Skip to content

Commit f93ef12

Browse files
guyp-descoperuvenzxomercnet
authored
Add audience claim verification to all verify methods (#422)
* add audience claim verification to all verify methods * fix lint * fix union --------- Co-authored-by: Reuven Zabirov <[email protected]> Co-authored-by: Omer C <[email protected]> Co-authored-by: Reuven Zabirov <[email protected]>
1 parent b249ba1 commit f93ef12

File tree

7 files changed

+65
-22
lines changed

7 files changed

+65
-22
lines changed

‎descope/auth.py‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@
55
import os
66
import platform
77
import re
8-
from collections.abc import Iterable
98
from http import HTTPStatus
109
from threading import Lock
10+
from typing import Iterable
1111

1212
import jwt
1313

@@ -188,7 +188,9 @@ def do_delete(
188188
self._raise_from_response(response)
189189
return response
190190

191-
def exchange_token(self, uri, code: str) -> dict:
191+
def exchange_token(
192+
self, uri, code: str, audience: str | None | Iterable[str] = None
193+
) -> dict:
192194
if not code:
193195
raise AuthException(
194196
400,
@@ -200,7 +202,7 @@ def exchange_token(self, uri, code: str) -> dict:
200202
response = self.do_post(uri=uri, body=body, params=None)
201203
resp = response.json()
202204
jwt_response = self.generate_jwt_response(
203-
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME), None
205+
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME), audience
204206
)
205207
return jwt_response
206208

@@ -682,7 +684,12 @@ def validate_and_refresh_session(
682684
)
683685
return self.refresh_session(refresh_token, audience)
684686

685-
def select_tenant(self, tenant_id: str, refresh_token: str) -> dict:
687+
def select_tenant(
688+
self,
689+
tenant_id: str,
690+
refresh_token: str,
691+
audience: str | None | Iterable[str] = None,
692+
) -> dict:
686693
if not refresh_token:
687694
raise AuthException(
688695
400,
@@ -697,7 +704,7 @@ def select_tenant(self, tenant_id: str, refresh_token: str) -> dict:
697704

698705
resp = response.json()
699706
jwt_response = self.generate_jwt_response(
700-
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), None
707+
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), audience
701708
)
702709
return jwt_response
703710

‎descope/authmethod/magiclink.py‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
from __future__ import annotations
22

3+
from typing import Iterable
4+
35
from descope._auth_base import AuthBase
46
from descope.auth import Auth
57
from descope.common import (
@@ -85,13 +87,13 @@ def sign_up_or_in(
8587
response = self._auth.do_post(uri, body, None)
8688
return Auth.extract_masked_address(response.json(), method)
8789

88-
def verify(self, token: str) -> dict:
90+
def verify(self, token: str, audience: str | None | Iterable[str] = None) -> dict:
8991
uri = EndpointsV1.verify_magiclink_auth_path
9092
body = MagicLink._compose_verify_body(token)
9193
response = self._auth.do_post(uri, body, None)
9294
resp = response.json()
9395
jwt_response = self._auth.generate_jwt_response(
94-
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), None
96+
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), audience
9597
)
9698
return jwt_response
9799

‎descope/authmethod/otp.py‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
from __future__ import annotations
22

3+
from typing import Iterable
4+
35
from descope._auth_base import AuthBase
46
from descope.auth import Auth
57
from descope.common import (
@@ -124,7 +126,13 @@ def sign_up_or_in(
124126
response = self._auth.do_post(uri, body)
125127
return Auth.extract_masked_address(response.json(), method)
126128

127-
def verify_code(self, method: DeliveryMethod, login_id: str, code: str) -> dict:
129+
def verify_code(
130+
self,
131+
method: DeliveryMethod,
132+
login_id: str,
133+
code: str,
134+
audience: str | None | Iterable[str] = None,
135+
) -> dict:
128136
"""
129137
Verify the validity of an OTP code entered by an end user during sign_in or sign_up.
130138
(This function is not needed if you are using the sign_up_or_in function.
@@ -153,7 +161,7 @@ def verify_code(self, method: DeliveryMethod, login_id: str, code: str) -> dict:
153161

154162
resp = response.json()
155163
jwt_response = self._auth.generate_jwt_response(
156-
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), None
164+
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), audience
157165
)
158166
return jwt_response
159167

‎descope/authmethod/password.py‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,20 @@
11
from __future__ import annotations
22

3+
from typing import Iterable
4+
35
from descope._auth_base import AuthBase
46
from descope.common import REFRESH_SESSION_COOKIE_NAME, EndpointsV1
57
from descope.exceptions import ERROR_TYPE_INVALID_ARGUMENT, AuthException
68

79

810
class Password(AuthBase):
9-
def sign_up(self, login_id: str, password: str, user: dict | None = None) -> dict:
11+
def sign_up(
12+
self,
13+
login_id: str,
14+
password: str,
15+
user: dict | None = None,
16+
audience: str | None | Iterable[str] = None,
17+
) -> dict:
1018
"""
1119
Sign up (create) a new user using a login ID and password.
1220
(optional) Include additional user metadata that you wish to save.
@@ -42,14 +50,15 @@ def sign_up(self, login_id: str, password: str, user: dict | None = None) -> dic
4250

4351
resp = response.json()
4452
jwt_response = self._auth.generate_jwt_response(
45-
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), None
53+
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), audience
4654
)
4755
return jwt_response
4856

4957
def sign_in(
5058
self,
5159
login_id: str,
5260
password: str,
61+
audience: str | None | Iterable[str] = None,
5362
) -> dict:
5463
"""
5564
Sign in by verifying the validity of a password entered by an end user.
@@ -82,7 +91,7 @@ def sign_in(
8291

8392
resp = response.json()
8493
jwt_response = self._auth.generate_jwt_response(
85-
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), None
94+
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), audience
8695
)
8796
return jwt_response
8897

@@ -166,7 +175,13 @@ def update(self, login_id: str, new_password: str, refresh_token: str) -> None:
166175
uri, {"loginId": login_id, "newPassword": new_password}, None, refresh_token
167176
)
168177

169-
def replace(self, login_id: str, old_password: str, new_password: str) -> dict:
178+
def replace(
179+
self,
180+
login_id: str,
181+
old_password: str,
182+
new_password: str,
183+
audience: str | None | Iterable[str] = None,
184+
) -> dict:
170185
"""
171186
Replace a valid active password with a new one. The old_password is used to
172187
authenticate the user. If the user cannot be authenticated, this operation
@@ -213,7 +228,7 @@ def replace(self, login_id: str, old_password: str, new_password: str) -> dict:
213228

214229
resp = response.json()
215230
jwt_response = self._auth.generate_jwt_response(
216-
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), None
231+
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), audience
217232
)
218233
return jwt_response
219234

‎descope/authmethod/totp.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
from typing import Optional
1+
from typing import Iterable, Optional, Union
22

33
from descope._auth_base import AuthBase
44
from descope.common import (
@@ -49,6 +49,7 @@ def sign_in_code(
4949
code: str,
5050
login_options: Optional[LoginOptions] = None,
5151
refresh_token: Optional[str] = None,
52+
audience: Union[str, None, Iterable[str]] = None,
5253
) -> dict:
5354
"""
5455
Sign in by verifying the validity of a TOTP code entered by an end user.
@@ -86,7 +87,7 @@ def sign_in_code(
8687

8788
resp = response.json()
8889
jwt_response = self._auth.generate_jwt_response(
89-
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), None
90+
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), audience
9091
)
9192
return jwt_response
9293

‎descope/authmethod/webauthn.py‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
from typing import Optional
1+
from typing import Iterable, Optional, Union
22

33
from requests import Response
44

@@ -41,7 +41,12 @@ def sign_up_start(
4141

4242
return response.json()
4343

44-
def sign_up_finish(self, transaction_id: str, response: Response) -> dict:
44+
def sign_up_finish(
45+
self,
46+
transaction_id: str,
47+
response: Response,
48+
audience: Union[str, None, Iterable[str]] = None,
49+
) -> dict:
4550
"""
4651
Docs
4752
"""
@@ -61,7 +66,7 @@ def sign_up_finish(self, transaction_id: str, response: Response) -> dict:
6166

6267
resp = response.json()
6368
jwt_response = self._auth.generate_jwt_response(
64-
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), None
69+
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), audience
6570
)
6671
return jwt_response
6772

@@ -93,7 +98,12 @@ def sign_in_start(
9398

9499
return response.json()
95100

96-
def sign_in_finish(self, transaction_id: str, response: Response) -> dict:
101+
def sign_in_finish(
102+
self,
103+
transaction_id: str,
104+
response: Response,
105+
audience: Union[str, None, Iterable[str]] = None,
106+
) -> dict:
97107
"""
98108
Docs
99109
"""
@@ -113,7 +123,7 @@ def sign_in_finish(self, transaction_id: str, response: Response) -> dict:
113123

114124
resp = response.json()
115125
jwt_response = self._auth.generate_jwt_response(
116-
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), None
126+
resp, response.cookies.get(REFRESH_SESSION_COOKIE_NAME, None), audience
117127
)
118128
return jwt_response
119129

‎descope/descope_client.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
from __future__ import annotations
22

3-
from collections.abc import Iterable
3+
from typing import Iterable
44

55
import requests
66

0 commit comments

Comments
 (0)