SIGNATURE_TYPE_BODY = 'BODY' CONTENT_TYPE_FORM_URLENCODED = 'application/x-www-form-urlencoded' class Client: """A client used to sign OAuth 1.0 RFC 5849 requests.""" SIGNATURE_METHODS = { SIGNATURE_HMAC_SHA1: signature.sign_hmac_sha1_with_client, SIGNATURE_HMAC_SHA256: signature.sign_hmac_sha256_with_client, SIGNATURE_HMAC_SHA512: signature.sign_hmac_sha512_with_client, # sign_rsa_shaXYZ_with_client actually points out to a dummy method # that just throws an exception SIGNATURE_RSA_SHA1: signature.sign_rsa_sha1_with_client, SIGNATURE_RSA_SHA256: signature.sign_rsa_sha256_with_client, SIGNATURE_RSA_SHA512: signature.sign_rsa_sha512_with_client, SIGNATURE_PLAINTEXT: signature.sign_plaintext_with_client } @classmethod def register_signature_method(cls, method_name, method_callback): cls.SIGNATURE_METHODS[method_name] = method_callback def __init__(self, client_key, client_secret=None, resource_owner_key=None, resource_owner_secret=None, callback_uri=None, signature_method=SIGNATURE_HMAC_SHA1, signature_type=SIGNATURE_TYPE_AUTH_HEADER, rsa_key=None, verifier=None, realm=None, encoding='utf-8', decoding=None, nonce=None, timestamp=None): """Create an OAuth 1 client. :param client_key: Client key (consumer key), mandatory. :param resource_owner_key: Resource owner key (oauth token). :param resource_owner_secret: Resource owner secret (oauth token secret). :param callback_uri: Callback used when obtaining request token. :param signature_method: SIGNATURE_HMAC, SIGNATURE_RSA or SIGNATURE_PLAINTEXT. :param signature_type: SIGNATURE_TYPE_AUTH_HEADER (default), SIGNATURE_TYPE_QUERY or SIGNATURE_TYPE_BODY depending on where you want to embed the oauth credentials. :param rsa_key: RSA key used with SIGNATURE_RSA. :param verifier: Verifier used when obtaining an access token. :param realm: Realm (scope) to which access is being requested. :param encoding: If you provide non-unicode input you may use this to have oauthlib automatically convert. :param decoding: If you wish that the returned uri, headers and body from sign be encoded back from unicode, then set decoding to your preferred encoding, i.e. utf-8. :param nonce: Use this nonce instead of generating one. (Mainly for testing) :param timestamp: Use this timestamp instead of using current. (Mainly for testing) """ # Convert to unicode using encoding if given, else assume unicode encode = lambda x: to_unicode(x, encoding) if encoding else x self.client_key = encode(client_key) self.client_secret = encode(client_secret) self.resource_owner_key = encode(resource_owner_key) self.resource_owner_secret = encode(resource_owner_secret) self.signature_method = encode(signature_method) self.signature_type = encode(signature_type) self.callback_uri = encode(callback_uri) self.rsa_key = encode(rsa_key) self.verifier = encode(verifier) self.realm = encode(realm) self.encoding = encode(encoding) self.decoding = encode(decoding) self.nonce = encode(nonce) self.timestamp = encode(timestamp) def __repr__(self): attrs = vars(self).copy() attrs['client_secret'] = '****' if attrs['client_secret'] else None attrs['rsa_key'] = '****' if attrs['rsa_key'] else None attrs[ 'resource_owner_secret'] = '****' if attrs['resource_owner_secret'] else None attribute_str = ', '.join('{}={}'.format(k, v) for k, v in attrs.items()) return '<{} {}>'.format(self.__class__.__name__, attribute_str) def get_oauth_signature(self, request): """Get an OAuth signature to be used in signing a request To satisfy `section 3.4.1.2`_ item 2, if the request argument's headers dict attribute contains a Host item, its value will replace any netloc part of the request argument's uri attribute value. .. _`section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2 """ if self.signature_method == SIGNATURE_PLAINTEXT: # fast-path return signature.sign_plaintext(self.client_secret, self.resource_owner_secret) uri, headers, body = self._render(request) collected_params = signature.collect_parameters( uri_query=urlparse.urlparse(uri).query, body=body, headers=headers) log.debug("Collected params: {}".format(collected_params)) normalized_params = signature.normalize_parameters(collected_params) normalized_uri = signature.base_string_uri(uri, headers.get('Host', None)) log.debug("Normalized params: {}".format(normalized_params)) log.debug("Normalized URI: {}".format(normalized_uri)) base_string = signature.signature_base_string(request.http_method, normalized_uri, normalized_params) log.debug("Signing: signature base string: {}".format(base_string)) if self.signature_method not in self.SIGNATURE_METHODS: raise ValueError('Invalid signature method.') sig = self.SIGNATURE_METHODS[self.signature_method](base_string, self) log.debug("Signature: {}".format(sig)) return sig def get_oauth_params(self, request): """Get the basic OAuth parameters to be used in generating a signature. """ nonce = (generate_nonce() if self.nonce is None else self.nonce) timestamp = (generate_timestamp() if self.timestamp is None else self.timestamp) params = [ ('oauth_nonce', nonce), ('oauth_timestamp', timestamp), ('oauth_version', '1.0'), ('oauth_signature_method', self.signature_method), ('oauth_consumer_key', self.client_key), ] if self.resource_owner_key: params.append(('oauth_token', self.resource_owner_key)) if self.callback_uri: params.append(('oauth_callback', self.callback_uri)) if self.verifier: params.append(('oauth_verifier', self.verifier)) # providing body hash for requests other than x-www-form-urlencoded # as described in https://tools.ietf.org/html/draft-eaton-oauth-bodyhash-00#section-4.1.1 # 4.1.1. When to include the body hash # * [...] MUST NOT include an oauth_body_hash parameter on requests with form-encoded request bodies # * [...] SHOULD include the oauth_body_hash parameter on all other requests. # Note that SHA-1 is vulnerable. The spec acknowledges that in https://tools.ietf.org/html/draft-eaton-oauth-bodyhash-00#section-6.2 # At this time, no further effort has been made to replace SHA-1 for the OAuth Request Body Hash extension. content_type = request.headers.get('Content-Type', None) content_type_eligible = content_type and content_type.find('application/x-www-form-urlencoded') < 0 if request.body is not None and content_type_eligible: params.append(('oauth_body_hash', base64.b64encode(hashlib.sha1(request.body.encode('utf-8')).digest()).decode('utf-8'))) return params def _render(self, request, formencode=False, realm=None): """Render a signed request according to signature type Returns a 3-tuple containing the request URI, headers, and body. If the formencode argument is True and the body contains parameters, it is escaped and returned as a valid formencoded string. """ # TODO what if there are body params on a header-type auth? # TODO what if there are query params on a body-type auth? uri, headers, body = request.uri, request.headers, request.body # TODO: right now these prepare_* methods are very narrow in scope--they # only affect their little thing. In some cases (for example, with # header auth) it might be advantageous to allow these methods to touch # other parts of the request, like the headers—so the prepare_headers # method could also set the Content-Type header to x-www-form-urlencoded # like the spec requires. This would be a fundamental change though, and # I'm not sure how I feel about it. if self.signature_type == SIGNATURE_TYPE_AUTH_HEADER: headers = parameters.prepare_headers( request.oauth_params, request.headers, realm=realm) elif self.signature_type == SIGNATURE_TYPE_BODY and request.decoded_body is not None: body = parameters.prepare_form_encoded_body( request.oauth_params, request.decoded_body) if formencode: body = urlencode(body) headers['Content-Type'] = 'application/x-www-form-urlencoded' elif self.signature_type == SIGNATURE_TYPE_QUERY: uri = parameters.prepare_request_uri_query( request.oauth_params, request.uri) else: raise ValueError('Unknown signature type specified.') return uri, headers, body def sign(self, uri, http_method='GET', body=None, headers=None, realm=None): """Sign a request Signs an HTTP request with the specified parts. Returns a 3-tuple of the signed request's URI, headers, and body. Note that http_method is not returned as it is unaffected by the OAuth signing process. Also worth noting is that duplicate parameters will be included in the signature, regardless of where they are specified (query, body). The body argument may be a dict, a list of 2-tuples, or a formencoded string. The Content-Type header must be 'application/x-www-form-urlencoded' if it is present. If the body argument is not one of the above, it will be returned verbatim as it is unaffected by the OAuth signing process. Attempting to sign a request with non-formencoded data using the OAuth body signature type is invalid and will raise an exception. If the body does contain parameters, it will be returned as a properly- formatted formencoded string. Body may not be included if the http_method is either GET or HEAD as this changes the semantic meaning of the request. All string data MUST be unicode or be encoded with the same encoding scheme supplied to the Client constructor, default utf-8. This includes strings inside body dicts, for example. """ # normalize request data request = Request(uri, http_method, body, headers, encoding=self.encoding) # sanity check content_type = request.headers.get('Content-Type', None) multipart = content_type and content_type.startswith('multipart/') should_have_params = content_type == CONTENT_TYPE_FORM_URLENCODED has_params = request.decoded_body is not None # 3.4.1.3.1. Parameter Sources # [Parameters are collected from the HTTP request entity-body, but only # if [...]: # * The entity-body is single-part. if multipart and has_params: raise ValueError( "Headers indicate a multipart body but body contains parameters.") # * The entity-body follows the encoding requirements of the # "application/x-www-form-urlencoded" content-type as defined by # [W3C.REC-html40-19980424]. elif should_have_params and not has_params: raise ValueError( "Headers indicate a formencoded body but body was not decodable.") # * The HTTP request entity-header includes the "Content-Type" # header field set to "application/x-www-form-urlencoded". elif not should_have_params and has_params: raise ValueError( "Body contains parameters but Content-Type header was {} " "instead of {}".format(content_type or "not set", CONTENT_TYPE_FORM_URLENCODED)) # 3.5.2. Form-Encoded Body # Protocol parameters can be transmitted in the HTTP request entity- # body, but only if the following REQUIRED conditions are met: # o The entity-body is single-part. # o The entity-body follows the encoding requirements of the # "application/x-www-form-urlencoded" content-type as defined by # [W3C.REC-html40-19980424]. # o The HTTP request entity-header includes the "Content-Type" header # field set to "application/x-www-form-urlencoded". elif self.signature_type == SIGNATURE_TYPE_BODY and not ( should_have_params and has_params and not multipart): raise ValueError( 'Body signatures may only be used with form-urlencoded content') # We amend https://tools.ietf.org/html/rfc5849#section-3.4.1.3.1 # with the clause that parameters from body should only be included # in non GET or HEAD requests. Extracting the request body parameters # and including them in the signature base string would give semantic # meaning to the body, which it should not have according to the # HTTP 1.1 spec. elif http_method.upper() in ('GET', 'HEAD') and has_params: raise ValueError('GET/HEAD requests should not include body.') # generate the basic OAuth parameters request.oauth_params = self.get_oauth_params(request) # generate the signature request.oauth_params.append( ('oauth_signature', self.get_oauth_signature(request))) # render the signed request and return it uri, headers, body = self._render(request, formencode=True, realm=(realm or self.realm)) if self.decoding: log.debug('Encoding URI, headers and body to %s.', self.decoding) uri = uri.encode(self.decoding) body = body.encode(self.decoding) if body else body new_headers = {} for k, v in headers.items(): new_headers[k.encode(self.decoding)] = v.encode(self.decoding) headers = new_headers return uri, headers, body oauth1/__init__.py 0000644 00000001774 15125174065 0010075 0 ustar 00 """ oauthlib.oauth1 ~~~~~~~~~~~~~~ This module is a wrapper for the most recent implementation of OAuth 1.0 Client and Server classes. """ from .rfc5849 import Client from .rfc5849 import (SIGNATURE_HMAC, SIGNATURE_HMAC_SHA1, SIGNATURE_HMAC_SHA256, SIGNATURE_HMAC_SHA512, SIGNATURE_PLAINTEXT) from .rfc5849 import SIGNATURE_TYPE_AUTH_HEADER, SIGNATURE_TYPE_QUERY from .rfc5849 import SIGNATURE_TYPE_BODY from .rfc5849.request_validator import RequestValidator from .rfc5849.endpoints import RequestTokenEndpoint, AuthorizationEndpoint from .rfc5849.endpoints import AccessTokenEndpoint, ResourceEndpoint from .rfc5849.endpoints import SignatureOnlyEndpoint, WebApplicationServer from .rfc5849.errors import (InsecureTransportError, InvalidClientError, InvalidRequestError, InvalidSignatureMethodError, OAuth1Error) common.py 0000644 00000032156 15125174065 0006423 0 ustar 00 """ oauthlib.common ~~~~~~~~~~~~~~ This module provides data structures and utilities common to all implementations of OAuth. """ import collections import datetime import logging import re import time import urllib.parse as urlparse from urllib.parse import ( quote as _quote, unquote as _unquote, urlencode as _urlencode, ) from . import get_debug try: from secrets import randbits from secrets import SystemRandom except ImportError: from random import getrandbits as randbits from random import SystemRandom UNICODE_ASCII_CHARACTER_SET = ('abcdefghijklmnopqrstuvwxyz' 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' '0123456789') CLIENT_ID_CHARACTER_SET = (r' !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMN' 'OPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}') SANITIZE_PATTERN = re.compile(r'([^&;]*(?:password|token)[^=]*=)[^&;]+', re.IGNORECASE) INVALID_HEX_PATTERN = re.compile(r'%[^0-9A-Fa-f]|%[0-9A-Fa-f][^0-9A-Fa-f]') always_safe = ('ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' '0123456789' '_.-') log = logging.getLogger('oauthlib') # 'safe' must be bytes (Python 2.6 requires bytes, other versions allow either) def quote(s, safe=b'/'): s = s.encode('utf-8') if isinstance(s, str) else s s = _quote(s, safe) # PY3 always returns unicode. PY2 may return either, depending on whether # it had to modify the string. if isinstance(s, bytes): s = s.decode('utf-8') return s def unquote(s): s = _unquote(s) # PY3 always returns unicode. PY2 seems to always return what you give it, # which differs from quote's behavior. Just to be safe, make sure it is # unicode before we return. if isinstance(s, bytes): s = s.decode('utf-8') return s def urlencode(params): utf8_params = encode_params_utf8(params) urlencoded = _urlencode(utf8_params) if isinstance(urlencoded, str): return urlencoded else: return urlencoded.decode("utf-8") def encode_params_utf8(params): """Ensures that all parameters in a list of 2-element tuples are encoded to bytestrings using UTF-8 """ encoded = [] for k, v in params: encoded.append(( k.encode('utf-8') if isinstance(k, str) else k, v.encode('utf-8') if isinstance(v, str) else v)) return encoded def decode_params_utf8(params): """Ensures that all parameters in a list of 2-element tuples are decoded to unicode using UTF-8. """ decoded = [] for k, v in params: decoded.append(( k.decode('utf-8') if isinstance(k, bytes) else k, v.decode('utf-8') if isinstance(v, bytes) else v)) return decoded urlencoded = set(always_safe) | set('=&;:%+~,*@!()/?\'$') def urldecode(query): """Decode a query string in x-www-form-urlencoded format into a sequence of two-element tuples. Unlike urlparse.parse_qsl(..., strict_parsing=True) urldecode will enforce correct formatting of the query string by validation. If validation fails a ValueError will be raised. urllib.parse_qsl will only raise errors if any of name-value pairs omits the equals sign. """ # Check if query contains invalid characters if query and not set(query) <= urlencoded: error = ("Error trying to decode a non urlencoded string. " "Found invalid characters: %s " "in the string: '%s'. " "Please ensure the request/response body is " "x-www-form-urlencoded.") raise ValueError(error % (set(query) - urlencoded, query)) # Check for correctly hex encoded values using a regular expression # All encoded values begin with % followed by two hex characters # correct = %00, %A0, %0A, %FF # invalid = %G0, %5H, %PO if INVALID_HEX_PATTERN.search(query): raise ValueError('Invalid hex encoding in query string.') # We want to allow queries such as "c2" whereas urlparse.parse_qsl # with the strict_parsing flag will not. params = urlparse.parse_qsl(query, keep_blank_values=True) # unicode all the things return decode_params_utf8(params) def extract_params(raw): """Extract parameters and return them as a list of 2-tuples. Will successfully extract parameters from urlencoded query strings, dicts, or lists of 2-tuples. Empty strings/dicts/lists will return an empty list of parameters. Any other input will result in a return value of None. """ if isinstance(raw, (bytes, str)): try: params = urldecode(raw) except ValueError: params = None elif hasattr(raw, '__iter__'): try: dict(raw) except ValueError: params = None except TypeError: params = None else: params = list(raw.items() if isinstance(raw, dict) else raw) params = decode_params_utf8(params) else: params = None return params def generate_nonce(): """Generate pseudorandom nonce that is unlikely to repeat. Per `section 3.3`_ of the OAuth 1 RFC 5849 spec. Per `section 3.2.1`_ of the MAC Access Authentication spec. A random 64-bit number is appended to the epoch timestamp for both randomness and to decrease the likelihood of collisions. .. _`section 3.2.1`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-3.2.1 .. _`section 3.3`: https://tools.ietf.org/html/rfc5849#section-3.3 """ return str(str(randbits(64)) + generate_timestamp()) def generate_timestamp(): """Get seconds since epoch (UTC). Per `section 3.3`_ of the OAuth 1 RFC 5849 spec. Per `section 3.2.1`_ of the MAC Access Authentication spec. .. _`section 3.2.1`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-3.2.1 .. _`section 3.3`: https://tools.ietf.org/html/rfc5849#section-3.3 """ return str(int(time.time())) def generate_token(length=30, chars=UNICODE_ASCII_CHARACTER_SET): """Generates a non-guessable OAuth token OAuth (1 and 2) does not specify the format of tokens except that they should be strings of random characters. Tokens should not be guessable and entropy when generating the random characters is important. Which is why SystemRandom is used instead of the default random.choice method. """ rand = SystemRandom() return ''.join(rand.choice(chars) for x in range(length)) def generate_signed_token(private_pem, request): import jwt now = datetime.datetime.utcnow() claims = { 'scope': request.scope, 'exp': now + datetime.timedelta(seconds=request.expires_in) } claims.update(request.claims) token = jwt.encode(claims, private_pem, 'RS256') token = to_unicode(token, "UTF-8") return token def verify_signed_token(public_pem, token): import jwt return jwt.decode(token, public_pem, algorithms=['RS256']) def generate_client_id(length=30, chars=CLIENT_ID_CHARACTER_SET): """Generates an OAuth client_id OAuth 2 specify the format of client_id in https://tools.ietf.org/html/rfc6749#appendix-A. """ return generate_token(length, chars) def add_params_to_qs(query, params): """Extend a query with a list of two-tuples.""" if isinstance(params, dict): params = params.items() queryparams = urlparse.parse_qsl(query, keep_blank_values=True) queryparams.extend(params) return urlencode(queryparams) def add_params_to_uri(uri, params, fragment=False): """Add a list of two-tuples to the uri query components.""" sch, net, path, par, query, fra = urlparse.urlparse(uri) if fragment: fra = add_params_to_qs(fra, params) else: query = add_params_to_qs(query, params) return urlparse.urlunparse((sch, net, path, par, query, fra)) def safe_string_equals(a, b): """ Near-constant time string comparison. Used in order to avoid timing attacks on sensitive information such as secret keys during request verification (`rootLabs`_). .. _`rootLabs`: http://rdist.root.org/2010/01/07/timing-independent-array-comparison/ """ if len(a) != len(b): return False result = 0 for x, y in zip(a, b): result |= ord(x) ^ ord(y) return result == 0 def to_unicode(data, encoding='UTF-8'): """Convert a number of different types of objects to unicode.""" if isinstance(data, str): return data if isinstance(data, bytes): return str(data, encoding=encoding) if hasattr(data, '__iter__'): try: dict(data) except TypeError: pass except ValueError: # Assume it's a one dimensional data structure return (to_unicode(i, encoding) for i in data) else: # We support 2.6 which lacks dict comprehensions if hasattr(data, 'items'): data = data.items() return {to_unicode(k, encoding): to_unicode(v, encoding) for k, v in data} return data class CaseInsensitiveDict(dict): """Basic case insensitive dict with strings only keys.""" proxy = {} def __init__(self, data): self.proxy = {k.lower(): k for k in data} for k in data: self[k] = data[k] def __contains__(self, k): return k.lower() in self.proxy def __delitem__(self, k): key = self.proxy[k.lower()] super().__delitem__(key) del self.proxy[k.lower()] def __getitem__(self, k): key = self.proxy[k.lower()] return super().__getitem__(key) def get(self, k, default=None): return self[k] if k in self else default def __setitem__(self, k, v): super().__setitem__(k, v) self.proxy[k.lower()] = k def update(self, *args, **kwargs): super().update(*args, **kwargs) for k in dict(*args, **kwargs): self.proxy[k.lower()] = k class Request: """A malleable representation of a signable HTTP request. Body argument may contain any data, but parameters will only be decoded if they are one of: * urlencoded query string * dict * list of 2-tuples Anything else will be treated as raw body data to be passed through unmolested. """ def __init__(self, uri, http_method='GET', body=None, headers=None, encoding='utf-8'): # Convert to unicode using encoding if given, else assume unicode encode = lambda x: to_unicode(x, encoding) if encoding else x self.uri = encode(uri) self.http_method = encode(http_method) self.headers = CaseInsensitiveDict(encode(headers or {})) self.body = encode(body) self.decoded_body = extract_params(self.body) self.oauth_params = [] self.validator_log = {} self._params = { "access_token": None, "client": None, "client_id": None, "client_secret": None, "code": None, "code_challenge": None, "code_challenge_method": None, "code_verifier": None, "extra_credentials": None, "grant_type": None, "redirect_uri": None, "refresh_token": None, "request_token": None, "response_type": None, "scope": None, "scopes": None, "state": None, "token": None, "user": None, "token_type_hint": None, # OpenID Connect "response_mode": None, "nonce": None, "display": None, "prompt": None, "claims": None, "max_age": None, "ui_locales": None, "id_token_hint": None, "login_hint": None, "acr_values": None } self._params.update(dict(urldecode(self.uri_query))) self._params.update(dict(self.decoded_body or [])) def __getattr__(self, name): if name in self._params: return self._params[name] else: raise AttributeError(name) def __repr__(self): if not get_debug(): return "<oauthlib.Request SANITIZED>" body = self.body headers = self.headers.copy() if body: body = SANITIZE_PATTERN.sub('\1<SANITIZED>', str(body)) if 'Authorization' in headers: headers['Authorization'] = '<SANITIZED>' return '<oauthlib.Request url="{}", http_method="{}", headers="{}", body="{}">'.format( self.uri, self.http_method, headers, body) @property def uri_query(self): return urlparse.urlparse(self.uri).query @property def uri_query_params(self): if not self.uri_query: return [] return urlparse.parse_qsl(self.uri_query, keep_blank_values=True, strict_parsing=True) @property def duplicate_params(self): seen_keys = collections.defaultdict(int) all_keys = (p[0] for p in (self.decoded_body or []) + self.uri_query_params) for k in all_keys: seen_keys[k] += 1 return [k for k, c in seen_keys.items() if c > 1] __init__.py 0000644 00000001256 15125174065 0006667 0 ustar 00 """ oauthlib ~~~~~~~~ A generic, spec-compliant, thorough implementation of the OAuth request-signing logic. :copyright: (c) 2019 by The OAuthlib Community :license: BSD, see LICENSE for details. """ import logging from logging import NullHandler __author__ = 'The OAuthlib Community' __version__ = '3.1.1' logging.getLogger('oauthlib').addHandler(NullHandler()) _DEBUG = False def set_debug(debug_val): """Set value of debug flag :param debug_val: Value to set. Must be a bool value. """ global _DEBUG _DEBUG = debug_val def get_debug(): """Get debug mode value. :return: `True` if debug mode is on, `False` otherwise """ return _DEBUG
| ver. 1.6 |
Github
|
.
| PHP 8.2.30 | ??????????? ?????????: 0.02 |
proxy
|
phpinfo
|
???????????