Simplify decode logout token service

- Implement as a simple function rather than a class
- Assume the client id is always the one configured in CIS2_CLIENT_ID,
  rather than a value injected into the service
- Accept the issuer value directly, rather than the entire metadata dict

Author: malcolmbaig

manage_breast_screening/auth/services.py

@@ -8,6 +8,7 @@
     InvalidTokenError,
     MissingClaimError,
 )
+from django.conf import settings
 
 logger = logging.getLogger(__name__)
 
@@ -16,46 +17,43 @@ class InvalidLogoutToken(Exception):
     """Raised when a CIS2 back-channel logout token is invalid."""
 
 
-class DecodeLogoutToken:
-    def call(
-        self,
-        metadata: Dict[str, Any],
-        logout_token: str,
-        client_id: str,
-        key_loader,
-    ):
-        """
-        Decode and validate a CIS2 back-channel logout token.
+def decode_logout_token(
+    issuer: str,
+    key_loader,
+    logout_token: str,
+) -> Dict[str, Any]:
+    """
+    Decode and validate a CIS2 back-channel logout token.
 
-        Returns the decoded claims on success and raises InvalidLogoutToken on
-        any underlying decoding/validation error.
-        """
-        try:
-            verification_rules = {
-                "iss": {"values": [metadata["issuer"]], "essential": True},
-                "aud": {"values": [client_id], "essential": True},
-                "exp": {"essential": True},
-                "iat": {"essential": True},
-                "events": {
-                    "essential": True,
-                    "validate": lambda claim, value: isinstance(value, dict)
-                    and "http://schemas.openid.net/event/backchannel-logout" in value,
-                },
-                "nonce": {"validate": lambda claim, value: value is None},
-            }
-            claims = jwt.decode(
-                logout_token,
-                key=key_loader,
-                claims_options=verification_rules,
-            )
-            claims.validate(leeway=60)
-            return claims
-        except (
-            ExpiredTokenError,
-            InvalidClaimError,
-            InvalidTokenError,
-            JoseError,
-            MissingClaimError,
-        ) as e:
-            logger.exception("Invalid logout token")
-            raise InvalidLogoutToken() from e
+    Returns the decoded claims on success and raises InvalidLogoutToken on
+    any underlying decoding/validation error.
+    """
+    try:
+        verification_rules = {
+            "iss": {"values": [issuer], "essential": True},
+            "aud": {"values": [settings.CIS2_CLIENT_ID], "essential": True},
+            "exp": {"essential": True},
+            "iat": {"essential": True},
+            "events": {
+                "essential": True,
+                "validate": lambda claim, value: isinstance(value, dict)
+                and "http://schemas.openid.net/event/backchannel-logout" in value,
+            },
+            "nonce": {"validate": lambda claim, value: value is None},
+        }
+        claims = jwt.decode(
+            logout_token,
+            key=key_loader,
+            claims_options=verification_rules,
+        )
+        claims.validate(leeway=60)
+        return claims
+    except (
+        ExpiredTokenError,
+        InvalidClaimError,
+        InvalidTokenError,
+        JoseError,
+        MissingClaimError,
+    ) as e:
+        logger.exception("Invalid logout token")
+        raise InvalidLogoutToken() from e

manage_breast_screening/auth/tests/test_services.py

@@ -8,10 +8,11 @@
     JoseError,
     MissingClaimError,
 )
+from django.conf import settings
 
 from manage_breast_screening.auth.services import (
-    DecodeLogoutToken,
     InvalidLogoutToken,
+    decode_logout_token,
 )
 
 
@@ -30,13 +31,12 @@ def _make_token(
         private_jwk: dict,
         kid: str,
         issuer: str,
-        client_id: str,
         overrides: dict | None = None,
     ) -> str:
         now = int(time.time())
         payload = {
             "iss": issuer,
-            "aud": client_id,
+            "aud": settings.CIS2_CLIENT_ID,
             "iat": now,
             "exp": now + 300,
             "events": {"http://schemas.openid.net/event/backchannel-logout": {}},
@@ -57,28 +57,24 @@ def _make_token(
 
     @staticmethod
     def _key_loader(public_jwk: dict):
-        def loader(headers, payload):
+        def loader(_headers, _payload):
             return public_jwk
 
         return loader
 
     def test_valid_token_returns_claims(self):
         kid = "k1"
-        issuer = "test-issuer"
-        client_id = "client-1"
         private_jwk, public_jwk = self._make_keys(kid)
-        token = self._make_token(private_jwk, kid, issuer, client_id)
-
-        service = DecodeLogoutToken()
-        claims = service.call(
-            metadata={"issuer": issuer},
-            logout_token=token,
-            client_id=client_id,
-            key_loader=self._key_loader(public_jwk),
+        token = self._make_token(private_jwk, kid, "test-issuer")
+
+        claims = decode_logout_token(
+            "test-issuer",
+            self._key_loader(public_jwk),
+            token,
         )
 
-        assert claims["iss"] == issuer
-        assert claims["aud"] == client_id
+        assert claims["iss"] == "test-issuer"
+        assert claims["aud"] == settings.CIS2_CLIENT_ID
         assert claims["sub"] == "user-123"
         assert "http://schemas.openid.net/event/backchannel-logout" in claims["events"]
 
@@ -108,89 +104,70 @@ def test_invalid_claims_raise_error(
         self, overrides, expected_error_type, expected_error_text
     ):
         kid = "k1"
-        issuer = "test-issuer"
-        client_id = "client-1"
         private_jwk, public_jwk = self._make_keys(kid)
-        token = self._make_token(
-            private_jwk, kid, issuer, client_id, overrides=overrides
-        )
+        token = self._make_token(private_jwk, kid, "test-issuer", overrides=overrides)
 
-        service = DecodeLogoutToken()
         with pytest.raises(InvalidLogoutToken) as excinfo:
-            service.call(
-                metadata={"issuer": issuer},
-                logout_token=token,
-                client_id=client_id,
-                key_loader=self._key_loader(public_jwk),
+            decode_logout_token(
+                "test-issuer",
+                self._key_loader(public_jwk),
+                token,
             )
 
         assert isinstance(excinfo.value.__cause__, expected_error_type)
         assert expected_error_text in str(excinfo.value.__cause__)
 
     def test_invalid_signature_raises_error(self):
         kid = "k1"
-        issuer = "test-issuer"
-        client_id = "client-1"
         # Create two different key pairs
         private_jwk_1, public_jwk_1 = self._make_keys(kid)
         private_jwk_2, _public_jwk_2 = self._make_keys(kid)
         # Sign with private_jwk_2 but verify with public_jwk_1 -> invalid signature
-        token = self._make_token(private_jwk_2, kid, issuer, client_id)
+        token = self._make_token(private_jwk_2, kid, "test-issuer")
 
-        service = DecodeLogoutToken()
         with pytest.raises(InvalidLogoutToken) as excinfo:
-            service.call(
-                metadata={"issuer": issuer},
-                logout_token=token,
-                client_id=client_id,
-                key_loader=self._key_loader(public_jwk_1),
+            decode_logout_token(
+                "test-issuer",
+                self._key_loader(public_jwk_1),
+                token,
             )
 
         assert isinstance(excinfo.value.__cause__, JoseError)
         assert "signature" in str(excinfo.value.__cause__)
 
     def test_expired_token_raises_error(self):
         kid = "k1"
-        issuer = "test-issuer"
-        client_id = "client-1"
         private_jwk, public_jwk = self._make_keys(kid)
         now = int(time.time())
         token = self._make_token(
             private_jwk,
             kid,
-            issuer,
-            client_id,
+            "test-issuer",
             overrides={"exp": now - 120},  # already expired beyond leeway
         )
 
-        service = DecodeLogoutToken()
         with pytest.raises(InvalidLogoutToken) as excinfo:
-            service.call(
-                metadata={"issuer": issuer},
-                logout_token=token,
-                client_id=client_id,
-                key_loader=self._key_loader(public_jwk),
+            decode_logout_token(
+                "test-issuer",
+                self._key_loader(public_jwk),
+                token,
             )
         assert isinstance(excinfo.value.__cause__, ExpiredTokenError)
         assert "expired" in str(excinfo.value.__cause__)
 
     def test_missing_iat_raises_error(self):
         kid = "k1"
-        issuer = "test-issuer"
-        client_id = "client-1"
         private_jwk, public_jwk = self._make_keys(kid)
         # Use overrides to remove the iat claim
         token = self._make_token(
-            private_jwk, kid, issuer, client_id, overrides={"iat": None}
+            private_jwk, kid, "test-issuer", overrides={"iat": None}
         )
 
-        service = DecodeLogoutToken()
         with pytest.raises(InvalidLogoutToken) as excinfo:
-            service.call(
-                metadata={"issuer": issuer},
-                logout_token=token,
-                client_id=client_id,
-                key_loader=self._key_loader(public_jwk),
+            decode_logout_token(
+                "test-issuer",
+                self._key_loader(public_jwk),
+                token,
             )
 
         assert isinstance(excinfo.value.__cause__, MissingClaimError)

manage_breast_screening/auth/views.py

@@ -11,7 +11,7 @@
 from django.views.decorators.http import require_http_methods
 
 from .oauth import get_cis2_client, jwk_from_public_key
-from .services import DecodeLogoutToken, InvalidLogoutToken
+from .services import InvalidLogoutToken, decode_logout_token
 
 logger = logging.getLogger(__name__)
 
@@ -115,12 +115,7 @@ def cis2_back_channel_logout(request):
     metadata = client.load_server_metadata()
     key_loader = client.create_load_key()
     try:
-        claims = DecodeLogoutToken().call(
-            metadata=metadata,
-            logout_token=logout_token,
-            client_id=client.client_id,
-            key_loader=key_loader,
-        )
+        claims = decode_logout_token(metadata["issuer"], key_loader, logout_token)
     except InvalidLogoutToken:
         return HttpResponseBadRequest("Invalid logout token")