3
,[9> @ s d Z ddlmZmZ ddlZddlZddlZddlmZm Z m
Z
ddl m Z ddl
mZmZmZmZmZmZ ddlmZ dd lmZmZmZ y ddlZW n ek
r ddl j ZY nX dd
d Z dd
dZ d ddZ d ddZ!d ddZ"d ddZ#dd Z$dS ) z
oauthlib.oauth2.rfc6749.parameters
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This module contains methods related to `Section 4`_ of the OAuth 2 RFC.
.. _`Section 4`: https://tools.ietf.org/html/rfc6749#section-4
)absolute_importunicode_literalsN)add_params_to_qsadd_params_to_uri unicode_type)
scope_changed )InsecureTransportErrorMismatchingStateErrorMissingCodeErrorMissingTokenErrorMissingTokenTypeErrorraise_from_error) OAuth2Token)is_secure_transport
list_to_scope
scope_to_listc K s t | st d|fd|fg}|r0|jd|f |rF|jdt|f |rX|jd|f x*|D ]"}|| r^|jt||| f q^W t| |S )aa Prepare the authorization grant request URI.
The client constructs the request URI by adding the following
parameters to the query component of the authorization endpoint URI
using the ``application/x-www-form-urlencoded`` format as defined by
[`W3C.REC-html401-19991224`_]:
:param response_type: To indicate which OAuth 2 grant/flow is required,
"code" and "token".
:param client_id: The client identifier as described in `Section 2.2`_.
:param redirect_uri: The client provided URI to redirect back to after
authorization as described in `Section 3.1.2`_.
:param scope: The scope of the access request as described by
`Section 3.3`_.
:param state: An opaque value used by the client to maintain
state between the request and callback. The authorization
server includes this value when redirecting the user-agent
back to the client. The parameter SHOULD be used for
preventing cross-site request forgery as described in
`Section 10.12`_.
:param kwargs: Extra arguments to embed in the grant/authorization URL.
An example of an authorization code grant authorization URL:
.. code-block:: http
GET /authorize?response_type=code&client_id=s6BhdRkqt3&state=xyz
&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb HTTP/1.1
Host: server.example.com
.. _`W3C.REC-html401-19991224`: https://tools.ietf.org/html/rfc6749#ref-W3C.REC-html401-19991224
.. _`Section 2.2`: https://tools.ietf.org/html/rfc6749#section-2.2
.. _`Section 3.1.2`: https://tools.ietf.org/html/rfc6749#section-3.1.2
.. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3
.. _`section 10.12`: https://tools.ietf.org/html/rfc6749#section-10.12
response_type client_id redirect_uriscopestate)r r appendr r r ) urir r r r r kwargsparamsk r /usr/lib/python3.6/parameters.pyprepare_grant_uri s '
r c K sX d| fg}d|kr"t |d |d< x*|D ]"}|| r(|jt||| f q(W t||S )au Prepare the access token request.
The client makes a request to the token endpoint by adding the
following parameters using the ``application/x-www-form-urlencoded``
format in the HTTP request entity-body:
:param grant_type: To indicate grant type being used, i.e. "password",
"authorization_code" or "client_credentials".
:param body: Existing request body to embed parameters in.
:param code: If using authorization code grant, pass the previously
obtained authorization code as the ``code`` argument.
:param redirect_uri: If the "redirect_uri" parameter was included in the
authorization request as described in
`Section 4.1.1`_, and their values MUST be identical.
:param kwargs: Extra arguments to embed in the request body.
An example of an authorization code token request body:
.. code-block:: http
grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA
&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb
.. _`Section 4.1.1`: https://tools.ietf.org/html/rfc6749#section-4.1.1
grant_typer )r r r r )r! bodyr r r r r r prepare_token_requestZ s
r# access_tokenc K s t | st d|fg}|r*|jd|f x*|D ]"}|| r0|jt||| f q0W ddi}|r|jd|f t| |||fS | |t||fS dS )ay Prepare a token revocation request.
The client constructs the request by including the following parameters
using the "application/x-www-form-urlencoded" format in the HTTP request
entity-body:
token REQUIRED. The token that the client wants to get revoked.
token_type_hint OPTIONAL. A hint about the type of the token submitted
for revocation. Clients MAY pass this parameter in order to help the
authorization server to optimize the token lookup. If the server is unable
to locate the token using the given hint, it MUST extend its search across
all of its supported token types. An authorization server MAY ignore this
parameter, particularly if it is able to detect the token type
automatically. This specification defines two such values:
* access_token: An access token as defined in [RFC6749],
`Section 1.4`_
* refresh_token: A refresh token as defined in [RFC6749],
`Section 1.5`_
Specific implementations, profiles, and extensions of this
specification MAY define other values for this parameter using the
registry defined in `Section 4.1.2`_.
.. _`Section 1.4`: https://tools.ietf.org/html/rfc6749#section-1.4
.. _`Section 1.5`: https://tools.ietf.org/html/rfc6749#section-1.5
.. _`Section 4.1.2`: https://tools.ietf.org/html/rfc7009#section-4.1.2
tokentoken_type_hintz Content-Typez!application/x-www-form-urlencodedcallbackN)r r r r r r ) Zurlr% r& r' r" r r r Zheadersr r r prepare_token_revocation_request s !
r( c C sV t | st tj| j}ttj|}d|kr8td|rR|jdd|krRt |S )aZ Parse authorization grant response URI into a dict.
If the resource owner grants the access request, the authorization
server issues an authorization code and delivers it to the client by
adding the following parameters to the query component of the
redirection URI using the ``application/x-www-form-urlencoded`` format:
**code**
REQUIRED. The authorization code generated by the
authorization server. The authorization code MUST expire
shortly after it is issued to mitigate the risk of leaks. A
maximum authorization code lifetime of 10 minutes is
RECOMMENDED. The client MUST NOT use the authorization code
more than once. If an authorization code is used more than
once, the authorization server MUST deny the request and SHOULD
revoke (when possible) all tokens previously issued based on
that authorization code. The authorization code is bound to
the client identifier and redirection URI.
**state**
REQUIRED if the "state" parameter was present in the client
authorization request. The exact value received from the
client.
:param uri: The full redirect URL back to the client.
:param state: The state parameter from the authorization request.
For example, the authorization server redirects the user-agent by
sending the following HTTP response:
.. code-block:: http
HTTP/1.1 302 Found
Location: https://client.example.com/cb?code=SplxlOBeZQQYbYS6WxSbIA
&state=xyz
codez#Missing code parameter in response.r N) r r urlparsequerydict parse_qslr getr
)r r r+ r r r r !parse_authorization_code_response s & r/ c C s t | st tj| j}ttj|dd}d|krDt|d |d< d|krdtj t|d |d< |r|j dd|krt
dt ||d }t | |S )
a] Parse the implicit token response URI into a dict.
If the resource owner grants the access request, the authorization
server issues an access token and delivers it to the client by adding
the following parameters to the fragment component of the redirection
URI using the ``application/x-www-form-urlencoded`` format:
**access_token**
REQUIRED. The access token issued by the authorization server.
**token_type**
REQUIRED. The type of the token issued as described in
Section 7.1. Value is case insensitive.
**expires_in**
RECOMMENDED. The lifetime in seconds of the access token. For
example, the value "3600" denotes that the access token will
expire in one hour from the time the response was generated.
If omitted, the authorization server SHOULD provide the
expiration time via other means or document the default value.
**scope**
OPTIONAL, if identical to the scope requested by the client,
otherwise REQUIRED. The scope of the access token as described
by Section 3.3.
**state**
REQUIRED if the "state" parameter was present in the client
authorization request. The exact value received from the
client.
Similar to the authorization code response, but with a full token provided
in the URL fragment:
.. code-block:: http
HTTP/1.1 302 Found
Location: http://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA
&state=xyz&token_type=example&expires_in=3600
T)Zkeep_blank_valuesr
expires_in
expires_atr Nz'Mismatching or missing state in params.) old_scope)
r r r* fragmentr, r- r timeintr.
ValueErrorr validate_token_parameters)r r r r3 r r r r parse_implicit_response s ) r8 c C s yt j| }W nH tk
rV ttj| }x$dD ] }||kr2t|| ||< q2W Y nX d|krpt|d |d< d|kr|jd|d< d|krt j t|d |d< t
||d}t | |S )a Parse the JSON token response body into a dict.
The authorization server issues an access token and optional refresh
token, and constructs the response by adding the following parameters
to the entity body of the HTTP response with a 200 (OK) status code:
access_token
REQUIRED. The access token issued by the authorization server.
token_type
REQUIRED. The type of the token issued as described in
`Section 7.1`_. Value is case insensitive.
expires_in
RECOMMENDED. The lifetime in seconds of the access token. For
example, the value "3600" denotes that the access token will
expire in one hour from the time the response was generated.
If omitted, the authorization server SHOULD provide the
expiration time via other means or document the default value.
refresh_token
OPTIONAL. The refresh token which can be used to obtain new
access tokens using the same authorization grant as described
in `Section 6`_.
scope
OPTIONAL, if identical to the scope requested by the client,
otherwise REQUIRED. The scope of the access token as described
by `Section 3.3`_.
The parameters are included in the entity body of the HTTP response
using the "application/json" media type as defined by [`RFC4627`_]. The
parameters are serialized into a JSON structure by adding each
parameter at the highest structure level. Parameter names and string
values are included as JSON strings. Numerical values are included
as JSON numbers. The order of parameters does not matter and can
vary.
:param body: The full json encoded response body.
:param scope: The scope requested during authorization.
For example:
.. code-block:: http
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache
{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"token_type":"example",
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
"example_parameter":"example_value"
}
.. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1
.. _`Section 6`: https://tools.ietf.org/html/rfc6749#section-6
.. _`Section 3.3`: https://tools.ietf.org/html/rfc6749#section-3.3
.. _`RFC4627`: https://tools.ietf.org/html/rfc4627
r0 expiresr r1 )r2 )r0 r9 ) jsonloadsr6 r, r* r- r5 r popr4 r r7 )r" r r keyr r r parse_token_response( s <
r> c C s d| krt | jd| d| kr*tddd| krDtjjdrDt | jrdj| j| j d}tj
|| j | j d tjjd
d st
|}| |_| j |_| j |_|d S ) zCEnsures token precence, token type, expiration and scope in params.errorr$ z Missing access token parameter.) description
token_typeZOAUTHLIB_STRICT_TOKEN_TYPEz*Scope has changed from "{old}" to "{new}".)oldnew)messagerB rC ZOAUTHLIB_RELAX_TOKEN_SCOPEN)r r. r osenvironr
r formatr2 r sendZ
old_scopesZscopesWarningr% Z new_scope)r rD wr r r r7 s"
r7 )NNN)r )r$ Nr )N)NN)N)%__doc__Z
__future__r r r: rE r4 Zoauthlib.commonr r r Zoauthlib.signalsr errorsr r
r r r
r tokensr Zutilsr r r r* ImportErrorZ urllib.parseparser r# r( r/ r8 r> r7 r r r r s,
:
&
5
5
=
W