Merge branch 'master' into honor-database-assigment-from-router

n2ygk · web-flow · commit f78ba9b0e1b6 · 2024-08-30T15:23:39.000-04:00
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.6.0
+    rev: v0.6.2
     hooks:
       - id: ruff
         args: [ --fix ]
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -25,6 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * #1446 use generic models pk instead of id.
 * Transactions wrapping writes of the Tokens now rely on Django's database routers to determine the correct
   database to use instead of assuming that 'default' is the correct one.
+* Bump oauthlib version to 3.2.0 and above
 
 ### Deprecated
 ### Removed
@@ -33,6 +34,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 * #1443 Query strings with invalid hex values now raise a SuspiciousOperation exception (in DRF extension) instead of raising a 500 ValueError: Invalid hex encoding in query string.
+* #1468 `ui_locales` request parameter triggers `AttributeError` under certain circumstances
 ### Security
 
 ## [2.4.0] - 2024-05-13
diff --git a/README.rst b/README.rst
@@ -45,7 +45,7 @@ Requirements
 
 * Python 3.8+
 * Django 4.2, 5.0 or 5.1
-* oauthlib 3.1+
+* oauthlib 3.2+
 
 Installation
 ------------
diff --git a/docs/index.rst b/docs/index.rst
@@ -23,7 +23,7 @@ Requirements
 
 * Python 3.8+
 * Django 4.2, 5.0 or 5.1
-* oauthlib 3.1+
+* oauthlib 3.2+
 
 Index
 =====
diff --git a/docs/requirements.txt b/docs/requirements.txt
@@ -1,5 +1,5 @@
 Django
-oauthlib>=3.1.0
+oauthlib>=3.2.0
 m2r>=0.2.1
 mistune<2
 sphinx==7.2.6
diff --git a/oauth2_provider/views/base.py b/oauth2_provider/views/base.py
@@ -186,6 +186,10 @@ def get(self, request, *args, **kwargs):
         # a successful response depending on "approval_prompt" url parameter
         require_approval = request.GET.get("approval_prompt", oauth2_settings.REQUEST_APPROVAL_PROMPT)
 
+        if "ui_locales" in credentials and isinstance(credentials["ui_locales"], list):
+            # Make sure ui_locales a space separated string for oauthlib to handle it correctly.
+            credentials["ui_locales"] = " ".join(credentials["ui_locales"])
+
         try:
             # If skip_authorization field is True, skip the authorization screen even
             # if this is the first use of the application and there was no previous authorization.
diff --git a/pyproject.toml b/pyproject.toml
@@ -36,7 +36,7 @@ classifiers = [
 dependencies = [
 	"django >= 4.2",
 	"requests >= 2.13.0",
-	"oauthlib >= 3.1.0",
+	"oauthlib >= 3.2.0",
 	"jwcrypto >= 0.8.0",
 ]
 
@@ -54,6 +54,26 @@ check-hidden = true
 ignore-regex = '.*pragma: codespell-ignore.*'
 ignore-words-list = 'assertIn'
 
+[tool.coverage.run]
+source = ["oauth2_provider"]
+omit = ["*/migrations/*"]
+
+[tool.coverage.report]
+show_missing = true
+
+[tool.pytest.ini_options]
+django_find_project = false
+addopts = [
+    "--cov=oauth2_provider",
+    "--cov-report=",
+    "--cov-append",
+    "-s"
+]
+markers = [
+    "oauth2_settings: Custom OAuth2 settings to use - use with oauth2_settings fixture",
+    "nologinrequiredmiddleware",
+]
+
 [tool.ruff]
 line-length = 110
 exclude = [".tox", "build/", "dist/", "docs/", "oauth2_provider/migrations/", "tests/migrations/", "manage.py"]
diff --git a/tests/app/rp/package-lock.json b/tests/app/rp/package-lock.json
diff --git a/tests/app/rp/package.json b/tests/app/rp/package.json
@@ -17,7 +17,7 @@
 		"@sveltejs/kit": "^2.5.10",
 		"prettier": "^3.3.2",
 		"prettier-plugin-svelte": "^3.2.4",
-		"svelte": "^4.0.0",
+		"svelte": "^4.2.19",
 		"svelte-check": "^3.8.0",
 		"tslib": "^2.4.1",
 		"typescript": "^5.0.0",
diff --git a/tests/test_ui_locales.py b/tests/test_ui_locales.py
@@ -0,0 +1,57 @@
+from django.contrib.auth import get_user_model
+from django.test import TestCase, override_settings
+from django.urls import reverse
+
+from oauth2_provider.models import get_application_model
+
+
+UserModel = get_user_model()
+Application = get_application_model()
+
+
+@override_settings(
+    OAUTH2_PROVIDER={
+        "OIDC_ENABLED": True,
+        "PKCE_REQUIRED": False,
+        "SCOPES": {
+            "openid": "OpenID connect",
+        },
+    }
+)
+class TestUILocalesParam(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        cls.application = Application.objects.create(
+            name="Test Application",
+            client_id="test",
+            redirect_uris="https://www.example.com/",
+            client_type=Application.CLIENT_PUBLIC,
+            authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
+        )
+        cls.trusted_application = Application.objects.create(
+            name="Trusted Application",
+            client_id="trusted",
+            redirect_uris="https://www.example.com/",
+            client_type=Application.CLIENT_PUBLIC,
+            authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
+            skip_authorization=True,
+        )
+        cls.user = UserModel.objects.create_user("test_user")
+        cls.url = reverse("oauth2_provider:authorize")
+
+    def setUp(self):
+        self.client.force_login(self.user)
+
+    def test_application_ui_locales_param(self):
+        response = self.client.get(
+            f"{self.url}?response_type=code&client_id=test&scope=openid&ui_locales=de",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertTemplateUsed(response, "oauth2_provider/authorize.html")
+
+    def test_trusted_application_ui_locales_param(self):
+        response = self.client.get(
+            f"{self.url}?response_type=code&client_id=trusted&scope=openid&ui_locales=de",
+        )
+        self.assertEqual(response.status_code, 302)
+        self.assertRegex(response.url, r"https://www\.example\.com/\?code=[a-zA-Z0-9]+")
diff --git a/tox.ini b/tox.ini
@@ -26,17 +26,6 @@ DJANGO =
     5.1: dj51
     main: djmain
 
-[pytest]
-django_find_project = false
-addopts =
-    --cov=oauth2_provider
-    --cov-report=
-    --cov-append
-    -s
-markers =
-    oauth2_settings: Custom OAuth2 settings to use - use with oauth2_settings fixture
-    nologinrequiredmiddleware
-
 [testenv]
 commands =
     pytest {posargs}
@@ -52,7 +41,7 @@ deps =
     dj51: Django>=5.1,<5.2
     djmain: https://github.com/django/django/archive/main.tar.gz
     djangorestframework
-    oauthlib>=3.1.0
+    oauthlib>=3.2.0
     jwcrypto
     coverage
     pytest
@@ -85,7 +74,7 @@ commands =
 deps =
     Jinja2<3.1
     sphinx<3
-    oauthlib>=3.1.0
+    oauthlib>=3.2.0
     m2r>=0.2.1
     mistune<2
     sphinx-rtd-theme
@@ -131,10 +120,3 @@ commands =
     rm -rf dist
     python -m build
     twine check dist/*
-
-[coverage:run]
-source = oauth2_provider
-omit = */migrations/*
-
-[coverage:report]
-show_missing = True
