@@ -70,20 +70,18 @@ def _verify_jwt(token: str) -> dict[str, Any] | None:
7070
7171# ============= OAuth endpoints =============
7272async def openid_config (_ : Request ) -> JSONResponse :
73- return JSONResponse (
74- {
75- "issuer" : str (settings .oauth_issuer ),
76- "authorization_endpoint" : f"{ str (settings .oauth_issuer )} authorize" ,
77- "token_endpoint" : f"{ str (settings .oauth_issuer )} oauth2/token" ,
78- "jwks_uri" : f"{ str (settings .oauth_issuer )} .well-known/jwks.json" ,
79- "registration_endpoint" : f"{ str (settings .oauth_issuer )} oauth2/register" ,
80- "scopes_supported" : ["openid" , "profile" , "offline_access" , "*" ],
81- "response_types_supported" : ["code" ],
82- "grant_types_supported" : ["authorization_code" , "refresh_token" ],
83- "code_challenge_methods_supported" : ["S256" ],
84- "token_endpoint_auth_methods_supported" : ["none" , "client_secret_post" ],
85- }
86- )
73+ return JSONResponse ({
74+ "issuer" : str (settings .oauth_issuer ),
75+ "authorization_endpoint" : f"{ str (settings .oauth_issuer )} authorize" ,
76+ "token_endpoint" : f"{ str (settings .oauth_issuer )} oauth2/token" ,
77+ "jwks_uri" : f"{ str (settings .oauth_issuer )} .well-known/jwks.json" ,
78+ "registration_endpoint" : f"{ str (settings .oauth_issuer )} oauth2/register" ,
79+ "scopes_supported" : ["openid" , "profile" , "offline_access" , "*" ],
80+ "response_types_supported" : ["code" ],
81+ "grant_types_supported" : ["authorization_code" , "refresh_token" ],
82+ "code_challenge_methods_supported" : ["S256" ],
83+ "token_endpoint_auth_methods_supported" : ["none" , "client_secret_post" ],
84+ })
8785
8886
8987async def oauth_as_meta (_ : Request ) -> JSONResponse :
@@ -134,15 +132,13 @@ async def token(req: Request) -> JSONResponse:
134132 return JSONResponse ({"error" : "external_token_error" }, status_code = 500 )
135133
136134 # Return tokens from SignNow API
137- return JSONResponse (
138- {
139- "token_type" : signnow_response .get ("token_type" , "Bearer" ),
140- "access_token" : signnow_response .get ("access_token" ),
141- "expires_in" : signnow_response .get ("expires_in" , settings .access_ttl ),
142- "refresh_token" : signnow_response .get ("refresh_token" ),
143- "scope" : "*" ,
144- }
145- )
135+ return JSONResponse ({
136+ "token_type" : signnow_response .get ("token_type" , "Bearer" ),
137+ "access_token" : signnow_response .get ("access_token" ),
138+ "expires_in" : signnow_response .get ("expires_in" , settings .access_ttl ),
139+ "refresh_token" : signnow_response .get ("refresh_token" ),
140+ "scope" : "*" ,
141+ })
146142
147143 elif grant_type == "refresh_token" :
148144 refresh = form .get ("refresh_token" )
@@ -159,15 +155,13 @@ async def token(req: Request) -> JSONResponse:
159155 return JSONResponse ({"error" : "invalid_request" , "error_description" : "refresh_token must be a string" }, status_code = 400 )
160156
161157 if signnow_response :
162- return JSONResponse (
163- {
164- "token_type" : signnow_response .get ("token_type" , "Bearer" ),
165- "access_token" : signnow_response .get ("access_token" ),
166- "expires_in" : signnow_response .get ("expires_in" , settings .access_ttl ),
167- "refresh_token" : signnow_response .get ("refresh_token" ),
168- "scope" : signnow_response .get ("scope" , "*" ),
169- }
170- )
158+ return JSONResponse ({
159+ "token_type" : signnow_response .get ("token_type" , "Bearer" ),
160+ "access_token" : signnow_response .get ("access_token" ),
161+ "expires_in" : signnow_response .get ("expires_in" , settings .access_ttl ),
162+ "refresh_token" : signnow_response .get ("refresh_token" ),
163+ "scope" : signnow_response .get ("scope" , "*" ),
164+ })
171165 else :
172166 return JSONResponse ({"error" : "invalid_grant" }, status_code = 400 )
173167
@@ -185,17 +179,15 @@ async def introspect(req: Request) -> JSONResponse:
185179 active = claims is not None
186180 resp : dict [str , Any ] = {"active" : bool (active )}
187181 if active and claims :
188- resp .update (
189- {
190- "iss" : claims ["iss" ],
191- "sub" : claims ["sub" ],
192- "aud" : claims ["aud" ],
193- "client_id" : claims .get ("client_id" ),
194- "scope" : claims .get ("scope" , "" ),
195- "exp" : claims ["exp" ],
196- "iat" : claims ["iat" ],
197- }
198- )
182+ resp .update ({
183+ "iss" : claims ["iss" ],
184+ "sub" : claims ["sub" ],
185+ "aud" : claims ["aud" ],
186+ "client_id" : claims .get ("client_id" ),
187+ "scope" : claims .get ("scope" , "" ),
188+ "exp" : claims ["exp" ],
189+ "iat" : claims ["iat" ],
190+ })
199191 return JSONResponse (resp )
200192
201193
@@ -220,14 +212,12 @@ async def revoke(req: Request) -> PlainTextResponse | JSONResponse:
220212
221213# ============= PRM (Protected Resource Metadata) =============
222214def prm_for_resource (resource_url : str ) -> JSONResponse :
223- return JSONResponse (
224- {
225- "resource" : resource_url ,
226- "authorization_servers" : [str (settings .oauth_issuer )],
227- "bearer_methods_supported" : ["header" ],
228- "scopes_supported" : ["openid" , "profile" , "offline_access" , "*" ],
229- }
230- )
215+ return JSONResponse ({
216+ "resource" : resource_url ,
217+ "authorization_servers" : [str (settings .oauth_issuer )],
218+ "bearer_methods_supported" : ["header" ],
219+ "scopes_supported" : ["openid" , "profile" , "offline_access" , "*" ],
220+ })
231221
232222
233223async def prm_root (_ : Request ) -> JSONResponse :
@@ -317,16 +307,14 @@ async def __call__(self, scope: dict[str, Any], receive: Any, send: Any) -> None
317307 if not self .token_provider .has_config_credentials ():
318308 token = self .token_provider .get_access_token (dict (request .headers ))
319309 if not token :
320- await send (
321- {
322- "type" : "http.response.start" ,
323- "status" : 401 ,
324- "headers" : [
325- (b"www-authenticate" , f'Bearer resource_metadata="{ str (settings .oauth_issuer )} /.well-known/oauth-protected-resource"' .encode ()),
326- (b"content-type" , b"text/plain; charset=utf-8" ),
327- ],
328- }
329- )
310+ await send ({
311+ "type" : "http.response.start" ,
312+ "status" : 401 ,
313+ "headers" : [
314+ (b"www-authenticate" , f'Bearer resource_metadata="{ str (settings .oauth_issuer )} /.well-known/oauth-protected-resource"' .encode ()),
315+ (b"content-type" , b"text/plain; charset=utf-8" ),
316+ ],
317+ })
330318 await send ({"type" : "http.response.body" , "body" : b"Unauthorized" })
331319 return
332320
0 commit comments