Make http_client and verify/proxies/timeout mutually exclusive

Author: rayluo

oauth2cli/oauth2.py

@@ -43,7 +43,7 @@ def __init__(
             client_assertion_type=None,  # type: Optional[str]
             default_headers=None,  # type: Optional[dict]
             default_body=None,  # type: Optional[dict]
-            verify=True,  # type: Union[str, True, False, None]
+            verify=None,  # type: Union[str, True, False, None]
             proxies=None,  # type: Optional[dict]
             timeout=None,  # type: Union[tuple, float, None]
             ):
@@ -60,9 +60,21 @@ def __init__(
                 or
                 https://example.com/.../.well-known/openid-configuration
             client_id (str): The client's id, issued by the authorization server
+
             http_client (http.HttpClient):
                 Your implementation of abstract class :class:`http.HttpClient`.
                 Defaults to a requests session instance.
+
+                There is no session-wide `timeout` parameter defined here.
+                Timeout behavior is determined by the actual http client you use.
+                If you happen to use Requests, it disallows session-wide timeout
+                (https://github.com/psf/requests/issues/3341). The workaround is:
+
+                    s = requests.Session()
+                    s.request = functools.partial(s.request, timeout=3)
+
+                and then feed that patched session instance to this class.
+
             client_secret (str):  Triggers HTTP AUTH for Confidential Client
             client_assertion (bytes, callable):
                 The client assertion to authenticate this client, per RFC 7521.
@@ -86,28 +98,25 @@ def __init__(
             verify (boolean):
                 It will be passed to the
                 `verify parameter in the underlying requests library
-                <http://docs.python-requests.org/en/v2.9.1/user/advanced/#ssl-cert-verification>`_
+                <http://docs.python-requests.org/en/v2.9.1/user/advanced/#ssl-cert-verification>`_.
+                When leaving it with default value (None), we will use True instead.
+
                 This does not apply if you have chosen to pass your own Http client.
+
             proxies (dict):
                 It will be passed to the
                 `proxies parameter in the underlying requests library
-                <http://docs.python-requests.org/en/v2.9.1/user/advanced/#proxies>`_
+                <http://docs.python-requests.org/en/v2.9.1/user/advanced/#proxies>`_.
+
                 This does not apply if you have chosen to pass your own Http client.
+
             timeout (object):
                 It will be passed to the
                 `timeout parameter in the underlying requests library
-                <http://docs.python-requests.org/en/v2.9.1/user/advanced/#timeouts>`_
-                This does not apply if you have chosen to pass your own Http client.
-
-        There is no session-wide `timeout` parameter defined here.
-        The timeout behavior is determined by the actual http client you use.
-        If you happen to use Requests, it chose to not support session-wide timeout
-        (https://github.com/psf/requests/issues/3341), but you can patch that by:
+                <http://docs.python-requests.org/en/v2.9.1/user/advanced/#timeouts>`_.
 
-            s = requests.Session()
-            s.request = functools.partial(s.request, timeout=3)
+                This does not apply if you have chosen to pass your own Http client.
 
-        and then feed that patched session instance to this class.
         """
         self.configuration = server_configuration
         self.client_id = client_id
@@ -119,10 +128,14 @@ def __init__(
             self.default_body["client_assertion_type"] = client_assertion_type
         self.logger = logging.getLogger(__name__)
         if http_client:
+            if verify is not None or proxies is not None or timeout is not None:
+                raise ValueError(
+                    "verify, proxies, or timeout is not allowed "
+                    "when http_client is in use")
             self.http_client = http_client
         else:
             self.http_client = requests.Session()
-            self.http_client.verify = verify
+            self.http_client.verify = True if verify is None else verify
             self.http_client.proxies = proxies
             self.http_client.request = functools.partial(
                 # A workaround for requests not supporting session-wide timeout