diff --git a/404.html b/404.html index 59ed438..923c931 100644 --- a/404.html +++ b/404.html @@ -12,7 +12,7 @@ - + @@ -20,7 +20,7 @@ - + @@ -44,7 +44,7 @@ - + @@ -82,12 +82,12 @@
@@ -113,7 +113,7 @@
@@ -17682,220 +19350,219 @@

- RequestUriParameterAuthorizationRequest + RequestUriParameterAuthorizationRequest

-
+
- -

Represent an Authorization Request that includes a request_uri parameter.

+

Represent an Authorization Request that includes a request_uri parameter.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +

Parameters:

+
NameTypeDescriptionDefault
authorization_endpoint - str - -
-

the Authorization Endpoint uri

-
- 		- required -
client_id - str - -
-

the client_id

-
- 		- required -
request_uri - str - -
-

the request_uri

-
- 		- required -
expires_at - datetime | None - -
-

the expiration date for this request

-
- 		- None -
kwargs - Any - -
-

extra parameters to include in the request

-
- 		- {} -
+ + + + + + - -
NameTypeDescriptionDefault
+ + + + authorization_endpoint + + str + + +
+

the Authorization Endpoint uri

+
+ + + required + + + + client_id + + str + + +
+

the client_id

+
+ + + required + + + + request_uri + + str + + +
+

the request_uri

+
+ + + required + + + + expires_at + + datetime | None + + +
+

the expiration date for this request

+
+ + + None + + + + kwargs + + Any + + +
+

extra parameters to include in the request

+
+ + + {} + + + + + +
+ Source code in requests_oauth2client/authorization_request.py + 
816
+817
+818
+819
+820
+821
+822
+823
+824
+825
+826
+827
+828
+829
+830
+831
+832
+833
+834
+835
+836
+837
+838
+839
+840
+841
+842
+843
+844
+845
+846
+847
+848
+849
+850
+851
+852
+853
+854
+855
+856
+857
+858
+859
+860
+861
+862
+863
+864
+865
+866
+867
+868
+869
+870
+871
@frozen(init=False)
+class RequestUriParameterAuthorizationRequest:
+    """Represent an Authorization Request that includes a `request_uri` parameter.
+
+    Args:
+        authorization_endpoint: the Authorization Endpoint uri
+        client_id: the client_id
+        request_uri: the request_uri
+        expires_at: the expiration date for this request
+        kwargs: extra parameters to include in the request
+
+    """
+
+    authorization_endpoint: str
+    client_id: str
+    request_uri: str
+    expires_at: datetime | None = None
+    kwargs: dict[str, Any] = Factory(dict)
+
+    @accepts_expires_in
+    def __init__(
+        self,
+        authorization_endpoint: str,
+        client_id: str,
+        request_uri: str,
+        expires_at: datetime | None = None,
+        **kwargs: Any,
+    ) -> None:
+        self.__attrs_init__(
+            authorization_endpoint=authorization_endpoint,
+            client_id=client_id,
+            request_uri=request_uri,
+            expires_at=expires_at,
+            kwargs=kwargs,
+        )
+
+    @property
+    def furl(self) -> furl:
+        """Return the Authorization Request URI, as a `furl` instance."""
+        return furl(
+            self.authorization_endpoint,
+            args={"client_id": self.client_id, "request_uri": self.request_uri, **self.kwargs},
+        )
+
+    @property
+    def uri(self) -> str:
+        """Return the Authorization Request URI, as a `str`."""
+        return str(self.furl.url)
+
+    def __getattr__(self, item: str) -> Any:
+        """Allow attribute access to extra parameters."""
+        return self.kwargs[item]
+
+    def __repr__(self) -> str:
+        """Return the Authorization Request URI, as a `str`."""
+        return self.uri
+
+
-
- Source code in requests_oauth2client/authorization_request.py - 
708
-709
-710
-711
-712
-713
-714
-715
-716
-717
-718
-719
-720
-721
-722
-723
-724
-725
-726
-727
-728
-729
-730
-731
-732
-733
-734
-735
-736
-737
-738
-739
-740
-741
-742
-743
-744
-745
-746
-747
-748
-749
-750
-751
-752
-753
-754
-755
-756
-757
-758
-759
-760
-761
-762
-763
@frozen(init=False)
-class RequestUriParameterAuthorizationRequest:
-    """Represent an Authorization Request that includes a `request_uri` parameter.
-
-    Args:
-        authorization_endpoint: the Authorization Endpoint uri
-        client_id: the client_id
-        request_uri: the request_uri
-        expires_at: the expiration date for this request
-        kwargs: extra parameters to include in the request
-
-    """
-
-    authorization_endpoint: str
-    client_id: str
-    request_uri: str
-    expires_at: datetime | None = None
-    kwargs: dict[str, Any] = Factory(dict)
-
-    @accepts_expires_in
-    def __init__(
-        self,
-        authorization_endpoint: str,
-        client_id: str,
-        request_uri: str,
-        expires_at: datetime | None = None,
-        **kwargs: Any,
-    ):
-        self.__attrs_init__(
-            authorization_endpoint=authorization_endpoint,
-            client_id=client_id,
-            request_uri=request_uri,
-            expires_at=expires_at,
-            kwargs=kwargs,
-        )
-
-    @property
-    def furl(self) -> furl:
-        """Return the Authorization Request URI, as a `furl` instance."""
-        return furl(
-            self.authorization_endpoint,
-            args={"client_id": self.client_id, "request_uri": self.request_uri, **self.kwargs},
-        )
-
-    @property
-    def uri(self) -> str:
-        """Return the Authorization Request URI, as a `str`."""
-        return str(self.furl.url)
-
-    def __getattr__(self, item: str) -> Any:
-        """Allow attribute access to extra parameters."""
-        return self.kwargs[item]
-
-    def __repr__(self) -> str:
-        """Return the Authorization Request URI, as a `str`."""
-        return self.uri
-
-
-
@@ -17910,8 +19577,8 @@

- furl: furl - + furl: furl + property @@ -17919,10 +19586,10 @@

-
- -

Return the Authorization Request URI, as a furl instance.

-
+
+ +

Return the Authorization Request URI, as a furl instance.

+
@@ -17931,8 +19598,8 @@

- uri: str - + uri: str + property @@ -17940,21 +19607,20 @@

-
- -

Return the Authorization Request URI, as a str.

-
+
-
+

Return the Authorization Request URI, as a str.

+
+
-
+ @@ -17962,242 +19628,56 @@

- BackChannelAuthenticationPoolingJob +

+ ResponseTypes -

+ -
-

- Bases: TokenEndpointPoolingJob

+
+

+ Bases: str, Enum

- -

A pooling job for the BackChannel Authentication flow.

-

This will poll the Token Endpoint until the user finishes with its authentication.

+

All standardised response_type values.

+

Note that you should always use code. All other values are deprecated.

+
+ Source code in requests_oauth2client/authorization_request.py + 
32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
class ResponseTypes(str, Enum):
+    """All standardised `response_type` values.
+
+    Note that you should always use `code`. All other values are deprecated.
+
+    """
+
+    CODE = "code"
+    NONE = "none"
+    TOKEN = "token"
+    IDTOKEN = "id_token"
+    CODE_IDTOKEN = "code id_token"
+    CODE_TOKEN = "code token"
+    CODE_IDTOKEN_TOKEN = "code id_token token"
+    IDTOKEN_TOKEN = "id_token token"
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client - OAuth2Client - -
-

an OAuth2Client that will be used to pool the token endpoint.

-
- 		- required -
auth_req_id - str | BackChannelAuthenticationResponse - -
-

an auth_req_id as str or a BackChannelAuthenticationResponse.

-
- 		- required -
interval - int | None - -
-

The pooling interval to use. This overrides the one in auth_req_id if it is -a BackChannelAuthenticationResponse.

-
- 		- None -
slow_down_interval - int - -
-

Number of seconds to add to the pooling interval when the AS returns -a slow down request.

-
- 		- 5 -
requests_kwargs - dict[str, Any] | None - -
-

Additional parameters for the underlying calls to requests.request.

-
- 		- None -
**token_kwargs - Any - -
-

Additional parameters for the token request.

-
- 		- {} -
-

auth=("client_id", "client_secret") ) pool_job = BackChannelAuthenticationPoolingJob( -client=client, auth_req_id="my_auth_req_id" )

-
1
token = None while token is None: token = pool_job() ```
-
- -
- Source code in requests_oauth2client/backchannel_authentication.py - 
 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
-141
-142
-143
-144
-145
class BackChannelAuthenticationPoolingJob(TokenEndpointPoolingJob):
-    """A pooling job for the BackChannel Authentication flow.
-
-    This will poll the Token Endpoint until the user finishes with its authentication.
-
-    Args:
-        client: an OAuth2Client that will be used to pool the token endpoint.
-        auth_req_id: an `auth_req_id` as `str` or a `BackChannelAuthenticationResponse`.
-        interval: The pooling interval to use. This overrides the one in `auth_req_id` if it is
-            a `BackChannelAuthenticationResponse`.
-        slow_down_interval: Number of seconds to add to the pooling interval when the AS returns
-            a slow down request.
-        requests_kwargs: Additional parameters for the underlying calls to [requests.request][].
-        **token_kwargs: Additional parameters for the token request.
-
-    Usage: ```python client = OAuth2Client( token_endpoint="https://my.as.local/token",
-    auth=("client_id", "client_secret") ) pool_job = BackChannelAuthenticationPoolingJob(
-    client=client, auth_req_id="my_auth_req_id" )
-
-        token = None while token is None: token = pool_job() ```
-
-    """
-
-    def __init__(
-        self,
-        client: OAuth2Client,
-        auth_req_id: str | BackChannelAuthenticationResponse,
-        *,
-        interval: int | None = None,
-        slow_down_interval: int = 5,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ):
-        if isinstance(auth_req_id, BackChannelAuthenticationResponse) and interval is None:
-            interval = auth_req_id.interval
-
-        super().__init__(
-            client=client,
-            interval=interval,
-            slow_down_interval=slow_down_interval,
-            requests_kwargs=requests_kwargs,
-            **token_kwargs,
-        )
-        self.auth_req_id = auth_req_id
-
-    def token_request(self) -> BearerToken:
-        """Implement the CIBA token request.
-
-        This actually calls [OAuth2Client.ciba(auth_req_id)] on `client`.
-
-        Returns:
-            a [BearerToken][requests_oauth2client.tokens.BearerToken]
-
-        """
-        return self.client.ciba(self.auth_req_id, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
-
-
-
@@ -18210,78 +19690,40 @@

+

+
-

- token_request() +

- +
-
- -

Implement the CIBA token request.

-

This actually calls [OAuth2Client.ciba(auth_req_id)] on client.

+

+ UnsupportedCodeChallengeMethod -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/backchannel_authentication.py - 
136
-137
-138
-139
-140
-141
-142
-143
-144
-145
def token_request(self) -> BearerToken:
-    """Implement the CIBA token request.
-
-    This actually calls [OAuth2Client.ciba(auth_req_id)] on `client`.
-
-    Returns:
-        a [BearerToken][requests_oauth2client.tokens.BearerToken]
-
-    """
-    return self.client.ciba(self.auth_req_id, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
-
-
-

+ -
+
+

+ Bases: ValueError

-
+

Raised when an unsupported code_challenge_method is provided.

- +
+ Source code in requests_oauth2client/authorization_request.py + 
60
+61
class UnsupportedCodeChallengeMethod(ValueError):
+    """Raised when an unsupported code_challenge_method is provided."""
+
+
+ @@ -18289,231 +19731,35 @@

- BackChannelAuthenticationResponse - +

+ UnsupportedResponseTypeParam -

+ -
- -

Represent a BackChannel Authentication Response.

-

This contains all the parameters that are returned by the AS as a result of a BackChannel -Authentication Request, such as auth_req_id (required), and the optional expires_at, -interval, and/or any custom parameters.

+
+

+ Bases: ValueError

+

Raised when an unsupported response_type is passed as parameter.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
auth_req_id - str - -
-

the auth_req_id as returned by the AS.

-
- 		- required -
expires_at - datetime | None - -
-

the date when the auth_req_id expires. -Note that this request also accepts an expires_in parameter, in seconds.

-
- 		- None -
interval - int | None - -
-

the Token Endpoint pooling interval, in seconds, as returned by the AS.

-
- 		- 20 -
**kwargs - Any - -
-

any additional custom parameters as returned by the AS.

-
- 		- {} -
+
+ Source code in requests_oauth2client/authorization_request.py + 
161
+162
+163
+164
+165
class UnsupportedResponseTypeParam(ValueError):
+    """Raised when an unsupported response_type is passed as parameter."""
+
+    def __init__(self, response_type: str) -> None:
+        super().__init__("""The only supported response type is 'code'.""", response_type)
+
+
-
- Source code in requests_oauth2client/backchannel_authentication.py - 
23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
-76
-77
-78
-79
-80
-81
-82
-83
-84
-85
-86
-87
-88
class BackChannelAuthenticationResponse:
-    """Represent a BackChannel Authentication Response.
-
-    This contains all the parameters that are returned by the AS as a result of a BackChannel
-    Authentication Request, such as `auth_req_id` (required), and the optional `expires_at`,
-    `interval`, and/or any custom parameters.
-
-    Args:
-        auth_req_id: the `auth_req_id` as returned by the AS.
-        expires_at: the date when the `auth_req_id` expires.
-            Note that this request also accepts an `expires_in` parameter, in seconds.
-        interval: the Token Endpoint pooling interval, in seconds, as returned by the AS.
-        **kwargs: any additional custom parameters as returned by the AS.
-
-    """
-
-    @accepts_expires_in
-    def __init__(
-        self,
-        auth_req_id: str,
-        expires_at: datetime | None = None,
-        interval: int | None = 20,
-        **kwargs: Any,
-    ):
-        self.auth_req_id = auth_req_id
-        self.expires_at = expires_at
-        self.interval = interval
-        self.other = kwargs
-
-    def is_expired(self, leeway: int = 0) -> bool | None:
-        """Return `True` if the `auth_req_id` within this response is expired.
-
-        Expiration is evaluated at the time of the call. If there is no "expires_at" hint (which is
-        derived from the `expires_in` hint returned by the AS BackChannel Authentication endpoint),
-        this will return `None`.
-
-        Returns:
-            `True` if the auth_req_id is expired, `False` if it is still valid, `None` if there is
-            no `expires_in` hint.
-
-        """
-        if self.expires_at:
-            return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
-        return None
-
-    def __getattr__(self, key: str) -> Any:
-        """Return attributes from this `BackChannelAuthenticationResponse`.
-
-        Allows accessing response parameters with `token_response.expires_in` or
-        `token_response.any_custom_attribute`.
-
-        Args:
-            key: a key
-
-        Returns:
-            the associated value in this token response
-
-        Raises:
-            AttributeError: if the attribute is not present in the response
-
-        """
-        if key == "expires_in":
-            if self.expires_at is None:
-                return None
-            return int(self.expires_at.timestamp() - datetime.now(tz=timezone.utc).timestamp())
-        return self.other.get(key) or super().__getattribute__(key)
-
-
-
@@ -18526,165 +19772,375 @@

+

+
-

- is_expired(leeway=0) +

- +
-
- -

Return True if the auth_req_id within this response is expired.

-

Expiration is evaluated at the time of the call. If there is no "expires_at" hint (which is -derived from the expires_in hint returned by the AS BackChannel Authentication endpoint), -this will return None.

+

+ BackChannelAuthenticationPoolingJob -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- bool | None - -
-

True if the auth_req_id is expired, False if it is still valid, None if there is

-
-
- bool | None - -
-

no expires_in hint.

-
-
- -
- Source code in requests_oauth2client/backchannel_authentication.py - 
52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
def is_expired(self, leeway: int = 0) -> bool | None:
-    """Return `True` if the `auth_req_id` within this response is expired.
-
-    Expiration is evaluated at the time of the call. If there is no "expires_at" hint (which is
-    derived from the `expires_in` hint returned by the AS BackChannel Authentication endpoint),
-    this will return `None`.
-
-    Returns:
-        `True` if the auth_req_id is expired, `False` if it is still valid, `None` if there is
-        no `expires_in` hint.
-
-    """
-    if self.expires_at:
-        return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
-    return None
-
-
-

+ -
+
+

+ Bases: BaseTokenEndpointPoolingJob

-
+

A pooling job for the BackChannel Authentication flow.

+

This will poll the Token Endpoint until the user finishes with its authentication.

- +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client + OAuth2Client + +
+

an OAuth2Client that will be used to pool the token endpoint.

+
+ 		+ required +
auth_req_id + str | BackChannelAuthenticationResponse + +
+

an auth_req_id as str or a BackChannelAuthenticationResponse.

+
+ 		+ required +
interval + int | None + +
+

The pooling interval, in seconds, to use. This overrides +the one in auth_req_id if it is a BackChannelAuthenticationResponse. +Defaults to 5 seconds.

+
+ 		+ None +
slow_down_interval + int + +
+

Number of seconds to add to the pooling interval when the AS returns +a slow down request.

+
+ 		+ 5 +
requests_kwargs + dict[str, Any] | None + +
+

Additional parameters for the underlying calls to requests.request.

+
+ 		+ None +
**token_kwargs + Any + +
+

Additional parameters for the token request.

+
+ 		+ {} +
+ + +
+ Example + 
1
+2
+3
+4
+5
+6
+7
+8
+9
client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+pool_job = BackChannelAuthenticationPoolingJob(
+    client=client,
+    auth_req_id="my_auth_req_id",
+)
+
+token = None
+while token is None:
+    token = pool_job()
+
+
+
+ Source code in requests_oauth2client/backchannel_authentication.py + 
 97
+ 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
+126
+127
+128
+129
+130
+131
+132
+133
+134
+135
+136
+137
+138
+139
+140
+141
+142
+143
+144
+145
+146
+147
+148
+149
+150
+151
+152
+153
+154
+155
+156
+157
+158
+159
+160
+161
+162
+163
@define(init=False)
+class BackChannelAuthenticationPoolingJob(BaseTokenEndpointPoolingJob):
+    """A pooling job for the BackChannel Authentication flow.
+
+    This will poll the Token Endpoint until the user finishes with its authentication.
+
+    Args:
+        client: an OAuth2Client that will be used to pool the token endpoint.
+        auth_req_id: an `auth_req_id` as `str` or a `BackChannelAuthenticationResponse`.
+        interval: The pooling interval, in seconds, to use. This overrides
+            the one in `auth_req_id` if it is a `BackChannelAuthenticationResponse`.
+            Defaults to 5 seconds.
+        slow_down_interval: Number of seconds to add to the pooling interval when the AS returns
+            a slow down request.
+        requests_kwargs: Additional parameters for the underlying calls to [requests.request][].
+        **token_kwargs: Additional parameters for the token request.
+
+    Example:
+        ```python
+        client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+        pool_job = BackChannelAuthenticationPoolingJob(
+            client=client,
+            auth_req_id="my_auth_req_id",
+        )
+
+        token = None
+        while token is None:
+            token = pool_job()
+        ```
+
+    """
+
+    auth_req_id: str
+
+    def __init__(
+        self,
+        client: OAuth2Client,
+        auth_req_id: str | BackChannelAuthenticationResponse,
+        *,
+        interval: int | None = None,
+        slow_down_interval: int = 5,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> None:
+        if isinstance(auth_req_id, BackChannelAuthenticationResponse):
+            interval = interval or auth_req_id.interval
+            auth_req_id = auth_req_id.auth_req_id
+
+        self.__attrs_init__(
+            client=client,
+            auth_req_id=auth_req_id,
+            interval=interval or 5,
+            slow_down_interval=slow_down_interval,
+            requests_kwargs=requests_kwargs or {},
+            token_kwargs=token_kwargs,
+        )
+
+    def token_request(self) -> BearerToken:
+        """Implement the CIBA token request.
+
+        This actually calls [OAuth2Client.ciba(auth_req_id)] on `client`.
+
+        Returns:
+            a [BearerToken][requests_oauth2client.tokens.BearerToken]
+
+        """
+        return self.client.ciba(self.auth_req_id, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
+
+
- -
+
-

- GrantType -

-
-

- Bases: str, Enum

- -

An enum of standardized grant_type values.

-
- Source code in requests_oauth2client/client.py - 
1609
-1610
-1611
-1612
-1613
-1614
-1615
-1616
-1617
-1618
-1619
class GrantType(str, Enum):
-    """An enum of standardized `grant_type` values."""
-
-    CLIENT_CREDENTIALS = "client_credentials"
-    AUTHORIZATION_CODE = "authorization_code"
-    REFRESH_TOKEN = "refresh_token"
-    RESOURCE_OWNER_PASSWORD = "password"
-    TOKEN_EXCHANGE = "urn:ietf:params:oauth:grant-type:token-exchange"
-    JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer"
-    CLIENT_INITIATED_BACKCHANNEL_AUTHENTICATION = "urn:openid:params:grant-type:ciba"
-    DEVICE_CODE = "urn:ietf:params:oauth:grant-type:device_code"
-
-
- +
-
+

+ token_request() +

+
+

Implement the CIBA token request.

+

This actually calls [OAuth2Client.ciba(auth_req_id)] on client.

+

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+
+ Source code in requests_oauth2client/backchannel_authentication.py + 
154
+155
+156
+157
+158
+159
+160
+161
+162
+163
def token_request(self) -> BearerToken:
+    """Implement the CIBA token request.
+
+    This actually calls [OAuth2Client.ciba(auth_req_id)] on `client`.
+
+    Returns:
+        a [BearerToken][requests_oauth2client.tokens.BearerToken]
+
+    """
+    return self.client.ciba(self.auth_req_id, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
+
+
+
+
-
+
@@ -18692,3435 +20148,236 @@

-

- OAuth2Client +

+ BackChannelAuthenticationResponse -

+ -
+
- -

An OAuth 2.x Client, that can send requests to an OAuth 2.x Authorization Server.

-

OAuth2Client is able to obtain tokens from the Token Endpoint using any of the standardised -Grant Types, and to communicate with the various backend endpoints like the Revocation, -Introspection, and UserInfo Endpoint.

-

To init an OAuth2Client, you only need the url to the Token Endpoint and the Credentials -(a client_id and one of a secret or private_key) that will be used to authenticate to that endpoint. -Other endpoint urls, such as the Authorization Endpoint, Revocation Endpoint, etc. can be passed as -parameter as well if you intend to use them.

-

This class is not intended to help with the end-user authentication or any request that goes in -a browser. For authentication requests, see -AuthorizationRequest. You -may use the method authorization_request() to generate AuthorizationRequests with the -preconfigured authorization_endpoint, client_id and `redirect_uri' from this client.

+

Represent a BackChannel Authentication Response.

+

This contains all the parameters that are returned by the AS as a result of a BackChannel +Authentication Request, such as auth_req_id (required), and the optional expires_at, +interval, and/or any custom parameters.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
token_endpoint - str - -
-

the Token Endpoint URI where this client will get access tokens

-
- 		- required -
auth - AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None - -
-

the authentication handler to use for client authentication on the token endpoint. -Can be:

- -
- 		- None -
client_id - str | None - -
-

client ID (use either this or auth)

-
- 		- None -
client_secret - str | None - -
-

client secret (use either this or auth)

-
- 		- None -
private_key - Jwk | dict[str, Any] | None - -
-

private_key to use for client authentication (use either this or auth)

-
- 		- None -
revocation_endpoint - str | None - -
-

the Revocation Endpoint URI to use for revoking tokens

-
- 		- None -
introspection_endpoint - str | None - -
-

the Introspection Endpoint URI to use to get info about tokens

-
- 		- None -
userinfo_endpoint - str | None - -
-

the Userinfo Endpoint URI to use to get information about the user

-
- 		- None -
authorization_endpoint - str | None - -
-

the Authorization Endpoint URI, used for initializing Authorization Requests

-
- 		- None -
redirect_uri - str | None - -
-

the redirect_uri for this client

-
- 		- None -
backchannel_authentication_endpoint - str | None - -
-

the BackChannel Authentication URI

-
- 		- None -
device_authorization_endpoint - str | None - -
-

the Device Authorization Endpoint URI to use to authorize devices

-
- 		- None -
jwks_uri - str | None - -
-

the JWKS URI to use to obtain the AS public keys

-
- 		- None -
code_challenge_method - str - -
-

challenge method to use for PKCE (should always be 'S256')

-
- 		- 'S256' -
session - Session | None - -
-

a requests Session to use when sending HTTP requests. -Useful if some extra parameters such as proxy or client certificate must be used -to connect to the AS.

-
- 		- None -
testing - bool - -
-

if True, don't verify the validity of the endpoint urls that are passed as parameter.

-
- 		- False -
**extra_metadata - Any - -
-

additional metadata for this client, unused by this class, but may be -used by subclasses. Those will be accessible with the extra_metadata attribute.

-
- 		- {} -
- -
- Usage - 
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-11
client = OAuth2Client(
-    token_endpoint="https://my.as.local/token",
-    revocation_endpoint="https://my.as.local/revoke",
-    client_id="client_id",
-    client_secret="client_secret",
-)
-
-# once initialized, a client can send requests to its configured endpoints
-cc_token = client.client_credentials(scope="my_scope")
-ac_token = client.authorization_code(code="my_code")
-client.revoke_access_token(cc_token)
-
-
-
- Source code in requests_oauth2client/client.py - 
  53
-  54
-  55
-  56
-  57
-  58
-  59
-  60
-  61
-  62
-  63
-  64
-  65
-  66
-  67
-  68
-  69
-  70
-  71
-  72
-  73
-  74
-  75
-  76
-  77
-  78
-  79
-  80
-  81
-  82
-  83
-  84
-  85
-  86
-  87
-  88
-  89
-  90
-  91
-  92
-  93
-  94
-  95
-  96
-  97
-  98
-  99
- 100
- 101
- 102
- 103
- 104
- 105
- 106
- 107
- 108
- 109
- 110
- 111
- 112
- 113
- 114
- 115
- 116
- 117
- 118
- 119
- 120
- 121
- 122
- 123
- 124
- 125
- 126
- 127
- 128
- 129
- 130
- 131
- 132
- 133
- 134
- 135
- 136
- 137
- 138
- 139
- 140
- 141
- 142
- 143
- 144
- 145
- 146
- 147
- 148
- 149
- 150
- 151
- 152
- 153
- 154
- 155
- 156
- 157
- 158
- 159
- 160
- 161
- 162
- 163
- 164
- 165
- 166
- 167
- 168
- 169
- 170
- 171
- 172
- 173
- 174
- 175
- 176
- 177
- 178
- 179
- 180
- 181
- 182
- 183
- 184
- 185
- 186
- 187
- 188
- 189
- 190
- 191
- 192
- 193
- 194
- 195
- 196
- 197
- 198
- 199
- 200
- 201
- 202
- 203
- 204
- 205
- 206
- 207
- 208
- 209
- 210
- 211
- 212
- 213
- 214
- 215
- 216
- 217
- 218
- 219
- 220
- 221
- 222
- 223
- 224
- 225
- 226
- 227
- 228
- 229
- 230
- 231
- 232
- 233
- 234
- 235
- 236
- 237
- 238
- 239
- 240
- 241
- 242
- 243
- 244
- 245
- 246
- 247
- 248
- 249
- 250
- 251
- 252
- 253
- 254
- 255
- 256
- 257
- 258
- 259
- 260
- 261
- 262
- 263
- 264
- 265
- 266
- 267
- 268
- 269
- 270
- 271
- 272
- 273
- 274
- 275
- 276
- 277
- 278
- 279
- 280
- 281
- 282
- 283
- 284
- 285
- 286
- 287
- 288
- 289
- 290
- 291
- 292
- 293
- 294
- 295
- 296
- 297
- 298
- 299
- 300
- 301
- 302
- 303
- 304
- 305
- 306
- 307
- 308
- 309
- 310
- 311
- 312
- 313
- 314
- 315
- 316
- 317
- 318
- 319
- 320
- 321
- 322
- 323
- 324
- 325
- 326
- 327
- 328
- 329
- 330
- 331
- 332
- 333
- 334
- 335
- 336
- 337
- 338
- 339
- 340
- 341
- 342
- 343
- 344
- 345
- 346
- 347
- 348
- 349
- 350
- 351
- 352
- 353
- 354
- 355
- 356
- 357
- 358
- 359
- 360
- 361
- 362
- 363
- 364
- 365
- 366
- 367
- 368
- 369
- 370
- 371
- 372
- 373
- 374
- 375
- 376
- 377
- 378
- 379
- 380
- 381
- 382
- 383
- 384
- 385
- 386
- 387
- 388
- 389
- 390
- 391
- 392
- 393
- 394
- 395
- 396
- 397
- 398
- 399
- 400
- 401
- 402
- 403
- 404
- 405
- 406
- 407
- 408
- 409
- 410
- 411
- 412
- 413
- 414
- 415
- 416
- 417
- 418
- 419
- 420
- 421
- 422
- 423
- 424
- 425
- 426
- 427
- 428
- 429
- 430
- 431
- 432
- 433
- 434
- 435
- 436
- 437
- 438
- 439
- 440
- 441
- 442
- 443
- 444
- 445
- 446
- 447
- 448
- 449
- 450
- 451
- 452
- 453
- 454
- 455
- 456
- 457
- 458
- 459
- 460
- 461
- 462
- 463
- 464
- 465
- 466
- 467
- 468
- 469
- 470
- 471
- 472
- 473
- 474
- 475
- 476
- 477
- 478
- 479
- 480
- 481
- 482
- 483
- 484
- 485
- 486
- 487
- 488
- 489
- 490
- 491
- 492
- 493
- 494
- 495
- 496
- 497
- 498
- 499
- 500
- 501
- 502
- 503
- 504
- 505
- 506
- 507
- 508
- 509
- 510
- 511
- 512
- 513
- 514
- 515
- 516
- 517
- 518
- 519
- 520
- 521
- 522
- 523
- 524
- 525
- 526
- 527
- 528
- 529
- 530
- 531
- 532
- 533
- 534
- 535
- 536
- 537
- 538
- 539
- 540
- 541
- 542
- 543
- 544
- 545
- 546
- 547
- 548
- 549
- 550
- 551
- 552
- 553
- 554
- 555
- 556
- 557
- 558
- 559
- 560
- 561
- 562
- 563
- 564
- 565
- 566
- 567
- 568
- 569
- 570
- 571
- 572
- 573
- 574
- 575
- 576
- 577
- 578
- 579
- 580
- 581
- 582
- 583
- 584
- 585
- 586
- 587
- 588
- 589
- 590
- 591
- 592
- 593
- 594
- 595
- 596
- 597
- 598
- 599
- 600
- 601
- 602
- 603
- 604
- 605
- 606
- 607
- 608
- 609
- 610
- 611
- 612
- 613
- 614
- 615
- 616
- 617
- 618
- 619
- 620
- 621
- 622
- 623
- 624
- 625
- 626
- 627
- 628
- 629
- 630
- 631
- 632
- 633
- 634
- 635
- 636
- 637
- 638
- 639
- 640
- 641
- 642
- 643
- 644
- 645
- 646
- 647
- 648
- 649
- 650
- 651
- 652
- 653
- 654
- 655
- 656
- 657
- 658
- 659
- 660
- 661
- 662
- 663
- 664
- 665
- 666
- 667
- 668
- 669
- 670
- 671
- 672
- 673
- 674
- 675
- 676
- 677
- 678
- 679
- 680
- 681
- 682
- 683
- 684
- 685
- 686
- 687
- 688
- 689
- 690
- 691
- 692
- 693
- 694
- 695
- 696
- 697
- 698
- 699
- 700
- 701
- 702
- 703
- 704
- 705
- 706
- 707
- 708
- 709
- 710
- 711
- 712
- 713
- 714
- 715
- 716
- 717
- 718
- 719
- 720
- 721
- 722
- 723
- 724
- 725
- 726
- 727
- 728
- 729
- 730
- 731
- 732
- 733
- 734
- 735
- 736
- 737
- 738
- 739
- 740
- 741
- 742
- 743
- 744
- 745
- 746
- 747
- 748
- 749
- 750
- 751
- 752
- 753
- 754
- 755
- 756
- 757
- 758
- 759
- 760
- 761
- 762
- 763
- 764
- 765
- 766
- 767
- 768
- 769
- 770
- 771
- 772
- 773
- 774
- 775
- 776
- 777
- 778
- 779
- 780
- 781
- 782
- 783
- 784
- 785
- 786
- 787
- 788
- 789
- 790
- 791
- 792
- 793
- 794
- 795
- 796
- 797
- 798
- 799
- 800
- 801
- 802
- 803
- 804
- 805
- 806
- 807
- 808
- 809
- 810
- 811
- 812
- 813
- 814
- 815
- 816
- 817
- 818
- 819
- 820
- 821
- 822
- 823
- 824
- 825
- 826
- 827
- 828
- 829
- 830
- 831
- 832
- 833
- 834
- 835
- 836
- 837
- 838
- 839
- 840
- 841
- 842
- 843
- 844
- 845
- 846
- 847
- 848
- 849
- 850
- 851
- 852
- 853
- 854
- 855
- 856
- 857
- 858
- 859
- 860
- 861
- 862
- 863
- 864
- 865
- 866
- 867
- 868
- 869
- 870
- 871
- 872
- 873
- 874
- 875
- 876
- 877
- 878
- 879
- 880
- 881
- 882
- 883
- 884
- 885
- 886
- 887
- 888
- 889
- 890
- 891
- 892
- 893
- 894
- 895
- 896
- 897
- 898
- 899
- 900
- 901
- 902
- 903
- 904
- 905
- 906
- 907
- 908
- 909
- 910
- 911
- 912
- 913
- 914
- 915
- 916
- 917
- 918
- 919
- 920
- 921
- 922
- 923
- 924
- 925
- 926
- 927
- 928
- 929
- 930
- 931
- 932
- 933
- 934
- 935
- 936
- 937
- 938
- 939
- 940
- 941
- 942
- 943
- 944
- 945
- 946
- 947
- 948
- 949
- 950
- 951
- 952
- 953
- 954
- 955
- 956
- 957
- 958
- 959
- 960
- 961
- 962
- 963
- 964
- 965
- 966
- 967
- 968
- 969
- 970
- 971
- 972
- 973
- 974
- 975
- 976
- 977
- 978
- 979
- 980
- 981
- 982
- 983
- 984
- 985
- 986
- 987
- 988
- 989
- 990
- 991
- 992
- 993
- 994
- 995
- 996
- 997
- 998
- 999
-1000
-1001
-1002
-1003
-1004
-1005
-1006
-1007
-1008
-1009
-1010
-1011
-1012
-1013
-1014
-1015
-1016
-1017
-1018
-1019
-1020
-1021
-1022
-1023
-1024
-1025
-1026
-1027
-1028
-1029
-1030
-1031
-1032
-1033
-1034
-1035
-1036
-1037
-1038
-1039
-1040
-1041
-1042
-1043
-1044
-1045
-1046
-1047
-1048
-1049
-1050
-1051
-1052
-1053
-1054
-1055
-1056
-1057
-1058
-1059
-1060
-1061
-1062
-1063
-1064
-1065
-1066
-1067
-1068
-1069
-1070
-1071
-1072
-1073
-1074
-1075
-1076
-1077
-1078
-1079
-1080
-1081
-1082
-1083
-1084
-1085
-1086
-1087
-1088
-1089
-1090
-1091
-1092
-1093
-1094
-1095
-1096
-1097
-1098
-1099
-1100
-1101
-1102
-1103
-1104
-1105
-1106
-1107
-1108
-1109
-1110
-1111
-1112
-1113
-1114
-1115
-1116
-1117
-1118
-1119
-1120
-1121
-1122
-1123
-1124
-1125
-1126
-1127
-1128
-1129
-1130
-1131
-1132
-1133
-1134
-1135
-1136
-1137
-1138
-1139
-1140
-1141
-1142
-1143
-1144
-1145
-1146
-1147
-1148
-1149
-1150
-1151
-1152
-1153
-1154
-1155
-1156
-1157
-1158
-1159
-1160
-1161
-1162
-1163
-1164
-1165
-1166
-1167
-1168
-1169
-1170
-1171
-1172
-1173
-1174
-1175
-1176
-1177
-1178
-1179
-1180
-1181
-1182
-1183
-1184
-1185
-1186
-1187
-1188
-1189
-1190
-1191
-1192
-1193
-1194
-1195
-1196
-1197
-1198
-1199
-1200
-1201
-1202
-1203
-1204
-1205
-1206
-1207
-1208
-1209
-1210
-1211
-1212
-1213
-1214
-1215
-1216
-1217
-1218
-1219
-1220
-1221
-1222
-1223
-1224
-1225
-1226
-1227
-1228
-1229
-1230
-1231
-1232
-1233
-1234
-1235
-1236
-1237
-1238
-1239
-1240
-1241
-1242
-1243
-1244
-1245
-1246
-1247
-1248
-1249
-1250
-1251
-1252
-1253
-1254
-1255
-1256
-1257
-1258
-1259
-1260
-1261
-1262
-1263
-1264
-1265
-1266
-1267
-1268
-1269
-1270
-1271
-1272
-1273
-1274
-1275
-1276
-1277
-1278
-1279
-1280
-1281
-1282
-1283
-1284
-1285
-1286
-1287
-1288
-1289
-1290
-1291
-1292
-1293
-1294
-1295
-1296
-1297
-1298
-1299
-1300
-1301
-1302
-1303
-1304
-1305
-1306
-1307
-1308
-1309
-1310
-1311
-1312
-1313
-1314
-1315
-1316
-1317
-1318
-1319
-1320
-1321
-1322
-1323
-1324
-1325
-1326
-1327
-1328
-1329
-1330
-1331
-1332
-1333
-1334
-1335
-1336
-1337
-1338
-1339
-1340
-1341
-1342
-1343
-1344
-1345
-1346
-1347
-1348
-1349
-1350
-1351
-1352
-1353
-1354
-1355
-1356
-1357
-1358
-1359
-1360
-1361
-1362
-1363
-1364
-1365
-1366
-1367
-1368
-1369
-1370
-1371
-1372
-1373
-1374
-1375
-1376
-1377
-1378
-1379
-1380
-1381
-1382
-1383
-1384
-1385
-1386
-1387
-1388
-1389
-1390
-1391
-1392
-1393
-1394
-1395
-1396
-1397
-1398
-1399
-1400
-1401
-1402
-1403
-1404
-1405
-1406
-1407
-1408
-1409
-1410
-1411
-1412
-1413
-1414
-1415
-1416
-1417
-1418
-1419
-1420
-1421
-1422
-1423
-1424
-1425
-1426
-1427
-1428
-1429
-1430
-1431
-1432
-1433
-1434
-1435
-1436
-1437
-1438
-1439
-1440
-1441
-1442
-1443
-1444
-1445
-1446
-1447
-1448
-1449
-1450
-1451
-1452
-1453
-1454
-1455
-1456
-1457
-1458
-1459
-1460
-1461
-1462
-1463
-1464
-1465
-1466
-1467
-1468
-1469
-1470
-1471
-1472
-1473
-1474
-1475
-1476
-1477
-1478
-1479
-1480
-1481
-1482
-1483
-1484
-1485
-1486
-1487
-1488
-1489
-1490
-1491
-1492
-1493
-1494
-1495
-1496
-1497
-1498
-1499
-1500
-1501
-1502
-1503
-1504
-1505
-1506
-1507
-1508
-1509
-1510
-1511
-1512
-1513
-1514
-1515
-1516
-1517
-1518
-1519
-1520
-1521
-1522
-1523
-1524
-1525
-1526
-1527
-1528
-1529
-1530
-1531
-1532
-1533
-1534
-1535
-1536
-1537
-1538
-1539
-1540
-1541
-1542
-1543
-1544
-1545
-1546
-1547
-1548
-1549
-1550
-1551
-1552
-1553
-1554
-1555
-1556
-1557
-1558
-1559
-1560
-1561
-1562
-1563
-1564
-1565
-1566
-1567
-1568
-1569
-1570
-1571
-1572
-1573
-1574
-1575
-1576
-1577
-1578
-1579
-1580
-1581
-1582
-1583
-1584
-1585
-1586
-1587
-1588
-1589
-1590
-1591
-1592
-1593
-1594
-1595
-1596
-1597
-1598
-1599
-1600
-1601
-1602
-1603
-1604
-1605
-1606
@frozen(init=False)
-class OAuth2Client:
-    """An OAuth 2.x Client, that can send requests to an OAuth 2.x Authorization Server.
-
-    `OAuth2Client` is able to obtain tokens from the Token Endpoint using any of the standardised
-    Grant Types, and to communicate with the various backend endpoints like the Revocation,
-    Introspection, and UserInfo Endpoint.
-
-    To init an OAuth2Client, you only need the url to the Token Endpoint and the Credentials
-    (a client_id and one of a secret or private_key) that will be used to authenticate to that endpoint.
-    Other endpoint urls, such as the Authorization Endpoint, Revocation Endpoint, etc. can be passed as
-    parameter as well if you intend to use them.
-
-
-    This class is not intended to help with the end-user authentication or any request that goes in
-    a browser. For authentication requests, see
-    [AuthorizationRequest][requests_oauth2client.authorization_request.AuthorizationRequest]. You
-    may use the method `authorization_request()` to generate `AuthorizationRequest`s with the
-    preconfigured `authorization_endpoint`, `client_id` and `redirect_uri' from this client.
-
-    Args:
-        token_endpoint: the Token Endpoint URI where this client will get access tokens
-        auth: the authentication handler to use for client authentication on the token endpoint.
-            Can be:
-
-            - a [requests.auth.AuthBase][] instance (which will be used as-is)
-            - a tuple of `(client_id, client_secret)` which will initialize an instance
-            of [ClientSecretPost][requests_oauth2client.client_authentication.ClientSecretPost]
-            - a `(client_id, jwk)` to initialize
-            a [PrivateKeyJwt][requests_oauth2client.client_authentication.PrivateKeyJwt],
-            - or a `client_id` which will
-            use [PublicApp][requests_oauth2client.client_authentication.PublicApp] authentication.
-
-        client_id: client ID (use either this or `auth`)
-        client_secret: client secret (use either this or `auth`)
-        private_key: private_key to use for client authentication (use either this or `auth`)
-        revocation_endpoint: the Revocation Endpoint URI to use for revoking tokens
-        introspection_endpoint: the Introspection Endpoint URI to use to get info about tokens
-        userinfo_endpoint: the Userinfo Endpoint URI to use to get information about the user
-        authorization_endpoint: the Authorization Endpoint URI, used for initializing Authorization Requests
-        redirect_uri: the redirect_uri for this client
-        backchannel_authentication_endpoint: the BackChannel Authentication URI
-        device_authorization_endpoint: the Device Authorization Endpoint URI to use to authorize devices
-        jwks_uri: the JWKS URI to use to obtain the AS public keys
-        code_challenge_method: challenge method to use for PKCE (should always be 'S256')
-        session: a requests Session to use when sending HTTP requests.
-            Useful if some extra parameters such as proxy or client certificate must be used
-            to connect to the AS.
-        testing: if `True`, don't verify the validity of the endpoint urls that are passed as parameter.
-        **extra_metadata: additional metadata for this client, unused by this class, but may be
-            used by subclasses. Those will be accessible with the `extra_metadata` attribute.
-
-    Usage:
-        ```python
-        client = OAuth2Client(
-            token_endpoint="https://my.as.local/token",
-            revocation_endpoint="https://my.as.local/revoke",
-            client_id="client_id",
-            client_secret="client_secret",
-        )
-
-        # once initialized, a client can send requests to its configured endpoints
-        cc_token = client.client_credentials(scope="my_scope")
-        ac_token = client.authorization_code(code="my_code")
-        client.revoke_access_token(cc_token)
-        ```
-
-    """
-
-    auth: requests.auth.AuthBase = field(converter=client_auth_factory)
-    token_endpoint: str = field()
-    revocation_endpoint: str | None = field()
-    introspection_endpoint: str | None = field()
-    userinfo_endpoint: str | None = field()
-    authorization_endpoint: str | None = field()
-    redirect_uri: str | None = field()
-    backchannel_authentication_endpoint: str | None = field()
-    device_authorization_endpoint: str | None = field()
-    pushed_authorization_request_endpoint: str | None = field()
-    jwks_uri: str | None = field()
-    authorization_server_jwks: JwkSet
-    issuer: str | None = field()
-    id_token_signed_response_alg: str | None = SignatureAlgs.RS256
-    id_token_encrypted_response_alg: str | None = None
-    id_token_decryption_key: Jwk | None = None
-    code_challenge_method: str | None = "S256"
-    authorization_response_iss_parameter_supported: bool = False
-    session: requests.Session = field(factory=requests.Session)
-    extra_metadata: dict[str, Any] = field(factory=dict)
-    testing: bool = False
-
-    bearer_token_class: type[BearerToken] = BearerToken
-
-    exception_classes: ClassVar[dict[str, type[Exception]]] = {
-        "server_error": ServerError,
-        "invalid_request": InvalidRequest,
-        "invalid_client": InvalidClient,
-        "invalid_scope": InvalidScope,
-        "invalid_target": InvalidTarget,
-        "invalid_grant": InvalidGrant,
-        "access_denied": AccessDenied,
-        "unauthorized_client": UnauthorizedClient,
-        "authorization_pending": AuthorizationPending,
-        "slow_down": SlowDown,
-        "expired_token": ExpiredToken,
-        "unsupported_token_type": UnsupportedTokenType,
-    }
-
-    def __init__(  # noqa: PLR0913
-        self,
-        token_endpoint: str,
-        auth: (
-            requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
-        ) = None,
-        *,
-        client_id: str | None = None,
-        client_secret: str | None = None,
-        private_key: Jwk | dict[str, Any] | None = None,
-        revocation_endpoint: str | None = None,
-        introspection_endpoint: str | None = None,
-        userinfo_endpoint: str | None = None,
-        authorization_endpoint: str | None = None,
-        redirect_uri: str | None = None,
-        backchannel_authentication_endpoint: str | None = None,
-        device_authorization_endpoint: str | None = None,
-        pushed_authorization_request_endpoint: str | None = None,
-        jwks_uri: str | None = None,
-        authorization_server_jwks: JwkSet | dict[str, Any] | None = None,
-        issuer: str | None = None,
-        id_token_signed_response_alg: str | None = SignatureAlgs.RS256,
-        id_token_encrypted_response_alg: str | None = None,
-        id_token_decryption_key: Jwk | dict[str, Any] | None = None,
-        code_challenge_method: str = "S256",
-        authorization_response_iss_parameter_supported: bool = False,
-        bearer_token_class: type[BearerToken] = BearerToken,
-        session: requests.Session | None = None,
-        testing: bool = False,
-        **extra_metadata: Any,
-    ):
-        if authorization_response_iss_parameter_supported and not issuer:
-            msg = (
-                "If the Authorization Server supports Issuer Identification, as specified by"
-                " `authorization_response_iss_parameter_supported=True`, then you must specify"
-                " the expected `issuer` value with parameter `issuer`."
-            )
-            raise ValueError(msg)
-
-        auth = client_auth_factory(
-            auth,
-            client_id=client_id,
-            client_secret=client_secret,
-            private_key=private_key,
-            default_auth_handler=ClientSecretPost,
-        )
-
-        if authorization_server_jwks is None:
-            authorization_server_jwks = JwkSet()
-        elif not isinstance(authorization_server_jwks, JwkSet):
-            authorization_server_jwks = JwkSet(authorization_server_jwks)
-
-        if id_token_decryption_key is not None and not isinstance(id_token_decryption_key, Jwk):
-            id_token_decryption_key = Jwk(id_token_decryption_key)
-
-        if id_token_decryption_key is not None and id_token_encrypted_response_alg is None:
-            if id_token_decryption_key.alg:
-                id_token_encrypted_response_alg = id_token_decryption_key.alg
-            else:
-                msg = (
-                    "An ID Token decryption key has been provided but no decryption algorithm is defined."
-                    " You can either pass an `id_token_encrypted_response_alg` parameter with the alg identifier,"
-                    " or include an `alg` attribute in the decryption key, if it is in Jwk format."
-                )
-                raise ValueError(msg)
-
-        if session is None:
-            session = requests.Session()
-
-        self.__attrs_init__(
-            testing=testing,
-            token_endpoint=token_endpoint,
-            revocation_endpoint=revocation_endpoint,
-            introspection_endpoint=introspection_endpoint,
-            userinfo_endpoint=userinfo_endpoint,
-            authorization_endpoint=authorization_endpoint,
-            redirect_uri=redirect_uri,
-            backchannel_authentication_endpoint=backchannel_authentication_endpoint,
-            device_authorization_endpoint=device_authorization_endpoint,
-            pushed_authorization_request_endpoint=pushed_authorization_request_endpoint,
-            jwks_uri=jwks_uri,
-            authorization_server_jwks=authorization_server_jwks,
-            issuer=issuer,
-            session=session,
-            auth=auth,
-            id_token_signed_response_alg=id_token_signed_response_alg,
-            id_token_encrypted_response_alg=id_token_encrypted_response_alg,
-            id_token_decryption_key=id_token_decryption_key,
-            code_challenge_method=code_challenge_method,
-            authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
-            bearer_token_class=bearer_token_class,
-            extra_metadata=extra_metadata,
-        )
-
-    @token_endpoint.validator
-    @revocation_endpoint.validator
-    @introspection_endpoint.validator
-    @userinfo_endpoint.validator
-    @authorization_endpoint.validator
-    @backchannel_authentication_endpoint.validator
-    @device_authorization_endpoint.validator
-    @pushed_authorization_request_endpoint.validator
-    @jwks_uri.validator
-    def validate_endpoint_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
-        """Validate that an endpoint URI is suitable for use.
-
-        If you need to disable some checks (for AS testing purposes only!), provide a different
-        method here.
-
-        """
-        if self.testing or uri is None:
-            return uri
-        try:
-            return validate_endpoint_uri(uri)
-        except ValueError as exc:
-            msg = f"Invalid value '{uri}' for '{attribute.name}': {exc}"
-            raise ValueError(msg) from exc
-
-    @issuer.validator
-    def validate_issuer_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
-        """Validate that an Issuer identifier is suitable for use.
-
-        This is the same check as an endpoint URI, but the path may be (and usually is) empty.
-
-        """
-        if self.testing or uri is None:
-            return uri
-        try:
-            return validate_issuer_uri(uri)
-        except ValueError as exc:
-            msg = f"Invalid value '{uri}' for '{attribute.name}': {exc}"
-            raise ValueError(msg) from exc
-
-    @property
-    def client_id(self) -> str:
-        """Client ID."""
-        if hasattr(self.auth, "client_id"):
-            return self.auth.client_id  # type: ignore[no-any-return]
-        msg = "This client uses a custom authentication method without client_id."
-        raise AttributeError(msg)  # pragma: no cover
-
-    @property
-    def client_secret(self) -> str | None:
-        """Client Secret."""
-        if hasattr(self.auth, "client_secret"):
-            return self.auth.client_secret  # type: ignore[no-any-return]
-        return None
-
-    @property
-    def client_jwks(self) -> JwkSet:
-        """A `JwkSet` containing the public keys for this client.
-
-        Keys are:
-
-        - the public key for client assertion signature verification (if using private_key_jwt)
-        - the ID Token encryption key
-
-        """
-        jwks = JwkSet()
-        if isinstance(self.auth, PrivateKeyJwt):
-            jwks.add_jwk(self.auth.private_jwk.public_jwk().with_usage_parameters())
-        if self.id_token_decryption_key:
-            jwks.add_jwk(self.id_token_decryption_key.public_jwk().with_usage_parameters())
-        return jwks
-
-    def _request(
-        self,
-        endpoint: str,
-        on_success: Callable[[requests.Response], T],
-        on_failure: Callable[[requests.Response], T],
-        accept: str = "application/json",
-        method: str = "POST",
-        **requests_kwargs: Any,
-    ) -> T:
-        """Send a request to one of the endpoints.
-
-        This is a helper method that takes care of the following tasks:
-
-        - make sure the endpoint as been configured
-        - set `Accept: application/json` header
-        - send the HTTP POST request, then
-            - apply `on_success` to a successful response
-            - or apply `on_failure` otherwise
-        - return the result
-
-        Args:
-            endpoint: name of the endpoint to use
-            on_success: a callable to apply to successful responses
-            on_failure: a callable to apply to error responses
-            accept: the Accept header to include in the request
-            method: the HTTP method to use
-            **requests_kwargs: keyword arguments for the request
-
-        """
-        endpoint_uri = self._require_endpoint(endpoint)
-        requests_kwargs.setdefault("headers", {})
-        requests_kwargs["headers"]["Accept"] = accept
-
-        response = self.session.request(
-            method,
-            endpoint_uri,
-            **requests_kwargs,
-        )
-        if response.ok:
-            return on_success(response)
-
-        return on_failure(response)
-
-    def token_request(
-        self,
-        data: dict[str, Any],
-        timeout: int = 10,
-        **requests_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request to the token endpoint.
-
-        Authentication will be added automatically based on the defined `auth` for this client.
-
-        Args:
-          data: parameters to send to the token endpoint. Items with a `None`
-               or empty value will not be sent in the request.
-          timeout: a timeout value for the call
-          **requests_kwargs: additional parameters for requests.post()
-
-        Returns:
-            the token endpoint response, as
-            [`BearerToken`][requests_oauth2client.tokens.BearerToken] instance.
-
-        """
-        return self._request(
-            "token_endpoint",
-            auth=self.auth,
-            data=data,
-            timeout=timeout,
-            on_success=self.parse_token_response,
-            on_failure=self.on_token_error,
-            **requests_kwargs,
-        )
-
-    def parse_token_response(self, response: requests.Response) -> BearerToken:
-        """Parse a Response returned by the Token Endpoint.
-
-        Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] to parse
-        responses returned by the Token Endpoint. Those responses contain an `access_token` and
-        additional attributes.
-
-        Args:
-            response: the [Response][requests.Response] returned by the Token Endpoint.
-
-        Returns:
-            a [`BearerToken`][requests_oauth2client.tokens.BearerToken] based on the response
-            contents.
-
-        """
-        try:
-            token_response = self.bearer_token_class(**response.json())
-        except Exception as response_class_exc:
-            try:
-                return self.on_token_error(response)
-            except Exception as token_error_exc:
-                raise token_error_exc from response_class_exc
-        else:
-            return token_response
-
-    def on_token_error(self, response: requests.Response) -> BearerToken:
-        """Error handler for `token_request()`.
-
-        Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] when the
-        Token Endpoint returns an error.
-
-        Args:
-            response: the [Response][requests.Response] returned by the Token Endpoint.
-
-        Returns:
-            nothing, and raises an exception instead. But a subclass may return a
-            [`BearerToken`][requests_oauth2client.tokens.BearerToken] to implement a default
-            behaviour if needed.
-
-        """
-        try:
-            data = response.json()
-            error = data["error"]
-            error_description = data.get("error_description")
-            error_uri = data.get("error_uri")
-            exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
-            exception = exception_class(response, error, error_description, error_uri)
-        except Exception as exc:
-            raise InvalidTokenResponse(response) from exc
-        raise exception
-
-    def client_credentials(
-        self,
-        scope: str | Iterable[str] | None = None,
-        *,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request to the token endpoint using the `client_credentials` grant.
-
-        Args:
-            scope: the scope to send with the request. Can be a str, or an iterable of str.
-                to pass that way include `scope`, `audience`, `resource`, etc.
-            requests_kwargs: additional parameters for the call to requests
-            **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`. Common parameters
-
-        Returns:
-            a TokenResponse
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        if scope and not isinstance(scope, str):
-            try:
-                scope = " ".join(scope)
-            except Exception as exc:
-                msg = "Unsupported scope value"
-                raise ValueError(msg) from exc
-
-        data = dict(grant_type=GrantType.CLIENT_CREDENTIALS, scope=scope, **token_kwargs)
-        return self.token_request(data, **requests_kwargs)
-
-    def authorization_code(
-        self,
-        code: str | AuthorizationResponse,
-        *,
-        validate: bool = True,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request to the token endpoint with the `authorization_code` grant.
-
-        Args:
-             code: an authorization code or an `AuthorizationResponse` to exchange for tokens
-             validate: if `True`, validate the received ID Token (this works only if `code` is an AuthorizationResponse)
-             requests_kwargs: additional parameters for the call to requests
-             **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `code`, etc.
-
-        Returns:
-            a `BearerToken`
-
-        """
-        azr: AuthorizationResponse | None = None
-        if isinstance(code, AuthorizationResponse):
-            token_kwargs.setdefault("code_verifier", code.code_verifier)
-            token_kwargs.setdefault("redirect_uri", code.redirect_uri)
-            azr = code
-            code = code.code
-
-        requests_kwargs = requests_kwargs or {}
-
-        data = dict(grant_type=GrantType.AUTHORIZATION_CODE, code=code, **token_kwargs)
-        token = self.token_request(data, **requests_kwargs)
-        if validate and token.id_token and isinstance(azr, AuthorizationResponse):
-            return token.validate_id_token(self, azr)
-        return token
-
-    def refresh_token(
-        self,
-        refresh_token: str | BearerToken,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request to the token endpoint with the `refresh_token` grant.
-
-        Args:
-            refresh_token: a refresh_token, as a string, or as a `BearerToken`.
-                That `BearerToken` must have a `refresh_token`.
-            requests_kwargs: additional parameters for the call to `requests`
-            **token_kwargs: additional parameters for the token endpoint,
-                alongside `grant_type`, `refresh_token`, etc.
-
-        Returns:
-            a `BearerToken`
-
-        """
-        if isinstance(refresh_token, BearerToken):
-            if refresh_token.refresh_token is None or not isinstance(refresh_token.refresh_token, str):
-                msg = "This BearerToken doesn't have a refresh_token"
-                raise ValueError(msg)
-            refresh_token = refresh_token.refresh_token
-
-        requests_kwargs = requests_kwargs or {}
-        data = dict(grant_type=GrantType.REFRESH_TOKEN, refresh_token=refresh_token, **token_kwargs)
-        return self.token_request(data, **requests_kwargs)
-
-    def device_code(
-        self,
-        device_code: str | DeviceAuthorizationResponse,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request to the token endpoint using the Device Code grant.
-
-        The grant_type is `urn:ietf:params:oauth:grant-type:device_code`. This needs a Device Code,
-        or a `DeviceAuthorizationResponse` as parameter.
-
-        Args:
-            device_code: a device code, or a `DeviceAuthorizationResponse`
-            requests_kwargs: additional parameters for the call to requests
-            **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `device_code`, etc.
-
-        Returns:
-            a `BearerToken`
-
-        """
-        if isinstance(device_code, DeviceAuthorizationResponse):
-            if device_code.device_code is None or not isinstance(device_code.device_code, str):
-                msg = "This DeviceAuthorizationResponse doesn't have a device_code"
-                raise ValueError(msg)
-            device_code = device_code.device_code
-
-        requests_kwargs = requests_kwargs or {}
-        data = dict(
-            grant_type=GrantType.DEVICE_CODE,
-            device_code=device_code,
-            **token_kwargs,
-        )
-        return self.token_request(data, **requests_kwargs)
-
-    def ciba(
-        self,
-        auth_req_id: str | BackChannelAuthenticationResponse,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a CIBA request to the Token Endpoint.
-
-        A CIBA request is a Token Request using the `urn:openid:params:grant-type:ciba` grant.
-
-        Args:
-            auth_req_id: an authentication request ID, as returned by the AS
-            requests_kwargs: additional parameters for the call to requests
-            **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `auth_req_id`, etc.
-
-        Returns:
-            a `BearerToken`
-
-        """
-        if isinstance(auth_req_id, BackChannelAuthenticationResponse):
-            if auth_req_id.auth_req_id is None or not isinstance(auth_req_id.auth_req_id, str):
-                msg = "This `BackChannelAuthenticationResponse` doesn't have an `auth_req_id`"
-                raise ValueError(msg)
-            auth_req_id = auth_req_id.auth_req_id
-
-        requests_kwargs = requests_kwargs or {}
-        data = dict(
-            grant_type=GrantType.CLIENT_INITIATED_BACKCHANNEL_AUTHENTICATION,
-            auth_req_id=auth_req_id,
-            **token_kwargs,
-        )
-        return self.token_request(data, **requests_kwargs)
-
-    def token_exchange(
-        self,
-        subject_token: str | BearerToken | IdToken,
-        subject_token_type: str | None = None,
-        actor_token: None | str | BearerToken | IdToken = None,
-        actor_token_type: str | None = None,
-        requested_token_type: str | None = None,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a Token Exchange request.
-
-        A Token Exchange request is actually a request to the Token Endpoint with a grant_type
-        `urn:ietf:params:oauth:grant-type:token-exchange`.
-
-        Args:
-            subject_token: the subject token to exchange for a new token.
-            subject_token_type: a token type identifier for the subject_token, mandatory if it cannot be guessed based
-                on `type(subject_token)`.
-            actor_token: the actor token to include in the request, if any.
-            actor_token_type: a token type identifier for the actor_token, mandatory if it cannot be guessed based
-                on `type(actor_token)`.
-            requested_token_type: a token type identifier for the requested token.
-            requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
-            **token_kwargs: additional parameters to include in the request body.
-
-        Returns:
-            a `BearerToken` as returned by the Authorization Server.
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        try:
-            subject_token_type = self.get_token_type(subject_token_type, subject_token)
-        except ValueError:
-            msg = "Cannot determine the kind of 'subject_token' you provided. Please specify a 'subject_token_type'."
-            raise TypeError(msg) from None
-        if actor_token:  # pragma: no branch
-            try:
-                actor_token_type = self.get_token_type(actor_token_type, actor_token)
-            except ValueError:
-                msg = "Cannot determine the kind of 'actor_token' you provided. Please specify an 'actor_token_type'."
-                raise TypeError(msg) from None
-
-        data = dict(
-            grant_type=GrantType.TOKEN_EXCHANGE,
-            subject_token=subject_token,
-            subject_token_type=subject_token_type,
-            actor_token=actor_token,
-            actor_token_type=actor_token_type,
-            requested_token_type=requested_token_type,
-            **token_kwargs,
-        )
-        return self.token_request(data, **requests_kwargs)
-
-    def jwt_bearer(
-        self,
-        assertion: Jwt | str,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request using a JWT as authorization grant.
-
-        This is defined in (RFC7523 $2.1)[https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1).
-
-        Args:
-            assertion: a JWT (as an instance of `jwskate.Jwt` or as a `str`) to use as authorization grant.
-            requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
-            **token_kwargs: additional parameters to include in the request body.
-
-        Returns:
-            a `BearerToken` as returned by the Authorization Server.
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        if not isinstance(assertion, Jwt):
-            assertion = Jwt(assertion)
-
-        data = dict(
-            grant_type=GrantType.JWT_BEARER,
-            assertion=assertion,
-            **token_kwargs,
-        )
-
-        return self.token_request(data, **requests_kwargs)
-
-    def resource_owner_password(
-        self,
-        username: str,
-        password: str,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request using the Resource Owner Password Grant.
-
-        This Grant Type is deprecated and should only be used when there is no other choice.
-
-        Args:
-            username: the resource owner user name
-            password: the resource owner password
-            requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
-            **token_kwargs: additional parameters to include in the request body.
-
-        Returns:
-            a `BearerToken` as returned by the Authorization Server
-
-        """
-        requests_kwargs = requests_kwargs or {}
-        data = dict(
-            grant_type=GrantType.RESOURCE_OWNER_PASSWORD,
-            username=username,
-            password=password,
-            **token_kwargs,
-        )
-
-        return self.token_request(data, **requests_kwargs)
-
-    def authorization_request(
-        self,
-        *,
-        scope: None | str | Iterable[str] = "openid",
-        response_type: str = "code",
-        redirect_uri: str | None = None,
-        state: str | ellipsis | None = ...,  # noqa: F821
-        nonce: str | ellipsis | None = ...,  # noqa: F821
-        code_verifier: str | None = None,
-        **kwargs: Any,
-    ) -> AuthorizationRequest:
-        """Generate an Authorization Request for this client.
-
-        Args:
-            scope: the `scope` to use
-            response_type: the `response_type` to use
-            redirect_uri: the `redirect_uri` to include in the request. By default,
-                the `redirect_uri` defined at init time is used.
-            state: the `state` parameter to use. Leave default to generate a random value.
-            nonce: a `nonce`. Leave default to generate a random value.
-            code_verifier: the PKCE `code_verifier` to use. Leave default to generate a random value.
-            **kwargs: additional parameters to include in the auth request
-
-        Returns:
-            an AuthorizationRequest with the supplied parameters
-
-        """
-        authorization_endpoint = self._require_endpoint("authorization_endpoint")
-
-        redirect_uri = redirect_uri or self.redirect_uri
-        if not redirect_uri:
-            msg = (
-                "No 'redirect_uri' defined for this client. You must either pass a redirect_uri"
-                " as parameter to this method, or include a redirect_uri when initializing your"
-                " OAuth2Client."
-            )
-            raise AttributeError(msg)
-
-        if response_type != "code":
-            msg = "Only response_type=code is supported."
-            raise ValueError(msg)
-
-        return AuthorizationRequest(
-            authorization_endpoint=authorization_endpoint,
-            client_id=self.client_id,
-            redirect_uri=redirect_uri,
-            issuer=self.issuer,
-            response_type=response_type,
-            scope=scope,
-            state=state,
-            nonce=nonce,
-            code_verifier=code_verifier,
-            code_challenge_method=self.code_challenge_method,
-            **kwargs,
-        )
-
-    def pushed_authorization_request(
-        self,
-        authorization_request: AuthorizationRequest,
-        requests_kwargs: dict[str, Any] | None = None,
-    ) -> RequestUriParameterAuthorizationRequest:
-        """Send a Pushed Authorization Request.
-
-        This sends a request to the Pushed Authorization Request Endpoint, and returns a
-        `RequestUriParameterAuthorizationRequest` initialized with the AS response.
-
-        Args:
-            authorization_request: the authorization request to send
-            requests_kwargs: additional parameters for `requests.request()`
-
-        Returns:
-            the `RequestUriParameterAuthorizationRequest` initialized based on the AS response
-
-        """
-        requests_kwargs = requests_kwargs or {}
-        return self._request(
-            "pushed_authorization_request_endpoint",
-            data=authorization_request.args,
-            auth=self.auth,
-            on_success=self.parse_pushed_authorization_response,
-            on_failure=self.on_pushed_authorization_request_error,
-            **requests_kwargs,
-        )
-
-    def parse_pushed_authorization_response(
-        self, response: requests.Response
-    ) -> RequestUriParameterAuthorizationRequest:
-        """Parse the response obtained by `pushed_authorization_request()`.
-
-        Args:
-            response: the `requests.Response` returned by the PAR endpoint
-
-        Returns:
-            a RequestUriParameterAuthorizationRequest instance
-
-        """
-        response_json = response.json()
-        request_uri = response_json.get("request_uri")
-        expires_in = response_json.get("expires_in")
-
-        return RequestUriParameterAuthorizationRequest(
-            authorization_endpoint=self.authorization_endpoint,
-            client_id=self.client_id,
-            request_uri=request_uri,
-            expires_in=expires_in,
-        )
-
-    def on_pushed_authorization_request_error(
-        self, response: requests.Response
-    ) -> RequestUriParameterAuthorizationRequest:
-        """Error Handler for Pushed Authorization Endpoint errors.
-
-        Args:
-            response: the HTTP response as returned by the AS PAR endpoint.
-
-        Returns:
-            a RequestUriParameterAuthorizationRequest, if the error is recoverable
-
-        Raises:
-            EndpointError: a subclass of this error depending on the error returned by the AS
-            InvalidPushedAuthorizationResponse: if the returned response is not following the
-            specifications UnknownTokenEndpointError: for unknown/unhandled errors
-
-        """
-        try:
-            data = response.json()
-            error = data["error"]
-            error_description = data.get("error_description")
-            error_uri = data.get("error_uri")
-            exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
-            exception = exception_class(response, error, error_description, error_uri)
-        except Exception as exc:
-            raise InvalidPushedAuthorizationResponse(response) from exc
-        raise exception
-
-    def userinfo(self, access_token: BearerToken | str) -> Any:
-        """Call the UserInfo endpoint.
-
-        This sends a request to the UserInfo endpoint, with the specified access_token, and returns
-        the parsed result.
-
-        Args:
-            access_token: the access token to use
-
-        Returns:
-            the [Response][requests.Response] returned by the userinfo endpoint.
-
-        """
-        return self._request(
-            "userinfo_endpoint",
-            auth=BearerAuth(access_token),
-            on_success=self.parse_userinfo_response,
-            on_failure=self.on_userinfo_error,
-        )
-
-    def parse_userinfo_response(self, resp: requests.Response) -> Any:
-        """Parse the response obtained by `userinfo()`.
-
-        Invoked by [userinfo()][requests_oauth2client.client.OAuth2Client.userinfo] to parse the
-        response from the UserInfo endpoint, this will extract and return its JSON content.
-
-        Args:
-            resp: a [Response][requests.Response] returned from the UserInfo endpoint.
-
-        Returns:
-            the parsed JSON content from this response.
-
-        """
-        return resp.json()
-
-    def on_userinfo_error(self, resp: requests.Response) -> Any:
-        """Parse UserInfo error response.
-
-        Args:
-            resp: a [Response][requests.Response] returned from the UserInfo endpoint.
-
-        Returns:
-            nothing, raises exception instead.
-
-        """
-        resp.raise_for_status()
-
-    @classmethod
-    def get_token_type(  # noqa: C901
-        cls,
-        token_type: str | None = None,
-        token: None | str | BearerToken | IdToken = None,
-    ) -> str:
-        """Get standardized token type identifiers.
-
-        Return a standardized token type identifier, based on a short `token_type` hint and/or a
-        token value.
-
-        Args:
-            token_type: a token_type hint, as `str`. May be "access_token", "refresh_token"
-                or "id_token"
-            token: a token value, as an instance of `BearerToken` or IdToken, or as a `str`.
-
-        Returns:
-            the token_type as defined in the Token Exchange RFC8693.
-
-        """
-        if not (token_type or token):
-            msg = "Cannot determine type of an empty token without a token_type hint"
-            raise ValueError(msg)
-
-        if token_type is None:
-            if isinstance(token, str):
-                msg = "Cannot determine the type of provided token when it is a bare str. Please specify a token_type."
-                raise ValueError(msg)
-            elif isinstance(token, BearerToken):
-                return "urn:ietf:params:oauth:token-type:access_token"
-            elif isinstance(token, IdToken):
-                return "urn:ietf:params:oauth:token-type:id_token"
-            else:
-                msg = "Unexpected type of token, please provide a string or a BearerToken or an IdToken."
-                raise TypeError(
-                    msg,
-                    type(token),
-                )
-        elif token_type == TokenType.ACCESS_TOKEN:
-            if token is not None and not isinstance(token, (str, BearerToken)):
-                msg = "The supplied token is not a BearerToken or a string representation of it."
-                raise TypeError(
-                    msg,
-                    type(token),
-                )
-            return "urn:ietf:params:oauth:token-type:access_token"
-        elif token_type == TokenType.REFRESH_TOKEN:
-            if token is not None and isinstance(token, BearerToken) and not token.refresh_token:
-                msg = "The supplied BearerToken doesn't have a refresh_token."
-                raise ValueError(msg)
-            return "urn:ietf:params:oauth:token-type:refresh_token"
-        elif token_type == "id_token":
-            if token is not None and not isinstance(token, (str, IdToken)):
-                msg = "The supplied token is not an IdToken or a string representation of it."
-                raise TypeError(
-                    msg,
-                    type(token),
-                )
-            return "urn:ietf:params:oauth:token-type:id_token"
-        else:
-            return {
-                "saml1": "urn:ietf:params:oauth:token-type:saml1",
-                "saml2": "urn:ietf:params:oauth:token-type:saml2",
-                "jwt": "urn:ietf:params:oauth:token-type:jwt",
-            }.get(token_type, token_type)
-
-    def revoke_access_token(
-        self,
-        access_token: BearerToken | str,
-        requests_kwargs: dict[str, Any] | None = None,
-        **revoke_kwargs: Any,
-    ) -> bool:
-        """Send a request to the Revocation Endpoint to revoke an access token.
-
-        Args:
-            access_token: the access token to revoke
-            requests_kwargs: additional parameters for the underlying requests.post() call
-            **revoke_kwargs: additional parameters to pass to the revocation endpoint
-
-        """
-        return self.revoke_token(
-            access_token,
-            token_type_hint=TokenType.ACCESS_TOKEN,
-            requests_kwargs=requests_kwargs,
-            **revoke_kwargs,
-        )
-
-    def revoke_refresh_token(
-        self,
-        refresh_token: str | BearerToken,
-        requests_kwargs: dict[str, Any] | None = None,
-        **revoke_kwargs: Any,
-    ) -> bool:
-        """Send a request to the Revocation Endpoint to revoke a refresh token.
-
-        Args:
-            refresh_token: the refresh token to revoke.
-            requests_kwargs: additional parameters to pass to the revocation endpoint.
-            **revoke_kwargs: additional parameters to pass to the revocation endpoint.
-
-        Returns:
-            `True` if the revocation request is successful, `False` if this client has no configured
-            revocation endpoint.
-
-        """
-        if isinstance(refresh_token, BearerToken):
-            if refresh_token.refresh_token is None:
-                msg = "The supplied BearerToken doesn't have a refresh token."
-                raise ValueError(msg)
-            refresh_token = refresh_token.refresh_token
-
-        return self.revoke_token(
-            refresh_token,
-            token_type_hint=TokenType.REFRESH_TOKEN,
-            requests_kwargs=requests_kwargs,
-            **revoke_kwargs,
-        )
-
-    def revoke_token(
-        self,
-        token: str | BearerToken,
-        token_type_hint: str | None = None,
-        requests_kwargs: dict[str, Any] | None = None,
-        **revoke_kwargs: Any,
-    ) -> bool:
-        """Send a Token Revocation request.
-
-        By default, authentication will be the same than the one used for the Token Endpoint.
-
-        Args:
-            token: the token to revoke.
-            token_type_hint: a token_type_hint to send to the revocation endpoint.
-            requests_kwargs: additional parameters to the underling call to requests.post()
-            **revoke_kwargs: additional parameters to send to the revocation endpoint.
-
-        Returns:
-            `True` if the revocation succeeds, `False` if no revocation endpoint is present or a
-            non-standardised error is returned.
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        if token_type_hint == TokenType.REFRESH_TOKEN and isinstance(token, BearerToken):
-            if token.refresh_token is None:
-                msg = "The supplied BearerToken doesn't have a refresh token."
-                raise ValueError(msg)
-            token = token.refresh_token
-
-        data = dict(revoke_kwargs, token=str(token))
-        if token_type_hint:
-            data["token_type_hint"] = token_type_hint
-
-        return self._request(
-            "revocation_endpoint",
-            data=data,
-            auth=self.auth,
-            on_success=lambda resp: True,
-            on_failure=self.on_revocation_error,
-            **requests_kwargs,
-        )
-
-    def on_revocation_error(self, response: requests.Response) -> bool:
-        """Error handler for `revoke_token()`.
-
-        Invoked by [revoke_token()][requests_oauth2client.client.OAuth2Client.revoke_token] when the
-        revocation endpoint returns an error.
-
-        Args:
-            response: the [Response][requests.Response] as returned by the Revocation Endpoint
-
-        Returns:
-            `False` to signal that an error occurred. May raise exceptions instead depending on the
-            revocation response.
-
-        """
-        try:
-            data = response.json()
-            error = data["error"]
-            error_description = data.get("error_description")
-            error_uri = data.get("error_uri")
-            exception_class = self.exception_classes.get(error, RevocationError)
-            exception = exception_class(error, error_description, error_uri)
-        except Exception:
-            return False
-        raise exception
-
-    def introspect_token(
-        self,
-        token: str | BearerToken,
-        token_type_hint: str | None = None,
-        requests_kwargs: dict[str, Any] | None = None,
-        **introspect_kwargs: Any,
-    ) -> Any:
-        """Send a request to the Introspection Endpoint.
-
-        Parameter `token` can be:
-
-        - a `str`
-        - a `BearerToken` instance
-
-        You may pass any arbitrary `token` and `token_type_hint` values as `str`. Those will
-        be included in the request, as-is.
-        If `token` is a `BearerToken`, then `token_type_hint` must be either:
-
-        - `None`: the access_token will be instrospected and no token_type_hint will be included
-        in the request
-        - `access_token`: same as `None`, but the token_type_hint will be included
-        - or `refresh_token`: only available if a Refresh Token is present in the BearerToken.
-
-        Args:
-            token: the token to instrospect
-            token_type_hint: the `token_type_hint` to include in the request.
-            requests_kwargs: additional parameters to the underling call to requests.post()
-            **introspect_kwargs: additional parameters to send to the introspection endpoint.
-
-        Returns:
-            the response as returned by the Introspection Endpoint.
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        if isinstance(token, BearerToken):
-            if token_type_hint is None or token_type_hint == TokenType.ACCESS_TOKEN:
-                token = token.access_token
-            elif token_type_hint == TokenType.REFRESH_TOKEN:
-                if token.refresh_token is None:
-                    msg = "The supplied BearerToken doesn't have a refresh token."
-                    raise ValueError(msg)
-                else:
-                    token = token.refresh_token
-            else:
-                msg = (
-                    "Invalid `token_type_hint`. To test arbitrary `token_type_hint` values,"
-                    " you must provide `token` as a `str`."
-                )
-                raise ValueError(msg)
-
-        data = dict(introspect_kwargs, token=str(token))
-        if token_type_hint:
-            data["token_type_hint"] = token_type_hint
-
-        return self._request(
-            "introspection_endpoint",
-            data=data,
-            auth=self.auth,
-            on_success=self.parse_introspection_response,
-            on_failure=self.on_introspection_error,
-            **requests_kwargs,
-        )
-
-    def parse_introspection_response(self, response: requests.Response) -> Any:
-        """Parse Token Introspection Responses received by `introspect_token()`.
-
-        Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
-        to parse the returned response. This decodes the JSON content if possible, otherwise it
-        returns the response as a string.
-
-        Args:
-            response: the [Response][requests.Response] as returned by the Introspection Endpoint.
-
-        Returns:
-            the decoded JSON content, or a `str` with the content.
-
-        """
-        try:
-            return response.json()
-        except ValueError:
-            return response.text
-
-    def on_introspection_error(self, response: requests.Response) -> Any:
-        """Error handler for `introspect_token()`.
-
-        Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
-        to parse the returned response in the case an error is returned.
-
-        Args:
-            response: the response as returned by the Introspection Endpoint.
-
-        Returns:
-            usually raises exceptions. A subclass can return a default response instead.
-
-        """
-        try:
-            data = response.json()
-            error = data["error"]
-            error_description = data.get("error_description")
-            error_uri = data.get("error_uri")
-            exception_class = self.exception_classes.get(error, IntrospectionError)
-            exception = exception_class(error, error_description, error_uri)
-        except Exception as exc:
-            raise UnknownIntrospectionError(response) from exc
-        raise exception
-
-    def backchannel_authentication_request(  # noqa: PLR0913
-        self,
-        scope: None | str | Iterable[str] = "openid",
-        *,
-        client_notification_token: str | None = None,
-        acr_values: None | str | Iterable[str] = None,
-        login_hint_token: str | None = None,
-        id_token_hint: str | None = None,
-        login_hint: str | None = None,
-        binding_message: str | None = None,
-        user_code: str | None = None,
-        requested_expiry: int | None = None,
-        private_jwk: Jwk | dict[str, Any] | None = None,
-        alg: str | None = None,
-        requests_kwargs: dict[str, Any] | None = None,
-        **ciba_kwargs: Any,
-    ) -> BackChannelAuthenticationResponse:
-        """Send a CIBA Authentication Request.
-
-        Args:
-             scope: the scope to include in the request.
-             client_notification_token: the Client Notification Token to include in the request.
-             acr_values: the acr values to include in the request.
-             login_hint_token: the Login Hint Token to include in the request.
-             id_token_hint: the ID Token Hint to include in the request.
-             login_hint: the Login Hint to include in the request.
-             binding_message: the Binding Message to include in the request.
-             user_code: the User Code to include in the request
-             requested_expiry: the Requested Expiry, in seconds, to include in the request.
-             private_jwk: the JWK to use to sign the request (optional)
-             alg: the alg to use to sign the request, if the provided JWK does not include an "alg" parameter.
-             requests_kwargs: additional parameters for
-             **ciba_kwargs: additional parameters to include in the request.
-
-        Returns:
-            a BackChannelAuthenticationResponse as returned by AS
-
-        """
-        if not (login_hint or login_hint_token or id_token_hint):
-            msg = "One of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
-            raise ValueError(msg)
-
-        if (login_hint_token and id_token_hint) or (login_hint and id_token_hint) or (login_hint_token and login_hint):
-            msg = "Only one of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
-            raise ValueError(msg)
-
-        requests_kwargs = requests_kwargs or {}
-
-        if scope is not None and not isinstance(scope, str):
-            try:
-                scope = " ".join(scope)
-            except Exception as exc:
-                msg = "Unsupported `scope` value"
-                raise ValueError(msg) from exc
-
-        if acr_values is not None and not isinstance(acr_values, str):
-            try:
-                acr_values = " ".join(acr_values)
-            except Exception as exc:
-                msg = "Unsupported `acr_values`"
-                raise ValueError(msg) from exc
-
-        data = dict(
-            ciba_kwargs,
-            scope=scope,
-            client_notification_token=client_notification_token,
-            acr_values=acr_values,
-            login_hint_token=login_hint_token,
-            id_token_hint=id_token_hint,
-            login_hint=login_hint,
-            binding_message=binding_message,
-            user_code=user_code,
-            requested_expiry=requested_expiry,
-        )
-
-        if private_jwk is not None:
-            data = {"request": str(Jwt.sign(data, key=private_jwk, alg=alg))}
-
-        return self._request(
-            "backchannel_authentication_endpoint",
-            data=data,
-            auth=self.auth,
-            on_success=self.parse_backchannel_authentication_response,
-            on_failure=self.on_backchannel_authentication_error,
-            **requests_kwargs,
-        )
-
-    def parse_backchannel_authentication_response(
-        self, response: requests.Response
-    ) -> BackChannelAuthenticationResponse:
-        """Parse a response received by `backchannel_authentication_request()`.
-
-        Invoked by
-        [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
-        to parse the response returned by the BackChannel Authentication Endpoint.
-
-        Args:
-            response: the response returned by the BackChannel Authentication Endpoint.
-
-        Returns:
-            a `BackChannelAuthenticationResponse`
-
-        """
-        try:
-            return BackChannelAuthenticationResponse(**response.json())
-        except TypeError as exc:
-            raise InvalidBackChannelAuthenticationResponse(response) from exc
-
-    def on_backchannel_authentication_error(self, response: requests.Response) -> BackChannelAuthenticationResponse:
-        """Error handler for `backchannel_authentication_request()`.
-
-        Invoked by
-        [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
-        to parse the response returned by the BackChannel Authentication Endpoint, when it is an
-        error.
-
-        Args:
-            response: the response returned by the BackChannel Authentication Endpoint.
-
-        Returns:
-            usually raises an exception. But a subclass can return a default response instead.
-
-        """
-        try:
-            data = response.json()
-            error = data["error"]
-            error_description = data.get("error_description")
-            error_uri = data.get("error_uri")
-            exception_class = self.exception_classes.get(error, BackChannelAuthenticationError)
-            exception = exception_class(error, error_description, error_uri)
-        except Exception as exc:
-            raise InvalidBackChannelAuthenticationResponse(response) from exc
-        raise exception
-
-    def authorize_device(
-        self, requests_kwargs: dict[str, Any] | None = None, **data: Any
-    ) -> DeviceAuthorizationResponse:
-        """Send a Device Authorization Request.
-
-        Args:
-            **data: additional data to send to the Device Authorization Endpoint
-            requests_kwargs: additional parameters for `requests.request()`
-
-        Returns:
-            a Device Authorization Response
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        return self._request(
-            "device_authorization_endpoint",
-            data=data,
-            auth=self.auth,
-            on_success=self.parse_device_authorization_response,
-            on_failure=self.on_device_authorization_error,
-            **requests_kwargs,
-        )
-
-    def parse_device_authorization_response(self, response: requests.Response) -> DeviceAuthorizationResponse:
-        """Parse a Device Authorization Response received by `authorize_device()`.
-
-        Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
-        to parse the response returned by the Device Authorization Endpoint.
-
-        Args:
-            response: the response returned by the Device Authorization Endpoint.
-
-        Returns:
-            a `DeviceAuthorizationResponse` as returned by AS
-
-        """
-        device_authorization_response = DeviceAuthorizationResponse(**response.json())
-        return device_authorization_response
-
-    def on_device_authorization_error(self, response: requests.Response) -> DeviceAuthorizationResponse:
-        """Error handler for `authorize_device()`.
-
-        Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
-        to parse the response returned by the Device Authorization Endpoint, when that response is
-        an error.
-
-        Args:
-            response: the response returned by the Device Authorization Endpoint.
-
-        Returns:
-            usually raises an Exception. But a subclass may return a default response instead.
-
-        """
-        try:
-            data = response.json()
-            error = data["error"]
-            error_description = data.get("error_description")
-            error_uri = data.get("error_uri")
-            exception_class = self.exception_classes.get(error, DeviceAuthorizationError)
-            exception = exception_class(response, error, error_description, error_uri)
-        except Exception as exc:
-            raise InvalidDeviceAuthorizationResponse(response) from exc
-        raise exception
-
-    def update_authorization_server_public_keys(self, requests_kwargs: dict[str, Any] | None = None) -> JwkSet:
-        """Update the cached AS public keys by retrieving them from its `jwks_uri`.
-
-        Public keys are returned by this method, as a `jwskate.JwkSet`. They are also
-        available in attribute `authorization_server_jwks`.
-
-        Returns:
-            the retrieved public keys
-
-        Raises:
-            ValueError: if no `jwks_uri` is configured
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        jwks = self._request(
-            "jwks_uri",
-            auth=None,
-            method="GET",
-            on_success=lambda resp: resp.json(),
-            on_failure=lambda resp: resp.raise_for_status(),
-            **requests_kwargs,
-        )
-        self.authorization_server_jwks.update(jwks)
-        return self.authorization_server_jwks
-
-    @classmethod
-    def from_discovery_endpoint(
-        cls,
-        url: str | None = None,
-        issuer: str | None = None,
-        *,
-        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
-        client_id: str | None = None,
-        client_secret: str | None = None,
-        private_key: Jwk | dict[str, Any] | None = None,
-        session: requests.Session | None = None,
-        testing: bool = False,
-        **kwargs: Any,
-    ) -> OAuth2Client:
-        """Initialise an OAuth2Client based on Authorization Server Metadata.
-
-        This will retrieve the standardised metadata document available at `url`, and will extract
-        all Endpoint Uris from that document, will fetch the current public keys from its
-        `jwks_uri`, then will initialise an OAuth2Client based on those endpoints.
-
-        Args:
-             url: the url where the server metadata will be retrieved
-             auth: the authentication handler to use for client authentication
-             client_id: client ID
-             client_secret: client secret to use to authenticate the client
-             private_key: private key to sign client assertions
-             session: a `requests.Session` to use to retrieve the document and initialise the client with
-             issuer: if an issuer is given, check that it matches the one from the retrieved document
-             testing: if True, don't try to validate the endpoint urls that are part of the document
-             **kwargs: additional keyword parameters to pass to OAuth2Client
-
-        Returns:
-            an OAuth2Client with endpoint initialised based on the obtained metadata
-
-        Raises:
-            ValueError: if neither `url` nor `issuer` are suitable urls
-            requests.HTTPError: if an error happens while fetching the documents
-
-        """
-        if url is None and issuer is not None:
-            url = oidc_discovery_document_url(issuer)
-        if url is None:
-            msg = "Please specify at least one of `issuer` or `url`"
-            raise ValueError(msg)
-
-        validate_endpoint_uri(url, path=False)
-
-        session = session or requests.Session()
-        discovery = session.get(url).json()
-
-        jwks_uri = discovery.get("jwks_uri")
-        if jwks_uri:
-            jwks = JwkSet(session.get(jwks_uri).json())
-
-        return cls.from_discovery_document(
-            discovery,
-            issuer=issuer,
-            auth=auth,
-            session=session,
-            client_id=client_id,
-            client_secret=client_secret,
-            private_key=private_key,
-            authorization_server_jwks=jwks,
-            testing=testing,
-            **kwargs,
-        )
-
-    @classmethod
-    def from_discovery_document(  # noqa: PLR0913
-        cls,
-        discovery: dict[str, Any],
-        issuer: str | None = None,
-        *,
-        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
-        client_id: str | None = None,
-        client_secret: str | None = None,
-        private_key: Jwk | dict[str, Any] | None = None,
-        authorization_server_jwks: JwkSet | dict[str, Any] | None = None,
-        session: requests.Session | None = None,
-        https: bool = True,
-        testing: bool = False,
-        **kwargs: Any,
-    ) -> OAuth2Client:
-        """Initialise an OAuth2Client, based on the server metadata from `discovery`.
-
-        Args:
-             discovery: a dict of server metadata, in the same format as retrieved from a discovery endpoint.
-             issuer: if an issuer is given, check that it matches the one mentioned in the document
-             auth: the authentication handler to use for client authentication
-             client_id: client ID
-             client_secret: client secret to use to authenticate the client
-             private_key: private key to sign client assertions
-             authorization_server_jwks: the current authorization server JWKS keys
-             session: a requests Session to use to retrieve the document and initialise the client with
-             https: (deprecated) if `True`, validates that urls in the discovery document use the https scheme
-             testing: if True, don't try to validate the endpoint urls that are part of the document
-             **kwargs: additional args that will be passed to OAuth2Client
-
-        Returns:
-            an `OAuth2Client`
-
-        """
-        if not https:
-            warnings.warn(
-                "The https parameter is deprecated."
-                " To disable endpoint uri validation, set `testing=True` when initializing your OAuth2Client.",
-                stacklevel=1,
-            )
-            testing = True
-        if issuer and discovery.get("issuer") != issuer:
-            msg = "Mismatching issuer value in discovery document: "
-            raise ValueError(
-                msg,
-                issuer,
-                discovery.get("issuer"),
-            )
-        elif issuer is None:
-            issuer = discovery.get("issuer")
-
-        token_endpoint = discovery.get("token_endpoint")
-        if token_endpoint is None:
-            msg = "token_endpoint not found in that discovery document"
-            raise ValueError(msg)
-        authorization_endpoint = discovery.get("authorization_endpoint")
-        revocation_endpoint = discovery.get("revocation_endpoint")
-        introspection_endpoint = discovery.get("introspection_endpoint")
-        userinfo_endpoint = discovery.get("userinfo_endpoint")
-        jwks_uri = discovery.get("jwks_uri")
-        if jwks_uri is not None:
-            validate_endpoint_uri(jwks_uri, https=https)
-        authorization_response_iss_parameter_supported = discovery.get(
-            "authorization_response_iss_parameter_supported", False
-        )
-
-        return cls(
-            token_endpoint=token_endpoint,
-            authorization_endpoint=authorization_endpoint,
-            revocation_endpoint=revocation_endpoint,
-            introspection_endpoint=introspection_endpoint,
-            userinfo_endpoint=userinfo_endpoint,
-            jwks_uri=jwks_uri,
-            authorization_server_jwks=authorization_server_jwks,
-            auth=auth,
-            client_id=client_id,
-            client_secret=client_secret,
-            private_key=private_key,
-            session=session,
-            issuer=issuer,
-            authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
-            testing=testing,
-            **kwargs,
-        )
-
-    def __enter__(self) -> OAuth2Client:
-        """Allow using `OAuth2Client` as a context-manager.
-
-        The Authorization Server public keys are retrieved on `__enter__`.
-
-        """
-        self.update_authorization_server_public_keys()
-        return self
-
-    def __exit__(self, exc_type: Any, exc_val: Any, exc_tb: Any) -> bool:  # noqa: D105
-        return True
-
-    def _require_endpoint(self, endpoint: str) -> str:
-        """Check that a required endpoint url is set."""
-        url = getattr(self, endpoint, None)
-        if not url:
-            msg = (
-                f"No '{endpoint}' defined for this client. Please provide the URL for that"
-                f" endpoint when initializing your {self.__class__.__name__} instance."
-            )
-            raise AttributeError(msg)
-
-        return str(url)
-
-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
auth_req_id + str + +
+

the auth_req_id as returned by the AS.

+
+ 		+ required +
expires_at + datetime | None + +
+

the date when the auth_req_id expires. +Note that this request also accepts an expires_in parameter, in seconds.

+
+ 		+ None +
interval + int | None + +
+

the Token Endpoint pooling interval, in seconds, as returned by the AS.

+
+ 		+ 20 +
**kwargs + Any + +
+

any additional custom parameters as returned by the AS.

+
+ 		+ {} +
+ +
+ Source code in requests_oauth2client/backchannel_authentication.py + 
26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
+69
+70
+71
+72
+73
+74
+75
+76
+77
+78
+79
+80
+81
+82
+83
+84
+85
+86
+87
+88
+89
+90
+91
+92
+93
+94
class BackChannelAuthenticationResponse:
+    """Represent a BackChannel Authentication Response.
+
+    This contains all the parameters that are returned by the AS as a result of a BackChannel
+    Authentication Request, such as `auth_req_id` (required), and the optional `expires_at`,
+    `interval`, and/or any custom parameters.
+
+    Args:
+        auth_req_id: the `auth_req_id` as returned by the AS.
+        expires_at: the date when the `auth_req_id` expires.
+            Note that this request also accepts an `expires_in` parameter, in seconds.
+        interval: the Token Endpoint pooling interval, in seconds, as returned by the AS.
+        **kwargs: any additional custom parameters as returned by the AS.
+
+    """
+
+    @accepts_expires_in
+    def __init__(
+        self,
+        auth_req_id: str,
+        expires_at: datetime | None = None,
+        interval: int | None = 20,
+        **kwargs: Any,
+    ) -> None:
+        self.auth_req_id = auth_req_id
+        self.expires_at = expires_at
+        self.interval = interval
+        self.other = kwargs
+
+    def is_expired(self, leeway: int = 0) -> bool | None:
+        """Return `True` if the `auth_req_id` within this response is expired.
+
+        Expiration is evaluated at the time of the call. If there is no "expires_at" hint (which is
+        derived from the `expires_in` hint returned by the AS BackChannel Authentication endpoint),
+        this will return `None`.
+
+        Returns:
+            `True` if the auth_req_id is expired, `False` if it is still valid, `None` if there is
+            no `expires_in` hint.
+
+        """
+        if self.expires_at:
+            return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
+        return None
+
+    @property
+    def expires_in(self) -> int | None:
+        """Number of seconds until expiration."""
+        if self.expires_at:
+            return ceil((self.expires_at - datetime.now(tz=timezone.utc)).total_seconds())
+        return None
+
+    def __getattr__(self, key: str) -> Any:
+        """Return attributes from this `BackChannelAuthenticationResponse`.
+
+        Allows accessing response parameters with `token_response.expires_in` or
+        `token_response.any_custom_attribute`.
+
+        Args:
+            key: a key
+
+        Returns:
+            the associated value in this token response
+
+        Raises:
+            AttributeError: if the attribute is not present in the response
+
+        """
+        return self.other.get(key) or super().__getattribute__(key)
+
+
+ -
@@ -22134,8934 +20391,11593 @@

-

- client_id: str - +

+ expires_in: int | None + property -

+ -
- -

Client ID.

-
+
+ +

Number of seconds until expiration.

+
-
+
-

- client_secret: str | None - - - property - -

+

+ is_expired(leeway=0) +

-
- -

Client Secret.

-
-
+
-
+

Return True if the auth_req_id within this response is expired.

+

Expiration is evaluated at the time of the call. If there is no "expires_at" hint (which is +derived from the expires_in hint returned by the AS BackChannel Authentication endpoint), +this will return None.

+

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ bool | None + +
+

True if the auth_req_id is expired, False if it is still valid, None if there is

+
+
+ bool | None + +
+

no expires_in hint.

+
+
-

- client_jwks: JwkSet - - - property - +
+ Source code in requests_oauth2client/backchannel_authentication.py + 
55
+56
+57
+58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
+69
def is_expired(self, leeway: int = 0) -> bool | None:
+    """Return `True` if the `auth_req_id` within this response is expired.
+
+    Expiration is evaluated at the time of the call. If there is no "expires_at" hint (which is
+    derived from the `expires_in` hint returned by the AS BackChannel Authentication endpoint),
+    this will return `None`.
+
+    Returns:
+        `True` if the auth_req_id is expired, `False` if it is still valid, `None` if there is
+        no `expires_in` hint.
+
+    """
+    if self.expires_at:
+        return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
+    return None
+
+
+

+ +
- -
- -

A JwkSet containing the public keys for this client.

-

Keys are:

-
    -
  • the public key for client assertion signature verification (if using private_key_jwt)
    • -
  • the ID Token encryption key
    • -
+
+
+
+ + + +

+ Endpoints + + +

+ + +
+

+ Bases: str, Enum

+ + +

All standardised OAuth 2.0 and extensions endpoints.

+

If an endpoint is not mentioned here, then its usage is not supported by OAuth2Client.

+ +
+ Source code in requests_oauth2client/client.py + 
167
+168
+169
+170
+171
+172
+173
+174
+175
+176
+177
+178
+179
+180
+181
+182
class Endpoints(str, Enum):
+    """All standardised OAuth 2.0 and extensions endpoints.
+
+    If an endpoint is not mentioned here, then its usage is not supported by OAuth2Client.
+
+    """
+
+    TOKEN = "token_endpoint"
+    AUTHORIZATION = "authorization_endpoint"
+    BACKCHANNEL_AUTHENTICATION = "backchannel_authentication_endpoint"
+    DEVICE_AUTHORIZATION = "device_authorization_endpoint"
+    INSTROSPECTION = "introspection_endpoint"
+    REVOCATION = "revocation_endpoint"
+    PUSHED_AUTHORIZATION_REQUEST = "pushed_authorization_request_endpoint"
+    JWKS = "jwks_uri"
+    USER_INFO = "userinfo_endpoint"
+
+
+ + + +
+ -
-

- validate_endpoint_uri(attribute, uri) -

-
- -

Validate that an endpoint URI is suitable for use.

-

If you need to disable some checks (for AS testing purposes only!), provide a different -method here.

-
- Source code in requests_oauth2client/client.py - 
255
-256
-257
-258
-259
-260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
@token_endpoint.validator
-@revocation_endpoint.validator
-@introspection_endpoint.validator
-@userinfo_endpoint.validator
-@authorization_endpoint.validator
-@backchannel_authentication_endpoint.validator
-@device_authorization_endpoint.validator
-@pushed_authorization_request_endpoint.validator
-@jwks_uri.validator
-def validate_endpoint_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
-    """Validate that an endpoint URI is suitable for use.
-
-    If you need to disable some checks (for AS testing purposes only!), provide a different
-    method here.
-
-    """
-    if self.testing or uri is None:
-        return uri
-    try:
-        return validate_endpoint_uri(uri)
-    except ValueError as exc:
-        msg = f"Invalid value '{uri}' for '{attribute.name}': {exc}"
-        raise ValueError(msg) from exc
-
-
+
+
+
-
+

+ GrantTypes -

- validate_issuer_uri(attribute, uri) -

+ -
- -

Validate that an Issuer identifier is suitable for use.

-

This is the same check as an endpoint URI, but the path may be (and usually is) empty.

+
+

+ Bases: str, Enum

-
- Source code in requests_oauth2client/client.py - 
279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
@issuer.validator
-def validate_issuer_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
-    """Validate that an Issuer identifier is suitable for use.
-
-    This is the same check as an endpoint URI, but the path may be (and usually is) empty.
-
-    """
-    if self.testing or uri is None:
-        return uri
-    try:
-        return validate_issuer_uri(uri)
-    except ValueError as exc:
-        msg = f"Invalid value '{uri}' for '{attribute.name}': {exc}"
-        raise ValueError(msg) from exc
-
-
-
-
+

An enum of standardized grant_type values.

+ +
+ Source code in requests_oauth2client/client.py + 
192
+193
+194
+195
+196
+197
+198
+199
+200
+201
+202
class GrantTypes(str, Enum):
+    """An enum of standardized `grant_type` values."""
+
+    CLIENT_CREDENTIALS = "client_credentials"
+    AUTHORIZATION_CODE = "authorization_code"
+    REFRESH_TOKEN = "refresh_token"
+    RESOURCE_OWNER_PASSWORD = "password"
+    TOKEN_EXCHANGE = "urn:ietf:params:oauth:grant-type:token-exchange"
+    JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer"
+    CLIENT_INITIATED_BACKCHANNEL_AUTHENTICATION = "urn:openid:params:grant-type:ciba"
+    DEVICE_CODE = "urn:ietf:params:oauth:grant-type:device_code"
+
+
+ + + +
-
-

- token_request(data, timeout=10, **requests_kwargs) -

-
- -

Send a request to the token endpoint.

-

Authentication will be added automatically based on the defined auth for this client.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
data - dict[str, Any] - -
-

parameters to send to the token endpoint. Items with a None - or empty value will not be sent in the request.

-
- 		- required -
timeout - int - -
-

a timeout value for the call

-
- 		- 10 -
**requests_kwargs - Any - -
-

additional parameters for requests.post()

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

the token endpoint response, as

-
-
- BearerToken - -
-

BearerToken instance.

-
-
- -
- Source code in requests_oauth2client/client.py - 
369
-370
-371
-372
-373
-374
-375
-376
-377
-378
-379
-380
-381
-382
-383
-384
-385
-386
-387
-388
-389
-390
-391
-392
-393
-394
-395
-396
-397
-398
def token_request(
-    self,
-    data: dict[str, Any],
-    timeout: int = 10,
-    **requests_kwargs: Any,
-) -> BearerToken:
-    """Send a request to the token endpoint.
-
-    Authentication will be added automatically based on the defined `auth` for this client.
-
-    Args:
-      data: parameters to send to the token endpoint. Items with a `None`
-           or empty value will not be sent in the request.
-      timeout: a timeout value for the call
-      **requests_kwargs: additional parameters for requests.post()
-
-    Returns:
-        the token endpoint response, as
-        [`BearerToken`][requests_oauth2client.tokens.BearerToken] instance.
-
-    """
-    return self._request(
-        "token_endpoint",
-        auth=self.auth,
-        data=data,
-        timeout=timeout,
-        on_success=self.parse_token_response,
-        on_failure=self.on_token_error,
-        **requests_kwargs,
-    )
-
-
+
+
+
-
+

+ InvalidAcrValuesParam -

- parse_token_response(response) -

+ -
- -

Parse a Response returned by the Token Endpoint.

-

Invoked by token_request to parse -responses returned by the Token Endpoint. Those responses contain an access_token and -additional attributes.

+
+

+ Bases: InvalidParam

+

Raised when an invalid 'acr_values' parameter is provided.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the Response returned by the Token Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken based on the response

-
-
- BearerToken - -
-

contents.

-
-
- -
- Source code in requests_oauth2client/client.py - 
400
-401
-402
-403
-404
-405
-406
-407
-408
-409
-410
-411
-412
-413
-414
-415
-416
-417
-418
-419
-420
-421
-422
-423
def parse_token_response(self, response: requests.Response) -> BearerToken:
-    """Parse a Response returned by the Token Endpoint.
-
-    Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] to parse
-    responses returned by the Token Endpoint. Those responses contain an `access_token` and
-    additional attributes.
-
-    Args:
-        response: the [Response][requests.Response] returned by the Token Endpoint.
-
-    Returns:
-        a [`BearerToken`][requests_oauth2client.tokens.BearerToken] based on the response
-        contents.
-
-    """
-    try:
-        token_response = self.bearer_token_class(**response.json())
-    except Exception as response_class_exc:
-        try:
-            return self.on_token_error(response)
-        except Exception as token_error_exc:
-            raise token_error_exc from response_class_exc
-    else:
-        return token_response
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
151
+152
+153
+154
+155
+156
class InvalidAcrValuesParam(InvalidParam):
+    """Raised when an invalid 'acr_values' parameter is provided."""
+
+    def __init__(self, acr_values: object) -> None:
+        super().__init__(f"Invalid 'acr_values' parameter: {acr_values}")
+        self.acr_values = acr_values
+
+
-
-
+
+ + -

- on_token_error(response) -

-
- -

Error handler for token_request().

-

Invoked by token_request when the -Token Endpoint returns an error.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the Response returned by the Token Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

nothing, and raises an exception instead. But a subclass may return a

-
-
- BearerToken - -
-

BearerToken to implement a default

-
-
- BearerToken - -
-

behaviour if needed.

-
-
- -
- Source code in requests_oauth2client/client.py - 
425
-426
-427
-428
-429
-430
-431
-432
-433
-434
-435
-436
-437
-438
-439
-440
-441
-442
-443
-444
-445
-446
-447
-448
-449
def on_token_error(self, response: requests.Response) -> BearerToken:
-    """Error handler for `token_request()`.
-
-    Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] when the
-    Token Endpoint returns an error.
-
-    Args:
-        response: the [Response][requests.Response] returned by the Token Endpoint.
-
-    Returns:
-        nothing, and raises an exception instead. But a subclass may return a
-        [`BearerToken`][requests_oauth2client.tokens.BearerToken] to implement a default
-        behaviour if needed.
-
-    """
-    try:
-        data = response.json()
-        error = data["error"]
-        error_description = data.get("error_description")
-        error_uri = data.get("error_uri")
-        exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
-        exception = exception_class(response, error, error_description, error_uri)
-    except Exception as exc:
-        raise InvalidTokenResponse(response) from exc
-    raise exception
-
-
+
+
+
-
+

+ InvalidBackchannelAuthenticationRequestHintParam -

- client_credentials(scope=None, *, requests_kwargs=None, **token_kwargs) -

+ -
- -

Send a request to the token endpoint using the client_credentials grant.

+
+

+ Bases: InvalidParam

+

Raised when an invalid hint is provided in a backchannel authentication request.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
scope - str | Iterable[str] | None - -
-

the scope to send with the request. Can be a str, or an iterable of str. -to pass that way include scope, audience, resource, etc.

-
- 		- None -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the call to requests

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters for the token endpoint, alongside grant_type. Common parameters

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a TokenResponse

-
-
- -
- Source code in requests_oauth2client/client.py - 
451
-452
-453
-454
-455
-456
-457
-458
-459
-460
-461
-462
-463
-464
-465
-466
-467
-468
-469
-470
-471
-472
-473
-474
-475
-476
-477
-478
-479
-480
def client_credentials(
-    self,
-    scope: str | Iterable[str] | None = None,
-    *,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a request to the token endpoint using the `client_credentials` grant.
-
-    Args:
-        scope: the scope to send with the request. Can be a str, or an iterable of str.
-            to pass that way include `scope`, `audience`, `resource`, etc.
-        requests_kwargs: additional parameters for the call to requests
-        **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`. Common parameters
-
-    Returns:
-        a TokenResponse
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    if scope and not isinstance(scope, str):
-        try:
-            scope = " ".join(scope)
-        except Exception as exc:
-            msg = "Unsupported scope value"
-            raise ValueError(msg) from exc
-
-    data = dict(grant_type=GrantType.CLIENT_CREDENTIALS, scope=scope, **token_kwargs)
-    return self.token_request(data, **requests_kwargs)
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
147
+148
class InvalidBackchannelAuthenticationRequestHintParam(InvalidParam):
+    """Raised when an invalid hint is provided in a backchannel authentication request."""
+
+
+ +
+
-
+

+ InvalidDiscoveryDocument -

- authorization_code(code, *, validate=True, requests_kwargs=None, **token_kwargs) -

+ -
- -

Send a request to the token endpoint with the authorization_code grant.

+
+

+ Bases: ValueError

+

Raised when handling an invalid Discovery Document.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
code - str | AuthorizationResponse - -
-

an authorization code or an AuthorizationResponse to exchange for tokens

-
- 		- required -
validate - bool - -
-

if True, validate the received ID Token (this works only if code is an AuthorizationResponse)

-
- 		- True -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the call to requests

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters for the token endpoint, alongside grant_type, code, etc.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/client.py - 
482
-483
-484
-485
-486
-487
-488
-489
-490
-491
-492
-493
-494
-495
-496
-497
-498
-499
-500
-501
-502
-503
-504
-505
-506
-507
-508
-509
-510
-511
-512
-513
-514
-515
def authorization_code(
-    self,
-    code: str | AuthorizationResponse,
-    *,
-    validate: bool = True,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a request to the token endpoint with the `authorization_code` grant.
-
-    Args:
-         code: an authorization code or an `AuthorizationResponse` to exchange for tokens
-         validate: if `True`, validate the received ID Token (this works only if `code` is an AuthorizationResponse)
-         requests_kwargs: additional parameters for the call to requests
-         **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `code`, etc.
-
-    Returns:
-        a `BearerToken`
-
-    """
-    azr: AuthorizationResponse | None = None
-    if isinstance(code, AuthorizationResponse):
-        token_kwargs.setdefault("code_verifier", code.code_verifier)
-        token_kwargs.setdefault("redirect_uri", code.redirect_uri)
-        azr = code
-        code = code.code
-
-    requests_kwargs = requests_kwargs or {}
-
-    data = dict(grant_type=GrantType.AUTHORIZATION_CODE, code=code, **token_kwargs)
-    token = self.token_request(data, **requests_kwargs)
-    if validate and token.id_token and isinstance(azr, AuthorizationResponse):
-        return token.validate_id_token(self, azr)
-    return token
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
159
+160
+161
+162
+163
+164
class InvalidDiscoveryDocument(ValueError):
+    """Raised when handling an invalid Discovery Document."""
+
+    def __init__(self, message: str, discovery_document: dict[str, Any]) -> None:
+        super().__init__(f"Invalid discovery document: {message}")
+        self.discovery_document = discovery_document
+
+
-
-
+
+ + -

- refresh_token(refresh_token, requests_kwargs=None, **token_kwargs) -

-
- -

Send a request to the token endpoint with the refresh_token grant.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
refresh_token - str | BearerToken - -
-

a refresh_token, as a string, or as a BearerToken. -That BearerToken must have a refresh_token.

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the call to requests

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters for the token endpoint, -alongside grant_type, refresh_token, etc.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/client.py - 
517
-518
-519
-520
-521
-522
-523
-524
-525
-526
-527
-528
-529
-530
-531
-532
-533
-534
-535
-536
-537
-538
-539
-540
-541
-542
-543
-544
def refresh_token(
-    self,
-    refresh_token: str | BearerToken,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a request to the token endpoint with the `refresh_token` grant.
-
-    Args:
-        refresh_token: a refresh_token, as a string, or as a `BearerToken`.
-            That `BearerToken` must have a `refresh_token`.
-        requests_kwargs: additional parameters for the call to `requests`
-        **token_kwargs: additional parameters for the token endpoint,
-            alongside `grant_type`, `refresh_token`, etc.
-
-    Returns:
-        a `BearerToken`
-
-    """
-    if isinstance(refresh_token, BearerToken):
-        if refresh_token.refresh_token is None or not isinstance(refresh_token.refresh_token, str):
-            msg = "This BearerToken doesn't have a refresh_token"
-            raise ValueError(msg)
-        refresh_token = refresh_token.refresh_token
-
-    requests_kwargs = requests_kwargs or {}
-    data = dict(grant_type=GrantType.REFRESH_TOKEN, refresh_token=refresh_token, **token_kwargs)
-    return self.token_request(data, **requests_kwargs)
-
-
+
+
+
-
+

+ InvalidEndpointUri -

- device_code(device_code, requests_kwargs=None, **token_kwargs) -

+ -
- -

Send a request to the token endpoint using the Device Code grant.

-

The grant_type is urn:ietf:params:oauth:grant-type:device_code. This needs a Device Code, -or a DeviceAuthorizationResponse as parameter.

+
+

+ Bases: InvalidParam

+

Raised when an invalid endpoint uri is provided.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
device_code - str | DeviceAuthorizationResponse - -
-

a device code, or a DeviceAuthorizationResponse

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the call to requests

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters for the token endpoint, alongside grant_type, device_code, etc.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/client.py - 
546
-547
-548
-549
-550
-551
-552
-553
-554
-555
-556
-557
-558
-559
-560
-561
-562
-563
-564
-565
-566
-567
-568
-569
-570
-571
-572
-573
-574
-575
-576
-577
-578
def device_code(
-    self,
-    device_code: str | DeviceAuthorizationResponse,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a request to the token endpoint using the Device Code grant.
-
-    The grant_type is `urn:ietf:params:oauth:grant-type:device_code`. This needs a Device Code,
-    or a `DeviceAuthorizationResponse` as parameter.
-
-    Args:
-        device_code: a device code, or a `DeviceAuthorizationResponse`
-        requests_kwargs: additional parameters for the call to requests
-        **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `device_code`, etc.
-
-    Returns:
-        a `BearerToken`
-
-    """
-    if isinstance(device_code, DeviceAuthorizationResponse):
-        if device_code.device_code is None or not isinstance(device_code.device_code, str):
-            msg = "This DeviceAuthorizationResponse doesn't have a device_code"
-            raise ValueError(msg)
-        device_code = device_code.device_code
-
-    requests_kwargs = requests_kwargs or {}
-    data = dict(
-        grant_type=GrantType.DEVICE_CODE,
-        device_code=device_code,
-        **token_kwargs,
-    )
-    return self.token_request(data, **requests_kwargs)
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
75
+76
+77
+78
+79
+80
+81
class InvalidEndpointUri(InvalidParam):
+    """Raised when an invalid endpoint uri is provided."""
+
+    def __init__(self, endpoint: str, uri: str, exc: InvalidUri) -> None:
+        super().__init__(f"Invalid endpoint uri '{uri}' for '{endpoint}': {exc}")
+        self.endpoint = endpoint
+        self.uri = uri
+
+
-
-
+
+ + -

- ciba(auth_req_id, requests_kwargs=None, **token_kwargs) -

-
- -

Send a CIBA request to the Token Endpoint.

-

A CIBA request is a Token Request using the urn:openid:params:grant-type:ciba grant.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
auth_req_id - str | BackChannelAuthenticationResponse - -
-

an authentication request ID, as returned by the AS

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the call to requests

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters for the token endpoint, alongside grant_type, auth_req_id, etc.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/client.py - 
580
-581
-582
-583
-584
-585
-586
-587
-588
-589
-590
-591
-592
-593
-594
-595
-596
-597
-598
-599
-600
-601
-602
-603
-604
-605
-606
-607
-608
-609
-610
-611
def ciba(
-    self,
-    auth_req_id: str | BackChannelAuthenticationResponse,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a CIBA request to the Token Endpoint.
-
-    A CIBA request is a Token Request using the `urn:openid:params:grant-type:ciba` grant.
-
-    Args:
-        auth_req_id: an authentication request ID, as returned by the AS
-        requests_kwargs: additional parameters for the call to requests
-        **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `auth_req_id`, etc.
-
-    Returns:
-        a `BearerToken`
-
-    """
-    if isinstance(auth_req_id, BackChannelAuthenticationResponse):
-        if auth_req_id.auth_req_id is None or not isinstance(auth_req_id.auth_req_id, str):
-            msg = "This `BackChannelAuthenticationResponse` doesn't have an `auth_req_id`"
-            raise ValueError(msg)
-        auth_req_id = auth_req_id.auth_req_id
-
-    requests_kwargs = requests_kwargs or {}
-    data = dict(
-        grant_type=GrantType.CLIENT_INITIATED_BACKCHANNEL_AUTHENTICATION,
-        auth_req_id=auth_req_id,
-        **token_kwargs,
-    )
-    return self.token_request(data, **requests_kwargs)
-
-
+
+
+
-
+

+ InvalidIssuer -

- token_exchange(subject_token, subject_token_type=None, actor_token=None, actor_token_type=None, requested_token_type=None, requests_kwargs=None, **token_kwargs) -

+ -
- -

Send a Token Exchange request.

-

A Token Exchange request is actually a request to the Token Endpoint with a grant_type -urn:ietf:params:oauth:grant-type:token-exchange.

+
+

+ Bases: InvalidEndpointUri

+

Raised when an invalid issuer parameter is provided.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
subject_token - str | BearerToken | IdToken - -
-

the subject token to exchange for a new token.

-
- 		- required -
subject_token_type - str | None - -
-

a token type identifier for the subject_token, mandatory if it cannot be guessed based -on type(subject_token).

-
- 		- None -
actor_token - None | str | BearerToken | IdToken - -
-

the actor token to include in the request, if any.

-
- 		- None -
actor_token_type - str | None - -
-

a token type identifier for the actor_token, mandatory if it cannot be guessed based -on type(actor_token).

-
- 		- None -
requested_token_type - str | None - -
-

a token type identifier for the requested token.

-
- 		- None -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters to pass to the underlying requests.post() call.

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters to include in the request body.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken as returned by the Authorization Server.

-
-
- -
- Source code in requests_oauth2client/client.py - 
613
-614
-615
-616
-617
-618
-619
-620
-621
-622
-623
-624
-625
-626
-627
-628
-629
-630
-631
-632
-633
-634
-635
-636
-637
-638
-639
-640
-641
-642
-643
-644
-645
-646
-647
-648
-649
-650
-651
-652
-653
-654
-655
-656
-657
-658
-659
-660
-661
-662
-663
-664
-665
-666
def token_exchange(
-    self,
-    subject_token: str | BearerToken | IdToken,
-    subject_token_type: str | None = None,
-    actor_token: None | str | BearerToken | IdToken = None,
-    actor_token_type: str | None = None,
-    requested_token_type: str | None = None,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a Token Exchange request.
-
-    A Token Exchange request is actually a request to the Token Endpoint with a grant_type
-    `urn:ietf:params:oauth:grant-type:token-exchange`.
-
-    Args:
-        subject_token: the subject token to exchange for a new token.
-        subject_token_type: a token type identifier for the subject_token, mandatory if it cannot be guessed based
-            on `type(subject_token)`.
-        actor_token: the actor token to include in the request, if any.
-        actor_token_type: a token type identifier for the actor_token, mandatory if it cannot be guessed based
-            on `type(actor_token)`.
-        requested_token_type: a token type identifier for the requested token.
-        requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
-        **token_kwargs: additional parameters to include in the request body.
-
-    Returns:
-        a `BearerToken` as returned by the Authorization Server.
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    try:
-        subject_token_type = self.get_token_type(subject_token_type, subject_token)
-    except ValueError:
-        msg = "Cannot determine the kind of 'subject_token' you provided. Please specify a 'subject_token_type'."
-        raise TypeError(msg) from None
-    if actor_token:  # pragma: no branch
-        try:
-            actor_token_type = self.get_token_type(actor_token_type, actor_token)
-        except ValueError:
-            msg = "Cannot determine the kind of 'actor_token' you provided. Please specify an 'actor_token_type'."
-            raise TypeError(msg) from None
-
-    data = dict(
-        grant_type=GrantType.TOKEN_EXCHANGE,
-        subject_token=subject_token,
-        subject_token_type=subject_token_type,
-        actor_token=actor_token,
-        actor_token_type=actor_token_type,
-        requested_token_type=requested_token_type,
-        **token_kwargs,
-    )
-    return self.token_request(data, **requests_kwargs)
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
84
+85
class InvalidIssuer(InvalidEndpointUri):
+    """Raised when an invalid issuer parameter is provided."""
+
+
-
-
+
+ + -

- jwt_bearer(assertion, requests_kwargs=None, **token_kwargs) -

-
- -

Send a request using a JWT as authorization grant.

-

This is defined in (RFC7523 $2.1)[https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1).

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
assertion - Jwt | str - -
-

a JWT (as an instance of jwskate.Jwt or as a str) to use as authorization grant.

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters to pass to the underlying requests.post() call.

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters to include in the request body.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken as returned by the Authorization Server.

-
-
- -
- Source code in requests_oauth2client/client.py - 
668
-669
-670
-671
-672
-673
-674
-675
-676
-677
-678
-679
-680
-681
-682
-683
-684
-685
-686
-687
-688
-689
-690
-691
-692
-693
-694
-695
-696
-697
-698
def jwt_bearer(
-    self,
-    assertion: Jwt | str,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a request using a JWT as authorization grant.
-
-    This is defined in (RFC7523 $2.1)[https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1).
-
-    Args:
-        assertion: a JWT (as an instance of `jwskate.Jwt` or as a `str`) to use as authorization grant.
-        requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
-        **token_kwargs: additional parameters to include in the request body.
-
-    Returns:
-        a `BearerToken` as returned by the Authorization Server.
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    if not isinstance(assertion, Jwt):
-        assertion = Jwt(assertion)
-
-    data = dict(
-        grant_type=GrantType.JWT_BEARER,
-        assertion=assertion,
-        **token_kwargs,
-    )
-
-    return self.token_request(data, **requests_kwargs)
-
-
+
+
+
-
+

+ InvalidParam -

- resource_owner_password(username, password, requests_kwargs=None, **token_kwargs) -

+ -
- -

Send a request using the Resource Owner Password Grant.

-

This Grant Type is deprecated and should only be used when there is no other choice.

+
+

+ Bases: ValueError

+

Base class for invalid parameters errors.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
username - str - -
-

the resource owner user name

-
- 		- required -
password - str - -
-

the resource owner password

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters to pass to the underlying requests.post() call.

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters to include in the request body.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken as returned by the Authorization Server

-
-
- -
- Source code in requests_oauth2client/client.py - 
700
-701
-702
-703
-704
-705
-706
-707
-708
-709
-710
-711
-712
-713
-714
-715
-716
-717
-718
-719
-720
-721
-722
-723
-724
-725
-726
-727
-728
-729
def resource_owner_password(
-    self,
-    username: str,
-    password: str,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a request using the Resource Owner Password Grant.
-
-    This Grant Type is deprecated and should only be used when there is no other choice.
-
-    Args:
-        username: the resource owner user name
-        password: the resource owner password
-        requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
-        **token_kwargs: additional parameters to include in the request body.
-
-    Returns:
-        a `BearerToken` as returned by the Authorization Server
-
-    """
-    requests_kwargs = requests_kwargs or {}
-    data = dict(
-        grant_type=GrantType.RESOURCE_OWNER_PASSWORD,
-        username=username,
-        password=password,
-        **token_kwargs,
-    )
-
-    return self.token_request(data, **requests_kwargs)
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
60
+61
class InvalidParam(ValueError):
+    """Base class for invalid parameters errors."""
+
+
+ +
+
-
+

+ InvalidScopeParam -

- authorization_request(*, scope='openid', response_type='code', redirect_uri=None, state=..., nonce=..., code_verifier=None, **kwargs) -

+ -
- -

Generate an Authorization Request for this client.

+
+

+ Bases: InvalidParam

+

Raised when an invalid scope parameter is provided.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
scope - None | str | Iterable[str] - -
-

the scope to use

-
- 		- 'openid' -
response_type - str - -
-

the response_type to use

-
- 		- 'code' -
redirect_uri - str | None - -
-

the redirect_uri to include in the request. By default, -the redirect_uri defined at init time is used.

-
- 		- None -
state - str | ellipsis | None - -
-

the state parameter to use. Leave default to generate a random value.

-
- 		- ... -
nonce - str | ellipsis | None - -
-

a nonce. Leave default to generate a random value.

-
- 		- ... -
code_verifier - str | None - -
-

the PKCE code_verifier to use. Leave default to generate a random value.

-
- 		- None -
**kwargs - Any - -
-

additional parameters to include in the auth request

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- AuthorizationRequest - -
-

an AuthorizationRequest with the supplied parameters

-
-
- -
- Source code in requests_oauth2client/client.py - 
731
-732
-733
-734
-735
-736
-737
-738
-739
-740
-741
-742
-743
-744
-745
-746
-747
-748
-749
-750
-751
-752
-753
-754
-755
-756
-757
-758
-759
-760
-761
-762
-763
-764
-765
-766
-767
-768
-769
-770
-771
-772
-773
-774
-775
-776
-777
-778
-779
-780
-781
-782
-783
-784
-785
def authorization_request(
-    self,
-    *,
-    scope: None | str | Iterable[str] = "openid",
-    response_type: str = "code",
-    redirect_uri: str | None = None,
-    state: str | ellipsis | None = ...,  # noqa: F821
-    nonce: str | ellipsis | None = ...,  # noqa: F821
-    code_verifier: str | None = None,
-    **kwargs: Any,
-) -> AuthorizationRequest:
-    """Generate an Authorization Request for this client.
-
-    Args:
-        scope: the `scope` to use
-        response_type: the `response_type` to use
-        redirect_uri: the `redirect_uri` to include in the request. By default,
-            the `redirect_uri` defined at init time is used.
-        state: the `state` parameter to use. Leave default to generate a random value.
-        nonce: a `nonce`. Leave default to generate a random value.
-        code_verifier: the PKCE `code_verifier` to use. Leave default to generate a random value.
-        **kwargs: additional parameters to include in the auth request
-
-    Returns:
-        an AuthorizationRequest with the supplied parameters
-
-    """
-    authorization_endpoint = self._require_endpoint("authorization_endpoint")
-
-    redirect_uri = redirect_uri or self.redirect_uri
-    if not redirect_uri:
-        msg = (
-            "No 'redirect_uri' defined for this client. You must either pass a redirect_uri"
-            " as parameter to this method, or include a redirect_uri when initializing your"
-            " OAuth2Client."
-        )
-        raise AttributeError(msg)
-
-    if response_type != "code":
-        msg = "Only response_type=code is supported."
-        raise ValueError(msg)
-
-    return AuthorizationRequest(
-        authorization_endpoint=authorization_endpoint,
-        client_id=self.client_id,
-        redirect_uri=redirect_uri,
-        issuer=self.issuer,
-        response_type=response_type,
-        scope=scope,
-        state=state,
-        nonce=nonce,
-        code_verifier=code_verifier,
-        code_challenge_method=self.code_challenge_method,
-        **kwargs,
-    )
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
88
+89
+90
+91
+92
+93
+94
+95
+96
+97
class InvalidScopeParam(InvalidParam):
+    """Raised when an invalid scope parameter is provided."""
+
+    def __init__(self, scope: object) -> None:
+        super().__init__("""\
+Unsupported scope value. It must be one of:
+- a space separated `str` of scopes names
+- an iterable of scope names as `str`
+""")
+        self.scope = scope
+
+
-
-
+
+ + -

- pushed_authorization_request(authorization_request, requests_kwargs=None) -

-
- -

Send a Pushed Authorization Request.

-

This sends a request to the Pushed Authorization Request Endpoint, and returns a -RequestUriParameterAuthorizationRequest initialized with the AS response.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
authorization_request - AuthorizationRequest - -
-

the authorization request to send

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for requests.request()

-
- 		- None -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- RequestUriParameterAuthorizationRequest - -
-

the RequestUriParameterAuthorizationRequest initialized based on the AS response

-
-
- -
- Source code in requests_oauth2client/client.py - 
787
-788
-789
-790
-791
-792
-793
-794
-795
-796
-797
-798
-799
-800
-801
-802
-803
-804
-805
-806
-807
-808
-809
-810
-811
-812
-813
def pushed_authorization_request(
-    self,
-    authorization_request: AuthorizationRequest,
-    requests_kwargs: dict[str, Any] | None = None,
-) -> RequestUriParameterAuthorizationRequest:
-    """Send a Pushed Authorization Request.
-
-    This sends a request to the Pushed Authorization Request Endpoint, and returns a
-    `RequestUriParameterAuthorizationRequest` initialized with the AS response.
-
-    Args:
-        authorization_request: the authorization request to send
-        requests_kwargs: additional parameters for `requests.request()`
-
-    Returns:
-        the `RequestUriParameterAuthorizationRequest` initialized based on the AS response
-
-    """
-    requests_kwargs = requests_kwargs or {}
-    return self._request(
-        "pushed_authorization_request_endpoint",
-        data=authorization_request.args,
-        auth=self.auth,
-        on_success=self.parse_pushed_authorization_response,
-        on_failure=self.on_pushed_authorization_request_error,
-        **requests_kwargs,
-    )
-
-
+
+
+
-
+

+ MissingAuthRequestId -

- parse_pushed_authorization_response(response) -

+ -
- -

Parse the response obtained by pushed_authorization_request().

+
+

+ Bases: ValueError

+

Raised when an 'auth_req_id' is missing in a BackChannelAuthenticationResponse.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the requests.Response returned by the PAR endpoint

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- RequestUriParameterAuthorizationRequest - -
-

a RequestUriParameterAuthorizationRequest instance

-
-
- -
- Source code in requests_oauth2client/client.py - 
815
-816
-817
-818
-819
-820
-821
-822
-823
-824
-825
-826
-827
-828
-829
-830
-831
-832
-833
-834
-835
-836
def parse_pushed_authorization_response(
-    self, response: requests.Response
-) -> RequestUriParameterAuthorizationRequest:
-    """Parse the response obtained by `pushed_authorization_request()`.
-
-    Args:
-        response: the `requests.Response` returned by the PAR endpoint
-
-    Returns:
-        a RequestUriParameterAuthorizationRequest instance
-
-    """
-    response_json = response.json()
-    request_uri = response_json.get("request_uri")
-    expires_in = response_json.get("expires_in")
-
-    return RequestUriParameterAuthorizationRequest(
-        authorization_endpoint=self.authorization_endpoint,
-        client_id=self.client_id,
-        request_uri=request_uri,
-        expires_in=expires_in,
-    )
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
116
+117
+118
+119
+120
+121
class MissingAuthRequestId(ValueError):
+    """Raised when an 'auth_req_id' is missing in a BackChannelAuthenticationResponse."""
+
+    def __init__(self, bcar: BackChannelAuthenticationResponse) -> None:
+        super().__init__("An 'auth_req_id' is required but is missing from this BackChannelAuthenticationResponse.")
+        self.backchannel_authentication_response = bcar
+
+
-
-
+
+ + -

- on_pushed_authorization_request_error(response) -

-
- -

Error Handler for Pushed Authorization Endpoint errors.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the HTTP response as returned by the AS PAR endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- RequestUriParameterAuthorizationRequest - -
-

a RequestUriParameterAuthorizationRequest, if the error is recoverable

-
-
- - - -

Raises:

- - - - - - - - - - - - - - - - - - - - - -
TypeDescription
- EndpointError - -
-

a subclass of this error depending on the error returned by the AS

-
-
- InvalidPushedAuthorizationResponse - -
-

if the returned response is not following the

-
-
- specifications UnknownTokenEndpointError - -
-

for unknown/unhandled errors

-
-
- -
- Source code in requests_oauth2client/client.py - 
838
-839
-840
-841
-842
-843
-844
-845
-846
-847
-848
-849
-850
-851
-852
-853
-854
-855
-856
-857
-858
-859
-860
-861
-862
-863
-864
def on_pushed_authorization_request_error(
-    self, response: requests.Response
-) -> RequestUriParameterAuthorizationRequest:
-    """Error Handler for Pushed Authorization Endpoint errors.
-
-    Args:
-        response: the HTTP response as returned by the AS PAR endpoint.
-
-    Returns:
-        a RequestUriParameterAuthorizationRequest, if the error is recoverable
-
-    Raises:
-        EndpointError: a subclass of this error depending on the error returned by the AS
-        InvalidPushedAuthorizationResponse: if the returned response is not following the
-        specifications UnknownTokenEndpointError: for unknown/unhandled errors
-
-    """
-    try:
-        data = response.json()
-        error = data["error"]
-        error_description = data.get("error_description")
-        error_uri = data.get("error_uri")
-        exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
-        exception = exception_class(response, error, error_description, error_uri)
-    except Exception as exc:
-        raise InvalidPushedAuthorizationResponse(response) from exc
-    raise exception
-
-
+
+
+
-
+

+ MissingDeviceCode -

- userinfo(access_token) -

+ -
- -

Call the UserInfo endpoint.

-

This sends a request to the UserInfo endpoint, with the specified access_token, and returns -the parsed result.

+
+

+ Bases: ValueError

+

Raised when a device_code is required but not provided.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
access_token - BearerToken | str - -
-

the access token to use

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Any - -
-

the Response returned by the userinfo endpoint.

-
-
- -
- Source code in requests_oauth2client/client.py - 
866
-867
-868
-869
-870
-871
-872
-873
-874
-875
-876
-877
-878
-879
-880
-881
-882
-883
-884
def userinfo(self, access_token: BearerToken | str) -> Any:
-    """Call the UserInfo endpoint.
-
-    This sends a request to the UserInfo endpoint, with the specified access_token, and returns
-    the parsed result.
-
-    Args:
-        access_token: the access token to use
-
-    Returns:
-        the [Response][requests.Response] returned by the userinfo endpoint.
-
-    """
-    return self._request(
-        "userinfo_endpoint",
-        auth=BearerAuth(access_token),
-        on_success=self.parse_userinfo_response,
-        on_failure=self.on_userinfo_error,
-    )
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
108
+109
+110
+111
+112
+113
class MissingDeviceCode(ValueError):
+    """Raised when a device_code is required but not provided."""
+
+    def __init__(self, dar: DeviceAuthorizationResponse) -> None:
+        super().__init__("A device_code is missing in this DeviceAuthorizationResponse")
+        self.device_authorization_response = dar
+
+
-
-
+
+ + -

- parse_userinfo_response(resp) -

-
- -

Parse the response obtained by userinfo().

-

Invoked by userinfo() to parse the -response from the UserInfo endpoint, this will extract and return its JSON content.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
resp - Response - -
-

a Response returned from the UserInfo endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Any - -
-

the parsed JSON content from this response.

-
-
- -
- Source code in requests_oauth2client/client.py - 
886
-887
-888
-889
-890
-891
-892
-893
-894
-895
-896
-897
-898
-899
def parse_userinfo_response(self, resp: requests.Response) -> Any:
-    """Parse the response obtained by `userinfo()`.
-
-    Invoked by [userinfo()][requests_oauth2client.client.OAuth2Client.userinfo] to parse the
-    response from the UserInfo endpoint, this will extract and return its JSON content.
-
-    Args:
-        resp: a [Response][requests.Response] returned from the UserInfo endpoint.
-
-    Returns:
-        the parsed JSON content from this response.
-
-    """
-    return resp.json()
-
-
+
+
+
-
+

+ MissingEndpointUri -

- on_userinfo_error(resp) -

+ -
- -

Parse UserInfo error response.

+
+

+ Bases: AttributeError

+

Raised when a required endpoint uri is not known.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
resp - Response - -
-

a Response returned from the UserInfo endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Any - -
-

nothing, raises exception instead.

-
-
- -
- Source code in requests_oauth2client/client.py - 
901
-902
-903
-904
-905
-906
-907
-908
-909
-910
-911
def on_userinfo_error(self, resp: requests.Response) -> Any:
-    """Parse UserInfo error response.
-
-    Args:
-        resp: a [Response][requests.Response] returned from the UserInfo endpoint.
-
-    Returns:
-        nothing, raises exception instead.
-
-    """
-    resp.raise_for_status()
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
185
+186
+187
+188
+189
class MissingEndpointUri(AttributeError):
+    """Raised when a required endpoint uri is not known."""
+
+    def __init__(self, endpoint: str) -> None:
+        super().__init__(f"No '{endpoint}' defined for this client.")
+
+
-
-
+
+ + -

- get_token_type(token_type=None, token=None) - - - classmethod - -

-
- -

Get standardized token type identifiers.

-

Return a standardized token type identifier, based on a short token_type hint and/or a -token value.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
token_type - str | None - -
-

a token_type hint, as str. May be "access_token", "refresh_token" -or "id_token"

-
- 		- None -
token - None | str | BearerToken | IdToken - -
-

a token value, as an instance of BearerToken or IdToken, or as a str.

-
- 		- None -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

the token_type as defined in the Token Exchange RFC8693.

-
-
- -
- Source code in requests_oauth2client/client.py - 
913
-914
-915
-916
-917
-918
-919
-920
-921
-922
-923
-924
-925
-926
-927
-928
-929
-930
-931
-932
-933
-934
-935
-936
-937
-938
-939
-940
-941
-942
-943
-944
-945
-946
-947
-948
-949
-950
-951
-952
-953
-954
-955
-956
-957
-958
-959
-960
-961
-962
-963
-964
-965
-966
-967
-968
-969
-970
-971
-972
-973
-974
-975
-976
-977
@classmethod
-def get_token_type(  # noqa: C901
-    cls,
-    token_type: str | None = None,
-    token: None | str | BearerToken | IdToken = None,
-) -> str:
-    """Get standardized token type identifiers.
-
-    Return a standardized token type identifier, based on a short `token_type` hint and/or a
-    token value.
-
-    Args:
-        token_type: a token_type hint, as `str`. May be "access_token", "refresh_token"
-            or "id_token"
-        token: a token value, as an instance of `BearerToken` or IdToken, or as a `str`.
-
-    Returns:
-        the token_type as defined in the Token Exchange RFC8693.
-
-    """
-    if not (token_type or token):
-        msg = "Cannot determine type of an empty token without a token_type hint"
-        raise ValueError(msg)
-
-    if token_type is None:
-        if isinstance(token, str):
-            msg = "Cannot determine the type of provided token when it is a bare str. Please specify a token_type."
-            raise ValueError(msg)
-        elif isinstance(token, BearerToken):
-            return "urn:ietf:params:oauth:token-type:access_token"
-        elif isinstance(token, IdToken):
-            return "urn:ietf:params:oauth:token-type:id_token"
-        else:
-            msg = "Unexpected type of token, please provide a string or a BearerToken or an IdToken."
-            raise TypeError(
-                msg,
-                type(token),
-            )
-    elif token_type == TokenType.ACCESS_TOKEN:
-        if token is not None and not isinstance(token, (str, BearerToken)):
-            msg = "The supplied token is not a BearerToken or a string representation of it."
-            raise TypeError(
-                msg,
-                type(token),
-            )
-        return "urn:ietf:params:oauth:token-type:access_token"
-    elif token_type == TokenType.REFRESH_TOKEN:
-        if token is not None and isinstance(token, BearerToken) and not token.refresh_token:
-            msg = "The supplied BearerToken doesn't have a refresh_token."
-            raise ValueError(msg)
-        return "urn:ietf:params:oauth:token-type:refresh_token"
-    elif token_type == "id_token":
-        if token is not None and not isinstance(token, (str, IdToken)):
-            msg = "The supplied token is not an IdToken or a string representation of it."
-            raise TypeError(
-                msg,
-                type(token),
-            )
-        return "urn:ietf:params:oauth:token-type:id_token"
-    else:
-        return {
-            "saml1": "urn:ietf:params:oauth:token-type:saml1",
-            "saml2": "urn:ietf:params:oauth:token-type:saml2",
-            "jwt": "urn:ietf:params:oauth:token-type:jwt",
-        }.get(token_type, token_type)
-
-
+
+
+
-
+

+ MissingIdTokenEncryptedResponseAlgParam -

- revoke_access_token(access_token, requests_kwargs=None, **revoke_kwargs) -

+ -
- -

Send a request to the Revocation Endpoint to revoke an access token.

+
+

+ Bases: InvalidParam

+

Raised when an ID Token encryption is required but not provided.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
access_token - BearerToken | str - -
-

the access token to revoke

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the underlying requests.post() call

-
- 		- None -
**revoke_kwargs - Any - -
-

additional parameters to pass to the revocation endpoint

-
- 		- {} -
- -
- Source code in requests_oauth2client/client.py - 
979
-980
-981
-982
-983
-984
-985
-986
-987
-988
-989
-990
-991
-992
-993
-994
-995
-996
-997
-998
def revoke_access_token(
-    self,
-    access_token: BearerToken | str,
-    requests_kwargs: dict[str, Any] | None = None,
-    **revoke_kwargs: Any,
-) -> bool:
-    """Send a request to the Revocation Endpoint to revoke an access token.
-
-    Args:
-        access_token: the access token to revoke
-        requests_kwargs: additional parameters for the underlying requests.post() call
-        **revoke_kwargs: additional parameters to pass to the revocation endpoint
-
-    """
-    return self.revoke_token(
-        access_token,
-        token_type_hint=TokenType.ACCESS_TOKEN,
-        requests_kwargs=requests_kwargs,
-        **revoke_kwargs,
-    )
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
64
+65
+66
+67
+68
+69
+70
+71
+72
class MissingIdTokenEncryptedResponseAlgParam(InvalidParam):
+    """Raised when an ID Token encryption is required but not provided."""
+
+    def __init__(self) -> None:
+        super().__init__("""\
+An ID Token decryption key has been provided but no decryption algorithm is defined.
+You can either pass an `id_token_encrypted_response_alg` parameter with the alg identifier,
+or include an `alg` attribute in the decryption key, if it is in Jwk format.
+""")
+
+
-
-
+
+ + -

- revoke_refresh_token(refresh_token, requests_kwargs=None, **revoke_kwargs) -

-
- -

Send a request to the Revocation Endpoint to revoke a refresh token.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
refresh_token - str | BearerToken - -
-

the refresh token to revoke.

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters to pass to the revocation endpoint.

-
- 		- None -
**revoke_kwargs - Any - -
-

additional parameters to pass to the revocation endpoint.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- bool - -
-

True if the revocation request is successful, False if this client has no configured

-
-
- bool - -
-

revocation endpoint.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1000
-1001
-1002
-1003
-1004
-1005
-1006
-1007
-1008
-1009
-1010
-1011
-1012
-1013
-1014
-1015
-1016
-1017
-1018
-1019
-1020
-1021
-1022
-1023
-1024
-1025
-1026
-1027
-1028
-1029
def revoke_refresh_token(
-    self,
-    refresh_token: str | BearerToken,
-    requests_kwargs: dict[str, Any] | None = None,
-    **revoke_kwargs: Any,
-) -> bool:
-    """Send a request to the Revocation Endpoint to revoke a refresh token.
-
-    Args:
-        refresh_token: the refresh token to revoke.
-        requests_kwargs: additional parameters to pass to the revocation endpoint.
-        **revoke_kwargs: additional parameters to pass to the revocation endpoint.
-
-    Returns:
-        `True` if the revocation request is successful, `False` if this client has no configured
-        revocation endpoint.
-
-    """
-    if isinstance(refresh_token, BearerToken):
-        if refresh_token.refresh_token is None:
-            msg = "The supplied BearerToken doesn't have a refresh token."
-            raise ValueError(msg)
-        refresh_token = refresh_token.refresh_token
-
-    return self.revoke_token(
-        refresh_token,
-        token_type_hint=TokenType.REFRESH_TOKEN,
-        requests_kwargs=requests_kwargs,
-        **revoke_kwargs,
-    )
-
-
+
+
+
-
+

+ MissingRefreshToken -

- revoke_token(token, token_type_hint=None, requests_kwargs=None, **revoke_kwargs) -

+ -
- -

Send a Token Revocation request.

-

By default, authentication will be the same than the one used for the Token Endpoint.

+
+

+ Bases: ValueError

+

Raised when a refresh token is required but not present.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
token - str | BearerToken - -
-

the token to revoke.

-
- 		- required -
token_type_hint - str | None - -
-

a token_type_hint to send to the revocation endpoint.

-
- 		- None -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters to the underling call to requests.post()

-
- 		- None -
**revoke_kwargs - Any - -
-

additional parameters to send to the revocation endpoint.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- bool - -
-

True if the revocation succeeds, False if no revocation endpoint is present or a

-
-
- bool - -
-

non-standardised error is returned.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1031
-1032
-1033
-1034
-1035
-1036
-1037
-1038
-1039
-1040
-1041
-1042
-1043
-1044
-1045
-1046
-1047
-1048
-1049
-1050
-1051
-1052
-1053
-1054
-1055
-1056
-1057
-1058
-1059
-1060
-1061
-1062
-1063
-1064
-1065
-1066
-1067
-1068
-1069
-1070
-1071
-1072
def revoke_token(
-    self,
-    token: str | BearerToken,
-    token_type_hint: str | None = None,
-    requests_kwargs: dict[str, Any] | None = None,
-    **revoke_kwargs: Any,
-) -> bool:
-    """Send a Token Revocation request.
-
-    By default, authentication will be the same than the one used for the Token Endpoint.
-
-    Args:
-        token: the token to revoke.
-        token_type_hint: a token_type_hint to send to the revocation endpoint.
-        requests_kwargs: additional parameters to the underling call to requests.post()
-        **revoke_kwargs: additional parameters to send to the revocation endpoint.
-
-    Returns:
-        `True` if the revocation succeeds, `False` if no revocation endpoint is present or a
-        non-standardised error is returned.
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    if token_type_hint == TokenType.REFRESH_TOKEN and isinstance(token, BearerToken):
-        if token.refresh_token is None:
-            msg = "The supplied BearerToken doesn't have a refresh token."
-            raise ValueError(msg)
-        token = token.refresh_token
-
-    data = dict(revoke_kwargs, token=str(token))
-    if token_type_hint:
-        data["token_type_hint"] = token_type_hint
-
-    return self._request(
-        "revocation_endpoint",
-        data=data,
-        auth=self.auth,
-        on_success=lambda resp: True,
-        on_failure=self.on_revocation_error,
-        **requests_kwargs,
-    )
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
100
+101
+102
+103
+104
+105
class MissingRefreshToken(ValueError):
+    """Raised when a refresh token is required but not present."""
+
+    def __init__(self, token: TokenResponse) -> None:
+        super().__init__("A refresh_token is required but is not present in this Access Token.")
+        self.token = token
+
+
-
-
+
+ + -

- on_revocation_error(response) -

-
- -

Error handler for revoke_token().

-

Invoked by revoke_token() when the -revocation endpoint returns an error.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the Response as returned by the Revocation Endpoint

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- bool - -
-

False to signal that an error occurred. May raise exceptions instead depending on the

-
-
- bool - -
-

revocation response.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1074
-1075
-1076
-1077
-1078
-1079
-1080
-1081
-1082
-1083
-1084
-1085
-1086
-1087
-1088
-1089
-1090
-1091
-1092
-1093
-1094
-1095
-1096
-1097
def on_revocation_error(self, response: requests.Response) -> bool:
-    """Error handler for `revoke_token()`.
-
-    Invoked by [revoke_token()][requests_oauth2client.client.OAuth2Client.revoke_token] when the
-    revocation endpoint returns an error.
-
-    Args:
-        response: the [Response][requests.Response] as returned by the Revocation Endpoint
-
-    Returns:
-        `False` to signal that an error occurred. May raise exceptions instead depending on the
-        revocation response.
-
-    """
-    try:
-        data = response.json()
-        error = data["error"]
-        error_description = data.get("error_description")
-        error_uri = data.get("error_uri")
-        exception_class = self.exception_classes.get(error, RevocationError)
-        exception = exception_class(error, error_description, error_uri)
-    except Exception:
-        return False
-    raise exception
-
-
+
+
+
-
+

+ OAuth2Client -

- introspect_token(token, token_type_hint=None, requests_kwargs=None, **introspect_kwargs) -

+ -
- -

Send a request to the Introspection Endpoint.

-

Parameter token can be:

+
+ + +

An OAuth 2.x Client, that can send requests to an OAuth 2.x Authorization Server.

+

OAuth2Client is able to obtain tokens from the Token Endpoint using any of the standardised +Grant Types, and to communicate with the various backend endpoints like the Revocation, +Introspection, and UserInfo Endpoint.

+

To init an OAuth2Client, you only need the url to the Token Endpoint and the Credentials +(a client_id and one of a secret or private_key) that will be used to authenticate to that endpoint. +Other endpoint urls, such as the Authorization Endpoint, Revocation Endpoint, etc. can be passed as +parameter as well if you intend to use them.

+

This class is not intended to help with the end-user authentication or any request that goes in +a browser. For authentication requests, see +AuthorizationRequest. You +may use the method authorization_request() to generate AuthorizationRequests with the +preconfigured authorization_endpoint, client_id and `redirect_uri' from this client.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
token_endpoint + str + +
+

the Token Endpoint URI where this client will get access tokens

+
+ 		+ required +
auth + AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None + +
+

the authentication handler to use for client authentication on the token endpoint. +Can be:

-

You may pass any arbitrary token and token_type_hint values as str. Those will -be included in the request, as-is. -If token is a BearerToken, then token_type_hint must be either:

+
+ 		+ None +
client_id + str | None + +
+

client ID (use either this or auth)

+
+ 		+ None +
client_secret + str | None + +
+

client secret (use either this or auth)

+
+ 		+ None +
private_key + Jwk | dict[str, Any] | None + +
+

private_key to use for client authentication (use either this or auth)

+
+ 		+ None +
revocation_endpoint + str | None + +
+

the Revocation Endpoint URI to use for revoking tokens

+
+ 		+ None +
introspection_endpoint + str | None + +
+

the Introspection Endpoint URI to use to get info about tokens

+
+ 		+ None +
userinfo_endpoint + str | None + +
+

the Userinfo Endpoint URI to use to get information about the user

+
+ 		+ None +
authorization_endpoint + str | None + +
+

the Authorization Endpoint URI, used for initializing Authorization Requests

+
+ 		+ None +
redirect_uri + str | None + +
+

the redirect_uri for this client

+
+ 		+ None +
backchannel_authentication_endpoint + str | None + +
+

the BackChannel Authentication URI

+
+ 		+ None +
device_authorization_endpoint + str | None + +
+

the Device Authorization Endpoint URI to use to authorize devices

+
+ 		+ None +
jwks_uri + str | None + +
+

the JWKS URI to use to obtain the AS public keys

+
+ 		+ None +
code_challenge_method + str + +
+

challenge method to use for PKCE (should always be 'S256')

+
+ 		+ S256 +
session + Session | None + +
+

a requests Session to use when sending HTTP requests. +Useful if some extra parameters such as proxy or client certificate must be used +to connect to the AS.

+
+ 		+ None +
testing + bool + +
+

if True, don't verify the validity of the endpoint urls that are passed as parameter.

+
+ 		+ False +
**extra_metadata + Any + +
+

additional metadata for this client, unused by this class, but may be +used by subclasses. Those will be accessible with the extra_metadata attribute.

+
+ 		+ {} +
+ + +
+ Example + 
 1
+ 2
+ 3
+ 4
+ 5
+ 6
+ 7
+ 8
+ 9
+10
+11
client = OAuth2Client(
+    token_endpoint="https://my.as.local/token",
+    revocation_endpoint="https://my.as.local/revoke",
+    client_id="client_id",
+    client_secret="client_secret",
+)
+
+# once initialized, a client can send requests to its configured endpoints
+cc_token = client.client_credentials(scope="my_scope")
+ac_token = client.authorization_code(code="my_code")
+client.revoke_access_token(cc_token)
+
+
+ +

Raises:

+ + + + + + + + + + + + + + + + + + + + + + + + + +
TypeDescription
+ MissingIDTokenEncryptedResponseAlgParam + +
+

if an id_token_decryption_key is provided +but no decryption alg is provided, either:

    -
  • None: the access_token will be instrospected and no token_type_hint will be included -in the request
    • -
  • access_token: same as None, but the token_type_hint will be included
    • -
  • or refresh_token: only available if a Refresh Token is present in the BearerToken.
    • +
  • using id_token_encrypted_response_alg,
    • +
  • or in the alg parameter of the Jwk key
+
+
+ MissingIssuerParam + +
+

if authorization_response_iss_parameter_supported is set to True +but the issuer is not provided.

+
+
+ InvalidEndpointUri + +
+

if a provided endpoint uri is not considered valid. For the rare cases +where those checks must be disabled, you can use testing=True.

+
+
+ InvalidIssuer + +
+

if the issuer value is not considered valid.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
 205
+ 206
+ 207
+ 208
+ 209
+ 210
+ 211
+ 212
+ 213
+ 214
+ 215
+ 216
+ 217
+ 218
+ 219
+ 220
+ 221
+ 222
+ 223
+ 224
+ 225
+ 226
+ 227
+ 228
+ 229
+ 230
+ 231
+ 232
+ 233
+ 234
+ 235
+ 236
+ 237
+ 238
+ 239
+ 240
+ 241
+ 242
+ 243
+ 244
+ 245
+ 246
+ 247
+ 248
+ 249
+ 250
+ 251
+ 252
+ 253
+ 254
+ 255
+ 256
+ 257
+ 258
+ 259
+ 260
+ 261
+ 262
+ 263
+ 264
+ 265
+ 266
+ 267
+ 268
+ 269
+ 270
+ 271
+ 272
+ 273
+ 274
+ 275
+ 276
+ 277
+ 278
+ 279
+ 280
+ 281
+ 282
+ 283
+ 284
+ 285
+ 286
+ 287
+ 288
+ 289
+ 290
+ 291
+ 292
+ 293
+ 294
+ 295
+ 296
+ 297
+ 298
+ 299
+ 300
+ 301
+ 302
+ 303
+ 304
+ 305
+ 306
+ 307
+ 308
+ 309
+ 310
+ 311
+ 312
+ 313
+ 314
+ 315
+ 316
+ 317
+ 318
+ 319
+ 320
+ 321
+ 322
+ 323
+ 324
+ 325
+ 326
+ 327
+ 328
+ 329
+ 330
+ 331
+ 332
+ 333
+ 334
+ 335
+ 336
+ 337
+ 338
+ 339
+ 340
+ 341
+ 342
+ 343
+ 344
+ 345
+ 346
+ 347
+ 348
+ 349
+ 350
+ 351
+ 352
+ 353
+ 354
+ 355
+ 356
+ 357
+ 358
+ 359
+ 360
+ 361
+ 362
+ 363
+ 364
+ 365
+ 366
+ 367
+ 368
+ 369
+ 370
+ 371
+ 372
+ 373
+ 374
+ 375
+ 376
+ 377
+ 378
+ 379
+ 380
+ 381
+ 382
+ 383
+ 384
+ 385
+ 386
+ 387
+ 388
+ 389
+ 390
+ 391
+ 392
+ 393
+ 394
+ 395
+ 396
+ 397
+ 398
+ 399
+ 400
+ 401
+ 402
+ 403
+ 404
+ 405
+ 406
+ 407
+ 408
+ 409
+ 410
+ 411
+ 412
+ 413
+ 414
+ 415
+ 416
+ 417
+ 418
+ 419
+ 420
+ 421
+ 422
+ 423
+ 424
+ 425
+ 426
+ 427
+ 428
+ 429
+ 430
+ 431
+ 432
+ 433
+ 434
+ 435
+ 436
+ 437
+ 438
+ 439
+ 440
+ 441
+ 442
+ 443
+ 444
+ 445
+ 446
+ 447
+ 448
+ 449
+ 450
+ 451
+ 452
+ 453
+ 454
+ 455
+ 456
+ 457
+ 458
+ 459
+ 460
+ 461
+ 462
+ 463
+ 464
+ 465
+ 466
+ 467
+ 468
+ 469
+ 470
+ 471
+ 472
+ 473
+ 474
+ 475
+ 476
+ 477
+ 478
+ 479
+ 480
+ 481
+ 482
+ 483
+ 484
+ 485
+ 486
+ 487
+ 488
+ 489
+ 490
+ 491
+ 492
+ 493
+ 494
+ 495
+ 496
+ 497
+ 498
+ 499
+ 500
+ 501
+ 502
+ 503
+ 504
+ 505
+ 506
+ 507
+ 508
+ 509
+ 510
+ 511
+ 512
+ 513
+ 514
+ 515
+ 516
+ 517
+ 518
+ 519
+ 520
+ 521
+ 522
+ 523
+ 524
+ 525
+ 526
+ 527
+ 528
+ 529
+ 530
+ 531
+ 532
+ 533
+ 534
+ 535
+ 536
+ 537
+ 538
+ 539
+ 540
+ 541
+ 542
+ 543
+ 544
+ 545
+ 546
+ 547
+ 548
+ 549
+ 550
+ 551
+ 552
+ 553
+ 554
+ 555
+ 556
+ 557
+ 558
+ 559
+ 560
+ 561
+ 562
+ 563
+ 564
+ 565
+ 566
+ 567
+ 568
+ 569
+ 570
+ 571
+ 572
+ 573
+ 574
+ 575
+ 576
+ 577
+ 578
+ 579
+ 580
+ 581
+ 582
+ 583
+ 584
+ 585
+ 586
+ 587
+ 588
+ 589
+ 590
+ 591
+ 592
+ 593
+ 594
+ 595
+ 596
+ 597
+ 598
+ 599
+ 600
+ 601
+ 602
+ 603
+ 604
+ 605
+ 606
+ 607
+ 608
+ 609
+ 610
+ 611
+ 612
+ 613
+ 614
+ 615
+ 616
+ 617
+ 618
+ 619
+ 620
+ 621
+ 622
+ 623
+ 624
+ 625
+ 626
+ 627
+ 628
+ 629
+ 630
+ 631
+ 632
+ 633
+ 634
+ 635
+ 636
+ 637
+ 638
+ 639
+ 640
+ 641
+ 642
+ 643
+ 644
+ 645
+ 646
+ 647
+ 648
+ 649
+ 650
+ 651
+ 652
+ 653
+ 654
+ 655
+ 656
+ 657
+ 658
+ 659
+ 660
+ 661
+ 662
+ 663
+ 664
+ 665
+ 666
+ 667
+ 668
+ 669
+ 670
+ 671
+ 672
+ 673
+ 674
+ 675
+ 676
+ 677
+ 678
+ 679
+ 680
+ 681
+ 682
+ 683
+ 684
+ 685
+ 686
+ 687
+ 688
+ 689
+ 690
+ 691
+ 692
+ 693
+ 694
+ 695
+ 696
+ 697
+ 698
+ 699
+ 700
+ 701
+ 702
+ 703
+ 704
+ 705
+ 706
+ 707
+ 708
+ 709
+ 710
+ 711
+ 712
+ 713
+ 714
+ 715
+ 716
+ 717
+ 718
+ 719
+ 720
+ 721
+ 722
+ 723
+ 724
+ 725
+ 726
+ 727
+ 728
+ 729
+ 730
+ 731
+ 732
+ 733
+ 734
+ 735
+ 736
+ 737
+ 738
+ 739
+ 740
+ 741
+ 742
+ 743
+ 744
+ 745
+ 746
+ 747
+ 748
+ 749
+ 750
+ 751
+ 752
+ 753
+ 754
+ 755
+ 756
+ 757
+ 758
+ 759
+ 760
+ 761
+ 762
+ 763
+ 764
+ 765
+ 766
+ 767
+ 768
+ 769
+ 770
+ 771
+ 772
+ 773
+ 774
+ 775
+ 776
+ 777
+ 778
+ 779
+ 780
+ 781
+ 782
+ 783
+ 784
+ 785
+ 786
+ 787
+ 788
+ 789
+ 790
+ 791
+ 792
+ 793
+ 794
+ 795
+ 796
+ 797
+ 798
+ 799
+ 800
+ 801
+ 802
+ 803
+ 804
+ 805
+ 806
+ 807
+ 808
+ 809
+ 810
+ 811
+ 812
+ 813
+ 814
+ 815
+ 816
+ 817
+ 818
+ 819
+ 820
+ 821
+ 822
+ 823
+ 824
+ 825
+ 826
+ 827
+ 828
+ 829
+ 830
+ 831
+ 832
+ 833
+ 834
+ 835
+ 836
+ 837
+ 838
+ 839
+ 840
+ 841
+ 842
+ 843
+ 844
+ 845
+ 846
+ 847
+ 848
+ 849
+ 850
+ 851
+ 852
+ 853
+ 854
+ 855
+ 856
+ 857
+ 858
+ 859
+ 860
+ 861
+ 862
+ 863
+ 864
+ 865
+ 866
+ 867
+ 868
+ 869
+ 870
+ 871
+ 872
+ 873
+ 874
+ 875
+ 876
+ 877
+ 878
+ 879
+ 880
+ 881
+ 882
+ 883
+ 884
+ 885
+ 886
+ 887
+ 888
+ 889
+ 890
+ 891
+ 892
+ 893
+ 894
+ 895
+ 896
+ 897
+ 898
+ 899
+ 900
+ 901
+ 902
+ 903
+ 904
+ 905
+ 906
+ 907
+ 908
+ 909
+ 910
+ 911
+ 912
+ 913
+ 914
+ 915
+ 916
+ 917
+ 918
+ 919
+ 920
+ 921
+ 922
+ 923
+ 924
+ 925
+ 926
+ 927
+ 928
+ 929
+ 930
+ 931
+ 932
+ 933
+ 934
+ 935
+ 936
+ 937
+ 938
+ 939
+ 940
+ 941
+ 942
+ 943
+ 944
+ 945
+ 946
+ 947
+ 948
+ 949
+ 950
+ 951
+ 952
+ 953
+ 954
+ 955
+ 956
+ 957
+ 958
+ 959
+ 960
+ 961
+ 962
+ 963
+ 964
+ 965
+ 966
+ 967
+ 968
+ 969
+ 970
+ 971
+ 972
+ 973
+ 974
+ 975
+ 976
+ 977
+ 978
+ 979
+ 980
+ 981
+ 982
+ 983
+ 984
+ 985
+ 986
+ 987
+ 988
+ 989
+ 990
+ 991
+ 992
+ 993
+ 994
+ 995
+ 996
+ 997
+ 998
+ 999
+1000
+1001
+1002
+1003
+1004
+1005
+1006
+1007
+1008
+1009
+1010
+1011
+1012
+1013
+1014
+1015
+1016
+1017
+1018
+1019
+1020
+1021
+1022
+1023
+1024
+1025
+1026
+1027
+1028
+1029
+1030
+1031
+1032
+1033
+1034
+1035
+1036
+1037
+1038
+1039
+1040
+1041
+1042
+1043
+1044
+1045
+1046
+1047
+1048
+1049
+1050
+1051
+1052
+1053
+1054
+1055
+1056
+1057
+1058
+1059
+1060
+1061
+1062
+1063
+1064
+1065
+1066
+1067
+1068
+1069
+1070
+1071
+1072
+1073
+1074
+1075
+1076
+1077
+1078
+1079
+1080
+1081
+1082
+1083
+1084
+1085
+1086
+1087
+1088
+1089
+1090
+1091
+1092
+1093
+1094
+1095
+1096
+1097
+1098
+1099
+1100
+1101
+1102
+1103
+1104
+1105
+1106
+1107
+1108
+1109
+1110
+1111
+1112
+1113
+1114
+1115
+1116
+1117
+1118
+1119
+1120
+1121
+1122
+1123
+1124
+1125
+1126
+1127
+1128
+1129
+1130
+1131
+1132
+1133
+1134
+1135
+1136
+1137
+1138
+1139
+1140
+1141
+1142
+1143
+1144
+1145
+1146
+1147
+1148
+1149
+1150
+1151
+1152
+1153
+1154
+1155
+1156
+1157
+1158
+1159
+1160
+1161
+1162
+1163
+1164
+1165
+1166
+1167
+1168
+1169
+1170
+1171
+1172
+1173
+1174
+1175
+1176
+1177
+1178
+1179
+1180
+1181
+1182
+1183
+1184
+1185
+1186
+1187
+1188
+1189
+1190
+1191
+1192
+1193
+1194
+1195
+1196
+1197
+1198
+1199
+1200
+1201
+1202
+1203
+1204
+1205
+1206
+1207
+1208
+1209
+1210
+1211
+1212
+1213
+1214
+1215
+1216
+1217
+1218
+1219
+1220
+1221
+1222
+1223
+1224
+1225
+1226
+1227
+1228
+1229
+1230
+1231
+1232
+1233
+1234
+1235
+1236
+1237
+1238
+1239
+1240
+1241
+1242
+1243
+1244
+1245
+1246
+1247
+1248
+1249
+1250
+1251
+1252
+1253
+1254
+1255
+1256
+1257
+1258
+1259
+1260
+1261
+1262
+1263
+1264
+1265
+1266
+1267
+1268
+1269
+1270
+1271
+1272
+1273
+1274
+1275
+1276
+1277
+1278
+1279
+1280
+1281
+1282
+1283
+1284
+1285
+1286
+1287
+1288
+1289
+1290
+1291
+1292
+1293
+1294
+1295
+1296
+1297
+1298
+1299
+1300
+1301
+1302
+1303
+1304
+1305
+1306
+1307
+1308
+1309
+1310
+1311
+1312
+1313
+1314
+1315
+1316
+1317
+1318
+1319
+1320
+1321
+1322
+1323
+1324
+1325
+1326
+1327
+1328
+1329
+1330
+1331
+1332
+1333
+1334
+1335
+1336
+1337
+1338
+1339
+1340
+1341
+1342
+1343
+1344
+1345
+1346
+1347
+1348
+1349
+1350
+1351
+1352
+1353
+1354
+1355
+1356
+1357
+1358
+1359
+1360
+1361
+1362
+1363
+1364
+1365
+1366
+1367
+1368
+1369
+1370
+1371
+1372
+1373
+1374
+1375
+1376
+1377
+1378
+1379
+1380
+1381
+1382
+1383
+1384
+1385
+1386
+1387
+1388
+1389
+1390
+1391
+1392
+1393
+1394
+1395
+1396
+1397
+1398
+1399
+1400
+1401
+1402
+1403
+1404
+1405
+1406
+1407
+1408
+1409
+1410
+1411
+1412
+1413
+1414
+1415
+1416
+1417
+1418
+1419
+1420
+1421
+1422
+1423
+1424
+1425
+1426
+1427
+1428
+1429
+1430
+1431
+1432
+1433
+1434
+1435
+1436
+1437
+1438
+1439
+1440
+1441
+1442
+1443
+1444
+1445
+1446
+1447
+1448
+1449
+1450
+1451
+1452
+1453
+1454
+1455
+1456
+1457
+1458
+1459
+1460
+1461
+1462
+1463
+1464
+1465
+1466
+1467
+1468
+1469
+1470
+1471
+1472
+1473
+1474
+1475
+1476
+1477
+1478
+1479
+1480
+1481
+1482
+1483
+1484
+1485
+1486
+1487
+1488
+1489
+1490
+1491
+1492
+1493
+1494
+1495
+1496
+1497
+1498
+1499
+1500
+1501
+1502
+1503
+1504
+1505
+1506
+1507
+1508
+1509
+1510
+1511
+1512
+1513
+1514
+1515
+1516
+1517
+1518
+1519
+1520
+1521
+1522
+1523
+1524
+1525
+1526
+1527
+1528
+1529
+1530
+1531
+1532
+1533
+1534
+1535
+1536
+1537
+1538
+1539
+1540
+1541
+1542
+1543
+1544
+1545
+1546
+1547
+1548
+1549
+1550
+1551
+1552
+1553
+1554
+1555
+1556
+1557
+1558
+1559
+1560
+1561
+1562
+1563
+1564
+1565
+1566
+1567
+1568
+1569
+1570
+1571
+1572
+1573
+1574
+1575
+1576
+1577
+1578
+1579
+1580
+1581
+1582
+1583
+1584
+1585
+1586
+1587
+1588
+1589
+1590
+1591
+1592
+1593
+1594
+1595
+1596
+1597
+1598
+1599
+1600
+1601
+1602
+1603
+1604
+1605
+1606
+1607
+1608
+1609
+1610
+1611
+1612
+1613
+1614
+1615
+1616
+1617
+1618
+1619
+1620
+1621
+1622
+1623
+1624
+1625
+1626
+1627
+1628
+1629
+1630
+1631
+1632
+1633
+1634
+1635
+1636
+1637
+1638
+1639
+1640
+1641
+1642
+1643
+1644
+1645
+1646
+1647
+1648
+1649
+1650
+1651
+1652
+1653
+1654
+1655
+1656
+1657
+1658
+1659
+1660
+1661
+1662
+1663
+1664
+1665
+1666
+1667
+1668
+1669
+1670
+1671
+1672
+1673
+1674
+1675
+1676
+1677
+1678
+1679
+1680
+1681
+1682
+1683
+1684
+1685
+1686
+1687
+1688
+1689
+1690
+1691
+1692
+1693
+1694
+1695
+1696
+1697
+1698
+1699
+1700
+1701
+1702
+1703
+1704
+1705
+1706
+1707
+1708
+1709
+1710
+1711
+1712
+1713
+1714
+1715
+1716
+1717
+1718
+1719
+1720
+1721
+1722
+1723
+1724
+1725
+1726
+1727
+1728
+1729
+1730
+1731
+1732
+1733
+1734
+1735
+1736
+1737
+1738
+1739
+1740
+1741
+1742
+1743
+1744
+1745
+1746
+1747
+1748
+1749
+1750
+1751
+1752
+1753
+1754
+1755
+1756
+1757
+1758
+1759
+1760
+1761
+1762
+1763
+1764
+1765
+1766
+1767
+1768
+1769
+1770
+1771
+1772
+1773
+1774
+1775
+1776
+1777
+1778
+1779
+1780
+1781
+1782
+1783
+1784
+1785
+1786
+1787
+1788
+1789
+1790
+1791
+1792
+1793
+1794
+1795
+1796
+1797
+1798
+1799
+1800
+1801
+1802
+1803
+1804
+1805
+1806
+1807
+1808
+1809
+1810
+1811
+1812
+1813
+1814
+1815
+1816
+1817
+1818
+1819
+1820
+1821
+1822
+1823
+1824
+1825
+1826
+1827
+1828
+1829
+1830
+1831
+1832
+1833
+1834
+1835
+1836
+1837
+1838
+1839
+1840
+1841
+1842
+1843
+1844
+1845
+1846
+1847
+1848
+1849
+1850
+1851
+1852
+1853
+1854
+1855
+1856
+1857
+1858
+1859
+1860
+1861
+1862
+1863
@frozen(init=False)
+class OAuth2Client:
+    """An OAuth 2.x Client, that can send requests to an OAuth 2.x Authorization Server.
+
+    `OAuth2Client` is able to obtain tokens from the Token Endpoint using any of the standardised
+    Grant Types, and to communicate with the various backend endpoints like the Revocation,
+    Introspection, and UserInfo Endpoint.
+
+    To init an OAuth2Client, you only need the url to the Token Endpoint and the Credentials
+    (a client_id and one of a secret or private_key) that will be used to authenticate to that endpoint.
+    Other endpoint urls, such as the Authorization Endpoint, Revocation Endpoint, etc. can be passed as
+    parameter as well if you intend to use them.
+
+
+    This class is not intended to help with the end-user authentication or any request that goes in
+    a browser. For authentication requests, see
+    [AuthorizationRequest][requests_oauth2client.authorization_request.AuthorizationRequest]. You
+    may use the method `authorization_request()` to generate `AuthorizationRequest`s with the
+    preconfigured `authorization_endpoint`, `client_id` and `redirect_uri' from this client.
+
+    Args:
+        token_endpoint: the Token Endpoint URI where this client will get access tokens
+        auth: the authentication handler to use for client authentication on the token endpoint.
+            Can be:
+
+            - a [requests.auth.AuthBase][] instance (which will be used as-is)
+            - a tuple of `(client_id, client_secret)` which will initialize an instance
+            of [ClientSecretPost][requests_oauth2client.client_authentication.ClientSecretPost]
+            - a `(client_id, jwk)` to initialize
+            a [PrivateKeyJwt][requests_oauth2client.client_authentication.PrivateKeyJwt],
+            - or a `client_id` which will
+            use [PublicApp][requests_oauth2client.client_authentication.PublicApp] authentication.
+
+        client_id: client ID (use either this or `auth`)
+        client_secret: client secret (use either this or `auth`)
+        private_key: private_key to use for client authentication (use either this or `auth`)
+        revocation_endpoint: the Revocation Endpoint URI to use for revoking tokens
+        introspection_endpoint: the Introspection Endpoint URI to use to get info about tokens
+        userinfo_endpoint: the Userinfo Endpoint URI to use to get information about the user
+        authorization_endpoint: the Authorization Endpoint URI, used for initializing Authorization Requests
+        redirect_uri: the redirect_uri for this client
+        backchannel_authentication_endpoint: the BackChannel Authentication URI
+        device_authorization_endpoint: the Device Authorization Endpoint URI to use to authorize devices
+        jwks_uri: the JWKS URI to use to obtain the AS public keys
+        code_challenge_method: challenge method to use for PKCE (should always be 'S256')
+        session: a requests Session to use when sending HTTP requests.
+            Useful if some extra parameters such as proxy or client certificate must be used
+            to connect to the AS.
+        testing: if `True`, don't verify the validity of the endpoint urls that are passed as parameter.
+        **extra_metadata: additional metadata for this client, unused by this class, but may be
+            used by subclasses. Those will be accessible with the `extra_metadata` attribute.
+
+    Example:
+        ```python
+        client = OAuth2Client(
+            token_endpoint="https://my.as.local/token",
+            revocation_endpoint="https://my.as.local/revoke",
+            client_id="client_id",
+            client_secret="client_secret",
+        )
+
+        # once initialized, a client can send requests to its configured endpoints
+        cc_token = client.client_credentials(scope="my_scope")
+        ac_token = client.authorization_code(code="my_code")
+        client.revoke_access_token(cc_token)
+        ```
+
+    Raises:
+        MissingIDTokenEncryptedResponseAlgParam: if an `id_token_decryption_key` is provided
+            but no decryption alg is provided, either:
+
+            - using `id_token_encrypted_response_alg`,
+            - or in the `alg` parameter of the `Jwk` key
+        MissingIssuerParam: if `authorization_response_iss_parameter_supported` is set to `True`
+            but the `issuer` is not provided.
+        InvalidEndpointUri: if a provided endpoint uri is not considered valid. For the rare cases
+            where those checks must be disabled, you can use `testing=True`.
+        InvalidIssuer: if the `issuer` value is not considered valid.
+
+    """
+
+    auth: requests.auth.AuthBase = field(converter=client_auth_factory)
+    token_endpoint: str = field()
+    revocation_endpoint: str | None = field()
+    introspection_endpoint: str | None = field()
+    userinfo_endpoint: str | None = field()
+    authorization_endpoint: str | None = field()
+    redirect_uri: str | None = field()
+    backchannel_authentication_endpoint: str | None = field()
+    device_authorization_endpoint: str | None = field()
+    pushed_authorization_request_endpoint: str | None = field()
+    jwks_uri: str | None = field()
+    authorization_server_jwks: JwkSet
+    issuer: str | None = field()
+    id_token_signed_response_alg: str | None = SignatureAlgs.RS256
+    id_token_encrypted_response_alg: str | None = None
+    id_token_decryption_key: Jwk | None = None
+    code_challenge_method: str | None = CodeChallengeMethods.S256
+    authorization_response_iss_parameter_supported: bool = False
+    session: requests.Session = field(factory=requests.Session)
+    extra_metadata: dict[str, Any] = field(factory=dict)
+    testing: bool = False
+
+    token_class: type[BearerToken] = BearerToken
+
+    exception_classes: ClassVar[dict[str, type[EndpointError]]] = {
+        "server_error": ServerError,
+        "invalid_request": InvalidRequest,
+        "invalid_client": InvalidClient,
+        "invalid_scope": InvalidScope,
+        "invalid_target": InvalidTarget,
+        "invalid_grant": InvalidGrant,
+        "access_denied": AccessDenied,
+        "unauthorized_client": UnauthorizedClient,
+        "authorization_pending": AuthorizationPending,
+        "slow_down": SlowDown,
+        "expired_token": ExpiredToken,
+        "unsupported_token_type": UnsupportedTokenType,
+    }
+
+    def __init__(  # noqa: PLR0913
+        self,
+        token_endpoint: str,
+        auth: (
+            requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
+        ) = None,
+        *,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_key: Jwk | dict[str, Any] | None = None,
+        revocation_endpoint: str | None = None,
+        introspection_endpoint: str | None = None,
+        userinfo_endpoint: str | None = None,
+        authorization_endpoint: str | None = None,
+        redirect_uri: str | None = None,
+        backchannel_authentication_endpoint: str | None = None,
+        device_authorization_endpoint: str | None = None,
+        pushed_authorization_request_endpoint: str | None = None,
+        jwks_uri: str | None = None,
+        authorization_server_jwks: JwkSet | dict[str, Any] | None = None,
+        issuer: str | None = None,
+        id_token_signed_response_alg: str | None = SignatureAlgs.RS256,
+        id_token_encrypted_response_alg: str | None = None,
+        id_token_decryption_key: Jwk | dict[str, Any] | None = None,
+        code_challenge_method: str = CodeChallengeMethods.S256,
+        authorization_response_iss_parameter_supported: bool = False,
+        token_class: type[BearerToken] = BearerToken,
+        session: requests.Session | None = None,
+        testing: bool = False,
+        **extra_metadata: Any,
+    ) -> None:
+        if authorization_response_iss_parameter_supported and not issuer:
+            raise MissingIssuerParam
+
+        auth = client_auth_factory(
+            auth,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_key=private_key,
+            default_auth_handler=ClientSecretPost,
+        )
+
+        if authorization_server_jwks is None:
+            authorization_server_jwks = JwkSet()
+        elif not isinstance(authorization_server_jwks, JwkSet):
+            authorization_server_jwks = JwkSet(authorization_server_jwks)
+
+        if id_token_decryption_key is not None and not isinstance(id_token_decryption_key, Jwk):
+            id_token_decryption_key = Jwk(id_token_decryption_key)
+
+        if id_token_decryption_key is not None and id_token_encrypted_response_alg is None:
+            if id_token_decryption_key.alg:
+                id_token_encrypted_response_alg = id_token_decryption_key.alg
+            else:
+                raise MissingIdTokenEncryptedResponseAlgParam
+
+        if session is None:
+            session = requests.Session()
+
+        self.__attrs_init__(
+            testing=testing,
+            token_endpoint=token_endpoint,
+            revocation_endpoint=revocation_endpoint,
+            introspection_endpoint=introspection_endpoint,
+            userinfo_endpoint=userinfo_endpoint,
+            authorization_endpoint=authorization_endpoint,
+            redirect_uri=redirect_uri,
+            backchannel_authentication_endpoint=backchannel_authentication_endpoint,
+            device_authorization_endpoint=device_authorization_endpoint,
+            pushed_authorization_request_endpoint=pushed_authorization_request_endpoint,
+            jwks_uri=jwks_uri,
+            authorization_server_jwks=authorization_server_jwks,
+            issuer=issuer,
+            session=session,
+            auth=auth,
+            id_token_signed_response_alg=id_token_signed_response_alg,
+            id_token_encrypted_response_alg=id_token_encrypted_response_alg,
+            id_token_decryption_key=id_token_decryption_key,
+            code_challenge_method=code_challenge_method,
+            authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
+            extra_metadata=extra_metadata,
+            token_class=token_class,
+        )
+
+    @token_endpoint.validator
+    @revocation_endpoint.validator
+    @introspection_endpoint.validator
+    @userinfo_endpoint.validator
+    @authorization_endpoint.validator
+    @backchannel_authentication_endpoint.validator
+    @device_authorization_endpoint.validator
+    @pushed_authorization_request_endpoint.validator
+    @jwks_uri.validator
+    def validate_endpoint_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
+        """Validate that an endpoint URI is suitable for use.
+
+        If you need to disable some checks (for AS testing purposes only!), provide a different
+        method here.
+
+        """
+        if self.testing or uri is None:
+            return uri
+        try:
+            return validate_endpoint_uri(uri)
+        except InvalidUri as exc:
+            raise InvalidEndpointUri(endpoint=attribute.name, uri=uri, exc=exc) from exc
+
+    @issuer.validator
+    def validate_issuer_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
+        """Validate that an Issuer identifier is suitable for use.
+
+        This is the same check as an endpoint URI, but the path may be (and usually is) empty.
+
+        """
+        if self.testing or uri is None:
+            return uri
+        try:
+            return validate_issuer_uri(uri)
+        except InvalidUri as exc:
+            raise InvalidIssuer(attribute.name, uri, exc) from exc
+
+    @property
+    def client_id(self) -> str:
+        """Client ID."""
+        if hasattr(self.auth, "client_id"):
+            return self.auth.client_id  # type: ignore[no-any-return]
+        msg = "This client uses a custom authentication method without client_id."
+        raise AttributeError(msg)  # pragma: no cover
+
+    @property
+    def client_secret(self) -> str | None:
+        """Client Secret."""
+        if hasattr(self.auth, "client_secret"):
+            return self.auth.client_secret  # type: ignore[no-any-return]
+        return None
+
+    @property
+    def client_jwks(self) -> JwkSet:
+        """A `JwkSet` containing the public keys for this client.
+
+        Keys are:
+
+        - the public key for client assertion signature verification (if using private_key_jwt)
+        - the ID Token encryption key
+
+        """
+        jwks = JwkSet()
+        if isinstance(self.auth, PrivateKeyJwt):
+            jwks.add_jwk(self.auth.private_jwk.public_jwk().with_usage_parameters())
+        if self.id_token_decryption_key:
+            jwks.add_jwk(self.id_token_decryption_key.public_jwk().with_usage_parameters())
+        return jwks
+
+    def _request(
+        self,
+        endpoint: str,
+        on_success: Callable[[requests.Response], T],
+        on_failure: Callable[[requests.Response], T],
+        accept: str = "application/json",
+        method: str = "POST",
+        **requests_kwargs: Any,
+    ) -> T:
+        """Send a request to one of the endpoints.
+
+        This is a helper method that takes care of the following tasks:
+
+        - make sure the endpoint as been configured
+        - set `Accept: application/json` header
+        - send the HTTP POST request, then
+            - apply `on_success` to a successful response
+            - or apply `on_failure` otherwise
+        - return the result
+
+        Args:
+            endpoint: name of the endpoint to use
+            on_success: a callable to apply to successful responses
+            on_failure: a callable to apply to error responses
+            accept: the Accept header to include in the request
+            method: the HTTP method to use
+            **requests_kwargs: keyword arguments for the request
+
+        """
+        endpoint_uri = self._require_endpoint(endpoint)
+        requests_kwargs.setdefault("headers", {})
+        requests_kwargs["headers"]["Accept"] = accept
+
+        response = self.session.request(
+            method,
+            endpoint_uri,
+            **requests_kwargs,
+        )
+        if response.ok:
+            return on_success(response)
+
+        return on_failure(response)
+
+    def token_request(
+        self,
+        data: dict[str, Any],
+        timeout: int = 10,
+        **requests_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request to the token endpoint.
+
+        Authentication will be added automatically based on the defined `auth` for this client.
+
+        Args:
+          data: parameters to send to the token endpoint. Items with a `None`
+               or empty value will not be sent in the request.
+          timeout: a timeout value for the call
+          **requests_kwargs: additional parameters for requests.post()
+
+        Returns:
+            the token endpoint response, as
+            [`BearerToken`][requests_oauth2client.tokens.BearerToken] instance.
+
+        """
+        return self._request(
+            Endpoints.TOKEN,
+            auth=self.auth,
+            data=data,
+            timeout=timeout,
+            on_success=self.parse_token_response,
+            on_failure=self.on_token_error,
+            **requests_kwargs,
+        )
+
+    def parse_token_response(self, response: requests.Response) -> BearerToken:
+        """Parse a Response returned by the Token Endpoint.
+
+        Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] to parse
+        responses returned by the Token Endpoint. Those responses contain an `access_token` and
+        additional attributes.
+
+        Args:
+            response: the [Response][requests.Response] returned by the Token Endpoint.
+
+        Returns:
+            a [`BearerToken`][requests_oauth2client.tokens.BearerToken] based on the response
+            contents.
+
+        """
+        try:
+            token_response = self.token_class(**response.json())
+        except Exception:  # noqa: BLE001
+            return self.on_token_error(response)
+        else:
+            return token_response
+
+    def on_token_error(self, response: requests.Response) -> BearerToken:
+        """Error handler for `token_request()`.
+
+        Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] when the
+        Token Endpoint returns an error.
+
+        Args:
+            response: the [Response][requests.Response] returned by the Token Endpoint.
+
+        Returns:
+            nothing, and raises an exception instead. But a subclass may return a
+            [`BearerToken`][requests_oauth2client.tokens.BearerToken] to implement a default
+            behaviour if needed.
+
+        Raises:
+            InvalidTokenResponse: if the error response does not contain an OAuth 2.0 standard
+                error response.
+
+        """
+        try:
+            data = response.json()
+            error = data["error"]
+            error_description = data.get("error_description")
+            error_uri = data.get("error_uri")
+            exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
+            exception = exception_class(
+                response=response,
+                client=self,
+                error=error,
+                description=error_description,
+                uri=error_uri,
+            )
+        except Exception as exc:
+            raise InvalidTokenResponse(response=response, client=self) from exc
+        raise exception
+
+    def client_credentials(
+        self,
+        scope: str | Iterable[str] | None = None,
+        *,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request to the token endpoint using the `client_credentials` grant.
+
+        Args:
+            scope: the scope to send with the request. Can be a str, or an iterable of str.
+                to pass that way include `scope`, `audience`, `resource`, etc.
+            requests_kwargs: additional parameters for the call to requests
+            **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`. Common parameters
+
+        Returns:
+            a BearerToken
+
+        Raises:
+            InvalidScopeParam: if the `scope` parameter is not suitable
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        if scope and not isinstance(scope, str):
+            try:
+                scope = " ".join(scope)
+            except Exception as exc:
+                raise InvalidScopeParam(scope) from exc
+
+        data = dict(grant_type=GrantTypes.CLIENT_CREDENTIALS, scope=scope, **token_kwargs)
+        return self.token_request(data, **requests_kwargs)
+
+    def authorization_code(
+        self,
+        code: str | AuthorizationResponse,
+        *,
+        validate: bool = True,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request to the token endpoint with the `authorization_code` grant.
+
+        Args:
+             code: an authorization code or an `AuthorizationResponse` to exchange for tokens
+             validate: if `True`, validate the received ID Token (this works only if `code` is an AuthorizationResponse)
+             requests_kwargs: additional parameters for the call to requests
+             **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `code`, etc.
+
+        Returns:
+            a `BearerToken`
+
+        """
+        azr: AuthorizationResponse | None = None
+        if isinstance(code, AuthorizationResponse):
+            token_kwargs.setdefault("code_verifier", code.code_verifier)
+            token_kwargs.setdefault("redirect_uri", code.redirect_uri)
+            azr = code
+            code = code.code
+
+        requests_kwargs = requests_kwargs or {}
+
+        data = dict(grant_type=GrantTypes.AUTHORIZATION_CODE, code=code, **token_kwargs)
+        token = self.token_request(data, **requests_kwargs)
+        if validate and token.id_token and isinstance(azr, AuthorizationResponse):
+            return token.validate_id_token(self, azr)
+        return token
+
+    def refresh_token(
+        self,
+        refresh_token: str | BearerToken,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request to the token endpoint with the `refresh_token` grant.
+
+        Args:
+            refresh_token: a refresh_token, as a string, or as a `BearerToken`.
+                That `BearerToken` must have a `refresh_token`.
+            requests_kwargs: additional parameters for the call to `requests`
+            **token_kwargs: additional parameters for the token endpoint,
+                alongside `grant_type`, `refresh_token`, etc.
+
+        Returns:
+            a `BearerToken`
+
+        Raises:
+            MissingRefreshToken: if `refresh_token` is a BearerToken instance but does not
+                contain a `refresh_token`
+
+        """
+        if isinstance(refresh_token, BearerToken):
+            if refresh_token.refresh_token is None or not isinstance(refresh_token.refresh_token, str):
+                raise MissingRefreshToken(refresh_token)
+            refresh_token = refresh_token.refresh_token
+
+        requests_kwargs = requests_kwargs or {}
+        data = dict(grant_type=GrantTypes.REFRESH_TOKEN, refresh_token=refresh_token, **token_kwargs)
+        return self.token_request(data, **requests_kwargs)
+
+    def device_code(
+        self,
+        device_code: str | DeviceAuthorizationResponse,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request to the token endpoint using the Device Code grant.
+
+        The grant_type is `urn:ietf:params:oauth:grant-type:device_code`. This needs a Device Code,
+        or a `DeviceAuthorizationResponse` as parameter.
+
+        Args:
+            device_code: a device code, or a `DeviceAuthorizationResponse`
+            requests_kwargs: additional parameters for the call to requests
+            **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `device_code`, etc.
+
+        Returns:
+            a `BearerToken`
+
+        Raises:
+            MissingDeviceCode: if `device_code` is a DeviceAuthorizationResponse but does not
+                contain a `device_code`.
+
+        """
+        if isinstance(device_code, DeviceAuthorizationResponse):
+            if device_code.device_code is None or not isinstance(device_code.device_code, str):
+                raise MissingDeviceCode(device_code)
+            device_code = device_code.device_code
+
+        requests_kwargs = requests_kwargs or {}
+        data = dict(
+            grant_type=GrantTypes.DEVICE_CODE,
+            device_code=device_code,
+            **token_kwargs,
+        )
+        return self.token_request(data, **requests_kwargs)
+
+    def ciba(
+        self,
+        auth_req_id: str | BackChannelAuthenticationResponse,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a CIBA request to the Token Endpoint.
+
+        A CIBA request is a Token Request using the `urn:openid:params:grant-type:ciba` grant.
+
+        Args:
+            auth_req_id: an authentication request ID, as returned by the AS
+            requests_kwargs: additional parameters for the call to requests
+            **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `auth_req_id`, etc.
+
+        Returns:
+            a `BearerToken`
+
+        Raises:
+            MissingAuthRequestId: if `auth_req_id` is a BackChannelAuthenticationResponse but does not contain
+                an `auth_req_id`.
+
+        """
+        if isinstance(auth_req_id, BackChannelAuthenticationResponse):
+            if auth_req_id.auth_req_id is None or not isinstance(auth_req_id.auth_req_id, str):
+                raise MissingAuthRequestId(auth_req_id)
+            auth_req_id = auth_req_id.auth_req_id
+
+        requests_kwargs = requests_kwargs or {}
+        data = dict(
+            grant_type=GrantTypes.CLIENT_INITIATED_BACKCHANNEL_AUTHENTICATION,
+            auth_req_id=auth_req_id,
+            **token_kwargs,
+        )
+        return self.token_request(data, **requests_kwargs)
+
+    def token_exchange(
+        self,
+        subject_token: str | BearerToken | IdToken,
+        subject_token_type: str | None = None,
+        actor_token: None | str | BearerToken | IdToken = None,
+        actor_token_type: str | None = None,
+        requested_token_type: str | None = None,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a Token Exchange request.
+
+        A Token Exchange request is actually a request to the Token Endpoint with a grant_type
+        `urn:ietf:params:oauth:grant-type:token-exchange`.
+
+        Args:
+            subject_token: the subject token to exchange for a new token.
+            subject_token_type: a token type identifier for the subject_token, mandatory if it cannot be guessed based
+                on `type(subject_token)`.
+            actor_token: the actor token to include in the request, if any.
+            actor_token_type: a token type identifier for the actor_token, mandatory if it cannot be guessed based
+                on `type(actor_token)`.
+            requested_token_type: a token type identifier for the requested token.
+            requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
+            **token_kwargs: additional parameters to include in the request body.
+
+        Returns:
+            a `BearerToken` as returned by the Authorization Server.
+
+        Raises:
+            UnknownSubjectTokenType: if the type of `subject_token` cannot be determined automatically.
+            UnknownActorTokenType: if the type of `actor_token` cannot be determined automaticatlly.
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        try:
+            subject_token_type = self.get_token_type(subject_token_type, subject_token)
+        except ValueError as exc:
+            raise UnknownSubjectTokenType(subject_token, subject_token_type) from exc
+        if actor_token:  # pragma: no branch
+            try:
+                actor_token_type = self.get_token_type(actor_token_type, actor_token)
+            except ValueError as exc:
+                raise UnknownActorTokenType(actor_token, actor_token_type) from exc
+
+        data = dict(
+            grant_type=GrantTypes.TOKEN_EXCHANGE,
+            subject_token=subject_token,
+            subject_token_type=subject_token_type,
+            actor_token=actor_token,
+            actor_token_type=actor_token_type,
+            requested_token_type=requested_token_type,
+            **token_kwargs,
+        )
+        return self.token_request(data, **requests_kwargs)
+
+    def jwt_bearer(
+        self,
+        assertion: Jwt | str,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request using a JWT as authorization grant.
+
+        This is defined in (RFC7523 $2.1)[https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1).
+
+        Args:
+            assertion: a JWT (as an instance of `jwskate.Jwt` or as a `str`) to use as authorization grant.
+            requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
+            **token_kwargs: additional parameters to include in the request body.
+
+        Returns:
+            a `BearerToken` as returned by the Authorization Server.
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        if not isinstance(assertion, Jwt):
+            assertion = Jwt(assertion)
+
+        data = dict(
+            grant_type=GrantTypes.JWT_BEARER,
+            assertion=assertion,
+            **token_kwargs,
+        )
+
+        return self.token_request(data, **requests_kwargs)
+
+    def resource_owner_password(
+        self,
+        username: str,
+        password: str,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request using the Resource Owner Password Grant.
+
+        This Grant Type is deprecated and should only be used when there is no other choice.
+
+        Args:
+            username: the resource owner user name
+            password: the resource owner password
+            requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
+            **token_kwargs: additional parameters to include in the request body.
+
+        Returns:
+            a `BearerToken` as returned by the Authorization Server
+
+        """
+        requests_kwargs = requests_kwargs or {}
+        data = dict(
+            grant_type=GrantTypes.RESOURCE_OWNER_PASSWORD,
+            username=username,
+            password=password,
+            **token_kwargs,
+        )
+
+        return self.token_request(data, **requests_kwargs)
+
+    def authorization_request(
+        self,
+        *,
+        scope: None | str | Iterable[str] = "openid",
+        response_type: str = ResponseTypes.CODE,
+        redirect_uri: str | None = None,
+        state: str | ellipsis | None = ...,  # noqa: F821
+        nonce: str | ellipsis | None = ...,  # noqa: F821
+        code_verifier: str | None = None,
+        **kwargs: Any,
+    ) -> AuthorizationRequest:
+        """Generate an Authorization Request for this client.
+
+        Args:
+            scope: the `scope` to use
+            response_type: the `response_type` to use
+            redirect_uri: the `redirect_uri` to include in the request. By default,
+                the `redirect_uri` defined at init time is used.
+            state: the `state` parameter to use. Leave default to generate a random value.
+            nonce: a `nonce`. Leave default to generate a random value.
+            code_verifier: the PKCE `code_verifier` to use. Leave default to generate a random value.
+            **kwargs: additional parameters to include in the auth request
+
+        Returns:
+            an AuthorizationRequest with the supplied parameters
+
+        """
+        authorization_endpoint = self._require_endpoint("authorization_endpoint")
+
+        redirect_uri = redirect_uri or self.redirect_uri
+
+        return AuthorizationRequest(
+            authorization_endpoint=authorization_endpoint,
+            client_id=self.client_id,
+            redirect_uri=redirect_uri,
+            issuer=self.issuer,
+            response_type=response_type,
+            scope=scope,
+            state=state,
+            nonce=nonce,
+            code_verifier=code_verifier,
+            code_challenge_method=self.code_challenge_method,
+            **kwargs,
+        )
+
+    def pushed_authorization_request(
+        self,
+        authorization_request: AuthorizationRequest,
+        requests_kwargs: dict[str, Any] | None = None,
+    ) -> RequestUriParameterAuthorizationRequest:
+        """Send a Pushed Authorization Request.
+
+        This sends a request to the Pushed Authorization Request Endpoint, and returns a
+        `RequestUriParameterAuthorizationRequest` initialized with the AS response.
+
+        Args:
+            authorization_request: the authorization request to send
+            requests_kwargs: additional parameters for `requests.request()`
+
+        Returns:
+            the `RequestUriParameterAuthorizationRequest` initialized based on the AS response
+
+        """
+        requests_kwargs = requests_kwargs or {}
+        return self._request(
+            Endpoints.PUSHED_AUTHORIZATION_REQUEST,
+            data=authorization_request.args,
+            auth=self.auth,
+            on_success=self.parse_pushed_authorization_response,
+            on_failure=self.on_pushed_authorization_request_error,
+            **requests_kwargs,
+        )
+
+    def parse_pushed_authorization_response(
+        self,
+        response: requests.Response,
+    ) -> RequestUriParameterAuthorizationRequest:
+        """Parse the response obtained by `pushed_authorization_request()`.
+
+        Args:
+            response: the `requests.Response` returned by the PAR endpoint
+
+        Returns:
+            a RequestUriParameterAuthorizationRequest instance
+
+        """
+        response_json = response.json()
+        request_uri = response_json.get("request_uri")
+        expires_in = response_json.get("expires_in")
+
+        return RequestUriParameterAuthorizationRequest(
+            authorization_endpoint=self.authorization_endpoint,
+            client_id=self.client_id,
+            request_uri=request_uri,
+            expires_in=expires_in,
+        )
+
+    def on_pushed_authorization_request_error(
+        self,
+        response: requests.Response,
+    ) -> RequestUriParameterAuthorizationRequest:
+        """Error Handler for Pushed Authorization Endpoint errors.
+
+        Args:
+            response: the HTTP response as returned by the AS PAR endpoint.
+
+        Returns:
+            a RequestUriParameterAuthorizationRequest, if the error is recoverable
+
+        Raises:
+            EndpointError: a subclass of this error depending on the error returned by the AS
+            InvalidPushedAuthorizationResponse: if the returned response is not following the
+                specifications
+            UnknownTokenEndpointError: for unknown/unhandled errors
+
+        """
+        try:
+            data = response.json()
+            error = data["error"]
+            error_description = data.get("error_description")
+            error_uri = data.get("error_uri")
+            exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
+            exception = exception_class(
+                response=response,
+                client=self,
+                error=error,
+                description=error_description,
+                uri=error_uri,
+            )
+        except Exception as exc:
+            raise InvalidPushedAuthorizationResponse(response=response, client=self) from exc
+        raise exception
+
+    def userinfo(self, access_token: BearerToken | str) -> Any:
+        """Call the UserInfo endpoint.
+
+        This sends a request to the UserInfo endpoint, with the specified access_token, and returns
+        the parsed result.
+
+        Args:
+            access_token: the access token to use
+
+        Returns:
+            the [Response][requests.Response] returned by the userinfo endpoint.
+
+        """
+        if isinstance(access_token, str):
+            access_token = BearerToken(access_token)
+        return self._request(
+            Endpoints.USER_INFO,
+            auth=access_token,
+            on_success=self.parse_userinfo_response,
+            on_failure=self.on_userinfo_error,
+        )
+
+    def parse_userinfo_response(self, resp: requests.Response) -> Any:
+        """Parse the response obtained by `userinfo()`.
+
+        Invoked by [userinfo()][requests_oauth2client.client.OAuth2Client.userinfo] to parse the
+        response from the UserInfo endpoint, this will extract and return its JSON content.
+
+        Args:
+            resp: a [Response][requests.Response] returned from the UserInfo endpoint.
+
+        Returns:
+            the parsed JSON content from this response.
+
+        """
+        return resp.json()
+
+    def on_userinfo_error(self, resp: requests.Response) -> Any:
+        """Parse UserInfo error response.
+
+        Args:
+            resp: a [Response][requests.Response] returned from the UserInfo endpoint.
+
+        Returns:
+            nothing, raises exception instead.
+
+        """
+        resp.raise_for_status()
+
+    @classmethod
+    def get_token_type(  # noqa: C901
+        cls,
+        token_type: str | None = None,
+        token: None | str | BearerToken | IdToken = None,
+    ) -> str:
+        """Get standardized token type identifiers.
+
+        Return a standardized token type identifier, based on a short `token_type` hint and/or a
+        token value.
+
+        Args:
+            token_type: a token_type hint, as `str`. May be "access_token", "refresh_token"
+                or "id_token"
+            token: a token value, as an instance of `BearerToken` or IdToken, or as a `str`.
+
+        Returns:
+            the token_type as defined in the Token Exchange RFC8693.
+
+        Raises:
+            UnknownTokenType: if the type of token cannot be determined
+
+        """
+        if not (token_type or token):
+            msg = "Cannot determine type of an empty token without a token_type hint"
+            raise UnknownTokenType(msg, token, token_type)
+
+        if token_type is None:
+            if isinstance(token, str):
+                msg = """\
+Cannot determine the type of provided token when it is a bare `str`. Please specify a 'token_type'.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            if isinstance(token, BearerToken):
+                return "urn:ietf:params:oauth:token-type:access_token"
+            if isinstance(token, IdToken):
+                return "urn:ietf:params:oauth:token-type:id_token"
+            msg = f"Unknown token type {type(token)}"
+            raise UnknownTokenType(msg, token, token_type)
+        if token_type == TokenType.ACCESS_TOKEN:
+            if token is not None and not isinstance(token, (str, BearerToken)):
+                msg = f"""\
+The supplied token is of type '{type(token)}' which is inconsistent with token_type '{token_type}'.
+A BearerToken or an access_token as a `str` is expected.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            return "urn:ietf:params:oauth:token-type:access_token"
+        if token_type == TokenType.REFRESH_TOKEN:
+            if token is not None and isinstance(token, BearerToken) and not token.refresh_token:
+                msg = f"""\
+The supplied BearerToken does not contain a refresh_token, which is inconsistent with token_type '{token_type}'.
+A BearerToken containing a refresh_token is expected.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            return "urn:ietf:params:oauth:token-type:refresh_token"
+        if token_type == TokenType.ID_TOKEN:
+            if token is not None and not isinstance(token, (str, IdToken)):
+                msg = f"""\
+The supplied token is of type '{type(token)}' which is inconsistent with token_type '{token_type}'.
+An IdToken or a string representation of it is expected.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            return "urn:ietf:params:oauth:token-type:id_token"
+
+        return {
+            "saml1": "urn:ietf:params:oauth:token-type:saml1",
+            "saml2": "urn:ietf:params:oauth:token-type:saml2",
+            "jwt": "urn:ietf:params:oauth:token-type:jwt",
+        }.get(token_type, token_type)
+
+    def revoke_access_token(
+        self,
+        access_token: BearerToken | str,
+        requests_kwargs: dict[str, Any] | None = None,
+        **revoke_kwargs: Any,
+    ) -> bool:
+        """Send a request to the Revocation Endpoint to revoke an access token.
+
+        Args:
+            access_token: the access token to revoke
+            requests_kwargs: additional parameters for the underlying requests.post() call
+            **revoke_kwargs: additional parameters to pass to the revocation endpoint
+
+        """
+        return self.revoke_token(
+            access_token,
+            token_type_hint=TokenType.ACCESS_TOKEN,
+            requests_kwargs=requests_kwargs,
+            **revoke_kwargs,
+        )
+
+    def revoke_refresh_token(
+        self,
+        refresh_token: str | BearerToken,
+        requests_kwargs: dict[str, Any] | None = None,
+        **revoke_kwargs: Any,
+    ) -> bool:
+        """Send a request to the Revocation Endpoint to revoke a refresh token.
+
+        Args:
+            refresh_token: the refresh token to revoke.
+            requests_kwargs: additional parameters to pass to the revocation endpoint.
+            **revoke_kwargs: additional parameters to pass to the revocation endpoint.
+
+        Returns:
+            `True` if the revocation request is successful, `False` if this client has no configured
+            revocation endpoint.
+
+        Raises:
+            MissingRefreshToken: when `refresh_token` is a [BearerToken][requests_oauth2client.tokens.BearerToken]
+                but does not contain a `refresh_token`.
+
+        """
+        if isinstance(refresh_token, BearerToken):
+            if refresh_token.refresh_token is None:
+                raise MissingRefreshToken(refresh_token)
+            refresh_token = refresh_token.refresh_token
+
+        return self.revoke_token(
+            refresh_token,
+            token_type_hint=TokenType.REFRESH_TOKEN,
+            requests_kwargs=requests_kwargs,
+            **revoke_kwargs,
+        )
+
+    def revoke_token(
+        self,
+        token: str | BearerToken,
+        token_type_hint: str | None = None,
+        requests_kwargs: dict[str, Any] | None = None,
+        **revoke_kwargs: Any,
+    ) -> bool:
+        """Send a Token Revocation request.
+
+        By default, authentication will be the same than the one used for the Token Endpoint.
+
+        Args:
+            token: the token to revoke.
+            token_type_hint: a token_type_hint to send to the revocation endpoint.
+            requests_kwargs: additional parameters to the underling call to requests.post()
+            **revoke_kwargs: additional parameters to send to the revocation endpoint.
+
+        Returns:
+            `True` if the revocation succeeds, `False` if no revocation endpoint is present or a
+            non-standardised error is returned.
+
+        Raises:
+            MissingEndpointUri: if the Revocation Endpoint URI is not configured.
+            MissingRefreshToken: if `token_type_hint` is `"refresh_token"` and `token` is a BearerToken
+                but does not contain a `refresh_token`.
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        if token_type_hint == TokenType.REFRESH_TOKEN and isinstance(token, BearerToken):
+            if token.refresh_token is None:
+                raise MissingRefreshToken(token)
+            token = token.refresh_token
+
+        data = dict(revoke_kwargs, token=str(token))
+        if token_type_hint:
+            data["token_type_hint"] = token_type_hint
+
+        return self._request(
+            Endpoints.REVOCATION,
+            data=data,
+            auth=self.auth,
+            on_success=lambda _: True,
+            on_failure=self.on_revocation_error,
+            **requests_kwargs,
+        )
+
+    def on_revocation_error(self, response: requests.Response) -> bool:
+        """Error handler for `revoke_token()`.
+
+        Invoked by [revoke_token()][requests_oauth2client.client.OAuth2Client.revoke_token] when the
+        revocation endpoint returns an error.
+
+        Args:
+            response: the [Response][requests.Response] as returned by the Revocation Endpoint
+
+        Returns:
+            `False` to signal that an error occurred. May raise exceptions instead depending on the
+            revocation response.
+
+        Raises:
+            EndpointError: if the response contains a standardised OAuth 2.0 error.
+
+        """
+        try:
+            data = response.json()
+            error = data["error"]
+            error_description = data.get("error_description")
+            error_uri = data.get("error_uri")
+            exception_class = self.exception_classes.get(error, RevocationError)
+            exception = exception_class(
+                response=response,
+                client=self,
+                error=error,
+                description=error_description,
+                uri=error_uri,
+            )
+        except Exception:  # noqa: BLE001
+            return False
+        raise exception
+
+    def introspect_token(
+        self,
+        token: str | BearerToken,
+        token_type_hint: str | None = None,
+        requests_kwargs: dict[str, Any] | None = None,
+        **introspect_kwargs: Any,
+    ) -> Any:
+        """Send a request to the Introspection Endpoint.
+
+        Parameter `token` can be:
+
+        - a `str`
+        - a `BearerToken` instance
+
+        You may pass any arbitrary `token` and `token_type_hint` values as `str`. Those will
+        be included in the request, as-is.
+        If `token` is a `BearerToken`, then `token_type_hint` must be either:
+
+        - `None`: the access_token will be instrospected and no token_type_hint will be included
+        in the request
+        - `access_token`: same as `None`, but the token_type_hint will be included
+        - or `refresh_token`: only available if a Refresh Token is present in the BearerToken.
+
+        Args:
+            token: the token to instrospect
+            token_type_hint: the `token_type_hint` to include in the request.
+            requests_kwargs: additional parameters to the underling call to requests.post()
+            **introspect_kwargs: additional parameters to send to the introspection endpoint.
+
+        Returns:
+            the response as returned by the Introspection Endpoint.
+
+        Raises:
+            MissingRefreshToken: if `token_type_hint` is `"refresh_token"` and `token` is a BearerToken
+                but does not contain a `refresh_token`.
+            UnknownTokenType: if `token_type_hint` is neither `None`, `"access_token"` or `"refresh_token"`.
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        if isinstance(token, BearerToken):
+            if token_type_hint is None or token_type_hint == TokenType.ACCESS_TOKEN:
+                token = token.access_token
+            elif token_type_hint == TokenType.REFRESH_TOKEN:
+                if token.refresh_token is None:
+                    raise MissingRefreshToken(token)
+
+                token = token.refresh_token
+            else:
+                msg = """\
+Invalid `token_type_hint`. To test arbitrary `token_type_hint` values, you must provide `token` as a `str`."""
+                raise UnknownTokenType(msg, token, token_type_hint)
+
+        data = dict(introspect_kwargs, token=str(token))
+        if token_type_hint:
+            data["token_type_hint"] = token_type_hint
+
+        return self._request(
+            Endpoints.INSTROSPECTION,
+            data=data,
+            auth=self.auth,
+            on_success=self.parse_introspection_response,
+            on_failure=self.on_introspection_error,
+            **requests_kwargs,
+        )
+
+    def parse_introspection_response(self, response: requests.Response) -> Any:
+        """Parse Token Introspection Responses received by `introspect_token()`.
+
+        Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
+        to parse the returned response. This decodes the JSON content if possible, otherwise it
+        returns the response as a string.
+
+        Args:
+            response: the [Response][requests.Response] as returned by the Introspection Endpoint.
+
+        Returns:
+            the decoded JSON content, or a `str` with the content.
+
+        """
+        try:
+            return response.json()
+        except ValueError:
+            return response.text
+
+    def on_introspection_error(self, response: requests.Response) -> Any:
+        """Error handler for `introspect_token()`.
+
+        Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
+        to parse the returned response in the case an error is returned.
+
+        Args:
+            response: the response as returned by the Introspection Endpoint.
+
+        Returns:
+            usually raises exceptions. A subclass can return a default response instead.
+
+        Raises:
+            EndpointError: (or one of its subclasses) if the response contains a standard OAuth 2.0 error.
+            UnknownIntrospectionError: if the response is not a standard error response.
+
+        """
+        try:
+            data = response.json()
+            error = data["error"]
+            error_description = data.get("error_description")
+            error_uri = data.get("error_uri")
+            exception_class = self.exception_classes.get(error, IntrospectionError)
+            exception = exception_class(
+                response=response,
+                client=self,
+                error=error,
+                description=error_description,
+                uri=error_uri,
+            )
+        except Exception as exc:
+            raise UnknownIntrospectionError(response=response, client=self) from exc
+        raise exception
+
+    def backchannel_authentication_request(  # noqa: PLR0913
+        self,
+        scope: None | str | Iterable[str] = "openid",
+        *,
+        client_notification_token: str | None = None,
+        acr_values: None | str | Iterable[str] = None,
+        login_hint_token: str | None = None,
+        id_token_hint: str | None = None,
+        login_hint: str | None = None,
+        binding_message: str | None = None,
+        user_code: str | None = None,
+        requested_expiry: int | None = None,
+        private_jwk: Jwk | dict[str, Any] | None = None,
+        alg: str | None = None,
+        requests_kwargs: dict[str, Any] | None = None,
+        **ciba_kwargs: Any,
+    ) -> BackChannelAuthenticationResponse:
+        """Send a CIBA Authentication Request.
+
+        Args:
+             scope: the scope to include in the request.
+             client_notification_token: the Client Notification Token to include in the request.
+             acr_values: the acr values to include in the request.
+             login_hint_token: the Login Hint Token to include in the request.
+             id_token_hint: the ID Token Hint to include in the request.
+             login_hint: the Login Hint to include in the request.
+             binding_message: the Binding Message to include in the request.
+             user_code: the User Code to include in the request
+             requested_expiry: the Requested Expiry, in seconds, to include in the request.
+             private_jwk: the JWK to use to sign the request (optional)
+             alg: the alg to use to sign the request, if the provided JWK does not include an "alg" parameter.
+             requests_kwargs: additional parameters for
+             **ciba_kwargs: additional parameters to include in the request.
+
+        Returns:
+            a BackChannelAuthenticationResponse as returned by AS
+
+        Raises:
+            InvalidBackchannelAuthenticationRequestHintParam: if none of `login_hint`, `login_hint_token`
+                or `id_token_hint` is provided, or more than one of them is provided.
+            InvalidScopeParam: if the `scope` parameter is invalid.
+            InvalidAcrValuesParam: if the `acr_values` parameter is invalid.
+
+        """
+        if not (login_hint or login_hint_token or id_token_hint):
+            msg = "One of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
+            raise InvalidBackchannelAuthenticationRequestHintParam(msg)
+
+        if (login_hint_token and id_token_hint) or (login_hint and id_token_hint) or (login_hint_token and login_hint):
+            msg = "Only one of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
+            raise InvalidBackchannelAuthenticationRequestHintParam(msg)
+
+        requests_kwargs = requests_kwargs or {}
+
+        if scope is not None and not isinstance(scope, str):
+            try:
+                scope = " ".join(scope)
+            except Exception as exc:
+                raise InvalidScopeParam(scope) from exc
+
+        if acr_values is not None and not isinstance(acr_values, str):
+            try:
+                acr_values = " ".join(acr_values)
+            except Exception as exc:
+                raise InvalidAcrValuesParam(acr_values) from exc
+
+        data = dict(
+            ciba_kwargs,
+            scope=scope,
+            client_notification_token=client_notification_token,
+            acr_values=acr_values,
+            login_hint_token=login_hint_token,
+            id_token_hint=id_token_hint,
+            login_hint=login_hint,
+            binding_message=binding_message,
+            user_code=user_code,
+            requested_expiry=requested_expiry,
+        )
+
+        if private_jwk is not None:
+            data = {"request": str(Jwt.sign(data, key=private_jwk, alg=alg))}
+
+        return self._request(
+            Endpoints.BACKCHANNEL_AUTHENTICATION,
+            data=data,
+            auth=self.auth,
+            on_success=self.parse_backchannel_authentication_response,
+            on_failure=self.on_backchannel_authentication_error,
+            **requests_kwargs,
+        )
+
+    def parse_backchannel_authentication_response(
+        self,
+        response: requests.Response,
+    ) -> BackChannelAuthenticationResponse:
+        """Parse a response received by `backchannel_authentication_request()`.
+
+        Invoked by
+        [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
+        to parse the response returned by the BackChannel Authentication Endpoint.
+
+        Args:
+            response: the response returned by the BackChannel Authentication Endpoint.
+
+        Returns:
+            a `BackChannelAuthenticationResponse`
+
+        Raises:
+            InvalidBackChannelAuthenticationResponse: if the response does not contain a standard
+                BackChannel Authentication response.
+
+        """
+        try:
+            return BackChannelAuthenticationResponse(**response.json())
+        except TypeError as exc:
+            raise InvalidBackChannelAuthenticationResponse(response=response, client=self) from exc
+
+    def on_backchannel_authentication_error(self, response: requests.Response) -> BackChannelAuthenticationResponse:
+        """Error handler for `backchannel_authentication_request()`.
+
+        Invoked by
+        [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
+        to parse the response returned by the BackChannel Authentication Endpoint, when it is an
+        error.
+
+        Args:
+            response: the response returned by the BackChannel Authentication Endpoint.
+
+        Returns:
+            usually raises an exception. But a subclass can return a default response instead.
+
+        Raises:
+            EndpointError: (or one of its subclasses) if the response contains a standard OAuth 2.0 error.
+            InvalidBackChannelAuthenticationResponse: for non-standard error responses.
+
+        """
+        try:
+            data = response.json()
+            error = data["error"]
+            error_description = data.get("error_description")
+            error_uri = data.get("error_uri")
+            exception_class = self.exception_classes.get(error, BackChannelAuthenticationError)
+            exception = exception_class(
+                response=response,
+                client=self,
+                error=error,
+                description=error_description,
+                uri=error_uri,
+            )
+        except Exception as exc:
+            raise InvalidBackChannelAuthenticationResponse(response=response, client=self) from exc
+        raise exception
+
+    def authorize_device(
+        self,
+        requests_kwargs: dict[str, Any] | None = None,
+        **data: Any,
+    ) -> DeviceAuthorizationResponse:
+        """Send a Device Authorization Request.
+
+        Args:
+            **data: additional data to send to the Device Authorization Endpoint
+            requests_kwargs: additional parameters for `requests.request()`
+
+        Returns:
+            a Device Authorization Response
+
+        Raises:
+            MissingEndpointUri: if the Device Authorization URI is not configured
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        return self._request(
+            Endpoints.DEVICE_AUTHORIZATION,
+            data=data,
+            auth=self.auth,
+            on_success=self.parse_device_authorization_response,
+            on_failure=self.on_device_authorization_error,
+            **requests_kwargs,
+        )
+
+    def parse_device_authorization_response(self, response: requests.Response) -> DeviceAuthorizationResponse:
+        """Parse a Device Authorization Response received by `authorize_device()`.
+
+        Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
+        to parse the response returned by the Device Authorization Endpoint.
+
+        Args:
+            response: the response returned by the Device Authorization Endpoint.
+
+        Returns:
+            a `DeviceAuthorizationResponse` as returned by AS
+
+        """
+        return DeviceAuthorizationResponse(**response.json())
+
+    def on_device_authorization_error(self, response: requests.Response) -> DeviceAuthorizationResponse:
+        """Error handler for `authorize_device()`.
+
+        Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
+        to parse the response returned by the Device Authorization Endpoint, when that response is
+        an error.
+
+        Args:
+            response: the response returned by the Device Authorization Endpoint.
+
+        Returns:
+            usually raises an Exception. But a subclass may return a default response instead.
+
+        Raises:
+            EndpointError: for standard OAuth 2.0 errors
+            InvalidDeviceAuthorizationResponse: for non-standard error responses.
+
+        """
+        try:
+            data = response.json()
+            error = data["error"]
+            error_description = data.get("error_description")
+            error_uri = data.get("error_uri")
+            exception_class = self.exception_classes.get(error, DeviceAuthorizationError)
+            exception = exception_class(
+                response=response,
+                client=self,
+                error=error,
+                description=error_description,
+                uri=error_uri,
+            )
+        except Exception as exc:
+            raise InvalidDeviceAuthorizationResponse(response=response, client=self) from exc
+        raise exception
+
+    def update_authorization_server_public_keys(self, requests_kwargs: dict[str, Any] | None = None) -> JwkSet:
+        """Update the cached AS public keys by retrieving them from its `jwks_uri`.
+
+        Public keys are returned by this method, as a `jwskate.JwkSet`. They are also
+        available in attribute `authorization_server_jwks`.
+
+        Returns:
+            the retrieved public keys
+
+        Raises:
+            ValueError: if no `jwks_uri` is configured
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        jwks = self._request(
+            Endpoints.JWKS,
+            auth=None,
+            method="GET",
+            on_success=lambda resp: resp.json(),
+            on_failure=lambda resp: resp.raise_for_status(),
+            **requests_kwargs,
+        )
+        self.authorization_server_jwks.update(jwks)
+        return self.authorization_server_jwks
+
+    @classmethod
+    def from_discovery_endpoint(
+        cls,
+        url: str | None = None,
+        issuer: str | None = None,
+        *,
+        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_key: Jwk | dict[str, Any] | None = None,
+        session: requests.Session | None = None,
+        testing: bool = False,
+        **kwargs: Any,
+    ) -> OAuth2Client:
+        """Initialise an OAuth2Client based on Authorization Server Metadata.
+
+        This will retrieve the standardised metadata document available at `url`, and will extract
+        all Endpoint Uris from that document, will fetch the current public keys from its
+        `jwks_uri`, then will initialise an OAuth2Client based on those endpoints.
+
+        Args:
+             url: the url where the server metadata will be retrieved
+             auth: the authentication handler to use for client authentication
+             client_id: client ID
+             client_secret: client secret to use to authenticate the client
+             private_key: private key to sign client assertions
+             session: a `requests.Session` to use to retrieve the document and initialise the client with
+             issuer: if an issuer is given, check that it matches the one from the retrieved document
+             testing: if True, don't try to validate the endpoint urls that are part of the document
+             **kwargs: additional keyword parameters to pass to OAuth2Client
+
+        Returns:
+            an OAuth2Client with endpoint initialised based on the obtained metadata
+
+        Raises:
+            InvalidParam: if neither `url` nor `issuer` are suitable urls
+            requests.HTTPError: if an error happens while fetching the documents
+
+        Example:
+            ```python
+            from requests_oauth2client import OAuth2Client
+
+            client = OAuth2Client.from_discovery_endpoint(
+                issuer="https://myserver.net",
+                client_id="my_client_id,
+                client_secret="my_client_secret"
+            )
+            ```
+
+        """
+        if url is None and issuer is not None:
+            url = oidc_discovery_document_url(issuer)
+        if url is None:
+            msg = "Please specify at least one of `issuer` or `url`"
+            raise InvalidParam(msg)
+
+        validate_endpoint_uri(url, path=False)
+
+        session = session or requests.Session()
+        discovery = session.get(url).json()
+
+        jwks_uri = discovery.get("jwks_uri")
+        if jwks_uri:
+            jwks = JwkSet(session.get(jwks_uri).json())
+
+        return cls.from_discovery_document(
+            discovery,
+            issuer=issuer,
+            auth=auth,
+            session=session,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_key=private_key,
+            authorization_server_jwks=jwks,
+            testing=testing,
+            **kwargs,
+        )
+
+    @classmethod
+    def from_discovery_document(
+        cls,
+        discovery: dict[str, Any],
+        issuer: str | None = None,
+        *,
+        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_key: Jwk | dict[str, Any] | None = None,
+        authorization_server_jwks: JwkSet | dict[str, Any] | None = None,
+        session: requests.Session | None = None,
+        https: bool = True,
+        testing: bool = False,
+        **kwargs: Any,
+    ) -> OAuth2Client:
+        """Initialize an OAuth2Client, based on the server metadata from `discovery`.
+
+        Args:
+             discovery: a dict of server metadata, in the same format as retrieved from a discovery endpoint.
+             issuer: if an issuer is given, check that it matches the one mentioned in the document
+             auth: the authentication handler to use for client authentication
+             client_id: client ID
+             client_secret: client secret to use to authenticate the client
+             private_key: private key to sign client assertions
+             authorization_server_jwks: the current authorization server JWKS keys
+             session: a requests Session to use to retrieve the document and initialise the client with
+             https: (deprecated) if `True`, validates that urls in the discovery document use the https scheme
+             testing: if True, don't try to validate the endpoint urls that are part of the document
+             **kwargs: additional args that will be passed to OAuth2Client
+
+        Returns:
+            an `OAuth2Client` initialized with the endpoints from the discovery document
+
+        Raises:
+            InvalidDiscoveryDocument: if the document does not contain at least a `"token_endpoint"`.
+
+        """
+        if not https:
+            warnings.warn(
+                """\
+The https parameter is deprecated.
+To disable endpoint uri validation, set `testing=True` when initializing your `OAuth2Client`.""",
+                stacklevel=1,
+            )
+            testing = True
+        if issuer and discovery.get("issuer") != issuer:
+            msg = (
+                f"Mismatching `issuer` value in discovery document"
+                f" (received '{discovery.get('issuer')}', expected '{issuer}')"
+            )
+            raise InvalidParam(
+                msg,
+                issuer,
+                discovery.get("issuer"),
+            )
+        if issuer is None:
+            issuer = discovery.get("issuer")
+
+        token_endpoint = discovery.get(Endpoints.TOKEN)
+        if token_endpoint is None:
+            msg = "token_endpoint not found in that discovery document"
+            raise InvalidDiscoveryDocument(msg, discovery)
+        authorization_endpoint = discovery.get(Endpoints.AUTHORIZATION)
+        revocation_endpoint = discovery.get(Endpoints.REVOCATION)
+        introspection_endpoint = discovery.get(Endpoints.INSTROSPECTION)
+        userinfo_endpoint = discovery.get(Endpoints.USER_INFO)
+        jwks_uri = discovery.get(Endpoints.JWKS)
+        if jwks_uri is not None:
+            validate_endpoint_uri(jwks_uri, https=https)
+        authorization_response_iss_parameter_supported = discovery.get(
+            "authorization_response_iss_parameter_supported",
+            False,
+        )
+
+        return cls(
+            token_endpoint=token_endpoint,
+            authorization_endpoint=authorization_endpoint,
+            revocation_endpoint=revocation_endpoint,
+            introspection_endpoint=introspection_endpoint,
+            userinfo_endpoint=userinfo_endpoint,
+            jwks_uri=jwks_uri,
+            authorization_server_jwks=authorization_server_jwks,
+            auth=auth,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_key=private_key,
+            session=session,
+            issuer=issuer,
+            authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
+            testing=testing,
+            **kwargs,
+        )
+
+    def __enter__(self) -> Self:
+        """Allow using `OAuth2Client` as a context-manager.
+
+        The Authorization Server public keys are retrieved on `__enter__`.
+
+        """
+        self.update_authorization_server_public_keys()
+        return self
+
+    def __exit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
+    ) -> bool:
+        return True
+
+    def _require_endpoint(self, endpoint: str) -> str:
+        """Check that a required endpoint url is set."""
+        url = getattr(self, endpoint, None)
+        if not url:
+            raise MissingEndpointUri(endpoint)
+
+        return str(url)
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
token - str | BearerToken - -
-

the token to instrospect

-
- 		- required -
token_type_hint - str | None - -
-

the token_type_hint to include in the request.

-
- 		- None -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters to the underling call to requests.post()

-
- 		- None -
**introspect_kwargs - Any - -
-

additional parameters to send to the introspection endpoint.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Any - -
-

the response as returned by the Introspection Endpoint.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1099
-1100
-1101
-1102
-1103
-1104
-1105
-1106
-1107
-1108
-1109
-1110
-1111
-1112
-1113
-1114
-1115
-1116
-1117
-1118
-1119
-1120
-1121
-1122
-1123
-1124
-1125
-1126
-1127
-1128
-1129
-1130
-1131
-1132
-1133
-1134
-1135
-1136
-1137
-1138
-1139
-1140
-1141
-1142
-1143
-1144
-1145
-1146
-1147
-1148
-1149
-1150
-1151
-1152
-1153
-1154
-1155
-1156
-1157
-1158
-1159
-1160
-1161
def introspect_token(
-    self,
-    token: str | BearerToken,
-    token_type_hint: str | None = None,
-    requests_kwargs: dict[str, Any] | None = None,
-    **introspect_kwargs: Any,
-) -> Any:
-    """Send a request to the Introspection Endpoint.
-
-    Parameter `token` can be:
-
-    - a `str`
-    - a `BearerToken` instance
-
-    You may pass any arbitrary `token` and `token_type_hint` values as `str`. Those will
-    be included in the request, as-is.
-    If `token` is a `BearerToken`, then `token_type_hint` must be either:
-
-    - `None`: the access_token will be instrospected and no token_type_hint will be included
-    in the request
-    - `access_token`: same as `None`, but the token_type_hint will be included
-    - or `refresh_token`: only available if a Refresh Token is present in the BearerToken.
-
-    Args:
-        token: the token to instrospect
-        token_type_hint: the `token_type_hint` to include in the request.
-        requests_kwargs: additional parameters to the underling call to requests.post()
-        **introspect_kwargs: additional parameters to send to the introspection endpoint.
-
-    Returns:
-        the response as returned by the Introspection Endpoint.
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    if isinstance(token, BearerToken):
-        if token_type_hint is None or token_type_hint == TokenType.ACCESS_TOKEN:
-            token = token.access_token
-        elif token_type_hint == TokenType.REFRESH_TOKEN:
-            if token.refresh_token is None:
-                msg = "The supplied BearerToken doesn't have a refresh token."
-                raise ValueError(msg)
-            else:
-                token = token.refresh_token
-        else:
-            msg = (
-                "Invalid `token_type_hint`. To test arbitrary `token_type_hint` values,"
-                " you must provide `token` as a `str`."
-            )
-            raise ValueError(msg)
-
-    data = dict(introspect_kwargs, token=str(token))
-    if token_type_hint:
-        data["token_type_hint"] = token_type_hint
-
-    return self._request(
-        "introspection_endpoint",
-        data=data,
-        auth=self.auth,
-        on_success=self.parse_introspection_response,
-        on_failure=self.on_introspection_error,
-        **requests_kwargs,
-    )
-
-
-
+
-
-
-

- parse_introspection_response(response) -

+
-
- -

Parse Token Introspection Responses received by introspect_token().

-

Invoked by introspect_token() -to parse the returned response. This decodes the JSON content if possible, otherwise it -returns the response as a string.

+

+ client_id: str + + property + -

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the Response as returned by the Introspection Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Any - -
-

the decoded JSON content, or a str with the content.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1163
-1164
-1165
-1166
-1167
-1168
-1169
-1170
-1171
-1172
-1173
-1174
-1175
-1176
-1177
-1178
-1179
-1180
def parse_introspection_response(self, response: requests.Response) -> Any:
-    """Parse Token Introspection Responses received by `introspect_token()`.
-
-    Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
-    to parse the returned response. This decodes the JSON content if possible, otherwise it
-    returns the response as a string.
-
-    Args:
-        response: the [Response][requests.Response] as returned by the Introspection Endpoint.
-
-    Returns:
-        the decoded JSON content, or a `str` with the content.
-
-    """
-    try:
-        return response.json()
-    except ValueError:
-        return response.text
-
-
-

+ -
+
-
+

Client ID.

+
+
+
-

- on_introspection_error(response) -

+

+ client_secret: str | None -
- -

Error handler for introspect_token().

-

Invoked by introspect_token() -to parse the returned response in the case an error is returned.

- + + property + +

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the response as returned by the Introspection Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Any - -
-

usually raises exceptions. A subclass can return a default response instead.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1182
-1183
-1184
-1185
-1186
-1187
-1188
-1189
-1190
-1191
-1192
-1193
-1194
-1195
-1196
-1197
-1198
-1199
-1200
-1201
-1202
-1203
-1204
def on_introspection_error(self, response: requests.Response) -> Any:
-    """Error handler for `introspect_token()`.
-
-    Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
-    to parse the returned response in the case an error is returned.
-
-    Args:
-        response: the response as returned by the Introspection Endpoint.
-
-    Returns:
-        usually raises exceptions. A subclass can return a default response instead.
-
-    """
-    try:
-        data = response.json()
-        error = data["error"]
-        error_description = data.get("error_description")
-        error_uri = data.get("error_uri")
-        exception_class = self.exception_classes.get(error, IntrospectionError)
-        exception = exception_class(error, error_description, error_uri)
-    except Exception as exc:
-        raise UnknownIntrospectionError(response) from exc
-    raise exception
-
-
-
-
+
+

Client Secret.

+
-
+
+
-

- backchannel_authentication_request(scope='openid', *, client_notification_token=None, acr_values=None, login_hint_token=None, id_token_hint=None, login_hint=None, binding_message=None, user_code=None, requested_expiry=None, private_jwk=None, alg=None, requests_kwargs=None, **ciba_kwargs) -

+

+ client_jwks: JwkSet + + property + -
- -

Send a CIBA Authentication Request.

+

+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
scope - None | str | Iterable[str] - -
-

the scope to include in the request.

-
- 		- 'openid' -
client_notification_token - str | None - -
-

the Client Notification Token to include in the request.

-
- 		- None -
acr_values - None | str | Iterable[str] - -
-

the acr values to include in the request.

-
- 		- None -
login_hint_token - str | None - -
-

the Login Hint Token to include in the request.

-
- 		- None -
id_token_hint - str | None - -
-

the ID Token Hint to include in the request.

-
- 		- None -
login_hint - str | None - -
-

the Login Hint to include in the request.

-
- 		- None -
binding_message - str | None - -
-

the Binding Message to include in the request.

-
- 		- None -
user_code - str | None - -
-

the User Code to include in the request

-
- 		- None -
requested_expiry - int | None - -
-

the Requested Expiry, in seconds, to include in the request.

-
- 		- None -
private_jwk - Jwk | dict[str, Any] | None - -
-

the JWK to use to sign the request (optional)

-
- 		- None -
alg - str | None - -
-

the alg to use to sign the request, if the provided JWK does not include an "alg" parameter.

-
- 		- None -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for

-
- 		- None -
**ciba_kwargs - Any - -
-

additional parameters to include in the request.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BackChannelAuthenticationResponse - -
-

a BackChannelAuthenticationResponse as returned by AS

-
-
- -
- Source code in requests_oauth2client/client.py - 
1206
-1207
-1208
-1209
-1210
-1211
-1212
-1213
-1214
-1215
-1216
-1217
-1218
-1219
-1220
-1221
-1222
-1223
-1224
-1225
-1226
-1227
-1228
-1229
-1230
-1231
-1232
-1233
-1234
-1235
-1236
-1237
-1238
-1239
-1240
-1241
-1242
-1243
-1244
-1245
-1246
-1247
-1248
-1249
-1250
-1251
-1252
-1253
-1254
-1255
-1256
-1257
-1258
-1259
-1260
-1261
-1262
-1263
-1264
-1265
-1266
-1267
-1268
-1269
-1270
-1271
-1272
-1273
-1274
-1275
-1276
-1277
-1278
-1279
-1280
-1281
-1282
-1283
-1284
-1285
-1286
-1287
-1288
-1289
-1290
-1291
def backchannel_authentication_request(  # noqa: PLR0913
-    self,
-    scope: None | str | Iterable[str] = "openid",
-    *,
-    client_notification_token: str | None = None,
-    acr_values: None | str | Iterable[str] = None,
-    login_hint_token: str | None = None,
-    id_token_hint: str | None = None,
-    login_hint: str | None = None,
-    binding_message: str | None = None,
-    user_code: str | None = None,
-    requested_expiry: int | None = None,
-    private_jwk: Jwk | dict[str, Any] | None = None,
-    alg: str | None = None,
-    requests_kwargs: dict[str, Any] | None = None,
-    **ciba_kwargs: Any,
-) -> BackChannelAuthenticationResponse:
-    """Send a CIBA Authentication Request.
-
-    Args:
-         scope: the scope to include in the request.
-         client_notification_token: the Client Notification Token to include in the request.
-         acr_values: the acr values to include in the request.
-         login_hint_token: the Login Hint Token to include in the request.
-         id_token_hint: the ID Token Hint to include in the request.
-         login_hint: the Login Hint to include in the request.
-         binding_message: the Binding Message to include in the request.
-         user_code: the User Code to include in the request
-         requested_expiry: the Requested Expiry, in seconds, to include in the request.
-         private_jwk: the JWK to use to sign the request (optional)
-         alg: the alg to use to sign the request, if the provided JWK does not include an "alg" parameter.
-         requests_kwargs: additional parameters for
-         **ciba_kwargs: additional parameters to include in the request.
-
-    Returns:
-        a BackChannelAuthenticationResponse as returned by AS
-
-    """
-    if not (login_hint or login_hint_token or id_token_hint):
-        msg = "One of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
-        raise ValueError(msg)
-
-    if (login_hint_token and id_token_hint) or (login_hint and id_token_hint) or (login_hint_token and login_hint):
-        msg = "Only one of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
-        raise ValueError(msg)
-
-    requests_kwargs = requests_kwargs or {}
-
-    if scope is not None and not isinstance(scope, str):
-        try:
-            scope = " ".join(scope)
-        except Exception as exc:
-            msg = "Unsupported `scope` value"
-            raise ValueError(msg) from exc
-
-    if acr_values is not None and not isinstance(acr_values, str):
-        try:
-            acr_values = " ".join(acr_values)
-        except Exception as exc:
-            msg = "Unsupported `acr_values`"
-            raise ValueError(msg) from exc
-
-    data = dict(
-        ciba_kwargs,
-        scope=scope,
-        client_notification_token=client_notification_token,
-        acr_values=acr_values,
-        login_hint_token=login_hint_token,
-        id_token_hint=id_token_hint,
-        login_hint=login_hint,
-        binding_message=binding_message,
-        user_code=user_code,
-        requested_expiry=requested_expiry,
-    )
-
-    if private_jwk is not None:
-        data = {"request": str(Jwt.sign(data, key=private_jwk, alg=alg))}
-
-    return self._request(
-        "backchannel_authentication_endpoint",
-        data=data,
-        auth=self.auth,
-        on_success=self.parse_backchannel_authentication_response,
-        on_failure=self.on_backchannel_authentication_error,
-        **requests_kwargs,
-    )
-
-
-
+

A JwkSet containing the public keys for this client.

+

Keys are:

+
    +
  • the public key for client assertion signature verification (if using private_key_jwt)
    • +
  • the ID Token encryption key
    • +
+
-
- +
-

- parse_backchannel_authentication_response(response) -

+

+ validate_endpoint_uri(attribute, uri) +

-
- -

Parse a response received by backchannel_authentication_request().

-

Invoked by -backchannel_authentication_request() -to parse the response returned by the BackChannel Authentication Endpoint.

+
+

Validate that an endpoint URI is suitable for use.

+

If you need to disable some checks (for AS testing purposes only!), provide a different +method here.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the response returned by the BackChannel Authentication Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BackChannelAuthenticationResponse - -
-

a BackChannelAuthenticationResponse

-
-
- -
- Source code in requests_oauth2client/client.py - 
1293
-1294
-1295
-1296
-1297
-1298
-1299
-1300
-1301
-1302
-1303
-1304
-1305
-1306
-1307
-1308
-1309
-1310
-1311
-1312
def parse_backchannel_authentication_response(
-    self, response: requests.Response
-) -> BackChannelAuthenticationResponse:
-    """Parse a response received by `backchannel_authentication_request()`.
-
-    Invoked by
-    [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
-    to parse the response returned by the BackChannel Authentication Endpoint.
-
-    Args:
-        response: the response returned by the BackChannel Authentication Endpoint.
-
-    Returns:
-        a `BackChannelAuthenticationResponse`
-
-    """
-    try:
-        return BackChannelAuthenticationResponse(**response.json())
-    except TypeError as exc:
-        raise InvalidBackChannelAuthenticationResponse(response) from exc
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
409
+410
+411
+412
+413
+414
+415
+416
+417
+418
+419
+420
+421
+422
+423
+424
+425
+426
+427
+428
+429
+430
@token_endpoint.validator
+@revocation_endpoint.validator
+@introspection_endpoint.validator
+@userinfo_endpoint.validator
+@authorization_endpoint.validator
+@backchannel_authentication_endpoint.validator
+@device_authorization_endpoint.validator
+@pushed_authorization_request_endpoint.validator
+@jwks_uri.validator
+def validate_endpoint_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
+    """Validate that an endpoint URI is suitable for use.
+
+    If you need to disable some checks (for AS testing purposes only!), provide a different
+    method here.
+
+    """
+    if self.testing or uri is None:
+        return uri
+    try:
+        return validate_endpoint_uri(uri)
+    except InvalidUri as exc:
+        raise InvalidEndpointUri(endpoint=attribute.name, uri=uri, exc=exc) from exc
+
+
+
-
+

+ validate_issuer_uri(attribute, uri) -

- on_backchannel_authentication_error(response) - -

- + -
- -

Error handler for backchannel_authentication_request().

-

Invoked by -backchannel_authentication_request() -to parse the response returned by the BackChannel Authentication Endpoint, when it is an -error.

+
+

Validate that an Issuer identifier is suitable for use.

+

This is the same check as an endpoint URI, but the path may be (and usually is) empty.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the response returned by the BackChannel Authentication Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BackChannelAuthenticationResponse - -
-

usually raises an exception. But a subclass can return a default response instead.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1314
-1315
-1316
-1317
-1318
-1319
-1320
-1321
-1322
-1323
-1324
-1325
-1326
-1327
-1328
-1329
-1330
-1331
-1332
-1333
-1334
-1335
-1336
-1337
-1338
def on_backchannel_authentication_error(self, response: requests.Response) -> BackChannelAuthenticationResponse:
-    """Error handler for `backchannel_authentication_request()`.
-
-    Invoked by
-    [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
-    to parse the response returned by the BackChannel Authentication Endpoint, when it is an
-    error.
-
-    Args:
-        response: the response returned by the BackChannel Authentication Endpoint.
-
-    Returns:
-        usually raises an exception. But a subclass can return a default response instead.
-
-    """
-    try:
-        data = response.json()
-        error = data["error"]
-        error_description = data.get("error_description")
-        error_uri = data.get("error_uri")
-        exception_class = self.exception_classes.get(error, BackChannelAuthenticationError)
-        exception = exception_class(error, error_description, error_uri)
-    except Exception as exc:
-        raise InvalidBackChannelAuthenticationResponse(response) from exc
-    raise exception
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
432
+433
+434
+435
+436
+437
+438
+439
+440
+441
+442
+443
+444
@issuer.validator
+def validate_issuer_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
+    """Validate that an Issuer identifier is suitable for use.
+
+    This is the same check as an endpoint URI, but the path may be (and usually is) empty.
+
+    """
+    if self.testing or uri is None:
+        return uri
+    try:
+        return validate_issuer_uri(uri)
+    except InvalidUri as exc:
+        raise InvalidIssuer(attribute.name, uri, exc) from exc
+
+
+
-
+

+ token_request(data, timeout=10, **requests_kwargs) -

- authorize_device(requests_kwargs=None, **data) +

- +
-
- -

Send a Device Authorization Request.

+

Send a request to the token endpoint.

+

Authentication will be added automatically based on the defined auth for this client.

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
data + dict[str, Any] + +
+

parameters to send to the token endpoint. Items with a None + or empty value will not be sent in the request.

+
+ 		+ required +
timeout + int + +
+

a timeout value for the call

+
+ 		+ 10 +
**requests_kwargs + Any + +
+

additional parameters for requests.post()

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

the token endpoint response, as

+
+
+ BearerToken + +
+

BearerToken instance.

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
**data - Any - -
-

additional data to send to the Device Authorization Endpoint

-
- 		- {} -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for requests.request()

-
- 		- None -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- DeviceAuthorizationResponse - -
-

a Device Authorization Response

-
-
- -
- Source code in requests_oauth2client/client.py - 
1340
-1341
-1342
-1343
-1344
-1345
-1346
-1347
-1348
-1349
-1350
-1351
-1352
-1353
-1354
-1355
-1356
-1357
-1358
-1359
-1360
-1361
-1362
def authorize_device(
-    self, requests_kwargs: dict[str, Any] | None = None, **data: Any
-) -> DeviceAuthorizationResponse:
-    """Send a Device Authorization Request.
-
-    Args:
-        **data: additional data to send to the Device Authorization Endpoint
-        requests_kwargs: additional parameters for `requests.request()`
-
-    Returns:
-        a Device Authorization Response
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    return self._request(
-        "device_authorization_endpoint",
-        data=data,
-        auth=self.auth,
-        on_success=self.parse_device_authorization_response,
-        on_failure=self.on_device_authorization_error,
-        **requests_kwargs,
-    )
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
521
+522
+523
+524
+525
+526
+527
+528
+529
+530
+531
+532
+533
+534
+535
+536
+537
+538
+539
+540
+541
+542
+543
+544
+545
+546
+547
+548
+549
+550
def token_request(
+    self,
+    data: dict[str, Any],
+    timeout: int = 10,
+    **requests_kwargs: Any,
+) -> BearerToken:
+    """Send a request to the token endpoint.
+
+    Authentication will be added automatically based on the defined `auth` for this client.
+
+    Args:
+      data: parameters to send to the token endpoint. Items with a `None`
+           or empty value will not be sent in the request.
+      timeout: a timeout value for the call
+      **requests_kwargs: additional parameters for requests.post()
+
+    Returns:
+        the token endpoint response, as
+        [`BearerToken`][requests_oauth2client.tokens.BearerToken] instance.
+
+    """
+    return self._request(
+        Endpoints.TOKEN,
+        auth=self.auth,
+        data=data,
+        timeout=timeout,
+        on_success=self.parse_token_response,
+        on_failure=self.on_token_error,
+        **requests_kwargs,
+    )
+
+
+
-
+

+ parse_token_response(response) -

- parse_device_authorization_response(response) +

- +
-
- -

Parse a Device Authorization Response received by authorize_device().

-

Invoked by authorize_device() -to parse the response returned by the Device Authorization Endpoint.

+

Parse a Response returned by the Token Endpoint.

+

Invoked by token_request to parse +responses returned by the Token Endpoint. Those responses contain an access_token and +additional attributes.

+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the Response returned by the Token Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken based on the response

+
+
+ BearerToken + +
+

contents.

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the response returned by the Device Authorization Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- DeviceAuthorizationResponse - -
-

a DeviceAuthorizationResponse as returned by AS

-
-
- -
- Source code in requests_oauth2client/client.py - 
1364
-1365
-1366
-1367
-1368
-1369
-1370
-1371
-1372
-1373
-1374
-1375
-1376
-1377
-1378
def parse_device_authorization_response(self, response: requests.Response) -> DeviceAuthorizationResponse:
-    """Parse a Device Authorization Response received by `authorize_device()`.
-
-    Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
-    to parse the response returned by the Device Authorization Endpoint.
-
-    Args:
-        response: the response returned by the Device Authorization Endpoint.
-
-    Returns:
-        a `DeviceAuthorizationResponse` as returned by AS
-
-    """
-    device_authorization_response = DeviceAuthorizationResponse(**response.json())
-    return device_authorization_response
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
552
+553
+554
+555
+556
+557
+558
+559
+560
+561
+562
+563
+564
+565
+566
+567
+568
+569
+570
+571
+572
def parse_token_response(self, response: requests.Response) -> BearerToken:
+    """Parse a Response returned by the Token Endpoint.
+
+    Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] to parse
+    responses returned by the Token Endpoint. Those responses contain an `access_token` and
+    additional attributes.
+
+    Args:
+        response: the [Response][requests.Response] returned by the Token Endpoint.
+
+    Returns:
+        a [`BearerToken`][requests_oauth2client.tokens.BearerToken] based on the response
+        contents.
+
+    """
+    try:
+        token_response = self.token_class(**response.json())
+    except Exception:  # noqa: BLE001
+        return self.on_token_error(response)
+    else:
+        return token_response
+
+
+
-
+

+ on_token_error(response) -

- on_device_authorization_error(response) +

- +
-
- -

Error handler for authorize_device().

-

Invoked by authorize_device() -to parse the response returned by the Device Authorization Endpoint, when that response is -an error.

+

Error handler for token_request().

+

Invoked by token_request when the +Token Endpoint returns an error.

+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the Response returned by the Token Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

nothing, and raises an exception instead. But a subclass may return a

+
+
+ BearerToken + +
+

BearerToken to implement a default

+
+
+ BearerToken + +
+

behaviour if needed.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ InvalidTokenResponse + +
+

if the error response does not contain an OAuth 2.0 standard +error response.

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the response returned by the Device Authorization Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- DeviceAuthorizationResponse - -
-

usually raises an Exception. But a subclass may return a default response instead.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1380
-1381
-1382
-1383
-1384
-1385
-1386
-1387
-1388
-1389
-1390
-1391
-1392
-1393
-1394
-1395
-1396
-1397
-1398
-1399
-1400
-1401
-1402
-1403
def on_device_authorization_error(self, response: requests.Response) -> DeviceAuthorizationResponse:
-    """Error handler for `authorize_device()`.
-
-    Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
-    to parse the response returned by the Device Authorization Endpoint, when that response is
-    an error.
-
-    Args:
-        response: the response returned by the Device Authorization Endpoint.
-
-    Returns:
-        usually raises an Exception. But a subclass may return a default response instead.
-
-    """
-    try:
-        data = response.json()
-        error = data["error"]
-        error_description = data.get("error_description")
-        error_uri = data.get("error_uri")
-        exception_class = self.exception_classes.get(error, DeviceAuthorizationError)
-        exception = exception_class(response, error, error_description, error_uri)
-    except Exception as exc:
-        raise InvalidDeviceAuthorizationResponse(response) from exc
-    raise exception
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
574
+575
+576
+577
+578
+579
+580
+581
+582
+583
+584
+585
+586
+587
+588
+589
+590
+591
+592
+593
+594
+595
+596
+597
+598
+599
+600
+601
+602
+603
+604
+605
+606
+607
+608
def on_token_error(self, response: requests.Response) -> BearerToken:
+    """Error handler for `token_request()`.
+
+    Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] when the
+    Token Endpoint returns an error.
+
+    Args:
+        response: the [Response][requests.Response] returned by the Token Endpoint.
+
+    Returns:
+        nothing, and raises an exception instead. But a subclass may return a
+        [`BearerToken`][requests_oauth2client.tokens.BearerToken] to implement a default
+        behaviour if needed.
+
+    Raises:
+        InvalidTokenResponse: if the error response does not contain an OAuth 2.0 standard
+            error response.
+
+    """
+    try:
+        data = response.json()
+        error = data["error"]
+        error_description = data.get("error_description")
+        error_uri = data.get("error_uri")
+        exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
+        exception = exception_class(
+            response=response,
+            client=self,
+            error=error,
+            description=error_description,
+            uri=error_uri,
+        )
+    except Exception as exc:
+        raise InvalidTokenResponse(response=response, client=self) from exc
+    raise exception
+
+
+
-
+

+ client_credentials(scope=None, *, requests_kwargs=None, **token_kwargs) -

- update_authorization_server_public_keys(requests_kwargs=None) - -

+ -
- -

Update the cached AS public keys by retrieving them from its jwks_uri.

-

Public keys are returned by this method, as a jwskate.JwkSet. They are also -available in attribute authorization_server_jwks.

+
+

Send a request to the token endpoint using the client_credentials grant.

-

Returns:

- - - - - - - - - - - - - -
TypeDescription
- JwkSet - -
-

the retrieved public keys

-
-
- - - -

Raises:

- - - - - - - - - - - +

Parameters:

+
TypeDescription
- ValueError - -
-

if no jwks_uri is configured

-
-
+ + + + + + - -
NameTypeDescriptionDefault
- -
- Source code in requests_oauth2client/client.py - 
1405
-1406
-1407
-1408
-1409
-1410
-1411
-1412
-1413
-1414
-1415
-1416
-1417
-1418
-1419
-1420
-1421
-1422
-1423
-1424
-1425
-1426
-1427
-1428
-1429
def update_authorization_server_public_keys(self, requests_kwargs: dict[str, Any] | None = None) -> JwkSet:
-    """Update the cached AS public keys by retrieving them from its `jwks_uri`.
-
-    Public keys are returned by this method, as a `jwskate.JwkSet`. They are also
-    available in attribute `authorization_server_jwks`.
-
-    Returns:
-        the retrieved public keys
-
-    Raises:
-        ValueError: if no `jwks_uri` is configured
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    jwks = self._request(
-        "jwks_uri",
-        auth=None,
-        method="GET",
-        on_success=lambda resp: resp.json(),
-        on_failure=lambda resp: resp.raise_for_status(),
-        **requests_kwargs,
-    )
-    self.authorization_server_jwks.update(jwks)
-    return self.authorization_server_jwks
-
-
-
+ + + + scope + + str | Iterable[str] | None + + +
+

the scope to send with the request. Can be a str, or an iterable of str. +to pass that way include scope, audience, resource, etc.

+
+ + + None + + + + requests_kwargs + + dict[str, Any] | None + + +
+

additional parameters for the call to requests

+
+ + + None + + + + **token_kwargs + + Any + + +
+

additional parameters for the token endpoint, alongside grant_type. Common parameters

+
+ + + {} + + + + + + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ InvalidScopeParam + +
+

if the scope parameter is not suitable

+
+
-
+
+ Source code in requests_oauth2client/client.py + 
610
+611
+612
+613
+614
+615
+616
+617
+618
+619
+620
+621
+622
+623
+624
+625
+626
+627
+628
+629
+630
+631
+632
+633
+634
+635
+636
+637
+638
+639
+640
+641
def client_credentials(
+    self,
+    scope: str | Iterable[str] | None = None,
+    *,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a request to the token endpoint using the `client_credentials` grant.
+
+    Args:
+        scope: the scope to send with the request. Can be a str, or an iterable of str.
+            to pass that way include `scope`, `audience`, `resource`, etc.
+        requests_kwargs: additional parameters for the call to requests
+        **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`. Common parameters
+
+    Returns:
+        a BearerToken
+
+    Raises:
+        InvalidScopeParam: if the `scope` parameter is not suitable
+
+    """
+    requests_kwargs = requests_kwargs or {}
+
+    if scope and not isinstance(scope, str):
+        try:
+            scope = " ".join(scope)
+        except Exception as exc:
+            raise InvalidScopeParam(scope) from exc
+
+    data = dict(grant_type=GrantTypes.CLIENT_CREDENTIALS, scope=scope, **token_kwargs)
+    return self.token_request(data, **requests_kwargs)
+
+
+
+
+

+ authorization_code(code, *, validate=True, requests_kwargs=None, **token_kwargs) -

- from_discovery_endpoint(url=None, issuer=None, *, auth=None, client_id=None, client_secret=None, private_key=None, session=None, testing=False, **kwargs) - - - classmethod - - -

+ -
- -

Initialise an OAuth2Client based on Authorization Server Metadata.

-

This will retrieve the standardised metadata document available at url, and will extract -all Endpoint Uris from that document, will fetch the current public keys from its -jwks_uri, then will initialise an OAuth2Client based on those endpoints.

+
+

Send a request to the token endpoint with the authorization_code grant.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +

Parameters:

+
NameTypeDescriptionDefault
url - str | None - -
-

the url where the server metadata will be retrieved

-
- 		- None -
auth - AuthBase | tuple[str, str] | str | None - -
-

the authentication handler to use for client authentication

-
- 		- None -
client_id - str | None - -
-

client ID

-
- 		- None -
client_secret - str | None - -
-

client secret to use to authenticate the client

-
- 		- None -
private_key - Jwk | dict[str, Any] | None - -
-

private key to sign client assertions

-
- 		- None -
session - Session | None - -
-

a requests.Session to use to retrieve the document and initialise the client with

-
- 		- None -
+ + + + + + - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
issuer - str | None - -
-

if an issuer is given, check that it matches the one from the retrieved document

-
- 		- None -
testing - bool - -
-

if True, don't try to validate the endpoint urls that are part of the document

-
- 		- False -
**kwargs - Any - -
-

additional keyword parameters to pass to OAuth2Client

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- OAuth2Client - -
-

an OAuth2Client with endpoint initialised based on the obtained metadata

-
-
- - - -

Raises:

- - - - - - - - - - - - - - - - - -
TypeDescription
- ValueError - -
-

if neither url nor issuer are suitable urls

-
-
- HTTPError - -
-

if an error happens while fetching the documents

-
-
- -
- Source code in requests_oauth2client/client.py - 
1431
-1432
-1433
-1434
-1435
-1436
-1437
-1438
-1439
-1440
-1441
-1442
-1443
-1444
-1445
-1446
-1447
-1448
-1449
-1450
-1451
-1452
-1453
-1454
-1455
-1456
-1457
-1458
-1459
-1460
-1461
-1462
-1463
-1464
-1465
-1466
-1467
-1468
-1469
-1470
-1471
-1472
-1473
-1474
-1475
-1476
-1477
-1478
-1479
-1480
-1481
-1482
-1483
-1484
-1485
-1486
-1487
-1488
-1489
-1490
-1491
-1492
-1493
-1494
-1495
-1496
@classmethod
-def from_discovery_endpoint(
-    cls,
-    url: str | None = None,
-    issuer: str | None = None,
-    *,
-    auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
-    client_id: str | None = None,
-    client_secret: str | None = None,
-    private_key: Jwk | dict[str, Any] | None = None,
-    session: requests.Session | None = None,
-    testing: bool = False,
-    **kwargs: Any,
-) -> OAuth2Client:
-    """Initialise an OAuth2Client based on Authorization Server Metadata.
-
-    This will retrieve the standardised metadata document available at `url`, and will extract
-    all Endpoint Uris from that document, will fetch the current public keys from its
-    `jwks_uri`, then will initialise an OAuth2Client based on those endpoints.
-
-    Args:
-         url: the url where the server metadata will be retrieved
-         auth: the authentication handler to use for client authentication
-         client_id: client ID
-         client_secret: client secret to use to authenticate the client
-         private_key: private key to sign client assertions
-         session: a `requests.Session` to use to retrieve the document and initialise the client with
-         issuer: if an issuer is given, check that it matches the one from the retrieved document
-         testing: if True, don't try to validate the endpoint urls that are part of the document
-         **kwargs: additional keyword parameters to pass to OAuth2Client
-
-    Returns:
-        an OAuth2Client with endpoint initialised based on the obtained metadata
-
-    Raises:
-        ValueError: if neither `url` nor `issuer` are suitable urls
-        requests.HTTPError: if an error happens while fetching the documents
-
-    """
-    if url is None and issuer is not None:
-        url = oidc_discovery_document_url(issuer)
-    if url is None:
-        msg = "Please specify at least one of `issuer` or `url`"
-        raise ValueError(msg)
-
-    validate_endpoint_uri(url, path=False)
-
-    session = session or requests.Session()
-    discovery = session.get(url).json()
-
-    jwks_uri = discovery.get("jwks_uri")
-    if jwks_uri:
-        jwks = JwkSet(session.get(jwks_uri).json())
-
-    return cls.from_discovery_document(
-        discovery,
-        issuer=issuer,
-        auth=auth,
-        session=session,
-        client_id=client_id,
-        client_secret=client_secret,
-        private_key=private_key,
-        authorization_server_jwks=jwks,
-        testing=testing,
-        **kwargs,
-    )
-
-
-
+ + + + code + + str | AuthorizationResponse + + +
+

an authorization code or an AuthorizationResponse to exchange for tokens

+
+ + + required + + + + validate + + bool + + +
+

if True, validate the received ID Token (this works only if code is an AuthorizationResponse)

+
+ + + True + + + + requests_kwargs + + dict[str, Any] | None + + +
+

additional parameters for the call to requests

+
+ + + None + + + + **token_kwargs + + Any + + +
+

additional parameters for the token endpoint, alongside grant_type, code, etc.

+
+ + + {} + + + + + + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
-
+
+ Source code in requests_oauth2client/client.py + 
643
+644
+645
+646
+647
+648
+649
+650
+651
+652
+653
+654
+655
+656
+657
+658
+659
+660
+661
+662
+663
+664
+665
+666
+667
+668
+669
+670
+671
+672
+673
+674
+675
+676
def authorization_code(
+    self,
+    code: str | AuthorizationResponse,
+    *,
+    validate: bool = True,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a request to the token endpoint with the `authorization_code` grant.
+
+    Args:
+         code: an authorization code or an `AuthorizationResponse` to exchange for tokens
+         validate: if `True`, validate the received ID Token (this works only if `code` is an AuthorizationResponse)
+         requests_kwargs: additional parameters for the call to requests
+         **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `code`, etc.
+
+    Returns:
+        a `BearerToken`
+
+    """
+    azr: AuthorizationResponse | None = None
+    if isinstance(code, AuthorizationResponse):
+        token_kwargs.setdefault("code_verifier", code.code_verifier)
+        token_kwargs.setdefault("redirect_uri", code.redirect_uri)
+        azr = code
+        code = code.code
+
+    requests_kwargs = requests_kwargs or {}
+
+    data = dict(grant_type=GrantTypes.AUTHORIZATION_CODE, code=code, **token_kwargs)
+    token = self.token_request(data, **requests_kwargs)
+    if validate and token.id_token and isinstance(azr, AuthorizationResponse):
+        return token.validate_id_token(self, azr)
+    return token
+
+
+
+
+

+ refresh_token(refresh_token, requests_kwargs=None, **token_kwargs) -

- from_discovery_document(discovery, issuer=None, *, auth=None, client_id=None, client_secret=None, private_key=None, authorization_server_jwks=None, session=None, https=True, testing=False, **kwargs) - - - classmethod - +

- +
-
- -

Initialise an OAuth2Client, based on the server metadata from discovery.

- +

Send a request to the token endpoint with the refresh_token grant.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
discovery - dict[str, Any] - -
-

a dict of server metadata, in the same format as retrieved from a discovery endpoint.

-
- 		- required -
issuer - str | None - -
-

if an issuer is given, check that it matches the one mentioned in the document

-
- 		- None -
auth - AuthBase | tuple[str, str] | str | None - -
-

the authentication handler to use for client authentication

-
- 		- None -
client_id - str | None - -
-

client ID

-
- 		- None -
client_secret - str | None - -
-

client secret to use to authenticate the client

-
- 		- None -
private_key - Jwk | dict[str, Any] | None - -
-

private key to sign client assertions

-
- 		- None -
authorization_server_jwks - JwkSet | dict[str, Any] | None - -
-

the current authorization server JWKS keys

-
- 		- None -
session - Session | None - -
-

a requests Session to use to retrieve the document and initialise the client with

-
- 		- None -
https - bool - -
-

(deprecated) if True, validates that urls in the discovery document use the https scheme

-
- 		- True -
testing - bool - -
-

if True, don't try to validate the endpoint urls that are part of the document

-
- 		- False -
**kwargs - Any - -
-

additional args that will be passed to OAuth2Client

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - +

Parameters:

+
TypeDescription
- OAuth2Client - -
-

an OAuth2Client

-
-
+ + + + + + - -
NameTypeDescriptionDefault
- -
- Source code in requests_oauth2client/client.py - 
1498
-1499
-1500
-1501
-1502
-1503
-1504
-1505
-1506
-1507
-1508
-1509
-1510
-1511
-1512
-1513
-1514
-1515
-1516
-1517
-1518
-1519
-1520
-1521
-1522
-1523
-1524
-1525
-1526
-1527
-1528
-1529
-1530
-1531
-1532
-1533
-1534
-1535
-1536
-1537
-1538
-1539
-1540
-1541
-1542
-1543
-1544
-1545
-1546
-1547
-1548
-1549
-1550
-1551
-1552
-1553
-1554
-1555
-1556
-1557
-1558
-1559
-1560
-1561
-1562
-1563
-1564
-1565
-1566
-1567
-1568
-1569
-1570
-1571
-1572
-1573
-1574
-1575
-1576
-1577
-1578
-1579
-1580
-1581
-1582
@classmethod
-def from_discovery_document(  # noqa: PLR0913
-    cls,
-    discovery: dict[str, Any],
-    issuer: str | None = None,
-    *,
-    auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
-    client_id: str | None = None,
-    client_secret: str | None = None,
-    private_key: Jwk | dict[str, Any] | None = None,
-    authorization_server_jwks: JwkSet | dict[str, Any] | None = None,
-    session: requests.Session | None = None,
-    https: bool = True,
-    testing: bool = False,
-    **kwargs: Any,
-) -> OAuth2Client:
-    """Initialise an OAuth2Client, based on the server metadata from `discovery`.
-
-    Args:
-         discovery: a dict of server metadata, in the same format as retrieved from a discovery endpoint.
-         issuer: if an issuer is given, check that it matches the one mentioned in the document
-         auth: the authentication handler to use for client authentication
-         client_id: client ID
-         client_secret: client secret to use to authenticate the client
-         private_key: private key to sign client assertions
-         authorization_server_jwks: the current authorization server JWKS keys
-         session: a requests Session to use to retrieve the document and initialise the client with
-         https: (deprecated) if `True`, validates that urls in the discovery document use the https scheme
-         testing: if True, don't try to validate the endpoint urls that are part of the document
-         **kwargs: additional args that will be passed to OAuth2Client
-
-    Returns:
-        an `OAuth2Client`
-
-    """
-    if not https:
-        warnings.warn(
-            "The https parameter is deprecated."
-            " To disable endpoint uri validation, set `testing=True` when initializing your OAuth2Client.",
-            stacklevel=1,
-        )
-        testing = True
-    if issuer and discovery.get("issuer") != issuer:
-        msg = "Mismatching issuer value in discovery document: "
-        raise ValueError(
-            msg,
-            issuer,
-            discovery.get("issuer"),
-        )
-    elif issuer is None:
-        issuer = discovery.get("issuer")
-
-    token_endpoint = discovery.get("token_endpoint")
-    if token_endpoint is None:
-        msg = "token_endpoint not found in that discovery document"
-        raise ValueError(msg)
-    authorization_endpoint = discovery.get("authorization_endpoint")
-    revocation_endpoint = discovery.get("revocation_endpoint")
-    introspection_endpoint = discovery.get("introspection_endpoint")
-    userinfo_endpoint = discovery.get("userinfo_endpoint")
-    jwks_uri = discovery.get("jwks_uri")
-    if jwks_uri is not None:
-        validate_endpoint_uri(jwks_uri, https=https)
-    authorization_response_iss_parameter_supported = discovery.get(
-        "authorization_response_iss_parameter_supported", False
-    )
-
-    return cls(
-        token_endpoint=token_endpoint,
-        authorization_endpoint=authorization_endpoint,
-        revocation_endpoint=revocation_endpoint,
-        introspection_endpoint=introspection_endpoint,
-        userinfo_endpoint=userinfo_endpoint,
-        jwks_uri=jwks_uri,
-        authorization_server_jwks=authorization_server_jwks,
-        auth=auth,
-        client_id=client_id,
-        client_secret=client_secret,
-        private_key=private_key,
-        session=session,
-        issuer=issuer,
-        authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
-        testing=testing,
-        **kwargs,
-    )
-
-
-
- -
- - - -
- -
+ + + + refresh_token + + str | BearerToken + + +
+

a refresh_token, as a string, or as a BearerToken. +That BearerToken must have a refresh_token.

+
+ + + required + + + + requests_kwargs + + dict[str, Any] | None + + +
+

additional parameters for the call to requests

+
+ + + None + + + + **token_kwargs + + Any + + +
+

additional parameters for the token endpoint, +alongside grant_type, refresh_token, etc.

+
+ + + {} + + + + + + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ MissingRefreshToken + +
+

if refresh_token is a BearerToken instance but does not +contain a refresh_token

+
+
+
+ Source code in requests_oauth2client/client.py + 
678
+679
+680
+681
+682
+683
+684
+685
+686
+687
+688
+689
+690
+691
+692
+693
+694
+695
+696
+697
+698
+699
+700
+701
+702
+703
+704
+705
+706
+707
+708
def refresh_token(
+    self,
+    refresh_token: str | BearerToken,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a request to the token endpoint with the `refresh_token` grant.
+
+    Args:
+        refresh_token: a refresh_token, as a string, or as a `BearerToken`.
+            That `BearerToken` must have a `refresh_token`.
+        requests_kwargs: additional parameters for the call to `requests`
+        **token_kwargs: additional parameters for the token endpoint,
+            alongside `grant_type`, `refresh_token`, etc.
+
+    Returns:
+        a `BearerToken`
+
+    Raises:
+        MissingRefreshToken: if `refresh_token` is a BearerToken instance but does not
+            contain a `refresh_token`
+
+    """
+    if isinstance(refresh_token, BearerToken):
+        if refresh_token.refresh_token is None or not isinstance(refresh_token.refresh_token, str):
+            raise MissingRefreshToken(refresh_token)
+        refresh_token = refresh_token.refresh_token
+
+    requests_kwargs = requests_kwargs or {}
+    data = dict(grant_type=GrantTypes.REFRESH_TOKEN, refresh_token=refresh_token, **token_kwargs)
+    return self.token_request(data, **requests_kwargs)
+
+
+
-
+
+

+ device_code(device_code, requests_kwargs=None, **token_kwargs) -

- BaseClientAuthenticationMethod +

- +
+

Send a request to the token endpoint using the Device Code grant.

+

The grant_type is urn:ietf:params:oauth:grant-type:device_code. This needs a Device Code, +or a DeviceAuthorizationResponse as parameter.

-
-

- Bases: AuthBase

- -

Base class for all Client Authentication methods. This extends [requests.auth.AuthBase].

-

This base class only checks that requests are suitable to add Client Authentication parameters -to, and doesn't modify the request.

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
device_code + str | DeviceAuthorizationResponse + +
+

a device code, or a DeviceAuthorizationResponse

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters for the call to requests

+
+ 		+ None +
**token_kwargs + Any + +
+

additional parameters for the token endpoint, alongside grant_type, device_code, etc.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ MissingDeviceCode + +
+

if device_code is a DeviceAuthorizationResponse but does not +contain a device_code.

+
+
- Source code in requests_oauth2client/client_authentication.py - 
21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
class BaseClientAuthenticationMethod(requests.auth.AuthBase):
-    """Base class for all Client Authentication methods. This extends [requests.auth.AuthBase].
-
-    This base class only checks that requests are suitable to add Client Authentication parameters
-    to, and doesn't modify the request.
-
-    """
-
-    def __init__(self, client_id: str):
-        self.client_id = str(client_id)
-
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        """Check that the request is suitable for Client Authentication.
-
-        It checks:
-
-        * that the method is `POST`
-        * that the Content-Type is "application/x-www-form-urlencoded" or None
-
-        Args:
-            request: a [requests.PreparedRequest][]
-
-        Returns:
-            a [requests.PreparedRequest][], unmodified
-
-        Raises:
-            RuntimeError: if the request is not suitable for OAuth 2.0 Client Authentication
-
-        """
-        if request.method != "POST" or request.headers.get("Content-Type") not in (
-            "application/x-www-form-urlencoded",
-            None,
-        ):
-            msg = "This request is not suitable for OAuth 2.0 Client Authentication"
-            raise RuntimeError(msg)
-        return request
-
+ Source code in requests_oauth2client/client.py + 
710
+711
+712
+713
+714
+715
+716
+717
+718
+719
+720
+721
+722
+723
+724
+725
+726
+727
+728
+729
+730
+731
+732
+733
+734
+735
+736
+737
+738
+739
+740
+741
+742
+743
+744
+745
def device_code(
+    self,
+    device_code: str | DeviceAuthorizationResponse,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a request to the token endpoint using the Device Code grant.
+
+    The grant_type is `urn:ietf:params:oauth:grant-type:device_code`. This needs a Device Code,
+    or a `DeviceAuthorizationResponse` as parameter.
+
+    Args:
+        device_code: a device code, or a `DeviceAuthorizationResponse`
+        requests_kwargs: additional parameters for the call to requests
+        **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `device_code`, etc.
+
+    Returns:
+        a `BearerToken`
+
+    Raises:
+        MissingDeviceCode: if `device_code` is a DeviceAuthorizationResponse but does not
+            contain a `device_code`.
+
+    """
+    if isinstance(device_code, DeviceAuthorizationResponse):
+        if device_code.device_code is None or not isinstance(device_code.device_code, str):
+            raise MissingDeviceCode(device_code)
+        device_code = device_code.device_code
+
+    requests_kwargs = requests_kwargs or {}
+    data = dict(
+        grant_type=GrantTypes.DEVICE_CODE,
+        device_code=device_code,
+        **token_kwargs,
+    )
+    return self.token_request(data, **requests_kwargs)
+
+
- - -
- - - +
+
+

+ ciba(auth_req_id, requests_kwargs=None, **token_kwargs) +

+
+

Send a CIBA request to the Token Endpoint.

+

A CIBA request is a Token Request using the urn:openid:params:grant-type:ciba grant.

-
-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
auth_req_id + str | BackChannelAuthenticationResponse + +
+

an authentication request ID, as returned by the AS

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters for the call to requests

+
+ 		+ None +
**token_kwargs + Any + +
+

additional parameters for the token endpoint, alongside grant_type, auth_req_id, etc.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ MissingAuthRequestId + +
+

if auth_req_id is a BackChannelAuthenticationResponse but does not contain +an auth_req_id.

+
+
+
+ Source code in requests_oauth2client/client.py + 
747
+748
+749
+750
+751
+752
+753
+754
+755
+756
+757
+758
+759
+760
+761
+762
+763
+764
+765
+766
+767
+768
+769
+770
+771
+772
+773
+774
+775
+776
+777
+778
+779
+780
+781
def ciba(
+    self,
+    auth_req_id: str | BackChannelAuthenticationResponse,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a CIBA request to the Token Endpoint.
+
+    A CIBA request is a Token Request using the `urn:openid:params:grant-type:ciba` grant.
+
+    Args:
+        auth_req_id: an authentication request ID, as returned by the AS
+        requests_kwargs: additional parameters for the call to requests
+        **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `auth_req_id`, etc.
+
+    Returns:
+        a `BearerToken`
+
+    Raises:
+        MissingAuthRequestId: if `auth_req_id` is a BackChannelAuthenticationResponse but does not contain
+            an `auth_req_id`.
+
+    """
+    if isinstance(auth_req_id, BackChannelAuthenticationResponse):
+        if auth_req_id.auth_req_id is None or not isinstance(auth_req_id.auth_req_id, str):
+            raise MissingAuthRequestId(auth_req_id)
+        auth_req_id = auth_req_id.auth_req_id
+
+    requests_kwargs = requests_kwargs or {}
+    data = dict(
+        grant_type=GrantTypes.CLIENT_INITIATED_BACKCHANNEL_AUTHENTICATION,
+        auth_req_id=auth_req_id,
+        **token_kwargs,
+    )
+    return self.token_request(data, **requests_kwargs)
+
+
+
-
- - - -

- ClientAssertionAuthenticationMethod +
-

+

+ token_exchange(subject_token, subject_token_type=None, actor_token=None, actor_token_type=None, requested_token_type=None, requests_kwargs=None, **token_kwargs) +

-
-

- Bases: BaseClientAuthenticationMethod

- -

Base class for assertion-based client authentication methods.

+
+

Send a Token Exchange request.

+

A Token Exchange request is actually a request to the Token Endpoint with a grant_type +urn:ietf:params:oauth:grant-type:token-exchange.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client_id - str - -
-

the client_id to use

-
- 		- required -
alg - str - -
-

the alg to use to sign generated Client Assertions.

-
- 		- required -
lifetime - int - -
-

the lifetime to use for generated Client Assertions.

-
- 		- required -
jti_gen - Callable[[], str] - -
-

a function to generate JWT Token Ids (jti) for generated Client Assertions.

-
- 		- required -
aud - str | None - -
-

the audience value to use. If None (default), the endpoint URL will be used.

-
- 		- None -
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
subject_token + str | BearerToken | IdToken + +
+

the subject token to exchange for a new token.

+
+ 		+ required +
subject_token_type + str | None + +
+

a token type identifier for the subject_token, mandatory if it cannot be guessed based +on type(subject_token).

+
+ 		+ None +
actor_token + None | str | BearerToken | IdToken + +
+

the actor token to include in the request, if any.

+
+ 		+ None +
actor_token_type + str | None + +
+

a token type identifier for the actor_token, mandatory if it cannot be guessed based +on type(actor_token).

+
+ 		+ None +
requested_token_type + str | None + +
+

a token type identifier for the requested token.

+
+ 		+ None +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters to pass to the underlying requests.post() call.

+
+ 		+ None +
**token_kwargs + Any + +
+

additional parameters to include in the request body.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken as returned by the Authorization Server.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ UnknownSubjectTokenType + +
+

if the type of subject_token cannot be determined automatically.

+
+
+ UnknownActorTokenType + +
+

if the type of actor_token cannot be determined automaticatlly.

+
+
- Source code in requests_oauth2client/client_authentication.py - 
132
-133
-134
-135
-136
-137
-138
-139
-140
-141
-142
-143
-144
-145
-146
-147
-148
-149
-150
-151
-152
-153
-154
-155
-156
-157
-158
-159
-160
-161
-162
-163
-164
-165
-166
-167
-168
-169
-170
-171
-172
-173
-174
-175
-176
-177
-178
-179
-180
-181
-182
-183
-184
-185
-186
-187
-188
-189
-190
-191
-192
-193
-194
-195
class ClientAssertionAuthenticationMethod(BaseClientAuthenticationMethod):
-    """Base class for assertion-based client authentication methods.
-
-    Args:
-        client_id: the client_id to use
-        alg: the alg to use to sign generated Client Assertions.
-        lifetime: the lifetime to use for generated Client Assertions.
-        jti_gen: a function to generate JWT Token Ids (`jti`) for generated Client Assertions.
-        aud: the audience value to use. If `None` (default), the endpoint URL will be used.
-
-    """
-
-    def __init__(
-        self,
-        client_id: str,
-        alg: str,
-        lifetime: int,
-        jti_gen: Callable[[], str],
-        aud: str | None = None,
-    ) -> None:
-        super().__init__(client_id)
-        self.alg = alg
-        self.lifetime = lifetime
-        self.jti_gen = jti_gen
-        self.aud = aud
-
-    def client_assertion(self, audience: str) -> str:
-        """Generate a Client Assertion for a specific audience.
-
-        Args:
-            audience: the audience to use for the `aud` claim of the generated Client Assertion.
-
-        Returns:
-            a Client Assertion, as `str`.
-
-        """
-        raise NotImplementedError()  # pragma: no cover
-
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        """Add a `client_assertion` field in the request body.
-
-        Args:
-            request: a [requests.PreparedRequest][].
-
-        Returns:
-            a [requests.PreparedRequest][] with the added `client_assertion` field.
-
-        """
-        request = super().__call__(request)
-        audience = self.aud or request.url
-        if audience is None:
-            msg = "No url defined for this request. This should never happen..."  # pragma: no cover
-            raise ValueError(msg)  # pragma: no cover
-        params = (
-            parse_qs(request.body, strict_parsing=True, keep_blank_values=True)  # type: ignore[type-var]
-            if request.body
-            else {}
-        )
-        client_assertion = self.client_assertion(audience)
-        params[b"client_id"] = [self.client_id.encode()]
-        params[b"client_assertion"] = [client_assertion.encode()]
-        params[b"client_assertion_type"] = [b"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]
-        request.prepare_body(params, files=None)
-        return request
-
+ Source code in requests_oauth2client/client.py + 
783
+784
+785
+786
+787
+788
+789
+790
+791
+792
+793
+794
+795
+796
+797
+798
+799
+800
+801
+802
+803
+804
+805
+806
+807
+808
+809
+810
+811
+812
+813
+814
+815
+816
+817
+818
+819
+820
+821
+822
+823
+824
+825
+826
+827
+828
+829
+830
+831
+832
+833
+834
+835
+836
+837
+838
def token_exchange(
+    self,
+    subject_token: str | BearerToken | IdToken,
+    subject_token_type: str | None = None,
+    actor_token: None | str | BearerToken | IdToken = None,
+    actor_token_type: str | None = None,
+    requested_token_type: str | None = None,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a Token Exchange request.
+
+    A Token Exchange request is actually a request to the Token Endpoint with a grant_type
+    `urn:ietf:params:oauth:grant-type:token-exchange`.
+
+    Args:
+        subject_token: the subject token to exchange for a new token.
+        subject_token_type: a token type identifier for the subject_token, mandatory if it cannot be guessed based
+            on `type(subject_token)`.
+        actor_token: the actor token to include in the request, if any.
+        actor_token_type: a token type identifier for the actor_token, mandatory if it cannot be guessed based
+            on `type(actor_token)`.
+        requested_token_type: a token type identifier for the requested token.
+        requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
+        **token_kwargs: additional parameters to include in the request body.
+
+    Returns:
+        a `BearerToken` as returned by the Authorization Server.
+
+    Raises:
+        UnknownSubjectTokenType: if the type of `subject_token` cannot be determined automatically.
+        UnknownActorTokenType: if the type of `actor_token` cannot be determined automaticatlly.
+
+    """
+    requests_kwargs = requests_kwargs or {}
+
+    try:
+        subject_token_type = self.get_token_type(subject_token_type, subject_token)
+    except ValueError as exc:
+        raise UnknownSubjectTokenType(subject_token, subject_token_type) from exc
+    if actor_token:  # pragma: no branch
+        try:
+            actor_token_type = self.get_token_type(actor_token_type, actor_token)
+        except ValueError as exc:
+            raise UnknownActorTokenType(actor_token, actor_token_type) from exc
+
+    data = dict(
+        grant_type=GrantTypes.TOKEN_EXCHANGE,
+        subject_token=subject_token,
+        subject_token_type=subject_token_type,
+        actor_token=actor_token,
+        actor_token_type=actor_token_type,
+        requested_token_type=requested_token_type,
+        **token_kwargs,
+    )
+    return self.token_request(data, **requests_kwargs)
+
+
- +
+ +
-
+

+ jwt_bearer(assertion, requests_kwargs=None, **token_kwargs) +

+
+

Send a request using a JWT as authorization grant.

+

This is defined in (RFC7523 $2.1)[https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1).

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
assertion + Jwt | str + +
+

a JWT (as an instance of jwskate.Jwt or as a str) to use as authorization grant.

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters to pass to the underlying requests.post() call.

+
+ 		+ None +
**token_kwargs + Any + +
+

additional parameters to include in the request body.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken as returned by the Authorization Server.

+
+
+
+ Source code in requests_oauth2client/client.py + 
840
+841
+842
+843
+844
+845
+846
+847
+848
+849
+850
+851
+852
+853
+854
+855
+856
+857
+858
+859
+860
+861
+862
+863
+864
+865
+866
+867
+868
+869
+870
def jwt_bearer(
+    self,
+    assertion: Jwt | str,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a request using a JWT as authorization grant.
+
+    This is defined in (RFC7523 $2.1)[https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1).
+
+    Args:
+        assertion: a JWT (as an instance of `jwskate.Jwt` or as a `str`) to use as authorization grant.
+        requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
+        **token_kwargs: additional parameters to include in the request body.
+
+    Returns:
+        a `BearerToken` as returned by the Authorization Server.
+
+    """
+    requests_kwargs = requests_kwargs or {}
+
+    if not isinstance(assertion, Jwt):
+        assertion = Jwt(assertion)
+
+    data = dict(
+        grant_type=GrantTypes.JWT_BEARER,
+        assertion=assertion,
+        **token_kwargs,
+    )
+
+    return self.token_request(data, **requests_kwargs)
+
+
+
+
+

+ resource_owner_password(username, password, requests_kwargs=None, **token_kwargs) -

- client_assertion(audience) +

- +
-
- -

Generate a Client Assertion for a specific audience.

+

Send a request using the Resource Owner Password Grant.

+

This Grant Type is deprecated and should only be used when there is no other choice.

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
username + str + +
+

the resource owner user name

+
+ 		+ required +
password + str + +
+

the resource owner password

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters to pass to the underlying requests.post() call.

+
+ 		+ None +
**token_kwargs + Any + +
+

additional parameters to include in the request body.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken as returned by the Authorization Server

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
audience - str - -
-

the audience to use for the aud claim of the generated Client Assertion.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

a Client Assertion, as str.

-
-
- -
- Source code in requests_oauth2client/client_authentication.py - 
158
-159
-160
-161
-162
-163
-164
-165
-166
-167
-168
def client_assertion(self, audience: str) -> str:
-    """Generate a Client Assertion for a specific audience.
-
-    Args:
-        audience: the audience to use for the `aud` claim of the generated Client Assertion.
-
-    Returns:
-        a Client Assertion, as `str`.
-
-    """
-    raise NotImplementedError()  # pragma: no cover
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
872
+873
+874
+875
+876
+877
+878
+879
+880
+881
+882
+883
+884
+885
+886
+887
+888
+889
+890
+891
+892
+893
+894
+895
+896
+897
+898
+899
+900
+901
def resource_owner_password(
+    self,
+    username: str,
+    password: str,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a request using the Resource Owner Password Grant.
+
+    This Grant Type is deprecated and should only be used when there is no other choice.
+
+    Args:
+        username: the resource owner user name
+        password: the resource owner password
+        requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
+        **token_kwargs: additional parameters to include in the request body.
+
+    Returns:
+        a `BearerToken` as returned by the Authorization Server
+
+    """
+    requests_kwargs = requests_kwargs or {}
+    data = dict(
+        grant_type=GrantTypes.RESOURCE_OWNER_PASSWORD,
+        username=username,
+        password=password,
+        **token_kwargs,
+    )
+
+    return self.token_request(data, **requests_kwargs)
+
+
+
+
-
- -
- - -
- -
- +

+ authorization_request(*, scope='openid', response_type=ResponseTypes.CODE, redirect_uri=None, state=..., nonce=..., code_verifier=None, **kwargs) +

-

- ClientSecretBasic +
-

+

Generate an Authorization Request for this client.

-
-

- Bases: BaseClientAuthenticationMethod

- - -

Implement client_secret_basic authentication.

-

With this method, the client sends its Client ID and Secret, in the Authorization header, with -the "Basic" scheme, in each authenticated request to the AS.

- - - -

Parameters:

- - - - - - - - - - - - - - - - - - - - - +

Parameters:

+
NameTypeDescriptionDefault
client_id - str - -
-

client_id to use.

-
- 		- required -
client_secret - str - -
-

client_secret to use.

-
- 		- required -
+ + + + + + - -
NameTypeDescriptionDefault
+ + + + scope + + None | str | Iterable[str] + + +
+

the scope to use

+
+ + + 'openid' + + + + response_type + + str + + +
+

the response_type to use

+
+ + + CODE + + + + redirect_uri + + str | None + + +
+

the redirect_uri to include in the request. By default, +the redirect_uri defined at init time is used.

+
+ + + None + + + + state + + str | ellipsis | None + + +
+

the state parameter to use. Leave default to generate a random value.

+
+ + + ... + + + + nonce + + str | ellipsis | None + + +
+

a nonce. Leave default to generate a random value.

+
+ + + ... + + + + code_verifier + + str | None + + +
+

the PKCE code_verifier to use. Leave default to generate a random value.

+
+ + + None + + + + **kwargs + + Any + + +
+

additional parameters to include in the auth request

+
+ + + {} + + + + + + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ AuthorizationRequest + +
+

an AuthorizationRequest with the supplied parameters

+
+
- Source code in requests_oauth2client/client_authentication.py - 
59
-60
-61
-62
-63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
-76
-77
-78
-79
-80
-81
-82
-83
-84
-85
-86
-87
-88
-89
-90
-91
class ClientSecretBasic(BaseClientAuthenticationMethod):
-    """Implement `client_secret_basic` authentication.
-
-    With this method, the client sends its Client ID and Secret, in the Authorization header, with
-    the "Basic" scheme, in each authenticated request to the AS.
-
-    Args:
-        client_id: `client_id` to use.
-        client_secret: `client_secret` to use.
-
-    """
-
-    def __init__(self, client_id: str, client_secret: str):
-        super().__init__(client_id)
-        self.client_secret = str(client_secret)
-
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        """Add the appropriate `Authorization` header in each request.
-
-        The Authorization header is formatted as such: `Authorization: Basic
-        BASE64('<client_id:client_secret>')`
-
-        Args:
-            request: a [requests.PreparedRequest][].
-
-        Returns:
-            a [requests.PreparedRequest][] with the added Authorization header.
-
-        """
-        request = super().__call__(request)
-        b64encoded_credentials = BinaPy(f"{self.client_id}:{self.client_secret}").to("b64").ascii()
-        request.headers["Authorization"] = f"Basic {b64encoded_credentials}"
-        return request
-
+ Source code in requests_oauth2client/client.py + 
903
+904
+905
+906
+907
+908
+909
+910
+911
+912
+913
+914
+915
+916
+917
+918
+919
+920
+921
+922
+923
+924
+925
+926
+927
+928
+929
+930
+931
+932
+933
+934
+935
+936
+937
+938
+939
+940
+941
+942
+943
+944
+945
+946
def authorization_request(
+    self,
+    *,
+    scope: None | str | Iterable[str] = "openid",
+    response_type: str = ResponseTypes.CODE,
+    redirect_uri: str | None = None,
+    state: str | ellipsis | None = ...,  # noqa: F821
+    nonce: str | ellipsis | None = ...,  # noqa: F821
+    code_verifier: str | None = None,
+    **kwargs: Any,
+) -> AuthorizationRequest:
+    """Generate an Authorization Request for this client.
+
+    Args:
+        scope: the `scope` to use
+        response_type: the `response_type` to use
+        redirect_uri: the `redirect_uri` to include in the request. By default,
+            the `redirect_uri` defined at init time is used.
+        state: the `state` parameter to use. Leave default to generate a random value.
+        nonce: a `nonce`. Leave default to generate a random value.
+        code_verifier: the PKCE `code_verifier` to use. Leave default to generate a random value.
+        **kwargs: additional parameters to include in the auth request
+
+    Returns:
+        an AuthorizationRequest with the supplied parameters
+
+    """
+    authorization_endpoint = self._require_endpoint("authorization_endpoint")
+
+    redirect_uri = redirect_uri or self.redirect_uri
+
+    return AuthorizationRequest(
+        authorization_endpoint=authorization_endpoint,
+        client_id=self.client_id,
+        redirect_uri=redirect_uri,
+        issuer=self.issuer,
+        response_type=response_type,
+        scope=scope,
+        state=state,
+        nonce=nonce,
+        code_verifier=code_verifier,
+        code_challenge_method=self.code_challenge_method,
+        **kwargs,
+    )
+
+
- - -
- - - +
+
+

+ pushed_authorization_request(authorization_request, requests_kwargs=None) +

+
+

Send a Pushed Authorization Request.

+

This sends a request to the Pushed Authorization Request Endpoint, and returns a +RequestUriParameterAuthorizationRequest initialized with the AS response.

-
-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
authorization_request + AuthorizationRequest + +
+

the authorization request to send

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters for requests.request()

+
+ 		+ None +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ RequestUriParameterAuthorizationRequest + +
+

the RequestUriParameterAuthorizationRequest initialized based on the AS response

+
+
+
+ Source code in requests_oauth2client/client.py + 
948
+949
+950
+951
+952
+953
+954
+955
+956
+957
+958
+959
+960
+961
+962
+963
+964
+965
+966
+967
+968
+969
+970
+971
+972
+973
+974
def pushed_authorization_request(
+    self,
+    authorization_request: AuthorizationRequest,
+    requests_kwargs: dict[str, Any] | None = None,
+) -> RequestUriParameterAuthorizationRequest:
+    """Send a Pushed Authorization Request.
+
+    This sends a request to the Pushed Authorization Request Endpoint, and returns a
+    `RequestUriParameterAuthorizationRequest` initialized with the AS response.
+
+    Args:
+        authorization_request: the authorization request to send
+        requests_kwargs: additional parameters for `requests.request()`
+
+    Returns:
+        the `RequestUriParameterAuthorizationRequest` initialized based on the AS response
+
+    """
+    requests_kwargs = requests_kwargs or {}
+    return self._request(
+        Endpoints.PUSHED_AUTHORIZATION_REQUEST,
+        data=authorization_request.args,
+        auth=self.auth,
+        on_success=self.parse_pushed_authorization_response,
+        on_failure=self.on_pushed_authorization_request_error,
+        **requests_kwargs,
+    )
+
+
+
-
+
+

+ parse_pushed_authorization_response(response) -

- ClientSecretJwt +

- +
+

Parse the response obtained by pushed_authorization_request().

-
-

- Bases: ClientAssertionAuthenticationMethod

- - -

Implement client_secret_jwt client authentication method.

-

With this method, the client generates and signs a client assertion that is symmetrically -signed with its Client Secret. The assertion is then sent to the AS in a client_assertion -field with each authenticated request.

- - - -

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +

Parameters:

+
NameTypeDescriptionDefault
client_id - str - -
-

the client_id to use.

-
- 		- required -
client_secret - str - -
-

the client_secret to use to sign generated Client Assertions.

-
- 		- required -
alg - str - -
-

the alg to use to sign generated Client Assertions.

-
- 		- 'HS256' -
lifetime - int - -
-

the lifetime to use for generated Client Assertions.

-
- 		- 60 -
jti_gen - Callable[[], Any] - -
-

a function to generate JWT Token Ids (jti) for generated Client Assertions.

-
- 		- lambda: uuid4() -
aud - str | None - -
-

the audience value to use. If None (default), the endpoint URL will be used.

-
- 		- None -
+ + + + + + - -
NameTypeDescriptionDefault
+ + + + response + + Response + + +
+

the requests.Response returned by the PAR endpoint

+
+ + + required + + + + + + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ RequestUriParameterAuthorizationRequest + +
+

a RequestUriParameterAuthorizationRequest instance

+
+
- Source code in requests_oauth2client/client_authentication.py - 
198
-199
-200
-201
-202
-203
-204
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
class ClientSecretJwt(ClientAssertionAuthenticationMethod):
-    """Implement `client_secret_jwt` client authentication method.
-
-    With this method, the client generates and signs a client assertion that is symmetrically
-    signed with its Client Secret. The assertion is then sent to the AS in a `client_assertion`
-    field with each authenticated request.
-
-    Args:
-        client_id: the `client_id` to use.
-        client_secret: the `client_secret` to use to sign generated Client Assertions.
-        alg: the alg to use to sign generated Client Assertions.
-        lifetime: the lifetime to use for generated Client Assertions.
-        jti_gen: a function to generate JWT Token Ids (`jti`) for generated Client Assertions.
-        aud: the audience value to use. If `None` (default), the endpoint URL will be used.
-
-    """
-
-    def __init__(
-        self,
-        client_id: str,
-        client_secret: str,
-        alg: str = "HS256",
-        lifetime: int = 60,
-        jti_gen: Callable[[], Any] = lambda: uuid4(),
-        aud: str | None = None,
-    ) -> None:
-        super().__init__(client_id, alg, lifetime, jti_gen, aud)
-        self.client_secret = str(client_secret)
-
-    def client_assertion(self, audience: str) -> str:
-        """Generate a symmetrically signed Client Assertion.
-
-        Assertion is signed with the `client_secret` as key and the `alg` passed at init time.
-
-        Args:
-            audience: the audience to use for the generated Client Assertion.
-
-        Returns:
-            a Client Assertion, as `str`.
-
-        """
-        iat = int(datetime.now(tz=timezone.utc).timestamp())
-        exp = iat + self.lifetime
-        jti = str(self.jti_gen())
-
-        jwk = SymmetricJwk.from_bytes(self.client_secret.encode())
-
-        jwt = Jwt.sign(
-            claims={
-                "iss": self.client_id,
-                "sub": self.client_id,
-                "aud": audience,
-                "iat": iat,
-                "exp": exp,
-                "jti": jti,
-            },
-            key=jwk,
-            alg=self.alg,
-        )
-        return str(jwt)
-
+ Source code in requests_oauth2client/client.py + 
976
+977
+978
+979
+980
+981
+982
+983
+984
+985
+986
+987
+988
+989
+990
+991
+992
+993
+994
+995
+996
+997
+998
def parse_pushed_authorization_response(
+    self,
+    response: requests.Response,
+) -> RequestUriParameterAuthorizationRequest:
+    """Parse the response obtained by `pushed_authorization_request()`.
+
+    Args:
+        response: the `requests.Response` returned by the PAR endpoint
+
+    Returns:
+        a RequestUriParameterAuthorizationRequest instance
+
+    """
+    response_json = response.json()
+    request_uri = response_json.get("request_uri")
+    expires_in = response_json.get("expires_in")
+
+    return RequestUriParameterAuthorizationRequest(
+        authorization_endpoint=self.authorization_endpoint,
+        client_id=self.client_id,
+        request_uri=request_uri,
+        expires_in=expires_in,
+    )
+
+
- +
+ +
-
+

+ on_pushed_authorization_request_error(response) +

+
+

Error Handler for Pushed Authorization Endpoint errors.

+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the HTTP response as returned by the AS PAR endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ RequestUriParameterAuthorizationRequest + +
+

a RequestUriParameterAuthorizationRequest, if the error is recoverable

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + + + + + +
TypeDescription
+ EndpointError + +
+

a subclass of this error depending on the error returned by the AS

+
+
+ InvalidPushedAuthorizationResponse + +
+

if the returned response is not following the +specifications

+
+
+ UnknownTokenEndpointError + +
+

for unknown/unhandled errors

+
+
+
+ Source code in requests_oauth2client/client.py + 
1000
+1001
+1002
+1003
+1004
+1005
+1006
+1007
+1008
+1009
+1010
+1011
+1012
+1013
+1014
+1015
+1016
+1017
+1018
+1019
+1020
+1021
+1022
+1023
+1024
+1025
+1026
+1027
+1028
+1029
+1030
+1031
+1032
+1033
+1034
def on_pushed_authorization_request_error(
+    self,
+    response: requests.Response,
+) -> RequestUriParameterAuthorizationRequest:
+    """Error Handler for Pushed Authorization Endpoint errors.
+
+    Args:
+        response: the HTTP response as returned by the AS PAR endpoint.
+
+    Returns:
+        a RequestUriParameterAuthorizationRequest, if the error is recoverable
+
+    Raises:
+        EndpointError: a subclass of this error depending on the error returned by the AS
+        InvalidPushedAuthorizationResponse: if the returned response is not following the
+            specifications
+        UnknownTokenEndpointError: for unknown/unhandled errors
+
+    """
+    try:
+        data = response.json()
+        error = data["error"]
+        error_description = data.get("error_description")
+        error_uri = data.get("error_uri")
+        exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
+        exception = exception_class(
+            response=response,
+            client=self,
+            error=error,
+            description=error_description,
+            uri=error_uri,
+        )
+    except Exception as exc:
+        raise InvalidPushedAuthorizationResponse(response=response, client=self) from exc
+    raise exception
+
+
+
+
+

+ userinfo(access_token) -

- client_assertion(audience) +

- +
-
- -

Generate a symmetrically signed Client Assertion.

-

Assertion is signed with the client_secret as key and the alg passed at init time.

+

Call the UserInfo endpoint.

+

This sends a request to the UserInfo endpoint, with the specified access_token, and returns +the parsed result.

+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
access_token + BearerToken | str + +
+

the access token to use

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Any + +
+

the Response returned by the userinfo endpoint.

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
audience - str - -
-

the audience to use for the generated Client Assertion.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

a Client Assertion, as str.

-
-
- -
- Source code in requests_oauth2client/client_authentication.py - 
227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
def client_assertion(self, audience: str) -> str:
-    """Generate a symmetrically signed Client Assertion.
-
-    Assertion is signed with the `client_secret` as key and the `alg` passed at init time.
-
-    Args:
-        audience: the audience to use for the generated Client Assertion.
-
-    Returns:
-        a Client Assertion, as `str`.
-
-    """
-    iat = int(datetime.now(tz=timezone.utc).timestamp())
-    exp = iat + self.lifetime
-    jti = str(self.jti_gen())
-
-    jwk = SymmetricJwk.from_bytes(self.client_secret.encode())
-
-    jwt = Jwt.sign(
-        claims={
-            "iss": self.client_id,
-            "sub": self.client_id,
-            "aud": audience,
-            "iat": iat,
-            "exp": exp,
-            "jti": jti,
-        },
-        key=jwk,
-        alg=self.alg,
-    )
-    return str(jwt)
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
1036
+1037
+1038
+1039
+1040
+1041
+1042
+1043
+1044
+1045
+1046
+1047
+1048
+1049
+1050
+1051
+1052
+1053
+1054
+1055
+1056
def userinfo(self, access_token: BearerToken | str) -> Any:
+    """Call the UserInfo endpoint.
+
+    This sends a request to the UserInfo endpoint, with the specified access_token, and returns
+    the parsed result.
+
+    Args:
+        access_token: the access token to use
+
+    Returns:
+        the [Response][requests.Response] returned by the userinfo endpoint.
+
+    """
+    if isinstance(access_token, str):
+        access_token = BearerToken(access_token)
+    return self._request(
+        Endpoints.USER_INFO,
+        auth=access_token,
+        on_success=self.parse_userinfo_response,
+        on_failure=self.on_userinfo_error,
+    )
+
+
+
+
-
- -
+

+ parse_userinfo_response(resp) +

-
-
+
+

Parse the response obtained by userinfo().

+

Invoked by userinfo() to parse the +response from the UserInfo endpoint, this will extract and return its JSON content.

-

- ClientSecretPost +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
resp + Response + +
+

a Response returned from the UserInfo endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Any + +
+

the parsed JSON content from this response.

+
+
+
+ Source code in requests_oauth2client/client.py + 
1058
+1059
+1060
+1061
+1062
+1063
+1064
+1065
+1066
+1067
+1068
+1069
+1070
+1071
def parse_userinfo_response(self, resp: requests.Response) -> Any:
+    """Parse the response obtained by `userinfo()`.
+
+    Invoked by [userinfo()][requests_oauth2client.client.OAuth2Client.userinfo] to parse the
+    response from the UserInfo endpoint, this will extract and return its JSON content.
+
+    Args:
+        resp: a [Response][requests.Response] returned from the UserInfo endpoint.
+
+    Returns:
+        the parsed JSON content from this response.
+
+    """
+    return resp.json()
+
+
+

- +
+
-
-

- Bases: BaseClientAuthenticationMethod

- -

Implement client_secret_post client authentication method.

-

With this method, the client inserts its client_id and client_secret in each authenticated - request to the AS.

- - - -

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client_id - str - -
-

client_id to use.

-
- 		- required -
client_secret - str - -
-

client_secret to use.

-
- 		- required -
+

+ on_userinfo_error(resp) -
- Source code in requests_oauth2client/client_authentication.py - 
 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
class ClientSecretPost(BaseClientAuthenticationMethod):
-    """Implement `client_secret_post` client authentication method.
-
-     With this method, the client inserts its client_id and client_secret in each authenticated
-     request to the AS.
-
-    Args:
-        client_id: `client_id` to use.
-        client_secret: `client_secret` to use.
-
-    """
-
-    def __init__(self, client_id: str, client_secret: str) -> None:
-        super().__init__(client_id)
-        self.client_secret = str(client_secret)
-
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        """Add the `client_id` and `client_secret` parameters in the request body.
-
-        Args:
-            request: a [requests.PreparedRequest][].
-
-        Returns:
-            a [requests.PreparedRequest][] with the added client credentials fields.
-
-        """
-        request = super().__call__(request)
-        params = (
-            parse_qs(request.body, strict_parsing=True, keep_blank_values=True)  # type: ignore[type-var]
-            if isinstance(request.body, (str, bytes))
-            else {}
-        )
-        params[b"client_id"] = [self.client_id.encode()]
-        params[b"client_secret"] = [self.client_secret.encode()]
-        request.prepare_body(params, files=None)
-        return request
-
-
+

- -
+
+

Parse UserInfo error response.

+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
resp + Response + +
+

a Response returned from the UserInfo endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Any + +
+

nothing, raises exception instead.

+
+
+
+ Source code in requests_oauth2client/client.py + 
1073
+1074
+1075
+1076
+1077
+1078
+1079
+1080
+1081
+1082
+1083
def on_userinfo_error(self, resp: requests.Response) -> Any:
+    """Parse UserInfo error response.
+
+    Args:
+        resp: a [Response][requests.Response] returned from the UserInfo endpoint.
+
+    Returns:
+        nothing, raises exception instead.
+
+    """
+    resp.raise_for_status()
+
+
+
+
+
+

+ get_token_type(token_type=None, token=None) + + classmethod + +

-
-
+
+

Get standardized token type identifiers.

+

Return a standardized token type identifier, based on a short token_type hint and/or a +token value.

-
-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
token_type + str | None + +
+

a token_type hint, as str. May be "access_token", "refresh_token" +or "id_token"

+
+ 		+ None +
token + None | str | BearerToken | IdToken + +
+

a token value, as an instance of BearerToken or IdToken, or as a str.

+
+ 		+ None +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the token_type as defined in the Token Exchange RFC8693.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ UnknownTokenType + +
+

if the type of token cannot be determined

+
+
+
+ Source code in requests_oauth2client/client.py + 
1085
+1086
+1087
+1088
+1089
+1090
+1091
+1092
+1093
+1094
+1095
+1096
+1097
+1098
+1099
+1100
+1101
+1102
+1103
+1104
+1105
+1106
+1107
+1108
+1109
+1110
+1111
+1112
+1113
+1114
+1115
+1116
+1117
+1118
+1119
+1120
+1121
+1122
+1123
+1124
+1125
+1126
+1127
+1128
+1129
+1130
+1131
+1132
+1133
+1134
+1135
+1136
+1137
+1138
+1139
+1140
+1141
+1142
+1143
+1144
+1145
+1146
+1147
+1148
+1149
+1150
+1151
+1152
+1153
    @classmethod
+    def get_token_type(  # noqa: C901
+        cls,
+        token_type: str | None = None,
+        token: None | str | BearerToken | IdToken = None,
+    ) -> str:
+        """Get standardized token type identifiers.
+
+        Return a standardized token type identifier, based on a short `token_type` hint and/or a
+        token value.
+
+        Args:
+            token_type: a token_type hint, as `str`. May be "access_token", "refresh_token"
+                or "id_token"
+            token: a token value, as an instance of `BearerToken` or IdToken, or as a `str`.
+
+        Returns:
+            the token_type as defined in the Token Exchange RFC8693.
+
+        Raises:
+            UnknownTokenType: if the type of token cannot be determined
+
+        """
+        if not (token_type or token):
+            msg = "Cannot determine type of an empty token without a token_type hint"
+            raise UnknownTokenType(msg, token, token_type)
+
+        if token_type is None:
+            if isinstance(token, str):
+                msg = """\
+Cannot determine the type of provided token when it is a bare `str`. Please specify a 'token_type'.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            if isinstance(token, BearerToken):
+                return "urn:ietf:params:oauth:token-type:access_token"
+            if isinstance(token, IdToken):
+                return "urn:ietf:params:oauth:token-type:id_token"
+            msg = f"Unknown token type {type(token)}"
+            raise UnknownTokenType(msg, token, token_type)
+        if token_type == TokenType.ACCESS_TOKEN:
+            if token is not None and not isinstance(token, (str, BearerToken)):
+                msg = f"""\
+The supplied token is of type '{type(token)}' which is inconsistent with token_type '{token_type}'.
+A BearerToken or an access_token as a `str` is expected.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            return "urn:ietf:params:oauth:token-type:access_token"
+        if token_type == TokenType.REFRESH_TOKEN:
+            if token is not None and isinstance(token, BearerToken) and not token.refresh_token:
+                msg = f"""\
+The supplied BearerToken does not contain a refresh_token, which is inconsistent with token_type '{token_type}'.
+A BearerToken containing a refresh_token is expected.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            return "urn:ietf:params:oauth:token-type:refresh_token"
+        if token_type == TokenType.ID_TOKEN:
+            if token is not None and not isinstance(token, (str, IdToken)):
+                msg = f"""\
+The supplied token is of type '{type(token)}' which is inconsistent with token_type '{token_type}'.
+An IdToken or a string representation of it is expected.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            return "urn:ietf:params:oauth:token-type:id_token"
+
+        return {
+            "saml1": "urn:ietf:params:oauth:token-type:saml1",
+            "saml2": "urn:ietf:params:oauth:token-type:saml2",
+            "jwt": "urn:ietf:params:oauth:token-type:jwt",
+        }.get(token_type, token_type)
+
+
+
+
-

- PrivateKeyJwt +
-

+

+ revoke_access_token(access_token, requests_kwargs=None, **revoke_kwargs) +

-
-

- Bases: ClientAssertionAuthenticationMethod

- -

Implement private_key_jwt client authentication method.

-

With this method, the client generates and sends a client_assertion, that is asymmetrically -signed with a private key, on each direct request to the Authorization Server.

+
+

Send a request to the Revocation Endpoint to revoke an access token.

-

Parameters:

- - - - - - - - - - - - - - - +

Parameters:

+
NameTypeDescriptionDefault
client_id - str - -
-

the client_id to use.

-
- 		- required -
+ + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
private_jwk - Jwk | dict[str, Any] - -
-

the private JWK to use to sign generated Client Assertions.

-
- 		- required -
alg - str - -
-

the alg to use to sign generated Client Assertions.

-
- 		- RS256 -
lifetime - int - -
-

the lifetime to use for generated Client Assertions.

-
- 		- 60 -
jti_gen - Callable[[], Any] - -
-

a function to generate JWT Token Ids (jti) for generated Client Assertions.

-
- 		- lambda: uuid4() -
aud - str | None - -
-

the audience value to use. If None (default), the endpoint URL will be used.k

-
- 		- None -
+ + + + access_token + + BearerToken | str + + +
+

the access token to revoke

+
+ + + required + + + + requests_kwargs + + dict[str, Any] | None + + +
+

additional parameters for the underlying requests.post() call

+
+ + + None + + + + **revoke_kwargs + + Any + + +
+

additional parameters to pass to the revocation endpoint

+
+ + + {} + + + +
- Source code in requests_oauth2client/client_authentication.py - 
260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
-293
-294
-295
-296
-297
-298
-299
-300
-301
-302
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320
-321
-322
-323
-324
-325
-326
-327
-328
-329
-330
class PrivateKeyJwt(ClientAssertionAuthenticationMethod):
-    """Implement `private_key_jwt` client authentication method.
-
-    With this method, the client generates and sends a client_assertion, that is asymmetrically
-    signed with a private key, on each direct request to the Authorization Server.
-
-    Args:
-        client_id: the `client_id` to use.
-        private_jwk: the private JWK to use to sign generated Client Assertions.
-        alg: the alg to use to sign generated Client Assertions.
-        lifetime: the lifetime to use for generated Client Assertions.
-        jti_gen: a function to generate JWT Token Ids (`jti`) for generated Client Assertions.
-        aud: the audience value to use. If `None` (default), the endpoint URL will be used.k
-
-    """
-
-    def __init__(
-        self,
-        client_id: str,
-        private_jwk: Jwk | dict[str, Any],
-        alg: str = SignatureAlgs.RS256,
-        lifetime: int = 60,
-        jti_gen: Callable[[], Any] = lambda: uuid4(),
-        aud: str | None = None,
-    ) -> None:
-        if not isinstance(private_jwk, Jwk):
-            private_jwk = Jwk(private_jwk)
-
-        if not private_jwk.is_private or private_jwk.is_symmetric:
-            msg = "Private Key JWT client authentication method uses asymmetric signing thus requires a private key."
-            raise ValueError(msg)
-
-        alg = private_jwk.alg or alg
-        if not alg:
-            msg = "An asymmetric signing alg is required, either as part of the private JWK, or passed as parameter."
-            raise ValueError(msg)
-        kid = private_jwk.get("kid")
-        if not kid:
-            msg = "Asymmetric signing requires the private JWK to have a Key ID (kid)."
-            raise ValueError(msg)
-
-        super().__init__(client_id, alg, lifetime, jti_gen, aud)
-        self.private_jwk = private_jwk
-
-    def client_assertion(self, audience: str) -> str:
-        """Generate a Client Assertion, asymmetrically signed with `private_jwk` as key.
-
-        Args:
-            audience: the audience to use for the generated Client Assertion.
-
-        Returns:
-            a Client Assertion.
-
-        """
-        iat = int(datetime.now(tz=timezone.utc).timestamp())
-        exp = iat + self.lifetime
-        jti = str(self.jti_gen())
-
-        jwt = Jwt.sign(
-            claims={
-                "iss": self.client_id,
-                "sub": self.client_id,
-                "aud": audience,
-                "iat": iat,
-                "exp": exp,
-                "jti": jti,
-            },
-            key=self.private_jwk,
-            alg=self.alg,
-        )
-        return str(jwt)
-
+ Source code in requests_oauth2client/client.py + 
1155
+1156
+1157
+1158
+1159
+1160
+1161
+1162
+1163
+1164
+1165
+1166
+1167
+1168
+1169
+1170
+1171
+1172
+1173
+1174
def revoke_access_token(
+    self,
+    access_token: BearerToken | str,
+    requests_kwargs: dict[str, Any] | None = None,
+    **revoke_kwargs: Any,
+) -> bool:
+    """Send a request to the Revocation Endpoint to revoke an access token.
+
+    Args:
+        access_token: the access token to revoke
+        requests_kwargs: additional parameters for the underlying requests.post() call
+        **revoke_kwargs: additional parameters to pass to the revocation endpoint
+
+    """
+    return self.revoke_token(
+        access_token,
+        token_type_hint=TokenType.ACCESS_TOKEN,
+        requests_kwargs=requests_kwargs,
+        **revoke_kwargs,
+    )
+
+
- +
-
+
+

+ revoke_refresh_token(refresh_token, requests_kwargs=None, **revoke_kwargs) + +

+
+

Send a request to the Revocation Endpoint to revoke a refresh token.

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
refresh_token + str | BearerToken + +
+

the refresh token to revoke.

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters to pass to the revocation endpoint.

+
+ 		+ None +
**revoke_kwargs + Any + +
+

additional parameters to pass to the revocation endpoint.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ bool + +
+

True if the revocation request is successful, False if this client has no configured

+
+
+ bool + +
+

revocation endpoint.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ MissingRefreshToken + +
+

when refresh_token is a BearerToken +but does not contain a refresh_token.

+
+
+
+ Source code in requests_oauth2client/client.py + 
1176
+1177
+1178
+1179
+1180
+1181
+1182
+1183
+1184
+1185
+1186
+1187
+1188
+1189
+1190
+1191
+1192
+1193
+1194
+1195
+1196
+1197
+1198
+1199
+1200
+1201
+1202
+1203
+1204
+1205
+1206
+1207
+1208
def revoke_refresh_token(
+    self,
+    refresh_token: str | BearerToken,
+    requests_kwargs: dict[str, Any] | None = None,
+    **revoke_kwargs: Any,
+) -> bool:
+    """Send a request to the Revocation Endpoint to revoke a refresh token.
+
+    Args:
+        refresh_token: the refresh token to revoke.
+        requests_kwargs: additional parameters to pass to the revocation endpoint.
+        **revoke_kwargs: additional parameters to pass to the revocation endpoint.
+
+    Returns:
+        `True` if the revocation request is successful, `False` if this client has no configured
+        revocation endpoint.
+
+    Raises:
+        MissingRefreshToken: when `refresh_token` is a [BearerToken][requests_oauth2client.tokens.BearerToken]
+            but does not contain a `refresh_token`.
+
+    """
+    if isinstance(refresh_token, BearerToken):
+        if refresh_token.refresh_token is None:
+            raise MissingRefreshToken(refresh_token)
+        refresh_token = refresh_token.refresh_token
+
+    return self.revoke_token(
+        refresh_token,
+        token_type_hint=TokenType.REFRESH_TOKEN,
+        requests_kwargs=requests_kwargs,
+        **revoke_kwargs,
+    )
+
+
+
+
+

+ revoke_token(token, token_type_hint=None, requests_kwargs=None, **revoke_kwargs) -

- client_assertion(audience) +

- +
-
- -

Generate a Client Assertion, asymmetrically signed with private_jwk as key.

+

Send a Token Revocation request.

+

By default, authentication will be the same than the one used for the Token Endpoint.

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
token + str | BearerToken + +
+

the token to revoke.

+
+ 		+ required +
token_type_hint + str | None + +
+

a token_type_hint to send to the revocation endpoint.

+
+ 		+ None +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters to the underling call to requests.post()

+
+ 		+ None +
**revoke_kwargs + Any + +
+

additional parameters to send to the revocation endpoint.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ bool + +
+

True if the revocation succeeds, False if no revocation endpoint is present or a

+
+
+ bool + +
+

non-standardised error is returned.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ MissingEndpointUri + +
+

if the Revocation Endpoint URI is not configured.

+
+
+ MissingRefreshToken + +
+

if token_type_hint is "refresh_token" and token is a BearerToken +but does not contain a refresh_token.

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
audience - str - -
-

the audience to use for the generated Client Assertion.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

a Client Assertion.

-
-
- -
- Source code in requests_oauth2client/client_authentication.py - 
304
-305
-306
-307
-308
-309
-310
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320
-321
-322
-323
-324
-325
-326
-327
-328
-329
-330
def client_assertion(self, audience: str) -> str:
-    """Generate a Client Assertion, asymmetrically signed with `private_jwk` as key.
-
-    Args:
-        audience: the audience to use for the generated Client Assertion.
-
-    Returns:
-        a Client Assertion.
-
-    """
-    iat = int(datetime.now(tz=timezone.utc).timestamp())
-    exp = iat + self.lifetime
-    jti = str(self.jti_gen())
-
-    jwt = Jwt.sign(
-        claims={
-            "iss": self.client_id,
-            "sub": self.client_id,
-            "aud": audience,
-            "iat": iat,
-            "exp": exp,
-            "jti": jti,
-        },
-        key=self.private_jwk,
-        alg=self.alg,
-    )
-    return str(jwt)
-
-
-
+
+ Source code in requests_oauth2client/client.py + 
1210
+1211
+1212
+1213
+1214
+1215
+1216
+1217
+1218
+1219
+1220
+1221
+1222
+1223
+1224
+1225
+1226
+1227
+1228
+1229
+1230
+1231
+1232
+1233
+1234
+1235
+1236
+1237
+1238
+1239
+1240
+1241
+1242
+1243
+1244
+1245
+1246
+1247
+1248
+1249
+1250
+1251
+1252
+1253
+1254
+1255
def revoke_token(
+    self,
+    token: str | BearerToken,
+    token_type_hint: str | None = None,
+    requests_kwargs: dict[str, Any] | None = None,
+    **revoke_kwargs: Any,
+) -> bool:
+    """Send a Token Revocation request.
+
+    By default, authentication will be the same than the one used for the Token Endpoint.
+
+    Args:
+        token: the token to revoke.
+        token_type_hint: a token_type_hint to send to the revocation endpoint.
+        requests_kwargs: additional parameters to the underling call to requests.post()
+        **revoke_kwargs: additional parameters to send to the revocation endpoint.
+
+    Returns:
+        `True` if the revocation succeeds, `False` if no revocation endpoint is present or a
+        non-standardised error is returned.
+
+    Raises:
+        MissingEndpointUri: if the Revocation Endpoint URI is not configured.
+        MissingRefreshToken: if `token_type_hint` is `"refresh_token"` and `token` is a BearerToken
+            but does not contain a `refresh_token`.
+
+    """
+    requests_kwargs = requests_kwargs or {}
+
+    if token_type_hint == TokenType.REFRESH_TOKEN and isinstance(token, BearerToken):
+        if token.refresh_token is None:
+            raise MissingRefreshToken(token)
+        token = token.refresh_token
+
+    data = dict(revoke_kwargs, token=str(token))
+    if token_type_hint:
+        data["token_type_hint"] = token_type_hint
+
+    return self._request(
+        Endpoints.REVOCATION,
+        data=data,
+        auth=self.auth,
+        on_success=lambda _: True,
+        on_failure=self.on_revocation_error,
+        **requests_kwargs,
+    )
+
+
+
+
-
- -
- +

+ on_revocation_error(response) -

+ -
+
+

Error handler for revoke_token().

+

Invoked by revoke_token() when the +revocation endpoint returns an error.

-

- PublicApp +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the Response as returned by the Revocation Endpoint

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ bool + +
+

False to signal that an error occurred. May raise exceptions instead depending on the

+
+
+ bool + +
+

revocation response.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ EndpointError + +
+

if the response contains a standardised OAuth 2.0 error.

+
+
-

+
+ Source code in requests_oauth2client/client.py + 
1257
+1258
+1259
+1260
+1261
+1262
+1263
+1264
+1265
+1266
+1267
+1268
+1269
+1270
+1271
+1272
+1273
+1274
+1275
+1276
+1277
+1278
+1279
+1280
+1281
+1282
+1283
+1284
+1285
+1286
+1287
+1288
+1289
def on_revocation_error(self, response: requests.Response) -> bool:
+    """Error handler for `revoke_token()`.
+
+    Invoked by [revoke_token()][requests_oauth2client.client.OAuth2Client.revoke_token] when the
+    revocation endpoint returns an error.
+
+    Args:
+        response: the [Response][requests.Response] as returned by the Revocation Endpoint
+
+    Returns:
+        `False` to signal that an error occurred. May raise exceptions instead depending on the
+        revocation response.
+
+    Raises:
+        EndpointError: if the response contains a standardised OAuth 2.0 error.
+
+    """
+    try:
+        data = response.json()
+        error = data["error"]
+        error_description = data.get("error_description")
+        error_uri = data.get("error_uri")
+        exception_class = self.exception_classes.get(error, RevocationError)
+        exception = exception_class(
+            response=response,
+            client=self,
+            error=error,
+            description=error_description,
+            uri=error_uri,
+        )
+    except Exception:  # noqa: BLE001
+        return False
+    raise exception
+
+
+
+
-
-

- Bases: BaseClientAuthenticationMethod

+
- -

Implement the none authentication method for public apps.

-

This scheme is used for Public Clients, which do not have any secret credentials. Those only -send their client_id to the Authorization Server.

+

+ introspect_token(token, token_type_hint=None, requests_kwargs=None, **introspect_kwargs) +

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client_id - str - -
-

the client_id to use.

-
- 		- required -
-
- Source code in requests_oauth2client/client_authentication.py - 
333
-334
-335
-336
-337
-338
-339
-340
-341
-342
-343
-344
-345
-346
-347
-348
-349
-350
-351
-352
-353
-354
-355
-356
-357
-358
-359
-360
-361
-362
-363
-364
-365
class PublicApp(BaseClientAuthenticationMethod):
-    """Implement the `none` authentication method for public apps.
-
-    This scheme is used for Public Clients, which do not have any secret credentials. Those only
-    send their client_id to the Authorization Server.
-
-    Args:
-        client_id: the client_id to use.
-
-    """
-
-    def __init__(self, client_id: str) -> None:
-        self.client_id = client_id
-
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        """Add the `client_id` field in the request body.
-
-        Args:
-            request: a [requests.PreparedRequest][].
-
-        Returns:
-            a [requests.PreparedRequest][] with the added `client_id` field.
-
-        """
-        request = super().__call__(request)
-        params = (
-            parse_qs(request.body, strict_parsing=True, keep_blank_values=True)  # type: ignore[type-var]
-            if request.body
-            else {}
-        )
-        params[b"client_id"] = [self.client_id.encode()]
-        request.prepare_body(params, files=None)
-        return request
-
-
+
- +

Send a request to the Introspection Endpoint.

+

Parameter token can be:

+
    +
  • a str
    • +
  • a BearerToken instance
    • +
+

You may pass any arbitrary token and token_type_hint values as str. Those will +be included in the request, as-is. +If token is a BearerToken, then token_type_hint must be either:

+
    +
  • None: the access_token will be instrospected and no token_type_hint will be included +in the request
    • +
  • access_token: same as None, but the token_type_hint will be included
    • +
  • or refresh_token: only available if a Refresh Token is present in the BearerToken.
    • +
-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
token + str | BearerToken + +
+

the token to instrospect

+
+ 		+ required +
token_type_hint + str | None + +
+

the token_type_hint to include in the request.

+
+ 		+ None +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters to the underling call to requests.post()

+
+ 		+ None +
**introspect_kwargs + Any + +
+

additional parameters to send to the introspection endpoint.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Any + +
+

the response as returned by the Introspection Endpoint.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ MissingRefreshToken + +
+

if token_type_hint is "refresh_token" and token is a BearerToken +but does not contain a refresh_token.

+
+
+ UnknownTokenType + +
+

if token_type_hint is neither None, "access_token" or "refresh_token".

+
+
+
+ Source code in requests_oauth2client/client.py + 
1291
+1292
+1293
+1294
+1295
+1296
+1297
+1298
+1299
+1300
+1301
+1302
+1303
+1304
+1305
+1306
+1307
+1308
+1309
+1310
+1311
+1312
+1313
+1314
+1315
+1316
+1317
+1318
+1319
+1320
+1321
+1322
+1323
+1324
+1325
+1326
+1327
+1328
+1329
+1330
+1331
+1332
+1333
+1334
+1335
+1336
+1337
+1338
+1339
+1340
+1341
+1342
+1343
+1344
+1345
+1346
+1347
+1348
+1349
+1350
+1351
+1352
+1353
+1354
+1355
    def introspect_token(
+        self,
+        token: str | BearerToken,
+        token_type_hint: str | None = None,
+        requests_kwargs: dict[str, Any] | None = None,
+        **introspect_kwargs: Any,
+    ) -> Any:
+        """Send a request to the Introspection Endpoint.
+
+        Parameter `token` can be:
+
+        - a `str`
+        - a `BearerToken` instance
+
+        You may pass any arbitrary `token` and `token_type_hint` values as `str`. Those will
+        be included in the request, as-is.
+        If `token` is a `BearerToken`, then `token_type_hint` must be either:
+
+        - `None`: the access_token will be instrospected and no token_type_hint will be included
+        in the request
+        - `access_token`: same as `None`, but the token_type_hint will be included
+        - or `refresh_token`: only available if a Refresh Token is present in the BearerToken.
+
+        Args:
+            token: the token to instrospect
+            token_type_hint: the `token_type_hint` to include in the request.
+            requests_kwargs: additional parameters to the underling call to requests.post()
+            **introspect_kwargs: additional parameters to send to the introspection endpoint.
+
+        Returns:
+            the response as returned by the Introspection Endpoint.
+
+        Raises:
+            MissingRefreshToken: if `token_type_hint` is `"refresh_token"` and `token` is a BearerToken
+                but does not contain a `refresh_token`.
+            UnknownTokenType: if `token_type_hint` is neither `None`, `"access_token"` or `"refresh_token"`.
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        if isinstance(token, BearerToken):
+            if token_type_hint is None or token_type_hint == TokenType.ACCESS_TOKEN:
+                token = token.access_token
+            elif token_type_hint == TokenType.REFRESH_TOKEN:
+                if token.refresh_token is None:
+                    raise MissingRefreshToken(token)
+
+                token = token.refresh_token
+            else:
+                msg = """\
+Invalid `token_type_hint`. To test arbitrary `token_type_hint` values, you must provide `token` as a `str`."""
+                raise UnknownTokenType(msg, token, token_type_hint)
+
+        data = dict(introspect_kwargs, token=str(token))
+        if token_type_hint:
+            data["token_type_hint"] = token_type_hint
+
+        return self._request(
+            Endpoints.INSTROSPECTION,
+            data=data,
+            auth=self.auth,
+            on_success=self.parse_introspection_response,
+            on_failure=self.on_introspection_error,
+            **requests_kwargs,
+        )
+
+
+
+
+
+

+ parse_introspection_response(response) +

+
+

Parse Token Introspection Responses received by introspect_token().

+

Invoked by introspect_token() +to parse the returned response. This decodes the JSON content if possible, otherwise it +returns the response as a string.

-
-
+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the Response as returned by the Introspection Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Any + +
+

the decoded JSON content, or a str with the content.

+
+
+
+ Source code in requests_oauth2client/client.py + 
1357
+1358
+1359
+1360
+1361
+1362
+1363
+1364
+1365
+1366
+1367
+1368
+1369
+1370
+1371
+1372
+1373
+1374
def parse_introspection_response(self, response: requests.Response) -> Any:
+    """Parse Token Introspection Responses received by `introspect_token()`.
+
+    Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
+    to parse the returned response. This decodes the JSON content if possible, otherwise it
+    returns the response as a string.
+
+    Args:
+        response: the [Response][requests.Response] as returned by the Introspection Endpoint.
+
+    Returns:
+        the decoded JSON content, or a `str` with the content.
+
+    """
+    try:
+        return response.json()
+    except ValueError:
+        return response.text
+
+
+
-
- - - -

- DeviceAuthorizationPoolingJob +
-

+

+ on_introspection_error(response) +

-
-

- Bases: TokenEndpointPoolingJob

- -

A Token Endpoint pooling job for the Device Authorization Flow.

-

This periodically checks if the user has finished with his authorization in a Device -Authorization flow.

+
+

Error handler for introspect_token().

+

Invoked by introspect_token() +to parse the returned response in the case an error is returned.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client - OAuth2Client - -
-

an OAuth2Client that will be used to pool the token endpoint.

-
- 		- required -
device_code - str | DeviceAuthorizationResponse - -
-

a device_code as str or a DeviceAuthorizationResponse.

-
- 		- required -
interval - int | None - -
-

The pooling interval to use. This overrides the one in auth_req_id if it is -a BackChannelAuthenticationResponse.

-
- 		- None -
slow_down_interval - int - -
-

Number of seconds to add to the pooling interval when the AS returns -a slow-down request.

-
- 		- 5 -
requests_kwargs - dict[str, Any] | None - -
-

Additional parameters for the underlying calls to requests.request.

-
- 		- None -
**token_kwargs - Any - -
-

Additional parameters for the token request.

-
- 		- {} -
-

auth=("client_id", "client_secret") ) pool_job = DeviceAuthorizationPoolingJob(client=client, -device_code="my_device_code")

-
1
token = None while token is None: token = pool_job() ```
-
+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the response as returned by the Introspection Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Any + +
+

usually raises exceptions. A subclass can return a default response instead.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ EndpointError + +
+

(or one of its subclasses) if the response contains a standard OAuth 2.0 error.

+
+
+ UnknownIntrospectionError + +
+

if the response is not a standard error response.

+
+
- Source code in requests_oauth2client/device_authorization.py - 
 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
class DeviceAuthorizationPoolingJob(TokenEndpointPoolingJob):
-    """A Token Endpoint pooling job for the Device Authorization Flow.
-
-    This periodically checks if the user has finished with his authorization in a Device
-    Authorization flow.
-
-    Args:
-        client: an OAuth2Client that will be used to pool the token endpoint.
-        device_code: a `device_code` as `str` or a `DeviceAuthorizationResponse`.
-        interval: The pooling interval to use. This overrides the one in `auth_req_id` if it is
-            a `BackChannelAuthenticationResponse`.
-        slow_down_interval: Number of seconds to add to the pooling interval when the AS returns
-            a slow-down request.
-        requests_kwargs: Additional parameters for the underlying calls to [requests.request][].
-        **token_kwargs: Additional parameters for the token request.
-
-    Usage: ```python client = OAuth2Client( token_endpoint="https://my.as.local/token",
-    auth=("client_id", "client_secret") ) pool_job = DeviceAuthorizationPoolingJob(client=client,
-    device_code="my_device_code")
-
-        token = None while token is None: token = pool_job() ```
-
-    """
-
-    def __init__(
-        self,
-        client: OAuth2Client,
-        device_code: str | DeviceAuthorizationResponse,
-        interval: int | None = None,
-        slow_down_interval: int = 5,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ):
-        super().__init__(
-            client=client,
-            interval=interval,
-            slow_down_interval=slow_down_interval,
-            requests_kwargs=requests_kwargs,
-            **token_kwargs,
-        )
-        self.device_code = device_code
-
-    def token_request(self) -> BearerToken:
-        """Implement the Device Code token request.
-
-        This actually calls [OAuth2Client.device_code(device_code)] on `client`.
-
-        Returns:
-            a [BearerToken][requests_oauth2client.tokens.BearerToken]
-
-        """
-        return self.client.device_code(self.device_code, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
-
+ Source code in requests_oauth2client/client.py + 
1376
+1377
+1378
+1379
+1380
+1381
+1382
+1383
+1384
+1385
+1386
+1387
+1388
+1389
+1390
+1391
+1392
+1393
+1394
+1395
+1396
+1397
+1398
+1399
+1400
+1401
+1402
+1403
+1404
+1405
+1406
+1407
+1408
def on_introspection_error(self, response: requests.Response) -> Any:
+    """Error handler for `introspect_token()`.
+
+    Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
+    to parse the returned response in the case an error is returned.
+
+    Args:
+        response: the response as returned by the Introspection Endpoint.
+
+    Returns:
+        usually raises exceptions. A subclass can return a default response instead.
+
+    Raises:
+        EndpointError: (or one of its subclasses) if the response contains a standard OAuth 2.0 error.
+        UnknownIntrospectionError: if the response is not a standard error response.
+
+    """
+    try:
+        data = response.json()
+        error = data["error"]
+        error_description = data.get("error_description")
+        error_uri = data.get("error_uri")
+        exception_class = self.exception_classes.get(error, IntrospectionError)
+        exception = exception_class(
+            response=response,
+            client=self,
+            error=error,
+            description=error_description,
+            uri=error_uri,
+        )
+    except Exception as exc:
+        raise UnknownIntrospectionError(response=response, client=self) from exc
+    raise exception
+
+
- - -
- +
+
+

+ backchannel_authentication_request(scope='openid', *, client_notification_token=None, acr_values=None, login_hint_token=None, id_token_hint=None, login_hint=None, binding_message=None, user_code=None, requested_expiry=None, private_jwk=None, alg=None, requests_kwargs=None, **ciba_kwargs) +

+
+

Send a CIBA Authentication Request.

-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
scope + None | str | Iterable[str] + +
+

the scope to include in the request.

+
+ 		+ 'openid' +
client_notification_token + str | None + +
+

the Client Notification Token to include in the request.

+
+ 		+ None +
acr_values + None | str | Iterable[str] + +
+

the acr values to include in the request.

+
+ 		+ None +
login_hint_token + str | None + +
+

the Login Hint Token to include in the request.

+
+ 		+ None +
id_token_hint + str | None + +
+

the ID Token Hint to include in the request.

+
+ 		+ None +
login_hint + str | None + +
+

the Login Hint to include in the request.

+
+ 		+ None +
binding_message + str | None + +
+

the Binding Message to include in the request.

+
+ 		+ None +
user_code + str | None + +
+

the User Code to include in the request

+
+ 		+ None +
requested_expiry + int | None + +
+

the Requested Expiry, in seconds, to include in the request.

+
+ 		+ None +
private_jwk + Jwk | dict[str, Any] | None + +
+

the JWK to use to sign the request (optional)

+
+ 		+ None +
alg + str | None + +
+

the alg to use to sign the request, if the provided JWK does not include an "alg" parameter.

+
+ 		+ None +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters for

+
+ 		+ None +
**ciba_kwargs + Any + +
+

additional parameters to include in the request.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BackChannelAuthenticationResponse + +
+

a BackChannelAuthenticationResponse as returned by AS

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + + + + + +
TypeDescription
+ InvalidBackchannelAuthenticationRequestHintParam + +
+

if none of login_hint, login_hint_token +or id_token_hint is provided, or more than one of them is provided.

+
+
+ InvalidScopeParam + +
+

if the scope parameter is invalid.

+
+
+ InvalidAcrValuesParam + +
+

if the acr_values parameter is invalid.

+
+
+
+ Source code in requests_oauth2client/client.py + 
1410
+1411
+1412
+1413
+1414
+1415
+1416
+1417
+1418
+1419
+1420
+1421
+1422
+1423
+1424
+1425
+1426
+1427
+1428
+1429
+1430
+1431
+1432
+1433
+1434
+1435
+1436
+1437
+1438
+1439
+1440
+1441
+1442
+1443
+1444
+1445
+1446
+1447
+1448
+1449
+1450
+1451
+1452
+1453
+1454
+1455
+1456
+1457
+1458
+1459
+1460
+1461
+1462
+1463
+1464
+1465
+1466
+1467
+1468
+1469
+1470
+1471
+1472
+1473
+1474
+1475
+1476
+1477
+1478
+1479
+1480
+1481
+1482
+1483
+1484
+1485
+1486
+1487
+1488
+1489
+1490
+1491
+1492
+1493
+1494
+1495
+1496
+1497
+1498
+1499
def backchannel_authentication_request(  # noqa: PLR0913
+    self,
+    scope: None | str | Iterable[str] = "openid",
+    *,
+    client_notification_token: str | None = None,
+    acr_values: None | str | Iterable[str] = None,
+    login_hint_token: str | None = None,
+    id_token_hint: str | None = None,
+    login_hint: str | None = None,
+    binding_message: str | None = None,
+    user_code: str | None = None,
+    requested_expiry: int | None = None,
+    private_jwk: Jwk | dict[str, Any] | None = None,
+    alg: str | None = None,
+    requests_kwargs: dict[str, Any] | None = None,
+    **ciba_kwargs: Any,
+) -> BackChannelAuthenticationResponse:
+    """Send a CIBA Authentication Request.
+
+    Args:
+         scope: the scope to include in the request.
+         client_notification_token: the Client Notification Token to include in the request.
+         acr_values: the acr values to include in the request.
+         login_hint_token: the Login Hint Token to include in the request.
+         id_token_hint: the ID Token Hint to include in the request.
+         login_hint: the Login Hint to include in the request.
+         binding_message: the Binding Message to include in the request.
+         user_code: the User Code to include in the request
+         requested_expiry: the Requested Expiry, in seconds, to include in the request.
+         private_jwk: the JWK to use to sign the request (optional)
+         alg: the alg to use to sign the request, if the provided JWK does not include an "alg" parameter.
+         requests_kwargs: additional parameters for
+         **ciba_kwargs: additional parameters to include in the request.
+
+    Returns:
+        a BackChannelAuthenticationResponse as returned by AS
+
+    Raises:
+        InvalidBackchannelAuthenticationRequestHintParam: if none of `login_hint`, `login_hint_token`
+            or `id_token_hint` is provided, or more than one of them is provided.
+        InvalidScopeParam: if the `scope` parameter is invalid.
+        InvalidAcrValuesParam: if the `acr_values` parameter is invalid.
+
+    """
+    if not (login_hint or login_hint_token or id_token_hint):
+        msg = "One of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
+        raise InvalidBackchannelAuthenticationRequestHintParam(msg)
+
+    if (login_hint_token and id_token_hint) or (login_hint and id_token_hint) or (login_hint_token and login_hint):
+        msg = "Only one of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
+        raise InvalidBackchannelAuthenticationRequestHintParam(msg)
+
+    requests_kwargs = requests_kwargs or {}
+
+    if scope is not None and not isinstance(scope, str):
+        try:
+            scope = " ".join(scope)
+        except Exception as exc:
+            raise InvalidScopeParam(scope) from exc
+
+    if acr_values is not None and not isinstance(acr_values, str):
+        try:
+            acr_values = " ".join(acr_values)
+        except Exception as exc:
+            raise InvalidAcrValuesParam(acr_values) from exc
+
+    data = dict(
+        ciba_kwargs,
+        scope=scope,
+        client_notification_token=client_notification_token,
+        acr_values=acr_values,
+        login_hint_token=login_hint_token,
+        id_token_hint=id_token_hint,
+        login_hint=login_hint,
+        binding_message=binding_message,
+        user_code=user_code,
+        requested_expiry=requested_expiry,
+    )
+
+    if private_jwk is not None:
+        data = {"request": str(Jwt.sign(data, key=private_jwk, alg=alg))}
+
+    return self._request(
+        Endpoints.BACKCHANNEL_AUTHENTICATION,
+        data=data,
+        auth=self.auth,
+        on_success=self.parse_backchannel_authentication_response,
+        on_failure=self.on_backchannel_authentication_error,
+        **requests_kwargs,
+    )
+
+
+
+
-

- token_request() +
-

+

+ parse_backchannel_authentication_response(response) -
- -

Implement the Device Code token request.

-

This actually calls [OAuth2Client.device_code(device_code)] on client.

+

+
-

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/device_authorization.py - 
111
-112
-113
-114
-115
-116
-117
-118
-119
-120
def token_request(self) -> BearerToken:
-    """Implement the Device Code token request.
-
-    This actually calls [OAuth2Client.device_code(device_code)] on `client`.
-
-    Returns:
-        a [BearerToken][requests_oauth2client.tokens.BearerToken]
-
-    """
-    return self.client.device_code(self.device_code, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
-
-
-
+

Parse a response received by backchannel_authentication_request().

+

Invoked by +backchannel_authentication_request() +to parse the response returned by the BackChannel Authentication Endpoint.

-
+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the response returned by the BackChannel Authentication Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BackChannelAuthenticationResponse + +
+

a BackChannelAuthenticationResponse

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ InvalidBackChannelAuthenticationResponse + +
+

if the response does not contain a standard +BackChannel Authentication response.

+
+
+
+ Source code in requests_oauth2client/client.py + 
1501
+1502
+1503
+1504
+1505
+1506
+1507
+1508
+1509
+1510
+1511
+1512
+1513
+1514
+1515
+1516
+1517
+1518
+1519
+1520
+1521
+1522
+1523
+1524
+1525
def parse_backchannel_authentication_response(
+    self,
+    response: requests.Response,
+) -> BackChannelAuthenticationResponse:
+    """Parse a response received by `backchannel_authentication_request()`.
+
+    Invoked by
+    [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
+    to parse the response returned by the BackChannel Authentication Endpoint.
+
+    Args:
+        response: the response returned by the BackChannel Authentication Endpoint.
+
+    Returns:
+        a `BackChannelAuthenticationResponse`
+
+    Raises:
+        InvalidBackChannelAuthenticationResponse: if the response does not contain a standard
+            BackChannel Authentication response.
+
+    """
+    try:
+        return BackChannelAuthenticationResponse(**response.json())
+    except TypeError as exc:
+        raise InvalidBackChannelAuthenticationResponse(response=response, client=self) from exc
+
+
+
-
+
-
+
-
+

+ on_backchannel_authentication_error(response) -
+

+
-

- DeviceAuthorizationResponse +

Error handler for backchannel_authentication_request().

+

Invoked by +backchannel_authentication_request() +to parse the response returned by the BackChannel Authentication Endpoint, when it is an +error.

-

+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the response returned by the BackChannel Authentication Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BackChannelAuthenticationResponse + +
+

usually raises an exception. But a subclass can return a default response instead.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ EndpointError + +
+

(or one of its subclasses) if the response contains a standard OAuth 2.0 error.

+
+
+ InvalidBackChannelAuthenticationResponse + +
+

for non-standard error responses.

+
+
+
+ Source code in requests_oauth2client/client.py + 
1527
+1528
+1529
+1530
+1531
+1532
+1533
+1534
+1535
+1536
+1537
+1538
+1539
+1540
+1541
+1542
+1543
+1544
+1545
+1546
+1547
+1548
+1549
+1550
+1551
+1552
+1553
+1554
+1555
+1556
+1557
+1558
+1559
+1560
+1561
def on_backchannel_authentication_error(self, response: requests.Response) -> BackChannelAuthenticationResponse:
+    """Error handler for `backchannel_authentication_request()`.
+
+    Invoked by
+    [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
+    to parse the response returned by the BackChannel Authentication Endpoint, when it is an
+    error.
+
+    Args:
+        response: the response returned by the BackChannel Authentication Endpoint.
+
+    Returns:
+        usually raises an exception. But a subclass can return a default response instead.
+
+    Raises:
+        EndpointError: (or one of its subclasses) if the response contains a standard OAuth 2.0 error.
+        InvalidBackChannelAuthenticationResponse: for non-standard error responses.
+
+    """
+    try:
+        data = response.json()
+        error = data["error"]
+        error_description = data.get("error_description")
+        error_uri = data.get("error_uri")
+        exception_class = self.exception_classes.get(error, BackChannelAuthenticationError)
+        exception = exception_class(
+            response=response,
+            client=self,
+            error=error,
+            description=error_description,
+            uri=error_uri,
+        )
+    except Exception as exc:
+        raise InvalidBackChannelAuthenticationResponse(response=response, client=self) from exc
+    raise exception
+
+
+
-
+
- -

Represent a response returned by the device Authorization Endpoint.

-

All parameters are those returned by the AS as response to a Device Authorization Request.

+
+

+ authorize_device(requests_kwargs=None, **data) -

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
device_code - str - -
-

the device_code as returned by the AS.

-
- 		- required -
user_code - str - -
-

the device_code as returned by the AS.

-
- 		- required -
verification_uri - str - -
-

the device_code as returned by the AS.

-
- 		- required -
verification_uri_complete - str | None - -
-

the device_code as returned by the AS.

-
- 		- None -
expires_at - datetime | None - -
-

the expiration date for the device_code. -Also accepts an expires_in parameter, as a number of seconds in the future.

-
- 		- None -
interval - int | None - -
-

the pooling interval as returned by the AS.

-
- 		- None -
**kwargs - Any - -
-

additional parameters as returned by the AS.

-
- 		- {} -
+

-
- Source code in requests_oauth2client/device_authorization.py - 
20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
class DeviceAuthorizationResponse:
-    """Represent a response returned by the device Authorization Endpoint.
-
-    All parameters are those returned by the AS as response to a Device Authorization Request.
-
-    Args:
-        device_code: the `device_code` as returned by the AS.
-        user_code: the `device_code` as returned by the AS.
-        verification_uri: the `device_code` as returned by the AS.
-        verification_uri_complete: the `device_code` as returned by the AS.
-        expires_at: the expiration date for the device_code.
-            Also accepts an `expires_in` parameter, as a number of seconds in the future.
-        interval: the pooling `interval` as returned by the AS.
-        **kwargs: additional parameters as returned by the AS.
-
-    """
-
-    @accepts_expires_in
-    def __init__(
-        self,
-        device_code: str,
-        user_code: str,
-        verification_uri: str,
-        verification_uri_complete: str | None = None,
-        expires_at: datetime | None = None,
-        interval: int | None = None,
-        **kwargs: Any,
-    ):
-        self.device_code = device_code
-        self.user_code = user_code
-        self.verification_uri = verification_uri
-        self.verification_uri_complete = verification_uri_complete
-        self.expires_at = expires_at
-        self.interval = interval
-        self.other = kwargs
-
-    def is_expired(self, leeway: int = 0) -> bool | None:
-        """Check if the `device_code` within this response is expired.
-
-        Returns:
-            `True` if the device_code is expired, `False` if it is still valid, `None` if there is
-            no `expires_in` hint.
-
-        """
-        if self.expires_at:
-            return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
-        return None
-
-
- +
-
+

Send a Device Authorization Request.

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
**data + Any + +
+

additional data to send to the Device Authorization Endpoint

+
+ 		+ {} +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters for requests.request()

+
+ 		+ None +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ DeviceAuthorizationResponse + +
+

a Device Authorization Response

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ MissingEndpointUri + +
+

if the Device Authorization URI is not configured

+
+
+
+ Source code in requests_oauth2client/client.py + 
1563
+1564
+1565
+1566
+1567
+1568
+1569
+1570
+1571
+1572
+1573
+1574
+1575
+1576
+1577
+1578
+1579
+1580
+1581
+1582
+1583
+1584
+1585
+1586
+1587
+1588
+1589
+1590
def authorize_device(
+    self,
+    requests_kwargs: dict[str, Any] | None = None,
+    **data: Any,
+) -> DeviceAuthorizationResponse:
+    """Send a Device Authorization Request.
+
+    Args:
+        **data: additional data to send to the Device Authorization Endpoint
+        requests_kwargs: additional parameters for `requests.request()`
+
+    Returns:
+        a Device Authorization Response
+
+    Raises:
+        MissingEndpointUri: if the Device Authorization URI is not configured
+
+    """
+    requests_kwargs = requests_kwargs or {}
+
+    return self._request(
+        Endpoints.DEVICE_AUTHORIZATION,
+        data=data,
+        auth=self.auth,
+        on_success=self.parse_device_authorization_response,
+        on_failure=self.on_device_authorization_error,
+        **requests_kwargs,
+    )
+
+
+
+
+
+

+ parse_device_authorization_response(response) +

-
+
+

Parse a Device Authorization Response received by authorize_device().

+

Invoked by authorize_device() +to parse the response returned by the Device Authorization Endpoint.

-

- is_expired(leeway=0) +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the response returned by the Device Authorization Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ DeviceAuthorizationResponse + +
+

a DeviceAuthorizationResponse as returned by AS

+
+
-

+
+ Source code in requests_oauth2client/client.py + 
1592
+1593
+1594
+1595
+1596
+1597
+1598
+1599
+1600
+1601
+1602
+1603
+1604
+1605
def parse_device_authorization_response(self, response: requests.Response) -> DeviceAuthorizationResponse:
+    """Parse a Device Authorization Response received by `authorize_device()`.
+
+    Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
+    to parse the response returned by the Device Authorization Endpoint.
+
+    Args:
+        response: the response returned by the Device Authorization Endpoint.
+
+    Returns:
+        a `DeviceAuthorizationResponse` as returned by AS
+
+    """
+    return DeviceAuthorizationResponse(**response.json())
+
+
+
+
-
- -

Check if the device_code within this response is expired.

+
+

+ on_device_authorization_error(response) -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- bool | None - -
-

True if the device_code is expired, False if it is still valid, None if there is

-
-
- bool | None - -
-

no expires_in hint.

-
-
- -
- Source code in requests_oauth2client/device_authorization.py - 
56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
def is_expired(self, leeway: int = 0) -> bool | None:
-    """Check if the `device_code` within this response is expired.
-
-    Returns:
-        `True` if the device_code is expired, `False` if it is still valid, `None` if there is
-        no `expires_in` hint.
-
-    """
-    if self.expires_at:
-        return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
-    return None
-
-
-

+ -
+
+

Error handler for authorize_device().

+

Invoked by authorize_device() +to parse the response returned by the Device Authorization Endpoint, when that response is +an error.

-
-
+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the response returned by the Device Authorization Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ DeviceAuthorizationResponse + +
+

usually raises an Exception. But a subclass may return a default response instead.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ EndpointError + +
+

for standard OAuth 2.0 errors

+
+
+ InvalidDeviceAuthorizationResponse + +
+

for non-standard error responses.

+
+
+
+ Source code in requests_oauth2client/client.py + 
1607
+1608
+1609
+1610
+1611
+1612
+1613
+1614
+1615
+1616
+1617
+1618
+1619
+1620
+1621
+1622
+1623
+1624
+1625
+1626
+1627
+1628
+1629
+1630
+1631
+1632
+1633
+1634
+1635
+1636
+1637
+1638
+1639
+1640
def on_device_authorization_error(self, response: requests.Response) -> DeviceAuthorizationResponse:
+    """Error handler for `authorize_device()`.
+
+    Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
+    to parse the response returned by the Device Authorization Endpoint, when that response is
+    an error.
+
+    Args:
+        response: the response returned by the Device Authorization Endpoint.
+
+    Returns:
+        usually raises an Exception. But a subclass may return a default response instead.
+
+    Raises:
+        EndpointError: for standard OAuth 2.0 errors
+        InvalidDeviceAuthorizationResponse: for non-standard error responses.
+
+    """
+    try:
+        data = response.json()
+        error = data["error"]
+        error_description = data.get("error_description")
+        error_uri = data.get("error_uri")
+        exception_class = self.exception_classes.get(error, DeviceAuthorizationError)
+        exception = exception_class(
+            response=response,
+            client=self,
+            error=error,
+            description=error_description,
+            uri=error_uri,
+        )
+    except Exception as exc:
+        raise InvalidDeviceAuthorizationResponse(response=response, client=self) from exc
+    raise exception
+
+
+
-
+
+

+ update_authorization_server_public_keys(requests_kwargs=None) -

- AccessDenied +

- +
+

Update the cached AS public keys by retrieving them from its jwks_uri.

+

Public keys are returned by this method, as a jwskate.JwkSet. They are also +available in attribute authorization_server_jwks.

-
-

- Bases: EndpointError

- -

Raised when the Authorization Server returns error = access_denied.

+

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ JwkSet + +
+

the retrieved public keys

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ ValueError + +
+

if no jwks_uri is configured

+
+
- Source code in requests_oauth2client/exceptions.py - 
97
-98
class AccessDenied(EndpointError):
-    """Raised when the Authorization Server returns `error = access_denied`."""
-
+ Source code in requests_oauth2client/client.py + 
1642
+1643
+1644
+1645
+1646
+1647
+1648
+1649
+1650
+1651
+1652
+1653
+1654
+1655
+1656
+1657
+1658
+1659
+1660
+1661
+1662
+1663
+1664
+1665
+1666
def update_authorization_server_public_keys(self, requests_kwargs: dict[str, Any] | None = None) -> JwkSet:
+    """Update the cached AS public keys by retrieving them from its `jwks_uri`.
+
+    Public keys are returned by this method, as a `jwskate.JwkSet`. They are also
+    available in attribute `authorization_server_jwks`.
+
+    Returns:
+        the retrieved public keys
+
+    Raises:
+        ValueError: if no `jwks_uri` is configured
+
+    """
+    requests_kwargs = requests_kwargs or {}
+
+    jwks = self._request(
+        Endpoints.JWKS,
+        auth=None,
+        method="GET",
+        on_success=lambda resp: resp.json(),
+        on_failure=lambda resp: resp.raise_for_status(),
+        **requests_kwargs,
+    )
+    self.authorization_server_jwks.update(jwks)
+    return self.authorization_server_jwks
+
- -
- +
-
+
+

+ from_discovery_endpoint(url=None, issuer=None, *, auth=None, client_id=None, client_secret=None, private_key=None, session=None, testing=False, **kwargs) -

- AccountSelectionRequired + + classmethod + +

- +
-
-

- Bases: InteractionRequired

+

Initialise an OAuth2Client based on Authorization Server Metadata.

+

This will retrieve the standardised metadata document available at url, and will extract +all Endpoint Uris from that document, will fetch the current public keys from its +jwks_uri, then will initialise an OAuth2Client based on those endpoints.

- -

Raised when the Authorization Endpoint returns error = account_selection_required.

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
url + str | None + +
+

the url where the server metadata will be retrieved

+
+ 		+ None +
auth + AuthBase | tuple[str, str] | str | None + +
+

the authentication handler to use for client authentication

+
+ 		+ None +
client_id + str | None + +
+

client ID

+
+ 		+ None +
client_secret + str | None + +
+

client secret to use to authenticate the client

+
+ 		+ None +
private_key + Jwk | dict[str, Any] | None + +
+

private key to sign client assertions

+
+ 		+ None +
session + Session | None + +
+

a requests.Session to use to retrieve the document and initialise the client with

+
+ 		+ None +
issuer + str | None + +
+

if an issuer is given, check that it matches the one from the retrieved document

+
+ 		+ None +
testing + bool + +
+

if True, don't try to validate the endpoint urls that are part of the document

+
+ 		+ False +
**kwargs + Any + +
+

additional keyword parameters to pass to OAuth2Client

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ OAuth2Client + +
+

an OAuth2Client with endpoint initialised based on the obtained metadata

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ InvalidParam + +
+

if neither url nor issuer are suitable urls

+
+
+ HTTPError + +
+

if an error happens while fetching the documents

+
+
+ + +
+ Example + 
1
+2
+3
+4
+5
+6
+7
from requests_oauth2client import OAuth2Client
+
+client = OAuth2Client.from_discovery_endpoint(
+    issuer="https://myserver.net",
+    client_id="my_client_id,
+    client_secret="my_client_secret"
+)
+
+
- Source code in requests_oauth2client/exceptions.py - 
172
-173
class AccountSelectionRequired(InteractionRequired):
-    """Raised when the Authorization Endpoint returns `error = account_selection_required`."""
-
+ Source code in requests_oauth2client/client.py + 
1668
+1669
+1670
+1671
+1672
+1673
+1674
+1675
+1676
+1677
+1678
+1679
+1680
+1681
+1682
+1683
+1684
+1685
+1686
+1687
+1688
+1689
+1690
+1691
+1692
+1693
+1694
+1695
+1696
+1697
+1698
+1699
+1700
+1701
+1702
+1703
+1704
+1705
+1706
+1707
+1708
+1709
+1710
+1711
+1712
+1713
+1714
+1715
+1716
+1717
+1718
+1719
+1720
+1721
+1722
+1723
+1724
+1725
+1726
+1727
+1728
+1729
+1730
+1731
+1732
+1733
+1734
+1735
+1736
+1737
+1738
+1739
+1740
+1741
+1742
+1743
+1744
@classmethod
+def from_discovery_endpoint(
+    cls,
+    url: str | None = None,
+    issuer: str | None = None,
+    *,
+    auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
+    client_id: str | None = None,
+    client_secret: str | None = None,
+    private_key: Jwk | dict[str, Any] | None = None,
+    session: requests.Session | None = None,
+    testing: bool = False,
+    **kwargs: Any,
+) -> OAuth2Client:
+    """Initialise an OAuth2Client based on Authorization Server Metadata.
+
+    This will retrieve the standardised metadata document available at `url`, and will extract
+    all Endpoint Uris from that document, will fetch the current public keys from its
+    `jwks_uri`, then will initialise an OAuth2Client based on those endpoints.
+
+    Args:
+         url: the url where the server metadata will be retrieved
+         auth: the authentication handler to use for client authentication
+         client_id: client ID
+         client_secret: client secret to use to authenticate the client
+         private_key: private key to sign client assertions
+         session: a `requests.Session` to use to retrieve the document and initialise the client with
+         issuer: if an issuer is given, check that it matches the one from the retrieved document
+         testing: if True, don't try to validate the endpoint urls that are part of the document
+         **kwargs: additional keyword parameters to pass to OAuth2Client
+
+    Returns:
+        an OAuth2Client with endpoint initialised based on the obtained metadata
+
+    Raises:
+        InvalidParam: if neither `url` nor `issuer` are suitable urls
+        requests.HTTPError: if an error happens while fetching the documents
+
+    Example:
+        ```python
+        from requests_oauth2client import OAuth2Client
+
+        client = OAuth2Client.from_discovery_endpoint(
+            issuer="https://myserver.net",
+            client_id="my_client_id,
+            client_secret="my_client_secret"
+        )
+        ```
+
+    """
+    if url is None and issuer is not None:
+        url = oidc_discovery_document_url(issuer)
+    if url is None:
+        msg = "Please specify at least one of `issuer` or `url`"
+        raise InvalidParam(msg)
+
+    validate_endpoint_uri(url, path=False)
+
+    session = session or requests.Session()
+    discovery = session.get(url).json()
+
+    jwks_uri = discovery.get("jwks_uri")
+    if jwks_uri:
+        jwks = JwkSet(session.get(jwks_uri).json())
+
+    return cls.from_discovery_document(
+        discovery,
+        issuer=issuer,
+        auth=auth,
+        session=session,
+        client_id=client_id,
+        client_secret=client_secret,
+        private_key=private_key,
+        authorization_server_jwks=jwks,
+        testing=testing,
+        **kwargs,
+    )
+
- -
- +
-
+
+

+ from_discovery_document(discovery, issuer=None, *, auth=None, client_id=None, client_secret=None, private_key=None, authorization_server_jwks=None, session=None, https=True, testing=False, **kwargs) -

- AuthorizationPending + + classmethod + +

- +
-
-

- Bases: TokenEndpointError

+

Initialize an OAuth2Client, based on the server metadata from discovery.

- -

Raised when the Token Endpoint returns error = authorization_pending.

+ +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
discovery + dict[str, Any] + +
+

a dict of server metadata, in the same format as retrieved from a discovery endpoint.

+
+ 		+ required +
issuer + str | None + +
+

if an issuer is given, check that it matches the one mentioned in the document

+
+ 		+ None +
auth + AuthBase | tuple[str, str] | str | None + +
+

the authentication handler to use for client authentication

+
+ 		+ None +
client_id + str | None + +
+

client ID

+
+ 		+ None +
client_secret + str | None + +
+

client secret to use to authenticate the client

+
+ 		+ None +
private_key + Jwk | dict[str, Any] | None + +
+

private key to sign client assertions

+
+ 		+ None +
authorization_server_jwks + JwkSet | dict[str, Any] | None + +
+

the current authorization server JWKS keys

+
+ 		+ None +
session + Session | None + +
+

a requests Session to use to retrieve the document and initialise the client with

+
+ 		+ None +
https + bool + +
+

(deprecated) if True, validates that urls in the discovery document use the https scheme

+
+ 		+ True +
testing + bool + +
+

if True, don't try to validate the endpoint urls that are part of the document

+
+ 		+ False +
**kwargs + Any + +
+

additional args that will be passed to OAuth2Client

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ OAuth2Client + +
+

an OAuth2Client initialized with the endpoints from the discovery document

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ InvalidDiscoveryDocument + +
+

if the document does not contain at least a "token_endpoint".

+
+
- Source code in requests_oauth2client/exceptions.py - 
125
-126
class AuthorizationPending(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = authorization_pending`."""
-
+ Source code in requests_oauth2client/client.py + 
1746
+1747
+1748
+1749
+1750
+1751
+1752
+1753
+1754
+1755
+1756
+1757
+1758
+1759
+1760
+1761
+1762
+1763
+1764
+1765
+1766
+1767
+1768
+1769
+1770
+1771
+1772
+1773
+1774
+1775
+1776
+1777
+1778
+1779
+1780
+1781
+1782
+1783
+1784
+1785
+1786
+1787
+1788
+1789
+1790
+1791
+1792
+1793
+1794
+1795
+1796
+1797
+1798
+1799
+1800
+1801
+1802
+1803
+1804
+1805
+1806
+1807
+1808
+1809
+1810
+1811
+1812
+1813
+1814
+1815
+1816
+1817
+1818
+1819
+1820
+1821
+1822
+1823
+1824
+1825
+1826
+1827
+1828
+1829
+1830
+1831
+1832
+1833
+1834
+1835
+1836
+1837
+1838
    @classmethod
+    def from_discovery_document(
+        cls,
+        discovery: dict[str, Any],
+        issuer: str | None = None,
+        *,
+        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_key: Jwk | dict[str, Any] | None = None,
+        authorization_server_jwks: JwkSet | dict[str, Any] | None = None,
+        session: requests.Session | None = None,
+        https: bool = True,
+        testing: bool = False,
+        **kwargs: Any,
+    ) -> OAuth2Client:
+        """Initialize an OAuth2Client, based on the server metadata from `discovery`.
+
+        Args:
+             discovery: a dict of server metadata, in the same format as retrieved from a discovery endpoint.
+             issuer: if an issuer is given, check that it matches the one mentioned in the document
+             auth: the authentication handler to use for client authentication
+             client_id: client ID
+             client_secret: client secret to use to authenticate the client
+             private_key: private key to sign client assertions
+             authorization_server_jwks: the current authorization server JWKS keys
+             session: a requests Session to use to retrieve the document and initialise the client with
+             https: (deprecated) if `True`, validates that urls in the discovery document use the https scheme
+             testing: if True, don't try to validate the endpoint urls that are part of the document
+             **kwargs: additional args that will be passed to OAuth2Client
+
+        Returns:
+            an `OAuth2Client` initialized with the endpoints from the discovery document
+
+        Raises:
+            InvalidDiscoveryDocument: if the document does not contain at least a `"token_endpoint"`.
+
+        """
+        if not https:
+            warnings.warn(
+                """\
+The https parameter is deprecated.
+To disable endpoint uri validation, set `testing=True` when initializing your `OAuth2Client`.""",
+                stacklevel=1,
+            )
+            testing = True
+        if issuer and discovery.get("issuer") != issuer:
+            msg = (
+                f"Mismatching `issuer` value in discovery document"
+                f" (received '{discovery.get('issuer')}', expected '{issuer}')"
+            )
+            raise InvalidParam(
+                msg,
+                issuer,
+                discovery.get("issuer"),
+            )
+        if issuer is None:
+            issuer = discovery.get("issuer")
+
+        token_endpoint = discovery.get(Endpoints.TOKEN)
+        if token_endpoint is None:
+            msg = "token_endpoint not found in that discovery document"
+            raise InvalidDiscoveryDocument(msg, discovery)
+        authorization_endpoint = discovery.get(Endpoints.AUTHORIZATION)
+        revocation_endpoint = discovery.get(Endpoints.REVOCATION)
+        introspection_endpoint = discovery.get(Endpoints.INSTROSPECTION)
+        userinfo_endpoint = discovery.get(Endpoints.USER_INFO)
+        jwks_uri = discovery.get(Endpoints.JWKS)
+        if jwks_uri is not None:
+            validate_endpoint_uri(jwks_uri, https=https)
+        authorization_response_iss_parameter_supported = discovery.get(
+            "authorization_response_iss_parameter_supported",
+            False,
+        )
+
+        return cls(
+            token_endpoint=token_endpoint,
+            authorization_endpoint=authorization_endpoint,
+            revocation_endpoint=revocation_endpoint,
+            introspection_endpoint=introspection_endpoint,
+            userinfo_endpoint=userinfo_endpoint,
+            jwks_uri=jwks_uri,
+            authorization_server_jwks=authorization_server_jwks,
+            auth=auth,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_key=private_key,
+            session=session,
+            issuer=issuer,
+            authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
+            testing=testing,
+            **kwargs,
+        )
+
+
+ +
+ +
+
@@ -31069,119 +31985,35 @@

-

- AuthorizationResponseError - +

+ UnknownActorTokenType -

+ -
-

- Bases: Exception

- -

Base class for error responses returned by the Authorization endpoint.

-

An AuthorizationResponseError contains the error message, description and uri that are -returned by the AS.

+
+

+ Bases: UnknownTokenType

+

Raised when the type of actor_token cannot be determined automatically.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
error - str - -
-

the error identifier as returned by the AS

-
- 		- required -
description - str | None - -
-

the error_description as returned by the AS

-
- 		- None -
uri - str | None - -
-

the error_uri as returned by the AS

-
- 		- None -
+
+ Source code in requests_oauth2client/client.py + 
140
+141
+142
+143
+144
class UnknownActorTokenType(UnknownTokenType):
+    """Raised when the type of actor_token cannot be determined automatically."""
+
+    def __init__(self, actor_token: object, actor_token_type: str | None) -> None:
+        super().__init__("actor_token", token=actor_token, token_type=actor_token_type)
+
+
-
- Source code in requests_oauth2client/exceptions.py - 
145
-146
-147
-148
-149
-150
-151
-152
-153
-154
-155
-156
-157
-158
-159
-160
-161
class AuthorizationResponseError(Exception):
-    """Base class for error responses returned by the Authorization endpoint.
-
-    An `AuthorizationResponseError` contains the error message, description and uri that are
-    returned by the AS.
-
-    Args:
-        error: the `error` identifier as returned by the AS
-        description: the `error_description` as returned by the AS
-        uri: the `error_uri` as returned by the AS
-
-    """
-
-    def __init__(self, error: str, description: str | None = None, uri: str | None = None):
-        self.error = error
-        self.description = description
-        self.uri = uri
-
-
-
@@ -31197,8 +32029,7 @@

- BackChannelAuthenticationError +

+ UnknownSubjectTokenType -

+ -
-

- Bases: EndpointError

+
+

+ Bases: UnknownTokenType

- -

Base class for errors returned by the BackChannel Authentication endpoint.

-
- Source code in requests_oauth2client/exceptions.py - 
269
-270
class BackChannelAuthenticationError(EndpointError):
-    """Base class for errors returned by the BackChannel Authentication endpoint."""
-
-
+

Raised when the type of subject_token cannot be determined automatically.

-
+
+ Source code in requests_oauth2client/client.py + 
133
+134
+135
+136
+137
class UnknownSubjectTokenType(UnknownTokenType):
+    """Raised when the type of subject_token cannot be determined automatically."""
+
+    def __init__(self, subject_token: object, subject_token_type: str | None) -> None:
+        super().__init__("subject_token", subject_token, subject_token_type)
+
+
-
-
+
+ -

- ConsentRequired -

-
-

- Bases: InteractionRequired

- -

Raised when the Authorization Endpoint returns error = consent_required.

-
- Source code in requests_oauth2client/exceptions.py - 
180
-181
class ConsentRequired(InteractionRequired):
-    """Raised when the Authorization Endpoint returns `error = consent_required`."""
-
-
+
@@ -31268,228 +32089,281 @@

-

- DeviceAuthorizationError +

+ UnknownTokenType -

+ -
-

- Bases: EndpointError

+
+

+ Bases: InvalidParam, TypeError

- -

Base class for Device Authorization Endpoint errors.

-
- Source code in requests_oauth2client/exceptions.py - 
121
-122
class DeviceAuthorizationError(EndpointError):
-    """Base class for Device Authorization Endpoint errors."""
-
-
+

Raised when the type of a token cannot be determined automatically.

-
+
+ Source code in requests_oauth2client/client.py + 
124
+125
+126
+127
+128
+129
+130
class UnknownTokenType(InvalidParam, TypeError):
+    """Raised when the type of a token cannot be determined automatically."""
+
+    def __init__(self, message: str, token: object, token_type: str | None) -> None:
+        super().__init__(f"Unable to determine the type of token provided: {message}")
+        self.token = token
+        self.token_type = token_type
+
+
-
-
+
-

- EndpointError -

-
-

- Bases: OAuth2Error

- - -

Base class for exceptions raised from backend endpoint errors.

-

This contains the error message, description and uri that are returned by the AS in the OAuth -2.0 standardised way.

- - - -

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the raw requests.PreparedResponse containing the error.

-
- 		- required -
error - str - -
-

the error identifier as returned by the AS.

-
- 		- required -
description - str | None - -
-

the error_description as returned by the AS.

-
- 		- None -
uri - str | None - -
-

the error_uri as returned by the AS.

-
- 		- None -
-
- Source code in requests_oauth2client/exceptions.py - 
30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
class EndpointError(OAuth2Error):
-    """Base class for exceptions raised from backend endpoint errors.
-
-    This contains the error message, description and uri that are returned by the AS in the OAuth
-    2.0 standardised way.
-
-    Args:
-        response: the raw requests.PreparedResponse containing the error.
-        error: the `error` identifier as returned by the AS.
-        description: the `error_description` as returned by the AS.
-        uri: the `error_uri` as returned by the AS.
-
-    """
-
-    def __init__(
-        self,
-        response: requests.Response,
-        error: str,
-        description: str | None = None,
-        uri: str | None = None,
-    ):
-        super().__init__(response)
-        self.error = error
-        self.description = description
-        self.uri = uri
-
-
- -
+
+
+
+
+

+ BaseClientAssertionAuthenticationMethod + + +

+ + +
+

+ Bases: BaseClientAuthenticationMethod

+ + +

Base class for assertion-based client authentication methods.

+ +
+ Source code in requests_oauth2client/client_authentication.py + 
166
+167
+168
+169
+170
+171
+172
+173
+174
+175
+176
+177
+178
+179
+180
+181
+182
+183
+184
+185
+186
+187
+188
+189
+190
+191
+192
+193
+194
+195
+196
+197
+198
+199
+200
+201
+202
+203
+204
+205
+206
+207
+208
+209
+210
@frozen
+class BaseClientAssertionAuthenticationMethod(BaseClientAuthenticationMethod):
+    """Base class for assertion-based client authentication methods."""
+
+    lifetime: int
+    jti_gen: Callable[[], str]
+    aud: str | None
+
+    def client_assertion(self, audience: str) -> str:
+        """Generate a Client Assertion for a specific audience.
+
+        Args:
+            audience: the audience to use for the `aud` claim of the generated Client Assertion.
+
+        Returns:
+            a Client Assertion, as `str`.
+
+        """
+        raise NotImplementedError
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Add a `client_assertion` field in the request body.
+
+        Args:
+            request: a [requests.PreparedRequest][].
+
+        Returns:
+            a [requests.PreparedRequest][] with the added `client_assertion` field.
+
+        """
+        request = super().__call__(request)
+        audience = self.aud or request.url
+        if audience is None:
+            raise InvalidRequestForClientAuthentication(request)  # pragma: no cover
+        params = (
+            parse_qs(request.body, strict_parsing=True, keep_blank_values=True)  # type: ignore[type-var]
+            if request.body
+            else {}
+        )
+        client_assertion = self.client_assertion(audience)
+        params[b"client_id"] = [self.client_id.encode()]
+        params[b"client_assertion"] = [client_assertion.encode()]
+        params[b"client_assertion_type"] = [b"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]
+        request.prepare_body(params, files=None)
+        return request
+
+
+
-
-
-
-
-

- ExpiredAccessToken +
-

+

+ client_assertion(audience) -
-

- Bases: RuntimeError

+

- -

Raised when an expired access token is used.

+ +
+ +

Generate a Client Assertion for a specific audience.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
audience + str + +
+

the audience to use for the aud claim of the generated Client Assertion.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

a Client Assertion, as str.

+
+
- Source code in requests_oauth2client/exceptions.py - 
61
-62
class ExpiredAccessToken(RuntimeError):
-    """Raised when an expired access token is used."""
-
+ Source code in requests_oauth2client/client_authentication.py + 
174
+175
+176
+177
+178
+179
+180
+181
+182
+183
+184
def client_assertion(self, audience: str) -> str:
+    """Generate a Client Assertion for a specific audience.
+
+    Args:
+        audience: the audience to use for the `aud` claim of the generated Client Assertion.
+
+    Returns:
+        a Client Assertion, as `str`.
+
+    """
+    raise NotImplementedError
+
+
+ +
+ +
+
@@ -31497,61 +32371,113 @@

-

- ExpiredIdToken - - -

+

+ BaseClientAuthenticationMethod -
-

- Bases: InvalidIdToken

+

- -

Raised when the returned ID Token is expired.

-
- Source code in requests_oauth2client/exceptions.py - 
265
-266
class ExpiredIdToken(InvalidIdToken):
-    """Raised when the returned ID Token is expired."""
-
-
+
+

+ Bases: AuthBase

+ + +

Base class for all Client Authentication methods. This extends requests.auth.AuthBase.

+

This base class checks that requests are suitable to add Client Authentication parameters to, +and does not modify the request.

+ +
+ Source code in requests_oauth2client/client_authentication.py + 
30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
@frozen
+class BaseClientAuthenticationMethod(requests.auth.AuthBase):
+    """Base class for all Client Authentication methods. This extends [requests.auth.AuthBase][].
+
+    This base class checks that requests are suitable to add Client Authentication parameters to,
+    and does not modify the request.
+
+    """
+
+    client_id: str
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Check that the request is suitable for Client Authentication.
+
+        It checks:
+
+        * that the method is `POST`
+        * that the Content-Type is "application/x-www-form-urlencoded" or None
+
+        Args:
+            request: a [requests.PreparedRequest][]
+
+        Returns:
+            a [requests.PreparedRequest][], unmodified
+
+        Raises:
+            RuntimeError: if the request is not suitable for OAuth 2.0 Client Authentication
+
+        """
+        if request.method != "POST" or request.headers.get("Content-Type") not in (
+            "application/x-www-form-urlencoded",
+            None,
+        ):
+            raise InvalidRequestForClientAuthentication(request)
+        return request
+
+
-
-
+
-
-

- ExpiredToken -

-
-

- Bases: TokenEndpointError

- -

Raised when the Token Endpoint returns error = expired_token.

-
- Source code in requests_oauth2client/exceptions.py - 
133
-134
class ExpiredToken(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = expired_token`."""
-
-
+
@@ -31559,61 +32485,190 @@

-

- InteractionRequired +

+ ClientSecretBasic -

+ -
-

- Bases: AuthorizationResponseError

+
+

+ Bases: BaseClientAuthenticationMethod

- -

Raised when the Authorization Endpoint returns error = interaction_required.

-
- Source code in requests_oauth2client/exceptions.py - 
164
-165
class InteractionRequired(AuthorizationResponseError):
-    """Raised when the Authorization Endpoint returns `error = interaction_required`."""
-
-
+

Implement client_secret_basic authentication.

+

With this method, the client sends its Client ID and Secret, in the HTTP Authorization header, with +the Basic scheme, in each authenticated request to the Authorization Server.

-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client_id + str + +
+

Client ID

+
+ 		+ required +
client_secret + str + +
+

Client Secret

+
+ 		+ required +
+ + +
+ Example + 
1
+2
+3
+4
from requests_oauth2client import ClientSecretBasic, OAuth2Client
+
+auth = ClientSecretBasic("my_client_id", "my_client_secret")
+client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+
+
+
+ Source code in requests_oauth2client/client_authentication.py + 
 67
+ 68
+ 69
+ 70
+ 71
+ 72
+ 73
+ 74
+ 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
@frozen(init=False)
+class ClientSecretBasic(BaseClientAuthenticationMethod):
+    """Implement `client_secret_basic` authentication.
+
+    With this method, the client sends its Client ID and Secret, in the HTTP `Authorization` header, with
+    the `Basic` scheme, in each authenticated request to the Authorization Server.
+
+    Args:
+        client_id: Client ID
+        client_secret: Client Secret
+
+    Example:
+        ```python
+        from requests_oauth2client import ClientSecretBasic, OAuth2Client
+
+        auth = ClientSecretBasic("my_client_id", "my_client_secret")
+        client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+        ```
+
+    """
+
+    client_secret: str
+
+    def __init__(self, client_id: str, client_secret: str) -> None:
+        self.__attrs_init__(
+            client_id=client_id,
+            client_secret=client_secret,
+        )
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Add the appropriate `Authorization` header in each request.
+
+        The Authorization header is formatted as such:
+        `Authorization: Basic BASE64('<client_id:client_secret>')`
+
+        Args:
+            request: the request
+
+        Returns:
+            a [requests.PreparedRequest][] with the added Authorization header.
+
+        """
+        request = super().__call__(request)
+        b64encoded_credentials = BinaPy(f"{self.client_id}:{self.client_secret}").to("b64").ascii()
+        request.headers["Authorization"] = f"Basic {b64encoded_credentials}"
+        return request
+
+
-
-
+ +
+ -

- IntrospectionError -

-
-

- Bases: EndpointError

- -

Base class for Introspection Endpoint errors.

-
- Source code in requests_oauth2client/exceptions.py - 
113
-114
class IntrospectionError(EndpointError):
-    """Base class for Introspection Endpoint errors."""
-
-
+
@@ -31621,92 +32676,443 @@

-

- InvalidAuthResponse +

+ ClientSecretJwt -

+ -
-

- Bases: Exception

+
+

+ Bases: BaseClientAssertionAuthenticationMethod

- -

Raised when the Authorization Endpoint returns an invalid response.

-
- Source code in requests_oauth2client/exceptions.py - 
184
-185
class InvalidAuthResponse(Exception):
-    """Raised when the Authorization Endpoint returns an invalid response."""
-
-
+

Implement client_secret_jwt client authentication method.

+

With this method, the client generates a client assertion, then symmetrically signs it with its Client Secret. +The assertion is then sent to the AS in a client_assertion field with each authenticated request.

-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client_id + str + +
+

the client_id to use.

+
+ 		+ required +
client_secret + str + +
+

the client_secret to use to sign generated Client Assertions.

+
+ 		+ required +
alg + str + +
+

the alg to use to sign generated Client Assertions.

+
+ 		+ HS256 +
lifetime + int + +
+

the lifetime to use for generated Client Assertions.

+
+ 		+ 60 +
jti_gen + Callable[[], str] + +
+

a function to generate JWT Token Ids (jti) for generated Client Assertions.

+
+ 		+ lambda: str(uuid4()) +
aud + str | None + +
+

the audience value to use. If None (default), the endpoint URL will be used.

+
+ 		+ None +
+ + +
+ Example + 
1
+2
+3
+4
from requests_oauth2client import OAuth2Client, ClientSecretJwt
+
+auth = ClientSecretJwt("my_client_id", "my_client_secret")
+client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+
+
+
+ Source code in requests_oauth2client/client_authentication.py + 
213
+214
+215
+216
+217
+218
+219
+220
+221
+222
+223
+224
+225
+226
+227
+228
+229
+230
+231
+232
+233
+234
+235
+236
+237
+238
+239
+240
+241
+242
+243
+244
+245
+246
+247
+248
+249
+250
+251
+252
+253
+254
+255
+256
+257
+258
+259
+260
+261
+262
+263
+264
+265
+266
+267
+268
+269
+270
+271
+272
+273
+274
+275
+276
+277
+278
+279
+280
+281
+282
+283
+284
+285
+286
+287
+288
+289
@frozen(init=False)
+class ClientSecretJwt(BaseClientAssertionAuthenticationMethod):
+    """Implement `client_secret_jwt` client authentication method.
+
+    With this method, the client generates a client assertion, then symmetrically signs it with its Client Secret.
+    The assertion is then sent to the AS in a `client_assertion` field with each authenticated request.
+
+    Args:
+        client_id: the `client_id` to use.
+        client_secret: the `client_secret` to use to sign generated Client Assertions.
+        alg: the alg to use to sign generated Client Assertions.
+        lifetime: the lifetime to use for generated Client Assertions.
+        jti_gen: a function to generate JWT Token Ids (`jti`) for generated Client Assertions.
+        aud: the audience value to use. If `None` (default), the endpoint URL will be used.
+
+    Example:
+        ```python
+        from requests_oauth2client import OAuth2Client, ClientSecretJwt
+
+        auth = ClientSecretJwt("my_client_id", "my_client_secret")
+        client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+        ```
+
+    """
+
+    client_secret: str
+    alg: str
+
+    def __init__(
+        self,
+        client_id: str,
+        client_secret: str,
+        lifetime: int = 60,
+        alg: str = SignatureAlgs.HS256,
+        jti_gen: Callable[[], str] = lambda: str(uuid4()),
+        aud: str | None = None,
+    ) -> None:
+        self.__attrs_init__(
+            client_id=client_id,
+            client_secret=client_secret,
+            lifetime=lifetime,
+            alg=alg,
+            jti_gen=jti_gen,
+            aud=aud,
+        )
+
+    def client_assertion(self, audience: str) -> str:
+        """Generate a symmetrically signed Client Assertion.
+
+        Assertion is signed with the `client_secret` as key and the `alg` passed at init time.
+
+        Args:
+            audience: the audience to use for the generated Client Assertion.
+
+        Returns:
+            a Client Assertion, as `str`.
+
+        """
+        iat = int(datetime.now(tz=timezone.utc).timestamp())
+        exp = iat + self.lifetime
+        jti = str(self.jti_gen())
+
+        jwk = SymmetricJwk.from_bytes(self.client_secret.encode())
+
+        jwt = Jwt.sign(
+            claims={
+                "iss": self.client_id,
+                "sub": self.client_id,
+                "aud": audience,
+                "iat": iat,
+                "exp": exp,
+                "jti": jti,
+            },
+            key=jwk,
+            alg=self.alg,
+        )
+        return str(jwt)
+
+
-
-
+
-

- InvalidBackChannelAuthenticationResponse -

-
-

- Bases: OAuth2Error

- -

Raised when the BackChannel Authentication endpoint returns a non-standard response.

-
- Source code in requests_oauth2client/exceptions.py - 
273
-274
class InvalidBackChannelAuthenticationResponse(OAuth2Error):
-    """Raised when the BackChannel Authentication endpoint returns a non-standard response."""
-
-
-
+
-
+

+ client_assertion(audience) -
+

+
-

- InvalidClient +

Generate a symmetrically signed Client Assertion.

+

Assertion is signed with the client_secret as key and the alg passed at init time.

-

+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
audience + str + +
+

the audience to use for the generated Client Assertion.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

a Client Assertion, as str.

+
+
+
+ Source code in requests_oauth2client/client_authentication.py + 
259
+260
+261
+262
+263
+264
+265
+266
+267
+268
+269
+270
+271
+272
+273
+274
+275
+276
+277
+278
+279
+280
+281
+282
+283
+284
+285
+286
+287
+288
+289
def client_assertion(self, audience: str) -> str:
+    """Generate a symmetrically signed Client Assertion.
+
+    Assertion is signed with the `client_secret` as key and the `alg` passed at init time.
+
+    Args:
+        audience: the audience to use for the generated Client Assertion.
+
+    Returns:
+        a Client Assertion, as `str`.
+
+    """
+    iat = int(datetime.now(tz=timezone.utc).timestamp())
+    exp = iat + self.lifetime
+    jti = str(self.jti_gen())
+
+    jwk = SymmetricJwk.from_bytes(self.client_secret.encode())
+
+    jwt = Jwt.sign(
+        claims={
+            "iss": self.client_id,
+            "sub": self.client_id,
+            "aud": audience,
+            "iat": iat,
+            "exp": exp,
+            "jti": jti,
+        },
+        key=jwk,
+        alg=self.alg,
+    )
+    return str(jwt)
+
+
+
-
-

- Bases: TokenEndpointError

+
- -

Raised when the Token Endpoint returns error = invalid_client.

-
- Source code in requests_oauth2client/exceptions.py - 
81
-82
class InvalidClient(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = invalid_client`."""
-
-
+
@@ -31714,61 +33120,196 @@

-

- InvalidDeviceAuthorizationResponse +

+ ClientSecretPost -

+ -
-

- Bases: OAuth2Error

+
+

+ Bases: BaseClientAuthenticationMethod

- -

Raised when the Device Authorization Endpoint returns a non-standard error response.

-
- Source code in requests_oauth2client/exceptions.py - 
137
-138
class InvalidDeviceAuthorizationResponse(OAuth2Error):
-    """Raised when the Device Authorization Endpoint returns a non-standard error response."""
-
-
+

Implement client_secret_post client authentication method.

+

With this method, the client inserts its client_id and client_secret in each authenticated +request to the AS.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client_id + str + +
+

Client ID

+
+ 		+ required +
client_secret + str + +
+

Client Secret

+
+ 		+ required +
+ + +
+ Example + 
1
+2
+3
+4
from requests_oauth2client import ClientSecretPost, OAuth2Client
+
+auth = ClientSecretPost("my_client_id", "my_client_secret")
+client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+
+
+
+ Source code in requests_oauth2client/client_authentication.py + 
115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
+126
+127
+128
+129
+130
+131
+132
+133
+134
+135
+136
+137
+138
+139
+140
+141
+142
+143
+144
+145
+146
+147
+148
+149
+150
+151
+152
+153
+154
+155
+156
+157
+158
+159
+160
+161
+162
+163
@frozen(init=False)
+class ClientSecretPost(BaseClientAuthenticationMethod):
+    """Implement `client_secret_post` client authentication method.
+
+    With this method, the client inserts its client_id and client_secret in each authenticated
+    request to the AS.
+
+    Args:
+        client_id: Client ID
+        client_secret: Client Secret
+
+    Example:
+        ```python
+        from requests_oauth2client import ClientSecretPost, OAuth2Client
+
+        auth = ClientSecretPost("my_client_id", "my_client_secret")
+        client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+        ```
+
+    """
+
+    client_secret: str
+
+    def __init__(self, client_id: str, client_secret: str) -> None:
+        self.__attrs_init__(
+            client_id=client_id,
+            client_secret=client_secret,
+        )
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Add the `client_id` and `client_secret` parameters in the request body.
+
+        Args:
+            request: a [requests.PreparedRequest][].
+
+        Returns:
+            a [requests.PreparedRequest][] with the added client credentials fields.
+
+        """
+        request = super().__call__(request)
+        params = (
+            parse_qs(request.body, strict_parsing=True, keep_blank_values=True)  # type: ignore[type-var]
+            if isinstance(request.body, (str, bytes))
+            else {}
+        )
+        params[b"client_id"] = [self.client_id.encode()]
+        params[b"client_secret"] = [self.client_secret.encode()]
+        request.prepare_body(params, files=None)
+        return request
+
+
-
-
+
-
-

- InvalidGrant -

-
-

- Bases: TokenEndpointError

- -

Raised when the Token Endpoint returns error = invalid_grant.

-
- Source code in requests_oauth2client/exceptions.py - 
93
-94
class InvalidGrant(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = invalid_grant`."""
-
-
+
@@ -31776,61 +33317,71 @@

-

- InvalidIdToken +

+ InvalidClientAssertionSigningKeyOrAlg -

+ -
-

- Bases: InvalidJwt

+
+

+ Bases: ValueError

- -

Raised when trying to validate an invalid ID Token value.

-
- Source code in requests_oauth2client/exceptions.py - 
141
-142
class InvalidIdToken(InvalidJwt):
-    """Raised when trying to validate an invalid ID Token value."""
-
-
+

Raised when the client assertion signing alg is not specified or invalid.

-
+
+ Source code in requests_oauth2client/client_authentication.py + 
292
+293
+294
+295
+296
+297
+298
+299
+300
+301
+302
+303
+304
+305
+306
class InvalidClientAssertionSigningKeyOrAlg(ValueError):
+    """Raised when the client assertion signing alg is not specified or invalid."""
+
+    def __init__(self, alg: str | None) -> None:
+        super().__init__("""\
+An asymmetric private signing key, and an alg that is supported by the signing key is required.
+It can be provided either:
+- as part of the private `Jwk`, in the parameter 'alg'
+- or passed as parameter `alg` when initializing a `PrivateKeyJwt`.
+Examples of valid `alg` values and matching key type:
+- 'RS256', 'RS512' (with a key of type RSA)
+- 'ES256', 'ES512' (with a key of type EC)
+The private key must include a Key ID (in its 'kid' parameter).
+""")
+        self.alg = alg
+
+
-
-
+
+ -

- InvalidPushedAuthorizationResponse -

-
-

- Bases: OAuth2Error

- -

Raised when the Pushed Authorization Endpoint returns an error.

-
- Source code in requests_oauth2client/exceptions.py - 
277
-278
class InvalidPushedAuthorizationResponse(OAuth2Error):
-    """Raised when the Pushed Authorization Endpoint returns an error."""
-
-
+
@@ -31838,61 +33389,53 @@

- InvalidRequest +

+ InvalidRequestForClientAuthentication -

+ -
-

- Bases: TokenEndpointError

+
+

+ Bases: RuntimeError

- -

Raised when the Token Endpoint returns error = invalid_request.

-
- Source code in requests_oauth2client/exceptions.py - 
77
-78
class InvalidRequest(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = invalid_request`."""
-
-
+

Raised when a request is not suitable for OAuth 2.0 client authentication.

-
+
+ Source code in requests_oauth2client/client_authentication.py + 
22
+23
+24
+25
+26
+27
class InvalidRequestForClientAuthentication(RuntimeError):
+    """Raised when a request is not suitable for OAuth 2.0 client authentication."""
+
+    def __init__(self, request: requests.PreparedRequest) -> None:
+        super().__init__("This request is not suitabe for OAuth 2.0 client authentication.")
+        self.request = request
+
+
-
-
+
+ -

- InvalidScope -

-
-

- Bases: TokenEndpointError

- -

Raised when the Token Endpoint returns error = invalid_scope.

-
- Source code in requests_oauth2client/exceptions.py - 
85
-86
class InvalidScope(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = invalid_scope`."""
-
-
+
@@ -31900,92 +33443,484 @@

-

- InvalidTarget - - -

+

+ PrivateKeyJwt -
-

- Bases: TokenEndpointError

+

- -

Raised when the Token Endpoint returns error = invalid_target.

-
- Source code in requests_oauth2client/exceptions.py - 
89
-90
class InvalidTarget(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = invalid_target`."""
-
-
+
+

+ Bases: BaseClientAssertionAuthenticationMethod

-
+

Implement private_key_jwt client authentication method.

+

With this method, the client generates and sends a client_assertion, that is asymmetrically +signed with a private key, on each direct request to the Authorization Server.

+

The private key must be supplied as a jwskate.Jwk instance, +or any key material that can be used to initialize one.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client_id + str + +
+

the client_id to use.

+
+ 		+ required +
private_jwk + Jwk | dict[str, Any] | Any + +
+

the private key to use to sign generated Client Assertions.

+
+ 		+ required +
alg + str | None + +
+

the alg to use to sign generated Client Assertions.

+
+ 		+ None +
lifetime + int + +
+

the lifetime to use for generated Client Assertions.

+
+ 		+ 60 +
jti_gen + Callable[[], str] + +
+

a function to generate JWT Token Ids (jti) for generated Client Assertions.

+
+ 		+ lambda: str(uuid4()) +
aud + str | None + +
+

the audience value to use. If None (default), the endpoint URL will be used.k

+
+ 		+ None +
+ + +
+ Example + 
1
+2
+3
+4
+5
+6
+7
+8
+9
from jwskate import Jwk
+from requests_oauth2client import OAuth2Client, PrivateKeyJwt
+
+# load your private key from wherever it is stored:
+with open("my_private_key.pem") as f:
+    my_private_key = Jwk.from_pem(f.read(), password="my_private_key_password")
+
+auth = PrivateKeyJwt("my_client_id", my_private_key, alg="RS256")
+client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+
+
+
+ Source code in requests_oauth2client/client_authentication.py + 
309
+310
+311
+312
+313
+314
+315
+316
+317
+318
+319
+320
+321
+322
+323
+324
+325
+326
+327
+328
+329
+330
+331
+332
+333
+334
+335
+336
+337
+338
+339
+340
+341
+342
+343
+344
+345
+346
+347
+348
+349
+350
+351
+352
+353
+354
+355
+356
+357
+358
+359
+360
+361
+362
+363
+364
+365
+366
+367
+368
+369
+370
+371
+372
+373
+374
+375
+376
+377
+378
+379
+380
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391
+392
+393
+394
+395
+396
+397
+398
+399
+400
+401
+402
+403
+404
@frozen(init=False)
+class PrivateKeyJwt(BaseClientAssertionAuthenticationMethod):
+    """Implement `private_key_jwt` client authentication method.
+
+    With this method, the client generates and sends a client_assertion, that is asymmetrically
+    signed with a private key, on each direct request to the Authorization Server.
+
+    The private key must be supplied as a [`jwskate.Jwk`][jwskate.jwk.Jwk] instance,
+    or any key material that can be used to initialize one.
+
+    Args:
+        client_id: the `client_id` to use.
+        private_jwk: the private key to use to sign generated Client Assertions.
+        alg: the alg to use to sign generated Client Assertions.
+        lifetime: the lifetime to use for generated Client Assertions.
+        jti_gen: a function to generate JWT Token Ids (`jti`) for generated Client Assertions.
+        aud: the audience value to use. If `None` (default), the endpoint URL will be used.k
+
+    Example:
+        ```python
+        from jwskate import Jwk
+        from requests_oauth2client import OAuth2Client, PrivateKeyJwt
+
+        # load your private key from wherever it is stored:
+        with open("my_private_key.pem") as f:
+            my_private_key = Jwk.from_pem(f.read(), password="my_private_key_password")
+
+        auth = PrivateKeyJwt("my_client_id", my_private_key, alg="RS256")
+        client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+        ```
+
+    """
+
+    private_jwk: Jwk = field(converter=to_jwk)
+    alg: str | None
+
+    def __init__(
+        self,
+        client_id: str,
+        private_jwk: Jwk | dict[str, Any] | Any,
+        *,
+        alg: str | None = None,
+        lifetime: int = 60,
+        jti_gen: Callable[[], str] = lambda: str(uuid4()),
+        aud: str | None = None,
+    ) -> None:
+        self.__attrs_init__(
+            client_id=client_id,
+            private_jwk=private_jwk,
+            alg=alg,
+            lifetime=lifetime,
+            jti_gen=jti_gen,
+            aud=aud,
+        )
+
+        alg = self.private_jwk.alg or alg
+        if not alg:
+            raise InvalidClientAssertionSigningKeyOrAlg(alg)
+
+        if alg not in self.private_jwk.supported_signing_algorithms():
+            raise InvalidClientAssertionSigningKeyOrAlg(alg)
+
+        if not self.private_jwk.is_private or self.private_jwk.is_symmetric:
+            raise InvalidClientAssertionSigningKeyOrAlg(alg)
+
+        kid = self.private_jwk.get("kid")
+        if not kid:
+            raise InvalidClientAssertionSigningKeyOrAlg(alg)
+
+    def client_assertion(self, audience: str) -> str:
+        """Generate a Client Assertion, asymmetrically signed with `private_jwk` as key.
+
+        Args:
+            audience: the audience to use for the generated Client Assertion.
+
+        Returns:
+            a Client Assertion.
+
+        """
+        iat = int(datetime.now(tz=timezone.utc).timestamp())
+        exp = iat + self.lifetime
+        jti = str(self.jti_gen())
+
+        jwt = Jwt.sign(
+            claims={
+                "iss": self.client_id,
+                "sub": self.client_id,
+                "aud": audience,
+                "iat": iat,
+                "exp": exp,
+                "jti": jti,
+            },
+            key=self.private_jwk,
+            alg=self.alg,
+        )
+        return str(jwt)
+
+
-
-
+
-

- InvalidTokenResponse -

-
-

- Bases: OAuth2Error

- -

Raised when the Token Endpoint returns a non-standard response.

-
- Source code in requests_oauth2client/exceptions.py - 
57
-58
class InvalidTokenResponse(OAuth2Error):
-    """Raised when the Token Endpoint returns a non-standard response."""
-
-
-
+
-
+

+ client_assertion(audience) -
+

+
-

- LoginRequired +

Generate a Client Assertion, asymmetrically signed with private_jwk as key.

-

+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
audience + str + +
+

the audience to use for the generated Client Assertion.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

a Client Assertion.

+
+
+
+ Source code in requests_oauth2client/client_authentication.py + 
378
+379
+380
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391
+392
+393
+394
+395
+396
+397
+398
+399
+400
+401
+402
+403
+404
def client_assertion(self, audience: str) -> str:
+    """Generate a Client Assertion, asymmetrically signed with `private_jwk` as key.
+
+    Args:
+        audience: the audience to use for the generated Client Assertion.
+
+    Returns:
+        a Client Assertion.
+
+    """
+    iat = int(datetime.now(tz=timezone.utc).timestamp())
+    exp = iat + self.lifetime
+    jti = str(self.jti_gen())
+
+    jwt = Jwt.sign(
+        claims={
+            "iss": self.client_id,
+            "sub": self.client_id,
+            "aud": audience,
+            "iat": iat,
+            "exp": exp,
+            "jti": jti,
+        },
+        key=self.private_jwk,
+        alg=self.alg,
+    )
+    return str(jwt)
+
+
+
-
-

- Bases: InteractionRequired

+
- -

Raised when the Authorization Endpoint returns error = login_required.

-
- Source code in requests_oauth2client/exceptions.py - 
168
-169
class LoginRequired(InteractionRequired):
-    """Raised when the Authorization Endpoint returns `error = login_required`."""
-
-
+
@@ -31993,73 +33928,127 @@

-

- MismatchingAcr +

+ PublicApp -

+ -
-

- Bases: InvalidIdToken

+
+

+ Bases: BaseClientAuthenticationMethod

- -

Raised when the returned ID Token doesn't contain one of the requested ACR Values.

-

This happens when the authorization request includes an acr_values parameter but the returned -ID Token includes a different value.

-
- Source code in requests_oauth2client/exceptions.py - 
244
-245
-246
-247
-248
-249
-250
class MismatchingAcr(InvalidIdToken):
-    """Raised when the returned ID Token doesn't contain one of the requested ACR Values.
-
-    This happens when the authorization request includes an `acr_values` parameter but the returned
-    ID Token includes a different value.
-
-    """
-
-
+

Implement the none authentication method for public apps.

+

This scheme is used for Public Clients, which do not have any secret credentials. Those only +send their client_id to the Authorization Server.

-
+
+ Example + 
1
+2
+3
+4
from requests_oauth2client import OAuth2Client, PublicApp
+
+auth = PublicApp("my_client_id")
+client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+
+
+
+ Source code in requests_oauth2client/client_authentication.py + 
407
+408
+409
+410
+411
+412
+413
+414
+415
+416
+417
+418
+419
+420
+421
+422
+423
+424
+425
+426
+427
+428
+429
+430
+431
+432
+433
+434
+435
+436
+437
+438
+439
+440
+441
+442
@frozen
+class PublicApp(BaseClientAuthenticationMethod):
+    """Implement the `none` authentication method for public apps.
+
+    This scheme is used for Public Clients, which do not have any secret credentials. Those only
+    send their client_id to the Authorization Server.
+
+    Example:
+        ```python
+        from requests_oauth2client import OAuth2Client, PublicApp
+
+        auth = PublicApp("my_client_id")
+        client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+        ```
+
+    """
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Add the `client_id` field in the request body.
+
+        Args:
+            request: a request.
+
+        Returns:
+            the request with the added `client_id` form field.
+
+        """
+        request = super().__call__(request)
+        params = (
+            parse_qs(request.body, strict_parsing=True, keep_blank_values=True)  # type: ignore[type-var]
+            if request.body
+            else {}
+        )
+        params[b"client_id"] = [self.client_id.encode()]
+        request.prepare_body(params, files=None)
+        return request
+
+
-
-
+ +
+ -

- MismatchingAudience -

-
-

- Bases: InvalidIdToken

- -

Raised when the ID Token audience does not include the requesting Client ID.

-
- Source code in requests_oauth2client/exceptions.py - 
253
-254
class MismatchingAudience(InvalidIdToken):
-    """Raised when the ID Token audience does not include the requesting Client ID."""
-
-
+
@@ -32067,30 +34056,29 @@

-

- MismatchingAzp +

+ UnsupportedClientCredentials -

+ -
-

- Bases: InvalidIdToken

+
+

+ Bases: TypeError, ValueError

- -

Raised when the ID Token Authorized Presenter (azp) claim is not the Client ID.

-
- Source code in requests_oauth2client/exceptions.py - 
257
-258
class MismatchingAzp(InvalidIdToken):
-    """Raised when the ID Token Authorized Presenter (azp) claim is not the Client ID."""
-
-
+

Raised when unsupported client credentials are provided.

-
+
+ Source code in requests_oauth2client/client_authentication.py + 
445
+446
class UnsupportedClientCredentials(TypeError, ValueError):
+    """Raised when unsupported client credentials are provided."""
+
+
+
@@ -32098,116 +34086,363 @@

-

- MismatchingIdTokenAlg +

+ DeviceAuthorizationPoolingJob -

+ -
-

- Bases: InvalidIdToken

+
+

+ Bases: BaseTokenEndpointPoolingJob

- -

Raised when the returned ID Token is signed with an unexpected alg.

-
- Source code in requests_oauth2client/exceptions.py - 
261
-262
class MismatchingIdTokenAlg(InvalidIdToken):
-    """Raised when the returned ID Token is signed with an unexpected alg."""
-
-
+

A Token Endpoint pooling job for the Device Authorization Flow.

+

This periodically checks if the user has finished with his authorization in a Device +Authorization flow.

-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client + OAuth2Client + +
+

an OAuth2Client that will be used to pool the token endpoint.

+
+ 		+ required +
device_code + str | DeviceAuthorizationResponse + +
+

a device_code as str or a DeviceAuthorizationResponse.

+
+ 		+ required +
interval + int | None + +
+

The pooling interval to use. This overrides the one in auth_req_id if it is +a BackChannelAuthenticationResponse.

+
+ 		+ None +
slow_down_interval + int + +
+

Number of seconds to add to the pooling interval when the AS returns +a slow-down request.

+
+ 		+ 5 +
requests_kwargs + dict[str, Any] | None + +
+

Additional parameters for the underlying calls to requests.request.

+
+ 		+ None +
**token_kwargs + Any + +
+

Additional parameters for the token request.

+
+ 		+ {} +
+ + +
+ Example + 
1
+2
+3
+4
+5
+6
+7
+8
from requests_oauth2client import DeviceAuthorizationPoolingJob, OAuth2Client
+
+client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+pooler = DeviceAuthorizationPoolingJob(client=client, device_code="my_device_code")
+
+token = None
+while token is None:
+    token = pooler()
+
+
+
+ Source code in requests_oauth2client/device_authorization.py + 
 71
+ 72
+ 73
+ 74
+ 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
+126
+127
+128
+129
+130
+131
+132
+133
+134
+135
+136
@define(init=False)
+class DeviceAuthorizationPoolingJob(BaseTokenEndpointPoolingJob):
+    """A Token Endpoint pooling job for the Device Authorization Flow.
+
+    This periodically checks if the user has finished with his authorization in a Device
+    Authorization flow.
+
+    Args:
+        client: an OAuth2Client that will be used to pool the token endpoint.
+        device_code: a `device_code` as `str` or a `DeviceAuthorizationResponse`.
+        interval: The pooling interval to use. This overrides the one in `auth_req_id` if it is
+            a `BackChannelAuthenticationResponse`.
+        slow_down_interval: Number of seconds to add to the pooling interval when the AS returns
+            a slow-down request.
+        requests_kwargs: Additional parameters for the underlying calls to [requests.request][].
+        **token_kwargs: Additional parameters for the token request.
+
+    Example:
+        ```python
+        from requests_oauth2client import DeviceAuthorizationPoolingJob, OAuth2Client
+
+        client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+        pooler = DeviceAuthorizationPoolingJob(client=client, device_code="my_device_code")
+
+        token = None
+        while token is None:
+            token = pooler()
+        ```
+
+    """
+
+    device_code: str
+
+    def __init__(
+        self,
+        client: OAuth2Client,
+        device_code: str | DeviceAuthorizationResponse,
+        interval: int | None = None,
+        slow_down_interval: int = 5,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> None:
+        if isinstance(device_code, DeviceAuthorizationResponse):
+            interval = interval or device_code.interval
+            device_code = device_code.device_code
+
+        self.__attrs_init__(
+            client=client,
+            device_code=device_code,
+            interval=interval or 5,
+            slow_down_interval=slow_down_interval,
+            requests_kwargs=requests_kwargs or {},
+            token_kwargs=token_kwargs,
+        )
+
+    def token_request(self) -> BearerToken:
+        """Implement the Device Code token request.
+
+        This actually calls [OAuth2Client.device_code(device_code)][requests_oauth2client.OAuth2Client.device_code]
+        on `self.client`.
+
+        Returns:
+            a [BearerToken][requests_oauth2client.tokens.BearerToken]
+
+        """
+        return self.client.device_code(self.device_code, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
+
+
-
-
+
-

- MismatchingIssuer -

-
-

- Bases: InvalidAuthResponse

- -

Raised on mismatching iss value.

-

This happens when the Authorization Endpoints returns an 'iss' that doesn't match the expected -value.

-
- Source code in requests_oauth2client/exceptions.py - 
226
-227
-228
-229
-230
-231
-232
class MismatchingIssuer(InvalidAuthResponse):
-    """Raised on mismatching `iss` value.
-
-    This happens when the Authorization Endpoints returns an 'iss' that doesn't match the expected
-    value.
-
-    """
-
-
-
+
-
+

+ token_request() -
+

+
-

- MismatchingNonce +

Implement the Device Code token request.

+

This actually calls OAuth2Client.device_code(device_code) +on self.client.

-

+

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+
+ Source code in requests_oauth2client/device_authorization.py + 
126
+127
+128
+129
+130
+131
+132
+133
+134
+135
+136
def token_request(self) -> BearerToken:
+    """Implement the Device Code token request.
+
+    This actually calls [OAuth2Client.device_code(device_code)][requests_oauth2client.OAuth2Client.device_code]
+    on `self.client`.
+
+    Returns:
+        a [BearerToken][requests_oauth2client.tokens.BearerToken]
+
+    """
+    return self.client.device_code(self.device_code, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
+
+
+
-
-

- Bases: InvalidIdToken

+
- -

Raised on mismatching nonce value in an ID Token.

-

This happens when the authorization request includes a nonce but the returned ID Token include -a different value.

-
- Source code in requests_oauth2client/exceptions.py - 
235
-236
-237
-238
-239
-240
-241
class MismatchingNonce(InvalidIdToken):
-    """Raised on mismatching `nonce` value in an ID Token.
-
-    This happens when the authorization request includes a `nonce` but the returned ID Token include
-    a different value.
-
-    """
-
-
+
@@ -32215,85 +34450,323 @@

-

- MismatchingState +

+ DeviceAuthorizationResponse -

+ -
-

- Bases: InvalidAuthResponse

+
- -

Raised on mismatching state value.

-

This happens when the Authorization Endpoints returns a 'state' parameter that doesn't match the -value passed in the Authorization Request.

-
- Source code in requests_oauth2client/exceptions.py - 
217
-218
-219
-220
-221
-222
-223
class MismatchingState(InvalidAuthResponse):
-    """Raised on mismatching `state` value.
-
-    This happens when the Authorization Endpoints returns a 'state' parameter that doesn't match the
-    value passed in the Authorization Request.
-
-    """
-
-
+

Represent a response returned by the device Authorization Endpoint.

+

All parameters are those returned by the AS as response to a Device Authorization Request.

-
+ +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
device_code + str + +
+

the device_code as returned by the AS.

+
+ 		+ required +
user_code + str + +
+

the device_code as returned by the AS.

+
+ 		+ required +
verification_uri + str + +
+

the device_code as returned by the AS.

+
+ 		+ required +
verification_uri_complete + str | None + +
+

the device_code as returned by the AS.

+
+ 		+ None +
expires_at + datetime | None + +
+

the expiration date for the device_code. +Also accepts an expires_in parameter, as a number of seconds in the future.

+
+ 		+ None +
interval + int | None + +
+

the pooling interval as returned by the AS.

+
+ 		+ None +
**kwargs + Any + +
+

additional parameters as returned by the AS.

+
+ 		+ {} +
+ +
+ Source code in requests_oauth2client/device_authorization.py + 
22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
class DeviceAuthorizationResponse:
+    """Represent a response returned by the device Authorization Endpoint.
+
+    All parameters are those returned by the AS as response to a Device Authorization Request.
+
+    Args:
+        device_code: the `device_code` as returned by the AS.
+        user_code: the `device_code` as returned by the AS.
+        verification_uri: the `device_code` as returned by the AS.
+        verification_uri_complete: the `device_code` as returned by the AS.
+        expires_at: the expiration date for the device_code.
+            Also accepts an `expires_in` parameter, as a number of seconds in the future.
+        interval: the pooling `interval` as returned by the AS.
+        **kwargs: additional parameters as returned by the AS.
+
+    """
+
+    @accepts_expires_in
+    def __init__(
+        self,
+        device_code: str,
+        user_code: str,
+        verification_uri: str,
+        verification_uri_complete: str | None = None,
+        expires_at: datetime | None = None,
+        interval: int | None = None,
+        **kwargs: Any,
+    ) -> None:
+        self.device_code = device_code
+        self.user_code = user_code
+        self.verification_uri = verification_uri
+        self.verification_uri_complete = verification_uri_complete
+        self.expires_at = expires_at
+        self.interval = interval
+        self.other = kwargs
+
+    def is_expired(self, leeway: int = 0) -> bool | None:
+        """Check if the `device_code` within this response is expired.
+
+        Returns:
+            `True` if the device_code is expired, `False` if it is still valid, `None` if there is
+            no `expires_in` hint.
+
+        """
+        if self.expires_at:
+            return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
+        return None
+
+
-
-
+
-

- MissingAuthCode -

-
-

- Bases: InvalidAuthResponse

- -

Raised when the Authorization Endpoint does not return the mandatory code.

-

This happens when the Authorization Endpoint does not return an error, but does not return an -authorization code either.

+ +
+ + +

+ is_expired(leeway=0) + +

+ + +
+ +

Check if the device_code within this response is expired.

+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ bool | None + +
+

True if the device_code is expired, False if it is still valid, None if there is

+
+
+ bool | None + +
+

no expires_in hint.

+
+
- Source code in requests_oauth2client/exceptions.py - 
188
-189
-190
-191
-192
-193
-194
class MissingAuthCode(InvalidAuthResponse):
-    """Raised when the Authorization Endpoint does not return the mandatory `code`.
-
-    This happens when the Authorization Endpoint does not return an error, but does not return an
-    authorization `code` either.
-
-    """
-
+ Source code in requests_oauth2client/device_authorization.py + 
58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
def is_expired(self, leeway: int = 0) -> bool | None:
+    """Check if the `device_code` within this response is expired.
+
+    Returns:
+        `True` if the device_code is expired, `False` if it is still valid, `None` if there is
+        no `expires_in` hint.
+
+    """
+    if self.expires_at:
+        return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
+    return None
+
+
+ +
+ +
+
@@ -32301,91 +34774,45 @@

-

- MissingIdToken +

+ AccessDenied -

+ -
-

- Bases: InvalidAuthResponse

+
+

+ Bases: EndpointError

- -

Raised when the Authorization Endpoint does not return a mandatory ID Token.

-

This happens when the Authorization Endpoint does not return an error, but does not return an ID -Token either.

-
- Source code in requests_oauth2client/exceptions.py - 
208
-209
-210
-211
-212
-213
-214
class MissingIdToken(InvalidAuthResponse):
-    """Raised when the Authorization Endpoint does not return a mandatory ID Token.
-
-    This happens when the Authorization Endpoint does not return an error, but does not return an ID
-    Token either.
-
-    """
-
-
+

Raised when the Authorization Server returns error = access_denied.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
98
+99
class AccessDenied(EndpointError):
+    """Raised when the Authorization Server returns `error = access_denied`."""
+
+
-
-
+
+ -

- MissingIssuer -

-
-

- Bases: InvalidAuthResponse

- -

Raised when the Authorization Endpoint does not return an iss parameter as expected.

-

The Authorization Server advertises its support with a flag -authorization_response_iss_parameter_supported in its discovery document. If it is set to -true, it must include an iss parameter in its authorization responses, containing its issuer -identifier.

-
- Source code in requests_oauth2client/exceptions.py - 
197
-198
-199
-200
-201
-202
-203
-204
-205
class MissingIssuer(InvalidAuthResponse):
-    """Raised when the Authorization Endpoint does not return an `iss` parameter as expected.
-
-    The Authorization Server advertises its support with a flag
-    `authorization_response_iss_parameter_supported` in its discovery document. If it is set to
-    `true`, it must include an `iss` parameter in its authorization responses, containing its issuer
-    identifier.
-
-    """
-
-
+
@@ -32393,85 +34820,29 @@

-

- OAuth2Error - +

+ AccountSelectionRequired -

+ -
-

- Bases: Exception

- -

Base class for Exceptions raised when a backend endpoint returns an error.

+
+

+ Bases: InteractionRequired

+

Raised when the Authorization Endpoint returns error = account_selection_required.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the HTTP response containing the error

-
- 		- required -
+
+ Source code in requests_oauth2client/exceptions.py + 
178
+179
class AccountSelectionRequired(InteractionRequired):
+    """Raised when the Authorization Endpoint returns `error = account_selection_required`."""
+
+
-
- Source code in requests_oauth2client/exceptions.py - 
13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
class OAuth2Error(Exception):
-    """Base class for Exceptions raised when a backend endpoint returns an error.
-
-    Args:
-        response: the HTTP response containing the error
-
-    """
-
-    def __init__(self, response: requests.Response):
-        self.response = response
-
-    @property
-    def request(self) -> requests.PreparedRequest:
-        """The request leading to the error."""
-        return self.response.request
-
-
-
@@ -32481,66 +34852,59 @@

-
- - -

- request: requests.PreparedRequest - - - property - -

-
- -

The request leading to the error.

+
+

+
+

+ AuthorizationPending -

-
+ -
+
+

+ Bases: TokenEndpointError

+ + +

Raised when the Token Endpoint returns error = authorization_pending.

+ +
+ Source code in requests_oauth2client/exceptions.py + 
126
+127
class AuthorizationPending(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = authorization_pending`."""
+
+
+ + + +
-
-

- RevocationError -

-
-

- Bases: EndpointError

- -

Base class for Revocation Endpoint errors.

-
- Source code in requests_oauth2client/exceptions.py - 
105
-106
class RevocationError(EndpointError):
-    """Base class for Revocation Endpoint errors."""
-
-
+
@@ -32548,61 +34912,152 @@

-

- ServerError +

+ AuthorizationResponseError -

+ -
-

- Bases: EndpointError

+
+

+ Bases: Exception

- -

Raised when the token endpoint returns error = server_error.

-
- Source code in requests_oauth2client/exceptions.py - 
69
-70
class ServerError(EndpointError):
-    """Raised when the token endpoint returns `error = server_error`."""
-
-
+

Base class for error responses returned by the Authorization endpoint.

+

An AuthorizationResponseError contains the error message, description and uri that are +returned by the AS.

-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
error + str + +
+

the error identifier as returned by the AS

+
+ 		+ required +
description + str | None + +
+

the error_description as returned by the AS

+
+ 		+ None +
uri + str | None + +
+

the error_uri as returned by the AS

+
+ 		+ None +
+ +
+ Source code in requests_oauth2client/exceptions.py + 
142
+143
+144
+145
+146
+147
+148
+149
+150
+151
+152
+153
+154
+155
+156
+157
+158
+159
+160
+161
+162
+163
+164
+165
+166
+167
class AuthorizationResponseError(Exception):
+    """Base class for error responses returned by the Authorization endpoint.
+
+    An `AuthorizationResponseError` contains the error message, description and uri that are
+    returned by the AS.
+
+    Args:
+        error: the `error` identifier as returned by the AS
+        description: the `error_description` as returned by the AS
+        uri: the `error_uri` as returned by the AS
+
+    """
+
+    def __init__(
+        self,
+        request: AuthorizationRequest,
+        response: str,
+        error: str,
+        description: str | None = None,
+        uri: str | None = None,
+    ) -> None:
+        self.error = error
+        self.description = description
+        self.uri = uri
+        self.request = request
+        self.response = response
+
+
-
-
+ +
+ -

- SessionSelectionRequired -

-
-

- Bases: InteractionRequired

- -

Raised when the Authorization Endpoint returns error = session_selection_required.

-
- Source code in requests_oauth2client/exceptions.py - 
176
-177
class SessionSelectionRequired(InteractionRequired):
-    """Raised when the Authorization Endpoint returns `error = session_selection_required`."""
-
-
+
@@ -32610,61 +35065,45 @@

-

- SlowDown +

+ BackChannelAuthenticationError -

+ -
-

- Bases: TokenEndpointError

+
+

+ Bases: EndpointError

- -

Raised when the Token Endpoint returns error = slow_down.

-
- Source code in requests_oauth2client/exceptions.py - 
129
-130
class SlowDown(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = slow_down`."""
-
-
+

Base class for errors returned by the BackChannel Authentication endpoint.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
253
+254
class BackChannelAuthenticationError(EndpointError):
+    """Base class for errors returned by the BackChannel Authentication endpoint."""
+
+
-
-
+
+ -

- TokenEndpointError -

-
-

- Bases: EndpointError

- -

Base class for errors that are specific to the token endpoint.

-
- Source code in requests_oauth2client/exceptions.py - 
73
-74
class TokenEndpointError(EndpointError):
-    """Base class for errors that are specific to the token endpoint."""
-
-
+
@@ -32672,61 +35111,45 @@

-

- UnauthorizedClient +

+ ConsentRequired -

+ -
-

- Bases: EndpointError

+
+

+ Bases: InteractionRequired

- -

Raised when the Authorization Server returns error = unauthorized_client.

-
- Source code in requests_oauth2client/exceptions.py - 
101
-102
class UnauthorizedClient(EndpointError):
-    """Raised when the Authorization Server returns `error = unauthorized_client`."""
-
-
+

Raised when the Authorization Endpoint returns error = consent_required.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
186
+187
class ConsentRequired(InteractionRequired):
+    """Raised when the Authorization Endpoint returns `error = consent_required`."""
+
+
-
-
+
+ -

- UnknownIntrospectionError -

-
-

- Bases: OAuth2Error

- -

Raised when the Introspection Endpoint returns a non-standard error.

-
- Source code in requests_oauth2client/exceptions.py - 
117
-118
class UnknownIntrospectionError(OAuth2Error):
-    """Raised when the Introspection Endpoint returns a non-standard error."""
-
-
+
@@ -32734,61 +35157,45 @@

- UnknownTokenEndpointError +

+ DeviceAuthorizationError -

+ -
-

- Bases: EndpointError

+
+

+ Bases: EndpointError

- -

Raised when an otherwise unknown error is returned by the token endpoint.

-
- Source code in requests_oauth2client/exceptions.py - 
65
-66
class UnknownTokenEndpointError(EndpointError):
-    """Raised when an otherwise unknown error is returned by the token endpoint."""
-
-
+

Base class for Device Authorization Endpoint errors.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
122
+123
class DeviceAuthorizationError(EndpointError):
+    """Base class for Device Authorization Endpoint errors."""
+
+
-
-
+
+ -

- UnsupportedTokenType -

-
-

- Bases: RevocationError

- -

Raised when the Revocation endpoint returns error = unsupported_token_type.

-
- Source code in requests_oauth2client/exceptions.py - 
109
-110
class UnsupportedTokenType(RevocationError):
-    """Raised when the Revocation endpoint returns `error = unsupported_token_type`."""
-
-
+
@@ -32796,267 +35203,150 @@

-

- TokenEndpointPoolingJob +

+ EndpointError -

+ -
-

- Bases: ABC

+
+

+ Bases: OAuth2Error

- -

Base class for Token Endpoint pooling jobs.

-

This is used for decoupled flows like CIBA or Device Authorization.

-

This class must be subclassed to implement actual BackChannel flows. This needs an -OAuth2Client that will be used to pool the token -endpoint. The initial pooling interval is configurable.

+

Base class for exceptions raised from backend endpoint errors.

+

This contains the error message, description and uri that are returned +by the AS in the OAuth 2.0 standardised way.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - +

Parameters:

+
NameTypeDescriptionDefault
client - OAuth2Client - -
-

the OAuth2Client that will be used -to pool the token endpoint.

-
- 		- required -
interval - int | None - -
-

initial pooling interval, in seconds. If None, default to 5.

-
- 		- None -
+ + + + + + - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
slow_down_interval - int - -
-

when a SlowDown is -received, this number of seconds will be added to the pooling interval.

-
- 		- 5 -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the underlying calls to requests.request

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters for the token request

-
- 		- {} -
+ + + + response + + Response + + +
+

the raw response containing the error.

+
+ + + required + + + + error + + str + + +
+

the error identifier as returned by the AS.

+
+ + + required + + + + description + + str | None + + +
+

the error_description as returned by the AS.

+
+ + + None + + + + uri + + str | None + + +
+

the error_uri as returned by the AS.

+
+ + + None + + + + + +
+ Source code in requests_oauth2client/exceptions.py + 
34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
class EndpointError(OAuth2Error):
+    """Base class for exceptions raised from backend endpoint errors.
+
+    This contains the error message, description and uri that are returned
+    by the AS in the OAuth 2.0 standardised way.
+
+    Args:
+        response: the raw response containing the error.
+        error: the `error` identifier as returned by the AS.
+        description: the `error_description` as returned by the AS.
+        uri: the `error_uri` as returned by the AS.
+
+    """
+
+    def __init__(
+        self,
+        response: requests.Response,
+        client: OAuth2Client,
+        error: str,
+        description: str | None = None,
+        uri: str | None = None,
+    ) -> None:
+        super().__init__(response=response, client=client)
+        self.error = error
+        self.description = description
+        self.uri = uri
+
+
-
- Source code in requests_oauth2client/pooling.py - 
16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
-76
-77
-78
-79
-80
-81
-82
-83
-84
-85
-86
-87
-88
-89
-90
class TokenEndpointPoolingJob(ABC):
-    """Base class for Token Endpoint pooling jobs.
-
-    This is used for decoupled flows like CIBA or Device Authorization.
-
-    This class must be subclassed to implement actual BackChannel flows. This needs an
-    [OAuth2Client][requests_oauth2client.client.OAuth2Client] that will be used to pool the token
-    endpoint. The initial pooling `interval` is configurable.
-
-    Args:
-        client: the [OAuth2Client][requests_oauth2client.client.OAuth2Client] that will be used
-            to pool the token endpoint.
-        interval: initial pooling interval, in seconds. If `None`, default to `5`.
-        slow_down_interval: when a [SlowDown][requests_oauth2client.exceptions.SlowDown] is
-            received, this number of seconds will be added to the pooling interval.
-        requests_kwargs: additional parameters for the underlying calls to [requests.request][]
-        **token_kwargs: additional parameters for the token request
-
-    """
-
-    def __init__(
-        self,
-        client: OAuth2Client,
-        interval: int | None = None,
-        slow_down_interval: int = 5,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ):
-        self.client = client
-        self.interval = interval or 5
-        self.slow_down_interval = slow_down_interval
-        self.requests_kwargs = requests_kwargs
-        self.token_kwargs = token_kwargs
-
-    def __call__(self) -> BearerToken | None:
-        """Wrap the actual Token Endpoint call with a pooling interval.
-
-        Everytime this method is called, it will wait for the entire duration of the pooling
-        interval before calling
-        [token_request()][requests_oauth2client.pooling.TokenEndpointPoolingJob.token_request]. So
-        you can call it immediately after initiating the BackChannel flow, and it will wait before
-        initiating the first call.
-
-        This implements the logic to handle
-        [AuthorizationPending][requests_oauth2client.exceptions.AuthorizationPending] or
-        [SlowDown][requests_oauth2client.exceptions.SlowDown] requests by the AS.
-
-        Returns:
-            a [BearerToken][requests_oauth2client.tokens.BearerToken] if the AS returns one, or
-            `None` if the Authorization is still pending.
-
-        """
-        time.sleep(self.interval)
-        try:
-            return self.token_request()
-        except SlowDown:
-            self.interval += self.slow_down_interval
-        except AuthorizationPending:
-            pass
-        return None
-
-    @abstractmethod
-    def token_request(self) -> BearerToken:
-        """Abstract method for the token endpoint call.
-
-        This must be implemented by subclasses. This method must Must raise
-        [AuthorizationPending][requests_oauth2client.exceptions.AuthorizationPending] to retry after
-        the pooling interval, or [SlowDown][requests_oauth2client.exceptions.SlowDown] to increase
-        the pooling interval by `slow_down_interval` seconds.
-
-        Returns:
-            a [BearerToken][requests_oauth2client.tokens.BearerToken]
-
-        """
-        raise NotImplementedError  # pragma: no cover
-
-
-
@@ -33069,93 +35359,56 @@

-
+
+

-

- token_request() - - - abstractmethod - +

+ +
+ + + +

+ ExpiredToken + + +

+ + +
+

+ Bases: TokenEndpointError

+ + +

Raised when the Token Endpoint returns error = expired_token.

+ +
+ Source code in requests_oauth2client/exceptions.py + 
134
+135
class ExpiredToken(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = expired_token`."""
+
+
+ + + +
- -
- -

Abstract method for the token endpoint call.

-

This must be implemented by subclasses. This method must Must raise -AuthorizationPending to retry after -the pooling interval, or SlowDown to increase -the pooling interval by slow_down_interval seconds.

-

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/pooling.py - 
77
-78
-79
-80
-81
-82
-83
-84
-85
-86
-87
-88
-89
-90
@abstractmethod
-def token_request(self) -> BearerToken:
-    """Abstract method for the token endpoint call.
-
-    This must be implemented by subclasses. This method must Must raise
-    [AuthorizationPending][requests_oauth2client.exceptions.AuthorizationPending] to retry after
-    the pooling interval, or [SlowDown][requests_oauth2client.exceptions.SlowDown] to increase
-    the pooling interval by `slow_down_interval` seconds.
-
-    Returns:
-        a [BearerToken][requests_oauth2client.tokens.BearerToken]
-
-    """
-    raise NotImplementedError  # pragma: no cover
-
-
-
-
-
+
@@ -33163,729 +35416,29 @@

- BearerToken - +

+ InteractionRequired -

+ -
-

- Bases: AccessToken

- -

Represents a Bearer Token as returned by a Token Endpoint.

-

This is a wrapper around a Bearer Token and associated parameters, such as expiration date and -refresh token, as returned by an OAuth 2.x or OIDC 1.0 Token Endpoint.

-

All parameters are as returned by a Token Endpoint. The token expiration date can be passed as -datetime in the expires_at parameter, or an expires_in parameter, as number of seconds in -the future, can be passed instead.

+
+

+ Bases: AuthorizationResponseError

+

Raised when the Authorization Endpoint returns error = interaction_required.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
access_token - str - -
-

an access_token, as returned by the AS.

-
- 		- required -
expires_at - datetime | None - -
-

an expiration date. This method also accepts an expires_in hint as -returned by the AS, if any.

-
- 		- None -
scope - str | None - -
-

a scope, as returned by the AS, if any.

-
- 		- None -
refresh_token - str | None - -
-

a refresh_token, as returned by the AS, if any.

-
- 		- None -
token_type - str - -
-

a token_type, as returned by the AS.

-
- 		- TOKEN_TYPE -
id_token - str | bytes | IdToken | JweCompact | None - -
-

an id_token, as returned by the AS, if any.

-
- 		- None -
**kwargs - Any - -
-

additional parameters as returned by the AS, if any.

-
- 		- {} -
+
+ Source code in requests_oauth2client/exceptions.py + 
170
+171
class InteractionRequired(AuthorizationResponseError):
+    """Raised when the Authorization Endpoint returns `error = interaction_required`."""
+
+
-
- Source code in requests_oauth2client/tokens.py - 
103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
-141
-142
-143
-144
-145
-146
-147
-148
-149
-150
-151
-152
-153
-154
-155
-156
-157
-158
-159
-160
-161
-162
-163
-164
-165
-166
-167
-168
-169
-170
-171
-172
-173
-174
-175
-176
-177
-178
-179
-180
-181
-182
-183
-184
-185
-186
-187
-188
-189
-190
-191
-192
-193
-194
-195
-196
-197
-198
-199
-200
-201
-202
-203
-204
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
-258
-259
-260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
-293
-294
-295
-296
-297
-298
-299
-300
-301
-302
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320
-321
-322
-323
-324
-325
-326
-327
-328
-329
-330
-331
-332
-333
-334
-335
-336
-337
-338
-339
-340
-341
-342
-343
-344
-345
-346
-347
-348
-349
-350
-351
-352
-353
-354
-355
-356
-357
-358
-359
-360
-361
-362
-363
-364
-365
-366
-367
-368
-369
-370
-371
-372
-373
-374
-375
-376
-377
-378
-379
-380
-381
-382
-383
-384
-385
-386
-387
-388
-389
-390
-391
-392
-393
-394
@frozen(init=False)
-class BearerToken(AccessToken):
-    """Represents a Bearer Token as returned by a Token Endpoint.
-
-    This is a wrapper around a Bearer Token and associated parameters, such as expiration date and
-    refresh token, as returned by an OAuth 2.x or OIDC 1.0 Token Endpoint.
-
-    All parameters are as returned by a Token Endpoint. The token expiration date can be passed as
-    datetime in the `expires_at` parameter, or an `expires_in` parameter, as number of seconds in
-    the future, can be passed instead.
-
-    Args:
-        access_token: an `access_token`, as returned by the AS.
-        expires_at: an expiration date. This method also accepts an `expires_in` hint as
-            returned by the AS, if any.
-        scope: a `scope`, as returned by the AS, if any.
-        refresh_token: a `refresh_token`, as returned by the AS, if any.
-        token_type: a `token_type`, as returned by the AS.
-        id_token: an `id_token`, as returned by the AS, if any.
-        **kwargs: additional parameters as returned by the AS, if any.
-
-    """
-
-    TOKEN_TYPE: ClassVar[str] = AccessTokenType.BEARER.value
-
-    access_token: str
-    expires_at: datetime | None = None
-    scope: str | None = None
-    refresh_token: str | None = None
-    token_type: str = TOKEN_TYPE
-    id_token: IdToken | jwskate.JweCompact | None = None
-    kwargs: dict[str, Any] = Factory(dict)
-
-    @accepts_expires_in
-    def __init__(
-        self,
-        access_token: str,
-        *,
-        expires_at: datetime | None = None,
-        scope: str | None = None,
-        refresh_token: str | None = None,
-        token_type: str = TOKEN_TYPE,
-        id_token: str | bytes | IdToken | jwskate.JweCompact | None = None,
-        **kwargs: Any,
-    ):
-        if token_type.title() != self.TOKEN_TYPE.title():
-            msg = f"Token Type is not '{self.TOKEN_TYPE}'!"
-            raise ValueError(msg, token_type)
-        id_token_jwt: IdToken | jwskate.JweCompact | None = None
-        if isinstance(id_token, (str, bytes)):
-            try:
-                id_token_jwt = IdToken(id_token)
-            except jwskate.InvalidJwt:
-                try:
-                    id_token_jwt = jwskate.JweCompact(id_token)
-                except jwskate.InvalidJwe:
-                    msg = "ID Token is invalid because it is  neither a JWT or a JWE."
-                    raise InvalidIdToken(msg) from None
-        else:
-            id_token_jwt = id_token
-        self.__attrs_init__(
-            access_token=access_token,
-            expires_at=expires_at,
-            scope=scope,
-            refresh_token=refresh_token,
-            token_type=token_type,
-            id_token=id_token_jwt,
-            kwargs=kwargs,
-        )
-
-    def is_expired(self, leeway: int = 0) -> bool | None:
-        """Check if the access token is expired.
-
-        Args:
-            leeway: If the token expires in the next given number of seconds,
-                then consider it expired already.
-
-        Returns:
-            One of:
-
-            - `True` if the access token is expired
-            - `False` if it is still valid
-            - `None` if there is no expires_in hint.
-
-        """
-        if self.expires_at:
-            return datetime.now(tz=timezone.utc) + timedelta(seconds=leeway) > self.expires_at
-        return None
-
-    def authorization_header(self) -> str:
-        """Return the appropriate Authorization Header value for this token.
-
-        The value is formatted correctly according to RFC6750.
-
-        Returns:
-            the value to use in an HTTP Authorization Header
-
-        """
-        return f"Bearer {self.access_token}"
-
-    def validate_id_token(self, client: OAuth2Client, azr: AuthorizationResponse) -> Self:  # noqa: C901, PLR0915
-        """Validate that a token response is valid, and return the ID Token.
-
-        This will validate the id_token as described in [OIDC 1.0
-        $3.1.3.7](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation).
-
-        If the ID Token is encrypted, this decrypts it and returns the clear-text ID Token.
-
-        """
-        if not self.id_token:
-            raise MissingIdToken()
-
-        raw_id_token = self.id_token
-
-        if isinstance(raw_id_token, jwskate.JweCompact) and client.id_token_encrypted_response_alg is None:
-            msg = "ID Token is encrypted while it should be clear-text"
-            raise InvalidIdToken(msg, self)
-        elif isinstance(raw_id_token, IdToken) and client.id_token_encrypted_response_alg is not None:
-            msg = "ID Token is clear-text while it should be encrypted"
-            raise InvalidIdToken(msg, self)
-
-        if isinstance(raw_id_token, jwskate.JweCompact):
-            enc_jwk = client.id_token_decryption_key
-            if enc_jwk is None:
-                msg = "ID Token is encrypted but client does not have a decryption key"
-                raise InvalidIdToken(msg, self)
-            nested_id_token = raw_id_token.decrypt(enc_jwk)
-            id_token = IdToken(nested_id_token)
-        else:
-            id_token = raw_id_token
-
-        if id_token.get_header("alg") is None and client.id_token_signed_response_alg is None:
-            msg = (
-                "ID Token does not contain an `alg` parameter to specify the signature"
-                " algorithm, and no algorithm has been configured for the client (using param"
-                " id_token_signed_response_alg`."
-            )
-            raise InvalidIdToken(msg)
-        elif client.id_token_signed_response_alg is not None and id_token.alg != client.id_token_signed_response_alg:
-            raise MismatchingIdTokenAlg(id_token.alg, client.id_token_signed_response_alg)
-
-        id_token_alg = id_token.alg or client.id_token_signed_response_alg
-
-        if azr.issuer and id_token.issuer != azr.issuer:
-            raise MismatchingIssuer(id_token.issuer, azr.issuer, self)
-
-        if id_token.audiences and client.client_id not in id_token.audiences:
-            raise MismatchingAudience(id_token.audiences, client.client_id, self)
-
-        if id_token.get_claim("azp") is not None and id_token.azp != client.client_id:
-            raise MismatchingAzp(id_token.azp, client.client_id, self)
-
-        if id_token.is_expired():
-            raise ExpiredIdToken(id_token)
-
-        if azr.nonce and id_token.nonce != azr.nonce:
-            raise MismatchingNonce()
-
-        if azr.acr_values and id_token.acr not in azr.acr_values:
-            raise MismatchingAcr(id_token.acr, azr.acr_values)
-
-        hash_function: Callable[[str], str]  # method used to calculate at_hash, s_hash, etc.
-
-        if id_token_alg in jwskate.SignatureAlgs.ALL_SYMMETRIC:
-            if not client.client_secret:
-                msg = "ID Token is symmetrically signed but this client does not have a Client Secret."
-                raise InvalidIdToken(msg)
-            id_token.verify_signature(jwskate.SymmetricJwk.from_bytes(client.client_secret), alg=id_token_alg)
-        elif id_token_alg in jwskate.SignatureAlgs.ALL_ASYMMETRIC:
-            if not client.authorization_server_jwks:
-                msg = "ID Token is asymmetrically signed but the Authorization Server JWKS is not available."
-                raise InvalidIdToken(msg)
-
-            if id_token.get_header("kid") is None:
-                msg = (
-                    "ID Token does not contain a Key ID (kid) to specify the asymmetric key "
-                    "to use for signature verification."
-                )
-                raise InvalidIdToken(msg)
-            try:
-                verification_jwk = client.authorization_server_jwks.get_jwk_by_kid(id_token.kid)
-            except KeyError:
-                msg = (
-                    f"ID Token is asymmetrically signed but its Key ID '{id_token.kid}' "
-                    "is not part of the Authorization Server JWKS."
-                )
-                raise InvalidIdToken(msg) from None
-
-            if id_token_alg not in verification_jwk.supported_signing_algorithms():
-                msg = "ID Token is asymmetrically signed but its algorithm is not supported by the verification key."
-                raise InvalidIdToken(msg)
-
-            id_token.verify_signature(verification_jwk, alg=id_token_alg)
-
-            hash_function = IdToken.hash_method(verification_jwk, id_token_alg)
-
-        at_hash = id_token.get_claim("at_hash")
-        if at_hash is not None:
-            expected_at_hash = hash_function(self.access_token)
-            if expected_at_hash != at_hash:
-                msg = f"Mismatching 'at_hash' value: expected '{expected_at_hash}', got '{at_hash}'"
-                raise InvalidIdToken(msg)
-
-        c_hash = id_token.get_claim("c_hash")
-        if c_hash is not None:
-            expected_c_hash = hash_function(azr.code)
-            if expected_c_hash != c_hash:
-                msg = f"Mismatching 'c_hash' value: expected '{expected_c_hash}', got '{c_hash}'"
-                raise InvalidIdToken(msg)
-
-        s_hash = id_token.get_claim("s_hash")
-        if s_hash is not None:
-            if azr.state is None:
-                msg = "ID Token has a 's_hash' claim but no state was included in the request."
-                raise InvalidIdToken(msg)
-            expected_s_hash = hash_function(azr.state)
-            if expected_s_hash != s_hash:
-                msg = f"Mismatching 's_hash' value (expected '{expected_s_hash}', got '{s_hash}'"
-                raise InvalidIdToken(msg)
-
-        if azr.max_age is not None:
-            try:
-                auth_time = id_token.auth_time
-            except AttributeError:
-                msg = (
-                    "A `max_age` parameter was included in the authorization request, "
-                    "but the ID Token does not contain an `auth_time` claim."
-                )
-                raise InvalidIdToken(msg) from None
-            auth_age = datetime.now(tz=timezone.utc) - auth_time
-            if auth_age.seconds > azr.max_age + 60:
-                msg = (
-                    "User authentication happened too long ago. The `auth_time` parameter from"
-                    " the ID Token indicate that the last Authentication Time was at"
-                    f" {auth_time} ({auth_age.seconds} sec ago), but the authorization request"
-                    f" `max_age` parameter specified that it must be maximum {azr.max_age} sec"
-                    " ago."
-                )
-                raise InvalidIdToken(msg)
-
-        return self.__class__(
-            access_token=self.access_token,
-            expires_at=self.expires_at,
-            scope=self.scope,
-            refresh_token=self.refresh_token,
-            token_type=self.token_type,
-            id_token=id_token,
-            **self.kwargs,
-        )
-
-    def __str__(self) -> str:
-        """Return the access token value, as a string.
-
-        Returns:
-            the access token string
-
-        """
-        return self.access_token
-
-    def as_dict(self) -> dict[str, Any]:
-        """Return a dict of parameters.
-
-        That is suitable for serialization or to init another BearerToken.
-
-        """
-        d = asdict(self)
-        d.pop("expires_at")
-        d["expires_in"] = self.expires_in
-        d.update(**d.pop("kwargs", {}))
-        return {key: val for key, val in d.items() if val is not None}
-
-    @property
-    def expires_in(self) -> int | None:
-        """Number of seconds until expiration."""
-        if self.expires_at:
-            return int(self.expires_at.timestamp() - datetime.now(tz=timezone.utc).timestamp())
-        return None
-
-    def __getattr__(self, key: str) -> Any:
-        """Return custom attributes from this BearerToken.
-
-        Args:
-            key: a key
-
-        Returns:
-            the associated value in this token response
-
-        Raises:
-            AttributeError: if the attribute is not found in this response.
-
-        """
-        return self.kwargs.get(key) or super().__getattribute__(key)
-
-
-
@@ -33895,619 +35448,115 @@

-
- - -

- expires_in: int | None - - - property - -

-
- -

Number of seconds until expiration.

+
+

+
-
+

+ IntrospectionError +

-

- is_expired(leeway=0) -

+
+

+ Bases: EndpointError

-
- -

Check if the access token is expired.

+

Base class for Introspection Endpoint errors.

+
+ Source code in requests_oauth2client/exceptions.py + 
114
+115
class IntrospectionError(EndpointError):
+    """Base class for Introspection Endpoint errors."""
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
leeway - int - -
-

If the token expires in the next given number of seconds, -then consider it expired already.

-
- 		- 0 -
- - - -

Returns:

- - - - - - - - - - - - - - - - - - - - - - - - - -
TypeDescription
- bool | None - -
-

One of:

-
-
- bool | None - -
-
    -
  • True if the access token is expired
    • -
-
-
- bool | None - -
-
    -
  • False if it is still valid
    • -
-
-
- bool | None - -
-
    -
  • None if there is no expires_in hint.
    • -
-
-
- -
- Source code in requests_oauth2client/tokens.py - 
173
-174
-175
-176
-177
-178
-179
-180
-181
-182
-183
-184
-185
-186
-187
-188
-189
-190
def is_expired(self, leeway: int = 0) -> bool | None:
-    """Check if the access token is expired.
-
-    Args:
-        leeway: If the token expires in the next given number of seconds,
-            then consider it expired already.
-
-    Returns:
-        One of:
-
-        - `True` if the access token is expired
-        - `False` if it is still valid
-        - `None` if there is no expires_in hint.
-
-    """
-    if self.expires_at:
-        return datetime.now(tz=timezone.utc) + timedelta(seconds=leeway) > self.expires_at
-    return None
-
-
-
-
+
-
-

- authorization_header() -

-
- -

Return the appropriate Authorization Header value for this token.

-

The value is formatted correctly according to RFC6750.

-

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

the value to use in an HTTP Authorization Header

-
-
- -
- Source code in requests_oauth2client/tokens.py - 
192
-193
-194
-195
-196
-197
-198
-199
-200
-201
def authorization_header(self) -> str:
-    """Return the appropriate Authorization Header value for this token.
-
-    The value is formatted correctly according to RFC6750.
-
-    Returns:
-        the value to use in an HTTP Authorization Header
-
-    """
-    return f"Bearer {self.access_token}"
-
-
+
+
+
-
+

+ InvalidAuthResponse -

- validate_id_token(client, azr) -

+ -
- -

Validate that a token response is valid, and return the ID Token.

-

This will validate the id_token as described in OIDC 1.0 -$3.1.3.7.

-

If the ID Token is encrypted, this decrypts it and returns the clear-text ID Token.

- -
- Source code in requests_oauth2client/tokens.py - 
203
-204
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
-258
-259
-260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
-293
-294
-295
-296
-297
-298
-299
-300
-301
-302
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320
-321
-322
-323
-324
-325
-326
-327
-328
-329
-330
-331
-332
-333
-334
-335
-336
-337
-338
-339
-340
-341
-342
-343
-344
-345
-346
-347
-348
-349
-350
-351
def validate_id_token(self, client: OAuth2Client, azr: AuthorizationResponse) -> Self:  # noqa: C901, PLR0915
-    """Validate that a token response is valid, and return the ID Token.
-
-    This will validate the id_token as described in [OIDC 1.0
-    $3.1.3.7](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation).
-
-    If the ID Token is encrypted, this decrypts it and returns the clear-text ID Token.
-
-    """
-    if not self.id_token:
-        raise MissingIdToken()
-
-    raw_id_token = self.id_token
-
-    if isinstance(raw_id_token, jwskate.JweCompact) and client.id_token_encrypted_response_alg is None:
-        msg = "ID Token is encrypted while it should be clear-text"
-        raise InvalidIdToken(msg, self)
-    elif isinstance(raw_id_token, IdToken) and client.id_token_encrypted_response_alg is not None:
-        msg = "ID Token is clear-text while it should be encrypted"
-        raise InvalidIdToken(msg, self)
-
-    if isinstance(raw_id_token, jwskate.JweCompact):
-        enc_jwk = client.id_token_decryption_key
-        if enc_jwk is None:
-            msg = "ID Token is encrypted but client does not have a decryption key"
-            raise InvalidIdToken(msg, self)
-        nested_id_token = raw_id_token.decrypt(enc_jwk)
-        id_token = IdToken(nested_id_token)
-    else:
-        id_token = raw_id_token
-
-    if id_token.get_header("alg") is None and client.id_token_signed_response_alg is None:
-        msg = (
-            "ID Token does not contain an `alg` parameter to specify the signature"
-            " algorithm, and no algorithm has been configured for the client (using param"
-            " id_token_signed_response_alg`."
-        )
-        raise InvalidIdToken(msg)
-    elif client.id_token_signed_response_alg is not None and id_token.alg != client.id_token_signed_response_alg:
-        raise MismatchingIdTokenAlg(id_token.alg, client.id_token_signed_response_alg)
-
-    id_token_alg = id_token.alg or client.id_token_signed_response_alg
-
-    if azr.issuer and id_token.issuer != azr.issuer:
-        raise MismatchingIssuer(id_token.issuer, azr.issuer, self)
-
-    if id_token.audiences and client.client_id not in id_token.audiences:
-        raise MismatchingAudience(id_token.audiences, client.client_id, self)
-
-    if id_token.get_claim("azp") is not None and id_token.azp != client.client_id:
-        raise MismatchingAzp(id_token.azp, client.client_id, self)
-
-    if id_token.is_expired():
-        raise ExpiredIdToken(id_token)
-
-    if azr.nonce and id_token.nonce != azr.nonce:
-        raise MismatchingNonce()
-
-    if azr.acr_values and id_token.acr not in azr.acr_values:
-        raise MismatchingAcr(id_token.acr, azr.acr_values)
-
-    hash_function: Callable[[str], str]  # method used to calculate at_hash, s_hash, etc.
-
-    if id_token_alg in jwskate.SignatureAlgs.ALL_SYMMETRIC:
-        if not client.client_secret:
-            msg = "ID Token is symmetrically signed but this client does not have a Client Secret."
-            raise InvalidIdToken(msg)
-        id_token.verify_signature(jwskate.SymmetricJwk.from_bytes(client.client_secret), alg=id_token_alg)
-    elif id_token_alg in jwskate.SignatureAlgs.ALL_ASYMMETRIC:
-        if not client.authorization_server_jwks:
-            msg = "ID Token is asymmetrically signed but the Authorization Server JWKS is not available."
-            raise InvalidIdToken(msg)
-
-        if id_token.get_header("kid") is None:
-            msg = (
-                "ID Token does not contain a Key ID (kid) to specify the asymmetric key "
-                "to use for signature verification."
-            )
-            raise InvalidIdToken(msg)
-        try:
-            verification_jwk = client.authorization_server_jwks.get_jwk_by_kid(id_token.kid)
-        except KeyError:
-            msg = (
-                f"ID Token is asymmetrically signed but its Key ID '{id_token.kid}' "
-                "is not part of the Authorization Server JWKS."
-            )
-            raise InvalidIdToken(msg) from None
-
-        if id_token_alg not in verification_jwk.supported_signing_algorithms():
-            msg = "ID Token is asymmetrically signed but its algorithm is not supported by the verification key."
-            raise InvalidIdToken(msg)
-
-        id_token.verify_signature(verification_jwk, alg=id_token_alg)
-
-        hash_function = IdToken.hash_method(verification_jwk, id_token_alg)
-
-    at_hash = id_token.get_claim("at_hash")
-    if at_hash is not None:
-        expected_at_hash = hash_function(self.access_token)
-        if expected_at_hash != at_hash:
-            msg = f"Mismatching 'at_hash' value: expected '{expected_at_hash}', got '{at_hash}'"
-            raise InvalidIdToken(msg)
-
-    c_hash = id_token.get_claim("c_hash")
-    if c_hash is not None:
-        expected_c_hash = hash_function(azr.code)
-        if expected_c_hash != c_hash:
-            msg = f"Mismatching 'c_hash' value: expected '{expected_c_hash}', got '{c_hash}'"
-            raise InvalidIdToken(msg)
-
-    s_hash = id_token.get_claim("s_hash")
-    if s_hash is not None:
-        if azr.state is None:
-            msg = "ID Token has a 's_hash' claim but no state was included in the request."
-            raise InvalidIdToken(msg)
-        expected_s_hash = hash_function(azr.state)
-        if expected_s_hash != s_hash:
-            msg = f"Mismatching 's_hash' value (expected '{expected_s_hash}', got '{s_hash}'"
-            raise InvalidIdToken(msg)
-
-    if azr.max_age is not None:
-        try:
-            auth_time = id_token.auth_time
-        except AttributeError:
-            msg = (
-                "A `max_age` parameter was included in the authorization request, "
-                "but the ID Token does not contain an `auth_time` claim."
-            )
-            raise InvalidIdToken(msg) from None
-        auth_age = datetime.now(tz=timezone.utc) - auth_time
-        if auth_age.seconds > azr.max_age + 60:
-            msg = (
-                "User authentication happened too long ago. The `auth_time` parameter from"
-                " the ID Token indicate that the last Authentication Time was at"
-                f" {auth_time} ({auth_age.seconds} sec ago), but the authorization request"
-                f" `max_age` parameter specified that it must be maximum {azr.max_age} sec"
-                " ago."
-            )
-            raise InvalidIdToken(msg)
-
-    return self.__class__(
-        access_token=self.access_token,
-        expires_at=self.expires_at,
-        scope=self.scope,
-        refresh_token=self.refresh_token,
-        token_type=self.token_type,
-        id_token=id_token,
-        **self.kwargs,
-    )
-
-
-
+
+

+ Bases: ValueError

-
+

Raised when the Authorization Endpoint returns an invalid response.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
190
+191
+192
+193
+194
+195
+196
class InvalidAuthResponse(ValueError):
+    """Raised when the Authorization Endpoint returns an invalid response."""
+
+    def __init__(self, message: str, request: AuthorizationRequest, response: str) -> None:
+        super().__init__(f"The Authorization Response is invalid: {message}")
+        self.request = request
+        self.response = response
+
+
-

- as_dict() +
+ + -

-
- -

Return a dict of parameters.

-

That is suitable for serialization or to init another BearerToken.

-
- Source code in requests_oauth2client/tokens.py - 
362
-363
-364
-365
-366
-367
-368
-369
-370
-371
-372
def as_dict(self) -> dict[str, Any]:
-    """Return a dict of parameters.
-
-    That is suitable for serialization or to init another BearerToken.
-
-    """
-    d = asdict(self)
-    d.pop("expires_at")
-    d["expires_in"] = self.expires_in
-    d.update(**d.pop("kwargs", {}))
-    return {key: val for key, val in d.items() if val is not None}
-
-
-
-
-
+
@@ -34515,227 +35564,29 @@

-

- BearerTokenSerializer - +

+ InvalidBackChannelAuthenticationResponse -

+ -
- -

A helper class to serialize Token Response returned by an AS.

-

This may be used to store BearerTokens in session or cookies.

-

It needs a dumper and a loader functions that will respectively serialize and deserialize -BearerTokens. Default implementations are provided with use gzip and base64url on the serialized -JSON representation.

+
+

+ Bases: OAuth2Error

+

Raised when the BackChannel Authentication endpoint returns a non-standard response.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
dumper - Callable[[BearerToken], str] | None - -
-

a function to serialize a token into a str.

-
- 		- None -
loader - Callable[[str], BearerToken] | None - -
-

a function to deserialize a serialized token representation.

-
- 		- None -
+
+ Source code in requests_oauth2client/exceptions.py + 
257
+258
class InvalidBackChannelAuthenticationResponse(OAuth2Error):
+    """Raised when the BackChannel Authentication endpoint returns a non-standard response."""
+
+
-
- Source code in requests_oauth2client/tokens.py - 
397
-398
-399
-400
-401
-402
-403
-404
-405
-406
-407
-408
-409
-410
-411
-412
-413
-414
-415
-416
-417
-418
-419
-420
-421
-422
-423
-424
-425
-426
-427
-428
-429
-430
-431
-432
-433
-434
-435
-436
-437
-438
-439
-440
-441
-442
-443
-444
-445
-446
-447
-448
-449
-450
-451
-452
-453
-454
-455
-456
-457
-458
-459
-460
-461
-462
-463
-464
-465
-466
-467
-468
-469
-470
-471
-472
-473
-474
class BearerTokenSerializer:
-    """A helper class to serialize Token Response returned by an AS.
-
-    This may be used to store BearerTokens in session or cookies.
-
-    It needs a `dumper` and a `loader` functions that will respectively serialize and deserialize
-    BearerTokens. Default implementations are provided with use gzip and base64url on the serialized
-    JSON representation.
-
-    Args:
-        dumper: a function to serialize a token into a `str`.
-        loader: a function to deserialize a serialized token representation.
-
-    """
-
-    def __init__(
-        self,
-        dumper: Callable[[BearerToken], str] | None = None,
-        loader: Callable[[str], BearerToken] | None = None,
-    ):
-        self.dumper = dumper or self.default_dumper
-        self.loader = loader or self.default_loader
-
-    @staticmethod
-    def default_dumper(token: BearerToken) -> str:
-        """Serialize a token as JSON, then compress with deflate, then encodes as base64url.
-
-        Args:
-            token: the `BearerToken` to serialize
-
-        Returns:
-            the serialized value
-
-        """
-        return BinaPy.serialize_to("json", token.as_dict()).to("deflate").to("b64u").ascii()
-
-    def default_loader(self, serialized: str, token_class: type[BearerToken] = BearerToken) -> BearerToken:
-        """Deserialize a BearerToken.
-
-        This does the opposite operations than `default_dumper`.
-
-        Args:
-            serialized: the serialized token
-            token_class: class to use to deserialize the Token
-
-        Returns:
-            a BearerToken
-
-        """
-        attrs = BinaPy(serialized).decode_from("b64u").decode_from("deflate").parse_from("json")
-        expires_at = attrs.get("expires_at")
-        if expires_at:
-            attrs["expires_at"] = datetime.fromtimestamp(expires_at, tz=timezone.utc)
-        return token_class(**attrs)
-
-    def dumps(self, token: BearerToken) -> str:
-        """Serialize and compress a given token for easier storage.
-
-        Args:
-            token: a BearerToken to serialize
-
-        Returns:
-            the serialized token, as a str
-
-        """
-        return self.dumper(token)
-
-    def loads(self, serialized: str) -> BearerToken:
-        """Deserialize a serialized token.
-
-        Args:
-            serialized: the serialized token
-
-        Returns:
-            the deserialized token
-
-        """
-        return self.loader(serialized)
-
-
-
@@ -34748,438 +35599,102 @@

-
+
+

-

- default_dumper(token) - - - staticmethod - +

- +
-
- -

Serialize a token as JSON, then compress with deflate, then encodes as base64url.

+

+ InvalidClient -

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
token - BearerToken - -
-

the BearerToken to serialize

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

the serialized value

-
-
- -
- Source code in requests_oauth2client/tokens.py - 
420
-421
-422
-423
-424
-425
-426
-427
-428
-429
-430
-431
@staticmethod
-def default_dumper(token: BearerToken) -> str:
-    """Serialize a token as JSON, then compress with deflate, then encodes as base64url.
-
-    Args:
-        token: the `BearerToken` to serialize
-
-    Returns:
-        the serialized value
-
-    """
-    return BinaPy.serialize_to("json", token.as_dict()).to("deflate").to("b64u").ascii()
-
-
-

+ -
+
+

+ Bases: TokenEndpointError

-
+

Raised when the Token Endpoint returns error = invalid_client.

+
+ Source code in requests_oauth2client/exceptions.py + 
82
+83
class InvalidClient(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = invalid_client`."""
+
+
-

- default_loader(serialized, token_class=BearerToken) -

+
-
- -

Deserialize a BearerToken.

-

This does the opposite operations than default_dumper.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
serialized - str - -
-

the serialized token

-
- 		- required -
token_class - type[BearerToken] - -
-

class to use to deserialize the Token

-
- 		- BearerToken -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/tokens.py - 
433
-434
-435
-436
-437
-438
-439
-440
-441
-442
-443
-444
-445
-446
-447
-448
-449
-450
def default_loader(self, serialized: str, token_class: type[BearerToken] = BearerToken) -> BearerToken:
-    """Deserialize a BearerToken.
-
-    This does the opposite operations than `default_dumper`.
-
-    Args:
-        serialized: the serialized token
-        token_class: class to use to deserialize the Token
-
-    Returns:
-        a BearerToken
-
-    """
-    attrs = BinaPy(serialized).decode_from("b64u").decode_from("deflate").parse_from("json")
-    expires_at = attrs.get("expires_at")
-    if expires_at:
-        attrs["expires_at"] = datetime.fromtimestamp(expires_at, tz=timezone.utc)
-    return token_class(**attrs)
-
-
-
-
-
-

- dumps(token) -

+
+
-
- -

Serialize and compress a given token for easier storage.

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
token - BearerToken - -
-

a BearerToken to serialize

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

the serialized token, as a str

-
-
- -
- Source code in requests_oauth2client/tokens.py - 
452
-453
-454
-455
-456
-457
-458
-459
-460
-461
-462
def dumps(self, token: BearerToken) -> str:
-    """Serialize and compress a given token for easier storage.
-
-    Args:
-        token: a BearerToken to serialize
-
-    Returns:
-        the serialized token, as a str
-
-    """
-    return self.dumper(token)
-
-
-
-
+

+ InvalidDeviceAuthorizationResponse -
+

+
+

+ Bases: OAuth2Error

-

- loads(serialized) -

+

Raised when the Device Authorization Endpoint returns a non-standard error response.

+ +
+ Source code in requests_oauth2client/exceptions.py + 
138
+139
class InvalidDeviceAuthorizationResponse(OAuth2Error):
+    """Raised when the Device Authorization Endpoint returns a non-standard error response."""
+
+
+ + + +
+ -
- -

Deserialize a serialized token.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
serialized - str - -
-

the serialized token

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

the deserialized token

-
-
- -
- Source code in requests_oauth2client/tokens.py - 
464
-465
-466
-467
-468
-469
-470
-471
-472
-473
-474
def loads(self, serialized: str) -> BearerToken:
-    """Deserialize a serialized token.
-
-    Args:
-        serialized: the serialized token
-
-    Returns:
-        the deserialized token
-
-    """
-    return self.loader(serialized)
-
-
-
-
-
+
@@ -35187,3920 +35702,591 @@

- IdToken +

+ InvalidGrant -

+ -
-

- Bases: SignedJwt

+
+

+ Bases: TokenEndpointError

- -

Represent an ID Token.

-

An ID Token is actually a Signed JWT. If the ID Token is encrypted, it must be decoded -beforehand.

-
- Source code in requests_oauth2client/tokens.py - 
46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
-76
-77
-78
-79
-80
-81
-82
-83
-84
-85
-86
-87
-88
-89
-90
-91
-92
-93
-94
class IdToken(jwskate.SignedJwt):
-    """Represent an ID Token.
-
-    An ID Token is actually a Signed JWT. If the ID Token is encrypted, it must be decoded
-    beforehand.
-
-    """
-
-    @property
-    def auth_time(self) -> datetime:
-        """The last user authentication time."""
-        auth_time = self.claims.get("auth_time")
-        if auth_time:
-            return self.timestamp_to_datetime(auth_time)
-        msg = "This ID Token doesn't have an `auth_time` attribute."
-        raise AttributeError(msg)
-
-    @classmethod
-    def hash_method(cls, key: jwskate.Jwk, alg: str | None = None) -> Callable[[str], str]:
-        """Returns a callable that generates valid OIDC hashes, such as at_hash, c_hash, s_hash.
-
-        Args:
-            key: the ID token signature verification public key
-            alg: the ID token signature algorithm
-
-        Returns:
-            a callable that takes a string as input and produces a valid hash as a str output
-
-        """
-        alg_class = jwskate.select_alg_class(key.SIGNATURE_ALGORITHMS, jwk_alg=key.alg, alg=alg)
-        if alg_class == jwskate.EdDsa:
-            if key.crv == "Ed25519":
-
-                def hash_method(token: str) -> str:
-                    return BinaPy(token).to("sha512")[:32].to("b64u").decode()
-
-            elif key.crv == "Ed448":
-
-                def hash_method(token: str) -> str:
-                    return BinaPy(token).to("shake256", 456).to("b64u").decode()
-
-        else:
-            hash_alg = alg_class.hashing_alg.name
-            hash_size = alg_class.hashing_alg.digest_size
-
-            def hash_method(token: str) -> str:
-                return BinaPy(token).to(hash_alg)[: hash_size // 2].to("b64u").decode()
-
-        return hash_method
-
-
+

Raised when the Token Endpoint returns error = invalid_grant.

- +
+ Source code in requests_oauth2client/exceptions.py + 
94
+95
class InvalidGrant(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = invalid_grant`."""
+
+
-
+
-
-

- auth_time: datetime - - - property - -

-
- -

The last user authentication time.

+
+
+
-
+

+ InvalidPushedAuthorizationResponse +

-

- hash_method(key, alg=None) - - - classmethod - -

+
+

+ Bases: OAuth2Error

+ + +

Raised when the Pushed Authorization Endpoint returns an error.

+ +
+ Source code in requests_oauth2client/exceptions.py + 
261
+262
class InvalidPushedAuthorizationResponse(OAuth2Error):
+    """Raised when the Pushed Authorization Endpoint returns an error."""
+
+
+ + + +
+ -
- -

Returns a callable that generates valid OIDC hashes, such as at_hash, c_hash, s_hash.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
key - Jwk - -
-

the ID token signature verification public key

-
- 		- required -
alg - str | None - -
-

the ID token signature algorithm

-
- 		- None -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Callable[[str], str] - -
-

a callable that takes a string as input and produces a valid hash as a str output

-
-
- -
- Source code in requests_oauth2client/tokens.py - 
63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
-76
-77
-78
-79
-80
-81
-82
-83
-84
-85
-86
-87
-88
-89
-90
-91
-92
-93
-94
@classmethod
-def hash_method(cls, key: jwskate.Jwk, alg: str | None = None) -> Callable[[str], str]:
-    """Returns a callable that generates valid OIDC hashes, such as at_hash, c_hash, s_hash.
-
-    Args:
-        key: the ID token signature verification public key
-        alg: the ID token signature algorithm
-
-    Returns:
-        a callable that takes a string as input and produces a valid hash as a str output
-
-    """
-    alg_class = jwskate.select_alg_class(key.SIGNATURE_ALGORITHMS, jwk_alg=key.alg, alg=alg)
-    if alg_class == jwskate.EdDsa:
-        if key.crv == "Ed25519":
-
-            def hash_method(token: str) -> str:
-                return BinaPy(token).to("sha512")[:32].to("b64u").decode()
-
-        elif key.crv == "Ed448":
-
-            def hash_method(token: str) -> str:
-                return BinaPy(token).to("shake256", 456).to("b64u").decode()
-
-    else:
-        hash_alg = alg_class.hashing_alg.name
-        hash_size = alg_class.hashing_alg.digest_size
-
-        def hash_method(token: str) -> str:
-            return BinaPy(token).to(hash_alg)[: hash_size // 2].to("b64u").decode()
-
-    return hash_method
-
-
-
-
-
+
+
-
+

+ InvalidRequest -

- oauth2_discovery_document_url(issuer) +

- +
+

+ Bases: TokenEndpointError

-
- -

Construct the standardised OAuth 2.0 discovery document url for a given issuer.

-

Based an issuer identifier, returns the standardised URL where the OAuth20 server metadata can -be retrieved.

-

The returned URL is built as specified in -RFC8414.

+

Raised when the Token Endpoint returns error = invalid_request.

+
+ Source code in requests_oauth2client/exceptions.py + 
78
+79
class InvalidRequest(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = invalid_request`."""
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
issuer - str - -
-

an OAuth20 Authentication Server issuer

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- str - -
-

the standardised discovery document URL. Note that no attempt to fetch this document is

-
-
- str - -
-

made.

-
-
- -
- Source code in requests_oauth2client/discovery.py - 
58
-59
-60
-61
-62
-63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
def oauth2_discovery_document_url(issuer: str) -> str:
-    """Construct the standardised OAuth 2.0 discovery document url for a given `issuer`.
-
-    Based an `issuer` identifier, returns the standardised URL where the OAuth20 server metadata can
-    be retrieved.
-
-    The returned URL is built as specified in
-    [RFC8414](https://datatracker.ietf.org/doc/html/rfc8414).
-
-    Args:
-        issuer: an OAuth20 Authentication Server `issuer`
-
-    Returns:
-        the standardised discovery document URL. Note that no attempt to fetch this document is
-        made.
-
-    """
-    return well_known_uri(issuer, "oauth-authorization-server", at_root=True)
-
-
-
-
+
-
-

- oidc_discovery_document_url(issuer) -

-
- -

Construct the OIDC discovery document url for a given issuer.

-

Given an issuer identifier, return the standardised URL where the OIDC discovery document can -be retrieved.

-

The returned URL is biuilt as specified in OpenID Connect Discovery -1.0.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
issuer - str - -
-

an OIDC Authentication Server issuer

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- str - -
-

the standardised discovery document URL. Note that no attempt to fetch this document is

-
-
- str - -
-

made.

-
-
- -
- Source code in requests_oauth2client/discovery.py - 
38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
def oidc_discovery_document_url(issuer: str) -> str:
-    """Construct the OIDC discovery document url for a given `issuer`.
-
-    Given an `issuer` identifier, return the standardised URL where the OIDC discovery document can
-    be retrieved.
-
-    The returned URL is biuilt as specified in [OpenID Connect Discovery
-    1.0](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
-
-    Args:
-        issuer: an OIDC Authentication Server `issuer`
-
-    Returns:
-        the standardised discovery document URL. Note that no attempt to fetch this document is
-        made.
-
-    """
-    return well_known_uri(issuer, "openid-configuration", at_root=False)
-
-
-
-
+
+
-
+
+
-

- well_known_uri(origin, name, *, at_root=True) -

+

+ InvalidScope -
- -

Return the location of a well-known document on an origin url.

-

See RFC8615 and OIDC -Discovery.

+

+
+

+ Bases: TokenEndpointError

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
origin - str - -
-

origin to use to build the well-known uri.

-
- 		- required -
name - str - -
-

document name to use to build the well-known uri.

-
- 		- required -
at_root - bool - -
-

if True, assume the well-known document is at root level (as defined in RFC8615). -If False, assume the well-known location is per-directory, as defined in OpenID -Connect Discovery -1.0.

-
- 		- True -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- str - -
-

the well-know uri, relative to origin, where the well-known document named name should be

-
-
- str - -
-

found.

-
-
- -
- Source code in requests_oauth2client/discovery.py - 
11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
def well_known_uri(origin: str, name: str, *, at_root: bool = True) -> str:
-    """Return the location of a well-known document on an origin url.
-
-    See [RFC8615](https://datatracker.ietf.org/doc/html/rfc8615) and [OIDC
-    Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
-
-    Args:
-        origin: origin to use to build the well-known uri.
-        name: document name to use to build the well-known uri.
-        at_root: if `True`, assume the well-known document is at root level (as defined in [RFC8615](https://datatracker.ietf.org/doc/html/rfc8615)).
-            If `False`, assume the well-known location is per-directory, as defined in [OpenID
-            Connect Discovery
-            1.0](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
-
-    Returns:
-        the well-know uri, relative to origin, where the well-known document named `name` should be
-        found.
-
-    """
-    url = furl(origin)
-    if at_root:
-        url.path = Path(".well-known") / url.path / name
-    else:
-        url.path.add(Path(".well-known") / name)
-    return str(url)
-
-
-
-
+

Raised when the Token Endpoint returns error = invalid_scope.

+
+ Source code in requests_oauth2client/exceptions.py + 
86
+87
class InvalidScope(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = invalid_scope`."""
+
+
-
+
-

- api_client -

-
- -

ApiClient main module.

- -
+
+
+
-

- ApiClient +

+ InvalidTarget -

+ -
+
+

+ Bases: TokenEndpointError

- -

A Wrapper around requests.Session with extra features for REST API calls.

-

Additional features compared to using a requests.Session directly:

-
    -
  • You must set a root url at creation time, which then allows passing relative urls at request time.
    • -
  • It may also raise exceptions instead of returning error responses.
    • -
  • You can also pass additional kwargs at init time, which will be used to configure the -Session, instead of setting them later.
    • -
  • for parameters passed as json, params or data, values that are None can be -automatically discarded from the request
    • -
  • boolean values in data or params fields can be serialized to values that are suitable -for the target API, like "true" or "false", or "1" / "0", instead of the default -values "True" or "False".
    • -
-

base_url will serve as root for relative urls passed to -ApiClient.request(), -ApiClient.get(), etc.

-

An HTTPError will be raised everytime an API call returns an error code (>= 400), unless -you set raise_for_status to False. Additional parameters passed at init time, including -auth will be used to configure the Session.

-
- Usage - 
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-11
-12
-13
-14
-15
-16
-17
from requests_oauth2client import ApiClient
-
-api = ApiClient("https://myapi.local/resource", timeout=10)
-resp = api.get("/myid")  # this will send a GET request
-# to https://myapi.local/resource/myid
-
-# you can pass an underlying requests.Session at init time
-session = requests.Session()
-session.proxies = {"https": "https://localhost:3128"}
-api = ApiClient("https://myapi.local/resource", session=session)
-
-# or you can let ApiClient init its own session and provide additional configuration
-# parameters:
-api = ApiClient(
-    "https://myapi.local/resource",
-    proxies={"https": "https://localhost:3128"},
-)
-
-
+

Raised when the Token Endpoint returns error = invalid_target.

+
+ Source code in requests_oauth2client/exceptions.py + 
90
+91
class InvalidTarget(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = invalid_target`."""
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
base_url - str - -
-

the base api url, that is the root for all the target API endpoints.

-
- 		- required -
auth - AuthBase | None - -
-

the requests.auth.AuthBase to use as authentication handler.

-
- 		- None -
timeout - int | None - -
-

the default timeout, in seconds, to use for each request from this ApiClient. -Can be set to None to disable timeout.

-
- 		- 60 -
raise_for_status - bool - -
-

if True, exceptions will be raised everytime a request returns an -error code (>= 400).

-
- 		- True -
none_fields - Literal['include', 'exclude', 'empty'] - -
-

what to do with parameters with value None in data or json fields.

-
    -
  • if "exclude" (default), fields whose values are None are not included in the request.
    • -
  • if "include", they are included with string value None. Note that this is -the default behavior of requests.
    • -
  • if "empty", they are included with an empty value (as an empty string).
    • -
-
- 		- 'exclude' -
bool_fields - tuple[Any, Any] | None - -
-

a tuple of (true_value, false_value). Fields from data or params with -a boolean value (True or False) will be serialized to the corresponding value. -This can be useful since some APIs expect a 'true' or 'false' value as boolean, -and requests serializes True to 'True' and False to 'False'. -Set it to None to restore default requests behaviour.

-
- 		- ('true', 'false') -
session - Session | None - -
-

a preconfigured requests.Session to use with this ApiClient.

-
- 		- None -
**session_kwargs - Any - -
-

additional kwargs to configure the underlying requests.Session.

-
- 		- {} -
-
- Source code in requests_oauth2client/api_client.py - 
 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
-141
-142
-143
-144
-145
-146
-147
-148
-149
-150
-151
-152
-153
-154
-155
-156
-157
-158
-159
-160
-161
-162
-163
-164
-165
-166
-167
-168
-169
-170
-171
-172
-173
-174
-175
-176
-177
-178
-179
-180
-181
-182
-183
-184
-185
-186
-187
-188
-189
-190
-191
-192
-193
-194
-195
-196
-197
-198
-199
-200
-201
-202
-203
-204
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
-258
-259
-260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
-293
-294
-295
-296
-297
-298
-299
-300
-301
-302
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320
-321
-322
-323
-324
-325
-326
-327
-328
-329
-330
-331
-332
-333
-334
-335
-336
-337
-338
-339
-340
-341
-342
-343
-344
-345
-346
-347
-348
-349
-350
-351
-352
-353
-354
-355
-356
-357
-358
-359
-360
-361
-362
-363
-364
-365
-366
-367
-368
-369
-370
-371
-372
-373
-374
-375
-376
-377
-378
-379
-380
-381
-382
-383
-384
-385
-386
-387
-388
-389
-390
-391
-392
-393
-394
-395
-396
-397
-398
-399
-400
-401
-402
-403
-404
-405
-406
-407
-408
-409
-410
-411
-412
-413
-414
-415
-416
-417
-418
-419
-420
-421
-422
-423
-424
-425
-426
-427
-428
-429
-430
-431
-432
-433
-434
-435
-436
-437
-438
-439
-440
-441
-442
-443
-444
-445
-446
-447
-448
-449
-450
-451
-452
-453
-454
-455
-456
-457
-458
-459
-460
-461
-462
-463
-464
-465
-466
-467
-468
-469
-470
-471
-472
-473
-474
-475
-476
-477
-478
-479
-480
-481
-482
-483
-484
-485
-486
-487
-488
-489
-490
-491
-492
-493
-494
-495
-496
-497
-498
-499
-500
-501
-502
-503
-504
-505
-506
-507
-508
-509
-510
-511
-512
-513
-514
@frozen(init=False)
-class ApiClient:
-    """A Wrapper around [requests.Session][] with extra features for REST API calls.
-
-    Additional features compared to using a [requests.Session][] directly:
-
-    - You must set a root url at creation time, which then allows passing relative urls at request time.
-    - It may also raise exceptions instead of returning error responses.
-    - You can also pass additional kwargs at init time, which will be used to configure the
-    [Session][requests.Session], instead of setting them later.
-    - for parameters passed as `json`, `params` or `data`, values that are `None` can be
-    automatically discarded from the request
-    - boolean values in `data` or `params` fields can be serialized to values that are suitable
-    for the target API, like `"true"`  or `"false"`, or `"1"` / `"0"`, instead of the default
-    values `"True"` or `"False"`.
-
-    `base_url` will serve as root for relative urls passed to
-    [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request],
-    [ApiClient.get()][requests_oauth2client.api_client.ApiClient.get], etc.
-
-    An `HTTPError` will be raised everytime an API call returns an error code (>= 400), unless
-    you set `raise_for_status` to `False`. Additional parameters passed at init time, including
-    `auth` will be used to configure the [Session][requests.Session].
-
-    Usage:
-        ```python
-        from requests_oauth2client import ApiClient
-
-        api = ApiClient("https://myapi.local/resource", timeout=10)
-        resp = api.get("/myid")  # this will send a GET request
-        # to https://myapi.local/resource/myid
-
-        # you can pass an underlying requests.Session at init time
-        session = requests.Session()
-        session.proxies = {"https": "https://localhost:3128"}
-        api = ApiClient("https://myapi.local/resource", session=session)
-
-        # or you can let ApiClient init its own session and provide additional configuration
-        # parameters:
-        api = ApiClient(
-            "https://myapi.local/resource",
-            proxies={"https": "https://localhost:3128"},
-        )
-        ```
-
-    Args:
-        base_url: the base api url, that is the root for all the target API endpoints.
-        auth: the [requests.auth.AuthBase][] to use as authentication handler.
-        timeout: the default timeout, in seconds, to use for each request from this `ApiClient`.
-            Can be set to `None` to disable timeout.
-        raise_for_status: if `True`, exceptions will be raised everytime a request returns an
-            error code (>= 400).
-        none_fields: what to do with parameters with value `None` in `data` or `json` fields.
-
-            - if `"exclude"` (default), fields whose values are `None` are not included in the request.
-            - if `"include"`, they are included with string value `None`. Note that this is
-            the default behavior of `requests`.
-            - if "empty", they are included with an empty value (as an empty string).
-        bool_fields: a tuple of (true_value, false_value). Fields from `data` or `params` with
-            a boolean value (`True` or `False`) will be serialized to the corresponding value.
-            This can be useful since some APIs expect a `'true'` or `'false'` value as boolean,
-            and `requests` serializes `True` to `'True'` and `False` to `'False'`.
-            Set it to `None` to restore default requests behaviour.
-        session: a preconfigured `requests.Session` to use with this `ApiClient`.
-        **session_kwargs: additional kwargs to configure the underlying `requests.Session`.
-
-    """
-
-    base_url: str
-    auth: requests.auth.AuthBase | None = None
-    timeout: int | None = 60
-    raise_for_status: bool = True
-    none_fields: Literal["include", "exclude", "empty"] = "exclude"
-    bool_fields: tuple[Any, Any] | None = "true", "false"
-    session: requests.Session = field(factory=requests.Session)
-
-    def __init__(
-        self,
-        base_url: str,
-        *,
-        auth: requests.auth.AuthBase | None = None,
-        timeout: int | None = 60,
-        raise_for_status: bool = True,
-        none_fields: Literal["include", "exclude", "empty"] = "exclude",
-        bool_fields: tuple[Any, Any] | None = ("true", "false"),
-        session: requests.Session | None = None,
-        **session_kwargs: Any,
-    ):
-        session = session or requests.Session()
-        for key, val in session_kwargs.items():
-            setattr(session, key, val)
-
-        if bool_fields is None:
-            bool_fields = (True, False)
-
-        self.__attrs_init__(
-            base_url=base_url,
-            auth=auth,
-            raise_for_status=raise_for_status,
-            none_fields=none_fields,
-            bool_fields=bool_fields,
-            timeout=timeout,
-            session=session,
-        )
-
-    def request(  # noqa: C901, PLR0913, D417
-        self,
-        method: str,
-        url: None | str | bytes | Iterable[str | bytes | int] = None,
-        *,
-        params: None | bytes | MutableMapping[str, str] = None,
-        data: (
-            Iterable[bytes]
-            | str
-            | bytes
-            | list[tuple[Any, Any]]
-            | tuple[tuple[Any, Any], ...]
-            | Mapping[Any, Any]
-            | None
-        ) = None,
-        headers: MutableMapping[str, str] | None = None,
-        cookies: None | RequestsCookieJar | MutableMapping[str, str] = None,
-        files: MutableMapping[str, IO[Any]] | None = None,
-        auth: (
-            None
-            | tuple[str, str]
-            | requests.auth.AuthBase
-            | Callable[[requests.PreparedRequest], requests.PreparedRequest]
-        ) = None,
-        timeout: None | float | tuple[float, float] | tuple[float, None] = None,
-        allow_redirects: bool = False,
-        proxies: MutableMapping[str, str] | None = None,
-        hooks: None
-        | (
-            MutableMapping[
-                str,
-                (Iterable[Callable[[requests.Response], Any]] | Callable[[requests.Response], Any]),
-            ]
-        ) = None,
-        stream: bool | None = None,
-        verify: str | bool | None = None,
-        cert: str | tuple[str, str] | None = None,
-        json: Mapping[str, Any] | None = None,
-        raise_for_status: bool | None = None,
-        none_fields: Literal["include", "exclude", "empty"] | None = None,
-        bool_fields: tuple[Any, Any] | None = None,
-    ) -> requests.Response:
-        """Overridden `request` method with extra features.
-
-        Features added compared to plain request():
-
-        - takes a relative path instead of a full url, which will be appended to the
-          base_url
-        - it can raise an exception when the API returns a non-success status code
-        - allow_redirects is False by default (since API usually don't use redirects)
-        - `data` or `json` fields with value `None` can either be included or excluded from the
-          request
-        - boolean fields can be serialized to `'true'` or `'false'` instead of `'True'` and
-          `'False'`
-
-        Args:
-          method: the HTTP method to use
-          url: the url where the request will be sent to. Can be a path, as str ;
-            that path will be joined to the configured API url. Can also be an iterable of path
-            segments, that will be joined to the root url.
-          raise_for_status: like the parameter of the same name from `ApiClient.__init__`,
-            but this will be applied for this request only.
-          none_fields: like the parameter of the same name from `ApiClient.__init__`,
-            but this will be applied for this request only.
-          bool_fields: like the parameter of the same name from `ApiClient.__init__`,
-            but this will be applied for this request only.
-
-        Returns:
-          a [requests.Response][] as returned by requests
-
-        """
-        url = self.to_absolute_url(url)
-
-        if none_fields is None:
-            none_fields = self.none_fields
-
-        if none_fields == "exclude":
-            if isinstance(data, Mapping):
-                data = {key: val for key, val in data.items() if val is not None}
-            if isinstance(json, Mapping):
-                json = {key: val for key, val in json.items() if val is not None}
-        elif none_fields == "empty":
-            if isinstance(data, Mapping):
-                data = {key: val if val is not None else "" for key, val in data.items()}
-            if isinstance(json, Mapping):
-                json = {key: val if val is not None else "" for key, val in json.items()}
-
-        if bool_fields is None:
-            bool_fields = self.bool_fields
-
-        if bool_fields:
-            try:
-                true_value, false_value = bool_fields
-            except ValueError:
-                msg = "Invalid value for 'bool_fields'. Must be a 2 value tuple, with (true_value, false_value)."
-                raise ValueError(msg) from None
-            if isinstance(data, MutableMapping):
-                for key, val in data.items():
-                    if val is True:
-                        data[key] = true_value
-                    elif val is False:
-                        data[key] = false_value
-            if isinstance(params, MutableMapping):
-                for key, val in params.items():
-                    if val is True:
-                        params[key] = true_value
-                    elif val is False:
-                        params[key] = false_value
-
-        timeout = timeout or self.timeout
-
-        response = self.session.request(
-            method,
-            url,
-            params=params,
-            data=data,
-            headers=headers,
-            cookies=cookies,
-            files=files,
-            auth=auth or self.auth,
-            timeout=timeout,
-            allow_redirects=allow_redirects,
-            proxies=proxies,
-            hooks=hooks,
-            stream=stream,
-            verify=verify,
-            cert=cert,
-            json=json,
-        )
-
-        if raise_for_status is None:
-            raise_for_status = self.raise_for_status
-        if raise_for_status:
-            response.raise_for_status()
-        return response
-
-    def to_absolute_url(self, relative_url: None | str | bytes | Iterable[str | bytes | int] = None) -> str:
-        """Convert a relative url to an absolute url.
-
-        Given a `relative_url`, return the matching absolute url, based on the `base_url` that is
-        configured for this API.
-
-        The result of this method is different from a standard `urljoin()`, because a relative_url
-        that starts with a "/" will not override the path from the base url. You can also pass an
-        iterable of path parts as relative url, which will be properly joined with "/". Those parts
-        may be `str` (which will be urlencoded) or `bytes` (which will be decoded as UTF-8 first) or
-        any other type (which will be converted to `str` first, using the `str() function`). See the
-        table below for example results which would exhibit most cases:
-
-        | base_url | relative_url | result_url |
-        |---------------------------|-----------------------------|-------------------------------------------|
-        | "https://myhost.com/root" | "/path" | "https://myhost.com/root/path" |
-        | "https://myhost.com/root" | "/path" | "https://myhost.com/root/path" |
-        | "https://myhost.com/root" | b"/path" | "https://myhost.com/root/path" |
-        | "https://myhost.com/root" | "path" | "https://myhost.com/root/path" |
-        | "https://myhost.com/root" | None | "https://myhost.com/root" |
-        | "https://myhost.com/root" |  ("user", 1, "resource") | "https://myhost.com/root/user/1/resource" |
-        | "https://myhost.com/root" | "https://otherhost.org/foo" | ValueError |
-
-        Args:
-          relative_url: a relative url
-
-        Returns:
-          the resulting absolute url
-
-        """
-        url = relative_url
-
-        if self.base_url:
-            if url is not None:
-                if not isinstance(url, (str, bytes)):
-                    try:
-                        url = "/".join(
-                            [urlencode(part.decode() if isinstance(part, bytes) else str(part)) for part in url if part]
-                        )
-                    except Exception as exc:
-                        msg = (
-                            "Unexpected url type, please pass a relative path as string or"
-                            " bytes, or an iterable of string-able objects"
-                        )
-                        raise TypeError(
-                            msg,
-                            type(url),
-                        ) from exc
-
-                if isinstance(url, bytes):
-                    url = url.decode()
-
-                if "://" in url:
-                    msg = "url must be relative to root_url"
-                    raise ValueError(msg)
-
-                url = urljoin(self.base_url + "/", url.lstrip("/"))
-            else:
-                url = self.base_url
-
-        if url is None or not isinstance(url, str):
-            msg = "Unable to determine an absolute url."
-            raise ValueError(msg)
-
-        return url
-
-    def get(
-        self,
-        url: None | str | bytes | Iterable[str | bytes | int] = None,
-        raise_for_status: bool | None = None,
-        **kwargs: Any,
-    ) -> requests.Response:
-        """Send a GET request. Return a [Response][requests.Response] object.
-
-        The passed `url` may be relative to the url passed at initialization time. It takes the same
-        parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
-
-        Args:
-            url: a url where the request will be sent.
-            raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
-            **kwargs: Optional arguments that [request()][requests.request] takes.
-
-        Returns:
-            a [Response][requests.Response] object.
-
-        Raises:
-            requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
-
-        """
-        return self.request("GET", url, raise_for_status=raise_for_status, **kwargs)
-
-    def post(
-        self,
-        url: str | bytes | Iterable[str | bytes] | None = None,
-        raise_for_status: bool | None = None,
-        **kwargs: Any,
-    ) -> requests.Response:
-        """Send a POST request. Return a [Response][requests.Response] object.
-
-        The passed `url` may be relative to the url passed at initialization time. It takes the same
-        parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
-
-        Args:
-          url: an url where the request will be sent.
-          raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
-          **kwargs: Optional arguments that ``request`` takes.
-
-        Returns:
-          a [Response][requests.Response] object.
-
-        Raises:
-          requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
-
-        """
-        return self.request("POST", url, raise_for_status=raise_for_status, **kwargs)
-
-    def patch(
-        self,
-        url: str | bytes | Iterable[str | bytes] | None = None,
-        raise_for_status: bool | None = None,
-        **kwargs: Any,
-    ) -> requests.Response:
-        """Send a PATCH request. Return a [Response][requests.Response] object.
-
-        The passed `url` may be relative to the url passed at initialization time. It takes the same
-        parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
-
-        Args:
-          url: an url where the request will be sent.
-          raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
-          **kwargs: Optional arguments that ``request`` takes.
-
-        Returns:
-          a [Response][requests.Response] object.
-
-        Raises:
-          requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
-
-        """
-        return self.request("PATCH", url, raise_for_status=raise_for_status, **kwargs)
-
-    def put(
-        self,
-        url: str | bytes | Iterable[str | bytes] | None = None,
-        raise_for_status: bool | None = None,
-        **kwargs: Any,
-    ) -> requests.Response:
-        """Send a PUT request. Return a [Response][requests.Response] object.
 
-        The passed `url` may be relative to the url passed at initialization time. It takes the same
-        parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
-
-        Args:
-          url: a url where the request will be sent.
-          raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
-          **kwargs: additional kwargs for `requests.request()`
-
-        Returns:
-          a [Response][requests.Response] object.
-
-        Raises:
-          requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
-
-        """
-        return self.request("PUT", url, raise_for_status=raise_for_status, **kwargs)
-
-    def delete(
-        self,
-        url: str | bytes | Iterable[str | bytes] | None = None,
-        raise_for_status: bool | None = None,
-        **kwargs: Any,
-    ) -> requests.Response:
-        """Send a DELETE request. Return a [Response][requests.Response] object.
+  

 
-        The passed `url` may be relative to the url passed at initialization time. It takes the same
-        parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
-
-        Args:
-          url: a url where the request will be sent.
-          raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
-          **kwargs: additional kwargs for `requests.request()`.
 
-        Returns:
-          a [Response][requests.Response] object.
-
-        Raises:
-          requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
-
-        """
-        return self.request("DELETE", url, raise_for_status=raise_for_status, **kwargs)
-
-    def __getattr__(self, item: str) -> ApiClient:
-        """Allow access sub resources with an attribute-based syntax.
-
-        Args:
-            item: a subpath
-
-        Returns:
-            a new ApiClient initialised on the new base url
-
-        Usage:
-            ```python
-            from requests_oauth2client import ApiClient
-
-            api = ApiClient("https://myapi.local")
-            resource1 = api.resource1.get()  # GET https://myapi.local/resource1
-            resource2 = api.resource2.get()  # GET https://myapi.local/resource2
-            ```
-
-        """
-        return self[item]
-
-    def __getitem__(self, item: str) -> ApiClient:
-        """Allow access to sub resources with a subscription-based syntax.
-
-        Args:
-            item: a subpath
-
-        Returns:
-            a new ApiClient initialised on the new base url
-
-        Usage:
-            ```python
-            from requests_oauth2client import ApiClient
-
-            api = ApiClient("https://myapi.local")
-            resource1 = api["resource1"].get()  # GET https://myapi.local/resource1
-            resource2 = api["resource2"].get()  # GET https://myapi.local/resource2
-            ```
 
-        """
-        new_base_uri = self.to_absolute_url(item)
-        return ApiClient(
-            new_base_uri,
-            session=self.session,
-            none_fields=self.none_fields,
-            bool_fields=self.bool_fields,
-            timeout=self.timeout,
-            raise_for_status=self.raise_for_status,
-        )
-
-    def __enter__(self) -> ApiClient:
-        """Allow `ApiClient` to act as a context manager.
-
-        You can then use an `ApiClient` instance in a `with` clause, the same way as
-        `requests.Session`. The underlying request.Session will be closed on exit.
 
-        Usage:
-            ```python
-            with ApiClient("https://myapi.com/path") as client:
-                resp = client.get("resource")
-            ```
-
-        """
-        return self
 
-    def __exit__(self, *args: Any) -> None:
-        """Close the underlying requests.Session on exit."""
-        self.session.close()
-
-
- -
+
+
+
+
-
+

+ InvalidTokenResponse +

-
- request(method, url=None, *, params=None, data=None, headers=None, cookies=None, files=None, auth=None, timeout=None, allow_redirects=False, proxies=None, hooks=None, stream=None, verify=None, cert=None, json=None, raise_for_status=None, none_fields=None, bool_fields=None) -
+
+

+ Bases: OAuth2Error

-
- -

Overridden request method with extra features.

-

Features added compared to plain request():

-
    -
  • takes a relative path instead of a full url, which will be appended to the - base_url
    • -
  • it can raise an exception when the API returns a non-success status code
    • -
  • allow_redirects is False by default (since API usually don't use redirects)
    • -
  • data or json fields with value None can either be included or excluded from the - request
    • -
  • boolean fields can be serialized to 'true' or 'false' instead of 'True' and - 'False'
    • -
+

Raised when the Token Endpoint returns a non-standard response.

+
+ Source code in requests_oauth2client/exceptions.py + 
62
+63
class InvalidTokenResponse(OAuth2Error):
+    """Raised when the Token Endpoint returns a non-standard response."""
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
method - str - -
-

the HTTP method to use

-
- 		- required -
url - None | str | bytes | Iterable[str | bytes | int] - -
-

the url where the request will be sent to. Can be a path, as str ; -that path will be joined to the configured API url. Can also be an iterable of path -segments, that will be joined to the root url.

-
- 		- None -
raise_for_status - bool | None - -
-

like the parameter of the same name from ApiClient.__init__, -but this will be applied for this request only.

-
- 		- None -
none_fields - Literal['include', 'exclude', 'empty'] | None - -
-

like the parameter of the same name from ApiClient.__init__, -but this will be applied for this request only.

-
- 		- None -
bool_fields - tuple[Any, Any] | None - -
-

like the parameter of the same name from ApiClient.__init__, -but this will be applied for this request only.

-
- 		- None -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Response - -
-

a requests.Response as returned by requests

-
-
- -
- Source code in requests_oauth2client/api_client.py - 
120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
-141
-142
-143
-144
-145
-146
-147
-148
-149
-150
-151
-152
-153
-154
-155
-156
-157
-158
-159
-160
-161
-162
-163
-164
-165
-166
-167
-168
-169
-170
-171
-172
-173
-174
-175
-176
-177
-178
-179
-180
-181
-182
-183
-184
-185
-186
-187
-188
-189
-190
-191
-192
-193
-194
-195
-196
-197
-198
-199
-200
-201
-202
-203
-204
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
def request(  # noqa: C901, PLR0913, D417
-    self,
-    method: str,
-    url: None | str | bytes | Iterable[str | bytes | int] = None,
-    *,
-    params: None | bytes | MutableMapping[str, str] = None,
-    data: (
-        Iterable[bytes]
-        | str
-        | bytes
-        | list[tuple[Any, Any]]
-        | tuple[tuple[Any, Any], ...]
-        | Mapping[Any, Any]
-        | None
-    ) = None,
-    headers: MutableMapping[str, str] | None = None,
-    cookies: None | RequestsCookieJar | MutableMapping[str, str] = None,
-    files: MutableMapping[str, IO[Any]] | None = None,
-    auth: (
-        None
-        | tuple[str, str]
-        | requests.auth.AuthBase
-        | Callable[[requests.PreparedRequest], requests.PreparedRequest]
-    ) = None,
-    timeout: None | float | tuple[float, float] | tuple[float, None] = None,
-    allow_redirects: bool = False,
-    proxies: MutableMapping[str, str] | None = None,
-    hooks: None
-    | (
-        MutableMapping[
-            str,
-            (Iterable[Callable[[requests.Response], Any]] | Callable[[requests.Response], Any]),
-        ]
-    ) = None,
-    stream: bool | None = None,
-    verify: str | bool | None = None,
-    cert: str | tuple[str, str] | None = None,
-    json: Mapping[str, Any] | None = None,
-    raise_for_status: bool | None = None,
-    none_fields: Literal["include", "exclude", "empty"] | None = None,
-    bool_fields: tuple[Any, Any] | None = None,
-) -> requests.Response:
-    """Overridden `request` method with extra features.
-
-    Features added compared to plain request():
-
-    - takes a relative path instead of a full url, which will be appended to the
-      base_url
-    - it can raise an exception when the API returns a non-success status code
-    - allow_redirects is False by default (since API usually don't use redirects)
-    - `data` or `json` fields with value `None` can either be included or excluded from the
-      request
-    - boolean fields can be serialized to `'true'` or `'false'` instead of `'True'` and
-      `'False'`
-
-    Args:
-      method: the HTTP method to use
-      url: the url where the request will be sent to. Can be a path, as str ;
-        that path will be joined to the configured API url. Can also be an iterable of path
-        segments, that will be joined to the root url.
-      raise_for_status: like the parameter of the same name from `ApiClient.__init__`,
-        but this will be applied for this request only.
-      none_fields: like the parameter of the same name from `ApiClient.__init__`,
-        but this will be applied for this request only.
-      bool_fields: like the parameter of the same name from `ApiClient.__init__`,
-        but this will be applied for this request only.
-
-    Returns:
-      a [requests.Response][] as returned by requests
-
-    """
-    url = self.to_absolute_url(url)
-
-    if none_fields is None:
-        none_fields = self.none_fields
-
-    if none_fields == "exclude":
-        if isinstance(data, Mapping):
-            data = {key: val for key, val in data.items() if val is not None}
-        if isinstance(json, Mapping):
-            json = {key: val for key, val in json.items() if val is not None}
-    elif none_fields == "empty":
-        if isinstance(data, Mapping):
-            data = {key: val if val is not None else "" for key, val in data.items()}
-        if isinstance(json, Mapping):
-            json = {key: val if val is not None else "" for key, val in json.items()}
-
-    if bool_fields is None:
-        bool_fields = self.bool_fields
-
-    if bool_fields:
-        try:
-            true_value, false_value = bool_fields
-        except ValueError:
-            msg = "Invalid value for 'bool_fields'. Must be a 2 value tuple, with (true_value, false_value)."
-            raise ValueError(msg) from None
-        if isinstance(data, MutableMapping):
-            for key, val in data.items():
-                if val is True:
-                    data[key] = true_value
-                elif val is False:
-                    data[key] = false_value
-        if isinstance(params, MutableMapping):
-            for key, val in params.items():
-                if val is True:
-                    params[key] = true_value
-                elif val is False:
-                    params[key] = false_value
-
-    timeout = timeout or self.timeout
-
-    response = self.session.request(
-        method,
-        url,
-        params=params,
-        data=data,
-        headers=headers,
-        cookies=cookies,
-        files=files,
-        auth=auth or self.auth,
-        timeout=timeout,
-        allow_redirects=allow_redirects,
-        proxies=proxies,
-        hooks=hooks,
-        stream=stream,
-        verify=verify,
-        cert=cert,
-        json=json,
-    )
-
-    if raise_for_status is None:
-        raise_for_status = self.raise_for_status
-    if raise_for_status:
-        response.raise_for_status()
-    return response
-
-
-
-
+
-
-
- to_absolute_url(relative_url=None) -
-
- -

Convert a relative url to an absolute url.

-

Given a relative_url, return the matching absolute url, based on the base_url that is -configured for this API.

-

The result of this method is different from a standard urljoin(), because a relative_url -that starts with a "/" will not override the path from the base url. You can also pass an -iterable of path parts as relative url, which will be properly joined with "/". Those parts -may be str (which will be urlencoded) or bytes (which will be decoded as UTF-8 first) or -any other type (which will be converted to str first, using the str() function). See the -table below for example results which would exhibit most cases:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
base_urlrelative_urlresult_url
"https://myhost.com/root""/path""https://myhost.com/root/path"
"https://myhost.com/root""/path""https://myhost.com/root/path"
"https://myhost.com/root"b"/path""https://myhost.com/root/path"
"https://myhost.com/root""path""https://myhost.com/root/path"
"https://myhost.com/root"None"https://myhost.com/root"
"https://myhost.com/root"("user", 1, "resource")"https://myhost.com/root/user/1/resource"
"https://myhost.com/root""https://otherhost.org/foo"ValueError
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
relative_url - None | str | bytes | Iterable[str | bytes | int] - -
-

a relative url

-
- 		- None -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

the resulting absolute url

-
-
- -
- Source code in requests_oauth2client/api_client.py - 
256
-257
-258
-259
-260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
-293
-294
-295
-296
-297
-298
-299
-300
-301
-302
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320
def to_absolute_url(self, relative_url: None | str | bytes | Iterable[str | bytes | int] = None) -> str:
-    """Convert a relative url to an absolute url.
-
-    Given a `relative_url`, return the matching absolute url, based on the `base_url` that is
-    configured for this API.
-
-    The result of this method is different from a standard `urljoin()`, because a relative_url
-    that starts with a "/" will not override the path from the base url. You can also pass an
-    iterable of path parts as relative url, which will be properly joined with "/". Those parts
-    may be `str` (which will be urlencoded) or `bytes` (which will be decoded as UTF-8 first) or
-    any other type (which will be converted to `str` first, using the `str() function`). See the
-    table below for example results which would exhibit most cases:
-
-    | base_url | relative_url | result_url |
-    |---------------------------|-----------------------------|-------------------------------------------|
-    | "https://myhost.com/root" | "/path" | "https://myhost.com/root/path" |
-    | "https://myhost.com/root" | "/path" | "https://myhost.com/root/path" |
-    | "https://myhost.com/root" | b"/path" | "https://myhost.com/root/path" |
-    | "https://myhost.com/root" | "path" | "https://myhost.com/root/path" |
-    | "https://myhost.com/root" | None | "https://myhost.com/root" |
-    | "https://myhost.com/root" |  ("user", 1, "resource") | "https://myhost.com/root/user/1/resource" |
-    | "https://myhost.com/root" | "https://otherhost.org/foo" | ValueError |
-
-    Args:
-      relative_url: a relative url
-
-    Returns:
-      the resulting absolute url
-
-    """
-    url = relative_url
-
-    if self.base_url:
-        if url is not None:
-            if not isinstance(url, (str, bytes)):
-                try:
-                    url = "/".join(
-                        [urlencode(part.decode() if isinstance(part, bytes) else str(part)) for part in url if part]
-                    )
-                except Exception as exc:
-                    msg = (
-                        "Unexpected url type, please pass a relative path as string or"
-                        " bytes, or an iterable of string-able objects"
-                    )
-                    raise TypeError(
-                        msg,
-                        type(url),
-                    ) from exc
-
-            if isinstance(url, bytes):
-                url = url.decode()
-
-            if "://" in url:
-                msg = "url must be relative to root_url"
-                raise ValueError(msg)
-
-            url = urljoin(self.base_url + "/", url.lstrip("/"))
-        else:
-            url = self.base_url
-
-    if url is None or not isinstance(url, str):
-        msg = "Unable to determine an absolute url."
-        raise ValueError(msg)
-
-    return url
-
-
+
+
+
-
+

+ LoginRequired -

- get(url=None, raise_for_status=None, **kwargs) -
+ -
- -

Send a GET request. Return a Response object.

-

The passed url may be relative to the url passed at initialization time. It takes the same -parameters as ApiClient.request().

+
+

+ Bases: InteractionRequired

+

Raised when the Authorization Endpoint returns error = login_required.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
url - None | str | bytes | Iterable[str | bytes | int] - -
-

a url where the request will be sent.

-
- 		- None -
raise_for_status - bool | None - -
-

overrides the raises_for_status parameter passed at initialization time.

-
- 		- None -
**kwargs - Any - -
-

Optional arguments that request() takes.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Response - -
-

a Response object.

-
-
- - - -

Raises:

- - - - - - - - - - - - - -
TypeDescription
- HTTPError - -
-

if raises_for_status is True and an error response is returned.

-
-
- -
- Source code in requests_oauth2client/api_client.py - 
322
-323
-324
-325
-326
-327
-328
-329
-330
-331
-332
-333
-334
-335
-336
-337
-338
-339
-340
-341
-342
-343
-344
-345
def get(
-    self,
-    url: None | str | bytes | Iterable[str | bytes | int] = None,
-    raise_for_status: bool | None = None,
-    **kwargs: Any,
-) -> requests.Response:
-    """Send a GET request. Return a [Response][requests.Response] object.
-
-    The passed `url` may be relative to the url passed at initialization time. It takes the same
-    parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
-
-    Args:
-        url: a url where the request will be sent.
-        raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
-        **kwargs: Optional arguments that [request()][requests.request] takes.
-
-    Returns:
-        a [Response][requests.Response] object.
-
-    Raises:
-        requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
-
-    """
-    return self.request("GET", url, raise_for_status=raise_for_status, **kwargs)
-
-
-
+
+ Source code in requests_oauth2client/exceptions.py + 
174
+175
class LoginRequired(InteractionRequired):
+    """Raised when the Authorization Endpoint returns `error = login_required`."""
+
+
-
-
+
+ + -
- post(url=None, raise_for_status=None, **kwargs) -
-
- -

Send a POST request. Return a Response object.

-

The passed url may be relative to the url passed at initialization time. It takes the same -parameters as ApiClient.request().

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
url - str | bytes | Iterable[str | bytes] | None - -
-

an url where the request will be sent.

-
- 		- None -
raise_for_status - bool | None - -
-

overrides the raises_for_status parameter passed at initialization time.

-
- 		- None -
**kwargs - Any - -
-

Optional arguments that request takes.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Response - -
-

a Response object.

-
-
- - - -

Raises:

- - - - - - - - - - - - - -
TypeDescription
- HTTPError - -
-

if raises_for_status is True and an error response is returned.

-
-
- -
- Source code in requests_oauth2client/api_client.py - 
347
-348
-349
-350
-351
-352
-353
-354
-355
-356
-357
-358
-359
-360
-361
-362
-363
-364
-365
-366
-367
-368
-369
-370
def post(
-    self,
-    url: str | bytes | Iterable[str | bytes] | None = None,
-    raise_for_status: bool | None = None,
-    **kwargs: Any,
-) -> requests.Response:
-    """Send a POST request. Return a [Response][requests.Response] object.
-
-    The passed `url` may be relative to the url passed at initialization time. It takes the same
-    parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
-
-    Args:
-      url: an url where the request will be sent.
-      raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
-      **kwargs: Optional arguments that ``request`` takes.
-
-    Returns:
-      a [Response][requests.Response] object.
-
-    Raises:
-      requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
-
-    """
-    return self.request("POST", url, raise_for_status=raise_for_status, **kwargs)
-
-
+
+
+
-
+

+ MismatchingIssuer -

- patch(url=None, raise_for_status=None, **kwargs) -
+ -
- -

Send a PATCH request. Return a Response object.

-

The passed url may be relative to the url passed at initialization time. It takes the same -parameters as ApiClient.request().

+
+

+ Bases: InvalidAuthResponse

+

Raised on mismatching iss value.

+

This happens when the Authorization Endpoints returns an 'iss' that doesn't match the expected +value.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
url - str | bytes | Iterable[str | bytes] | None - -
-

an url where the request will be sent.

-
- 		- None -
raise_for_status - bool | None - -
-

overrides the raises_for_status parameter passed at initialization time.

-
- 		- None -
**kwargs - Any - -
-

Optional arguments that request takes.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Response - -
-

a Response object.

-
-
- - - -

Raises:

- - - - - - - - - - - - - -
TypeDescription
- HTTPError - -
-

if raises_for_status is True and an error response is returned.

-
-
- -
- Source code in requests_oauth2client/api_client.py - 
372
-373
-374
-375
-376
-377
-378
-379
-380
-381
-382
-383
-384
-385
-386
-387
-388
-389
-390
-391
-392
-393
-394
-395
def patch(
-    self,
-    url: str | bytes | Iterable[str | bytes] | None = None,
-    raise_for_status: bool | None = None,
-    **kwargs: Any,
-) -> requests.Response:
-    """Send a PATCH request. Return a [Response][requests.Response] object.
-
-    The passed `url` may be relative to the url passed at initialization time. It takes the same
-    parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
-
-    Args:
-      url: an url where the request will be sent.
-      raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
-      **kwargs: Optional arguments that ``request`` takes.
-
-    Returns:
-      a [Response][requests.Response] object.
-
-    Raises:
-      requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
-
-    """
-    return self.request("PATCH", url, raise_for_status=raise_for_status, **kwargs)
-
-
-
+
+ Source code in requests_oauth2client/exceptions.py + 
239
+240
+241
+242
+243
+244
+245
+246
+247
+248
+249
+250
class MismatchingIssuer(InvalidAuthResponse):
+    """Raised on mismatching `iss` value.
+
+    This happens when the Authorization Endpoints returns an 'iss' that doesn't match the expected
+    value.
+
+    """
+
+    def __init__(self, received: str, expected: str, request: AuthorizationRequest, response: str) -> None:
+        super().__init__(f"mismatching `iss` (received '{received}', expected '{expected}')", request, response)
+        self.received = received
+        self.expected = expected
+
+
-
-
+
+ + -
- put(url=None, raise_for_status=None, **kwargs) -
-
- -

Send a PUT request. Return a Response object.

-

The passed url may be relative to the url passed at initialization time. It takes the same -parameters as ApiClient.request().

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
url - str | bytes | Iterable[str | bytes] | None - -
-

a url where the request will be sent.

-
- 		- None -
raise_for_status - bool | None - -
-

overrides the raises_for_status parameter passed at initialization time.

-
- 		- None -
**kwargs - Any - -
-

additional kwargs for requests.request()

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Response - -
-

a Response object.

-
-
- - - -

Raises:

- - - - - - - - - - - - - -
TypeDescription
- HTTPError - -
-

if raises_for_status is True and an error response is returned.

-
-
- -
- Source code in requests_oauth2client/api_client.py - 
397
-398
-399
-400
-401
-402
-403
-404
-405
-406
-407
-408
-409
-410
-411
-412
-413
-414
-415
-416
-417
-418
-419
-420
def put(
-    self,
-    url: str | bytes | Iterable[str | bytes] | None = None,
-    raise_for_status: bool | None = None,
-    **kwargs: Any,
-) -> requests.Response:
-    """Send a PUT request. Return a [Response][requests.Response] object.
-
-    The passed `url` may be relative to the url passed at initialization time. It takes the same
-    parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
-
-    Args:
-      url: a url where the request will be sent.
-      raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
-      **kwargs: additional kwargs for `requests.request()`
-
-    Returns:
-      a [Response][requests.Response] object.
-
-    Raises:
-      requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
-
-    """
-    return self.request("PUT", url, raise_for_status=raise_for_status, **kwargs)
-
-
+
+
+
-
+

+ MismatchingState -

- delete(url=None, raise_for_status=None, **kwargs) -
+ -
- -

Send a DELETE request. Return a Response object.

-

The passed url may be relative to the url passed at initialization time. It takes the same -parameters as ApiClient.request().

+
+

+ Bases: InvalidAuthResponse

+

Raised on mismatching state value.

+

This happens when the Authorization Endpoints returns a 'state' parameter that doesn't match the +value passed in the Authorization Request.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
url - str | bytes | Iterable[str | bytes] | None - -
-

a url where the request will be sent.

-
- 		- None -
raise_for_status - bool | None - -
-

overrides the raises_for_status parameter passed at initialization time.

-
- 		- None -
**kwargs - Any - -
-

additional kwargs for requests.request().

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Response - -
-

a Response object.

-
-
- - - -

Raises:

- - - - - - - - - - - - - -
TypeDescription
- HTTPError - -
-

if raises_for_status is True and an error response is returned.

-
-
- -
- Source code in requests_oauth2client/api_client.py - 
422
-423
-424
-425
-426
-427
-428
-429
-430
-431
-432
-433
-434
-435
-436
-437
-438
-439
-440
-441
-442
-443
-444
-445
def delete(
-    self,
-    url: str | bytes | Iterable[str | bytes] | None = None,
-    raise_for_status: bool | None = None,
-    **kwargs: Any,
-) -> requests.Response:
-    """Send a DELETE request. Return a [Response][requests.Response] object.
-
-    The passed `url` may be relative to the url passed at initialization time. It takes the same
-    parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
-
-    Args:
-      url: a url where the request will be sent.
-      raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
-      **kwargs: additional kwargs for `requests.request()`.
-
-    Returns:
-      a [Response][requests.Response] object.
-
-    Raises:
-      requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
-
-    """
-    return self.request("DELETE", url, raise_for_status=raise_for_status, **kwargs)
-
-
-
+
+ Source code in requests_oauth2client/exceptions.py + 
225
+226
+227
+228
+229
+230
+231
+232
+233
+234
+235
+236
class MismatchingState(InvalidAuthResponse):
+    """Raised on mismatching `state` value.
+
+    This happens when the Authorization Endpoints returns a 'state' parameter that doesn't match the
+    value passed in the Authorization Request.
+
+    """
+
+    def __init__(self, received: str, expected: str, request: AuthorizationRequest, response: str) -> None:
+        super().__init__(f"mismatching `state` (received '{received}', expected '{expected}')", request, response)
+        self.received = received
+        self.expected = expected
+
+
-
+
-
-
-
-
-
-
-
+
+
+
-

- auth +
-

-
- -

This module contains requests-compatible Auth Handlers that implement OAuth 2.0.

+

+ MissingAuthCode - -
+

+
+

+ Bases: InvalidAuthResponse

+

Raised when the Authorization Endpoint does not return the mandatory code.

+

This happens when the Authorization Endpoint does not return an error, but does not return an +authorization code either.

+
+ Source code in requests_oauth2client/exceptions.py + 
199
+200
+201
+202
+203
+204
+205
+206
+207
+208
class MissingAuthCode(InvalidAuthResponse):
+    """Raised when the Authorization Endpoint does not return the mandatory `code`.
+
+    This happens when the Authorization Endpoint does not return an error, but does not return an
+    authorization `code` either.
+
+    """
+
+    def __init__(self, request: AuthorizationRequest, response: str) -> None:
+        super().__init__("missing `code` query parameter in response", request, response)
+
+
-
+
-

- BearerAuth -

-
-

- Bases: AuthBase

- -

An Auth Handler that includes a Bearer Token in API calls, as defined in RFC6750$2.1.

-

As a prerequisite to using this AuthBase, you have to obtain an access token manually. -You most likely don't want to do that by yourself, but instead use an instance of -OAuth2Client to do that for you. -See the others Auth Handlers in this module, which will automatically obtain -access tokens from an OAuth 2.x server.

-
- Usage - 
1
-2
auth = BearerAuth("my_access_token")
-resp = requests.get("https://my.api.local/resource", auth=auth)
-
-

The HTTP request will look like: -

1
-2
-3
GET /resource HTTP/1.1
-Host: my.api.local
-Authorization: Bearer my_access_token
-

-
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
token - str | BearerToken | None - -
-

a BearerToken or a string -to use as token for this Auth Handler. If None, this Auth Handler is a no-op.

-
- 		- None -
+
-
- Source code in requests_oauth2client/auth.py - 
 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
-100
class BearerAuth(requests.auth.AuthBase):
-    """An Auth Handler that includes a Bearer Token in API calls, as defined in [RFC6750$2.1].
-
-    As a prerequisite to using this `AuthBase`, you have to obtain an access token manually.
-    You most likely don't want to do that by yourself, but instead use an instance of
-    [OAuth2Client][requests_oauth2client.client.OAuth2Client] to do that for you.
-    See the others Auth Handlers in this module, which will automatically obtain
-    access tokens from an OAuth 2.x server.
-
-    [RFC6750$2.1]: https://datatracker.ietf.org/doc/html/rfc6750#section-2.1
-
-    Usage:
-        ```python
-        auth = BearerAuth("my_access_token")
-        resp = requests.get("https://my.api.local/resource", auth=auth)
-        ```
-
-        The HTTP request will look like:
-        ```
-        GET /resource HTTP/1.1
-        Host: my.api.local
-        Authorization: Bearer my_access_token
-        ```
-
-    Args:
-        token: a [BearerToken][requests_oauth2client.tokens.BearerToken] or a string
-            to use as token for this Auth Handler. If `None`, this Auth Handler is a no-op.
-
-    """
-
-    def __init__(self, token: str | BearerToken | None = None) -> None:
-        self.token = token  # type: ignore[assignment] # until https://github.com/python/mypy/issues/3004 is fixed
-
-    @property
-    def token(self) -> BearerToken | None:
-        """Return the [BearerToken] that is used for authorization against the API.
-
-        Returns:
-            the configured [BearerToken][requests_oauth2client.tokens.BearerToken] used with this
-            AuthHandler.
-
-        """
-        return self._token
-
-    @token.setter
-    def token(self, token: str | BearerToken | None) -> None:
-        """Change the access token used with this AuthHandler.
-
-        Accepts a [BearerToken][requests_oauth2client.tokens.BearerToken] or an access token as
-        `str`.
-
-        Args:
-            token: an access token to use for this Auth Handler
-
-        """
-        if token is not None and not isinstance(token, BearerToken):
-            token = BearerToken(token)
-        self._token = token
-
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        """Implement the usage of Bearer Tokens in requests.
-
-        This will add a properly formatted `Authorization: Bearer <token>` header in the request.
-
-        If the configured token is an instance of BearerToken with an expires_at attribute, raises
-        [ExpiredAccessToken][requests_oauth2client.exceptions.ExpiredAccessToken] once the access
-        token is expired.
-
-        Args:
-            request: a [PreparedRequest][requests.PreparedRequest]
-
-        Returns:
-            a [PreparedRequest][requests.PreparedRequest] with an Access Token added in
-            Authorization Header
-
-        """
-        if self.token is None:
-            return request
-        if self.token.is_expired():
-            raise ExpiredAccessToken(self.token)
-        request.headers["Authorization"] = self.token.authorization_header()
-        return request
-
-
+
- +
-
+
+

+ MissingIssuer +

-
+
+

+ Bases: InvalidAuthResponse

+

Raised when the Authorization Endpoint does not return an iss parameter as expected.

+

The Authorization Server advertises its support with a flag +authorization_response_iss_parameter_supported in its discovery document. If it is set to +true, it must include an iss parameter in its authorization responses, containing its issuer +identifier.

-
- token: BearerToken | None - - - property - writable - +
+ Source code in requests_oauth2client/exceptions.py + 
211
+212
+213
+214
+215
+216
+217
+218
+219
+220
+221
+222
class MissingIssuer(InvalidAuthResponse):
+    """Raised when the Authorization Endpoint does not return an `iss` parameter as expected.
+
+    The Authorization Server advertises its support with a flag
+    `authorization_response_iss_parameter_supported` in its discovery document. If it is set to
+    `true`, it must include an `iss` parameter in its authorization responses, containing its issuer
+    identifier.
+
+    """
+
+    def __init__(self, request: AuthorizationRequest, response: str) -> None:
+        super().__init__("missing `iss` query parameter in response", request, response)
+
+
-
-
- -

Return the [BearerToken] that is used for authorization against the API.

+
+ -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- BearerToken | None - -
-

the configured BearerToken used with this

-
-
- BearerToken | None - -
-

AuthHandler.

-
-
-
-
-
+
@@ -39108,196 +36294,103 @@
-

- BaseOAuth2RenewableTokenAuth +

+ OAuth2Error -

+ -
-

- Bases: BearerAuth

+
+

+ Bases: Exception

- -

Base class for BearerToken-based Auth Handlers, with an obtainable or renewable token.

-

In addition to adding a properly formatted Authorization header, this will obtain a new token -once the current token is expired. Expiration is detected based on the expires_in hint -returned by the AS. A configurable leeway, in number of seconds, will make sure that a new -token is obtained some seconds before the actual expiration is reached. This may help in -situations where the client, AS and RS have slightly offset clocks.

+

Base class for Exceptions raised when a backend endpoint returns an error.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +

Parameters:

+
NameTypeDescriptionDefault
client - OAuth2Client - -
-

an OAuth2Client

-
- 		- required -
token - None | BearerToken | str - -
-

an initial Access Token, if you have one already. In most cases, leave None.

-
- 		- None -
leeway - int - -
-

expiration leeway, in number of seconds

-
- 		- 20 -
token_kwargs - Any - -
-

additional kwargs to include in token requests

-
- 		- {} -
+ + + + + + - -
NameTypeDescriptionDefault
+ + + + response + + Response + + +
+

the HTTP response containing the error

+
+ + + required + + + + client + + + +
+

the OAuth2Client used to send the request

+
+ + + required + + + + + +
+ Source code in requests_oauth2client/exceptions.py + 
14
+15
+16
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
class OAuth2Error(Exception):
+    """Base class for Exceptions raised when a backend endpoint returns an error.
+
+    Args:
+        response: the HTTP response containing the error
+        client : the OAuth2Client used to send the request
+
+    """
+
+    def __init__(self, response: requests.Response, client: OAuth2Client) -> None:
+        super().__init__("The remote endpoint returned an error")
+        self.response = response
+        self.client = client
+
+    @property
+    def request(self) -> requests.PreparedRequest:
+        """The request leading to the error."""
+        return self.response.request
+
+
-
- Source code in requests_oauth2client/auth.py - 
103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
-141
-142
-143
-144
-145
-146
-147
-148
-149
class BaseOAuth2RenewableTokenAuth(BearerAuth):
-    """Base class for BearerToken-based Auth Handlers, with an obtainable or renewable token.
-
-    In addition to adding a properly formatted `Authorization` header, this will obtain a new token
-    once the current token is expired. Expiration is detected based on the `expires_in` hint
-    returned by the AS. A configurable `leeway`, in number of seconds, will make sure that a new
-    token is obtained some seconds before the actual expiration is reached. This may help in
-    situations where the client, AS and RS have slightly offset clocks.
-
-    Args:
-        client: an OAuth2Client
-        token: an initial Access Token, if you have one already. In most cases, leave `None`.
-        leeway: expiration leeway, in number of seconds
-        token_kwargs: additional kwargs to include in token requests
-
-    """
-
-    def __init__(
-        self,
-        client: OAuth2Client,
-        token: None | BearerToken | str = None,
-        leeway: int = 20,
-        **token_kwargs: Any,
-    ) -> None:
-        super().__init__(token)
-        self.client = client
-        self.leeway = leeway
-        self.token_kwargs = token_kwargs
-
-    @override
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        token = self.token
-        if token is None or token.is_expired(self.leeway):
-            self.renew_token()
-        return super().__call__(request)
-
-    def renew_token(self) -> None:
-        """Obtain a new Bearer Token.
-
-        Subclasses should implement this.
-
-        """
-        raise NotImplementedError
-
-    def forget_token(self) -> None:
-        """Forget the current token, forcing a renewal on the next HTTP request."""
-        self.token = None
-
-
-
@@ -39307,256 +36400,126 @@

-
+

+ request: requests.PreparedRequest + + property + +

+ + +
+ +

The request leading to the error.

+
+ +
-

- renew_token() -
-
- -

Obtain a new Bearer Token.

-

Subclasses should implement this.

-
- Source code in requests_oauth2client/auth.py - 
139
-140
-141
-142
-143
-144
-145
def renew_token(self) -> None:
-    """Obtain a new Bearer Token.
-
-    Subclasses should implement this.
-
-    """
-    raise NotImplementedError
-
-
+
+
+
-
+

+ RevocationError -

- forget_token() -
+ -
- -

Forget the current token, forcing a renewal on the next HTTP request.

+
+

+ Bases: EndpointError

-
- Source code in requests_oauth2client/auth.py - 
147
-148
-149
def forget_token(self) -> None:
-    """Forget the current token, forcing a renewal on the next HTTP request."""
-    self.token = None
-
-
-
-
+

Base class for Revocation Endpoint errors.

+
+ Source code in requests_oauth2client/exceptions.py + 
106
+107
class RevocationError(EndpointError):
+    """Base class for Revocation Endpoint errors."""
+
+
-
-
+
-
-
-

- OAuth2ClientCredentialsAuth -

-
-

- Bases: BaseOAuth2RenewableTokenAuth

- -

An Auth Handler for the Client Credentials grant.

-

This requests AuthBase automatically gets Access Tokens from an OAuth -2.0 Token Endpoint with the Client Credentials grant, and will get a new one once the current -one is expired.

+
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client - OAuth2Client - -
-

the OAuth2Client to use to obtain Access Tokens.

-
- 		- required -
**token_kwargs - Any - -
-

extra kw parameters to pass to the Token Endpoint. May include scope, resource, etc.

-
- 		- {} -
- -
- Usage - 
1
-2
-3
client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
-oauth2cc = OAuth2ClientCredentialsAuth(client, scope="my_scope")
-resp = requests.post("https://my.api.local/resource", auth=oauth2cc)
-
-
-
- Source code in requests_oauth2client/auth.py - 
152
-153
-154
-155
-156
-157
-158
-159
-160
-161
-162
-163
-164
-165
-166
-167
-168
-169
-170
-171
-172
-173
-174
-175
class OAuth2ClientCredentialsAuth(BaseOAuth2RenewableTokenAuth):
-    """An Auth Handler for the Client Credentials grant.
-
-    This [requests AuthBase][requests.auth.AuthBase] automatically gets Access Tokens from an OAuth
-    2.0 Token Endpoint with the Client Credentials grant, and will get a new one once the current
-    one is expired.
-
-    Args:
-        client: the [OAuth2Client][requests_oauth2client.client.OAuth2Client] to use to obtain Access Tokens.
-        **token_kwargs: extra kw parameters to pass to the Token Endpoint. May include `scope`, `resource`, etc.
-
-    Usage:
-        ```python
-        client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
-        oauth2cc = OAuth2ClientCredentialsAuth(client, scope="my_scope")
-        resp = requests.post("https://my.api.local/resource", auth=oauth2cc)
-        ```
-
-    """
-
-    @override
-    def renew_token(self) -> None:
-        """Obtain a new token for use within this Auth Handler."""
-        self.token = self.client.client_credentials(**self.token_kwargs)
-
-
+
- -
+

+ ServerError +

+
+

+ Bases: EndpointError

+

Raised when the token endpoint returns error = server_error.

+
+ Source code in requests_oauth2client/exceptions.py + 
70
+71
class ServerError(EndpointError):
+    """Raised when the token endpoint returns `error = server_error`."""
+
+
-
+
-
- renew_token() -
-
- -

Obtain a new token for use within this Auth Handler.

-
- Source code in requests_oauth2client/auth.py - 
172
-173
-174
-175
@override
-def renew_token(self) -> None:
-    """Obtain a new token for use within this Auth Handler."""
-    self.token = self.client.client_credentials(**self.token_kwargs)
-
-
-
-
-
+
@@ -39564,733 +36527,183 @@
- OAuth2AccessTokenAuth - - -
- +

+ SessionSelectionRequired -
-

- Bases: BaseOAuth2RenewableTokenAuth

- -

Authentication Handler for OAuth 2.0 Access Tokens and (optional) Refresh Tokens.

-

This Requests Auth handler implementation uses an access token as -Bearer token, and can automatically refresh it when expired, if a refresh token is available.

-

Token can be a simple str containing a raw access token value, or a -BearerToken that can contain a refresh_token. If a -refresh_token and an expiration date are available, this Auth Handler will automatically refresh -the access token once it is expired.

- - - -

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client - OAuth2Client - -
-

the OAuth2Client to use to refresh tokens.

-
- 		- required -
token - None | BearerToken | str - -
-

a access token that has been previously obtained

-
- 		- None -
**token_kwargs - Any - -
-

additional kwargs to pass to the token endpoint

-
- 		- {} -
- -
- Usage -

```python -client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret")) -token = BearerToken( - access_token="access_token", expires_in=600, refresh_token="refresh_token" -) # obtain a BearerToken any way you see fit, including a refresh token -oauth2at_auth = OAuth2ClientCredentialsAuth(client, token, scope="my_scope") -resp = requests.post("https://my.api.local/resource", auth=oauth2at_auth) -````

-
-
- Source code in requests_oauth2client/auth.py - 
178
-179
-180
-181
-182
-183
-184
-185
-186
-187
-188
-189
-190
-191
-192
-193
-194
-195
-196
-197
-198
-199
-200
-201
-202
-203
-204
-205
-206
-207
-208
-209
-210
class OAuth2AccessTokenAuth(BaseOAuth2RenewableTokenAuth):
-    """Authentication Handler for OAuth 2.0 Access Tokens and (optional) Refresh Tokens.
-
-    This [Requests Auth handler][requests.auth.AuthBase] implementation uses an access token as
-    Bearer token, and can automatically refresh it when expired, if a refresh token is available.
-
-    Token can be a simple `str` containing a raw access token value, or a
-    [BearerToken][requests_oauth2client.tokens.BearerToken] that can contain a refresh_token. If a
-    refresh_token and an expiration date are available, this Auth Handler will automatically refresh
-    the access token once it is expired.
-
-    Args:
-        client: the [OAuth2Client][requests_oauth2client.client.OAuth2Client] to use to refresh tokens.
-        token: a access token that has been previously obtained
-        **token_kwargs: additional kwargs to pass to the token endpoint
-
-    Usage:
-        ```python
-        client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
-        token = BearerToken(
-            access_token="access_token", expires_in=600, refresh_token="refresh_token"
-        )  # obtain a BearerToken any way you see fit, including a refresh token
-        oauth2at_auth = OAuth2ClientCredentialsAuth(client, token, scope="my_scope")
-        resp = requests.post("https://my.api.local/resource", auth=oauth2at_auth)
-        ````
-
-    """
-
-    @override
-    def renew_token(self) -> None:
-        """Obtain a new token, using the Refresh Token, if available."""
-        if self.token and self.token.refresh_token and self.client is not None:
-            self.token = self.client.refresh_token(refresh_token=self.token.refresh_token, **self.token_kwargs)
-
-
+

- -
+
+

+ Bases: InteractionRequired

+

Raised when the Authorization Endpoint returns error = session_selection_required.

+
+ Source code in requests_oauth2client/exceptions.py + 
182
+183
class SessionSelectionRequired(InteractionRequired):
+    """Raised when the Authorization Endpoint returns `error = session_selection_required`."""
+
+
+
-
-
- renew_token() -
-
- -

Obtain a new token, using the Refresh Token, if available.

-
- Source code in requests_oauth2client/auth.py - 
206
-207
-208
-209
-210
@override
-def renew_token(self) -> None:
-    """Obtain a new token, using the Refresh Token, if available."""
-    if self.token and self.token.refresh_token and self.client is not None:
-        self.token = self.client.refresh_token(refresh_token=self.token.refresh_token, **self.token_kwargs)
-
-
+
+
+
-
- -
+

+ SlowDown -

-
+ +
+

+ Bases: TokenEndpointError

-

- OAuth2AuthorizationCodeAuth +

Raised when the Token Endpoint returns error = slow_down.

-

+
+ Source code in requests_oauth2client/exceptions.py + 
130
+131
class SlowDown(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = slow_down`."""
+
+
-
-

- Bases: OAuth2AccessTokenAuth

- -

Authentication handler for the Authorization Code grant.

-

This Requests Auth handler implementation exchanges an Authorization -Code for an access token, then automatically refreshes it once it is expired.

+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client - OAuth2Client - -
-

the OAuth2Client to use to obtain Access Tokens.

-
- 		- required -
code - str | AuthorizationResponse - -
-

an Authorization Code that has been obtained from the AS.

-
- 		- required -
**token_kwargs - Any - -
-

additional kwargs to pass to the token endpoint

-
- 		- {} -
- -
- Usage -

```python -client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret")) -code = "my_code" # you must obtain this code yourself -resp = requests.post("https://my.api.local/resource", auth=OAuth2AuthorizationCodeAuth(client, code)) -````

-
-
- Source code in requests_oauth2client/auth.py - 
213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
-258
-259
-260
-261
-262
-263
-264
-265
-266
class OAuth2AuthorizationCodeAuth(OAuth2AccessTokenAuth):
-    """Authentication handler for the Authorization Code grant.
-
-    This [Requests Auth handler][requests.auth.AuthBase] implementation exchanges an Authorization
-    Code for an access token, then automatically refreshes it once it is expired.
-
-    Args:
-        client: the [OAuth2Client][requests_oauth2client.client.OAuth2Client] to use to obtain Access Tokens.
-        code: an Authorization Code that has been obtained from the AS.
-        **token_kwargs: additional kwargs to pass to the token endpoint
-
-    Usage:
-        ```python
-        client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
-        code = "my_code"  # you must obtain this code yourself
-        resp = requests.post("https://my.api.local/resource", auth=OAuth2AuthorizationCodeAuth(client, code))
-        ````
-
-    """
-
-    def __init__(
-        self,
-        client: OAuth2Client,
-        code: str | AuthorizationResponse,
-        leeway: int = 20,
-        **token_kwargs: Any,
-    ) -> None:
-        super().__init__(client, token=None, leeway=leeway, **token_kwargs)
-        self.code: str | AuthorizationResponse | None = code
-
-    @override
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        """Implement the Authorization Code grant as an Authentication Handler.
-
-        This exchanges an Authorization Code for an access token and adds it in the request.
-
-        Args:
-            request: a [PreparedRequest][requests.PreparedRequest]
-
-        Returns:
-            a [PreparedRequest][requests.PreparedRequest] with an Access Token added in
-            Authorization Header
-
-        """
-        token = self.token
-        if token is None or token.is_expired():
-            self.exchange_code_for_token()
-        return super().__call__(request)
-
-    def exchange_code_for_token(self) -> None:
-        """Obtain the initial access token with the authorization_code grant."""
-        if self.code:  # pragma: no branch
-            self.token = self.client.authorization_code(code=self.code, **self.token_kwargs)
-            self.code = None
-
-
- -
+
+
+
+
-
+

+ TokenEndpointError -

- exchange_code_for_token() -
+ -
- -

Obtain the initial access token with the authorization_code grant.

+
+

+ Bases: EndpointError

-
- Source code in requests_oauth2client/auth.py - 
262
-263
-264
-265
-266
def exchange_code_for_token(self) -> None:
-    """Obtain the initial access token with the authorization_code grant."""
-    if self.code:  # pragma: no branch
-        self.token = self.client.authorization_code(code=self.code, **self.token_kwargs)
-        self.code = None
-
-
-
-
+

Base class for errors that are specific to the token endpoint.

+
+ Source code in requests_oauth2client/exceptions.py + 
74
+75
class TokenEndpointError(EndpointError):
+    """Base class for errors that are specific to the token endpoint."""
+
+
-
-
+
-
-
-

- OAuth2ResourceOwnerPasswordAuth -

-
-

- Bases: BaseOAuth2RenewableTokenAuth

- -

Authentication Handler for the Resource Owner Password Flow.

-

This Requests Auth handler implementation exchanges the user -credentials for an Access Token, then automatically obtains a new one once it is expired.

-

Note that this flow is considered deprecated, and the Authorization Code flow should be -used whenever possible. Among other bad things, ROPC does not support SSO nor MFA and -depends on the user typing its credentials directly inside the application instead of on a -dedicated login page, which makes it totally insecure for 3rd party apps.

-

It needs the username and password and an -OAuth2Client to be able to get a token from -the AS Token Endpoint just before the first request using this Auth Handler is being sent.

+
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client - OAuth2Client - -
-

the OAuth2Client to use to obtain -Access Tokens

-
- 		- required -
username - str - -
-

the username

-
- 		- required -
password - str - -
-

the user password

-
- 		- required -
leeway - int - -
-

an amount of time, in seconds

-
- 		- 20 -
**token_kwargs - Any - -
-

additional kwargs to pass to the token endpoint

-
- 		- {} -
+
-
- Source code in requests_oauth2client/auth.py - 
269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
-293
-294
-295
-296
-297
-298
-299
-300
-301
-302
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312
-313
class OAuth2ResourceOwnerPasswordAuth(BaseOAuth2RenewableTokenAuth):
-    """Authentication Handler for the [Resource Owner Password Flow](https://www.rfc-editor.org/rfc/rfc6749#section-4.3).
-
-    This [Requests Auth handler][requests.auth.AuthBase] implementation exchanges the user
-    credentials for an Access Token, then automatically obtains a new one once it is expired.
-
-    Note that this flow is considered *deprecated*, and the Authorization Code flow should be
-    used whenever possible. Among other bad things, ROPC does not support SSO nor MFA and
-    depends on the user typing its credentials directly inside the application instead of on a
-    dedicated login page, which makes it totally insecure for 3rd party apps.
-
-    It needs the username and password and an
-    [OAuth2Client][requests_oauth2client.client.OAuth2Client] to be able to get a token from
-    the AS Token Endpoint just before the first request using this Auth Handler is being sent.
-
-    Args:
-        client: the [OAuth2Client][requests_oauth2client.client.OAuth2Client] to use to obtain
-            Access Tokens
-        username: the username
-        password: the user password
-        leeway: an amount of time, in seconds
-        **token_kwargs: additional kwargs to pass to the token endpoint
-
-    """
-
-    def __init__(
-        self,
-        client: OAuth2Client,
-        username: str,
-        password: str,
-        leeway: int = 20,
-        **token_kwargs: Any,
-    ):
-        super().__init__(client=client, leeway=leeway, **token_kwargs)
-        self.username = username
-        self.password = password
-
-    @override
-    def renew_token(self) -> None:
-        """Exchange the user credentials for an Access Token."""
-        self.token = self.client.resource_owner_password(
-            username=self.username,
-            password=self.password,
-            **self.token_kwargs,
-        )
-
-
- -
+

+ UnauthorizedClient +

+
+

+ Bases: EndpointError

+

Raised when the Authorization Server returns error = unauthorized_client.

+
+ Source code in requests_oauth2client/exceptions.py + 
102
+103
class UnauthorizedClient(EndpointError):
+    """Raised when the Authorization Server returns `error = unauthorized_client`."""
+
+
-
+
-
- renew_token() -
-
- -

Exchange the user credentials for an Access Token.

- -
- Source code in requests_oauth2client/auth.py - 
306
-307
-308
-309
-310
-311
-312
-313
@override
-def renew_token(self) -> None:
-    """Exchange the user credentials for an Access Token."""
-    self.token = self.client.resource_owner_password(
-        username=self.username,
-        password=self.password,
-        **self.token_kwargs,
-    )
-
-
-
-
-
+
@@ -40298,275 +36711,29 @@
- OAuth2DeviceCodeAuth +

+ UnknownIntrospectionError -

+ -
-

- Bases: OAuth2AccessTokenAuth

+
+

+ Bases: OAuth2Error

- -

Authentication Handler for the Device Code Flow.

-

This Requests Auth handler implementation exchanges a Device Code for -an Access Token, then automatically refreshes it once it is expired.

-

It needs a Device Code and an OAuth2Client to be -able to get a token from the AS Token Endpoint just before the first request using this Auth -Handler is being sent.

+

Raised when the Introspection Endpoint returns a non-standard error.

+
+ Source code in requests_oauth2client/exceptions.py + 
118
+119
class UnknownIntrospectionError(OAuth2Error):
+    """Raised when the Introspection Endpoint returns a non-standard error."""
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client - OAuth2Client - -
-

the OAuth2Client to use to obtain Access Tokens.

-
- 		- required -
device_code - str | DeviceAuthorizationResponse - -
-

a Device Code obtained from the AS.

-
- 		- required -
interval - int - -
-

the interval to use to pool the Token Endpoint, in seconds.

-
- 		- 5 -
expires_in - int - -
-

the lifetime of the token, in seconds.

-
- 		- 360 -
**token_kwargs - Any - -
-

additional kwargs to pass to the token endpoint.

-
- 		- {} -
- -
- Usage -

```python -client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret")) -device_code = client.device_authorization() -auth = OAuth2DeviceCodeAuth(client, device_code) -resp = requests.post("https://my.api.local/resource", auth=auth) -````

-
-
- Source code in requests_oauth2client/auth.py - 
316
-317
-318
-319
-320
-321
-322
-323
-324
-325
-326
-327
-328
-329
-330
-331
-332
-333
-334
-335
-336
-337
-338
-339
-340
-341
-342
-343
-344
-345
-346
-347
-348
-349
-350
-351
-352
-353
-354
-355
-356
-357
-358
-359
-360
-361
-362
-363
-364
-365
-366
-367
-368
-369
-370
-371
-372
-373
-374
-375
-376
-377
-378
-379
-380
-381
-382
-383
-384
-385
-386
-387
-388
-389
-390
class OAuth2DeviceCodeAuth(OAuth2AccessTokenAuth):
-    """Authentication Handler for the [Device Code Flow](https://www.rfc-editor.org/rfc/rfc8628).
-
-    This [Requests Auth handler][requests.auth.AuthBase] implementation exchanges a Device Code for
-    an Access Token, then automatically refreshes it once it is expired.
-
-    It needs a Device Code and an [OAuth2Client][requests_oauth2client.client.OAuth2Client] to be
-    able to get a token from the AS Token Endpoint just before the first request using this Auth
-    Handler is being sent.
-
-    Args:
-        client: the [OAuth2Client][requests_oauth2client.client.OAuth2Client] to use to obtain Access Tokens.
-        device_code: a Device Code obtained from the AS.
-        interval: the interval to use to pool the Token Endpoint, in seconds.
-        expires_in: the lifetime of the token, in seconds.
-        **token_kwargs: additional kwargs to pass to the token endpoint.
-
-    Usage:
-        ```python
-        client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
-        device_code = client.device_authorization()
-        auth = OAuth2DeviceCodeAuth(client, device_code)
-        resp = requests.post("https://my.api.local/resource", auth=auth)
-        ````
-    """
-
-    def __init__(
-        self,
-        client: OAuth2Client,
-        device_code: str | DeviceAuthorizationResponse,
-        leeway: int = 20,
-        interval: int = 5,
-        expires_in: int = 360,
-        **token_kwargs: Any,
-    ) -> None:
-        super().__init__(client=client, leeway=leeway, token=None, **token_kwargs)
-        self.device_code: str | DeviceAuthorizationResponse | None = device_code
-        self.interval = interval
-        self.expires_in = expires_in
-
-    @override
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        """Implement the Device Code grant as a request Authentication Handler.
-
-        This exchanges a Device Code for an access token and adds it in HTTP requests.
-
-        Args:
-            request: a [requests.PreparedRequest][]
-
-        Returns:
-            a [requests.PreparedRequest][] with an Access Token added in Authorization Header
-
-        """
-        token = self.token
-        if token is None or token.is_expired():
-            self.exchange_device_code_for_token()
-        return super().__call__(request)
-
-    def exchange_device_code_for_token(self) -> None:
-        """Exchange the Device Code for an access token.
-
-        This will poll the Token Endpoint until the user finishes the authorization process.
-
-        """
-        from .device_authorization import DeviceAuthorizationPoolingJob
-
-        if self.device_code:  # pragma: no branch
-            pooling_job = DeviceAuthorizationPoolingJob(
-                client=self.client,
-                device_code=self.device_code,
-                interval=self.interval,
-            )
-            while self.token is None:
-                self.token = pooling_job()
-            self.device_code = None
-
-
-
@@ -40579,287 +36746,92 @@

+

+
-
- exchange_device_code_for_token() +
- +
-
- -

Exchange the Device Code for an access token.

-

This will poll the Token Endpoint until the user finishes the authorization process.

-
- Source code in requests_oauth2client/auth.py - 
374
-375
-376
-377
-378
-379
-380
-381
-382
-383
-384
-385
-386
-387
-388
-389
-390
def exchange_device_code_for_token(self) -> None:
-    """Exchange the Device Code for an access token.
-
-    This will poll the Token Endpoint until the user finishes the authorization process.
-
-    """
-    from .device_authorization import DeviceAuthorizationPoolingJob
-
-    if self.device_code:  # pragma: no branch
-        pooling_job = DeviceAuthorizationPoolingJob(
-            client=self.client,
-            device_code=self.device_code,
-            interval=self.interval,
-        )
-        while self.token is None:
-            self.token = pooling_job()
-        self.device_code = None
-
-
-
+

+ UnknownTokenEndpointError -

+ -
+
+

+ Bases: EndpointError

-
+

Raised when an otherwise unknown error is returned by the token endpoint.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
66
+67
class UnknownTokenEndpointError(EndpointError):
+    """Raised when an otherwise unknown error is returned by the token endpoint."""
+
+
+
-
-
-
-
-

- authorization_request -

-
- -

Classes and utilities related to Authorization Requests and Responses.

- +
-
+
+
+
+

+ UnsupportedTokenType +

-
+
+

+ Bases: RevocationError

-

- PkceUtils +

Raised when the Revocation endpoint returns error = unsupported_token_type.

+
+ Source code in requests_oauth2client/exceptions.py + 
110
+111
class UnsupportedTokenType(RevocationError):
+    """Raised when the Revocation endpoint returns `error = unsupported_token_type`."""
+
+
-

-
+
- -

Contains helper methods for PKCE, as described in RFC7636.

-

See RFC7636.

-
- Source code in requests_oauth2client/authorization_request.py - 
 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
class PkceUtils:
-    """Contains helper methods for PKCE, as described in RFC7636.
-
-    See [RFC7636](https://tools.ietf.org/html/rfc7636).
-
-    """
-
-    code_verifier_re = re.compile(r"^[a-zA-Z0-9_\-~.]{43,128}$")
-    """A regex that matches valid code verifiers."""
-
-    @classmethod
-    def generate_code_verifier(cls) -> str:
-        """Generate a valid `code_verifier`.
-
-        Returns:
-            a `code_verifier` ready to use for PKCE
-
-        """
-        return secrets.token_urlsafe(96)
-
-    @classmethod
-    def derive_challenge(cls, verifier: str | bytes, method: str = "S256") -> str:
-        """Derive the `code_challenge` from a given `code_verifier`.
-
-        Args:
-            verifier: a code verifier
-            method: the method to use for deriving the challenge. Accepts 'S256' or 'plain'.
-
-        Returns:
-            a `code_challenge` derived from the given verifier
-
-        """
-        if isinstance(verifier, bytes):
-            verifier = verifier.decode()
-
-        if not cls.code_verifier_re.match(verifier):
-            msg = f"Invalid code verifier, does not match {cls.code_verifier_re}"
-            raise ValueError(
-                msg,
-                verifier,
-            )
-
-        if method == "S256":
-            return BinaPy(verifier).to("sha256").to("b64u").ascii()
-        elif method == "plain":
-            return verifier
-        else:
-            msg = "Unsupported code_challenge_method"
-            raise ValueError(msg, method)
-
-    @classmethod
-    def generate_code_verifier_and_challenge(cls, method: str = "S256") -> tuple[str, str]:
-        """Generate a valid `code_verifier` and derive its `code_challenge`.
-
-        Args:
-            method: the method to use for deriving the challenge. Accepts 'S256' or 'plain'.
-
-        Returns:
-            a `(code_verifier, code_challenge)` tuple.
-
-        """
-        verifier = cls.generate_code_verifier()
-        challenge = cls.derive_challenge(verifier, method)
-        return verifier, challenge
-
-    @classmethod
-    def validate_code_verifier(cls, verifier: str, challenge: str, method: str = "S256") -> bool:
-        """Validate a `code_verifier` against a `code_challenge`.
-
-        Args:
-            verifier: the `code_verifier`, exactly as submitted by the client on token request.
-            challenge: the `code_challenge`, exactly as submitted by the client on authorization request.
-            method: the method to use for deriving the challenge. Accepts 'S256' or 'plain'.
-
-        Returns:
-            `True` if verifier is valid, or `False` otherwise
-
-        """
-        return cls.code_verifier_re.match(verifier) is not None and cls.derive_challenge(verifier, method) == challenge
-
-
- -
@@ -40867,491 +36839,381 @@

+

+
+
-
- code_verifier_re = re.compile('^[a-zA-Z0-9_\\-~.]{43,128}$') - - - class-attribute - instance-attribute - +
-
-
- -

A regex that matches valid code verifiers.

-
+

+ BaseTokenEndpointPoolingJob -

+ +
-
+

Base class for Token Endpoint pooling jobs.

+

This is used for decoupled flows like CIBA or Device Authorization.

+

This class must be subclassed to implement actual BackChannel flows. This needs an +OAuth2Client that will be used to pool the token +endpoint. The initial pooling interval is configurable.

+
+ Source code in requests_oauth2client/pooling.py + 
17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
+69
+70
+71
+72
+73
+74
+75
+76
+77
+78
+79
+80
+81
+82
+83
+84
+85
+86
+87
+88
+89
+90
+91
+92
+93
+94
+95
+96
@define
+class BaseTokenEndpointPoolingJob:
+    """Base class for Token Endpoint pooling jobs.
+
+    This is used for decoupled flows like CIBA or Device Authorization.
+
+    This class must be subclassed to implement actual BackChannel flows. This needs an
+    [OAuth2Client][requests_oauth2client.client.OAuth2Client] that will be used to pool the token
+    endpoint. The initial pooling `interval` is configurable.
+
+    """
+
+    client: OAuth2Client
+    requests_kwargs: dict[str, Any]
+    token_kwargs: dict[str, Any]
+    interval: int
+    slow_down_interval: int
+
+    def __call__(self) -> BearerToken | None:
+        """Wrap the actual Token Endpoint call with a pooling interval.
+
+        Everytime this method is called, it will wait for the entire duration of the pooling
+        interval before calling
+        [token_request()][requests_oauth2client.pooling.TokenEndpointPoolingJob.token_request]. So
+        you can call it immediately after initiating the BackChannel flow, and it will wait before
+        initiating the first call.
+
+        This implements the logic to handle
+        [AuthorizationPending][requests_oauth2client.exceptions.AuthorizationPending] or
+        [SlowDown][requests_oauth2client.exceptions.SlowDown] requests by the AS.
+
+        Returns:
+            a `BearerToken` if the AS returns one, or `None` if the Authorization is still pending.
+
+        """
+        self.sleep()
+        try:
+            return self.token_request()
+        except SlowDown:
+            self.slow_down()
+        except AuthorizationPending:
+            self.authorization_pending()
+        return None
+
+    def sleep(self) -> None:
+        """Implement the wait between two requests of the token endpoint.
+
+        By default, relies on time.sleep().
+
+        """
+        time.sleep(self.interval)
+
+    def slow_down(self) -> None:
+        """Implement the behavior when receiving a 'slow_down' response from the AS.
+
+        By default, it increases the pooling interval by the slow down interval.
+
+        """
+        self.interval += self.slow_down_interval
+
+    def authorization_pending(self) -> None:
+        """Implement the behavior when receiving an 'authorization_pending' response from the AS.
+
+        By default, it does nothing.
+
+        """
+
+    def token_request(self) -> BearerToken:
+        """Abstract method for the token endpoint call.
+
+        Subclasses must implement this. This method must raise
+        [AuthorizationPending][requests_oauth2client.exceptions.AuthorizationPending] to retry after
+        the pooling interval, or [SlowDown][requests_oauth2client.exceptions.SlowDown] to increase
+        the pooling interval by `slow_down_interval` seconds.
+
+        Returns:
+            a [BearerToken][requests_oauth2client.tokens.BearerToken]
+
+        """
+        raise NotImplementedError
+
+
-
- generate_code_verifier() - - - classmethod - -
+
-
- -

Generate a valid code_verifier.

-

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

a code_verifier ready to use for PKCE

-
-
- -
- Source code in requests_oauth2client/authorization_request.py - 
40
-41
-42
-43
-44
-45
-46
-47
-48
@classmethod
-def generate_code_verifier(cls) -> str:
-    """Generate a valid `code_verifier`.
-
-    Returns:
-        a `code_verifier` ready to use for PKCE
-
-    """
-    return secrets.token_urlsafe(96)
-
-
-
-
-
+
-
- derive_challenge(verifier, method='S256') - - - classmethod - -
+

+ sleep() +

-
- -

Derive the code_challenge from a given code_verifier.

+
+

Implement the wait between two requests of the token endpoint.

+

By default, relies on time.sleep().

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
verifier - str | bytes - -
-

a code verifier

-
- 		- required -
method - str - -
-

the method to use for deriving the challenge. Accepts 'S256' or 'plain'.

-
- 		- 'S256' -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

a code_challenge derived from the given verifier

-
-
- -
- Source code in requests_oauth2client/authorization_request.py - 
50
-51
-52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
-76
-77
-78
@classmethod
-def derive_challenge(cls, verifier: str | bytes, method: str = "S256") -> str:
-    """Derive the `code_challenge` from a given `code_verifier`.
-
-    Args:
-        verifier: a code verifier
-        method: the method to use for deriving the challenge. Accepts 'S256' or 'plain'.
-
-    Returns:
-        a `code_challenge` derived from the given verifier
-
-    """
-    if isinstance(verifier, bytes):
-        verifier = verifier.decode()
-
-    if not cls.code_verifier_re.match(verifier):
-        msg = f"Invalid code verifier, does not match {cls.code_verifier_re}"
-        raise ValueError(
-            msg,
-            verifier,
-        )
-
-    if method == "S256":
-        return BinaPy(verifier).to("sha256").to("b64u").ascii()
-    elif method == "plain":
-        return verifier
-    else:
-        msg = "Unsupported code_challenge_method"
-        raise ValueError(msg, method)
-
-
-
+
+ Source code in requests_oauth2client/pooling.py + 
61
+62
+63
+64
+65
+66
+67
def sleep(self) -> None:
+    """Implement the wait between two requests of the token endpoint.
+
+    By default, relies on time.sleep().
+
+    """
+    time.sleep(self.interval)
+
+
+
-
+

+ slow_down() -

- generate_code_verifier_and_challenge(method='S256') - - - classmethod - +
- +
-
- -

Generate a valid code_verifier and derive its code_challenge.

+

Implement the behavior when receiving a 'slow_down' response from the AS.

+

By default, it increases the pooling interval by the slow down interval.

+ +
+ Source code in requests_oauth2client/pooling.py + 
69
+70
+71
+72
+73
+74
+75
def slow_down(self) -> None:
+    """Implement the behavior when receiving a 'slow_down' response from the AS.
+
+    By default, it increases the pooling interval by the slow down interval.
+
+    """
+    self.interval += self.slow_down_interval
+
+
+
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
method - str - -
-

the method to use for deriving the challenge. Accepts 'S256' or 'plain'.

-
- 		- 'S256' -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- tuple[str, str] - -
-

a (code_verifier, code_challenge) tuple.

-
-
- -
- Source code in requests_oauth2client/authorization_request.py - 
80
-81
-82
-83
-84
-85
-86
-87
-88
-89
-90
-91
-92
-93
@classmethod
-def generate_code_verifier_and_challenge(cls, method: str = "S256") -> tuple[str, str]:
-    """Generate a valid `code_verifier` and derive its `code_challenge`.
-
-    Args:
-        method: the method to use for deriving the challenge. Accepts 'S256' or 'plain'.
-
-    Returns:
-        a `(code_verifier, code_challenge)` tuple.
-
-    """
-    verifier = cls.generate_code_verifier()
-    challenge = cls.derive_challenge(verifier, method)
-    return verifier, challenge
-
-
-
-
+

+ authorization_pending() + +

+ + +
+ +

Implement the behavior when receiving an 'authorization_pending' response from the AS.

+

By default, it does nothing.

+ +
+ Source code in requests_oauth2client/pooling.py + 
77
+78
+79
+80
+81
+82
def authorization_pending(self) -> None:
+    """Implement the behavior when receiving an 'authorization_pending' response from the AS.
+
+    By default, it does nothing.
+
+    """
+
+
+
+
+

+ token_request() -

- validate_code_verifier(verifier, challenge, method='S256') - - - classmethod - +
- +
-
- -

Validate a code_verifier against a code_challenge.

+

Abstract method for the token endpoint call.

+

Subclasses must implement this. This method must raise +AuthorizationPending to retry after +the pooling interval, or SlowDown to increase +the pooling interval by slow_down_interval seconds.

+

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
verifier - str - -
-

the code_verifier, exactly as submitted by the client on token request.

-
- 		- required -
challenge - str - -
-

the code_challenge, exactly as submitted by the client on authorization request.

-
- 		- required -
method - str - -
-

the method to use for deriving the challenge. Accepts 'S256' or 'plain'.

-
- 		- 'S256' -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- bool - -
-

True if verifier is valid, or False otherwise

-
-
- -
- Source code in requests_oauth2client/authorization_request.py - 
 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
@classmethod
-def validate_code_verifier(cls, verifier: str, challenge: str, method: str = "S256") -> bool:
-    """Validate a `code_verifier` against a `code_challenge`.
-
-    Args:
-        verifier: the `code_verifier`, exactly as submitted by the client on token request.
-        challenge: the `code_challenge`, exactly as submitted by the client on authorization request.
-        method: the method to use for deriving the challenge. Accepts 'S256' or 'plain'.
-
-    Returns:
-        `True` if verifier is valid, or `False` otherwise
-
-    """
-    return cls.code_verifier_re.match(verifier) is not None and cls.derive_challenge(verifier, method) == challenge
-
-
-
+
+ Source code in requests_oauth2client/pooling.py + 
84
+85
+86
+87
+88
+89
+90
+91
+92
+93
+94
+95
+96
def token_request(self) -> BearerToken:
+    """Abstract method for the token endpoint call.
+
+    Subclasses must implement this. This method must raise
+    [AuthorizationPending][requests_oauth2client.exceptions.AuthorizationPending] to retry after
+    the pooling interval, or [SlowDown][requests_oauth2client.exceptions.SlowDown] to increase
+    the pooling interval by `slow_down_interval` seconds.
+
+    Returns:
+        a [BearerToken][requests_oauth2client.tokens.BearerToken]
+
+    """
+    raise NotImplementedError
+
+
+
@@ -41359,8 +37221,7 @@
- CodeChallengeMethods +

+ BearerToken -

+ -
-

- Bases: str, Enum

+
+

+ Bases: TokenResponse, AuthBase

- -

PKCE Code Challenge Methods.

-
- Source code in requests_oauth2client/authorization_request.py - 
111
-112
-113
-114
-115
class CodeChallengeMethods(str, Enum):
-    """PKCE Code Challenge Methods."""
-
-    plain = "plain"
-    S256 = "S256"
-
-
+

Represents a Bearer Token as returned by a Token Endpoint.

+

This is a wrapper around a Bearer Token and associated parameters, such as expiration date and +refresh token, as returned by an OAuth 2.x or OIDC 1.0 Token Endpoint.

+

All parameters are as returned by a Token Endpoint. The token expiration date can be passed as +datetime in the expires_at parameter, or an expires_in parameter, as number of seconds in +the future, can be passed instead.

- -
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
access_token + str + +
+

an access_token, as returned by the AS.

+
+ 		+ required +
expires_at + datetime | None + +
+

an expiration date. This method also accepts an expires_in hint as +returned by the AS, if any.

+
+ 		+ None +
scope + str | None + +
+

a scope, as returned by the AS, if any.

+
+ 		+ None +
refresh_token + str | None + +
+

a refresh_token, as returned by the AS, if any.

+
+ 		+ None +
token_type + str + +
+

a token_type, as returned by the AS.

+
+ 		+ TOKEN_TYPE +
id_token + str | bytes | IdToken | JweCompact | None + +
+

an id_token, as returned by the AS, if any.

+
+ 		+ None +
**kwargs + Any + +
+

additional parameters as returned by the AS, if any.

+
+ 		+ {} +
+ +
+ Source code in requests_oauth2client/tokens.py + 
227
+228
+229
+230
+231
+232
+233
+234
+235
+236
+237
+238
+239
+240
+241
+242
+243
+244
+245
+246
+247
+248
+249
+250
+251
+252
+253
+254
+255
+256
+257
+258
+259
+260
+261
+262
+263
+264
+265
+266
+267
+268
+269
+270
+271
+272
+273
+274
+275
+276
+277
+278
+279
+280
+281
+282
+283
+284
+285
+286
+287
+288
+289
+290
+291
+292
+293
+294
+295
+296
+297
+298
+299
+300
+301
+302
+303
+304
+305
+306
+307
+308
+309
+310
+311
+312
+313
+314
+315
+316
+317
+318
+319
+320
+321
+322
+323
+324
+325
+326
+327
+328
+329
+330
+331
+332
+333
+334
+335
+336
+337
+338
+339
+340
+341
+342
+343
+344
+345
+346
+347
+348
+349
+350
+351
+352
+353
+354
+355
+356
+357
+358
+359
+360
+361
+362
+363
+364
+365
+366
+367
+368
+369
+370
+371
+372
+373
+374
+375
+376
+377
+378
+379
+380
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391
+392
+393
+394
+395
+396
+397
+398
+399
+400
+401
+402
+403
+404
+405
+406
+407
+408
+409
+410
+411
+412
+413
+414
+415
+416
+417
+418
+419
+420
+421
+422
+423
+424
+425
+426
+427
+428
+429
+430
+431
+432
+433
+434
+435
+436
+437
+438
+439
+440
+441
+442
+443
+444
+445
+446
+447
+448
+449
+450
+451
+452
+453
+454
+455
+456
+457
+458
+459
+460
+461
+462
+463
+464
+465
+466
+467
+468
+469
+470
+471
+472
+473
+474
+475
+476
+477
+478
+479
+480
+481
+482
+483
+484
+485
+486
+487
+488
+489
+490
+491
+492
+493
+494
+495
+496
+497
+498
+499
+500
+501
+502
+503
+504
+505
+506
+507
+508
+509
+510
+511
+512
+513
+514
+515
+516
+517
+518
+519
+520
+521
+522
+523
+524
+525
+526
+527
+528
+529
+530
+531
+532
+533
+534
+535
+536
+537
+538
+539
+540
+541
+542
+543
+544
+545
+546
+547
+548
+549
+550
+551
+552
+553
+554
+555
+556
+557
+558
+559
+560
+561
+562
+563
+564
+565
+566
+567
+568
+569
+570
+571
+572
+573
+574
+575
+576
@frozen(init=False)
+class BearerToken(TokenResponse, requests.auth.AuthBase):
+    """Represents a Bearer Token as returned by a Token Endpoint.
+
+    This is a wrapper around a Bearer Token and associated parameters, such as expiration date and
+    refresh token, as returned by an OAuth 2.x or OIDC 1.0 Token Endpoint.
+
+    All parameters are as returned by a Token Endpoint. The token expiration date can be passed as
+    datetime in the `expires_at` parameter, or an `expires_in` parameter, as number of seconds in
+    the future, can be passed instead.
+
+    Args:
+        access_token: an `access_token`, as returned by the AS.
+        expires_at: an expiration date. This method also accepts an `expires_in` hint as
+            returned by the AS, if any.
+        scope: a `scope`, as returned by the AS, if any.
+        refresh_token: a `refresh_token`, as returned by the AS, if any.
+        token_type: a `token_type`, as returned by the AS.
+        id_token: an `id_token`, as returned by the AS, if any.
+        **kwargs: additional parameters as returned by the AS, if any.
+
+    """
+
+    TOKEN_TYPE: ClassVar[str] = AccessTokenType.BEARER.value
+    AUTHORIZATION_HEADER: ClassVar[str] = "Authorization"
+
+    access_token: str
+    expires_at: datetime | None = None
+    scope: str | None = None
+    refresh_token: str | None = None
+    token_type: str = TOKEN_TYPE
+    id_token: IdToken | jwskate.JweCompact | None = None
+    kwargs: dict[str, Any] = Factory(dict)
+
+    @accepts_expires_in
+    def __init__(
+        self,
+        access_token: str,
+        *,
+        expires_at: datetime | None = None,
+        scope: str | None = None,
+        refresh_token: str | None = None,
+        token_type: str = TOKEN_TYPE,
+        id_token: str | bytes | IdToken | jwskate.JweCompact | None = None,
+        **kwargs: Any,
+    ) -> None:
+        if token_type.title() != self.TOKEN_TYPE.title():
+            raise UnsupportedTokenType(token_type)
+        id_token_jwt: IdToken | jwskate.JweCompact | None
+        if isinstance(id_token, (str, bytes)):
+            try:
+                id_token_jwt = IdToken(id_token)
+            except jwskate.InvalidJwt:
+                try:
+                    id_token_jwt = jwskate.JweCompact(id_token)
+                except jwskate.InvalidJwe:
+                    msg = "token is neither a JWT or a JWE."
+                    raise InvalidIdToken(msg, self) from None
+        else:
+            id_token_jwt = id_token
+        self.__attrs_init__(
+            access_token=access_token,
+            expires_at=expires_at,
+            scope=scope,
+            refresh_token=refresh_token,
+            token_type=token_type,
+            id_token=id_token_jwt,
+            kwargs=kwargs,
+        )
+
+    def is_expired(self, leeway: int = 0) -> bool | None:
+        """Check if the access token is expired.
+
+        Args:
+            leeway: If the token expires in the next given number of seconds,
+                then consider it expired already.
+
+        Returns:
+            One of:
+
+            - `True` if the access token is expired
+            - `False` if it is still valid
+            - `None` if there is no expires_in hint.
+
+        """
+        if self.expires_at:
+            return datetime.now(tz=timezone.utc) + timedelta(seconds=leeway) > self.expires_at
+        return None
+
+    def authorization_header(self) -> str:
+        """Return the appropriate Authorization Header value for this token.
+
+        The value is formatted correctly according to RFC6750.
+
+        Returns:
+            the value to use in an HTTP Authorization Header
+
+        """
+        return f"Bearer {self.access_token}"
+
+    def validate_id_token(  # noqa: PLR0915, C901
+        self, client: OAuth2Client, azr: AuthorizationResponse, exp_leeway: int = 0, auth_time_leeway: int = 10
+    ) -> Self:
+        """Validate the ID Token, and return a new instance with the decrypted ID Token.
+
+        If the ID Token was not encrypted, the returned instance will contain the same ID Token.
+
+        This will validate the id_token as described in [OIDC 1.0
+        $3.1.3.7](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation).
+
+        Args:
+            client: the `OAuth2Client` that was used to obtain this token
+            azr: the `AuthorizationResponse`, as obtained by a call to `AuthorizationRequest.validate()`
+            exp_leeway: a leeway, in seconds, applied to the ID Token expiration date
+            auth_time_leeway: a leeway, in seconds, applied to the `auth_time` validation
+
+        Raises:
+            MissingIdToken: if the ID Token is missing
+            InvalidIdToken: this is a base exception class, which is raised:
+
+                - if the ID Token is not a JWT
+                - or is encrypted while a clear-text token is expected
+                - or is clear-text while an encrypted token is expected
+                - if token is encrypted but client does not have a decryption key
+                - if the token does not contain an `alg` header
+            MismatchingIdTokenAlg: if the `alg` header from the ID Token does not match
+                the expected `client.id_token_signed_response_alg`.
+            MismatchingIdTokenIssuer: if the `iss` claim from the ID Token does not match
+                the expected `azr.issuer`.
+            MismatchingIdTokenAcr: if the `acr` claim from the ID Token does not match
+                on of the expected `azr.acr_values`.
+            MismatchingIdTokenAudience: if the `aud` claim from the ID Token does not match
+                the expected `client.client_id`.
+            MismatchingIdTokenAzp: if the `azp` claim from the ID Token does not match
+                the expected `client.client_id`.
+            MismatchingIdTokenNonce: if the `nonce` claim from the ID Token does not match
+                the expected `azr.nonce`.
+            ExpiredIdToken: if the ID Token is expired at the time of the check.
+            UnsupportedIdTokenAlg: if the signature alg for the ID Token is not supported.
+
+        """
+        if not self.id_token:
+            raise MissingIdToken(self)
+
+        raw_id_token = self.id_token
+
+        if isinstance(raw_id_token, jwskate.JweCompact) and client.id_token_encrypted_response_alg is None:
+            msg = "token is encrypted while it should be clear-text"
+            raise InvalidIdToken(msg, self)
+        if isinstance(raw_id_token, IdToken) and client.id_token_encrypted_response_alg is not None:
+            msg = "token is clear-text while it should be encrypted"
+            raise InvalidIdToken(msg, self)
+
+        if isinstance(raw_id_token, jwskate.JweCompact):
+            enc_jwk = client.id_token_decryption_key
+            if enc_jwk is None:
+                msg = "token is encrypted but client does not have a decryption key"
+                raise InvalidIdToken(msg, self)
+            nested_id_token = raw_id_token.decrypt(enc_jwk)
+            id_token = IdToken(nested_id_token)
+        else:
+            id_token = raw_id_token
+
+        id_token_alg = id_token.get_header("alg")
+        if id_token_alg is None:
+            id_token_alg = client.id_token_signed_response_alg
+        if id_token_alg is None:
+            msg = """
+token does not contain an `alg` parameter to specify the signature algorithm,
+and no algorithm has been configured for the client (using param `id_token_signed_response_alg`).
+"""
+            raise InvalidIdToken(msg, self, id_token)
+        if client.id_token_signed_response_alg is not None and id_token_alg != client.id_token_signed_response_alg:
+            raise MismatchingIdTokenAlg(id_token.alg, client.id_token_signed_response_alg, self, id_token)
+
+        verification_jwk: jwskate.Jwk
+
+        if id_token_alg in jwskate.SignatureAlgs.ALL_SYMMETRIC:
+            if not client.client_secret:
+                msg = "token is symmetrically signed but this client does not have a Client Secret."
+                raise InvalidIdToken(msg, self, id_token)
+            verification_jwk = jwskate.SymmetricJwk.from_bytes(client.client_secret, alg=id_token_alg)
+            id_token.verify_signature(verification_jwk, alg=id_token_alg)
+        elif id_token_alg in jwskate.SignatureAlgs.ALL_ASYMMETRIC:
+            if not client.authorization_server_jwks:
+                msg = "token is asymmetrically signed but the Authorization Server JWKS is not available."
+                raise InvalidIdToken(msg, self, id_token)
+
+            if id_token.get_header("kid") is None:
+                msg = """
+token does not contain a Key ID (kid) to specify the asymmetric key
+to use for signature verification."""
+                raise InvalidIdToken(msg, self, id_token)
+            try:
+                verification_jwk = client.authorization_server_jwks.get_jwk_by_kid(id_token.kid)
+            except KeyError:
+                msg = f"""\
+token is asymmetrically signed but there is no key
+with kid='{id_token.kid}' in the Authorization Server JWKS."""
+                raise InvalidIdToken(msg, self, id_token) from None
+
+            if id_token_alg not in verification_jwk.supported_signing_algorithms():
+                msg = "token is asymmetrically signed but its algorithm is not supported by the verification key."
+                raise InvalidIdToken(msg, self, id_token)
+        else:
+            raise UnsupportedIdTokenAlg(self, id_token, id_token_alg)
+
+        id_token.verify(verification_jwk, alg=id_token_alg)
+
+        if azr.issuer and id_token.issuer != azr.issuer:
+            raise MismatchingIdTokenIssuer(id_token.issuer, azr.issuer, self, id_token)
+
+        if id_token.audiences and client.client_id not in id_token.audiences:
+            raise MismatchingIdTokenAudience(id_token.audiences, client.client_id, self, id_token)
+
+        if id_token.authorized_party is not None and id_token.authorized_party != client.client_id:
+            raise MismatchingIdTokenAzp(id_token.azp, client.client_id, self, id_token)
+
+        if id_token.is_expired(leeway=exp_leeway):
+            raise ExpiredIdToken(self, id_token)
+
+        if azr.nonce and id_token.nonce != azr.nonce:
+            raise MismatchingIdTokenNonce(id_token.nonce, azr.nonce, self, id_token)
+
+        if azr.acr_values and id_token.acr not in azr.acr_values:
+            raise MismatchingIdTokenAcr(id_token.acr, azr.acr_values, self, id_token)
+
+        hash_function = IdToken.hash_method(verification_jwk, id_token_alg)
+
+        at_hash = id_token.get_claim("at_hash")
+        if at_hash is not None:
+            expected_at_hash = hash_function(self.access_token)
+            if expected_at_hash != at_hash:
+                msg = f"mismatching 'at_hash' value (expected '{expected_at_hash}', got '{at_hash}')"
+                raise InvalidIdToken(msg, self, id_token)
+
+        c_hash = id_token.get_claim("c_hash")
+        if c_hash is not None:
+            expected_c_hash = hash_function(azr.code)
+            if expected_c_hash != c_hash:
+                msg = f"mismatching 'c_hash' value (expected '{expected_c_hash}', got '{c_hash}')"
+                raise InvalidIdToken(msg, self, id_token)
+
+        s_hash = id_token.get_claim("s_hash")
+        if s_hash is not None:
+            if azr.state is None:
+                msg = "token has a 's_hash' claim but no state was included in the request."
+                raise InvalidIdToken(msg, self, id_token)
+            expected_s_hash = hash_function(azr.state)
+            if expected_s_hash != s_hash:
+                msg = f"mismatching 's_hash' value (expected '{expected_s_hash}', got '{s_hash}')"
+                raise InvalidIdToken(msg, self, id_token)
+
+        if azr.max_age is not None:
+            auth_time = id_token.auth_datetime
+            if auth_time is None:
+                msg = """
+a `max_age` parameter was included in the authorization request,
+but the ID Token does not contain an `auth_time` claim.
+"""
+                raise InvalidIdToken(msg, self, id_token) from None
+            auth_age = datetime.now(tz=timezone.utc) - auth_time
+            if auth_age.total_seconds() > azr.max_age + auth_time_leeway:
+                msg = f"""
+user authentication happened too far in the past.
+The `auth_time` parameter from the ID Token indicate that
+the last Authentication Time was at {auth_time} ({auth_age.total_seconds()} sec ago),
+but the authorization request `max_age` parameter specified that it must
+be a maximum of {azr.max_age} sec ago.
+"""
+                raise InvalidIdToken(msg, self, id_token)
+
+        return self.__class__(
+            access_token=self.access_token,
+            expires_at=self.expires_at,
+            scope=self.scope,
+            refresh_token=self.refresh_token,
+            token_type=self.token_type,
+            id_token=id_token,
+            **self.kwargs,
+        )
+
+    def __str__(self) -> str:
+        """Return the access token value, as a string.
+
+        Returns:
+            the access token string
+
+        """
+        return self.access_token
+
+    def as_dict(self) -> dict[str, Any]:
+        """Return a dict of parameters.
+
+        That is suitable for serialization or to init another BearerToken.
+
+        """
+        d = asdict(self)
+        d.pop("expires_at")
+        d["expires_in"] = self.expires_in
+        d.update(**d.pop("kwargs", {}))
+        return {key: val for key, val in d.items() if val is not None}
+
+    @property
+    def expires_in(self) -> int | None:
+        """Number of seconds until expiration."""
+        if self.expires_at:
+            return ceil((self.expires_at - datetime.now(tz=timezone.utc)).total_seconds())
+        return None
+
+    def __getattr__(self, key: str) -> Any:
+        """Return custom attributes from this BearerToken.
+
+        Args:
+            key: a key
+
+        Returns:
+            the associated value in this token response
+
+        Raises:
+            AttributeError: if the attribute is not found in this response.
+
+        """
+        return self.kwargs.get(key) or super().__getattribute__(key)
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Implement the usage of Bearer Tokens in requests.
+
+        This will add a properly formatted `Authorization: Bearer <token>` header in the request.
+
+        If the configured token is an instance of BearerToken with an expires_at attribute, raises
+        [ExpiredAccessToken][requests_oauth2client.exceptions.ExpiredAccessToken] once the access
+        token is expired.
+
+        Args:
+            request: the request
+
+        Returns:
+            the same request with an Access Token added in `Authorization` Header
+
+        Raises:
+            ExpiredAccessToken: if the token is expired
+
+        """
+        if self.access_token is None:
+            return request  # pragma: no cover
+        if self.is_expired():
+            raise ExpiredAccessToken(self)
+        request.headers[self.AUTHORIZATION_HEADER] = self.authorization_header()
+        return request
+
+
+
@@ -41409,1533 +38076,1110 @@

-

-
+

+ expires_in: int | None -

+ + property + -
+ +
-

- AuthorizationResponse +

Number of seconds until expiration.

+

+
- -
+
- -

Represent a successful Authorization Response.

-

An Authorization Response is the redirection initiated by the AS to the client's redirection -endpoint (redirect_uri) after an Authorization Request. This Response is typically created with -a call to AuthorizationRequest.validate_callback() once the call to the client Redirection -Endpoint is made. AuthorizationResponse contains the following, all accessible as attributes:

-
    -
  • all the parameters that have been returned by the AS, most notably the code, and optional - parameters such as state.
    • -
  • the redirect_uri that was used for the Authorization Request
    • -
  • the code_verifier matching the code_challenge that was used for the Authorization Request
    • -
-

Parameters redirect_uri and code_verifier must be those from the matching -AuthorizationRequest. All other parameters including code and state must be those -extracted from the Authorization Response parameters.

+

+ is_expired(leeway=0) +

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
code - str - -
-

the authorization code returned by the AS

-
- 		- required -
redirect_uri - str | None - -
-

the redirect_uri that was passed as parameter in the AuthorizationRequest

-
- 		- None -
code_verifier - str | None - -
-

the code_verifier matching the code_challenge that was passed as -parameter in the AuthorizationRequest

-
- 		- None -
state - str | None - -
-

the state returned by the AS

-
- 		- None -
**kwargs - str - -
-

other parameters as returned by the AS

-
- 		- {} -
-
- Source code in requests_oauth2client/authorization_request.py - 
118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
-141
-142
-143
-144
-145
-146
-147
-148
-149
-150
-151
-152
-153
-154
-155
-156
-157
-158
-159
-160
-161
-162
-163
-164
-165
-166
-167
-168
-169
-170
-171
-172
-173
-174
-175
-176
-177
-178
-179
-180
-181
-182
-183
-184
-185
-186
-187
-188
-189
-190
-191
-192
-193
-194
-195
-196
-197
-198
@frozen(init=False)
-class AuthorizationResponse:
-    """Represent a successful Authorization Response.
-
-    An Authorization Response is the redirection initiated by the AS to the client's redirection
-    endpoint (redirect_uri) after an Authorization Request. This Response is typically created with
-    a call to `AuthorizationRequest.validate_callback()` once the call to the client Redirection
-    Endpoint is made. AuthorizationResponse contains the following, all accessible as attributes:
-
-     - all the parameters that have been returned by the AS, most notably the `code`, and optional
-       parameters such as `state`.
-     - the redirect_uri that was used for the Authorization Request
-     - the code_verifier matching the code_challenge that was used for the Authorization Request
-
-    Parameters `redirect_uri` and `code_verifier` must be those from the matching
-    `AuthorizationRequest`. All other parameters including `code` and `state` must be those
-    extracted from the Authorization Response parameters.
-
-    Args:
-        code: the authorization code returned by the AS
-        redirect_uri: the redirect_uri that was passed as parameter in the AuthorizationRequest
-        code_verifier: the code_verifier matching the code_challenge that was passed as
-            parameter in the AuthorizationRequest
-        state: the state returned by the AS
-        **kwargs: other parameters as returned by the AS
-
-    """
-
-    code: str
-    redirect_uri: str | None = None
-    code_verifier: str | None = None
-    state: str | None = None
-    nonce: str | None = None
-    acr_values: tuple[str, ...] | None = None
-    max_age: int | None = None
-    issuer: str | None = None
-    kwargs: dict[str, Any] = Factory(dict)
-
-    def __init__(
-        self,
-        *,
-        code: str,
-        redirect_uri: str | None = None,
-        code_verifier: str | None = None,
-        state: str | None = None,
-        nonce: str | None = None,
-        acr_values: str | Sequence[str] | None = None,
-        max_age: int | None = None,
-        issuer: str | None = None,
-        **kwargs: str,
-    ):
-        if not acr_values:
-            acr_values = None
-        elif isinstance(acr_values, str):
-            acr_values = tuple(acr_values.split(" "))
-        else:
-            acr_values = tuple(acr_values)
-
-        self.__attrs_init__(
-            code=code,
-            redirect_uri=redirect_uri,
-            code_verifier=code_verifier,
-            state=state,
-            nonce=nonce,
-            acr_values=acr_values,
-            max_age=max_age,
-            issuer=issuer,
-            kwargs=kwargs,
-        )
-
-    def __getattr__(self, item: str) -> str | None:
-        """Make additional parameters available as attributes.
-
-        Args:
-            item: the attribute name
-
-        Returns:
-            the attribute value, or None if it isn't part of the returned attributes
-
-        """
-        return self.kwargs.get(item)
-
-
+
- +

Check if the access token is expired.

-
+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
leeway + int + +
+

If the token expires in the next given number of seconds, +then consider it expired already.

+
+ 		+ 0 +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + + + + + + + + + +
TypeDescription
+ bool | None + +
+

One of:

+
+
+ bool | None + +
+
    +
  • True if the access token is expired
    • +
+
+
+ bool | None + +
+
    +
  • False if it is still valid
    • +
+
+
+ bool | None + +
+
    +
  • None if there is no expires_in hint.
    • +
+
+
+
+ Source code in requests_oauth2client/tokens.py + 
297
+298
+299
+300
+301
+302
+303
+304
+305
+306
+307
+308
+309
+310
+311
+312
+313
+314
def is_expired(self, leeway: int = 0) -> bool | None:
+    """Check if the access token is expired.
+
+    Args:
+        leeway: If the token expires in the next given number of seconds,
+            then consider it expired already.
+
+    Returns:
+        One of:
+
+        - `True` if the access token is expired
+        - `False` if it is still valid
+        - `None` if there is no expires_in hint.
+
+    """
+    if self.expires_at:
+        return datetime.now(tz=timezone.utc) + timedelta(seconds=leeway) > self.expires_at
+    return None
+
+
+
+
+
+

+ authorization_header() +

+
+

Return the appropriate Authorization Header value for this token.

+

The value is formatted correctly according to RFC6750.

-
-
+

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the value to use in an HTTP Authorization Header

+
+
+
+ Source code in requests_oauth2client/tokens.py + 
316
+317
+318
+319
+320
+321
+322
+323
+324
+325
def authorization_header(self) -> str:
+    """Return the appropriate Authorization Header value for this token.
+
+    The value is formatted correctly according to RFC6750.
+
+    Returns:
+        the value to use in an HTTP Authorization Header
+
+    """
+    return f"Bearer {self.access_token}"
+
+
+
-
+
+

+ validate_id_token(client, azr, exp_leeway=0, auth_time_leeway=10) -

- AuthorizationRequest +

- +
+

Validate the ID Token, and return a new instance with the decrypted ID Token.

+

If the ID Token was not encrypted, the returned instance will contain the same ID Token.

+

This will validate the id_token as described in OIDC 1.0 +$3.1.3.7.

-
- -

Represent an Authorization Request.

-

This class makes it easy to generate valid Authorization Request URI (possibly including a -state, nonce, PKCE, and custom args), to store all parameters, and to validate an Authorization -Response.

-

All parameters passed at init time will be included in the request query parameters as-is, -excepted for a few parameters which have a special behaviour:

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client + OAuth2Client + +
+

the OAuth2Client that was used to obtain this token

+
+ 		+ required +
azr + AuthorizationResponse + +
+

the AuthorizationResponse, as obtained by a call to AuthorizationRequest.validate()

+
+ 		+ required +
exp_leeway + int + +
+

a leeway, in seconds, applied to the ID Token expiration date

+
+ 		+ 0 +
auth_time_leeway + int + +
+

a leeway, in seconds, applied to the auth_time validation

+
+ 		+ 10 +
+ + +

Raises:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
TypeDescription
+ MissingIdToken + +
+

if the ID Token is missing

+
+
+ InvalidIdToken + +
+

this is a base exception class, which is raised:

    -
  • state: if ... (default), a random state parameter will be generated for you. - You may pass your own state as str, or set it to None so that the state parameter - will not be included in the request. You may access that state in the state attribute - from this request.
    • -
  • nonce: if ... (default) and scope includes 'openid', a random nonce will be - generated and included in the request. You may access that nonce in the nonce attribute - from this request.
    • -
  • code_verifier: if None, and code_challenge_method is 'S256' or 'plain', - a valid code_challenge and code_verifier for PKCE will be automatically generated, - and the code_challenge will be included in the request. - You may pass your own code_verifier as a str parameter, in which case the - appropriate code_challenge will be included in the request, according to the - code_challenge_method.
    • -
  • authorization_response_iss_parameter_supported and issuer: - those are used for Server Issuer Identification. If ìssuer is set and an issuer is - included in the Authorization Response, then the consistency between those 2 values will be - checked when using validate_callback(). If issuer is not included in the response, and - authorization_response_iss_parameter_supported is False (default), then no issuer check - is performed. Set authorization_response_iss_parameter_supported - to True to enforce server identification: if no issuer is included in the Authorization - Response, then an error will be raised instead.
    • +
  • if the ID Token is not a JWT
    • +
  • or is encrypted while a clear-text token is expected
    • +
  • or is clear-text while an encrypted token is expected
    • +
  • if token is encrypted but client does not have a decryption key
    • +
  • if the token does not contain an alg header
- - - -

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
authorization_endpoint - str - -
-

the uri for the authorization endpoint.

-
- 		- required -
client_id - str - -
-

the client_id to include in the request.

-
- 		- required -
redirect_uri - str | None - -
-

the redirect_uri to include in the request. This is required in OAuth 2.0 and optional -in OAuth 2.1. Pass None if you don't need any redirect_uri in the Authorization -Request.

-
- 		- None -
scope - None | str | Iterable[str] - -
-

the scope to include in the request, as an iterable of str, or a single space-separated str.

-
- 		- 'openid' -
response_type - str - -
-

the response type to include in the request.

-
- 		- 'code' -
state - str | ellipsis | None - -
-

the state to include in the request, or ... to autogenerate one (default).

-
- 		- ... -
nonce - str | ellipsis | None - -
-

the nonce to include in the request, or ... to autogenerate one (default).

-
- 		- ... -
code_verifier - str | None - -
-

the code verifier to include in the request. -If left as None and code_challenge_method is set, a valid code_verifier -will be generated.

-
- 		- None -
code_challenge_method - str | None - -
-

the method to use to derive the code_challenge from the code_verifier.

-
- 		- 'S256' -
acr_values - str | Iterable[str] | None - -
-

requested Authentication Context Class Reference values.

-
- 		- None -
issuer - str | None - -
-

Issuer Identifier value from the OAuth/OIDC Server, if using Server Issuer Identification.

-
- 		- None -
**kwargs - Any - -
-

extra parameters to include in the request, as-is.

-
- 		- {} -
+
+
+ MismatchingIdTokenAlg + +
+

if the alg header from the ID Token does not match +the expected client.id_token_signed_response_alg.

+
+
+ MismatchingIdTokenIssuer + +
+

if the iss claim from the ID Token does not match +the expected azr.issuer.

+
+
+ MismatchingIdTokenAcr + +
+

if the acr claim from the ID Token does not match +on of the expected azr.acr_values.

+
+
+ MismatchingIdTokenAudience + +
+

if the aud claim from the ID Token does not match +the expected client.client_id.

+
+
+ MismatchingIdTokenAzp + +
+

if the azp claim from the ID Token does not match +the expected client.client_id.

+
+
+ MismatchingIdTokenNonce + +
+

if the nonce claim from the ID Token does not match +the expected azr.nonce.

+
+
+ ExpiredIdToken + +
+

if the ID Token is expired at the time of the check.

+
+
+ UnsupportedIdTokenAlg + +
+

if the signature alg for the ID Token is not supported.

+
+
- Source code in requests_oauth2client/authorization_request.py - 
201
-202
-203
-204
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
-258
-259
-260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
-293
-294
-295
-296
-297
-298
-299
-300
-301
-302
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320
-321
-322
-323
-324
-325
-326
-327
-328
-329
-330
-331
-332
-333
-334
-335
-336
-337
-338
-339
-340
-341
-342
-343
-344
-345
-346
-347
-348
-349
-350
-351
-352
-353
-354
-355
-356
-357
-358
-359
-360
-361
-362
-363
-364
-365
-366
-367
-368
-369
-370
-371
-372
-373
-374
-375
-376
-377
-378
-379
-380
-381
-382
-383
-384
-385
-386
-387
-388
-389
-390
-391
-392
-393
-394
-395
-396
-397
-398
-399
-400
-401
-402
-403
-404
-405
-406
-407
-408
-409
-410
-411
-412
-413
-414
-415
-416
-417
-418
-419
-420
-421
-422
-423
-424
-425
-426
-427
-428
-429
-430
-431
-432
-433
-434
-435
-436
-437
-438
-439
-440
-441
-442
-443
-444
-445
-446
-447
-448
-449
-450
-451
-452
-453
-454
-455
-456
-457
-458
-459
-460
-461
-462
-463
-464
-465
-466
-467
-468
-469
-470
-471
-472
-473
-474
-475
-476
-477
-478
-479
-480
-481
-482
-483
-484
-485
-486
-487
-488
-489
-490
-491
-492
-493
-494
-495
-496
-497
-498
-499
-500
-501
-502
-503
-504
-505
-506
-507
-508
-509
-510
-511
-512
-513
-514
-515
-516
-517
-518
-519
-520
-521
-522
-523
-524
-525
-526
-527
-528
-529
-530
-531
-532
-533
-534
-535
-536
-537
-538
-539
-540
-541
-542
-543
-544
-545
-546
-547
-548
-549
-550
-551
-552
-553
-554
-555
-556
-557
-558
-559
-560
-561
-562
-563
-564
-565
-566
-567
-568
-569
-570
-571
-572
-573
-574
-575
-576
-577
-578
-579
-580
-581
-582
-583
-584
-585
-586
-587
-588
-589
-590
-591
-592
-593
-594
-595
-596
-597
-598
-599
-600
-601
-602
-603
-604
-605
-606
-607
-608
-609
-610
-611
-612
-613
-614
-615
-616
-617
-618
-619
-620
-621
-622
-623
-624
-625
-626
-627
-628
-629
-630
-631
-632
-633
-634
-635
-636
-637
-638
-639
-640
-641
-642
@frozen(init=False)
-class AuthorizationRequest:
-    """Represent an Authorization Request.
-
-    This class makes it easy to generate valid Authorization Request URI (possibly including a
-    state, nonce, PKCE, and custom args), to store all parameters, and to validate an Authorization
-    Response.
-
-    All parameters passed at init time will be included in the request query parameters as-is,
-    excepted for a few parameters which have a special behaviour:
-
-    - `state`: if `...` (default), a random `state` parameter will be generated for you.
-      You may pass your own `state` as `str`, or set it to `None` so that the `state` parameter
-      will not be included in the request. You may access that state in the `state` attribute
-      from this request.
-    - `nonce`: if `...` (default) and `scope` includes 'openid', a random `nonce` will be
-      generated and included in the request. You may access that `nonce` in the `nonce` attribute
-      from this request.
-    - `code_verifier`: if `None`, and `code_challenge_method` is `'S256'` or `'plain'`,
-      a valid `code_challenge` and `code_verifier` for PKCE will be automatically generated,
-      and the `code_challenge` will be included in the request.
-      You may pass your own `code_verifier` as a `str` parameter, in which case the
-      appropriate `code_challenge` will be included in the request, according to the
-      `code_challenge_method`.
-    - `authorization_response_iss_parameter_supported` and `issuer`:
-       those are used for Server Issuer Identification. If `ìssuer` is set and an issuer is
-       included in the Authorization Response, then the consistency between those 2 values will be
-       checked when using `validate_callback()`. If issuer is not included in the response, and
-       `authorization_response_iss_parameter_supported` is `False` (default), then no issuer check
-       is performed. Set `authorization_response_iss_parameter_supported`
-       to `True` to enforce server identification: if no issuer is included in the Authorization
-       Response, then an error will be raised instead.
-
-    Args:
-        authorization_endpoint: the uri for the authorization endpoint.
-        client_id: the client_id to include in the request.
-        redirect_uri: the redirect_uri to include in the request. This is required in OAuth 2.0 and optional
-            in OAuth 2.1. Pass `None` if you don't need any redirect_uri in the Authorization
-            Request.
-        scope: the scope to include in the request, as an iterable of `str`, or a single space-separated `str`.
-        response_type: the response type to include in the request.
-        state: the state to include in the request, or `...` to autogenerate one (default).
-        nonce: the nonce to include in the request, or `...` to autogenerate one (default).
-        code_verifier: the code verifier to include in the request.
-            If left as `None` and `code_challenge_method` is set, a valid code_verifier
-            will be generated.
-        code_challenge_method: the method to use to derive the `code_challenge` from the `code_verifier`.
-        acr_values: requested Authentication Context Class Reference values.
-        issuer: Issuer Identifier value from the OAuth/OIDC Server, if using Server Issuer Identification.
-        **kwargs: extra parameters to include in the request, as-is.
-
-    """
-
-    authorization_endpoint: str
-
-    client_id: str = field(metadata={"query": True})
-    redirect_uri: str | None = field(metadata={"query": True}, default=None)
-    scope: tuple[str, ...] | None = field(metadata={"query": True}, default=("openid",))
-    response_type: str = field(metadata={"query": True}, default="code")
-    state: str | None = field(metadata={"query": True}, default=None)
-    nonce: str | None = field(metadata={"query": True}, default=None)
-    code_challenge_method: str | None = field(metadata={"query": True}, default="S256")
-    acr_values: tuple[str, ...] | None = field(metadata={"query": True}, default=None)
-    max_age: int | None = field(metadata={"query": True}, default=None)
-    kwargs: dict[str, Any] = Factory(dict)
-
-    code_verifier: str | None = None
-    code_challenge: str | None = field(init=False, metadata={"query": True})
-    authorization_response_iss_parameter_supported: bool = False
-    issuer: str | None = None
-
-    exception_classes: ClassVar[dict[str, type[Exception]]] = {
-        "interaction_required": InteractionRequired,
-        "login_required": LoginRequired,
-        "session_selection_required": SessionSelectionRequired,
-        "consent_required": ConsentRequired,
-    }
-
-    @classmethod
-    def generate_state(cls) -> str:
-        """Generate a random `state` parameter."""
-        return secrets.token_urlsafe(32)
-
-    @classmethod
-    def generate_nonce(cls) -> str:
-        """Generate a random `nonce`."""
-        return secrets.token_urlsafe(32)
-
-    def __init__(  # noqa: PLR0913, C901
-        self,
-        authorization_endpoint: str,
-        *,
-        client_id: str,
-        redirect_uri: str | None = None,
-        scope: None | str | Iterable[str] = "openid",
-        response_type: str = "code",
-        state: str | ellipsis | None = ...,  # noqa: F821
-        nonce: str | ellipsis | None = ...,  # noqa: F821
-        code_verifier: str | None = None,
-        code_challenge_method: str | None = "S256",
-        acr_values: str | Iterable[str] | None = None,
-        max_age: int | None = None,
-        issuer: str | None = None,
-        authorization_response_iss_parameter_supported: bool = False,
-        **kwargs: Any,
-    ) -> None:
-        if authorization_response_iss_parameter_supported and not issuer:
-            msg = (
-                "When 'authorization_response_iss_parameter_supported' is `True`, you must"
-                " provide the expected `issuer` as parameter."
-            )
-            raise ValueError(msg)
-
-        if state is ...:
-            state = self.generate_state()
-        if state is not None and not isinstance(state, str):
-            state = str(state)  # pragma: no cover
-
-        if nonce is ...:
-            nonce = self.generate_nonce() if scope is not None and "openid" in scope else None
-        if nonce is not None and not isinstance(nonce, str):
-            nonce = str(nonce)  # pragma: no cover
-
-        if not scope:
-            scope = None
-
-        if scope is not None:
-            scope = tuple(scope.split(" ")) if isinstance(scope, str) else tuple(scope)
-
-        if acr_values is not None:
-            acr_values = tuple(acr_values.split()) if isinstance(acr_values, str) else tuple(acr_values)
-
-        if max_age is not None and max_age < 0:
-            msg = "The `max_age` parameter is a number of seconds and cannot be negative."
-            raise ValueError(msg)
-
-        if "code_challenge" in kwargs:
-            msg = (
-                "A `code_challenge` must not be passed as parameter. Pass the `code_verifier`"
-                " instead, and the appropriate `code_challenge` will automatically be derived"
-                " from it and included in the request, based on `code_challenge_method`."
-            )
-            raise ValueError(msg)
-
-        code_challenge: str | None = None
-        if code_challenge_method:
-            if not code_verifier:
-                code_verifier = PkceUtils.generate_code_verifier()
-            code_challenge = PkceUtils.derive_challenge(code_verifier, code_challenge_method)
-        else:
-            code_verifier = None
-
-        self.__attrs_init__(
-            authorization_endpoint=authorization_endpoint,
-            client_id=client_id,
-            redirect_uri=redirect_uri,
-            issuer=issuer,
-            response_type=response_type,
-            scope=scope,
-            state=state,
-            nonce=nonce,
-            code_verifier=code_verifier,
-            code_challenge_method=code_challenge_method,
-            acr_values=acr_values,
-            max_age=max_age,
-            authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
-            kwargs=kwargs,
-        )
-        object.__setattr__(self, "code_challenge", code_challenge)
-
-    def as_dict(self) -> dict[str, Any]:
-        """Return the full argument dict.
-
-        This can be used to serialize this request and/or to initialize a similar request.
-
-        """
-        d = asdict(self)
-        d.update(**d.pop("kwargs", {}))
-        d.pop("code_challenge")
-        return d
-
-    @property
-    def args(self) -> dict[str, Any]:
-        """Return a dict with all the query parameters from this AuthorizationRequest.
-
-        Returns:
-            a dict of parameters
-
-        """
-        d = {field.name: getattr(self, field.name) for field in fields(type(self)) if field.metadata.get("query")}
-        if d["scope"]:
-            d["scope"] = " ".join(d["scope"])
-        d.update(self.kwargs)
-
-        return {key: val for key, val in d.items() if val is not None}
-
-    def validate_callback(self, response: str) -> AuthorizationResponse:
-        """Validate an Authorization Response against this Request.
-
-        Validate a given Authorization Response URI against this Authorization Request, and return
-        an
-        [AuthorizationResponse][requests_oauth2client.authorization_request.AuthorizationResponse].
-
-        This includes matching the `state` parameter, checking for returned errors, and extracting
-        the returned `code` and other parameters.
-
-        Args:
-            response: the Authorization Response URI. This can be the full URL, or just the
-                query parameters (still encoded as x-www-form-urlencoded).
-
-        Returns:
-            the extracted code, if all checks are successful
-
-        Raises:
-            MismatchingIssuer: if the 'iss' received from the response does not match the
-                expected value.
-            MismatchingState: if the response `state` does not match the expected value.
-            OAuth2Error: if the response includes an error.
-            MissingAuthCode: if the response does not contain a `code`.
-            NotImplementedError: if response_type anything else than 'code'.
-
-        """
-        try:
-            response_url = furl(response)
-        except ValueError:
-            return self.on_response_error(response)
-
-        # validate 'iss' according to RFC9207
-        received_issuer = response_url.args.get("iss")
-        if self.authorization_response_iss_parameter_supported or received_issuer:
-            if received_issuer is None:
-                raise MissingIssuer()
-            if self.issuer and received_issuer != self.issuer:
-                raise MismatchingIssuer(self.issuer, received_issuer)
-
-        # validate state
-        requested_state = self.state
-        if requested_state:
-            received_state = response_url.args.get("state")
-            if requested_state != received_state:
-                raise MismatchingState(requested_state, received_state)
-
-        error = response_url.args.get("error")
-        if error:
-            return self.on_response_error(response)
-
-        if "code" in self.response_type:
-            code: str = response_url.args.get("code")
-            if code is None:
-                raise MissingAuthCode()
-        else:
-            raise NotImplementedError()
-
-        return AuthorizationResponse(
-            code_verifier=self.code_verifier,
-            redirect_uri=self.redirect_uri,
-            nonce=self.nonce,
-            acr_values=self.acr_values,
-            max_age=self.max_age,
-            **response_url.args,
-        )
-
-    def sign_request_jwt(
-        self,
-        jwk: Jwk | dict[str, Any],
-        alg: str | None = None,
-        lifetime: int | None = None,
-    ) -> SignedJwt:
-        """Sign the `request` object that matches this Authorization Request parameters.
-
-        Args:
-            jwk: the JWK to use to sign the request
-            alg: the alg to use to sign the request, if the provided `jwk` has no `alg` parameter.
-            lifetime: an optional number of seconds of validity for the signed request.
-                If present, `iat` an `exp` claims will be included in the signed JWT.
-
-        Returns:
-            a `Jwt` that contains the signed request object.
-
-        """
-        claims = self.args
-        if lifetime:
-            claims["iat"] = Jwt.timestamp()
-            claims["exp"] = Jwt.timestamp(lifetime)
-        return Jwt.sign(
-            claims,
-            key=jwk,
-            alg=alg,
-        )
-
-    def sign(
-        self,
-        jwk: Jwk | dict[str, Any],
-        alg: str | None = None,
-        lifetime: int | None = None,
-        **kwargs: Any,
-    ) -> RequestParameterAuthorizationRequest:
-        """Sign this Authorization Request and return a new one.
-
-        This replaces all parameters with a signed `request` JWT.
-
-        Args:
-            jwk: the JWK to use to sign the request
-            alg: the alg to use to sign the request, if the provided `jwk` has no `alg` parameter.
-            lifetime: lifetime of the resulting Jwt (used to calculate the 'exp' claim).
-                By default, don't use an 'exp' claim.
-            kwargs: additional query parameters to include in the signed authorization request
-
-        Returns:
-            the signed Authorization Request
-
-        """
-        request_jwt = self.sign_request_jwt(jwk, alg, lifetime)
-        return RequestParameterAuthorizationRequest(
-            authorization_endpoint=self.authorization_endpoint,
-            client_id=self.client_id,
-            request=str(request_jwt),
-            expires_at=request_jwt.expires_at,
-            **kwargs,
-        )
-
-    def sign_and_encrypt_request_jwt(
-        self,
-        sign_jwk: Jwk | dict[str, Any],
-        enc_jwk: Jwk | dict[str, Any],
-        sign_alg: str | None = None,
-        enc_alg: str | None = None,
-        enc: str = "A128CBC-HS256",
-        lifetime: int | None = None,
-    ) -> JweCompact:
-        """Sign and encrypt a `request` object for this Authorization Request.
-
-        The signed `request` will contain the same parameters as this AuthorizationRequest.
-
-        Args:
-            sign_jwk: the JWK to use to sign the request
-            enc_jwk: the JWK to use to encrypt the request
-            sign_alg: the alg to use to sign the request, if `sign_jwk` has no `alg` parameter.
-            enc_alg: the alg to use to encrypt the request, if `enc_jwk` has no `alg` parameter.
-            enc: the encoding to use to encrypt the request.
-            lifetime: lifetime of the resulting Jwt (used to calculate the 'exp' claim).
-                By default, do not include an 'exp' claim.
-
-        Returns:
-            the signed and encrypted request object, as a `jwskate.Jwt`
-
-        """
-        claims = self.args
-        if lifetime:
-            claims["iat"] = Jwt.timestamp()
-            claims["exp"] = Jwt.timestamp(lifetime)
-        return Jwt.sign_and_encrypt(
-            claims=claims,
-            sign_key=sign_jwk,
-            sign_alg=sign_alg,
-            enc_key=enc_jwk,
-            enc_alg=enc_alg,
-            enc=enc,
-        )
-
-    def sign_and_encrypt(
-        self,
-        sign_jwk: Jwk | dict[str, Any],
-        enc_jwk: Jwk | dict[str, Any],
-        sign_alg: str | None = None,
-        enc_alg: str | None = None,
-        enc: str = "A128CBC-HS256",
-        lifetime: int | None = None,
-    ) -> RequestParameterAuthorizationRequest:
-        """Sign and encrypt the current Authorization Request.
-
-        This replaces all parameters with a matching `request` object.
-
-        Args:
-            sign_jwk: the JWK to use to sign the request
-            enc_jwk: the JWK to use to encrypt the request
-            sign_alg: the alg to use to sign the request, if `sign_jwk` has no `alg` parameter.
-            enc_alg: the alg to use to encrypt the request, if `enc_jwk` has no `alg` parameter.
-            enc: the encoding to use to encrypt the request.
-            lifetime: lifetime of the resulting Jwt (used to calculate the 'exp' claim).
-                By default, do not include an 'exp' claim.
-
-        Returns:
-            a `RequestParameterAuthorizationRequest`, with a request object as parameter
-
-        """
-        request_jwt = self.sign_and_encrypt_request_jwt(
-            sign_jwk=sign_jwk,
-            enc_jwk=enc_jwk,
-            sign_alg=sign_alg,
-            enc_alg=enc_alg,
-            enc=enc,
-            lifetime=lifetime,
-        )
-        return RequestParameterAuthorizationRequest(
-            authorization_endpoint=self.authorization_endpoint,
-            client_id=self.client_id,
-            request=str(request_jwt),
-        )
-
-    def on_response_error(self, response: str) -> AuthorizationResponse:
-        """Error handler for Authorization Response errors.
-
-        Triggered by
-        [validate_callback()][requests_oauth2client.authorization_request.AuthorizationRequest.validate_callback]
-        if the response uri contains an error.
-
-        Args:
-            response: the Authorization Response URI. This can be the full URL, or just the query parameters.
-
-        Returns:
-            may return a default code that will be returned by `validate_callback`. But this method
-            will most likely raise exceptions instead.
-
-        """
-        response_url = furl(response)
-        error = response_url.args.get("error")
-        error_description = response_url.args.get("error_description")
-        error_uri = response_url.args.get("error_uri")
-        exception_class = self.exception_classes.get(error, AuthorizationResponseError)
-        raise exception_class(error, error_description, error_uri)
-
-    @property
-    def furl(self) -> furl:
-        """Return the Authorization Request URI, as a `furl`."""
-        return furl(
-            self.authorization_endpoint,
-            args=self.args,
-        )
-
-    @property
-    def uri(self) -> str:
-        """Return the Authorization Request URI, as a `str`."""
-        return str(self.furl.url)
-
-    def __getattr__(self, item: str) -> Any:
-        """Allow attribute access to extra parameters."""
-        return self.kwargs[item]
-
-    def __repr__(self) -> str:
-        """Return the Authorization Request URI, as a `str`."""
-        return self.uri
-
+ Source code in requests_oauth2client/tokens.py + 
327
+328
+329
+330
+331
+332
+333
+334
+335
+336
+337
+338
+339
+340
+341
+342
+343
+344
+345
+346
+347
+348
+349
+350
+351
+352
+353
+354
+355
+356
+357
+358
+359
+360
+361
+362
+363
+364
+365
+366
+367
+368
+369
+370
+371
+372
+373
+374
+375
+376
+377
+378
+379
+380
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391
+392
+393
+394
+395
+396
+397
+398
+399
+400
+401
+402
+403
+404
+405
+406
+407
+408
+409
+410
+411
+412
+413
+414
+415
+416
+417
+418
+419
+420
+421
+422
+423
+424
+425
+426
+427
+428
+429
+430
+431
+432
+433
+434
+435
+436
+437
+438
+439
+440
+441
+442
+443
+444
+445
+446
+447
+448
+449
+450
+451
+452
+453
+454
+455
+456
+457
+458
+459
+460
+461
+462
+463
+464
+465
+466
+467
+468
+469
+470
+471
+472
+473
+474
+475
+476
+477
+478
+479
+480
+481
+482
+483
+484
+485
+486
+487
+488
+489
+490
+491
+492
+493
+494
+495
+496
+497
+498
+499
+500
+501
+502
+503
+504
+505
+506
+507
    def validate_id_token(  # noqa: PLR0915, C901
+        self, client: OAuth2Client, azr: AuthorizationResponse, exp_leeway: int = 0, auth_time_leeway: int = 10
+    ) -> Self:
+        """Validate the ID Token, and return a new instance with the decrypted ID Token.
+
+        If the ID Token was not encrypted, the returned instance will contain the same ID Token.
+
+        This will validate the id_token as described in [OIDC 1.0
+        $3.1.3.7](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation).
+
+        Args:
+            client: the `OAuth2Client` that was used to obtain this token
+            azr: the `AuthorizationResponse`, as obtained by a call to `AuthorizationRequest.validate()`
+            exp_leeway: a leeway, in seconds, applied to the ID Token expiration date
+            auth_time_leeway: a leeway, in seconds, applied to the `auth_time` validation
+
+        Raises:
+            MissingIdToken: if the ID Token is missing
+            InvalidIdToken: this is a base exception class, which is raised:
+
+                - if the ID Token is not a JWT
+                - or is encrypted while a clear-text token is expected
+                - or is clear-text while an encrypted token is expected
+                - if token is encrypted but client does not have a decryption key
+                - if the token does not contain an `alg` header
+            MismatchingIdTokenAlg: if the `alg` header from the ID Token does not match
+                the expected `client.id_token_signed_response_alg`.
+            MismatchingIdTokenIssuer: if the `iss` claim from the ID Token does not match
+                the expected `azr.issuer`.
+            MismatchingIdTokenAcr: if the `acr` claim from the ID Token does not match
+                on of the expected `azr.acr_values`.
+            MismatchingIdTokenAudience: if the `aud` claim from the ID Token does not match
+                the expected `client.client_id`.
+            MismatchingIdTokenAzp: if the `azp` claim from the ID Token does not match
+                the expected `client.client_id`.
+            MismatchingIdTokenNonce: if the `nonce` claim from the ID Token does not match
+                the expected `azr.nonce`.
+            ExpiredIdToken: if the ID Token is expired at the time of the check.
+            UnsupportedIdTokenAlg: if the signature alg for the ID Token is not supported.
+
+        """
+        if not self.id_token:
+            raise MissingIdToken(self)
+
+        raw_id_token = self.id_token
+
+        if isinstance(raw_id_token, jwskate.JweCompact) and client.id_token_encrypted_response_alg is None:
+            msg = "token is encrypted while it should be clear-text"
+            raise InvalidIdToken(msg, self)
+        if isinstance(raw_id_token, IdToken) and client.id_token_encrypted_response_alg is not None:
+            msg = "token is clear-text while it should be encrypted"
+            raise InvalidIdToken(msg, self)
+
+        if isinstance(raw_id_token, jwskate.JweCompact):
+            enc_jwk = client.id_token_decryption_key
+            if enc_jwk is None:
+                msg = "token is encrypted but client does not have a decryption key"
+                raise InvalidIdToken(msg, self)
+            nested_id_token = raw_id_token.decrypt(enc_jwk)
+            id_token = IdToken(nested_id_token)
+        else:
+            id_token = raw_id_token
+
+        id_token_alg = id_token.get_header("alg")
+        if id_token_alg is None:
+            id_token_alg = client.id_token_signed_response_alg
+        if id_token_alg is None:
+            msg = """
+token does not contain an `alg` parameter to specify the signature algorithm,
+and no algorithm has been configured for the client (using param `id_token_signed_response_alg`).
+"""
+            raise InvalidIdToken(msg, self, id_token)
+        if client.id_token_signed_response_alg is not None and id_token_alg != client.id_token_signed_response_alg:
+            raise MismatchingIdTokenAlg(id_token.alg, client.id_token_signed_response_alg, self, id_token)
+
+        verification_jwk: jwskate.Jwk
+
+        if id_token_alg in jwskate.SignatureAlgs.ALL_SYMMETRIC:
+            if not client.client_secret:
+                msg = "token is symmetrically signed but this client does not have a Client Secret."
+                raise InvalidIdToken(msg, self, id_token)
+            verification_jwk = jwskate.SymmetricJwk.from_bytes(client.client_secret, alg=id_token_alg)
+            id_token.verify_signature(verification_jwk, alg=id_token_alg)
+        elif id_token_alg in jwskate.SignatureAlgs.ALL_ASYMMETRIC:
+            if not client.authorization_server_jwks:
+                msg = "token is asymmetrically signed but the Authorization Server JWKS is not available."
+                raise InvalidIdToken(msg, self, id_token)
+
+            if id_token.get_header("kid") is None:
+                msg = """
+token does not contain a Key ID (kid) to specify the asymmetric key
+to use for signature verification."""
+                raise InvalidIdToken(msg, self, id_token)
+            try:
+                verification_jwk = client.authorization_server_jwks.get_jwk_by_kid(id_token.kid)
+            except KeyError:
+                msg = f"""\
+token is asymmetrically signed but there is no key
+with kid='{id_token.kid}' in the Authorization Server JWKS."""
+                raise InvalidIdToken(msg, self, id_token) from None
+
+            if id_token_alg not in verification_jwk.supported_signing_algorithms():
+                msg = "token is asymmetrically signed but its algorithm is not supported by the verification key."
+                raise InvalidIdToken(msg, self, id_token)
+        else:
+            raise UnsupportedIdTokenAlg(self, id_token, id_token_alg)
+
+        id_token.verify(verification_jwk, alg=id_token_alg)
+
+        if azr.issuer and id_token.issuer != azr.issuer:
+            raise MismatchingIdTokenIssuer(id_token.issuer, azr.issuer, self, id_token)
+
+        if id_token.audiences and client.client_id not in id_token.audiences:
+            raise MismatchingIdTokenAudience(id_token.audiences, client.client_id, self, id_token)
+
+        if id_token.authorized_party is not None and id_token.authorized_party != client.client_id:
+            raise MismatchingIdTokenAzp(id_token.azp, client.client_id, self, id_token)
+
+        if id_token.is_expired(leeway=exp_leeway):
+            raise ExpiredIdToken(self, id_token)
+
+        if azr.nonce and id_token.nonce != azr.nonce:
+            raise MismatchingIdTokenNonce(id_token.nonce, azr.nonce, self, id_token)
+
+        if azr.acr_values and id_token.acr not in azr.acr_values:
+            raise MismatchingIdTokenAcr(id_token.acr, azr.acr_values, self, id_token)
+
+        hash_function = IdToken.hash_method(verification_jwk, id_token_alg)
+
+        at_hash = id_token.get_claim("at_hash")
+        if at_hash is not None:
+            expected_at_hash = hash_function(self.access_token)
+            if expected_at_hash != at_hash:
+                msg = f"mismatching 'at_hash' value (expected '{expected_at_hash}', got '{at_hash}')"
+                raise InvalidIdToken(msg, self, id_token)
+
+        c_hash = id_token.get_claim("c_hash")
+        if c_hash is not None:
+            expected_c_hash = hash_function(azr.code)
+            if expected_c_hash != c_hash:
+                msg = f"mismatching 'c_hash' value (expected '{expected_c_hash}', got '{c_hash}')"
+                raise InvalidIdToken(msg, self, id_token)
+
+        s_hash = id_token.get_claim("s_hash")
+        if s_hash is not None:
+            if azr.state is None:
+                msg = "token has a 's_hash' claim but no state was included in the request."
+                raise InvalidIdToken(msg, self, id_token)
+            expected_s_hash = hash_function(azr.state)
+            if expected_s_hash != s_hash:
+                msg = f"mismatching 's_hash' value (expected '{expected_s_hash}', got '{s_hash}')"
+                raise InvalidIdToken(msg, self, id_token)
+
+        if azr.max_age is not None:
+            auth_time = id_token.auth_datetime
+            if auth_time is None:
+                msg = """
+a `max_age` parameter was included in the authorization request,
+but the ID Token does not contain an `auth_time` claim.
+"""
+                raise InvalidIdToken(msg, self, id_token) from None
+            auth_age = datetime.now(tz=timezone.utc) - auth_time
+            if auth_age.total_seconds() > azr.max_age + auth_time_leeway:
+                msg = f"""
+user authentication happened too far in the past.
+The `auth_time` parameter from the ID Token indicate that
+the last Authentication Time was at {auth_time} ({auth_age.total_seconds()} sec ago),
+but the authorization request `max_age` parameter specified that it must
+be a maximum of {azr.max_age} sec ago.
+"""
+                raise InvalidIdToken(msg, self, id_token)
+
+        return self.__class__(
+            access_token=self.access_token,
+            expires_at=self.expires_at,
+            scope=self.scope,
+            refresh_token=self.refresh_token,
+            token_type=self.token_type,
+            id_token=id_token,
+            **self.kwargs,
+        )
+
+
- +
-
+
+

+ as_dict() +

+
+

Return a dict of parameters.

+

That is suitable for serialization or to init another BearerToken.

-
+
+ Source code in requests_oauth2client/tokens.py + 
518
+519
+520
+521
+522
+523
+524
+525
+526
+527
+528
def as_dict(self) -> dict[str, Any]:
+    """Return a dict of parameters.
+
+    That is suitable for serialization or to init another BearerToken.
+
+    """
+    d = asdict(self)
+    d.pop("expires_at")
+    d["expires_in"] = self.expires_in
+    d.update(**d.pop("kwargs", {}))
+    return {key: val for key, val in d.items() if val is not None}
+
+
+
+
-
- args: dict[str, Any] - - - property - -
+
+
-
- -

Return a dict with all the query parameters from this AuthorizationRequest.

+
+
-

Returns:

- - - - - - - - - - - - - -
TypeDescription
- dict[str, Any] - -
-

a dict of parameters

-
-
-
-
+

+ BearerTokenSerializer -
+

-
- furl: furl - - - property - +
-
+

A helper class to serialize Token Response returned by an AS.

+

This may be used to store BearerTokens in session or cookies.

+

It needs a dumper and a loader functions that will respectively serialize and deserialize +BearerTokens. Default implementations are provided with use gzip and base64url on the serialized +JSON representation.

-
- -

Return the Authorization Request URI, as a furl.

-
-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
dumper + Callable[[BearerToken], str] | None + +
+

a function to serialize a token into a str.

+
+ 		+ None +
loader + Callable[[str], BearerToken] | None + +
+

a function to deserialize a serialized token representation.

+
+ 		+ None +
+ +
+ Source code in requests_oauth2client/tokens.py + 
579
+580
+581
+582
+583
+584
+585
+586
+587
+588
+589
+590
+591
+592
+593
+594
+595
+596
+597
+598
+599
+600
+601
+602
+603
+604
+605
+606
+607
+608
+609
+610
+611
+612
+613
+614
+615
+616
+617
+618
+619
+620
+621
+622
+623
+624
+625
+626
+627
+628
+629
+630
+631
+632
+633
+634
+635
+636
+637
+638
+639
+640
+641
+642
+643
+644
+645
+646
+647
+648
+649
+650
+651
+652
+653
+654
+655
+656
+657
+658
+659
+660
class BearerTokenSerializer:
+    """A helper class to serialize Token Response returned by an AS.
+
+    This may be used to store BearerTokens in session or cookies.
+
+    It needs a `dumper` and a `loader` functions that will respectively serialize and deserialize
+    BearerTokens. Default implementations are provided with use gzip and base64url on the serialized
+    JSON representation.
+
+    Args:
+        dumper: a function to serialize a token into a `str`.
+        loader: a function to deserialize a serialized token representation.
+
+    """
+
+    def __init__(
+        self,
+        dumper: Callable[[BearerToken], str] | None = None,
+        loader: Callable[[str], BearerToken] | None = None,
+    ) -> None:
+        self.dumper = dumper or self.default_dumper
+        self.loader = loader or self.default_loader
+
+    @staticmethod
+    def default_dumper(token: BearerToken) -> str:
+        """Serialize a token as JSON, then compress with deflate, then encodes as base64url.
+
+        Args:
+            token: the `BearerToken` to serialize
+
+        Returns:
+            the serialized value
+
+        """
+        d = asdict(token)
+        d.update(**d.pop("kwargs", {}))
+        return (
+            BinaPy.serialize_to("json", {k: w for k, w in d.items() if w is not None}).to("deflate").to("b64u").ascii()
+        )
+
+    def default_loader(self, serialized: str, token_class: type[BearerToken] = BearerToken) -> BearerToken:
+        """Deserialize a BearerToken.
+
+        This does the opposite operations than `default_dumper`.
+
+        Args:
+            serialized: the serialized token
+            token_class: class to use to deserialize the Token
+
+        Returns:
+            a BearerToken
+
+        """
+        attrs = BinaPy(serialized).decode_from("b64u").decode_from("deflate").parse_from("json")
+        expires_at = attrs.get("expires_at")
+        if expires_at:
+            attrs["expires_at"] = datetime.fromtimestamp(expires_at, tz=timezone.utc)
+        return token_class(**attrs)
+
+    def dumps(self, token: BearerToken) -> str:
+        """Serialize and compress a given token for easier storage.
+
+        Args:
+            token: a BearerToken to serialize
+
+        Returns:
+            the serialized token, as a str
+
+        """
+        return self.dumper(token)
+
+    def loads(self, serialized: str) -> BearerToken:
+        """Deserialize a serialized token.
+
+        Args:
+            serialized: the serialized token
+
+        Returns:
+            the deserialized token
+
+        """
+        return self.loader(serialized)
+
+
-
+
-
- uri: str - - - property - -
-
- -

Return the Authorization Request URI, as a str.

-
-
@@ -42943,2803 +39187,25714 @@
+

+ default_dumper(token) -

- generate_state() - - classmethod + staticmethod -
+ -
- -

Generate a random state parameter.

+
-
- Source code in requests_oauth2client/authorization_request.py - 
279
-280
-281
-282
@classmethod
-def generate_state(cls) -> str:
-    """Generate a random `state` parameter."""
-    return secrets.token_urlsafe(32)
-
-
-
+

Serialize a token as JSON, then compress with deflate, then encodes as base64url.

-
+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
token + BearerToken + +
+

the BearerToken to serialize

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the serialized value

+
+
-
+
+ Source code in requests_oauth2client/tokens.py + 
602
+603
+604
+605
+606
+607
+608
+609
+610
+611
+612
+613
+614
+615
+616
+617
@staticmethod
+def default_dumper(token: BearerToken) -> str:
+    """Serialize a token as JSON, then compress with deflate, then encodes as base64url.
+
+    Args:
+        token: the `BearerToken` to serialize
+
+    Returns:
+        the serialized value
+
+    """
+    d = asdict(token)
+    d.update(**d.pop("kwargs", {}))
+    return (
+        BinaPy.serialize_to("json", {k: w for k, w in d.items() if w is not None}).to("deflate").to("b64u").ascii()
+    )
+
+
+
+
+
-
- generate_nonce() - - - classmethod - -
+

+ default_loader(serialized, token_class=BearerToken) +

-
- -

Generate a random nonce.

-
- Source code in requests_oauth2client/authorization_request.py - 
284
-285
-286
-287
@classmethod
-def generate_nonce(cls) -> str:
-    """Generate a random `nonce`."""
-    return secrets.token_urlsafe(32)
-
-
-
+
-
+

Deserialize a BearerToken.

+

This does the opposite operations than default_dumper.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
serialized + str + +
+

the serialized token

+
+ 		+ required +
token_class + type[BearerToken] + +
+

class to use to deserialize the Token

+
+ 		+ BearerToken +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+ +
+ Source code in requests_oauth2client/tokens.py + 
619
+620
+621
+622
+623
+624
+625
+626
+627
+628
+629
+630
+631
+632
+633
+634
+635
+636
def default_loader(self, serialized: str, token_class: type[BearerToken] = BearerToken) -> BearerToken:
+    """Deserialize a BearerToken.
+
+    This does the opposite operations than `default_dumper`.
+
+    Args:
+        serialized: the serialized token
+        token_class: class to use to deserialize the Token
+
+    Returns:
+        a BearerToken
+
+    """
+    attrs = BinaPy(serialized).decode_from("b64u").decode_from("deflate").parse_from("json")
+    expires_at = attrs.get("expires_at")
+    if expires_at:
+        attrs["expires_at"] = datetime.fromtimestamp(expires_at, tz=timezone.utc)
+    return token_class(**attrs)
+
+
+
+
+

+ dumps(token) -

- as_dict() +
- +
-
- -

Return the full argument dict.

-

This can be used to serialize this request and/or to initialize a similar request.

+

Serialize and compress a given token for easier storage.

-
- Source code in requests_oauth2client/authorization_request.py - 
371
-372
-373
-374
-375
-376
-377
-378
-379
-380
def as_dict(self) -> dict[str, Any]:
-    """Return the full argument dict.
-
-    This can be used to serialize this request and/or to initialize a similar request.
-
-    """
-    d = asdict(self)
-    d.update(**d.pop("kwargs", {}))
-    d.pop("code_challenge")
-    return d
-
-
-
-
+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
token + BearerToken + +
+

a BearerToken to serialize

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the serialized token, as a str

+
+
+ +
+ Source code in requests_oauth2client/tokens.py + 
638
+639
+640
+641
+642
+643
+644
+645
+646
+647
+648
def dumps(self, token: BearerToken) -> str:
+    """Serialize and compress a given token for easier storage.
+
+    Args:
+        token: a BearerToken to serialize
+
+    Returns:
+        the serialized token, as a str
+
+    """
+    return self.dumper(token)
+
+
+
+
+

+ loads(serialized) -

- validate_callback(response) - -
+ -
- -

Validate an Authorization Response against this Request.

-

Validate a given Authorization Response URI against this Authorization Request, and return -an -AuthorizationResponse.

-

This includes matching the state parameter, checking for returned errors, and extracting -the returned code and other parameters.

+
+

Deserialize a serialized token.

-

Parameters:

- - - - - - - - - - - - - - - +

Parameters:

+
NameTypeDescriptionDefault
response - str - -
-

the Authorization Response URI. This can be the full URL, or just the -query parameters (still encoded as x-www-form-urlencoded).

-
- 		- required -
+ + + + + + - -
NameTypeDescriptionDefault
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- AuthorizationResponse - -
-

the extracted code, if all checks are successful

-
-
- - - -

Raises:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
TypeDescription
- MismatchingIssuer - -
-

if the 'iss' received from the response does not match the -expected value.

-
-
- MismatchingState - -
-

if the response state does not match the expected value.

-
-
- OAuth2Error - -
-

if the response includes an error.

-
-
- MissingAuthCode - -
-

if the response does not contain a code.

-
-
- NotImplementedError - -
-

if response_type anything else than 'code'.

-
-
- -
- Source code in requests_oauth2client/authorization_request.py - 
397
-398
-399
-400
-401
-402
-403
-404
-405
-406
-407
-408
-409
-410
-411
-412
-413
-414
-415
-416
-417
-418
-419
-420
-421
-422
-423
-424
-425
-426
-427
-428
-429
-430
-431
-432
-433
-434
-435
-436
-437
-438
-439
-440
-441
-442
-443
-444
-445
-446
-447
-448
-449
-450
-451
-452
-453
-454
-455
-456
-457
-458
-459
-460
-461
def validate_callback(self, response: str) -> AuthorizationResponse:
-    """Validate an Authorization Response against this Request.
-
-    Validate a given Authorization Response URI against this Authorization Request, and return
-    an
-    [AuthorizationResponse][requests_oauth2client.authorization_request.AuthorizationResponse].
-
-    This includes matching the `state` parameter, checking for returned errors, and extracting
-    the returned `code` and other parameters.
-
-    Args:
-        response: the Authorization Response URI. This can be the full URL, or just the
-            query parameters (still encoded as x-www-form-urlencoded).
-
-    Returns:
-        the extracted code, if all checks are successful
-
-    Raises:
-        MismatchingIssuer: if the 'iss' received from the response does not match the
-            expected value.
-        MismatchingState: if the response `state` does not match the expected value.
-        OAuth2Error: if the response includes an error.
-        MissingAuthCode: if the response does not contain a `code`.
-        NotImplementedError: if response_type anything else than 'code'.
-
-    """
-    try:
-        response_url = furl(response)
-    except ValueError:
-        return self.on_response_error(response)
-
-    # validate 'iss' according to RFC9207
-    received_issuer = response_url.args.get("iss")
-    if self.authorization_response_iss_parameter_supported or received_issuer:
-        if received_issuer is None:
-            raise MissingIssuer()
-        if self.issuer and received_issuer != self.issuer:
-            raise MismatchingIssuer(self.issuer, received_issuer)
-
-    # validate state
-    requested_state = self.state
-    if requested_state:
-        received_state = response_url.args.get("state")
-        if requested_state != received_state:
-            raise MismatchingState(requested_state, received_state)
-
-    error = response_url.args.get("error")
-    if error:
-        return self.on_response_error(response)
-
-    if "code" in self.response_type:
-        code: str = response_url.args.get("code")
-        if code is None:
-            raise MissingAuthCode()
-    else:
-        raise NotImplementedError()
-
-    return AuthorizationResponse(
-        code_verifier=self.code_verifier,
-        redirect_uri=self.redirect_uri,
-        nonce=self.nonce,
-        acr_values=self.acr_values,
-        max_age=self.max_age,
-        **response_url.args,
-    )
-
-
+ + + + serialized + + str + + +
+

the serialized token

+
+ + + required + + + + + + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

the deserialized token

+
+
+ +
+ Source code in requests_oauth2client/tokens.py + 
650
+651
+652
+653
+654
+655
+656
+657
+658
+659
+660
def loads(self, serialized: str) -> BearerToken:
+    """Deserialize a serialized token.
+
+    Args:
+        serialized: the serialized token
+
+    Returns:
+        the deserialized token
+
+    """
+    return self.loader(serialized)
+
+
+
+ +
+ + +
+
+
+
-
+

+ ExpiredAccessToken -

- sign_request_jwt(jwk, alg=None, lifetime=None) -
+ -
- -

Sign the request object that matches this Authorization Request parameters.

+
+

+ Bases: RuntimeError

+

Raised when an expired access token is used.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
jwk - Jwk | dict[str, Any] - -
-

the JWK to use to sign the request

-
- 		- required -
alg - str | None - -
-

the alg to use to sign the request, if the provided jwk has no alg parameter.

-
- 		- None -
lifetime - int | None - -
-

an optional number of seconds of validity for the signed request. -If present, iat an exp claims will be included in the signed JWT.

-
- 		- None -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- SignedJwt - -
-

a Jwt that contains the signed request object.

-
-
- -
- Source code in requests_oauth2client/authorization_request.py - 
463
-464
-465
-466
-467
-468
-469
-470
-471
-472
-473
-474
-475
-476
-477
-478
-479
-480
-481
-482
-483
-484
-485
-486
-487
-488
-489
def sign_request_jwt(
-    self,
-    jwk: Jwk | dict[str, Any],
-    alg: str | None = None,
-    lifetime: int | None = None,
-) -> SignedJwt:
-    """Sign the `request` object that matches this Authorization Request parameters.
-
-    Args:
-        jwk: the JWK to use to sign the request
-        alg: the alg to use to sign the request, if the provided `jwk` has no `alg` parameter.
-        lifetime: an optional number of seconds of validity for the signed request.
-            If present, `iat` an `exp` claims will be included in the signed JWT.
-
-    Returns:
-        a `Jwt` that contains the signed request object.
-
-    """
-    claims = self.args
-    if lifetime:
-        claims["iat"] = Jwt.timestamp()
-        claims["exp"] = Jwt.timestamp(lifetime)
-    return Jwt.sign(
-        claims,
-        key=jwk,
-        alg=alg,
-    )
-
-
-
+
+ Source code in requests_oauth2client/tokens.py + 
223
+224
class ExpiredAccessToken(RuntimeError):
+    """Raised when an expired access token is used."""
+
+
+ +
+
-
+

+ ExpiredIdToken -

- sign(jwk, alg=None, lifetime=None, **kwargs) -
+ -
- -

Sign this Authorization Request and return a new one.

-

This replaces all parameters with a signed request JWT.

+
+

+ Bases: InvalidIdToken

+

Raised when the returned ID Token is expired.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
jwk - Jwk | dict[str, Any] - -
-

the JWK to use to sign the request

-
- 		- required -
alg - str | None - -
-

the alg to use to sign the request, if the provided jwk has no alg parameter.

-
- 		- None -
lifetime - int | None - -
-

lifetime of the resulting Jwt (used to calculate the 'exp' claim). -By default, don't use an 'exp' claim.

-
- 		- None -
kwargs - Any - -
-

additional query parameters to include in the signed authorization request

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- RequestParameterAuthorizationRequest - -
-

the signed Authorization Request

-
-
- -
- Source code in requests_oauth2client/authorization_request.py - 
491
-492
-493
-494
-495
-496
-497
-498
-499
-500
-501
-502
-503
-504
-505
-506
-507
-508
-509
-510
-511
-512
-513
-514
-515
-516
-517
-518
-519
-520
def sign(
-    self,
-    jwk: Jwk | dict[str, Any],
-    alg: str | None = None,
-    lifetime: int | None = None,
-    **kwargs: Any,
-) -> RequestParameterAuthorizationRequest:
-    """Sign this Authorization Request and return a new one.
-
-    This replaces all parameters with a signed `request` JWT.
-
-    Args:
-        jwk: the JWK to use to sign the request
-        alg: the alg to use to sign the request, if the provided `jwk` has no `alg` parameter.
-        lifetime: lifetime of the resulting Jwt (used to calculate the 'exp' claim).
-            By default, don't use an 'exp' claim.
-        kwargs: additional query parameters to include in the signed authorization request
-
-    Returns:
-        the signed Authorization Request
-
-    """
-    request_jwt = self.sign_request_jwt(jwk, alg, lifetime)
-    return RequestParameterAuthorizationRequest(
-        authorization_endpoint=self.authorization_endpoint,
-        client_id=self.client_id,
-        request=str(request_jwt),
-        expires_at=request_jwt.expires_at,
-        **kwargs,
-    )
-
-
-
+
+ Source code in requests_oauth2client/tokens.py + 
200
+201
+202
+203
+204
+205
+206
class ExpiredIdToken(InvalidIdToken):
+    """Raised when the returned ID Token is expired."""
+
+    def __init__(self, token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__("token is expired", token, id_token)
+        self.received = id_token.expires_at
+        self.expected = datetime.now(tz=timezone.utc)
+
+
-
-
+
+ + -
- sign_and_encrypt_request_jwt(sign_jwk, enc_jwk, sign_alg=None, enc_alg=None, enc='A128CBC-HS256', lifetime=None) -
-
- -

Sign and encrypt a request object for this Authorization Request.

-

The signed request will contain the same parameters as this AuthorizationRequest.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
sign_jwk - Jwk | dict[str, Any] - -
-

the JWK to use to sign the request

-
- 		- required -
enc_jwk - Jwk | dict[str, Any] - -
-

the JWK to use to encrypt the request

-
- 		- required -
sign_alg - str | None - -
-

the alg to use to sign the request, if sign_jwk has no alg parameter.

-
- 		- None -
enc_alg - str | None - -
-

the alg to use to encrypt the request, if enc_jwk has no alg parameter.

-
- 		- None -
enc - str - -
-

the encoding to use to encrypt the request.

-
- 		- 'A128CBC-HS256' -
lifetime - int | None - -
-

lifetime of the resulting Jwt (used to calculate the 'exp' claim). -By default, do not include an 'exp' claim.

-
- 		- None -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- JweCompact - -
-

the signed and encrypted request object, as a jwskate.Jwt

-
-
- -
- Source code in requests_oauth2client/authorization_request.py - 
522
-523
-524
-525
-526
-527
-528
-529
-530
-531
-532
-533
-534
-535
-536
-537
-538
-539
-540
-541
-542
-543
-544
-545
-546
-547
-548
-549
-550
-551
-552
-553
-554
-555
-556
-557
-558
-559
def sign_and_encrypt_request_jwt(
-    self,
-    sign_jwk: Jwk | dict[str, Any],
-    enc_jwk: Jwk | dict[str, Any],
-    sign_alg: str | None = None,
-    enc_alg: str | None = None,
-    enc: str = "A128CBC-HS256",
-    lifetime: int | None = None,
-) -> JweCompact:
-    """Sign and encrypt a `request` object for this Authorization Request.
-
-    The signed `request` will contain the same parameters as this AuthorizationRequest.
-
-    Args:
-        sign_jwk: the JWK to use to sign the request
-        enc_jwk: the JWK to use to encrypt the request
-        sign_alg: the alg to use to sign the request, if `sign_jwk` has no `alg` parameter.
-        enc_alg: the alg to use to encrypt the request, if `enc_jwk` has no `alg` parameter.
-        enc: the encoding to use to encrypt the request.
-        lifetime: lifetime of the resulting Jwt (used to calculate the 'exp' claim).
-            By default, do not include an 'exp' claim.
-
-    Returns:
-        the signed and encrypted request object, as a `jwskate.Jwt`
-
-    """
-    claims = self.args
-    if lifetime:
-        claims["iat"] = Jwt.timestamp()
-        claims["exp"] = Jwt.timestamp(lifetime)
-    return Jwt.sign_and_encrypt(
-        claims=claims,
-        sign_key=sign_jwk,
-        sign_alg=sign_alg,
-        enc_key=enc_jwk,
-        enc_alg=enc_alg,
-        enc=enc,
-    )
-
-
+
+
+
-
+

+ IdToken -

- sign_and_encrypt(sign_jwk, enc_jwk, sign_alg=None, enc_alg=None, enc='A128CBC-HS256', lifetime=None) -
+ -
- -

Sign and encrypt the current Authorization Request.

-

This replaces all parameters with a matching request object.

+
+

+ Bases: SignedJwt

+

Represent an ID Token.

+

An ID Token is actually a Signed JWT. If the ID Token is encrypted, it must be decoded +beforehand.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
sign_jwk - Jwk | dict[str, Any] - -
-

the JWK to use to sign the request

-
- 		- required -
enc_jwk - Jwk | dict[str, Any] - -
-

the JWK to use to encrypt the request

-
- 		- required -
sign_alg - str | None - -
-

the alg to use to sign the request, if sign_jwk has no alg parameter.

-
- 		- None -
enc_alg - str | None - -
-

the alg to use to encrypt the request, if enc_jwk has no alg parameter.

-
- 		- None -
enc - str - -
-

the encoding to use to encrypt the request.

-
- 		- 'A128CBC-HS256' -
lifetime - int | None - -
-

lifetime of the resulting Jwt (used to calculate the 'exp' claim). -By default, do not include an 'exp' claim.

-
- 		- None -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- RequestParameterAuthorizationRequest - -
-

a RequestParameterAuthorizationRequest, with a request object as parameter

-
-
- -
- Source code in requests_oauth2client/authorization_request.py - 
561
-562
-563
-564
-565
-566
-567
-568
-569
-570
-571
-572
-573
-574
-575
-576
-577
-578
-579
-580
-581
-582
-583
-584
-585
-586
-587
-588
-589
-590
-591
-592
-593
-594
-595
-596
-597
-598
-599
def sign_and_encrypt(
-    self,
-    sign_jwk: Jwk | dict[str, Any],
-    enc_jwk: Jwk | dict[str, Any],
-    sign_alg: str | None = None,
-    enc_alg: str | None = None,
-    enc: str = "A128CBC-HS256",
-    lifetime: int | None = None,
-) -> RequestParameterAuthorizationRequest:
-    """Sign and encrypt the current Authorization Request.
-
-    This replaces all parameters with a matching `request` object.
-
-    Args:
-        sign_jwk: the JWK to use to sign the request
-        enc_jwk: the JWK to use to encrypt the request
-        sign_alg: the alg to use to sign the request, if `sign_jwk` has no `alg` parameter.
-        enc_alg: the alg to use to encrypt the request, if `enc_jwk` has no `alg` parameter.
-        enc: the encoding to use to encrypt the request.
-        lifetime: lifetime of the resulting Jwt (used to calculate the 'exp' claim).
-            By default, do not include an 'exp' claim.
-
-    Returns:
-        a `RequestParameterAuthorizationRequest`, with a request object as parameter
-
-    """
-    request_jwt = self.sign_and_encrypt_request_jwt(
-        sign_jwk=sign_jwk,
-        enc_jwk=enc_jwk,
-        sign_alg=sign_alg,
-        enc_alg=enc_alg,
-        enc=enc,
-        lifetime=lifetime,
-    )
-    return RequestParameterAuthorizationRequest(
-        authorization_endpoint=self.authorization_endpoint,
-        client_id=self.client_id,
-        request=str(request_jwt),
-    )
-
-
-
+
+ Source code in requests_oauth2client/tokens.py + 
 45
+ 46
+ 47
+ 48
+ 49
+ 50
+ 51
+ 52
+ 53
+ 54
+ 55
+ 56
+ 57
+ 58
+ 59
+ 60
+ 61
+ 62
+ 63
+ 64
+ 65
+ 66
+ 67
+ 68
+ 69
+ 70
+ 71
+ 72
+ 73
+ 74
+ 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
class IdToken(jwskate.SignedJwt):
+    """Represent an ID Token.
+
+    An ID Token is actually a Signed JWT. If the ID Token is encrypted, it must be decoded
+    beforehand.
+
+    """
+
+    @property
+    def authorized_party(self) -> str | None:
+        """The Authorized Party (azp)."""
+        azp = self.claims.get("azp")
+        if azp is None or isinstance(azp, str):
+            return azp
+        msg = "`azp` attribute must be a string."
+        raise AttributeError(msg)
+
+    @property
+    def auth_datetime(self) -> datetime | None:
+        """The last user authentication time (auth_time)."""
+        auth_time = self.claims.get("auth_time")
+        if auth_time is None:
+            return None
+        if isinstance(auth_time, int) and auth_time > 0:
+            return self.timestamp_to_datetime(auth_time)
+        msg = "`auth_time` must be a positive integer"
+        raise AttributeError(msg)
+
+    @classmethod
+    def hash_method(cls, key: jwskate.Jwk, alg: str | None = None) -> Callable[[str], str]:
+        """Returns a callable that generates valid OIDC hashes, such as `at_hash`, `c_hash`, etc.
+
+        Args:
+            key: the ID token signature verification public key
+            alg: the ID token signature algorithm
+
+        Returns:
+            a callable that takes a string as input and produces a valid hash as a str output
+
+        """
+        alg_class = jwskate.select_alg_class(key.SIGNATURE_ALGORITHMS, jwk_alg=key.alg, alg=alg)
+        if alg_class == jwskate.EdDsa:
+            if key.crv == "Ed25519":
+
+                def hash_method(token: str) -> str:
+                    return BinaPy(token).to("sha512")[:32].to("b64u").decode()
+
+            elif key.crv == "Ed448":
+
+                def hash_method(token: str) -> str:
+                    return BinaPy(token).to("shake256", 456).to("b64u").decode()
+
+        else:
+            hash_alg = alg_class.hashing_alg.name
+            hash_size = alg_class.hashing_alg.digest_size
+
+            def hash_method(token: str) -> str:
+                return BinaPy(token).to(hash_alg)[: hash_size // 2].to("b64u").decode()
+
+        return hash_method
+
+
+ + + +
+ + + + + + + +
+ + + +

+ authorized_party: str | None + + + property + + +

+ + +
+ +

The Authorized Party (azp).

+
+ +
+ +
+ + + +

+ auth_datetime: datetime | None + + + property + + +

+ + +
+ +

The last user authentication time (auth_time).

+
+
+

+ hash_method(key, alg=None) -

- on_response_error(response) + + classmethod + -
+ -
- -

Error handler for Authorization Response errors.

-

Triggered by -validate_callback() -if the response uri contains an error.

+
+

Returns a callable that generates valid OIDC hashes, such as at_hash, c_hash, etc.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - str - -
-

the Authorization Response URI. This can be the full URL, or just the query parameters.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - - - +

Parameters:

+
TypeDescription
- AuthorizationResponse - -
-

may return a default code that will be returned by validate_callback. But this method

-
-
- AuthorizationResponse - -
-

will most likely raise exceptions instead.

-
-
+ + + + + + - -
NameTypeDescriptionDefault
- -
- Source code in requests_oauth2client/authorization_request.py - 
601
-602
-603
-604
-605
-606
-607
-608
-609
-610
-611
-612
-613
-614
-615
-616
-617
-618
-619
-620
-621
def on_response_error(self, response: str) -> AuthorizationResponse:
-    """Error handler for Authorization Response errors.
-
-    Triggered by
-    [validate_callback()][requests_oauth2client.authorization_request.AuthorizationRequest.validate_callback]
-    if the response uri contains an error.
-
-    Args:
-        response: the Authorization Response URI. This can be the full URL, or just the query parameters.
-
-    Returns:
-        may return a default code that will be returned by `validate_callback`. But this method
-        will most likely raise exceptions instead.
-
-    """
-    response_url = furl(response)
-    error = response_url.args.get("error")
-    error_description = response_url.args.get("error_description")
-    error_uri = response_url.args.get("error_uri")
-    exception_class = self.exception_classes.get(error, AuthorizationResponseError)
-    raise exception_class(error, error_description, error_uri)
-
-
+ + + + key + + Jwk + + +
+

the ID token signature verification public key

+
+ + + required + + + + alg + + str | None + + +
+

the ID token signature algorithm

+
+ + + None + + + + + + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Callable[[str], str] + +
+

a callable that takes a string as input and produces a valid hash as a str output

+
+
+ +
+ Source code in requests_oauth2client/tokens.py + 
 73
+ 74
+ 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
@classmethod
+def hash_method(cls, key: jwskate.Jwk, alg: str | None = None) -> Callable[[str], str]:
+    """Returns a callable that generates valid OIDC hashes, such as `at_hash`, `c_hash`, etc.
+
+    Args:
+        key: the ID token signature verification public key
+        alg: the ID token signature algorithm
+
+    Returns:
+        a callable that takes a string as input and produces a valid hash as a str output
+
+    """
+    alg_class = jwskate.select_alg_class(key.SIGNATURE_ALGORITHMS, jwk_alg=key.alg, alg=alg)
+    if alg_class == jwskate.EdDsa:
+        if key.crv == "Ed25519":
+
+            def hash_method(token: str) -> str:
+                return BinaPy(token).to("sha512")[:32].to("b64u").decode()
+
+        elif key.crv == "Ed448":
+
+            def hash_method(token: str) -> str:
+                return BinaPy(token).to("shake256", 456).to("b64u").decode()
+
+    else:
+        hash_alg = alg_class.hashing_alg.name
+        hash_size = alg_class.hashing_alg.digest_size
+
+        def hash_method(token: str) -> str:
+            return BinaPy(token).to(hash_alg)[: hash_size // 2].to("b64u").decode()
+
+    return hash_method
+
+
+
+ +
+ + +
+
+
+
+ + + +

+ InvalidIdToken + + +

+ + +
+

+ Bases: ValueError

+ + +

Raised when trying to validate an invalid ID Token value.

+ +
+ Source code in requests_oauth2client/tokens.py + 
107
+108
+109
+110
+111
+112
+113
class InvalidIdToken(ValueError):
+    """Raised when trying to validate an invalid ID Token value."""
+
+    def __init__(self, message: str, token: TokenResponse, id_token: IdToken | None = None) -> None:
+        super().__init__(f"Invalid ID Token: {message}")
+        self.token = token
+        self.id_token = id_token
+
+
+ + + +
+ -
-
-
-
-

- RequestParameterAuthorizationRequest + +

+ +
+ +
+ +
+ + + +

+ MismatchingIdTokenAcr + + +

+ + +
+

+ Bases: InvalidIdToken

+ + +

Raised when the returned ID Token doesn't contain one of the requested ACR Values.

+

This happens when the authorization request includes an acr_values parameter but the returned +ID Token includes a different value.

+ +
+ Source code in requests_oauth2client/tokens.py + 
155
+156
+157
+158
+159
+160
+161
+162
+163
+164
+165
+166
class MismatchingIdTokenAcr(InvalidIdToken):
+    """Raised when the returned ID Token doesn't contain one of the requested ACR Values.
+
+    This happens when the authorization request includes an `acr_values` parameter but the returned
+    ID Token includes a different value.
+
+    """
+
+    def __init__(self, acr: str, expected: Sequence[str], token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__(f"token contains acr '{acr}' while client expects one of '{expected}'", token, id_token)
+        self.received = acr
+        self.expected = expected
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ MismatchingIdTokenAlg + + +

+ + +
+

+ Bases: InvalidIdToken

+ + +

Raised when the returned ID Token is signed with an unexpected alg.

+ +
+ Source code in requests_oauth2client/tokens.py + 
191
+192
+193
+194
+195
+196
+197
class MismatchingIdTokenAlg(InvalidIdToken):
+    """Raised when the returned ID Token is signed with an unexpected alg."""
+
+    def __init__(self, token_alg: str, client_alg: str, token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__(f"token is signed with alg {token_alg}, client expects {client_alg}", token, id_token)
+        self.received = token_alg
+        self.expected = client_alg
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ MismatchingIdTokenAudience + + +

+ + +
+

+ Bases: InvalidIdToken

+ + +

Raised when the ID Token audience does not include the requesting Client ID.

+ +
+ Source code in requests_oauth2client/tokens.py + 
169
+170
+171
+172
+173
+174
+175
+176
+177
class MismatchingIdTokenAudience(InvalidIdToken):
+    """Raised when the ID Token audience does not include the requesting Client ID."""
+
+    def __init__(self, audiences: Sequence[str], client_id: str, token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__(
+            f"token audience (`aud`) '{audiences}' does not match client_id '{client_id}'", token, id_token
+        )
+        self.received = audiences
+        self.expected = client_id
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ MismatchingIdTokenAzp + + +

+ + +
+

+ Bases: InvalidIdToken

+ + +

Raised when the ID Token Authorized Presenter (azp) claim is not the Client ID.

+ +
+ Source code in requests_oauth2client/tokens.py + 
180
+181
+182
+183
+184
+185
+186
+187
+188
class MismatchingIdTokenAzp(InvalidIdToken):
+    """Raised when the ID Token Authorized Presenter (azp) claim is not the Client ID."""
+
+    def __init__(self, azp: str, client_id: str, token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__(
+            f"token Authorized Presenter (`azp`) claim '{azp}' does not match client_id '{client_id}'", token, id_token
+        )
+        self.received = azp
+        self.expected = client_id
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ MismatchingIdTokenIssuer + + +

+ + +
+

+ Bases: InvalidIdToken

+ + +

Raised on mismatching iss value in an ID Token.

+

This happens when the expected issuer value is different from the iss value in an obtained ID Token.

+ +
+ Source code in requests_oauth2client/tokens.py + 
128
+129
+130
+131
+132
+133
+134
+135
+136
+137
+138
class MismatchingIdTokenIssuer(InvalidIdToken):
+    """Raised on mismatching `iss` value in an ID Token.
+
+    This happens when the expected `issuer` value is different from the `iss` value in an obtained ID Token.
+
+    """
+
+    def __init__(self, iss: str | None, expected: str, token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__(f"`iss` from token '{iss}' does not match expected value '{expected}'", token, id_token)
+        self.received = iss
+        self.expected = expected
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ MismatchingIdTokenNonce + + +

+ + +
+

+ Bases: InvalidIdToken

+ + +

Raised on mismatching nonce value in an ID Token.

+

This happens when the authorization request includes a nonce but the returned ID Token include +a different value.

+ +
+ Source code in requests_oauth2client/tokens.py + 
141
+142
+143
+144
+145
+146
+147
+148
+149
+150
+151
+152
class MismatchingIdTokenNonce(InvalidIdToken):
+    """Raised on mismatching `nonce` value in an ID Token.
+
+    This happens when the authorization request includes a `nonce` but the returned ID Token include
+    a different value.
+
+    """
+
+    def __init__(self, nonce: str, expected: str, token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__(f"nonce from token '{nonce}' does not match expected value '{expected}'", token, id_token)
+        self.received = nonce
+        self.expected = expected
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ MissingIdToken + + +

+ + +
+

+ Bases: InvalidIdToken

+ + +

Raised when the Authorization Endpoint does not return a mandatory ID Token.

+

This happens when the Authorization Endpoint does not return an error, but does not return an ID +Token either.

+ +
+ Source code in requests_oauth2client/tokens.py + 
116
+117
+118
+119
+120
+121
+122
+123
+124
+125
class MissingIdToken(InvalidIdToken):
+    """Raised when the Authorization Endpoint does not return a mandatory ID Token.
+
+    This happens when the Authorization Endpoint does not return an error, but does not return an ID
+    Token either.
+
+    """
+
+    def __init__(self, token: TokenResponse) -> None:
+        super().__init__("An expected `id_token` is missing in the response.", token, None)
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ InvalidUri + + +

+ + +
+

+ Bases: ValueError

+ + +

Raised when a URI does not pass validation by validate_endpoint_uri().

+ +
+ Source code in requests_oauth2client/utils.py + 
17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
class InvalidUri(ValueError):
+    """Raised when a URI does not pass validation by `validate_endpoint_uri()`."""
+
+    def __init__(
+        self, url: str, *, https: bool, no_credentials: bool, no_port: bool, no_fragment: bool, path: bool
+    ) -> None:
+        super().__init__("Invalid endpoint uri.")
+        self.url = url
+        self.https = https
+        self.no_credentials = no_credentials
+        self.no_port = no_port
+        self.no_fragment = no_fragment
+        self.path = path
+
+    def errors(self) -> Iterator[str]:
+        """Iterate over all error descriptions, as str."""
+        if self.https:
+            yield "must use https"
+        if self.no_credentials:
+            yield "must not contain basic credentials"
+        if self.no_port:
+            yield "no custom port number allowed"
+        if self.no_fragment:
+            yield "must not contain a uri fragment"
+        if self.path:
+            yield "must include a path other than /"
+
+    def __str__(self) -> str:
+        all_errors = ", ".join(self.errors())
+        return f"Invalid URI: {all_errors}"
+
+
+ + + +
+ + + + + + + + + +
+ + +

+ errors() + +

+ + +
+ +

Iterate over all error descriptions, as str.

+ +
+ Source code in requests_oauth2client/utils.py + 
31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
def errors(self) -> Iterator[str]:
+    """Iterate over all error descriptions, as str."""
+    if self.https:
+        yield "must use https"
+    if self.no_credentials:
+        yield "must not contain basic credentials"
+    if self.no_port:
+        yield "no custom port number allowed"
+    if self.no_fragment:
+        yield "must not contain a uri fragment"
+    if self.path:
+        yield "must include a path other than /"
+
+
+
+ +
+ + + +
+ +
+ +
+ + +
+ + +

+ oauth2_discovery_document_url(issuer) + +

+ + +
+ +

Construct the standardised OAuth 2.0 discovery document url for a given issuer.

+

Based an issuer identifier, returns the standardised URL where the OAuth20 server metadata can +be retrieved.

+

The returned URL is built as specified in +RFC8414.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
issuer + str + +
+

an OAuth20 Authentication Server issuer

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the standardised discovery document URL. Note that no attempt to fetch this document is

+
+
+ str + +
+

made.

+
+
+ +
+ Source code in requests_oauth2client/discovery.py + 
58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
+69
+70
+71
+72
+73
+74
+75
def oauth2_discovery_document_url(issuer: str) -> str:
+    """Construct the standardised OAuth 2.0 discovery document url for a given `issuer`.
+
+    Based an `issuer` identifier, returns the standardised URL where the OAuth20 server metadata can
+    be retrieved.
+
+    The returned URL is built as specified in
+    [RFC8414](https://datatracker.ietf.org/doc/html/rfc8414).
+
+    Args:
+        issuer: an OAuth20 Authentication Server `issuer`
+
+    Returns:
+        the standardised discovery document URL. Note that no attempt to fetch this document is
+        made.
+
+    """
+    return well_known_uri(issuer, "oauth-authorization-server", at_root=True)
+
+
+
+ +
+ +
+ + +

+ oidc_discovery_document_url(issuer) + +

+ + +
+ +

Construct the OIDC discovery document url for a given issuer.

+

Given an issuer identifier, return the standardised URL where the OIDC discovery document can +be retrieved.

+

The returned URL is biuilt as specified in OpenID Connect Discovery +1.0.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
issuer + str + +
+

an OIDC Authentication Server issuer

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the standardised discovery document URL. Note that no attempt to fetch this document is

+
+
+ str + +
+

made.

+
+
+ +
+ Source code in requests_oauth2client/discovery.py + 
38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
def oidc_discovery_document_url(issuer: str) -> str:
+    """Construct the OIDC discovery document url for a given `issuer`.
+
+    Given an `issuer` identifier, return the standardised URL where the OIDC discovery document can
+    be retrieved.
+
+    The returned URL is biuilt as specified in [OpenID Connect Discovery
+    1.0](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
+
+    Args:
+        issuer: an OIDC Authentication Server `issuer`
+
+    Returns:
+        the standardised discovery document URL. Note that no attempt to fetch this document is
+        made.
+
+    """
+    return well_known_uri(issuer, "openid-configuration", at_root=False)
+
+
+
+ +
+ +
+ + +

+ well_known_uri(origin, name, *, at_root=True) + +

+ + +
+ +

Return the location of a well-known document on an origin url.

+

See RFC8615 and OIDC +Discovery.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
origin + str + +
+

origin to use to build the well-known uri.

+
+ 		+ required +
name + str + +
+

document name to use to build the well-known uri.

+
+ 		+ required +
at_root + bool + +
+

if True, assume the well-known document is at root level (as defined in RFC8615). +If False, assume the well-known location is per-directory, as defined in OpenID +Connect Discovery +1.0.

+
+ 		+ True +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the well-know uri, relative to origin, where the well-known document named name should be

+
+
+ str + +
+

found.

+
+
+ +
+ Source code in requests_oauth2client/discovery.py + 
11
+12
+13
+14
+15
+16
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
def well_known_uri(origin: str, name: str, *, at_root: bool = True) -> str:
+    """Return the location of a well-known document on an origin url.
+
+    See [RFC8615](https://datatracker.ietf.org/doc/html/rfc8615) and [OIDC
+    Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
+
+    Args:
+        origin: origin to use to build the well-known uri.
+        name: document name to use to build the well-known uri.
+        at_root: if `True`, assume the well-known document is at root level (as defined in [RFC8615](https://datatracker.ietf.org/doc/html/rfc8615)).
+            If `False`, assume the well-known location is per-directory, as defined in [OpenID
+            Connect Discovery
+            1.0](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
+
+    Returns:
+        the well-know uri, relative to origin, where the well-known document named `name` should be
+        found.
+
+    """
+    url = furl(origin)
+    if at_root:
+        url.path = Path(".well-known") / url.path / name
+    else:
+        url.path.add(Path(".well-known") / name)
+    return str(url)
+
+
+
+ +
+ +
+ + +

+ validate_endpoint_uri(uri, *, https=True, no_credentials=True, no_port=True, no_fragment=True, path=True) + +

+ + +
+ +

Validate that a URI is suitable as an endpoint URI.

+

It checks:

+
    +
  • that the scheme is https
    • +
  • that no custom port number is being used
    • +
  • that no username or password are included
    • +
  • that no fragment is included
    • +
  • that a path is present
    • +
+

Those checks can be individually disabled by using the parameters.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
uri + str + +
+

the uri

+
+ 		+ required +
https + bool + +
+

if True, check that the uri is https

+
+ 		+ True +
no_port + bool + +
+

if True, check that no custom port number is included

+
+ 		+ True +
no_credentials + bool + +
+

if True, check that no username/password are included

+
+ 		+ True +
no_fragment + bool + +
+

if True, check that the uri contains no fragment

+
+ 		+ True +
path + bool + +
+

if True, check that the uri contains a path component

+
+ 		+ True +
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ ValueError + +
+

if the supplied url is not suitable

+
+
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the endpoint URI, if all checks passed

+
+
+ +
+ Source code in requests_oauth2client/utils.py + 
 49
+ 50
+ 51
+ 52
+ 53
+ 54
+ 55
+ 56
+ 57
+ 58
+ 59
+ 60
+ 61
+ 62
+ 63
+ 64
+ 65
+ 66
+ 67
+ 68
+ 69
+ 70
+ 71
+ 72
+ 73
+ 74
+ 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
def validate_endpoint_uri(
+    uri: str,
+    *,
+    https: bool = True,
+    no_credentials: bool = True,
+    no_port: bool = True,
+    no_fragment: bool = True,
+    path: bool = True,
+) -> str:
+    """Validate that a URI is suitable as an endpoint URI.
+
+    It checks:
+
+    - that the scheme is `https`
+    - that no custom port number is being used
+    - that no username or password are included
+    - that no fragment is included
+    - that a path is present
+
+    Those checks can be individually disabled by using the parameters.
+
+    Args:
+        uri: the uri
+        https: if `True`, check that the uri is https
+        no_port: if `True`, check that no custom port number is included
+        no_credentials: if ` True`, check that no username/password are included
+        no_fragment: if `True`, check that the uri contains no fragment
+        path: if `True`, check that the uri contains a path component
+
+    Raises:
+        ValueError: if the supplied url is not suitable
+
+    Returns:
+        the endpoint URI, if all checks passed
+
+    """
+    url = furl(uri)
+    if https and url.scheme == "https":
+        https = False
+    if no_port and url.port == 443:  # noqa: PLR2004
+        no_port = False
+    if no_credentials and not url.username and not url.password:
+        no_credentials = False
+    if no_fragment and not url.fragment:
+        no_fragment = False
+    if path and url.path and url.path != "/":
+        path = False
+
+    if https or no_port or no_credentials or no_fragment or path:
+        raise InvalidUri(
+            uri, https=https, no_port=no_port, no_credentials=no_credentials, no_fragment=no_fragment, path=path
+        )
+
+    return uri
+
+
+
+ +
+ +
+ + +

+ validate_issuer_uri(uri) + +

+ + +
+ +

Validate that an Issuer Identifier URI is valid.

+

This is almost the same as a valid endpoint URI, but a path is not mandatory.

+ +
+ Source code in requests_oauth2client/utils.py + 
105
+106
+107
+108
+109
+110
+111
def validate_issuer_uri(uri: str) -> str:
+    """Validate that an Issuer Identifier URI is valid.
+
+    This is almost the same as a valid endpoint URI, but a path is not mandatory.
+
+    """
+    return validate_endpoint_uri(uri, path=False)
+
+
+
+ +
+ + +
+ + + +

+ api_client + + +

+ +
+ +

ApiClient main module.

+ + + +
+ + + + + + + + +
+ + + +

+ InvalidBoolFieldsParam + + +

+ + +
+

+ Bases: ValueError

+ + +

Raised when an invalid value is passed as 'bool_fields' parameter.

+ +
+ Source code in requests_oauth2client/api_client.py + 
19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
class InvalidBoolFieldsParam(ValueError):
+    """Raised when an invalid value is passed as 'bool_fields' parameter."""
+
+    def __init__(self, bool_fields: object) -> None:
+        super().__init__("""\
+Invalid value for 'bool_fields' parameter. It must be an iterable of 2 str values:
+- first one for the True value
+- second one for the False value
+boolean fields in `data` or `params` with a boolean value (`True` or `False`)
+will be serialized to the corresponding value.
+Default is `('true', 'false')`
+Use this parameter when the target API expects some other values, e.g.:
+- ('on', 'off')
+- ('1', '0')
+- ('yes', 'no')
+""")
+        self.value = bool_fields
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ InvalidPathParam + + +

+ + +
+

+ Bases: TypeError, ValueError

+ + +

Raised when an unexpected path is passed as 'url' parameter.

+ +
+ Source code in requests_oauth2client/api_client.py + 
53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
class InvalidPathParam(TypeError, ValueError):
+    """Raised when an unexpected path is passed as 'url' parameter."""
+
+    def __init__(self, path: None | str | bytes | Iterable[str | bytes | int]) -> None:
+        super().__init__("""\
+Unexpected path. Please provide a path that is relative to the configured `base_url`:
+- `None` (default) to call the base_url
+- a `str` or `bytes`, that will be joined to the base_url (with a / separator, if required)
+- or an iterable of string-able objects, which will be joined to the base_url with / separators
+""")
+        self.url = path
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ ApiClient + + +

+ + +
+ + +

A Wrapper around requests.Session with extra features for REST API calls.

+

Additional features compared to using a requests.Session directly:

+
    +
  • You must set a root url at creation time, which then allows passing relative urls at request time.
    • +
  • It may also raise exceptions instead of returning error responses.
    • +
  • You can also pass additional kwargs at init time, which will be used to configure the +Session, instead of setting them later.
    • +
  • for parameters passed as json, params or data, values that are None can be +automatically discarded from the request
    • +
  • boolean values in data or params fields can be serialized to values that are suitable +for the target API, like "true" or "false", or "1" / "0", instead of the default +values "True" or "False".
    • +
+

base_url will serve as root for relative urls passed to +ApiClient.request(), +ApiClient.get(), etc.

+

A requests.HTTPError will be raised everytime an API call returns an error code (>= 400), unless +you set raise_for_status to False. Additional parameters passed at init time, including +auth will be used to configure the Session.

+ + +
+ Example + 
 1
+ 2
+ 3
+ 4
+ 5
+ 6
+ 7
+ 8
+ 9
+10
+11
+12
+13
+14
+15
+16
+17
from requests_oauth2client import ApiClient
+
+api = ApiClient("https://myapi.local/resource", timeout=10)
+resp = api.get("/myid")  # this will send a GET request
+# to https://myapi.local/resource/myid
+
+# you can pass an underlying requests.Session at init time
+session = requests.Session()
+session.proxies = {"https": "https://localhost:3128"}
+api = ApiClient("https://myapi.local/resource", session=session)
+
+# or you can let ApiClient init its own session and provide additional configuration
+# parameters:
+api = ApiClient(
+    "https://myapi.local/resource",
+    proxies={"https": "https://localhost:3128"},
+)
+
+
+ +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
base_url + str + +
+

the base api url, that is the root for all the target API endpoints.

+
+ 		+ required +
auth + AuthBase | None + +
+

the requests.auth.AuthBase to use as authentication handler.

+
+ 		+ None +
timeout + int | None + +
+

the default timeout, in seconds, to use for each request from this ApiClient. +Can be set to None to disable timeout.

+
+ 		+ 60 +
raise_for_status + bool + +
+

if True, exceptions will be raised everytime a request returns an +error code (>= 400).

+
+ 		+ True +
none_fields + Literal['include', 'exclude', 'empty'] + +
+

defines what to do with parameters with value None in data or json fields.

+
    +
  • if "exclude" (default), fields whose values are None are not included in the request.
    • +
  • if "include", they are included with string value None. This is +the default behavior of requests. Note that they will be serialized to null in JSON.
    • +
  • if "empty", they are included with an empty value (as an empty string).
    • +
+
+ 		+ 'exclude' +
bool_fields + tuple[Any, Any] | None + +
+

a tuple of (true_value, false_value). Fields from data or params with +a boolean value (True or False) will be serialized to the corresponding value. +This can be useful since some APIs expect a 'true' or 'false' value as boolean, +and requests serializes True to 'True' and False to 'False'. +Set it to None to restore default requests behaviour.

+
+ 		+ ('true', 'false') +
session + Session | None + +
+

a preconfigured requests.Session to use with this ApiClient.

+
+ 		+ None +
**session_kwargs + Any + +
+

additional kwargs to configure the underlying requests.Session.

+
+ 		+ {} +
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ InvalidBoolFieldsParam + +
+

if the provided bool_fields parameter is invalid.

+
+
+ +
+ Source code in requests_oauth2client/api_client.py + 
 66
+ 67
+ 68
+ 69
+ 70
+ 71
+ 72
+ 73
+ 74
+ 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
+126
+127
+128
+129
+130
+131
+132
+133
+134
+135
+136
+137
+138
+139
+140
+141
+142
+143
+144
+145
+146
+147
+148
+149
+150
+151
+152
+153
+154
+155
+156
+157
+158
+159
+160
+161
+162
+163
+164
+165
+166
+167
+168
+169
+170
+171
+172
+173
+174
+175
+176
+177
+178
+179
+180
+181
+182
+183
+184
+185
+186
+187
+188
+189
+190
+191
+192
+193
+194
+195
+196
+197
+198
+199
+200
+201
+202
+203
+204
+205
+206
+207
+208
+209
+210
+211
+212
+213
+214
+215
+216
+217
+218
+219
+220
+221
+222
+223
+224
+225
+226
+227
+228
+229
+230
+231
+232
+233
+234
+235
+236
+237
+238
+239
+240
+241
+242
+243
+244
+245
+246
+247
+248
+249
+250
+251
+252
+253
+254
+255
+256
+257
+258
+259
+260
+261
+262
+263
+264
+265
+266
+267
+268
+269
+270
+271
+272
+273
+274
+275
+276
+277
+278
+279
+280
+281
+282
+283
+284
+285
+286
+287
+288
+289
+290
+291
+292
+293
+294
+295
+296
+297
+298
+299
+300
+301
+302
+303
+304
+305
+306
+307
+308
+309
+310
+311
+312
+313
+314
+315
+316
+317
+318
+319
+320
+321
+322
+323
+324
+325
+326
+327
+328
+329
+330
+331
+332
+333
+334
+335
+336
+337
+338
+339
+340
+341
+342
+343
+344
+345
+346
+347
+348
+349
+350
+351
+352
+353
+354
+355
+356
+357
+358
+359
+360
+361
+362
+363
+364
+365
+366
+367
+368
+369
+370
+371
+372
+373
+374
+375
+376
+377
+378
+379
+380
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391
+392
+393
+394
+395
+396
+397
+398
+399
+400
+401
+402
+403
+404
+405
+406
+407
+408
+409
+410
+411
+412
+413
+414
+415
+416
+417
+418
+419
+420
+421
+422
+423
+424
+425
+426
+427
+428
+429
+430
+431
+432
+433
+434
+435
+436
+437
+438
+439
+440
+441
+442
+443
+444
+445
+446
+447
+448
+449
+450
+451
+452
+453
+454
+455
+456
+457
+458
+459
+460
+461
+462
+463
+464
+465
+466
+467
+468
+469
+470
+471
+472
+473
+474
+475
+476
+477
+478
+479
+480
+481
+482
+483
+484
+485
+486
+487
+488
+489
+490
+491
+492
+493
+494
+495
+496
+497
+498
+499
+500
+501
+502
+503
+504
+505
+506
+507
+508
+509
+510
+511
+512
+513
+514
+515
+516
+517
+518
+519
+520
+521
+522
+523
+524
+525
+526
+527
+528
+529
+530
+531
+532
+533
+534
+535
+536
+537
+538
+539
+540
+541
+542
+543
+544
+545
+546
+547
+548
+549
+550
+551
+552
+553
+554
+555
+556
+557
+558
+559
+560
+561
+562
+563
+564
+565
@frozen(init=False)
+class ApiClient:
+    """A Wrapper around [requests.Session][] with extra features for REST API calls.
+
+    Additional features compared to using a [requests.Session][] directly:
+
+    - You must set a root url at creation time, which then allows passing relative urls at request time.
+    - It may also raise exceptions instead of returning error responses.
+    - You can also pass additional kwargs at init time, which will be used to configure the
+    [Session][requests.Session], instead of setting them later.
+    - for parameters passed as `json`, `params` or `data`, values that are `None` can be
+    automatically discarded from the request
+    - boolean values in `data` or `params` fields can be serialized to values that are suitable
+    for the target API, like `"true"`  or `"false"`, or `"1"` / `"0"`, instead of the default
+    values `"True"` or `"False"`.
+
+    `base_url` will serve as root for relative urls passed to
+    [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request],
+    [ApiClient.get()][requests_oauth2client.api_client.ApiClient.get], etc.
+
+    A [requests.HTTPError][] will be raised everytime an API call returns an error code (>= 400), unless
+    you set `raise_for_status` to `False`. Additional parameters passed at init time, including
+    `auth` will be used to configure the [Session][requests.Session].
+
+    Example:
+        ```python
+        from requests_oauth2client import ApiClient
+
+        api = ApiClient("https://myapi.local/resource", timeout=10)
+        resp = api.get("/myid")  # this will send a GET request
+        # to https://myapi.local/resource/myid
+
+        # you can pass an underlying requests.Session at init time
+        session = requests.Session()
+        session.proxies = {"https": "https://localhost:3128"}
+        api = ApiClient("https://myapi.local/resource", session=session)
+
+        # or you can let ApiClient init its own session and provide additional configuration
+        # parameters:
+        api = ApiClient(
+            "https://myapi.local/resource",
+            proxies={"https": "https://localhost:3128"},
+        )
+        ```
+
+    Args:
+        base_url: the base api url, that is the root for all the target API endpoints.
+        auth: the [requests.auth.AuthBase][] to use as authentication handler.
+        timeout: the default timeout, in seconds, to use for each request from this `ApiClient`.
+            Can be set to `None` to disable timeout.
+        raise_for_status: if `True`, exceptions will be raised everytime a request returns an
+            error code (>= 400).
+        none_fields: defines what to do with parameters with value `None` in `data` or `json` fields.
+
+            - if `"exclude"` (default), fields whose values are `None` are not included in the request.
+            - if `"include"`, they are included with string value `None`. This is
+            the default behavior of `requests`. Note that they will be serialized to `null` in JSON.
+            - if `"empty"`, they are included with an empty value (as an empty string).
+        bool_fields: a tuple of `(true_value, false_value)`. Fields from `data` or `params` with
+            a boolean value (`True` or `False`) will be serialized to the corresponding value.
+            This can be useful since some APIs expect a `'true'` or `'false'` value as boolean,
+            and `requests` serializes `True` to `'True'` and `False` to `'False'`.
+            Set it to `None` to restore default requests behaviour.
+        session: a preconfigured `requests.Session` to use with this `ApiClient`.
+        **session_kwargs: additional kwargs to configure the underlying `requests.Session`.
+
+    Raises:
+        InvalidBoolFieldsParam: if the provided `bool_fields` parameter is invalid.
+
+    """
+
+    base_url: str
+    auth: requests.auth.AuthBase | None = None
+    timeout: int | None = 60
+    raise_for_status: bool = True
+    none_fields: Literal["include", "exclude", "empty"] = "exclude"
+    bool_fields: tuple[Any, Any] | None = "true", "false"
+    session: requests.Session = field(factory=requests.Session)
+
+    def __init__(
+        self,
+        base_url: str,
+        *,
+        auth: requests.auth.AuthBase | None = None,
+        timeout: int | None = 60,
+        raise_for_status: bool = True,
+        none_fields: Literal["include", "exclude", "empty"] = "exclude",
+        bool_fields: tuple[Any, Any] | None = ("true", "false"),
+        session: requests.Session | None = None,
+        **session_kwargs: Any,
+    ) -> None:
+        session = session or requests.Session()
+        for key, val in session_kwargs.items():
+            setattr(session, key, val)
+
+        if bool_fields is None:
+            bool_fields = ("True", "False")
+        else:
+            validate_bool_fields(bool_fields)
+
+        self.__attrs_init__(
+            base_url=base_url,
+            auth=auth,
+            raise_for_status=raise_for_status,
+            none_fields=none_fields,
+            bool_fields=bool_fields,
+            timeout=timeout,
+            session=session,
+        )
+
+    def request(  # noqa: C901, PLR0913, D417
+        self,
+        method: str,
+        path: None | str | bytes | Iterable[str | bytes | int] = None,
+        *,
+        params: None | bytes | MutableMapping[str, str] = None,
+        data: (
+            Iterable[bytes]
+            | str
+            | bytes
+            | list[tuple[Any, Any]]
+            | tuple[tuple[Any, Any], ...]
+            | Mapping[Any, Any]
+            | None
+        ) = None,
+        headers: MutableMapping[str, str] | None = None,
+        cookies: None | RequestsCookieJar | MutableMapping[str, str] = None,
+        files: MutableMapping[str, IO[Any]] | None = None,
+        auth: (
+            None
+            | tuple[str, str]
+            | requests.auth.AuthBase
+            | Callable[[requests.PreparedRequest], requests.PreparedRequest]
+        ) = None,
+        timeout: None | float | tuple[float, float] | tuple[float, None] = None,
+        allow_redirects: bool = False,
+        proxies: MutableMapping[str, str] | None = None,
+        hooks: None
+        | (
+            MutableMapping[
+                str,
+                (Iterable[Callable[[requests.Response], Any]] | Callable[[requests.Response], Any]),
+            ]
+        ) = None,
+        stream: bool | None = None,
+        verify: str | bool | None = None,
+        cert: str | tuple[str, str] | None = None,
+        json: Mapping[str, Any] | None = None,
+        raise_for_status: bool | None = None,
+        none_fields: Literal["include", "exclude", "empty"] | None = None,
+        bool_fields: tuple[Any, Any] | None = None,
+    ) -> requests.Response:
+        """A wrapper around [requests.Session.request][] method with extra features.
+
+        Additional features are described in
+        [ApiClient][requests_oauth2client.api_client.ApiClient] documentation.
+
+        All parameters will be passed as-is to [requests.Session.request][], expected those
+        described below which have a special behavior.
+
+        Args:
+          path: the url where the request will be sent to. Can be:
+
+            - a path, as `str`: that path will be joined to the configured API url,
+            - an iterable of path segments: that will be joined to the root url.
+          raise_for_status: like the parameter of the same name from
+            [ApiClient][requests_oauth2client.api_client.ApiClient],
+            but this will be applied for this request only.
+          none_fields: like the parameter of the same name from
+            [ApiClient][requests_oauth2client.api_client.ApiClient],
+            but this will be applied for this request only.
+          bool_fields: like the parameter of the same name from
+            [ApiClient][requests_oauth2client.api_client.ApiClient],
+            but this will be applied for this request only.
+
+        Returns:
+          a Response as returned by requests
+
+        Raises:
+            InvalidBoolFieldsParam: if the provided `bool_fields` parameter is invalid.
+
+        """
+        path = self.to_absolute_url(path)
+
+        if none_fields is None:
+            none_fields = self.none_fields
+
+        if none_fields == "exclude":
+            if isinstance(data, Mapping):
+                data = {key: val for key, val in data.items() if val is not None}
+            if isinstance(json, Mapping):
+                json = {key: val for key, val in json.items() if val is not None}
+        elif none_fields == "empty":
+            if isinstance(data, Mapping):
+                data = {key: val if val is not None else "" for key, val in data.items()}
+            if isinstance(json, Mapping):
+                json = {key: val if val is not None else "" for key, val in json.items()}
+
+        if bool_fields is None:
+            bool_fields = self.bool_fields
+
+        if bool_fields:
+            true_value, false_value = validate_bool_fields(bool_fields)
+            if isinstance(data, MutableMapping):
+                for key, val in data.items():
+                    if val is True:
+                        data[key] = true_value
+                    elif val is False:
+                        data[key] = false_value
+            if isinstance(params, MutableMapping):
+                for key, val in params.items():
+                    if val is True:
+                        params[key] = true_value
+                    elif val is False:
+                        params[key] = false_value
+
+        timeout = timeout or self.timeout
+
+        response = self.session.request(
+            method,
+            path,
+            params=params,
+            data=data,
+            headers=headers,
+            cookies=cookies,
+            files=files,
+            auth=auth or self.auth,
+            timeout=timeout,
+            allow_redirects=allow_redirects,
+            proxies=proxies,
+            hooks=hooks,
+            stream=stream,
+            verify=verify,
+            cert=cert,
+            json=json,
+        )
+
+        if raise_for_status is None:
+            raise_for_status = self.raise_for_status
+        if raise_for_status:
+            response.raise_for_status()
+        return response
+
+    def to_absolute_url(self, path: None | str | bytes | Iterable[str | bytes | int] = None) -> str:
+        """Convert a relative url to an absolute url.
+
+        Given a `path`, return the matching absolute url, based on the `base_url` that is
+        configured for this API.
+
+        The result of this method is different from a standard `urljoin()`, because a relative_url
+        that starts with a "/" will not override the path from the base url. You can also pass an
+        iterable of path parts as relative url, which will be properly joined with "/". Those parts
+        may be `str` (which will be urlencoded) or `bytes` (which will be decoded as UTF-8 first) or
+        any other type (which will be converted to `str` first, using the `str() function`). See the
+        table below for example results which would exhibit most cases:
+
+        | base_url | relative_url | result_url |
+        |---------------------------|-----------------------------|-------------------------------------------|
+        | `"https://myhost.com/root"` | `"/path"` | `"https://myhost.com/root/path"` |
+        | `"https://myhost.com/root"` | `"/path"` | `"https://myhost.com/root/path"` |
+        | `"https://myhost.com/root"` | `b"/path"` | `"https://myhost.com/root/path"` |
+        | `"https://myhost.com/root"` | `"path"` | `"https://myhost.com/root/path"` |
+        | `"https://myhost.com/root"` | `None` | `"https://myhost.com/root"` |
+        | `"https://myhost.com/root"` |  `("user", 1, "resource")` | `"https://myhost.com/root/user/1/resource"` |
+        | `"https://myhost.com/root"` | `"https://otherhost.org/foo"` | `ValueError` |
+
+        Args:
+          path: a relative url
+
+        Returns:
+          the resulting absolute url
+
+        Raises:
+            InvalidPathParam: if the provided path does not allow constructing a valid url
+
+        """
+        url = path
+
+        if url is None:
+            url = self.base_url
+        else:
+            if not isinstance(url, (str, bytes)):
+                try:
+                    url = "/".join(
+                        [urlencode(part.decode() if isinstance(part, bytes) else str(part)) for part in url if part],
+                    )
+                except Exception as exc:
+                    raise InvalidPathParam(url) from exc
+
+            if isinstance(url, bytes):
+                url = url.decode()
+
+            if "://" in url:
+                raise InvalidPathParam(url)
+
+            url = urljoin(self.base_url + "/", url.lstrip("/"))
+
+        if url is None or not isinstance(url, str):
+            raise InvalidPathParam(url)  # pragma: no cover
+
+        return url
+
+    def get(
+        self,
+        path: None | str | bytes | Iterable[str | bytes | int] = None,
+        raise_for_status: bool | None = None,
+        **kwargs: Any,
+    ) -> requests.Response:
+        """Send a GET request and return a [Response][requests.Response] object.
+
+        The passed `url` is relative to the `base_url` passed at initialization time.
+        It takes the same parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
+
+        Args:
+            path: the path where the request will be sent.
+            raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
+            **kwargs: additional kwargs for `requests.request()`
+
+        Returns:
+            a response object.
+
+        Raises:
+            requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
+
+        """
+        return self.request("GET", path, raise_for_status=raise_for_status, **kwargs)
+
+    def post(
+        self,
+        path: str | bytes | Iterable[str | bytes] | None = None,
+        raise_for_status: bool | None = None,
+        **kwargs: Any,
+    ) -> requests.Response:
+        """Send a POST request and return a [Response][requests.Response] object.
+
+        The passed `url` is relative to the `base_url` passed at initialization time.
+        It takes the same parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
+
+        Args:
+          path: the path where the request will be sent.
+          raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
+          **kwargs: additional kwargs for `requests.request()`
+
+        Returns:
+          a response object.
+
+        Raises:
+          requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
+
+        """
+        return self.request("POST", path, raise_for_status=raise_for_status, **kwargs)
+
+    def patch(
+        self,
+        path: str | bytes | Iterable[str | bytes] | None = None,
+        raise_for_status: bool | None = None,
+        **kwargs: Any,
+    ) -> requests.Response:
+        """Send a PATCH request. Return a [Response][requests.Response] object.
+
+        The passed `url` is relative to the `base_url` passed at initialization time.
+        It takes the same parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
+
+        Args:
+          path: the path where the request will be sent.
+          raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
+          **kwargs: additional kwargs for `requests.request()`
+
+        Returns:
+          a [Response][requests.Response] object.
+
+        Raises:
+          requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
+
+        """
+        return self.request("PATCH", path, raise_for_status=raise_for_status, **kwargs)
+
+    def put(
+        self,
+        path: str | bytes | Iterable[str | bytes] | None = None,
+        raise_for_status: bool | None = None,
+        **kwargs: Any,
+    ) -> requests.Response:
+        """Send a PUT request. Return a [Response][requests.Response] object.
+
+        The passed `url` is relative to the `base_url` passed at initialization time.
+        It takes the same parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
+
+        Args:
+          path: the path where the request will be sent.
+          raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
+          **kwargs: additional kwargs for `requests.request()`
+
+        Returns:
+          a [Response][requests.Response] object.
+
+        Raises:
+          requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
+
+        """
+        return self.request("PUT", path, raise_for_status=raise_for_status, **kwargs)
+
+    def delete(
+        self,
+        path: str | bytes | Iterable[str | bytes] | None = None,
+        raise_for_status: bool | None = None,
+        **kwargs: Any,
+    ) -> requests.Response:
+        """Send a DELETE request. Return a [Response][requests.Response] object.
+
+        The passed `url` may be relative to the url passed at initialization time. It takes the same
+        parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
+
+        Args:
+          path: the path where the request will be sent.
+          raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
+          **kwargs: additional kwargs for `requests.request()`.
+
+        Returns:
+          a response object.
+
+        Raises:
+          requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
+
+        """
+        return self.request("DELETE", path, raise_for_status=raise_for_status, **kwargs)
+
+    def __getattr__(self, item: str) -> ApiClient:
+        """Allow access sub resources with an attribute-based syntax.
+
+        Args:
+            item: a subpath
+
+        Returns:
+            a new `ApiClient` initialized on the new base url
+
+        Example:
+            ```python
+            from requests_oauth2client import ApiClient
+
+            api = ApiClient("https://myapi.local")
+            resource1 = api.resource1.get()  # GET https://myapi.local/resource1
+            resource2 = api.resource2.get()  # GET https://myapi.local/resource2
+            ```
+
+        """
+        return self[item]
+
+    def __getitem__(self, item: str) -> ApiClient:
+        """Allow access to sub resources with a subscription-based syntax.
+
+        Args:
+            item: a subpath
+
+        Returns:
+            a new `ApiClient` initialized on the new base url
+
+        Example:
+            ```python
+            from requests_oauth2client import ApiClient
+
+            api = ApiClient("https://myapi.local")
+            resource1 = api["resource1"].get()  # GET https://myapi.local/resource1
+            resource2 = api["resource2"].get()  # GET https://myapi.local/resource2
+            ```
+
+        """
+        new_base_uri = self.to_absolute_url(item)
+        return ApiClient(
+            new_base_uri,
+            session=self.session,
+            none_fields=self.none_fields,
+            bool_fields=self.bool_fields,
+            timeout=self.timeout,
+            raise_for_status=self.raise_for_status,
+        )
+
+    def __enter__(self) -> Self:
+        """Allow `ApiClient` to act as a context manager.
+
+        You can then use an `ApiClient` instance in a `with` clause, the same way as
+        `requests.Session`. The underlying request.Session will be closed on exit.
+
+        Example:
+            ```python
+            with ApiClient("https://myapi.com/path") as client:
+                resp = client.get("resource")
+            ```
+
+        """
+        return self
+
+    def __exit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
+    ) -> None:
+        """Close the underlying requests.Session on exit."""
+        self.session.close()
+
+
+ + + +
+ + + + + + + + + +
+ + +
+ request(method, path=None, *, params=None, data=None, headers=None, cookies=None, files=None, auth=None, timeout=None, allow_redirects=False, proxies=None, hooks=None, stream=None, verify=None, cert=None, json=None, raise_for_status=None, none_fields=None, bool_fields=None) + +
+ + +
+ +

A wrapper around requests.Session.request method with extra features.

+

Additional features are described in +ApiClient documentation.

+

All parameters will be passed as-is to requests.Session.request, expected those +described below which have a special behavior.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
path + None | str | bytes | Iterable[str | bytes | int] + +
+

the url where the request will be sent to. Can be:

+
    +
  • a path, as str: that path will be joined to the configured API url,
    • +
  • an iterable of path segments: that will be joined to the root url.
    • +
+
+ 		+ None +
raise_for_status + bool | None + +
+

like the parameter of the same name from +ApiClient, +but this will be applied for this request only.

+
+ 		+ None +
none_fields + Literal['include', 'exclude', 'empty'] | None + +
+

like the parameter of the same name from +ApiClient, +but this will be applied for this request only.

+
+ 		+ None +
bool_fields + tuple[Any, Any] | None + +
+

like the parameter of the same name from +ApiClient, +but this will be applied for this request only.

+
+ 		+ None +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Response + +
+

a Response as returned by requests

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ InvalidBoolFieldsParam + +
+

if the provided bool_fields parameter is invalid.

+
+
+ +
+ Source code in requests_oauth2client/api_client.py + 
176
+177
+178
+179
+180
+181
+182
+183
+184
+185
+186
+187
+188
+189
+190
+191
+192
+193
+194
+195
+196
+197
+198
+199
+200
+201
+202
+203
+204
+205
+206
+207
+208
+209
+210
+211
+212
+213
+214
+215
+216
+217
+218
+219
+220
+221
+222
+223
+224
+225
+226
+227
+228
+229
+230
+231
+232
+233
+234
+235
+236
+237
+238
+239
+240
+241
+242
+243
+244
+245
+246
+247
+248
+249
+250
+251
+252
+253
+254
+255
+256
+257
+258
+259
+260
+261
+262
+263
+264
+265
+266
+267
+268
+269
+270
+271
+272
+273
+274
+275
+276
+277
+278
+279
+280
+281
+282
+283
+284
+285
+286
+287
+288
+289
+290
+291
+292
+293
+294
+295
+296
+297
+298
+299
+300
+301
+302
+303
+304
+305
+306
+307
def request(  # noqa: C901, PLR0913, D417
+    self,
+    method: str,
+    path: None | str | bytes | Iterable[str | bytes | int] = None,
+    *,
+    params: None | bytes | MutableMapping[str, str] = None,
+    data: (
+        Iterable[bytes]
+        | str
+        | bytes
+        | list[tuple[Any, Any]]
+        | tuple[tuple[Any, Any], ...]
+        | Mapping[Any, Any]
+        | None
+    ) = None,
+    headers: MutableMapping[str, str] | None = None,
+    cookies: None | RequestsCookieJar | MutableMapping[str, str] = None,
+    files: MutableMapping[str, IO[Any]] | None = None,
+    auth: (
+        None
+        | tuple[str, str]
+        | requests.auth.AuthBase
+        | Callable[[requests.PreparedRequest], requests.PreparedRequest]
+    ) = None,
+    timeout: None | float | tuple[float, float] | tuple[float, None] = None,
+    allow_redirects: bool = False,
+    proxies: MutableMapping[str, str] | None = None,
+    hooks: None
+    | (
+        MutableMapping[
+            str,
+            (Iterable[Callable[[requests.Response], Any]] | Callable[[requests.Response], Any]),
+        ]
+    ) = None,
+    stream: bool | None = None,
+    verify: str | bool | None = None,
+    cert: str | tuple[str, str] | None = None,
+    json: Mapping[str, Any] | None = None,
+    raise_for_status: bool | None = None,
+    none_fields: Literal["include", "exclude", "empty"] | None = None,
+    bool_fields: tuple[Any, Any] | None = None,
+) -> requests.Response:
+    """A wrapper around [requests.Session.request][] method with extra features.
+
+    Additional features are described in
+    [ApiClient][requests_oauth2client.api_client.ApiClient] documentation.
+
+    All parameters will be passed as-is to [requests.Session.request][], expected those
+    described below which have a special behavior.
+
+    Args:
+      path: the url where the request will be sent to. Can be:
+
+        - a path, as `str`: that path will be joined to the configured API url,
+        - an iterable of path segments: that will be joined to the root url.
+      raise_for_status: like the parameter of the same name from
+        [ApiClient][requests_oauth2client.api_client.ApiClient],
+        but this will be applied for this request only.
+      none_fields: like the parameter of the same name from
+        [ApiClient][requests_oauth2client.api_client.ApiClient],
+        but this will be applied for this request only.
+      bool_fields: like the parameter of the same name from
+        [ApiClient][requests_oauth2client.api_client.ApiClient],
+        but this will be applied for this request only.
+
+    Returns:
+      a Response as returned by requests
+
+    Raises:
+        InvalidBoolFieldsParam: if the provided `bool_fields` parameter is invalid.
+
+    """
+    path = self.to_absolute_url(path)
+
+    if none_fields is None:
+        none_fields = self.none_fields
+
+    if none_fields == "exclude":
+        if isinstance(data, Mapping):
+            data = {key: val for key, val in data.items() if val is not None}
+        if isinstance(json, Mapping):
+            json = {key: val for key, val in json.items() if val is not None}
+    elif none_fields == "empty":
+        if isinstance(data, Mapping):
+            data = {key: val if val is not None else "" for key, val in data.items()}
+        if isinstance(json, Mapping):
+            json = {key: val if val is not None else "" for key, val in json.items()}
+
+    if bool_fields is None:
+        bool_fields = self.bool_fields
+
+    if bool_fields:
+        true_value, false_value = validate_bool_fields(bool_fields)
+        if isinstance(data, MutableMapping):
+            for key, val in data.items():
+                if val is True:
+                    data[key] = true_value
+                elif val is False:
+                    data[key] = false_value
+        if isinstance(params, MutableMapping):
+            for key, val in params.items():
+                if val is True:
+                    params[key] = true_value
+                elif val is False:
+                    params[key] = false_value
+
+    timeout = timeout or self.timeout
+
+    response = self.session.request(
+        method,
+        path,
+        params=params,
+        data=data,
+        headers=headers,
+        cookies=cookies,
+        files=files,
+        auth=auth or self.auth,
+        timeout=timeout,
+        allow_redirects=allow_redirects,
+        proxies=proxies,
+        hooks=hooks,
+        stream=stream,
+        verify=verify,
+        cert=cert,
+        json=json,
+    )
+
+    if raise_for_status is None:
+        raise_for_status = self.raise_for_status
+    if raise_for_status:
+        response.raise_for_status()
+    return response
+
+
+
+ +
+ +
+ + +
+ to_absolute_url(path=None) + +
+ + +
+ +

Convert a relative url to an absolute url.

+

Given a path, return the matching absolute url, based on the base_url that is +configured for this API.

+

The result of this method is different from a standard urljoin(), because a relative_url +that starts with a "/" will not override the path from the base url. You can also pass an +iterable of path parts as relative url, which will be properly joined with "/". Those parts +may be str (which will be urlencoded) or bytes (which will be decoded as UTF-8 first) or +any other type (which will be converted to str first, using the str() function). See the +table below for example results which would exhibit most cases:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
base_urlrelative_urlresult_url
"https://myhost.com/root""/path""https://myhost.com/root/path"
"https://myhost.com/root""/path""https://myhost.com/root/path"
"https://myhost.com/root"b"/path""https://myhost.com/root/path"
"https://myhost.com/root""path""https://myhost.com/root/path"
"https://myhost.com/root"None"https://myhost.com/root"
"https://myhost.com/root"("user", 1, "resource")"https://myhost.com/root/user/1/resource"
"https://myhost.com/root""https://otherhost.org/foo"ValueError
+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
path + None | str | bytes | Iterable[str | bytes | int] + +
+

a relative url

+
+ 		+ None +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the resulting absolute url

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ InvalidPathParam + +
+

if the provided path does not allow constructing a valid url

+
+
+ +
+ Source code in requests_oauth2client/api_client.py + 
309
+310
+311
+312
+313
+314
+315
+316
+317
+318
+319
+320
+321
+322
+323
+324
+325
+326
+327
+328
+329
+330
+331
+332
+333
+334
+335
+336
+337
+338
+339
+340
+341
+342
+343
+344
+345
+346
+347
+348
+349
+350
+351
+352
+353
+354
+355
+356
+357
+358
+359
+360
+361
+362
+363
+364
+365
+366
def to_absolute_url(self, path: None | str | bytes | Iterable[str | bytes | int] = None) -> str:
+    """Convert a relative url to an absolute url.
+
+    Given a `path`, return the matching absolute url, based on the `base_url` that is
+    configured for this API.
+
+    The result of this method is different from a standard `urljoin()`, because a relative_url
+    that starts with a "/" will not override the path from the base url. You can also pass an
+    iterable of path parts as relative url, which will be properly joined with "/". Those parts
+    may be `str` (which will be urlencoded) or `bytes` (which will be decoded as UTF-8 first) or
+    any other type (which will be converted to `str` first, using the `str() function`). See the
+    table below for example results which would exhibit most cases:
+
+    | base_url | relative_url | result_url |
+    |---------------------------|-----------------------------|-------------------------------------------|
+    | `"https://myhost.com/root"` | `"/path"` | `"https://myhost.com/root/path"` |
+    | `"https://myhost.com/root"` | `"/path"` | `"https://myhost.com/root/path"` |
+    | `"https://myhost.com/root"` | `b"/path"` | `"https://myhost.com/root/path"` |
+    | `"https://myhost.com/root"` | `"path"` | `"https://myhost.com/root/path"` |
+    | `"https://myhost.com/root"` | `None` | `"https://myhost.com/root"` |
+    | `"https://myhost.com/root"` |  `("user", 1, "resource")` | `"https://myhost.com/root/user/1/resource"` |
+    | `"https://myhost.com/root"` | `"https://otherhost.org/foo"` | `ValueError` |
+
+    Args:
+      path: a relative url
+
+    Returns:
+      the resulting absolute url
+
+    Raises:
+        InvalidPathParam: if the provided path does not allow constructing a valid url
+
+    """
+    url = path
+
+    if url is None:
+        url = self.base_url
+    else:
+        if not isinstance(url, (str, bytes)):
+            try:
+                url = "/".join(
+                    [urlencode(part.decode() if isinstance(part, bytes) else str(part)) for part in url if part],
+                )
+            except Exception as exc:
+                raise InvalidPathParam(url) from exc
+
+        if isinstance(url, bytes):
+            url = url.decode()
+
+        if "://" in url:
+            raise InvalidPathParam(url)
+
+        url = urljoin(self.base_url + "/", url.lstrip("/"))
+
+    if url is None or not isinstance(url, str):
+        raise InvalidPathParam(url)  # pragma: no cover
+
+    return url
+
+
+
+ +
+ +
+ + +
+ get(path=None, raise_for_status=None, **kwargs) + +
+ + +
+ +

Send a GET request and return a Response object.

+

The passed url is relative to the base_url passed at initialization time. +It takes the same parameters as ApiClient.request().

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
path + None | str | bytes | Iterable[str | bytes | int] + +
+

the path where the request will be sent.

+
+ 		+ None +
raise_for_status + bool | None + +
+

overrides the raises_for_status parameter passed at initialization time.

+
+ 		+ None +
**kwargs + Any + +
+

additional kwargs for requests.request()

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Response + +
+

a response object.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ HTTPError + +
+

if raises_for_status is True and an error response is returned.

+
+
+ +
+ Source code in requests_oauth2client/api_client.py + 
368
+369
+370
+371
+372
+373
+374
+375
+376
+377
+378
+379
+380
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391
def get(
+    self,
+    path: None | str | bytes | Iterable[str | bytes | int] = None,
+    raise_for_status: bool | None = None,
+    **kwargs: Any,
+) -> requests.Response:
+    """Send a GET request and return a [Response][requests.Response] object.
+
+    The passed `url` is relative to the `base_url` passed at initialization time.
+    It takes the same parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
+
+    Args:
+        path: the path where the request will be sent.
+        raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
+        **kwargs: additional kwargs for `requests.request()`
+
+    Returns:
+        a response object.
+
+    Raises:
+        requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
+
+    """
+    return self.request("GET", path, raise_for_status=raise_for_status, **kwargs)
+
+
+
+ +
+ +
+ + +
+ post(path=None, raise_for_status=None, **kwargs) + +
+ + +
+ +

Send a POST request and return a Response object.

+

The passed url is relative to the base_url passed at initialization time. +It takes the same parameters as ApiClient.request().

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
path + str | bytes | Iterable[str | bytes] | None + +
+

the path where the request will be sent.

+
+ 		+ None +
raise_for_status + bool | None + +
+

overrides the raises_for_status parameter passed at initialization time.

+
+ 		+ None +
**kwargs + Any + +
+

additional kwargs for requests.request()

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Response + +
+

a response object.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ HTTPError + +
+

if raises_for_status is True and an error response is returned.

+
+
+ +
+ Source code in requests_oauth2client/api_client.py + 
393
+394
+395
+396
+397
+398
+399
+400
+401
+402
+403
+404
+405
+406
+407
+408
+409
+410
+411
+412
+413
+414
+415
+416
def post(
+    self,
+    path: str | bytes | Iterable[str | bytes] | None = None,
+    raise_for_status: bool | None = None,
+    **kwargs: Any,
+) -> requests.Response:
+    """Send a POST request and return a [Response][requests.Response] object.
+
+    The passed `url` is relative to the `base_url` passed at initialization time.
+    It takes the same parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
+
+    Args:
+      path: the path where the request will be sent.
+      raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
+      **kwargs: additional kwargs for `requests.request()`
+
+    Returns:
+      a response object.
+
+    Raises:
+      requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
+
+    """
+    return self.request("POST", path, raise_for_status=raise_for_status, **kwargs)
+
+
+
+ +
+ +
+ + +
+ patch(path=None, raise_for_status=None, **kwargs) + +
+ + +
+ +

Send a PATCH request. Return a Response object.

+

The passed url is relative to the base_url passed at initialization time. +It takes the same parameters as ApiClient.request().

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
path + str | bytes | Iterable[str | bytes] | None + +
+

the path where the request will be sent.

+
+ 		+ None +
raise_for_status + bool | None + +
+

overrides the raises_for_status parameter passed at initialization time.

+
+ 		+ None +
**kwargs + Any + +
+

additional kwargs for requests.request()

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Response + +
+

a Response object.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ HTTPError + +
+

if raises_for_status is True and an error response is returned.

+
+
+ +
+ Source code in requests_oauth2client/api_client.py + 
418
+419
+420
+421
+422
+423
+424
+425
+426
+427
+428
+429
+430
+431
+432
+433
+434
+435
+436
+437
+438
+439
+440
+441
def patch(
+    self,
+    path: str | bytes | Iterable[str | bytes] | None = None,
+    raise_for_status: bool | None = None,
+    **kwargs: Any,
+) -> requests.Response:
+    """Send a PATCH request. Return a [Response][requests.Response] object.
+
+    The passed `url` is relative to the `base_url` passed at initialization time.
+    It takes the same parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
+
+    Args:
+      path: the path where the request will be sent.
+      raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
+      **kwargs: additional kwargs for `requests.request()`
+
+    Returns:
+      a [Response][requests.Response] object.
+
+    Raises:
+      requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
+
+    """
+    return self.request("PATCH", path, raise_for_status=raise_for_status, **kwargs)
+
+
+
+ +
+ +
+ + +
+ put(path=None, raise_for_status=None, **kwargs) + +
+ + +
+ +

Send a PUT request. Return a Response object.

+

The passed url is relative to the base_url passed at initialization time. +It takes the same parameters as ApiClient.request().

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
path + str | bytes | Iterable[str | bytes] | None + +
+

the path where the request will be sent.

+
+ 		+ None +
raise_for_status + bool | None + +
+

overrides the raises_for_status parameter passed at initialization time.

+
+ 		+ None +
**kwargs + Any + +
+

additional kwargs for requests.request()

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Response + +
+

a Response object.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ HTTPError + +
+

if raises_for_status is True and an error response is returned.

+
+
+ +
+ Source code in requests_oauth2client/api_client.py + 
443
+444
+445
+446
+447
+448
+449
+450
+451
+452
+453
+454
+455
+456
+457
+458
+459
+460
+461
+462
+463
+464
+465
+466
def put(
+    self,
+    path: str | bytes | Iterable[str | bytes] | None = None,
+    raise_for_status: bool | None = None,
+    **kwargs: Any,
+) -> requests.Response:
+    """Send a PUT request. Return a [Response][requests.Response] object.
+
+    The passed `url` is relative to the `base_url` passed at initialization time.
+    It takes the same parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
+
+    Args:
+      path: the path where the request will be sent.
+      raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
+      **kwargs: additional kwargs for `requests.request()`
+
+    Returns:
+      a [Response][requests.Response] object.
+
+    Raises:
+      requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
+
+    """
+    return self.request("PUT", path, raise_for_status=raise_for_status, **kwargs)
+
+
+
+ +
+ +
+ + +
+ delete(path=None, raise_for_status=None, **kwargs) + +
+ + +
+ +

Send a DELETE request. Return a Response object.

+

The passed url may be relative to the url passed at initialization time. It takes the same +parameters as ApiClient.request().

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
path + str | bytes | Iterable[str | bytes] | None + +
+

the path where the request will be sent.

+
+ 		+ None +
raise_for_status + bool | None + +
+

overrides the raises_for_status parameter passed at initialization time.

+
+ 		+ None +
**kwargs + Any + +
+

additional kwargs for requests.request().

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Response + +
+

a response object.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ HTTPError + +
+

if raises_for_status is True and an error response is returned.

+
+
+ +
+ Source code in requests_oauth2client/api_client.py + 
468
+469
+470
+471
+472
+473
+474
+475
+476
+477
+478
+479
+480
+481
+482
+483
+484
+485
+486
+487
+488
+489
+490
+491
def delete(
+    self,
+    path: str | bytes | Iterable[str | bytes] | None = None,
+    raise_for_status: bool | None = None,
+    **kwargs: Any,
+) -> requests.Response:
+    """Send a DELETE request. Return a [Response][requests.Response] object.
+
+    The passed `url` may be relative to the url passed at initialization time. It takes the same
+    parameters as [ApiClient.request()][requests_oauth2client.api_client.ApiClient.request].
+
+    Args:
+      path: the path where the request will be sent.
+      raise_for_status: overrides the `raises_for_status` parameter passed at initialization time.
+      **kwargs: additional kwargs for `requests.request()`.
+
+    Returns:
+      a response object.
+
+    Raises:
+      requests.HTTPError: if `raises_for_status` is `True` and an error response is returned.
+
+    """
+    return self.request("DELETE", path, raise_for_status=raise_for_status, **kwargs)
+
+
+
+ +
+ + + +
+ +
+ +
+ + +
+ + +

+ validate_bool_fields(bool_fields) + +

+ + +
+ +

Validate the bool_fields paremeter.

+

It must be a sequence of 2 values. First one is the True value, second one is the False value. +Both must be str or string-able values.

+ +
+ Source code in requests_oauth2client/api_client.py + 
38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
def validate_bool_fields(bool_fields: tuple[str, str]) -> tuple[str, str]:
+    """Validate the `bool_fields` paremeter.
+
+    It must be a sequence of 2 values. First one is the `True` value, second one is the `False` value.
+    Both must be `str` or string-able values.
+
+    """
+    try:
+        true_value, false_value = bool_fields
+    except ValueError:
+        raise InvalidBoolFieldsParam(bool_fields) from None
+    else:
+        return str(true_value), str(false_value)
+
+
+
+ +
+ + + +
+ +
+ +
+ +
+ + + +

+ auth + + +

+ +
+ +

This module contains requests-compatible Auth Handlers that implement OAuth 2.0.

+ + + +
+ + + + + + + + +
+ + + +

+ NonRenewableTokenError + + +

+ + +
+

+ Bases: Exception

+ + +

Raised when attempting to renew a token non-interactively when missing renewing material.

+ +
+ Source code in requests_oauth2client/auth.py + 
19
+20
class NonRenewableTokenError(Exception):
+    """Raised when attempting to renew a token non-interactively when missing renewing material."""
+
+
+ +
+ +
+ +
+ + + +

+ BaseOAuth2RenewableTokenAuth + + +

+ + +
+

+ Bases: AuthBase

+ + +

Base class for BearerToken-based Auth Handlers, with an obtainable or renewable token.

+

In addition to adding a properly formatted Authorization header, this will obtain a new token +once the current token is expired. Expiration is detected based on the expires_in hint +returned by the AS. A configurable leeway, in number of seconds, will make sure that a new +token is obtained some seconds before the actual expiration is reached. This may help in +situations where the client, AS and RS have slightly offset clocks.

+ +
+ Source code in requests_oauth2client/auth.py + 
23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
+65
@define(init=False)
+class BaseOAuth2RenewableTokenAuth(requests.auth.AuthBase):
+    """Base class for BearerToken-based Auth Handlers, with an obtainable or renewable token.
+
+    In addition to adding a properly formatted `Authorization` header, this will obtain a new token
+    once the current token is expired. Expiration is detected based on the `expires_in` hint
+    returned by the AS. A configurable `leeway`, in number of seconds, will make sure that a new
+    token is obtained some seconds before the actual expiration is reached. This may help in
+    situations where the client, AS and RS have slightly offset clocks.
+
+    """
+
+    client: OAuth2Client = field(on_setattr=setters.frozen)
+    token: BearerToken | None
+    leeway: int = field(on_setattr=setters.frozen)
+    token_kwargs: dict[str, Any] = field(on_setattr=setters.frozen)
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Add the Access Token to the request.
+
+        If Access Token is not specified or expired, obtain a new one first.
+
+        Raises:
+            NonRenewableTokenError: if the token is not renewable
+
+        """
+        if self.token is None or self.token.is_expired(self.leeway):
+            self.renew_token()
+        if self.token is None:
+            raise NonRenewableTokenError  # pragma: no cover
+        return self.token(request)
+
+    def renew_token(self) -> None:
+        """Obtain a new Bearer Token.
+
+        Subclasses should implement this.
+
+        """
+        raise NotImplementedError
+
+    def forget_token(self) -> None:
+        """Forget the current token, forcing a renewal on the next HTTP request."""
+        self.token = None
+
+
+ + + +
+ + + + + + + + + +
+ + +
+ renew_token() + +
+ + +
+ +

Obtain a new Bearer Token.

+

Subclasses should implement this.

+ +
+ Source code in requests_oauth2client/auth.py + 
55
+56
+57
+58
+59
+60
+61
def renew_token(self) -> None:
+    """Obtain a new Bearer Token.
+
+    Subclasses should implement this.
+
+    """
+    raise NotImplementedError
+
+
+
+ +
+ +
+ + +
+ forget_token() + +
+ + +
+ +

Forget the current token, forcing a renewal on the next HTTP request.

+ +
+ Source code in requests_oauth2client/auth.py + 
63
+64
+65
def forget_token(self) -> None:
+    """Forget the current token, forcing a renewal on the next HTTP request."""
+    self.token = None
+
+
+
+ +
+ + + +
+ +
+ +
+ +
+ + + +

+ BaseOAuth2RefreshTokenAuth + + +

+ + +
+

+ Bases: BaseOAuth2RenewableTokenAuth

+ + +

Base class for flows which can have a refresh-token.

+

This implements a renew_token() method which uses the refresh token to obtain new tokens.

+ +
+ Source code in requests_oauth2client/auth.py + 
68
+69
+70
+71
+72
+73
+74
+75
+76
+77
+78
+79
+80
+81
+82
+83
+84
+85
+86
+87
@define(init=False)
+class BaseOAuth2RefreshTokenAuth(BaseOAuth2RenewableTokenAuth):
+    """Base class for flows which can have a refresh-token.
+
+    This implements a `renew_token()` method which uses the refresh token to obtain new tokens.
+
+    """
+
+    @override
+    def renew_token(self) -> None:
+        """Obtain a new token, using the Refresh Token, if available.
+
+        Raises:
+            NonRenewableTokenError: if the token is not renewable.
+
+        """
+        if self.token is None or self.token.refresh_token is None:
+            raise NonRenewableTokenError
+
+        self.token = self.client.refresh_token(refresh_token=self.token, **self.token_kwargs)
+
+
+ + + +
+ + + + + + + + + +
+ + +
+ renew_token() + +
+ + +
+ +

Obtain a new token, using the Refresh Token, if available.

+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ NonRenewableTokenError + +
+

if the token is not renewable.

+
+
+ +
+ Source code in requests_oauth2client/auth.py + 
76
+77
+78
+79
+80
+81
+82
+83
+84
+85
+86
+87
@override
+def renew_token(self) -> None:
+    """Obtain a new token, using the Refresh Token, if available.
+
+    Raises:
+        NonRenewableTokenError: if the token is not renewable.
+
+    """
+    if self.token is None or self.token.refresh_token is None:
+        raise NonRenewableTokenError
+
+    self.token = self.client.refresh_token(refresh_token=self.token, **self.token_kwargs)
+
+
+
+ +
+ + + +
+ +
+ +
+ +
+ + + +

+ OAuth2ClientCredentialsAuth + + +

+ + +
+

+ Bases: BaseOAuth2RenewableTokenAuth

+ + +

An Auth Handler for the Client Credentials grant.

+

This requests AuthBase automatically gets Access Tokens from an OAuth +2.0 Token Endpoint with the Client Credentials grant, and will get a new one once the current +one is expired.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client + OAuth2Client + +
+

the OAuth2Client to use to obtain Access Tokens.

+
+ 		+ required +
token + str | BearerToken | None + +
+

an initial Access Token, if you have one already. In most cases, leave None.

+
+ 		+ None +
leeway + int + +
+

expiration leeway, in number of seconds

+
+ 		+ 20 +
**token_kwargs + Any + +
+

extra kw parameters to pass to the Token Endpoint. May include scope, resource, etc.

+
+ 		+ {} +
+ + +
+ Example + 
1
+2
+3
+4
+5
from requests_oauth2client import OAuth2Client, OAuth2ClientCredentialsAuth, requests
+
+client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+oauth2cc = OAuth2ClientCredentialsAuth(client, scope="my_scope")
+resp = requests.post("https://my.api.local/resource", auth=oauth2cc)
+
+
+
+ Source code in requests_oauth2client/auth.py + 
 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
@define(init=False)
+class OAuth2ClientCredentialsAuth(BaseOAuth2RenewableTokenAuth):
+    """An Auth Handler for the [Client Credentials grant](https://www.rfc-editor.org/rfc/rfc6749#section-4.4).
+
+    This [requests AuthBase][requests.auth.AuthBase] automatically gets Access Tokens from an OAuth
+    2.0 Token Endpoint with the Client Credentials grant, and will get a new one once the current
+    one is expired.
+
+    Args:
+        client: the [OAuth2Client][requests_oauth2client.client.OAuth2Client] to use to obtain Access Tokens.
+        token: an initial Access Token, if you have one already. In most cases, leave `None`.
+        leeway: expiration leeway, in number of seconds
+        **token_kwargs: extra kw parameters to pass to the Token Endpoint. May include `scope`, `resource`, etc.
+
+    Example:
+        ```python
+        from requests_oauth2client import OAuth2Client, OAuth2ClientCredentialsAuth, requests
+
+        client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+        oauth2cc = OAuth2ClientCredentialsAuth(client, scope="my_scope")
+        resp = requests.post("https://my.api.local/resource", auth=oauth2cc)
+        ```
+
+    """
+
+    def __init__(
+        self, client: OAuth2Client, *, leeway: int = 20, token: str | BearerToken | None = None, **token_kwargs: Any
+    ) -> None:
+        if isinstance(token, str):
+            token = BearerToken(token)
+        self.__attrs_init__(client=client, token=token, leeway=leeway, token_kwargs=token_kwargs)
+
+    @override
+    def renew_token(self) -> None:
+        """Obtain a new token for use within this Auth Handler."""
+        self.token = self.client.client_credentials(**self.token_kwargs)
+
+
+ + + +
+ + + + + + + + + +
+ + +
+ renew_token() + +
+ + +
+ +

Obtain a new token for use within this Auth Handler.

+ +
+ Source code in requests_oauth2client/auth.py + 
122
+123
+124
+125
@override
+def renew_token(self) -> None:
+    """Obtain a new token for use within this Auth Handler."""
+    self.token = self.client.client_credentials(**self.token_kwargs)
+
+
+
+ +
+ + + +
+ +
+ +
+ +
+ + + +

+ OAuth2AccessTokenAuth + + +

+ + +
+

+ Bases: BaseOAuth2RefreshTokenAuth

+ + +

Authentication Handler for OAuth 2.0 Access Tokens and (optional) Refresh Tokens.

+

This Requests Auth handler implementation uses an access token as +Bearer token, and can automatically refresh it when expired, if a refresh token is available.

+

Token can be a simple str containing a raw access token value, or a +BearerToken that can contain a refresh_token. +If a refresh_token and an expiration date are available (based on expires_in hint), +this Auth Handler will automatically refresh the access token once it is expired.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client + OAuth2Client + +
+

the client to use to refresh tokens.

+
+ 		+ required +
token + str | BearerToken + +
+

an initial Access Token, if you have one already. In most cases, leave None.

+
+ 		+ required +
leeway + int + +
+

expiration leeway, in number of seconds.

+
+ 		+ 20 +
**token_kwargs + Any + +
+

additional kwargs to pass to the token endpoint.

+
+ 		+ {} +
+ + +
+ Example + 
1
+2
+3
+4
+5
+6
+7
+8
from requests_oauth2client import BearerToken, OAuth2Client, OAuth2AccessTokenAuth, requests
+
+client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+# obtain a BearerToken any way you see fit, optionally including a refresh token
+# for this example, the token value is hardcoded
+token = BearerToken(access_token="access_token", expires_in=600, refresh_token="refresh_token")
+auth = OAuth2AccessTokenAuth(client, token, scope="my_scope")
+resp = requests.post("https://my.api.local/resource", auth=auth)
+
+
+
+ Source code in requests_oauth2client/auth.py + 
128
+129
+130
+131
+132
+133
+134
+135
+136
+137
+138
+139
+140
+141
+142
+143
+144
+145
+146
+147
+148
+149
+150
+151
+152
+153
+154
+155
+156
+157
+158
+159
+160
+161
+162
+163
+164
+165
@define(init=False)
+class OAuth2AccessTokenAuth(BaseOAuth2RefreshTokenAuth):
+    """Authentication Handler for OAuth 2.0 Access Tokens and (optional) Refresh Tokens.
+
+    This [Requests Auth handler][requests.auth.AuthBase] implementation uses an access token as
+    Bearer token, and can automatically refresh it when expired, if a refresh token is available.
+
+    Token can be a simple `str` containing a raw access token value, or a
+    [BearerToken][requests_oauth2client.tokens.BearerToken] that can contain a `refresh_token`.
+    If a `refresh_token` and an expiration date are available (based on `expires_in` hint),
+    this Auth Handler will automatically refresh the access token once it is expired.
+
+    Args:
+        client: the client to use to refresh tokens.
+        token: an initial Access Token, if you have one already. In most cases, leave `None`.
+        leeway: expiration leeway, in number of seconds.
+        **token_kwargs: additional kwargs to pass to the token endpoint.
+
+    Example:
+        ```python
+        from requests_oauth2client import BearerToken, OAuth2Client, OAuth2AccessTokenAuth, requests
+
+        client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+        # obtain a BearerToken any way you see fit, optionally including a refresh token
+        # for this example, the token value is hardcoded
+        token = BearerToken(access_token="access_token", expires_in=600, refresh_token="refresh_token")
+        auth = OAuth2AccessTokenAuth(client, token, scope="my_scope")
+        resp = requests.post("https://my.api.local/resource", auth=auth)
+        ```
+
+    """
+
+    def __init__(
+        self, client: OAuth2Client, token: str | BearerToken, *, leeway: int = 20, **token_kwargs: Any
+    ) -> None:
+        if isinstance(token, str):
+            token = BearerToken(token)
+        self.__attrs_init__(client=client, token=token, leeway=leeway, token_kwargs=token_kwargs)
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ OAuth2AuthorizationCodeAuth + + +

+ + +
+

+ Bases: BaseOAuth2RefreshTokenAuth

+ + +

Authentication handler for the Authorization Code grant.

+

This Requests Auth handler implementation exchanges an Authorization +Code for an access token, then automatically refreshes it once it is expired.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client + OAuth2Client + +
+

the client to use to obtain Access Tokens.

+
+ 		+ required +
code + str | AuthorizationResponse | None + +
+

an Authorization Code that has been obtained from the AS.

+
+ 		+ required +
token + str | BearerToken | None + +
+

an initial Access Token, if you have one already. In most cases, leave None.

+
+ 		+ None +
leeway + int + +
+

expiration leeway, in number of seconds.

+
+ 		+ 20 +
**token_kwargs + Any + +
+

additional kwargs to pass to the token endpoint.

+
+ 		+ {} +
+ + +
+ Example + 
1
+2
+3
+4
+5
from requests_oauth2client import ApiClient, OAuth2Client, OAuth2AuthorizationCodeAuth
+
+client = OAuth2Client(token_endpoint="https://myas.local/token", auth=("client_id", "client_secret"))
+code = "my_code"  # you must obtain this code yourself
+api = ApiClient("https://my.api.local/resource", auth=OAuth2AuthorizationCodeAuth(client, code))
+
+
+
+ Source code in requests_oauth2client/auth.py + 
168
+169
+170
+171
+172
+173
+174
+175
+176
+177
+178
+179
+180
+181
+182
+183
+184
+185
+186
+187
+188
+189
+190
+191
+192
+193
+194
+195
+196
+197
+198
+199
+200
+201
+202
+203
+204
+205
+206
+207
+208
+209
+210
+211
+212
+213
+214
+215
+216
+217
+218
+219
+220
+221
+222
+223
+224
+225
+226
+227
+228
+229
+230
+231
+232
+233
+234
@define(init=False)
+class OAuth2AuthorizationCodeAuth(BaseOAuth2RefreshTokenAuth):  # type: ignore[override]
+    """Authentication handler for the [Authorization Code grant](https://www.rfc-editor.org/rfc/rfc6749#section-4.1).
+
+    This [Requests Auth handler][requests.auth.AuthBase] implementation exchanges an Authorization
+    Code for an access token, then automatically refreshes it once it is expired.
+
+    Args:
+        client: the client to use to obtain Access Tokens.
+        code: an Authorization Code that has been obtained from the AS.
+        token: an initial Access Token, if you have one already. In most cases, leave `None`.
+        leeway: expiration leeway, in number of seconds.
+        **token_kwargs: additional kwargs to pass to the token endpoint.
+
+    Example:
+        ```python
+        from requests_oauth2client import ApiClient, OAuth2Client, OAuth2AuthorizationCodeAuth
+
+        client = OAuth2Client(token_endpoint="https://myas.local/token", auth=("client_id", "client_secret"))
+        code = "my_code"  # you must obtain this code yourself
+        api = ApiClient("https://my.api.local/resource", auth=OAuth2AuthorizationCodeAuth(client, code))
+        ```
+
+    """
+
+    code: str | AuthorizationResponse | None
+
+    def __init__(
+        self,
+        client: OAuth2Client,
+        code: str | AuthorizationResponse | None,
+        *,
+        leeway: int = 20,
+        token: str | BearerToken | None = None,
+        **token_kwargs: Any,
+    ) -> None:
+        if isinstance(token, str):
+            token = BearerToken(token)
+        self.__attrs_init__(
+            client=client,
+            token=token,
+            code=code,
+            leeway=leeway,
+            token_kwargs=token_kwargs,
+        )
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Implement the Authorization Code grant as an Authentication Handler.
+
+        This exchanges an Authorization Code for an access token and adds it in the request.
+
+        Args:
+            request: the request
+
+        Returns:
+            the request, with an Access Token added in Authorization Header
+
+        """
+        if self.token is None or self.token.is_expired():
+            self.exchange_code_for_token()
+        return super().__call__(request)
+
+    def exchange_code_for_token(self) -> None:
+        """Exchange the authorization code for an access token."""
+        if self.code:  # pragma: no branch
+            self.token = self.client.authorization_code(code=self.code, **self.token_kwargs)
+            self.code = None
+
+
+ + + +
+ + + + + + + + + +
+ + +
+ exchange_code_for_token() + +
+ + +
+ +

Exchange the authorization code for an access token.

+ +
+ Source code in requests_oauth2client/auth.py + 
230
+231
+232
+233
+234
def exchange_code_for_token(self) -> None:
+    """Exchange the authorization code for an access token."""
+    if self.code:  # pragma: no branch
+        self.token = self.client.authorization_code(code=self.code, **self.token_kwargs)
+        self.code = None
+
+
+
+ +
+ + + +
+ +
+ +
+ +
+ + + +

+ OAuth2ResourceOwnerPasswordAuth + + +

+ + +
+

+ Bases: BaseOAuth2RenewableTokenAuth

+ + +

Authentication Handler for the Resource Owner Password Credentials Flow.

+

This Requests Auth handler implementation exchanges the user +credentials for an Access Token, then automatically repeats the process to get a new one +once the current one is expired.

+

Note that this flow is considered deprecated, and the Authorization Code flow should be +used whenever possible. +Among other bad things, ROPC:

+
    +
  • does not support SSO between multiple apps,
    • +
  • does not support MFA or risk-based adaptative authentication,
    • +
  • depends on the user typing its credentials directly inside the application, instead of on a +dedicated, centralized login page managed by the AS, which makes it totally insecure for 3rd party apps.
    • +
+

It needs the username and password and an +OAuth2Client to be able to get a token from +the AS Token Endpoint just before the first request using this Auth Handler is being sent.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client + OAuth2Client + +
+

the client to use to obtain Access Tokens

+
+ 		+ required +
username + str + +
+

the username

+
+ 		+ required +
password + str + +
+

the user password

+
+ 		+ required +
leeway + int + +
+

an amount of time, in seconds

+
+ 		+ 20 +
token + str | BearerToken | None + +
+

an initial Access Token, if you have one already. In most cases, leave None.

+
+ 		+ None +
**token_kwargs + Any + +
+

additional kwargs to pass to the token endpoint

+
+ 		+ {} +
+ + +
+ Example + 
 1
+ 2
+ 3
+ 4
+ 5
+ 6
+ 7
+ 8
+ 9
+10
from requests_oauth2client import ApiClient, OAuth2Client, OAuth2ResourceOwnerPasswordAuth
+
+client = OAuth2Client(
+    token_endpoint="https://myas.local/token",
+    auth=("client_id", "client_secret"),
+)
+username = "my_username"
+password = "my_password"  # you must obtain those credentials from the user
+auth = OAuth2ResourceOwnerPasswordAuth(client, username=username, password=password)
+api = ApiClient("https://myapi.local", auth=auth)
+
+
+
+ Source code in requests_oauth2client/auth.py + 
237
+238
+239
+240
+241
+242
+243
+244
+245
+246
+247
+248
+249
+250
+251
+252
+253
+254
+255
+256
+257
+258
+259
+260
+261
+262
+263
+264
+265
+266
+267
+268
+269
+270
+271
+272
+273
+274
+275
+276
+277
+278
+279
+280
+281
+282
+283
+284
+285
+286
+287
+288
+289
+290
+291
+292
+293
+294
+295
+296
+297
+298
+299
+300
+301
+302
+303
+304
+305
+306
+307
+308
+309
+310
+311
+312
@define(init=False)
+class OAuth2ResourceOwnerPasswordAuth(BaseOAuth2RenewableTokenAuth):  # type: ignore[override]
+    """Authentication Handler for the [Resource Owner Password Credentials Flow](https://www.rfc-editor.org/rfc/rfc6749#section-4.3).
+
+    This [Requests Auth handler][requests.auth.AuthBase] implementation exchanges the user
+    credentials for an Access Token, then automatically repeats the process to get a new one
+    once the current one is expired.
+
+    Note that this flow is considered *deprecated*, and the Authorization Code flow should be
+    used whenever possible.
+    Among other bad things, ROPC:
+
+    - does not support SSO between multiple apps,
+    - does not support MFA or risk-based adaptative authentication,
+    - depends on the user typing its credentials directly inside the application, instead of on a
+    dedicated, centralized login page managed by the AS, which makes it totally insecure for 3rd party apps.
+
+    It needs the username and password and an
+    [OAuth2Client][requests_oauth2client.client.OAuth2Client] to be able to get a token from
+    the AS Token Endpoint just before the first request using this Auth Handler is being sent.
+
+    Args:
+        client: the client to use to obtain Access Tokens
+        username: the username
+        password: the user password
+        leeway: an amount of time, in seconds
+        token: an initial Access Token, if you have one already. In most cases, leave `None`.
+        **token_kwargs: additional kwargs to pass to the token endpoint
+
+    Example:
+        ```python
+        from requests_oauth2client import ApiClient, OAuth2Client, OAuth2ResourceOwnerPasswordAuth
+
+        client = OAuth2Client(
+            token_endpoint="https://myas.local/token",
+            auth=("client_id", "client_secret"),
+        )
+        username = "my_username"
+        password = "my_password"  # you must obtain those credentials from the user
+        auth = OAuth2ResourceOwnerPasswordAuth(client, username=username, password=password)
+        api = ApiClient("https://myapi.local", auth=auth)
+        ```
+    """
+
+    username: str
+    password: str
+
+    def __init__(
+        self,
+        client: OAuth2Client,
+        *,
+        username: str,
+        password: str,
+        leeway: int = 20,
+        token: str | BearerToken | None = None,
+        **token_kwargs: Any,
+    ) -> None:
+        if isinstance(token, str):
+            token = BearerToken(token)
+        self.__attrs_init__(
+            client=client,
+            token=token,
+            leeway=leeway,
+            token_kwargs=token_kwargs,
+            username=username,
+            password=password,
+        )
+
+    @override
+    def renew_token(self) -> None:
+        """Exchange the user credentials for an Access Token."""
+        self.token = self.client.resource_owner_password(
+            username=self.username,
+            password=self.password,
+            **self.token_kwargs,
+        )
+
+
+ + + +
+ + + + + + + + + +
+ + +
+ renew_token() + +
+ + +
+ +

Exchange the user credentials for an Access Token.

+ +
+ Source code in requests_oauth2client/auth.py + 
305
+306
+307
+308
+309
+310
+311
+312
@override
+def renew_token(self) -> None:
+    """Exchange the user credentials for an Access Token."""
+    self.token = self.client.resource_owner_password(
+        username=self.username,
+        password=self.password,
+        **self.token_kwargs,
+    )
+
+
+
+ +
+ + + +
+ +
+ +
+ +
+ + + +

+ OAuth2DeviceCodeAuth + + +

+ + +
+

+ Bases: BaseOAuth2RefreshTokenAuth

+ + +

Authentication Handler for the Device Code Flow.

+

This Requests Auth handler implementation exchanges a Device Code for +an Access Token, then automatically refreshes it once it is expired.

+

It needs a Device Code and an OAuth2Client to be +able to get a token from the AS Token Endpoint just before the first request using this Auth +Handler is being sent.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client + OAuth2Client + +
+

the OAuth2Client to use to obtain Access Tokens.

+
+ 		+ required +
device_code + str | DeviceAuthorizationResponse + +
+

a Device Code obtained from the AS.

+
+ 		+ required +
interval + int + +
+

the interval to use to pool the Token Endpoint, in seconds.

+
+ 		+ 5 +
expires_in + int + +
+

the lifetime of the token, in seconds.

+
+ 		+ 360 +
token + str | BearerToken | None + +
+

an initial Access Token, if you have one already. In most cases, leave None.

+
+ 		+ None +
leeway + int + +
+

expiration leeway, in number of seconds.

+
+ 		+ 20 +
**token_kwargs + Any + +
+

additional kwargs to pass to the token endpoint.

+
+ 		+ {} +
+ + +
+ Example + 
1
+2
+3
+4
+5
+6
from requests_oauth2client import OAuth2Client, OAuth2DeviceCodeAuth, requests
+
+client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+device_code = client.device_authorization()
+auth = OAuth2DeviceCodeAuth(client, device_code)
+resp = requests.post("https://my.api.local/resource", auth=auth)
+
+
+
+ Source code in requests_oauth2client/auth.py + 
315
+316
+317
+318
+319
+320
+321
+322
+323
+324
+325
+326
+327
+328
+329
+330
+331
+332
+333
+334
+335
+336
+337
+338
+339
+340
+341
+342
+343
+344
+345
+346
+347
+348
+349
+350
+351
+352
+353
+354
+355
+356
+357
+358
+359
+360
+361
+362
+363
+364
+365
+366
+367
+368
+369
+370
+371
+372
+373
+374
+375
+376
+377
+378
+379
+380
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391
+392
+393
+394
+395
+396
+397
+398
+399
+400
+401
+402
+403
+404
+405
+406
+407
+408
+409
@define(init=False)
+class OAuth2DeviceCodeAuth(BaseOAuth2RefreshTokenAuth):  # type: ignore[override]
+    """Authentication Handler for the [Device Code Flow](https://www.rfc-editor.org/rfc/rfc8628).
+
+    This [Requests Auth handler][requests.auth.AuthBase] implementation exchanges a Device Code for
+    an Access Token, then automatically refreshes it once it is expired.
+
+    It needs a Device Code and an [OAuth2Client][requests_oauth2client.client.OAuth2Client] to be
+    able to get a token from the AS Token Endpoint just before the first request using this Auth
+    Handler is being sent.
+
+    Args:
+        client: the [OAuth2Client][requests_oauth2client.client.OAuth2Client] to use to obtain Access Tokens.
+        device_code: a Device Code obtained from the AS.
+        interval: the interval to use to pool the Token Endpoint, in seconds.
+        expires_in: the lifetime of the token, in seconds.
+        token: an initial Access Token, if you have one already. In most cases, leave `None`.
+        leeway: expiration leeway, in number of seconds.
+        **token_kwargs: additional kwargs to pass to the token endpoint.
+
+    Example:
+        ```python
+        from requests_oauth2client import OAuth2Client, OAuth2DeviceCodeAuth, requests
+
+        client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+        device_code = client.device_authorization()
+        auth = OAuth2DeviceCodeAuth(client, device_code)
+        resp = requests.post("https://my.api.local/resource", auth=auth)
+        ```
+
+    """
+
+    device_code: str | DeviceAuthorizationResponse
+    interval: int
+    expires_in: int
+
+    def __init__(
+        self,
+        client: OAuth2Client,
+        *,
+        device_code: str | DeviceAuthorizationResponse,
+        leeway: int = 20,
+        interval: int = 5,
+        expires_in: int = 360,
+        token: str | BearerToken | None = None,
+        **token_kwargs: Any,
+    ) -> None:
+        if isinstance(token, str):
+            token = BearerToken(token)
+        self.__attrs_init__(
+            client=client,
+            token=token,
+            leeway=leeway,
+            token_kwargs=token_kwargs,
+            device_code=device_code,
+            interval=interval,
+            expires_in=expires_in,
+        )
+
+    @override
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Implement the Device Code grant as a request Authentication Handler.
+
+        This exchanges a Device Code for an access token and adds it in HTTP requests.
+
+        Args:
+            request: a [requests.PreparedRequest][]
+
+        Returns:
+            a [requests.PreparedRequest][] with an Access Token added in Authorization Header
+
+        """
+        if self.token is None:
+            self.exchange_device_code_for_token()
+        return super().__call__(request)
+
+    def exchange_device_code_for_token(self) -> None:
+        """Exchange the Device Code for an access token.
+
+        This will poll the Token Endpoint until the user finishes the authorization process.
+
+        """
+        from .device_authorization import DeviceAuthorizationPoolingJob
+
+        if self.device_code:  # pragma: no branch
+            pooling_job = DeviceAuthorizationPoolingJob(
+                client=self.client,
+                device_code=self.device_code,
+                interval=self.interval,
+            )
+            token = None
+            while token is None:
+                token = pooling_job()
+            self.token = token
+            self.device_code = None
+
+
+ + + +
+ + + + + + + + + +
+ + +
+ exchange_device_code_for_token() + +
+ + +
+ +

Exchange the Device Code for an access token.

+

This will poll the Token Endpoint until the user finishes the authorization process.

+ +
+ Source code in requests_oauth2client/auth.py + 
391
+392
+393
+394
+395
+396
+397
+398
+399
+400
+401
+402
+403
+404
+405
+406
+407
+408
+409
def exchange_device_code_for_token(self) -> None:
+    """Exchange the Device Code for an access token.
+
+    This will poll the Token Endpoint until the user finishes the authorization process.
+
+    """
+    from .device_authorization import DeviceAuthorizationPoolingJob
+
+    if self.device_code:  # pragma: no branch
+        pooling_job = DeviceAuthorizationPoolingJob(
+            client=self.client,
+            device_code=self.device_code,
+            interval=self.interval,
+        )
+        token = None
+        while token is None:
+            token = pooling_job()
+        self.token = token
+        self.device_code = None
+
+
+
+ +
+ + + +
+ +
+ +
+ + + + +
+ +
+ +
+ +
+ + + +

+ authorization_request + + +

+ +
+ +

Classes and utilities related to Authorization Requests and Responses.

+ + + +
+ + + + + + + + +
+ + + +

+ ResponseTypes + + +

+ + +
+

+ Bases: str, Enum

+ + +

All standardised response_type values.

+

Note that you should always use code. All other values are deprecated.

+ +
+ Source code in requests_oauth2client/authorization_request.py + 
32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
class ResponseTypes(str, Enum):
+    """All standardised `response_type` values.
+
+    Note that you should always use `code`. All other values are deprecated.
+
+    """
+
+    CODE = "code"
+    NONE = "none"
+    TOKEN = "token"
+    IDTOKEN = "id_token"
+    CODE_IDTOKEN = "code id_token"
+    CODE_TOKEN = "code token"
+    CODE_IDTOKEN_TOKEN = "code id_token token"
+    IDTOKEN_TOKEN = "id_token token"
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ CodeChallengeMethods + + +

+ + +
+

+ Bases: str, Enum

+ + +

All standardised code_challenge values.

+

You should always use S256.

+ +
+ Source code in requests_oauth2client/authorization_request.py + 
49
+50
+51
+52
+53
+54
+55
+56
+57
class CodeChallengeMethods(str, Enum):
+    """All standardised `code_challenge` values.
+
+    You should always use `S256`.
+
+    """
+
+    S256 = "S256"
+    plain = "plain"
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ UnsupportedCodeChallengeMethod + + +

+ + +
+

+ Bases: ValueError

+ + +

Raised when an unsupported code_challenge_method is provided.

+ +
+ Source code in requests_oauth2client/authorization_request.py + 
60
+61
class UnsupportedCodeChallengeMethod(ValueError):
+    """Raised when an unsupported code_challenge_method is provided."""
+
+
+ +
+ +
+ +
+ + + +

+ InvalidCodeVerifierParam + + +

+ + +
+

+ Bases: ValueError

+ + +

Raised when an invalid code_verifier is supplied.

+ +
+ Source code in requests_oauth2client/authorization_request.py + 
64
+65
+66
+67
+68
+69
+70
+71
+72
+73
+74
+75
class InvalidCodeVerifierParam(ValueError):
+    """Raised when an invalid code_verifier is supplied."""
+
+    def __init__(self, code_verifier: str) -> None:
+        super().__init__("""\
+Invalid 'code_verifier'. It must be a 43 to 128 characters long string, with:
+- lowercase letters
+- uppercase letters
+- digits
+- underscore, dash, tilde, or dot (_-~.)
+""")
+        self.code_verifier = code_verifier
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ PkceUtils + + +

+ + +
+ + +

Contains helper methods for PKCE, as described in RFC7636.

+

See RFC7636.

+ +
+ Source code in requests_oauth2client/authorization_request.py + 
 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
+126
+127
+128
+129
+130
+131
+132
+133
+134
+135
+136
+137
+138
+139
+140
+141
+142
+143
+144
+145
+146
+147
+148
+149
+150
+151
+152
+153
+154
+155
+156
+157
+158
class PkceUtils:
+    """Contains helper methods for PKCE, as described in RFC7636.
+
+    See [RFC7636](https://tools.ietf.org/html/rfc7636).
+
+    """
+
+    code_verifier_pattern = re.compile(r"^[a-zA-Z0-9_\-~.]{43,128}$")
+    """A regex that matches valid code verifiers."""
+
+    @classmethod
+    def generate_code_verifier(cls) -> str:
+        """Generate a valid `code_verifier`.
+
+        Returns:
+            a `code_verifier` ready to use for PKCE
+
+        """
+        return secrets.token_urlsafe(96)
+
+    @classmethod
+    def derive_challenge(cls, verifier: str | bytes, method: str = CodeChallengeMethods.S256) -> str:
+        """Derive the `code_challenge` from a given `code_verifier`.
+
+        Args:
+            verifier: a code verifier
+            method: the method to use for deriving the challenge. Accepts 'S256' or 'plain'.
+
+        Returns:
+            a `code_challenge` derived from the given verifier
+
+        Raises:
+            InvalidCodeVerifierParam: if the `verifier` does not match `code_verifier_pattern`
+            UnsupportedCodeChallengeMethod: if the method is not supported
+
+        """
+        if isinstance(verifier, bytes):
+            verifier = verifier.decode()
+
+        if not cls.code_verifier_pattern.match(verifier):
+            raise InvalidCodeVerifierParam(verifier)
+
+        if method == CodeChallengeMethods.S256:
+            return BinaPy(verifier).to("sha256").to("b64u").ascii()
+        if method == CodeChallengeMethods.plain:
+            return verifier
+
+        raise UnsupportedCodeChallengeMethod(method)
+
+    @classmethod
+    def generate_code_verifier_and_challenge(cls, method: str = CodeChallengeMethods.S256) -> tuple[str, str]:
+        """Generate a valid `code_verifier` and derive its `code_challenge`.
+
+        Args:
+            method: the method to use for deriving the challenge. Accepts 'S256' or 'plain'.
+
+        Returns:
+            a `(code_verifier, code_challenge)` tuple.
+
+        """
+        verifier = cls.generate_code_verifier()
+        challenge = cls.derive_challenge(verifier, method)
+        return verifier, challenge
+
+    @classmethod
+    def validate_code_verifier(cls, verifier: str, challenge: str, method: str = CodeChallengeMethods.S256) -> bool:
+        """Validate a `code_verifier` against a `code_challenge`.
+
+        Args:
+            verifier: the `code_verifier`, exactly as submitted by the client on token request.
+            challenge: the `code_challenge`, exactly as submitted by the client on authorization request.
+            method: the method to use for deriving the challenge. Accepts 'S256' or 'plain'.
+
+        Returns:
+            `True` if verifier is valid, or `False` otherwise
+
+        """
+        return (
+            cls.code_verifier_pattern.match(verifier) is not None
+            and cls.derive_challenge(verifier, method) == challenge
+        )
+
+
+ + + +
+ + + + + + + +
+ + + +
+ code_verifier_pattern = re.compile('^[a-zA-Z0-9_\\-~.]{43,128}$') + + + class-attribute + instance-attribute + + +
+ + +
+ +

A regex that matches valid code verifiers.

+
+ +
+ + + +
+ + +
+ generate_code_verifier() + + + classmethod + + +
+ + +
+ +

Generate a valid code_verifier.

+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

a code_verifier ready to use for PKCE

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
88
+89
+90
+91
+92
+93
+94
+95
+96
@classmethod
+def generate_code_verifier(cls) -> str:
+    """Generate a valid `code_verifier`.
+
+    Returns:
+        a `code_verifier` ready to use for PKCE
+
+    """
+    return secrets.token_urlsafe(96)
+
+
+
+ +
+ +
+ + +
+ derive_challenge(verifier, method=CodeChallengeMethods.S256) + + + classmethod + + +
+ + +
+ +

Derive the code_challenge from a given code_verifier.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
verifier + str | bytes + +
+

a code verifier

+
+ 		+ required +
method + str + +
+

the method to use for deriving the challenge. Accepts 'S256' or 'plain'.

+
+ 		+ S256 +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

a code_challenge derived from the given verifier

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ InvalidCodeVerifierParam + +
+

if the verifier does not match code_verifier_pattern

+
+
+ UnsupportedCodeChallengeMethod + +
+

if the method is not supported

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
@classmethod
+def derive_challenge(cls, verifier: str | bytes, method: str = CodeChallengeMethods.S256) -> str:
+    """Derive the `code_challenge` from a given `code_verifier`.
+
+    Args:
+        verifier: a code verifier
+        method: the method to use for deriving the challenge. Accepts 'S256' or 'plain'.
+
+    Returns:
+        a `code_challenge` derived from the given verifier
+
+    Raises:
+        InvalidCodeVerifierParam: if the `verifier` does not match `code_verifier_pattern`
+        UnsupportedCodeChallengeMethod: if the method is not supported
+
+    """
+    if isinstance(verifier, bytes):
+        verifier = verifier.decode()
+
+    if not cls.code_verifier_pattern.match(verifier):
+        raise InvalidCodeVerifierParam(verifier)
+
+    if method == CodeChallengeMethods.S256:
+        return BinaPy(verifier).to("sha256").to("b64u").ascii()
+    if method == CodeChallengeMethods.plain:
+        return verifier
+
+    raise UnsupportedCodeChallengeMethod(method)
+
+
+
+ +
+ +
+ + +
+ generate_code_verifier_and_challenge(method=CodeChallengeMethods.S256) + + + classmethod + + +
+ + +
+ +

Generate a valid code_verifier and derive its code_challenge.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
method + str + +
+

the method to use for deriving the challenge. Accepts 'S256' or 'plain'.

+
+ 		+ S256 +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ tuple[str, str] + +
+

a (code_verifier, code_challenge) tuple.

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
127
+128
+129
+130
+131
+132
+133
+134
+135
+136
+137
+138
+139
+140
@classmethod
+def generate_code_verifier_and_challenge(cls, method: str = CodeChallengeMethods.S256) -> tuple[str, str]:
+    """Generate a valid `code_verifier` and derive its `code_challenge`.
+
+    Args:
+        method: the method to use for deriving the challenge. Accepts 'S256' or 'plain'.
+
+    Returns:
+        a `(code_verifier, code_challenge)` tuple.
+
+    """
+    verifier = cls.generate_code_verifier()
+    challenge = cls.derive_challenge(verifier, method)
+    return verifier, challenge
+
+
+
+ +
+ +
+ + +
+ validate_code_verifier(verifier, challenge, method=CodeChallengeMethods.S256) + + + classmethod + + +
+ + +
+ +

Validate a code_verifier against a code_challenge.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
verifier + str + +
+

the code_verifier, exactly as submitted by the client on token request.

+
+ 		+ required +
challenge + str + +
+

the code_challenge, exactly as submitted by the client on authorization request.

+
+ 		+ required +
method + str + +
+

the method to use for deriving the challenge. Accepts 'S256' or 'plain'.

+
+ 		+ S256 +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ bool + +
+

True if verifier is valid, or False otherwise

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
142
+143
+144
+145
+146
+147
+148
+149
+150
+151
+152
+153
+154
+155
+156
+157
+158
@classmethod
+def validate_code_verifier(cls, verifier: str, challenge: str, method: str = CodeChallengeMethods.S256) -> bool:
+    """Validate a `code_verifier` against a `code_challenge`.
+
+    Args:
+        verifier: the `code_verifier`, exactly as submitted by the client on token request.
+        challenge: the `code_challenge`, exactly as submitted by the client on authorization request.
+        method: the method to use for deriving the challenge. Accepts 'S256' or 'plain'.
+
+    Returns:
+        `True` if verifier is valid, or `False` otherwise
+
+    """
+    return (
+        cls.code_verifier_pattern.match(verifier) is not None
+        and cls.derive_challenge(verifier, method) == challenge
+    )
+
+
+
+ +
+ + + +
+ +
+ +
+ +
+ + + +

+ UnsupportedResponseTypeParam + + +

+ + +
+

+ Bases: ValueError

+ + +

Raised when an unsupported response_type is passed as parameter.

+ +
+ Source code in requests_oauth2client/authorization_request.py + 
161
+162
+163
+164
+165
class UnsupportedResponseTypeParam(ValueError):
+    """Raised when an unsupported response_type is passed as parameter."""
+
+    def __init__(self, response_type: str) -> None:
+        super().__init__("""The only supported response type is 'code'.""", response_type)
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ MissingIssuerParam + + +

+ + +
+

+ Bases: ValueError

+ + +

Raised when the 'issuer' parameter is required but not provided.

+ +
+ Source code in requests_oauth2client/authorization_request.py + 
168
+169
+170
+171
+172
+173
+174
+175
class MissingIssuerParam(ValueError):
+    """Raised when the 'issuer' parameter is required but not provided."""
+
+    def __init__(self) -> None:
+        super().__init__("""\
+When 'authorization_response_iss_parameter_supported' is `True`, you must
+provide the expected `issuer` as parameter.
+""")
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ InvalidMaxAgeParam + + +

+ + +
+

+ Bases: ValueError

+ + +

Raised when an invalid 'max_age' parameter is provided.

+ +
+ Source code in requests_oauth2client/authorization_request.py + 
178
+179
+180
+181
+182
+183
+184
+185
+186
class InvalidMaxAgeParam(ValueError):
+    """Raised when an invalid 'max_age' parameter is provided."""
+
+    def __init__(self) -> None:
+        super().__init__("""\
+Invalid 'max_age' parameter. It must be a positive number of seconds.
+This specifies the allowable elapsed time in seconds since the last time
+the End-User was actively authenticated by the OP.
+""")
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ AuthorizationResponse + + +

+ + +
+ + +

Represent a successful Authorization Response.

+

An Authorization Response is the redirection initiated by the AS to the client's redirection +endpoint (redirect_uri) after an Authorization Request. This Response is typically created with +a call to AuthorizationRequest.validate_callback() once the call to the client Redirection +Endpoint is made. AuthorizationResponse contains the following, all accessible as attributes:

+
    +
  • all the parameters that have been returned by the AS, most notably the code, and optional + parameters such as state.
    • +
  • the redirect_uri that was used for the Authorization Request
    • +
  • the code_verifier matching the code_challenge that was used for the Authorization Request
    • +
+

Parameters redirect_uri and code_verifier must be those from the matching +AuthorizationRequest. All other parameters including code and state must be those +extracted from the Authorization Response parameters.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
code + str + +
+

the authorization code returned by the AS

+
+ 		+ required +
redirect_uri + str | None + +
+

the redirect_uri that was passed as parameter in the AuthorizationRequest

+
+ 		+ None +
code_verifier + str | None + +
+

the code_verifier matching the code_challenge that was passed as +parameter in the AuthorizationRequest

+
+ 		+ None +
state + str | None + +
+

the state returned by the AS

+
+ 		+ None +
**kwargs + str + +
+

other parameters as returned by the AS

+
+ 		+ {} +
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
189
+190
+191
+192
+193
+194
+195
+196
+197
+198
+199
+200
+201
+202
+203
+204
+205
+206
+207
+208
+209
+210
+211
+212
+213
+214
+215
+216
+217
+218
+219
+220
+221
+222
+223
+224
+225
+226
+227
+228
+229
+230
+231
+232
+233
+234
+235
+236
+237
+238
+239
+240
+241
+242
+243
+244
+245
+246
+247
+248
+249
+250
+251
+252
+253
+254
+255
+256
+257
+258
+259
+260
+261
+262
+263
+264
+265
+266
+267
+268
+269
@frozen(init=False)
+class AuthorizationResponse:
+    """Represent a successful Authorization Response.
+
+    An Authorization Response is the redirection initiated by the AS to the client's redirection
+    endpoint (redirect_uri) after an Authorization Request. This Response is typically created with
+    a call to `AuthorizationRequest.validate_callback()` once the call to the client Redirection
+    Endpoint is made. AuthorizationResponse contains the following, all accessible as attributes:
+
+     - all the parameters that have been returned by the AS, most notably the `code`, and optional
+       parameters such as `state`.
+     - the redirect_uri that was used for the Authorization Request
+     - the code_verifier matching the code_challenge that was used for the Authorization Request
+
+    Parameters `redirect_uri` and `code_verifier` must be those from the matching
+    `AuthorizationRequest`. All other parameters including `code` and `state` must be those
+    extracted from the Authorization Response parameters.
+
+    Args:
+        code: the authorization code returned by the AS
+        redirect_uri: the redirect_uri that was passed as parameter in the AuthorizationRequest
+        code_verifier: the code_verifier matching the code_challenge that was passed as
+            parameter in the AuthorizationRequest
+        state: the state returned by the AS
+        **kwargs: other parameters as returned by the AS
+
+    """
+
+    code: str
+    redirect_uri: str | None = None
+    code_verifier: str | None = None
+    state: str | None = None
+    nonce: str | None = None
+    acr_values: tuple[str, ...] | None = None
+    max_age: int | None = None
+    issuer: str | None = None
+    kwargs: dict[str, Any] = Factory(dict)
+
+    def __init__(
+        self,
+        *,
+        code: str,
+        redirect_uri: str | None = None,
+        code_verifier: str | None = None,
+        state: str | None = None,
+        nonce: str | None = None,
+        acr_values: str | Sequence[str] | None = None,
+        max_age: int | None = None,
+        issuer: str | None = None,
+        **kwargs: str,
+    ) -> None:
+        if not acr_values:
+            acr_values = None
+        elif isinstance(acr_values, str):
+            acr_values = tuple(acr_values.split(" "))
+        else:
+            acr_values = tuple(acr_values)
+
+        self.__attrs_init__(
+            code=code,
+            redirect_uri=redirect_uri,
+            code_verifier=code_verifier,
+            state=state,
+            nonce=nonce,
+            acr_values=acr_values,
+            max_age=max_age,
+            issuer=issuer,
+            kwargs=kwargs,
+        )
+
+    def __getattr__(self, item: str) -> str | None:
+        """Make additional parameters available as attributes.
+
+        Args:
+            item: the attribute name
+
+        Returns:
+            the attribute value, or None if it isn't part of the returned attributes
+
+        """
+        return self.kwargs.get(item)
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ AuthorizationRequest + + +

+ + +
+ + +

Represent an Authorization Request.

+

This class makes it easy to generate valid Authorization Request URI (possibly including a +state, nonce, PKCE, and custom args), to store all parameters, and to validate an Authorization +Response.

+

All parameters passed at init time will be included in the request query parameters as-is, +excepted for a few parameters which have a special behaviour:

+
    +
  • state: if ... (default), a random state parameter will be generated for you. + You may pass your own state as str, or set it to None so that the state parameter + will not be included in the request. You may access that state in the state attribute + from this request.
    • +
  • nonce: if ... (default) and scope includes 'openid', a random nonce will be + generated and included in the request. You may access that nonce in the nonce attribute + from this request.
    • +
  • code_verifier: if None, and code_challenge_method is 'S256' or 'plain', + a valid code_challenge and code_verifier for PKCE will be automatically generated, + and the code_challenge will be included in the request. + You may pass your own code_verifier as a str parameter, in which case the + appropriate code_challenge will be included in the request, according to the + code_challenge_method.
    • +
  • +

    authorization_response_iss_parameter_supported and issuer: + those are used for Server Issuer Identification. By default:

    +
      +
    • If ìssuer is set and an issuer is included in the Authorization Response, +then the consistency between those 2 values will be checked when using validate_callback().
      • +
    • If issuer is not included in the response, then no issuer check is performed.
      • +
    +

    Set authorization_response_iss_parameter_supported to True to enforce server identification:

    +
      +
    • an issuer must also be provided as parameter, and the AS must return that same value +for the response to be considered valid by validate_callback().
      • +
    • if no issuer is included in the Authorization Response, then an error will be raised.
      • +
    +
    • +
+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
authorization_endpoint + str + +
+

the uri for the authorization endpoint.

+
+ 		+ required +
client_id + str + +
+

the client_id to include in the request.

+
+ 		+ required +
redirect_uri + str | None + +
+

the redirect_uri to include in the request. This is required in OAuth 2.0 and optional +in OAuth 2.1. Pass None if you don't need any redirect_uri in the Authorization +Request.

+
+ 		+ None +
scope + None | str | Iterable[str] + +
+

the scope to include in the request, as an iterable of str, or a single space-separated str.

+
+ 		+ 'openid' +
response_type + str + +
+

the response type to include in the request.

+
+ 		+ CODE +
state + str | ellipsis | None + +
+

the state to include in the request, or ... to autogenerate one (default).

+
+ 		+ ... +
nonce + str | ellipsis | None + +
+

the nonce to include in the request, or ... to autogenerate one (default).

+
+ 		+ ... +
code_verifier + str | None + +
+

the code verifier to include in the request. +If left as None and code_challenge_method is set, a valid code_verifier +will be generated.

+
+ 		+ None +
code_challenge_method + str | None + +
+

the method to use to derive the code_challenge from the code_verifier.

+
+ 		+ S256 +
acr_values + str | Iterable[str] | None + +
+

requested Authentication Context Class Reference values.

+
+ 		+ None +
issuer + str | None + +
+

Issuer Identifier value from the OAuth/OIDC Server, if using Server Issuer Identification.

+
+ 		+ None +
**kwargs + Any + +
+

extra parameters to include in the request, as-is.

+
+ 		+ {} +
+ + +
+ Example + 
1
+2
+3
+4
+5
+6
+7
+8
+9
from requests_oauth2client import AuthorizationRequest
+
+azr = AuthorizationRequest(
+    authorization_endpoint="https://url.to.the/authorization_endpoint",
+    client_id="my_client_id",
+    redirect_uri="http://localhost/callback",
+    scope="openid email profile",
+)
+print(azr)
+
+
+ +

Raises:

+ + + + + + + + + + + + + + + + + + + + + +
TypeDescription
+ InvalidMaxAgeParam + +
+

if the max_age parameter is invalid.

+
+
+ MissingIssuerParam + +
+

if authorization_response_iss_parameter_supported is set to True +but the issuer parameter is not provided.

+
+
+ UnsupportedResponseTypeParam + +
+

if response_type is not supported.

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
272
+273
+274
+275
+276
+277
+278
+279
+280
+281
+282
+283
+284
+285
+286
+287
+288
+289
+290
+291
+292
+293
+294
+295
+296
+297
+298
+299
+300
+301
+302
+303
+304
+305
+306
+307
+308
+309
+310
+311
+312
+313
+314
+315
+316
+317
+318
+319
+320
+321
+322
+323
+324
+325
+326
+327
+328
+329
+330
+331
+332
+333
+334
+335
+336
+337
+338
+339
+340
+341
+342
+343
+344
+345
+346
+347
+348
+349
+350
+351
+352
+353
+354
+355
+356
+357
+358
+359
+360
+361
+362
+363
+364
+365
+366
+367
+368
+369
+370
+371
+372
+373
+374
+375
+376
+377
+378
+379
+380
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391
+392
+393
+394
+395
+396
+397
+398
+399
+400
+401
+402
+403
+404
+405
+406
+407
+408
+409
+410
+411
+412
+413
+414
+415
+416
+417
+418
+419
+420
+421
+422
+423
+424
+425
+426
+427
+428
+429
+430
+431
+432
+433
+434
+435
+436
+437
+438
+439
+440
+441
+442
+443
+444
+445
+446
+447
+448
+449
+450
+451
+452
+453
+454
+455
+456
+457
+458
+459
+460
+461
+462
+463
+464
+465
+466
+467
+468
+469
+470
+471
+472
+473
+474
+475
+476
+477
+478
+479
+480
+481
+482
+483
+484
+485
+486
+487
+488
+489
+490
+491
+492
+493
+494
+495
+496
+497
+498
+499
+500
+501
+502
+503
+504
+505
+506
+507
+508
+509
+510
+511
+512
+513
+514
+515
+516
+517
+518
+519
+520
+521
+522
+523
+524
+525
+526
+527
+528
+529
+530
+531
+532
+533
+534
+535
+536
+537
+538
+539
+540
+541
+542
+543
+544
+545
+546
+547
+548
+549
+550
+551
+552
+553
+554
+555
+556
+557
+558
+559
+560
+561
+562
+563
+564
+565
+566
+567
+568
+569
+570
+571
+572
+573
+574
+575
+576
+577
+578
+579
+580
+581
+582
+583
+584
+585
+586
+587
+588
+589
+590
+591
+592
+593
+594
+595
+596
+597
+598
+599
+600
+601
+602
+603
+604
+605
+606
+607
+608
+609
+610
+611
+612
+613
+614
+615
+616
+617
+618
+619
+620
+621
+622
+623
+624
+625
+626
+627
+628
+629
+630
+631
+632
+633
+634
+635
+636
+637
+638
+639
+640
+641
+642
+643
+644
+645
+646
+647
+648
+649
+650
+651
+652
+653
+654
+655
+656
+657
+658
+659
+660
+661
+662
+663
+664
+665
+666
+667
+668
+669
+670
+671
+672
+673
+674
+675
+676
+677
+678
+679
+680
+681
+682
+683
+684
+685
+686
+687
+688
+689
+690
+691
+692
+693
+694
+695
+696
+697
+698
+699
+700
+701
+702
+703
+704
+705
+706
+707
+708
+709
+710
+711
+712
+713
+714
+715
+716
+717
+718
+719
+720
+721
+722
+723
+724
+725
+726
+727
+728
+729
+730
+731
+732
+733
+734
+735
+736
+737
+738
+739
+740
+741
+742
@frozen(init=False, repr=False)
+class AuthorizationRequest:
+    """Represent an Authorization Request.
+
+    This class makes it easy to generate valid Authorization Request URI (possibly including a
+    state, nonce, PKCE, and custom args), to store all parameters, and to validate an Authorization
+    Response.
+
+    All parameters passed at init time will be included in the request query parameters as-is,
+    excepted for a few parameters which have a special behaviour:
+
+    - `state`: if `...` (default), a random `state` parameter will be generated for you.
+      You may pass your own `state` as `str`, or set it to `None` so that the `state` parameter
+      will not be included in the request. You may access that state in the `state` attribute
+      from this request.
+    - `nonce`: if `...` (default) and `scope` includes 'openid', a random `nonce` will be
+      generated and included in the request. You may access that `nonce` in the `nonce` attribute
+      from this request.
+    - `code_verifier`: if `None`, and `code_challenge_method` is `'S256'` or `'plain'`,
+      a valid `code_challenge` and `code_verifier` for PKCE will be automatically generated,
+      and the `code_challenge` will be included in the request.
+      You may pass your own `code_verifier` as a `str` parameter, in which case the
+      appropriate `code_challenge` will be included in the request, according to the
+      `code_challenge_method`.
+    - `authorization_response_iss_parameter_supported` and `issuer`:
+       those are used for Server Issuer Identification. By default:
+
+        - If `ìssuer` is set and an issuer is included in the Authorization Response,
+        then the consistency between those 2 values will be checked when using `validate_callback()`.
+        - If issuer is not included in the response, then no issuer check is performed.
+
+        Set `authorization_response_iss_parameter_supported` to `True` to enforce server identification:
+
+        - an `issuer` must also be provided as parameter, and the AS must return that same value
+        for the response to be considered valid by `validate_callback()`.
+        - if no issuer is included in the Authorization Response, then an error will be raised.
+
+    Args:
+        authorization_endpoint: the uri for the authorization endpoint.
+        client_id: the client_id to include in the request.
+        redirect_uri: the redirect_uri to include in the request. This is required in OAuth 2.0 and optional
+            in OAuth 2.1. Pass `None` if you don't need any redirect_uri in the Authorization
+            Request.
+        scope: the scope to include in the request, as an iterable of `str`, or a single space-separated `str`.
+        response_type: the response type to include in the request.
+        state: the state to include in the request, or `...` to autogenerate one (default).
+        nonce: the nonce to include in the request, or `...` to autogenerate one (default).
+        code_verifier: the code verifier to include in the request.
+            If left as `None` and `code_challenge_method` is set, a valid code_verifier
+            will be generated.
+        code_challenge_method: the method to use to derive the `code_challenge` from the `code_verifier`.
+        acr_values: requested Authentication Context Class Reference values.
+        issuer: Issuer Identifier value from the OAuth/OIDC Server, if using Server Issuer Identification.
+        **kwargs: extra parameters to include in the request, as-is.
+
+    Example:
+        ```python
+        from requests_oauth2client import AuthorizationRequest
+
+        azr = AuthorizationRequest(
+            authorization_endpoint="https://url.to.the/authorization_endpoint",
+            client_id="my_client_id",
+            redirect_uri="http://localhost/callback",
+            scope="openid email profile",
+        )
+        print(azr)
+        ```
+
+    Raises:
+        InvalidMaxAgeParam: if the `max_age` parameter is invalid.
+        MissingIssuerParam: if `authorization_response_iss_parameter_supported` is set to `True`
+            but the `issuer` parameter is not provided.
+        UnsupportedResponseTypeParam: if `response_type` is not supported.
+
+    """
+
+    authorization_endpoint: str
+
+    client_id: str = field(metadata={"query": True})
+    redirect_uri: str | None = field(metadata={"query": True}, default=None)
+    scope: tuple[str, ...] | None = field(metadata={"query": True}, default=("openid",))
+    response_type: str = field(metadata={"query": True}, default=ResponseTypes.CODE)
+    state: str | None = field(metadata={"query": True}, default=None)
+    nonce: str | None = field(metadata={"query": True}, default=None)
+    code_challenge_method: str | None = field(metadata={"query": True}, default=CodeChallengeMethods.S256)
+    acr_values: tuple[str, ...] | None = field(metadata={"query": True}, default=None)
+    max_age: int | None = field(metadata={"query": True}, default=None)
+    kwargs: dict[str, Any] = Factory(dict)
+
+    code_verifier: str | None = None
+    code_challenge: str | None = field(init=False, metadata={"query": True})
+    authorization_response_iss_parameter_supported: bool = False
+    issuer: str | None = None
+
+    exception_classes: ClassVar[dict[str, type[AuthorizationResponseError]]] = {
+        "interaction_required": InteractionRequired,
+        "login_required": LoginRequired,
+        "session_selection_required": SessionSelectionRequired,
+        "consent_required": ConsentRequired,
+    }
+
+    @classmethod
+    def generate_state(cls) -> str:
+        """Generate a random `state` parameter."""
+        return secrets.token_urlsafe(32)
+
+    @classmethod
+    def generate_nonce(cls) -> str:
+        """Generate a random `nonce`."""
+        return secrets.token_urlsafe(32)
+
+    def __init__(  # noqa: PLR0913, C901
+        self,
+        authorization_endpoint: str,
+        *,
+        client_id: str,
+        redirect_uri: str | None = None,
+        scope: None | str | Iterable[str] = "openid",
+        response_type: str = ResponseTypes.CODE,
+        state: str | ellipsis | None = ...,  # noqa: F821
+        nonce: str | ellipsis | None = ...,  # noqa: F821
+        code_verifier: str | None = None,
+        code_challenge_method: str | None = CodeChallengeMethods.S256,
+        acr_values: str | Iterable[str] | None = None,
+        max_age: int | None = None,
+        issuer: str | None = None,
+        authorization_response_iss_parameter_supported: bool = False,
+        **kwargs: Any,
+    ) -> None:
+        if response_type != ResponseTypes.CODE:
+            raise UnsupportedResponseTypeParam(response_type)
+
+        if authorization_response_iss_parameter_supported and not issuer:
+            raise MissingIssuerParam
+
+        if state is ...:
+            state = self.generate_state()
+        if state is not None and not isinstance(state, str):
+            state = str(state)  # pragma: no cover
+
+        if nonce is ...:
+            nonce = self.generate_nonce() if scope is not None and "openid" in scope else None
+        if nonce is not None and not isinstance(nonce, str):
+            nonce = str(nonce)  # pragma: no cover
+
+        if not scope:
+            scope = None
+
+        if scope is not None:
+            scope = tuple(scope.split(" ")) if isinstance(scope, str) else tuple(scope)
+
+        if acr_values is not None:
+            acr_values = tuple(acr_values.split()) if isinstance(acr_values, str) else tuple(acr_values)
+
+        if max_age is not None and max_age < 0:
+            raise InvalidMaxAgeParam
+
+        if "code_challenge" in kwargs:
+            msg = (
+                "A `code_challenge` must not be passed as parameter. Pass the `code_verifier`"
+                " instead, and the appropriate `code_challenge` will automatically be derived"
+                " from it and included in the request, based on `code_challenge_method`."
+            )
+            raise ValueError(msg)
+
+        code_challenge: str | None = None
+        if code_challenge_method:
+            if not code_verifier:
+                code_verifier = PkceUtils.generate_code_verifier()
+            code_challenge = PkceUtils.derive_challenge(code_verifier, code_challenge_method)
+        else:
+            code_verifier = None
+
+        self.__attrs_init__(
+            authorization_endpoint=authorization_endpoint,
+            client_id=client_id,
+            redirect_uri=redirect_uri,
+            issuer=issuer,
+            response_type=response_type,
+            scope=scope,
+            state=state,
+            nonce=nonce,
+            code_verifier=code_verifier,
+            code_challenge_method=code_challenge_method,
+            acr_values=acr_values,
+            max_age=max_age,
+            authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
+            kwargs=kwargs,
+        )
+        object.__setattr__(self, "code_challenge", code_challenge)
+
+    def as_dict(self) -> dict[str, Any]:
+        """Return the full argument dict.
+
+        This can be used to serialize this request and/or to initialize a similar request.
+
+        """
+        d = asdict(self)
+        d.update(**d.pop("kwargs", {}))
+        d.pop("code_challenge")
+        return d
+
+    @property
+    def args(self) -> dict[str, Any]:
+        """Return a dict with all the query parameters from this AuthorizationRequest.
+
+        Returns:
+            a dict of parameters
+
+        """
+        d = {field.name: getattr(self, field.name) for field in fields(type(self)) if field.metadata.get("query")}
+        if d["scope"]:
+            d["scope"] = " ".join(d["scope"])
+        d.update(self.kwargs)
+
+        return {key: val for key, val in d.items() if val is not None}
+
+    def validate_callback(self, response: str) -> AuthorizationResponse:
+        """Validate an Authorization Response against this Request.
+
+        Validate a given Authorization Response URI against this Authorization Request, and return
+        an
+        [AuthorizationResponse][requests_oauth2client.authorization_request.AuthorizationResponse].
+
+        This includes matching the `state` parameter, checking for returned errors, and extracting
+        the returned `code` and other parameters.
+
+        Args:
+            response: the Authorization Response URI. This can be the full URL, or just the
+                query parameters (still encoded as x-www-form-urlencoded).
+
+        Returns:
+            the extracted code, if all checks are successful
+
+        Raises:
+            MissingAuthCode: if the `code` is missing in the response
+            MissingIssuer: if Server Issuer verification is active and the response does
+                not contain an `iss`.
+            MismatchingIssuer: if the 'iss' received from the response does not match the
+                expected value.
+            MismatchingState: if the response `state` does not match the expected value.
+            OAuth2Error: if the response includes an error.
+            MissingAuthCode: if the response does not contain a `code`.
+            UnsupportedResponseTypeParam: if response_type anything else than 'code'.
+
+        """
+        try:
+            response_url = furl(response)
+        except ValueError:
+            return self.on_response_error(response)
+
+        # validate 'iss' according to RFC9207
+        received_issuer = response_url.args.get("iss")
+        if self.authorization_response_iss_parameter_supported or received_issuer:
+            if received_issuer is None:
+                raise MissingIssuer(self, response)
+            if self.issuer and received_issuer != self.issuer:
+                raise MismatchingIssuer(self.issuer, received_issuer, self, response)
+
+        # validate state
+        requested_state = self.state
+        if requested_state:
+            received_state = response_url.args.get("state")
+            if requested_state != received_state:
+                raise MismatchingState(requested_state, received_state, self, response)
+
+        error = response_url.args.get("error")
+        if error:
+            return self.on_response_error(response)
+
+        if self.response_type == ResponseTypes.CODE:
+            code: str = response_url.args.get("code")
+            if code is None:
+                raise MissingAuthCode(self, response)
+        else:
+            raise UnsupportedResponseTypeParam(self.response_type)  # pragma: no cover
+
+        return AuthorizationResponse(
+            code_verifier=self.code_verifier,
+            redirect_uri=self.redirect_uri,
+            nonce=self.nonce,
+            acr_values=self.acr_values,
+            max_age=self.max_age,
+            **response_url.args,
+        )
+
+    def sign_request_jwt(
+        self,
+        jwk: Jwk | dict[str, Any],
+        alg: str | None = None,
+        lifetime: int | None = None,
+    ) -> SignedJwt:
+        """Sign the `request` object that matches this Authorization Request parameters.
+
+        Args:
+            jwk: the JWK to use to sign the request
+            alg: the alg to use to sign the request, if the provided `jwk` has no `alg` parameter.
+            lifetime: an optional number of seconds of validity for the signed request.
+                If present, `iat` an `exp` claims will be included in the signed JWT.
+
+        Returns:
+            a `Jwt` that contains the signed request object.
+
+        """
+        claims = self.args
+        if lifetime:
+            claims["iat"] = Jwt.timestamp()
+            claims["exp"] = Jwt.timestamp(lifetime)
+        return Jwt.sign(
+            claims,
+            key=jwk,
+            alg=alg,
+        )
+
+    def sign(
+        self,
+        jwk: Jwk | dict[str, Any],
+        alg: str | None = None,
+        lifetime: int | None = None,
+        **kwargs: Any,
+    ) -> RequestParameterAuthorizationRequest:
+        """Sign this Authorization Request and return a new one.
+
+        This replaces all parameters with a signed `request` JWT.
+
+        Args:
+            jwk: the JWK to use to sign the request
+            alg: the alg to use to sign the request, if the provided `jwk` has no `alg` parameter.
+            lifetime: lifetime of the resulting Jwt (used to calculate the 'exp' claim).
+                By default, don't use an 'exp' claim.
+            kwargs: additional query parameters to include in the signed authorization request
+
+        Returns:
+            the signed Authorization Request
+
+        """
+        request_jwt = self.sign_request_jwt(jwk, alg, lifetime)
+        return RequestParameterAuthorizationRequest(
+            authorization_endpoint=self.authorization_endpoint,
+            client_id=self.client_id,
+            request=str(request_jwt),
+            expires_at=request_jwt.expires_at,
+            **kwargs,
+        )
+
+    def sign_and_encrypt_request_jwt(
+        self,
+        sign_jwk: Jwk | dict[str, Any],
+        enc_jwk: Jwk | dict[str, Any],
+        sign_alg: str | None = None,
+        enc_alg: str | None = None,
+        enc: str = "A128CBC-HS256",
+        lifetime: int | None = None,
+    ) -> JweCompact:
+        """Sign and encrypt a `request` object for this Authorization Request.
+
+        The signed `request` will contain the same parameters as this AuthorizationRequest.
+
+        Args:
+            sign_jwk: the JWK to use to sign the request
+            enc_jwk: the JWK to use to encrypt the request
+            sign_alg: the alg to use to sign the request, if `sign_jwk` has no `alg` parameter.
+            enc_alg: the alg to use to encrypt the request, if `enc_jwk` has no `alg` parameter.
+            enc: the encoding to use to encrypt the request.
+            lifetime: lifetime of the resulting Jwt (used to calculate the 'exp' claim).
+                By default, do not include an 'exp' claim.
+
+        Returns:
+            the signed and encrypted request object, as a `jwskate.Jwt`
+
+        """
+        claims = self.args
+        if lifetime:
+            claims["iat"] = Jwt.timestamp()
+            claims["exp"] = Jwt.timestamp(lifetime)
+        return Jwt.sign_and_encrypt(
+            claims=claims,
+            sign_key=sign_jwk,
+            sign_alg=sign_alg,
+            enc_key=enc_jwk,
+            enc_alg=enc_alg,
+            enc=enc,
+        )
+
+    def sign_and_encrypt(
+        self,
+        sign_jwk: Jwk | dict[str, Any],
+        enc_jwk: Jwk | dict[str, Any],
+        sign_alg: str | None = None,
+        enc_alg: str | None = None,
+        enc: str = "A128CBC-HS256",
+        lifetime: int | None = None,
+    ) -> RequestParameterAuthorizationRequest:
+        """Sign and encrypt the current Authorization Request.
+
+        This replaces all parameters with a matching `request` object.
+
+        Args:
+            sign_jwk: the JWK to use to sign the request
+            enc_jwk: the JWK to use to encrypt the request
+            sign_alg: the alg to use to sign the request, if `sign_jwk` has no `alg` parameter.
+            enc_alg: the alg to use to encrypt the request, if `enc_jwk` has no `alg` parameter.
+            enc: the encoding to use to encrypt the request.
+            lifetime: lifetime of the resulting Jwt (used to calculate the 'exp' claim).
+                By default, do not include an 'exp' claim.
+
+        Returns:
+            a `RequestParameterAuthorizationRequest`, with a request object as parameter
+
+        """
+        request_jwt = self.sign_and_encrypt_request_jwt(
+            sign_jwk=sign_jwk,
+            enc_jwk=enc_jwk,
+            sign_alg=sign_alg,
+            enc_alg=enc_alg,
+            enc=enc,
+            lifetime=lifetime,
+        )
+        return RequestParameterAuthorizationRequest(
+            authorization_endpoint=self.authorization_endpoint,
+            client_id=self.client_id,
+            request=str(request_jwt),
+        )
+
+    def on_response_error(self, response: str) -> AuthorizationResponse:
+        """Error handler for Authorization Response errors.
+
+        Triggered by
+        [validate_callback()][requests_oauth2client.authorization_request.AuthorizationRequest.validate_callback]
+        if the response uri contains an error.
+
+        Args:
+            response: the Authorization Response URI. This can be the full URL, or just the query parameters.
+
+        Returns:
+            may return a default code that will be returned by `validate_callback`. But this method
+            will most likely raise exceptions instead.
+
+        Raises:
+            AuthorizationResponseError: if the response contains an `error`. The raised exception may be a subclass
+
+        """
+        response_url = furl(response)
+        error = response_url.args.get("error")
+        error_description = response_url.args.get("error_description")
+        error_uri = response_url.args.get("error_uri")
+        exception_class = self.exception_classes.get(error, AuthorizationResponseError)
+        raise exception_class(
+            request=self, response=response, error=error, description=error_description, uri=error_uri
+        )
+
+    @property
+    def furl(self) -> furl:
+        """Return the Authorization Request URI, as a `furl`."""
+        return furl(
+            self.authorization_endpoint,
+            args=self.args,
+        )
+
+    @property
+    def uri(self) -> str:
+        """Return the Authorization Request URI, as a `str`."""
+        return str(self.furl.url)
+
+    def __getattr__(self, item: str) -> Any:
+        """Allow attribute access to extra parameters."""
+        return self.kwargs[item]
+
+    def __repr__(self) -> str:
+        """Return the Authorization Request URI, as a `str`."""
+        return self.uri
+
+
+ + + +
+ + + + + + + +
+ + + +
+ args: dict[str, Any] + + + property + + +
+ + +
+ +

Return a dict with all the query parameters from this AuthorizationRequest.

+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ dict[str, Any] + +
+

a dict of parameters

+
+
+
+ +
+ +
+ + + +
+ furl: furl + + + property + + +
+ + +
+ +

Return the Authorization Request URI, as a furl.

+
+ +
+ +
+ + + +
+ uri: str + + + property + + +
+ + +
+ +

Return the Authorization Request URI, as a str.

+
+ +
+ + + +
+ + +
+ generate_state() + + + classmethod + + +
+ + +
+ +

Generate a random state parameter.

+ +
+ Source code in requests_oauth2client/authorization_request.py + 
373
+374
+375
+376
@classmethod
+def generate_state(cls) -> str:
+    """Generate a random `state` parameter."""
+    return secrets.token_urlsafe(32)
+
+
+
+ +
+ +
+ + +
+ generate_nonce() + + + classmethod + + +
+ + +
+ +

Generate a random nonce.

+ +
+ Source code in requests_oauth2client/authorization_request.py + 
378
+379
+380
+381
@classmethod
+def generate_nonce(cls) -> str:
+    """Generate a random `nonce`."""
+    return secrets.token_urlsafe(32)
+
+
+
+ +
+ +
+ + +
+ as_dict() + +
+ + +
+ +

Return the full argument dict.

+

This can be used to serialize this request and/or to initialize a similar request.

+ +
+ Source code in requests_oauth2client/authorization_request.py + 
463
+464
+465
+466
+467
+468
+469
+470
+471
+472
def as_dict(self) -> dict[str, Any]:
+    """Return the full argument dict.
+
+    This can be used to serialize this request and/or to initialize a similar request.
+
+    """
+    d = asdict(self)
+    d.update(**d.pop("kwargs", {}))
+    d.pop("code_challenge")
+    return d
+
+
+
+ +
+ +
+ + +
+ validate_callback(response) + +
+ + +
+ +

Validate an Authorization Response against this Request.

+

Validate a given Authorization Response URI against this Authorization Request, and return +an +AuthorizationResponse.

+

This includes matching the state parameter, checking for returned errors, and extracting +the returned code and other parameters.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + str + +
+

the Authorization Response URI. This can be the full URL, or just the +query parameters (still encoded as x-www-form-urlencoded).

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ AuthorizationResponse + +
+

the extracted code, if all checks are successful

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
TypeDescription
+ MissingAuthCode + +
+

if the code is missing in the response

+
+
+ MissingIssuer + +
+

if Server Issuer verification is active and the response does +not contain an iss.

+
+
+ MismatchingIssuer + +
+

if the 'iss' received from the response does not match the +expected value.

+
+
+ MismatchingState + +
+

if the response state does not match the expected value.

+
+
+ OAuth2Error + +
+

if the response includes an error.

+
+
+ MissingAuthCode + +
+

if the response does not contain a code.

+
+
+ UnsupportedResponseTypeParam + +
+

if response_type anything else than 'code'.

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
489
+490
+491
+492
+493
+494
+495
+496
+497
+498
+499
+500
+501
+502
+503
+504
+505
+506
+507
+508
+509
+510
+511
+512
+513
+514
+515
+516
+517
+518
+519
+520
+521
+522
+523
+524
+525
+526
+527
+528
+529
+530
+531
+532
+533
+534
+535
+536
+537
+538
+539
+540
+541
+542
+543
+544
+545
+546
+547
+548
+549
+550
+551
+552
+553
+554
+555
+556
def validate_callback(self, response: str) -> AuthorizationResponse:
+    """Validate an Authorization Response against this Request.
+
+    Validate a given Authorization Response URI against this Authorization Request, and return
+    an
+    [AuthorizationResponse][requests_oauth2client.authorization_request.AuthorizationResponse].
+
+    This includes matching the `state` parameter, checking for returned errors, and extracting
+    the returned `code` and other parameters.
+
+    Args:
+        response: the Authorization Response URI. This can be the full URL, or just the
+            query parameters (still encoded as x-www-form-urlencoded).
+
+    Returns:
+        the extracted code, if all checks are successful
+
+    Raises:
+        MissingAuthCode: if the `code` is missing in the response
+        MissingIssuer: if Server Issuer verification is active and the response does
+            not contain an `iss`.
+        MismatchingIssuer: if the 'iss' received from the response does not match the
+            expected value.
+        MismatchingState: if the response `state` does not match the expected value.
+        OAuth2Error: if the response includes an error.
+        MissingAuthCode: if the response does not contain a `code`.
+        UnsupportedResponseTypeParam: if response_type anything else than 'code'.
+
+    """
+    try:
+        response_url = furl(response)
+    except ValueError:
+        return self.on_response_error(response)
+
+    # validate 'iss' according to RFC9207
+    received_issuer = response_url.args.get("iss")
+    if self.authorization_response_iss_parameter_supported or received_issuer:
+        if received_issuer is None:
+            raise MissingIssuer(self, response)
+        if self.issuer and received_issuer != self.issuer:
+            raise MismatchingIssuer(self.issuer, received_issuer, self, response)
+
+    # validate state
+    requested_state = self.state
+    if requested_state:
+        received_state = response_url.args.get("state")
+        if requested_state != received_state:
+            raise MismatchingState(requested_state, received_state, self, response)
+
+    error = response_url.args.get("error")
+    if error:
+        return self.on_response_error(response)
+
+    if self.response_type == ResponseTypes.CODE:
+        code: str = response_url.args.get("code")
+        if code is None:
+            raise MissingAuthCode(self, response)
+    else:
+        raise UnsupportedResponseTypeParam(self.response_type)  # pragma: no cover
+
+    return AuthorizationResponse(
+        code_verifier=self.code_verifier,
+        redirect_uri=self.redirect_uri,
+        nonce=self.nonce,
+        acr_values=self.acr_values,
+        max_age=self.max_age,
+        **response_url.args,
+    )
+
+
+
+ +
+ +
+ + +
+ sign_request_jwt(jwk, alg=None, lifetime=None) + +
+ + +
+ +

Sign the request object that matches this Authorization Request parameters.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
jwk + Jwk | dict[str, Any] + +
+

the JWK to use to sign the request

+
+ 		+ required +
alg + str | None + +
+

the alg to use to sign the request, if the provided jwk has no alg parameter.

+
+ 		+ None +
lifetime + int | None + +
+

an optional number of seconds of validity for the signed request. +If present, iat an exp claims will be included in the signed JWT.

+
+ 		+ None +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ SignedJwt + +
+

a Jwt that contains the signed request object.

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
558
+559
+560
+561
+562
+563
+564
+565
+566
+567
+568
+569
+570
+571
+572
+573
+574
+575
+576
+577
+578
+579
+580
+581
+582
+583
+584
def sign_request_jwt(
+    self,
+    jwk: Jwk | dict[str, Any],
+    alg: str | None = None,
+    lifetime: int | None = None,
+) -> SignedJwt:
+    """Sign the `request` object that matches this Authorization Request parameters.
+
+    Args:
+        jwk: the JWK to use to sign the request
+        alg: the alg to use to sign the request, if the provided `jwk` has no `alg` parameter.
+        lifetime: an optional number of seconds of validity for the signed request.
+            If present, `iat` an `exp` claims will be included in the signed JWT.
+
+    Returns:
+        a `Jwt` that contains the signed request object.
+
+    """
+    claims = self.args
+    if lifetime:
+        claims["iat"] = Jwt.timestamp()
+        claims["exp"] = Jwt.timestamp(lifetime)
+    return Jwt.sign(
+        claims,
+        key=jwk,
+        alg=alg,
+    )
+
+
+
+ +
+ +
+ + +
+ sign(jwk, alg=None, lifetime=None, **kwargs) + +
+ + +
+ +

Sign this Authorization Request and return a new one.

+

This replaces all parameters with a signed request JWT.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
jwk + Jwk | dict[str, Any] + +
+

the JWK to use to sign the request

+
+ 		+ required +
alg + str | None + +
+

the alg to use to sign the request, if the provided jwk has no alg parameter.

+
+ 		+ None +
lifetime + int | None + +
+

lifetime of the resulting Jwt (used to calculate the 'exp' claim). +By default, don't use an 'exp' claim.

+
+ 		+ None +
kwargs + Any + +
+

additional query parameters to include in the signed authorization request

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ RequestParameterAuthorizationRequest + +
+

the signed Authorization Request

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
586
+587
+588
+589
+590
+591
+592
+593
+594
+595
+596
+597
+598
+599
+600
+601
+602
+603
+604
+605
+606
+607
+608
+609
+610
+611
+612
+613
+614
+615
def sign(
+    self,
+    jwk: Jwk | dict[str, Any],
+    alg: str | None = None,
+    lifetime: int | None = None,
+    **kwargs: Any,
+) -> RequestParameterAuthorizationRequest:
+    """Sign this Authorization Request and return a new one.
+
+    This replaces all parameters with a signed `request` JWT.
+
+    Args:
+        jwk: the JWK to use to sign the request
+        alg: the alg to use to sign the request, if the provided `jwk` has no `alg` parameter.
+        lifetime: lifetime of the resulting Jwt (used to calculate the 'exp' claim).
+            By default, don't use an 'exp' claim.
+        kwargs: additional query parameters to include in the signed authorization request
+
+    Returns:
+        the signed Authorization Request
+
+    """
+    request_jwt = self.sign_request_jwt(jwk, alg, lifetime)
+    return RequestParameterAuthorizationRequest(
+        authorization_endpoint=self.authorization_endpoint,
+        client_id=self.client_id,
+        request=str(request_jwt),
+        expires_at=request_jwt.expires_at,
+        **kwargs,
+    )
+
+
+
+ +
+ +
+ + +
+ sign_and_encrypt_request_jwt(sign_jwk, enc_jwk, sign_alg=None, enc_alg=None, enc='A128CBC-HS256', lifetime=None) + +
+ + +
+ +

Sign and encrypt a request object for this Authorization Request.

+

The signed request will contain the same parameters as this AuthorizationRequest.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
sign_jwk + Jwk | dict[str, Any] + +
+

the JWK to use to sign the request

+
+ 		+ required +
enc_jwk + Jwk | dict[str, Any] + +
+

the JWK to use to encrypt the request

+
+ 		+ required +
sign_alg + str | None + +
+

the alg to use to sign the request, if sign_jwk has no alg parameter.

+
+ 		+ None +
enc_alg + str | None + +
+

the alg to use to encrypt the request, if enc_jwk has no alg parameter.

+
+ 		+ None +
enc + str + +
+

the encoding to use to encrypt the request.

+
+ 		+ 'A128CBC-HS256' +
lifetime + int | None + +
+

lifetime of the resulting Jwt (used to calculate the 'exp' claim). +By default, do not include an 'exp' claim.

+
+ 		+ None +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ JweCompact + +
+

the signed and encrypted request object, as a jwskate.Jwt

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
617
+618
+619
+620
+621
+622
+623
+624
+625
+626
+627
+628
+629
+630
+631
+632
+633
+634
+635
+636
+637
+638
+639
+640
+641
+642
+643
+644
+645
+646
+647
+648
+649
+650
+651
+652
+653
+654
def sign_and_encrypt_request_jwt(
+    self,
+    sign_jwk: Jwk | dict[str, Any],
+    enc_jwk: Jwk | dict[str, Any],
+    sign_alg: str | None = None,
+    enc_alg: str | None = None,
+    enc: str = "A128CBC-HS256",
+    lifetime: int | None = None,
+) -> JweCompact:
+    """Sign and encrypt a `request` object for this Authorization Request.
+
+    The signed `request` will contain the same parameters as this AuthorizationRequest.
+
+    Args:
+        sign_jwk: the JWK to use to sign the request
+        enc_jwk: the JWK to use to encrypt the request
+        sign_alg: the alg to use to sign the request, if `sign_jwk` has no `alg` parameter.
+        enc_alg: the alg to use to encrypt the request, if `enc_jwk` has no `alg` parameter.
+        enc: the encoding to use to encrypt the request.
+        lifetime: lifetime of the resulting Jwt (used to calculate the 'exp' claim).
+            By default, do not include an 'exp' claim.
+
+    Returns:
+        the signed and encrypted request object, as a `jwskate.Jwt`
+
+    """
+    claims = self.args
+    if lifetime:
+        claims["iat"] = Jwt.timestamp()
+        claims["exp"] = Jwt.timestamp(lifetime)
+    return Jwt.sign_and_encrypt(
+        claims=claims,
+        sign_key=sign_jwk,
+        sign_alg=sign_alg,
+        enc_key=enc_jwk,
+        enc_alg=enc_alg,
+        enc=enc,
+    )
+
+
+
+ +
+ +
+ + +
+ sign_and_encrypt(sign_jwk, enc_jwk, sign_alg=None, enc_alg=None, enc='A128CBC-HS256', lifetime=None) + +
+ + +
+ +

Sign and encrypt the current Authorization Request.

+

This replaces all parameters with a matching request object.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
sign_jwk + Jwk | dict[str, Any] + +
+

the JWK to use to sign the request

+
+ 		+ required +
enc_jwk + Jwk | dict[str, Any] + +
+

the JWK to use to encrypt the request

+
+ 		+ required +
sign_alg + str | None + +
+

the alg to use to sign the request, if sign_jwk has no alg parameter.

+
+ 		+ None +
enc_alg + str | None + +
+

the alg to use to encrypt the request, if enc_jwk has no alg parameter.

+
+ 		+ None +
enc + str + +
+

the encoding to use to encrypt the request.

+
+ 		+ 'A128CBC-HS256' +
lifetime + int | None + +
+

lifetime of the resulting Jwt (used to calculate the 'exp' claim). +By default, do not include an 'exp' claim.

+
+ 		+ None +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ RequestParameterAuthorizationRequest + +
+

a RequestParameterAuthorizationRequest, with a request object as parameter

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
656
+657
+658
+659
+660
+661
+662
+663
+664
+665
+666
+667
+668
+669
+670
+671
+672
+673
+674
+675
+676
+677
+678
+679
+680
+681
+682
+683
+684
+685
+686
+687
+688
+689
+690
+691
+692
+693
+694
def sign_and_encrypt(
+    self,
+    sign_jwk: Jwk | dict[str, Any],
+    enc_jwk: Jwk | dict[str, Any],
+    sign_alg: str | None = None,
+    enc_alg: str | None = None,
+    enc: str = "A128CBC-HS256",
+    lifetime: int | None = None,
+) -> RequestParameterAuthorizationRequest:
+    """Sign and encrypt the current Authorization Request.
+
+    This replaces all parameters with a matching `request` object.
+
+    Args:
+        sign_jwk: the JWK to use to sign the request
+        enc_jwk: the JWK to use to encrypt the request
+        sign_alg: the alg to use to sign the request, if `sign_jwk` has no `alg` parameter.
+        enc_alg: the alg to use to encrypt the request, if `enc_jwk` has no `alg` parameter.
+        enc: the encoding to use to encrypt the request.
+        lifetime: lifetime of the resulting Jwt (used to calculate the 'exp' claim).
+            By default, do not include an 'exp' claim.
+
+    Returns:
+        a `RequestParameterAuthorizationRequest`, with a request object as parameter
+
+    """
+    request_jwt = self.sign_and_encrypt_request_jwt(
+        sign_jwk=sign_jwk,
+        enc_jwk=enc_jwk,
+        sign_alg=sign_alg,
+        enc_alg=enc_alg,
+        enc=enc,
+        lifetime=lifetime,
+    )
+    return RequestParameterAuthorizationRequest(
+        authorization_endpoint=self.authorization_endpoint,
+        client_id=self.client_id,
+        request=str(request_jwt),
+    )
+
+
+
+ +
+ +
+ + +
+ on_response_error(response) + +
+ + +
+ +

Error handler for Authorization Response errors.

+

Triggered by +validate_callback() +if the response uri contains an error.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + str + +
+

the Authorization Response URI. This can be the full URL, or just the query parameters.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ AuthorizationResponse + +
+

may return a default code that will be returned by validate_callback. But this method

+
+
+ AuthorizationResponse + +
+

will most likely raise exceptions instead.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ AuthorizationResponseError + +
+

if the response contains an error. The raised exception may be a subclass

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
696
+697
+698
+699
+700
+701
+702
+703
+704
+705
+706
+707
+708
+709
+710
+711
+712
+713
+714
+715
+716
+717
+718
+719
+720
+721
def on_response_error(self, response: str) -> AuthorizationResponse:
+    """Error handler for Authorization Response errors.
+
+    Triggered by
+    [validate_callback()][requests_oauth2client.authorization_request.AuthorizationRequest.validate_callback]
+    if the response uri contains an error.
+
+    Args:
+        response: the Authorization Response URI. This can be the full URL, or just the query parameters.
+
+    Returns:
+        may return a default code that will be returned by `validate_callback`. But this method
+        will most likely raise exceptions instead.
+
+    Raises:
+        AuthorizationResponseError: if the response contains an `error`. The raised exception may be a subclass
+
+    """
+    response_url = furl(response)
+    error = response_url.args.get("error")
+    error_description = response_url.args.get("error_description")
+    error_uri = response_url.args.get("error_uri")
+    exception_class = self.exception_classes.get(error, AuthorizationResponseError)
+    raise exception_class(
+        request=self, response=response, error=error, description=error_description, uri=error_uri
+    )
+
+
+
+ +
+ + + +
+ +
+ +
+ +
+ + + +

+ RequestParameterAuthorizationRequest + + +

+ + +
+ + +

Represent an Authorization Request that includes a request JWT.

+

To construct such a request yourself, the easiest way is to initialize +an AuthorizationRequest +then sign it with +AuthorizationRequest.sign().

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
authorization_endpoint + str + +
+

the Authorization Endpoint uri

+
+ 		+ required +
client_id + str + +
+

the client_id

+
+ 		+ required +
request + Jwt | str + +
+

the request JWT

+
+ 		+ required +
expires_at + datetime | None + +
+

the expiration date for this request

+
+ 		+ None +
kwargs + Any + +
+

extra parameters to include in the request

+
+ 		+ {} +
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
745
+746
+747
+748
+749
+750
+751
+752
+753
+754
+755
+756
+757
+758
+759
+760
+761
+762
+763
+764
+765
+766
+767
+768
+769
+770
+771
+772
+773
+774
+775
+776
+777
+778
+779
+780
+781
+782
+783
+784
+785
+786
+787
+788
+789
+790
+791
+792
+793
+794
+795
+796
+797
+798
+799
+800
+801
+802
+803
+804
+805
+806
+807
+808
+809
+810
+811
+812
+813
@frozen(init=False, repr=False)
+class RequestParameterAuthorizationRequest:
+    """Represent an Authorization Request that includes a `request` JWT.
+
+    To construct such a request yourself, the easiest way is to initialize
+    an [`AuthorizationRequest`][requests_oauth2client.authorization_request.AuthorizationRequest]
+    then sign it with
+    [`AuthorizationRequest.sign()`][requests_oauth2client.authorization_request.AuthorizationRequest.sign].
+
+    Args:
+        authorization_endpoint: the Authorization Endpoint uri
+        client_id: the client_id
+        request: the request JWT
+        expires_at: the expiration date for this request
+        kwargs: extra parameters to include in the request
+
+    """
+
+    authorization_endpoint: str
+    client_id: str
+    request: Jwt
+    expires_at: datetime | None = None
+    kwargs: dict[str, Any] = Factory(dict)
+
+    @accepts_expires_in
+    def __init__(
+        self,
+        authorization_endpoint: str,
+        client_id: str,
+        request: Jwt | str,
+        expires_at: datetime | None = None,
+        **kwargs: Any,
+    ) -> None:
+        if isinstance(request, str):
+            request = Jwt(request)
+
+        self.__attrs_init__(
+            authorization_endpoint=authorization_endpoint,
+            client_id=client_id,
+            request=request,
+            expires_at=expires_at,
+            kwargs=kwargs,
+        )
+
+    @property
+    def furl(self) -> furl:
+        """Return the Authorization Request URI, as a `furl` instance."""
+        return furl(
+            self.authorization_endpoint,
+            args={"client_id": self.client_id, "request": str(self.request), **self.kwargs},
+        )
+
+    @property
+    def uri(self) -> str:
+        """Return the Authorization Request URI, as a `str`."""
+        return str(self.furl.url)
+
+    def __getattr__(self, item: str) -> Any:
+        """Allow attribute access to extra parameters."""
+        return self.kwargs[item]
+
+    def __repr__(self) -> str:
+        """Return the Authorization Request URI, as a `str`.
+
+        Returns:
+             the Authorization Request URI
+
+        """
+        return self.uri
+
+
+ + + +
+ + + + + + + +
+ + + +
+ furl: furl + + + property + + +
+ + +
+ +

Return the Authorization Request URI, as a furl instance.

+
+ +
+ +
+ + + +
+ uri: str + + + property + + +
+ + +
+ +

Return the Authorization Request URI, as a str.

+
+ +
+ + + + + +
+ +
+ +
+ +
+ + + +

+ RequestUriParameterAuthorizationRequest + + +

+ + +
+ + +

Represent an Authorization Request that includes a request_uri parameter.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
authorization_endpoint + str + +
+

the Authorization Endpoint uri

+
+ 		+ required +
client_id + str + +
+

the client_id

+
+ 		+ required +
request_uri + str + +
+

the request_uri

+
+ 		+ required +
expires_at + datetime | None + +
+

the expiration date for this request

+
+ 		+ None +
kwargs + Any + +
+

extra parameters to include in the request

+
+ 		+ {} +
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
816
+817
+818
+819
+820
+821
+822
+823
+824
+825
+826
+827
+828
+829
+830
+831
+832
+833
+834
+835
+836
+837
+838
+839
+840
+841
+842
+843
+844
+845
+846
+847
+848
+849
+850
+851
+852
+853
+854
+855
+856
+857
+858
+859
+860
+861
+862
+863
+864
+865
+866
+867
+868
+869
+870
+871
@frozen(init=False)
+class RequestUriParameterAuthorizationRequest:
+    """Represent an Authorization Request that includes a `request_uri` parameter.
+
+    Args:
+        authorization_endpoint: the Authorization Endpoint uri
+        client_id: the client_id
+        request_uri: the request_uri
+        expires_at: the expiration date for this request
+        kwargs: extra parameters to include in the request
+
+    """
+
+    authorization_endpoint: str
+    client_id: str
+    request_uri: str
+    expires_at: datetime | None = None
+    kwargs: dict[str, Any] = Factory(dict)
+
+    @accepts_expires_in
+    def __init__(
+        self,
+        authorization_endpoint: str,
+        client_id: str,
+        request_uri: str,
+        expires_at: datetime | None = None,
+        **kwargs: Any,
+    ) -> None:
+        self.__attrs_init__(
+            authorization_endpoint=authorization_endpoint,
+            client_id=client_id,
+            request_uri=request_uri,
+            expires_at=expires_at,
+            kwargs=kwargs,
+        )
+
+    @property
+    def furl(self) -> furl:
+        """Return the Authorization Request URI, as a `furl` instance."""
+        return furl(
+            self.authorization_endpoint,
+            args={"client_id": self.client_id, "request_uri": self.request_uri, **self.kwargs},
+        )
+
+    @property
+    def uri(self) -> str:
+        """Return the Authorization Request URI, as a `str`."""
+        return str(self.furl.url)
+
+    def __getattr__(self, item: str) -> Any:
+        """Allow attribute access to extra parameters."""
+        return self.kwargs[item]
+
+    def __repr__(self) -> str:
+        """Return the Authorization Request URI, as a `str`."""
+        return self.uri
+
+
+ + + +
+ + + + + + + +
+ + + +
+ furl: furl + + + property + + +
+ + +
+ +

Return the Authorization Request URI, as a furl instance.

+
+ +
+ +
+ + + +
+ uri: str + + + property + + +
+ + +
+ +

Return the Authorization Request URI, as a str.

+
+ +
+ + + + + +
+ +
+ +
+ +
+ + + +

+ AuthorizationRequestSerializer + + +

+ + +
+ + +

(De)Serializer for AuthorizationRequest instances.

+

You might need to store pending authorization requests in session, either server-side or client- +side. This class is here to help you do that.

+ +
+ Source code in requests_oauth2client/authorization_request.py + 
874
+875
+876
+877
+878
+879
+880
+881
+882
+883
+884
+885
+886
+887
+888
+889
+890
+891
+892
+893
+894
+895
+896
+897
+898
+899
+900
+901
+902
+903
+904
+905
+906
+907
+908
+909
+910
+911
+912
+913
+914
+915
+916
+917
+918
+919
+920
+921
+922
+923
+924
+925
+926
+927
+928
+929
+930
+931
+932
+933
+934
+935
+936
+937
+938
+939
+940
+941
+942
+943
+944
+945
+946
+947
+948
+949
+950
+951
class AuthorizationRequestSerializer:
+    """(De)Serializer for `AuthorizationRequest` instances.
+
+    You might need to store pending authorization requests in session, either server-side or client-
+    side. This class is here to help you do that.
+
+    """
+
+    def __init__(
+        self,
+        dumper: Callable[[AuthorizationRequest], str] | None = None,
+        loader: Callable[[str], AuthorizationRequest] | None = None,
+    ) -> None:
+        self.dumper = dumper or self.default_dumper
+        self.loader = loader or self.default_loader
+
+    @staticmethod
+    def default_dumper(azr: AuthorizationRequest) -> str:
+        """Provide a default dumper implementation.
+
+        Serialize an AuthorizationRequest as JSON, then compress with deflate, then encodes as
+        base64url.
+
+        Args:
+            azr: the `AuthorizationRequest` to serialize
+
+        Returns:
+            the serialized value
+
+        """
+        d = asdict(azr)
+        d.update(**d.pop("kwargs", {}))
+        d.pop("code_challenge")
+        return BinaPy.serialize_to("json", d).to("deflate").to("b64u").ascii()
+
+    @staticmethod
+    def default_loader(
+        serialized: str,
+        azr_class: type[AuthorizationRequest] = AuthorizationRequest,
+    ) -> AuthorizationRequest:
+        """Provide a default deserializer implementation.
+
+        This does the opposite operations than `default_dumper`.
+
+        Args:
+            serialized: the serialized AuthorizationRequest
+            azr_class: the class to deserialize the Authorization Request to
+
+        Returns:
+            an AuthorizationRequest
+
+        """
+        args = BinaPy(serialized).decode_from("b64u").decode_from("deflate").parse_from("json")
+        return azr_class(**args)
+
+    def dumps(self, azr: AuthorizationRequest) -> str:
+        """Serialize and compress a given AuthorizationRequest for easier storage.
+
+        Args:
+            azr: an AuthorizationRequest to serialize
+
+        Returns:
+            the serialized AuthorizationRequest, as a str
+
+        """
+        return self.dumper(azr)
+
+    def loads(self, serialized: str) -> AuthorizationRequest:
+        """Deserialize a serialized AuthorizationRequest.
+
+        Args:
+            serialized: the serialized AuthorizationRequest
+
+        Returns:
+            the deserialized AuthorizationRequest
+
+        """
+        return self.loader(serialized)
+
+
+ + + +
+ + + + + + + + + +
+ + +
+ default_dumper(azr) + + + staticmethod + + +
+ + +
+ +

Provide a default dumper implementation.

+

Serialize an AuthorizationRequest as JSON, then compress with deflate, then encodes as +base64url.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
azr + AuthorizationRequest + +
+

the AuthorizationRequest to serialize

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the serialized value

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
890
+891
+892
+893
+894
+895
+896
+897
+898
+899
+900
+901
+902
+903
+904
+905
+906
+907
@staticmethod
+def default_dumper(azr: AuthorizationRequest) -> str:
+    """Provide a default dumper implementation.
+
+    Serialize an AuthorizationRequest as JSON, then compress with deflate, then encodes as
+    base64url.
+
+    Args:
+        azr: the `AuthorizationRequest` to serialize
+
+    Returns:
+        the serialized value
+
+    """
+    d = asdict(azr)
+    d.update(**d.pop("kwargs", {}))
+    d.pop("code_challenge")
+    return BinaPy.serialize_to("json", d).to("deflate").to("b64u").ascii()
+
+
+
+ +
+ +
+ + +
+ default_loader(serialized, azr_class=AuthorizationRequest) + + + staticmethod + + +
+ + +
+ +

Provide a default deserializer implementation.

+

This does the opposite operations than default_dumper.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
serialized + str + +
+

the serialized AuthorizationRequest

+
+ 		+ required +
azr_class + type[AuthorizationRequest] + +
+

the class to deserialize the Authorization Request to

+
+ 		+ AuthorizationRequest +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ AuthorizationRequest + +
+

an AuthorizationRequest

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
909
+910
+911
+912
+913
+914
+915
+916
+917
+918
+919
+920
+921
+922
+923
+924
+925
+926
+927
@staticmethod
+def default_loader(
+    serialized: str,
+    azr_class: type[AuthorizationRequest] = AuthorizationRequest,
+) -> AuthorizationRequest:
+    """Provide a default deserializer implementation.
+
+    This does the opposite operations than `default_dumper`.
+
+    Args:
+        serialized: the serialized AuthorizationRequest
+        azr_class: the class to deserialize the Authorization Request to
+
+    Returns:
+        an AuthorizationRequest
+
+    """
+    args = BinaPy(serialized).decode_from("b64u").decode_from("deflate").parse_from("json")
+    return azr_class(**args)
+
+
+
+ +
+ +
+ + +
+ dumps(azr) + +
+ + +
+ +

Serialize and compress a given AuthorizationRequest for easier storage.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
azr + AuthorizationRequest + +
+

an AuthorizationRequest to serialize

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the serialized AuthorizationRequest, as a str

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
929
+930
+931
+932
+933
+934
+935
+936
+937
+938
+939
def dumps(self, azr: AuthorizationRequest) -> str:
+    """Serialize and compress a given AuthorizationRequest for easier storage.
+
+    Args:
+        azr: an AuthorizationRequest to serialize
+
+    Returns:
+        the serialized AuthorizationRequest, as a str
+
+    """
+    return self.dumper(azr)
+
+
+
+ +
+ +
+ + +
+ loads(serialized) + +
+ + +
+ +

Deserialize a serialized AuthorizationRequest.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
serialized + str + +
+

the serialized AuthorizationRequest

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ AuthorizationRequest + +
+

the deserialized AuthorizationRequest

+
+
+ +
+ Source code in requests_oauth2client/authorization_request.py + 
941
+942
+943
+944
+945
+946
+947
+948
+949
+950
+951
def loads(self, serialized: str) -> AuthorizationRequest:
+    """Deserialize a serialized AuthorizationRequest.
+
+    Args:
+        serialized: the serialized AuthorizationRequest
+
+    Returns:
+        the deserialized AuthorizationRequest
+
+    """
+    return self.loader(serialized)
+
+
+
+ +
+ + + +
+ +
+ +
+ + + + +
+ +
+ +
+ +
+ + + +

+ backchannel_authentication + + +

+ +
+ +

Implementation of CIBA.

+

CIBA stands for Client Initiated BackChannel Authentication and is standardised by the OpenID +Fundation. +https://openid.net/specs/openid-client-initiated-backchannel- +authentication-core-1_0.html.

+ + + +
+ + + + + + + + +
+ + + +

+ BackChannelAuthenticationResponse + + +

+ + +
+ + +

Represent a BackChannel Authentication Response.

+

This contains all the parameters that are returned by the AS as a result of a BackChannel +Authentication Request, such as auth_req_id (required), and the optional expires_at, +interval, and/or any custom parameters.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
auth_req_id + str + +
+

the auth_req_id as returned by the AS.

+
+ 		+ required +
expires_at + datetime | None + +
+

the date when the auth_req_id expires. +Note that this request also accepts an expires_in parameter, in seconds.

+
+ 		+ None +
interval + int | None + +
+

the Token Endpoint pooling interval, in seconds, as returned by the AS.

+
+ 		+ 20 +
**kwargs + Any + +
+

any additional custom parameters as returned by the AS.

+
+ 		+ {} +
+ +
+ Source code in requests_oauth2client/backchannel_authentication.py + 
26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
+69
+70
+71
+72
+73
+74
+75
+76
+77
+78
+79
+80
+81
+82
+83
+84
+85
+86
+87
+88
+89
+90
+91
+92
+93
+94
class BackChannelAuthenticationResponse:
+    """Represent a BackChannel Authentication Response.
+
+    This contains all the parameters that are returned by the AS as a result of a BackChannel
+    Authentication Request, such as `auth_req_id` (required), and the optional `expires_at`,
+    `interval`, and/or any custom parameters.
+
+    Args:
+        auth_req_id: the `auth_req_id` as returned by the AS.
+        expires_at: the date when the `auth_req_id` expires.
+            Note that this request also accepts an `expires_in` parameter, in seconds.
+        interval: the Token Endpoint pooling interval, in seconds, as returned by the AS.
+        **kwargs: any additional custom parameters as returned by the AS.
+
+    """
+
+    @accepts_expires_in
+    def __init__(
+        self,
+        auth_req_id: str,
+        expires_at: datetime | None = None,
+        interval: int | None = 20,
+        **kwargs: Any,
+    ) -> None:
+        self.auth_req_id = auth_req_id
+        self.expires_at = expires_at
+        self.interval = interval
+        self.other = kwargs
+
+    def is_expired(self, leeway: int = 0) -> bool | None:
+        """Return `True` if the `auth_req_id` within this response is expired.
+
+        Expiration is evaluated at the time of the call. If there is no "expires_at" hint (which is
+        derived from the `expires_in` hint returned by the AS BackChannel Authentication endpoint),
+        this will return `None`.
+
+        Returns:
+            `True` if the auth_req_id is expired, `False` if it is still valid, `None` if there is
+            no `expires_in` hint.
+
+        """
+        if self.expires_at:
+            return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
+        return None
+
+    @property
+    def expires_in(self) -> int | None:
+        """Number of seconds until expiration."""
+        if self.expires_at:
+            return ceil((self.expires_at - datetime.now(tz=timezone.utc)).total_seconds())
+        return None
+
+    def __getattr__(self, key: str) -> Any:
+        """Return attributes from this `BackChannelAuthenticationResponse`.
+
+        Allows accessing response parameters with `token_response.expires_in` or
+        `token_response.any_custom_attribute`.
+
+        Args:
+            key: a key
+
+        Returns:
+            the associated value in this token response
+
+        Raises:
+            AttributeError: if the attribute is not present in the response
+
+        """
+        return self.other.get(key) or super().__getattribute__(key)
+
+
+ + + +
+ + + + + + + +
+ + + +
+ expires_in: int | None + + + property + + +
+ + +
+ +

Number of seconds until expiration.

+
+ +
+ + + +
+ + +
+ is_expired(leeway=0) + +
+ + +
+ +

Return True if the auth_req_id within this response is expired.

+

Expiration is evaluated at the time of the call. If there is no "expires_at" hint (which is +derived from the expires_in hint returned by the AS BackChannel Authentication endpoint), +this will return None.

+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ bool | None + +
+

True if the auth_req_id is expired, False if it is still valid, None if there is

+
+
+ bool | None + +
+

no expires_in hint.

+
+
+ +
+ Source code in requests_oauth2client/backchannel_authentication.py + 
55
+56
+57
+58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
+69
def is_expired(self, leeway: int = 0) -> bool | None:
+    """Return `True` if the `auth_req_id` within this response is expired.
+
+    Expiration is evaluated at the time of the call. If there is no "expires_at" hint (which is
+    derived from the `expires_in` hint returned by the AS BackChannel Authentication endpoint),
+    this will return `None`.
+
+    Returns:
+        `True` if the auth_req_id is expired, `False` if it is still valid, `None` if there is
+        no `expires_in` hint.
+
+    """
+    if self.expires_at:
+        return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
+    return None
+
+
+
+ +
+ + + +
+ +
+ +
+ +
+ + + +

+ BackChannelAuthenticationPoolingJob + + +

+ + +
+

+ Bases: BaseTokenEndpointPoolingJob

+ + +

A pooling job for the BackChannel Authentication flow.

+

This will poll the Token Endpoint until the user finishes with its authentication.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client + OAuth2Client + +
+

an OAuth2Client that will be used to pool the token endpoint.

+
+ 		+ required +
auth_req_id + str | BackChannelAuthenticationResponse + +
+

an auth_req_id as str or a BackChannelAuthenticationResponse.

+
+ 		+ required +
interval + int | None + +
+

The pooling interval, in seconds, to use. This overrides +the one in auth_req_id if it is a BackChannelAuthenticationResponse. +Defaults to 5 seconds.

+
+ 		+ None +
slow_down_interval + int + +
+

Number of seconds to add to the pooling interval when the AS returns +a slow down request.

+
+ 		+ 5 +
requests_kwargs + dict[str, Any] | None + +
+

Additional parameters for the underlying calls to requests.request.

+
+ 		+ None +
**token_kwargs + Any + +
+

Additional parameters for the token request.

+
+ 		+ {} +
+ + +
+ Example + 
1
+2
+3
+4
+5
+6
+7
+8
+9
client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+pool_job = BackChannelAuthenticationPoolingJob(
+    client=client,
+    auth_req_id="my_auth_req_id",
+)
+
+token = None
+while token is None:
+    token = pool_job()
+
+
+
+ Source code in requests_oauth2client/backchannel_authentication.py + 
 97
+ 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
+126
+127
+128
+129
+130
+131
+132
+133
+134
+135
+136
+137
+138
+139
+140
+141
+142
+143
+144
+145
+146
+147
+148
+149
+150
+151
+152
+153
+154
+155
+156
+157
+158
+159
+160
+161
+162
+163
@define(init=False)
+class BackChannelAuthenticationPoolingJob(BaseTokenEndpointPoolingJob):
+    """A pooling job for the BackChannel Authentication flow.
+
+    This will poll the Token Endpoint until the user finishes with its authentication.
+
+    Args:
+        client: an OAuth2Client that will be used to pool the token endpoint.
+        auth_req_id: an `auth_req_id` as `str` or a `BackChannelAuthenticationResponse`.
+        interval: The pooling interval, in seconds, to use. This overrides
+            the one in `auth_req_id` if it is a `BackChannelAuthenticationResponse`.
+            Defaults to 5 seconds.
+        slow_down_interval: Number of seconds to add to the pooling interval when the AS returns
+            a slow down request.
+        requests_kwargs: Additional parameters for the underlying calls to [requests.request][].
+        **token_kwargs: Additional parameters for the token request.
+
+    Example:
+        ```python
+        client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+        pool_job = BackChannelAuthenticationPoolingJob(
+            client=client,
+            auth_req_id="my_auth_req_id",
+        )
+
+        token = None
+        while token is None:
+            token = pool_job()
+        ```
+
+    """
+
+    auth_req_id: str
+
+    def __init__(
+        self,
+        client: OAuth2Client,
+        auth_req_id: str | BackChannelAuthenticationResponse,
+        *,
+        interval: int | None = None,
+        slow_down_interval: int = 5,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> None:
+        if isinstance(auth_req_id, BackChannelAuthenticationResponse):
+            interval = interval or auth_req_id.interval
+            auth_req_id = auth_req_id.auth_req_id
+
+        self.__attrs_init__(
+            client=client,
+            auth_req_id=auth_req_id,
+            interval=interval or 5,
+            slow_down_interval=slow_down_interval,
+            requests_kwargs=requests_kwargs or {},
+            token_kwargs=token_kwargs,
+        )
+
+    def token_request(self) -> BearerToken:
+        """Implement the CIBA token request.
+
+        This actually calls [OAuth2Client.ciba(auth_req_id)] on `client`.
+
+        Returns:
+            a [BearerToken][requests_oauth2client.tokens.BearerToken]
+
+        """
+        return self.client.ciba(self.auth_req_id, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
+
+
+ + + +
+ + + + + + + + + +
+ + +
+ token_request() + +
+ + +
+ +

Implement the CIBA token request.

+

This actually calls [OAuth2Client.ciba(auth_req_id)] on client.

+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+ +
+ Source code in requests_oauth2client/backchannel_authentication.py + 
154
+155
+156
+157
+158
+159
+160
+161
+162
+163
def token_request(self) -> BearerToken:
+    """Implement the CIBA token request.
+
+    This actually calls [OAuth2Client.ciba(auth_req_id)] on `client`.
+
+    Returns:
+        a [BearerToken][requests_oauth2client.tokens.BearerToken]
+
+    """
+    return self.client.ciba(self.auth_req_id, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
+
+
+
+ +
+ + + +
+ +
+ +
+ + + + +
+ +
+ +
+ +
+ + + +

+ client + + +

+ +
+ +

This module contains the OAuth2Client class.

+ + + +
+ + + + + + + + +
+ + + +

+ InvalidParam + + +

+ + +
+

+ Bases: ValueError

+ + +

Base class for invalid parameters errors.

+ +
+ Source code in requests_oauth2client/client.py + 
60
+61
class InvalidParam(ValueError):
+    """Base class for invalid parameters errors."""
+
+
+ +
+ +
+ +
+ + + +

+ MissingIdTokenEncryptedResponseAlgParam + + +

+ + +
+

+ Bases: InvalidParam

+ + +

Raised when an ID Token encryption is required but not provided.

+ +
+ Source code in requests_oauth2client/client.py + 
64
+65
+66
+67
+68
+69
+70
+71
+72
class MissingIdTokenEncryptedResponseAlgParam(InvalidParam):
+    """Raised when an ID Token encryption is required but not provided."""
+
+    def __init__(self) -> None:
+        super().__init__("""\
+An ID Token decryption key has been provided but no decryption algorithm is defined.
+You can either pass an `id_token_encrypted_response_alg` parameter with the alg identifier,
+or include an `alg` attribute in the decryption key, if it is in Jwk format.
+""")
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ InvalidEndpointUri + + +

+ + +
+

+ Bases: InvalidParam

+ + +

Raised when an invalid endpoint uri is provided.

+ +
+ Source code in requests_oauth2client/client.py + 
75
+76
+77
+78
+79
+80
+81
class InvalidEndpointUri(InvalidParam):
+    """Raised when an invalid endpoint uri is provided."""
+
+    def __init__(self, endpoint: str, uri: str, exc: InvalidUri) -> None:
+        super().__init__(f"Invalid endpoint uri '{uri}' for '{endpoint}': {exc}")
+        self.endpoint = endpoint
+        self.uri = uri
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ InvalidIssuer + + +

+ + +
+

+ Bases: InvalidEndpointUri

+ + +

Raised when an invalid issuer parameter is provided.

+ +
+ Source code in requests_oauth2client/client.py + 
84
+85
class InvalidIssuer(InvalidEndpointUri):
+    """Raised when an invalid issuer parameter is provided."""
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ InvalidScopeParam + + +

+ + +
+

+ Bases: InvalidParam

+ + +

Raised when an invalid scope parameter is provided.

+ +
+ Source code in requests_oauth2client/client.py + 
88
+89
+90
+91
+92
+93
+94
+95
+96
+97
class InvalidScopeParam(InvalidParam):
+    """Raised when an invalid scope parameter is provided."""
+
+    def __init__(self, scope: object) -> None:
+        super().__init__("""\
+Unsupported scope value. It must be one of:
+- a space separated `str` of scopes names
+- an iterable of scope names as `str`
+""")
+        self.scope = scope
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ MissingRefreshToken + + +

+ + +
+

+ Bases: ValueError

+ + +

Raised when a refresh token is required but not present.

+ +
+ Source code in requests_oauth2client/client.py + 
100
+101
+102
+103
+104
+105
class MissingRefreshToken(ValueError):
+    """Raised when a refresh token is required but not present."""
+
+    def __init__(self, token: TokenResponse) -> None:
+        super().__init__("A refresh_token is required but is not present in this Access Token.")
+        self.token = token
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ MissingDeviceCode + + +

+ + +
+

+ Bases: ValueError

+ + +

Raised when a device_code is required but not provided.

+ +
+ Source code in requests_oauth2client/client.py + 
108
+109
+110
+111
+112
+113
class MissingDeviceCode(ValueError):
+    """Raised when a device_code is required but not provided."""
+
+    def __init__(self, dar: DeviceAuthorizationResponse) -> None:
+        super().__init__("A device_code is missing in this DeviceAuthorizationResponse")
+        self.device_authorization_response = dar
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ MissingAuthRequestId + + +

+ + +
+

+ Bases: ValueError

+ + +

Raised when an 'auth_req_id' is missing in a BackChannelAuthenticationResponse.

+ +
+ Source code in requests_oauth2client/client.py + 
116
+117
+118
+119
+120
+121
class MissingAuthRequestId(ValueError):
+    """Raised when an 'auth_req_id' is missing in a BackChannelAuthenticationResponse."""
+
+    def __init__(self, bcar: BackChannelAuthenticationResponse) -> None:
+        super().__init__("An 'auth_req_id' is required but is missing from this BackChannelAuthenticationResponse.")
+        self.backchannel_authentication_response = bcar
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ UnknownTokenType + + +

+ + +
+

+ Bases: InvalidParam, TypeError

+ + +

Raised when the type of a token cannot be determined automatically.

+ +
+ Source code in requests_oauth2client/client.py + 
124
+125
+126
+127
+128
+129
+130
class UnknownTokenType(InvalidParam, TypeError):
+    """Raised when the type of a token cannot be determined automatically."""
+
+    def __init__(self, message: str, token: object, token_type: str | None) -> None:
+        super().__init__(f"Unable to determine the type of token provided: {message}")
+        self.token = token
+        self.token_type = token_type
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ UnknownSubjectTokenType + + +

+ + +
+

+ Bases: UnknownTokenType

+ + +

Raised when the type of subject_token cannot be determined automatically.

+ +
+ Source code in requests_oauth2client/client.py + 
133
+134
+135
+136
+137
class UnknownSubjectTokenType(UnknownTokenType):
+    """Raised when the type of subject_token cannot be determined automatically."""
+
+    def __init__(self, subject_token: object, subject_token_type: str | None) -> None:
+        super().__init__("subject_token", subject_token, subject_token_type)
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ UnknownActorTokenType + + +

+ + +
+

+ Bases: UnknownTokenType

+ + +

Raised when the type of actor_token cannot be determined automatically.

+ +
+ Source code in requests_oauth2client/client.py + 
140
+141
+142
+143
+144
class UnknownActorTokenType(UnknownTokenType):
+    """Raised when the type of actor_token cannot be determined automatically."""
+
+    def __init__(self, actor_token: object, actor_token_type: str | None) -> None:
+        super().__init__("actor_token", token=actor_token, token_type=actor_token_type)
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ InvalidBackchannelAuthenticationRequestHintParam + + +

+ + +
+

+ Bases: InvalidParam

+ + +

Raised when an invalid hint is provided in a backchannel authentication request.

+ +
+ Source code in requests_oauth2client/client.py + 
147
+148
class InvalidBackchannelAuthenticationRequestHintParam(InvalidParam):
+    """Raised when an invalid hint is provided in a backchannel authentication request."""
+
+
+ +
+ +
+ +
+ + + +

+ InvalidAcrValuesParam + + +

+ + +
+

+ Bases: InvalidParam

+ + +

Raised when an invalid 'acr_values' parameter is provided.

+ +
+ Source code in requests_oauth2client/client.py + 
151
+152
+153
+154
+155
+156
class InvalidAcrValuesParam(InvalidParam):
+    """Raised when an invalid 'acr_values' parameter is provided."""
+
+    def __init__(self, acr_values: object) -> None:
+        super().__init__(f"Invalid 'acr_values' parameter: {acr_values}")
+        self.acr_values = acr_values
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ InvalidDiscoveryDocument + + +

+ + +
+

+ Bases: ValueError

+ + +

Raised when handling an invalid Discovery Document.

+ +
+ Source code in requests_oauth2client/client.py + 
159
+160
+161
+162
+163
+164
class InvalidDiscoveryDocument(ValueError):
+    """Raised when handling an invalid Discovery Document."""
+
+    def __init__(self, message: str, discovery_document: dict[str, Any]) -> None:
+        super().__init__(f"Invalid discovery document: {message}")
+        self.discovery_document = discovery_document
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ Endpoints + + +

+ + +
+

+ Bases: str, Enum

+ + +

All standardised OAuth 2.0 and extensions endpoints.

+

If an endpoint is not mentioned here, then its usage is not supported by OAuth2Client.

+ +
+ Source code in requests_oauth2client/client.py + 
167
+168
+169
+170
+171
+172
+173
+174
+175
+176
+177
+178
+179
+180
+181
+182
class Endpoints(str, Enum):
+    """All standardised OAuth 2.0 and extensions endpoints.
+
+    If an endpoint is not mentioned here, then its usage is not supported by OAuth2Client.
+
+    """
+
+    TOKEN = "token_endpoint"
+    AUTHORIZATION = "authorization_endpoint"
+    BACKCHANNEL_AUTHENTICATION = "backchannel_authentication_endpoint"
+    DEVICE_AUTHORIZATION = "device_authorization_endpoint"
+    INSTROSPECTION = "introspection_endpoint"
+    REVOCATION = "revocation_endpoint"
+    PUSHED_AUTHORIZATION_REQUEST = "pushed_authorization_request_endpoint"
+    JWKS = "jwks_uri"
+    USER_INFO = "userinfo_endpoint"
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ MissingEndpointUri + + +

+ + +
+

+ Bases: AttributeError

+ + +

Raised when a required endpoint uri is not known.

+ +
+ Source code in requests_oauth2client/client.py + 
185
+186
+187
+188
+189
class MissingEndpointUri(AttributeError):
+    """Raised when a required endpoint uri is not known."""
+
+    def __init__(self, endpoint: str) -> None:
+        super().__init__(f"No '{endpoint}' defined for this client.")
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ GrantTypes + + +

+ + +
+

+ Bases: str, Enum

+ + +

An enum of standardized grant_type values.

+ +
+ Source code in requests_oauth2client/client.py + 
192
+193
+194
+195
+196
+197
+198
+199
+200
+201
+202
class GrantTypes(str, Enum):
+    """An enum of standardized `grant_type` values."""
+
+    CLIENT_CREDENTIALS = "client_credentials"
+    AUTHORIZATION_CODE = "authorization_code"
+    REFRESH_TOKEN = "refresh_token"
+    RESOURCE_OWNER_PASSWORD = "password"
+    TOKEN_EXCHANGE = "urn:ietf:params:oauth:grant-type:token-exchange"
+    JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer"
+    CLIENT_INITIATED_BACKCHANNEL_AUTHENTICATION = "urn:openid:params:grant-type:ciba"
+    DEVICE_CODE = "urn:ietf:params:oauth:grant-type:device_code"
+
+
+ + + +
+ + + + + + + + + + + +
+ +
+ +
+ +
+ + + +

+ OAuth2Client + + +

+ + +
+ + +

An OAuth 2.x Client, that can send requests to an OAuth 2.x Authorization Server.

+

OAuth2Client is able to obtain tokens from the Token Endpoint using any of the standardised +Grant Types, and to communicate with the various backend endpoints like the Revocation, +Introspection, and UserInfo Endpoint.

+

To init an OAuth2Client, you only need the url to the Token Endpoint and the Credentials +(a client_id and one of a secret or private_key) that will be used to authenticate to that endpoint. +Other endpoint urls, such as the Authorization Endpoint, Revocation Endpoint, etc. can be passed as +parameter as well if you intend to use them.

+

This class is not intended to help with the end-user authentication or any request that goes in +a browser. For authentication requests, see +AuthorizationRequest. You +may use the method authorization_request() to generate AuthorizationRequests with the +preconfigured authorization_endpoint, client_id and `redirect_uri' from this client.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
token_endpoint + str + +
+

the Token Endpoint URI where this client will get access tokens

+
+ 		+ required +
auth + AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None + +
+

the authentication handler to use for client authentication on the token endpoint. +Can be:

+ +
+ 		+ None +
client_id + str | None + +
+

client ID (use either this or auth)

+
+ 		+ None +
client_secret + str | None + +
+

client secret (use either this or auth)

+
+ 		+ None +
private_key + Jwk | dict[str, Any] | None + +
+

private_key to use for client authentication (use either this or auth)

+
+ 		+ None +
revocation_endpoint + str | None + +
+

the Revocation Endpoint URI to use for revoking tokens

+
+ 		+ None +
introspection_endpoint + str | None + +
+

the Introspection Endpoint URI to use to get info about tokens

+
+ 		+ None +
userinfo_endpoint + str | None + +
+

the Userinfo Endpoint URI to use to get information about the user

+
+ 		+ None +
authorization_endpoint + str | None + +
+

the Authorization Endpoint URI, used for initializing Authorization Requests

+
+ 		+ None +
redirect_uri + str | None + +
+

the redirect_uri for this client

+
+ 		+ None +
backchannel_authentication_endpoint + str | None + +
+

the BackChannel Authentication URI

+
+ 		+ None +
device_authorization_endpoint + str | None + +
+

the Device Authorization Endpoint URI to use to authorize devices

+
+ 		+ None +
jwks_uri + str | None + +
+

the JWKS URI to use to obtain the AS public keys

+
+ 		+ None +
code_challenge_method + str + +
+

challenge method to use for PKCE (should always be 'S256')

+
+ 		+ S256 +
session + Session | None + +
+

a requests Session to use when sending HTTP requests. +Useful if some extra parameters such as proxy or client certificate must be used +to connect to the AS.

+
+ 		+ None +
testing + bool + +
+

if True, don't verify the validity of the endpoint urls that are passed as parameter.

+
+ 		+ False +
**extra_metadata + Any + +
+

additional metadata for this client, unused by this class, but may be +used by subclasses. Those will be accessible with the extra_metadata attribute.

+
+ 		+ {} +
+ + +
+ Example + 
 1
+ 2
+ 3
+ 4
+ 5
+ 6
+ 7
+ 8
+ 9
+10
+11
client = OAuth2Client(
+    token_endpoint="https://my.as.local/token",
+    revocation_endpoint="https://my.as.local/revoke",
+    client_id="client_id",
+    client_secret="client_secret",
+)
+
+# once initialized, a client can send requests to its configured endpoints
+cc_token = client.client_credentials(scope="my_scope")
+ac_token = client.authorization_code(code="my_code")
+client.revoke_access_token(cc_token)
+
+
+ +

Raises:

+ + + + + + + + + + + + + + + + + + + + + + + + + +
TypeDescription
+ MissingIDTokenEncryptedResponseAlgParam + +
+

if an id_token_decryption_key is provided +but no decryption alg is provided, either:

+
    +
  • using id_token_encrypted_response_alg,
    • +
  • or in the alg parameter of the Jwk key
    • +
+
+
+ MissingIssuerParam + +
+

if authorization_response_iss_parameter_supported is set to True +but the issuer is not provided.

+
+
+ InvalidEndpointUri + +
+

if a provided endpoint uri is not considered valid. For the rare cases +where those checks must be disabled, you can use testing=True.

+
+
+ InvalidIssuer + +
+

if the issuer value is not considered valid.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
 205
+ 206
+ 207
+ 208
+ 209
+ 210
+ 211
+ 212
+ 213
+ 214
+ 215
+ 216
+ 217
+ 218
+ 219
+ 220
+ 221
+ 222
+ 223
+ 224
+ 225
+ 226
+ 227
+ 228
+ 229
+ 230
+ 231
+ 232
+ 233
+ 234
+ 235
+ 236
+ 237
+ 238
+ 239
+ 240
+ 241
+ 242
+ 243
+ 244
+ 245
+ 246
+ 247
+ 248
+ 249
+ 250
+ 251
+ 252
+ 253
+ 254
+ 255
+ 256
+ 257
+ 258
+ 259
+ 260
+ 261
+ 262
+ 263
+ 264
+ 265
+ 266
+ 267
+ 268
+ 269
+ 270
+ 271
+ 272
+ 273
+ 274
+ 275
+ 276
+ 277
+ 278
+ 279
+ 280
+ 281
+ 282
+ 283
+ 284
+ 285
+ 286
+ 287
+ 288
+ 289
+ 290
+ 291
+ 292
+ 293
+ 294
+ 295
+ 296
+ 297
+ 298
+ 299
+ 300
+ 301
+ 302
+ 303
+ 304
+ 305
+ 306
+ 307
+ 308
+ 309
+ 310
+ 311
+ 312
+ 313
+ 314
+ 315
+ 316
+ 317
+ 318
+ 319
+ 320
+ 321
+ 322
+ 323
+ 324
+ 325
+ 326
+ 327
+ 328
+ 329
+ 330
+ 331
+ 332
+ 333
+ 334
+ 335
+ 336
+ 337
+ 338
+ 339
+ 340
+ 341
+ 342
+ 343
+ 344
+ 345
+ 346
+ 347
+ 348
+ 349
+ 350
+ 351
+ 352
+ 353
+ 354
+ 355
+ 356
+ 357
+ 358
+ 359
+ 360
+ 361
+ 362
+ 363
+ 364
+ 365
+ 366
+ 367
+ 368
+ 369
+ 370
+ 371
+ 372
+ 373
+ 374
+ 375
+ 376
+ 377
+ 378
+ 379
+ 380
+ 381
+ 382
+ 383
+ 384
+ 385
+ 386
+ 387
+ 388
+ 389
+ 390
+ 391
+ 392
+ 393
+ 394
+ 395
+ 396
+ 397
+ 398
+ 399
+ 400
+ 401
+ 402
+ 403
+ 404
+ 405
+ 406
+ 407
+ 408
+ 409
+ 410
+ 411
+ 412
+ 413
+ 414
+ 415
+ 416
+ 417
+ 418
+ 419
+ 420
+ 421
+ 422
+ 423
+ 424
+ 425
+ 426
+ 427
+ 428
+ 429
+ 430
+ 431
+ 432
+ 433
+ 434
+ 435
+ 436
+ 437
+ 438
+ 439
+ 440
+ 441
+ 442
+ 443
+ 444
+ 445
+ 446
+ 447
+ 448
+ 449
+ 450
+ 451
+ 452
+ 453
+ 454
+ 455
+ 456
+ 457
+ 458
+ 459
+ 460
+ 461
+ 462
+ 463
+ 464
+ 465
+ 466
+ 467
+ 468
+ 469
+ 470
+ 471
+ 472
+ 473
+ 474
+ 475
+ 476
+ 477
+ 478
+ 479
+ 480
+ 481
+ 482
+ 483
+ 484
+ 485
+ 486
+ 487
+ 488
+ 489
+ 490
+ 491
+ 492
+ 493
+ 494
+ 495
+ 496
+ 497
+ 498
+ 499
+ 500
+ 501
+ 502
+ 503
+ 504
+ 505
+ 506
+ 507
+ 508
+ 509
+ 510
+ 511
+ 512
+ 513
+ 514
+ 515
+ 516
+ 517
+ 518
+ 519
+ 520
+ 521
+ 522
+ 523
+ 524
+ 525
+ 526
+ 527
+ 528
+ 529
+ 530
+ 531
+ 532
+ 533
+ 534
+ 535
+ 536
+ 537
+ 538
+ 539
+ 540
+ 541
+ 542
+ 543
+ 544
+ 545
+ 546
+ 547
+ 548
+ 549
+ 550
+ 551
+ 552
+ 553
+ 554
+ 555
+ 556
+ 557
+ 558
+ 559
+ 560
+ 561
+ 562
+ 563
+ 564
+ 565
+ 566
+ 567
+ 568
+ 569
+ 570
+ 571
+ 572
+ 573
+ 574
+ 575
+ 576
+ 577
+ 578
+ 579
+ 580
+ 581
+ 582
+ 583
+ 584
+ 585
+ 586
+ 587
+ 588
+ 589
+ 590
+ 591
+ 592
+ 593
+ 594
+ 595
+ 596
+ 597
+ 598
+ 599
+ 600
+ 601
+ 602
+ 603
+ 604
+ 605
+ 606
+ 607
+ 608
+ 609
+ 610
+ 611
+ 612
+ 613
+ 614
+ 615
+ 616
+ 617
+ 618
+ 619
+ 620
+ 621
+ 622
+ 623
+ 624
+ 625
+ 626
+ 627
+ 628
+ 629
+ 630
+ 631
+ 632
+ 633
+ 634
+ 635
+ 636
+ 637
+ 638
+ 639
+ 640
+ 641
+ 642
+ 643
+ 644
+ 645
+ 646
+ 647
+ 648
+ 649
+ 650
+ 651
+ 652
+ 653
+ 654
+ 655
+ 656
+ 657
+ 658
+ 659
+ 660
+ 661
+ 662
+ 663
+ 664
+ 665
+ 666
+ 667
+ 668
+ 669
+ 670
+ 671
+ 672
+ 673
+ 674
+ 675
+ 676
+ 677
+ 678
+ 679
+ 680
+ 681
+ 682
+ 683
+ 684
+ 685
+ 686
+ 687
+ 688
+ 689
+ 690
+ 691
+ 692
+ 693
+ 694
+ 695
+ 696
+ 697
+ 698
+ 699
+ 700
+ 701
+ 702
+ 703
+ 704
+ 705
+ 706
+ 707
+ 708
+ 709
+ 710
+ 711
+ 712
+ 713
+ 714
+ 715
+ 716
+ 717
+ 718
+ 719
+ 720
+ 721
+ 722
+ 723
+ 724
+ 725
+ 726
+ 727
+ 728
+ 729
+ 730
+ 731
+ 732
+ 733
+ 734
+ 735
+ 736
+ 737
+ 738
+ 739
+ 740
+ 741
+ 742
+ 743
+ 744
+ 745
+ 746
+ 747
+ 748
+ 749
+ 750
+ 751
+ 752
+ 753
+ 754
+ 755
+ 756
+ 757
+ 758
+ 759
+ 760
+ 761
+ 762
+ 763
+ 764
+ 765
+ 766
+ 767
+ 768
+ 769
+ 770
+ 771
+ 772
+ 773
+ 774
+ 775
+ 776
+ 777
+ 778
+ 779
+ 780
+ 781
+ 782
+ 783
+ 784
+ 785
+ 786
+ 787
+ 788
+ 789
+ 790
+ 791
+ 792
+ 793
+ 794
+ 795
+ 796
+ 797
+ 798
+ 799
+ 800
+ 801
+ 802
+ 803
+ 804
+ 805
+ 806
+ 807
+ 808
+ 809
+ 810
+ 811
+ 812
+ 813
+ 814
+ 815
+ 816
+ 817
+ 818
+ 819
+ 820
+ 821
+ 822
+ 823
+ 824
+ 825
+ 826
+ 827
+ 828
+ 829
+ 830
+ 831
+ 832
+ 833
+ 834
+ 835
+ 836
+ 837
+ 838
+ 839
+ 840
+ 841
+ 842
+ 843
+ 844
+ 845
+ 846
+ 847
+ 848
+ 849
+ 850
+ 851
+ 852
+ 853
+ 854
+ 855
+ 856
+ 857
+ 858
+ 859
+ 860
+ 861
+ 862
+ 863
+ 864
+ 865
+ 866
+ 867
+ 868
+ 869
+ 870
+ 871
+ 872
+ 873
+ 874
+ 875
+ 876
+ 877
+ 878
+ 879
+ 880
+ 881
+ 882
+ 883
+ 884
+ 885
+ 886
+ 887
+ 888
+ 889
+ 890
+ 891
+ 892
+ 893
+ 894
+ 895
+ 896
+ 897
+ 898
+ 899
+ 900
+ 901
+ 902
+ 903
+ 904
+ 905
+ 906
+ 907
+ 908
+ 909
+ 910
+ 911
+ 912
+ 913
+ 914
+ 915
+ 916
+ 917
+ 918
+ 919
+ 920
+ 921
+ 922
+ 923
+ 924
+ 925
+ 926
+ 927
+ 928
+ 929
+ 930
+ 931
+ 932
+ 933
+ 934
+ 935
+ 936
+ 937
+ 938
+ 939
+ 940
+ 941
+ 942
+ 943
+ 944
+ 945
+ 946
+ 947
+ 948
+ 949
+ 950
+ 951
+ 952
+ 953
+ 954
+ 955
+ 956
+ 957
+ 958
+ 959
+ 960
+ 961
+ 962
+ 963
+ 964
+ 965
+ 966
+ 967
+ 968
+ 969
+ 970
+ 971
+ 972
+ 973
+ 974
+ 975
+ 976
+ 977
+ 978
+ 979
+ 980
+ 981
+ 982
+ 983
+ 984
+ 985
+ 986
+ 987
+ 988
+ 989
+ 990
+ 991
+ 992
+ 993
+ 994
+ 995
+ 996
+ 997
+ 998
+ 999
+1000
+1001
+1002
+1003
+1004
+1005
+1006
+1007
+1008
+1009
+1010
+1011
+1012
+1013
+1014
+1015
+1016
+1017
+1018
+1019
+1020
+1021
+1022
+1023
+1024
+1025
+1026
+1027
+1028
+1029
+1030
+1031
+1032
+1033
+1034
+1035
+1036
+1037
+1038
+1039
+1040
+1041
+1042
+1043
+1044
+1045
+1046
+1047
+1048
+1049
+1050
+1051
+1052
+1053
+1054
+1055
+1056
+1057
+1058
+1059
+1060
+1061
+1062
+1063
+1064
+1065
+1066
+1067
+1068
+1069
+1070
+1071
+1072
+1073
+1074
+1075
+1076
+1077
+1078
+1079
+1080
+1081
+1082
+1083
+1084
+1085
+1086
+1087
+1088
+1089
+1090
+1091
+1092
+1093
+1094
+1095
+1096
+1097
+1098
+1099
+1100
+1101
+1102
+1103
+1104
+1105
+1106
+1107
+1108
+1109
+1110
+1111
+1112
+1113
+1114
+1115
+1116
+1117
+1118
+1119
+1120
+1121
+1122
+1123
+1124
+1125
+1126
+1127
+1128
+1129
+1130
+1131
+1132
+1133
+1134
+1135
+1136
+1137
+1138
+1139
+1140
+1141
+1142
+1143
+1144
+1145
+1146
+1147
+1148
+1149
+1150
+1151
+1152
+1153
+1154
+1155
+1156
+1157
+1158
+1159
+1160
+1161
+1162
+1163
+1164
+1165
+1166
+1167
+1168
+1169
+1170
+1171
+1172
+1173
+1174
+1175
+1176
+1177
+1178
+1179
+1180
+1181
+1182
+1183
+1184
+1185
+1186
+1187
+1188
+1189
+1190
+1191
+1192
+1193
+1194
+1195
+1196
+1197
+1198
+1199
+1200
+1201
+1202
+1203
+1204
+1205
+1206
+1207
+1208
+1209
+1210
+1211
+1212
+1213
+1214
+1215
+1216
+1217
+1218
+1219
+1220
+1221
+1222
+1223
+1224
+1225
+1226
+1227
+1228
+1229
+1230
+1231
+1232
+1233
+1234
+1235
+1236
+1237
+1238
+1239
+1240
+1241
+1242
+1243
+1244
+1245
+1246
+1247
+1248
+1249
+1250
+1251
+1252
+1253
+1254
+1255
+1256
+1257
+1258
+1259
+1260
+1261
+1262
+1263
+1264
+1265
+1266
+1267
+1268
+1269
+1270
+1271
+1272
+1273
+1274
+1275
+1276
+1277
+1278
+1279
+1280
+1281
+1282
+1283
+1284
+1285
+1286
+1287
+1288
+1289
+1290
+1291
+1292
+1293
+1294
+1295
+1296
+1297
+1298
+1299
+1300
+1301
+1302
+1303
+1304
+1305
+1306
+1307
+1308
+1309
+1310
+1311
+1312
+1313
+1314
+1315
+1316
+1317
+1318
+1319
+1320
+1321
+1322
+1323
+1324
+1325
+1326
+1327
+1328
+1329
+1330
+1331
+1332
+1333
+1334
+1335
+1336
+1337
+1338
+1339
+1340
+1341
+1342
+1343
+1344
+1345
+1346
+1347
+1348
+1349
+1350
+1351
+1352
+1353
+1354
+1355
+1356
+1357
+1358
+1359
+1360
+1361
+1362
+1363
+1364
+1365
+1366
+1367
+1368
+1369
+1370
+1371
+1372
+1373
+1374
+1375
+1376
+1377
+1378
+1379
+1380
+1381
+1382
+1383
+1384
+1385
+1386
+1387
+1388
+1389
+1390
+1391
+1392
+1393
+1394
+1395
+1396
+1397
+1398
+1399
+1400
+1401
+1402
+1403
+1404
+1405
+1406
+1407
+1408
+1409
+1410
+1411
+1412
+1413
+1414
+1415
+1416
+1417
+1418
+1419
+1420
+1421
+1422
+1423
+1424
+1425
+1426
+1427
+1428
+1429
+1430
+1431
+1432
+1433
+1434
+1435
+1436
+1437
+1438
+1439
+1440
+1441
+1442
+1443
+1444
+1445
+1446
+1447
+1448
+1449
+1450
+1451
+1452
+1453
+1454
+1455
+1456
+1457
+1458
+1459
+1460
+1461
+1462
+1463
+1464
+1465
+1466
+1467
+1468
+1469
+1470
+1471
+1472
+1473
+1474
+1475
+1476
+1477
+1478
+1479
+1480
+1481
+1482
+1483
+1484
+1485
+1486
+1487
+1488
+1489
+1490
+1491
+1492
+1493
+1494
+1495
+1496
+1497
+1498
+1499
+1500
+1501
+1502
+1503
+1504
+1505
+1506
+1507
+1508
+1509
+1510
+1511
+1512
+1513
+1514
+1515
+1516
+1517
+1518
+1519
+1520
+1521
+1522
+1523
+1524
+1525
+1526
+1527
+1528
+1529
+1530
+1531
+1532
+1533
+1534
+1535
+1536
+1537
+1538
+1539
+1540
+1541
+1542
+1543
+1544
+1545
+1546
+1547
+1548
+1549
+1550
+1551
+1552
+1553
+1554
+1555
+1556
+1557
+1558
+1559
+1560
+1561
+1562
+1563
+1564
+1565
+1566
+1567
+1568
+1569
+1570
+1571
+1572
+1573
+1574
+1575
+1576
+1577
+1578
+1579
+1580
+1581
+1582
+1583
+1584
+1585
+1586
+1587
+1588
+1589
+1590
+1591
+1592
+1593
+1594
+1595
+1596
+1597
+1598
+1599
+1600
+1601
+1602
+1603
+1604
+1605
+1606
+1607
+1608
+1609
+1610
+1611
+1612
+1613
+1614
+1615
+1616
+1617
+1618
+1619
+1620
+1621
+1622
+1623
+1624
+1625
+1626
+1627
+1628
+1629
+1630
+1631
+1632
+1633
+1634
+1635
+1636
+1637
+1638
+1639
+1640
+1641
+1642
+1643
+1644
+1645
+1646
+1647
+1648
+1649
+1650
+1651
+1652
+1653
+1654
+1655
+1656
+1657
+1658
+1659
+1660
+1661
+1662
+1663
+1664
+1665
+1666
+1667
+1668
+1669
+1670
+1671
+1672
+1673
+1674
+1675
+1676
+1677
+1678
+1679
+1680
+1681
+1682
+1683
+1684
+1685
+1686
+1687
+1688
+1689
+1690
+1691
+1692
+1693
+1694
+1695
+1696
+1697
+1698
+1699
+1700
+1701
+1702
+1703
+1704
+1705
+1706
+1707
+1708
+1709
+1710
+1711
+1712
+1713
+1714
+1715
+1716
+1717
+1718
+1719
+1720
+1721
+1722
+1723
+1724
+1725
+1726
+1727
+1728
+1729
+1730
+1731
+1732
+1733
+1734
+1735
+1736
+1737
+1738
+1739
+1740
+1741
+1742
+1743
+1744
+1745
+1746
+1747
+1748
+1749
+1750
+1751
+1752
+1753
+1754
+1755
+1756
+1757
+1758
+1759
+1760
+1761
+1762
+1763
+1764
+1765
+1766
+1767
+1768
+1769
+1770
+1771
+1772
+1773
+1774
+1775
+1776
+1777
+1778
+1779
+1780
+1781
+1782
+1783
+1784
+1785
+1786
+1787
+1788
+1789
+1790
+1791
+1792
+1793
+1794
+1795
+1796
+1797
+1798
+1799
+1800
+1801
+1802
+1803
+1804
+1805
+1806
+1807
+1808
+1809
+1810
+1811
+1812
+1813
+1814
+1815
+1816
+1817
+1818
+1819
+1820
+1821
+1822
+1823
+1824
+1825
+1826
+1827
+1828
+1829
+1830
+1831
+1832
+1833
+1834
+1835
+1836
+1837
+1838
+1839
+1840
+1841
+1842
+1843
+1844
+1845
+1846
+1847
+1848
+1849
+1850
+1851
+1852
+1853
+1854
+1855
+1856
+1857
+1858
+1859
+1860
+1861
+1862
+1863
@frozen(init=False)
+class OAuth2Client:
+    """An OAuth 2.x Client, that can send requests to an OAuth 2.x Authorization Server.
+
+    `OAuth2Client` is able to obtain tokens from the Token Endpoint using any of the standardised
+    Grant Types, and to communicate with the various backend endpoints like the Revocation,
+    Introspection, and UserInfo Endpoint.
+
+    To init an OAuth2Client, you only need the url to the Token Endpoint and the Credentials
+    (a client_id and one of a secret or private_key) that will be used to authenticate to that endpoint.
+    Other endpoint urls, such as the Authorization Endpoint, Revocation Endpoint, etc. can be passed as
+    parameter as well if you intend to use them.
+
+
+    This class is not intended to help with the end-user authentication or any request that goes in
+    a browser. For authentication requests, see
+    [AuthorizationRequest][requests_oauth2client.authorization_request.AuthorizationRequest]. You
+    may use the method `authorization_request()` to generate `AuthorizationRequest`s with the
+    preconfigured `authorization_endpoint`, `client_id` and `redirect_uri' from this client.
+
+    Args:
+        token_endpoint: the Token Endpoint URI where this client will get access tokens
+        auth: the authentication handler to use for client authentication on the token endpoint.
+            Can be:
+
+            - a [requests.auth.AuthBase][] instance (which will be used as-is)
+            - a tuple of `(client_id, client_secret)` which will initialize an instance
+            of [ClientSecretPost][requests_oauth2client.client_authentication.ClientSecretPost]
+            - a `(client_id, jwk)` to initialize
+            a [PrivateKeyJwt][requests_oauth2client.client_authentication.PrivateKeyJwt],
+            - or a `client_id` which will
+            use [PublicApp][requests_oauth2client.client_authentication.PublicApp] authentication.
+
+        client_id: client ID (use either this or `auth`)
+        client_secret: client secret (use either this or `auth`)
+        private_key: private_key to use for client authentication (use either this or `auth`)
+        revocation_endpoint: the Revocation Endpoint URI to use for revoking tokens
+        introspection_endpoint: the Introspection Endpoint URI to use to get info about tokens
+        userinfo_endpoint: the Userinfo Endpoint URI to use to get information about the user
+        authorization_endpoint: the Authorization Endpoint URI, used for initializing Authorization Requests
+        redirect_uri: the redirect_uri for this client
+        backchannel_authentication_endpoint: the BackChannel Authentication URI
+        device_authorization_endpoint: the Device Authorization Endpoint URI to use to authorize devices
+        jwks_uri: the JWKS URI to use to obtain the AS public keys
+        code_challenge_method: challenge method to use for PKCE (should always be 'S256')
+        session: a requests Session to use when sending HTTP requests.
+            Useful if some extra parameters such as proxy or client certificate must be used
+            to connect to the AS.
+        testing: if `True`, don't verify the validity of the endpoint urls that are passed as parameter.
+        **extra_metadata: additional metadata for this client, unused by this class, but may be
+            used by subclasses. Those will be accessible with the `extra_metadata` attribute.
+
+    Example:
+        ```python
+        client = OAuth2Client(
+            token_endpoint="https://my.as.local/token",
+            revocation_endpoint="https://my.as.local/revoke",
+            client_id="client_id",
+            client_secret="client_secret",
+        )
+
+        # once initialized, a client can send requests to its configured endpoints
+        cc_token = client.client_credentials(scope="my_scope")
+        ac_token = client.authorization_code(code="my_code")
+        client.revoke_access_token(cc_token)
+        ```
+
+    Raises:
+        MissingIDTokenEncryptedResponseAlgParam: if an `id_token_decryption_key` is provided
+            but no decryption alg is provided, either:
+
+            - using `id_token_encrypted_response_alg`,
+            - or in the `alg` parameter of the `Jwk` key
+        MissingIssuerParam: if `authorization_response_iss_parameter_supported` is set to `True`
+            but the `issuer` is not provided.
+        InvalidEndpointUri: if a provided endpoint uri is not considered valid. For the rare cases
+            where those checks must be disabled, you can use `testing=True`.
+        InvalidIssuer: if the `issuer` value is not considered valid.
+
+    """
+
+    auth: requests.auth.AuthBase = field(converter=client_auth_factory)
+    token_endpoint: str = field()
+    revocation_endpoint: str | None = field()
+    introspection_endpoint: str | None = field()
+    userinfo_endpoint: str | None = field()
+    authorization_endpoint: str | None = field()
+    redirect_uri: str | None = field()
+    backchannel_authentication_endpoint: str | None = field()
+    device_authorization_endpoint: str | None = field()
+    pushed_authorization_request_endpoint: str | None = field()
+    jwks_uri: str | None = field()
+    authorization_server_jwks: JwkSet
+    issuer: str | None = field()
+    id_token_signed_response_alg: str | None = SignatureAlgs.RS256
+    id_token_encrypted_response_alg: str | None = None
+    id_token_decryption_key: Jwk | None = None
+    code_challenge_method: str | None = CodeChallengeMethods.S256
+    authorization_response_iss_parameter_supported: bool = False
+    session: requests.Session = field(factory=requests.Session)
+    extra_metadata: dict[str, Any] = field(factory=dict)
+    testing: bool = False
+
+    token_class: type[BearerToken] = BearerToken
+
+    exception_classes: ClassVar[dict[str, type[EndpointError]]] = {
+        "server_error": ServerError,
+        "invalid_request": InvalidRequest,
+        "invalid_client": InvalidClient,
+        "invalid_scope": InvalidScope,
+        "invalid_target": InvalidTarget,
+        "invalid_grant": InvalidGrant,
+        "access_denied": AccessDenied,
+        "unauthorized_client": UnauthorizedClient,
+        "authorization_pending": AuthorizationPending,
+        "slow_down": SlowDown,
+        "expired_token": ExpiredToken,
+        "unsupported_token_type": UnsupportedTokenType,
+    }
+
+    def __init__(  # noqa: PLR0913
+        self,
+        token_endpoint: str,
+        auth: (
+            requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
+        ) = None,
+        *,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_key: Jwk | dict[str, Any] | None = None,
+        revocation_endpoint: str | None = None,
+        introspection_endpoint: str | None = None,
+        userinfo_endpoint: str | None = None,
+        authorization_endpoint: str | None = None,
+        redirect_uri: str | None = None,
+        backchannel_authentication_endpoint: str | None = None,
+        device_authorization_endpoint: str | None = None,
+        pushed_authorization_request_endpoint: str | None = None,
+        jwks_uri: str | None = None,
+        authorization_server_jwks: JwkSet | dict[str, Any] | None = None,
+        issuer: str | None = None,
+        id_token_signed_response_alg: str | None = SignatureAlgs.RS256,
+        id_token_encrypted_response_alg: str | None = None,
+        id_token_decryption_key: Jwk | dict[str, Any] | None = None,
+        code_challenge_method: str = CodeChallengeMethods.S256,
+        authorization_response_iss_parameter_supported: bool = False,
+        token_class: type[BearerToken] = BearerToken,
+        session: requests.Session | None = None,
+        testing: bool = False,
+        **extra_metadata: Any,
+    ) -> None:
+        if authorization_response_iss_parameter_supported and not issuer:
+            raise MissingIssuerParam
+
+        auth = client_auth_factory(
+            auth,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_key=private_key,
+            default_auth_handler=ClientSecretPost,
+        )
+
+        if authorization_server_jwks is None:
+            authorization_server_jwks = JwkSet()
+        elif not isinstance(authorization_server_jwks, JwkSet):
+            authorization_server_jwks = JwkSet(authorization_server_jwks)
+
+        if id_token_decryption_key is not None and not isinstance(id_token_decryption_key, Jwk):
+            id_token_decryption_key = Jwk(id_token_decryption_key)
+
+        if id_token_decryption_key is not None and id_token_encrypted_response_alg is None:
+            if id_token_decryption_key.alg:
+                id_token_encrypted_response_alg = id_token_decryption_key.alg
+            else:
+                raise MissingIdTokenEncryptedResponseAlgParam
+
+        if session is None:
+            session = requests.Session()
+
+        self.__attrs_init__(
+            testing=testing,
+            token_endpoint=token_endpoint,
+            revocation_endpoint=revocation_endpoint,
+            introspection_endpoint=introspection_endpoint,
+            userinfo_endpoint=userinfo_endpoint,
+            authorization_endpoint=authorization_endpoint,
+            redirect_uri=redirect_uri,
+            backchannel_authentication_endpoint=backchannel_authentication_endpoint,
+            device_authorization_endpoint=device_authorization_endpoint,
+            pushed_authorization_request_endpoint=pushed_authorization_request_endpoint,
+            jwks_uri=jwks_uri,
+            authorization_server_jwks=authorization_server_jwks,
+            issuer=issuer,
+            session=session,
+            auth=auth,
+            id_token_signed_response_alg=id_token_signed_response_alg,
+            id_token_encrypted_response_alg=id_token_encrypted_response_alg,
+            id_token_decryption_key=id_token_decryption_key,
+            code_challenge_method=code_challenge_method,
+            authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
+            extra_metadata=extra_metadata,
+            token_class=token_class,
+        )
+
+    @token_endpoint.validator
+    @revocation_endpoint.validator
+    @introspection_endpoint.validator
+    @userinfo_endpoint.validator
+    @authorization_endpoint.validator
+    @backchannel_authentication_endpoint.validator
+    @device_authorization_endpoint.validator
+    @pushed_authorization_request_endpoint.validator
+    @jwks_uri.validator
+    def validate_endpoint_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
+        """Validate that an endpoint URI is suitable for use.
+
+        If you need to disable some checks (for AS testing purposes only!), provide a different
+        method here.
+
+        """
+        if self.testing or uri is None:
+            return uri
+        try:
+            return validate_endpoint_uri(uri)
+        except InvalidUri as exc:
+            raise InvalidEndpointUri(endpoint=attribute.name, uri=uri, exc=exc) from exc
+
+    @issuer.validator
+    def validate_issuer_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
+        """Validate that an Issuer identifier is suitable for use.
+
+        This is the same check as an endpoint URI, but the path may be (and usually is) empty.
+
+        """
+        if self.testing or uri is None:
+            return uri
+        try:
+            return validate_issuer_uri(uri)
+        except InvalidUri as exc:
+            raise InvalidIssuer(attribute.name, uri, exc) from exc
+
+    @property
+    def client_id(self) -> str:
+        """Client ID."""
+        if hasattr(self.auth, "client_id"):
+            return self.auth.client_id  # type: ignore[no-any-return]
+        msg = "This client uses a custom authentication method without client_id."
+        raise AttributeError(msg)  # pragma: no cover
+
+    @property
+    def client_secret(self) -> str | None:
+        """Client Secret."""
+        if hasattr(self.auth, "client_secret"):
+            return self.auth.client_secret  # type: ignore[no-any-return]
+        return None
+
+    @property
+    def client_jwks(self) -> JwkSet:
+        """A `JwkSet` containing the public keys for this client.
+
+        Keys are:
+
+        - the public key for client assertion signature verification (if using private_key_jwt)
+        - the ID Token encryption key
+
+        """
+        jwks = JwkSet()
+        if isinstance(self.auth, PrivateKeyJwt):
+            jwks.add_jwk(self.auth.private_jwk.public_jwk().with_usage_parameters())
+        if self.id_token_decryption_key:
+            jwks.add_jwk(self.id_token_decryption_key.public_jwk().with_usage_parameters())
+        return jwks
+
+    def _request(
+        self,
+        endpoint: str,
+        on_success: Callable[[requests.Response], T],
+        on_failure: Callable[[requests.Response], T],
+        accept: str = "application/json",
+        method: str = "POST",
+        **requests_kwargs: Any,
+    ) -> T:
+        """Send a request to one of the endpoints.
+
+        This is a helper method that takes care of the following tasks:
+
+        - make sure the endpoint as been configured
+        - set `Accept: application/json` header
+        - send the HTTP POST request, then
+            - apply `on_success` to a successful response
+            - or apply `on_failure` otherwise
+        - return the result
+
+        Args:
+            endpoint: name of the endpoint to use
+            on_success: a callable to apply to successful responses
+            on_failure: a callable to apply to error responses
+            accept: the Accept header to include in the request
+            method: the HTTP method to use
+            **requests_kwargs: keyword arguments for the request
+
+        """
+        endpoint_uri = self._require_endpoint(endpoint)
+        requests_kwargs.setdefault("headers", {})
+        requests_kwargs["headers"]["Accept"] = accept
+
+        response = self.session.request(
+            method,
+            endpoint_uri,
+            **requests_kwargs,
+        )
+        if response.ok:
+            return on_success(response)
+
+        return on_failure(response)
+
+    def token_request(
+        self,
+        data: dict[str, Any],
+        timeout: int = 10,
+        **requests_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request to the token endpoint.
+
+        Authentication will be added automatically based on the defined `auth` for this client.
+
+        Args:
+          data: parameters to send to the token endpoint. Items with a `None`
+               or empty value will not be sent in the request.
+          timeout: a timeout value for the call
+          **requests_kwargs: additional parameters for requests.post()
+
+        Returns:
+            the token endpoint response, as
+            [`BearerToken`][requests_oauth2client.tokens.BearerToken] instance.
+
+        """
+        return self._request(
+            Endpoints.TOKEN,
+            auth=self.auth,
+            data=data,
+            timeout=timeout,
+            on_success=self.parse_token_response,
+            on_failure=self.on_token_error,
+            **requests_kwargs,
+        )
+
+    def parse_token_response(self, response: requests.Response) -> BearerToken:
+        """Parse a Response returned by the Token Endpoint.
+
+        Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] to parse
+        responses returned by the Token Endpoint. Those responses contain an `access_token` and
+        additional attributes.
+
+        Args:
+            response: the [Response][requests.Response] returned by the Token Endpoint.
+
+        Returns:
+            a [`BearerToken`][requests_oauth2client.tokens.BearerToken] based on the response
+            contents.
+
+        """
+        try:
+            token_response = self.token_class(**response.json())
+        except Exception:  # noqa: BLE001
+            return self.on_token_error(response)
+        else:
+            return token_response
+
+    def on_token_error(self, response: requests.Response) -> BearerToken:
+        """Error handler for `token_request()`.
+
+        Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] when the
+        Token Endpoint returns an error.
+
+        Args:
+            response: the [Response][requests.Response] returned by the Token Endpoint.
+
+        Returns:
+            nothing, and raises an exception instead. But a subclass may return a
+            [`BearerToken`][requests_oauth2client.tokens.BearerToken] to implement a default
+            behaviour if needed.
+
+        Raises:
+            InvalidTokenResponse: if the error response does not contain an OAuth 2.0 standard
+                error response.
+
+        """
+        try:
+            data = response.json()
+            error = data["error"]
+            error_description = data.get("error_description")
+            error_uri = data.get("error_uri")
+            exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
+            exception = exception_class(
+                response=response,
+                client=self,
+                error=error,
+                description=error_description,
+                uri=error_uri,
+            )
+        except Exception as exc:
+            raise InvalidTokenResponse(response=response, client=self) from exc
+        raise exception
+
+    def client_credentials(
+        self,
+        scope: str | Iterable[str] | None = None,
+        *,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request to the token endpoint using the `client_credentials` grant.
+
+        Args:
+            scope: the scope to send with the request. Can be a str, or an iterable of str.
+                to pass that way include `scope`, `audience`, `resource`, etc.
+            requests_kwargs: additional parameters for the call to requests
+            **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`. Common parameters
+
+        Returns:
+            a BearerToken
+
+        Raises:
+            InvalidScopeParam: if the `scope` parameter is not suitable
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        if scope and not isinstance(scope, str):
+            try:
+                scope = " ".join(scope)
+            except Exception as exc:
+                raise InvalidScopeParam(scope) from exc
+
+        data = dict(grant_type=GrantTypes.CLIENT_CREDENTIALS, scope=scope, **token_kwargs)
+        return self.token_request(data, **requests_kwargs)
+
+    def authorization_code(
+        self,
+        code: str | AuthorizationResponse,
+        *,
+        validate: bool = True,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request to the token endpoint with the `authorization_code` grant.
+
+        Args:
+             code: an authorization code or an `AuthorizationResponse` to exchange for tokens
+             validate: if `True`, validate the received ID Token (this works only if `code` is an AuthorizationResponse)
+             requests_kwargs: additional parameters for the call to requests
+             **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `code`, etc.
+
+        Returns:
+            a `BearerToken`
+
+        """
+        azr: AuthorizationResponse | None = None
+        if isinstance(code, AuthorizationResponse):
+            token_kwargs.setdefault("code_verifier", code.code_verifier)
+            token_kwargs.setdefault("redirect_uri", code.redirect_uri)
+            azr = code
+            code = code.code
+
+        requests_kwargs = requests_kwargs or {}
+
+        data = dict(grant_type=GrantTypes.AUTHORIZATION_CODE, code=code, **token_kwargs)
+        token = self.token_request(data, **requests_kwargs)
+        if validate and token.id_token and isinstance(azr, AuthorizationResponse):
+            return token.validate_id_token(self, azr)
+        return token
+
+    def refresh_token(
+        self,
+        refresh_token: str | BearerToken,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request to the token endpoint with the `refresh_token` grant.
+
+        Args:
+            refresh_token: a refresh_token, as a string, or as a `BearerToken`.
+                That `BearerToken` must have a `refresh_token`.
+            requests_kwargs: additional parameters for the call to `requests`
+            **token_kwargs: additional parameters for the token endpoint,
+                alongside `grant_type`, `refresh_token`, etc.
+
+        Returns:
+            a `BearerToken`
+
+        Raises:
+            MissingRefreshToken: if `refresh_token` is a BearerToken instance but does not
+                contain a `refresh_token`
+
+        """
+        if isinstance(refresh_token, BearerToken):
+            if refresh_token.refresh_token is None or not isinstance(refresh_token.refresh_token, str):
+                raise MissingRefreshToken(refresh_token)
+            refresh_token = refresh_token.refresh_token
+
+        requests_kwargs = requests_kwargs or {}
+        data = dict(grant_type=GrantTypes.REFRESH_TOKEN, refresh_token=refresh_token, **token_kwargs)
+        return self.token_request(data, **requests_kwargs)
+
+    def device_code(
+        self,
+        device_code: str | DeviceAuthorizationResponse,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request to the token endpoint using the Device Code grant.
+
+        The grant_type is `urn:ietf:params:oauth:grant-type:device_code`. This needs a Device Code,
+        or a `DeviceAuthorizationResponse` as parameter.
+
+        Args:
+            device_code: a device code, or a `DeviceAuthorizationResponse`
+            requests_kwargs: additional parameters for the call to requests
+            **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `device_code`, etc.
+
+        Returns:
+            a `BearerToken`
+
+        Raises:
+            MissingDeviceCode: if `device_code` is a DeviceAuthorizationResponse but does not
+                contain a `device_code`.
+
+        """
+        if isinstance(device_code, DeviceAuthorizationResponse):
+            if device_code.device_code is None or not isinstance(device_code.device_code, str):
+                raise MissingDeviceCode(device_code)
+            device_code = device_code.device_code
+
+        requests_kwargs = requests_kwargs or {}
+        data = dict(
+            grant_type=GrantTypes.DEVICE_CODE,
+            device_code=device_code,
+            **token_kwargs,
+        )
+        return self.token_request(data, **requests_kwargs)
+
+    def ciba(
+        self,
+        auth_req_id: str | BackChannelAuthenticationResponse,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a CIBA request to the Token Endpoint.
+
+        A CIBA request is a Token Request using the `urn:openid:params:grant-type:ciba` grant.
+
+        Args:
+            auth_req_id: an authentication request ID, as returned by the AS
+            requests_kwargs: additional parameters for the call to requests
+            **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `auth_req_id`, etc.
+
+        Returns:
+            a `BearerToken`
+
+        Raises:
+            MissingAuthRequestId: if `auth_req_id` is a BackChannelAuthenticationResponse but does not contain
+                an `auth_req_id`.
+
+        """
+        if isinstance(auth_req_id, BackChannelAuthenticationResponse):
+            if auth_req_id.auth_req_id is None or not isinstance(auth_req_id.auth_req_id, str):
+                raise MissingAuthRequestId(auth_req_id)
+            auth_req_id = auth_req_id.auth_req_id
+
+        requests_kwargs = requests_kwargs or {}
+        data = dict(
+            grant_type=GrantTypes.CLIENT_INITIATED_BACKCHANNEL_AUTHENTICATION,
+            auth_req_id=auth_req_id,
+            **token_kwargs,
+        )
+        return self.token_request(data, **requests_kwargs)
+
+    def token_exchange(
+        self,
+        subject_token: str | BearerToken | IdToken,
+        subject_token_type: str | None = None,
+        actor_token: None | str | BearerToken | IdToken = None,
+        actor_token_type: str | None = None,
+        requested_token_type: str | None = None,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a Token Exchange request.
+
+        A Token Exchange request is actually a request to the Token Endpoint with a grant_type
+        `urn:ietf:params:oauth:grant-type:token-exchange`.
+
+        Args:
+            subject_token: the subject token to exchange for a new token.
+            subject_token_type: a token type identifier for the subject_token, mandatory if it cannot be guessed based
+                on `type(subject_token)`.
+            actor_token: the actor token to include in the request, if any.
+            actor_token_type: a token type identifier for the actor_token, mandatory if it cannot be guessed based
+                on `type(actor_token)`.
+            requested_token_type: a token type identifier for the requested token.
+            requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
+            **token_kwargs: additional parameters to include in the request body.
+
+        Returns:
+            a `BearerToken` as returned by the Authorization Server.
+
+        Raises:
+            UnknownSubjectTokenType: if the type of `subject_token` cannot be determined automatically.
+            UnknownActorTokenType: if the type of `actor_token` cannot be determined automaticatlly.
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        try:
+            subject_token_type = self.get_token_type(subject_token_type, subject_token)
+        except ValueError as exc:
+            raise UnknownSubjectTokenType(subject_token, subject_token_type) from exc
+        if actor_token:  # pragma: no branch
+            try:
+                actor_token_type = self.get_token_type(actor_token_type, actor_token)
+            except ValueError as exc:
+                raise UnknownActorTokenType(actor_token, actor_token_type) from exc
+
+        data = dict(
+            grant_type=GrantTypes.TOKEN_EXCHANGE,
+            subject_token=subject_token,
+            subject_token_type=subject_token_type,
+            actor_token=actor_token,
+            actor_token_type=actor_token_type,
+            requested_token_type=requested_token_type,
+            **token_kwargs,
+        )
+        return self.token_request(data, **requests_kwargs)
+
+    def jwt_bearer(
+        self,
+        assertion: Jwt | str,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request using a JWT as authorization grant.
+
+        This is defined in (RFC7523 $2.1)[https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1).
+
+        Args:
+            assertion: a JWT (as an instance of `jwskate.Jwt` or as a `str`) to use as authorization grant.
+            requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
+            **token_kwargs: additional parameters to include in the request body.
+
+        Returns:
+            a `BearerToken` as returned by the Authorization Server.
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        if not isinstance(assertion, Jwt):
+            assertion = Jwt(assertion)
+
+        data = dict(
+            grant_type=GrantTypes.JWT_BEARER,
+            assertion=assertion,
+            **token_kwargs,
+        )
+
+        return self.token_request(data, **requests_kwargs)
+
+    def resource_owner_password(
+        self,
+        username: str,
+        password: str,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> BearerToken:
+        """Send a request using the Resource Owner Password Grant.
+
+        This Grant Type is deprecated and should only be used when there is no other choice.
+
+        Args:
+            username: the resource owner user name
+            password: the resource owner password
+            requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
+            **token_kwargs: additional parameters to include in the request body.
+
+        Returns:
+            a `BearerToken` as returned by the Authorization Server
+
+        """
+        requests_kwargs = requests_kwargs or {}
+        data = dict(
+            grant_type=GrantTypes.RESOURCE_OWNER_PASSWORD,
+            username=username,
+            password=password,
+            **token_kwargs,
+        )
+
+        return self.token_request(data, **requests_kwargs)
+
+    def authorization_request(
+        self,
+        *,
+        scope: None | str | Iterable[str] = "openid",
+        response_type: str = ResponseTypes.CODE,
+        redirect_uri: str | None = None,
+        state: str | ellipsis | None = ...,  # noqa: F821
+        nonce: str | ellipsis | None = ...,  # noqa: F821
+        code_verifier: str | None = None,
+        **kwargs: Any,
+    ) -> AuthorizationRequest:
+        """Generate an Authorization Request for this client.
+
+        Args:
+            scope: the `scope` to use
+            response_type: the `response_type` to use
+            redirect_uri: the `redirect_uri` to include in the request. By default,
+                the `redirect_uri` defined at init time is used.
+            state: the `state` parameter to use. Leave default to generate a random value.
+            nonce: a `nonce`. Leave default to generate a random value.
+            code_verifier: the PKCE `code_verifier` to use. Leave default to generate a random value.
+            **kwargs: additional parameters to include in the auth request
+
+        Returns:
+            an AuthorizationRequest with the supplied parameters
+
+        """
+        authorization_endpoint = self._require_endpoint("authorization_endpoint")
+
+        redirect_uri = redirect_uri or self.redirect_uri
+
+        return AuthorizationRequest(
+            authorization_endpoint=authorization_endpoint,
+            client_id=self.client_id,
+            redirect_uri=redirect_uri,
+            issuer=self.issuer,
+            response_type=response_type,
+            scope=scope,
+            state=state,
+            nonce=nonce,
+            code_verifier=code_verifier,
+            code_challenge_method=self.code_challenge_method,
+            **kwargs,
+        )
+
+    def pushed_authorization_request(
+        self,
+        authorization_request: AuthorizationRequest,
+        requests_kwargs: dict[str, Any] | None = None,
+    ) -> RequestUriParameterAuthorizationRequest:
+        """Send a Pushed Authorization Request.
+
+        This sends a request to the Pushed Authorization Request Endpoint, and returns a
+        `RequestUriParameterAuthorizationRequest` initialized with the AS response.
+
+        Args:
+            authorization_request: the authorization request to send
+            requests_kwargs: additional parameters for `requests.request()`
+
+        Returns:
+            the `RequestUriParameterAuthorizationRequest` initialized based on the AS response
+
+        """
+        requests_kwargs = requests_kwargs or {}
+        return self._request(
+            Endpoints.PUSHED_AUTHORIZATION_REQUEST,
+            data=authorization_request.args,
+            auth=self.auth,
+            on_success=self.parse_pushed_authorization_response,
+            on_failure=self.on_pushed_authorization_request_error,
+            **requests_kwargs,
+        )
+
+    def parse_pushed_authorization_response(
+        self,
+        response: requests.Response,
+    ) -> RequestUriParameterAuthorizationRequest:
+        """Parse the response obtained by `pushed_authorization_request()`.
+
+        Args:
+            response: the `requests.Response` returned by the PAR endpoint
+
+        Returns:
+            a RequestUriParameterAuthorizationRequest instance
+
+        """
+        response_json = response.json()
+        request_uri = response_json.get("request_uri")
+        expires_in = response_json.get("expires_in")
+
+        return RequestUriParameterAuthorizationRequest(
+            authorization_endpoint=self.authorization_endpoint,
+            client_id=self.client_id,
+            request_uri=request_uri,
+            expires_in=expires_in,
+        )
+
+    def on_pushed_authorization_request_error(
+        self,
+        response: requests.Response,
+    ) -> RequestUriParameterAuthorizationRequest:
+        """Error Handler for Pushed Authorization Endpoint errors.
+
+        Args:
+            response: the HTTP response as returned by the AS PAR endpoint.
+
+        Returns:
+            a RequestUriParameterAuthorizationRequest, if the error is recoverable
+
+        Raises:
+            EndpointError: a subclass of this error depending on the error returned by the AS
+            InvalidPushedAuthorizationResponse: if the returned response is not following the
+                specifications
+            UnknownTokenEndpointError: for unknown/unhandled errors
+
+        """
+        try:
+            data = response.json()
+            error = data["error"]
+            error_description = data.get("error_description")
+            error_uri = data.get("error_uri")
+            exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
+            exception = exception_class(
+                response=response,
+                client=self,
+                error=error,
+                description=error_description,
+                uri=error_uri,
+            )
+        except Exception as exc:
+            raise InvalidPushedAuthorizationResponse(response=response, client=self) from exc
+        raise exception
+
+    def userinfo(self, access_token: BearerToken | str) -> Any:
+        """Call the UserInfo endpoint.
+
+        This sends a request to the UserInfo endpoint, with the specified access_token, and returns
+        the parsed result.
+
+        Args:
+            access_token: the access token to use
+
+        Returns:
+            the [Response][requests.Response] returned by the userinfo endpoint.
+
+        """
+        if isinstance(access_token, str):
+            access_token = BearerToken(access_token)
+        return self._request(
+            Endpoints.USER_INFO,
+            auth=access_token,
+            on_success=self.parse_userinfo_response,
+            on_failure=self.on_userinfo_error,
+        )
+
+    def parse_userinfo_response(self, resp: requests.Response) -> Any:
+        """Parse the response obtained by `userinfo()`.
+
+        Invoked by [userinfo()][requests_oauth2client.client.OAuth2Client.userinfo] to parse the
+        response from the UserInfo endpoint, this will extract and return its JSON content.
+
+        Args:
+            resp: a [Response][requests.Response] returned from the UserInfo endpoint.
+
+        Returns:
+            the parsed JSON content from this response.
+
+        """
+        return resp.json()
+
+    def on_userinfo_error(self, resp: requests.Response) -> Any:
+        """Parse UserInfo error response.
+
+        Args:
+            resp: a [Response][requests.Response] returned from the UserInfo endpoint.
+
+        Returns:
+            nothing, raises exception instead.
+
+        """
+        resp.raise_for_status()
+
+    @classmethod
+    def get_token_type(  # noqa: C901
+        cls,
+        token_type: str | None = None,
+        token: None | str | BearerToken | IdToken = None,
+    ) -> str:
+        """Get standardized token type identifiers.
+
+        Return a standardized token type identifier, based on a short `token_type` hint and/or a
+        token value.
+
+        Args:
+            token_type: a token_type hint, as `str`. May be "access_token", "refresh_token"
+                or "id_token"
+            token: a token value, as an instance of `BearerToken` or IdToken, or as a `str`.
+
+        Returns:
+            the token_type as defined in the Token Exchange RFC8693.
+
+        Raises:
+            UnknownTokenType: if the type of token cannot be determined
+
+        """
+        if not (token_type or token):
+            msg = "Cannot determine type of an empty token without a token_type hint"
+            raise UnknownTokenType(msg, token, token_type)
+
+        if token_type is None:
+            if isinstance(token, str):
+                msg = """\
+Cannot determine the type of provided token when it is a bare `str`. Please specify a 'token_type'.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            if isinstance(token, BearerToken):
+                return "urn:ietf:params:oauth:token-type:access_token"
+            if isinstance(token, IdToken):
+                return "urn:ietf:params:oauth:token-type:id_token"
+            msg = f"Unknown token type {type(token)}"
+            raise UnknownTokenType(msg, token, token_type)
+        if token_type == TokenType.ACCESS_TOKEN:
+            if token is not None and not isinstance(token, (str, BearerToken)):
+                msg = f"""\
+The supplied token is of type '{type(token)}' which is inconsistent with token_type '{token_type}'.
+A BearerToken or an access_token as a `str` is expected.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            return "urn:ietf:params:oauth:token-type:access_token"
+        if token_type == TokenType.REFRESH_TOKEN:
+            if token is not None and isinstance(token, BearerToken) and not token.refresh_token:
+                msg = f"""\
+The supplied BearerToken does not contain a refresh_token, which is inconsistent with token_type '{token_type}'.
+A BearerToken containing a refresh_token is expected.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            return "urn:ietf:params:oauth:token-type:refresh_token"
+        if token_type == TokenType.ID_TOKEN:
+            if token is not None and not isinstance(token, (str, IdToken)):
+                msg = f"""\
+The supplied token is of type '{type(token)}' which is inconsistent with token_type '{token_type}'.
+An IdToken or a string representation of it is expected.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            return "urn:ietf:params:oauth:token-type:id_token"
+
+        return {
+            "saml1": "urn:ietf:params:oauth:token-type:saml1",
+            "saml2": "urn:ietf:params:oauth:token-type:saml2",
+            "jwt": "urn:ietf:params:oauth:token-type:jwt",
+        }.get(token_type, token_type)
+
+    def revoke_access_token(
+        self,
+        access_token: BearerToken | str,
+        requests_kwargs: dict[str, Any] | None = None,
+        **revoke_kwargs: Any,
+    ) -> bool:
+        """Send a request to the Revocation Endpoint to revoke an access token.
+
+        Args:
+            access_token: the access token to revoke
+            requests_kwargs: additional parameters for the underlying requests.post() call
+            **revoke_kwargs: additional parameters to pass to the revocation endpoint
+
+        """
+        return self.revoke_token(
+            access_token,
+            token_type_hint=TokenType.ACCESS_TOKEN,
+            requests_kwargs=requests_kwargs,
+            **revoke_kwargs,
+        )
+
+    def revoke_refresh_token(
+        self,
+        refresh_token: str | BearerToken,
+        requests_kwargs: dict[str, Any] | None = None,
+        **revoke_kwargs: Any,
+    ) -> bool:
+        """Send a request to the Revocation Endpoint to revoke a refresh token.
+
+        Args:
+            refresh_token: the refresh token to revoke.
+            requests_kwargs: additional parameters to pass to the revocation endpoint.
+            **revoke_kwargs: additional parameters to pass to the revocation endpoint.
+
+        Returns:
+            `True` if the revocation request is successful, `False` if this client has no configured
+            revocation endpoint.
+
+        Raises:
+            MissingRefreshToken: when `refresh_token` is a [BearerToken][requests_oauth2client.tokens.BearerToken]
+                but does not contain a `refresh_token`.
+
+        """
+        if isinstance(refresh_token, BearerToken):
+            if refresh_token.refresh_token is None:
+                raise MissingRefreshToken(refresh_token)
+            refresh_token = refresh_token.refresh_token
+
+        return self.revoke_token(
+            refresh_token,
+            token_type_hint=TokenType.REFRESH_TOKEN,
+            requests_kwargs=requests_kwargs,
+            **revoke_kwargs,
+        )
+
+    def revoke_token(
+        self,
+        token: str | BearerToken,
+        token_type_hint: str | None = None,
+        requests_kwargs: dict[str, Any] | None = None,
+        **revoke_kwargs: Any,
+    ) -> bool:
+        """Send a Token Revocation request.
+
+        By default, authentication will be the same than the one used for the Token Endpoint.
+
+        Args:
+            token: the token to revoke.
+            token_type_hint: a token_type_hint to send to the revocation endpoint.
+            requests_kwargs: additional parameters to the underling call to requests.post()
+            **revoke_kwargs: additional parameters to send to the revocation endpoint.
+
+        Returns:
+            `True` if the revocation succeeds, `False` if no revocation endpoint is present or a
+            non-standardised error is returned.
+
+        Raises:
+            MissingEndpointUri: if the Revocation Endpoint URI is not configured.
+            MissingRefreshToken: if `token_type_hint` is `"refresh_token"` and `token` is a BearerToken
+                but does not contain a `refresh_token`.
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        if token_type_hint == TokenType.REFRESH_TOKEN and isinstance(token, BearerToken):
+            if token.refresh_token is None:
+                raise MissingRefreshToken(token)
+            token = token.refresh_token
+
+        data = dict(revoke_kwargs, token=str(token))
+        if token_type_hint:
+            data["token_type_hint"] = token_type_hint
+
+        return self._request(
+            Endpoints.REVOCATION,
+            data=data,
+            auth=self.auth,
+            on_success=lambda _: True,
+            on_failure=self.on_revocation_error,
+            **requests_kwargs,
+        )
+
+    def on_revocation_error(self, response: requests.Response) -> bool:
+        """Error handler for `revoke_token()`.
+
+        Invoked by [revoke_token()][requests_oauth2client.client.OAuth2Client.revoke_token] when the
+        revocation endpoint returns an error.
+
+        Args:
+            response: the [Response][requests.Response] as returned by the Revocation Endpoint
+
+        Returns:
+            `False` to signal that an error occurred. May raise exceptions instead depending on the
+            revocation response.
+
+        Raises:
+            EndpointError: if the response contains a standardised OAuth 2.0 error.
+
+        """
+        try:
+            data = response.json()
+            error = data["error"]
+            error_description = data.get("error_description")
+            error_uri = data.get("error_uri")
+            exception_class = self.exception_classes.get(error, RevocationError)
+            exception = exception_class(
+                response=response,
+                client=self,
+                error=error,
+                description=error_description,
+                uri=error_uri,
+            )
+        except Exception:  # noqa: BLE001
+            return False
+        raise exception
+
+    def introspect_token(
+        self,
+        token: str | BearerToken,
+        token_type_hint: str | None = None,
+        requests_kwargs: dict[str, Any] | None = None,
+        **introspect_kwargs: Any,
+    ) -> Any:
+        """Send a request to the Introspection Endpoint.
+
+        Parameter `token` can be:
+
+        - a `str`
+        - a `BearerToken` instance
+
+        You may pass any arbitrary `token` and `token_type_hint` values as `str`. Those will
+        be included in the request, as-is.
+        If `token` is a `BearerToken`, then `token_type_hint` must be either:
+
+        - `None`: the access_token will be instrospected and no token_type_hint will be included
+        in the request
+        - `access_token`: same as `None`, but the token_type_hint will be included
+        - or `refresh_token`: only available if a Refresh Token is present in the BearerToken.
+
+        Args:
+            token: the token to instrospect
+            token_type_hint: the `token_type_hint` to include in the request.
+            requests_kwargs: additional parameters to the underling call to requests.post()
+            **introspect_kwargs: additional parameters to send to the introspection endpoint.
+
+        Returns:
+            the response as returned by the Introspection Endpoint.
+
+        Raises:
+            MissingRefreshToken: if `token_type_hint` is `"refresh_token"` and `token` is a BearerToken
+                but does not contain a `refresh_token`.
+            UnknownTokenType: if `token_type_hint` is neither `None`, `"access_token"` or `"refresh_token"`.
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        if isinstance(token, BearerToken):
+            if token_type_hint is None or token_type_hint == TokenType.ACCESS_TOKEN:
+                token = token.access_token
+            elif token_type_hint == TokenType.REFRESH_TOKEN:
+                if token.refresh_token is None:
+                    raise MissingRefreshToken(token)
+
+                token = token.refresh_token
+            else:
+                msg = """\
+Invalid `token_type_hint`. To test arbitrary `token_type_hint` values, you must provide `token` as a `str`."""
+                raise UnknownTokenType(msg, token, token_type_hint)
+
+        data = dict(introspect_kwargs, token=str(token))
+        if token_type_hint:
+            data["token_type_hint"] = token_type_hint
+
+        return self._request(
+            Endpoints.INSTROSPECTION,
+            data=data,
+            auth=self.auth,
+            on_success=self.parse_introspection_response,
+            on_failure=self.on_introspection_error,
+            **requests_kwargs,
+        )
+
+    def parse_introspection_response(self, response: requests.Response) -> Any:
+        """Parse Token Introspection Responses received by `introspect_token()`.
+
+        Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
+        to parse the returned response. This decodes the JSON content if possible, otherwise it
+        returns the response as a string.
+
+        Args:
+            response: the [Response][requests.Response] as returned by the Introspection Endpoint.
+
+        Returns:
+            the decoded JSON content, or a `str` with the content.
+
+        """
+        try:
+            return response.json()
+        except ValueError:
+            return response.text
+
+    def on_introspection_error(self, response: requests.Response) -> Any:
+        """Error handler for `introspect_token()`.
+
+        Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
+        to parse the returned response in the case an error is returned.
+
+        Args:
+            response: the response as returned by the Introspection Endpoint.
+
+        Returns:
+            usually raises exceptions. A subclass can return a default response instead.
+
+        Raises:
+            EndpointError: (or one of its subclasses) if the response contains a standard OAuth 2.0 error.
+            UnknownIntrospectionError: if the response is not a standard error response.
+
+        """
+        try:
+            data = response.json()
+            error = data["error"]
+            error_description = data.get("error_description")
+            error_uri = data.get("error_uri")
+            exception_class = self.exception_classes.get(error, IntrospectionError)
+            exception = exception_class(
+                response=response,
+                client=self,
+                error=error,
+                description=error_description,
+                uri=error_uri,
+            )
+        except Exception as exc:
+            raise UnknownIntrospectionError(response=response, client=self) from exc
+        raise exception
+
+    def backchannel_authentication_request(  # noqa: PLR0913
+        self,
+        scope: None | str | Iterable[str] = "openid",
+        *,
+        client_notification_token: str | None = None,
+        acr_values: None | str | Iterable[str] = None,
+        login_hint_token: str | None = None,
+        id_token_hint: str | None = None,
+        login_hint: str | None = None,
+        binding_message: str | None = None,
+        user_code: str | None = None,
+        requested_expiry: int | None = None,
+        private_jwk: Jwk | dict[str, Any] | None = None,
+        alg: str | None = None,
+        requests_kwargs: dict[str, Any] | None = None,
+        **ciba_kwargs: Any,
+    ) -> BackChannelAuthenticationResponse:
+        """Send a CIBA Authentication Request.
+
+        Args:
+             scope: the scope to include in the request.
+             client_notification_token: the Client Notification Token to include in the request.
+             acr_values: the acr values to include in the request.
+             login_hint_token: the Login Hint Token to include in the request.
+             id_token_hint: the ID Token Hint to include in the request.
+             login_hint: the Login Hint to include in the request.
+             binding_message: the Binding Message to include in the request.
+             user_code: the User Code to include in the request
+             requested_expiry: the Requested Expiry, in seconds, to include in the request.
+             private_jwk: the JWK to use to sign the request (optional)
+             alg: the alg to use to sign the request, if the provided JWK does not include an "alg" parameter.
+             requests_kwargs: additional parameters for
+             **ciba_kwargs: additional parameters to include in the request.
+
+        Returns:
+            a BackChannelAuthenticationResponse as returned by AS
+
+        Raises:
+            InvalidBackchannelAuthenticationRequestHintParam: if none of `login_hint`, `login_hint_token`
+                or `id_token_hint` is provided, or more than one of them is provided.
+            InvalidScopeParam: if the `scope` parameter is invalid.
+            InvalidAcrValuesParam: if the `acr_values` parameter is invalid.
+
+        """
+        if not (login_hint or login_hint_token or id_token_hint):
+            msg = "One of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
+            raise InvalidBackchannelAuthenticationRequestHintParam(msg)
+
+        if (login_hint_token and id_token_hint) or (login_hint and id_token_hint) or (login_hint_token and login_hint):
+            msg = "Only one of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
+            raise InvalidBackchannelAuthenticationRequestHintParam(msg)
+
+        requests_kwargs = requests_kwargs or {}
+
+        if scope is not None and not isinstance(scope, str):
+            try:
+                scope = " ".join(scope)
+            except Exception as exc:
+                raise InvalidScopeParam(scope) from exc
+
+        if acr_values is not None and not isinstance(acr_values, str):
+            try:
+                acr_values = " ".join(acr_values)
+            except Exception as exc:
+                raise InvalidAcrValuesParam(acr_values) from exc
+
+        data = dict(
+            ciba_kwargs,
+            scope=scope,
+            client_notification_token=client_notification_token,
+            acr_values=acr_values,
+            login_hint_token=login_hint_token,
+            id_token_hint=id_token_hint,
+            login_hint=login_hint,
+            binding_message=binding_message,
+            user_code=user_code,
+            requested_expiry=requested_expiry,
+        )
+
+        if private_jwk is not None:
+            data = {"request": str(Jwt.sign(data, key=private_jwk, alg=alg))}
+
+        return self._request(
+            Endpoints.BACKCHANNEL_AUTHENTICATION,
+            data=data,
+            auth=self.auth,
+            on_success=self.parse_backchannel_authentication_response,
+            on_failure=self.on_backchannel_authentication_error,
+            **requests_kwargs,
+        )
+
+    def parse_backchannel_authentication_response(
+        self,
+        response: requests.Response,
+    ) -> BackChannelAuthenticationResponse:
+        """Parse a response received by `backchannel_authentication_request()`.
+
+        Invoked by
+        [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
+        to parse the response returned by the BackChannel Authentication Endpoint.
+
+        Args:
+            response: the response returned by the BackChannel Authentication Endpoint.
+
+        Returns:
+            a `BackChannelAuthenticationResponse`
+
+        Raises:
+            InvalidBackChannelAuthenticationResponse: if the response does not contain a standard
+                BackChannel Authentication response.
+
+        """
+        try:
+            return BackChannelAuthenticationResponse(**response.json())
+        except TypeError as exc:
+            raise InvalidBackChannelAuthenticationResponse(response=response, client=self) from exc
+
+    def on_backchannel_authentication_error(self, response: requests.Response) -> BackChannelAuthenticationResponse:
+        """Error handler for `backchannel_authentication_request()`.
+
+        Invoked by
+        [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
+        to parse the response returned by the BackChannel Authentication Endpoint, when it is an
+        error.
+
+        Args:
+            response: the response returned by the BackChannel Authentication Endpoint.
+
+        Returns:
+            usually raises an exception. But a subclass can return a default response instead.
+
+        Raises:
+            EndpointError: (or one of its subclasses) if the response contains a standard OAuth 2.0 error.
+            InvalidBackChannelAuthenticationResponse: for non-standard error responses.
+
+        """
+        try:
+            data = response.json()
+            error = data["error"]
+            error_description = data.get("error_description")
+            error_uri = data.get("error_uri")
+            exception_class = self.exception_classes.get(error, BackChannelAuthenticationError)
+            exception = exception_class(
+                response=response,
+                client=self,
+                error=error,
+                description=error_description,
+                uri=error_uri,
+            )
+        except Exception as exc:
+            raise InvalidBackChannelAuthenticationResponse(response=response, client=self) from exc
+        raise exception
+
+    def authorize_device(
+        self,
+        requests_kwargs: dict[str, Any] | None = None,
+        **data: Any,
+    ) -> DeviceAuthorizationResponse:
+        """Send a Device Authorization Request.
+
+        Args:
+            **data: additional data to send to the Device Authorization Endpoint
+            requests_kwargs: additional parameters for `requests.request()`
+
+        Returns:
+            a Device Authorization Response
+
+        Raises:
+            MissingEndpointUri: if the Device Authorization URI is not configured
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        return self._request(
+            Endpoints.DEVICE_AUTHORIZATION,
+            data=data,
+            auth=self.auth,
+            on_success=self.parse_device_authorization_response,
+            on_failure=self.on_device_authorization_error,
+            **requests_kwargs,
+        )
+
+    def parse_device_authorization_response(self, response: requests.Response) -> DeviceAuthorizationResponse:
+        """Parse a Device Authorization Response received by `authorize_device()`.
+
+        Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
+        to parse the response returned by the Device Authorization Endpoint.
+
+        Args:
+            response: the response returned by the Device Authorization Endpoint.
+
+        Returns:
+            a `DeviceAuthorizationResponse` as returned by AS
+
+        """
+        return DeviceAuthorizationResponse(**response.json())
+
+    def on_device_authorization_error(self, response: requests.Response) -> DeviceAuthorizationResponse:
+        """Error handler for `authorize_device()`.
+
+        Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
+        to parse the response returned by the Device Authorization Endpoint, when that response is
+        an error.
+
+        Args:
+            response: the response returned by the Device Authorization Endpoint.
+
+        Returns:
+            usually raises an Exception. But a subclass may return a default response instead.
+
+        Raises:
+            EndpointError: for standard OAuth 2.0 errors
+            InvalidDeviceAuthorizationResponse: for non-standard error responses.
+
+        """
+        try:
+            data = response.json()
+            error = data["error"]
+            error_description = data.get("error_description")
+            error_uri = data.get("error_uri")
+            exception_class = self.exception_classes.get(error, DeviceAuthorizationError)
+            exception = exception_class(
+                response=response,
+                client=self,
+                error=error,
+                description=error_description,
+                uri=error_uri,
+            )
+        except Exception as exc:
+            raise InvalidDeviceAuthorizationResponse(response=response, client=self) from exc
+        raise exception
+
+    def update_authorization_server_public_keys(self, requests_kwargs: dict[str, Any] | None = None) -> JwkSet:
+        """Update the cached AS public keys by retrieving them from its `jwks_uri`.
+
+        Public keys are returned by this method, as a `jwskate.JwkSet`. They are also
+        available in attribute `authorization_server_jwks`.
+
+        Returns:
+            the retrieved public keys
+
+        Raises:
+            ValueError: if no `jwks_uri` is configured
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        jwks = self._request(
+            Endpoints.JWKS,
+            auth=None,
+            method="GET",
+            on_success=lambda resp: resp.json(),
+            on_failure=lambda resp: resp.raise_for_status(),
+            **requests_kwargs,
+        )
+        self.authorization_server_jwks.update(jwks)
+        return self.authorization_server_jwks
+
+    @classmethod
+    def from_discovery_endpoint(
+        cls,
+        url: str | None = None,
+        issuer: str | None = None,
+        *,
+        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_key: Jwk | dict[str, Any] | None = None,
+        session: requests.Session | None = None,
+        testing: bool = False,
+        **kwargs: Any,
+    ) -> OAuth2Client:
+        """Initialise an OAuth2Client based on Authorization Server Metadata.
+
+        This will retrieve the standardised metadata document available at `url`, and will extract
+        all Endpoint Uris from that document, will fetch the current public keys from its
+        `jwks_uri`, then will initialise an OAuth2Client based on those endpoints.
+
+        Args:
+             url: the url where the server metadata will be retrieved
+             auth: the authentication handler to use for client authentication
+             client_id: client ID
+             client_secret: client secret to use to authenticate the client
+             private_key: private key to sign client assertions
+             session: a `requests.Session` to use to retrieve the document and initialise the client with
+             issuer: if an issuer is given, check that it matches the one from the retrieved document
+             testing: if True, don't try to validate the endpoint urls that are part of the document
+             **kwargs: additional keyword parameters to pass to OAuth2Client
+
+        Returns:
+            an OAuth2Client with endpoint initialised based on the obtained metadata
+
+        Raises:
+            InvalidParam: if neither `url` nor `issuer` are suitable urls
+            requests.HTTPError: if an error happens while fetching the documents
+
+        Example:
+            ```python
+            from requests_oauth2client import OAuth2Client
+
+            client = OAuth2Client.from_discovery_endpoint(
+                issuer="https://myserver.net",
+                client_id="my_client_id,
+                client_secret="my_client_secret"
+            )
+            ```
+
+        """
+        if url is None and issuer is not None:
+            url = oidc_discovery_document_url(issuer)
+        if url is None:
+            msg = "Please specify at least one of `issuer` or `url`"
+            raise InvalidParam(msg)
+
+        validate_endpoint_uri(url, path=False)
+
+        session = session or requests.Session()
+        discovery = session.get(url).json()
+
+        jwks_uri = discovery.get("jwks_uri")
+        if jwks_uri:
+            jwks = JwkSet(session.get(jwks_uri).json())
+
+        return cls.from_discovery_document(
+            discovery,
+            issuer=issuer,
+            auth=auth,
+            session=session,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_key=private_key,
+            authorization_server_jwks=jwks,
+            testing=testing,
+            **kwargs,
+        )
+
+    @classmethod
+    def from_discovery_document(
+        cls,
+        discovery: dict[str, Any],
+        issuer: str | None = None,
+        *,
+        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_key: Jwk | dict[str, Any] | None = None,
+        authorization_server_jwks: JwkSet | dict[str, Any] | None = None,
+        session: requests.Session | None = None,
+        https: bool = True,
+        testing: bool = False,
+        **kwargs: Any,
+    ) -> OAuth2Client:
+        """Initialize an OAuth2Client, based on the server metadata from `discovery`.
+
+        Args:
+             discovery: a dict of server metadata, in the same format as retrieved from a discovery endpoint.
+             issuer: if an issuer is given, check that it matches the one mentioned in the document
+             auth: the authentication handler to use for client authentication
+             client_id: client ID
+             client_secret: client secret to use to authenticate the client
+             private_key: private key to sign client assertions
+             authorization_server_jwks: the current authorization server JWKS keys
+             session: a requests Session to use to retrieve the document and initialise the client with
+             https: (deprecated) if `True`, validates that urls in the discovery document use the https scheme
+             testing: if True, don't try to validate the endpoint urls that are part of the document
+             **kwargs: additional args that will be passed to OAuth2Client
+
+        Returns:
+            an `OAuth2Client` initialized with the endpoints from the discovery document
+
+        Raises:
+            InvalidDiscoveryDocument: if the document does not contain at least a `"token_endpoint"`.
+
+        """
+        if not https:
+            warnings.warn(
+                """\
+The https parameter is deprecated.
+To disable endpoint uri validation, set `testing=True` when initializing your `OAuth2Client`.""",
+                stacklevel=1,
+            )
+            testing = True
+        if issuer and discovery.get("issuer") != issuer:
+            msg = (
+                f"Mismatching `issuer` value in discovery document"
+                f" (received '{discovery.get('issuer')}', expected '{issuer}')"
+            )
+            raise InvalidParam(
+                msg,
+                issuer,
+                discovery.get("issuer"),
+            )
+        if issuer is None:
+            issuer = discovery.get("issuer")
+
+        token_endpoint = discovery.get(Endpoints.TOKEN)
+        if token_endpoint is None:
+            msg = "token_endpoint not found in that discovery document"
+            raise InvalidDiscoveryDocument(msg, discovery)
+        authorization_endpoint = discovery.get(Endpoints.AUTHORIZATION)
+        revocation_endpoint = discovery.get(Endpoints.REVOCATION)
+        introspection_endpoint = discovery.get(Endpoints.INSTROSPECTION)
+        userinfo_endpoint = discovery.get(Endpoints.USER_INFO)
+        jwks_uri = discovery.get(Endpoints.JWKS)
+        if jwks_uri is not None:
+            validate_endpoint_uri(jwks_uri, https=https)
+        authorization_response_iss_parameter_supported = discovery.get(
+            "authorization_response_iss_parameter_supported",
+            False,
+        )
+
+        return cls(
+            token_endpoint=token_endpoint,
+            authorization_endpoint=authorization_endpoint,
+            revocation_endpoint=revocation_endpoint,
+            introspection_endpoint=introspection_endpoint,
+            userinfo_endpoint=userinfo_endpoint,
+            jwks_uri=jwks_uri,
+            authorization_server_jwks=authorization_server_jwks,
+            auth=auth,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_key=private_key,
+            session=session,
+            issuer=issuer,
+            authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
+            testing=testing,
+            **kwargs,
+        )
+
+    def __enter__(self) -> Self:
+        """Allow using `OAuth2Client` as a context-manager.
+
+        The Authorization Server public keys are retrieved on `__enter__`.
+
+        """
+        self.update_authorization_server_public_keys()
+        return self
+
+    def __exit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
+    ) -> bool:
+        return True
+
+    def _require_endpoint(self, endpoint: str) -> str:
+        """Check that a required endpoint url is set."""
+        url = getattr(self, endpoint, None)
+        if not url:
+            raise MissingEndpointUri(endpoint)
+
+        return str(url)
+
+
+ + + +
+ + + + + + + +
+ + + +
+ client_id: str + + + property + + +
+ + +
+ +

Client ID.

+
+ +
+ +
+ + + +
+ client_secret: str | None + + + property + + +
+ + +
+ +

Client Secret.

+
+ +
+ +
+ + + +
+ client_jwks: JwkSet + + + property + + +
+ + +
+ +

A JwkSet containing the public keys for this client.

+

Keys are:

+
    +
  • the public key for client assertion signature verification (if using private_key_jwt)
    • +
  • the ID Token encryption key
    • +
+
+ +
+ + + +
+ + +
+ validate_endpoint_uri(attribute, uri) + +
+ + +
+ +

Validate that an endpoint URI is suitable for use.

+

If you need to disable some checks (for AS testing purposes only!), provide a different +method here.

+ +
+ Source code in requests_oauth2client/client.py + 
409
+410
+411
+412
+413
+414
+415
+416
+417
+418
+419
+420
+421
+422
+423
+424
+425
+426
+427
+428
+429
+430
@token_endpoint.validator
+@revocation_endpoint.validator
+@introspection_endpoint.validator
+@userinfo_endpoint.validator
+@authorization_endpoint.validator
+@backchannel_authentication_endpoint.validator
+@device_authorization_endpoint.validator
+@pushed_authorization_request_endpoint.validator
+@jwks_uri.validator
+def validate_endpoint_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
+    """Validate that an endpoint URI is suitable for use.
+
+    If you need to disable some checks (for AS testing purposes only!), provide a different
+    method here.
+
+    """
+    if self.testing or uri is None:
+        return uri
+    try:
+        return validate_endpoint_uri(uri)
+    except InvalidUri as exc:
+        raise InvalidEndpointUri(endpoint=attribute.name, uri=uri, exc=exc) from exc
+
+
+
+ +
+ +
+ + +
+ validate_issuer_uri(attribute, uri) + +
+ + +
+ +

Validate that an Issuer identifier is suitable for use.

+

This is the same check as an endpoint URI, but the path may be (and usually is) empty.

+ +
+ Source code in requests_oauth2client/client.py + 
432
+433
+434
+435
+436
+437
+438
+439
+440
+441
+442
+443
+444
@issuer.validator
+def validate_issuer_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
+    """Validate that an Issuer identifier is suitable for use.
+
+    This is the same check as an endpoint URI, but the path may be (and usually is) empty.
+
+    """
+    if self.testing or uri is None:
+        return uri
+    try:
+        return validate_issuer_uri(uri)
+    except InvalidUri as exc:
+        raise InvalidIssuer(attribute.name, uri, exc) from exc
+
+
+
+ +
+ +
+ + +
+ token_request(data, timeout=10, **requests_kwargs) + +
+ + +
+ +

Send a request to the token endpoint.

+

Authentication will be added automatically based on the defined auth for this client.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
data + dict[str, Any] + +
+

parameters to send to the token endpoint. Items with a None + or empty value will not be sent in the request.

+
+ 		+ required +
timeout + int + +
+

a timeout value for the call

+
+ 		+ 10 +
**requests_kwargs + Any + +
+

additional parameters for requests.post()

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

the token endpoint response, as

+
+
+ BearerToken + +
+

BearerToken instance.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
521
+522
+523
+524
+525
+526
+527
+528
+529
+530
+531
+532
+533
+534
+535
+536
+537
+538
+539
+540
+541
+542
+543
+544
+545
+546
+547
+548
+549
+550
def token_request(
+    self,
+    data: dict[str, Any],
+    timeout: int = 10,
+    **requests_kwargs: Any,
+) -> BearerToken:
+    """Send a request to the token endpoint.
+
+    Authentication will be added automatically based on the defined `auth` for this client.
+
+    Args:
+      data: parameters to send to the token endpoint. Items with a `None`
+           or empty value will not be sent in the request.
+      timeout: a timeout value for the call
+      **requests_kwargs: additional parameters for requests.post()
+
+    Returns:
+        the token endpoint response, as
+        [`BearerToken`][requests_oauth2client.tokens.BearerToken] instance.
+
+    """
+    return self._request(
+        Endpoints.TOKEN,
+        auth=self.auth,
+        data=data,
+        timeout=timeout,
+        on_success=self.parse_token_response,
+        on_failure=self.on_token_error,
+        **requests_kwargs,
+    )
+
+
+
+ +
+ +
+ + +
+ parse_token_response(response) + +
+ + +
+ +

Parse a Response returned by the Token Endpoint.

+

Invoked by token_request to parse +responses returned by the Token Endpoint. Those responses contain an access_token and +additional attributes.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the Response returned by the Token Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken based on the response

+
+
+ BearerToken + +
+

contents.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
552
+553
+554
+555
+556
+557
+558
+559
+560
+561
+562
+563
+564
+565
+566
+567
+568
+569
+570
+571
+572
def parse_token_response(self, response: requests.Response) -> BearerToken:
+    """Parse a Response returned by the Token Endpoint.
+
+    Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] to parse
+    responses returned by the Token Endpoint. Those responses contain an `access_token` and
+    additional attributes.
+
+    Args:
+        response: the [Response][requests.Response] returned by the Token Endpoint.
+
+    Returns:
+        a [`BearerToken`][requests_oauth2client.tokens.BearerToken] based on the response
+        contents.
+
+    """
+    try:
+        token_response = self.token_class(**response.json())
+    except Exception:  # noqa: BLE001
+        return self.on_token_error(response)
+    else:
+        return token_response
+
+
+
+ +
+ +
+ + +
+ on_token_error(response) + +
+ + +
+ +

Error handler for token_request().

+

Invoked by token_request when the +Token Endpoint returns an error.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the Response returned by the Token Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

nothing, and raises an exception instead. But a subclass may return a

+
+
+ BearerToken + +
+

BearerToken to implement a default

+
+
+ BearerToken + +
+

behaviour if needed.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ InvalidTokenResponse + +
+

if the error response does not contain an OAuth 2.0 standard +error response.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
574
+575
+576
+577
+578
+579
+580
+581
+582
+583
+584
+585
+586
+587
+588
+589
+590
+591
+592
+593
+594
+595
+596
+597
+598
+599
+600
+601
+602
+603
+604
+605
+606
+607
+608
def on_token_error(self, response: requests.Response) -> BearerToken:
+    """Error handler for `token_request()`.
+
+    Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] when the
+    Token Endpoint returns an error.
+
+    Args:
+        response: the [Response][requests.Response] returned by the Token Endpoint.
+
+    Returns:
+        nothing, and raises an exception instead. But a subclass may return a
+        [`BearerToken`][requests_oauth2client.tokens.BearerToken] to implement a default
+        behaviour if needed.
+
+    Raises:
+        InvalidTokenResponse: if the error response does not contain an OAuth 2.0 standard
+            error response.
+
+    """
+    try:
+        data = response.json()
+        error = data["error"]
+        error_description = data.get("error_description")
+        error_uri = data.get("error_uri")
+        exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
+        exception = exception_class(
+            response=response,
+            client=self,
+            error=error,
+            description=error_description,
+            uri=error_uri,
+        )
+    except Exception as exc:
+        raise InvalidTokenResponse(response=response, client=self) from exc
+    raise exception
+
+
+
+ +
+ +
+ + +
+ client_credentials(scope=None, *, requests_kwargs=None, **token_kwargs) + +
+ + +
+ +

Send a request to the token endpoint using the client_credentials grant.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
scope + str | Iterable[str] | None + +
+

the scope to send with the request. Can be a str, or an iterable of str. +to pass that way include scope, audience, resource, etc.

+
+ 		+ None +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters for the call to requests

+
+ 		+ None +
**token_kwargs + Any + +
+

additional parameters for the token endpoint, alongside grant_type. Common parameters

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ InvalidScopeParam + +
+

if the scope parameter is not suitable

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
610
+611
+612
+613
+614
+615
+616
+617
+618
+619
+620
+621
+622
+623
+624
+625
+626
+627
+628
+629
+630
+631
+632
+633
+634
+635
+636
+637
+638
+639
+640
+641
def client_credentials(
+    self,
+    scope: str | Iterable[str] | None = None,
+    *,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a request to the token endpoint using the `client_credentials` grant.
+
+    Args:
+        scope: the scope to send with the request. Can be a str, or an iterable of str.
+            to pass that way include `scope`, `audience`, `resource`, etc.
+        requests_kwargs: additional parameters for the call to requests
+        **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`. Common parameters
+
+    Returns:
+        a BearerToken
+
+    Raises:
+        InvalidScopeParam: if the `scope` parameter is not suitable
+
+    """
+    requests_kwargs = requests_kwargs or {}
+
+    if scope and not isinstance(scope, str):
+        try:
+            scope = " ".join(scope)
+        except Exception as exc:
+            raise InvalidScopeParam(scope) from exc
+
+    data = dict(grant_type=GrantTypes.CLIENT_CREDENTIALS, scope=scope, **token_kwargs)
+    return self.token_request(data, **requests_kwargs)
+
+
+
+ +
+ +
+ + +
+ authorization_code(code, *, validate=True, requests_kwargs=None, **token_kwargs) + +
+ + +
+ +

Send a request to the token endpoint with the authorization_code grant.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
code + str | AuthorizationResponse + +
+

an authorization code or an AuthorizationResponse to exchange for tokens

+
+ 		+ required +
validate + bool + +
+

if True, validate the received ID Token (this works only if code is an AuthorizationResponse)

+
+ 		+ True +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters for the call to requests

+
+ 		+ None +
**token_kwargs + Any + +
+

additional parameters for the token endpoint, alongside grant_type, code, etc.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
643
+644
+645
+646
+647
+648
+649
+650
+651
+652
+653
+654
+655
+656
+657
+658
+659
+660
+661
+662
+663
+664
+665
+666
+667
+668
+669
+670
+671
+672
+673
+674
+675
+676
def authorization_code(
+    self,
+    code: str | AuthorizationResponse,
+    *,
+    validate: bool = True,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a request to the token endpoint with the `authorization_code` grant.
+
+    Args:
+         code: an authorization code or an `AuthorizationResponse` to exchange for tokens
+         validate: if `True`, validate the received ID Token (this works only if `code` is an AuthorizationResponse)
+         requests_kwargs: additional parameters for the call to requests
+         **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `code`, etc.
+
+    Returns:
+        a `BearerToken`
+
+    """
+    azr: AuthorizationResponse | None = None
+    if isinstance(code, AuthorizationResponse):
+        token_kwargs.setdefault("code_verifier", code.code_verifier)
+        token_kwargs.setdefault("redirect_uri", code.redirect_uri)
+        azr = code
+        code = code.code
+
+    requests_kwargs = requests_kwargs or {}
+
+    data = dict(grant_type=GrantTypes.AUTHORIZATION_CODE, code=code, **token_kwargs)
+    token = self.token_request(data, **requests_kwargs)
+    if validate and token.id_token and isinstance(azr, AuthorizationResponse):
+        return token.validate_id_token(self, azr)
+    return token
+
+
+
+ +
+ +
+ + +
+ refresh_token(refresh_token, requests_kwargs=None, **token_kwargs) + +
+ + +
+ +

Send a request to the token endpoint with the refresh_token grant.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
refresh_token + str | BearerToken + +
+

a refresh_token, as a string, or as a BearerToken. +That BearerToken must have a refresh_token.

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters for the call to requests

+
+ 		+ None +
**token_kwargs + Any + +
+

additional parameters for the token endpoint, +alongside grant_type, refresh_token, etc.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ MissingRefreshToken + +
+

if refresh_token is a BearerToken instance but does not +contain a refresh_token

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
678
+679
+680
+681
+682
+683
+684
+685
+686
+687
+688
+689
+690
+691
+692
+693
+694
+695
+696
+697
+698
+699
+700
+701
+702
+703
+704
+705
+706
+707
+708
def refresh_token(
+    self,
+    refresh_token: str | BearerToken,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a request to the token endpoint with the `refresh_token` grant.
+
+    Args:
+        refresh_token: a refresh_token, as a string, or as a `BearerToken`.
+            That `BearerToken` must have a `refresh_token`.
+        requests_kwargs: additional parameters for the call to `requests`
+        **token_kwargs: additional parameters for the token endpoint,
+            alongside `grant_type`, `refresh_token`, etc.
+
+    Returns:
+        a `BearerToken`
+
+    Raises:
+        MissingRefreshToken: if `refresh_token` is a BearerToken instance but does not
+            contain a `refresh_token`
+
+    """
+    if isinstance(refresh_token, BearerToken):
+        if refresh_token.refresh_token is None or not isinstance(refresh_token.refresh_token, str):
+            raise MissingRefreshToken(refresh_token)
+        refresh_token = refresh_token.refresh_token
+
+    requests_kwargs = requests_kwargs or {}
+    data = dict(grant_type=GrantTypes.REFRESH_TOKEN, refresh_token=refresh_token, **token_kwargs)
+    return self.token_request(data, **requests_kwargs)
+
+
+
+ +
+ +
+ + +
+ device_code(device_code, requests_kwargs=None, **token_kwargs) + +
+ + +
+ +

Send a request to the token endpoint using the Device Code grant.

+

The grant_type is urn:ietf:params:oauth:grant-type:device_code. This needs a Device Code, +or a DeviceAuthorizationResponse as parameter.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
device_code + str | DeviceAuthorizationResponse + +
+

a device code, or a DeviceAuthorizationResponse

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters for the call to requests

+
+ 		+ None +
**token_kwargs + Any + +
+

additional parameters for the token endpoint, alongside grant_type, device_code, etc.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ MissingDeviceCode + +
+

if device_code is a DeviceAuthorizationResponse but does not +contain a device_code.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
710
+711
+712
+713
+714
+715
+716
+717
+718
+719
+720
+721
+722
+723
+724
+725
+726
+727
+728
+729
+730
+731
+732
+733
+734
+735
+736
+737
+738
+739
+740
+741
+742
+743
+744
+745
def device_code(
+    self,
+    device_code: str | DeviceAuthorizationResponse,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a request to the token endpoint using the Device Code grant.
+
+    The grant_type is `urn:ietf:params:oauth:grant-type:device_code`. This needs a Device Code,
+    or a `DeviceAuthorizationResponse` as parameter.
+
+    Args:
+        device_code: a device code, or a `DeviceAuthorizationResponse`
+        requests_kwargs: additional parameters for the call to requests
+        **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `device_code`, etc.
+
+    Returns:
+        a `BearerToken`
+
+    Raises:
+        MissingDeviceCode: if `device_code` is a DeviceAuthorizationResponse but does not
+            contain a `device_code`.
+
+    """
+    if isinstance(device_code, DeviceAuthorizationResponse):
+        if device_code.device_code is None or not isinstance(device_code.device_code, str):
+            raise MissingDeviceCode(device_code)
+        device_code = device_code.device_code
+
+    requests_kwargs = requests_kwargs or {}
+    data = dict(
+        grant_type=GrantTypes.DEVICE_CODE,
+        device_code=device_code,
+        **token_kwargs,
+    )
+    return self.token_request(data, **requests_kwargs)
+
+
+
+ +
+ +
+ + +
+ ciba(auth_req_id, requests_kwargs=None, **token_kwargs) + +
+ + +
+ +

Send a CIBA request to the Token Endpoint.

+

A CIBA request is a Token Request using the urn:openid:params:grant-type:ciba grant.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
auth_req_id + str | BackChannelAuthenticationResponse + +
+

an authentication request ID, as returned by the AS

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters for the call to requests

+
+ 		+ None +
**token_kwargs + Any + +
+

additional parameters for the token endpoint, alongside grant_type, auth_req_id, etc.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ MissingAuthRequestId + +
+

if auth_req_id is a BackChannelAuthenticationResponse but does not contain +an auth_req_id.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
747
+748
+749
+750
+751
+752
+753
+754
+755
+756
+757
+758
+759
+760
+761
+762
+763
+764
+765
+766
+767
+768
+769
+770
+771
+772
+773
+774
+775
+776
+777
+778
+779
+780
+781
def ciba(
+    self,
+    auth_req_id: str | BackChannelAuthenticationResponse,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a CIBA request to the Token Endpoint.
+
+    A CIBA request is a Token Request using the `urn:openid:params:grant-type:ciba` grant.
+
+    Args:
+        auth_req_id: an authentication request ID, as returned by the AS
+        requests_kwargs: additional parameters for the call to requests
+        **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `auth_req_id`, etc.
+
+    Returns:
+        a `BearerToken`
+
+    Raises:
+        MissingAuthRequestId: if `auth_req_id` is a BackChannelAuthenticationResponse but does not contain
+            an `auth_req_id`.
+
+    """
+    if isinstance(auth_req_id, BackChannelAuthenticationResponse):
+        if auth_req_id.auth_req_id is None or not isinstance(auth_req_id.auth_req_id, str):
+            raise MissingAuthRequestId(auth_req_id)
+        auth_req_id = auth_req_id.auth_req_id
+
+    requests_kwargs = requests_kwargs or {}
+    data = dict(
+        grant_type=GrantTypes.CLIENT_INITIATED_BACKCHANNEL_AUTHENTICATION,
+        auth_req_id=auth_req_id,
+        **token_kwargs,
+    )
+    return self.token_request(data, **requests_kwargs)
+
+
+
+ +
+ +
+ + +
+ token_exchange(subject_token, subject_token_type=None, actor_token=None, actor_token_type=None, requested_token_type=None, requests_kwargs=None, **token_kwargs) + +
+ + +
+ +

Send a Token Exchange request.

+

A Token Exchange request is actually a request to the Token Endpoint with a grant_type +urn:ietf:params:oauth:grant-type:token-exchange.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
subject_token + str | BearerToken | IdToken + +
+

the subject token to exchange for a new token.

+
+ 		+ required +
subject_token_type + str | None + +
+

a token type identifier for the subject_token, mandatory if it cannot be guessed based +on type(subject_token).

+
+ 		+ None +
actor_token + None | str | BearerToken | IdToken + +
+

the actor token to include in the request, if any.

+
+ 		+ None +
actor_token_type + str | None + +
+

a token type identifier for the actor_token, mandatory if it cannot be guessed based +on type(actor_token).

+
+ 		+ None +
requested_token_type + str | None + +
+

a token type identifier for the requested token.

+
+ 		+ None +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters to pass to the underlying requests.post() call.

+
+ 		+ None +
**token_kwargs + Any + +
+

additional parameters to include in the request body.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken as returned by the Authorization Server.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ UnknownSubjectTokenType + +
+

if the type of subject_token cannot be determined automatically.

+
+
+ UnknownActorTokenType + +
+

if the type of actor_token cannot be determined automaticatlly.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
783
+784
+785
+786
+787
+788
+789
+790
+791
+792
+793
+794
+795
+796
+797
+798
+799
+800
+801
+802
+803
+804
+805
+806
+807
+808
+809
+810
+811
+812
+813
+814
+815
+816
+817
+818
+819
+820
+821
+822
+823
+824
+825
+826
+827
+828
+829
+830
+831
+832
+833
+834
+835
+836
+837
+838
def token_exchange(
+    self,
+    subject_token: str | BearerToken | IdToken,
+    subject_token_type: str | None = None,
+    actor_token: None | str | BearerToken | IdToken = None,
+    actor_token_type: str | None = None,
+    requested_token_type: str | None = None,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a Token Exchange request.
+
+    A Token Exchange request is actually a request to the Token Endpoint with a grant_type
+    `urn:ietf:params:oauth:grant-type:token-exchange`.
+
+    Args:
+        subject_token: the subject token to exchange for a new token.
+        subject_token_type: a token type identifier for the subject_token, mandatory if it cannot be guessed based
+            on `type(subject_token)`.
+        actor_token: the actor token to include in the request, if any.
+        actor_token_type: a token type identifier for the actor_token, mandatory if it cannot be guessed based
+            on `type(actor_token)`.
+        requested_token_type: a token type identifier for the requested token.
+        requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
+        **token_kwargs: additional parameters to include in the request body.
+
+    Returns:
+        a `BearerToken` as returned by the Authorization Server.
+
+    Raises:
+        UnknownSubjectTokenType: if the type of `subject_token` cannot be determined automatically.
+        UnknownActorTokenType: if the type of `actor_token` cannot be determined automaticatlly.
+
+    """
+    requests_kwargs = requests_kwargs or {}
+
+    try:
+        subject_token_type = self.get_token_type(subject_token_type, subject_token)
+    except ValueError as exc:
+        raise UnknownSubjectTokenType(subject_token, subject_token_type) from exc
+    if actor_token:  # pragma: no branch
+        try:
+            actor_token_type = self.get_token_type(actor_token_type, actor_token)
+        except ValueError as exc:
+            raise UnknownActorTokenType(actor_token, actor_token_type) from exc
+
+    data = dict(
+        grant_type=GrantTypes.TOKEN_EXCHANGE,
+        subject_token=subject_token,
+        subject_token_type=subject_token_type,
+        actor_token=actor_token,
+        actor_token_type=actor_token_type,
+        requested_token_type=requested_token_type,
+        **token_kwargs,
+    )
+    return self.token_request(data, **requests_kwargs)
+
+
+
+ +
+ +
+ + +
+ jwt_bearer(assertion, requests_kwargs=None, **token_kwargs) + +
+ + +
+ +

Send a request using a JWT as authorization grant.

+

This is defined in (RFC7523 $2.1)[https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1).

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
assertion + Jwt | str + +
+

a JWT (as an instance of jwskate.Jwt or as a str) to use as authorization grant.

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters to pass to the underlying requests.post() call.

+
+ 		+ None +
**token_kwargs + Any + +
+

additional parameters to include in the request body.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken as returned by the Authorization Server.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
840
+841
+842
+843
+844
+845
+846
+847
+848
+849
+850
+851
+852
+853
+854
+855
+856
+857
+858
+859
+860
+861
+862
+863
+864
+865
+866
+867
+868
+869
+870
def jwt_bearer(
+    self,
+    assertion: Jwt | str,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a request using a JWT as authorization grant.
+
+    This is defined in (RFC7523 $2.1)[https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1).
+
+    Args:
+        assertion: a JWT (as an instance of `jwskate.Jwt` or as a `str`) to use as authorization grant.
+        requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
+        **token_kwargs: additional parameters to include in the request body.
+
+    Returns:
+        a `BearerToken` as returned by the Authorization Server.
+
+    """
+    requests_kwargs = requests_kwargs or {}
+
+    if not isinstance(assertion, Jwt):
+        assertion = Jwt(assertion)
+
+    data = dict(
+        grant_type=GrantTypes.JWT_BEARER,
+        assertion=assertion,
+        **token_kwargs,
+    )
+
+    return self.token_request(data, **requests_kwargs)
+
+
+
+ +
+ +
+ + +
+ resource_owner_password(username, password, requests_kwargs=None, **token_kwargs) + +
+ + +
+ +

Send a request using the Resource Owner Password Grant.

+

This Grant Type is deprecated and should only be used when there is no other choice.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
username + str + +
+

the resource owner user name

+
+ 		+ required +
password + str + +
+

the resource owner password

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters to pass to the underlying requests.post() call.

+
+ 		+ None +
**token_kwargs + Any + +
+

additional parameters to include in the request body.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken as returned by the Authorization Server

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
872
+873
+874
+875
+876
+877
+878
+879
+880
+881
+882
+883
+884
+885
+886
+887
+888
+889
+890
+891
+892
+893
+894
+895
+896
+897
+898
+899
+900
+901
def resource_owner_password(
+    self,
+    username: str,
+    password: str,
+    requests_kwargs: dict[str, Any] | None = None,
+    **token_kwargs: Any,
+) -> BearerToken:
+    """Send a request using the Resource Owner Password Grant.
+
+    This Grant Type is deprecated and should only be used when there is no other choice.
+
+    Args:
+        username: the resource owner user name
+        password: the resource owner password
+        requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
+        **token_kwargs: additional parameters to include in the request body.
+
+    Returns:
+        a `BearerToken` as returned by the Authorization Server
+
+    """
+    requests_kwargs = requests_kwargs or {}
+    data = dict(
+        grant_type=GrantTypes.RESOURCE_OWNER_PASSWORD,
+        username=username,
+        password=password,
+        **token_kwargs,
+    )
+
+    return self.token_request(data, **requests_kwargs)
+
+
+
+ +
+ +
+ + +
+ authorization_request(*, scope='openid', response_type=ResponseTypes.CODE, redirect_uri=None, state=..., nonce=..., code_verifier=None, **kwargs) + +
+ + +
+ +

Generate an Authorization Request for this client.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
scope + None | str | Iterable[str] + +
+

the scope to use

+
+ 		+ 'openid' +
response_type + str + +
+

the response_type to use

+
+ 		+ CODE +
redirect_uri + str | None + +
+

the redirect_uri to include in the request. By default, +the redirect_uri defined at init time is used.

+
+ 		+ None +
state + str | ellipsis | None + +
+

the state parameter to use. Leave default to generate a random value.

+
+ 		+ ... +
nonce + str | ellipsis | None + +
+

a nonce. Leave default to generate a random value.

+
+ 		+ ... +
code_verifier + str | None + +
+

the PKCE code_verifier to use. Leave default to generate a random value.

+
+ 		+ None +
**kwargs + Any + +
+

additional parameters to include in the auth request

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ AuthorizationRequest + +
+

an AuthorizationRequest with the supplied parameters

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
903
+904
+905
+906
+907
+908
+909
+910
+911
+912
+913
+914
+915
+916
+917
+918
+919
+920
+921
+922
+923
+924
+925
+926
+927
+928
+929
+930
+931
+932
+933
+934
+935
+936
+937
+938
+939
+940
+941
+942
+943
+944
+945
+946
def authorization_request(
+    self,
+    *,
+    scope: None | str | Iterable[str] = "openid",
+    response_type: str = ResponseTypes.CODE,
+    redirect_uri: str | None = None,
+    state: str | ellipsis | None = ...,  # noqa: F821
+    nonce: str | ellipsis | None = ...,  # noqa: F821
+    code_verifier: str | None = None,
+    **kwargs: Any,
+) -> AuthorizationRequest:
+    """Generate an Authorization Request for this client.
+
+    Args:
+        scope: the `scope` to use
+        response_type: the `response_type` to use
+        redirect_uri: the `redirect_uri` to include in the request. By default,
+            the `redirect_uri` defined at init time is used.
+        state: the `state` parameter to use. Leave default to generate a random value.
+        nonce: a `nonce`. Leave default to generate a random value.
+        code_verifier: the PKCE `code_verifier` to use. Leave default to generate a random value.
+        **kwargs: additional parameters to include in the auth request
+
+    Returns:
+        an AuthorizationRequest with the supplied parameters
+
+    """
+    authorization_endpoint = self._require_endpoint("authorization_endpoint")
+
+    redirect_uri = redirect_uri or self.redirect_uri
+
+    return AuthorizationRequest(
+        authorization_endpoint=authorization_endpoint,
+        client_id=self.client_id,
+        redirect_uri=redirect_uri,
+        issuer=self.issuer,
+        response_type=response_type,
+        scope=scope,
+        state=state,
+        nonce=nonce,
+        code_verifier=code_verifier,
+        code_challenge_method=self.code_challenge_method,
+        **kwargs,
+    )
+
+
+
+ +
+ +
+ + +
+ pushed_authorization_request(authorization_request, requests_kwargs=None) + +
+ + +
+ +

Send a Pushed Authorization Request.

+

This sends a request to the Pushed Authorization Request Endpoint, and returns a +RequestUriParameterAuthorizationRequest initialized with the AS response.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
authorization_request + AuthorizationRequest + +
+

the authorization request to send

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters for requests.request()

+
+ 		+ None +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ RequestUriParameterAuthorizationRequest + +
+

the RequestUriParameterAuthorizationRequest initialized based on the AS response

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
948
+949
+950
+951
+952
+953
+954
+955
+956
+957
+958
+959
+960
+961
+962
+963
+964
+965
+966
+967
+968
+969
+970
+971
+972
+973
+974
def pushed_authorization_request(
+    self,
+    authorization_request: AuthorizationRequest,
+    requests_kwargs: dict[str, Any] | None = None,
+) -> RequestUriParameterAuthorizationRequest:
+    """Send a Pushed Authorization Request.
+
+    This sends a request to the Pushed Authorization Request Endpoint, and returns a
+    `RequestUriParameterAuthorizationRequest` initialized with the AS response.
+
+    Args:
+        authorization_request: the authorization request to send
+        requests_kwargs: additional parameters for `requests.request()`
+
+    Returns:
+        the `RequestUriParameterAuthorizationRequest` initialized based on the AS response
+
+    """
+    requests_kwargs = requests_kwargs or {}
+    return self._request(
+        Endpoints.PUSHED_AUTHORIZATION_REQUEST,
+        data=authorization_request.args,
+        auth=self.auth,
+        on_success=self.parse_pushed_authorization_response,
+        on_failure=self.on_pushed_authorization_request_error,
+        **requests_kwargs,
+    )
+
+
+
+ +
+ +
+ + +
+ parse_pushed_authorization_response(response) + +
+ + +
+ +

Parse the response obtained by pushed_authorization_request().

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the requests.Response returned by the PAR endpoint

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ RequestUriParameterAuthorizationRequest + +
+

a RequestUriParameterAuthorizationRequest instance

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
976
+977
+978
+979
+980
+981
+982
+983
+984
+985
+986
+987
+988
+989
+990
+991
+992
+993
+994
+995
+996
+997
+998
def parse_pushed_authorization_response(
+    self,
+    response: requests.Response,
+) -> RequestUriParameterAuthorizationRequest:
+    """Parse the response obtained by `pushed_authorization_request()`.
+
+    Args:
+        response: the `requests.Response` returned by the PAR endpoint
+
+    Returns:
+        a RequestUriParameterAuthorizationRequest instance
+
+    """
+    response_json = response.json()
+    request_uri = response_json.get("request_uri")
+    expires_in = response_json.get("expires_in")
+
+    return RequestUriParameterAuthorizationRequest(
+        authorization_endpoint=self.authorization_endpoint,
+        client_id=self.client_id,
+        request_uri=request_uri,
+        expires_in=expires_in,
+    )
+
+
+
+ +
+ +
+ + +
+ on_pushed_authorization_request_error(response) + +
+ + +
+ +

Error Handler for Pushed Authorization Endpoint errors.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the HTTP response as returned by the AS PAR endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ RequestUriParameterAuthorizationRequest + +
+

a RequestUriParameterAuthorizationRequest, if the error is recoverable

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + + + + + +
TypeDescription
+ EndpointError + +
+

a subclass of this error depending on the error returned by the AS

+
+
+ InvalidPushedAuthorizationResponse + +
+

if the returned response is not following the +specifications

+
+
+ UnknownTokenEndpointError + +
+

for unknown/unhandled errors

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1000
+1001
+1002
+1003
+1004
+1005
+1006
+1007
+1008
+1009
+1010
+1011
+1012
+1013
+1014
+1015
+1016
+1017
+1018
+1019
+1020
+1021
+1022
+1023
+1024
+1025
+1026
+1027
+1028
+1029
+1030
+1031
+1032
+1033
+1034
def on_pushed_authorization_request_error(
+    self,
+    response: requests.Response,
+) -> RequestUriParameterAuthorizationRequest:
+    """Error Handler for Pushed Authorization Endpoint errors.
+
+    Args:
+        response: the HTTP response as returned by the AS PAR endpoint.
+
+    Returns:
+        a RequestUriParameterAuthorizationRequest, if the error is recoverable
+
+    Raises:
+        EndpointError: a subclass of this error depending on the error returned by the AS
+        InvalidPushedAuthorizationResponse: if the returned response is not following the
+            specifications
+        UnknownTokenEndpointError: for unknown/unhandled errors
+
+    """
+    try:
+        data = response.json()
+        error = data["error"]
+        error_description = data.get("error_description")
+        error_uri = data.get("error_uri")
+        exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
+        exception = exception_class(
+            response=response,
+            client=self,
+            error=error,
+            description=error_description,
+            uri=error_uri,
+        )
+    except Exception as exc:
+        raise InvalidPushedAuthorizationResponse(response=response, client=self) from exc
+    raise exception
+
+
+
+ +
+ +
+ + +
+ userinfo(access_token) + +
+ + +
+ +

Call the UserInfo endpoint.

+

This sends a request to the UserInfo endpoint, with the specified access_token, and returns +the parsed result.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
access_token + BearerToken | str + +
+

the access token to use

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Any + +
+

the Response returned by the userinfo endpoint.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1036
+1037
+1038
+1039
+1040
+1041
+1042
+1043
+1044
+1045
+1046
+1047
+1048
+1049
+1050
+1051
+1052
+1053
+1054
+1055
+1056
def userinfo(self, access_token: BearerToken | str) -> Any:
+    """Call the UserInfo endpoint.
+
+    This sends a request to the UserInfo endpoint, with the specified access_token, and returns
+    the parsed result.
+
+    Args:
+        access_token: the access token to use
+
+    Returns:
+        the [Response][requests.Response] returned by the userinfo endpoint.
+
+    """
+    if isinstance(access_token, str):
+        access_token = BearerToken(access_token)
+    return self._request(
+        Endpoints.USER_INFO,
+        auth=access_token,
+        on_success=self.parse_userinfo_response,
+        on_failure=self.on_userinfo_error,
+    )
+
+
+
+ +
+ +
+ + +
+ parse_userinfo_response(resp) + +
+ + +
+ +

Parse the response obtained by userinfo().

+

Invoked by userinfo() to parse the +response from the UserInfo endpoint, this will extract and return its JSON content.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
resp + Response + +
+

a Response returned from the UserInfo endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Any + +
+

the parsed JSON content from this response.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1058
+1059
+1060
+1061
+1062
+1063
+1064
+1065
+1066
+1067
+1068
+1069
+1070
+1071
def parse_userinfo_response(self, resp: requests.Response) -> Any:
+    """Parse the response obtained by `userinfo()`.
+
+    Invoked by [userinfo()][requests_oauth2client.client.OAuth2Client.userinfo] to parse the
+    response from the UserInfo endpoint, this will extract and return its JSON content.
+
+    Args:
+        resp: a [Response][requests.Response] returned from the UserInfo endpoint.
+
+    Returns:
+        the parsed JSON content from this response.
+
+    """
+    return resp.json()
+
+
+
+ +
+ +
+ + +
+ on_userinfo_error(resp) + +
+ + +
+ +

Parse UserInfo error response.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
resp + Response + +
+

a Response returned from the UserInfo endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Any + +
+

nothing, raises exception instead.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1073
+1074
+1075
+1076
+1077
+1078
+1079
+1080
+1081
+1082
+1083
def on_userinfo_error(self, resp: requests.Response) -> Any:
+    """Parse UserInfo error response.
+
+    Args:
+        resp: a [Response][requests.Response] returned from the UserInfo endpoint.
+
+    Returns:
+        nothing, raises exception instead.
+
+    """
+    resp.raise_for_status()
+
+
+
+ +
+ +
+ + +
+ get_token_type(token_type=None, token=None) + + + classmethod + + +
+ + +
+ +

Get standardized token type identifiers.

+

Return a standardized token type identifier, based on a short token_type hint and/or a +token value.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
token_type + str | None + +
+

a token_type hint, as str. May be "access_token", "refresh_token" +or "id_token"

+
+ 		+ None +
token + None | str | BearerToken | IdToken + +
+

a token value, as an instance of BearerToken or IdToken, or as a str.

+
+ 		+ None +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the token_type as defined in the Token Exchange RFC8693.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ UnknownTokenType + +
+

if the type of token cannot be determined

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1085
+1086
+1087
+1088
+1089
+1090
+1091
+1092
+1093
+1094
+1095
+1096
+1097
+1098
+1099
+1100
+1101
+1102
+1103
+1104
+1105
+1106
+1107
+1108
+1109
+1110
+1111
+1112
+1113
+1114
+1115
+1116
+1117
+1118
+1119
+1120
+1121
+1122
+1123
+1124
+1125
+1126
+1127
+1128
+1129
+1130
+1131
+1132
+1133
+1134
+1135
+1136
+1137
+1138
+1139
+1140
+1141
+1142
+1143
+1144
+1145
+1146
+1147
+1148
+1149
+1150
+1151
+1152
+1153
    @classmethod
+    def get_token_type(  # noqa: C901
+        cls,
+        token_type: str | None = None,
+        token: None | str | BearerToken | IdToken = None,
+    ) -> str:
+        """Get standardized token type identifiers.
+
+        Return a standardized token type identifier, based on a short `token_type` hint and/or a
+        token value.
+
+        Args:
+            token_type: a token_type hint, as `str`. May be "access_token", "refresh_token"
+                or "id_token"
+            token: a token value, as an instance of `BearerToken` or IdToken, or as a `str`.
+
+        Returns:
+            the token_type as defined in the Token Exchange RFC8693.
+
+        Raises:
+            UnknownTokenType: if the type of token cannot be determined
+
+        """
+        if not (token_type or token):
+            msg = "Cannot determine type of an empty token without a token_type hint"
+            raise UnknownTokenType(msg, token, token_type)
+
+        if token_type is None:
+            if isinstance(token, str):
+                msg = """\
+Cannot determine the type of provided token when it is a bare `str`. Please specify a 'token_type'.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            if isinstance(token, BearerToken):
+                return "urn:ietf:params:oauth:token-type:access_token"
+            if isinstance(token, IdToken):
+                return "urn:ietf:params:oauth:token-type:id_token"
+            msg = f"Unknown token type {type(token)}"
+            raise UnknownTokenType(msg, token, token_type)
+        if token_type == TokenType.ACCESS_TOKEN:
+            if token is not None and not isinstance(token, (str, BearerToken)):
+                msg = f"""\
+The supplied token is of type '{type(token)}' which is inconsistent with token_type '{token_type}'.
+A BearerToken or an access_token as a `str` is expected.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            return "urn:ietf:params:oauth:token-type:access_token"
+        if token_type == TokenType.REFRESH_TOKEN:
+            if token is not None and isinstance(token, BearerToken) and not token.refresh_token:
+                msg = f"""\
+The supplied BearerToken does not contain a refresh_token, which is inconsistent with token_type '{token_type}'.
+A BearerToken containing a refresh_token is expected.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            return "urn:ietf:params:oauth:token-type:refresh_token"
+        if token_type == TokenType.ID_TOKEN:
+            if token is not None and not isinstance(token, (str, IdToken)):
+                msg = f"""\
+The supplied token is of type '{type(token)}' which is inconsistent with token_type '{token_type}'.
+An IdToken or a string representation of it is expected.
+"""
+                raise UnknownTokenType(msg, token, token_type)
+            return "urn:ietf:params:oauth:token-type:id_token"
+
+        return {
+            "saml1": "urn:ietf:params:oauth:token-type:saml1",
+            "saml2": "urn:ietf:params:oauth:token-type:saml2",
+            "jwt": "urn:ietf:params:oauth:token-type:jwt",
+        }.get(token_type, token_type)
+
+
+
+ +
+ +
+ + +
+ revoke_access_token(access_token, requests_kwargs=None, **revoke_kwargs) + +
+ + +
+ +

Send a request to the Revocation Endpoint to revoke an access token.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
access_token + BearerToken | str + +
+

the access token to revoke

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters for the underlying requests.post() call

+
+ 		+ None +
**revoke_kwargs + Any + +
+

additional parameters to pass to the revocation endpoint

+
+ 		+ {} +
+ +
+ Source code in requests_oauth2client/client.py + 
1155
+1156
+1157
+1158
+1159
+1160
+1161
+1162
+1163
+1164
+1165
+1166
+1167
+1168
+1169
+1170
+1171
+1172
+1173
+1174
def revoke_access_token(
+    self,
+    access_token: BearerToken | str,
+    requests_kwargs: dict[str, Any] | None = None,
+    **revoke_kwargs: Any,
+) -> bool:
+    """Send a request to the Revocation Endpoint to revoke an access token.
+
+    Args:
+        access_token: the access token to revoke
+        requests_kwargs: additional parameters for the underlying requests.post() call
+        **revoke_kwargs: additional parameters to pass to the revocation endpoint
+
+    """
+    return self.revoke_token(
+        access_token,
+        token_type_hint=TokenType.ACCESS_TOKEN,
+        requests_kwargs=requests_kwargs,
+        **revoke_kwargs,
+    )
+
+
+
+ +
+ +
+ + +
+ revoke_refresh_token(refresh_token, requests_kwargs=None, **revoke_kwargs) + +
+ + +
+ +

Send a request to the Revocation Endpoint to revoke a refresh token.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
refresh_token + str | BearerToken + +
+

the refresh token to revoke.

+
+ 		+ required +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters to pass to the revocation endpoint.

+
+ 		+ None +
**revoke_kwargs + Any + +
+

additional parameters to pass to the revocation endpoint.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ bool + +
+

True if the revocation request is successful, False if this client has no configured

+
+
+ bool + +
+

revocation endpoint.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ MissingRefreshToken + +
+

when refresh_token is a BearerToken +but does not contain a refresh_token.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1176
+1177
+1178
+1179
+1180
+1181
+1182
+1183
+1184
+1185
+1186
+1187
+1188
+1189
+1190
+1191
+1192
+1193
+1194
+1195
+1196
+1197
+1198
+1199
+1200
+1201
+1202
+1203
+1204
+1205
+1206
+1207
+1208
def revoke_refresh_token(
+    self,
+    refresh_token: str | BearerToken,
+    requests_kwargs: dict[str, Any] | None = None,
+    **revoke_kwargs: Any,
+) -> bool:
+    """Send a request to the Revocation Endpoint to revoke a refresh token.
+
+    Args:
+        refresh_token: the refresh token to revoke.
+        requests_kwargs: additional parameters to pass to the revocation endpoint.
+        **revoke_kwargs: additional parameters to pass to the revocation endpoint.
+
+    Returns:
+        `True` if the revocation request is successful, `False` if this client has no configured
+        revocation endpoint.
+
+    Raises:
+        MissingRefreshToken: when `refresh_token` is a [BearerToken][requests_oauth2client.tokens.BearerToken]
+            but does not contain a `refresh_token`.
+
+    """
+    if isinstance(refresh_token, BearerToken):
+        if refresh_token.refresh_token is None:
+            raise MissingRefreshToken(refresh_token)
+        refresh_token = refresh_token.refresh_token
+
+    return self.revoke_token(
+        refresh_token,
+        token_type_hint=TokenType.REFRESH_TOKEN,
+        requests_kwargs=requests_kwargs,
+        **revoke_kwargs,
+    )
+
+
+
+ +
+ +
+ + +
+ revoke_token(token, token_type_hint=None, requests_kwargs=None, **revoke_kwargs) + +
+ + +
+ +

Send a Token Revocation request.

+

By default, authentication will be the same than the one used for the Token Endpoint.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
token + str | BearerToken + +
+

the token to revoke.

+
+ 		+ required +
token_type_hint + str | None + +
+

a token_type_hint to send to the revocation endpoint.

+
+ 		+ None +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters to the underling call to requests.post()

+
+ 		+ None +
**revoke_kwargs + Any + +
+

additional parameters to send to the revocation endpoint.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ bool + +
+

True if the revocation succeeds, False if no revocation endpoint is present or a

+
+
+ bool + +
+

non-standardised error is returned.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ MissingEndpointUri + +
+

if the Revocation Endpoint URI is not configured.

+
+
+ MissingRefreshToken + +
+

if token_type_hint is "refresh_token" and token is a BearerToken +but does not contain a refresh_token.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1210
+1211
+1212
+1213
+1214
+1215
+1216
+1217
+1218
+1219
+1220
+1221
+1222
+1223
+1224
+1225
+1226
+1227
+1228
+1229
+1230
+1231
+1232
+1233
+1234
+1235
+1236
+1237
+1238
+1239
+1240
+1241
+1242
+1243
+1244
+1245
+1246
+1247
+1248
+1249
+1250
+1251
+1252
+1253
+1254
+1255
def revoke_token(
+    self,
+    token: str | BearerToken,
+    token_type_hint: str | None = None,
+    requests_kwargs: dict[str, Any] | None = None,
+    **revoke_kwargs: Any,
+) -> bool:
+    """Send a Token Revocation request.
+
+    By default, authentication will be the same than the one used for the Token Endpoint.
+
+    Args:
+        token: the token to revoke.
+        token_type_hint: a token_type_hint to send to the revocation endpoint.
+        requests_kwargs: additional parameters to the underling call to requests.post()
+        **revoke_kwargs: additional parameters to send to the revocation endpoint.
+
+    Returns:
+        `True` if the revocation succeeds, `False` if no revocation endpoint is present or a
+        non-standardised error is returned.
+
+    Raises:
+        MissingEndpointUri: if the Revocation Endpoint URI is not configured.
+        MissingRefreshToken: if `token_type_hint` is `"refresh_token"` and `token` is a BearerToken
+            but does not contain a `refresh_token`.
+
+    """
+    requests_kwargs = requests_kwargs or {}
+
+    if token_type_hint == TokenType.REFRESH_TOKEN and isinstance(token, BearerToken):
+        if token.refresh_token is None:
+            raise MissingRefreshToken(token)
+        token = token.refresh_token
+
+    data = dict(revoke_kwargs, token=str(token))
+    if token_type_hint:
+        data["token_type_hint"] = token_type_hint
+
+    return self._request(
+        Endpoints.REVOCATION,
+        data=data,
+        auth=self.auth,
+        on_success=lambda _: True,
+        on_failure=self.on_revocation_error,
+        **requests_kwargs,
+    )
+
+
+
+ +
+ +
+ + +
+ on_revocation_error(response) + +
+ + +
+ +

Error handler for revoke_token().

+

Invoked by revoke_token() when the +revocation endpoint returns an error.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the Response as returned by the Revocation Endpoint

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ bool + +
+

False to signal that an error occurred. May raise exceptions instead depending on the

+
+
+ bool + +
+

revocation response.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ EndpointError + +
+

if the response contains a standardised OAuth 2.0 error.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1257
+1258
+1259
+1260
+1261
+1262
+1263
+1264
+1265
+1266
+1267
+1268
+1269
+1270
+1271
+1272
+1273
+1274
+1275
+1276
+1277
+1278
+1279
+1280
+1281
+1282
+1283
+1284
+1285
+1286
+1287
+1288
+1289
def on_revocation_error(self, response: requests.Response) -> bool:
+    """Error handler for `revoke_token()`.
+
+    Invoked by [revoke_token()][requests_oauth2client.client.OAuth2Client.revoke_token] when the
+    revocation endpoint returns an error.
+
+    Args:
+        response: the [Response][requests.Response] as returned by the Revocation Endpoint
+
+    Returns:
+        `False` to signal that an error occurred. May raise exceptions instead depending on the
+        revocation response.
+
+    Raises:
+        EndpointError: if the response contains a standardised OAuth 2.0 error.
+
+    """
+    try:
+        data = response.json()
+        error = data["error"]
+        error_description = data.get("error_description")
+        error_uri = data.get("error_uri")
+        exception_class = self.exception_classes.get(error, RevocationError)
+        exception = exception_class(
+            response=response,
+            client=self,
+            error=error,
+            description=error_description,
+            uri=error_uri,
+        )
+    except Exception:  # noqa: BLE001
+        return False
+    raise exception
+
+
+
+ +
+ +
+ + +
+ introspect_token(token, token_type_hint=None, requests_kwargs=None, **introspect_kwargs) + +
+ + +
+ +

Send a request to the Introspection Endpoint.

+

Parameter token can be:

+
    +
  • a str
    • +
  • a BearerToken instance
    • +
+

You may pass any arbitrary token and token_type_hint values as str. Those will +be included in the request, as-is. +If token is a BearerToken, then token_type_hint must be either:

+
    +
  • None: the access_token will be instrospected and no token_type_hint will be included +in the request
    • +
  • access_token: same as None, but the token_type_hint will be included
    • +
  • or refresh_token: only available if a Refresh Token is present in the BearerToken.
    • +
+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
token + str | BearerToken + +
+

the token to instrospect

+
+ 		+ required +
token_type_hint + str | None + +
+

the token_type_hint to include in the request.

+
+ 		+ None +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters to the underling call to requests.post()

+
+ 		+ None +
**introspect_kwargs + Any + +
+

additional parameters to send to the introspection endpoint.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Any + +
+

the response as returned by the Introspection Endpoint.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ MissingRefreshToken + +
+

if token_type_hint is "refresh_token" and token is a BearerToken +but does not contain a refresh_token.

+
+
+ UnknownTokenType + +
+

if token_type_hint is neither None, "access_token" or "refresh_token".

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1291
+1292
+1293
+1294
+1295
+1296
+1297
+1298
+1299
+1300
+1301
+1302
+1303
+1304
+1305
+1306
+1307
+1308
+1309
+1310
+1311
+1312
+1313
+1314
+1315
+1316
+1317
+1318
+1319
+1320
+1321
+1322
+1323
+1324
+1325
+1326
+1327
+1328
+1329
+1330
+1331
+1332
+1333
+1334
+1335
+1336
+1337
+1338
+1339
+1340
+1341
+1342
+1343
+1344
+1345
+1346
+1347
+1348
+1349
+1350
+1351
+1352
+1353
+1354
+1355
    def introspect_token(
+        self,
+        token: str | BearerToken,
+        token_type_hint: str | None = None,
+        requests_kwargs: dict[str, Any] | None = None,
+        **introspect_kwargs: Any,
+    ) -> Any:
+        """Send a request to the Introspection Endpoint.
+
+        Parameter `token` can be:
+
+        - a `str`
+        - a `BearerToken` instance
+
+        You may pass any arbitrary `token` and `token_type_hint` values as `str`. Those will
+        be included in the request, as-is.
+        If `token` is a `BearerToken`, then `token_type_hint` must be either:
+
+        - `None`: the access_token will be instrospected and no token_type_hint will be included
+        in the request
+        - `access_token`: same as `None`, but the token_type_hint will be included
+        - or `refresh_token`: only available if a Refresh Token is present in the BearerToken.
+
+        Args:
+            token: the token to instrospect
+            token_type_hint: the `token_type_hint` to include in the request.
+            requests_kwargs: additional parameters to the underling call to requests.post()
+            **introspect_kwargs: additional parameters to send to the introspection endpoint.
+
+        Returns:
+            the response as returned by the Introspection Endpoint.
+
+        Raises:
+            MissingRefreshToken: if `token_type_hint` is `"refresh_token"` and `token` is a BearerToken
+                but does not contain a `refresh_token`.
+            UnknownTokenType: if `token_type_hint` is neither `None`, `"access_token"` or `"refresh_token"`.
+
+        """
+        requests_kwargs = requests_kwargs or {}
+
+        if isinstance(token, BearerToken):
+            if token_type_hint is None or token_type_hint == TokenType.ACCESS_TOKEN:
+                token = token.access_token
+            elif token_type_hint == TokenType.REFRESH_TOKEN:
+                if token.refresh_token is None:
+                    raise MissingRefreshToken(token)
+
+                token = token.refresh_token
+            else:
+                msg = """\
+Invalid `token_type_hint`. To test arbitrary `token_type_hint` values, you must provide `token` as a `str`."""
+                raise UnknownTokenType(msg, token, token_type_hint)
+
+        data = dict(introspect_kwargs, token=str(token))
+        if token_type_hint:
+            data["token_type_hint"] = token_type_hint
+
+        return self._request(
+            Endpoints.INSTROSPECTION,
+            data=data,
+            auth=self.auth,
+            on_success=self.parse_introspection_response,
+            on_failure=self.on_introspection_error,
+            **requests_kwargs,
+        )
+
+
+
+ +
+ +
+ + +
+ parse_introspection_response(response) + +
+ + +
+ +

Parse Token Introspection Responses received by introspect_token().

+

Invoked by introspect_token() +to parse the returned response. This decodes the JSON content if possible, otherwise it +returns the response as a string.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the Response as returned by the Introspection Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Any + +
+

the decoded JSON content, or a str with the content.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1357
+1358
+1359
+1360
+1361
+1362
+1363
+1364
+1365
+1366
+1367
+1368
+1369
+1370
+1371
+1372
+1373
+1374
def parse_introspection_response(self, response: requests.Response) -> Any:
+    """Parse Token Introspection Responses received by `introspect_token()`.
+
+    Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
+    to parse the returned response. This decodes the JSON content if possible, otherwise it
+    returns the response as a string.
+
+    Args:
+        response: the [Response][requests.Response] as returned by the Introspection Endpoint.
+
+    Returns:
+        the decoded JSON content, or a `str` with the content.
+
+    """
+    try:
+        return response.json()
+    except ValueError:
+        return response.text
+
+
+
+ +
+ +
+ + +
+ on_introspection_error(response) + +
+ + +
+ +

Error handler for introspect_token().

+

Invoked by introspect_token() +to parse the returned response in the case an error is returned.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the response as returned by the Introspection Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Any + +
+

usually raises exceptions. A subclass can return a default response instead.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ EndpointError + +
+

(or one of its subclasses) if the response contains a standard OAuth 2.0 error.

+
+
+ UnknownIntrospectionError + +
+

if the response is not a standard error response.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1376
+1377
+1378
+1379
+1380
+1381
+1382
+1383
+1384
+1385
+1386
+1387
+1388
+1389
+1390
+1391
+1392
+1393
+1394
+1395
+1396
+1397
+1398
+1399
+1400
+1401
+1402
+1403
+1404
+1405
+1406
+1407
+1408
def on_introspection_error(self, response: requests.Response) -> Any:
+    """Error handler for `introspect_token()`.
+
+    Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
+    to parse the returned response in the case an error is returned.
+
+    Args:
+        response: the response as returned by the Introspection Endpoint.
+
+    Returns:
+        usually raises exceptions. A subclass can return a default response instead.
+
+    Raises:
+        EndpointError: (or one of its subclasses) if the response contains a standard OAuth 2.0 error.
+        UnknownIntrospectionError: if the response is not a standard error response.
+
+    """
+    try:
+        data = response.json()
+        error = data["error"]
+        error_description = data.get("error_description")
+        error_uri = data.get("error_uri")
+        exception_class = self.exception_classes.get(error, IntrospectionError)
+        exception = exception_class(
+            response=response,
+            client=self,
+            error=error,
+            description=error_description,
+            uri=error_uri,
+        )
+    except Exception as exc:
+        raise UnknownIntrospectionError(response=response, client=self) from exc
+    raise exception
+
+
+
+ +
+ +
+ + +
+ backchannel_authentication_request(scope='openid', *, client_notification_token=None, acr_values=None, login_hint_token=None, id_token_hint=None, login_hint=None, binding_message=None, user_code=None, requested_expiry=None, private_jwk=None, alg=None, requests_kwargs=None, **ciba_kwargs) + +
+ + +
+ +

Send a CIBA Authentication Request.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
scope + None | str | Iterable[str] + +
+

the scope to include in the request.

+
+ 		+ 'openid' +
client_notification_token + str | None + +
+

the Client Notification Token to include in the request.

+
+ 		+ None +
acr_values + None | str | Iterable[str] + +
+

the acr values to include in the request.

+
+ 		+ None +
login_hint_token + str | None + +
+

the Login Hint Token to include in the request.

+
+ 		+ None +
id_token_hint + str | None + +
+

the ID Token Hint to include in the request.

+
+ 		+ None +
login_hint + str | None + +
+

the Login Hint to include in the request.

+
+ 		+ None +
binding_message + str | None + +
+

the Binding Message to include in the request.

+
+ 		+ None +
user_code + str | None + +
+

the User Code to include in the request

+
+ 		+ None +
requested_expiry + int | None + +
+

the Requested Expiry, in seconds, to include in the request.

+
+ 		+ None +
private_jwk + Jwk | dict[str, Any] | None + +
+

the JWK to use to sign the request (optional)

+
+ 		+ None +
alg + str | None + +
+

the alg to use to sign the request, if the provided JWK does not include an "alg" parameter.

+
+ 		+ None +
requests_kwargs + dict[str, Any] | None + +
+

additional parameters for

+
+ 		+ None +
**ciba_kwargs + Any + +
+

additional parameters to include in the request.

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BackChannelAuthenticationResponse + +
+

a BackChannelAuthenticationResponse as returned by AS

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + + + + + +
TypeDescription
+ InvalidBackchannelAuthenticationRequestHintParam + +
+

if none of login_hint, login_hint_token +or id_token_hint is provided, or more than one of them is provided.

+
+
+ InvalidScopeParam + +
+

if the scope parameter is invalid.

+
+
+ InvalidAcrValuesParam + +
+

if the acr_values parameter is invalid.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1410
+1411
+1412
+1413
+1414
+1415
+1416
+1417
+1418
+1419
+1420
+1421
+1422
+1423
+1424
+1425
+1426
+1427
+1428
+1429
+1430
+1431
+1432
+1433
+1434
+1435
+1436
+1437
+1438
+1439
+1440
+1441
+1442
+1443
+1444
+1445
+1446
+1447
+1448
+1449
+1450
+1451
+1452
+1453
+1454
+1455
+1456
+1457
+1458
+1459
+1460
+1461
+1462
+1463
+1464
+1465
+1466
+1467
+1468
+1469
+1470
+1471
+1472
+1473
+1474
+1475
+1476
+1477
+1478
+1479
+1480
+1481
+1482
+1483
+1484
+1485
+1486
+1487
+1488
+1489
+1490
+1491
+1492
+1493
+1494
+1495
+1496
+1497
+1498
+1499
def backchannel_authentication_request(  # noqa: PLR0913
+    self,
+    scope: None | str | Iterable[str] = "openid",
+    *,
+    client_notification_token: str | None = None,
+    acr_values: None | str | Iterable[str] = None,
+    login_hint_token: str | None = None,
+    id_token_hint: str | None = None,
+    login_hint: str | None = None,
+    binding_message: str | None = None,
+    user_code: str | None = None,
+    requested_expiry: int | None = None,
+    private_jwk: Jwk | dict[str, Any] | None = None,
+    alg: str | None = None,
+    requests_kwargs: dict[str, Any] | None = None,
+    **ciba_kwargs: Any,
+) -> BackChannelAuthenticationResponse:
+    """Send a CIBA Authentication Request.
+
+    Args:
+         scope: the scope to include in the request.
+         client_notification_token: the Client Notification Token to include in the request.
+         acr_values: the acr values to include in the request.
+         login_hint_token: the Login Hint Token to include in the request.
+         id_token_hint: the ID Token Hint to include in the request.
+         login_hint: the Login Hint to include in the request.
+         binding_message: the Binding Message to include in the request.
+         user_code: the User Code to include in the request
+         requested_expiry: the Requested Expiry, in seconds, to include in the request.
+         private_jwk: the JWK to use to sign the request (optional)
+         alg: the alg to use to sign the request, if the provided JWK does not include an "alg" parameter.
+         requests_kwargs: additional parameters for
+         **ciba_kwargs: additional parameters to include in the request.
+
+    Returns:
+        a BackChannelAuthenticationResponse as returned by AS
+
+    Raises:
+        InvalidBackchannelAuthenticationRequestHintParam: if none of `login_hint`, `login_hint_token`
+            or `id_token_hint` is provided, or more than one of them is provided.
+        InvalidScopeParam: if the `scope` parameter is invalid.
+        InvalidAcrValuesParam: if the `acr_values` parameter is invalid.
+
+    """
+    if not (login_hint or login_hint_token or id_token_hint):
+        msg = "One of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
+        raise InvalidBackchannelAuthenticationRequestHintParam(msg)
+
+    if (login_hint_token and id_token_hint) or (login_hint and id_token_hint) or (login_hint_token and login_hint):
+        msg = "Only one of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
+        raise InvalidBackchannelAuthenticationRequestHintParam(msg)
+
+    requests_kwargs = requests_kwargs or {}
+
+    if scope is not None and not isinstance(scope, str):
+        try:
+            scope = " ".join(scope)
+        except Exception as exc:
+            raise InvalidScopeParam(scope) from exc
+
+    if acr_values is not None and not isinstance(acr_values, str):
+        try:
+            acr_values = " ".join(acr_values)
+        except Exception as exc:
+            raise InvalidAcrValuesParam(acr_values) from exc
+
+    data = dict(
+        ciba_kwargs,
+        scope=scope,
+        client_notification_token=client_notification_token,
+        acr_values=acr_values,
+        login_hint_token=login_hint_token,
+        id_token_hint=id_token_hint,
+        login_hint=login_hint,
+        binding_message=binding_message,
+        user_code=user_code,
+        requested_expiry=requested_expiry,
+    )
+
+    if private_jwk is not None:
+        data = {"request": str(Jwt.sign(data, key=private_jwk, alg=alg))}
+
+    return self._request(
+        Endpoints.BACKCHANNEL_AUTHENTICATION,
+        data=data,
+        auth=self.auth,
+        on_success=self.parse_backchannel_authentication_response,
+        on_failure=self.on_backchannel_authentication_error,
+        **requests_kwargs,
+    )
+
+
+
+ +
+ +
+ + +
+ parse_backchannel_authentication_response(response) + +
+ + +
+ +

Parse a response received by backchannel_authentication_request().

+

Invoked by +backchannel_authentication_request() +to parse the response returned by the BackChannel Authentication Endpoint.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the response returned by the BackChannel Authentication Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BackChannelAuthenticationResponse + +
+

a BackChannelAuthenticationResponse

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ InvalidBackChannelAuthenticationResponse + +
+

if the response does not contain a standard +BackChannel Authentication response.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1501
+1502
+1503
+1504
+1505
+1506
+1507
+1508
+1509
+1510
+1511
+1512
+1513
+1514
+1515
+1516
+1517
+1518
+1519
+1520
+1521
+1522
+1523
+1524
+1525
def parse_backchannel_authentication_response(
+    self,
+    response: requests.Response,
+) -> BackChannelAuthenticationResponse:
+    """Parse a response received by `backchannel_authentication_request()`.
+
+    Invoked by
+    [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
+    to parse the response returned by the BackChannel Authentication Endpoint.
+
+    Args:
+        response: the response returned by the BackChannel Authentication Endpoint.
+
+    Returns:
+        a `BackChannelAuthenticationResponse`
+
+    Raises:
+        InvalidBackChannelAuthenticationResponse: if the response does not contain a standard
+            BackChannel Authentication response.
+
+    """
+    try:
+        return BackChannelAuthenticationResponse(**response.json())
+    except TypeError as exc:
+        raise InvalidBackChannelAuthenticationResponse(response=response, client=self) from exc
+
+
+
+ +
+ +
+ + +
+ on_backchannel_authentication_error(response) + +
+ + +
+ +

Error handler for backchannel_authentication_request().

+

Invoked by +backchannel_authentication_request() +to parse the response returned by the BackChannel Authentication Endpoint, when it is an +error.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the response returned by the BackChannel Authentication Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BackChannelAuthenticationResponse + +
+

usually raises an exception. But a subclass can return a default response instead.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ EndpointError + +
+

(or one of its subclasses) if the response contains a standard OAuth 2.0 error.

+
+
+ InvalidBackChannelAuthenticationResponse + +
+

for non-standard error responses.

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1527
+1528
+1529
+1530
+1531
+1532
+1533
+1534
+1535
+1536
+1537
+1538
+1539
+1540
+1541
+1542
+1543
+1544
+1545
+1546
+1547
+1548
+1549
+1550
+1551
+1552
+1553
+1554
+1555
+1556
+1557
+1558
+1559
+1560
+1561
def on_backchannel_authentication_error(self, response: requests.Response) -> BackChannelAuthenticationResponse:
+    """Error handler for `backchannel_authentication_request()`.
+
+    Invoked by
+    [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
+    to parse the response returned by the BackChannel Authentication Endpoint, when it is an
+    error.
+
+    Args:
+        response: the response returned by the BackChannel Authentication Endpoint.
+
+    Returns:
+        usually raises an exception. But a subclass can return a default response instead.
+
+    Raises:
+        EndpointError: (or one of its subclasses) if the response contains a standard OAuth 2.0 error.
+        InvalidBackChannelAuthenticationResponse: for non-standard error responses.
+
+    """
+    try:
+        data = response.json()
+        error = data["error"]
+        error_description = data.get("error_description")
+        error_uri = data.get("error_uri")
+        exception_class = self.exception_classes.get(error, BackChannelAuthenticationError)
+        exception = exception_class(
+            response=response,
+            client=self,
+            error=error,
+            description=error_description,
+            uri=error_uri,
+        )
+    except Exception as exc:
+        raise InvalidBackChannelAuthenticationResponse(response=response, client=self) from exc
+    raise exception
+
+
+
+ +
+ +
- +
+ authorize_device(requests_kwargs=None, **data) +
-
- -

Represent an Authorization Request that includes a request JWT.

+
+

Send a Device Authorization Request.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +

Parameters:

+
NameTypeDescriptionDefault
authorization_endpoint - str - -
-

the Authorization Endpoint uri

-
- 		- required -
client_id - str - -
-

the client_id

-
- 		- required -
request - str - -
-

the request JWT

-
- 		- required -
expires_at - datetime | None - -
-

the expiration date for this request

-
- 		- None -
kwargs - Any - -
-

extra parameters to include in the request

-
- 		- {} -
+ + + + + + - -
NameTypeDescriptionDefault
+ + + + **data + + Any + + +
+

additional data to send to the Device Authorization Endpoint

+
+ + + {} + + + + requests_kwargs + + dict[str, Any] | None + + +
+

additional parameters for requests.request()

+
+ + + None + + + + + + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ DeviceAuthorizationResponse + +
+

a Device Authorization Response

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ MissingEndpointUri + +
+

if the Device Authorization URI is not configured

+
+
- Source code in requests_oauth2client/authorization_request.py - 
645
-646
-647
-648
-649
-650
-651
-652
-653
-654
-655
-656
-657
-658
-659
-660
-661
-662
-663
-664
-665
-666
-667
-668
-669
-670
-671
-672
-673
-674
-675
-676
-677
-678
-679
-680
-681
-682
-683
-684
-685
-686
-687
-688
-689
-690
-691
-692
-693
-694
-695
-696
-697
-698
-699
-700
-701
-702
-703
-704
-705
@frozen(init=False)
-class RequestParameterAuthorizationRequest:
-    """Represent an Authorization Request that includes a `request` JWT.
-
-    Args:
-        authorization_endpoint: the Authorization Endpoint uri
-        client_id: the client_id
-        request: the request JWT
-        expires_at: the expiration date for this request
-        kwargs: extra parameters to include in the request
-
-    """
-
-    authorization_endpoint: str
-    client_id: str
-    request: str
-    expires_at: datetime | None = None
-    kwargs: dict[str, Any] = Factory(dict)
-
-    @accepts_expires_in
-    def __init__(
-        self,
-        authorization_endpoint: str,
-        client_id: str,
-        request: str,
-        expires_at: datetime | None = None,
-        **kwargs: Any,
-    ):
-        self.__attrs_init__(
-            authorization_endpoint=authorization_endpoint,
-            client_id=client_id,
-            request=request,
-            expires_at=expires_at,
-            kwargs=kwargs,
-        )
-
-    @property
-    def furl(self) -> furl:
-        """Return the Authorization Request URI, as a `furl` instance."""
-        return furl(
-            self.authorization_endpoint,
-            args={"client_id": self.client_id, "request": self.request, **self.kwargs},
-        )
-
-    @property
-    def uri(self) -> str:
-        """Return the Authorization Request URI, as a `str`."""
-        return str(self.furl.url)
-
-    def __getattr__(self, item: str) -> Any:
-        """Allow attribute access to extra parameters."""
-        return self.kwargs[item]
-
-    def __repr__(self) -> str:
-        """Return the Authorization Request URI, as a `str`.
-
-        Returns:
-             the Authorization Request URI
-
-        """
-        return self.uri
-
+ Source code in requests_oauth2client/client.py + 
1563
+1564
+1565
+1566
+1567
+1568
+1569
+1570
+1571
+1572
+1573
+1574
+1575
+1576
+1577
+1578
+1579
+1580
+1581
+1582
+1583
+1584
+1585
+1586
+1587
+1588
+1589
+1590
def authorize_device(
+    self,
+    requests_kwargs: dict[str, Any] | None = None,
+    **data: Any,
+) -> DeviceAuthorizationResponse:
+    """Send a Device Authorization Request.
+
+    Args:
+        **data: additional data to send to the Device Authorization Endpoint
+        requests_kwargs: additional parameters for `requests.request()`
+
+    Returns:
+        a Device Authorization Response
+
+    Raises:
+        MissingEndpointUri: if the Device Authorization URI is not configured
+
+    """
+    requests_kwargs = requests_kwargs or {}
+
+    return self._request(
+        Endpoints.DEVICE_AUTHORIZATION,
+        data=data,
+        auth=self.auth,
+        on_success=self.parse_device_authorization_response,
+        on_failure=self.on_device_authorization_error,
+        **requests_kwargs,
+    )
+
+
- - -
+
+
+
+ parse_device_authorization_response(response) +
+
-
+

Parse a Device Authorization Response received by authorize_device().

+

Invoked by authorize_device() +to parse the response returned by the Device Authorization Endpoint.

+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the response returned by the Device Authorization Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ DeviceAuthorizationResponse + +
+

a DeviceAuthorizationResponse as returned by AS

+
+
-
- furl: furl - - - property - +
+ Source code in requests_oauth2client/client.py + 
1592
+1593
+1594
+1595
+1596
+1597
+1598
+1599
+1600
+1601
+1602
+1603
+1604
+1605
def parse_device_authorization_response(self, response: requests.Response) -> DeviceAuthorizationResponse:
+    """Parse a Device Authorization Response received by `authorize_device()`.
+
+    Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
+    to parse the response returned by the Device Authorization Endpoint.
+
+    Args:
+        response: the response returned by the Device Authorization Endpoint.
+
+    Returns:
+        a `DeviceAuthorizationResponse` as returned by AS
+
+    """
+    return DeviceAuthorizationResponse(**response.json())
+
+
+
- +
+
-
- -

Return the Authorization Request URI, as a furl instance.

-
-
+
+ on_device_authorization_error(response) -
+
+
-
- uri: str - - - property - +

Error handler for authorize_device().

+

Invoked by authorize_device() +to parse the response returned by the Device Authorization Endpoint, when that response is +an error.

-
+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
response + Response + +
+

the response returned by the Device Authorization Endpoint.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ DeviceAuthorizationResponse + +
+

usually raises an Exception. But a subclass may return a default response instead.

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ EndpointError + +
+

for standard OAuth 2.0 errors

+
+
+ InvalidDeviceAuthorizationResponse + +
+

for non-standard error responses.

+
+
-
- -

Return the Authorization Request URI, as a str.

-
+
+ Source code in requests_oauth2client/client.py + 
1607
+1608
+1609
+1610
+1611
+1612
+1613
+1614
+1615
+1616
+1617
+1618
+1619
+1620
+1621
+1622
+1623
+1624
+1625
+1626
+1627
+1628
+1629
+1630
+1631
+1632
+1633
+1634
+1635
+1636
+1637
+1638
+1639
+1640
def on_device_authorization_error(self, response: requests.Response) -> DeviceAuthorizationResponse:
+    """Error handler for `authorize_device()`.
+
+    Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
+    to parse the response returned by the Device Authorization Endpoint, when that response is
+    an error.
+
+    Args:
+        response: the response returned by the Device Authorization Endpoint.
+
+    Returns:
+        usually raises an Exception. But a subclass may return a default response instead.
+
+    Raises:
+        EndpointError: for standard OAuth 2.0 errors
+        InvalidDeviceAuthorizationResponse: for non-standard error responses.
+
+    """
+    try:
+        data = response.json()
+        error = data["error"]
+        error_description = data.get("error_description")
+        error_uri = data.get("error_uri")
+        exception_class = self.exception_classes.get(error, DeviceAuthorizationError)
+        exception = exception_class(
+            response=response,
+            client=self,
+            error=error,
+            description=error_description,
+            uri=error_uri,
+        )
+    except Exception as exc:
+        raise InvalidDeviceAuthorizationResponse(response=response, client=self) from exc
+    raise exception
+
+
+
+
+
+ update_authorization_server_public_keys(requests_kwargs=None) +
-
-
+
+

Update the cached AS public keys by retrieving them from its jwks_uri.

+

Public keys are returned by this method, as a jwskate.JwkSet. They are also +available in attribute authorization_server_jwks.

-
-
+

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ JwkSet + +
+

the retrieved public keys

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ ValueError + +
+

if no jwks_uri is configured

+
+
+
+ Source code in requests_oauth2client/client.py + 
1642
+1643
+1644
+1645
+1646
+1647
+1648
+1649
+1650
+1651
+1652
+1653
+1654
+1655
+1656
+1657
+1658
+1659
+1660
+1661
+1662
+1663
+1664
+1665
+1666
def update_authorization_server_public_keys(self, requests_kwargs: dict[str, Any] | None = None) -> JwkSet:
+    """Update the cached AS public keys by retrieving them from its `jwks_uri`.
+
+    Public keys are returned by this method, as a `jwskate.JwkSet`. They are also
+    available in attribute `authorization_server_jwks`.
+
+    Returns:
+        the retrieved public keys
+
+    Raises:
+        ValueError: if no `jwks_uri` is configured
+
+    """
+    requests_kwargs = requests_kwargs or {}
+
+    jwks = self._request(
+        Endpoints.JWKS,
+        auth=None,
+        method="GET",
+        on_success=lambda resp: resp.json(),
+        on_failure=lambda resp: resp.raise_for_status(),
+        **requests_kwargs,
+    )
+    self.authorization_server_jwks.update(jwks)
+    return self.authorization_server_jwks
+
+
+
+
-

- RequestUriParameterAuthorizationRequest +
-

+
+ from_discovery_endpoint(url=None, issuer=None, *, auth=None, client_id=None, client_secret=None, private_key=None, session=None, testing=False, **kwargs) + + classmethod + -
+
- -

Represent an Authorization Request that includes a request_uri parameter.

+
+

Initialise an OAuth2Client based on Authorization Server Metadata.

+

This will retrieve the standardised metadata document available at url, and will extract +all Endpoint Uris from that document, will fetch the current public keys from its +jwks_uri, then will initialise an OAuth2Client based on those endpoints.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
authorization_endpoint - str - -
-

the Authorization Endpoint uri

-
- 		- required -
client_id - str - -
-

the client_id

-
- 		- required -
request_uri - str - -
-

the request_uri

-
- 		- required -
expires_at - datetime | None - -
-

the expiration date for this request

-
- 		- None -
kwargs - Any - -
-

extra parameters to include in the request

-
- 		- {} -
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
url + str | None + +
+

the url where the server metadata will be retrieved

+
+ 		+ None +
auth + AuthBase | tuple[str, str] | str | None + +
+

the authentication handler to use for client authentication

+
+ 		+ None +
client_id + str | None + +
+

client ID

+
+ 		+ None +
client_secret + str | None + +
+

client secret to use to authenticate the client

+
+ 		+ None +
private_key + Jwk | dict[str, Any] | None + +
+

private key to sign client assertions

+
+ 		+ None +
session + Session | None + +
+

a requests.Session to use to retrieve the document and initialise the client with

+
+ 		+ None +
issuer + str | None + +
+

if an issuer is given, check that it matches the one from the retrieved document

+
+ 		+ None +
testing + bool + +
+

if True, don't try to validate the endpoint urls that are part of the document

+
+ 		+ False +
**kwargs + Any + +
+

additional keyword parameters to pass to OAuth2Client

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ OAuth2Client + +
+

an OAuth2Client with endpoint initialised based on the obtained metadata

+
+
+ + +

Raises:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ InvalidParam + +
+

if neither url nor issuer are suitable urls

+
+
+ HTTPError + +
+

if an error happens while fetching the documents

+
+
+ + +
+ Example + 
1
+2
+3
+4
+5
+6
+7
from requests_oauth2client import OAuth2Client
+
+client = OAuth2Client.from_discovery_endpoint(
+    issuer="https://myserver.net",
+    client_id="my_client_id,
+    client_secret="my_client_secret"
+)
+
+
- Source code in requests_oauth2client/authorization_request.py - 
708
-709
-710
-711
-712
-713
-714
-715
-716
-717
-718
-719
-720
-721
-722
-723
-724
-725
-726
-727
-728
-729
-730
-731
-732
-733
-734
-735
-736
-737
-738
-739
-740
-741
-742
-743
-744
-745
-746
-747
-748
-749
-750
-751
-752
-753
-754
-755
-756
-757
-758
-759
-760
-761
-762
-763
@frozen(init=False)
-class RequestUriParameterAuthorizationRequest:
-    """Represent an Authorization Request that includes a `request_uri` parameter.
-
-    Args:
-        authorization_endpoint: the Authorization Endpoint uri
-        client_id: the client_id
-        request_uri: the request_uri
-        expires_at: the expiration date for this request
-        kwargs: extra parameters to include in the request
-
-    """
-
-    authorization_endpoint: str
-    client_id: str
-    request_uri: str
-    expires_at: datetime | None = None
-    kwargs: dict[str, Any] = Factory(dict)
-
-    @accepts_expires_in
-    def __init__(
-        self,
-        authorization_endpoint: str,
-        client_id: str,
-        request_uri: str,
-        expires_at: datetime | None = None,
-        **kwargs: Any,
-    ):
-        self.__attrs_init__(
-            authorization_endpoint=authorization_endpoint,
-            client_id=client_id,
-            request_uri=request_uri,
-            expires_at=expires_at,
-            kwargs=kwargs,
-        )
-
-    @property
-    def furl(self) -> furl:
-        """Return the Authorization Request URI, as a `furl` instance."""
-        return furl(
-            self.authorization_endpoint,
-            args={"client_id": self.client_id, "request_uri": self.request_uri, **self.kwargs},
-        )
-
-    @property
-    def uri(self) -> str:
-        """Return the Authorization Request URI, as a `str`."""
-        return str(self.furl.url)
-
-    def __getattr__(self, item: str) -> Any:
-        """Allow attribute access to extra parameters."""
-        return self.kwargs[item]
-
-    def __repr__(self) -> str:
-        """Return the Authorization Request URI, as a `str`."""
-        return self.uri
-
+ Source code in requests_oauth2client/client.py + 
1668
+1669
+1670
+1671
+1672
+1673
+1674
+1675
+1676
+1677
+1678
+1679
+1680
+1681
+1682
+1683
+1684
+1685
+1686
+1687
+1688
+1689
+1690
+1691
+1692
+1693
+1694
+1695
+1696
+1697
+1698
+1699
+1700
+1701
+1702
+1703
+1704
+1705
+1706
+1707
+1708
+1709
+1710
+1711
+1712
+1713
+1714
+1715
+1716
+1717
+1718
+1719
+1720
+1721
+1722
+1723
+1724
+1725
+1726
+1727
+1728
+1729
+1730
+1731
+1732
+1733
+1734
+1735
+1736
+1737
+1738
+1739
+1740
+1741
+1742
+1743
+1744
@classmethod
+def from_discovery_endpoint(
+    cls,
+    url: str | None = None,
+    issuer: str | None = None,
+    *,
+    auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
+    client_id: str | None = None,
+    client_secret: str | None = None,
+    private_key: Jwk | dict[str, Any] | None = None,
+    session: requests.Session | None = None,
+    testing: bool = False,
+    **kwargs: Any,
+) -> OAuth2Client:
+    """Initialise an OAuth2Client based on Authorization Server Metadata.
+
+    This will retrieve the standardised metadata document available at `url`, and will extract
+    all Endpoint Uris from that document, will fetch the current public keys from its
+    `jwks_uri`, then will initialise an OAuth2Client based on those endpoints.
+
+    Args:
+         url: the url where the server metadata will be retrieved
+         auth: the authentication handler to use for client authentication
+         client_id: client ID
+         client_secret: client secret to use to authenticate the client
+         private_key: private key to sign client assertions
+         session: a `requests.Session` to use to retrieve the document and initialise the client with
+         issuer: if an issuer is given, check that it matches the one from the retrieved document
+         testing: if True, don't try to validate the endpoint urls that are part of the document
+         **kwargs: additional keyword parameters to pass to OAuth2Client
+
+    Returns:
+        an OAuth2Client with endpoint initialised based on the obtained metadata
+
+    Raises:
+        InvalidParam: if neither `url` nor `issuer` are suitable urls
+        requests.HTTPError: if an error happens while fetching the documents
+
+    Example:
+        ```python
+        from requests_oauth2client import OAuth2Client
+
+        client = OAuth2Client.from_discovery_endpoint(
+            issuer="https://myserver.net",
+            client_id="my_client_id,
+            client_secret="my_client_secret"
+        )
+        ```
+
+    """
+    if url is None and issuer is not None:
+        url = oidc_discovery_document_url(issuer)
+    if url is None:
+        msg = "Please specify at least one of `issuer` or `url`"
+        raise InvalidParam(msg)
+
+    validate_endpoint_uri(url, path=False)
+
+    session = session or requests.Session()
+    discovery = session.get(url).json()
+
+    jwks_uri = discovery.get("jwks_uri")
+    if jwks_uri:
+        jwks = JwkSet(session.get(jwks_uri).json())
+
+    return cls.from_discovery_document(
+        discovery,
+        issuer=issuer,
+        auth=auth,
+        session=session,
+        client_id=client_id,
+        client_secret=client_secret,
+        private_key=private_key,
+        authorization_server_jwks=jwks,
+        testing=testing,
+        **kwargs,
+    )
+
+
- +
-
+
+
+ from_discovery_document(discovery, issuer=None, *, auth=None, client_id=None, client_secret=None, private_key=None, authorization_server_jwks=None, session=None, https=True, testing=False, **kwargs) + + classmethod + +
+
-
+

Initialize an OAuth2Client, based on the server metadata from discovery.

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
discovery + dict[str, Any] + +
+

a dict of server metadata, in the same format as retrieved from a discovery endpoint.

+
+ 		+ required +
issuer + str | None + +
+

if an issuer is given, check that it matches the one mentioned in the document

+
+ 		+ None +
auth + AuthBase | tuple[str, str] | str | None + +
+

the authentication handler to use for client authentication

+
+ 		+ None +
client_id + str | None + +
+

client ID

+
+ 		+ None +
client_secret + str | None + +
+

client secret to use to authenticate the client

+
+ 		+ None +
private_key + Jwk | dict[str, Any] | None + +
+

private key to sign client assertions

+
+ 		+ None +
authorization_server_jwks + JwkSet | dict[str, Any] | None + +
+

the current authorization server JWKS keys

+
+ 		+ None +
session + Session | None + +
+

a requests Session to use to retrieve the document and initialise the client with

+
+ 		+ None +
https + bool + +
+

(deprecated) if True, validates that urls in the discovery document use the https scheme

+
+ 		+ True +
testing + bool + +
+

if True, don't try to validate the endpoint urls that are part of the document

+
+ 		+ False +
**kwargs + Any + +
+

additional args that will be passed to OAuth2Client

+
+ 		+ {} +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ OAuth2Client + +
+

an OAuth2Client initialized with the endpoints from the discovery document

+
+
+ + +

Raises:

+ + + + + + + + + + + + + +
TypeDescription
+ InvalidDiscoveryDocument + +
+

if the document does not contain at least a "token_endpoint".

+
+
+ +
+ Source code in requests_oauth2client/client.py + 
1746
+1747
+1748
+1749
+1750
+1751
+1752
+1753
+1754
+1755
+1756
+1757
+1758
+1759
+1760
+1761
+1762
+1763
+1764
+1765
+1766
+1767
+1768
+1769
+1770
+1771
+1772
+1773
+1774
+1775
+1776
+1777
+1778
+1779
+1780
+1781
+1782
+1783
+1784
+1785
+1786
+1787
+1788
+1789
+1790
+1791
+1792
+1793
+1794
+1795
+1796
+1797
+1798
+1799
+1800
+1801
+1802
+1803
+1804
+1805
+1806
+1807
+1808
+1809
+1810
+1811
+1812
+1813
+1814
+1815
+1816
+1817
+1818
+1819
+1820
+1821
+1822
+1823
+1824
+1825
+1826
+1827
+1828
+1829
+1830
+1831
+1832
+1833
+1834
+1835
+1836
+1837
+1838
    @classmethod
+    def from_discovery_document(
+        cls,
+        discovery: dict[str, Any],
+        issuer: str | None = None,
+        *,
+        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_key: Jwk | dict[str, Any] | None = None,
+        authorization_server_jwks: JwkSet | dict[str, Any] | None = None,
+        session: requests.Session | None = None,
+        https: bool = True,
+        testing: bool = False,
+        **kwargs: Any,
+    ) -> OAuth2Client:
+        """Initialize an OAuth2Client, based on the server metadata from `discovery`.
+
+        Args:
+             discovery: a dict of server metadata, in the same format as retrieved from a discovery endpoint.
+             issuer: if an issuer is given, check that it matches the one mentioned in the document
+             auth: the authentication handler to use for client authentication
+             client_id: client ID
+             client_secret: client secret to use to authenticate the client
+             private_key: private key to sign client assertions
+             authorization_server_jwks: the current authorization server JWKS keys
+             session: a requests Session to use to retrieve the document and initialise the client with
+             https: (deprecated) if `True`, validates that urls in the discovery document use the https scheme
+             testing: if True, don't try to validate the endpoint urls that are part of the document
+             **kwargs: additional args that will be passed to OAuth2Client
+
+        Returns:
+            an `OAuth2Client` initialized with the endpoints from the discovery document
+
+        Raises:
+            InvalidDiscoveryDocument: if the document does not contain at least a `"token_endpoint"`.
+
+        """
+        if not https:
+            warnings.warn(
+                """\
+The https parameter is deprecated.
+To disable endpoint uri validation, set `testing=True` when initializing your `OAuth2Client`.""",
+                stacklevel=1,
+            )
+            testing = True
+        if issuer and discovery.get("issuer") != issuer:
+            msg = (
+                f"Mismatching `issuer` value in discovery document"
+                f" (received '{discovery.get('issuer')}', expected '{issuer}')"
+            )
+            raise InvalidParam(
+                msg,
+                issuer,
+                discovery.get("issuer"),
+            )
+        if issuer is None:
+            issuer = discovery.get("issuer")
+
+        token_endpoint = discovery.get(Endpoints.TOKEN)
+        if token_endpoint is None:
+            msg = "token_endpoint not found in that discovery document"
+            raise InvalidDiscoveryDocument(msg, discovery)
+        authorization_endpoint = discovery.get(Endpoints.AUTHORIZATION)
+        revocation_endpoint = discovery.get(Endpoints.REVOCATION)
+        introspection_endpoint = discovery.get(Endpoints.INSTROSPECTION)
+        userinfo_endpoint = discovery.get(Endpoints.USER_INFO)
+        jwks_uri = discovery.get(Endpoints.JWKS)
+        if jwks_uri is not None:
+            validate_endpoint_uri(jwks_uri, https=https)
+        authorization_response_iss_parameter_supported = discovery.get(
+            "authorization_response_iss_parameter_supported",
+            False,
+        )
+
+        return cls(
+            token_endpoint=token_endpoint,
+            authorization_endpoint=authorization_endpoint,
+            revocation_endpoint=revocation_endpoint,
+            introspection_endpoint=introspection_endpoint,
+            userinfo_endpoint=userinfo_endpoint,
+            jwks_uri=jwks_uri,
+            authorization_server_jwks=authorization_server_jwks,
+            auth=auth,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_key=private_key,
+            session=session,
+            issuer=issuer,
+            authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
+            testing=testing,
+            **kwargs,
+        )
+
+
+
-
- furl: furl - - - property - +
- -
- -

Return the Authorization Request URI, as a furl instance.

+
+
-
-
- uri: str - - - property - +
- +
+
-
- -

Return the Authorization Request URI, as a str.

-
+
-
+

+ client_authentication +

-
+
-
+

This module implements OAuth 2.0 Client Authentication Methods.

+

An OAuth 2.0 Client must authenticate to the AS whenever it sends a request to the Token Endpoint, +by including appropriate credentials. This module contains helper classes and methods that implement +the standardized and commonly used Client Authentication Methods.

-
-
+
-

- AuthorizationRequestSerializer -

-
- -

(De)Serializer for AuthorizationRequest instances.

-

You might need to store pending authorization requests in session, either server-side or client- -side. This class is here to help you do that.

+
-
- Source code in requests_oauth2client/authorization_request.py - 
766
-767
-768
-769
-770
-771
-772
-773
-774
-775
-776
-777
-778
-779
-780
-781
-782
-783
-784
-785
-786
-787
-788
-789
-790
-791
-792
-793
-794
-795
-796
-797
-798
-799
-800
-801
-802
-803
-804
-805
-806
-807
-808
-809
-810
-811
-812
-813
-814
-815
-816
-817
-818
-819
-820
-821
-822
-823
-824
-825
-826
-827
-828
-829
-830
-831
-832
-833
-834
-835
-836
-837
-838
-839
-840
-841
-842
class AuthorizationRequestSerializer:
-    """(De)Serializer for `AuthorizationRequest` instances.
-
-    You might need to store pending authorization requests in session, either server-side or client-
-    side. This class is here to help you do that.
-
-    """
-
-    def __init__(
-        self,
-        dumper: Callable[[AuthorizationRequest], str] | None = None,
-        loader: Callable[[str], AuthorizationRequest] | None = None,
-    ):
-        self.dumper = dumper or self.default_dumper
-        self.loader = loader or self.default_loader
-
-    @staticmethod
-    def default_dumper(azr: AuthorizationRequest) -> str:
-        """Provide a default dumper implementation.
-
-        Serialize an AuthorizationRequest as JSON, then compress with deflate, then encodes as
-        base64url.
-
-        Args:
-            azr: the `AuthorizationRequest` to serialize
-
-        Returns:
-            the serialized value
-
-        """
-        d = asdict(azr)
-        d.update(**d.pop("kwargs", {}))
-        d.pop("code_challenge")
-        return BinaPy.serialize_to("json", d).to("deflate").to("b64u").ascii()
-
-    @staticmethod
-    def default_loader(
-        serialized: str, azr_class: type[AuthorizationRequest] = AuthorizationRequest
-    ) -> AuthorizationRequest:
-        """Provide a default deserializer implementation.
-
-        This does the opposite operations than `default_dumper`.
-
-        Args:
-            serialized: the serialized AuthorizationRequest
-            azr_class: the class to deserialize the Authorization Request to
-
-        Returns:
-            an AuthorizationRequest
-
-        """
-        args = BinaPy(serialized).decode_from("b64u").decode_from("deflate").parse_from("json")
-        return azr_class(**args)
-
-    def dumps(self, azr: AuthorizationRequest) -> str:
-        """Serialize and compress a given AuthorizationRequest for easier storage.
-
-        Args:
-            azr: an AuthorizationRequest to serialize
-
-        Returns:
-            the serialized AuthorizationRequest, as a str
-
-        """
-        return self.dumper(azr)
-
-    def loads(self, serialized: str) -> AuthorizationRequest:
-        """Deserialize a serialized AuthorizationRequest.
-
-        Args:
-            serialized: the serialized AuthorizationRequest
-
-        Returns:
-            the deserialized AuthorizationRequest
-
-        """
-        return self.loader(serialized)
-
-
- -
+

+ InvalidRequestForClientAuthentication +

+
+

+ Bases: RuntimeError

+

Raised when a request is not suitable for OAuth 2.0 client authentication.

+
+ Source code in requests_oauth2client/client_authentication.py + 
22
+23
+24
+25
+26
+27
class InvalidRequestForClientAuthentication(RuntimeError):
+    """Raised when a request is not suitable for OAuth 2.0 client authentication."""
+
+    def __init__(self, request: requests.PreparedRequest) -> None:
+        super().__init__("This request is not suitabe for OAuth 2.0 client authentication.")
+        self.request = request
+
+
-
+
+ + -
- default_dumper(azr) - - - staticmethod - -
-
- -

Provide a default dumper implementation.

-

Serialize an AuthorizationRequest as JSON, then compress with deflate, then encodes as -base64url.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
azr - AuthorizationRequest - -
-

the AuthorizationRequest to serialize

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

the serialized value

-
-
- -
- Source code in requests_oauth2client/authorization_request.py - 
782
-783
-784
-785
-786
-787
-788
-789
-790
-791
-792
-793
-794
-795
-796
-797
-798
-799
@staticmethod
-def default_dumper(azr: AuthorizationRequest) -> str:
-    """Provide a default dumper implementation.
-
-    Serialize an AuthorizationRequest as JSON, then compress with deflate, then encodes as
-    base64url.
-
-    Args:
-        azr: the `AuthorizationRequest` to serialize
-
-    Returns:
-        the serialized value
-
-    """
-    d = asdict(azr)
-    d.update(**d.pop("kwargs", {}))
-    d.pop("code_challenge")
-    return BinaPy.serialize_to("json", d).to("deflate").to("b64u").ascii()
-
-
-
+
+
-
+
-
- default_loader(serialized, azr_class=AuthorizationRequest) - - - staticmethod - +

+ BaseClientAuthenticationMethod -

+ -
- -

Provide a default deserializer implementation.

-

This does the opposite operations than default_dumper.

+
+

+ Bases: AuthBase

+ + +

Base class for all Client Authentication methods. This extends requests.auth.AuthBase.

+

This base class checks that requests are suitable to add Client Authentication parameters to, +and does not modify the request.

+ +
+ Source code in requests_oauth2client/client_authentication.py + 
30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
@frozen
+class BaseClientAuthenticationMethod(requests.auth.AuthBase):
+    """Base class for all Client Authentication methods. This extends [requests.auth.AuthBase][].
+
+    This base class checks that requests are suitable to add Client Authentication parameters to,
+    and does not modify the request.
+
+    """
+
+    client_id: str
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Check that the request is suitable for Client Authentication.
+
+        It checks:
+
+        * that the method is `POST`
+        * that the Content-Type is "application/x-www-form-urlencoded" or None
+
+        Args:
+            request: a [requests.PreparedRequest][]
+
+        Returns:
+            a [requests.PreparedRequest][], unmodified
+
+        Raises:
+            RuntimeError: if the request is not suitable for OAuth 2.0 Client Authentication
+
+        """
+        if request.method != "POST" or request.headers.get("Content-Type") not in (
+            "application/x-www-form-urlencoded",
+            None,
+        ):
+            raise InvalidRequestForClientAuthentication(request)
+        return request
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
serialized - str - -
-

the serialized AuthorizationRequest

-
- 		- required -
azr_class - type[AuthorizationRequest] - -
-

the class to deserialize the Authorization Request to

-
- 		- AuthorizationRequest -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- AuthorizationRequest - -
-

an AuthorizationRequest

-
-
- -
- Source code in requests_oauth2client/authorization_request.py - 
801
-802
-803
-804
-805
-806
-807
-808
-809
-810
-811
-812
-813
-814
-815
-816
-817
-818
@staticmethod
-def default_loader(
-    serialized: str, azr_class: type[AuthorizationRequest] = AuthorizationRequest
-) -> AuthorizationRequest:
-    """Provide a default deserializer implementation.
-
-    This does the opposite operations than `default_dumper`.
-
-    Args:
-        serialized: the serialized AuthorizationRequest
-        azr_class: the class to deserialize the Authorization Request to
-
-    Returns:
-        an AuthorizationRequest
-
-    """
-    args = BinaPy(serialized).decode_from("b64u").decode_from("deflate").parse_from("json")
-    return azr_class(**args)
-
-
-
-
+
-
-
- dumps(azr) -
-
- -

Serialize and compress a given AuthorizationRequest for easier storage.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
azr - AuthorizationRequest - -
-

an AuthorizationRequest to serialize

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

the serialized AuthorizationRequest, as a str

-
-
- -
- Source code in requests_oauth2client/authorization_request.py - 
820
-821
-822
-823
-824
-825
-826
-827
-828
-829
-830
def dumps(self, azr: AuthorizationRequest) -> str:
-    """Serialize and compress a given AuthorizationRequest for easier storage.
-
-    Args:
-        azr: an AuthorizationRequest to serialize
-
-    Returns:
-        the serialized AuthorizationRequest, as a str
-
-    """
-    return self.dumper(azr)
-
-
+
+
+
-
+

+ ClientSecretBasic -

- loads(serialized) -
+ -
- -

Deserialize a serialized AuthorizationRequest.

+
+

+ Bases: BaseClientAuthenticationMethod

+

Implement client_secret_basic authentication.

+

With this method, the client sends its Client ID and Secret, in the HTTP Authorization header, with +the Basic scheme, in each authenticated request to the Authorization Server.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
serialized - str - -
-

the serialized AuthorizationRequest

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - + +

Parameters:

+
TypeDescription
- AuthorizationRequest - -
-

the deserialized AuthorizationRequest

-
-
+ + + + + + - -
NameTypeDescriptionDefault
- -
- Source code in requests_oauth2client/authorization_request.py - 
832
-833
-834
-835
-836
-837
-838
-839
-840
-841
-842
def loads(self, serialized: str) -> AuthorizationRequest:
-    """Deserialize a serialized AuthorizationRequest.
-
-    Args:
-        serialized: the serialized AuthorizationRequest
-
-    Returns:
-        the deserialized AuthorizationRequest
-
-    """
-    return self.loader(serialized)
-
-
-
+ + + + client_id + + str + + +
+

Client ID

+
+ + + required + + + + client_secret + + str + + +
+

Client Secret

+
+ + + required + + + + + + +
+ Example + 
1
+2
+3
+4
from requests_oauth2client import ClientSecretBasic, OAuth2Client
+
+auth = ClientSecretBasic("my_client_id", "my_client_secret")
+client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+
+
+
+ Source code in requests_oauth2client/client_authentication.py + 
 67
+ 68
+ 69
+ 70
+ 71
+ 72
+ 73
+ 74
+ 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
@frozen(init=False)
+class ClientSecretBasic(BaseClientAuthenticationMethod):
+    """Implement `client_secret_basic` authentication.
+
+    With this method, the client sends its Client ID and Secret, in the HTTP `Authorization` header, with
+    the `Basic` scheme, in each authenticated request to the Authorization Server.
+
+    Args:
+        client_id: Client ID
+        client_secret: Client Secret
+
+    Example:
+        ```python
+        from requests_oauth2client import ClientSecretBasic, OAuth2Client
+
+        auth = ClientSecretBasic("my_client_id", "my_client_secret")
+        client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+        ```
+
+    """
+
+    client_secret: str
+
+    def __init__(self, client_id: str, client_secret: str) -> None:
+        self.__attrs_init__(
+            client_id=client_id,
+            client_secret=client_secret,
+        )
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Add the appropriate `Authorization` header in each request.
+
+        The Authorization header is formatted as such:
+        `Authorization: Basic BASE64('<client_id:client_secret>')`
+
+        Args:
+            request: the request
+
+        Returns:
+            a [requests.PreparedRequest][] with the added Authorization header.
+
+        """
+        request = super().__call__(request)
+        b64encoded_credentials = BinaPy(f"{self.client_id}:{self.client_secret}").to("b64").ascii()
+        request.headers["Authorization"] = f"Basic {b64encoded_credentials}"
+        return request
+
+
-
+ + +
-
-
-
-
+
+
-
+
-

- backchannel_authentication +

+ ClientSecretPost -

+ -
- -

Implementation of CIBA.

-

CIBA stands for Client Initiated BackChannel Authentication and is standardised by the OpenID -Fundation. -https://openid.net/specs/openid-client-initiated-backchannel- -authentication-core-1_0.html.

- +
+

+ Bases: BaseClientAuthenticationMethod

-
+

Implement client_secret_post client authentication method.

+

With this method, the client inserts its client_id and client_secret in each authenticated +request to the AS.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client_id + str + +
+

Client ID

+
+ 		+ required +
client_secret + str + +
+

Client Secret

+
+ 		+ required +
+ + +
+ Example + 
1
+2
+3
+4
from requests_oauth2client import ClientSecretPost, OAuth2Client
+
+auth = ClientSecretPost("my_client_id", "my_client_secret")
+client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+
+
+
+ Source code in requests_oauth2client/client_authentication.py + 
115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
+126
+127
+128
+129
+130
+131
+132
+133
+134
+135
+136
+137
+138
+139
+140
+141
+142
+143
+144
+145
+146
+147
+148
+149
+150
+151
+152
+153
+154
+155
+156
+157
+158
+159
+160
+161
+162
+163
@frozen(init=False)
+class ClientSecretPost(BaseClientAuthenticationMethod):
+    """Implement `client_secret_post` client authentication method.
+
+    With this method, the client inserts its client_id and client_secret in each authenticated
+    request to the AS.
+
+    Args:
+        client_id: Client ID
+        client_secret: Client Secret
+
+    Example:
+        ```python
+        from requests_oauth2client import ClientSecretPost, OAuth2Client
+
+        auth = ClientSecretPost("my_client_id", "my_client_secret")
+        client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+        ```
+
+    """
+
+    client_secret: str
+
+    def __init__(self, client_id: str, client_secret: str) -> None:
+        self.__attrs_init__(
+            client_id=client_id,
+            client_secret=client_secret,
+        )
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Add the `client_id` and `client_secret` parameters in the request body.
+
+        Args:
+            request: a [requests.PreparedRequest][].
+
+        Returns:
+            a [requests.PreparedRequest][] with the added client credentials fields.
+
+        """
+        request = super().__call__(request)
+        params = (
+            parse_qs(request.body, strict_parsing=True, keep_blank_values=True)  # type: ignore[type-var]
+            if isinstance(request.body, (str, bytes))
+            else {}
+        )
+        params[b"client_id"] = [self.client_id.encode()]
+        params[b"client_secret"] = [self.client_secret.encode()]
+        request.prepare_body(params, files=None)
+        return request
+
+
+
-
-

- BackChannelAuthenticationResponse -

-
+
- -

Represent a BackChannel Authentication Response.

-

This contains all the parameters that are returned by the AS as a result of a BackChannel -Authentication Request, such as auth_req_id (required), and the optional expires_at, -interval, and/or any custom parameters.

+
+ +
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
auth_req_id - str - -
-

the auth_req_id as returned by the AS.

-
- 		- required -
expires_at - datetime | None - -
-

the date when the auth_req_id expires. -Note that this request also accepts an expires_in parameter, in seconds.

-
- 		- None -
interval - int | None - -
-

the Token Endpoint pooling interval, in seconds, as returned by the AS.

-
- 		- 20 -
**kwargs - Any - -
-

any additional custom parameters as returned by the AS.

-
- 		- {} -
-
- Source code in requests_oauth2client/backchannel_authentication.py - 
23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
-76
-77
-78
-79
-80
-81
-82
-83
-84
-85
-86
-87
-88
class BackChannelAuthenticationResponse:
-    """Represent a BackChannel Authentication Response.
-
-    This contains all the parameters that are returned by the AS as a result of a BackChannel
-    Authentication Request, such as `auth_req_id` (required), and the optional `expires_at`,
-    `interval`, and/or any custom parameters.
-
-    Args:
-        auth_req_id: the `auth_req_id` as returned by the AS.
-        expires_at: the date when the `auth_req_id` expires.
-            Note that this request also accepts an `expires_in` parameter, in seconds.
-        interval: the Token Endpoint pooling interval, in seconds, as returned by the AS.
-        **kwargs: any additional custom parameters as returned by the AS.
-
-    """
-
-    @accepts_expires_in
-    def __init__(
-        self,
-        auth_req_id: str,
-        expires_at: datetime | None = None,
-        interval: int | None = 20,
-        **kwargs: Any,
-    ):
-        self.auth_req_id = auth_req_id
-        self.expires_at = expires_at
-        self.interval = interval
-        self.other = kwargs
-
-    def is_expired(self, leeway: int = 0) -> bool | None:
-        """Return `True` if the `auth_req_id` within this response is expired.
-
-        Expiration is evaluated at the time of the call. If there is no "expires_at" hint (which is
-        derived from the `expires_in` hint returned by the AS BackChannel Authentication endpoint),
-        this will return `None`.
-
-        Returns:
-            `True` if the auth_req_id is expired, `False` if it is still valid, `None` if there is
-            no `expires_in` hint.
-
-        """
-        if self.expires_at:
-            return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
-        return None
-
-    def __getattr__(self, key: str) -> Any:
-        """Return attributes from this `BackChannelAuthenticationResponse`.
-
-        Allows accessing response parameters with `token_response.expires_in` or
-        `token_response.any_custom_attribute`.
-
-        Args:
-            key: a key
-
-        Returns:
-            the associated value in this token response
-
-        Raises:
-            AttributeError: if the attribute is not present in the response
-
-        """
-        if key == "expires_in":
-            if self.expires_at is None:
-                return None
-            return int(self.expires_at.timestamp() - datetime.now(tz=timezone.utc).timestamp())
-        return self.other.get(key) or super().__getattribute__(key)
-
-
+

+ BaseClientAssertionAuthenticationMethod + + +

+ + +
+

+ Bases: BaseClientAuthenticationMethod

+ + +

Base class for assertion-based client authentication methods.

+ +
+ Source code in requests_oauth2client/client_authentication.py + 
166
+167
+168
+169
+170
+171
+172
+173
+174
+175
+176
+177
+178
+179
+180
+181
+182
+183
+184
+185
+186
+187
+188
+189
+190
+191
+192
+193
+194
+195
+196
+197
+198
+199
+200
+201
+202
+203
+204
+205
+206
+207
+208
+209
+210
@frozen
+class BaseClientAssertionAuthenticationMethod(BaseClientAuthenticationMethod):
+    """Base class for assertion-based client authentication methods."""
+
+    lifetime: int
+    jti_gen: Callable[[], str]
+    aud: str | None
+
+    def client_assertion(self, audience: str) -> str:
+        """Generate a Client Assertion for a specific audience.
+
+        Args:
+            audience: the audience to use for the `aud` claim of the generated Client Assertion.
+
+        Returns:
+            a Client Assertion, as `str`.
+
+        """
+        raise NotImplementedError
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Add a `client_assertion` field in the request body.
+
+        Args:
+            request: a [requests.PreparedRequest][].
+
+        Returns:
+            a [requests.PreparedRequest][] with the added `client_assertion` field.
+
+        """
+        request = super().__call__(request)
+        audience = self.aud or request.url
+        if audience is None:
+            raise InvalidRequestForClientAuthentication(request)  # pragma: no cover
+        params = (
+            parse_qs(request.body, strict_parsing=True, keep_blank_values=True)  # type: ignore[type-var]
+            if request.body
+            else {}
+        )
+        client_assertion = self.client_assertion(audience)
+        params[b"client_id"] = [self.client_id.encode()]
+        params[b"client_assertion"] = [client_assertion.encode()]
+        params[b"client_assertion_type"] = [b"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]
+        request.prepare_body(params, files=None)
+        return request
+
+
- -
+
@@ -45752,97 +64907,102 @@

+

+ client_assertion(audience) -
- is_expired(leeway=0) - -
+ -
- -

Return True if the auth_req_id within this response is expired.

-

Expiration is evaluated at the time of the call. If there is no "expires_at" hint (which is -derived from the expires_in hint returned by the AS BackChannel Authentication endpoint), -this will return None.

+
+

Generate a Client Assertion for a specific audience.

-

Returns:

- - - - - - - - - - - - - - - +

Parameters:

+
TypeDescription
- bool | None - -
-

True if the auth_req_id is expired, False if it is still valid, None if there is

-
-
- bool | None - -
-

no expires_in hint.

-
-
+ + + + + + - -
NameTypeDescriptionDefault
- -
- Source code in requests_oauth2client/backchannel_authentication.py - 
52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
def is_expired(self, leeway: int = 0) -> bool | None:
-    """Return `True` if the `auth_req_id` within this response is expired.
-
-    Expiration is evaluated at the time of the call. If there is no "expires_at" hint (which is
-    derived from the `expires_in` hint returned by the AS BackChannel Authentication endpoint),
-    this will return `None`.
-
-    Returns:
-        `True` if the auth_req_id is expired, `False` if it is still valid, `None` if there is
-        no `expires_in` hint.
-
-    """
-    if self.expires_at:
-        return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
-    return None
-
-
-
+ + + + audience + + str + + +
+

the audience to use for the aud claim of the generated Client Assertion.

+
+ + + required + + + + + + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

a Client Assertion, as str.

+
+
-
+
+ Source code in requests_oauth2client/client_authentication.py + 
174
+175
+176
+177
+178
+179
+180
+181
+182
+183
+184
def client_assertion(self, audience: str) -> str:
+    """Generate a Client Assertion for a specific audience.
+
+    Args:
+        audience: the audience to use for the `aud` claim of the generated Client Assertion.
+
+    Returns:
+        a Client Assertion, as `str`.
+
+    """
+    raise NotImplementedError
+
+
+
+
-
+
@@ -45850,242 +65010,292 @@
- BackChannelAuthenticationPoolingJob +

+ ClientSecretJwt -

+ -
-

- Bases: TokenEndpointPoolingJob

+
+

+ Bases: BaseClientAssertionAuthenticationMethod

- -

A pooling job for the BackChannel Authentication flow.

-

This will poll the Token Endpoint until the user finishes with its authentication.

+

Implement client_secret_jwt client authentication method.

+

With this method, the client generates a client assertion, then symmetrically signs it with its Client Secret. +The assertion is then sent to the AS in a client_assertion field with each authenticated request.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +

Parameters:

+
NameTypeDescriptionDefault
client - OAuth2Client - -
-

an OAuth2Client that will be used to pool the token endpoint.

-
- 		- required -
auth_req_id - str | BackChannelAuthenticationResponse - -
-

an auth_req_id as str or a BackChannelAuthenticationResponse.

-
- 		- required -
interval - int | None - -
-

The pooling interval to use. This overrides the one in auth_req_id if it is -a BackChannelAuthenticationResponse.

-
- 		- None -
slow_down_interval - int - -
-

Number of seconds to add to the pooling interval when the AS returns -a slow down request.

-
- 		- 5 -
requests_kwargs - dict[str, Any] | None - -
-

Additional parameters for the underlying calls to requests.request.

-
- 		- None -
**token_kwargs - Any - -
-

Additional parameters for the token request.

-
- 		- {} -
+ + + + + + - -
NameTypeDescriptionDefault
-

auth=("client_id", "client_secret") ) pool_job = BackChannelAuthenticationPoolingJob( -client=client, auth_req_id="my_auth_req_id" )

-
1
token = None while token is None: token = pool_job() ```
-
+ + + + client_id + + str + + +
+

the client_id to use.

+
+ + + required + + + + client_secret + + str + + +
+

the client_secret to use to sign generated Client Assertions.

+
+ + + required + + + + alg + + str + + +
+

the alg to use to sign generated Client Assertions.

+
+ + + HS256 + + + + lifetime + + int + + +
+

the lifetime to use for generated Client Assertions.

+
+ + + 60 + + + + jti_gen + + Callable[[], str] + + +
+

a function to generate JWT Token Ids (jti) for generated Client Assertions.

+
+ + + lambda: str(uuid4()) + + + + aud + + str | None + + +
+

the audience value to use. If None (default), the endpoint URL will be used.

+
+ + + None + + + + + + +
+ Example + 
1
+2
+3
+4
from requests_oauth2client import OAuth2Client, ClientSecretJwt
+
+auth = ClientSecretJwt("my_client_id", "my_client_secret")
+client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+
+
+
+ Source code in requests_oauth2client/client_authentication.py + 
213
+214
+215
+216
+217
+218
+219
+220
+221
+222
+223
+224
+225
+226
+227
+228
+229
+230
+231
+232
+233
+234
+235
+236
+237
+238
+239
+240
+241
+242
+243
+244
+245
+246
+247
+248
+249
+250
+251
+252
+253
+254
+255
+256
+257
+258
+259
+260
+261
+262
+263
+264
+265
+266
+267
+268
+269
+270
+271
+272
+273
+274
+275
+276
+277
+278
+279
+280
+281
+282
+283
+284
+285
+286
+287
+288
+289
@frozen(init=False)
+class ClientSecretJwt(BaseClientAssertionAuthenticationMethod):
+    """Implement `client_secret_jwt` client authentication method.
+
+    With this method, the client generates a client assertion, then symmetrically signs it with its Client Secret.
+    The assertion is then sent to the AS in a `client_assertion` field with each authenticated request.
+
+    Args:
+        client_id: the `client_id` to use.
+        client_secret: the `client_secret` to use to sign generated Client Assertions.
+        alg: the alg to use to sign generated Client Assertions.
+        lifetime: the lifetime to use for generated Client Assertions.
+        jti_gen: a function to generate JWT Token Ids (`jti`) for generated Client Assertions.
+        aud: the audience value to use. If `None` (default), the endpoint URL will be used.
+
+    Example:
+        ```python
+        from requests_oauth2client import OAuth2Client, ClientSecretJwt
+
+        auth = ClientSecretJwt("my_client_id", "my_client_secret")
+        client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+        ```
+
+    """
+
+    client_secret: str
+    alg: str
+
+    def __init__(
+        self,
+        client_id: str,
+        client_secret: str,
+        lifetime: int = 60,
+        alg: str = SignatureAlgs.HS256,
+        jti_gen: Callable[[], str] = lambda: str(uuid4()),
+        aud: str | None = None,
+    ) -> None:
+        self.__attrs_init__(
+            client_id=client_id,
+            client_secret=client_secret,
+            lifetime=lifetime,
+            alg=alg,
+            jti_gen=jti_gen,
+            aud=aud,
+        )
+
+    def client_assertion(self, audience: str) -> str:
+        """Generate a symmetrically signed Client Assertion.
+
+        Assertion is signed with the `client_secret` as key and the `alg` passed at init time.
+
+        Args:
+            audience: the audience to use for the generated Client Assertion.
+
+        Returns:
+            a Client Assertion, as `str`.
+
+        """
+        iat = int(datetime.now(tz=timezone.utc).timestamp())
+        exp = iat + self.lifetime
+        jti = str(self.jti_gen())
+
+        jwk = SymmetricJwk.from_bytes(self.client_secret.encode())
+
+        jwt = Jwt.sign(
+            claims={
+                "iss": self.client_id,
+                "sub": self.client_id,
+                "aud": audience,
+                "iat": iat,
+                "exp": exp,
+                "jti": jti,
+            },
+            key=jwk,
+            alg=self.alg,
+        )
+        return str(jwt)
+
+
-
- Source code in requests_oauth2client/backchannel_authentication.py - 
 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
-141
-142
-143
-144
-145
class BackChannelAuthenticationPoolingJob(TokenEndpointPoolingJob):
-    """A pooling job for the BackChannel Authentication flow.
-
-    This will poll the Token Endpoint until the user finishes with its authentication.
-
-    Args:
-        client: an OAuth2Client that will be used to pool the token endpoint.
-        auth_req_id: an `auth_req_id` as `str` or a `BackChannelAuthenticationResponse`.
-        interval: The pooling interval to use. This overrides the one in `auth_req_id` if it is
-            a `BackChannelAuthenticationResponse`.
-        slow_down_interval: Number of seconds to add to the pooling interval when the AS returns
-            a slow down request.
-        requests_kwargs: Additional parameters for the underlying calls to [requests.request][].
-        **token_kwargs: Additional parameters for the token request.
-
-    Usage: ```python client = OAuth2Client( token_endpoint="https://my.as.local/token",
-    auth=("client_id", "client_secret") ) pool_job = BackChannelAuthenticationPoolingJob(
-    client=client, auth_req_id="my_auth_req_id" )
-
-        token = None while token is None: token = pool_job() ```
-
-    """
-
-    def __init__(
-        self,
-        client: OAuth2Client,
-        auth_req_id: str | BackChannelAuthenticationResponse,
-        *,
-        interval: int | None = None,
-        slow_down_interval: int = 5,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ):
-        if isinstance(auth_req_id, BackChannelAuthenticationResponse) and interval is None:
-            interval = auth_req_id.interval
-
-        super().__init__(
-            client=client,
-            interval=interval,
-            slow_down_interval=slow_down_interval,
-            requests_kwargs=requests_kwargs,
-            **token_kwargs,
-        )
-        self.auth_req_id = auth_req_id
-
-    def token_request(self) -> BearerToken:
-        """Implement the CIBA token request.
-
-        This actually calls [OAuth2Client.ciba(auth_req_id)] on `client`.
-
-        Returns:
-            a [BearerToken][requests_oauth2client.tokens.BearerToken]
-
-        """
-        return self.client.ciba(self.auth_req_id, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
-
-
-
@@ -46097,70 +65307,138 @@

+

+ client_assertion(audience) -
- token_request() +
- +
-
- -

Implement the CIBA token request.

-

This actually calls [OAuth2Client.ciba(auth_req_id)] on client.

+

Generate a symmetrically signed Client Assertion.

+

Assertion is signed with the client_secret as key and the alg passed at init time.

+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
audience + str + +
+

the audience to use for the generated Client Assertion.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

a Client Assertion, as str.

+
+
-

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/backchannel_authentication.py - 
136
-137
-138
-139
-140
-141
-142
-143
-144
-145
def token_request(self) -> BearerToken:
-    """Implement the CIBA token request.
-
-    This actually calls [OAuth2Client.ciba(auth_req_id)] on `client`.
-
-    Returns:
-        a [BearerToken][requests_oauth2client.tokens.BearerToken]
-
-    """
-    return self.client.ciba(self.auth_req_id, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
-
-
-
+
+ Source code in requests_oauth2client/client_authentication.py + 
259
+260
+261
+262
+263
+264
+265
+266
+267
+268
+269
+270
+271
+272
+273
+274
+275
+276
+277
+278
+279
+280
+281
+282
+283
+284
+285
+286
+287
+288
+289
def client_assertion(self, audience: str) -> str:
+    """Generate a symmetrically signed Client Assertion.
+
+    Assertion is signed with the `client_secret` as key and the `alg` passed at init time.
+
+    Args:
+        audience: the audience to use for the generated Client Assertion.
+
+    Returns:
+        a Client Assertion, as `str`.
+
+    """
+    iat = int(datetime.now(tz=timezone.utc).timestamp())
+    exp = iat + self.lifetime
+    jti = str(self.jti_gen())
+
+    jwk = SymmetricJwk.from_bytes(self.client_secret.encode())
+
+    jwt = Jwt.sign(
+        claims={
+            "iss": self.client_id,
+            "sub": self.client_id,
+            "aud": audience,
+            "iat": iat,
+            "exp": exp,
+            "jti": jti,
+        },
+        key=jwk,
+        alg=self.alg,
+    )
+    return str(jwt)
+
+
+
@@ -46168,35 +65446,63 @@
-
- -
+

+ InvalidClientAssertionSigningKeyOrAlg -

-
+ +
+

+ Bases: ValueError

-

- client +

Raised when the client assertion signing alg is not specified or invalid.

-

+
+ Source code in requests_oauth2client/client_authentication.py + 
292
+293
+294
+295
+296
+297
+298
+299
+300
+301
+302
+303
+304
+305
+306
class InvalidClientAssertionSigningKeyOrAlg(ValueError):
+    """Raised when the client assertion signing alg is not specified or invalid."""
+
+    def __init__(self, alg: str | None) -> None:
+        super().__init__("""\
+An asymmetric private signing key, and an alg that is supported by the signing key is required.
+It can be provided either:
+- as part of the private `Jwk`, in the parameter 'alg'
+- or passed as parameter `alg` when initializing a `PrivateKeyJwt`.
+Examples of valid `alg` values and matching key type:
+- 'RS256', 'RS512' (with a key of type RSA)
+- 'ES256', 'ES512' (with a key of type EC)
+The private key must include a Key ID (in its 'kid' parameter).
+""")
+        self.alg = alg
+
+
-
- -

This module contains the OAuth2Client class.

-
@@ -46207,3949 +65513,655 @@

-
- - - -

- OAuth2Client - - -

- - -
- - -

An OAuth 2.x Client, that can send requests to an OAuth 2.x Authorization Server.

-

OAuth2Client is able to obtain tokens from the Token Endpoint using any of the standardised -Grant Types, and to communicate with the various backend endpoints like the Revocation, -Introspection, and UserInfo Endpoint.

-

To init an OAuth2Client, you only need the url to the Token Endpoint and the Credentials -(a client_id and one of a secret or private_key) that will be used to authenticate to that endpoint. -Other endpoint urls, such as the Authorization Endpoint, Revocation Endpoint, etc. can be passed as -parameter as well if you intend to use them.

-

This class is not intended to help with the end-user authentication or any request that goes in -a browser. For authentication requests, see -AuthorizationRequest. You -may use the method authorization_request() to generate AuthorizationRequests with the -preconfigured authorization_endpoint, client_id and `redirect_uri' from this client.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
token_endpoint - str - -
-

the Token Endpoint URI where this client will get access tokens

-
- 		- required -
auth - AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None - -
-

the authentication handler to use for client authentication on the token endpoint. -Can be:

- -
- 		- None -
client_id - str | None - -
-

client ID (use either this or auth)

-
- 		- None -
client_secret - str | None - -
-

client secret (use either this or auth)

-
- 		- None -
private_key - Jwk | dict[str, Any] | None - -
-

private_key to use for client authentication (use either this or auth)

-
- 		- None -
revocation_endpoint - str | None - -
-

the Revocation Endpoint URI to use for revoking tokens

-
- 		- None -
introspection_endpoint - str | None - -
-

the Introspection Endpoint URI to use to get info about tokens

-
- 		- None -
userinfo_endpoint - str | None - -
-

the Userinfo Endpoint URI to use to get information about the user

-
- 		- None -
authorization_endpoint - str | None - -
-

the Authorization Endpoint URI, used for initializing Authorization Requests

-
- 		- None -
redirect_uri - str | None - -
-

the redirect_uri for this client

-
- 		- None -
backchannel_authentication_endpoint - str | None - -
-

the BackChannel Authentication URI

-
- 		- None -
device_authorization_endpoint - str | None - -
-

the Device Authorization Endpoint URI to use to authorize devices

-
- 		- None -
jwks_uri - str | None - -
-

the JWKS URI to use to obtain the AS public keys

-
- 		- None -
code_challenge_method - str - -
-

challenge method to use for PKCE (should always be 'S256')

-
- 		- 'S256' -
session - Session | None - -
-

a requests Session to use when sending HTTP requests. -Useful if some extra parameters such as proxy or client certificate must be used -to connect to the AS.

-
- 		- None -
testing - bool - -
-

if True, don't verify the validity of the endpoint urls that are passed as parameter.

-
- 		- False -
**extra_metadata - Any - -
-

additional metadata for this client, unused by this class, but may be -used by subclasses. Those will be accessible with the extra_metadata attribute.

-
- 		- {} -
- -
- Usage - 
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-11
client = OAuth2Client(
-    token_endpoint="https://my.as.local/token",
-    revocation_endpoint="https://my.as.local/revoke",
-    client_id="client_id",
-    client_secret="client_secret",
-)
-
-# once initialized, a client can send requests to its configured endpoints
-cc_token = client.client_credentials(scope="my_scope")
-ac_token = client.authorization_code(code="my_code")
-client.revoke_access_token(cc_token)
-
-
-
- Source code in requests_oauth2client/client.py - 
  53
-  54
-  55
-  56
-  57
-  58
-  59
-  60
-  61
-  62
-  63
-  64
-  65
-  66
-  67
-  68
-  69
-  70
-  71
-  72
-  73
-  74
-  75
-  76
-  77
-  78
-  79
-  80
-  81
-  82
-  83
-  84
-  85
-  86
-  87
-  88
-  89
-  90
-  91
-  92
-  93
-  94
-  95
-  96
-  97
-  98
-  99
- 100
- 101
- 102
- 103
- 104
- 105
- 106
- 107
- 108
- 109
- 110
- 111
- 112
- 113
- 114
- 115
- 116
- 117
- 118
- 119
- 120
- 121
- 122
- 123
- 124
- 125
- 126
- 127
- 128
- 129
- 130
- 131
- 132
- 133
- 134
- 135
- 136
- 137
- 138
- 139
- 140
- 141
- 142
- 143
- 144
- 145
- 146
- 147
- 148
- 149
- 150
- 151
- 152
- 153
- 154
- 155
- 156
- 157
- 158
- 159
- 160
- 161
- 162
- 163
- 164
- 165
- 166
- 167
- 168
- 169
- 170
- 171
- 172
- 173
- 174
- 175
- 176
- 177
- 178
- 179
- 180
- 181
- 182
- 183
- 184
- 185
- 186
- 187
- 188
- 189
- 190
- 191
- 192
- 193
- 194
- 195
- 196
- 197
- 198
- 199
- 200
- 201
- 202
- 203
- 204
- 205
- 206
- 207
- 208
- 209
- 210
- 211
- 212
- 213
- 214
- 215
- 216
- 217
- 218
- 219
- 220
- 221
- 222
- 223
- 224
- 225
- 226
- 227
- 228
- 229
- 230
- 231
- 232
- 233
- 234
- 235
- 236
- 237
- 238
- 239
- 240
- 241
- 242
- 243
- 244
- 245
- 246
- 247
- 248
- 249
- 250
- 251
- 252
- 253
- 254
- 255
- 256
- 257
- 258
- 259
- 260
- 261
- 262
- 263
- 264
- 265
- 266
- 267
- 268
- 269
- 270
- 271
- 272
- 273
- 274
- 275
- 276
- 277
- 278
- 279
- 280
- 281
- 282
- 283
- 284
- 285
- 286
- 287
- 288
- 289
- 290
- 291
- 292
- 293
- 294
- 295
- 296
- 297
- 298
- 299
- 300
- 301
- 302
- 303
- 304
- 305
- 306
- 307
- 308
- 309
- 310
- 311
- 312
- 313
- 314
- 315
- 316
- 317
- 318
- 319
- 320
- 321
- 322
- 323
- 324
- 325
- 326
- 327
- 328
- 329
- 330
- 331
- 332
- 333
- 334
- 335
- 336
- 337
- 338
- 339
- 340
- 341
- 342
- 343
- 344
- 345
- 346
- 347
- 348
- 349
- 350
- 351
- 352
- 353
- 354
- 355
- 356
- 357
- 358
- 359
- 360
- 361
- 362
- 363
- 364
- 365
- 366
- 367
- 368
- 369
- 370
- 371
- 372
- 373
- 374
- 375
- 376
- 377
- 378
- 379
- 380
- 381
- 382
- 383
- 384
- 385
- 386
- 387
- 388
- 389
- 390
- 391
- 392
- 393
- 394
- 395
- 396
- 397
- 398
- 399
- 400
- 401
- 402
- 403
- 404
- 405
- 406
- 407
- 408
- 409
- 410
- 411
- 412
- 413
- 414
- 415
- 416
- 417
- 418
- 419
- 420
- 421
- 422
- 423
- 424
- 425
- 426
- 427
- 428
- 429
- 430
- 431
- 432
- 433
- 434
- 435
- 436
- 437
- 438
- 439
- 440
- 441
- 442
- 443
- 444
- 445
- 446
- 447
- 448
- 449
- 450
- 451
- 452
- 453
- 454
- 455
- 456
- 457
- 458
- 459
- 460
- 461
- 462
- 463
- 464
- 465
- 466
- 467
- 468
- 469
- 470
- 471
- 472
- 473
- 474
- 475
- 476
- 477
- 478
- 479
- 480
- 481
- 482
- 483
- 484
- 485
- 486
- 487
- 488
- 489
- 490
- 491
- 492
- 493
- 494
- 495
- 496
- 497
- 498
- 499
- 500
- 501
- 502
- 503
- 504
- 505
- 506
- 507
- 508
- 509
- 510
- 511
- 512
- 513
- 514
- 515
- 516
- 517
- 518
- 519
- 520
- 521
- 522
- 523
- 524
- 525
- 526
- 527
- 528
- 529
- 530
- 531
- 532
- 533
- 534
- 535
- 536
- 537
- 538
- 539
- 540
- 541
- 542
- 543
- 544
- 545
- 546
- 547
- 548
- 549
- 550
- 551
- 552
- 553
- 554
- 555
- 556
- 557
- 558
- 559
- 560
- 561
- 562
- 563
- 564
- 565
- 566
- 567
- 568
- 569
- 570
- 571
- 572
- 573
- 574
- 575
- 576
- 577
- 578
- 579
- 580
- 581
- 582
- 583
- 584
- 585
- 586
- 587
- 588
- 589
- 590
- 591
- 592
- 593
- 594
- 595
- 596
- 597
- 598
- 599
- 600
- 601
- 602
- 603
- 604
- 605
- 606
- 607
- 608
- 609
- 610
- 611
- 612
- 613
- 614
- 615
- 616
- 617
- 618
- 619
- 620
- 621
- 622
- 623
- 624
- 625
- 626
- 627
- 628
- 629
- 630
- 631
- 632
- 633
- 634
- 635
- 636
- 637
- 638
- 639
- 640
- 641
- 642
- 643
- 644
- 645
- 646
- 647
- 648
- 649
- 650
- 651
- 652
- 653
- 654
- 655
- 656
- 657
- 658
- 659
- 660
- 661
- 662
- 663
- 664
- 665
- 666
- 667
- 668
- 669
- 670
- 671
- 672
- 673
- 674
- 675
- 676
- 677
- 678
- 679
- 680
- 681
- 682
- 683
- 684
- 685
- 686
- 687
- 688
- 689
- 690
- 691
- 692
- 693
- 694
- 695
- 696
- 697
- 698
- 699
- 700
- 701
- 702
- 703
- 704
- 705
- 706
- 707
- 708
- 709
- 710
- 711
- 712
- 713
- 714
- 715
- 716
- 717
- 718
- 719
- 720
- 721
- 722
- 723
- 724
- 725
- 726
- 727
- 728
- 729
- 730
- 731
- 732
- 733
- 734
- 735
- 736
- 737
- 738
- 739
- 740
- 741
- 742
- 743
- 744
- 745
- 746
- 747
- 748
- 749
- 750
- 751
- 752
- 753
- 754
- 755
- 756
- 757
- 758
- 759
- 760
- 761
- 762
- 763
- 764
- 765
- 766
- 767
- 768
- 769
- 770
- 771
- 772
- 773
- 774
- 775
- 776
- 777
- 778
- 779
- 780
- 781
- 782
- 783
- 784
- 785
- 786
- 787
- 788
- 789
- 790
- 791
- 792
- 793
- 794
- 795
- 796
- 797
- 798
- 799
- 800
- 801
- 802
- 803
- 804
- 805
- 806
- 807
- 808
- 809
- 810
- 811
- 812
- 813
- 814
- 815
- 816
- 817
- 818
- 819
- 820
- 821
- 822
- 823
- 824
- 825
- 826
- 827
- 828
- 829
- 830
- 831
- 832
- 833
- 834
- 835
- 836
- 837
- 838
- 839
- 840
- 841
- 842
- 843
- 844
- 845
- 846
- 847
- 848
- 849
- 850
- 851
- 852
- 853
- 854
- 855
- 856
- 857
- 858
- 859
- 860
- 861
- 862
- 863
- 864
- 865
- 866
- 867
- 868
- 869
- 870
- 871
- 872
- 873
- 874
- 875
- 876
- 877
- 878
- 879
- 880
- 881
- 882
- 883
- 884
- 885
- 886
- 887
- 888
- 889
- 890
- 891
- 892
- 893
- 894
- 895
- 896
- 897
- 898
- 899
- 900
- 901
- 902
- 903
- 904
- 905
- 906
- 907
- 908
- 909
- 910
- 911
- 912
- 913
- 914
- 915
- 916
- 917
- 918
- 919
- 920
- 921
- 922
- 923
- 924
- 925
- 926
- 927
- 928
- 929
- 930
- 931
- 932
- 933
- 934
- 935
- 936
- 937
- 938
- 939
- 940
- 941
- 942
- 943
- 944
- 945
- 946
- 947
- 948
- 949
- 950
- 951
- 952
- 953
- 954
- 955
- 956
- 957
- 958
- 959
- 960
- 961
- 962
- 963
- 964
- 965
- 966
- 967
- 968
- 969
- 970
- 971
- 972
- 973
- 974
- 975
- 976
- 977
- 978
- 979
- 980
- 981
- 982
- 983
- 984
- 985
- 986
- 987
- 988
- 989
- 990
- 991
- 992
- 993
- 994
- 995
- 996
- 997
- 998
- 999
-1000
-1001
-1002
-1003
-1004
-1005
-1006
-1007
-1008
-1009
-1010
-1011
-1012
-1013
-1014
-1015
-1016
-1017
-1018
-1019
-1020
-1021
-1022
-1023
-1024
-1025
-1026
-1027
-1028
-1029
-1030
-1031
-1032
-1033
-1034
-1035
-1036
-1037
-1038
-1039
-1040
-1041
-1042
-1043
-1044
-1045
-1046
-1047
-1048
-1049
-1050
-1051
-1052
-1053
-1054
-1055
-1056
-1057
-1058
-1059
-1060
-1061
-1062
-1063
-1064
-1065
-1066
-1067
-1068
-1069
-1070
-1071
-1072
-1073
-1074
-1075
-1076
-1077
-1078
-1079
-1080
-1081
-1082
-1083
-1084
-1085
-1086
-1087
-1088
-1089
-1090
-1091
-1092
-1093
-1094
-1095
-1096
-1097
-1098
-1099
-1100
-1101
-1102
-1103
-1104
-1105
-1106
-1107
-1108
-1109
-1110
-1111
-1112
-1113
-1114
-1115
-1116
-1117
-1118
-1119
-1120
-1121
-1122
-1123
-1124
-1125
-1126
-1127
-1128
-1129
-1130
-1131
-1132
-1133
-1134
-1135
-1136
-1137
-1138
-1139
-1140
-1141
-1142
-1143
-1144
-1145
-1146
-1147
-1148
-1149
-1150
-1151
-1152
-1153
-1154
-1155
-1156
-1157
-1158
-1159
-1160
-1161
-1162
-1163
-1164
-1165
-1166
-1167
-1168
-1169
-1170
-1171
-1172
-1173
-1174
-1175
-1176
-1177
-1178
-1179
-1180
-1181
-1182
-1183
-1184
-1185
-1186
-1187
-1188
-1189
-1190
-1191
-1192
-1193
-1194
-1195
-1196
-1197
-1198
-1199
-1200
-1201
-1202
-1203
-1204
-1205
-1206
-1207
-1208
-1209
-1210
-1211
-1212
-1213
-1214
-1215
-1216
-1217
-1218
-1219
-1220
-1221
-1222
-1223
-1224
-1225
-1226
-1227
-1228
-1229
-1230
-1231
-1232
-1233
-1234
-1235
-1236
-1237
-1238
-1239
-1240
-1241
-1242
-1243
-1244
-1245
-1246
-1247
-1248
-1249
-1250
-1251
-1252
-1253
-1254
-1255
-1256
-1257
-1258
-1259
-1260
-1261
-1262
-1263
-1264
-1265
-1266
-1267
-1268
-1269
-1270
-1271
-1272
-1273
-1274
-1275
-1276
-1277
-1278
-1279
-1280
-1281
-1282
-1283
-1284
-1285
-1286
-1287
-1288
-1289
-1290
-1291
-1292
-1293
-1294
-1295
-1296
-1297
-1298
-1299
-1300
-1301
-1302
-1303
-1304
-1305
-1306
-1307
-1308
-1309
-1310
-1311
-1312
-1313
-1314
-1315
-1316
-1317
-1318
-1319
-1320
-1321
-1322
-1323
-1324
-1325
-1326
-1327
-1328
-1329
-1330
-1331
-1332
-1333
-1334
-1335
-1336
-1337
-1338
-1339
-1340
-1341
-1342
-1343
-1344
-1345
-1346
-1347
-1348
-1349
-1350
-1351
-1352
-1353
-1354
-1355
-1356
-1357
-1358
-1359
-1360
-1361
-1362
-1363
-1364
-1365
-1366
-1367
-1368
-1369
-1370
-1371
-1372
-1373
-1374
-1375
-1376
-1377
-1378
-1379
-1380
-1381
-1382
-1383
-1384
-1385
-1386
-1387
-1388
-1389
-1390
-1391
-1392
-1393
-1394
-1395
-1396
-1397
-1398
-1399
-1400
-1401
-1402
-1403
-1404
-1405
-1406
-1407
-1408
-1409
-1410
-1411
-1412
-1413
-1414
-1415
-1416
-1417
-1418
-1419
-1420
-1421
-1422
-1423
-1424
-1425
-1426
-1427
-1428
-1429
-1430
-1431
-1432
-1433
-1434
-1435
-1436
-1437
-1438
-1439
-1440
-1441
-1442
-1443
-1444
-1445
-1446
-1447
-1448
-1449
-1450
-1451
-1452
-1453
-1454
-1455
-1456
-1457
-1458
-1459
-1460
-1461
-1462
-1463
-1464
-1465
-1466
-1467
-1468
-1469
-1470
-1471
-1472
-1473
-1474
-1475
-1476
-1477
-1478
-1479
-1480
-1481
-1482
-1483
-1484
-1485
-1486
-1487
-1488
-1489
-1490
-1491
-1492
-1493
-1494
-1495
-1496
-1497
-1498
-1499
-1500
-1501
-1502
-1503
-1504
-1505
-1506
-1507
-1508
-1509
-1510
-1511
-1512
-1513
-1514
-1515
-1516
-1517
-1518
-1519
-1520
-1521
-1522
-1523
-1524
-1525
-1526
-1527
-1528
-1529
-1530
-1531
-1532
-1533
-1534
-1535
-1536
-1537
-1538
-1539
-1540
-1541
-1542
-1543
-1544
-1545
-1546
-1547
-1548
-1549
-1550
-1551
-1552
-1553
-1554
-1555
-1556
-1557
-1558
-1559
-1560
-1561
-1562
-1563
-1564
-1565
-1566
-1567
-1568
-1569
-1570
-1571
-1572
-1573
-1574
-1575
-1576
-1577
-1578
-1579
-1580
-1581
-1582
-1583
-1584
-1585
-1586
-1587
-1588
-1589
-1590
-1591
-1592
-1593
-1594
-1595
-1596
-1597
-1598
-1599
-1600
-1601
-1602
-1603
-1604
-1605
-1606
@frozen(init=False)
-class OAuth2Client:
-    """An OAuth 2.x Client, that can send requests to an OAuth 2.x Authorization Server.
-
-    `OAuth2Client` is able to obtain tokens from the Token Endpoint using any of the standardised
-    Grant Types, and to communicate with the various backend endpoints like the Revocation,
-    Introspection, and UserInfo Endpoint.
-
-    To init an OAuth2Client, you only need the url to the Token Endpoint and the Credentials
-    (a client_id and one of a secret or private_key) that will be used to authenticate to that endpoint.
-    Other endpoint urls, such as the Authorization Endpoint, Revocation Endpoint, etc. can be passed as
-    parameter as well if you intend to use them.
-
-
-    This class is not intended to help with the end-user authentication or any request that goes in
-    a browser. For authentication requests, see
-    [AuthorizationRequest][requests_oauth2client.authorization_request.AuthorizationRequest]. You
-    may use the method `authorization_request()` to generate `AuthorizationRequest`s with the
-    preconfigured `authorization_endpoint`, `client_id` and `redirect_uri' from this client.
-
-    Args:
-        token_endpoint: the Token Endpoint URI where this client will get access tokens
-        auth: the authentication handler to use for client authentication on the token endpoint.
-            Can be:
-
-            - a [requests.auth.AuthBase][] instance (which will be used as-is)
-            - a tuple of `(client_id, client_secret)` which will initialize an instance
-            of [ClientSecretPost][requests_oauth2client.client_authentication.ClientSecretPost]
-            - a `(client_id, jwk)` to initialize
-            a [PrivateKeyJwt][requests_oauth2client.client_authentication.PrivateKeyJwt],
-            - or a `client_id` which will
-            use [PublicApp][requests_oauth2client.client_authentication.PublicApp] authentication.
-
-        client_id: client ID (use either this or `auth`)
-        client_secret: client secret (use either this or `auth`)
-        private_key: private_key to use for client authentication (use either this or `auth`)
-        revocation_endpoint: the Revocation Endpoint URI to use for revoking tokens
-        introspection_endpoint: the Introspection Endpoint URI to use to get info about tokens
-        userinfo_endpoint: the Userinfo Endpoint URI to use to get information about the user
-        authorization_endpoint: the Authorization Endpoint URI, used for initializing Authorization Requests
-        redirect_uri: the redirect_uri for this client
-        backchannel_authentication_endpoint: the BackChannel Authentication URI
-        device_authorization_endpoint: the Device Authorization Endpoint URI to use to authorize devices
-        jwks_uri: the JWKS URI to use to obtain the AS public keys
-        code_challenge_method: challenge method to use for PKCE (should always be 'S256')
-        session: a requests Session to use when sending HTTP requests.
-            Useful if some extra parameters such as proxy or client certificate must be used
-            to connect to the AS.
-        testing: if `True`, don't verify the validity of the endpoint urls that are passed as parameter.
-        **extra_metadata: additional metadata for this client, unused by this class, but may be
-            used by subclasses. Those will be accessible with the `extra_metadata` attribute.
-
-    Usage:
-        ```python
-        client = OAuth2Client(
-            token_endpoint="https://my.as.local/token",
-            revocation_endpoint="https://my.as.local/revoke",
-            client_id="client_id",
-            client_secret="client_secret",
-        )
-
-        # once initialized, a client can send requests to its configured endpoints
-        cc_token = client.client_credentials(scope="my_scope")
-        ac_token = client.authorization_code(code="my_code")
-        client.revoke_access_token(cc_token)
-        ```
-
-    """
-
-    auth: requests.auth.AuthBase = field(converter=client_auth_factory)
-    token_endpoint: str = field()
-    revocation_endpoint: str | None = field()
-    introspection_endpoint: str | None = field()
-    userinfo_endpoint: str | None = field()
-    authorization_endpoint: str | None = field()
-    redirect_uri: str | None = field()
-    backchannel_authentication_endpoint: str | None = field()
-    device_authorization_endpoint: str | None = field()
-    pushed_authorization_request_endpoint: str | None = field()
-    jwks_uri: str | None = field()
-    authorization_server_jwks: JwkSet
-    issuer: str | None = field()
-    id_token_signed_response_alg: str | None = SignatureAlgs.RS256
-    id_token_encrypted_response_alg: str | None = None
-    id_token_decryption_key: Jwk | None = None
-    code_challenge_method: str | None = "S256"
-    authorization_response_iss_parameter_supported: bool = False
-    session: requests.Session = field(factory=requests.Session)
-    extra_metadata: dict[str, Any] = field(factory=dict)
-    testing: bool = False
-
-    bearer_token_class: type[BearerToken] = BearerToken
-
-    exception_classes: ClassVar[dict[str, type[Exception]]] = {
-        "server_error": ServerError,
-        "invalid_request": InvalidRequest,
-        "invalid_client": InvalidClient,
-        "invalid_scope": InvalidScope,
-        "invalid_target": InvalidTarget,
-        "invalid_grant": InvalidGrant,
-        "access_denied": AccessDenied,
-        "unauthorized_client": UnauthorizedClient,
-        "authorization_pending": AuthorizationPending,
-        "slow_down": SlowDown,
-        "expired_token": ExpiredToken,
-        "unsupported_token_type": UnsupportedTokenType,
-    }
-
-    def __init__(  # noqa: PLR0913
-        self,
-        token_endpoint: str,
-        auth: (
-            requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
-        ) = None,
-        *,
-        client_id: str | None = None,
-        client_secret: str | None = None,
-        private_key: Jwk | dict[str, Any] | None = None,
-        revocation_endpoint: str | None = None,
-        introspection_endpoint: str | None = None,
-        userinfo_endpoint: str | None = None,
-        authorization_endpoint: str | None = None,
-        redirect_uri: str | None = None,
-        backchannel_authentication_endpoint: str | None = None,
-        device_authorization_endpoint: str | None = None,
-        pushed_authorization_request_endpoint: str | None = None,
-        jwks_uri: str | None = None,
-        authorization_server_jwks: JwkSet | dict[str, Any] | None = None,
-        issuer: str | None = None,
-        id_token_signed_response_alg: str | None = SignatureAlgs.RS256,
-        id_token_encrypted_response_alg: str | None = None,
-        id_token_decryption_key: Jwk | dict[str, Any] | None = None,
-        code_challenge_method: str = "S256",
-        authorization_response_iss_parameter_supported: bool = False,
-        bearer_token_class: type[BearerToken] = BearerToken,
-        session: requests.Session | None = None,
-        testing: bool = False,
-        **extra_metadata: Any,
-    ):
-        if authorization_response_iss_parameter_supported and not issuer:
-            msg = (
-                "If the Authorization Server supports Issuer Identification, as specified by"
-                " `authorization_response_iss_parameter_supported=True`, then you must specify"
-                " the expected `issuer` value with parameter `issuer`."
-            )
-            raise ValueError(msg)
-
-        auth = client_auth_factory(
-            auth,
-            client_id=client_id,
-            client_secret=client_secret,
-            private_key=private_key,
-            default_auth_handler=ClientSecretPost,
-        )
-
-        if authorization_server_jwks is None:
-            authorization_server_jwks = JwkSet()
-        elif not isinstance(authorization_server_jwks, JwkSet):
-            authorization_server_jwks = JwkSet(authorization_server_jwks)
-
-        if id_token_decryption_key is not None and not isinstance(id_token_decryption_key, Jwk):
-            id_token_decryption_key = Jwk(id_token_decryption_key)
-
-        if id_token_decryption_key is not None and id_token_encrypted_response_alg is None:
-            if id_token_decryption_key.alg:
-                id_token_encrypted_response_alg = id_token_decryption_key.alg
-            else:
-                msg = (
-                    "An ID Token decryption key has been provided but no decryption algorithm is defined."
-                    " You can either pass an `id_token_encrypted_response_alg` parameter with the alg identifier,"
-                    " or include an `alg` attribute in the decryption key, if it is in Jwk format."
-                )
-                raise ValueError(msg)
-
-        if session is None:
-            session = requests.Session()
-
-        self.__attrs_init__(
-            testing=testing,
-            token_endpoint=token_endpoint,
-            revocation_endpoint=revocation_endpoint,
-            introspection_endpoint=introspection_endpoint,
-            userinfo_endpoint=userinfo_endpoint,
-            authorization_endpoint=authorization_endpoint,
-            redirect_uri=redirect_uri,
-            backchannel_authentication_endpoint=backchannel_authentication_endpoint,
-            device_authorization_endpoint=device_authorization_endpoint,
-            pushed_authorization_request_endpoint=pushed_authorization_request_endpoint,
-            jwks_uri=jwks_uri,
-            authorization_server_jwks=authorization_server_jwks,
-            issuer=issuer,
-            session=session,
-            auth=auth,
-            id_token_signed_response_alg=id_token_signed_response_alg,
-            id_token_encrypted_response_alg=id_token_encrypted_response_alg,
-            id_token_decryption_key=id_token_decryption_key,
-            code_challenge_method=code_challenge_method,
-            authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
-            bearer_token_class=bearer_token_class,
-            extra_metadata=extra_metadata,
-        )
-
-    @token_endpoint.validator
-    @revocation_endpoint.validator
-    @introspection_endpoint.validator
-    @userinfo_endpoint.validator
-    @authorization_endpoint.validator
-    @backchannel_authentication_endpoint.validator
-    @device_authorization_endpoint.validator
-    @pushed_authorization_request_endpoint.validator
-    @jwks_uri.validator
-    def validate_endpoint_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
-        """Validate that an endpoint URI is suitable for use.
-
-        If you need to disable some checks (for AS testing purposes only!), provide a different
-        method here.
-
-        """
-        if self.testing or uri is None:
-            return uri
-        try:
-            return validate_endpoint_uri(uri)
-        except ValueError as exc:
-            msg = f"Invalid value '{uri}' for '{attribute.name}': {exc}"
-            raise ValueError(msg) from exc
-
-    @issuer.validator
-    def validate_issuer_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
-        """Validate that an Issuer identifier is suitable for use.
-
-        This is the same check as an endpoint URI, but the path may be (and usually is) empty.
-
-        """
-        if self.testing or uri is None:
-            return uri
-        try:
-            return validate_issuer_uri(uri)
-        except ValueError as exc:
-            msg = f"Invalid value '{uri}' for '{attribute.name}': {exc}"
-            raise ValueError(msg) from exc
-
-    @property
-    def client_id(self) -> str:
-        """Client ID."""
-        if hasattr(self.auth, "client_id"):
-            return self.auth.client_id  # type: ignore[no-any-return]
-        msg = "This client uses a custom authentication method without client_id."
-        raise AttributeError(msg)  # pragma: no cover
-
-    @property
-    def client_secret(self) -> str | None:
-        """Client Secret."""
-        if hasattr(self.auth, "client_secret"):
-            return self.auth.client_secret  # type: ignore[no-any-return]
-        return None
-
-    @property
-    def client_jwks(self) -> JwkSet:
-        """A `JwkSet` containing the public keys for this client.
-
-        Keys are:
-
-        - the public key for client assertion signature verification (if using private_key_jwt)
-        - the ID Token encryption key
-
-        """
-        jwks = JwkSet()
-        if isinstance(self.auth, PrivateKeyJwt):
-            jwks.add_jwk(self.auth.private_jwk.public_jwk().with_usage_parameters())
-        if self.id_token_decryption_key:
-            jwks.add_jwk(self.id_token_decryption_key.public_jwk().with_usage_parameters())
-        return jwks
-
-    def _request(
-        self,
-        endpoint: str,
-        on_success: Callable[[requests.Response], T],
-        on_failure: Callable[[requests.Response], T],
-        accept: str = "application/json",
-        method: str = "POST",
-        **requests_kwargs: Any,
-    ) -> T:
-        """Send a request to one of the endpoints.
-
-        This is a helper method that takes care of the following tasks:
-
-        - make sure the endpoint as been configured
-        - set `Accept: application/json` header
-        - send the HTTP POST request, then
-            - apply `on_success` to a successful response
-            - or apply `on_failure` otherwise
-        - return the result
-
-        Args:
-            endpoint: name of the endpoint to use
-            on_success: a callable to apply to successful responses
-            on_failure: a callable to apply to error responses
-            accept: the Accept header to include in the request
-            method: the HTTP method to use
-            **requests_kwargs: keyword arguments for the request
-
-        """
-        endpoint_uri = self._require_endpoint(endpoint)
-        requests_kwargs.setdefault("headers", {})
-        requests_kwargs["headers"]["Accept"] = accept
-
-        response = self.session.request(
-            method,
-            endpoint_uri,
-            **requests_kwargs,
-        )
-        if response.ok:
-            return on_success(response)
-
-        return on_failure(response)
-
-    def token_request(
-        self,
-        data: dict[str, Any],
-        timeout: int = 10,
-        **requests_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request to the token endpoint.
-
-        Authentication will be added automatically based on the defined `auth` for this client.
-
-        Args:
-          data: parameters to send to the token endpoint. Items with a `None`
-               or empty value will not be sent in the request.
-          timeout: a timeout value for the call
-          **requests_kwargs: additional parameters for requests.post()
-
-        Returns:
-            the token endpoint response, as
-            [`BearerToken`][requests_oauth2client.tokens.BearerToken] instance.
-
-        """
-        return self._request(
-            "token_endpoint",
-            auth=self.auth,
-            data=data,
-            timeout=timeout,
-            on_success=self.parse_token_response,
-            on_failure=self.on_token_error,
-            **requests_kwargs,
-        )
-
-    def parse_token_response(self, response: requests.Response) -> BearerToken:
-        """Parse a Response returned by the Token Endpoint.
-
-        Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] to parse
-        responses returned by the Token Endpoint. Those responses contain an `access_token` and
-        additional attributes.
-
-        Args:
-            response: the [Response][requests.Response] returned by the Token Endpoint.
-
-        Returns:
-            a [`BearerToken`][requests_oauth2client.tokens.BearerToken] based on the response
-            contents.
-
-        """
-        try:
-            token_response = self.bearer_token_class(**response.json())
-        except Exception as response_class_exc:
-            try:
-                return self.on_token_error(response)
-            except Exception as token_error_exc:
-                raise token_error_exc from response_class_exc
-        else:
-            return token_response
-
-    def on_token_error(self, response: requests.Response) -> BearerToken:
-        """Error handler for `token_request()`.
-
-        Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] when the
-        Token Endpoint returns an error.
-
-        Args:
-            response: the [Response][requests.Response] returned by the Token Endpoint.
-
-        Returns:
-            nothing, and raises an exception instead. But a subclass may return a
-            [`BearerToken`][requests_oauth2client.tokens.BearerToken] to implement a default
-            behaviour if needed.
-
-        """
-        try:
-            data = response.json()
-            error = data["error"]
-            error_description = data.get("error_description")
-            error_uri = data.get("error_uri")
-            exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
-            exception = exception_class(response, error, error_description, error_uri)
-        except Exception as exc:
-            raise InvalidTokenResponse(response) from exc
-        raise exception
-
-    def client_credentials(
-        self,
-        scope: str | Iterable[str] | None = None,
-        *,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request to the token endpoint using the `client_credentials` grant.
-
-        Args:
-            scope: the scope to send with the request. Can be a str, or an iterable of str.
-                to pass that way include `scope`, `audience`, `resource`, etc.
-            requests_kwargs: additional parameters for the call to requests
-            **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`. Common parameters
-
-        Returns:
-            a TokenResponse
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        if scope and not isinstance(scope, str):
-            try:
-                scope = " ".join(scope)
-            except Exception as exc:
-                msg = "Unsupported scope value"
-                raise ValueError(msg) from exc
-
-        data = dict(grant_type=GrantType.CLIENT_CREDENTIALS, scope=scope, **token_kwargs)
-        return self.token_request(data, **requests_kwargs)
-
-    def authorization_code(
-        self,
-        code: str | AuthorizationResponse,
-        *,
-        validate: bool = True,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request to the token endpoint with the `authorization_code` grant.
-
-        Args:
-             code: an authorization code or an `AuthorizationResponse` to exchange for tokens
-             validate: if `True`, validate the received ID Token (this works only if `code` is an AuthorizationResponse)
-             requests_kwargs: additional parameters for the call to requests
-             **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `code`, etc.
-
-        Returns:
-            a `BearerToken`
-
-        """
-        azr: AuthorizationResponse | None = None
-        if isinstance(code, AuthorizationResponse):
-            token_kwargs.setdefault("code_verifier", code.code_verifier)
-            token_kwargs.setdefault("redirect_uri", code.redirect_uri)
-            azr = code
-            code = code.code
-
-        requests_kwargs = requests_kwargs or {}
-
-        data = dict(grant_type=GrantType.AUTHORIZATION_CODE, code=code, **token_kwargs)
-        token = self.token_request(data, **requests_kwargs)
-        if validate and token.id_token and isinstance(azr, AuthorizationResponse):
-            return token.validate_id_token(self, azr)
-        return token
-
-    def refresh_token(
-        self,
-        refresh_token: str | BearerToken,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request to the token endpoint with the `refresh_token` grant.
-
-        Args:
-            refresh_token: a refresh_token, as a string, or as a `BearerToken`.
-                That `BearerToken` must have a `refresh_token`.
-            requests_kwargs: additional parameters for the call to `requests`
-            **token_kwargs: additional parameters for the token endpoint,
-                alongside `grant_type`, `refresh_token`, etc.
-
-        Returns:
-            a `BearerToken`
-
-        """
-        if isinstance(refresh_token, BearerToken):
-            if refresh_token.refresh_token is None or not isinstance(refresh_token.refresh_token, str):
-                msg = "This BearerToken doesn't have a refresh_token"
-                raise ValueError(msg)
-            refresh_token = refresh_token.refresh_token
-
-        requests_kwargs = requests_kwargs or {}
-        data = dict(grant_type=GrantType.REFRESH_TOKEN, refresh_token=refresh_token, **token_kwargs)
-        return self.token_request(data, **requests_kwargs)
-
-    def device_code(
-        self,
-        device_code: str | DeviceAuthorizationResponse,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request to the token endpoint using the Device Code grant.
-
-        The grant_type is `urn:ietf:params:oauth:grant-type:device_code`. This needs a Device Code,
-        or a `DeviceAuthorizationResponse` as parameter.
-
-        Args:
-            device_code: a device code, or a `DeviceAuthorizationResponse`
-            requests_kwargs: additional parameters for the call to requests
-            **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `device_code`, etc.
-
-        Returns:
-            a `BearerToken`
-
-        """
-        if isinstance(device_code, DeviceAuthorizationResponse):
-            if device_code.device_code is None or not isinstance(device_code.device_code, str):
-                msg = "This DeviceAuthorizationResponse doesn't have a device_code"
-                raise ValueError(msg)
-            device_code = device_code.device_code
-
-        requests_kwargs = requests_kwargs or {}
-        data = dict(
-            grant_type=GrantType.DEVICE_CODE,
-            device_code=device_code,
-            **token_kwargs,
-        )
-        return self.token_request(data, **requests_kwargs)
-
-    def ciba(
-        self,
-        auth_req_id: str | BackChannelAuthenticationResponse,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a CIBA request to the Token Endpoint.
-
-        A CIBA request is a Token Request using the `urn:openid:params:grant-type:ciba` grant.
-
-        Args:
-            auth_req_id: an authentication request ID, as returned by the AS
-            requests_kwargs: additional parameters for the call to requests
-            **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `auth_req_id`, etc.
-
-        Returns:
-            a `BearerToken`
-
-        """
-        if isinstance(auth_req_id, BackChannelAuthenticationResponse):
-            if auth_req_id.auth_req_id is None or not isinstance(auth_req_id.auth_req_id, str):
-                msg = "This `BackChannelAuthenticationResponse` doesn't have an `auth_req_id`"
-                raise ValueError(msg)
-            auth_req_id = auth_req_id.auth_req_id
-
-        requests_kwargs = requests_kwargs or {}
-        data = dict(
-            grant_type=GrantType.CLIENT_INITIATED_BACKCHANNEL_AUTHENTICATION,
-            auth_req_id=auth_req_id,
-            **token_kwargs,
-        )
-        return self.token_request(data, **requests_kwargs)
-
-    def token_exchange(
-        self,
-        subject_token: str | BearerToken | IdToken,
-        subject_token_type: str | None = None,
-        actor_token: None | str | BearerToken | IdToken = None,
-        actor_token_type: str | None = None,
-        requested_token_type: str | None = None,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a Token Exchange request.
-
-        A Token Exchange request is actually a request to the Token Endpoint with a grant_type
-        `urn:ietf:params:oauth:grant-type:token-exchange`.
-
-        Args:
-            subject_token: the subject token to exchange for a new token.
-            subject_token_type: a token type identifier for the subject_token, mandatory if it cannot be guessed based
-                on `type(subject_token)`.
-            actor_token: the actor token to include in the request, if any.
-            actor_token_type: a token type identifier for the actor_token, mandatory if it cannot be guessed based
-                on `type(actor_token)`.
-            requested_token_type: a token type identifier for the requested token.
-            requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
-            **token_kwargs: additional parameters to include in the request body.
-
-        Returns:
-            a `BearerToken` as returned by the Authorization Server.
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        try:
-            subject_token_type = self.get_token_type(subject_token_type, subject_token)
-        except ValueError:
-            msg = "Cannot determine the kind of 'subject_token' you provided. Please specify a 'subject_token_type'."
-            raise TypeError(msg) from None
-        if actor_token:  # pragma: no branch
-            try:
-                actor_token_type = self.get_token_type(actor_token_type, actor_token)
-            except ValueError:
-                msg = "Cannot determine the kind of 'actor_token' you provided. Please specify an 'actor_token_type'."
-                raise TypeError(msg) from None
-
-        data = dict(
-            grant_type=GrantType.TOKEN_EXCHANGE,
-            subject_token=subject_token,
-            subject_token_type=subject_token_type,
-            actor_token=actor_token,
-            actor_token_type=actor_token_type,
-            requested_token_type=requested_token_type,
-            **token_kwargs,
-        )
-        return self.token_request(data, **requests_kwargs)
-
-    def jwt_bearer(
-        self,
-        assertion: Jwt | str,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request using a JWT as authorization grant.
-
-        This is defined in (RFC7523 $2.1)[https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1).
-
-        Args:
-            assertion: a JWT (as an instance of `jwskate.Jwt` or as a `str`) to use as authorization grant.
-            requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
-            **token_kwargs: additional parameters to include in the request body.
-
-        Returns:
-            a `BearerToken` as returned by the Authorization Server.
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        if not isinstance(assertion, Jwt):
-            assertion = Jwt(assertion)
-
-        data = dict(
-            grant_type=GrantType.JWT_BEARER,
-            assertion=assertion,
-            **token_kwargs,
-        )
-
-        return self.token_request(data, **requests_kwargs)
-
-    def resource_owner_password(
-        self,
-        username: str,
-        password: str,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ) -> BearerToken:
-        """Send a request using the Resource Owner Password Grant.
-
-        This Grant Type is deprecated and should only be used when there is no other choice.
-
-        Args:
-            username: the resource owner user name
-            password: the resource owner password
-            requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
-            **token_kwargs: additional parameters to include in the request body.
-
-        Returns:
-            a `BearerToken` as returned by the Authorization Server
-
-        """
-        requests_kwargs = requests_kwargs or {}
-        data = dict(
-            grant_type=GrantType.RESOURCE_OWNER_PASSWORD,
-            username=username,
-            password=password,
-            **token_kwargs,
-        )
-
-        return self.token_request(data, **requests_kwargs)
-
-    def authorization_request(
-        self,
-        *,
-        scope: None | str | Iterable[str] = "openid",
-        response_type: str = "code",
-        redirect_uri: str | None = None,
-        state: str | ellipsis | None = ...,  # noqa: F821
-        nonce: str | ellipsis | None = ...,  # noqa: F821
-        code_verifier: str | None = None,
-        **kwargs: Any,
-    ) -> AuthorizationRequest:
-        """Generate an Authorization Request for this client.
-
-        Args:
-            scope: the `scope` to use
-            response_type: the `response_type` to use
-            redirect_uri: the `redirect_uri` to include in the request. By default,
-                the `redirect_uri` defined at init time is used.
-            state: the `state` parameter to use. Leave default to generate a random value.
-            nonce: a `nonce`. Leave default to generate a random value.
-            code_verifier: the PKCE `code_verifier` to use. Leave default to generate a random value.
-            **kwargs: additional parameters to include in the auth request
-
-        Returns:
-            an AuthorizationRequest with the supplied parameters
-
-        """
-        authorization_endpoint = self._require_endpoint("authorization_endpoint")
-
-        redirect_uri = redirect_uri or self.redirect_uri
-        if not redirect_uri:
-            msg = (
-                "No 'redirect_uri' defined for this client. You must either pass a redirect_uri"
-                " as parameter to this method, or include a redirect_uri when initializing your"
-                " OAuth2Client."
-            )
-            raise AttributeError(msg)
-
-        if response_type != "code":
-            msg = "Only response_type=code is supported."
-            raise ValueError(msg)
-
-        return AuthorizationRequest(
-            authorization_endpoint=authorization_endpoint,
-            client_id=self.client_id,
-            redirect_uri=redirect_uri,
-            issuer=self.issuer,
-            response_type=response_type,
-            scope=scope,
-            state=state,
-            nonce=nonce,
-            code_verifier=code_verifier,
-            code_challenge_method=self.code_challenge_method,
-            **kwargs,
-        )
-
-    def pushed_authorization_request(
-        self,
-        authorization_request: AuthorizationRequest,
-        requests_kwargs: dict[str, Any] | None = None,
-    ) -> RequestUriParameterAuthorizationRequest:
-        """Send a Pushed Authorization Request.
-
-        This sends a request to the Pushed Authorization Request Endpoint, and returns a
-        `RequestUriParameterAuthorizationRequest` initialized with the AS response.
-
-        Args:
-            authorization_request: the authorization request to send
-            requests_kwargs: additional parameters for `requests.request()`
-
-        Returns:
-            the `RequestUriParameterAuthorizationRequest` initialized based on the AS response
-
-        """
-        requests_kwargs = requests_kwargs or {}
-        return self._request(
-            "pushed_authorization_request_endpoint",
-            data=authorization_request.args,
-            auth=self.auth,
-            on_success=self.parse_pushed_authorization_response,
-            on_failure=self.on_pushed_authorization_request_error,
-            **requests_kwargs,
-        )
-
-    def parse_pushed_authorization_response(
-        self, response: requests.Response
-    ) -> RequestUriParameterAuthorizationRequest:
-        """Parse the response obtained by `pushed_authorization_request()`.
-
-        Args:
-            response: the `requests.Response` returned by the PAR endpoint
-
-        Returns:
-            a RequestUriParameterAuthorizationRequest instance
-
-        """
-        response_json = response.json()
-        request_uri = response_json.get("request_uri")
-        expires_in = response_json.get("expires_in")
-
-        return RequestUriParameterAuthorizationRequest(
-            authorization_endpoint=self.authorization_endpoint,
-            client_id=self.client_id,
-            request_uri=request_uri,
-            expires_in=expires_in,
-        )
-
-    def on_pushed_authorization_request_error(
-        self, response: requests.Response
-    ) -> RequestUriParameterAuthorizationRequest:
-        """Error Handler for Pushed Authorization Endpoint errors.
-
-        Args:
-            response: the HTTP response as returned by the AS PAR endpoint.
-
-        Returns:
-            a RequestUriParameterAuthorizationRequest, if the error is recoverable
-
-        Raises:
-            EndpointError: a subclass of this error depending on the error returned by the AS
-            InvalidPushedAuthorizationResponse: if the returned response is not following the
-            specifications UnknownTokenEndpointError: for unknown/unhandled errors
-
-        """
-        try:
-            data = response.json()
-            error = data["error"]
-            error_description = data.get("error_description")
-            error_uri = data.get("error_uri")
-            exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
-            exception = exception_class(response, error, error_description, error_uri)
-        except Exception as exc:
-            raise InvalidPushedAuthorizationResponse(response) from exc
-        raise exception
-
-    def userinfo(self, access_token: BearerToken | str) -> Any:
-        """Call the UserInfo endpoint.
-
-        This sends a request to the UserInfo endpoint, with the specified access_token, and returns
-        the parsed result.
-
-        Args:
-            access_token: the access token to use
-
-        Returns:
-            the [Response][requests.Response] returned by the userinfo endpoint.
-
-        """
-        return self._request(
-            "userinfo_endpoint",
-            auth=BearerAuth(access_token),
-            on_success=self.parse_userinfo_response,
-            on_failure=self.on_userinfo_error,
-        )
-
-    def parse_userinfo_response(self, resp: requests.Response) -> Any:
-        """Parse the response obtained by `userinfo()`.
-
-        Invoked by [userinfo()][requests_oauth2client.client.OAuth2Client.userinfo] to parse the
-        response from the UserInfo endpoint, this will extract and return its JSON content.
-
-        Args:
-            resp: a [Response][requests.Response] returned from the UserInfo endpoint.
-
-        Returns:
-            the parsed JSON content from this response.
-
-        """
-        return resp.json()
-
-    def on_userinfo_error(self, resp: requests.Response) -> Any:
-        """Parse UserInfo error response.
-
-        Args:
-            resp: a [Response][requests.Response] returned from the UserInfo endpoint.
-
-        Returns:
-            nothing, raises exception instead.
-
-        """
-        resp.raise_for_status()
-
-    @classmethod
-    def get_token_type(  # noqa: C901
-        cls,
-        token_type: str | None = None,
-        token: None | str | BearerToken | IdToken = None,
-    ) -> str:
-        """Get standardized token type identifiers.
-
-        Return a standardized token type identifier, based on a short `token_type` hint and/or a
-        token value.
-
-        Args:
-            token_type: a token_type hint, as `str`. May be "access_token", "refresh_token"
-                or "id_token"
-            token: a token value, as an instance of `BearerToken` or IdToken, or as a `str`.
-
-        Returns:
-            the token_type as defined in the Token Exchange RFC8693.
-
-        """
-        if not (token_type or token):
-            msg = "Cannot determine type of an empty token without a token_type hint"
-            raise ValueError(msg)
-
-        if token_type is None:
-            if isinstance(token, str):
-                msg = "Cannot determine the type of provided token when it is a bare str. Please specify a token_type."
-                raise ValueError(msg)
-            elif isinstance(token, BearerToken):
-                return "urn:ietf:params:oauth:token-type:access_token"
-            elif isinstance(token, IdToken):
-                return "urn:ietf:params:oauth:token-type:id_token"
-            else:
-                msg = "Unexpected type of token, please provide a string or a BearerToken or an IdToken."
-                raise TypeError(
-                    msg,
-                    type(token),
-                )
-        elif token_type == TokenType.ACCESS_TOKEN:
-            if token is not None and not isinstance(token, (str, BearerToken)):
-                msg = "The supplied token is not a BearerToken or a string representation of it."
-                raise TypeError(
-                    msg,
-                    type(token),
-                )
-            return "urn:ietf:params:oauth:token-type:access_token"
-        elif token_type == TokenType.REFRESH_TOKEN:
-            if token is not None and isinstance(token, BearerToken) and not token.refresh_token:
-                msg = "The supplied BearerToken doesn't have a refresh_token."
-                raise ValueError(msg)
-            return "urn:ietf:params:oauth:token-type:refresh_token"
-        elif token_type == "id_token":
-            if token is not None and not isinstance(token, (str, IdToken)):
-                msg = "The supplied token is not an IdToken or a string representation of it."
-                raise TypeError(
-                    msg,
-                    type(token),
-                )
-            return "urn:ietf:params:oauth:token-type:id_token"
-        else:
-            return {
-                "saml1": "urn:ietf:params:oauth:token-type:saml1",
-                "saml2": "urn:ietf:params:oauth:token-type:saml2",
-                "jwt": "urn:ietf:params:oauth:token-type:jwt",
-            }.get(token_type, token_type)
-
-    def revoke_access_token(
-        self,
-        access_token: BearerToken | str,
-        requests_kwargs: dict[str, Any] | None = None,
-        **revoke_kwargs: Any,
-    ) -> bool:
-        """Send a request to the Revocation Endpoint to revoke an access token.
-
-        Args:
-            access_token: the access token to revoke
-            requests_kwargs: additional parameters for the underlying requests.post() call
-            **revoke_kwargs: additional parameters to pass to the revocation endpoint
-
-        """
-        return self.revoke_token(
-            access_token,
-            token_type_hint=TokenType.ACCESS_TOKEN,
-            requests_kwargs=requests_kwargs,
-            **revoke_kwargs,
-        )
-
-    def revoke_refresh_token(
-        self,
-        refresh_token: str | BearerToken,
-        requests_kwargs: dict[str, Any] | None = None,
-        **revoke_kwargs: Any,
-    ) -> bool:
-        """Send a request to the Revocation Endpoint to revoke a refresh token.
-
-        Args:
-            refresh_token: the refresh token to revoke.
-            requests_kwargs: additional parameters to pass to the revocation endpoint.
-            **revoke_kwargs: additional parameters to pass to the revocation endpoint.
-
-        Returns:
-            `True` if the revocation request is successful, `False` if this client has no configured
-            revocation endpoint.
-
-        """
-        if isinstance(refresh_token, BearerToken):
-            if refresh_token.refresh_token is None:
-                msg = "The supplied BearerToken doesn't have a refresh token."
-                raise ValueError(msg)
-            refresh_token = refresh_token.refresh_token
-
-        return self.revoke_token(
-            refresh_token,
-            token_type_hint=TokenType.REFRESH_TOKEN,
-            requests_kwargs=requests_kwargs,
-            **revoke_kwargs,
-        )
-
-    def revoke_token(
-        self,
-        token: str | BearerToken,
-        token_type_hint: str | None = None,
-        requests_kwargs: dict[str, Any] | None = None,
-        **revoke_kwargs: Any,
-    ) -> bool:
-        """Send a Token Revocation request.
-
-        By default, authentication will be the same than the one used for the Token Endpoint.
-
-        Args:
-            token: the token to revoke.
-            token_type_hint: a token_type_hint to send to the revocation endpoint.
-            requests_kwargs: additional parameters to the underling call to requests.post()
-            **revoke_kwargs: additional parameters to send to the revocation endpoint.
-
-        Returns:
-            `True` if the revocation succeeds, `False` if no revocation endpoint is present or a
-            non-standardised error is returned.
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        if token_type_hint == TokenType.REFRESH_TOKEN and isinstance(token, BearerToken):
-            if token.refresh_token is None:
-                msg = "The supplied BearerToken doesn't have a refresh token."
-                raise ValueError(msg)
-            token = token.refresh_token
-
-        data = dict(revoke_kwargs, token=str(token))
-        if token_type_hint:
-            data["token_type_hint"] = token_type_hint
-
-        return self._request(
-            "revocation_endpoint",
-            data=data,
-            auth=self.auth,
-            on_success=lambda resp: True,
-            on_failure=self.on_revocation_error,
-            **requests_kwargs,
-        )
-
-    def on_revocation_error(self, response: requests.Response) -> bool:
-        """Error handler for `revoke_token()`.
-
-        Invoked by [revoke_token()][requests_oauth2client.client.OAuth2Client.revoke_token] when the
-        revocation endpoint returns an error.
-
-        Args:
-            response: the [Response][requests.Response] as returned by the Revocation Endpoint
-
-        Returns:
-            `False` to signal that an error occurred. May raise exceptions instead depending on the
-            revocation response.
-
-        """
-        try:
-            data = response.json()
-            error = data["error"]
-            error_description = data.get("error_description")
-            error_uri = data.get("error_uri")
-            exception_class = self.exception_classes.get(error, RevocationError)
-            exception = exception_class(error, error_description, error_uri)
-        except Exception:
-            return False
-        raise exception
-
-    def introspect_token(
-        self,
-        token: str | BearerToken,
-        token_type_hint: str | None = None,
-        requests_kwargs: dict[str, Any] | None = None,
-        **introspect_kwargs: Any,
-    ) -> Any:
-        """Send a request to the Introspection Endpoint.
-
-        Parameter `token` can be:
-
-        - a `str`
-        - a `BearerToken` instance
-
-        You may pass any arbitrary `token` and `token_type_hint` values as `str`. Those will
-        be included in the request, as-is.
-        If `token` is a `BearerToken`, then `token_type_hint` must be either:
-
-        - `None`: the access_token will be instrospected and no token_type_hint will be included
-        in the request
-        - `access_token`: same as `None`, but the token_type_hint will be included
-        - or `refresh_token`: only available if a Refresh Token is present in the BearerToken.
-
-        Args:
-            token: the token to instrospect
-            token_type_hint: the `token_type_hint` to include in the request.
-            requests_kwargs: additional parameters to the underling call to requests.post()
-            **introspect_kwargs: additional parameters to send to the introspection endpoint.
-
-        Returns:
-            the response as returned by the Introspection Endpoint.
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        if isinstance(token, BearerToken):
-            if token_type_hint is None or token_type_hint == TokenType.ACCESS_TOKEN:
-                token = token.access_token
-            elif token_type_hint == TokenType.REFRESH_TOKEN:
-                if token.refresh_token is None:
-                    msg = "The supplied BearerToken doesn't have a refresh token."
-                    raise ValueError(msg)
-                else:
-                    token = token.refresh_token
-            else:
-                msg = (
-                    "Invalid `token_type_hint`. To test arbitrary `token_type_hint` values,"
-                    " you must provide `token` as a `str`."
-                )
-                raise ValueError(msg)
-
-        data = dict(introspect_kwargs, token=str(token))
-        if token_type_hint:
-            data["token_type_hint"] = token_type_hint
-
-        return self._request(
-            "introspection_endpoint",
-            data=data,
-            auth=self.auth,
-            on_success=self.parse_introspection_response,
-            on_failure=self.on_introspection_error,
-            **requests_kwargs,
-        )
-
-    def parse_introspection_response(self, response: requests.Response) -> Any:
-        """Parse Token Introspection Responses received by `introspect_token()`.
-
-        Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
-        to parse the returned response. This decodes the JSON content if possible, otherwise it
-        returns the response as a string.
-
-        Args:
-            response: the [Response][requests.Response] as returned by the Introspection Endpoint.
-
-        Returns:
-            the decoded JSON content, or a `str` with the content.
-
-        """
-        try:
-            return response.json()
-        except ValueError:
-            return response.text
-
-    def on_introspection_error(self, response: requests.Response) -> Any:
-        """Error handler for `introspect_token()`.
-
-        Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
-        to parse the returned response in the case an error is returned.
-
-        Args:
-            response: the response as returned by the Introspection Endpoint.
-
-        Returns:
-            usually raises exceptions. A subclass can return a default response instead.
-
-        """
-        try:
-            data = response.json()
-            error = data["error"]
-            error_description = data.get("error_description")
-            error_uri = data.get("error_uri")
-            exception_class = self.exception_classes.get(error, IntrospectionError)
-            exception = exception_class(error, error_description, error_uri)
-        except Exception as exc:
-            raise UnknownIntrospectionError(response) from exc
-        raise exception
-
-    def backchannel_authentication_request(  # noqa: PLR0913
-        self,
-        scope: None | str | Iterable[str] = "openid",
-        *,
-        client_notification_token: str | None = None,
-        acr_values: None | str | Iterable[str] = None,
-        login_hint_token: str | None = None,
-        id_token_hint: str | None = None,
-        login_hint: str | None = None,
-        binding_message: str | None = None,
-        user_code: str | None = None,
-        requested_expiry: int | None = None,
-        private_jwk: Jwk | dict[str, Any] | None = None,
-        alg: str | None = None,
-        requests_kwargs: dict[str, Any] | None = None,
-        **ciba_kwargs: Any,
-    ) -> BackChannelAuthenticationResponse:
-        """Send a CIBA Authentication Request.
-
-        Args:
-             scope: the scope to include in the request.
-             client_notification_token: the Client Notification Token to include in the request.
-             acr_values: the acr values to include in the request.
-             login_hint_token: the Login Hint Token to include in the request.
-             id_token_hint: the ID Token Hint to include in the request.
-             login_hint: the Login Hint to include in the request.
-             binding_message: the Binding Message to include in the request.
-             user_code: the User Code to include in the request
-             requested_expiry: the Requested Expiry, in seconds, to include in the request.
-             private_jwk: the JWK to use to sign the request (optional)
-             alg: the alg to use to sign the request, if the provided JWK does not include an "alg" parameter.
-             requests_kwargs: additional parameters for
-             **ciba_kwargs: additional parameters to include in the request.
-
-        Returns:
-            a BackChannelAuthenticationResponse as returned by AS
-
-        """
-        if not (login_hint or login_hint_token or id_token_hint):
-            msg = "One of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
-            raise ValueError(msg)
-
-        if (login_hint_token and id_token_hint) or (login_hint and id_token_hint) or (login_hint_token and login_hint):
-            msg = "Only one of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
-            raise ValueError(msg)
-
-        requests_kwargs = requests_kwargs or {}
-
-        if scope is not None and not isinstance(scope, str):
-            try:
-                scope = " ".join(scope)
-            except Exception as exc:
-                msg = "Unsupported `scope` value"
-                raise ValueError(msg) from exc
-
-        if acr_values is not None and not isinstance(acr_values, str):
-            try:
-                acr_values = " ".join(acr_values)
-            except Exception as exc:
-                msg = "Unsupported `acr_values`"
-                raise ValueError(msg) from exc
-
-        data = dict(
-            ciba_kwargs,
-            scope=scope,
-            client_notification_token=client_notification_token,
-            acr_values=acr_values,
-            login_hint_token=login_hint_token,
-            id_token_hint=id_token_hint,
-            login_hint=login_hint,
-            binding_message=binding_message,
-            user_code=user_code,
-            requested_expiry=requested_expiry,
-        )
-
-        if private_jwk is not None:
-            data = {"request": str(Jwt.sign(data, key=private_jwk, alg=alg))}
-
-        return self._request(
-            "backchannel_authentication_endpoint",
-            data=data,
-            auth=self.auth,
-            on_success=self.parse_backchannel_authentication_response,
-            on_failure=self.on_backchannel_authentication_error,
-            **requests_kwargs,
-        )
-
-    def parse_backchannel_authentication_response(
-        self, response: requests.Response
-    ) -> BackChannelAuthenticationResponse:
-        """Parse a response received by `backchannel_authentication_request()`.
-
-        Invoked by
-        [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
-        to parse the response returned by the BackChannel Authentication Endpoint.
-
-        Args:
-            response: the response returned by the BackChannel Authentication Endpoint.
-
-        Returns:
-            a `BackChannelAuthenticationResponse`
-
-        """
-        try:
-            return BackChannelAuthenticationResponse(**response.json())
-        except TypeError as exc:
-            raise InvalidBackChannelAuthenticationResponse(response) from exc
-
-    def on_backchannel_authentication_error(self, response: requests.Response) -> BackChannelAuthenticationResponse:
-        """Error handler for `backchannel_authentication_request()`.
-
-        Invoked by
-        [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
-        to parse the response returned by the BackChannel Authentication Endpoint, when it is an
-        error.
-
-        Args:
-            response: the response returned by the BackChannel Authentication Endpoint.
-
-        Returns:
-            usually raises an exception. But a subclass can return a default response instead.
-
-        """
-        try:
-            data = response.json()
-            error = data["error"]
-            error_description = data.get("error_description")
-            error_uri = data.get("error_uri")
-            exception_class = self.exception_classes.get(error, BackChannelAuthenticationError)
-            exception = exception_class(error, error_description, error_uri)
-        except Exception as exc:
-            raise InvalidBackChannelAuthenticationResponse(response) from exc
-        raise exception
-
-    def authorize_device(
-        self, requests_kwargs: dict[str, Any] | None = None, **data: Any
-    ) -> DeviceAuthorizationResponse:
-        """Send a Device Authorization Request.
-
-        Args:
-            **data: additional data to send to the Device Authorization Endpoint
-            requests_kwargs: additional parameters for `requests.request()`
-
-        Returns:
-            a Device Authorization Response
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        return self._request(
-            "device_authorization_endpoint",
-            data=data,
-            auth=self.auth,
-            on_success=self.parse_device_authorization_response,
-            on_failure=self.on_device_authorization_error,
-            **requests_kwargs,
-        )
-
-    def parse_device_authorization_response(self, response: requests.Response) -> DeviceAuthorizationResponse:
-        """Parse a Device Authorization Response received by `authorize_device()`.
-
-        Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
-        to parse the response returned by the Device Authorization Endpoint.
-
-        Args:
-            response: the response returned by the Device Authorization Endpoint.
-
-        Returns:
-            a `DeviceAuthorizationResponse` as returned by AS
-
-        """
-        device_authorization_response = DeviceAuthorizationResponse(**response.json())
-        return device_authorization_response
-
-    def on_device_authorization_error(self, response: requests.Response) -> DeviceAuthorizationResponse:
-        """Error handler for `authorize_device()`.
-
-        Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
-        to parse the response returned by the Device Authorization Endpoint, when that response is
-        an error.
-
-        Args:
-            response: the response returned by the Device Authorization Endpoint.
-
-        Returns:
-            usually raises an Exception. But a subclass may return a default response instead.
-
-        """
-        try:
-            data = response.json()
-            error = data["error"]
-            error_description = data.get("error_description")
-            error_uri = data.get("error_uri")
-            exception_class = self.exception_classes.get(error, DeviceAuthorizationError)
-            exception = exception_class(response, error, error_description, error_uri)
-        except Exception as exc:
-            raise InvalidDeviceAuthorizationResponse(response) from exc
-        raise exception
-
-    def update_authorization_server_public_keys(self, requests_kwargs: dict[str, Any] | None = None) -> JwkSet:
-        """Update the cached AS public keys by retrieving them from its `jwks_uri`.
-
-        Public keys are returned by this method, as a `jwskate.JwkSet`. They are also
-        available in attribute `authorization_server_jwks`.
-
-        Returns:
-            the retrieved public keys
-
-        Raises:
-            ValueError: if no `jwks_uri` is configured
-
-        """
-        requests_kwargs = requests_kwargs or {}
-
-        jwks = self._request(
-            "jwks_uri",
-            auth=None,
-            method="GET",
-            on_success=lambda resp: resp.json(),
-            on_failure=lambda resp: resp.raise_for_status(),
-            **requests_kwargs,
-        )
-        self.authorization_server_jwks.update(jwks)
-        return self.authorization_server_jwks
-
-    @classmethod
-    def from_discovery_endpoint(
-        cls,
-        url: str | None = None,
-        issuer: str | None = None,
-        *,
-        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
-        client_id: str | None = None,
-        client_secret: str | None = None,
-        private_key: Jwk | dict[str, Any] | None = None,
-        session: requests.Session | None = None,
-        testing: bool = False,
-        **kwargs: Any,
-    ) -> OAuth2Client:
-        """Initialise an OAuth2Client based on Authorization Server Metadata.
-
-        This will retrieve the standardised metadata document available at `url`, and will extract
-        all Endpoint Uris from that document, will fetch the current public keys from its
-        `jwks_uri`, then will initialise an OAuth2Client based on those endpoints.
-
-        Args:
-             url: the url where the server metadata will be retrieved
-             auth: the authentication handler to use for client authentication
-             client_id: client ID
-             client_secret: client secret to use to authenticate the client
-             private_key: private key to sign client assertions
-             session: a `requests.Session` to use to retrieve the document and initialise the client with
-             issuer: if an issuer is given, check that it matches the one from the retrieved document
-             testing: if True, don't try to validate the endpoint urls that are part of the document
-             **kwargs: additional keyword parameters to pass to OAuth2Client
-
-        Returns:
-            an OAuth2Client with endpoint initialised based on the obtained metadata
-
-        Raises:
-            ValueError: if neither `url` nor `issuer` are suitable urls
-            requests.HTTPError: if an error happens while fetching the documents
-
-        """
-        if url is None and issuer is not None:
-            url = oidc_discovery_document_url(issuer)
-        if url is None:
-            msg = "Please specify at least one of `issuer` or `url`"
-            raise ValueError(msg)
-
-        validate_endpoint_uri(url, path=False)
-
-        session = session or requests.Session()
-        discovery = session.get(url).json()
-
-        jwks_uri = discovery.get("jwks_uri")
-        if jwks_uri:
-            jwks = JwkSet(session.get(jwks_uri).json())
-
-        return cls.from_discovery_document(
-            discovery,
-            issuer=issuer,
-            auth=auth,
-            session=session,
-            client_id=client_id,
-            client_secret=client_secret,
-            private_key=private_key,
-            authorization_server_jwks=jwks,
-            testing=testing,
-            **kwargs,
-        )
-
-    @classmethod
-    def from_discovery_document(  # noqa: PLR0913
-        cls,
-        discovery: dict[str, Any],
-        issuer: str | None = None,
-        *,
-        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
-        client_id: str | None = None,
-        client_secret: str | None = None,
-        private_key: Jwk | dict[str, Any] | None = None,
-        authorization_server_jwks: JwkSet | dict[str, Any] | None = None,
-        session: requests.Session | None = None,
-        https: bool = True,
-        testing: bool = False,
-        **kwargs: Any,
-    ) -> OAuth2Client:
-        """Initialise an OAuth2Client, based on the server metadata from `discovery`.
-
-        Args:
-             discovery: a dict of server metadata, in the same format as retrieved from a discovery endpoint.
-             issuer: if an issuer is given, check that it matches the one mentioned in the document
-             auth: the authentication handler to use for client authentication
-             client_id: client ID
-             client_secret: client secret to use to authenticate the client
-             private_key: private key to sign client assertions
-             authorization_server_jwks: the current authorization server JWKS keys
-             session: a requests Session to use to retrieve the document and initialise the client with
-             https: (deprecated) if `True`, validates that urls in the discovery document use the https scheme
-             testing: if True, don't try to validate the endpoint urls that are part of the document
-             **kwargs: additional args that will be passed to OAuth2Client
-
-        Returns:
-            an `OAuth2Client`
-
-        """
-        if not https:
-            warnings.warn(
-                "The https parameter is deprecated."
-                " To disable endpoint uri validation, set `testing=True` when initializing your OAuth2Client.",
-                stacklevel=1,
-            )
-            testing = True
-        if issuer and discovery.get("issuer") != issuer:
-            msg = "Mismatching issuer value in discovery document: "
-            raise ValueError(
-                msg,
-                issuer,
-                discovery.get("issuer"),
-            )
-        elif issuer is None:
-            issuer = discovery.get("issuer")
-
-        token_endpoint = discovery.get("token_endpoint")
-        if token_endpoint is None:
-            msg = "token_endpoint not found in that discovery document"
-            raise ValueError(msg)
-        authorization_endpoint = discovery.get("authorization_endpoint")
-        revocation_endpoint = discovery.get("revocation_endpoint")
-        introspection_endpoint = discovery.get("introspection_endpoint")
-        userinfo_endpoint = discovery.get("userinfo_endpoint")
-        jwks_uri = discovery.get("jwks_uri")
-        if jwks_uri is not None:
-            validate_endpoint_uri(jwks_uri, https=https)
-        authorization_response_iss_parameter_supported = discovery.get(
-            "authorization_response_iss_parameter_supported", False
-        )
-
-        return cls(
-            token_endpoint=token_endpoint,
-            authorization_endpoint=authorization_endpoint,
-            revocation_endpoint=revocation_endpoint,
-            introspection_endpoint=introspection_endpoint,
-            userinfo_endpoint=userinfo_endpoint,
-            jwks_uri=jwks_uri,
-            authorization_server_jwks=authorization_server_jwks,
-            auth=auth,
-            client_id=client_id,
-            client_secret=client_secret,
-            private_key=private_key,
-            session=session,
-            issuer=issuer,
-            authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
-            testing=testing,
-            **kwargs,
-        )
-
-    def __enter__(self) -> OAuth2Client:
-        """Allow using `OAuth2Client` as a context-manager.
-
-        The Authorization Server public keys are retrieved on `__enter__`.
-
-        """
-        self.update_authorization_server_public_keys()
-        return self
-
-    def __exit__(self, exc_type: Any, exc_val: Any, exc_tb: Any) -> bool:  # noqa: D105
-        return True
-
-    def _require_endpoint(self, endpoint: str) -> str:
-        """Check that a required endpoint url is set."""
-        url = getattr(self, endpoint, None)
-        if not url:
-            msg = (
-                f"No '{endpoint}' defined for this client. Please provide the URL for that"
-                f" endpoint when initializing your {self.__class__.__name__} instance."
-            )
-            raise AttributeError(msg)
-
-        return str(url)
-
-
+
- +
-
+
+
+

+ PrivateKeyJwt +

-
+
+

+ Bases: BaseClientAssertionAuthenticationMethod

-
- client_id: str - - - property - +

Implement private_key_jwt client authentication method.

+

With this method, the client generates and sends a client_assertion, that is asymmetrically +signed with a private key, on each direct request to the Authorization Server.

+

The private key must be supplied as a jwskate.Jwk instance, +or any key material that can be used to initialize one.

+ + +

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client_id + str + +
+

the client_id to use.

+
+ 		+ required +
private_jwk + Jwk | dict[str, Any] | Any + +
+

the private key to use to sign generated Client Assertions.

+
+ 		+ required +
alg + str | None + +
+

the alg to use to sign generated Client Assertions.

+
+ 		+ None +
lifetime + int + +
+

the lifetime to use for generated Client Assertions.

+
+ 		+ 60 +
jti_gen + Callable[[], str] + +
+

a function to generate JWT Token Ids (jti) for generated Client Assertions.

+
+ 		+ lambda: str(uuid4()) +
aud + str | None + +
+

the audience value to use. If None (default), the endpoint URL will be used.k

+
+ 		+ None +
+ + +
+ Example + 
1
+2
+3
+4
+5
+6
+7
+8
+9
from jwskate import Jwk
+from requests_oauth2client import OAuth2Client, PrivateKeyJwt
+
+# load your private key from wherever it is stored:
+with open("my_private_key.pem") as f:
+    my_private_key = Jwk.from_pem(f.read(), password="my_private_key_password")
+
+auth = PrivateKeyJwt("my_client_id", my_private_key, alg="RS256")
+client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+
+
+
+ Source code in requests_oauth2client/client_authentication.py + 
309
+310
+311
+312
+313
+314
+315
+316
+317
+318
+319
+320
+321
+322
+323
+324
+325
+326
+327
+328
+329
+330
+331
+332
+333
+334
+335
+336
+337
+338
+339
+340
+341
+342
+343
+344
+345
+346
+347
+348
+349
+350
+351
+352
+353
+354
+355
+356
+357
+358
+359
+360
+361
+362
+363
+364
+365
+366
+367
+368
+369
+370
+371
+372
+373
+374
+375
+376
+377
+378
+379
+380
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391
+392
+393
+394
+395
+396
+397
+398
+399
+400
+401
+402
+403
+404
@frozen(init=False)
+class PrivateKeyJwt(BaseClientAssertionAuthenticationMethod):
+    """Implement `private_key_jwt` client authentication method.
+
+    With this method, the client generates and sends a client_assertion, that is asymmetrically
+    signed with a private key, on each direct request to the Authorization Server.
+
+    The private key must be supplied as a [`jwskate.Jwk`][jwskate.jwk.Jwk] instance,
+    or any key material that can be used to initialize one.
+
+    Args:
+        client_id: the `client_id` to use.
+        private_jwk: the private key to use to sign generated Client Assertions.
+        alg: the alg to use to sign generated Client Assertions.
+        lifetime: the lifetime to use for generated Client Assertions.
+        jti_gen: a function to generate JWT Token Ids (`jti`) for generated Client Assertions.
+        aud: the audience value to use. If `None` (default), the endpoint URL will be used.k
+
+    Example:
+        ```python
+        from jwskate import Jwk
+        from requests_oauth2client import OAuth2Client, PrivateKeyJwt
+
+        # load your private key from wherever it is stored:
+        with open("my_private_key.pem") as f:
+            my_private_key = Jwk.from_pem(f.read(), password="my_private_key_password")
+
+        auth = PrivateKeyJwt("my_client_id", my_private_key, alg="RS256")
+        client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+        ```
+
+    """
+
+    private_jwk: Jwk = field(converter=to_jwk)
+    alg: str | None
+
+    def __init__(
+        self,
+        client_id: str,
+        private_jwk: Jwk | dict[str, Any] | Any,
+        *,
+        alg: str | None = None,
+        lifetime: int = 60,
+        jti_gen: Callable[[], str] = lambda: str(uuid4()),
+        aud: str | None = None,
+    ) -> None:
+        self.__attrs_init__(
+            client_id=client_id,
+            private_jwk=private_jwk,
+            alg=alg,
+            lifetime=lifetime,
+            jti_gen=jti_gen,
+            aud=aud,
+        )
+
+        alg = self.private_jwk.alg or alg
+        if not alg:
+            raise InvalidClientAssertionSigningKeyOrAlg(alg)
+
+        if alg not in self.private_jwk.supported_signing_algorithms():
+            raise InvalidClientAssertionSigningKeyOrAlg(alg)
+
+        if not self.private_jwk.is_private or self.private_jwk.is_symmetric:
+            raise InvalidClientAssertionSigningKeyOrAlg(alg)
+
+        kid = self.private_jwk.get("kid")
+        if not kid:
+            raise InvalidClientAssertionSigningKeyOrAlg(alg)
+
+    def client_assertion(self, audience: str) -> str:
+        """Generate a Client Assertion, asymmetrically signed with `private_jwk` as key.
+
+        Args:
+            audience: the audience to use for the generated Client Assertion.
+
+        Returns:
+            a Client Assertion.
+
+        """
+        iat = int(datetime.now(tz=timezone.utc).timestamp())
+        exp = iat + self.lifetime
+        jti = str(self.jti_gen())
+
+        jwt = Jwt.sign(
+            claims={
+                "iss": self.client_id,
+                "sub": self.client_id,
+                "aud": audience,
+                "iat": iat,
+                "exp": exp,
+                "jti": jti,
+            },
+            key=self.private_jwk,
+            alg=self.alg,
+        )
+        return str(jwt)
+
+
-
-
- -

Client ID.

-
+
-
-
-
- client_secret: str | None - - - property - -
-
- -

Client Secret.

-
-
+
-
+
+ client_assertion(audience) +
-
- client_jwks: JwkSet - - - property - -
+
+

Generate a Client Assertion, asymmetrically signed with private_jwk as key.

-
- -

A JwkSet containing the public keys for this client.

-

Keys are:

-
    -
  • the public key for client assertion signature verification (if using private_key_jwt)
    • -
  • the ID Token encryption key
    • -
-
-
+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
audience + str + +
+

the audience to use for the generated Client Assertion.

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

a Client Assertion.

+
+
+
+ Source code in requests_oauth2client/client_authentication.py + 
378
+379
+380
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391
+392
+393
+394
+395
+396
+397
+398
+399
+400
+401
+402
+403
+404
def client_assertion(self, audience: str) -> str:
+    """Generate a Client Assertion, asymmetrically signed with `private_jwk` as key.
+
+    Args:
+        audience: the audience to use for the generated Client Assertion.
+
+    Returns:
+        a Client Assertion.
+
+    """
+    iat = int(datetime.now(tz=timezone.utc).timestamp())
+    exp = iat + self.lifetime
+    jti = str(self.jti_gen())
+
+    jwt = Jwt.sign(
+        claims={
+            "iss": self.client_id,
+            "sub": self.client_id,
+            "aud": audience,
+            "iat": iat,
+            "exp": exp,
+            "jti": jti,
+        },
+        key=self.private_jwk,
+        alg=self.alg,
+    )
+    return str(jwt)
+
+
+
+
-
+
+
-
- validate_endpoint_uri(attribute, uri) +
-

+
-
- -

Validate that an endpoint URI is suitable for use.

-

If you need to disable some checks (for AS testing purposes only!), provide a different -method here.

-
- Source code in requests_oauth2client/client.py - 
255
-256
-257
-258
-259
-260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
@token_endpoint.validator
-@revocation_endpoint.validator
-@introspection_endpoint.validator
-@userinfo_endpoint.validator
-@authorization_endpoint.validator
-@backchannel_authentication_endpoint.validator
-@device_authorization_endpoint.validator
-@pushed_authorization_request_endpoint.validator
-@jwks_uri.validator
-def validate_endpoint_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
-    """Validate that an endpoint URI is suitable for use.
-
-    If you need to disable some checks (for AS testing purposes only!), provide a different
-    method here.
-
-    """
-    if self.testing or uri is None:
-        return uri
-    try:
-        return validate_endpoint_uri(uri)
-    except ValueError as exc:
-        msg = f"Invalid value '{uri}' for '{attribute.name}': {exc}"
-        raise ValueError(msg) from exc
-
-
-
+

+ PublicApp -

+ -
+
+

+ Bases: BaseClientAuthenticationMethod

-
- validate_issuer_uri(attribute, uri) +

Implement the none authentication method for public apps.

+

This scheme is used for Public Clients, which do not have any secret credentials. Those only +send their client_id to the Authorization Server.

-
+
+ Example + 
1
+2
+3
+4
from requests_oauth2client import OAuth2Client, PublicApp
+
+auth = PublicApp("my_client_id")
+client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+
+
+
+ Source code in requests_oauth2client/client_authentication.py + 
407
+408
+409
+410
+411
+412
+413
+414
+415
+416
+417
+418
+419
+420
+421
+422
+423
+424
+425
+426
+427
+428
+429
+430
+431
+432
+433
+434
+435
+436
+437
+438
+439
+440
+441
+442
@frozen
+class PublicApp(BaseClientAuthenticationMethod):
+    """Implement the `none` authentication method for public apps.
+
+    This scheme is used for Public Clients, which do not have any secret credentials. Those only
+    send their client_id to the Authorization Server.
+
+    Example:
+        ```python
+        from requests_oauth2client import OAuth2Client, PublicApp
+
+        auth = PublicApp("my_client_id")
+        client = OAuth2Client("https://url.to.the/token_endpoint", auth=auth)
+        ```
+
+    """
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Add the `client_id` field in the request body.
+
+        Args:
+            request: a request.
+
+        Returns:
+            the request with the added `client_id` form field.
+
+        """
+        request = super().__call__(request)
+        params = (
+            parse_qs(request.body, strict_parsing=True, keep_blank_values=True)  # type: ignore[type-var]
+            if request.body
+            else {}
+        )
+        params[b"client_id"] = [self.client_id.encode()]
+        request.prepare_body(params, files=None)
+        return request
+
+
-
- -

Validate that an Issuer identifier is suitable for use.

-

This is the same check as an endpoint URI, but the path may be (and usually is) empty.

-
- Source code in requests_oauth2client/client.py - 
279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
@issuer.validator
-def validate_issuer_uri(self, attribute: Attribute[str | None], uri: str | None) -> str | None:
-    """Validate that an Issuer identifier is suitable for use.
-
-    This is the same check as an endpoint URI, but the path may be (and usually is) empty.
-
-    """
-    if self.testing or uri is None:
-        return uri
-    try:
-        return validate_issuer_uri(uri)
-    except ValueError as exc:
-        msg = f"Invalid value '{uri}' for '{attribute.name}': {exc}"
-        raise ValueError(msg) from exc
-
-
-
-
+
-
-
- token_request(data, timeout=10, **requests_kwargs) -
-
- -

Send a request to the token endpoint.

-

Authentication will be added automatically based on the defined auth for this client.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
data - dict[str, Any] - -
-

parameters to send to the token endpoint. Items with a None - or empty value will not be sent in the request.

-
- 		- required -
timeout - int - -
-

a timeout value for the call

-
- 		- 10 -
**requests_kwargs - Any - -
-

additional parameters for requests.post()

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

the token endpoint response, as

-
-
- BearerToken - -
-

BearerToken instance.

-
-
- -
- Source code in requests_oauth2client/client.py - 
369
-370
-371
-372
-373
-374
-375
-376
-377
-378
-379
-380
-381
-382
-383
-384
-385
-386
-387
-388
-389
-390
-391
-392
-393
-394
-395
-396
-397
-398
def token_request(
-    self,
-    data: dict[str, Any],
-    timeout: int = 10,
-    **requests_kwargs: Any,
-) -> BearerToken:
-    """Send a request to the token endpoint.
-
-    Authentication will be added automatically based on the defined `auth` for this client.
-
-    Args:
-      data: parameters to send to the token endpoint. Items with a `None`
-           or empty value will not be sent in the request.
-      timeout: a timeout value for the call
-      **requests_kwargs: additional parameters for requests.post()
-
-    Returns:
-        the token endpoint response, as
-        [`BearerToken`][requests_oauth2client.tokens.BearerToken] instance.
-
-    """
-    return self._request(
-        "token_endpoint",
-        auth=self.auth,
-        data=data,
-        timeout=timeout,
-        on_success=self.parse_token_response,
-        on_failure=self.on_token_error,
-        **requests_kwargs,
-    )
-
-
+
+
+
-
+

+ UnsupportedClientCredentials -

- parse_token_response(response) -
+ -
- -

Parse a Response returned by the Token Endpoint.

-

Invoked by token_request to parse -responses returned by the Token Endpoint. Those responses contain an access_token and -additional attributes.

+
+

+ Bases: TypeError, ValueError

+

Raised when unsupported client credentials are provided.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the Response returned by the Token Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken based on the response

-
-
- BearerToken - -
-

contents.

-
-
- -
- Source code in requests_oauth2client/client.py - 
400
-401
-402
-403
-404
-405
-406
-407
-408
-409
-410
-411
-412
-413
-414
-415
-416
-417
-418
-419
-420
-421
-422
-423
def parse_token_response(self, response: requests.Response) -> BearerToken:
-    """Parse a Response returned by the Token Endpoint.
-
-    Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] to parse
-    responses returned by the Token Endpoint. Those responses contain an `access_token` and
-    additional attributes.
-
-    Args:
-        response: the [Response][requests.Response] returned by the Token Endpoint.
-
-    Returns:
-        a [`BearerToken`][requests_oauth2client.tokens.BearerToken] based on the response
-        contents.
-
-    """
-    try:
-        token_response = self.bearer_token_class(**response.json())
-    except Exception as response_class_exc:
-        try:
-            return self.on_token_error(response)
-        except Exception as token_error_exc:
-            raise token_error_exc from response_class_exc
-    else:
-        return token_response
-
-
-
+
+ Source code in requests_oauth2client/client_authentication.py + 
445
+446
class UnsupportedClientCredentials(TypeError, ValueError):
+    """Raised when unsupported client credentials are provided."""
+
+
+ +
@@ -50157,5935 +66169,2071 @@
+

+ client_auth_factory(auth, *, client_id=None, client_secret=None, private_key=None, default_auth_handler=ClientSecretPost) -

- on_token_error(response) +
- +
-
- -

Error handler for token_request().

-

Invoked by token_request when the -Token Endpoint returns an error.

+

Initialize the appropriate Auth Handler based on the provided parameters.

+

This initializes a ClientAuthenticationMethod subclass based on the provided parameters.

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
auth + AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None + +
+

can be:

+
    +
  • a requests.auth.AuthBase instance (which will be used directly)
    • +
  • a tuple of (client_id, client_secret) which will be used to initialize an instance of + default_auth_handler,
    • +
  • a tuple of (client_id, jwk), used to initialize a PrivateKeyJwk (jwk being an + instance of jwskate.Jwk or a dict),
    • +
  • a client_id, as str,
    • +
  • or None, to pass client_id and other credentials as dedicated parameters, see + below.
    • +
+
+ 		+ required +
client_id + str | None + +
+

the Client ID to use for this client

+
+ 		+ None +
client_secret + str | None + +
+

the Client Secret to use for this client, if any (for clients using +an authentication method based on a secret)

+
+ 		+ None +
private_key + Jwk | dict[str, Any] | None + +
+

the private key to use for private_key_jwt authentication method

+
+ 		+ None +
default_auth_handler + type[ClientSecretPost | ClientSecretBasic | ClientSecretJwt] + +
+

if a client_id and client_secret are provided, initialize an +instance of this class with those 2 parameters. +You can choose between ClientSecretBasic, ClientSecretPost, or ClientSecretJwt.

+
+ 		+ ClientSecretPost +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ AuthBase + +
+

an Auth Handler that will manage client authentication to the AS Token Endpoint or other

+
+
+ AuthBase + +
+

backend endpoints.

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the Response returned by the Token Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

nothing, and raises an exception instead. But a subclass may return a

-
-
- BearerToken - -
-

BearerToken to implement a default

-
-
- BearerToken - -
-

behaviour if needed.

-
-
- -
- Source code in requests_oauth2client/client.py - 
425
-426
-427
-428
-429
-430
-431
-432
-433
-434
-435
-436
-437
-438
-439
-440
-441
-442
-443
-444
-445
-446
-447
-448
-449
def on_token_error(self, response: requests.Response) -> BearerToken:
-    """Error handler for `token_request()`.
-
-    Invoked by [token_request][requests_oauth2client.client.OAuth2Client.token_request] when the
-    Token Endpoint returns an error.
-
-    Args:
-        response: the [Response][requests.Response] returned by the Token Endpoint.
-
-    Returns:
-        nothing, and raises an exception instead. But a subclass may return a
-        [`BearerToken`][requests_oauth2client.tokens.BearerToken] to implement a default
-        behaviour if needed.
-
-    """
-    try:
-        data = response.json()
-        error = data["error"]
-        error_description = data.get("error_description")
-        error_uri = data.get("error_uri")
-        exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
-        exception = exception_class(response, error, error_description, error_uri)
-    except Exception as exc:
-        raise InvalidTokenResponse(response) from exc
-    raise exception
-
-
-
+
+ Source code in requests_oauth2client/client_authentication.py + 
449
+450
+451
+452
+453
+454
+455
+456
+457
+458
+459
+460
+461
+462
+463
+464
+465
+466
+467
+468
+469
+470
+471
+472
+473
+474
+475
+476
+477
+478
+479
+480
+481
+482
+483
+484
+485
+486
+487
+488
+489
+490
+491
+492
+493
+494
+495
+496
+497
+498
+499
+500
+501
+502
+503
+504
+505
+506
+507
+508
+509
+510
+511
+512
+513
+514
+515
def client_auth_factory(
+    auth: requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None,
+    *,
+    client_id: str | None = None,
+    client_secret: str | None = None,
+    private_key: Jwk | dict[str, Any] | None = None,
+    default_auth_handler: type[ClientSecretPost | ClientSecretBasic | ClientSecretJwt] = ClientSecretPost,
+) -> requests.auth.AuthBase:
+    """Initialize the appropriate Auth Handler based on the provided parameters.
+
+    This initializes a `ClientAuthenticationMethod` subclass based on the provided parameters.
+
+    Args:
+        auth: can be:
+
+            - a `requests.auth.AuthBase` instance (which will be used directly)
+            - a tuple of (client_id, client_secret) which will be used to initialize an instance of
+              `default_auth_handler`,
+            - a tuple of (client_id, jwk), used to initialize a `PrivateKeyJwk` (`jwk` being an
+              instance of `jwskate.Jwk` or a `dict`),
+            - a `client_id`, as `str`,
+            - or `None`, to pass `client_id` and other credentials as dedicated parameters, see
+              below.
+        client_id: the Client ID to use for this client
+        client_secret: the Client Secret to use for this client, if any (for clients using
+            an authentication method based on a secret)
+        private_key: the private key to use for private_key_jwt authentication method
+        default_auth_handler: if a client_id and client_secret are provided, initialize an
+            instance of this class with those 2 parameters.
+            You can choose between `ClientSecretBasic`, `ClientSecretPost`, or `ClientSecretJwt`.
+
+    Returns:
+        an Auth Handler that will manage client authentication to the AS Token Endpoint or other
+        backend endpoints.
+
+    """
+    if auth is not None and (client_id is not None or client_secret is not None or private_key is not None):
+        msg = """\
+Please use either `auth` parameter to provide an authentication method,
+or use `client_id` and one of `client_secret` or `private_key`.
+"""
+        raise UnsupportedClientCredentials(msg)
+
+    if isinstance(auth, str):
+        client_id = auth
+    elif isinstance(auth, requests.auth.AuthBase):
+        return auth
+    elif isinstance(auth, tuple) and len(auth) == 2:  # noqa: PLR2004
+        client_id, credential = auth
+        if isinstance(credential, (Jwk, dict)):
+            private_key = credential
+        elif isinstance(credential, str):
+            client_secret = credential
+        else:
+            msg = "This credential type is not supported:"
+            raise UnsupportedClientCredentials(msg, type(credential), credential)
+
+    if client_id is None:
+        msg = "A client_id must be provided."
+        raise UnsupportedClientCredentials(msg)
+
+    if private_key is not None:
+        return PrivateKeyJwt(client_id, private_jwk=private_key)
+    if client_secret is None:
+        return PublicApp(str(client_id))
+
+    return default_auth_handler(str(client_id), str(client_secret))
+
+
+
-
+
+
-
- client_credentials(scope=None, *, requests_kwargs=None, **token_kwargs) +
- +
-
- -

Send a request to the token endpoint using the client_credentials grant.

+

+ device_authorization -

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
scope - str | Iterable[str] | None - -
-

the scope to send with the request. Can be a str, or an iterable of str. -to pass that way include scope, audience, resource, etc.

-
- 		- None -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the call to requests

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters for the token endpoint, alongside grant_type. Common parameters

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a TokenResponse

-
-
- -
- Source code in requests_oauth2client/client.py - 
451
-452
-453
-454
-455
-456
-457
-458
-459
-460
-461
-462
-463
-464
-465
-466
-467
-468
-469
-470
-471
-472
-473
-474
-475
-476
-477
-478
-479
-480
def client_credentials(
-    self,
-    scope: str | Iterable[str] | None = None,
-    *,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a request to the token endpoint using the `client_credentials` grant.
-
-    Args:
-        scope: the scope to send with the request. Can be a str, or an iterable of str.
-            to pass that way include `scope`, `audience`, `resource`, etc.
-        requests_kwargs: additional parameters for the call to requests
-        **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`. Common parameters
-
-    Returns:
-        a TokenResponse
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    if scope and not isinstance(scope, str):
-        try:
-            scope = " ".join(scope)
-        except Exception as exc:
-            msg = "Unsupported scope value"
-            raise ValueError(msg) from exc
-
-    data = dict(grant_type=GrantType.CLIENT_CREDENTIALS, scope=scope, **token_kwargs)
-    return self.token_request(data, **requests_kwargs)
-
-
-

+ -
+
+

Implements the Device Authorization Flow as defined in RFC8628.

+

See RFC8628.

-
+
-
- authorization_code(code, *, validate=True, requests_kwargs=None, **token_kwargs) -
-
- -

Send a request to the token endpoint with the authorization_code grant.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
code - str | AuthorizationResponse - -
-

an authorization code or an AuthorizationResponse to exchange for tokens

-
- 		- required -
validate - bool - -
-

if True, validate the received ID Token (this works only if code is an AuthorizationResponse)

-
- 		- True -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the call to requests

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters for the token endpoint, alongside grant_type, code, etc.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/client.py - 
482
-483
-484
-485
-486
-487
-488
-489
-490
-491
-492
-493
-494
-495
-496
-497
-498
-499
-500
-501
-502
-503
-504
-505
-506
-507
-508
-509
-510
-511
-512
-513
-514
-515
def authorization_code(
-    self,
-    code: str | AuthorizationResponse,
-    *,
-    validate: bool = True,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a request to the token endpoint with the `authorization_code` grant.
-
-    Args:
-         code: an authorization code or an `AuthorizationResponse` to exchange for tokens
-         validate: if `True`, validate the received ID Token (this works only if `code` is an AuthorizationResponse)
-         requests_kwargs: additional parameters for the call to requests
-         **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `code`, etc.
-
-    Returns:
-        a `BearerToken`
-
-    """
-    azr: AuthorizationResponse | None = None
-    if isinstance(code, AuthorizationResponse):
-        token_kwargs.setdefault("code_verifier", code.code_verifier)
-        token_kwargs.setdefault("redirect_uri", code.redirect_uri)
-        azr = code
-        code = code.code
-
-    requests_kwargs = requests_kwargs or {}
-
-    data = dict(grant_type=GrantType.AUTHORIZATION_CODE, code=code, **token_kwargs)
-    token = self.token_request(data, **requests_kwargs)
-    if validate and token.id_token and isinstance(azr, AuthorizationResponse):
-        return token.validate_id_token(self, azr)
-    return token
-
-
-
-
+
-
+

+ DeviceAuthorizationResponse -

- refresh_token(refresh_token, requests_kwargs=None, **token_kwargs) +
- +
-
- -

Send a request to the token endpoint with the refresh_token grant.

+

Represent a response returned by the device Authorization Endpoint.

+

All parameters are those returned by the AS as response to a Device Authorization Request.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
refresh_token - str | BearerToken - -
-

a refresh_token, as a string, or as a BearerToken. -That BearerToken must have a refresh_token.

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the call to requests

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters for the token endpoint, -alongside grant_type, refresh_token, etc.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/client.py - 
517
-518
-519
-520
-521
-522
-523
-524
-525
-526
-527
-528
-529
-530
-531
-532
-533
-534
-535
-536
-537
-538
-539
-540
-541
-542
-543
-544
def refresh_token(
-    self,
-    refresh_token: str | BearerToken,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a request to the token endpoint with the `refresh_token` grant.
-
-    Args:
-        refresh_token: a refresh_token, as a string, or as a `BearerToken`.
-            That `BearerToken` must have a `refresh_token`.
-        requests_kwargs: additional parameters for the call to `requests`
-        **token_kwargs: additional parameters for the token endpoint,
-            alongside `grant_type`, `refresh_token`, etc.
-
-    Returns:
-        a `BearerToken`
-
-    """
-    if isinstance(refresh_token, BearerToken):
-        if refresh_token.refresh_token is None or not isinstance(refresh_token.refresh_token, str):
-            msg = "This BearerToken doesn't have a refresh_token"
-            raise ValueError(msg)
-        refresh_token = refresh_token.refresh_token
-
-    requests_kwargs = requests_kwargs or {}
-    data = dict(grant_type=GrantType.REFRESH_TOKEN, refresh_token=refresh_token, **token_kwargs)
-    return self.token_request(data, **requests_kwargs)
-
-
-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
device_code + str + +
+

the device_code as returned by the AS.

+
+ 		+ required +
user_code + str + +
+

the device_code as returned by the AS.

+
+ 		+ required +
verification_uri + str + +
+

the device_code as returned by the AS.

+
+ 		+ required +
verification_uri_complete + str | None + +
+

the device_code as returned by the AS.

+
+ 		+ None +
expires_at + datetime | None + +
+

the expiration date for the device_code. +Also accepts an expires_in parameter, as a number of seconds in the future.

+
+ 		+ None +
interval + int | None + +
+

the pooling interval as returned by the AS.

+
+ 		+ None +
**kwargs + Any + +
+

additional parameters as returned by the AS.

+
+ 		+ {} +
+ +
+ Source code in requests_oauth2client/device_authorization.py + 
22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
class DeviceAuthorizationResponse:
+    """Represent a response returned by the device Authorization Endpoint.
+
+    All parameters are those returned by the AS as response to a Device Authorization Request.
+
+    Args:
+        device_code: the `device_code` as returned by the AS.
+        user_code: the `device_code` as returned by the AS.
+        verification_uri: the `device_code` as returned by the AS.
+        verification_uri_complete: the `device_code` as returned by the AS.
+        expires_at: the expiration date for the device_code.
+            Also accepts an `expires_in` parameter, as a number of seconds in the future.
+        interval: the pooling `interval` as returned by the AS.
+        **kwargs: additional parameters as returned by the AS.
+
+    """
+
+    @accepts_expires_in
+    def __init__(
+        self,
+        device_code: str,
+        user_code: str,
+        verification_uri: str,
+        verification_uri_complete: str | None = None,
+        expires_at: datetime | None = None,
+        interval: int | None = None,
+        **kwargs: Any,
+    ) -> None:
+        self.device_code = device_code
+        self.user_code = user_code
+        self.verification_uri = verification_uri
+        self.verification_uri_complete = verification_uri_complete
+        self.expires_at = expires_at
+        self.interval = interval
+        self.other = kwargs
+
+    def is_expired(self, leeway: int = 0) -> bool | None:
+        """Check if the `device_code` within this response is expired.
+
+        Returns:
+            `True` if the device_code is expired, `False` if it is still valid, `None` if there is
+            no `expires_in` hint.
+
+        """
+        if self.expires_at:
+            return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
+        return None
+
+
-
-
+
-
- device_code(device_code, requests_kwargs=None, **token_kwargs) -
-
- -

Send a request to the token endpoint using the Device Code grant.

-

The grant_type is urn:ietf:params:oauth:grant-type:device_code. This needs a Device Code, -or a DeviceAuthorizationResponse as parameter.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
device_code - str | DeviceAuthorizationResponse - -
-

a device code, or a DeviceAuthorizationResponse

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the call to requests

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters for the token endpoint, alongside grant_type, device_code, etc.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/client.py - 
546
-547
-548
-549
-550
-551
-552
-553
-554
-555
-556
-557
-558
-559
-560
-561
-562
-563
-564
-565
-566
-567
-568
-569
-570
-571
-572
-573
-574
-575
-576
-577
-578
def device_code(
-    self,
-    device_code: str | DeviceAuthorizationResponse,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a request to the token endpoint using the Device Code grant.
-
-    The grant_type is `urn:ietf:params:oauth:grant-type:device_code`. This needs a Device Code,
-    or a `DeviceAuthorizationResponse` as parameter.
-
-    Args:
-        device_code: a device code, or a `DeviceAuthorizationResponse`
-        requests_kwargs: additional parameters for the call to requests
-        **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `device_code`, etc.
-
-    Returns:
-        a `BearerToken`
-
-    """
-    if isinstance(device_code, DeviceAuthorizationResponse):
-        if device_code.device_code is None or not isinstance(device_code.device_code, str):
-            msg = "This DeviceAuthorizationResponse doesn't have a device_code"
-            raise ValueError(msg)
-        device_code = device_code.device_code
-
-    requests_kwargs = requests_kwargs or {}
-    data = dict(
-        grant_type=GrantType.DEVICE_CODE,
-        device_code=device_code,
-        **token_kwargs,
-    )
-    return self.token_request(data, **requests_kwargs)
-
-
-
+
-
+
+ is_expired(leeway=0) -
+
+
-
- ciba(auth_req_id, requests_kwargs=None, **token_kwargs) +

Check if the device_code within this response is expired.

-
+

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ bool | None + +
+

True if the device_code is expired, False if it is still valid, None if there is

+
+
+ bool | None + +
+

no expires_in hint.

+
+
-
- -

Send a CIBA request to the Token Endpoint.

-

A CIBA request is a Token Request using the urn:openid:params:grant-type:ciba grant.

+
+ Source code in requests_oauth2client/device_authorization.py + 
58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
def is_expired(self, leeway: int = 0) -> bool | None:
+    """Check if the `device_code` within this response is expired.
+
+    Returns:
+        `True` if the device_code is expired, `False` if it is still valid, `None` if there is
+        no `expires_in` hint.
+
+    """
+    if self.expires_at:
+        return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
+    return None
+
+
+
+ +
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
auth_req_id - str | BackChannelAuthenticationResponse - -
-

an authentication request ID, as returned by the AS

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the call to requests

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters for the token endpoint, alongside grant_type, auth_req_id, etc.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/client.py - 
580
-581
-582
-583
-584
-585
-586
-587
-588
-589
-590
-591
-592
-593
-594
-595
-596
-597
-598
-599
-600
-601
-602
-603
-604
-605
-606
-607
-608
-609
-610
-611
def ciba(
-    self,
-    auth_req_id: str | BackChannelAuthenticationResponse,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a CIBA request to the Token Endpoint.
-
-    A CIBA request is a Token Request using the `urn:openid:params:grant-type:ciba` grant.
-
-    Args:
-        auth_req_id: an authentication request ID, as returned by the AS
-        requests_kwargs: additional parameters for the call to requests
-        **token_kwargs: additional parameters for the token endpoint, alongside `grant_type`, `auth_req_id`, etc.
-
-    Returns:
-        a `BearerToken`
-
-    """
-    if isinstance(auth_req_id, BackChannelAuthenticationResponse):
-        if auth_req_id.auth_req_id is None or not isinstance(auth_req_id.auth_req_id, str):
-            msg = "This `BackChannelAuthenticationResponse` doesn't have an `auth_req_id`"
-            raise ValueError(msg)
-        auth_req_id = auth_req_id.auth_req_id
-
-    requests_kwargs = requests_kwargs or {}
-    data = dict(
-        grant_type=GrantType.CLIENT_INITIATED_BACKCHANNEL_AUTHENTICATION,
-        auth_req_id=auth_req_id,
-        **token_kwargs,
-    )
-    return self.token_request(data, **requests_kwargs)
-
-
+
+
+
-
+

+ DeviceAuthorizationPoolingJob -

- token_exchange(subject_token, subject_token_type=None, actor_token=None, actor_token_type=None, requested_token_type=None, requests_kwargs=None, **token_kwargs) -
+ -
- -

Send a Token Exchange request.

-

A Token Exchange request is actually a request to the Token Endpoint with a grant_type -urn:ietf:params:oauth:grant-type:token-exchange.

+
+

+ Bases: BaseTokenEndpointPoolingJob

+

A Token Endpoint pooling job for the Device Authorization Flow.

+

This periodically checks if the user has finished with his authorization in a Device +Authorization flow.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
subject_token - str | BearerToken | IdToken - -
-

the subject token to exchange for a new token.

-
- 		- required -
subject_token_type - str | None - -
-

a token type identifier for the subject_token, mandatory if it cannot be guessed based -on type(subject_token).

-
- 		- None -
actor_token - None | str | BearerToken | IdToken - -
-

the actor token to include in the request, if any.

-
- 		- None -
actor_token_type - str | None - -
-

a token type identifier for the actor_token, mandatory if it cannot be guessed based -on type(actor_token).

-
- 		- None -
requested_token_type - str | None - -
-

a token type identifier for the requested token.

-
- 		- None -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters to pass to the underlying requests.post() call.

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters to include in the request body.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken as returned by the Authorization Server.

-
-
- -
- Source code in requests_oauth2client/client.py - 
613
-614
-615
-616
-617
-618
-619
-620
-621
-622
-623
-624
-625
-626
-627
-628
-629
-630
-631
-632
-633
-634
-635
-636
-637
-638
-639
-640
-641
-642
-643
-644
-645
-646
-647
-648
-649
-650
-651
-652
-653
-654
-655
-656
-657
-658
-659
-660
-661
-662
-663
-664
-665
-666
def token_exchange(
-    self,
-    subject_token: str | BearerToken | IdToken,
-    subject_token_type: str | None = None,
-    actor_token: None | str | BearerToken | IdToken = None,
-    actor_token_type: str | None = None,
-    requested_token_type: str | None = None,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a Token Exchange request.
-
-    A Token Exchange request is actually a request to the Token Endpoint with a grant_type
-    `urn:ietf:params:oauth:grant-type:token-exchange`.
-
-    Args:
-        subject_token: the subject token to exchange for a new token.
-        subject_token_type: a token type identifier for the subject_token, mandatory if it cannot be guessed based
-            on `type(subject_token)`.
-        actor_token: the actor token to include in the request, if any.
-        actor_token_type: a token type identifier for the actor_token, mandatory if it cannot be guessed based
-            on `type(actor_token)`.
-        requested_token_type: a token type identifier for the requested token.
-        requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
-        **token_kwargs: additional parameters to include in the request body.
-
-    Returns:
-        a `BearerToken` as returned by the Authorization Server.
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    try:
-        subject_token_type = self.get_token_type(subject_token_type, subject_token)
-    except ValueError:
-        msg = "Cannot determine the kind of 'subject_token' you provided. Please specify a 'subject_token_type'."
-        raise TypeError(msg) from None
-    if actor_token:  # pragma: no branch
-        try:
-            actor_token_type = self.get_token_type(actor_token_type, actor_token)
-        except ValueError:
-            msg = "Cannot determine the kind of 'actor_token' you provided. Please specify an 'actor_token_type'."
-            raise TypeError(msg) from None
-
-    data = dict(
-        grant_type=GrantType.TOKEN_EXCHANGE,
-        subject_token=subject_token,
-        subject_token_type=subject_token_type,
-        actor_token=actor_token,
-        actor_token_type=actor_token_type,
-        requested_token_type=requested_token_type,
-        **token_kwargs,
-    )
-    return self.token_request(data, **requests_kwargs)
-
-
-
-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client + OAuth2Client + +
+

an OAuth2Client that will be used to pool the token endpoint.

+
+ 		+ required +
device_code + str | DeviceAuthorizationResponse + +
+

a device_code as str or a DeviceAuthorizationResponse.

+
+ 		+ required +
interval + int | None + +
+

The pooling interval to use. This overrides the one in auth_req_id if it is +a BackChannelAuthenticationResponse.

+
+ 		+ None +
slow_down_interval + int + +
+

Number of seconds to add to the pooling interval when the AS returns +a slow-down request.

+
+ 		+ 5 +
requests_kwargs + dict[str, Any] | None + +
+

Additional parameters for the underlying calls to requests.request.

+
+ 		+ None +
**token_kwargs + Any + +
+

Additional parameters for the token request.

+
+ 		+ {} +
+ + +
+ Example + 
1
+2
+3
+4
+5
+6
+7
+8
from requests_oauth2client import DeviceAuthorizationPoolingJob, OAuth2Client
+
+client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+pooler = DeviceAuthorizationPoolingJob(client=client, device_code="my_device_code")
+
+token = None
+while token is None:
+    token = pooler()
+
+
+
+ Source code in requests_oauth2client/device_authorization.py + 
 71
+ 72
+ 73
+ 74
+ 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
+126
+127
+128
+129
+130
+131
+132
+133
+134
+135
+136
@define(init=False)
+class DeviceAuthorizationPoolingJob(BaseTokenEndpointPoolingJob):
+    """A Token Endpoint pooling job for the Device Authorization Flow.
+
+    This periodically checks if the user has finished with his authorization in a Device
+    Authorization flow.
+
+    Args:
+        client: an OAuth2Client that will be used to pool the token endpoint.
+        device_code: a `device_code` as `str` or a `DeviceAuthorizationResponse`.
+        interval: The pooling interval to use. This overrides the one in `auth_req_id` if it is
+            a `BackChannelAuthenticationResponse`.
+        slow_down_interval: Number of seconds to add to the pooling interval when the AS returns
+            a slow-down request.
+        requests_kwargs: Additional parameters for the underlying calls to [requests.request][].
+        **token_kwargs: Additional parameters for the token request.
+
+    Example:
+        ```python
+        from requests_oauth2client import DeviceAuthorizationPoolingJob, OAuth2Client
+
+        client = OAuth2Client(token_endpoint="https://my.as.local/token", auth=("client_id", "client_secret"))
+        pooler = DeviceAuthorizationPoolingJob(client=client, device_code="my_device_code")
+
+        token = None
+        while token is None:
+            token = pooler()
+        ```
+
+    """
+
+    device_code: str
+
+    def __init__(
+        self,
+        client: OAuth2Client,
+        device_code: str | DeviceAuthorizationResponse,
+        interval: int | None = None,
+        slow_down_interval: int = 5,
+        requests_kwargs: dict[str, Any] | None = None,
+        **token_kwargs: Any,
+    ) -> None:
+        if isinstance(device_code, DeviceAuthorizationResponse):
+            interval = interval or device_code.interval
+            device_code = device_code.device_code
+
+        self.__attrs_init__(
+            client=client,
+            device_code=device_code,
+            interval=interval or 5,
+            slow_down_interval=slow_down_interval,
+            requests_kwargs=requests_kwargs or {},
+            token_kwargs=token_kwargs,
+        )
+
+    def token_request(self) -> BearerToken:
+        """Implement the Device Code token request.
+
+        This actually calls [OAuth2Client.device_code(device_code)][requests_oauth2client.OAuth2Client.device_code]
+        on `self.client`.
+
+        Returns:
+            a [BearerToken][requests_oauth2client.tokens.BearerToken]
+
+        """
+        return self.client.device_code(self.device_code, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
+
+
-
+
-
- jwt_bearer(assertion, requests_kwargs=None, **token_kwargs) -
-
- -

Send a request using a JWT as authorization grant.

-

This is defined in (RFC7523 $2.1)[https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1).

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
assertion - Jwt | str - -
-

a JWT (as an instance of jwskate.Jwt or as a str) to use as authorization grant.

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters to pass to the underlying requests.post() call.

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters to include in the request body.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken as returned by the Authorization Server.

-
-
- -
- Source code in requests_oauth2client/client.py - 
668
-669
-670
-671
-672
-673
-674
-675
-676
-677
-678
-679
-680
-681
-682
-683
-684
-685
-686
-687
-688
-689
-690
-691
-692
-693
-694
-695
-696
-697
-698
def jwt_bearer(
-    self,
-    assertion: Jwt | str,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a request using a JWT as authorization grant.
-
-    This is defined in (RFC7523 $2.1)[https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1).
-
-    Args:
-        assertion: a JWT (as an instance of `jwskate.Jwt` or as a `str`) to use as authorization grant.
-        requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
-        **token_kwargs: additional parameters to include in the request body.
-
-    Returns:
-        a `BearerToken` as returned by the Authorization Server.
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    if not isinstance(assertion, Jwt):
-        assertion = Jwt(assertion)
-
-    data = dict(
-        grant_type=GrantType.JWT_BEARER,
-        assertion=assertion,
-        **token_kwargs,
-    )
-
-    return self.token_request(data, **requests_kwargs)
-
-
-
-
+
-
+
+ token_request() +
-
- resource_owner_password(username, password, requests_kwargs=None, **token_kwargs) +
-
+

Implement the Device Code token request.

+

This actually calls OAuth2Client.device_code(device_code) +on self.client.

-
- -

Send a request using the Resource Owner Password Grant.

-

This Grant Type is deprecated and should only be used when there is no other choice.

+

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
+ +
+ Source code in requests_oauth2client/device_authorization.py + 
126
+127
+128
+129
+130
+131
+132
+133
+134
+135
+136
def token_request(self) -> BearerToken:
+    """Implement the Device Code token request.
+
+    This actually calls [OAuth2Client.device_code(device_code)][requests_oauth2client.OAuth2Client.device_code]
+    on `self.client`.
+
+    Returns:
+        a [BearerToken][requests_oauth2client.tokens.BearerToken]
+
+    """
+    return self.client.device_code(self.device_code, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
+
+
+
+ +
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
username - str - -
-

the resource owner user name

-
- 		- required -
password - str - -
-

the resource owner password

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters to pass to the underlying requests.post() call.

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters to include in the request body.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken as returned by the Authorization Server

-
-
- -
- Source code in requests_oauth2client/client.py - 
700
-701
-702
-703
-704
-705
-706
-707
-708
-709
-710
-711
-712
-713
-714
-715
-716
-717
-718
-719
-720
-721
-722
-723
-724
-725
-726
-727
-728
-729
def resource_owner_password(
-    self,
-    username: str,
-    password: str,
-    requests_kwargs: dict[str, Any] | None = None,
-    **token_kwargs: Any,
-) -> BearerToken:
-    """Send a request using the Resource Owner Password Grant.
-
-    This Grant Type is deprecated and should only be used when there is no other choice.
-
-    Args:
-        username: the resource owner user name
-        password: the resource owner password
-        requests_kwargs: additional parameters to pass to the underlying `requests.post()` call.
-        **token_kwargs: additional parameters to include in the request body.
-
-    Returns:
-        a `BearerToken` as returned by the Authorization Server
-
-    """
-    requests_kwargs = requests_kwargs or {}
-    data = dict(
-        grant_type=GrantType.RESOURCE_OWNER_PASSWORD,
-        username=username,
-        password=password,
-        **token_kwargs,
-    )
-
-    return self.token_request(data, **requests_kwargs)
-
-
+
+
-
+
-
- authorization_request(*, scope='openid', response_type='code', redirect_uri=None, state=..., nonce=..., code_verifier=None, **kwargs) +
- +
+
-
- -

Generate an Authorization Request for this client.

+

+ discovery -

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
scope - None | str | Iterable[str] - -
-

the scope to use

-
- 		- 'openid' -
response_type - str - -
-

the response_type to use

-
- 		- 'code' -
redirect_uri - str | None - -
-

the redirect_uri to include in the request. By default, -the redirect_uri defined at init time is used.

-
- 		- None -
state - str | ellipsis | None - -
-

the state parameter to use. Leave default to generate a random value.

-
- 		- ... -
nonce - str | ellipsis | None - -
-

a nonce. Leave default to generate a random value.

-
- 		- ... -
code_verifier - str | None - -
-

the PKCE code_verifier to use. Leave default to generate a random value.

-
- 		- None -
**kwargs - Any - -
-

additional parameters to include in the auth request

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- AuthorizationRequest - -
-

an AuthorizationRequest with the supplied parameters

-
-
- -
- Source code in requests_oauth2client/client.py - 
731
-732
-733
-734
-735
-736
-737
-738
-739
-740
-741
-742
-743
-744
-745
-746
-747
-748
-749
-750
-751
-752
-753
-754
-755
-756
-757
-758
-759
-760
-761
-762
-763
-764
-765
-766
-767
-768
-769
-770
-771
-772
-773
-774
-775
-776
-777
-778
-779
-780
-781
-782
-783
-784
-785
def authorization_request(
-    self,
-    *,
-    scope: None | str | Iterable[str] = "openid",
-    response_type: str = "code",
-    redirect_uri: str | None = None,
-    state: str | ellipsis | None = ...,  # noqa: F821
-    nonce: str | ellipsis | None = ...,  # noqa: F821
-    code_verifier: str | None = None,
-    **kwargs: Any,
-) -> AuthorizationRequest:
-    """Generate an Authorization Request for this client.
-
-    Args:
-        scope: the `scope` to use
-        response_type: the `response_type` to use
-        redirect_uri: the `redirect_uri` to include in the request. By default,
-            the `redirect_uri` defined at init time is used.
-        state: the `state` parameter to use. Leave default to generate a random value.
-        nonce: a `nonce`. Leave default to generate a random value.
-        code_verifier: the PKCE `code_verifier` to use. Leave default to generate a random value.
-        **kwargs: additional parameters to include in the auth request
-
-    Returns:
-        an AuthorizationRequest with the supplied parameters
-
-    """
-    authorization_endpoint = self._require_endpoint("authorization_endpoint")
-
-    redirect_uri = redirect_uri or self.redirect_uri
-    if not redirect_uri:
-        msg = (
-            "No 'redirect_uri' defined for this client. You must either pass a redirect_uri"
-            " as parameter to this method, or include a redirect_uri when initializing your"
-            " OAuth2Client."
-        )
-        raise AttributeError(msg)
-
-    if response_type != "code":
-        msg = "Only response_type=code is supported."
-        raise ValueError(msg)
-
-    return AuthorizationRequest(
-        authorization_endpoint=authorization_endpoint,
-        client_id=self.client_id,
-        redirect_uri=redirect_uri,
-        issuer=self.issuer,
-        response_type=response_type,
-        scope=scope,
-        state=state,
-        nonce=nonce,
-        code_verifier=code_verifier,
-        code_challenge_method=self.code_challenge_method,
-        **kwargs,
-    )
-
-
-

-
+ +
-
+

Implements Metadata discovery documents URLS.

+

This is as defined in RFC8615 and OpenID Connect +Discovery 1.0.

-
- pushed_authorization_request(authorization_request, requests_kwargs=None) +
-
-
- -

Send a Pushed Authorization Request.

-

This sends a request to the Pushed Authorization Request Endpoint, and returns a -RequestUriParameterAuthorizationRequest initialized with the AS response.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
authorization_request - AuthorizationRequest - -
-

the authorization request to send

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for requests.request()

-
- 		- None -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- RequestUriParameterAuthorizationRequest - -
-

the RequestUriParameterAuthorizationRequest initialized based on the AS response

-
-
- -
- Source code in requests_oauth2client/client.py - 
787
-788
-789
-790
-791
-792
-793
-794
-795
-796
-797
-798
-799
-800
-801
-802
-803
-804
-805
-806
-807
-808
-809
-810
-811
-812
-813
def pushed_authorization_request(
-    self,
-    authorization_request: AuthorizationRequest,
-    requests_kwargs: dict[str, Any] | None = None,
-) -> RequestUriParameterAuthorizationRequest:
-    """Send a Pushed Authorization Request.
-
-    This sends a request to the Pushed Authorization Request Endpoint, and returns a
-    `RequestUriParameterAuthorizationRequest` initialized with the AS response.
-
-    Args:
-        authorization_request: the authorization request to send
-        requests_kwargs: additional parameters for `requests.request()`
-
-    Returns:
-        the `RequestUriParameterAuthorizationRequest` initialized based on the AS response
-
-    """
-    requests_kwargs = requests_kwargs or {}
-    return self._request(
-        "pushed_authorization_request_endpoint",
-        data=authorization_request.args,
-        auth=self.auth,
-        on_success=self.parse_pushed_authorization_response,
-        on_failure=self.on_pushed_authorization_request_error,
-        **requests_kwargs,
-    )
-
-
-
-
+

+ well_known_uri(origin, name, *, at_root=True) -

- parse_pushed_authorization_response(response) +
- +
-
- -

Parse the response obtained by pushed_authorization_request().

+

Return the location of a well-known document on an origin url.

+

See RFC8615 and OIDC +Discovery.

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
origin + str + +
+

origin to use to build the well-known uri.

+
+ 		+ required +
name + str + +
+

document name to use to build the well-known uri.

+
+ 		+ required +
at_root + bool + +
+

if True, assume the well-known document is at root level (as defined in RFC8615). +If False, assume the well-known location is per-directory, as defined in OpenID +Connect Discovery +1.0.

+
+ 		+ True +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the well-know uri, relative to origin, where the well-known document named name should be

+
+
+ str + +
+

found.

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the requests.Response returned by the PAR endpoint

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- RequestUriParameterAuthorizationRequest - -
-

a RequestUriParameterAuthorizationRequest instance

-
-
- -
- Source code in requests_oauth2client/client.py - 
815
-816
-817
-818
-819
-820
-821
-822
-823
-824
-825
-826
-827
-828
-829
-830
-831
-832
-833
-834
-835
-836
def parse_pushed_authorization_response(
-    self, response: requests.Response
-) -> RequestUriParameterAuthorizationRequest:
-    """Parse the response obtained by `pushed_authorization_request()`.
-
-    Args:
-        response: the `requests.Response` returned by the PAR endpoint
-
-    Returns:
-        a RequestUriParameterAuthorizationRequest instance
-
-    """
-    response_json = response.json()
-    request_uri = response_json.get("request_uri")
-    expires_in = response_json.get("expires_in")
-
-    return RequestUriParameterAuthorizationRequest(
-        authorization_endpoint=self.authorization_endpoint,
-        client_id=self.client_id,
-        request_uri=request_uri,
-        expires_in=expires_in,
-    )
-
-
-
+
+ Source code in requests_oauth2client/discovery.py + 
11
+12
+13
+14
+15
+16
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
def well_known_uri(origin: str, name: str, *, at_root: bool = True) -> str:
+    """Return the location of a well-known document on an origin url.
+
+    See [RFC8615](https://datatracker.ietf.org/doc/html/rfc8615) and [OIDC
+    Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
+
+    Args:
+        origin: origin to use to build the well-known uri.
+        name: document name to use to build the well-known uri.
+        at_root: if `True`, assume the well-known document is at root level (as defined in [RFC8615](https://datatracker.ietf.org/doc/html/rfc8615)).
+            If `False`, assume the well-known location is per-directory, as defined in [OpenID
+            Connect Discovery
+            1.0](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
+
+    Returns:
+        the well-know uri, relative to origin, where the well-known document named `name` should be
+        found.
+
+    """
+    url = furl(origin)
+    if at_root:
+        url.path = Path(".well-known") / url.path / name
+    else:
+        url.path.add(Path(".well-known") / name)
+    return str(url)
+
+
+
-
+

+ oidc_discovery_document_url(issuer) -

- on_pushed_authorization_request_error(response) +
- +
-
- -

Error Handler for Pushed Authorization Endpoint errors.

+

Construct the OIDC discovery document url for a given issuer.

+

Given an issuer identifier, return the standardised URL where the OIDC discovery document can +be retrieved.

+

The returned URL is biuilt as specified in OpenID Connect Discovery +1.0.

+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
issuer + str + +
+

an OIDC Authentication Server issuer

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the standardised discovery document URL. Note that no attempt to fetch this document is

+
+
+ str + +
+

made.

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the HTTP response as returned by the AS PAR endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- RequestUriParameterAuthorizationRequest - -
-

a RequestUriParameterAuthorizationRequest, if the error is recoverable

-
-
- - - -

Raises:

- - - - - - - - - - - - - - - - - - - - - -
TypeDescription
- EndpointError - -
-

a subclass of this error depending on the error returned by the AS

-
-
- InvalidPushedAuthorizationResponse - -
-

if the returned response is not following the

-
-
- specifications UnknownTokenEndpointError - -
-

for unknown/unhandled errors

-
-
- -
- Source code in requests_oauth2client/client.py - 
838
-839
-840
-841
-842
-843
-844
-845
-846
-847
-848
-849
-850
-851
-852
-853
-854
-855
-856
-857
-858
-859
-860
-861
-862
-863
-864
def on_pushed_authorization_request_error(
-    self, response: requests.Response
-) -> RequestUriParameterAuthorizationRequest:
-    """Error Handler for Pushed Authorization Endpoint errors.
-
-    Args:
-        response: the HTTP response as returned by the AS PAR endpoint.
-
-    Returns:
-        a RequestUriParameterAuthorizationRequest, if the error is recoverable
-
-    Raises:
-        EndpointError: a subclass of this error depending on the error returned by the AS
-        InvalidPushedAuthorizationResponse: if the returned response is not following the
-        specifications UnknownTokenEndpointError: for unknown/unhandled errors
-
-    """
-    try:
-        data = response.json()
-        error = data["error"]
-        error_description = data.get("error_description")
-        error_uri = data.get("error_uri")
-        exception_class = self.exception_classes.get(error, UnknownTokenEndpointError)
-        exception = exception_class(response, error, error_description, error_uri)
-    except Exception as exc:
-        raise InvalidPushedAuthorizationResponse(response) from exc
-    raise exception
-
-
-
+
+ Source code in requests_oauth2client/discovery.py + 
38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
def oidc_discovery_document_url(issuer: str) -> str:
+    """Construct the OIDC discovery document url for a given `issuer`.
+
+    Given an `issuer` identifier, return the standardised URL where the OIDC discovery document can
+    be retrieved.
+
+    The returned URL is biuilt as specified in [OpenID Connect Discovery
+    1.0](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
+
+    Args:
+        issuer: an OIDC Authentication Server `issuer`
+
+    Returns:
+        the standardised discovery document URL. Note that no attempt to fetch this document is
+        made.
+
+    """
+    return well_known_uri(issuer, "openid-configuration", at_root=False)
+
+
+
-
+

+ oauth2_discovery_document_url(issuer) -

- userinfo(access_token) +
- +
-
- -

Call the UserInfo endpoint.

-

This sends a request to the UserInfo endpoint, with the specified access_token, and returns -the parsed result.

+

Construct the standardised OAuth 2.0 discovery document url for a given issuer.

+

Based an issuer identifier, returns the standardised URL where the OAuth20 server metadata can +be retrieved.

+

The returned URL is built as specified in +RFC8414.

+

Parameters:

+ + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
issuer + str + +
+

an OAuth20 Authentication Server issuer

+
+ 		+ required +
+ + +

Returns:

+ + + + + + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the standardised discovery document URL. Note that no attempt to fetch this document is

+
+
+ str + +
+

made.

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
access_token - BearerToken | str - -
-

the access token to use

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Any - -
-

the Response returned by the userinfo endpoint.

-
-
- -
- Source code in requests_oauth2client/client.py - 
866
-867
-868
-869
-870
-871
-872
-873
-874
-875
-876
-877
-878
-879
-880
-881
-882
-883
-884
def userinfo(self, access_token: BearerToken | str) -> Any:
-    """Call the UserInfo endpoint.
-
-    This sends a request to the UserInfo endpoint, with the specified access_token, and returns
-    the parsed result.
-
-    Args:
-        access_token: the access token to use
-
-    Returns:
-        the [Response][requests.Response] returned by the userinfo endpoint.
-
-    """
-    return self._request(
-        "userinfo_endpoint",
-        auth=BearerAuth(access_token),
-        on_success=self.parse_userinfo_response,
-        on_failure=self.on_userinfo_error,
-    )
-
-
-
+
+ Source code in requests_oauth2client/discovery.py + 
58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
+69
+70
+71
+72
+73
+74
+75
def oauth2_discovery_document_url(issuer: str) -> str:
+    """Construct the standardised OAuth 2.0 discovery document url for a given `issuer`.
+
+    Based an `issuer` identifier, returns the standardised URL where the OAuth20 server metadata can
+    be retrieved.
+
+    The returned URL is built as specified in
+    [RFC8414](https://datatracker.ietf.org/doc/html/rfc8414).
+
+    Args:
+        issuer: an OAuth20 Authentication Server `issuer`
+
+    Returns:
+        the standardised discovery document URL. Note that no attempt to fetch this document is
+        made.
+
+    """
+    return well_known_uri(issuer, "oauth-authorization-server", at_root=True)
+
+
+
-
- - -
- parse_userinfo_response(resp) - -
+
+
-
- -

Parse the response obtained by userinfo().

-

Invoked by userinfo() to parse the -response from the UserInfo endpoint, this will extract and return its JSON content.

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
resp - Response - -
-

a Response returned from the UserInfo endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Any - -
-

the parsed JSON content from this response.

-
-
- -
- Source code in requests_oauth2client/client.py - 
886
-887
-888
-889
-890
-891
-892
-893
-894
-895
-896
-897
-898
-899
def parse_userinfo_response(self, resp: requests.Response) -> Any:
-    """Parse the response obtained by `userinfo()`.
-
-    Invoked by [userinfo()][requests_oauth2client.client.OAuth2Client.userinfo] to parse the
-    response from the UserInfo endpoint, this will extract and return its JSON content.
-
-    Args:
-        resp: a [Response][requests.Response] returned from the UserInfo endpoint.
-
-    Returns:
-        the parsed JSON content from this response.
-
-    """
-    return resp.json()
-
-
-
-
+

+ exceptions -
+

+
+

This module contains all exception classes from requests_oauth2client.

-
- on_userinfo_error(resp) -
+
-
- -

Parse UserInfo error response.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
resp - Response - -
-

a Response returned from the UserInfo endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Any - -
-

nothing, raises exception instead.

-
-
- -
- Source code in requests_oauth2client/client.py - 
901
-902
-903
-904
-905
-906
-907
-908
-909
-910
-911
def on_userinfo_error(self, resp: requests.Response) -> Any:
-    """Parse UserInfo error response.
-
-    Args:
-        resp: a [Response][requests.Response] returned from the UserInfo endpoint.
-
-    Returns:
-        nothing, raises exception instead.
-
-    """
-    resp.raise_for_status()
-
-
-
-
-
+
-
- get_token_type(token_type=None, token=None) - - - classmethod - -
+

+ OAuth2Error -
- -

Get standardized token type identifiers.

-

Return a standardized token type identifier, based on a short token_type hint and/or a -token value.

+

+
+

+ Bases: Exception

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
token_type - str | None - -
-

a token_type hint, as str. May be "access_token", "refresh_token" -or "id_token"

-
- 		- None -
token - None | str | BearerToken | IdToken - -
-

a token value, as an instance of BearerToken or IdToken, or as a str.

-
- 		- None -
- - - -

Returns:

- - - - - - - - - - - + +

Base class for Exceptions raised when a backend endpoint returns an error.

+ + +

Parameters:

+
TypeDescription
- str - -
-

the token_type as defined in the Token Exchange RFC8693.

-
-
+ + + + + + - -
NameTypeDescriptionDefault
- -
- Source code in requests_oauth2client/client.py - 
913
-914
-915
-916
-917
-918
-919
-920
-921
-922
-923
-924
-925
-926
-927
-928
-929
-930
-931
-932
-933
-934
-935
-936
-937
-938
-939
-940
-941
-942
-943
-944
-945
-946
-947
-948
-949
-950
-951
-952
-953
-954
-955
-956
-957
-958
-959
-960
-961
-962
-963
-964
-965
-966
-967
-968
-969
-970
-971
-972
-973
-974
-975
-976
-977
@classmethod
-def get_token_type(  # noqa: C901
-    cls,
-    token_type: str | None = None,
-    token: None | str | BearerToken | IdToken = None,
-) -> str:
-    """Get standardized token type identifiers.
-
-    Return a standardized token type identifier, based on a short `token_type` hint and/or a
-    token value.
-
-    Args:
-        token_type: a token_type hint, as `str`. May be "access_token", "refresh_token"
-            or "id_token"
-        token: a token value, as an instance of `BearerToken` or IdToken, or as a `str`.
-
-    Returns:
-        the token_type as defined in the Token Exchange RFC8693.
-
-    """
-    if not (token_type or token):
-        msg = "Cannot determine type of an empty token without a token_type hint"
-        raise ValueError(msg)
-
-    if token_type is None:
-        if isinstance(token, str):
-            msg = "Cannot determine the type of provided token when it is a bare str. Please specify a token_type."
-            raise ValueError(msg)
-        elif isinstance(token, BearerToken):
-            return "urn:ietf:params:oauth:token-type:access_token"
-        elif isinstance(token, IdToken):
-            return "urn:ietf:params:oauth:token-type:id_token"
-        else:
-            msg = "Unexpected type of token, please provide a string or a BearerToken or an IdToken."
-            raise TypeError(
-                msg,
-                type(token),
-            )
-    elif token_type == TokenType.ACCESS_TOKEN:
-        if token is not None and not isinstance(token, (str, BearerToken)):
-            msg = "The supplied token is not a BearerToken or a string representation of it."
-            raise TypeError(
-                msg,
-                type(token),
-            )
-        return "urn:ietf:params:oauth:token-type:access_token"
-    elif token_type == TokenType.REFRESH_TOKEN:
-        if token is not None and isinstance(token, BearerToken) and not token.refresh_token:
-            msg = "The supplied BearerToken doesn't have a refresh_token."
-            raise ValueError(msg)
-        return "urn:ietf:params:oauth:token-type:refresh_token"
-    elif token_type == "id_token":
-        if token is not None and not isinstance(token, (str, IdToken)):
-            msg = "The supplied token is not an IdToken or a string representation of it."
-            raise TypeError(
-                msg,
-                type(token),
-            )
-        return "urn:ietf:params:oauth:token-type:id_token"
-    else:
-        return {
-            "saml1": "urn:ietf:params:oauth:token-type:saml1",
-            "saml2": "urn:ietf:params:oauth:token-type:saml2",
-            "jwt": "urn:ietf:params:oauth:token-type:jwt",
-        }.get(token_type, token_type)
-
-
-
+ + + + response + + Response + + +
+

the HTTP response containing the error

+
+ + + required + + + + client + + + +
+

the OAuth2Client used to send the request

+
+ + + required + + + + + +
+ Source code in requests_oauth2client/exceptions.py + 
14
+15
+16
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
class OAuth2Error(Exception):
+    """Base class for Exceptions raised when a backend endpoint returns an error.
+
+    Args:
+        response: the HTTP response containing the error
+        client : the OAuth2Client used to send the request
+
+    """
+
+    def __init__(self, response: requests.Response, client: OAuth2Client) -> None:
+        super().__init__("The remote endpoint returned an error")
+        self.response = response
+        self.client = client
+
+    @property
+    def request(self) -> requests.PreparedRequest:
+        """The request leading to the error."""
+        return self.response.request
+
+
-
-
+
-
- revoke_access_token(access_token, requests_kwargs=None, **revoke_kwargs) -
-
- -

Send a request to the Revocation Endpoint to revoke an access token.

+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
access_token - BearerToken | str - -
-

the access token to revoke

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the underlying requests.post() call

-
- 		- None -
**revoke_kwargs - Any - -
-

additional parameters to pass to the revocation endpoint

-
- 		- {} -
- -
- Source code in requests_oauth2client/client.py - 
979
-980
-981
-982
-983
-984
-985
-986
-987
-988
-989
-990
-991
-992
-993
-994
-995
-996
-997
-998
def revoke_access_token(
-    self,
-    access_token: BearerToken | str,
-    requests_kwargs: dict[str, Any] | None = None,
-    **revoke_kwargs: Any,
-) -> bool:
-    """Send a request to the Revocation Endpoint to revoke an access token.
-
-    Args:
-        access_token: the access token to revoke
-        requests_kwargs: additional parameters for the underlying requests.post() call
-        **revoke_kwargs: additional parameters to pass to the revocation endpoint
-
-    """
-    return self.revoke_token(
-        access_token,
-        token_type_hint=TokenType.ACCESS_TOKEN,
-        requests_kwargs=requests_kwargs,
-        **revoke_kwargs,
-    )
-
-
-
-
+
+ request: requests.PreparedRequest + + property + -
+
+
-
- revoke_refresh_token(refresh_token, requests_kwargs=None, **revoke_kwargs) +

The request leading to the error.

+
- +
-
- -

Send a request to the Revocation Endpoint to revoke a refresh token.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
refresh_token - str | BearerToken - -
-

the refresh token to revoke.

-
- 		- required -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters to pass to the revocation endpoint.

-
- 		- None -
**revoke_kwargs - Any - -
-

additional parameters to pass to the revocation endpoint.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- bool - -
-

True if the revocation request is successful, False if this client has no configured

-
-
- bool - -
-

revocation endpoint.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1000
-1001
-1002
-1003
-1004
-1005
-1006
-1007
-1008
-1009
-1010
-1011
-1012
-1013
-1014
-1015
-1016
-1017
-1018
-1019
-1020
-1021
-1022
-1023
-1024
-1025
-1026
-1027
-1028
-1029
def revoke_refresh_token(
-    self,
-    refresh_token: str | BearerToken,
-    requests_kwargs: dict[str, Any] | None = None,
-    **revoke_kwargs: Any,
-) -> bool:
-    """Send a request to the Revocation Endpoint to revoke a refresh token.
-
-    Args:
-        refresh_token: the refresh token to revoke.
-        requests_kwargs: additional parameters to pass to the revocation endpoint.
-        **revoke_kwargs: additional parameters to pass to the revocation endpoint.
-
-    Returns:
-        `True` if the revocation request is successful, `False` if this client has no configured
-        revocation endpoint.
-
-    """
-    if isinstance(refresh_token, BearerToken):
-        if refresh_token.refresh_token is None:
-            msg = "The supplied BearerToken doesn't have a refresh token."
-            raise ValueError(msg)
-        refresh_token = refresh_token.refresh_token
-
-    return self.revoke_token(
-        refresh_token,
-        token_type_hint=TokenType.REFRESH_TOKEN,
-        requests_kwargs=requests_kwargs,
-        **revoke_kwargs,
-    )
-
-
+
+
+
-
+

+ EndpointError -

- revoke_token(token, token_type_hint=None, requests_kwargs=None, **revoke_kwargs) -
+ -
- -

Send a Token Revocation request.

-

By default, authentication will be the same than the one used for the Token Endpoint.

+
+

+ Bases: OAuth2Error

+

Base class for exceptions raised from backend endpoint errors.

+

This contains the error message, description and uri that are returned +by the AS in the OAuth 2.0 standardised way.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
token - str | BearerToken - -
-

the token to revoke.

-
- 		- required -
token_type_hint - str | None - -
-

a token_type_hint to send to the revocation endpoint.

-
- 		- None -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters to the underling call to requests.post()

-
- 		- None -
**revoke_kwargs - Any - -
-

additional parameters to send to the revocation endpoint.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - - - + +

Parameters:

+
TypeDescription
- bool - -
-

True if the revocation succeeds, False if no revocation endpoint is present or a

-
-
- bool - -
-

non-standardised error is returned.

-
-
+ + + + + + - -
NameTypeDescriptionDefault
- -
- Source code in requests_oauth2client/client.py - 
1031
-1032
-1033
-1034
-1035
-1036
-1037
-1038
-1039
-1040
-1041
-1042
-1043
-1044
-1045
-1046
-1047
-1048
-1049
-1050
-1051
-1052
-1053
-1054
-1055
-1056
-1057
-1058
-1059
-1060
-1061
-1062
-1063
-1064
-1065
-1066
-1067
-1068
-1069
-1070
-1071
-1072
def revoke_token(
-    self,
-    token: str | BearerToken,
-    token_type_hint: str | None = None,
-    requests_kwargs: dict[str, Any] | None = None,
-    **revoke_kwargs: Any,
-) -> bool:
-    """Send a Token Revocation request.
-
-    By default, authentication will be the same than the one used for the Token Endpoint.
-
-    Args:
-        token: the token to revoke.
-        token_type_hint: a token_type_hint to send to the revocation endpoint.
-        requests_kwargs: additional parameters to the underling call to requests.post()
-        **revoke_kwargs: additional parameters to send to the revocation endpoint.
-
-    Returns:
-        `True` if the revocation succeeds, `False` if no revocation endpoint is present or a
-        non-standardised error is returned.
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    if token_type_hint == TokenType.REFRESH_TOKEN and isinstance(token, BearerToken):
-        if token.refresh_token is None:
-            msg = "The supplied BearerToken doesn't have a refresh token."
-            raise ValueError(msg)
-        token = token.refresh_token
-
-    data = dict(revoke_kwargs, token=str(token))
-    if token_type_hint:
-        data["token_type_hint"] = token_type_hint
-
-    return self._request(
-        "revocation_endpoint",
-        data=data,
-        auth=self.auth,
-        on_success=lambda resp: True,
-        on_failure=self.on_revocation_error,
-        **requests_kwargs,
-    )
-
-
-
+ + + + response + + Response + + +
+

the raw response containing the error.

+
+ + + required + + + + error + + str + + +
+

the error identifier as returned by the AS.

+
+ + + required + + + + description + + str | None + + +
+

the error_description as returned by the AS.

+
+ + + None + + + + uri + + str | None + + +
+

the error_uri as returned by the AS.

+
+ + + None + + + + + +
+ Source code in requests_oauth2client/exceptions.py + 
34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
class EndpointError(OAuth2Error):
+    """Base class for exceptions raised from backend endpoint errors.
+
+    This contains the error message, description and uri that are returned
+    by the AS in the OAuth 2.0 standardised way.
+
+    Args:
+        response: the raw response containing the error.
+        error: the `error` identifier as returned by the AS.
+        description: the `error_description` as returned by the AS.
+        uri: the `error_uri` as returned by the AS.
+
+    """
+
+    def __init__(
+        self,
+        response: requests.Response,
+        client: OAuth2Client,
+        error: str,
+        description: str | None = None,
+        uri: str | None = None,
+    ) -> None:
+        super().__init__(response=response, client=client)
+        self.error = error
+        self.description = description
+        self.uri = uri
+
+
-
-
+
+ + -
- on_revocation_error(response) -
-
- -

Error handler for revoke_token().

-

Invoked by revoke_token() when the -revocation endpoint returns an error.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the Response as returned by the Revocation Endpoint

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- bool - -
-

False to signal that an error occurred. May raise exceptions instead depending on the

-
-
- bool - -
-

revocation response.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1074
-1075
-1076
-1077
-1078
-1079
-1080
-1081
-1082
-1083
-1084
-1085
-1086
-1087
-1088
-1089
-1090
-1091
-1092
-1093
-1094
-1095
-1096
-1097
def on_revocation_error(self, response: requests.Response) -> bool:
-    """Error handler for `revoke_token()`.
-
-    Invoked by [revoke_token()][requests_oauth2client.client.OAuth2Client.revoke_token] when the
-    revocation endpoint returns an error.
-
-    Args:
-        response: the [Response][requests.Response] as returned by the Revocation Endpoint
-
-    Returns:
-        `False` to signal that an error occurred. May raise exceptions instead depending on the
-        revocation response.
-
-    """
-    try:
-        data = response.json()
-        error = data["error"]
-        error_description = data.get("error_description")
-        error_uri = data.get("error_uri")
-        exception_class = self.exception_classes.get(error, RevocationError)
-        exception = exception_class(error, error_description, error_uri)
-    except Exception:
-        return False
-    raise exception
-
-
+
+
+
-
+

+ InvalidTokenResponse -

- introspect_token(token, token_type_hint=None, requests_kwargs=None, **introspect_kwargs) -
+ -
- -

Send a request to the Introspection Endpoint.

-

Parameter token can be:

-
    -
  • a str
    • -
  • a BearerToken instance
    • -
-

You may pass any arbitrary token and token_type_hint values as str. Those will -be included in the request, as-is. -If token is a BearerToken, then token_type_hint must be either:

-
    -
  • None: the access_token will be instrospected and no token_type_hint will be included -in the request
    • -
  • access_token: same as None, but the token_type_hint will be included
    • -
  • or refresh_token: only available if a Refresh Token is present in the BearerToken.
    • -
+
+

+ Bases: OAuth2Error

+

Raised when the Token Endpoint returns a non-standard response.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
token - str | BearerToken - -
-

the token to instrospect

-
- 		- required -
token_type_hint - str | None - -
-

the token_type_hint to include in the request.

-
- 		- None -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters to the underling call to requests.post()

-
- 		- None -
**introspect_kwargs - Any - -
-

additional parameters to send to the introspection endpoint.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Any - -
-

the response as returned by the Introspection Endpoint.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1099
-1100
-1101
-1102
-1103
-1104
-1105
-1106
-1107
-1108
-1109
-1110
-1111
-1112
-1113
-1114
-1115
-1116
-1117
-1118
-1119
-1120
-1121
-1122
-1123
-1124
-1125
-1126
-1127
-1128
-1129
-1130
-1131
-1132
-1133
-1134
-1135
-1136
-1137
-1138
-1139
-1140
-1141
-1142
-1143
-1144
-1145
-1146
-1147
-1148
-1149
-1150
-1151
-1152
-1153
-1154
-1155
-1156
-1157
-1158
-1159
-1160
-1161
def introspect_token(
-    self,
-    token: str | BearerToken,
-    token_type_hint: str | None = None,
-    requests_kwargs: dict[str, Any] | None = None,
-    **introspect_kwargs: Any,
-) -> Any:
-    """Send a request to the Introspection Endpoint.
-
-    Parameter `token` can be:
-
-    - a `str`
-    - a `BearerToken` instance
-
-    You may pass any arbitrary `token` and `token_type_hint` values as `str`. Those will
-    be included in the request, as-is.
-    If `token` is a `BearerToken`, then `token_type_hint` must be either:
-
-    - `None`: the access_token will be instrospected and no token_type_hint will be included
-    in the request
-    - `access_token`: same as `None`, but the token_type_hint will be included
-    - or `refresh_token`: only available if a Refresh Token is present in the BearerToken.
-
-    Args:
-        token: the token to instrospect
-        token_type_hint: the `token_type_hint` to include in the request.
-        requests_kwargs: additional parameters to the underling call to requests.post()
-        **introspect_kwargs: additional parameters to send to the introspection endpoint.
-
-    Returns:
-        the response as returned by the Introspection Endpoint.
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    if isinstance(token, BearerToken):
-        if token_type_hint is None or token_type_hint == TokenType.ACCESS_TOKEN:
-            token = token.access_token
-        elif token_type_hint == TokenType.REFRESH_TOKEN:
-            if token.refresh_token is None:
-                msg = "The supplied BearerToken doesn't have a refresh token."
-                raise ValueError(msg)
-            else:
-                token = token.refresh_token
-        else:
-            msg = (
-                "Invalid `token_type_hint`. To test arbitrary `token_type_hint` values,"
-                " you must provide `token` as a `str`."
-            )
-            raise ValueError(msg)
-
-    data = dict(introspect_kwargs, token=str(token))
-    if token_type_hint:
-        data["token_type_hint"] = token_type_hint
-
-    return self._request(
-        "introspection_endpoint",
-        data=data,
-        auth=self.auth,
-        on_success=self.parse_introspection_response,
-        on_failure=self.on_introspection_error,
-        **requests_kwargs,
-    )
-
-
-
+
+ Source code in requests_oauth2client/exceptions.py + 
62
+63
class InvalidTokenResponse(OAuth2Error):
+    """Raised when the Token Endpoint returns a non-standard response."""
+
+
-
-
+
+ + -
- parse_introspection_response(response) -
-
- -

Parse Token Introspection Responses received by introspect_token().

-

Invoked by introspect_token() -to parse the returned response. This decodes the JSON content if possible, otherwise it -returns the response as a string.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the Response as returned by the Introspection Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Any - -
-

the decoded JSON content, or a str with the content.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1163
-1164
-1165
-1166
-1167
-1168
-1169
-1170
-1171
-1172
-1173
-1174
-1175
-1176
-1177
-1178
-1179
-1180
def parse_introspection_response(self, response: requests.Response) -> Any:
-    """Parse Token Introspection Responses received by `introspect_token()`.
-
-    Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
-    to parse the returned response. This decodes the JSON content if possible, otherwise it
-    returns the response as a string.
-
-    Args:
-        response: the [Response][requests.Response] as returned by the Introspection Endpoint.
-
-    Returns:
-        the decoded JSON content, or a `str` with the content.
-
-    """
-    try:
-        return response.json()
-    except ValueError:
-        return response.text
-
-
+
+
+
-
+

+ UnknownTokenEndpointError -

- on_introspection_error(response) -
+ -
- -

Error handler for introspect_token().

-

Invoked by introspect_token() -to parse the returned response in the case an error is returned.

+
+

+ Bases: EndpointError

+

Raised when an otherwise unknown error is returned by the token endpoint.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the response as returned by the Introspection Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Any - -
-

usually raises exceptions. A subclass can return a default response instead.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1182
-1183
-1184
-1185
-1186
-1187
-1188
-1189
-1190
-1191
-1192
-1193
-1194
-1195
-1196
-1197
-1198
-1199
-1200
-1201
-1202
-1203
-1204
def on_introspection_error(self, response: requests.Response) -> Any:
-    """Error handler for `introspect_token()`.
-
-    Invoked by [introspect_token()][requests_oauth2client.client.OAuth2Client.introspect_token]
-    to parse the returned response in the case an error is returned.
-
-    Args:
-        response: the response as returned by the Introspection Endpoint.
-
-    Returns:
-        usually raises exceptions. A subclass can return a default response instead.
-
-    """
-    try:
-        data = response.json()
-        error = data["error"]
-        error_description = data.get("error_description")
-        error_uri = data.get("error_uri")
-        exception_class = self.exception_classes.get(error, IntrospectionError)
-        exception = exception_class(error, error_description, error_uri)
-    except Exception as exc:
-        raise UnknownIntrospectionError(response) from exc
-    raise exception
-
-
-
+
+ Source code in requests_oauth2client/exceptions.py + 
66
+67
class UnknownTokenEndpointError(EndpointError):
+    """Raised when an otherwise unknown error is returned by the token endpoint."""
+
+
-
-
+
+ + -
- backchannel_authentication_request(scope='openid', *, client_notification_token=None, acr_values=None, login_hint_token=None, id_token_hint=None, login_hint=None, binding_message=None, user_code=None, requested_expiry=None, private_jwk=None, alg=None, requests_kwargs=None, **ciba_kwargs) -
-
- -

Send a CIBA Authentication Request.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
scope - None | str | Iterable[str] - -
-

the scope to include in the request.

-
- 		- 'openid' -
client_notification_token - str | None - -
-

the Client Notification Token to include in the request.

-
- 		- None -
acr_values - None | str | Iterable[str] - -
-

the acr values to include in the request.

-
- 		- None -
login_hint_token - str | None - -
-

the Login Hint Token to include in the request.

-
- 		- None -
id_token_hint - str | None - -
-

the ID Token Hint to include in the request.

-
- 		- None -
login_hint - str | None - -
-

the Login Hint to include in the request.

-
- 		- None -
binding_message - str | None - -
-

the Binding Message to include in the request.

-
- 		- None -
user_code - str | None - -
-

the User Code to include in the request

-
- 		- None -
requested_expiry - int | None - -
-

the Requested Expiry, in seconds, to include in the request.

-
- 		- None -
private_jwk - Jwk | dict[str, Any] | None - -
-

the JWK to use to sign the request (optional)

-
- 		- None -
alg - str | None - -
-

the alg to use to sign the request, if the provided JWK does not include an "alg" parameter.

-
- 		- None -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for

-
- 		- None -
**ciba_kwargs - Any - -
-

additional parameters to include in the request.

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BackChannelAuthenticationResponse - -
-

a BackChannelAuthenticationResponse as returned by AS

-
-
- -
- Source code in requests_oauth2client/client.py - 
1206
-1207
-1208
-1209
-1210
-1211
-1212
-1213
-1214
-1215
-1216
-1217
-1218
-1219
-1220
-1221
-1222
-1223
-1224
-1225
-1226
-1227
-1228
-1229
-1230
-1231
-1232
-1233
-1234
-1235
-1236
-1237
-1238
-1239
-1240
-1241
-1242
-1243
-1244
-1245
-1246
-1247
-1248
-1249
-1250
-1251
-1252
-1253
-1254
-1255
-1256
-1257
-1258
-1259
-1260
-1261
-1262
-1263
-1264
-1265
-1266
-1267
-1268
-1269
-1270
-1271
-1272
-1273
-1274
-1275
-1276
-1277
-1278
-1279
-1280
-1281
-1282
-1283
-1284
-1285
-1286
-1287
-1288
-1289
-1290
-1291
def backchannel_authentication_request(  # noqa: PLR0913
-    self,
-    scope: None | str | Iterable[str] = "openid",
-    *,
-    client_notification_token: str | None = None,
-    acr_values: None | str | Iterable[str] = None,
-    login_hint_token: str | None = None,
-    id_token_hint: str | None = None,
-    login_hint: str | None = None,
-    binding_message: str | None = None,
-    user_code: str | None = None,
-    requested_expiry: int | None = None,
-    private_jwk: Jwk | dict[str, Any] | None = None,
-    alg: str | None = None,
-    requests_kwargs: dict[str, Any] | None = None,
-    **ciba_kwargs: Any,
-) -> BackChannelAuthenticationResponse:
-    """Send a CIBA Authentication Request.
-
-    Args:
-         scope: the scope to include in the request.
-         client_notification_token: the Client Notification Token to include in the request.
-         acr_values: the acr values to include in the request.
-         login_hint_token: the Login Hint Token to include in the request.
-         id_token_hint: the ID Token Hint to include in the request.
-         login_hint: the Login Hint to include in the request.
-         binding_message: the Binding Message to include in the request.
-         user_code: the User Code to include in the request
-         requested_expiry: the Requested Expiry, in seconds, to include in the request.
-         private_jwk: the JWK to use to sign the request (optional)
-         alg: the alg to use to sign the request, if the provided JWK does not include an "alg" parameter.
-         requests_kwargs: additional parameters for
-         **ciba_kwargs: additional parameters to include in the request.
-
-    Returns:
-        a BackChannelAuthenticationResponse as returned by AS
-
-    """
-    if not (login_hint or login_hint_token or id_token_hint):
-        msg = "One of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
-        raise ValueError(msg)
-
-    if (login_hint_token and id_token_hint) or (login_hint and id_token_hint) or (login_hint_token and login_hint):
-        msg = "Only one of `login_hint`, `login_hint_token` or `ìd_token_hint` must be provided"
-        raise ValueError(msg)
-
-    requests_kwargs = requests_kwargs or {}
-
-    if scope is not None and not isinstance(scope, str):
-        try:
-            scope = " ".join(scope)
-        except Exception as exc:
-            msg = "Unsupported `scope` value"
-            raise ValueError(msg) from exc
-
-    if acr_values is not None and not isinstance(acr_values, str):
-        try:
-            acr_values = " ".join(acr_values)
-        except Exception as exc:
-            msg = "Unsupported `acr_values`"
-            raise ValueError(msg) from exc
-
-    data = dict(
-        ciba_kwargs,
-        scope=scope,
-        client_notification_token=client_notification_token,
-        acr_values=acr_values,
-        login_hint_token=login_hint_token,
-        id_token_hint=id_token_hint,
-        login_hint=login_hint,
-        binding_message=binding_message,
-        user_code=user_code,
-        requested_expiry=requested_expiry,
-    )
-
-    if private_jwk is not None:
-        data = {"request": str(Jwt.sign(data, key=private_jwk, alg=alg))}
-
-    return self._request(
-        "backchannel_authentication_endpoint",
-        data=data,
-        auth=self.auth,
-        on_success=self.parse_backchannel_authentication_response,
-        on_failure=self.on_backchannel_authentication_error,
-        **requests_kwargs,
-    )
-
-
+
+
+
-
+

+ ServerError -

- parse_backchannel_authentication_response(response) -
+ -
- -

Parse a response received by backchannel_authentication_request().

-

Invoked by -backchannel_authentication_request() -to parse the response returned by the BackChannel Authentication Endpoint.

+
+

+ Bases: EndpointError

+

Raised when the token endpoint returns error = server_error.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the response returned by the BackChannel Authentication Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BackChannelAuthenticationResponse - -
-

a BackChannelAuthenticationResponse

-
-
- -
- Source code in requests_oauth2client/client.py - 
1293
-1294
-1295
-1296
-1297
-1298
-1299
-1300
-1301
-1302
-1303
-1304
-1305
-1306
-1307
-1308
-1309
-1310
-1311
-1312
def parse_backchannel_authentication_response(
-    self, response: requests.Response
-) -> BackChannelAuthenticationResponse:
-    """Parse a response received by `backchannel_authentication_request()`.
-
-    Invoked by
-    [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
-    to parse the response returned by the BackChannel Authentication Endpoint.
-
-    Args:
-        response: the response returned by the BackChannel Authentication Endpoint.
-
-    Returns:
-        a `BackChannelAuthenticationResponse`
-
-    """
-    try:
-        return BackChannelAuthenticationResponse(**response.json())
-    except TypeError as exc:
-        raise InvalidBackChannelAuthenticationResponse(response) from exc
-
-
-
+
+ Source code in requests_oauth2client/exceptions.py + 
70
+71
class ServerError(EndpointError):
+    """Raised when the token endpoint returns `error = server_error`."""
+
+
-
-
+
+ + -
- on_backchannel_authentication_error(response) -
-
- -

Error handler for backchannel_authentication_request().

-

Invoked by -backchannel_authentication_request() -to parse the response returned by the BackChannel Authentication Endpoint, when it is an -error.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the response returned by the BackChannel Authentication Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BackChannelAuthenticationResponse - -
-

usually raises an exception. But a subclass can return a default response instead.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1314
-1315
-1316
-1317
-1318
-1319
-1320
-1321
-1322
-1323
-1324
-1325
-1326
-1327
-1328
-1329
-1330
-1331
-1332
-1333
-1334
-1335
-1336
-1337
-1338
def on_backchannel_authentication_error(self, response: requests.Response) -> BackChannelAuthenticationResponse:
-    """Error handler for `backchannel_authentication_request()`.
-
-    Invoked by
-    [backchannel_authentication_request()][requests_oauth2client.client.OAuth2Client.backchannel_authentication_request]
-    to parse the response returned by the BackChannel Authentication Endpoint, when it is an
-    error.
-
-    Args:
-        response: the response returned by the BackChannel Authentication Endpoint.
-
-    Returns:
-        usually raises an exception. But a subclass can return a default response instead.
-
-    """
-    try:
-        data = response.json()
-        error = data["error"]
-        error_description = data.get("error_description")
-        error_uri = data.get("error_uri")
-        exception_class = self.exception_classes.get(error, BackChannelAuthenticationError)
-        exception = exception_class(error, error_description, error_uri)
-    except Exception as exc:
-        raise InvalidBackChannelAuthenticationResponse(response) from exc
-    raise exception
-
-
+
+
+
+ -
+

+ TokenEndpointError -

- authorize_device(requests_kwargs=None, **data) +
- +
+

+ Bases: EndpointError

-
- -

Send a Device Authorization Request.

+

Base class for errors that are specific to the token endpoint.

+
+ Source code in requests_oauth2client/exceptions.py + 
74
+75
class TokenEndpointError(EndpointError):
+    """Base class for errors that are specific to the token endpoint."""
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
**data - Any - -
-

additional data to send to the Device Authorization Endpoint

-
- 		- {} -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for requests.request()

-
- 		- None -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- DeviceAuthorizationResponse - -
-

a Device Authorization Response

-
-
- -
- Source code in requests_oauth2client/client.py - 
1340
-1341
-1342
-1343
-1344
-1345
-1346
-1347
-1348
-1349
-1350
-1351
-1352
-1353
-1354
-1355
-1356
-1357
-1358
-1359
-1360
-1361
-1362
def authorize_device(
-    self, requests_kwargs: dict[str, Any] | None = None, **data: Any
-) -> DeviceAuthorizationResponse:
-    """Send a Device Authorization Request.
-
-    Args:
-        **data: additional data to send to the Device Authorization Endpoint
-        requests_kwargs: additional parameters for `requests.request()`
-
-    Returns:
-        a Device Authorization Response
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    return self._request(
-        "device_authorization_endpoint",
-        data=data,
-        auth=self.auth,
-        on_success=self.parse_device_authorization_response,
-        on_failure=self.on_device_authorization_error,
-        **requests_kwargs,
-    )
-
-
-
-
+ +
-
-
- parse_device_authorization_response(response) -
-
- -

Parse a Device Authorization Response received by authorize_device().

-

Invoked by authorize_device() -to parse the response returned by the Device Authorization Endpoint.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the response returned by the Device Authorization Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- DeviceAuthorizationResponse - -
-

a DeviceAuthorizationResponse as returned by AS

-
-
- -
- Source code in requests_oauth2client/client.py - 
1364
-1365
-1366
-1367
-1368
-1369
-1370
-1371
-1372
-1373
-1374
-1375
-1376
-1377
-1378
def parse_device_authorization_response(self, response: requests.Response) -> DeviceAuthorizationResponse:
-    """Parse a Device Authorization Response received by `authorize_device()`.
-
-    Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
-    to parse the response returned by the Device Authorization Endpoint.
-
-    Args:
-        response: the response returned by the Device Authorization Endpoint.
-
-    Returns:
-        a `DeviceAuthorizationResponse` as returned by AS
-
-    """
-    device_authorization_response = DeviceAuthorizationResponse(**response.json())
-    return device_authorization_response
-
-
+
+
+
-
+

+ InvalidRequest -

- on_device_authorization_error(response) -
+ -
- -

Error handler for authorize_device().

-

Invoked by authorize_device() -to parse the response returned by the Device Authorization Endpoint, when that response is -an error.

+
+

+ Bases: TokenEndpointError

+

Raised when the Token Endpoint returns error = invalid_request.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the response returned by the Device Authorization Endpoint.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- DeviceAuthorizationResponse - -
-

usually raises an Exception. But a subclass may return a default response instead.

-
-
- -
- Source code in requests_oauth2client/client.py - 
1380
-1381
-1382
-1383
-1384
-1385
-1386
-1387
-1388
-1389
-1390
-1391
-1392
-1393
-1394
-1395
-1396
-1397
-1398
-1399
-1400
-1401
-1402
-1403
def on_device_authorization_error(self, response: requests.Response) -> DeviceAuthorizationResponse:
-    """Error handler for `authorize_device()`.
-
-    Invoked by [authorize_device()][requests_oauth2client.client.OAuth2Client.authorize_device]
-    to parse the response returned by the Device Authorization Endpoint, when that response is
-    an error.
-
-    Args:
-        response: the response returned by the Device Authorization Endpoint.
-
-    Returns:
-        usually raises an Exception. But a subclass may return a default response instead.
-
-    """
-    try:
-        data = response.json()
-        error = data["error"]
-        error_description = data.get("error_description")
-        error_uri = data.get("error_uri")
-        exception_class = self.exception_classes.get(error, DeviceAuthorizationError)
-        exception = exception_class(response, error, error_description, error_uri)
-    except Exception as exc:
-        raise InvalidDeviceAuthorizationResponse(response) from exc
-    raise exception
-
-
-
+
+ Source code in requests_oauth2client/exceptions.py + 
78
+79
class InvalidRequest(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = invalid_request`."""
+
+
-
-
+
-
- update_authorization_server_public_keys(requests_kwargs=None) -
-
- -

Update the cached AS public keys by retrieving them from its jwks_uri.

-

Public keys are returned by this method, as a jwskate.JwkSet. They are also -available in attribute authorization_server_jwks.

-

Returns:

- - - - - - - - - - - - - -
TypeDescription
- JwkSet - -
-

the retrieved public keys

-
-
- - - -

Raises:

- - - - - - - - - - - - - -
TypeDescription
- ValueError - -
-

if no jwks_uri is configured

-
-
- -
- Source code in requests_oauth2client/client.py - 
1405
-1406
-1407
-1408
-1409
-1410
-1411
-1412
-1413
-1414
-1415
-1416
-1417
-1418
-1419
-1420
-1421
-1422
-1423
-1424
-1425
-1426
-1427
-1428
-1429
def update_authorization_server_public_keys(self, requests_kwargs: dict[str, Any] | None = None) -> JwkSet:
-    """Update the cached AS public keys by retrieving them from its `jwks_uri`.
-
-    Public keys are returned by this method, as a `jwskate.JwkSet`. They are also
-    available in attribute `authorization_server_jwks`.
-
-    Returns:
-        the retrieved public keys
-
-    Raises:
-        ValueError: if no `jwks_uri` is configured
-
-    """
-    requests_kwargs = requests_kwargs or {}
-
-    jwks = self._request(
-        "jwks_uri",
-        auth=None,
-        method="GET",
-        on_success=lambda resp: resp.json(),
-        on_failure=lambda resp: resp.raise_for_status(),
-        **requests_kwargs,
-    )
-    self.authorization_server_jwks.update(jwks)
-    return self.authorization_server_jwks
-
-
-
-
+
-
+
+
+
-
- from_discovery_endpoint(url=None, issuer=None, *, auth=None, client_id=None, client_secret=None, private_key=None, session=None, testing=False, **kwargs) - - - classmethod - -
+

+ InvalidClient -
- -

Initialise an OAuth2Client based on Authorization Server Metadata.

-

This will retrieve the standardised metadata document available at url, and will extract -all Endpoint Uris from that document, will fetch the current public keys from its -jwks_uri, then will initialise an OAuth2Client based on those endpoints.

+

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
url - str | None - -
-

the url where the server metadata will be retrieved

-
- 		- None -
auth - AuthBase | tuple[str, str] | str | None - -
-

the authentication handler to use for client authentication

-
- 		- None -
client_id - str | None - -
-

client ID

-
- 		- None -
client_secret - str | None - -
-

client secret to use to authenticate the client

-
- 		- None -
private_key - Jwk | dict[str, Any] | None - -
-

private key to sign client assertions

-
- 		- None -
session - Session | None - -
-

a requests.Session to use to retrieve the document and initialise the client with

-
- 		- None -
issuer - str | None - -
-

if an issuer is given, check that it matches the one from the retrieved document

-
- 		- None -
testing - bool - -
-

if True, don't try to validate the endpoint urls that are part of the document

-
- 		- False -
**kwargs - Any - -
-

additional keyword parameters to pass to OAuth2Client

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- OAuth2Client - -
-

an OAuth2Client with endpoint initialised based on the obtained metadata

-
-
- - - -

Raises:

- - - - - - - - - - - - - - - - - -
TypeDescription
- ValueError - -
-

if neither url nor issuer are suitable urls

-
-
- HTTPError - -
-

if an error happens while fetching the documents

-
-
- -
- Source code in requests_oauth2client/client.py - 
1431
-1432
-1433
-1434
-1435
-1436
-1437
-1438
-1439
-1440
-1441
-1442
-1443
-1444
-1445
-1446
-1447
-1448
-1449
-1450
-1451
-1452
-1453
-1454
-1455
-1456
-1457
-1458
-1459
-1460
-1461
-1462
-1463
-1464
-1465
-1466
-1467
-1468
-1469
-1470
-1471
-1472
-1473
-1474
-1475
-1476
-1477
-1478
-1479
-1480
-1481
-1482
-1483
-1484
-1485
-1486
-1487
-1488
-1489
-1490
-1491
-1492
-1493
-1494
-1495
-1496
@classmethod
-def from_discovery_endpoint(
-    cls,
-    url: str | None = None,
-    issuer: str | None = None,
-    *,
-    auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
-    client_id: str | None = None,
-    client_secret: str | None = None,
-    private_key: Jwk | dict[str, Any] | None = None,
-    session: requests.Session | None = None,
-    testing: bool = False,
-    **kwargs: Any,
-) -> OAuth2Client:
-    """Initialise an OAuth2Client based on Authorization Server Metadata.
-
-    This will retrieve the standardised metadata document available at `url`, and will extract
-    all Endpoint Uris from that document, will fetch the current public keys from its
-    `jwks_uri`, then will initialise an OAuth2Client based on those endpoints.
-
-    Args:
-         url: the url where the server metadata will be retrieved
-         auth: the authentication handler to use for client authentication
-         client_id: client ID
-         client_secret: client secret to use to authenticate the client
-         private_key: private key to sign client assertions
-         session: a `requests.Session` to use to retrieve the document and initialise the client with
-         issuer: if an issuer is given, check that it matches the one from the retrieved document
-         testing: if True, don't try to validate the endpoint urls that are part of the document
-         **kwargs: additional keyword parameters to pass to OAuth2Client
-
-    Returns:
-        an OAuth2Client with endpoint initialised based on the obtained metadata
-
-    Raises:
-        ValueError: if neither `url` nor `issuer` are suitable urls
-        requests.HTTPError: if an error happens while fetching the documents
-
-    """
-    if url is None and issuer is not None:
-        url = oidc_discovery_document_url(issuer)
-    if url is None:
-        msg = "Please specify at least one of `issuer` or `url`"
-        raise ValueError(msg)
-
-    validate_endpoint_uri(url, path=False)
-
-    session = session or requests.Session()
-    discovery = session.get(url).json()
-
-    jwks_uri = discovery.get("jwks_uri")
-    if jwks_uri:
-        jwks = JwkSet(session.get(jwks_uri).json())
-
-    return cls.from_discovery_document(
-        discovery,
-        issuer=issuer,
-        auth=auth,
-        session=session,
-        client_id=client_id,
-        client_secret=client_secret,
-        private_key=private_key,
-        authorization_server_jwks=jwks,
-        testing=testing,
-        **kwargs,
-    )
-
-
-
+
+

+ Bases: TokenEndpointError

-
+

Raised when the Token Endpoint returns error = invalid_client.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
82
+83
class InvalidClient(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = invalid_client`."""
+
+
-
- from_discovery_document(discovery, issuer=None, *, auth=None, client_id=None, client_secret=None, private_key=None, authorization_server_jwks=None, session=None, https=True, testing=False, **kwargs) - - - classmethod - +
-
-
- -

Initialise an OAuth2Client, based on the server metadata from discovery.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
discovery - dict[str, Any] - -
-

a dict of server metadata, in the same format as retrieved from a discovery endpoint.

-
- 		- required -
issuer - str | None - -
-

if an issuer is given, check that it matches the one mentioned in the document

-
- 		- None -
auth - AuthBase | tuple[str, str] | str | None - -
-

the authentication handler to use for client authentication

-
- 		- None -
client_id - str | None - -
-

client ID

-
- 		- None -
client_secret - str | None - -
-

client secret to use to authenticate the client

-
- 		- None -
private_key - Jwk | dict[str, Any] | None - -
-

private key to sign client assertions

-
- 		- None -
authorization_server_jwks - JwkSet | dict[str, Any] | None - -
-

the current authorization server JWKS keys

-
- 		- None -
session - Session | None - -
-

a requests Session to use to retrieve the document and initialise the client with

-
- 		- None -
https - bool - -
-

(deprecated) if True, validates that urls in the discovery document use the https scheme

-
- 		- True -
testing - bool - -
-

if True, don't try to validate the endpoint urls that are part of the document

-
- 		- False -
**kwargs - Any - -
-

additional args that will be passed to OAuth2Client

-
- 		- {} -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- OAuth2Client - -
-

an OAuth2Client

-
-
- -
- Source code in requests_oauth2client/client.py - 
1498
-1499
-1500
-1501
-1502
-1503
-1504
-1505
-1506
-1507
-1508
-1509
-1510
-1511
-1512
-1513
-1514
-1515
-1516
-1517
-1518
-1519
-1520
-1521
-1522
-1523
-1524
-1525
-1526
-1527
-1528
-1529
-1530
-1531
-1532
-1533
-1534
-1535
-1536
-1537
-1538
-1539
-1540
-1541
-1542
-1543
-1544
-1545
-1546
-1547
-1548
-1549
-1550
-1551
-1552
-1553
-1554
-1555
-1556
-1557
-1558
-1559
-1560
-1561
-1562
-1563
-1564
-1565
-1566
-1567
-1568
-1569
-1570
-1571
-1572
-1573
-1574
-1575
-1576
-1577
-1578
-1579
-1580
-1581
-1582
@classmethod
-def from_discovery_document(  # noqa: PLR0913
-    cls,
-    discovery: dict[str, Any],
-    issuer: str | None = None,
-    *,
-    auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
-    client_id: str | None = None,
-    client_secret: str | None = None,
-    private_key: Jwk | dict[str, Any] | None = None,
-    authorization_server_jwks: JwkSet | dict[str, Any] | None = None,
-    session: requests.Session | None = None,
-    https: bool = True,
-    testing: bool = False,
-    **kwargs: Any,
-) -> OAuth2Client:
-    """Initialise an OAuth2Client, based on the server metadata from `discovery`.
-
-    Args:
-         discovery: a dict of server metadata, in the same format as retrieved from a discovery endpoint.
-         issuer: if an issuer is given, check that it matches the one mentioned in the document
-         auth: the authentication handler to use for client authentication
-         client_id: client ID
-         client_secret: client secret to use to authenticate the client
-         private_key: private key to sign client assertions
-         authorization_server_jwks: the current authorization server JWKS keys
-         session: a requests Session to use to retrieve the document and initialise the client with
-         https: (deprecated) if `True`, validates that urls in the discovery document use the https scheme
-         testing: if True, don't try to validate the endpoint urls that are part of the document
-         **kwargs: additional args that will be passed to OAuth2Client
-
-    Returns:
-        an `OAuth2Client`
-
-    """
-    if not https:
-        warnings.warn(
-            "The https parameter is deprecated."
-            " To disable endpoint uri validation, set `testing=True` when initializing your OAuth2Client.",
-            stacklevel=1,
-        )
-        testing = True
-    if issuer and discovery.get("issuer") != issuer:
-        msg = "Mismatching issuer value in discovery document: "
-        raise ValueError(
-            msg,
-            issuer,
-            discovery.get("issuer"),
-        )
-    elif issuer is None:
-        issuer = discovery.get("issuer")
-
-    token_endpoint = discovery.get("token_endpoint")
-    if token_endpoint is None:
-        msg = "token_endpoint not found in that discovery document"
-        raise ValueError(msg)
-    authorization_endpoint = discovery.get("authorization_endpoint")
-    revocation_endpoint = discovery.get("revocation_endpoint")
-    introspection_endpoint = discovery.get("introspection_endpoint")
-    userinfo_endpoint = discovery.get("userinfo_endpoint")
-    jwks_uri = discovery.get("jwks_uri")
-    if jwks_uri is not None:
-        validate_endpoint_uri(jwks_uri, https=https)
-    authorization_response_iss_parameter_supported = discovery.get(
-        "authorization_response_iss_parameter_supported", False
-    )
-
-    return cls(
-        token_endpoint=token_endpoint,
-        authorization_endpoint=authorization_endpoint,
-        revocation_endpoint=revocation_endpoint,
-        introspection_endpoint=introspection_endpoint,
-        userinfo_endpoint=userinfo_endpoint,
-        jwks_uri=jwks_uri,
-        authorization_server_jwks=authorization_server_jwks,
-        auth=auth,
-        client_id=client_id,
-        client_secret=client_secret,
-        private_key=private_key,
-        session=session,
-        issuer=issuer,
-        authorization_response_iss_parameter_supported=authorization_response_iss_parameter_supported,
-        testing=testing,
-        **kwargs,
-    )
-
-
-
-
-
+
@@ -56093,51 +68241,32 @@
- GrantType +

+ InvalidScope -

+ -
-

- Bases: str, Enum

+
+

+ Bases: TokenEndpointError

- -

An enum of standardized grant_type values.

-
- Source code in requests_oauth2client/client.py - 
1609
-1610
-1611
-1612
-1613
-1614
-1615
-1616
-1617
-1618
-1619
class GrantType(str, Enum):
-    """An enum of standardized `grant_type` values."""
-
-    CLIENT_CREDENTIALS = "client_credentials"
-    AUTHORIZATION_CODE = "authorization_code"
-    REFRESH_TOKEN = "refresh_token"
-    RESOURCE_OWNER_PASSWORD = "password"
-    TOKEN_EXCHANGE = "urn:ietf:params:oauth:grant-type:token-exchange"
-    JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer"
-    CLIENT_INITIATED_BACKCHANNEL_AUTHENTICATION = "urn:openid:params:grant-type:ciba"
-    DEVICE_CODE = "urn:ietf:params:oauth:grant-type:device_code"
-
-
+

Raised when the Token Endpoint returns error = invalid_scope.

- +
+ Source code in requests_oauth2client/exceptions.py + 
86
+87
class InvalidScope(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = invalid_scope`."""
+
+
-
+
+ @@ -56147,40 +68276,40 @@

-

+
+
-
- -
+

+ InvalidTarget -

-
+ +
+

+ Bases: TokenEndpointError

-

- client_authentication +

Raised when the Token Endpoint returns error = invalid_target.

-

+
+ Source code in requests_oauth2client/exceptions.py + 
90
+91
class InvalidTarget(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = invalid_target`."""
+
+
-
- -

This module implements OAuth 2.0 Client Authentication Methods.

-

An OAuth 2.0 Client must authenticate to the AS whenever it sends a request to the Token Endpoint, -by including appropriate credentials. This module contains helper classes and methods that implement -the standardized and commonly used Client Authentication Methods.

-
@@ -56191,107 +68320,45 @@

+ + + +

+ +
+ +
+
-

- BaseClientAuthenticationMethod +

+ InvalidGrant -

+ -
-

- Bases: AuthBase

+
+

+ Bases: TokenEndpointError

- -

Base class for all Client Authentication methods. This extends [requests.auth.AuthBase].

-

This base class only checks that requests are suitable to add Client Authentication parameters -to, and doesn't modify the request.

-
- Source code in requests_oauth2client/client_authentication.py - 
21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
class BaseClientAuthenticationMethod(requests.auth.AuthBase):
-    """Base class for all Client Authentication methods. This extends [requests.auth.AuthBase].
-
-    This base class only checks that requests are suitable to add Client Authentication parameters
-    to, and doesn't modify the request.
-
-    """
-
-    def __init__(self, client_id: str):
-        self.client_id = str(client_id)
-
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        """Check that the request is suitable for Client Authentication.
-
-        It checks:
-
-        * that the method is `POST`
-        * that the Content-Type is "application/x-www-form-urlencoded" or None
-
-        Args:
-            request: a [requests.PreparedRequest][]
-
-        Returns:
-            a [requests.PreparedRequest][], unmodified
-
-        Raises:
-            RuntimeError: if the request is not suitable for OAuth 2.0 Client Authentication
-
-        """
-        if request.method != "POST" or request.headers.get("Content-Type") not in (
-            "application/x-www-form-urlencoded",
-            None,
-        ):
-            msg = "This request is not suitable for OAuth 2.0 Client Authentication"
-            raise RuntimeError(msg)
-        return request
-
-
+

Raised when the Token Endpoint returns error = invalid_grant.

- +
+ Source code in requests_oauth2client/exceptions.py + 
94
+95
class InvalidGrant(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = invalid_grant`."""
+
+
-
+
+ @@ -56301,10 +68368,10 @@

- ClientSecretBasic +

+ AccessDenied -

+ -
-

- Bases: BaseClientAuthenticationMethod

- - -

Implement client_secret_basic authentication.

-

With this method, the client sends its Client ID and Secret, in the Authorization header, with -the "Basic" scheme, in each authenticated request to the AS.

- - - -

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client_id - str - -
-

client_id to use.

-
- 		- required -
client_secret - str - -
-

client_secret to use.

-
- 		- required -
+
+

+ Bases: EndpointError

-
- Source code in requests_oauth2client/client_authentication.py - 
59
-60
-61
-62
-63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
-76
-77
-78
-79
-80
-81
-82
-83
-84
-85
-86
-87
-88
-89
-90
-91
class ClientSecretBasic(BaseClientAuthenticationMethod):
-    """Implement `client_secret_basic` authentication.
-
-    With this method, the client sends its Client ID and Secret, in the Authorization header, with
-    the "Basic" scheme, in each authenticated request to the AS.
-
-    Args:
-        client_id: `client_id` to use.
-        client_secret: `client_secret` to use.
-
-    """
-
-    def __init__(self, client_id: str, client_secret: str):
-        super().__init__(client_id)
-        self.client_secret = str(client_secret)
-
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        """Add the appropriate `Authorization` header in each request.
-
-        The Authorization header is formatted as such: `Authorization: Basic
-        BASE64('<client_id:client_secret>')`
-
-        Args:
-            request: a [requests.PreparedRequest][].
-
-        Returns:
-            a [requests.PreparedRequest][] with the added Authorization header.
-
-        """
-        request = super().__call__(request)
-        b64encoded_credentials = BinaPy(f"{self.client_id}:{self.client_secret}").to("b64").ascii()
-        request.headers["Authorization"] = f"Basic {b64encoded_credentials}"
-        return request
-
-
- +

Raised when the Authorization Server returns error = access_denied.

+ +
+ Source code in requests_oauth2client/exceptions.py + 
98
+99
class AccessDenied(EndpointError):
+    """Raised when the Authorization Server returns `error = access_denied`."""
+
+
-
+
+ @@ -56456,10 +68414,10 @@

- ClientSecretPost +

+ UnauthorizedClient -

+ -
-

- Bases: BaseClientAuthenticationMethod

+
+

+ Bases: EndpointError

- -

Implement client_secret_post client authentication method.

-

With this method, the client inserts its client_id and client_secret in each authenticated - request to the AS.

- - - -

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client_id - str - -
-

client_id to use.

-
- 		- required -
client_secret - str - -
-

client_secret to use.

-
- 		- required -
-
- Source code in requests_oauth2client/client_authentication.py - 
 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
class ClientSecretPost(BaseClientAuthenticationMethod):
-    """Implement `client_secret_post` client authentication method.
-
-     With this method, the client inserts its client_id and client_secret in each authenticated
-     request to the AS.
-
-    Args:
-        client_id: `client_id` to use.
-        client_secret: `client_secret` to use.
-
-    """
-
-    def __init__(self, client_id: str, client_secret: str) -> None:
-        super().__init__(client_id)
-        self.client_secret = str(client_secret)
-
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        """Add the `client_id` and `client_secret` parameters in the request body.
-
-        Args:
-            request: a [requests.PreparedRequest][].
-
-        Returns:
-            a [requests.PreparedRequest][] with the added client credentials fields.
-
-        """
-        request = super().__call__(request)
-        params = (
-            parse_qs(request.body, strict_parsing=True, keep_blank_values=True)  # type: ignore[type-var]
-            if isinstance(request.body, (str, bytes))
-            else {}
-        )
-        params[b"client_id"] = [self.client_id.encode()]
-        params[b"client_secret"] = [self.client_secret.encode()]
-        request.prepare_body(params, files=None)
-        return request
-
-
+

Raised when the Authorization Server returns error = unauthorized_client.

+ +
+ Source code in requests_oauth2client/exceptions.py + 
102
+103
class UnauthorizedClient(EndpointError):
+    """Raised when the Authorization Server returns `error = unauthorized_client`."""
+
+
- -
+
@@ -56617,10 +68460,10 @@

- ClientAssertionAuthenticationMethod - +

+ RevocationError -

+ -
-

- Bases: BaseClientAuthenticationMethod

- -

Base class for assertion-based client authentication methods.

+
+

+ Bases: EndpointError

+

Base class for Revocation Endpoint errors.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client_id - str - -
-

the client_id to use

-
- 		- required -
alg - str - -
-

the alg to use to sign generated Client Assertions.

-
- 		- required -
lifetime - int - -
-

the lifetime to use for generated Client Assertions.

-
- 		- required -
jti_gen - Callable[[], str] - -
-

a function to generate JWT Token Ids (jti) for generated Client Assertions.

-
- 		- required -
aud - str | None - -
-

the audience value to use. If None (default), the endpoint URL will be used.

-
- 		- None -
+
+ Source code in requests_oauth2client/exceptions.py + 
106
+107
class RevocationError(EndpointError):
+    """Base class for Revocation Endpoint errors."""
+
+
-
- Source code in requests_oauth2client/client_authentication.py - 
132
-133
-134
-135
-136
-137
-138
-139
-140
-141
-142
-143
-144
-145
-146
-147
-148
-149
-150
-151
-152
-153
-154
-155
-156
-157
-158
-159
-160
-161
-162
-163
-164
-165
-166
-167
-168
-169
-170
-171
-172
-173
-174
-175
-176
-177
-178
-179
-180
-181
-182
-183
-184
-185
-186
-187
-188
-189
-190
-191
-192
-193
-194
-195
class ClientAssertionAuthenticationMethod(BaseClientAuthenticationMethod):
-    """Base class for assertion-based client authentication methods.
-
-    Args:
-        client_id: the client_id to use
-        alg: the alg to use to sign generated Client Assertions.
-        lifetime: the lifetime to use for generated Client Assertions.
-        jti_gen: a function to generate JWT Token Ids (`jti`) for generated Client Assertions.
-        aud: the audience value to use. If `None` (default), the endpoint URL will be used.
-
-    """
-
-    def __init__(
-        self,
-        client_id: str,
-        alg: str,
-        lifetime: int,
-        jti_gen: Callable[[], str],
-        aud: str | None = None,
-    ) -> None:
-        super().__init__(client_id)
-        self.alg = alg
-        self.lifetime = lifetime
-        self.jti_gen = jti_gen
-        self.aud = aud
-
-    def client_assertion(self, audience: str) -> str:
-        """Generate a Client Assertion for a specific audience.
-
-        Args:
-            audience: the audience to use for the `aud` claim of the generated Client Assertion.
-
-        Returns:
-            a Client Assertion, as `str`.
-
-        """
-        raise NotImplementedError()  # pragma: no cover
-
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        """Add a `client_assertion` field in the request body.
-
-        Args:
-            request: a [requests.PreparedRequest][].
-
-        Returns:
-            a [requests.PreparedRequest][] with the added `client_assertion` field.
-
-        """
-        request = super().__call__(request)
-        audience = self.aud or request.url
-        if audience is None:
-            msg = "No url defined for this request. This should never happen..."  # pragma: no cover
-            raise ValueError(msg)  # pragma: no cover
-        params = (
-            parse_qs(request.body, strict_parsing=True, keep_blank_values=True)  # type: ignore[type-var]
-            if request.body
-            else {}
-        )
-        client_assertion = self.client_assertion(audience)
-        params[b"client_id"] = [self.client_id.encode()]
-        params[b"client_assertion"] = [client_assertion.encode()]
-        params[b"client_assertion_type"] = [b"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]
-        request.prepare_body(params, files=None)
-        return request
-
-
-
@@ -56873,109 +68506,56 @@

+

+
-
- client_assertion(audience) +
+ +
+ + + +

+ UnsupportedTokenType + + +

+ + +
+

+ Bases: RevocationError

+ + +

Raised when the Revocation endpoint returns error = unsupported_token_type.

+ +
+ Source code in requests_oauth2client/exceptions.py + 
110
+111
class UnsupportedTokenType(RevocationError):
+    """Raised when the Revocation endpoint returns `error = unsupported_token_type`."""
+
+
+ + + +
- -
- -

Generate a Client Assertion for a specific audience.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
audience - str - -
-

the audience to use for the aud claim of the generated Client Assertion.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

a Client Assertion, as str.

-
-
- -
- Source code in requests_oauth2client/client_authentication.py - 
158
-159
-160
-161
-162
-163
-164
-165
-166
-167
-168
def client_assertion(self, audience: str) -> str:
-    """Generate a Client Assertion for a specific audience.
-
-    Args:
-        audience: the audience to use for the `aud` claim of the generated Client Assertion.
-
-    Returns:
-        a Client Assertion, as `str`.
-
-    """
-    raise NotImplementedError()  # pragma: no cover
-
-
-
-
-
+
@@ -56983,248 +68563,29 @@
- ClientSecretJwt +

+ IntrospectionError -

+ -
-

- Bases: ClientAssertionAuthenticationMethod

- - -

Implement client_secret_jwt client authentication method.

-

With this method, the client generates and signs a client assertion that is symmetrically -signed with its Client Secret. The assertion is then sent to the AS in a client_assertion -field with each authenticated request.

- - - -

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client_id - str - -
-

the client_id to use.

-
- 		- required -
client_secret - str - -
-

the client_secret to use to sign generated Client Assertions.

-
- 		- required -
alg - str - -
-

the alg to use to sign generated Client Assertions.

-
- 		- 'HS256' -
lifetime - int - -
-

the lifetime to use for generated Client Assertions.

-
- 		- 60 -
jti_gen - Callable[[], Any] - -
-

a function to generate JWT Token Ids (jti) for generated Client Assertions.

-
- 		- lambda: uuid4() -
aud - str | None - -
-

the audience value to use. If None (default), the endpoint URL will be used.

-
- 		- None -
+
+

+ Bases: EndpointError

+ + +

Base class for Introspection Endpoint errors.

+ +
+ Source code in requests_oauth2client/exceptions.py + 
114
+115
class IntrospectionError(EndpointError):
+    """Base class for Introspection Endpoint errors."""
+
+
-
- Source code in requests_oauth2client/client_authentication.py - 
198
-199
-200
-201
-202
-203
-204
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
class ClientSecretJwt(ClientAssertionAuthenticationMethod):
-    """Implement `client_secret_jwt` client authentication method.
-
-    With this method, the client generates and signs a client assertion that is symmetrically
-    signed with its Client Secret. The assertion is then sent to the AS in a `client_assertion`
-    field with each authenticated request.
-
-    Args:
-        client_id: the `client_id` to use.
-        client_secret: the `client_secret` to use to sign generated Client Assertions.
-        alg: the alg to use to sign generated Client Assertions.
-        lifetime: the lifetime to use for generated Client Assertions.
-        jti_gen: a function to generate JWT Token Ids (`jti`) for generated Client Assertions.
-        aud: the audience value to use. If `None` (default), the endpoint URL will be used.
-
-    """
-
-    def __init__(
-        self,
-        client_id: str,
-        client_secret: str,
-        alg: str = "HS256",
-        lifetime: int = 60,
-        jti_gen: Callable[[], Any] = lambda: uuid4(),
-        aud: str | None = None,
-    ) -> None:
-        super().__init__(client_id, alg, lifetime, jti_gen, aud)
-        self.client_secret = str(client_secret)
-
-    def client_assertion(self, audience: str) -> str:
-        """Generate a symmetrically signed Client Assertion.
-
-        Assertion is signed with the `client_secret` as key and the `alg` passed at init time.
-
-        Args:
-            audience: the audience to use for the generated Client Assertion.
-
-        Returns:
-            a Client Assertion, as `str`.
-
-        """
-        iat = int(datetime.now(tz=timezone.utc).timestamp())
-        exp = iat + self.lifetime
-        jti = str(self.jti_gen())
-
-        jwk = SymmetricJwk.from_bytes(self.client_secret.encode())
-
-        jwt = Jwt.sign(
-            claims={
-                "iss": self.client_id,
-                "sub": self.client_id,
-                "aud": audience,
-                "iat": iat,
-                "exp": exp,
-                "jti": jti,
-            },
-            key=jwk,
-            alg=self.alg,
-        )
-        return str(jwt)
-
-
-
@@ -57237,567 +68598,102 @@

+

+
-
- client_assertion(audience) +
- +
-
- -

Generate a symmetrically signed Client Assertion.

-

Assertion is signed with the client_secret as key and the alg passed at init time.

+

+ UnknownIntrospectionError -

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
audience - str - -
-

the audience to use for the generated Client Assertion.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

a Client Assertion, as str.

-
-
- -
- Source code in requests_oauth2client/client_authentication.py - 
227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
def client_assertion(self, audience: str) -> str:
-    """Generate a symmetrically signed Client Assertion.
-
-    Assertion is signed with the `client_secret` as key and the `alg` passed at init time.
-
-    Args:
-        audience: the audience to use for the generated Client Assertion.
-
-    Returns:
-        a Client Assertion, as `str`.
-
-    """
-    iat = int(datetime.now(tz=timezone.utc).timestamp())
-    exp = iat + self.lifetime
-    jti = str(self.jti_gen())
-
-    jwk = SymmetricJwk.from_bytes(self.client_secret.encode())
-
-    jwt = Jwt.sign(
-        claims={
-            "iss": self.client_id,
-            "sub": self.client_id,
-            "aud": audience,
-            "iat": iat,
-            "exp": exp,
-            "jti": jti,
-        },
-        key=jwk,
-        alg=self.alg,
-    )
-    return str(jwt)
-
-
-

+ -
+
+

+ Bases: OAuth2Error

-
+

Raised when the Introspection Endpoint returns a non-standard error.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
118
+119
class UnknownIntrospectionError(OAuth2Error):
+    """Raised when the Introspection Endpoint returns a non-standard error."""
+
+
-
-
+
-

- PrivateKeyJwt -

-
-

- Bases: ClientAssertionAuthenticationMethod

- -

Implement private_key_jwt client authentication method.

-

With this method, the client generates and sends a client_assertion, that is asymmetrically -signed with a private key, on each direct request to the Authorization Server.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client_id - str - -
-

the client_id to use.

-
- 		- required -
private_jwk - Jwk | dict[str, Any] - -
-

the private JWK to use to sign generated Client Assertions.

-
- 		- required -
alg - str - -
-

the alg to use to sign generated Client Assertions.

-
- 		- RS256 -
lifetime - int - -
-

the lifetime to use for generated Client Assertions.

-
- 		- 60 -
jti_gen - Callable[[], Any] - -
-

a function to generate JWT Token Ids (jti) for generated Client Assertions.

-
- 		- lambda: uuid4() -
aud - str | None - -
-

the audience value to use. If None (default), the endpoint URL will be used.k

-
- 		- None -
+
-
- Source code in requests_oauth2client/client_authentication.py - 
260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
-293
-294
-295
-296
-297
-298
-299
-300
-301
-302
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320
-321
-322
-323
-324
-325
-326
-327
-328
-329
-330
class PrivateKeyJwt(ClientAssertionAuthenticationMethod):
-    """Implement `private_key_jwt` client authentication method.
-
-    With this method, the client generates and sends a client_assertion, that is asymmetrically
-    signed with a private key, on each direct request to the Authorization Server.
-
-    Args:
-        client_id: the `client_id` to use.
-        private_jwk: the private JWK to use to sign generated Client Assertions.
-        alg: the alg to use to sign generated Client Assertions.
-        lifetime: the lifetime to use for generated Client Assertions.
-        jti_gen: a function to generate JWT Token Ids (`jti`) for generated Client Assertions.
-        aud: the audience value to use. If `None` (default), the endpoint URL will be used.k
-
-    """
-
-    def __init__(
-        self,
-        client_id: str,
-        private_jwk: Jwk | dict[str, Any],
-        alg: str = SignatureAlgs.RS256,
-        lifetime: int = 60,
-        jti_gen: Callable[[], Any] = lambda: uuid4(),
-        aud: str | None = None,
-    ) -> None:
-        if not isinstance(private_jwk, Jwk):
-            private_jwk = Jwk(private_jwk)
-
-        if not private_jwk.is_private or private_jwk.is_symmetric:
-            msg = "Private Key JWT client authentication method uses asymmetric signing thus requires a private key."
-            raise ValueError(msg)
-
-        alg = private_jwk.alg or alg
-        if not alg:
-            msg = "An asymmetric signing alg is required, either as part of the private JWK, or passed as parameter."
-            raise ValueError(msg)
-        kid = private_jwk.get("kid")
-        if not kid:
-            msg = "Asymmetric signing requires the private JWK to have a Key ID (kid)."
-            raise ValueError(msg)
-
-        super().__init__(client_id, alg, lifetime, jti_gen, aud)
-        self.private_jwk = private_jwk
-
-    def client_assertion(self, audience: str) -> str:
-        """Generate a Client Assertion, asymmetrically signed with `private_jwk` as key.
-
-        Args:
-            audience: the audience to use for the generated Client Assertion.
-
-        Returns:
-            a Client Assertion.
-
-        """
-        iat = int(datetime.now(tz=timezone.utc).timestamp())
-        exp = iat + self.lifetime
-        jti = str(self.jti_gen())
-
-        jwt = Jwt.sign(
-            claims={
-                "iss": self.client_id,
-                "sub": self.client_id,
-                "aud": audience,
-                "iat": iat,
-                "exp": exp,
-                "jti": jti,
-            },
-            key=self.private_jwk,
-            alg=self.alg,
-        )
-        return str(jwt)
-
-
+
- +
-
+
+

+ DeviceAuthorizationError +

+
+

+ Bases: EndpointError

+

Base class for Device Authorization Endpoint errors.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
122
+123
class DeviceAuthorizationError(EndpointError):
+    """Base class for Device Authorization Endpoint errors."""
+
+
-
- client_assertion(audience) +
-
-
- -

Generate a Client Assertion, asymmetrically signed with private_jwk as key.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
audience - str - -
-

the audience to use for the generated Client Assertion.

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

a Client Assertion.

-
-
- -
- Source code in requests_oauth2client/client_authentication.py - 
304
-305
-306
-307
-308
-309
-310
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320
-321
-322
-323
-324
-325
-326
-327
-328
-329
-330
def client_assertion(self, audience: str) -> str:
-    """Generate a Client Assertion, asymmetrically signed with `private_jwk` as key.
-
-    Args:
-        audience: the audience to use for the generated Client Assertion.
-
-    Returns:
-        a Client Assertion.
-
-    """
-    iat = int(datetime.now(tz=timezone.utc).timestamp())
-    exp = iat + self.lifetime
-    jti = str(self.jti_gen())
-
-    jwt = Jwt.sign(
-        claims={
-            "iss": self.client_id,
-            "sub": self.client_id,
-            "aud": audience,
-            "iat": iat,
-            "exp": exp,
-            "jti": jti,
-        },
-        key=self.private_jwk,
-        alg=self.alg,
-    )
-    return str(jwt)
-
-
-
-
-
+
@@ -57805,123 +68701,29 @@
- PublicApp - +

+ AuthorizationPending -

+ -
-

- Bases: BaseClientAuthenticationMethod

- -

Implement the none authentication method for public apps.

-

This scheme is used for Public Clients, which do not have any secret credentials. Those only -send their client_id to the Authorization Server.

+
+

+ Bases: TokenEndpointError

+

Raised when the Token Endpoint returns error = authorization_pending.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client_id - str - -
-

the client_id to use.

-
- 		- required -
+
+ Source code in requests_oauth2client/exceptions.py + 
126
+127
class AuthorizationPending(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = authorization_pending`."""
+
+
-
- Source code in requests_oauth2client/client_authentication.py - 
333
-334
-335
-336
-337
-338
-339
-340
-341
-342
-343
-344
-345
-346
-347
-348
-349
-350
-351
-352
-353
-354
-355
-356
-357
-358
-359
-360
-361
-362
-363
-364
-365
class PublicApp(BaseClientAuthenticationMethod):
-    """Implement the `none` authentication method for public apps.
-
-    This scheme is used for Public Clients, which do not have any secret credentials. Those only
-    send their client_id to the Authorization Server.
-
-    Args:
-        client_id: the client_id to use.
-
-    """
-
-    def __init__(self, client_id: str) -> None:
-        self.client_id = client_id
-
-    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
-        """Add the `client_id` field in the request body.
-
-        Args:
-            request: a [requests.PreparedRequest][].
-
-        Returns:
-            a [requests.PreparedRequest][] with the added `client_id` field.
-
-        """
-        request = super().__call__(request)
-        params = (
-            parse_qs(request.body, strict_parsing=True, keep_blank_values=True)  # type: ignore[type-var]
-            if request.body
-            else {}
-        )
-        params[b"client_id"] = [self.client_id.encode()]
-        request.prepare_body(params, files=None)
-        return request
-
-
-
@@ -57937,662 +68739,145 @@

-
+

+ SlowDown -

- client_auth_factory(auth, *, client_id=None, client_secret=None, private_key=None, default_auth_handler=ClientSecretPost) +

-

+
+

+ Bases: TokenEndpointError

-
- -

Initialize the appropriate Auth Handler based on the provided parameters.

-

This initializes a ClientAuthenticationMethod subclass based on the provided parameters.

+

Raised when the Token Endpoint returns error = slow_down.

+
+ Source code in requests_oauth2client/exceptions.py + 
130
+131
class SlowDown(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = slow_down`."""
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
auth - AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None - -
-

can be:

-
    -
  • a requests.auth.AuthBase instance (which will be used directly)
    • -
  • a tuple of (client_id, client_secret) which will be used to initialize an instance of - default_auth_handler,
    • -
  • a tuple of (client_id, jwk), used to initialize a PrivateKeyJwk (jwk being an - instance of jwskate.Jwk or a dict),
    • -
  • a client_id, as str,
    • -
  • or None, to pass client_id and other credentials as dedicated parameters, see - below.
    • -
-
- 		- required -
client_id - str | None - -
-

the Client ID to use for this client

-
- 		- None -
client_secret - str | None - -
-

the Client Secret to use for this client, if any (for clients using -an authentication method based on a secret)

-
- 		- None -
private_key - Jwk | dict[str, Any] | None - -
-

the private key to use for private_key_jwt authentication method

-
- 		- None -
default_auth_handler - type[ClientSecretPost] | type[ClientSecretBasic] | type[ClientSecretJwt] - -
-

if a client_id and client_secret are provided, initialize an -instance of this class with those 2 parameters. -You can choose between ClientSecretBasic, ClientSecretPost, or ClientSecretJwt.

-
- 		- ClientSecretPost -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- AuthBase - -
-

an Auth Handler that will manage client authentication to the AS Token Endpoint or other

-
-
- AuthBase - -
-

backend endpoints.

-
-
- -
- Source code in requests_oauth2client/client_authentication.py - 
368
-369
-370
-371
-372
-373
-374
-375
-376
-377
-378
-379
-380
-381
-382
-383
-384
-385
-386
-387
-388
-389
-390
-391
-392
-393
-394
-395
-396
-397
-398
-399
-400
-401
-402
-403
-404
-405
-406
-407
-408
-409
-410
-411
-412
-413
-414
-415
-416
-417
-418
-419
-420
-421
-422
-423
-424
-425
-426
-427
-428
-429
-430
-431
-432
-433
-434
def client_auth_factory(
-    auth: requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None,
-    *,
-    client_id: str | None = None,
-    client_secret: str | None = None,
-    private_key: Jwk | dict[str, Any] | None = None,
-    default_auth_handler: type[ClientSecretPost] | type[ClientSecretBasic] | type[ClientSecretJwt] = ClientSecretPost,
-) -> requests.auth.AuthBase:
-    """Initialize the appropriate Auth Handler based on the provided parameters.
-
-    This initializes a `ClientAuthenticationMethod` subclass based on the provided parameters.
-
-    Args:
-        auth: can be:
-
-            - a `requests.auth.AuthBase` instance (which will be used directly)
-            - a tuple of (client_id, client_secret) which will be used to initialize an instance of
-              `default_auth_handler`,
-            - a tuple of (client_id, jwk), used to initialize a `PrivateKeyJwk` (`jwk` being an
-              instance of `jwskate.Jwk` or a `dict`),
-            - a `client_id`, as `str`,
-            - or `None`, to pass `client_id` and other credentials as dedicated parameters, see
-              below.
-        client_id: the Client ID to use for this client
-        client_secret: the Client Secret to use for this client, if any (for clients using
-            an authentication method based on a secret)
-        private_key: the private key to use for private_key_jwt authentication method
-        default_auth_handler: if a client_id and client_secret are provided, initialize an
-            instance of this class with those 2 parameters.
-            You can choose between `ClientSecretBasic`, `ClientSecretPost`, or `ClientSecretJwt`.
-
-    Returns:
-        an Auth Handler that will manage client authentication to the AS Token Endpoint or other
-        backend endpoints.
-
-    """
-    if auth is not None and (client_id is not None or client_secret is not None or private_key is not None):
-        msg = (
-            "Please use either `auth` parameter to provide an authentication method, or use"
-            " `client_id` and one of `client_secret` or `private_key`."
-        )
-        raise ValueError(msg)
-
-    if isinstance(auth, str):
-        client_id = auth
-    elif isinstance(auth, requests.auth.AuthBase):
-        return auth
-    elif isinstance(auth, tuple) and len(auth) == 2:  # noqa: PLR2004
-        client_id, credential = auth
-        if isinstance(credential, (Jwk, dict)):
-            private_key = credential
-        elif isinstance(credential, str):
-            client_secret = credential
-        else:
-            msg = "This credential type is not supported:"
-            raise TypeError(msg, type(credential), credential)
-
-    if client_id is None:
-        msg = "A client_id must be provided."
-        raise ValueError(msg)
-
-    if private_key is not None:
-        return PrivateKeyJwt(str(client_id), private_key)
-    elif client_secret is None:
-        return PublicApp(str(client_id))
-    else:
-        return default_auth_handler(str(client_id), str(client_secret))
-
-
-
-
+
-
-
-
-
-

- device_authorization -

-
- -

Implements the Device Authorization Flow as defined in RFC8628.

-

See RFC8628.

+
- +
-
+
+
+

+ ExpiredToken +

-
+
+

+ Bases: TokenEndpointError

+

Raised when the Token Endpoint returns error = expired_token.

-

- DeviceAuthorizationResponse +
+ Source code in requests_oauth2client/exceptions.py + 
134
+135
class ExpiredToken(TokenEndpointError):
+    """Raised when the Token Endpoint returns `error = expired_token`."""
+
+
-

+
-
- -

Represent a response returned by the device Authorization Endpoint.

-

All parameters are those returned by the AS as response to a Device Authorization Request.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
device_code - str - -
-

the device_code as returned by the AS.

-
- 		- required -
user_code - str - -
-

the device_code as returned by the AS.

-
- 		- required -
verification_uri - str - -
-

the device_code as returned by the AS.

-
- 		- required -
verification_uri_complete - str | None - -
-

the device_code as returned by the AS.

-
- 		- None -
expires_at - datetime | None - -
-

the expiration date for the device_code. -Also accepts an expires_in parameter, as a number of seconds in the future.

-
- 		- None -
interval - int | None - -
-

the pooling interval as returned by the AS.

-
- 		- None -
**kwargs - Any - -
-

additional parameters as returned by the AS.

-
- 		- {} -
-
- Source code in requests_oauth2client/device_authorization.py - 
20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
class DeviceAuthorizationResponse:
-    """Represent a response returned by the device Authorization Endpoint.
-
-    All parameters are those returned by the AS as response to a Device Authorization Request.
-
-    Args:
-        device_code: the `device_code` as returned by the AS.
-        user_code: the `device_code` as returned by the AS.
-        verification_uri: the `device_code` as returned by the AS.
-        verification_uri_complete: the `device_code` as returned by the AS.
-        expires_at: the expiration date for the device_code.
-            Also accepts an `expires_in` parameter, as a number of seconds in the future.
-        interval: the pooling `interval` as returned by the AS.
-        **kwargs: additional parameters as returned by the AS.
-
-    """
-
-    @accepts_expires_in
-    def __init__(
-        self,
-        device_code: str,
-        user_code: str,
-        verification_uri: str,
-        verification_uri_complete: str | None = None,
-        expires_at: datetime | None = None,
-        interval: int | None = None,
-        **kwargs: Any,
-    ):
-        self.device_code = device_code
-        self.user_code = user_code
-        self.verification_uri = verification_uri
-        self.verification_uri_complete = verification_uri_complete
-        self.expires_at = expires_at
-        self.interval = interval
-        self.other = kwargs
-
-    def is_expired(self, leeway: int = 0) -> bool | None:
-        """Check if the `device_code` within this response is expired.
-
-        Returns:
-            `True` if the device_code is expired, `False` if it is still valid, `None` if there is
-            no `expires_in` hint.
-
-        """
-        if self.expires_at:
-            return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
-        return None
-
-
- -
+
+
+
+
+

+ InvalidDeviceAuthorizationResponse -
+

-
- is_expired(leeway=0) +
+

+ Bases: OAuth2Error

+ + +

Raised when the Device Authorization Endpoint returns a non-standard error response.

+ +
+ Source code in requests_oauth2client/exceptions.py + 
138
+139
class InvalidDeviceAuthorizationResponse(OAuth2Error):
+    """Raised when the Device Authorization Endpoint returns a non-standard error response."""
+
+
+ + + +
-
-
- -

Check if the device_code within this response is expired.

-

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- bool | None - -
-

True if the device_code is expired, False if it is still valid, None if there is

-
-
- bool | None - -
-

no expires_in hint.

-
-
- -
- Source code in requests_oauth2client/device_authorization.py - 
56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
def is_expired(self, leeway: int = 0) -> bool | None:
-    """Check if the `device_code` within this response is expired.
-
-    Returns:
-        `True` if the device_code is expired, `False` if it is still valid, `None` if there is
-        no `expires_in` hint.
-
-    """
-    if self.expires_at:
-        return datetime.now(tz=timezone.utc) - timedelta(seconds=leeway) > self.expires_at
-    return None
-
-
-
-
-
+
@@ -58600,237 +68885,136 @@
- DeviceAuthorizationPoolingJob +

+ AuthorizationResponseError -

+ -
-

- Bases: TokenEndpointPoolingJob

+
+

+ Bases: Exception

- -

A Token Endpoint pooling job for the Device Authorization Flow.

-

This periodically checks if the user has finished with his authorization in a Device -Authorization flow.

+

Base class for error responses returned by the Authorization endpoint.

+

An AuthorizationResponseError contains the error message, description and uri that are +returned by the AS.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client - OAuth2Client - -
-

an OAuth2Client that will be used to pool the token endpoint.

-
- 		- required -
device_code - str | DeviceAuthorizationResponse - -
-

a device_code as str or a DeviceAuthorizationResponse.

-
- 		- required -
interval - int | None - -
-

The pooling interval to use. This overrides the one in auth_req_id if it is -a BackChannelAuthenticationResponse.

-
- 		- None -
slow_down_interval - int - -
-

Number of seconds to add to the pooling interval when the AS returns -a slow-down request.

-
- 		- 5 -
requests_kwargs - dict[str, Any] | None - -
-

Additional parameters for the underlying calls to requests.request.

-
- 		- None -
**token_kwargs - Any - -
-

Additional parameters for the token request.

-
- 		- {} -
-

auth=("client_id", "client_secret") ) pool_job = DeviceAuthorizationPoolingJob(client=client, -device_code="my_device_code")

-
1
token = None while token is None: token = pool_job() ```
-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
error + str + +
+

the error identifier as returned by the AS

+
+ 		+ required +
description + str | None + +
+

the error_description as returned by the AS

+
+ 		+ None +
uri + str | None + +
+

the error_uri as returned by the AS

+
+ 		+ None +
+ +
+ Source code in requests_oauth2client/exceptions.py + 
142
+143
+144
+145
+146
+147
+148
+149
+150
+151
+152
+153
+154
+155
+156
+157
+158
+159
+160
+161
+162
+163
+164
+165
+166
+167
class AuthorizationResponseError(Exception):
+    """Base class for error responses returned by the Authorization endpoint.
+
+    An `AuthorizationResponseError` contains the error message, description and uri that are
+    returned by the AS.
+
+    Args:
+        error: the `error` identifier as returned by the AS
+        description: the `error_description` as returned by the AS
+        uri: the `error_uri` as returned by the AS
+
+    """
+
+    def __init__(
+        self,
+        request: AuthorizationRequest,
+        response: str,
+        error: str,
+        description: str | None = None,
+        uri: str | None = None,
+    ) -> None:
+        self.error = error
+        self.description = description
+        self.uri = uri
+        self.request = request
+        self.response = response
+
+
-
- Source code in requests_oauth2client/device_authorization.py - 
 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
class DeviceAuthorizationPoolingJob(TokenEndpointPoolingJob):
-    """A Token Endpoint pooling job for the Device Authorization Flow.
-
-    This periodically checks if the user has finished with his authorization in a Device
-    Authorization flow.
-
-    Args:
-        client: an OAuth2Client that will be used to pool the token endpoint.
-        device_code: a `device_code` as `str` or a `DeviceAuthorizationResponse`.
-        interval: The pooling interval to use. This overrides the one in `auth_req_id` if it is
-            a `BackChannelAuthenticationResponse`.
-        slow_down_interval: Number of seconds to add to the pooling interval when the AS returns
-            a slow-down request.
-        requests_kwargs: Additional parameters for the underlying calls to [requests.request][].
-        **token_kwargs: Additional parameters for the token request.
-
-    Usage: ```python client = OAuth2Client( token_endpoint="https://my.as.local/token",
-    auth=("client_id", "client_secret") ) pool_job = DeviceAuthorizationPoolingJob(client=client,
-    device_code="my_device_code")
-
-        token = None while token is None: token = pool_job() ```
-
-    """
-
-    def __init__(
-        self,
-        client: OAuth2Client,
-        device_code: str | DeviceAuthorizationResponse,
-        interval: int | None = None,
-        slow_down_interval: int = 5,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ):
-        super().__init__(
-            client=client,
-            interval=interval,
-            slow_down_interval=slow_down_interval,
-            requests_kwargs=requests_kwargs,
-            **token_kwargs,
-        )
-        self.device_code = device_code
-
-    def token_request(self) -> BearerToken:
-        """Implement the Device Code token request.
-
-        This actually calls [OAuth2Client.device_code(device_code)] on `client`.
-
-        Returns:
-            a [BearerToken][requests_oauth2client.tokens.BearerToken]
-
-        """
-        return self.client.device_code(self.device_code, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
-
-
-
@@ -58843,693 +69027,240 @@

+

+ +
+
-
- token_request() +
-
-
- -

Implement the Device Code token request.

-

This actually calls [OAuth2Client.device_code(device_code)] on client.

+

+ InteractionRequired +

-

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/device_authorization.py - 
111
-112
-113
-114
-115
-116
-117
-118
-119
-120
def token_request(self) -> BearerToken:
-    """Implement the Device Code token request.
-
-    This actually calls [OAuth2Client.device_code(device_code)] on `client`.
-
-    Returns:
-        a [BearerToken][requests_oauth2client.tokens.BearerToken]
-
-    """
-    return self.client.device_code(self.device_code, requests_kwargs=self.requests_kwargs, **self.token_kwargs)
-
-
-
-
+
+

+ Bases: AuthorizationResponseError

+

Raised when the Authorization Endpoint returns error = interaction_required.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
170
+171
class InteractionRequired(AuthorizationResponseError):
+    """Raised when the Authorization Endpoint returns `error = interaction_required`."""
+
+
-
-
+
-
-
-
-
-

- discovery +

- +
+ +
+ +
-
- -

Implements Metadata discovery documents URLS.

-

This is as defined in RFC8615 and OpenID Connect -Discovery 1.0.

- -
+

+ LoginRequired +

+
+

+ Bases: InteractionRequired

+

Raised when the Authorization Endpoint returns error = login_required.

+
+ Source code in requests_oauth2client/exceptions.py + 
174
+175
class LoginRequired(InteractionRequired):
+    """Raised when the Authorization Endpoint returns `error = login_required`."""
+
+
-
+
-

- well_known_uri(origin, name, *, at_root=True) -

-
- -

Return the location of a well-known document on an origin url.

-

See RFC8615 and OIDC -Discovery.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
origin - str - -
-

origin to use to build the well-known uri.

-
- 		- required -
name - str - -
-

document name to use to build the well-known uri.

-
- 		- required -
at_root - bool - -
-

if True, assume the well-known document is at root level (as defined in RFC8615). -If False, assume the well-known location is per-directory, as defined in OpenID -Connect Discovery -1.0.

-
- 		- True -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- str - -
-

the well-know uri, relative to origin, where the well-known document named name should be

-
-
- str - -
-

found.

-
-
- -
- Source code in requests_oauth2client/discovery.py - 
11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
def well_known_uri(origin: str, name: str, *, at_root: bool = True) -> str:
-    """Return the location of a well-known document on an origin url.
-
-    See [RFC8615](https://datatracker.ietf.org/doc/html/rfc8615) and [OIDC
-    Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
-
-    Args:
-        origin: origin to use to build the well-known uri.
-        name: document name to use to build the well-known uri.
-        at_root: if `True`, assume the well-known document is at root level (as defined in [RFC8615](https://datatracker.ietf.org/doc/html/rfc8615)).
-            If `False`, assume the well-known location is per-directory, as defined in [OpenID
-            Connect Discovery
-            1.0](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
-
-    Returns:
-        the well-know uri, relative to origin, where the well-known document named `name` should be
-        found.
-
-    """
-    url = furl(origin)
-    if at_root:
-        url.path = Path(".well-known") / url.path / name
-    else:
-        url.path.add(Path(".well-known") / name)
-    return str(url)
-
-
-
-
+
-
+
+
+
-

- oidc_discovery_document_url(issuer) -

+

+ AccountSelectionRequired -
- -

Construct the OIDC discovery document url for a given issuer.

-

Given an issuer identifier, return the standardised URL where the OIDC discovery document can -be retrieved.

-

The returned URL is biuilt as specified in OpenID Connect Discovery -1.0.

+

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
issuer - str - -
-

an OIDC Authentication Server issuer

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- str - -
-

the standardised discovery document URL. Note that no attempt to fetch this document is

-
-
- str - -
-

made.

-
-
- -
- Source code in requests_oauth2client/discovery.py - 
38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
def oidc_discovery_document_url(issuer: str) -> str:
-    """Construct the OIDC discovery document url for a given `issuer`.
-
-    Given an `issuer` identifier, return the standardised URL where the OIDC discovery document can
-    be retrieved.
-
-    The returned URL is biuilt as specified in [OpenID Connect Discovery
-    1.0](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
-
-    Args:
-        issuer: an OIDC Authentication Server `issuer`
-
-    Returns:
-        the standardised discovery document URL. Note that no attempt to fetch this document is
-        made.
-
-    """
-    return well_known_uri(issuer, "openid-configuration", at_root=False)
-
-
-
+
+

+ Bases: InteractionRequired

-
+

Raised when the Authorization Endpoint returns error = account_selection_required.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
178
+179
class AccountSelectionRequired(InteractionRequired):
+    """Raised when the Authorization Endpoint returns `error = account_selection_required`."""
+
+
-

- oauth2_discovery_document_url(issuer) +
-

-
- -

Construct the standardised OAuth 2.0 discovery document url for a given issuer.

-

Based an issuer identifier, returns the standardised URL where the OAuth20 server metadata can -be retrieved.

-

The returned URL is built as specified in -RFC8414.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
issuer - str - -
-

an OAuth20 Authentication Server issuer

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - - - - - - - -
TypeDescription
- str - -
-

the standardised discovery document URL. Note that no attempt to fetch this document is

-
-
- str - -
-

made.

-
-
- -
- Source code in requests_oauth2client/discovery.py - 
58
-59
-60
-61
-62
-63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
def oauth2_discovery_document_url(issuer: str) -> str:
-    """Construct the standardised OAuth 2.0 discovery document url for a given `issuer`.
-
-    Based an `issuer` identifier, returns the standardised URL where the OAuth20 server metadata can
-    be retrieved.
-
-    The returned URL is built as specified in
-    [RFC8414](https://datatracker.ietf.org/doc/html/rfc8414).
-
-    Args:
-        issuer: an OAuth20 Authentication Server `issuer`
-
-    Returns:
-        the standardised discovery document URL. Note that no attempt to fetch this document is
-        made.
-
-    """
-    return well_known_uri(issuer, "oauth-authorization-server", at_root=True)
-
-
-
-
-
+
+
-
+
-

- exceptions +

+ SessionSelectionRequired -

+ -
- -

This module contains all exception classes from requests_oauth2client.

- +
+

+ Bases: InteractionRequired

-
+

Raised when the Authorization Endpoint returns error = session_selection_required.

+
+ Source code in requests_oauth2client/exceptions.py + 
182
+183
class SessionSelectionRequired(InteractionRequired):
+    """Raised when the Authorization Endpoint returns `error = session_selection_required`."""
+
+
+
-
-

- OAuth2Error -

-
-

- Bases: Exception

- -

Base class for Exceptions raised when a backend endpoint returns an error.

+
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the HTTP response containing the error

-
- 		- required -
+
-
- Source code in requests_oauth2client/exceptions.py - 
13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
class OAuth2Error(Exception):
-    """Base class for Exceptions raised when a backend endpoint returns an error.
-
-    Args:
-        response: the HTTP response containing the error
-
-    """
-
-    def __init__(self, response: requests.Response):
-        self.response = response
-
-    @property
-    def request(self) -> requests.PreparedRequest:
-        """The request leading to the error."""
-        return self.response.request
-
-
- -
+

+ ConsentRequired +

+
+

+ Bases: InteractionRequired

+

Raised when the Authorization Endpoint returns error = consent_required.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
186
+187
class ConsentRequired(InteractionRequired):
+    """Raised when the Authorization Endpoint returns `error = consent_required`."""
+
+
-
- request: requests.PreparedRequest - - - property - +
+ -
-
- -

The request leading to the error.

-
-
-
+
@@ -59537,154 +69268,43 @@
- EndpointError +

+ InvalidAuthResponse -

+ -
-

- Bases: OAuth2Error

- - -

Base class for exceptions raised from backend endpoint errors.

-

This contains the error message, description and uri that are returned by the AS in the OAuth -2.0 standardised way.

- - - -

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
response - Response - -
-

the raw requests.PreparedResponse containing the error.

-
- 		- required -
error - str - -
-

the error identifier as returned by the AS.

-
- 		- required -
description - str | None - -
-

the error_description as returned by the AS.

-
- 		- None -
uri - str | None - -
-

the error_uri as returned by the AS.

-
- 		- None -
+
+

+ Bases: ValueError

-
- Source code in requests_oauth2client/exceptions.py - 
30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
class EndpointError(OAuth2Error):
-    """Base class for exceptions raised from backend endpoint errors.
-
-    This contains the error message, description and uri that are returned by the AS in the OAuth
-    2.0 standardised way.
-
-    Args:
-        response: the raw requests.PreparedResponse containing the error.
-        error: the `error` identifier as returned by the AS.
-        description: the `error_description` as returned by the AS.
-        uri: the `error_uri` as returned by the AS.
-
-    """
-
-    def __init__(
-        self,
-        response: requests.Response,
-        error: str,
-        description: str | None = None,
-        uri: str | None = None,
-    ):
-        super().__init__(response)
-        self.error = error
-        self.description = description
-        self.uri = uri
-
-
- +

Raised when the Authorization Endpoint returns an invalid response.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
190
+191
+192
+193
+194
+195
+196
class InvalidAuthResponse(ValueError):
+    """Raised when the Authorization Endpoint returns an invalid response."""
+
+    def __init__(self, message: str, request: AuthorizationRequest, response: str) -> None:
+        super().__init__(f"The Authorization Response is invalid: {message}")
+        self.request = request
+        self.response = response
+
+
+
+ + @@ -59693,10 +69313,10 @@

-

+
@@ -59704,61 +69324,63 @@

-

- InvalidTokenResponse +

+ MissingAuthCode -

+ -
-

- Bases: OAuth2Error

+
+

+ Bases: InvalidAuthResponse

- -

Raised when the Token Endpoint returns a non-standard response.

-
- Source code in requests_oauth2client/exceptions.py - 
57
-58
class InvalidTokenResponse(OAuth2Error):
-    """Raised when the Token Endpoint returns a non-standard response."""
-
-
+

Raised when the Authorization Endpoint does not return the mandatory code.

+

This happens when the Authorization Endpoint does not return an error, but does not return an +authorization code either.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
199
+200
+201
+202
+203
+204
+205
+206
+207
+208
class MissingAuthCode(InvalidAuthResponse):
+    """Raised when the Authorization Endpoint does not return the mandatory `code`.
+
+    This happens when the Authorization Endpoint does not return an error, but does not return an
+    authorization `code` either.
+
+    """
+
+    def __init__(self, request: AuthorizationRequest, response: str) -> None:
+        super().__init__("missing `code` query parameter in response", request, response)
+
+
-
-
+
+ -

- ExpiredAccessToken -

-
-

- Bases: RuntimeError

- -

Raised when an expired access token is used.

-
- Source code in requests_oauth2client/exceptions.py - 
61
-62
class ExpiredAccessToken(RuntimeError):
-    """Raised when an expired access token is used."""
-
-
+
@@ -59766,61 +69388,69 @@

- UnknownTokenEndpointError +

+ MissingIssuer -

+ -
-

- Bases: EndpointError

+
+

+ Bases: InvalidAuthResponse

- -

Raised when an otherwise unknown error is returned by the token endpoint.

-
- Source code in requests_oauth2client/exceptions.py - 
65
-66
class UnknownTokenEndpointError(EndpointError):
-    """Raised when an otherwise unknown error is returned by the token endpoint."""
-
-
+

Raised when the Authorization Endpoint does not return an iss parameter as expected.

+

The Authorization Server advertises its support with a flag +authorization_response_iss_parameter_supported in its discovery document. If it is set to +true, it must include an iss parameter in its authorization responses, containing its issuer +identifier.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
211
+212
+213
+214
+215
+216
+217
+218
+219
+220
+221
+222
class MissingIssuer(InvalidAuthResponse):
+    """Raised when the Authorization Endpoint does not return an `iss` parameter as expected.
+
+    The Authorization Server advertises its support with a flag
+    `authorization_response_iss_parameter_supported` in its discovery document. If it is set to
+    `true`, it must include an `iss` parameter in its authorization responses, containing its issuer
+    identifier.
+
+    """
+
+    def __init__(self, request: AuthorizationRequest, response: str) -> None:
+        super().__init__("missing `iss` query parameter in response", request, response)
+
+
-
-
+
+ -

- ServerError -

-
-

- Bases: EndpointError

- -

Raised when the token endpoint returns error = server_error.

-
- Source code in requests_oauth2client/exceptions.py - 
69
-70
class ServerError(EndpointError):
-    """Raised when the token endpoint returns `error = server_error`."""
-
-
+
@@ -59828,61 +69458,67 @@

-

- TokenEndpointError +

+ MismatchingState -

+ -
-

- Bases: EndpointError

+
+

+ Bases: InvalidAuthResponse

- -

Base class for errors that are specific to the token endpoint.

-
- Source code in requests_oauth2client/exceptions.py - 
73
-74
class TokenEndpointError(EndpointError):
-    """Base class for errors that are specific to the token endpoint."""
-
-
+

Raised on mismatching state value.

+

This happens when the Authorization Endpoints returns a 'state' parameter that doesn't match the +value passed in the Authorization Request.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
225
+226
+227
+228
+229
+230
+231
+232
+233
+234
+235
+236
class MismatchingState(InvalidAuthResponse):
+    """Raised on mismatching `state` value.
+
+    This happens when the Authorization Endpoints returns a 'state' parameter that doesn't match the
+    value passed in the Authorization Request.
+
+    """
+
+    def __init__(self, received: str, expected: str, request: AuthorizationRequest, response: str) -> None:
+        super().__init__(f"mismatching `state` (received '{received}', expected '{expected}')", request, response)
+        self.received = received
+        self.expected = expected
+
+
-
-
+
+ -

- InvalidRequest -

-
-

- Bases: TokenEndpointError

- -

Raised when the Token Endpoint returns error = invalid_request.

-
- Source code in requests_oauth2client/exceptions.py - 
77
-78
class InvalidRequest(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = invalid_request`."""
-
-
+
@@ -59890,61 +69526,67 @@

- InvalidClient +

+ MismatchingIssuer -

+ -
-

- Bases: TokenEndpointError

+
+

+ Bases: InvalidAuthResponse

- -

Raised when the Token Endpoint returns error = invalid_client.

-
- Source code in requests_oauth2client/exceptions.py - 
81
-82
class InvalidClient(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = invalid_client`."""
-
-
+

Raised on mismatching iss value.

+

This happens when the Authorization Endpoints returns an 'iss' that doesn't match the expected +value.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
239
+240
+241
+242
+243
+244
+245
+246
+247
+248
+249
+250
class MismatchingIssuer(InvalidAuthResponse):
+    """Raised on mismatching `iss` value.
+
+    This happens when the Authorization Endpoints returns an 'iss' that doesn't match the expected
+    value.
+
+    """
+
+    def __init__(self, received: str, expected: str, request: AuthorizationRequest, response: str) -> None:
+        super().__init__(f"mismatching `iss` (received '{received}', expected '{expected}')", request, response)
+        self.received = received
+        self.expected = expected
+
+
-
-
+
+ -

- InvalidScope -

-
-

- Bases: TokenEndpointError

- -

Raised when the Token Endpoint returns error = invalid_scope.

-
- Source code in requests_oauth2client/exceptions.py - 
85
-86
class InvalidScope(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = invalid_scope`."""
-
-
+
@@ -59952,61 +69594,45 @@

-

- InvalidTarget +

+ BackChannelAuthenticationError -

+ -
-

- Bases: TokenEndpointError

+
+

+ Bases: EndpointError

- -

Raised when the Token Endpoint returns error = invalid_target.

-
- Source code in requests_oauth2client/exceptions.py - 
89
-90
class InvalidTarget(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = invalid_target`."""
-
-
+

Base class for errors returned by the BackChannel Authentication endpoint.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
253
+254
class BackChannelAuthenticationError(EndpointError):
+    """Base class for errors returned by the BackChannel Authentication endpoint."""
+
+
-
-
+
+ -

- InvalidGrant -

-
-

- Bases: TokenEndpointError

- -

Raised when the Token Endpoint returns error = invalid_grant.

-
- Source code in requests_oauth2client/exceptions.py - 
93
-94
class InvalidGrant(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = invalid_grant`."""
-
-
+
@@ -60014,371 +69640,449 @@

-

- AccessDenied +

+ InvalidBackChannelAuthenticationResponse -

+ -
-

- Bases: EndpointError

+
+

+ Bases: OAuth2Error

- -

Raised when the Authorization Server returns error = access_denied.

-
- Source code in requests_oauth2client/exceptions.py - 
97
-98
class AccessDenied(EndpointError):
-    """Raised when the Authorization Server returns `error = access_denied`."""
-
-
+

Raised when the BackChannel Authentication endpoint returns a non-standard response.

-
+
+ Source code in requests_oauth2client/exceptions.py + 
257
+258
class InvalidBackChannelAuthenticationResponse(OAuth2Error):
+    """Raised when the BackChannel Authentication endpoint returns a non-standard response."""
+
+
-
-
+
+ -

- UnauthorizedClient -

-
-

- Bases: EndpointError

- -

Raised when the Authorization Server returns error = unauthorized_client.

-
- Source code in requests_oauth2client/exceptions.py - 
101
-102
class UnauthorizedClient(EndpointError):
-    """Raised when the Authorization Server returns `error = unauthorized_client`."""
-
-
+
+ +
+ +
+ + + +

+ InvalidPushedAuthorizationResponse + + +

-
-
+
+

+ Bases: OAuth2Error

+

Raised when the Pushed Authorization Endpoint returns an error.

-

- RevocationError +
+ Source code in requests_oauth2client/exceptions.py + 
261
+262
class InvalidPushedAuthorizationResponse(OAuth2Error):
+    """Raised when the Pushed Authorization Endpoint returns an error."""
+
+
-

+
-
-

- Bases: EndpointError

- -

Base class for Revocation Endpoint errors.

-
- Source code in requests_oauth2client/exceptions.py - 
105
-106
class RevocationError(EndpointError):
-    """Base class for Revocation Endpoint errors."""
-
-
-
-
-
-

- UnsupportedTokenType +

- +
+
-
-

- Bases: RevocationError

- -

Raised when the Revocation endpoint returns error = unsupported_token_type.

-
- Source code in requests_oauth2client/exceptions.py - 
109
-110
class UnsupportedTokenType(RevocationError):
-    """Raised when the Revocation endpoint returns `error = unsupported_token_type`."""
-
-
+
-
+
-

- IntrospectionError +

+ flask -

+ +
-
-

- Bases: EndpointError

+

This module contains helper classes for the Flask Framework.

+

See Flask framework.

- -

Base class for Introspection Endpoint errors.

-
- Source code in requests_oauth2client/exceptions.py - 
113
-114
class IntrospectionError(EndpointError):
-    """Base class for Introspection Endpoint errors."""
-
-
-
+
-
-
-

- UnknownIntrospectionError -

+
-
-

- Bases: OAuth2Error

- -

Raised when the Introspection Endpoint returns a non-standard error.

+

+ FlaskOAuth2ClientCredentialsAuth -
- Source code in requests_oauth2client/exceptions.py - 
117
-118
class UnknownIntrospectionError(OAuth2Error):
-    """Raised when the Introspection Endpoint returns a non-standard error."""
-
-
-

+ -
+
+

+ Bases: FlaskSessionAuthMixin, OAuth2ClientCredentialsAuth

-
+

A requests Auth handler for CC grant that stores its token in Flask session.

+

It will automatically get Access Tokens from an OAuth 2.x AS with the Client Credentials grant +(and can get a new one once the first one is expired), and stores the retrieved token, +serialized in Flask session, so that each user has a different access token.

+
+ Source code in requests_oauth2client/flask/auth.py + 
67
+68
+69
+70
+71
+72
+73
+74
class FlaskOAuth2ClientCredentialsAuth(FlaskSessionAuthMixin, OAuth2ClientCredentialsAuth):  # type: ignore[misc]
+    """A `requests` Auth handler for CC grant that stores its token in Flask session.
+
+    It will automatically get Access Tokens from an OAuth 2.x AS with the Client Credentials grant
+    (and can get a new one once the first one is expired), and stores the retrieved token,
+    serialized in Flask `session`, so that each user has a different access token.
+
+    """
+
+
-

- DeviceAuthorizationError -

+
-
-

- Bases: EndpointError

- -

Base class for Device Authorization Endpoint errors.

-
- Source code in requests_oauth2client/exceptions.py - 
121
-122
class DeviceAuthorizationError(EndpointError):
-    """Base class for Device Authorization Endpoint errors."""
-
-
-
-
-
-

- AuthorizationPending +

+
- +
-
-

- Bases: TokenEndpointError

- -

Raised when the Token Endpoint returns error = authorization_pending.

+
-
- Source code in requests_oauth2client/exceptions.py - 
125
-126
class AuthorizationPending(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = authorization_pending`."""
-
-
-
+

+ auth -

-
+ +
+

Helper classes for the Flask framework.

-

- SlowDown -

+
-
-

- Bases: TokenEndpointError

- -

Raised when the Token Endpoint returns error = slow_down.

-
- Source code in requests_oauth2client/exceptions.py - 
129
-130
class SlowDown(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = slow_down`."""
-
-
-
-
-

- ExpiredToken +

+ FlaskSessionAuthMixin -
+ -
-

- Bases: TokenEndpointError

+
- -

Raised when the Token Endpoint returns error = expired_token.

-
- Source code in requests_oauth2client/exceptions.py - 
133
-134
class ExpiredToken(TokenEndpointError):
-    """Raised when the Token Endpoint returns `error = expired_token`."""
-
-
+

A Mixin for auth handlers to store their tokens in Flask session.

+

Storing tokens in Flask session does ensure that each user of a Flask application has a +different access token, and that tokens used for backend API access will be persisted between +multiple requests to the front-end Flask app.

-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
session_key + str + +
+

the key that will be used to store the access token in session.

+
+ 		+ required +
serializer + BearerTokenSerializer | None + +
+

the serializer that will be used to store the access token in session.

+
+ 		+ None +
+ +
+ Source code in requests_oauth2client/flask/auth.py + 
13
+14
+15
+16
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
class FlaskSessionAuthMixin:
+    """A Mixin for auth handlers to store their tokens in Flask session.
+
+    Storing tokens in Flask session does ensure that each user of a Flask application has a
+    different access token, and that tokens used for backend API access will be persisted between
+    multiple requests to the front-end Flask app.
+
+    Args:
+        session_key: the key that will be used to store the access token in session.
+        serializer: the serializer that will be used to store the access token in session.
+
+    """
+
+    def __init__(
+        self,
+        session_key: str,
+        serializer: BearerTokenSerializer | None = None,
+        *args: Any,
+        **token_kwargs: Any,
+    ) -> None:
+        super().__init__(*args, **token_kwargs)
+        self.serializer = serializer or BearerTokenSerializer()
+        self.session_key = session_key
+
+    @property
+    def token(self) -> BearerToken | None:
+        """Return the Access Token stored in session.
+
+        Returns:
+            The current `BearerToken` for this session, if any.
+
+        """
+        serialized_token = session.get(self.session_key)
+        if serialized_token is None:
+            return None
+        return self.serializer.loads(serialized_token)
+
+    @token.setter
+    def token(self, token: BearerToken | str | None) -> None:
+        """Store an Access Token in session.
+
+        Args:
+            token: the token to store
+
+        """
+        if isinstance(token, str):
+            token = BearerToken(token)  # pragma: no cover
+        if token:
+            serialized_token = self.serializer.dumps(token)
+            session[self.session_key] = serialized_token
+        elif session and self.session_key in session:
+            session.pop(self.session_key, None)
+
+
-
-
+
-

- InvalidDeviceAuthorizationResponse -

-
-

- Bases: OAuth2Error

- -

Raised when the Device Authorization Endpoint returns a non-standard error response.

+
-
- Source code in requests_oauth2client/exceptions.py - 
137
-138
class InvalidDeviceAuthorizationResponse(OAuth2Error):
-    """Raised when the Device Authorization Endpoint returns a non-standard error response."""
-
-
-
+
+ token: BearerToken | None -
+ + property + writable + -
+ +
-

- InvalidIdToken +

Return the Access Token stored in session.

-

+

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken | None + +
+

The current BearerToken for this session, if any.

+
+
+
+ +
-
-

- Bases: InvalidJwt

- -

Raised when trying to validate an invalid ID Token value.

-
- Source code in requests_oauth2client/exceptions.py - 
141
-142
class InvalidIdToken(InvalidJwt):
-    """Raised when trying to validate an invalid ID Token value."""
-
-
+
@@ -60386,119 +70090,44 @@

- AuthorizationResponseError - +

+ FlaskOAuth2ClientCredentialsAuth -
+ -
-

- Bases: Exception

- -

Base class for error responses returned by the Authorization endpoint.

-

An AuthorizationResponseError contains the error message, description and uri that are -returned by the AS.

+
+

+ Bases: FlaskSessionAuthMixin, OAuth2ClientCredentialsAuth

+

A requests Auth handler for CC grant that stores its token in Flask session.

+

It will automatically get Access Tokens from an OAuth 2.x AS with the Client Credentials grant +(and can get a new one once the first one is expired), and stores the retrieved token, +serialized in Flask session, so that each user has a different access token.

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
error - str - -
-

the error identifier as returned by the AS

-
- 		- required -
description - str | None - -
-

the error_description as returned by the AS

-
- 		- None -
uri - str | None - -
-

the error_uri as returned by the AS

-
- 		- None -
+
+ Source code in requests_oauth2client/flask/auth.py + 
67
+68
+69
+70
+71
+72
+73
+74
class FlaskOAuth2ClientCredentialsAuth(FlaskSessionAuthMixin, OAuth2ClientCredentialsAuth):  # type: ignore[misc]
+    """A `requests` Auth handler for CC grant that stores its token in Flask session.
+
+    It will automatically get Access Tokens from an OAuth 2.x AS with the Client Credentials grant
+    (and can get a new one once the first one is expired), and stores the retrieved token,
+    serialized in Flask `session`, so that each user has a different access token.
+
+    """
+
+
-
- Source code in requests_oauth2client/exceptions.py - 
145
-146
-147
-148
-149
-150
-151
-152
-153
-154
-155
-156
-157
-158
-159
-160
-161
class AuthorizationResponseError(Exception):
-    """Base class for error responses returned by the Authorization endpoint.
-
-    An `AuthorizationResponseError` contains the error message, description and uri that are
-    returned by the AS.
-
-    Args:
-        error: the `error` identifier as returned by the AS
-        description: the `error_description` as returned by the AS
-        uri: the `error_uri` as returned by the AS
-
-    """
-
-    def __init__(self, error: str, description: str | None = None, uri: str | None = None):
-        self.error = error
-        self.description = description
-        self.uri = uri
-
-
-
@@ -60514,458 +70143,516 @@

- -

- InteractionRequired - - -

+
-
-

- Bases: AuthorizationResponseError

+
- -

Raised when the Authorization Endpoint returns error = interaction_required.

+
-
- Source code in requests_oauth2client/exceptions.py - 
164
-165
class InteractionRequired(AuthorizationResponseError):
-    """Raised when the Authorization Endpoint returns `error = interaction_required`."""
-
-
+
-
- +
-

- LoginRequired +

+ pooling -

+ -
-

- Bases: InteractionRequired

+
- -

Raised when the Authorization Endpoint returns error = login_required.

+

Contains base classes for pooling jobs.

-
- Source code in requests_oauth2client/exceptions.py - 
168
-169
class LoginRequired(InteractionRequired):
-    """Raised when the Authorization Endpoint returns `error = login_required`."""
-
-
-
+
-
-
-

- AccountSelectionRequired -

+
-
-

- Bases: InteractionRequired

- -

Raised when the Authorization Endpoint returns error = account_selection_required.

-
- Source code in requests_oauth2client/exceptions.py - 
172
-173
class AccountSelectionRequired(InteractionRequired):
-    """Raised when the Authorization Endpoint returns `error = account_selection_required`."""
-
-
+

+ BaseTokenEndpointPoolingJob -

+ -
-
+
+

Base class for Token Endpoint pooling jobs.

+

This is used for decoupled flows like CIBA or Device Authorization.

+

This class must be subclassed to implement actual BackChannel flows. This needs an +OAuth2Client that will be used to pool the token +endpoint. The initial pooling interval is configurable.

-

- SessionSelectionRequired +
+ Source code in requests_oauth2client/pooling.py + 
17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
+69
+70
+71
+72
+73
+74
+75
+76
+77
+78
+79
+80
+81
+82
+83
+84
+85
+86
+87
+88
+89
+90
+91
+92
+93
+94
+95
+96
@define
+class BaseTokenEndpointPoolingJob:
+    """Base class for Token Endpoint pooling jobs.
+
+    This is used for decoupled flows like CIBA or Device Authorization.
+
+    This class must be subclassed to implement actual BackChannel flows. This needs an
+    [OAuth2Client][requests_oauth2client.client.OAuth2Client] that will be used to pool the token
+    endpoint. The initial pooling `interval` is configurable.
+
+    """
+
+    client: OAuth2Client
+    requests_kwargs: dict[str, Any]
+    token_kwargs: dict[str, Any]
+    interval: int
+    slow_down_interval: int
+
+    def __call__(self) -> BearerToken | None:
+        """Wrap the actual Token Endpoint call with a pooling interval.
+
+        Everytime this method is called, it will wait for the entire duration of the pooling
+        interval before calling
+        [token_request()][requests_oauth2client.pooling.TokenEndpointPoolingJob.token_request]. So
+        you can call it immediately after initiating the BackChannel flow, and it will wait before
+        initiating the first call.
+
+        This implements the logic to handle
+        [AuthorizationPending][requests_oauth2client.exceptions.AuthorizationPending] or
+        [SlowDown][requests_oauth2client.exceptions.SlowDown] requests by the AS.
+
+        Returns:
+            a `BearerToken` if the AS returns one, or `None` if the Authorization is still pending.
+
+        """
+        self.sleep()
+        try:
+            return self.token_request()
+        except SlowDown:
+            self.slow_down()
+        except AuthorizationPending:
+            self.authorization_pending()
+        return None
+
+    def sleep(self) -> None:
+        """Implement the wait between two requests of the token endpoint.
+
+        By default, relies on time.sleep().
+
+        """
+        time.sleep(self.interval)
+
+    def slow_down(self) -> None:
+        """Implement the behavior when receiving a 'slow_down' response from the AS.
+
+        By default, it increases the pooling interval by the slow down interval.
+
+        """
+        self.interval += self.slow_down_interval
+
+    def authorization_pending(self) -> None:
+        """Implement the behavior when receiving an 'authorization_pending' response from the AS.
+
+        By default, it does nothing.
+
+        """
+
+    def token_request(self) -> BearerToken:
+        """Abstract method for the token endpoint call.
+
+        Subclasses must implement this. This method must raise
+        [AuthorizationPending][requests_oauth2client.exceptions.AuthorizationPending] to retry after
+        the pooling interval, or [SlowDown][requests_oauth2client.exceptions.SlowDown] to increase
+        the pooling interval by `slow_down_interval` seconds.
+
+        Returns:
+            a [BearerToken][requests_oauth2client.tokens.BearerToken]
+
+        """
+        raise NotImplementedError
+
+
-

+
-
-

- Bases: InteractionRequired

- -

Raised when the Authorization Endpoint returns error = session_selection_required.

-
- Source code in requests_oauth2client/exceptions.py - 
176
-177
class SessionSelectionRequired(InteractionRequired):
-    """Raised when the Authorization Endpoint returns `error = session_selection_required`."""
-
-
-
-
-
+
-

- ConsentRequired +

+ sleep() -
+ -
-

- Bases: InteractionRequired

+
- -

Raised when the Authorization Endpoint returns error = consent_required.

+

Implement the wait between two requests of the token endpoint.

+

By default, relies on time.sleep().

- Source code in requests_oauth2client/exceptions.py - 
180
-181
class ConsentRequired(InteractionRequired):
-    """Raised when the Authorization Endpoint returns `error = consent_required`."""
-
+ Source code in requests_oauth2client/pooling.py + 
61
+62
+63
+64
+65
+66
+67
def sleep(self) -> None:
+    """Implement the wait between two requests of the token endpoint.
+
+    By default, relies on time.sleep().
+
+    """
+    time.sleep(self.interval)
+
- -
- +
-
- - +
-

- InvalidAuthResponse +

+ slow_down() -
+ -
-

- Bases: Exception

+
- -

Raised when the Authorization Endpoint returns an invalid response.

+

Implement the behavior when receiving a 'slow_down' response from the AS.

+

By default, it increases the pooling interval by the slow down interval.

- Source code in requests_oauth2client/exceptions.py - 
184
-185
class InvalidAuthResponse(Exception):
-    """Raised when the Authorization Endpoint returns an invalid response."""
-
+ Source code in requests_oauth2client/pooling.py + 
69
+70
+71
+72
+73
+74
+75
def slow_down(self) -> None:
+    """Implement the behavior when receiving a 'slow_down' response from the AS.
+
+    By default, it increases the pooling interval by the slow down interval.
+
+    """
+    self.interval += self.slow_down_interval
+
- -
- +
-
- - +
-

- MissingAuthCode +

+ authorization_pending() -
+ -
-

- Bases: InvalidAuthResponse

+
- -

Raised when the Authorization Endpoint does not return the mandatory code.

-

This happens when the Authorization Endpoint does not return an error, but does not return an -authorization code either.

+

Implement the behavior when receiving an 'authorization_pending' response from the AS.

+

By default, it does nothing.

- Source code in requests_oauth2client/exceptions.py - 
188
-189
-190
-191
-192
-193
-194
class MissingAuthCode(InvalidAuthResponse):
-    """Raised when the Authorization Endpoint does not return the mandatory `code`.
-
-    This happens when the Authorization Endpoint does not return an error, but does not return an
-    authorization `code` either.
-
-    """
-
+ Source code in requests_oauth2client/pooling.py + 
77
+78
+79
+80
+81
+82
def authorization_pending(self) -> None:
+    """Implement the behavior when receiving an 'authorization_pending' response from the AS.
+
+    By default, it does nothing.
+
+    """
+
- -
- +
-
+
+
+ token_request() -

- MissingIssuer +

- +
+

Abstract method for the token endpoint call.

+

Subclasses must implement this. This method must raise +AuthorizationPending to retry after +the pooling interval, or SlowDown to increase +the pooling interval by slow_down_interval seconds.

-
-

- Bases: InvalidAuthResponse

- -

Raised when the Authorization Endpoint does not return an iss parameter as expected.

-

The Authorization Server advertises its support with a flag -authorization_response_iss_parameter_supported in its discovery document. If it is set to -true, it must include an iss parameter in its authorization responses, containing its issuer -identifier.

+

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
- Source code in requests_oauth2client/exceptions.py - 
197
-198
-199
-200
-201
-202
-203
-204
-205
class MissingIssuer(InvalidAuthResponse):
-    """Raised when the Authorization Endpoint does not return an `iss` parameter as expected.
-
-    The Authorization Server advertises its support with a flag
-    `authorization_response_iss_parameter_supported` in its discovery document. If it is set to
-    `true`, it must include an `iss` parameter in its authorization responses, containing its issuer
-    identifier.
-
-    """
-
+ Source code in requests_oauth2client/pooling.py + 
84
+85
+86
+87
+88
+89
+90
+91
+92
+93
+94
+95
+96
def token_request(self) -> BearerToken:
+    """Abstract method for the token endpoint call.
+
+    Subclasses must implement this. This method must raise
+    [AuthorizationPending][requests_oauth2client.exceptions.AuthorizationPending] to retry after
+    the pooling interval, or [SlowDown][requests_oauth2client.exceptions.SlowDown] to increase
+    the pooling interval by `slow_down_interval` seconds.
+
+    Returns:
+        a [BearerToken][requests_oauth2client.tokens.BearerToken]
+
+    """
+    raise NotImplementedError
+
- -
- +
-
- - - -

- MissingIdToken -

+
+
+ +
-
-

- Bases: InvalidAuthResponse

- -

Raised when the Authorization Endpoint does not return a mandatory ID Token.

-

This happens when the Authorization Endpoint does not return an error, but does not return an ID -Token either.

-
- Source code in requests_oauth2client/exceptions.py - 
208
-209
-210
-211
-212
-213
-214
class MissingIdToken(InvalidAuthResponse):
-    """Raised when the Authorization Endpoint does not return a mandatory ID Token.
-
-    This happens when the Authorization Endpoint does not return an error, but does not return an ID
-    Token either.
-
-    """
-
-
+
-
+
-

- MismatchingState +

+ tokens -

+ + +
+ +

This module contains classes that represent Tokens used in OAuth2.0 / OIDC.

+ + + +
-
-

- Bases: InvalidAuthResponse

- -

Raised on mismatching state value.

-

This happens when the Authorization Endpoints returns a 'state' parameter that doesn't match the -value passed in the Authorization Request.

-
- Source code in requests_oauth2client/exceptions.py - 
217
-218
-219
-220
-221
-222
-223
class MismatchingState(InvalidAuthResponse):
-    """Raised on mismatching `state` value.
-
-    This happens when the Authorization Endpoints returns a 'state' parameter that doesn't match the
-    value passed in the Authorization Request.
-
-    """
-
-
-
-
-

- MismatchingIssuer +

+ TokenType -

+ -
-

- Bases: InvalidAuthResponse

+
+

+ Bases: str, Enum

- -

Raised on mismatching iss value.

-

This happens when the Authorization Endpoints returns an 'iss' that doesn't match the expected -value.

-
- Source code in requests_oauth2client/exceptions.py - 
226
-227
-228
-229
-230
-231
-232
class MismatchingIssuer(InvalidAuthResponse):
-    """Raised on mismatching `iss` value.
-
-    This happens when the Authorization Endpoints returns an 'iss' that doesn't match the expected
-    value.
-
-    """
-
-
+

An enum of standardised token_type values.

-
+
+ Source code in requests_oauth2client/tokens.py + 
23
+24
+25
+26
+27
+28
class TokenType(str, Enum):
+    """An enum of standardised `token_type` values."""
+
+    ACCESS_TOKEN = "access_token"
+    REFRESH_TOKEN = "refresh_token"
+    ID_TOKEN = "id_token"
+
+
-
-
+
+ -

- MismatchingNonce -

-
-

- Bases: InvalidIdToken

- -

Raised on mismatching nonce value in an ID Token.

-

This happens when the authorization request includes a nonce but the returned ID Token include -a different value.

-
- Source code in requests_oauth2client/exceptions.py - 
235
-236
-237
-238
-239
-240
-241
class MismatchingNonce(InvalidIdToken):
-    """Raised on mismatching `nonce` value in an ID Token.
-
-    This happens when the authorization request includes a `nonce` but the returned ID Token include
-    a different value.
-
-    """
-
-
+
@@ -60973,73 +70660,49 @@

- MismatchingAcr +

+ AccessTokenType -

+ -
-

- Bases: InvalidIdToken

+
+

+ Bases: str, Enum

- -

Raised when the returned ID Token doesn't contain one of the requested ACR Values.

-

This happens when the authorization request includes an acr_values parameter but the returned -ID Token includes a different value.

-
- Source code in requests_oauth2client/exceptions.py - 
244
-245
-246
-247
-248
-249
-250
class MismatchingAcr(InvalidIdToken):
-    """Raised when the returned ID Token doesn't contain one of the requested ACR Values.
-
-    This happens when the authorization request includes an `acr_values` parameter but the returned
-    ID Token includes a different value.
-
-    """
-
-
+

An enum of standardised access_token types.

-
+
+ Source code in requests_oauth2client/tokens.py + 
31
+32
+33
+34
class AccessTokenType(str, Enum):
+    """An enum of standardised `access_token` types."""
+
+    BEARER = "Bearer"
+
+
-
-
+
+ -

- MismatchingAudience -

-
-

- Bases: InvalidIdToken

- -

Raised when the ID Token audience does not include the requesting Client ID.

-
- Source code in requests_oauth2client/exceptions.py - 
253
-254
class MismatchingAudience(InvalidIdToken):
-    """Raised when the ID Token audience does not include the requesting Client ID."""
-
-
+
@@ -61047,61 +70710,53 @@

- MismatchingAzp +

+ UnsupportedTokenType -

+ -
-

- Bases: InvalidIdToken

+
+

+ Bases: ValueError

- -

Raised when the ID Token Authorized Presenter (azp) claim is not the Client ID.

-
- Source code in requests_oauth2client/exceptions.py - 
257
-258
class MismatchingAzp(InvalidIdToken):
-    """Raised when the ID Token Authorized Presenter (azp) claim is not the Client ID."""
-
-
+

Raised when an unsupported token_type is provided.

-
+
+ Source code in requests_oauth2client/tokens.py + 
37
+38
+39
+40
+41
+42
class UnsupportedTokenType(ValueError):
+    """Raised when an unsupported token_type is provided."""
+
+    def __init__(self, token_type: str) -> None:
+        super().__init__(f"Unsupported token_type: {token_type}")
+        self.token_type = token_type
+
+
-
-
+
+ -

- MismatchingIdTokenAlg -

-
-

- Bases: InvalidIdToken

- -

Raised when the returned ID Token is signed with an unexpected alg.

-
- Source code in requests_oauth2client/exceptions.py - 
261
-262
class MismatchingIdTokenAlg(InvalidIdToken):
-    """Raised when the returned ID Token is signed with an unexpected alg."""
-
-
+
@@ -61109,224 +70764,463 @@

- ExpiredIdToken +

+ IdToken -

+ -
-

- Bases: InvalidIdToken

+
+

+ Bases: SignedJwt

- -

Raised when the returned ID Token is expired.

-
- Source code in requests_oauth2client/exceptions.py - 
265
-266
class ExpiredIdToken(InvalidIdToken):
-    """Raised when the returned ID Token is expired."""
-
-
+

Represent an ID Token.

+

An ID Token is actually a Signed JWT. If the ID Token is encrypted, it must be decoded +beforehand.

-
+
+ Source code in requests_oauth2client/tokens.py + 
 45
+ 46
+ 47
+ 48
+ 49
+ 50
+ 51
+ 52
+ 53
+ 54
+ 55
+ 56
+ 57
+ 58
+ 59
+ 60
+ 61
+ 62
+ 63
+ 64
+ 65
+ 66
+ 67
+ 68
+ 69
+ 70
+ 71
+ 72
+ 73
+ 74
+ 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
class IdToken(jwskate.SignedJwt):
+    """Represent an ID Token.
+
+    An ID Token is actually a Signed JWT. If the ID Token is encrypted, it must be decoded
+    beforehand.
+
+    """
+
+    @property
+    def authorized_party(self) -> str | None:
+        """The Authorized Party (azp)."""
+        azp = self.claims.get("azp")
+        if azp is None or isinstance(azp, str):
+            return azp
+        msg = "`azp` attribute must be a string."
+        raise AttributeError(msg)
+
+    @property
+    def auth_datetime(self) -> datetime | None:
+        """The last user authentication time (auth_time)."""
+        auth_time = self.claims.get("auth_time")
+        if auth_time is None:
+            return None
+        if isinstance(auth_time, int) and auth_time > 0:
+            return self.timestamp_to_datetime(auth_time)
+        msg = "`auth_time` must be a positive integer"
+        raise AttributeError(msg)
+
+    @classmethod
+    def hash_method(cls, key: jwskate.Jwk, alg: str | None = None) -> Callable[[str], str]:
+        """Returns a callable that generates valid OIDC hashes, such as `at_hash`, `c_hash`, etc.
+
+        Args:
+            key: the ID token signature verification public key
+            alg: the ID token signature algorithm
+
+        Returns:
+            a callable that takes a string as input and produces a valid hash as a str output
+
+        """
+        alg_class = jwskate.select_alg_class(key.SIGNATURE_ALGORITHMS, jwk_alg=key.alg, alg=alg)
+        if alg_class == jwskate.EdDsa:
+            if key.crv == "Ed25519":
+
+                def hash_method(token: str) -> str:
+                    return BinaPy(token).to("sha512")[:32].to("b64u").decode()
+
+            elif key.crv == "Ed448":
+
+                def hash_method(token: str) -> str:
+                    return BinaPy(token).to("shake256", 456).to("b64u").decode()
+
+        else:
+            hash_alg = alg_class.hashing_alg.name
+            hash_size = alg_class.hashing_alg.digest_size
+
+            def hash_method(token: str) -> str:
+                return BinaPy(token).to(hash_alg)[: hash_size // 2].to("b64u").decode()
+
+        return hash_method
+
+
-
-
+
-

- BackChannelAuthenticationError -

-
-

- Bases: EndpointError

+
- -

Base class for errors returned by the BackChannel Authentication endpoint.

-
- Source code in requests_oauth2client/exceptions.py - 
269
-270
class BackChannelAuthenticationError(EndpointError):
-    """Base class for errors returned by the BackChannel Authentication endpoint."""
-
-
-
+
+ authorized_party: str | None + + + property + +
-
-
+
+

The Authorized Party (azp).

+
+
-

- InvalidBackChannelAuthenticationResponse +
-

+
+ auth_datetime: datetime | None -
-

- Bases: OAuth2Error

+ + property + - -

Raised when the BackChannel Authentication endpoint returns a non-standard response.

+
-
- Source code in requests_oauth2client/exceptions.py - 
273
-274
class InvalidBackChannelAuthenticationResponse(OAuth2Error):
-    """Raised when the BackChannel Authentication endpoint returns a non-standard response."""
-
-
-
+
+

The last user authentication time (auth_time).

+
-
+
-

- InvalidPushedAuthorizationResponse +

+ hash_method(key, alg=None) -
+ + classmethod + + -
-

- Bases: OAuth2Error

- -

Raised when the Pushed Authorization Endpoint returns an error.

+
-
- Source code in requests_oauth2client/exceptions.py - 
277
-278
class InvalidPushedAuthorizationResponse(OAuth2Error):
-    """Raised when the Pushed Authorization Endpoint returns an error."""
-
-
+

Returns a callable that generates valid OIDC hashes, such as at_hash, c_hash, etc.

-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
key + Jwk + +
+

the ID token signature verification public key

+
+ 		+ required +
alg + str | None + +
+

the ID token signature algorithm

+
+ 		+ None +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ Callable[[str], str] + +
+

a callable that takes a string as input and produces a valid hash as a str output

+
+
-
+
+ Source code in requests_oauth2client/tokens.py + 
 73
+ 74
+ 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
@classmethod
+def hash_method(cls, key: jwskate.Jwk, alg: str | None = None) -> Callable[[str], str]:
+    """Returns a callable that generates valid OIDC hashes, such as `at_hash`, `c_hash`, etc.
+
+    Args:
+        key: the ID token signature verification public key
+        alg: the ID token signature algorithm
+
+    Returns:
+        a callable that takes a string as input and produces a valid hash as a str output
+
+    """
+    alg_class = jwskate.select_alg_class(key.SIGNATURE_ALGORITHMS, jwk_alg=key.alg, alg=alg)
+    if alg_class == jwskate.EdDsa:
+        if key.crv == "Ed25519":
+
+            def hash_method(token: str) -> str:
+                return BinaPy(token).to("sha512")[:32].to("b64u").decode()
+
+        elif key.crv == "Ed448":
+
+            def hash_method(token: str) -> str:
+                return BinaPy(token).to("shake256", 456).to("b64u").decode()
+
+    else:
+        hash_alg = alg_class.hashing_alg.name
+        hash_size = alg_class.hashing_alg.digest_size
+
+        def hash_method(token: str) -> str:
+            return BinaPy(token).to(hash_alg)[: hash_size // 2].to("b64u").decode()
+
+    return hash_method
+
+
+
+
-
+
-
- - +
-

- flask -

+

+ InvalidIdToken -
- -

This module contains helper classes for the Flask Framework.

-

See Flask framework.

- +

-
+
+

+ Bases: ValueError

+

Raised when trying to validate an invalid ID Token value.

+
+ Source code in requests_oauth2client/tokens.py + 
107
+108
+109
+110
+111
+112
+113
class InvalidIdToken(ValueError):
+    """Raised when trying to validate an invalid ID Token value."""
+
+    def __init__(self, message: str, token: TokenResponse, id_token: IdToken | None = None) -> None:
+        super().__init__(f"Invalid ID Token: {message}")
+        self.token = token
+        self.id_token = id_token
+
+
+
-
-

- FlaskOAuth2ClientCredentialsAuth -

-
-

- Bases: FlaskSessionAuthMixin, OAuth2ClientCredentialsAuth

- -

A requests Auth handler for CC grant that stores its token in Flask session.

-

It will automatically get Access Tokens from an OAuth 2.x AS with the Client Credentials grant -(and can get a new one once the first one is expired), and stores the retrieved token, -serialized in Flask session, so that each user has a different access token.

-
- Source code in requests_oauth2client/flask/auth.py - 
67
-68
-69
-70
-71
-72
-73
-74
class FlaskOAuth2ClientCredentialsAuth(FlaskSessionAuthMixin, OAuth2ClientCredentialsAuth):
-    """A `requests` Auth handler for CC grant that stores its token in Flask session.
-
-    It will automatically get Access Tokens from an OAuth 2.x AS with the Client Credentials grant
-    (and can get a new one once the first one is expired), and stores the retrieved token,
-    serialized in Flask `session`, so that each user has a different access token.
-
-    """
-
-
+
+
-
+

+ MissingIdToken -

- auth +

- +
+

+ Bases: InvalidIdToken

+ + +

Raised when the Authorization Endpoint does not return a mandatory ID Token.

+

This happens when the Authorization Endpoint does not return an error, but does not return an ID +Token either.

+ +
+ Source code in requests_oauth2client/tokens.py + 
116
+117
+118
+119
+120
+121
+122
+123
+124
+125
class MissingIdToken(InvalidIdToken):
+    """Raised when the Authorization Endpoint does not return a mandatory ID Token.
+
+    This happens when the Authorization Endpoint does not return an error, but does not return an ID
+    Token either.
+
+    """
+
+    def __init__(self, token: TokenResponse) -> None:
+        super().__init__("An expected `id_token` is missing in the response.", token, None)
+
+
-
- -

Helper classes for the Flask framework.

-
@@ -61337,770 +71231,375 @@

-
-
- FlaskSessionAuthMixin +
+

- +
+
-
- -

A Mixin for auth handlers to store their tokens in Flask session.

-

Storing tokens in Flask session does ensure that each user of a Flask application has a -different access token, and that tokens used for backend API access will be persisted between -multiple requests to the front-end Flask app.

+

+ MismatchingIdTokenIssuer -

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
session_key - str - -
-

the key that will be used to store the access token in session.

-
- 		- required -
serializer - BearerTokenSerializer | None - -
-

the serializer that will be used to store the access token in session.

-
- 		- None -
+

-
- Source code in requests_oauth2client/flask/auth.py - 
13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
class FlaskSessionAuthMixin:
-    """A Mixin for auth handlers to store their tokens in Flask session.
-
-    Storing tokens in Flask session does ensure that each user of a Flask application has a
-    different access token, and that tokens used for backend API access will be persisted between
-    multiple requests to the front-end Flask app.
-
-    Args:
-        session_key: the key that will be used to store the access token in session.
-        serializer: the serializer that will be used to store the access token in session.
-
-    """
-
-    def __init__(
-        self,
-        session_key: str,
-        serializer: BearerTokenSerializer | None = None,
-        *args: Any,
-        **token_kwargs: Any,
-    ) -> None:
-        super().__init__(*args, **token_kwargs)
-        self.serializer = serializer or BearerTokenSerializer()
-        self.session_key = session_key
-
-    @property
-    def token(self) -> BearerToken | None:
-        """Return the Access Token stored in session.
-
-        Returns:
-            The current `BearerToken` for this session, if any.
-
-        """
-        serialized_token = session.get(self.session_key)
-        if serialized_token is None:
-            return None
-        return self.serializer.loads(serialized_token)
-
-    @token.setter
-    def token(self, token: BearerToken | str | None) -> None:
-        """Store an Access Token in session.
-
-        Args:
-            token: the token to store
-
-        """
-        if isinstance(token, str):
-            token = BearerToken(token)  # pragma: no cover
-        if token:
-            serialized_token = self.serializer.dumps(token)
-            session[self.session_key] = serialized_token
-        elif session and self.session_key in session:
-            session.pop(self.session_key, None)
-
-
- +
+

+ Bases: InvalidIdToken

-
+

Raised on mismatching iss value in an ID Token.

+

This happens when the expected issuer value is different from the iss value in an obtained ID Token.

+
+ Source code in requests_oauth2client/tokens.py + 
128
+129
+130
+131
+132
+133
+134
+135
+136
+137
+138
class MismatchingIdTokenIssuer(InvalidIdToken):
+    """Raised on mismatching `iss` value in an ID Token.
+
+    This happens when the expected `issuer` value is different from the `iss` value in an obtained ID Token.
+
+    """
+
+    def __init__(self, iss: str | None, expected: str, token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__(f"`iss` from token '{iss}' does not match expected value '{expected}'", token, id_token)
+        self.received = iss
+        self.expected = expected
+
+
+
-
-
- token: BearerToken | None - - - property - writable - -
-
- -

Return the Access Token stored in session.

-

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken | None - -
-

The current BearerToken for this session, if any.

-
-
+
+
+
+

+ MismatchingIdTokenNonce -

-
+ -
+
+

+ Bases: InvalidIdToken

-
+

Raised on mismatching nonce value in an ID Token.

+

This happens when the authorization request includes a nonce but the returned ID Token include +a different value.

+
+ Source code in requests_oauth2client/tokens.py + 
141
+142
+143
+144
+145
+146
+147
+148
+149
+150
+151
+152
class MismatchingIdTokenNonce(InvalidIdToken):
+    """Raised on mismatching `nonce` value in an ID Token.
+
+    This happens when the authorization request includes a `nonce` but the returned ID Token include
+    a different value.
+
+    """
+
+    def __init__(self, nonce: str, expected: str, token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__(f"nonce from token '{nonce}' does not match expected value '{expected}'", token, id_token)
+        self.received = nonce
+        self.expected = expected
+
+
-
- FlaskOAuth2ClientCredentialsAuth -
+
-
-

- Bases: FlaskSessionAuthMixin, OAuth2ClientCredentialsAuth

- -

A requests Auth handler for CC grant that stores its token in Flask session.

-

It will automatically get Access Tokens from an OAuth 2.x AS with the Client Credentials grant -(and can get a new one once the first one is expired), and stores the retrieved token, -serialized in Flask session, so that each user has a different access token.

-
- Source code in requests_oauth2client/flask/auth.py - 
67
-68
-69
-70
-71
-72
-73
-74
class FlaskOAuth2ClientCredentialsAuth(FlaskSessionAuthMixin, OAuth2ClientCredentialsAuth):
-    """A `requests` Auth handler for CC grant that stores its token in Flask session.
-
-    It will automatically get Access Tokens from an OAuth 2.x AS with the Client Credentials grant
-    (and can get a new one once the first one is expired), and stores the retrieved token,
-    serialized in Flask `session`, so that each user has a different access token.
-
-    """
-
-
-
-
-
+
+
-
- -
- -
-
+

+ MismatchingIdTokenAcr -

- pooling +

- +
+

+ Bases: InvalidIdToken

-
- -

Contains base classes for pooling jobs.

- +

Raised when the returned ID Token doesn't contain one of the requested ACR Values.

+

This happens when the authorization request includes an acr_values parameter but the returned +ID Token includes a different value.

-
+
+ Source code in requests_oauth2client/tokens.py + 
155
+156
+157
+158
+159
+160
+161
+162
+163
+164
+165
+166
class MismatchingIdTokenAcr(InvalidIdToken):
+    """Raised when the returned ID Token doesn't contain one of the requested ACR Values.
+
+    This happens when the authorization request includes an `acr_values` parameter but the returned
+    ID Token includes a different value.
+
+    """
+
+    def __init__(self, acr: str, expected: Sequence[str], token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__(f"token contains acr '{acr}' while client expects one of '{expected}'", token, id_token)
+        self.received = acr
+        self.expected = expected
+
+
+
-
-

- TokenEndpointPoolingJob -

+
-
-

- Bases: ABC

+
- -

Base class for Token Endpoint pooling jobs.

-

This is used for decoupled flows like CIBA or Device Authorization.

-

This class must be subclassed to implement actual BackChannel flows. This needs an -OAuth2Client that will be used to pool the token -endpoint. The initial pooling interval is configurable.

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
client - OAuth2Client - -
-

the OAuth2Client that will be used -to pool the token endpoint.

-
- 		- required -
interval - int | None - -
-

initial pooling interval, in seconds. If None, default to 5.

-
- 		- None -
slow_down_interval - int - -
-

when a SlowDown is -received, this number of seconds will be added to the pooling interval.

-
- 		- 5 -
requests_kwargs - dict[str, Any] | None - -
-

additional parameters for the underlying calls to requests.request

-
- 		- None -
**token_kwargs - Any - -
-

additional parameters for the token request

-
- 		- {} -
-
- Source code in requests_oauth2client/pooling.py - 
16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
-76
-77
-78
-79
-80
-81
-82
-83
-84
-85
-86
-87
-88
-89
-90
class TokenEndpointPoolingJob(ABC):
-    """Base class for Token Endpoint pooling jobs.
-
-    This is used for decoupled flows like CIBA or Device Authorization.
-
-    This class must be subclassed to implement actual BackChannel flows. This needs an
-    [OAuth2Client][requests_oauth2client.client.OAuth2Client] that will be used to pool the token
-    endpoint. The initial pooling `interval` is configurable.
-
-    Args:
-        client: the [OAuth2Client][requests_oauth2client.client.OAuth2Client] that will be used
-            to pool the token endpoint.
-        interval: initial pooling interval, in seconds. If `None`, default to `5`.
-        slow_down_interval: when a [SlowDown][requests_oauth2client.exceptions.SlowDown] is
-            received, this number of seconds will be added to the pooling interval.
-        requests_kwargs: additional parameters for the underlying calls to [requests.request][]
-        **token_kwargs: additional parameters for the token request
-
-    """
-
-    def __init__(
-        self,
-        client: OAuth2Client,
-        interval: int | None = None,
-        slow_down_interval: int = 5,
-        requests_kwargs: dict[str, Any] | None = None,
-        **token_kwargs: Any,
-    ):
-        self.client = client
-        self.interval = interval or 5
-        self.slow_down_interval = slow_down_interval
-        self.requests_kwargs = requests_kwargs
-        self.token_kwargs = token_kwargs
-
-    def __call__(self) -> BearerToken | None:
-        """Wrap the actual Token Endpoint call with a pooling interval.
-
-        Everytime this method is called, it will wait for the entire duration of the pooling
-        interval before calling
-        [token_request()][requests_oauth2client.pooling.TokenEndpointPoolingJob.token_request]. So
-        you can call it immediately after initiating the BackChannel flow, and it will wait before
-        initiating the first call.
-
-        This implements the logic to handle
-        [AuthorizationPending][requests_oauth2client.exceptions.AuthorizationPending] or
-        [SlowDown][requests_oauth2client.exceptions.SlowDown] requests by the AS.
-
-        Returns:
-            a [BearerToken][requests_oauth2client.tokens.BearerToken] if the AS returns one, or
-            `None` if the Authorization is still pending.
-
-        """
-        time.sleep(self.interval)
-        try:
-            return self.token_request()
-        except SlowDown:
-            self.interval += self.slow_down_interval
-        except AuthorizationPending:
-            pass
-        return None
-
-    @abstractmethod
-    def token_request(self) -> BearerToken:
-        """Abstract method for the token endpoint call.
-
-        This must be implemented by subclasses. This method must Must raise
-        [AuthorizationPending][requests_oauth2client.exceptions.AuthorizationPending] to retry after
-        the pooling interval, or [SlowDown][requests_oauth2client.exceptions.SlowDown] to increase
-        the pooling interval by `slow_down_interval` seconds.
-
-        Returns:
-            a [BearerToken][requests_oauth2client.tokens.BearerToken]
-
-        """
-        raise NotImplementedError  # pragma: no cover
-
-
+

+ MismatchingIdTokenAudience - -
+

+
+

+ Bases: InvalidIdToken

+

Raised when the ID Token audience does not include the requesting Client ID.

+
+ Source code in requests_oauth2client/tokens.py + 
169
+170
+171
+172
+173
+174
+175
+176
+177
class MismatchingIdTokenAudience(InvalidIdToken):
+    """Raised when the ID Token audience does not include the requesting Client ID."""
+
+    def __init__(self, audiences: Sequence[str], client_id: str, token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__(
+            f"token audience (`aud`) '{audiences}' does not match client_id '{client_id}'", token, id_token
+        )
+        self.received = audiences
+        self.expected = client_id
+
+
+
-
-
- token_request() - - - abstractmethod - -
-
- -

Abstract method for the token endpoint call.

-

This must be implemented by subclasses. This method must Must raise -AuthorizationPending to retry after -the pooling interval, or SlowDown to increase -the pooling interval by slow_down_interval seconds.

-

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/pooling.py - 
77
-78
-79
-80
-81
-82
-83
-84
-85
-86
-87
-88
-89
-90
@abstractmethod
-def token_request(self) -> BearerToken:
-    """Abstract method for the token endpoint call.
-
-    This must be implemented by subclasses. This method must Must raise
-    [AuthorizationPending][requests_oauth2client.exceptions.AuthorizationPending] to retry after
-    the pooling interval, or [SlowDown][requests_oauth2client.exceptions.SlowDown] to increase
-    the pooling interval by `slow_down_interval` seconds.
-
-    Returns:
-        a [BearerToken][requests_oauth2client.tokens.BearerToken]
-
-    """
-    raise NotImplementedError  # pragma: no cover
-
-
-
+
+
+
-
-
+

+ MismatchingIdTokenAzp -

+ +
+

+ Bases: InvalidIdToken

-
-
+

Raised when the ID Token Authorized Presenter (azp) claim is not the Client ID.

-
+
+ Source code in requests_oauth2client/tokens.py + 
180
+181
+182
+183
+184
+185
+186
+187
+188
class MismatchingIdTokenAzp(InvalidIdToken):
+    """Raised when the ID Token Authorized Presenter (azp) claim is not the Client ID."""
+
+    def __init__(self, azp: str, client_id: str, token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__(
+            f"token Authorized Presenter (`azp`) claim '{azp}' does not match client_id '{client_id}'", token, id_token
+        )
+        self.received = azp
+        self.expected = client_id
+
+
-
+
-

- tokens -

-
- -

This module contains classes that represent Tokens used in OAuth2.0 / OIDC.

- -
+
+
+
-

- TokenType +

+ MismatchingIdTokenAlg -

+ -
-

- Bases: str, Enum

+
+

+ Bases: InvalidIdToken

- -

An enum of standardised token_type values.

-
- Source code in requests_oauth2client/tokens.py - 
32
-33
-34
-35
-36
-37
class TokenType(str, Enum):
-    """An enum of standardised `token_type` values."""
-
-    ACCESS_TOKEN = "access_token"
-    REFRESH_TOKEN = "refresh_token"
-    ID_TOKEN = "id_token"
-
-
+

Raised when the returned ID Token is signed with an unexpected alg.

+ +
+ Source code in requests_oauth2client/tokens.py + 
191
+192
+193
+194
+195
+196
+197
class MismatchingIdTokenAlg(InvalidIdToken):
+    """Raised when the returned ID Token is signed with an unexpected alg."""
+
+    def __init__(self, token_alg: str, client_alg: str, token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__(f"token is signed with alg {token_alg}, client expects {client_alg}", token, id_token)
+        self.received = token_alg
+        self.expected = client_alg
+
+
- -
+
@@ -62111,10 +71610,10 @@

-

+
@@ -62122,36 +71621,41 @@

-

- AccessTokenType +

+ ExpiredIdToken -

+ -
-

- Bases: str, Enum

+
+

+ Bases: InvalidIdToken

- -

An enum of standardised access_token types.

-
- Source code in requests_oauth2client/tokens.py - 
40
-41
-42
-43
class AccessTokenType(str, Enum):
-    """An enum of standardised `access_token` types."""
-
-    BEARER = "Bearer"
-
-
+

Raised when the returned ID Token is expired.

+ +
+ Source code in requests_oauth2client/tokens.py + 
200
+201
+202
+203
+204
+205
+206
class ExpiredIdToken(InvalidIdToken):
+    """Raised when the returned ID Token is expired."""
+
+    def __init__(self, token: TokenResponse, id_token: IdToken) -> None:
+        super().__init__("token is expired", token, id_token)
+        self.received = id_token.expires_at
+        self.expected = datetime.now(tz=timezone.utc)
+
+
- -
+
@@ -62162,10 +71666,10 @@

-

+
@@ -62173,370 +71677,131 @@

-

- IdToken +

+ UnsupportedIdTokenAlg -

+ -
-

- Bases: SignedJwt

+
+

+ Bases: InvalidIdToken

- -

Represent an ID Token.

-

An ID Token is actually a Signed JWT. If the ID Token is encrypted, it must be decoded -beforehand.

-
- Source code in requests_oauth2client/tokens.py - 
46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
-76
-77
-78
-79
-80
-81
-82
-83
-84
-85
-86
-87
-88
-89
-90
-91
-92
-93
-94
class IdToken(jwskate.SignedJwt):
-    """Represent an ID Token.
-
-    An ID Token is actually a Signed JWT. If the ID Token is encrypted, it must be decoded
-    beforehand.
-
-    """
-
-    @property
-    def auth_time(self) -> datetime:
-        """The last user authentication time."""
-        auth_time = self.claims.get("auth_time")
-        if auth_time:
-            return self.timestamp_to_datetime(auth_time)
-        msg = "This ID Token doesn't have an `auth_time` attribute."
-        raise AttributeError(msg)
-
-    @classmethod
-    def hash_method(cls, key: jwskate.Jwk, alg: str | None = None) -> Callable[[str], str]:
-        """Returns a callable that generates valid OIDC hashes, such as at_hash, c_hash, s_hash.
-
-        Args:
-            key: the ID token signature verification public key
-            alg: the ID token signature algorithm
-
-        Returns:
-            a callable that takes a string as input and produces a valid hash as a str output
-
-        """
-        alg_class = jwskate.select_alg_class(key.SIGNATURE_ALGORITHMS, jwk_alg=key.alg, alg=alg)
-        if alg_class == jwskate.EdDsa:
-            if key.crv == "Ed25519":
-
-                def hash_method(token: str) -> str:
-                    return BinaPy(token).to("sha512")[:32].to("b64u").decode()
-
-            elif key.crv == "Ed448":
-
-                def hash_method(token: str) -> str:
-                    return BinaPy(token).to("shake256", 456).to("b64u").decode()
-
-        else:
-            hash_alg = alg_class.hashing_alg.name
-            hash_size = alg_class.hashing_alg.digest_size
-
-            def hash_method(token: str) -> str:
-                return BinaPy(token).to(hash_alg)[: hash_size // 2].to("b64u").decode()
-
-        return hash_method
-
-
+

Raised when the return ID Token is signed with an unsupported alg.

- +
+ Source code in requests_oauth2client/tokens.py + 
209
+210
+211
+212
+213
+214
class UnsupportedIdTokenAlg(InvalidIdToken):
+    """Raised when the return ID Token is signed with an unsupported alg."""
+
+    def __init__(self, token: TokenResponse, id_token: IdToken, alg: str) -> None:
+        super().__init__(f"token is signed with an unsupported alg {alg}", token, id_token)
+        self.alg = alg
+
+
-
+
-
-
- auth_time: datetime - - - property - -
-
- -

The last user authentication time.

-
- - - - -
- +
+
-
- hash_method(key, alg=None) - - - classmethod - +
-
-
- -

Returns a callable that generates valid OIDC hashes, such as at_hash, c_hash, s_hash.

+

+ TokenResponse +

-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
key - Jwk - -
-

the ID token signature verification public key

-
- 		- required -
alg - str | None - -
-

the ID token signature algorithm

-
- 		- None -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- Callable[[str], str] - -
-

a callable that takes a string as input and produces a valid hash as a str output

-
-
- -
- Source code in requests_oauth2client/tokens.py - 
63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
-76
-77
-78
-79
-80
-81
-82
-83
-84
-85
-86
-87
-88
-89
-90
-91
-92
-93
-94
@classmethod
-def hash_method(cls, key: jwskate.Jwk, alg: str | None = None) -> Callable[[str], str]:
-    """Returns a callable that generates valid OIDC hashes, such as at_hash, c_hash, s_hash.
-
-    Args:
-        key: the ID token signature verification public key
-        alg: the ID token signature algorithm
-
-    Returns:
-        a callable that takes a string as input and produces a valid hash as a str output
-
-    """
-    alg_class = jwskate.select_alg_class(key.SIGNATURE_ALGORITHMS, jwk_alg=key.alg, alg=alg)
-    if alg_class == jwskate.EdDsa:
-        if key.crv == "Ed25519":
-
-            def hash_method(token: str) -> str:
-                return BinaPy(token).to("sha512")[:32].to("b64u").decode()
-
-        elif key.crv == "Ed448":
-
-            def hash_method(token: str) -> str:
-                return BinaPy(token).to("shake256", 456).to("b64u").decode()
-
-    else:
-        hash_alg = alg_class.hashing_alg.name
-        hash_size = alg_class.hashing_alg.digest_size
-
-        def hash_method(token: str) -> str:
-            return BinaPy(token).to(hash_alg)[: hash_size // 2].to("b64u").decode()
-
-    return hash_method
-
-
-
-
+
+

Base class for Token Endpoint Responses.

-
+
+ Source code in requests_oauth2client/tokens.py + 
217
+218
+219
+220
class TokenResponse:
+    """Base class for Token Endpoint Responses."""
+
+    TOKEN_TYPE: ClassVar[str]
+
+
-
-
+
-
-

- AccessToken -

-
- -

Base class for Access Tokens.

-
- Source code in requests_oauth2client/tokens.py - 
 97
- 98
- 99
-100
class AccessToken:
-    """Base class for Access Tokens."""
-
-    TOKEN_TYPE: ClassVar[str]
-
-
- +
-
+
+
+
+

+ ExpiredAccessToken +

+
+

+ Bases: RuntimeError

-
+

Raised when an expired access token is used.

-
+
+ Source code in requests_oauth2client/tokens.py + 
223
+224
class ExpiredAccessToken(RuntimeError):
+    """Raised when an expired access token is used."""
+
+
+
@@ -62545,18 +71810,18 @@

- BearerToken + BearerToken

-
-

- Bases: AccessToken

+
+

+ Bases: TokenResponse, AuthBase

- -

Represents a Bearer Token as returned by a Token Endpoint.

+ +

Represents a Bearer Token as returned by a Token Endpoint.

This is a wrapper around a Bearer Token and associated parameters, such as expiration date and refresh token, as returned by an OAuth 2.x or OIDC 1.0 Token Endpoint.

All parameters are as returned by a Token Endpoint. The token expiration date can be passed as @@ -62564,709 +71829,824 @@

the future, can be passed instead.

- -

Parameters:

- - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
access_token - str - -
-

an access_token, as returned by the AS.

-
- 		- required -
expires_at - datetime | None - -
-

an expiration date. This method also accepts an expires_in hint as +

Parameters:

+ + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
access_token + str + +
+

an access_token, as returned by the AS.

+
+ 		+ required +
expires_at + datetime | None + +
+

an expiration date. This method also accepts an expires_in hint as returned by the AS, if any.

-
- 		- None -
scope - str | None - -
-

a scope, as returned by the AS, if any.

-
- 		- None -
refresh_token - str | None - -
-

a refresh_token, as returned by the AS, if any.

-
- 		- None -
token_type - str - -
-

a token_type, as returned by the AS.

-
- 		- TOKEN_TYPE -
id_token - str | bytes | IdToken | JweCompact | None - -
-

an id_token, as returned by the AS, if any.

-
- 		- None -
**kwargs - Any - -
-

additional parameters as returned by the AS, if any.

-
- 		- {} -
+
+ 		+ None +
scope + str | None + +
+

a scope, as returned by the AS, if any.

+
+ 		+ None +
refresh_token + str | None + +
+

a refresh_token, as returned by the AS, if any.

+
+ 		+ None +
token_type + str + +
+

a token_type, as returned by the AS.

+
+ 		+ TOKEN_TYPE +
id_token + str | bytes | IdToken | JweCompact | None + +
+

an id_token, as returned by the AS, if any.

+
+ 		+ None +
**kwargs + Any + +
+

additional parameters as returned by the AS, if any.

+
+ 		+ {} +
+ +
+ Source code in requests_oauth2client/tokens.py + 
227
+228
+229
+230
+231
+232
+233
+234
+235
+236
+237
+238
+239
+240
+241
+242
+243
+244
+245
+246
+247
+248
+249
+250
+251
+252
+253
+254
+255
+256
+257
+258
+259
+260
+261
+262
+263
+264
+265
+266
+267
+268
+269
+270
+271
+272
+273
+274
+275
+276
+277
+278
+279
+280
+281
+282
+283
+284
+285
+286
+287
+288
+289
+290
+291
+292
+293
+294
+295
+296
+297
+298
+299
+300
+301
+302
+303
+304
+305
+306
+307
+308
+309
+310
+311
+312
+313
+314
+315
+316
+317
+318
+319
+320
+321
+322
+323
+324
+325
+326
+327
+328
+329
+330
+331
+332
+333
+334
+335
+336
+337
+338
+339
+340
+341
+342
+343
+344
+345
+346
+347
+348
+349
+350
+351
+352
+353
+354
+355
+356
+357
+358
+359
+360
+361
+362
+363
+364
+365
+366
+367
+368
+369
+370
+371
+372
+373
+374
+375
+376
+377
+378
+379
+380
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391
+392
+393
+394
+395
+396
+397
+398
+399
+400
+401
+402
+403
+404
+405
+406
+407
+408
+409
+410
+411
+412
+413
+414
+415
+416
+417
+418
+419
+420
+421
+422
+423
+424
+425
+426
+427
+428
+429
+430
+431
+432
+433
+434
+435
+436
+437
+438
+439
+440
+441
+442
+443
+444
+445
+446
+447
+448
+449
+450
+451
+452
+453
+454
+455
+456
+457
+458
+459
+460
+461
+462
+463
+464
+465
+466
+467
+468
+469
+470
+471
+472
+473
+474
+475
+476
+477
+478
+479
+480
+481
+482
+483
+484
+485
+486
+487
+488
+489
+490
+491
+492
+493
+494
+495
+496
+497
+498
+499
+500
+501
+502
+503
+504
+505
+506
+507
+508
+509
+510
+511
+512
+513
+514
+515
+516
+517
+518
+519
+520
+521
+522
+523
+524
+525
+526
+527
+528
+529
+530
+531
+532
+533
+534
+535
+536
+537
+538
+539
+540
+541
+542
+543
+544
+545
+546
+547
+548
+549
+550
+551
+552
+553
+554
+555
+556
+557
+558
+559
+560
+561
+562
+563
+564
+565
+566
+567
+568
+569
+570
+571
+572
+573
+574
+575
+576
@frozen(init=False)
+class BearerToken(TokenResponse, requests.auth.AuthBase):
+    """Represents a Bearer Token as returned by a Token Endpoint.
+
+    This is a wrapper around a Bearer Token and associated parameters, such as expiration date and
+    refresh token, as returned by an OAuth 2.x or OIDC 1.0 Token Endpoint.
+
+    All parameters are as returned by a Token Endpoint. The token expiration date can be passed as
+    datetime in the `expires_at` parameter, or an `expires_in` parameter, as number of seconds in
+    the future, can be passed instead.
+
+    Args:
+        access_token: an `access_token`, as returned by the AS.
+        expires_at: an expiration date. This method also accepts an `expires_in` hint as
+            returned by the AS, if any.
+        scope: a `scope`, as returned by the AS, if any.
+        refresh_token: a `refresh_token`, as returned by the AS, if any.
+        token_type: a `token_type`, as returned by the AS.
+        id_token: an `id_token`, as returned by the AS, if any.
+        **kwargs: additional parameters as returned by the AS, if any.
+
+    """
+
+    TOKEN_TYPE: ClassVar[str] = AccessTokenType.BEARER.value
+    AUTHORIZATION_HEADER: ClassVar[str] = "Authorization"
+
+    access_token: str
+    expires_at: datetime | None = None
+    scope: str | None = None
+    refresh_token: str | None = None
+    token_type: str = TOKEN_TYPE
+    id_token: IdToken | jwskate.JweCompact | None = None
+    kwargs: dict[str, Any] = Factory(dict)
+
+    @accepts_expires_in
+    def __init__(
+        self,
+        access_token: str,
+        *,
+        expires_at: datetime | None = None,
+        scope: str | None = None,
+        refresh_token: str | None = None,
+        token_type: str = TOKEN_TYPE,
+        id_token: str | bytes | IdToken | jwskate.JweCompact | None = None,
+        **kwargs: Any,
+    ) -> None:
+        if token_type.title() != self.TOKEN_TYPE.title():
+            raise UnsupportedTokenType(token_type)
+        id_token_jwt: IdToken | jwskate.JweCompact | None
+        if isinstance(id_token, (str, bytes)):
+            try:
+                id_token_jwt = IdToken(id_token)
+            except jwskate.InvalidJwt:
+                try:
+                    id_token_jwt = jwskate.JweCompact(id_token)
+                except jwskate.InvalidJwe:
+                    msg = "token is neither a JWT or a JWE."
+                    raise InvalidIdToken(msg, self) from None
+        else:
+            id_token_jwt = id_token
+        self.__attrs_init__(
+            access_token=access_token,
+            expires_at=expires_at,
+            scope=scope,
+            refresh_token=refresh_token,
+            token_type=token_type,
+            id_token=id_token_jwt,
+            kwargs=kwargs,
+        )
+
+    def is_expired(self, leeway: int = 0) -> bool | None:
+        """Check if the access token is expired.
+
+        Args:
+            leeway: If the token expires in the next given number of seconds,
+                then consider it expired already.
+
+        Returns:
+            One of:
+
+            - `True` if the access token is expired
+            - `False` if it is still valid
+            - `None` if there is no expires_in hint.
+
+        """
+        if self.expires_at:
+            return datetime.now(tz=timezone.utc) + timedelta(seconds=leeway) > self.expires_at
+        return None
+
+    def authorization_header(self) -> str:
+        """Return the appropriate Authorization Header value for this token.
+
+        The value is formatted correctly according to RFC6750.
+
+        Returns:
+            the value to use in an HTTP Authorization Header
+
+        """
+        return f"Bearer {self.access_token}"
+
+    def validate_id_token(  # noqa: PLR0915, C901
+        self, client: OAuth2Client, azr: AuthorizationResponse, exp_leeway: int = 0, auth_time_leeway: int = 10
+    ) -> Self:
+        """Validate the ID Token, and return a new instance with the decrypted ID Token.
+
+        If the ID Token was not encrypted, the returned instance will contain the same ID Token.
+
+        This will validate the id_token as described in [OIDC 1.0
+        $3.1.3.7](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation).
+
+        Args:
+            client: the `OAuth2Client` that was used to obtain this token
+            azr: the `AuthorizationResponse`, as obtained by a call to `AuthorizationRequest.validate()`
+            exp_leeway: a leeway, in seconds, applied to the ID Token expiration date
+            auth_time_leeway: a leeway, in seconds, applied to the `auth_time` validation
+
+        Raises:
+            MissingIdToken: if the ID Token is missing
+            InvalidIdToken: this is a base exception class, which is raised:
+
+                - if the ID Token is not a JWT
+                - or is encrypted while a clear-text token is expected
+                - or is clear-text while an encrypted token is expected
+                - if token is encrypted but client does not have a decryption key
+                - if the token does not contain an `alg` header
+            MismatchingIdTokenAlg: if the `alg` header from the ID Token does not match
+                the expected `client.id_token_signed_response_alg`.
+            MismatchingIdTokenIssuer: if the `iss` claim from the ID Token does not match
+                the expected `azr.issuer`.
+            MismatchingIdTokenAcr: if the `acr` claim from the ID Token does not match
+                on of the expected `azr.acr_values`.
+            MismatchingIdTokenAudience: if the `aud` claim from the ID Token does not match
+                the expected `client.client_id`.
+            MismatchingIdTokenAzp: if the `azp` claim from the ID Token does not match
+                the expected `client.client_id`.
+            MismatchingIdTokenNonce: if the `nonce` claim from the ID Token does not match
+                the expected `azr.nonce`.
+            ExpiredIdToken: if the ID Token is expired at the time of the check.
+            UnsupportedIdTokenAlg: if the signature alg for the ID Token is not supported.
+
+        """
+        if not self.id_token:
+            raise MissingIdToken(self)
+
+        raw_id_token = self.id_token
+
+        if isinstance(raw_id_token, jwskate.JweCompact) and client.id_token_encrypted_response_alg is None:
+            msg = "token is encrypted while it should be clear-text"
+            raise InvalidIdToken(msg, self)
+        if isinstance(raw_id_token, IdToken) and client.id_token_encrypted_response_alg is not None:
+            msg = "token is clear-text while it should be encrypted"
+            raise InvalidIdToken(msg, self)
+
+        if isinstance(raw_id_token, jwskate.JweCompact):
+            enc_jwk = client.id_token_decryption_key
+            if enc_jwk is None:
+                msg = "token is encrypted but client does not have a decryption key"
+                raise InvalidIdToken(msg, self)
+            nested_id_token = raw_id_token.decrypt(enc_jwk)
+            id_token = IdToken(nested_id_token)
+        else:
+            id_token = raw_id_token
+
+        id_token_alg = id_token.get_header("alg")
+        if id_token_alg is None:
+            id_token_alg = client.id_token_signed_response_alg
+        if id_token_alg is None:
+            msg = """
+token does not contain an `alg` parameter to specify the signature algorithm,
+and no algorithm has been configured for the client (using param `id_token_signed_response_alg`).
+"""
+            raise InvalidIdToken(msg, self, id_token)
+        if client.id_token_signed_response_alg is not None and id_token_alg != client.id_token_signed_response_alg:
+            raise MismatchingIdTokenAlg(id_token.alg, client.id_token_signed_response_alg, self, id_token)
+
+        verification_jwk: jwskate.Jwk
+
+        if id_token_alg in jwskate.SignatureAlgs.ALL_SYMMETRIC:
+            if not client.client_secret:
+                msg = "token is symmetrically signed but this client does not have a Client Secret."
+                raise InvalidIdToken(msg, self, id_token)
+            verification_jwk = jwskate.SymmetricJwk.from_bytes(client.client_secret, alg=id_token_alg)
+            id_token.verify_signature(verification_jwk, alg=id_token_alg)
+        elif id_token_alg in jwskate.SignatureAlgs.ALL_ASYMMETRIC:
+            if not client.authorization_server_jwks:
+                msg = "token is asymmetrically signed but the Authorization Server JWKS is not available."
+                raise InvalidIdToken(msg, self, id_token)
+
+            if id_token.get_header("kid") is None:
+                msg = """
+token does not contain a Key ID (kid) to specify the asymmetric key
+to use for signature verification."""
+                raise InvalidIdToken(msg, self, id_token)
+            try:
+                verification_jwk = client.authorization_server_jwks.get_jwk_by_kid(id_token.kid)
+            except KeyError:
+                msg = f"""\
+token is asymmetrically signed but there is no key
+with kid='{id_token.kid}' in the Authorization Server JWKS."""
+                raise InvalidIdToken(msg, self, id_token) from None
+
+            if id_token_alg not in verification_jwk.supported_signing_algorithms():
+                msg = "token is asymmetrically signed but its algorithm is not supported by the verification key."
+                raise InvalidIdToken(msg, self, id_token)
+        else:
+            raise UnsupportedIdTokenAlg(self, id_token, id_token_alg)
+
+        id_token.verify(verification_jwk, alg=id_token_alg)
+
+        if azr.issuer and id_token.issuer != azr.issuer:
+            raise MismatchingIdTokenIssuer(id_token.issuer, azr.issuer, self, id_token)
+
+        if id_token.audiences and client.client_id not in id_token.audiences:
+            raise MismatchingIdTokenAudience(id_token.audiences, client.client_id, self, id_token)
+
+        if id_token.authorized_party is not None and id_token.authorized_party != client.client_id:
+            raise MismatchingIdTokenAzp(id_token.azp, client.client_id, self, id_token)
+
+        if id_token.is_expired(leeway=exp_leeway):
+            raise ExpiredIdToken(self, id_token)
+
+        if azr.nonce and id_token.nonce != azr.nonce:
+            raise MismatchingIdTokenNonce(id_token.nonce, azr.nonce, self, id_token)
+
+        if azr.acr_values and id_token.acr not in azr.acr_values:
+            raise MismatchingIdTokenAcr(id_token.acr, azr.acr_values, self, id_token)
+
+        hash_function = IdToken.hash_method(verification_jwk, id_token_alg)
+
+        at_hash = id_token.get_claim("at_hash")
+        if at_hash is not None:
+            expected_at_hash = hash_function(self.access_token)
+            if expected_at_hash != at_hash:
+                msg = f"mismatching 'at_hash' value (expected '{expected_at_hash}', got '{at_hash}')"
+                raise InvalidIdToken(msg, self, id_token)
+
+        c_hash = id_token.get_claim("c_hash")
+        if c_hash is not None:
+            expected_c_hash = hash_function(azr.code)
+            if expected_c_hash != c_hash:
+                msg = f"mismatching 'c_hash' value (expected '{expected_c_hash}', got '{c_hash}')"
+                raise InvalidIdToken(msg, self, id_token)
+
+        s_hash = id_token.get_claim("s_hash")
+        if s_hash is not None:
+            if azr.state is None:
+                msg = "token has a 's_hash' claim but no state was included in the request."
+                raise InvalidIdToken(msg, self, id_token)
+            expected_s_hash = hash_function(azr.state)
+            if expected_s_hash != s_hash:
+                msg = f"mismatching 's_hash' value (expected '{expected_s_hash}', got '{s_hash}')"
+                raise InvalidIdToken(msg, self, id_token)
+
+        if azr.max_age is not None:
+            auth_time = id_token.auth_datetime
+            if auth_time is None:
+                msg = """
+a `max_age` parameter was included in the authorization request,
+but the ID Token does not contain an `auth_time` claim.
+"""
+                raise InvalidIdToken(msg, self, id_token) from None
+            auth_age = datetime.now(tz=timezone.utc) - auth_time
+            if auth_age.total_seconds() > azr.max_age + auth_time_leeway:
+                msg = f"""
+user authentication happened too far in the past.
+The `auth_time` parameter from the ID Token indicate that
+the last Authentication Time was at {auth_time} ({auth_age.total_seconds()} sec ago),
+but the authorization request `max_age` parameter specified that it must
+be a maximum of {azr.max_age} sec ago.
+"""
+                raise InvalidIdToken(msg, self, id_token)
+
+        return self.__class__(
+            access_token=self.access_token,
+            expires_at=self.expires_at,
+            scope=self.scope,
+            refresh_token=self.refresh_token,
+            token_type=self.token_type,
+            id_token=id_token,
+            **self.kwargs,
+        )
+
+    def __str__(self) -> str:
+        """Return the access token value, as a string.
+
+        Returns:
+            the access token string
+
+        """
+        return self.access_token
+
+    def as_dict(self) -> dict[str, Any]:
+        """Return a dict of parameters.
+
+        That is suitable for serialization or to init another BearerToken.
+
+        """
+        d = asdict(self)
+        d.pop("expires_at")
+        d["expires_in"] = self.expires_in
+        d.update(**d.pop("kwargs", {}))
+        return {key: val for key, val in d.items() if val is not None}
+
+    @property
+    def expires_in(self) -> int | None:
+        """Number of seconds until expiration."""
+        if self.expires_at:
+            return ceil((self.expires_at - datetime.now(tz=timezone.utc)).total_seconds())
+        return None
+
+    def __getattr__(self, key: str) -> Any:
+        """Return custom attributes from this BearerToken.
+
+        Args:
+            key: a key
+
+        Returns:
+            the associated value in this token response
+
+        Raises:
+            AttributeError: if the attribute is not found in this response.
+
+        """
+        return self.kwargs.get(key) or super().__getattribute__(key)
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        """Implement the usage of Bearer Tokens in requests.
+
+        This will add a properly formatted `Authorization: Bearer <token>` header in the request.
+
+        If the configured token is an instance of BearerToken with an expires_at attribute, raises
+        [ExpiredAccessToken][requests_oauth2client.exceptions.ExpiredAccessToken] once the access
+        token is expired.
+
+        Args:
+            request: the request
+
+        Returns:
+            the same request with an Access Token added in `Authorization` Header
+
+        Raises:
+            ExpiredAccessToken: if the token is expired
+
+        """
+        if self.access_token is None:
+            return request  # pragma: no cover
+        if self.is_expired():
+            raise ExpiredAccessToken(self)
+        request.headers[self.AUTHORIZATION_HEADER] = self.authorization_header()
+        return request
+
+
-
- Source code in requests_oauth2client/tokens.py - 
103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
-141
-142
-143
-144
-145
-146
-147
-148
-149
-150
-151
-152
-153
-154
-155
-156
-157
-158
-159
-160
-161
-162
-163
-164
-165
-166
-167
-168
-169
-170
-171
-172
-173
-174
-175
-176
-177
-178
-179
-180
-181
-182
-183
-184
-185
-186
-187
-188
-189
-190
-191
-192
-193
-194
-195
-196
-197
-198
-199
-200
-201
-202
-203
-204
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
-258
-259
-260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
-293
-294
-295
-296
-297
-298
-299
-300
-301
-302
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320
-321
-322
-323
-324
-325
-326
-327
-328
-329
-330
-331
-332
-333
-334
-335
-336
-337
-338
-339
-340
-341
-342
-343
-344
-345
-346
-347
-348
-349
-350
-351
-352
-353
-354
-355
-356
-357
-358
-359
-360
-361
-362
-363
-364
-365
-366
-367
-368
-369
-370
-371
-372
-373
-374
-375
-376
-377
-378
-379
-380
-381
-382
-383
-384
-385
-386
-387
-388
-389
-390
-391
-392
-393
-394
@frozen(init=False)
-class BearerToken(AccessToken):
-    """Represents a Bearer Token as returned by a Token Endpoint.
-
-    This is a wrapper around a Bearer Token and associated parameters, such as expiration date and
-    refresh token, as returned by an OAuth 2.x or OIDC 1.0 Token Endpoint.
-
-    All parameters are as returned by a Token Endpoint. The token expiration date can be passed as
-    datetime in the `expires_at` parameter, or an `expires_in` parameter, as number of seconds in
-    the future, can be passed instead.
-
-    Args:
-        access_token: an `access_token`, as returned by the AS.
-        expires_at: an expiration date. This method also accepts an `expires_in` hint as
-            returned by the AS, if any.
-        scope: a `scope`, as returned by the AS, if any.
-        refresh_token: a `refresh_token`, as returned by the AS, if any.
-        token_type: a `token_type`, as returned by the AS.
-        id_token: an `id_token`, as returned by the AS, if any.
-        **kwargs: additional parameters as returned by the AS, if any.
-
-    """
-
-    TOKEN_TYPE: ClassVar[str] = AccessTokenType.BEARER.value
-
-    access_token: str
-    expires_at: datetime | None = None
-    scope: str | None = None
-    refresh_token: str | None = None
-    token_type: str = TOKEN_TYPE
-    id_token: IdToken | jwskate.JweCompact | None = None
-    kwargs: dict[str, Any] = Factory(dict)
-
-    @accepts_expires_in
-    def __init__(
-        self,
-        access_token: str,
-        *,
-        expires_at: datetime | None = None,
-        scope: str | None = None,
-        refresh_token: str | None = None,
-        token_type: str = TOKEN_TYPE,
-        id_token: str | bytes | IdToken | jwskate.JweCompact | None = None,
-        **kwargs: Any,
-    ):
-        if token_type.title() != self.TOKEN_TYPE.title():
-            msg = f"Token Type is not '{self.TOKEN_TYPE}'!"
-            raise ValueError(msg, token_type)
-        id_token_jwt: IdToken | jwskate.JweCompact | None = None
-        if isinstance(id_token, (str, bytes)):
-            try:
-                id_token_jwt = IdToken(id_token)
-            except jwskate.InvalidJwt:
-                try:
-                    id_token_jwt = jwskate.JweCompact(id_token)
-                except jwskate.InvalidJwe:
-                    msg = "ID Token is invalid because it is  neither a JWT or a JWE."
-                    raise InvalidIdToken(msg) from None
-        else:
-            id_token_jwt = id_token
-        self.__attrs_init__(
-            access_token=access_token,
-            expires_at=expires_at,
-            scope=scope,
-            refresh_token=refresh_token,
-            token_type=token_type,
-            id_token=id_token_jwt,
-            kwargs=kwargs,
-        )
-
-    def is_expired(self, leeway: int = 0) -> bool | None:
-        """Check if the access token is expired.
-
-        Args:
-            leeway: If the token expires in the next given number of seconds,
-                then consider it expired already.
-
-        Returns:
-            One of:
-
-            - `True` if the access token is expired
-            - `False` if it is still valid
-            - `None` if there is no expires_in hint.
-
-        """
-        if self.expires_at:
-            return datetime.now(tz=timezone.utc) + timedelta(seconds=leeway) > self.expires_at
-        return None
-
-    def authorization_header(self) -> str:
-        """Return the appropriate Authorization Header value for this token.
-
-        The value is formatted correctly according to RFC6750.
-
-        Returns:
-            the value to use in an HTTP Authorization Header
-
-        """
-        return f"Bearer {self.access_token}"
-
-    def validate_id_token(self, client: OAuth2Client, azr: AuthorizationResponse) -> Self:  # noqa: C901, PLR0915
-        """Validate that a token response is valid, and return the ID Token.
-
-        This will validate the id_token as described in [OIDC 1.0
-        $3.1.3.7](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation).
-
-        If the ID Token is encrypted, this decrypts it and returns the clear-text ID Token.
-
-        """
-        if not self.id_token:
-            raise MissingIdToken()
-
-        raw_id_token = self.id_token
-
-        if isinstance(raw_id_token, jwskate.JweCompact) and client.id_token_encrypted_response_alg is None:
-            msg = "ID Token is encrypted while it should be clear-text"
-            raise InvalidIdToken(msg, self)
-        elif isinstance(raw_id_token, IdToken) and client.id_token_encrypted_response_alg is not None:
-            msg = "ID Token is clear-text while it should be encrypted"
-            raise InvalidIdToken(msg, self)
-
-        if isinstance(raw_id_token, jwskate.JweCompact):
-            enc_jwk = client.id_token_decryption_key
-            if enc_jwk is None:
-                msg = "ID Token is encrypted but client does not have a decryption key"
-                raise InvalidIdToken(msg, self)
-            nested_id_token = raw_id_token.decrypt(enc_jwk)
-            id_token = IdToken(nested_id_token)
-        else:
-            id_token = raw_id_token
-
-        if id_token.get_header("alg") is None and client.id_token_signed_response_alg is None:
-            msg = (
-                "ID Token does not contain an `alg` parameter to specify the signature"
-                " algorithm, and no algorithm has been configured for the client (using param"
-                " id_token_signed_response_alg`."
-            )
-            raise InvalidIdToken(msg)
-        elif client.id_token_signed_response_alg is not None and id_token.alg != client.id_token_signed_response_alg:
-            raise MismatchingIdTokenAlg(id_token.alg, client.id_token_signed_response_alg)
-
-        id_token_alg = id_token.alg or client.id_token_signed_response_alg
-
-        if azr.issuer and id_token.issuer != azr.issuer:
-            raise MismatchingIssuer(id_token.issuer, azr.issuer, self)
-
-        if id_token.audiences and client.client_id not in id_token.audiences:
-            raise MismatchingAudience(id_token.audiences, client.client_id, self)
-
-        if id_token.get_claim("azp") is not None and id_token.azp != client.client_id:
-            raise MismatchingAzp(id_token.azp, client.client_id, self)
-
-        if id_token.is_expired():
-            raise ExpiredIdToken(id_token)
-
-        if azr.nonce and id_token.nonce != azr.nonce:
-            raise MismatchingNonce()
-
-        if azr.acr_values and id_token.acr not in azr.acr_values:
-            raise MismatchingAcr(id_token.acr, azr.acr_values)
-
-        hash_function: Callable[[str], str]  # method used to calculate at_hash, s_hash, etc.
-
-        if id_token_alg in jwskate.SignatureAlgs.ALL_SYMMETRIC:
-            if not client.client_secret:
-                msg = "ID Token is symmetrically signed but this client does not have a Client Secret."
-                raise InvalidIdToken(msg)
-            id_token.verify_signature(jwskate.SymmetricJwk.from_bytes(client.client_secret), alg=id_token_alg)
-        elif id_token_alg in jwskate.SignatureAlgs.ALL_ASYMMETRIC:
-            if not client.authorization_server_jwks:
-                msg = "ID Token is asymmetrically signed but the Authorization Server JWKS is not available."
-                raise InvalidIdToken(msg)
-
-            if id_token.get_header("kid") is None:
-                msg = (
-                    "ID Token does not contain a Key ID (kid) to specify the asymmetric key "
-                    "to use for signature verification."
-                )
-                raise InvalidIdToken(msg)
-            try:
-                verification_jwk = client.authorization_server_jwks.get_jwk_by_kid(id_token.kid)
-            except KeyError:
-                msg = (
-                    f"ID Token is asymmetrically signed but its Key ID '{id_token.kid}' "
-                    "is not part of the Authorization Server JWKS."
-                )
-                raise InvalidIdToken(msg) from None
-
-            if id_token_alg not in verification_jwk.supported_signing_algorithms():
-                msg = "ID Token is asymmetrically signed but its algorithm is not supported by the verification key."
-                raise InvalidIdToken(msg)
-
-            id_token.verify_signature(verification_jwk, alg=id_token_alg)
-
-            hash_function = IdToken.hash_method(verification_jwk, id_token_alg)
-
-        at_hash = id_token.get_claim("at_hash")
-        if at_hash is not None:
-            expected_at_hash = hash_function(self.access_token)
-            if expected_at_hash != at_hash:
-                msg = f"Mismatching 'at_hash' value: expected '{expected_at_hash}', got '{at_hash}'"
-                raise InvalidIdToken(msg)
-
-        c_hash = id_token.get_claim("c_hash")
-        if c_hash is not None:
-            expected_c_hash = hash_function(azr.code)
-            if expected_c_hash != c_hash:
-                msg = f"Mismatching 'c_hash' value: expected '{expected_c_hash}', got '{c_hash}'"
-                raise InvalidIdToken(msg)
-
-        s_hash = id_token.get_claim("s_hash")
-        if s_hash is not None:
-            if azr.state is None:
-                msg = "ID Token has a 's_hash' claim but no state was included in the request."
-                raise InvalidIdToken(msg)
-            expected_s_hash = hash_function(azr.state)
-            if expected_s_hash != s_hash:
-                msg = f"Mismatching 's_hash' value (expected '{expected_s_hash}', got '{s_hash}'"
-                raise InvalidIdToken(msg)
-
-        if azr.max_age is not None:
-            try:
-                auth_time = id_token.auth_time
-            except AttributeError:
-                msg = (
-                    "A `max_age` parameter was included in the authorization request, "
-                    "but the ID Token does not contain an `auth_time` claim."
-                )
-                raise InvalidIdToken(msg) from None
-            auth_age = datetime.now(tz=timezone.utc) - auth_time
-            if auth_age.seconds > azr.max_age + 60:
-                msg = (
-                    "User authentication happened too long ago. The `auth_time` parameter from"
-                    " the ID Token indicate that the last Authentication Time was at"
-                    f" {auth_time} ({auth_age.seconds} sec ago), but the authorization request"
-                    f" `max_age` parameter specified that it must be maximum {azr.max_age} sec"
-                    " ago."
-                )
-                raise InvalidIdToken(msg)
-
-        return self.__class__(
-            access_token=self.access_token,
-            expires_at=self.expires_at,
-            scope=self.scope,
-            refresh_token=self.refresh_token,
-            token_type=self.token_type,
-            id_token=id_token,
-            **self.kwargs,
-        )
-
-    def __str__(self) -> str:
-        """Return the access token value, as a string.
-
-        Returns:
-            the access token string
-
-        """
-        return self.access_token
-
-    def as_dict(self) -> dict[str, Any]:
-        """Return a dict of parameters.
-
-        That is suitable for serialization or to init another BearerToken.
-
-        """
-        d = asdict(self)
-        d.pop("expires_at")
-        d["expires_in"] = self.expires_in
-        d.update(**d.pop("kwargs", {}))
-        return {key: val for key, val in d.items() if val is not None}
-
-    @property
-    def expires_in(self) -> int | None:
-        """Number of seconds until expiration."""
-        if self.expires_at:
-            return int(self.expires_at.timestamp() - datetime.now(tz=timezone.utc).timestamp())
-        return None
-
-    def __getattr__(self, key: str) -> Any:
-        """Return custom attributes from this BearerToken.
-
-        Args:
-            key: a key
-
-        Returns:
-            the associated value in this token response
-
-        Raises:
-            AttributeError: if the attribute is not found in this response.
-
-        """
-        return self.kwargs.get(key) or super().__getattribute__(key)
-
-
-
@@ -63281,8 +72661,8 @@

- expires_in: int | None - + expires_in: int | None + property @@ -63290,596 +72670,846 @@
-
- -

Number of seconds until expiration.

-
+
-
+

Number of seconds until expiration.

+
+

-
- is_expired(leeway=0) + is_expired(leeway=0)
-
- -

Check if the access token is expired.

+
+

Check if the access token is expired.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
leeway - int - -
-

If the token expires in the next given number of seconds, -then consider it expired already.

-
- 		- 0 -
- - - -

Returns:

- - - - - - - - - - - +

Parameters:

+
TypeDescription
- bool | None - -
-

One of:

-
-
+ + + + + + - - - + + + + + + + + +
NameTypeDescriptionDefault
- bool | None - -
-
    +
leeway + int + +
+

If the token expires in the next given number of seconds, +then consider it expired already.

+
+ 		+ 0 +
+ + +

Returns:

+ + + + + + + + + + + + + + + - - - - + + + + - - - - + + + + - - -
TypeDescription
+ bool | None + +
+

One of:

+
+
+ bool | None + +
+
  • True if the access token is expired
-
-
- bool | None - -
-
    +
+
+ bool | None + +
+
  • False if it is still valid
-
-
- bool | None - -
-
    +
+
+ bool | None + +
+
  • None if there is no expires_in hint.
-
-
- -
- Source code in requests_oauth2client/tokens.py - 
173
-174
-175
-176
-177
-178
-179
-180
-181
-182
-183
-184
-185
-186
-187
-188
-189
-190
def is_expired(self, leeway: int = 0) -> bool | None:
-    """Check if the access token is expired.
-
-    Args:
-        leeway: If the token expires in the next given number of seconds,
-            then consider it expired already.
-
-    Returns:
-        One of:
-
-        - `True` if the access token is expired
-        - `False` if it is still valid
-        - `None` if there is no expires_in hint.
-
-    """
-    if self.expires_at:
-        return datetime.now(tz=timezone.utc) + timedelta(seconds=leeway) > self.expires_at
-    return None
-
-
-
+
+ + + + -
+
+ Source code in requests_oauth2client/tokens.py + 
297
+298
+299
+300
+301
+302
+303
+304
+305
+306
+307
+308
+309
+310
+311
+312
+313
+314
def is_expired(self, leeway: int = 0) -> bool | None:
+    """Check if the access token is expired.
+
+    Args:
+        leeway: If the token expires in the next given number of seconds,
+            then consider it expired already.
+
+    Returns:
+        One of:
+
+        - `True` if the access token is expired
+        - `False` if it is still valid
+        - `None` if there is no expires_in hint.
+
+    """
+    if self.expires_at:
+        return datetime.now(tz=timezone.utc) + timedelta(seconds=leeway) > self.expires_at
+    return None
+
+
+
+
-
- authorization_header() + authorization_header()
-
- -

Return the appropriate Authorization Header value for this token.

+
+ +

Return the appropriate Authorization Header value for this token.

The value is formatted correctly according to RFC6750.

+

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the value to use in an HTTP Authorization Header

+
+
-

Returns:

- - - - - - - - - - - - - -
TypeDescription
- str - -
-

the value to use in an HTTP Authorization Header

-
-
- -
- Source code in requests_oauth2client/tokens.py - 
192
-193
-194
-195
-196
-197
-198
-199
-200
-201
def authorization_header(self) -> str:
-    """Return the appropriate Authorization Header value for this token.
-
-    The value is formatted correctly according to RFC6750.
-
-    Returns:
-        the value to use in an HTTP Authorization Header
-
-    """
-    return f"Bearer {self.access_token}"
-
-
-
+
+ Source code in requests_oauth2client/tokens.py + 
316
+317
+318
+319
+320
+321
+322
+323
+324
+325
def authorization_header(self) -> str:
+    """Return the appropriate Authorization Header value for this token.
+
+    The value is formatted correctly according to RFC6750.
+
+    Returns:
+        the value to use in an HTTP Authorization Header
+
+    """
+    return f"Bearer {self.access_token}"
+
+
+
-
-
- validate_id_token(client, azr) + validate_id_token(client, azr, exp_leeway=0, auth_time_leeway=10)
-
- -

Validate that a token response is valid, and return the ID Token.

+
+ +

Validate the ID Token, and return a new instance with the decrypted ID Token.

+

If the ID Token was not encrypted, the returned instance will contain the same ID Token.

This will validate the id_token as described in OIDC 1.0 $3.1.3.7.

-

If the ID Token is encrypted, this decrypts it and returns the clear-text ID Token.

- -
- Source code in requests_oauth2client/tokens.py - 
203
-204
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
-258
-259
-260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
-293
-294
-295
-296
-297
-298
-299
-300
-301
-302
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320
-321
-322
-323
-324
-325
-326
-327
-328
-329
-330
-331
-332
-333
-334
-335
-336
-337
-338
-339
-340
-341
-342
-343
-344
-345
-346
-347
-348
-349
-350
-351
def validate_id_token(self, client: OAuth2Client, azr: AuthorizationResponse) -> Self:  # noqa: C901, PLR0915
-    """Validate that a token response is valid, and return the ID Token.
-
-    This will validate the id_token as described in [OIDC 1.0
-    $3.1.3.7](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation).
-
-    If the ID Token is encrypted, this decrypts it and returns the clear-text ID Token.
-
-    """
-    if not self.id_token:
-        raise MissingIdToken()
-
-    raw_id_token = self.id_token
-
-    if isinstance(raw_id_token, jwskate.JweCompact) and client.id_token_encrypted_response_alg is None:
-        msg = "ID Token is encrypted while it should be clear-text"
-        raise InvalidIdToken(msg, self)
-    elif isinstance(raw_id_token, IdToken) and client.id_token_encrypted_response_alg is not None:
-        msg = "ID Token is clear-text while it should be encrypted"
-        raise InvalidIdToken(msg, self)
-
-    if isinstance(raw_id_token, jwskate.JweCompact):
-        enc_jwk = client.id_token_decryption_key
-        if enc_jwk is None:
-            msg = "ID Token is encrypted but client does not have a decryption key"
-            raise InvalidIdToken(msg, self)
-        nested_id_token = raw_id_token.decrypt(enc_jwk)
-        id_token = IdToken(nested_id_token)
-    else:
-        id_token = raw_id_token
-
-    if id_token.get_header("alg") is None and client.id_token_signed_response_alg is None:
-        msg = (
-            "ID Token does not contain an `alg` parameter to specify the signature"
-            " algorithm, and no algorithm has been configured for the client (using param"
-            " id_token_signed_response_alg`."
-        )
-        raise InvalidIdToken(msg)
-    elif client.id_token_signed_response_alg is not None and id_token.alg != client.id_token_signed_response_alg:
-        raise MismatchingIdTokenAlg(id_token.alg, client.id_token_signed_response_alg)
-
-    id_token_alg = id_token.alg or client.id_token_signed_response_alg
-
-    if azr.issuer and id_token.issuer != azr.issuer:
-        raise MismatchingIssuer(id_token.issuer, azr.issuer, self)
-
-    if id_token.audiences and client.client_id not in id_token.audiences:
-        raise MismatchingAudience(id_token.audiences, client.client_id, self)
-
-    if id_token.get_claim("azp") is not None and id_token.azp != client.client_id:
-        raise MismatchingAzp(id_token.azp, client.client_id, self)
-
-    if id_token.is_expired():
-        raise ExpiredIdToken(id_token)
-
-    if azr.nonce and id_token.nonce != azr.nonce:
-        raise MismatchingNonce()
-
-    if azr.acr_values and id_token.acr not in azr.acr_values:
-        raise MismatchingAcr(id_token.acr, azr.acr_values)
-
-    hash_function: Callable[[str], str]  # method used to calculate at_hash, s_hash, etc.
-
-    if id_token_alg in jwskate.SignatureAlgs.ALL_SYMMETRIC:
-        if not client.client_secret:
-            msg = "ID Token is symmetrically signed but this client does not have a Client Secret."
-            raise InvalidIdToken(msg)
-        id_token.verify_signature(jwskate.SymmetricJwk.from_bytes(client.client_secret), alg=id_token_alg)
-    elif id_token_alg in jwskate.SignatureAlgs.ALL_ASYMMETRIC:
-        if not client.authorization_server_jwks:
-            msg = "ID Token is asymmetrically signed but the Authorization Server JWKS is not available."
-            raise InvalidIdToken(msg)
-
-        if id_token.get_header("kid") is None:
-            msg = (
-                "ID Token does not contain a Key ID (kid) to specify the asymmetric key "
-                "to use for signature verification."
-            )
-            raise InvalidIdToken(msg)
-        try:
-            verification_jwk = client.authorization_server_jwks.get_jwk_by_kid(id_token.kid)
-        except KeyError:
-            msg = (
-                f"ID Token is asymmetrically signed but its Key ID '{id_token.kid}' "
-                "is not part of the Authorization Server JWKS."
-            )
-            raise InvalidIdToken(msg) from None
-
-        if id_token_alg not in verification_jwk.supported_signing_algorithms():
-            msg = "ID Token is asymmetrically signed but its algorithm is not supported by the verification key."
-            raise InvalidIdToken(msg)
-
-        id_token.verify_signature(verification_jwk, alg=id_token_alg)
-
-        hash_function = IdToken.hash_method(verification_jwk, id_token_alg)
-
-    at_hash = id_token.get_claim("at_hash")
-    if at_hash is not None:
-        expected_at_hash = hash_function(self.access_token)
-        if expected_at_hash != at_hash:
-            msg = f"Mismatching 'at_hash' value: expected '{expected_at_hash}', got '{at_hash}'"
-            raise InvalidIdToken(msg)
-
-    c_hash = id_token.get_claim("c_hash")
-    if c_hash is not None:
-        expected_c_hash = hash_function(azr.code)
-        if expected_c_hash != c_hash:
-            msg = f"Mismatching 'c_hash' value: expected '{expected_c_hash}', got '{c_hash}'"
-            raise InvalidIdToken(msg)
-
-    s_hash = id_token.get_claim("s_hash")
-    if s_hash is not None:
-        if azr.state is None:
-            msg = "ID Token has a 's_hash' claim but no state was included in the request."
-            raise InvalidIdToken(msg)
-        expected_s_hash = hash_function(azr.state)
-        if expected_s_hash != s_hash:
-            msg = f"Mismatching 's_hash' value (expected '{expected_s_hash}', got '{s_hash}'"
-            raise InvalidIdToken(msg)
-
-    if azr.max_age is not None:
-        try:
-            auth_time = id_token.auth_time
-        except AttributeError:
-            msg = (
-                "A `max_age` parameter was included in the authorization request, "
-                "but the ID Token does not contain an `auth_time` claim."
-            )
-            raise InvalidIdToken(msg) from None
-        auth_age = datetime.now(tz=timezone.utc) - auth_time
-        if auth_age.seconds > azr.max_age + 60:
-            msg = (
-                "User authentication happened too long ago. The `auth_time` parameter from"
-                " the ID Token indicate that the last Authentication Time was at"
-                f" {auth_time} ({auth_age.seconds} sec ago), but the authorization request"
-                f" `max_age` parameter specified that it must be maximum {azr.max_age} sec"
-                " ago."
-            )
-            raise InvalidIdToken(msg)
-
-    return self.__class__(
-        access_token=self.access_token,
-        expires_at=self.expires_at,
-        scope=self.scope,
-        refresh_token=self.refresh_token,
-        token_type=self.token_type,
-        id_token=id_token,
-        **self.kwargs,
-    )
-
-
-
-
+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
client + OAuth2Client + +
+

the OAuth2Client that was used to obtain this token

+
+ 		+ required +
azr + AuthorizationResponse + +
+

the AuthorizationResponse, as obtained by a call to AuthorizationRequest.validate()

+
+ 		+ required +
exp_leeway + int + +
+

a leeway, in seconds, applied to the ID Token expiration date

+
+ 		+ 0 +
auth_time_leeway + int + +
+

a leeway, in seconds, applied to the auth_time validation

+
+ 		+ 10 +
+ + +

Raises:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
TypeDescription
+ MissingIdToken + +
+

if the ID Token is missing

+
+
+ InvalidIdToken + +
+

this is a base exception class, which is raised:

+
    +
  • if the ID Token is not a JWT
    • +
  • or is encrypted while a clear-text token is expected
    • +
  • or is clear-text while an encrypted token is expected
    • +
  • if token is encrypted but client does not have a decryption key
    • +
  • if the token does not contain an alg header
    • +
+
+
+ MismatchingIdTokenAlg + +
+

if the alg header from the ID Token does not match +the expected client.id_token_signed_response_alg.

+
+
+ MismatchingIdTokenIssuer + +
+

if the iss claim from the ID Token does not match +the expected azr.issuer.

+
+
+ MismatchingIdTokenAcr + +
+

if the acr claim from the ID Token does not match +on of the expected azr.acr_values.

+
+
+ MismatchingIdTokenAudience + +
+

if the aud claim from the ID Token does not match +the expected client.client_id.

+
+
+ MismatchingIdTokenAzp + +
+

if the azp claim from the ID Token does not match +the expected client.client_id.

+
+
+ MismatchingIdTokenNonce + +
+

if the nonce claim from the ID Token does not match +the expected azr.nonce.

+
+
+ ExpiredIdToken + +
+

if the ID Token is expired at the time of the check.

+
+
+ UnsupportedIdTokenAlg + +
+

if the signature alg for the ID Token is not supported.

+
+
-
+
+ Source code in requests_oauth2client/tokens.py + 
327
+328
+329
+330
+331
+332
+333
+334
+335
+336
+337
+338
+339
+340
+341
+342
+343
+344
+345
+346
+347
+348
+349
+350
+351
+352
+353
+354
+355
+356
+357
+358
+359
+360
+361
+362
+363
+364
+365
+366
+367
+368
+369
+370
+371
+372
+373
+374
+375
+376
+377
+378
+379
+380
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391
+392
+393
+394
+395
+396
+397
+398
+399
+400
+401
+402
+403
+404
+405
+406
+407
+408
+409
+410
+411
+412
+413
+414
+415
+416
+417
+418
+419
+420
+421
+422
+423
+424
+425
+426
+427
+428
+429
+430
+431
+432
+433
+434
+435
+436
+437
+438
+439
+440
+441
+442
+443
+444
+445
+446
+447
+448
+449
+450
+451
+452
+453
+454
+455
+456
+457
+458
+459
+460
+461
+462
+463
+464
+465
+466
+467
+468
+469
+470
+471
+472
+473
+474
+475
+476
+477
+478
+479
+480
+481
+482
+483
+484
+485
+486
+487
+488
+489
+490
+491
+492
+493
+494
+495
+496
+497
+498
+499
+500
+501
+502
+503
+504
+505
+506
+507
    def validate_id_token(  # noqa: PLR0915, C901
+        self, client: OAuth2Client, azr: AuthorizationResponse, exp_leeway: int = 0, auth_time_leeway: int = 10
+    ) -> Self:
+        """Validate the ID Token, and return a new instance with the decrypted ID Token.
+
+        If the ID Token was not encrypted, the returned instance will contain the same ID Token.
+
+        This will validate the id_token as described in [OIDC 1.0
+        $3.1.3.7](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation).
+
+        Args:
+            client: the `OAuth2Client` that was used to obtain this token
+            azr: the `AuthorizationResponse`, as obtained by a call to `AuthorizationRequest.validate()`
+            exp_leeway: a leeway, in seconds, applied to the ID Token expiration date
+            auth_time_leeway: a leeway, in seconds, applied to the `auth_time` validation
+
+        Raises:
+            MissingIdToken: if the ID Token is missing
+            InvalidIdToken: this is a base exception class, which is raised:
+
+                - if the ID Token is not a JWT
+                - or is encrypted while a clear-text token is expected
+                - or is clear-text while an encrypted token is expected
+                - if token is encrypted but client does not have a decryption key
+                - if the token does not contain an `alg` header
+            MismatchingIdTokenAlg: if the `alg` header from the ID Token does not match
+                the expected `client.id_token_signed_response_alg`.
+            MismatchingIdTokenIssuer: if the `iss` claim from the ID Token does not match
+                the expected `azr.issuer`.
+            MismatchingIdTokenAcr: if the `acr` claim from the ID Token does not match
+                on of the expected `azr.acr_values`.
+            MismatchingIdTokenAudience: if the `aud` claim from the ID Token does not match
+                the expected `client.client_id`.
+            MismatchingIdTokenAzp: if the `azp` claim from the ID Token does not match
+                the expected `client.client_id`.
+            MismatchingIdTokenNonce: if the `nonce` claim from the ID Token does not match
+                the expected `azr.nonce`.
+            ExpiredIdToken: if the ID Token is expired at the time of the check.
+            UnsupportedIdTokenAlg: if the signature alg for the ID Token is not supported.
+
+        """
+        if not self.id_token:
+            raise MissingIdToken(self)
+
+        raw_id_token = self.id_token
+
+        if isinstance(raw_id_token, jwskate.JweCompact) and client.id_token_encrypted_response_alg is None:
+            msg = "token is encrypted while it should be clear-text"
+            raise InvalidIdToken(msg, self)
+        if isinstance(raw_id_token, IdToken) and client.id_token_encrypted_response_alg is not None:
+            msg = "token is clear-text while it should be encrypted"
+            raise InvalidIdToken(msg, self)
+
+        if isinstance(raw_id_token, jwskate.JweCompact):
+            enc_jwk = client.id_token_decryption_key
+            if enc_jwk is None:
+                msg = "token is encrypted but client does not have a decryption key"
+                raise InvalidIdToken(msg, self)
+            nested_id_token = raw_id_token.decrypt(enc_jwk)
+            id_token = IdToken(nested_id_token)
+        else:
+            id_token = raw_id_token
+
+        id_token_alg = id_token.get_header("alg")
+        if id_token_alg is None:
+            id_token_alg = client.id_token_signed_response_alg
+        if id_token_alg is None:
+            msg = """
+token does not contain an `alg` parameter to specify the signature algorithm,
+and no algorithm has been configured for the client (using param `id_token_signed_response_alg`).
+"""
+            raise InvalidIdToken(msg, self, id_token)
+        if client.id_token_signed_response_alg is not None and id_token_alg != client.id_token_signed_response_alg:
+            raise MismatchingIdTokenAlg(id_token.alg, client.id_token_signed_response_alg, self, id_token)
+
+        verification_jwk: jwskate.Jwk
+
+        if id_token_alg in jwskate.SignatureAlgs.ALL_SYMMETRIC:
+            if not client.client_secret:
+                msg = "token is symmetrically signed but this client does not have a Client Secret."
+                raise InvalidIdToken(msg, self, id_token)
+            verification_jwk = jwskate.SymmetricJwk.from_bytes(client.client_secret, alg=id_token_alg)
+            id_token.verify_signature(verification_jwk, alg=id_token_alg)
+        elif id_token_alg in jwskate.SignatureAlgs.ALL_ASYMMETRIC:
+            if not client.authorization_server_jwks:
+                msg = "token is asymmetrically signed but the Authorization Server JWKS is not available."
+                raise InvalidIdToken(msg, self, id_token)
+
+            if id_token.get_header("kid") is None:
+                msg = """
+token does not contain a Key ID (kid) to specify the asymmetric key
+to use for signature verification."""
+                raise InvalidIdToken(msg, self, id_token)
+            try:
+                verification_jwk = client.authorization_server_jwks.get_jwk_by_kid(id_token.kid)
+            except KeyError:
+                msg = f"""\
+token is asymmetrically signed but there is no key
+with kid='{id_token.kid}' in the Authorization Server JWKS."""
+                raise InvalidIdToken(msg, self, id_token) from None
+
+            if id_token_alg not in verification_jwk.supported_signing_algorithms():
+                msg = "token is asymmetrically signed but its algorithm is not supported by the verification key."
+                raise InvalidIdToken(msg, self, id_token)
+        else:
+            raise UnsupportedIdTokenAlg(self, id_token, id_token_alg)
+
+        id_token.verify(verification_jwk, alg=id_token_alg)
+
+        if azr.issuer and id_token.issuer != azr.issuer:
+            raise MismatchingIdTokenIssuer(id_token.issuer, azr.issuer, self, id_token)
+
+        if id_token.audiences and client.client_id not in id_token.audiences:
+            raise MismatchingIdTokenAudience(id_token.audiences, client.client_id, self, id_token)
+
+        if id_token.authorized_party is not None and id_token.authorized_party != client.client_id:
+            raise MismatchingIdTokenAzp(id_token.azp, client.client_id, self, id_token)
+
+        if id_token.is_expired(leeway=exp_leeway):
+            raise ExpiredIdToken(self, id_token)
+
+        if azr.nonce and id_token.nonce != azr.nonce:
+            raise MismatchingIdTokenNonce(id_token.nonce, azr.nonce, self, id_token)
+
+        if azr.acr_values and id_token.acr not in azr.acr_values:
+            raise MismatchingIdTokenAcr(id_token.acr, azr.acr_values, self, id_token)
+
+        hash_function = IdToken.hash_method(verification_jwk, id_token_alg)
+
+        at_hash = id_token.get_claim("at_hash")
+        if at_hash is not None:
+            expected_at_hash = hash_function(self.access_token)
+            if expected_at_hash != at_hash:
+                msg = f"mismatching 'at_hash' value (expected '{expected_at_hash}', got '{at_hash}')"
+                raise InvalidIdToken(msg, self, id_token)
+
+        c_hash = id_token.get_claim("c_hash")
+        if c_hash is not None:
+            expected_c_hash = hash_function(azr.code)
+            if expected_c_hash != c_hash:
+                msg = f"mismatching 'c_hash' value (expected '{expected_c_hash}', got '{c_hash}')"
+                raise InvalidIdToken(msg, self, id_token)
+
+        s_hash = id_token.get_claim("s_hash")
+        if s_hash is not None:
+            if azr.state is None:
+                msg = "token has a 's_hash' claim but no state was included in the request."
+                raise InvalidIdToken(msg, self, id_token)
+            expected_s_hash = hash_function(azr.state)
+            if expected_s_hash != s_hash:
+                msg = f"mismatching 's_hash' value (expected '{expected_s_hash}', got '{s_hash}')"
+                raise InvalidIdToken(msg, self, id_token)
+
+        if azr.max_age is not None:
+            auth_time = id_token.auth_datetime
+            if auth_time is None:
+                msg = """
+a `max_age` parameter was included in the authorization request,
+but the ID Token does not contain an `auth_time` claim.
+"""
+                raise InvalidIdToken(msg, self, id_token) from None
+            auth_age = datetime.now(tz=timezone.utc) - auth_time
+            if auth_age.total_seconds() > azr.max_age + auth_time_leeway:
+                msg = f"""
+user authentication happened too far in the past.
+The `auth_time` parameter from the ID Token indicate that
+the last Authentication Time was at {auth_time} ({auth_age.total_seconds()} sec ago),
+but the authorization request `max_age` parameter specified that it must
+be a maximum of {azr.max_age} sec ago.
+"""
+                raise InvalidIdToken(msg, self, id_token)
+
+        return self.__class__(
+            access_token=self.access_token,
+            expires_at=self.expires_at,
+            scope=self.scope,
+            refresh_token=self.refresh_token,
+            token_type=self.token_type,
+            id_token=id_token,
+            **self.kwargs,
+        )
+
+
+
+ +
+
- as_dict() + as_dict()
-
- -

Return a dict of parameters.

+
+ +

Return a dict of parameters.

That is suitable for serialization or to init another BearerToken.

-
- Source code in requests_oauth2client/tokens.py - 
362
-363
-364
-365
-366
-367
-368
-369
-370
-371
-372
def as_dict(self) -> dict[str, Any]:
-    """Return a dict of parameters.
-
-    That is suitable for serialization or to init another BearerToken.
-
-    """
-    d = asdict(self)
-    d.pop("expires_at")
-    d["expires_in"] = self.expires_in
-    d.update(**d.pop("kwargs", {}))
-    return {key: val for key, val in d.items() if val is not None}
-
-
-
+
+ Source code in requests_oauth2client/tokens.py + 
518
+519
+520
+521
+522
+523
+524
+525
+526
+527
+528
def as_dict(self) -> dict[str, Any]:
+    """Return a dict of parameters.
+
+    That is suitable for serialization or to init another BearerToken.
+
+    """
+    d = asdict(self)
+    d.pop("expires_at")
+    d["expires_in"] = self.expires_in
+    d.update(**d.pop("kwargs", {}))
+    return {key: val for key, val in d.items() if val is not None}
+
+
+
@@ -63887,8 +73517,7 @@
- BearerTokenSerializer + BearerTokenSerializer
-
+
- -

A helper class to serialize Token Response returned by an AS.

+ +

A helper class to serialize Token Response returned by an AS.

This may be used to store BearerTokens in session or cookies.

It needs a dumper and a loader functions that will respectively serialize and deserialize BearerTokens. Default implementations are provided with use gzip and base64url on the serialized JSON representation.

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
dumper + Callable[[BearerToken], str] | None + +
+

a function to serialize a token into a str.

+
+ 		+ None +
loader + Callable[[str], BearerToken] | None + +
+

a function to deserialize a serialized token representation.

+
+ 		+ None +
+ +
+ Source code in requests_oauth2client/tokens.py + 
579
+580
+581
+582
+583
+584
+585
+586
+587
+588
+589
+590
+591
+592
+593
+594
+595
+596
+597
+598
+599
+600
+601
+602
+603
+604
+605
+606
+607
+608
+609
+610
+611
+612
+613
+614
+615
+616
+617
+618
+619
+620
+621
+622
+623
+624
+625
+626
+627
+628
+629
+630
+631
+632
+633
+634
+635
+636
+637
+638
+639
+640
+641
+642
+643
+644
+645
+646
+647
+648
+649
+650
+651
+652
+653
+654
+655
+656
+657
+658
+659
+660
class BearerTokenSerializer:
+    """A helper class to serialize Token Response returned by an AS.
+
+    This may be used to store BearerTokens in session or cookies.
+
+    It needs a `dumper` and a `loader` functions that will respectively serialize and deserialize
+    BearerTokens. Default implementations are provided with use gzip and base64url on the serialized
+    JSON representation.
+
+    Args:
+        dumper: a function to serialize a token into a `str`.
+        loader: a function to deserialize a serialized token representation.
+
+    """
+
+    def __init__(
+        self,
+        dumper: Callable[[BearerToken], str] | None = None,
+        loader: Callable[[str], BearerToken] | None = None,
+    ) -> None:
+        self.dumper = dumper or self.default_dumper
+        self.loader = loader or self.default_loader
+
+    @staticmethod
+    def default_dumper(token: BearerToken) -> str:
+        """Serialize a token as JSON, then compress with deflate, then encodes as base64url.
+
+        Args:
+            token: the `BearerToken` to serialize
+
+        Returns:
+            the serialized value
+
+        """
+        d = asdict(token)
+        d.update(**d.pop("kwargs", {}))
+        return (
+            BinaPy.serialize_to("json", {k: w for k, w in d.items() if w is not None}).to("deflate").to("b64u").ascii()
+        )
+
+    def default_loader(self, serialized: str, token_class: type[BearerToken] = BearerToken) -> BearerToken:
+        """Deserialize a BearerToken.
+
+        This does the opposite operations than `default_dumper`.
+
+        Args:
+            serialized: the serialized token
+            token_class: class to use to deserialize the Token
+
+        Returns:
+            a BearerToken
+
+        """
+        attrs = BinaPy(serialized).decode_from("b64u").decode_from("deflate").parse_from("json")
+        expires_at = attrs.get("expires_at")
+        if expires_at:
+            attrs["expires_at"] = datetime.fromtimestamp(expires_at, tz=timezone.utc)
+        return token_class(**attrs)
+
+    def dumps(self, token: BearerToken) -> str:
+        """Serialize and compress a given token for easier storage.
+
+        Args:
+            token: a BearerToken to serialize
+
+        Returns:
+            the serialized token, as a str
+
+        """
+        return self.dumper(token)
+
+    def loads(self, serialized: str) -> BearerToken:
+        """Deserialize a serialized token.
+
+        Args:
+            serialized: the serialized token
+
+        Returns:
+            the deserialized token
+
+        """
+        return self.loader(serialized)
+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
dumper - Callable[[BearerToken], str] | None - -
-

a function to serialize a token into a str.

-
- 		- None -
loader - Callable[[str], BearerToken] | None - -
-

a function to deserialize a serialized token representation.

-
- 		- None -
- -
- Source code in requests_oauth2client/tokens.py - 
397
-398
-399
-400
-401
-402
-403
-404
-405
-406
-407
-408
-409
-410
-411
-412
-413
-414
-415
-416
-417
-418
-419
-420
-421
-422
-423
-424
-425
-426
-427
-428
-429
-430
-431
-432
-433
-434
-435
-436
-437
-438
-439
-440
-441
-442
-443
-444
-445
-446
-447
-448
-449
-450
-451
-452
-453
-454
-455
-456
-457
-458
-459
-460
-461
-462
-463
-464
-465
-466
-467
-468
-469
-470
-471
-472
-473
-474
class BearerTokenSerializer:
-    """A helper class to serialize Token Response returned by an AS.
-
-    This may be used to store BearerTokens in session or cookies.
-
-    It needs a `dumper` and a `loader` functions that will respectively serialize and deserialize
-    BearerTokens. Default implementations are provided with use gzip and base64url on the serialized
-    JSON representation.
-
-    Args:
-        dumper: a function to serialize a token into a `str`.
-        loader: a function to deserialize a serialized token representation.
-
-    """
-
-    def __init__(
-        self,
-        dumper: Callable[[BearerToken], str] | None = None,
-        loader: Callable[[str], BearerToken] | None = None,
-    ):
-        self.dumper = dumper or self.default_dumper
-        self.loader = loader or self.default_loader
-
-    @staticmethod
-    def default_dumper(token: BearerToken) -> str:
-        """Serialize a token as JSON, then compress with deflate, then encodes as base64url.
-
-        Args:
-            token: the `BearerToken` to serialize
-
-        Returns:
-            the serialized value
-
-        """
-        return BinaPy.serialize_to("json", token.as_dict()).to("deflate").to("b64u").ascii()
-
-    def default_loader(self, serialized: str, token_class: type[BearerToken] = BearerToken) -> BearerToken:
-        """Deserialize a BearerToken.
-
-        This does the opposite operations than `default_dumper`.
-
-        Args:
-            serialized: the serialized token
-            token_class: class to use to deserialize the Token
-
-        Returns:
-            a BearerToken
-
-        """
-        attrs = BinaPy(serialized).decode_from("b64u").decode_from("deflate").parse_from("json")
-        expires_at = attrs.get("expires_at")
-        if expires_at:
-            attrs["expires_at"] = datetime.fromtimestamp(expires_at, tz=timezone.utc)
-        return token_class(**attrs)
-
-    def dumps(self, token: BearerToken) -> str:
-        """Serialize and compress a given token for easier storage.
-
-        Args:
-            token: a BearerToken to serialize
-
-        Returns:
-            the serialized token, as a str
-
-        """
-        return self.dumper(token)
-
-    def loads(self, serialized: str) -> BearerToken:
-        """Deserialize a serialized token.
-
-        Args:
-            serialized: the serialized token
-
-        Returns:
-            the deserialized token
-
-        """
-        return self.loader(serialized)
-
-
-
@@ -64128,14 +73764,12 @@

-

- default_dumper(token) - + default_dumper(token) + staticmethod @@ -64143,455 +73777,417 @@
-
- -

Serialize a token as JSON, then compress with deflate, then encodes as base64url.

+
+

Serialize a token as JSON, then compress with deflate, then encodes as base64url.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
token - BearerToken - -
-

the BearerToken to serialize

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - +

Parameters:

+
TypeDescription
- str - -
-

the serialized value

-
-
+ + + + + + - -
NameTypeDescriptionDefault
- -
- Source code in requests_oauth2client/tokens.py - 
420
-421
-422
-423
-424
-425
-426
-427
-428
-429
-430
-431
@staticmethod
-def default_dumper(token: BearerToken) -> str:
-    """Serialize a token as JSON, then compress with deflate, then encodes as base64url.
-
-    Args:
-        token: the `BearerToken` to serialize
-
-    Returns:
-        the serialized value
-
-    """
-    return BinaPy.serialize_to("json", token.as_dict()).to("deflate").to("b64u").ascii()
-
-
-
+ + + + token + + BearerToken + + +
+

the BearerToken to serialize

+
+ + + required + + + + + + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the serialized value

+
+
-
+
+ Source code in requests_oauth2client/tokens.py + 
602
+603
+604
+605
+606
+607
+608
+609
+610
+611
+612
+613
+614
+615
+616
+617
@staticmethod
+def default_dumper(token: BearerToken) -> str:
+    """Serialize a token as JSON, then compress with deflate, then encodes as base64url.
+
+    Args:
+        token: the `BearerToken` to serialize
+
+    Returns:
+        the serialized value
+
+    """
+    d = asdict(token)
+    d.update(**d.pop("kwargs", {}))
+    return (
+        BinaPy.serialize_to("json", {k: w for k, w in d.items() if w is not None}).to("deflate").to("b64u").ascii()
+    )
+
+
+
+
-
- default_loader(serialized, token_class=BearerToken) + default_loader(serialized, token_class=BearerToken)
-
- -

Deserialize a BearerToken.

+
+ +

Deserialize a BearerToken.

This does the opposite operations than default_dumper.

+

Parameters:

+ + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionDefault
serialized + str + +
+

the serialized token

+
+ 		+ required +
token_class + type[BearerToken] + +
+

class to use to deserialize the Token

+
+ 		+ BearerToken +
+ + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

a BearerToken

+
+
-

Parameters:

- - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
serialized - str - -
-

the serialized token

-
- 		- required -
token_class - type[BearerToken] - -
-

class to use to deserialize the Token

-
- 		- BearerToken -
- - - -

Returns:

- - - - - - - - - - - - - -
TypeDescription
- BearerToken - -
-

a BearerToken

-
-
- -
- Source code in requests_oauth2client/tokens.py - 
433
-434
-435
-436
-437
-438
-439
-440
-441
-442
-443
-444
-445
-446
-447
-448
-449
-450
def default_loader(self, serialized: str, token_class: type[BearerToken] = BearerToken) -> BearerToken:
-    """Deserialize a BearerToken.
-
-    This does the opposite operations than `default_dumper`.
-
-    Args:
-        serialized: the serialized token
-        token_class: class to use to deserialize the Token
-
-    Returns:
-        a BearerToken
-
-    """
-    attrs = BinaPy(serialized).decode_from("b64u").decode_from("deflate").parse_from("json")
-    expires_at = attrs.get("expires_at")
-    if expires_at:
-        attrs["expires_at"] = datetime.fromtimestamp(expires_at, tz=timezone.utc)
-    return token_class(**attrs)
-
-
-
+
+ Source code in requests_oauth2client/tokens.py + 
619
+620
+621
+622
+623
+624
+625
+626
+627
+628
+629
+630
+631
+632
+633
+634
+635
+636
def default_loader(self, serialized: str, token_class: type[BearerToken] = BearerToken) -> BearerToken:
+    """Deserialize a BearerToken.
+
+    This does the opposite operations than `default_dumper`.
+
+    Args:
+        serialized: the serialized token
+        token_class: class to use to deserialize the Token
+
+    Returns:
+        a BearerToken
+
+    """
+    attrs = BinaPy(serialized).decode_from("b64u").decode_from("deflate").parse_from("json")
+    expires_at = attrs.get("expires_at")
+    if expires_at:
+        attrs["expires_at"] = datetime.fromtimestamp(expires_at, tz=timezone.utc)
+    return token_class(**attrs)
+
+
+
-
-
- dumps(token) + dumps(token)
-
- -

Serialize and compress a given token for easier storage.

+
+

Serialize and compress a given token for easier storage.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
token - BearerToken - -
-

a BearerToken to serialize

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - +

Parameters:

+
TypeDescription
- str - -
-

the serialized token, as a str

-
-
+ + + + + + - -
NameTypeDescriptionDefault
- -
- Source code in requests_oauth2client/tokens.py - 
452
-453
-454
-455
-456
-457
-458
-459
-460
-461
-462
def dumps(self, token: BearerToken) -> str:
-    """Serialize and compress a given token for easier storage.
-
-    Args:
-        token: a BearerToken to serialize
-
-    Returns:
-        the serialized token, as a str
-
-    """
-    return self.dumper(token)
-
-
-
+ + + + token + + BearerToken + + +
+

a BearerToken to serialize

+
+ + + required + + + + + + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ str + +
+

the serialized token, as a str

+
+
-
+
+ Source code in requests_oauth2client/tokens.py + 
638
+639
+640
+641
+642
+643
+644
+645
+646
+647
+648
def dumps(self, token: BearerToken) -> str:
+    """Serialize and compress a given token for easier storage.
+
+    Args:
+        token: a BearerToken to serialize
+
+    Returns:
+        the serialized token, as a str
+
+    """
+    return self.dumper(token)
+
+
+
+
-
- loads(serialized) + loads(serialized)
-
- -

Deserialize a serialized token.

+
+

Deserialize a serialized token.

-

Parameters:

- - - - - - - - - - - - - - - - - -
NameTypeDescriptionDefault
serialized - str - -
-

the serialized token

-
- 		- required -
- - - -

Returns:

- - - - - - - - - - - +

Parameters:

+
TypeDescription
- BearerToken - -
-

the deserialized token

-
-
+ + + + + + - -
NameTypeDescriptionDefault
- -
- Source code in requests_oauth2client/tokens.py - 
464
-465
-466
-467
-468
-469
-470
-471
-472
-473
-474
def loads(self, serialized: str) -> BearerToken:
-    """Deserialize a serialized token.
-
-    Args:
-        serialized: the serialized token
-
-    Returns:
-        the deserialized token
-
-    """
-    return self.loader(serialized)
-
-
-
- -
- - - -
- -
+ + + + serialized + + str + + +
+

the serialized token

+
+ + + required + + + + + + +

Returns:

+ + + + + + + + + + + + + +
TypeDescription
+ BearerToken + +
+

the deserialized token

+
+
+
+ Source code in requests_oauth2client/tokens.py + 
650
+651
+652
+653
+654
+655
+656
+657
+658
+659
+660
def loads(self, serialized: str) -> BearerToken:
+    """Deserialize a serialized token.
+
+    Args:
+        serialized: the serialized token
+
+    Returns:
+        the deserialized token
+
+    """
+    return self.loader(serialized)
+
+
+
-
- - - -

- DPoPToken -

- - -
-

- Bases: AccessToken

- - -

Represents a DPoP Token.

- -
- Source code in requests_oauth2client/tokens.py - 
477
-478
class DPoPToken(AccessToken):
-    """Represents a DPoP Token."""
-
-
-
+
@@ -64600,7 +74196,7 @@

-
+
@@ -64609,18 +74205,18 @@

- vendor_specific + vendor_specific

-
- -

Vendor-specific utilities.

+
+ +

Vendor-specific utilities.

This module contains vendor-specific subclasses of [requests_oauth2client] classes, that make it easier to work with specific OAuth 2.x providers and/or fix compatibility issues.

- +
@@ -64636,278 +74232,266 @@

- Auth0 + Auth0

-
+
+ + +

Auth0-related utilities.

+ +
+ Source code in requests_oauth2client/vendor_specific/auth0.py + 
 14
+ 15
+ 16
+ 17
+ 18
+ 19
+ 20
+ 21
+ 22
+ 23
+ 24
+ 25
+ 26
+ 27
+ 28
+ 29
+ 30
+ 31
+ 32
+ 33
+ 34
+ 35
+ 36
+ 37
+ 38
+ 39
+ 40
+ 41
+ 42
+ 43
+ 44
+ 45
+ 46
+ 47
+ 48
+ 49
+ 50
+ 51
+ 52
+ 53
+ 54
+ 55
+ 56
+ 57
+ 58
+ 59
+ 60
+ 61
+ 62
+ 63
+ 64
+ 65
+ 66
+ 67
+ 68
+ 69
+ 70
+ 71
+ 72
+ 73
+ 74
+ 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
+126
+127
+128
+129
+130
+131
+132
+133
+134
+135
class Auth0:
+    """Auth0-related utilities."""
+
+    @classmethod
+    def tenant(cls, tenant: str) -> str:
+        """Given a short tenant name, returns the full tenant FQDN."""
+        if not tenant:
+            msg = "You must specify a tenant name."
+            raise ValueError(msg)
+        if "." not in tenant or tenant.endswith((".eu", ".us", ".au", ".jp")):
+            tenant = f"{tenant}.auth0.com"
+        if "://" in tenant:
+            if tenant.startswith("https://"):
+                return tenant[8:]
+            msg = (
+                "Invalid tenant name. "
+                "It must be a tenant name like 'mytenant.myregion' "
+                "or a full FQDN like 'mytenant.myregion.auth0.com'."
+                "or an issuer like 'https://mytenant.myregion.auth0.com'"
+            )
+            raise ValueError(msg)
+        return tenant
+
+    @classmethod
+    def client(
+        cls,
+        tenant: str,
+        auth: (
+            requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
+        ) = None,
+        *,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_jwk: Any | None = None,
+        session: requests.Session | None = None,
+        **kwargs: Any,
+    ) -> OAuth2Client:
+        """Initialise an OAuth2Client for an Auth0 tenant."""
+        tenant = cls.tenant(tenant)
+        issuer = f"https://{tenant}"
+        token_endpoint = f"{issuer}/oauth/token"
+        authorization_endpoint = f"{issuer}/authorize"
+        revocation_endpoint = f"{issuer}/oauth/revoke"
+        userinfo_endpoint = f"{issuer}/userinfo"
+        jwks_uri = f"{issuer}/.well-known/jwks.json"
+
+        return OAuth2Client(
+            auth=auth,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_jwk=private_jwk,
+            session=session,
+            token_endpoint=token_endpoint,
+            authorization_endpoint=authorization_endpoint,
+            revocation_endpoint=revocation_endpoint,
+            userinfo_endpoint=userinfo_endpoint,
+            issuer=issuer,
+            jwks_uri=jwks_uri,
+            **kwargs,
+        )
+
+    @classmethod
+    def management_api_client(
+        cls,
+        tenant: str,
+        auth: (
+            requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
+        ) = None,
+        *,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_jwk: Any | None = None,
+        session: requests.Session | None = None,
+        **kwargs: Any,
+    ) -> ApiClient:
+        """Initialize a client for the Auth0 Management API.
+
+        See [Auth0 Management API v2](https://auth0.com/docs/api/management/v2). You must provide the
+        target tenant name and the credentials for a client that is allowed access to the Management
+        API.
+
+        Args:
+            tenant: the tenant name.
+                Same definition as for [Auth0.client][requests_oauth2client.vendor_specific.auth0.Auth0.client]
+            auth: client credentials.
+                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+            client_id: the Client ID.
+                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+            client_secret: the Client Secret.
+                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+            private_jwk: the private key to use for client authentication.
+                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+            session: requests session.
+                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+            **kwargs: additional kwargs to pass to the ApiClient base class
+
+        Example:
+            ```python
+            from requests_oauth2client.vendor_specific import Auth0
+
+            a0mgmt = Auth0.management_api_client("mytenant.eu", client_id=client_id, client_secret=client_secret)
+            users = a0mgmt.get("users", params={"page": 0, "per_page": 100})
+            ```
+
+        """
+        tenant = cls.tenant(tenant)
+        client = cls.client(
+            tenant,
+            auth=auth,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_jwk=private_jwk,
+            session=session,
+        )
+        audience = f"https://{tenant}/api/v2/"
+        api_auth = OAuth2ClientCredentialsAuth(client, audience=audience)
+        return ApiClient(
+            base_url=audience,
+            auth=api_auth,
+            session=session,
+            **kwargs,
+        )
+
+
- -

Auth0-related utilities.

- -
- Source code in requests_oauth2client/vendor_specific/auth0.py - 
 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
class Auth0:
-    """Auth0-related utilities."""
-
-    @classmethod
-    def tenant(cls, tenant: str) -> str:
-        """Given a short tenant name, returns the full tenant FQDN."""
-        if not tenant:
-            msg = "You must specify a tenant name."
-            raise ValueError(msg)
-        if (
-            "." not in tenant
-            or tenant.endswith(".eu")
-            or tenant.endswith(".us")
-            or tenant.endswith(".au")
-            or tenant.endswith(".jp")
-        ):
-            tenant = f"{tenant}.auth0.com"
-        if "://" in tenant:
-            if tenant.startswith("https://"):
-                return tenant[8:]
-            msg = (
-                "Invalid tenant name. "
-                "It must be a tenant name like 'mytenant.myregion' "
-                "or a full FQDN like 'mytenant.myregion.auth0.com'."
-                "or an issuer like 'https://mytenant.myregion.auth0.com'"
-            )
-            raise ValueError(msg)
-        return tenant
-
-    @classmethod
-    def client(
-        cls,
-        tenant: str,
-        auth: (
-            requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
-        ) = None,
-        *,
-        client_id: str | None = None,
-        client_secret: str | None = None,
-        private_jwk: Any | None = None,
-        session: requests.Session | None = None,
-        **kwargs: Any,
-    ) -> OAuth2Client:
-        """Initialise an OAuth2Client for an Auth0 tenant."""
-        tenant = cls.tenant(tenant)
-        issuer = f"https://{tenant}"
-        token_endpoint = f"{issuer}/oauth/token"
-        authorization_endpoint = f"{issuer}/authorize"
-        revocation_endpoint = f"{issuer}/oauth/revoke"
-        userinfo_endpoint = f"{issuer}/userinfo"
-        jwks_uri = f"{issuer}/.well-known/jwks.json"
-
-        return OAuth2Client(
-            auth=auth,
-            client_id=client_id,
-            client_secret=client_secret,
-            private_jwk=private_jwk,
-            session=session,
-            token_endpoint=token_endpoint,
-            authorization_endpoint=authorization_endpoint,
-            revocation_endpoint=revocation_endpoint,
-            userinfo_endpoint=userinfo_endpoint,
-            issuer=issuer,
-            jwks_uri=jwks_uri,
-            **kwargs,
-        )
-
-    @classmethod
-    def management_api_client(
-        cls,
-        tenant: str,
-        auth: (
-            requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
-        ) = None,
-        *,
-        client_id: str | None = None,
-        client_secret: str | None = None,
-        private_jwk: Any | None = None,
-        session: requests.Session | None = None,
-        **kwargs: Any,
-    ) -> ApiClient:
-        """Initialize a client for the Auth0 Management API.
-
-        See [Auth0 Management API v2](https://auth0.com/docs/api/management/v2). You must provide the
-        target tenant name and the credentials for a client that is allowed access to the Management
-        API.
-
-        Args:
-            tenant: the tenant name.
-                Same definition as for [Auth0.client][requests_oauth2client.vendor_specific.auth0.Auth0.client]
-            auth: client credentials.
-                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-            client_id: the Client ID.
-                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-            client_secret: the Client Secret.
-                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-            private_jwk: the private key to use for client authentication.
-                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-            session: requests session.
-                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-            **kwargs: additional kwargs to pass to the ApiClient base class
-
-        Usage:
-            ```python
-            from requests_oauth2client.vendor_specific import Auth0
-
-            a0mgmt = Auth0.management_api_client("mytenant.eu", client_id=client_id, client_secret=client_secret)
-            users = a0mgmt.get("users", params={"page": 0, "per_page": 100})
-            ```
-
-        """
-        tenant = cls.tenant(tenant)
-        client = cls.client(
-            tenant,
-            auth=auth,
-            client_id=client_id,
-            client_secret=client_secret,
-            private_jwk=private_jwk,
-            session=session,
-        )
-        audience = f"https://{tenant}/api/v2/"
-        api_auth = OAuth2ClientCredentialsAuth(client, audience=audience)
-        return ApiClient(
-            base_url=audience,
-            auth=api_auth,
-            session=session,
-            **kwargs,
-        )
-
-
-
@@ -64919,14 +74503,12 @@

-
-
- tenant(tenant) - + tenant(tenant) + classmethod @@ -64934,75 +74516,61 @@
-
- -

Given a short tenant name, returns the full tenant FQDN.

- -
- Source code in requests_oauth2client/vendor_specific/auth0.py - 
16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
@classmethod
-def tenant(cls, tenant: str) -> str:
-    """Given a short tenant name, returns the full tenant FQDN."""
-    if not tenant:
-        msg = "You must specify a tenant name."
-        raise ValueError(msg)
-    if (
-        "." not in tenant
-        or tenant.endswith(".eu")
-        or tenant.endswith(".us")
-        or tenant.endswith(".au")
-        or tenant.endswith(".jp")
-    ):
-        tenant = f"{tenant}.auth0.com"
-    if "://" in tenant:
-        if tenant.startswith("https://"):
-            return tenant[8:]
-        msg = (
-            "Invalid tenant name. "
-            "It must be a tenant name like 'mytenant.myregion' "
-            "or a full FQDN like 'mytenant.myregion.auth0.com'."
-            "or an issuer like 'https://mytenant.myregion.auth0.com'"
-        )
-        raise ValueError(msg)
-    return tenant
-
-
-
+
-
+

Given a short tenant name, returns the full tenant FQDN.

+ +
+ Source code in requests_oauth2client/vendor_specific/auth0.py + 
17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
@classmethod
+def tenant(cls, tenant: str) -> str:
+    """Given a short tenant name, returns the full tenant FQDN."""
+    if not tenant:
+        msg = "You must specify a tenant name."
+        raise ValueError(msg)
+    if "." not in tenant or tenant.endswith((".eu", ".us", ".au", ".jp")):
+        tenant = f"{tenant}.auth0.com"
+    if "://" in tenant:
+        if tenant.startswith("https://"):
+            return tenant[8:]
+        msg = (
+            "Invalid tenant name. "
+            "It must be a tenant name like 'mytenant.myregion' "
+            "or a full FQDN like 'mytenant.myregion.auth0.com'."
+            "or an issuer like 'https://mytenant.myregion.auth0.com'"
+        )
+        raise ValueError(msg)
+    return tenant
+
+
+
+

-
- client(tenant, auth=None, *, client_id=None, client_secret=None, private_jwk=None, session=None, **kwargs) - + client(tenant, auth=None, *, client_id=None, client_secret=None, private_jwk=None, session=None, **kwargs) + classmethod @@ -65010,99 +74578,97 @@
-
- -

Initialise an OAuth2Client for an Auth0 tenant.

- -
- Source code in requests_oauth2client/vendor_specific/auth0.py - 
42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
-76
-77
-78
@classmethod
-def client(
-    cls,
-    tenant: str,
-    auth: (
-        requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
-    ) = None,
-    *,
-    client_id: str | None = None,
-    client_secret: str | None = None,
-    private_jwk: Any | None = None,
-    session: requests.Session | None = None,
-    **kwargs: Any,
-) -> OAuth2Client:
-    """Initialise an OAuth2Client for an Auth0 tenant."""
-    tenant = cls.tenant(tenant)
-    issuer = f"https://{tenant}"
-    token_endpoint = f"{issuer}/oauth/token"
-    authorization_endpoint = f"{issuer}/authorize"
-    revocation_endpoint = f"{issuer}/oauth/revoke"
-    userinfo_endpoint = f"{issuer}/userinfo"
-    jwks_uri = f"{issuer}/.well-known/jwks.json"
-
-    return OAuth2Client(
-        auth=auth,
-        client_id=client_id,
-        client_secret=client_secret,
-        private_jwk=private_jwk,
-        session=session,
-        token_endpoint=token_endpoint,
-        authorization_endpoint=authorization_endpoint,
-        revocation_endpoint=revocation_endpoint,
-        userinfo_endpoint=userinfo_endpoint,
-        issuer=issuer,
-        jwks_uri=jwks_uri,
-        **kwargs,
-    )
-
-
-
+
-
+

Initialise an OAuth2Client for an Auth0 tenant.

+ +
+ Source code in requests_oauth2client/vendor_specific/auth0.py + 
37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
+69
+70
+71
+72
+73
@classmethod
+def client(
+    cls,
+    tenant: str,
+    auth: (
+        requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
+    ) = None,
+    *,
+    client_id: str | None = None,
+    client_secret: str | None = None,
+    private_jwk: Any | None = None,
+    session: requests.Session | None = None,
+    **kwargs: Any,
+) -> OAuth2Client:
+    """Initialise an OAuth2Client for an Auth0 tenant."""
+    tenant = cls.tenant(tenant)
+    issuer = f"https://{tenant}"
+    token_endpoint = f"{issuer}/oauth/token"
+    authorization_endpoint = f"{issuer}/authorize"
+    revocation_endpoint = f"{issuer}/oauth/revoke"
+    userinfo_endpoint = f"{issuer}/userinfo"
+    jwks_uri = f"{issuer}/.well-known/jwks.json"
+
+    return OAuth2Client(
+        auth=auth,
+        client_id=client_id,
+        client_secret=client_secret,
+        private_jwk=private_jwk,
+        session=session,
+        token_endpoint=token_endpoint,
+        authorization_endpoint=authorization_endpoint,
+        revocation_endpoint=revocation_endpoint,
+        userinfo_endpoint=userinfo_endpoint,
+        issuer=issuer,
+        jwks_uri=jwks_uri,
+        **kwargs,
+    )
+
+
+
+
-
- management_api_client(tenant, auth=None, *, client_id=None, client_secret=None, private_jwk=None, session=None, **kwargs) - + management_api_client(tenant, auth=None, *, client_id=None, client_secret=None, private_jwk=None, session=None, **kwargs) + classmethod @@ -65110,270 +74676,270 @@
-
- -

Initialize a client for the Auth0 Management API.

+
+ +

Initialize a client for the Auth0 Management API.

See Auth0 Management API v2. You must provide the target tenant name and the credentials for a client that is allowed access to the Management API.

- -

Parameters:

- - - - - - - - - - - - - - + + + + + + + + + +
NameTypeDescriptionDefault
tenant - str - -
-

the tenant name. +

Parameters:

+ + + + + + + + + + + + + + - - - - - - + + + + + + - - - - - - + + + + + + - - - - - - + + + + + + - - - - - - + + + + + + - - - - - - + + + + + + - - - - - - - - - -
NameTypeDescriptionDefault
tenant + str + +
+

the tenant name. Same definition as for Auth0.client

-
- 		- required -
auth - AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None - -
-

client credentials. +

+ 		+ required +
auth + AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None + +
+

client credentials. Same definition as for OAuth2Client

-
- 		- None -
client_id - str | None - -
-

the Client ID. +

+ 		+ None +
client_id + str | None + +
+

the Client ID. Same definition as for OAuth2Client

-
- 		- None -
client_secret - str | None - -
-

the Client Secret. +

+ 		+ None +
client_secret + str | None + +
+

the Client Secret. Same definition as for OAuth2Client

-
- 		- None -
private_jwk - Any | None - -
-

the private key to use for client authentication. +

+ 		+ None +
private_jwk + Any | None + +
+

the private key to use for client authentication. Same definition as for OAuth2Client

-
- 		- None -
session - Session | None - -
-

requests session. +

+ 		+ None +
session + Session | None + +
+

requests session. Same definition as for OAuth2Client

-
- 		- None -
**kwargs - Any - -
-

additional kwargs to pass to the ApiClient base class

-
- 		- {} -
- -
- Usage - 
1
-2
-3
-4
from requests_oauth2client.vendor_specific import Auth0
-
-a0mgmt = Auth0.management_api_client("mytenant.eu", client_id=client_id, client_secret=client_secret)
-users = a0mgmt.get("users", params={"page": 0, "per_page": 100})
-
+
+ 		+ None +
**kwargs + Any + +
+

additional kwargs to pass to the ApiClient base class

+
+ 		+ {} +
+ + +
+ Example + 
1
+2
+3
+4
from requests_oauth2client.vendor_specific import Auth0
+
+a0mgmt = Auth0.management_api_client("mytenant.eu", client_id=client_id, client_secret=client_secret)
+users = a0mgmt.get("users", params={"page": 0, "per_page": 100})
+
-
- Source code in requests_oauth2client/vendor_specific/auth0.py - 
 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
@classmethod
-def management_api_client(
-    cls,
-    tenant: str,
-    auth: (
-        requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
-    ) = None,
-    *,
-    client_id: str | None = None,
-    client_secret: str | None = None,
-    private_jwk: Any | None = None,
-    session: requests.Session | None = None,
-    **kwargs: Any,
-) -> ApiClient:
-    """Initialize a client for the Auth0 Management API.
-
-    See [Auth0 Management API v2](https://auth0.com/docs/api/management/v2). You must provide the
-    target tenant name and the credentials for a client that is allowed access to the Management
-    API.
-
-    Args:
-        tenant: the tenant name.
-            Same definition as for [Auth0.client][requests_oauth2client.vendor_specific.auth0.Auth0.client]
-        auth: client credentials.
-            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-        client_id: the Client ID.
-            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-        client_secret: the Client Secret.
-            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-        private_jwk: the private key to use for client authentication.
-            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-        session: requests session.
-            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-        **kwargs: additional kwargs to pass to the ApiClient base class
-
-    Usage:
-        ```python
-        from requests_oauth2client.vendor_specific import Auth0
-
-        a0mgmt = Auth0.management_api_client("mytenant.eu", client_id=client_id, client_secret=client_secret)
-        users = a0mgmt.get("users", params={"page": 0, "per_page": 100})
-        ```
-
-    """
-    tenant = cls.tenant(tenant)
-    client = cls.client(
-        tenant,
-        auth=auth,
-        client_id=client_id,
-        client_secret=client_secret,
-        private_jwk=private_jwk,
-        session=session,
-    )
-    audience = f"https://{tenant}/api/v2/"
-    api_auth = OAuth2ClientCredentialsAuth(client, audience=audience)
-    return ApiClient(
-        base_url=audience,
-        auth=api_auth,
-        session=session,
-        **kwargs,
-    )
-
-
-
+
+ Source code in requests_oauth2client/vendor_specific/auth0.py + 
 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
+126
+127
+128
+129
+130
+131
+132
+133
+134
+135
@classmethod
+def management_api_client(
+    cls,
+    tenant: str,
+    auth: (
+        requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
+    ) = None,
+    *,
+    client_id: str | None = None,
+    client_secret: str | None = None,
+    private_jwk: Any | None = None,
+    session: requests.Session | None = None,
+    **kwargs: Any,
+) -> ApiClient:
+    """Initialize a client for the Auth0 Management API.
+
+    See [Auth0 Management API v2](https://auth0.com/docs/api/management/v2). You must provide the
+    target tenant name and the credentials for a client that is allowed access to the Management
+    API.
+
+    Args:
+        tenant: the tenant name.
+            Same definition as for [Auth0.client][requests_oauth2client.vendor_specific.auth0.Auth0.client]
+        auth: client credentials.
+            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+        client_id: the Client ID.
+            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+        client_secret: the Client Secret.
+            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+        private_jwk: the private key to use for client authentication.
+            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+        session: requests session.
+            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+        **kwargs: additional kwargs to pass to the ApiClient base class
+
+    Example:
+        ```python
+        from requests_oauth2client.vendor_specific import Auth0
+
+        a0mgmt = Auth0.management_api_client("mytenant.eu", client_id=client_id, client_secret=client_secret)
+        users = a0mgmt.get("users", params={"page": 0, "per_page": 100})
+        ```
+
+    """
+    tenant = cls.tenant(tenant)
+    client = cls.client(
+        tenant,
+        auth=auth,
+        client_id=client_id,
+        client_secret=client_secret,
+        private_jwk=private_jwk,
+        session=session,
+    )
+    audience = f"https://{tenant}/api/v2/"
+    api_auth = OAuth2ClientCredentialsAuth(client, audience=audience)
+    return ApiClient(
+        base_url=audience,
+        auth=api_auth,
+        session=session,
+        **kwargs,
+    )
+
+
+
@@ -65381,8 +74947,7 @@
-
- +
@@ -65391,118 +74956,118 @@
- Ping + Ping
-
+
+ + +

Ping Identity related utilities.

+ +
+ Source code in requests_oauth2client/vendor_specific/ping.py + 
12
+13
+14
+15
+16
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
class Ping:
+    """Ping Identity related utilities."""
+
+    @classmethod
+    def client(
+        cls,
+        issuer: str,
+        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_jwk: Any = None,
+        session: requests.Session | None = None,
+    ) -> OAuth2Client:
+        """Initialize an OAuth2Client for PingFederate.
+
+        This will configure all endpoints with PingID specific urls, without using the metadata.
+        Excepted for avoiding a round-trip to get the metadata url, this does not provide any advantage
+        over using `OAuth2Client.from_discovery_endpoint(issuer="https://myissuer.domain.tld")`.
+
+        """
+        if not issuer.startswith("https://"):
+            if "://" in issuer:
+                msg = "Invalid issuer. It must be an https:// url or a domain name without a scheme."
+                raise ValueError(msg)
+            issuer = f"https://{issuer}"
+        if "." not in issuer:
+            msg = "Invalid issuer. It must contain at least a dot in the domain name."
+            raise ValueError(msg)
+
+        return OAuth2Client(
+            authorization_endpoint=f"{issuer}/as/authorization.oauth2",
+            token_endpoint=f"{issuer}/as/token.oauth2",
+            revocation_endpoint=f"{issuer}/as/revoke_token.oauth2",
+            userinfo_endpoint=f"{issuer}/idp/userinfo.openid",
+            introspection_endpoint=f"{issuer}/as/introspect.oauth2",
+            jwks_uri=f"{issuer}/pf/JWKS",
+            registration_endpoint=f"{issuer}/as/clients.oauth2",
+            ping_revoked_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/revokedSris",
+            ping_session_management_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/sessions",
+            ping_session_management_users_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/users",
+            ping_end_session_endpoint=f"{issuer}/idp/startSLO.ping",
+            device_authorization_endpoint=f"{issuer}/as/device_authz.oauth2",
+            auth=auth,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_jwk=private_jwk,
+            session=session,
+        )
+
+
- -

Ping Identity related utilities.

- -
- Source code in requests_oauth2client/vendor_specific/ping.py - 
12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
class Ping:
-    """Ping Identity related utilities."""
-
-    @classmethod
-    def client(
-        cls,
-        issuer: str,
-        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
-        client_id: str | None = None,
-        client_secret: str | None = None,
-        private_jwk: Any = None,
-        session: requests.Session | None = None,
-    ) -> OAuth2Client:
-        """Initialize an OAuth2Client for PingFederate.
-
-        This will configure all endpoints with PingID specific urls, without using the metadata.
-        Excepted for avoiding a round-trip to get the metadata url, this does not provide any advantage
-        over using `OAuth2Client.from_discovery_endpoint(issuer="https://myissuer.domain.tld")`.
-
-        """
-        if not issuer.startswith("https://"):
-            if "://" in issuer:
-                msg = "Invalid issuer. It must be an https:// url or a domain name without a scheme."
-                raise ValueError(msg)
-            issuer = f"https://{issuer}"
-        if "." not in issuer:
-            msg = "Invalid issuer. It must contain at least a dot in the domain name."
-            raise ValueError(msg)
-
-        return OAuth2Client(
-            authorization_endpoint=f"{issuer}/as/authorization.oauth2",
-            token_endpoint=f"{issuer}/as/token.oauth2",
-            revocation_endpoint=f"{issuer}/as/revoke_token.oauth2",
-            userinfo_endpoint=f"{issuer}/idp/userinfo.openid",
-            introspection_endpoint=f"{issuer}/as/introspect.oauth2",
-            jwks_uri=f"{issuer}/pf/JWKS",
-            registration_endpoint=f"{issuer}/as/clients.oauth2",
-            ping_revoked_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/revokedSris",
-            ping_session_management_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/sessions",
-            ping_session_management_users_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/users",
-            ping_end_session_endpoint=f"{issuer}/idp/startSLO.ping",
-            device_authorization_endpoint=f"{issuer}/as/device_authz.oauth2",
-            auth=auth,
-            client_id=client_id,
-            client_secret=client_secret,
-            private_jwk=private_jwk,
-            session=session,
-        )
-
-
-
@@ -65514,14 +75079,12 @@

-
-
- client(issuer, auth=None, client_id=None, client_secret=None, private_jwk=None, session=None) - + client(issuer, auth=None, client_id=None, client_secret=None, private_jwk=None, session=None) + classmethod @@ -65529,107 +75092,107 @@
-
- -

Initialize an OAuth2Client for PingFederate.

+
+ +

Initialize an OAuth2Client for PingFederate.

This will configure all endpoints with PingID specific urls, without using the metadata. Excepted for avoiding a round-trip to get the metadata url, this does not provide any advantage over using OAuth2Client.from_discovery_endpoint(issuer="https://myissuer.domain.tld").

-
- Source code in requests_oauth2client/vendor_specific/ping.py - 
15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
@classmethod
-def client(
-    cls,
-    issuer: str,
-    auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
-    client_id: str | None = None,
-    client_secret: str | None = None,
-    private_jwk: Any = None,
-    session: requests.Session | None = None,
-) -> OAuth2Client:
-    """Initialize an OAuth2Client for PingFederate.
-
-    This will configure all endpoints with PingID specific urls, without using the metadata.
-    Excepted for avoiding a round-trip to get the metadata url, this does not provide any advantage
-    over using `OAuth2Client.from_discovery_endpoint(issuer="https://myissuer.domain.tld")`.
-
-    """
-    if not issuer.startswith("https://"):
-        if "://" in issuer:
-            msg = "Invalid issuer. It must be an https:// url or a domain name without a scheme."
-            raise ValueError(msg)
-        issuer = f"https://{issuer}"
-    if "." not in issuer:
-        msg = "Invalid issuer. It must contain at least a dot in the domain name."
-        raise ValueError(msg)
-
-    return OAuth2Client(
-        authorization_endpoint=f"{issuer}/as/authorization.oauth2",
-        token_endpoint=f"{issuer}/as/token.oauth2",
-        revocation_endpoint=f"{issuer}/as/revoke_token.oauth2",
-        userinfo_endpoint=f"{issuer}/idp/userinfo.openid",
-        introspection_endpoint=f"{issuer}/as/introspect.oauth2",
-        jwks_uri=f"{issuer}/pf/JWKS",
-        registration_endpoint=f"{issuer}/as/clients.oauth2",
-        ping_revoked_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/revokedSris",
-        ping_session_management_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/sessions",
-        ping_session_management_users_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/users",
-        ping_end_session_endpoint=f"{issuer}/idp/startSLO.ping",
-        device_authorization_endpoint=f"{issuer}/as/device_authz.oauth2",
-        auth=auth,
-        client_id=client_id,
-        client_secret=client_secret,
-        private_jwk=private_jwk,
-        session=session,
-    )
-
-
-
+
+ Source code in requests_oauth2client/vendor_specific/ping.py + 
15
+16
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
@classmethod
+def client(
+    cls,
+    issuer: str,
+    auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
+    client_id: str | None = None,
+    client_secret: str | None = None,
+    private_jwk: Any = None,
+    session: requests.Session | None = None,
+) -> OAuth2Client:
+    """Initialize an OAuth2Client for PingFederate.
+
+    This will configure all endpoints with PingID specific urls, without using the metadata.
+    Excepted for avoiding a round-trip to get the metadata url, this does not provide any advantage
+    over using `OAuth2Client.from_discovery_endpoint(issuer="https://myissuer.domain.tld")`.
+
+    """
+    if not issuer.startswith("https://"):
+        if "://" in issuer:
+            msg = "Invalid issuer. It must be an https:// url or a domain name without a scheme."
+            raise ValueError(msg)
+        issuer = f"https://{issuer}"
+    if "." not in issuer:
+        msg = "Invalid issuer. It must contain at least a dot in the domain name."
+        raise ValueError(msg)
+
+    return OAuth2Client(
+        authorization_endpoint=f"{issuer}/as/authorization.oauth2",
+        token_endpoint=f"{issuer}/as/token.oauth2",
+        revocation_endpoint=f"{issuer}/as/revoke_token.oauth2",
+        userinfo_endpoint=f"{issuer}/idp/userinfo.openid",
+        introspection_endpoint=f"{issuer}/as/introspect.oauth2",
+        jwks_uri=f"{issuer}/pf/JWKS",
+        registration_endpoint=f"{issuer}/as/clients.oauth2",
+        ping_revoked_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/revokedSris",
+        ping_session_management_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/sessions",
+        ping_session_management_users_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/users",
+        ping_end_session_endpoint=f"{issuer}/idp/startSLO.ping",
+        device_authorization_endpoint=f"{issuer}/as/device_authz.oauth2",
+        auth=auth,
+        client_id=client_id,
+        client_secret=client_secret,
+        private_jwk=private_jwk,
+        session=session,
+    )
+
+
+
@@ -65637,8 +75200,7 @@

- auth0 + auth0
-
- -

Implements subclasses for Auth0.

+
+ +

Implements subclasses for Auth0.

+ -
@@ -65674,278 +75236,266 @@

- Auth0 + Auth0
-
+
+ + +

Auth0-related utilities.

+ +
+ Source code in requests_oauth2client/vendor_specific/auth0.py + 
 14
+ 15
+ 16
+ 17
+ 18
+ 19
+ 20
+ 21
+ 22
+ 23
+ 24
+ 25
+ 26
+ 27
+ 28
+ 29
+ 30
+ 31
+ 32
+ 33
+ 34
+ 35
+ 36
+ 37
+ 38
+ 39
+ 40
+ 41
+ 42
+ 43
+ 44
+ 45
+ 46
+ 47
+ 48
+ 49
+ 50
+ 51
+ 52
+ 53
+ 54
+ 55
+ 56
+ 57
+ 58
+ 59
+ 60
+ 61
+ 62
+ 63
+ 64
+ 65
+ 66
+ 67
+ 68
+ 69
+ 70
+ 71
+ 72
+ 73
+ 74
+ 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
+126
+127
+128
+129
+130
+131
+132
+133
+134
+135
class Auth0:
+    """Auth0-related utilities."""
+
+    @classmethod
+    def tenant(cls, tenant: str) -> str:
+        """Given a short tenant name, returns the full tenant FQDN."""
+        if not tenant:
+            msg = "You must specify a tenant name."
+            raise ValueError(msg)
+        if "." not in tenant or tenant.endswith((".eu", ".us", ".au", ".jp")):
+            tenant = f"{tenant}.auth0.com"
+        if "://" in tenant:
+            if tenant.startswith("https://"):
+                return tenant[8:]
+            msg = (
+                "Invalid tenant name. "
+                "It must be a tenant name like 'mytenant.myregion' "
+                "or a full FQDN like 'mytenant.myregion.auth0.com'."
+                "or an issuer like 'https://mytenant.myregion.auth0.com'"
+            )
+            raise ValueError(msg)
+        return tenant
+
+    @classmethod
+    def client(
+        cls,
+        tenant: str,
+        auth: (
+            requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
+        ) = None,
+        *,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_jwk: Any | None = None,
+        session: requests.Session | None = None,
+        **kwargs: Any,
+    ) -> OAuth2Client:
+        """Initialise an OAuth2Client for an Auth0 tenant."""
+        tenant = cls.tenant(tenant)
+        issuer = f"https://{tenant}"
+        token_endpoint = f"{issuer}/oauth/token"
+        authorization_endpoint = f"{issuer}/authorize"
+        revocation_endpoint = f"{issuer}/oauth/revoke"
+        userinfo_endpoint = f"{issuer}/userinfo"
+        jwks_uri = f"{issuer}/.well-known/jwks.json"
+
+        return OAuth2Client(
+            auth=auth,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_jwk=private_jwk,
+            session=session,
+            token_endpoint=token_endpoint,
+            authorization_endpoint=authorization_endpoint,
+            revocation_endpoint=revocation_endpoint,
+            userinfo_endpoint=userinfo_endpoint,
+            issuer=issuer,
+            jwks_uri=jwks_uri,
+            **kwargs,
+        )
+
+    @classmethod
+    def management_api_client(
+        cls,
+        tenant: str,
+        auth: (
+            requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
+        ) = None,
+        *,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_jwk: Any | None = None,
+        session: requests.Session | None = None,
+        **kwargs: Any,
+    ) -> ApiClient:
+        """Initialize a client for the Auth0 Management API.
+
+        See [Auth0 Management API v2](https://auth0.com/docs/api/management/v2). You must provide the
+        target tenant name and the credentials for a client that is allowed access to the Management
+        API.
+
+        Args:
+            tenant: the tenant name.
+                Same definition as for [Auth0.client][requests_oauth2client.vendor_specific.auth0.Auth0.client]
+            auth: client credentials.
+                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+            client_id: the Client ID.
+                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+            client_secret: the Client Secret.
+                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+            private_jwk: the private key to use for client authentication.
+                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+            session: requests session.
+                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+            **kwargs: additional kwargs to pass to the ApiClient base class
+
+        Example:
+            ```python
+            from requests_oauth2client.vendor_specific import Auth0
+
+            a0mgmt = Auth0.management_api_client("mytenant.eu", client_id=client_id, client_secret=client_secret)
+            users = a0mgmt.get("users", params={"page": 0, "per_page": 100})
+            ```
+
+        """
+        tenant = cls.tenant(tenant)
+        client = cls.client(
+            tenant,
+            auth=auth,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_jwk=private_jwk,
+            session=session,
+        )
+        audience = f"https://{tenant}/api/v2/"
+        api_auth = OAuth2ClientCredentialsAuth(client, audience=audience)
+        return ApiClient(
+            base_url=audience,
+            auth=api_auth,
+            session=session,
+            **kwargs,
+        )
+
+
- -

Auth0-related utilities.

- -
- Source code in requests_oauth2client/vendor_specific/auth0.py - 
 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
class Auth0:
-    """Auth0-related utilities."""
-
-    @classmethod
-    def tenant(cls, tenant: str) -> str:
-        """Given a short tenant name, returns the full tenant FQDN."""
-        if not tenant:
-            msg = "You must specify a tenant name."
-            raise ValueError(msg)
-        if (
-            "." not in tenant
-            or tenant.endswith(".eu")
-            or tenant.endswith(".us")
-            or tenant.endswith(".au")
-            or tenant.endswith(".jp")
-        ):
-            tenant = f"{tenant}.auth0.com"
-        if "://" in tenant:
-            if tenant.startswith("https://"):
-                return tenant[8:]
-            msg = (
-                "Invalid tenant name. "
-                "It must be a tenant name like 'mytenant.myregion' "
-                "or a full FQDN like 'mytenant.myregion.auth0.com'."
-                "or an issuer like 'https://mytenant.myregion.auth0.com'"
-            )
-            raise ValueError(msg)
-        return tenant
-
-    @classmethod
-    def client(
-        cls,
-        tenant: str,
-        auth: (
-            requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
-        ) = None,
-        *,
-        client_id: str | None = None,
-        client_secret: str | None = None,
-        private_jwk: Any | None = None,
-        session: requests.Session | None = None,
-        **kwargs: Any,
-    ) -> OAuth2Client:
-        """Initialise an OAuth2Client for an Auth0 tenant."""
-        tenant = cls.tenant(tenant)
-        issuer = f"https://{tenant}"
-        token_endpoint = f"{issuer}/oauth/token"
-        authorization_endpoint = f"{issuer}/authorize"
-        revocation_endpoint = f"{issuer}/oauth/revoke"
-        userinfo_endpoint = f"{issuer}/userinfo"
-        jwks_uri = f"{issuer}/.well-known/jwks.json"
-
-        return OAuth2Client(
-            auth=auth,
-            client_id=client_id,
-            client_secret=client_secret,
-            private_jwk=private_jwk,
-            session=session,
-            token_endpoint=token_endpoint,
-            authorization_endpoint=authorization_endpoint,
-            revocation_endpoint=revocation_endpoint,
-            userinfo_endpoint=userinfo_endpoint,
-            issuer=issuer,
-            jwks_uri=jwks_uri,
-            **kwargs,
-        )
-
-    @classmethod
-    def management_api_client(
-        cls,
-        tenant: str,
-        auth: (
-            requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
-        ) = None,
-        *,
-        client_id: str | None = None,
-        client_secret: str | None = None,
-        private_jwk: Any | None = None,
-        session: requests.Session | None = None,
-        **kwargs: Any,
-    ) -> ApiClient:
-        """Initialize a client for the Auth0 Management API.
-
-        See [Auth0 Management API v2](https://auth0.com/docs/api/management/v2). You must provide the
-        target tenant name and the credentials for a client that is allowed access to the Management
-        API.
-
-        Args:
-            tenant: the tenant name.
-                Same definition as for [Auth0.client][requests_oauth2client.vendor_specific.auth0.Auth0.client]
-            auth: client credentials.
-                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-            client_id: the Client ID.
-                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-            client_secret: the Client Secret.
-                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-            private_jwk: the private key to use for client authentication.
-                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-            session: requests session.
-                Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-            **kwargs: additional kwargs to pass to the ApiClient base class
-
-        Usage:
-            ```python
-            from requests_oauth2client.vendor_specific import Auth0
-
-            a0mgmt = Auth0.management_api_client("mytenant.eu", client_id=client_id, client_secret=client_secret)
-            users = a0mgmt.get("users", params={"page": 0, "per_page": 100})
-            ```
-
-        """
-        tenant = cls.tenant(tenant)
-        client = cls.client(
-            tenant,
-            auth=auth,
-            client_id=client_id,
-            client_secret=client_secret,
-            private_jwk=private_jwk,
-            session=session,
-        )
-        audience = f"https://{tenant}/api/v2/"
-        api_auth = OAuth2ClientCredentialsAuth(client, audience=audience)
-        return ApiClient(
-            base_url=audience,
-            auth=api_auth,
-            session=session,
-            **kwargs,
-        )
-
-
-
@@ -65957,14 +75507,12 @@
-
- tenant(tenant) - + tenant(tenant) + classmethod @@ -65972,75 +75520,61 @@
-
- -

Given a short tenant name, returns the full tenant FQDN.

- -
- Source code in requests_oauth2client/vendor_specific/auth0.py - 
16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
@classmethod
-def tenant(cls, tenant: str) -> str:
-    """Given a short tenant name, returns the full tenant FQDN."""
-    if not tenant:
-        msg = "You must specify a tenant name."
-        raise ValueError(msg)
-    if (
-        "." not in tenant
-        or tenant.endswith(".eu")
-        or tenant.endswith(".us")
-        or tenant.endswith(".au")
-        or tenant.endswith(".jp")
-    ):
-        tenant = f"{tenant}.auth0.com"
-    if "://" in tenant:
-        if tenant.startswith("https://"):
-            return tenant[8:]
-        msg = (
-            "Invalid tenant name. "
-            "It must be a tenant name like 'mytenant.myregion' "
-            "or a full FQDN like 'mytenant.myregion.auth0.com'."
-            "or an issuer like 'https://mytenant.myregion.auth0.com'"
-        )
-        raise ValueError(msg)
-    return tenant
-
-
-
+
-
+

Given a short tenant name, returns the full tenant FQDN.

+ +
+ Source code in requests_oauth2client/vendor_specific/auth0.py + 
17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
@classmethod
+def tenant(cls, tenant: str) -> str:
+    """Given a short tenant name, returns the full tenant FQDN."""
+    if not tenant:
+        msg = "You must specify a tenant name."
+        raise ValueError(msg)
+    if "." not in tenant or tenant.endswith((".eu", ".us", ".au", ".jp")):
+        tenant = f"{tenant}.auth0.com"
+    if "://" in tenant:
+        if tenant.startswith("https://"):
+            return tenant[8:]
+        msg = (
+            "Invalid tenant name. "
+            "It must be a tenant name like 'mytenant.myregion' "
+            "or a full FQDN like 'mytenant.myregion.auth0.com'."
+            "or an issuer like 'https://mytenant.myregion.auth0.com'"
+        )
+        raise ValueError(msg)
+    return tenant
+
+
+
+
-
- client(tenant, auth=None, *, client_id=None, client_secret=None, private_jwk=None, session=None, **kwargs) - + client(tenant, auth=None, *, client_id=None, client_secret=None, private_jwk=None, session=None, **kwargs) + classmethod @@ -66048,99 +75582,97 @@
-
- -

Initialise an OAuth2Client for an Auth0 tenant.

- -
- Source code in requests_oauth2client/vendor_specific/auth0.py - 
42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
-60
-61
-62
-63
-64
-65
-66
-67
-68
-69
-70
-71
-72
-73
-74
-75
-76
-77
-78
@classmethod
-def client(
-    cls,
-    tenant: str,
-    auth: (
-        requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
-    ) = None,
-    *,
-    client_id: str | None = None,
-    client_secret: str | None = None,
-    private_jwk: Any | None = None,
-    session: requests.Session | None = None,
-    **kwargs: Any,
-) -> OAuth2Client:
-    """Initialise an OAuth2Client for an Auth0 tenant."""
-    tenant = cls.tenant(tenant)
-    issuer = f"https://{tenant}"
-    token_endpoint = f"{issuer}/oauth/token"
-    authorization_endpoint = f"{issuer}/authorize"
-    revocation_endpoint = f"{issuer}/oauth/revoke"
-    userinfo_endpoint = f"{issuer}/userinfo"
-    jwks_uri = f"{issuer}/.well-known/jwks.json"
-
-    return OAuth2Client(
-        auth=auth,
-        client_id=client_id,
-        client_secret=client_secret,
-        private_jwk=private_jwk,
-        session=session,
-        token_endpoint=token_endpoint,
-        authorization_endpoint=authorization_endpoint,
-        revocation_endpoint=revocation_endpoint,
-        userinfo_endpoint=userinfo_endpoint,
-        issuer=issuer,
-        jwks_uri=jwks_uri,
-        **kwargs,
-    )
-
-
-
+
-
+

Initialise an OAuth2Client for an Auth0 tenant.

+ +
+ Source code in requests_oauth2client/vendor_specific/auth0.py + 
37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
+69
+70
+71
+72
+73
@classmethod
+def client(
+    cls,
+    tenant: str,
+    auth: (
+        requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
+    ) = None,
+    *,
+    client_id: str | None = None,
+    client_secret: str | None = None,
+    private_jwk: Any | None = None,
+    session: requests.Session | None = None,
+    **kwargs: Any,
+) -> OAuth2Client:
+    """Initialise an OAuth2Client for an Auth0 tenant."""
+    tenant = cls.tenant(tenant)
+    issuer = f"https://{tenant}"
+    token_endpoint = f"{issuer}/oauth/token"
+    authorization_endpoint = f"{issuer}/authorize"
+    revocation_endpoint = f"{issuer}/oauth/revoke"
+    userinfo_endpoint = f"{issuer}/userinfo"
+    jwks_uri = f"{issuer}/.well-known/jwks.json"
+
+    return OAuth2Client(
+        auth=auth,
+        client_id=client_id,
+        client_secret=client_secret,
+        private_jwk=private_jwk,
+        session=session,
+        token_endpoint=token_endpoint,
+        authorization_endpoint=authorization_endpoint,
+        revocation_endpoint=revocation_endpoint,
+        userinfo_endpoint=userinfo_endpoint,
+        issuer=issuer,
+        jwks_uri=jwks_uri,
+        **kwargs,
+    )
+
+
+
+
-
- management_api_client(tenant, auth=None, *, client_id=None, client_secret=None, private_jwk=None, session=None, **kwargs) - + management_api_client(tenant, auth=None, *, client_id=None, client_secret=None, private_jwk=None, session=None, **kwargs) + classmethod @@ -66148,270 +75680,270 @@
-
- -

Initialize a client for the Auth0 Management API.

+
+ +

Initialize a client for the Auth0 Management API.

See Auth0 Management API v2. You must provide the target tenant name and the credentials for a client that is allowed access to the Management API.

- -

Parameters:

- - - - - - - - - - - - - - + + + + + + + + + +
NameTypeDescriptionDefault
tenant - str - -
-

the tenant name. +

Parameters:

+ + + + + + + + + + + + + + - - - - - - + + + + + + - - - - - - + + + + + + - - - - - - + + + + + + - - - - - - + + + + + + - - - - - - + + + + + + - - - - - - - - - -
NameTypeDescriptionDefault
tenant + str + +
+

the tenant name. Same definition as for Auth0.client

-
- 		- required -
auth - AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None - -
-

client credentials. +

+ 		+ required +
auth + AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None + +
+

client credentials. Same definition as for OAuth2Client

-
- 		- None -
client_id - str | None - -
-

the Client ID. +

+ 		+ None +
client_id + str | None + +
+

the Client ID. Same definition as for OAuth2Client

-
- 		- None -
client_secret - str | None - -
-

the Client Secret. +

+ 		+ None +
client_secret + str | None + +
+

the Client Secret. Same definition as for OAuth2Client

-
- 		- None -
private_jwk - Any | None - -
-

the private key to use for client authentication. +

+ 		+ None +
private_jwk + Any | None + +
+

the private key to use for client authentication. Same definition as for OAuth2Client

-
- 		- None -
session - Session | None - -
-

requests session. +

+ 		+ None +
session + Session | None + +
+

requests session. Same definition as for OAuth2Client

-
- 		- None -
**kwargs - Any - -
-

additional kwargs to pass to the ApiClient base class

-
- 		- {} -
- -
- Usage - 
1
-2
-3
-4
from requests_oauth2client.vendor_specific import Auth0
-
-a0mgmt = Auth0.management_api_client("mytenant.eu", client_id=client_id, client_secret=client_secret)
-users = a0mgmt.get("users", params={"page": 0, "per_page": 100})
-
+
+ 		+ None +
**kwargs + Any + +
+

additional kwargs to pass to the ApiClient base class

+
+ 		+ {} +
+ + +
+ Example + 
1
+2
+3
+4
from requests_oauth2client.vendor_specific import Auth0
+
+a0mgmt = Auth0.management_api_client("mytenant.eu", client_id=client_id, client_secret=client_secret)
+users = a0mgmt.get("users", params={"page": 0, "per_page": 100})
+
-
- Source code in requests_oauth2client/vendor_specific/auth0.py - 
 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
@classmethod
-def management_api_client(
-    cls,
-    tenant: str,
-    auth: (
-        requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
-    ) = None,
-    *,
-    client_id: str | None = None,
-    client_secret: str | None = None,
-    private_jwk: Any | None = None,
-    session: requests.Session | None = None,
-    **kwargs: Any,
-) -> ApiClient:
-    """Initialize a client for the Auth0 Management API.
-
-    See [Auth0 Management API v2](https://auth0.com/docs/api/management/v2). You must provide the
-    target tenant name and the credentials for a client that is allowed access to the Management
-    API.
-
-    Args:
-        tenant: the tenant name.
-            Same definition as for [Auth0.client][requests_oauth2client.vendor_specific.auth0.Auth0.client]
-        auth: client credentials.
-            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-        client_id: the Client ID.
-            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-        client_secret: the Client Secret.
-            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-        private_jwk: the private key to use for client authentication.
-            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-        session: requests session.
-            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
-        **kwargs: additional kwargs to pass to the ApiClient base class
-
-    Usage:
-        ```python
-        from requests_oauth2client.vendor_specific import Auth0
-
-        a0mgmt = Auth0.management_api_client("mytenant.eu", client_id=client_id, client_secret=client_secret)
-        users = a0mgmt.get("users", params={"page": 0, "per_page": 100})
-        ```
-
-    """
-    tenant = cls.tenant(tenant)
-    client = cls.client(
-        tenant,
-        auth=auth,
-        client_id=client_id,
-        client_secret=client_secret,
-        private_jwk=private_jwk,
-        session=session,
-    )
-    audience = f"https://{tenant}/api/v2/"
-    api_auth = OAuth2ClientCredentialsAuth(client, audience=audience)
-    return ApiClient(
-        base_url=audience,
-        auth=api_auth,
-        session=session,
-        **kwargs,
-    )
-
-
-
+
+ Source code in requests_oauth2client/vendor_specific/auth0.py + 
 75
+ 76
+ 77
+ 78
+ 79
+ 80
+ 81
+ 82
+ 83
+ 84
+ 85
+ 86
+ 87
+ 88
+ 89
+ 90
+ 91
+ 92
+ 93
+ 94
+ 95
+ 96
+ 97
+ 98
+ 99
+100
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117
+118
+119
+120
+121
+122
+123
+124
+125
+126
+127
+128
+129
+130
+131
+132
+133
+134
+135
@classmethod
+def management_api_client(
+    cls,
+    tenant: str,
+    auth: (
+        requests.auth.AuthBase | tuple[str, str] | tuple[str, Jwk] | tuple[str, dict[str, Any]] | str | None
+    ) = None,
+    *,
+    client_id: str | None = None,
+    client_secret: str | None = None,
+    private_jwk: Any | None = None,
+    session: requests.Session | None = None,
+    **kwargs: Any,
+) -> ApiClient:
+    """Initialize a client for the Auth0 Management API.
+
+    See [Auth0 Management API v2](https://auth0.com/docs/api/management/v2). You must provide the
+    target tenant name and the credentials for a client that is allowed access to the Management
+    API.
+
+    Args:
+        tenant: the tenant name.
+            Same definition as for [Auth0.client][requests_oauth2client.vendor_specific.auth0.Auth0.client]
+        auth: client credentials.
+            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+        client_id: the Client ID.
+            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+        client_secret: the Client Secret.
+            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+        private_jwk: the private key to use for client authentication.
+            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+        session: requests session.
+            Same definition as for [OAuth2Client][requests_oauth2client.client.OAuth2Client]
+        **kwargs: additional kwargs to pass to the ApiClient base class
+
+    Example:
+        ```python
+        from requests_oauth2client.vendor_specific import Auth0
+
+        a0mgmt = Auth0.management_api_client("mytenant.eu", client_id=client_id, client_secret=client_secret)
+        users = a0mgmt.get("users", params={"page": 0, "per_page": 100})
+        ```
+
+    """
+    tenant = cls.tenant(tenant)
+    client = cls.client(
+        tenant,
+        auth=auth,
+        client_id=client_id,
+        client_secret=client_secret,
+        private_jwk=private_jwk,
+        session=session,
+    )
+    audience = f"https://{tenant}/api/v2/"
+    api_auth = OAuth2ClientCredentialsAuth(client, audience=audience)
+    return ApiClient(
+        base_url=audience,
+        auth=api_auth,
+        session=session,
+        **kwargs,
+    )
+
+
+
@@ -66419,8 +75951,7 @@
-
- +
@@ -66429,7 +75960,7 @@
-
+
@@ -66438,16 +75969,16 @@
- ping + ping
-
- -

PingID specific client.

+
+ +

PingID specific client.

+ -
@@ -66463,118 +75994,118 @@

- Ping + Ping
-
- - -

Ping Identity related utilities.

+
+ + +

Ping Identity related utilities.

+ +
+ Source code in requests_oauth2client/vendor_specific/ping.py + 
12
+13
+14
+15
+16
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
class Ping:
+    """Ping Identity related utilities."""
+
+    @classmethod
+    def client(
+        cls,
+        issuer: str,
+        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        private_jwk: Any = None,
+        session: requests.Session | None = None,
+    ) -> OAuth2Client:
+        """Initialize an OAuth2Client for PingFederate.
+
+        This will configure all endpoints with PingID specific urls, without using the metadata.
+        Excepted for avoiding a round-trip to get the metadata url, this does not provide any advantage
+        over using `OAuth2Client.from_discovery_endpoint(issuer="https://myissuer.domain.tld")`.
+
+        """
+        if not issuer.startswith("https://"):
+            if "://" in issuer:
+                msg = "Invalid issuer. It must be an https:// url or a domain name without a scheme."
+                raise ValueError(msg)
+            issuer = f"https://{issuer}"
+        if "." not in issuer:
+            msg = "Invalid issuer. It must contain at least a dot in the domain name."
+            raise ValueError(msg)
+
+        return OAuth2Client(
+            authorization_endpoint=f"{issuer}/as/authorization.oauth2",
+            token_endpoint=f"{issuer}/as/token.oauth2",
+            revocation_endpoint=f"{issuer}/as/revoke_token.oauth2",
+            userinfo_endpoint=f"{issuer}/idp/userinfo.openid",
+            introspection_endpoint=f"{issuer}/as/introspect.oauth2",
+            jwks_uri=f"{issuer}/pf/JWKS",
+            registration_endpoint=f"{issuer}/as/clients.oauth2",
+            ping_revoked_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/revokedSris",
+            ping_session_management_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/sessions",
+            ping_session_management_users_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/users",
+            ping_end_session_endpoint=f"{issuer}/idp/startSLO.ping",
+            device_authorization_endpoint=f"{issuer}/as/device_authz.oauth2",
+            auth=auth,
+            client_id=client_id,
+            client_secret=client_secret,
+            private_jwk=private_jwk,
+            session=session,
+        )
+
+
-
- Source code in requests_oauth2client/vendor_specific/ping.py - 
12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
class Ping:
-    """Ping Identity related utilities."""
-
-    @classmethod
-    def client(
-        cls,
-        issuer: str,
-        auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
-        client_id: str | None = None,
-        client_secret: str | None = None,
-        private_jwk: Any = None,
-        session: requests.Session | None = None,
-    ) -> OAuth2Client:
-        """Initialize an OAuth2Client for PingFederate.
-
-        This will configure all endpoints with PingID specific urls, without using the metadata.
-        Excepted for avoiding a round-trip to get the metadata url, this does not provide any advantage
-        over using `OAuth2Client.from_discovery_endpoint(issuer="https://myissuer.domain.tld")`.
-
-        """
-        if not issuer.startswith("https://"):
-            if "://" in issuer:
-                msg = "Invalid issuer. It must be an https:// url or a domain name without a scheme."
-                raise ValueError(msg)
-            issuer = f"https://{issuer}"
-        if "." not in issuer:
-            msg = "Invalid issuer. It must contain at least a dot in the domain name."
-            raise ValueError(msg)
-
-        return OAuth2Client(
-            authorization_endpoint=f"{issuer}/as/authorization.oauth2",
-            token_endpoint=f"{issuer}/as/token.oauth2",
-            revocation_endpoint=f"{issuer}/as/revoke_token.oauth2",
-            userinfo_endpoint=f"{issuer}/idp/userinfo.openid",
-            introspection_endpoint=f"{issuer}/as/introspect.oauth2",
-            jwks_uri=f"{issuer}/pf/JWKS",
-            registration_endpoint=f"{issuer}/as/clients.oauth2",
-            ping_revoked_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/revokedSris",
-            ping_session_management_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/sessions",
-            ping_session_management_users_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/users",
-            ping_end_session_endpoint=f"{issuer}/idp/startSLO.ping",
-            device_authorization_endpoint=f"{issuer}/as/device_authz.oauth2",
-            auth=auth,
-            client_id=client_id,
-            client_secret=client_secret,
-            private_jwk=private_jwk,
-            session=session,
-        )
-
-
-
@@ -66586,14 +76117,12 @@
-
- client(issuer, auth=None, client_id=None, client_secret=None, private_jwk=None, session=None) - + client(issuer, auth=None, client_id=None, client_secret=None, private_jwk=None, session=None) + classmethod @@ -66601,107 +76130,107 @@
-
- -

Initialize an OAuth2Client for PingFederate.

+
+ +

Initialize an OAuth2Client for PingFederate.

This will configure all endpoints with PingID specific urls, without using the metadata. Excepted for avoiding a round-trip to get the metadata url, this does not provide any advantage over using OAuth2Client.from_discovery_endpoint(issuer="https://myissuer.domain.tld").

-
- Source code in requests_oauth2client/vendor_specific/ping.py - 
15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59
@classmethod
-def client(
-    cls,
-    issuer: str,
-    auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
-    client_id: str | None = None,
-    client_secret: str | None = None,
-    private_jwk: Any = None,
-    session: requests.Session | None = None,
-) -> OAuth2Client:
-    """Initialize an OAuth2Client for PingFederate.
-
-    This will configure all endpoints with PingID specific urls, without using the metadata.
-    Excepted for avoiding a round-trip to get the metadata url, this does not provide any advantage
-    over using `OAuth2Client.from_discovery_endpoint(issuer="https://myissuer.domain.tld")`.
-
-    """
-    if not issuer.startswith("https://"):
-        if "://" in issuer:
-            msg = "Invalid issuer. It must be an https:// url or a domain name without a scheme."
-            raise ValueError(msg)
-        issuer = f"https://{issuer}"
-    if "." not in issuer:
-        msg = "Invalid issuer. It must contain at least a dot in the domain name."
-        raise ValueError(msg)
-
-    return OAuth2Client(
-        authorization_endpoint=f"{issuer}/as/authorization.oauth2",
-        token_endpoint=f"{issuer}/as/token.oauth2",
-        revocation_endpoint=f"{issuer}/as/revoke_token.oauth2",
-        userinfo_endpoint=f"{issuer}/idp/userinfo.openid",
-        introspection_endpoint=f"{issuer}/as/introspect.oauth2",
-        jwks_uri=f"{issuer}/pf/JWKS",
-        registration_endpoint=f"{issuer}/as/clients.oauth2",
-        ping_revoked_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/revokedSris",
-        ping_session_management_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/sessions",
-        ping_session_management_users_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/users",
-        ping_end_session_endpoint=f"{issuer}/idp/startSLO.ping",
-        device_authorization_endpoint=f"{issuer}/as/device_authz.oauth2",
-        auth=auth,
-        client_id=client_id,
-        client_secret=client_secret,
-        private_jwk=private_jwk,
-        session=session,
-    )
-
-
-
+
+ Source code in requests_oauth2client/vendor_specific/ping.py + 
15
+16
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
@classmethod
+def client(
+    cls,
+    issuer: str,
+    auth: requests.auth.AuthBase | tuple[str, str] | str | None = None,
+    client_id: str | None = None,
+    client_secret: str | None = None,
+    private_jwk: Any = None,
+    session: requests.Session | None = None,
+) -> OAuth2Client:
+    """Initialize an OAuth2Client for PingFederate.
+
+    This will configure all endpoints with PingID specific urls, without using the metadata.
+    Excepted for avoiding a round-trip to get the metadata url, this does not provide any advantage
+    over using `OAuth2Client.from_discovery_endpoint(issuer="https://myissuer.domain.tld")`.
+
+    """
+    if not issuer.startswith("https://"):
+        if "://" in issuer:
+            msg = "Invalid issuer. It must be an https:// url or a domain name without a scheme."
+            raise ValueError(msg)
+        issuer = f"https://{issuer}"
+    if "." not in issuer:
+        msg = "Invalid issuer. It must contain at least a dot in the domain name."
+        raise ValueError(msg)
+
+    return OAuth2Client(
+        authorization_endpoint=f"{issuer}/as/authorization.oauth2",
+        token_endpoint=f"{issuer}/as/token.oauth2",
+        revocation_endpoint=f"{issuer}/as/revoke_token.oauth2",
+        userinfo_endpoint=f"{issuer}/idp/userinfo.openid",
+        introspection_endpoint=f"{issuer}/as/introspect.oauth2",
+        jwks_uri=f"{issuer}/pf/JWKS",
+        registration_endpoint=f"{issuer}/as/clients.oauth2",
+        ping_revoked_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/revokedSris",
+        ping_session_management_sris_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/sessions",
+        ping_session_management_users_endpoint=f"{issuer}/pf-ws/rest/sessionMgmt/users",
+        ping_end_session_endpoint=f"{issuer}/idp/startSLO.ping",
+        device_authorization_endpoint=f"{issuer}/as/device_authz.oauth2",
+        auth=auth,
+        client_id=client_id,
+        client_secret=client_secret,
+        private_jwk=private_jwk,
+        session=session,
+    )
+
+
+
@@ -66709,8 +76238,7 @@
- +
@@ -66793,7 +76321,7 @@
- +
@@ -66819,7 +76347,7 @@
- + @@ -66827,7 +76355,7 @@
- +
@@ -66842,10 +76370,10 @@
{"base": "..", "features": ["navigation.indexes", "navigation.tabs", "navigation.instant", "navigation.tabs.sticky", "navigation.footer", "content.code.copy", "content.action.view"], "search": "../assets/javascripts/workers/search.b8dbb3d2.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}} + - + diff --git a/assets/javascripts/bundle.56dfad97.min.js b/assets/javascripts/bundle.56dfad97.min.js new file mode 100644 index 0000000..1df62cd --- /dev/null +++ b/assets/javascripts/bundle.56dfad97.min.js @@ -0,0 +1,16 @@ +"use strict";(()=>{var Fi=Object.create;var gr=Object.defineProperty;var Wi=Object.getOwnPropertyDescriptor;var Ui=Object.getOwnPropertyNames,Vt=Object.getOwnPropertySymbols,Di=Object.getPrototypeOf,yr=Object.prototype.hasOwnProperty,io=Object.prototype.propertyIsEnumerable;var no=(e,t,r)=>t in e?gr(e,t,{enumerable:!0,configurable:!0,writable:!0,value:r}):e[t]=r,$=(e,t)=>{for(var r in t||(t={}))yr.call(t,r)&&no(e,r,t[r]);if(Vt)for(var r of Vt(t))io.call(t,r)&&no(e,r,t[r]);return e};var ao=(e,t)=>{var r={};for(var o in e)yr.call(e,o)&&t.indexOf(o)<0&&(r[o]=e[o]);if(e!=null&&Vt)for(var o of Vt(e))t.indexOf(o)<0&&io.call(e,o)&&(r[o]=e[o]);return r};var xr=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Vi=(e,t,r,o)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of Ui(t))!yr.call(e,n)&&n!==r&&gr(e,n,{get:()=>t[n],enumerable:!(o=Wi(t,n))||o.enumerable});return e};var Lt=(e,t,r)=>(r=e!=null?Fi(Di(e)):{},Vi(t||!e||!e.__esModule?gr(r,"default",{value:e,enumerable:!0}):r,e));var so=(e,t,r)=>new Promise((o,n)=>{var i=p=>{try{s(r.next(p))}catch(c){n(c)}},a=p=>{try{s(r.throw(p))}catch(c){n(c)}},s=p=>p.done?o(p.value):Promise.resolve(p.value).then(i,a);s((r=r.apply(e,t)).next())});var po=xr((Er,co)=>{(function(e,t){typeof Er=="object"&&typeof co!="undefined"?t():typeof define=="function"&&define.amd?define(t):t()})(Er,function(){"use strict";function e(r){var o=!0,n=!1,i=null,a={text:!0,search:!0,url:!0,tel:!0,email:!0,password:!0,number:!0,date:!0,month:!0,week:!0,time:!0,datetime:!0,"datetime-local":!0};function s(k){return!!(k&&k!==document&&k.nodeName!=="HTML"&&k.nodeName!=="BODY"&&"classList"in k&&"contains"in k.classList)}function p(k){var ft=k.type,qe=k.tagName;return!!(qe==="INPUT"&&a[ft]&&!k.readOnly||qe==="TEXTAREA"&&!k.readOnly||k.isContentEditable)}function c(k){k.classList.contains("focus-visible")||(k.classList.add("focus-visible"),k.setAttribute("data-focus-visible-added",""))}function l(k){k.hasAttribute("data-focus-visible-added")&&(k.classList.remove("focus-visible"),k.removeAttribute("data-focus-visible-added"))}function f(k){k.metaKey||k.altKey||k.ctrlKey||(s(r.activeElement)&&c(r.activeElement),o=!0)}function u(k){o=!1}function d(k){s(k.target)&&(o||p(k.target))&&c(k.target)}function y(k){s(k.target)&&(k.target.classList.contains("focus-visible")||k.target.hasAttribute("data-focus-visible-added"))&&(n=!0,window.clearTimeout(i),i=window.setTimeout(function(){n=!1},100),l(k.target))}function M(k){document.visibilityState==="hidden"&&(n&&(o=!0),X())}function X(){document.addEventListener("mousemove",J),document.addEventListener("mousedown",J),document.addEventListener("mouseup",J),document.addEventListener("pointermove",J),document.addEventListener("pointerdown",J),document.addEventListener("pointerup",J),document.addEventListener("touchmove",J),document.addEventListener("touchstart",J),document.addEventListener("touchend",J)}function te(){document.removeEventListener("mousemove",J),document.removeEventListener("mousedown",J),document.removeEventListener("mouseup",J),document.removeEventListener("pointermove",J),document.removeEventListener("pointerdown",J),document.removeEventListener("pointerup",J),document.removeEventListener("touchmove",J),document.removeEventListener("touchstart",J),document.removeEventListener("touchend",J)}function J(k){k.target.nodeName&&k.target.nodeName.toLowerCase()==="html"||(o=!1,te())}document.addEventListener("keydown",f,!0),document.addEventListener("mousedown",u,!0),document.addEventListener("pointerdown",u,!0),document.addEventListener("touchstart",u,!0),document.addEventListener("visibilitychange",M,!0),X(),r.addEventListener("focus",d,!0),r.addEventListener("blur",y,!0),r.nodeType===Node.DOCUMENT_FRAGMENT_NODE&&r.host?r.host.setAttribute("data-js-focus-visible",""):r.nodeType===Node.DOCUMENT_NODE&&(document.documentElement.classList.add("js-focus-visible"),document.documentElement.setAttribute("data-js-focus-visible",""))}if(typeof window!="undefined"&&typeof document!="undefined"){window.applyFocusVisiblePolyfill=e;var t;try{t=new CustomEvent("focus-visible-polyfill-ready")}catch(r){t=document.createEvent("CustomEvent"),t.initCustomEvent("focus-visible-polyfill-ready",!1,!1,{})}window.dispatchEvent(t)}typeof document!="undefined"&&e(document)})});var qr=xr((ly,Sn)=>{"use strict";/*! + * escape-html + * Copyright(c) 2012-2013 TJ Holowaychuk + * Copyright(c) 2015 Andreas Lubbe + * Copyright(c) 2015 Tiancheng "Timothy" Gu + * MIT Licensed + */var ka=/["'&<>]/;Sn.exports=Ha;function Ha(e){var t=""+e,r=ka.exec(t);if(!r)return t;var o,n="",i=0,a=0;for(i=r.index;i{/*! + * clipboard.js v2.0.11 + * https://clipboardjs.com/ + * + * Licensed MIT © Zeno Rocha + */(function(t,r){typeof It=="object"&&typeof Yr=="object"?Yr.exports=r():typeof define=="function"&&define.amd?define([],r):typeof It=="object"?It.ClipboardJS=r():t.ClipboardJS=r()})(It,function(){return function(){var e={686:function(o,n,i){"use strict";i.d(n,{default:function(){return ji}});var a=i(279),s=i.n(a),p=i(370),c=i.n(p),l=i(817),f=i.n(l);function u(V){try{return document.execCommand(V)}catch(A){return!1}}var d=function(A){var L=f()(A);return u("cut"),L},y=d;function M(V){var A=document.documentElement.getAttribute("dir")==="rtl",L=document.createElement("textarea");L.style.fontSize="12pt",L.style.border="0",L.style.padding="0",L.style.margin="0",L.style.position="absolute",L.style[A?"right":"left"]="-9999px";var F=window.pageYOffset||document.documentElement.scrollTop;return L.style.top="".concat(F,"px"),L.setAttribute("readonly",""),L.value=V,L}var X=function(A,L){var F=M(A);L.container.appendChild(F);var D=f()(F);return u("copy"),F.remove(),D},te=function(A){var L=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{container:document.body},F="";return typeof A=="string"?F=X(A,L):A instanceof HTMLInputElement&&!["text","search","url","tel","password"].includes(A==null?void 0:A.type)?F=X(A.value,L):(F=f()(A),u("copy")),F},J=te;function k(V){"@babel/helpers - typeof";return typeof Symbol=="function"&&typeof Symbol.iterator=="symbol"?k=function(L){return typeof L}:k=function(L){return L&&typeof Symbol=="function"&&L.constructor===Symbol&&L!==Symbol.prototype?"symbol":typeof L},k(V)}var ft=function(){var A=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{},L=A.action,F=L===void 0?"copy":L,D=A.container,Y=A.target,$e=A.text;if(F!=="copy"&&F!=="cut")throw new Error('Invalid "action" value, use either "copy" or "cut"');if(Y!==void 0)if(Y&&k(Y)==="object"&&Y.nodeType===1){if(F==="copy"&&Y.hasAttribute("disabled"))throw new Error('Invalid "target" attribute. Please use "readonly" instead of "disabled" attribute');if(F==="cut"&&(Y.hasAttribute("readonly")||Y.hasAttribute("disabled")))throw new Error(`Invalid "target" attribute. You can't cut text from elements with "readonly" or "disabled" attributes`)}else throw new Error('Invalid "target" value, use a valid Element');if($e)return J($e,{container:D});if(Y)return F==="cut"?y(Y):J(Y,{container:D})},qe=ft;function Fe(V){"@babel/helpers - typeof";return typeof Symbol=="function"&&typeof Symbol.iterator=="symbol"?Fe=function(L){return typeof L}:Fe=function(L){return L&&typeof Symbol=="function"&&L.constructor===Symbol&&L!==Symbol.prototype?"symbol":typeof L},Fe(V)}function Ai(V,A){if(!(V instanceof A))throw new TypeError("Cannot call a class as a function")}function oo(V,A){for(var L=0;L0&&arguments[0]!==void 0?arguments[0]:{};this.action=typeof D.action=="function"?D.action:this.defaultAction,this.target=typeof D.target=="function"?D.target:this.defaultTarget,this.text=typeof D.text=="function"?D.text:this.defaultText,this.container=Fe(D.container)==="object"?D.container:document.body}},{key:"listenClick",value:function(D){var Y=this;this.listener=c()(D,"click",function($e){return Y.onClick($e)})}},{key:"onClick",value:function(D){var Y=D.delegateTarget||D.currentTarget,$e=this.action(Y)||"copy",Dt=qe({action:$e,container:this.container,target:this.target(Y),text:this.text(Y)});this.emit(Dt?"success":"error",{action:$e,text:Dt,trigger:Y,clearSelection:function(){Y&&Y.focus(),window.getSelection().removeAllRanges()}})}},{key:"defaultAction",value:function(D){return vr("action",D)}},{key:"defaultTarget",value:function(D){var Y=vr("target",D);if(Y)return document.querySelector(Y)}},{key:"defaultText",value:function(D){return vr("text",D)}},{key:"destroy",value:function(){this.listener.destroy()}}],[{key:"copy",value:function(D){var Y=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{container:document.body};return J(D,Y)}},{key:"cut",value:function(D){return y(D)}},{key:"isSupported",value:function(){var D=arguments.length>0&&arguments[0]!==void 0?arguments[0]:["copy","cut"],Y=typeof D=="string"?[D]:D,$e=!!document.queryCommandSupported;return Y.forEach(function(Dt){$e=$e&&!!document.queryCommandSupported(Dt)}),$e}}]),L}(s()),ji=Ii},828:function(o){var n=9;if(typeof Element!="undefined"&&!Element.prototype.matches){var i=Element.prototype;i.matches=i.matchesSelector||i.mozMatchesSelector||i.msMatchesSelector||i.oMatchesSelector||i.webkitMatchesSelector}function a(s,p){for(;s&&s.nodeType!==n;){if(typeof s.matches=="function"&&s.matches(p))return s;s=s.parentNode}}o.exports=a},438:function(o,n,i){var a=i(828);function s(l,f,u,d,y){var M=c.apply(this,arguments);return l.addEventListener(u,M,y),{destroy:function(){l.removeEventListener(u,M,y)}}}function p(l,f,u,d,y){return typeof l.addEventListener=="function"?s.apply(null,arguments):typeof u=="function"?s.bind(null,document).apply(null,arguments):(typeof l=="string"&&(l=document.querySelectorAll(l)),Array.prototype.map.call(l,function(M){return s(M,f,u,d,y)}))}function c(l,f,u,d){return function(y){y.delegateTarget=a(y.target,f),y.delegateTarget&&d.call(l,y)}}o.exports=p},879:function(o,n){n.node=function(i){return i!==void 0&&i instanceof HTMLElement&&i.nodeType===1},n.nodeList=function(i){var a=Object.prototype.toString.call(i);return i!==void 0&&(a==="[object NodeList]"||a==="[object HTMLCollection]")&&"length"in i&&(i.length===0||n.node(i[0]))},n.string=function(i){return typeof i=="string"||i instanceof String},n.fn=function(i){var a=Object.prototype.toString.call(i);return a==="[object Function]"}},370:function(o,n,i){var a=i(879),s=i(438);function p(u,d,y){if(!u&&!d&&!y)throw new Error("Missing required arguments");if(!a.string(d))throw new TypeError("Second argument must be a String");if(!a.fn(y))throw new TypeError("Third argument must be a Function");if(a.node(u))return c(u,d,y);if(a.nodeList(u))return l(u,d,y);if(a.string(u))return f(u,d,y);throw new TypeError("First argument must be a String, HTMLElement, HTMLCollection, or NodeList")}function c(u,d,y){return u.addEventListener(d,y),{destroy:function(){u.removeEventListener(d,y)}}}function l(u,d,y){return Array.prototype.forEach.call(u,function(M){M.addEventListener(d,y)}),{destroy:function(){Array.prototype.forEach.call(u,function(M){M.removeEventListener(d,y)})}}}function f(u,d,y){return s(document.body,u,d,y)}o.exports=p},817:function(o){function n(i){var a;if(i.nodeName==="SELECT")i.focus(),a=i.value;else if(i.nodeName==="INPUT"||i.nodeName==="TEXTAREA"){var s=i.hasAttribute("readonly");s||i.setAttribute("readonly",""),i.select(),i.setSelectionRange(0,i.value.length),s||i.removeAttribute("readonly"),a=i.value}else{i.hasAttribute("contenteditable")&&i.focus();var p=window.getSelection(),c=document.createRange();c.selectNodeContents(i),p.removeAllRanges(),p.addRange(c),a=p.toString()}return a}o.exports=n},279:function(o){function n(){}n.prototype={on:function(i,a,s){var p=this.e||(this.e={});return(p[i]||(p[i]=[])).push({fn:a,ctx:s}),this},once:function(i,a,s){var p=this;function c(){p.off(i,c),a.apply(s,arguments)}return c._=a,this.on(i,c,s)},emit:function(i){var a=[].slice.call(arguments,1),s=((this.e||(this.e={}))[i]||[]).slice(),p=0,c=s.length;for(p;p0&&i[i.length-1])&&(c[0]===6||c[0]===2)){r=0;continue}if(c[0]===3&&(!i||c[1]>i[0]&&c[1]=e.length&&(e=void 0),{value:e&&e[o++],done:!e}}};throw new TypeError(t?"Object is not iterable.":"Symbol.iterator is not defined.")}function N(e,t){var r=typeof Symbol=="function"&&e[Symbol.iterator];if(!r)return e;var o=r.call(e),n,i=[],a;try{for(;(t===void 0||t-- >0)&&!(n=o.next()).done;)i.push(n.value)}catch(s){a={error:s}}finally{try{n&&!n.done&&(r=o.return)&&r.call(o)}finally{if(a)throw a.error}}return i}function q(e,t,r){if(r||arguments.length===2)for(var o=0,n=t.length,i;o1||p(d,M)})},y&&(n[d]=y(n[d])))}function p(d,y){try{c(o[d](y))}catch(M){u(i[0][3],M)}}function c(d){d.value instanceof nt?Promise.resolve(d.value.v).then(l,f):u(i[0][2],d)}function l(d){p("next",d)}function f(d){p("throw",d)}function u(d,y){d(y),i.shift(),i.length&&p(i[0][0],i[0][1])}}function fo(e){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var t=e[Symbol.asyncIterator],r;return t?t.call(e):(e=typeof he=="function"?he(e):e[Symbol.iterator](),r={},o("next"),o("throw"),o("return"),r[Symbol.asyncIterator]=function(){return this},r);function o(i){r[i]=e[i]&&function(a){return new Promise(function(s,p){a=e[i](a),n(s,p,a.done,a.value)})}}function n(i,a,s,p){Promise.resolve(p).then(function(c){i({value:c,done:s})},a)}}function H(e){return typeof e=="function"}function ut(e){var t=function(o){Error.call(o),o.stack=new Error().stack},r=e(t);return r.prototype=Object.create(Error.prototype),r.prototype.constructor=r,r}var zt=ut(function(e){return function(r){e(this),this.message=r?r.length+` errors occurred during unsubscription: +`+r.map(function(o,n){return n+1+") "+o.toString()}).join(` + `):"",this.name="UnsubscriptionError",this.errors=r}});function Qe(e,t){if(e){var r=e.indexOf(t);0<=r&&e.splice(r,1)}}var We=function(){function e(t){this.initialTeardown=t,this.closed=!1,this._parentage=null,this._finalizers=null}return e.prototype.unsubscribe=function(){var t,r,o,n,i;if(!this.closed){this.closed=!0;var a=this._parentage;if(a)if(this._parentage=null,Array.isArray(a))try{for(var s=he(a),p=s.next();!p.done;p=s.next()){var c=p.value;c.remove(this)}}catch(M){t={error:M}}finally{try{p&&!p.done&&(r=s.return)&&r.call(s)}finally{if(t)throw t.error}}else a.remove(this);var l=this.initialTeardown;if(H(l))try{l()}catch(M){i=M instanceof zt?M.errors:[M]}var f=this._finalizers;if(f){this._finalizers=null;try{for(var u=he(f),d=u.next();!d.done;d=u.next()){var y=d.value;try{uo(y)}catch(M){i=i!=null?i:[],M instanceof zt?i=q(q([],N(i)),N(M.errors)):i.push(M)}}}catch(M){o={error:M}}finally{try{d&&!d.done&&(n=u.return)&&n.call(u)}finally{if(o)throw o.error}}}if(i)throw new zt(i)}},e.prototype.add=function(t){var r;if(t&&t!==this)if(this.closed)uo(t);else{if(t instanceof e){if(t.closed||t._hasParent(this))return;t._addParent(this)}(this._finalizers=(r=this._finalizers)!==null&&r!==void 0?r:[]).push(t)}},e.prototype._hasParent=function(t){var r=this._parentage;return r===t||Array.isArray(r)&&r.includes(t)},e.prototype._addParent=function(t){var r=this._parentage;this._parentage=Array.isArray(r)?(r.push(t),r):r?[r,t]:t},e.prototype._removeParent=function(t){var r=this._parentage;r===t?this._parentage=null:Array.isArray(r)&&Qe(r,t)},e.prototype.remove=function(t){var r=this._finalizers;r&&Qe(r,t),t instanceof e&&t._removeParent(this)},e.EMPTY=function(){var t=new e;return t.closed=!0,t}(),e}();var Tr=We.EMPTY;function qt(e){return e instanceof We||e&&"closed"in e&&H(e.remove)&&H(e.add)&&H(e.unsubscribe)}function uo(e){H(e)?e():e.unsubscribe()}var Pe={onUnhandledError:null,onStoppedNotification:null,Promise:void 0,useDeprecatedSynchronousErrorHandling:!1,useDeprecatedNextContext:!1};var dt={setTimeout:function(e,t){for(var r=[],o=2;o0},enumerable:!1,configurable:!0}),t.prototype._trySubscribe=function(r){return this._throwIfClosed(),e.prototype._trySubscribe.call(this,r)},t.prototype._subscribe=function(r){return this._throwIfClosed(),this._checkFinalizedStatuses(r),this._innerSubscribe(r)},t.prototype._innerSubscribe=function(r){var o=this,n=this,i=n.hasError,a=n.isStopped,s=n.observers;return i||a?Tr:(this.currentObservers=null,s.push(r),new We(function(){o.currentObservers=null,Qe(s,r)}))},t.prototype._checkFinalizedStatuses=function(r){var o=this,n=o.hasError,i=o.thrownError,a=o.isStopped;n?r.error(i):a&&r.complete()},t.prototype.asObservable=function(){var r=new j;return r.source=this,r},t.create=function(r,o){return new wo(r,o)},t}(j);var wo=function(e){oe(t,e);function t(r,o){var n=e.call(this)||this;return n.destination=r,n.source=o,n}return t.prototype.next=function(r){var o,n;(n=(o=this.destination)===null||o===void 0?void 0:o.next)===null||n===void 0||n.call(o,r)},t.prototype.error=function(r){var o,n;(n=(o=this.destination)===null||o===void 0?void 0:o.error)===null||n===void 0||n.call(o,r)},t.prototype.complete=function(){var r,o;(o=(r=this.destination)===null||r===void 0?void 0:r.complete)===null||o===void 0||o.call(r)},t.prototype._subscribe=function(r){var o,n;return(n=(o=this.source)===null||o===void 0?void 0:o.subscribe(r))!==null&&n!==void 0?n:Tr},t}(g);var _r=function(e){oe(t,e);function t(r){var o=e.call(this)||this;return o._value=r,o}return Object.defineProperty(t.prototype,"value",{get:function(){return this.getValue()},enumerable:!1,configurable:!0}),t.prototype._subscribe=function(r){var o=e.prototype._subscribe.call(this,r);return!o.closed&&r.next(this._value),o},t.prototype.getValue=function(){var r=this,o=r.hasError,n=r.thrownError,i=r._value;if(o)throw n;return this._throwIfClosed(),i},t.prototype.next=function(r){e.prototype.next.call(this,this._value=r)},t}(g);var At={now:function(){return(At.delegate||Date).now()},delegate:void 0};var Ct=function(e){oe(t,e);function t(r,o,n){r===void 0&&(r=1/0),o===void 0&&(o=1/0),n===void 0&&(n=At);var i=e.call(this)||this;return i._bufferSize=r,i._windowTime=o,i._timestampProvider=n,i._buffer=[],i._infiniteTimeWindow=!0,i._infiniteTimeWindow=o===1/0,i._bufferSize=Math.max(1,r),i._windowTime=Math.max(1,o),i}return t.prototype.next=function(r){var o=this,n=o.isStopped,i=o._buffer,a=o._infiniteTimeWindow,s=o._timestampProvider,p=o._windowTime;n||(i.push(r),!a&&i.push(s.now()+p)),this._trimBuffer(),e.prototype.next.call(this,r)},t.prototype._subscribe=function(r){this._throwIfClosed(),this._trimBuffer();for(var o=this._innerSubscribe(r),n=this,i=n._infiniteTimeWindow,a=n._buffer,s=a.slice(),p=0;p0?e.prototype.schedule.call(this,r,o):(this.delay=o,this.state=r,this.scheduler.flush(this),this)},t.prototype.execute=function(r,o){return o>0||this.closed?e.prototype.execute.call(this,r,o):this._execute(r,o)},t.prototype.requestAsyncId=function(r,o,n){return n===void 0&&(n=0),n!=null&&n>0||n==null&&this.delay>0?e.prototype.requestAsyncId.call(this,r,o,n):(r.flush(this),0)},t}(gt);var Oo=function(e){oe(t,e);function t(){return e!==null&&e.apply(this,arguments)||this}return t}(yt);var kr=new Oo(So);var Mo=function(e){oe(t,e);function t(r,o){var n=e.call(this,r,o)||this;return n.scheduler=r,n.work=o,n}return t.prototype.requestAsyncId=function(r,o,n){return n===void 0&&(n=0),n!==null&&n>0?e.prototype.requestAsyncId.call(this,r,o,n):(r.actions.push(this),r._scheduled||(r._scheduled=vt.requestAnimationFrame(function(){return r.flush(void 0)})))},t.prototype.recycleAsyncId=function(r,o,n){var i;if(n===void 0&&(n=0),n!=null?n>0:this.delay>0)return e.prototype.recycleAsyncId.call(this,r,o,n);var a=r.actions;o!=null&&((i=a[a.length-1])===null||i===void 0?void 0:i.id)!==o&&(vt.cancelAnimationFrame(o),r._scheduled=void 0)},t}(gt);var Lo=function(e){oe(t,e);function t(){return e!==null&&e.apply(this,arguments)||this}return t.prototype.flush=function(r){this._active=!0;var o=this._scheduled;this._scheduled=void 0;var n=this.actions,i;r=r||n.shift();do if(i=r.execute(r.state,r.delay))break;while((r=n[0])&&r.id===o&&n.shift());if(this._active=!1,i){for(;(r=n[0])&&r.id===o&&n.shift();)r.unsubscribe();throw i}},t}(yt);var me=new Lo(Mo);var S=new j(function(e){return e.complete()});function Yt(e){return e&&H(e.schedule)}function Hr(e){return e[e.length-1]}function Xe(e){return H(Hr(e))?e.pop():void 0}function ke(e){return Yt(Hr(e))?e.pop():void 0}function Bt(e,t){return typeof Hr(e)=="number"?e.pop():t}var xt=function(e){return e&&typeof e.length=="number"&&typeof e!="function"};function Gt(e){return H(e==null?void 0:e.then)}function Jt(e){return H(e[bt])}function Xt(e){return Symbol.asyncIterator&&H(e==null?void 0:e[Symbol.asyncIterator])}function Zt(e){return new TypeError("You provided "+(e!==null&&typeof e=="object"?"an invalid object":"'"+e+"'")+" where a stream was expected. You can provide an Observable, Promise, ReadableStream, Array, AsyncIterable, or Iterable.")}function Ji(){return typeof Symbol!="function"||!Symbol.iterator?"@@iterator":Symbol.iterator}var er=Ji();function tr(e){return H(e==null?void 0:e[er])}function rr(e){return mo(this,arguments,function(){var r,o,n,i;return Nt(this,function(a){switch(a.label){case 0:r=e.getReader(),a.label=1;case 1:a.trys.push([1,,9,10]),a.label=2;case 2:return[4,nt(r.read())];case 3:return o=a.sent(),n=o.value,i=o.done,i?[4,nt(void 0)]:[3,5];case 4:return[2,a.sent()];case 5:return[4,nt(n)];case 6:return[4,a.sent()];case 7:return a.sent(),[3,2];case 8:return[3,10];case 9:return r.releaseLock(),[7];case 10:return[2]}})})}function or(e){return H(e==null?void 0:e.getReader)}function W(e){if(e instanceof j)return e;if(e!=null){if(Jt(e))return Xi(e);if(xt(e))return Zi(e);if(Gt(e))return ea(e);if(Xt(e))return _o(e);if(tr(e))return ta(e);if(or(e))return ra(e)}throw Zt(e)}function Xi(e){return new j(function(t){var r=e[bt]();if(H(r.subscribe))return r.subscribe(t);throw new TypeError("Provided object does not correctly implement Symbol.observable")})}function Zi(e){return new j(function(t){for(var r=0;r=2;return function(o){return o.pipe(e?b(function(n,i){return e(n,i,o)}):le,Te(1),r?De(t):qo(function(){return new ir}))}}function jr(e){return e<=0?function(){return S}:E(function(t,r){var o=[];t.subscribe(T(r,function(n){o.push(n),e=2,!0))}function pe(e){e===void 0&&(e={});var t=e.connector,r=t===void 0?function(){return new g}:t,o=e.resetOnError,n=o===void 0?!0:o,i=e.resetOnComplete,a=i===void 0?!0:i,s=e.resetOnRefCountZero,p=s===void 0?!0:s;return function(c){var l,f,u,d=0,y=!1,M=!1,X=function(){f==null||f.unsubscribe(),f=void 0},te=function(){X(),l=u=void 0,y=M=!1},J=function(){var k=l;te(),k==null||k.unsubscribe()};return E(function(k,ft){d++,!M&&!y&&X();var qe=u=u!=null?u:r();ft.add(function(){d--,d===0&&!M&&!y&&(f=Wr(J,p))}),qe.subscribe(ft),!l&&d>0&&(l=new at({next:function(Fe){return qe.next(Fe)},error:function(Fe){M=!0,X(),f=Wr(te,n,Fe),qe.error(Fe)},complete:function(){y=!0,X(),f=Wr(te,a),qe.complete()}}),W(k).subscribe(l))})(c)}}function Wr(e,t){for(var r=[],o=2;oe.next(document)),e}function P(e,t=document){return Array.from(t.querySelectorAll(e))}function R(e,t=document){let r=fe(e,t);if(typeof r=="undefined")throw new ReferenceError(`Missing element: expected "${e}" to be present`);return r}function fe(e,t=document){return t.querySelector(e)||void 0}function Ie(){var e,t,r,o;return(o=(r=(t=(e=document.activeElement)==null?void 0:e.shadowRoot)==null?void 0:t.activeElement)!=null?r:document.activeElement)!=null?o:void 0}var xa=O(h(document.body,"focusin"),h(document.body,"focusout")).pipe(_e(1),Q(void 0),m(()=>Ie()||document.body),G(1));function et(e){return xa.pipe(m(t=>e.contains(t)),K())}function $t(e,t){return C(()=>O(h(e,"mouseenter").pipe(m(()=>!0)),h(e,"mouseleave").pipe(m(()=>!1))).pipe(t?Ht(r=>Me(+!r*t)):le,Q(e.matches(":hover"))))}function Go(e,t){if(typeof t=="string"||typeof t=="number")e.innerHTML+=t.toString();else if(t instanceof Node)e.appendChild(t);else if(Array.isArray(t))for(let r of t)Go(e,r)}function x(e,t,...r){let o=document.createElement(e);if(t)for(let n of Object.keys(t))typeof t[n]!="undefined"&&(typeof t[n]!="boolean"?o.setAttribute(n,t[n]):o.setAttribute(n,""));for(let n of r)Go(o,n);return o}function sr(e){if(e>999){let t=+((e-950)%1e3>99);return`${((e+1e-6)/1e3).toFixed(t)}k`}else return e.toString()}function Tt(e){let t=x("script",{src:e});return C(()=>(document.head.appendChild(t),O(h(t,"load"),h(t,"error").pipe(v(()=>$r(()=>new ReferenceError(`Invalid script: ${e}`))))).pipe(m(()=>{}),_(()=>document.head.removeChild(t)),Te(1))))}var Jo=new g,Ea=C(()=>typeof ResizeObserver=="undefined"?Tt("https://unpkg.com/resize-observer-polyfill"):I(void 0)).pipe(m(()=>new ResizeObserver(e=>e.forEach(t=>Jo.next(t)))),v(e=>O(Ye,I(e)).pipe(_(()=>e.disconnect()))),G(1));function ce(e){return{width:e.offsetWidth,height:e.offsetHeight}}function ge(e){let t=e;for(;t.clientWidth===0&&t.parentElement;)t=t.parentElement;return Ea.pipe(w(r=>r.observe(t)),v(r=>Jo.pipe(b(o=>o.target===t),_(()=>r.unobserve(t)))),m(()=>ce(e)),Q(ce(e)))}function St(e){return{width:e.scrollWidth,height:e.scrollHeight}}function cr(e){let t=e.parentElement;for(;t&&(e.scrollWidth<=t.scrollWidth&&e.scrollHeight<=t.scrollHeight);)t=(e=t).parentElement;return t?e:void 0}function Xo(e){let t=[],r=e.parentElement;for(;r;)(e.clientWidth>r.clientWidth||e.clientHeight>r.clientHeight)&&t.push(r),r=(e=r).parentElement;return t.length===0&&t.push(document.documentElement),t}function Ve(e){return{x:e.offsetLeft,y:e.offsetTop}}function Zo(e){let t=e.getBoundingClientRect();return{x:t.x+window.scrollX,y:t.y+window.scrollY}}function en(e){return O(h(window,"load"),h(window,"resize")).pipe(Le(0,me),m(()=>Ve(e)),Q(Ve(e)))}function pr(e){return{x:e.scrollLeft,y:e.scrollTop}}function Ne(e){return O(h(e,"scroll"),h(window,"scroll"),h(window,"resize")).pipe(Le(0,me),m(()=>pr(e)),Q(pr(e)))}var tn=new g,wa=C(()=>I(new IntersectionObserver(e=>{for(let t of e)tn.next(t)},{threshold:0}))).pipe(v(e=>O(Ye,I(e)).pipe(_(()=>e.disconnect()))),G(1));function tt(e){return wa.pipe(w(t=>t.observe(e)),v(t=>tn.pipe(b(({target:r})=>r===e),_(()=>t.unobserve(e)),m(({isIntersecting:r})=>r))))}function rn(e,t=16){return Ne(e).pipe(m(({y:r})=>{let o=ce(e),n=St(e);return r>=n.height-o.height-t}),K())}var lr={drawer:R("[data-md-toggle=drawer]"),search:R("[data-md-toggle=search]")};function on(e){return lr[e].checked}function Je(e,t){lr[e].checked!==t&&lr[e].click()}function ze(e){let t=lr[e];return h(t,"change").pipe(m(()=>t.checked),Q(t.checked))}function Ta(e,t){switch(e.constructor){case HTMLInputElement:return e.type==="radio"?/^Arrow/.test(t):!0;case HTMLSelectElement:case HTMLTextAreaElement:return!0;default:return e.isContentEditable}}function Sa(){return O(h(window,"compositionstart").pipe(m(()=>!0)),h(window,"compositionend").pipe(m(()=>!1))).pipe(Q(!1))}function nn(){let e=h(window,"keydown").pipe(b(t=>!(t.metaKey||t.ctrlKey)),m(t=>({mode:on("search")?"search":"global",type:t.key,claim(){t.preventDefault(),t.stopPropagation()}})),b(({mode:t,type:r})=>{if(t==="global"){let o=Ie();if(typeof o!="undefined")return!Ta(o,r)}return!0}),pe());return Sa().pipe(v(t=>t?S:e))}function ye(){return new URL(location.href)}function lt(e,t=!1){if(B("navigation.instant")&&!t){let r=x("a",{href:e.href});document.body.appendChild(r),r.click(),r.remove()}else location.href=e.href}function an(){return new g}function sn(){return location.hash.slice(1)}function cn(e){let t=x("a",{href:e});t.addEventListener("click",r=>r.stopPropagation()),t.click()}function Oa(e){return O(h(window,"hashchange"),e).pipe(m(sn),Q(sn()),b(t=>t.length>0),G(1))}function pn(e){return Oa(e).pipe(m(t=>fe(`[id="${t}"]`)),b(t=>typeof t!="undefined"))}function Pt(e){let t=matchMedia(e);return ar(r=>t.addListener(()=>r(t.matches))).pipe(Q(t.matches))}function ln(){let e=matchMedia("print");return O(h(window,"beforeprint").pipe(m(()=>!0)),h(window,"afterprint").pipe(m(()=>!1))).pipe(Q(e.matches))}function Nr(e,t){return e.pipe(v(r=>r?t():S))}function zr(e,t){return new j(r=>{let o=new XMLHttpRequest;return o.open("GET",`${e}`),o.responseType="blob",o.addEventListener("load",()=>{o.status>=200&&o.status<300?(r.next(o.response),r.complete()):r.error(new Error(o.statusText))}),o.addEventListener("error",()=>{r.error(new Error("Network error"))}),o.addEventListener("abort",()=>{r.complete()}),typeof(t==null?void 0:t.progress$)!="undefined"&&(o.addEventListener("progress",n=>{var i;if(n.lengthComputable)t.progress$.next(n.loaded/n.total*100);else{let a=(i=o.getResponseHeader("Content-Length"))!=null?i:0;t.progress$.next(n.loaded/+a*100)}}),t.progress$.next(5)),o.send(),()=>o.abort()})}function je(e,t){return zr(e,t).pipe(v(r=>r.text()),m(r=>JSON.parse(r)),G(1))}function mn(e,t){let r=new DOMParser;return zr(e,t).pipe(v(o=>o.text()),m(o=>r.parseFromString(o,"text/html")),G(1))}function fn(e,t){let r=new DOMParser;return zr(e,t).pipe(v(o=>o.text()),m(o=>r.parseFromString(o,"text/xml")),G(1))}function un(){return{x:Math.max(0,scrollX),y:Math.max(0,scrollY)}}function dn(){return O(h(window,"scroll",{passive:!0}),h(window,"resize",{passive:!0})).pipe(m(un),Q(un()))}function hn(){return{width:innerWidth,height:innerHeight}}function bn(){return h(window,"resize",{passive:!0}).pipe(m(hn),Q(hn()))}function vn(){return z([dn(),bn()]).pipe(m(([e,t])=>({offset:e,size:t})),G(1))}function mr(e,{viewport$:t,header$:r}){let o=t.pipe(ee("size")),n=z([o,r]).pipe(m(()=>Ve(e)));return z([r,t,n]).pipe(m(([{height:i},{offset:a,size:s},{x:p,y:c}])=>({offset:{x:a.x-p,y:a.y-c+i},size:s})))}function Ma(e){return h(e,"message",t=>t.data)}function La(e){let t=new g;return t.subscribe(r=>e.postMessage(r)),t}function gn(e,t=new Worker(e)){let r=Ma(t),o=La(t),n=new g;n.subscribe(o);let i=o.pipe(Z(),ie(!0));return n.pipe(Z(),Re(r.pipe(U(i))),pe())}var _a=R("#__config"),Ot=JSON.parse(_a.textContent);Ot.base=`${new URL(Ot.base,ye())}`;function xe(){return Ot}function B(e){return Ot.features.includes(e)}function Ee(e,t){return typeof t!="undefined"?Ot.translations[e].replace("#",t.toString()):Ot.translations[e]}function Se(e,t=document){return R(`[data-md-component=${e}]`,t)}function ae(e,t=document){return P(`[data-md-component=${e}]`,t)}function Aa(e){let t=R(".md-typeset > :first-child",e);return h(t,"click",{once:!0}).pipe(m(()=>R(".md-typeset",e)),m(r=>({hash:__md_hash(r.innerHTML)})))}function yn(e){if(!B("announce.dismiss")||!e.childElementCount)return S;if(!e.hidden){let t=R(".md-typeset",e);__md_hash(t.innerHTML)===__md_get("__announce")&&(e.hidden=!0)}return C(()=>{let t=new g;return t.subscribe(({hash:r})=>{e.hidden=!0,__md_set("__announce",r)}),Aa(e).pipe(w(r=>t.next(r)),_(()=>t.complete()),m(r=>$({ref:e},r)))})}function Ca(e,{target$:t}){return t.pipe(m(r=>({hidden:r!==e})))}function xn(e,t){let r=new g;return r.subscribe(({hidden:o})=>{e.hidden=o}),Ca(e,t).pipe(w(o=>r.next(o)),_(()=>r.complete()),m(o=>$({ref:e},o)))}function Rt(e,t){return t==="inline"?x("div",{class:"md-tooltip md-tooltip--inline",id:e,role:"tooltip"},x("div",{class:"md-tooltip__inner md-typeset"})):x("div",{class:"md-tooltip",id:e,role:"tooltip"},x("div",{class:"md-tooltip__inner md-typeset"}))}function En(...e){return x("div",{class:"md-tooltip2",role:"tooltip"},x("div",{class:"md-tooltip2__inner md-typeset"},e))}function wn(e,t){if(t=t?`${t}_annotation_${e}`:void 0,t){let r=t?`#${t}`:void 0;return x("aside",{class:"md-annotation",tabIndex:0},Rt(t),x("a",{href:r,class:"md-annotation__index",tabIndex:-1},x("span",{"data-md-annotation-id":e})))}else return x("aside",{class:"md-annotation",tabIndex:0},Rt(t),x("span",{class:"md-annotation__index",tabIndex:-1},x("span",{"data-md-annotation-id":e})))}function Tn(e){return x("button",{class:"md-clipboard md-icon",title:Ee("clipboard.copy"),"data-clipboard-target":`#${e} > code`})}var On=Lt(qr());function Qr(e,t){let r=t&2,o=t&1,n=Object.keys(e.terms).filter(p=>!e.terms[p]).reduce((p,c)=>[...p,x("del",null,(0,On.default)(c))," "],[]).slice(0,-1),i=xe(),a=new URL(e.location,i.base);B("search.highlight")&&a.searchParams.set("h",Object.entries(e.terms).filter(([,p])=>p).reduce((p,[c])=>`${p} ${c}`.trim(),""));let{tags:s}=xe();return x("a",{href:`${a}`,class:"md-search-result__link",tabIndex:-1},x("article",{class:"md-search-result__article md-typeset","data-md-score":e.score.toFixed(2)},r>0&&x("div",{class:"md-search-result__icon md-icon"}),r>0&&x("h1",null,e.title),r<=0&&x("h2",null,e.title),o>0&&e.text.length>0&&e.text,e.tags&&e.tags.map(p=>{let c=s?p in s?`md-tag-icon md-tag--${s[p]}`:"md-tag-icon":"";return x("span",{class:`md-tag ${c}`},p)}),o>0&&n.length>0&&x("p",{class:"md-search-result__terms"},Ee("search.result.term.missing"),": ",...n)))}function Mn(e){let t=e[0].score,r=[...e],o=xe(),n=r.findIndex(l=>!`${new URL(l.location,o.base)}`.includes("#")),[i]=r.splice(n,1),a=r.findIndex(l=>l.scoreQr(l,1)),...p.length?[x("details",{class:"md-search-result__more"},x("summary",{tabIndex:-1},x("div",null,p.length>0&&p.length===1?Ee("search.result.more.one"):Ee("search.result.more.other",p.length))),...p.map(l=>Qr(l,1)))]:[]];return x("li",{class:"md-search-result__item"},c)}function Ln(e){return x("ul",{class:"md-source__facts"},Object.entries(e).map(([t,r])=>x("li",{class:`md-source__fact md-source__fact--${t}`},typeof r=="number"?sr(r):r)))}function Kr(e){let t=`tabbed-control tabbed-control--${e}`;return x("div",{class:t,hidden:!0},x("button",{class:"tabbed-button",tabIndex:-1,"aria-hidden":"true"}))}function _n(e){return x("div",{class:"md-typeset__scrollwrap"},x("div",{class:"md-typeset__table"},e))}function $a(e){var o;let t=xe(),r=new URL(`../${e.version}/`,t.base);return x("li",{class:"md-version__item"},x("a",{href:`${r}`,class:"md-version__link"},e.title,((o=t.version)==null?void 0:o.alias)&&e.aliases.length>0&&x("span",{class:"md-version__alias"},e.aliases[0])))}function An(e,t){var o;let r=xe();return e=e.filter(n=>{var i;return!((i=n.properties)!=null&&i.hidden)}),x("div",{class:"md-version"},x("button",{class:"md-version__current","aria-label":Ee("select.version")},t.title,((o=r.version)==null?void 0:o.alias)&&t.aliases.length>0&&x("span",{class:"md-version__alias"},t.aliases[0])),x("ul",{class:"md-version__list"},e.map($a)))}var Pa=0;function Ra(e){let t=z([et(e),$t(e)]).pipe(m(([o,n])=>o||n),K()),r=C(()=>Xo(e)).pipe(ne(Ne),pt(1),He(t),m(()=>Zo(e)));return t.pipe(Ae(o=>o),v(()=>z([t,r])),m(([o,n])=>({active:o,offset:n})),pe())}function Ia(e,t){let{content$:r,viewport$:o}=t,n=`__tooltip2_${Pa++}`;return C(()=>{let i=new g,a=new _r(!1);i.pipe(Z(),ie(!1)).subscribe(a);let s=a.pipe(Ht(c=>Me(+!c*250,kr)),K(),v(c=>c?r:S),w(c=>c.id=n),pe());z([i.pipe(m(({active:c})=>c)),s.pipe(v(c=>$t(c,250)),Q(!1))]).pipe(m(c=>c.some(l=>l))).subscribe(a);let p=a.pipe(b(c=>c),re(s,o),m(([c,l,{size:f}])=>{let u=e.getBoundingClientRect(),d=u.width/2;if(l.role==="tooltip")return{x:d,y:8+u.height};if(u.y>=f.height/2){let{height:y}=ce(l);return{x:d,y:-16-y}}else return{x:d,y:16+u.height}}));return z([s,i,p]).subscribe(([c,{offset:l},f])=>{c.style.setProperty("--md-tooltip-host-x",`${l.x}px`),c.style.setProperty("--md-tooltip-host-y",`${l.y}px`),c.style.setProperty("--md-tooltip-x",`${f.x}px`),c.style.setProperty("--md-tooltip-y",`${f.y}px`),c.classList.toggle("md-tooltip2--top",f.y<0),c.classList.toggle("md-tooltip2--bottom",f.y>=0)}),a.pipe(b(c=>c),re(s,(c,l)=>l),b(c=>c.role==="tooltip")).subscribe(c=>{let l=ce(R(":scope > *",c));c.style.setProperty("--md-tooltip-width",`${l.width}px`),c.style.setProperty("--md-tooltip-tail","0px")}),a.pipe(K(),ve(me),re(s)).subscribe(([c,l])=>{l.classList.toggle("md-tooltip2--active",c)}),z([a.pipe(b(c=>c)),s]).subscribe(([c,l])=>{l.role==="dialog"?(e.setAttribute("aria-controls",n),e.setAttribute("aria-haspopup","dialog")):e.setAttribute("aria-describedby",n)}),a.pipe(b(c=>!c)).subscribe(()=>{e.removeAttribute("aria-controls"),e.removeAttribute("aria-describedby"),e.removeAttribute("aria-haspopup")}),Ra(e).pipe(w(c=>i.next(c)),_(()=>i.complete()),m(c=>$({ref:e},c)))})}function mt(e,{viewport$:t},r=document.body){return Ia(e,{content$:new j(o=>{let n=e.title,i=En(n);return o.next(i),e.removeAttribute("title"),r.append(i),()=>{i.remove(),e.setAttribute("title",n)}}),viewport$:t})}function ja(e,t){let r=C(()=>z([en(e),Ne(t)])).pipe(m(([{x:o,y:n},i])=>{let{width:a,height:s}=ce(e);return{x:o-i.x+a/2,y:n-i.y+s/2}}));return et(e).pipe(v(o=>r.pipe(m(n=>({active:o,offset:n})),Te(+!o||1/0))))}function Cn(e,t,{target$:r}){let[o,n]=Array.from(e.children);return C(()=>{let i=new g,a=i.pipe(Z(),ie(!0));return i.subscribe({next({offset:s}){e.style.setProperty("--md-tooltip-x",`${s.x}px`),e.style.setProperty("--md-tooltip-y",`${s.y}px`)},complete(){e.style.removeProperty("--md-tooltip-x"),e.style.removeProperty("--md-tooltip-y")}}),tt(e).pipe(U(a)).subscribe(s=>{e.toggleAttribute("data-md-visible",s)}),O(i.pipe(b(({active:s})=>s)),i.pipe(_e(250),b(({active:s})=>!s))).subscribe({next({active:s}){s?e.prepend(o):o.remove()},complete(){e.prepend(o)}}),i.pipe(Le(16,me)).subscribe(({active:s})=>{o.classList.toggle("md-tooltip--active",s)}),i.pipe(pt(125,me),b(()=>!!e.offsetParent),m(()=>e.offsetParent.getBoundingClientRect()),m(({x:s})=>s)).subscribe({next(s){s?e.style.setProperty("--md-tooltip-0",`${-s}px`):e.style.removeProperty("--md-tooltip-0")},complete(){e.style.removeProperty("--md-tooltip-0")}}),h(n,"click").pipe(U(a),b(s=>!(s.metaKey||s.ctrlKey))).subscribe(s=>{s.stopPropagation(),s.preventDefault()}),h(n,"mousedown").pipe(U(a),re(i)).subscribe(([s,{active:p}])=>{var c;if(s.button!==0||s.metaKey||s.ctrlKey)s.preventDefault();else if(p){s.preventDefault();let l=e.parentElement.closest(".md-annotation");l instanceof HTMLElement?l.focus():(c=Ie())==null||c.blur()}}),r.pipe(U(a),b(s=>s===o),Ge(125)).subscribe(()=>e.focus()),ja(e,t).pipe(w(s=>i.next(s)),_(()=>i.complete()),m(s=>$({ref:e},s)))})}function Fa(e){return e.tagName==="CODE"?P(".c, .c1, .cm",e):[e]}function Wa(e){let t=[];for(let r of Fa(e)){let o=[],n=document.createNodeIterator(r,NodeFilter.SHOW_TEXT);for(let i=n.nextNode();i;i=n.nextNode())o.push(i);for(let i of o){let a;for(;a=/(\(\d+\))(!)?/.exec(i.textContent);){let[,s,p]=a;if(typeof p=="undefined"){let c=i.splitText(a.index);i=c.splitText(s.length),t.push(c)}else{i.textContent=s,t.push(i);break}}}}return t}function kn(e,t){t.append(...Array.from(e.childNodes))}function fr(e,t,{target$:r,print$:o}){let n=t.closest("[id]"),i=n==null?void 0:n.id,a=new Map;for(let s of Wa(t)){let[,p]=s.textContent.match(/\((\d+)\)/);fe(`:scope > li:nth-child(${p})`,e)&&(a.set(p,wn(p,i)),s.replaceWith(a.get(p)))}return a.size===0?S:C(()=>{let s=new g,p=s.pipe(Z(),ie(!0)),c=[];for(let[l,f]of a)c.push([R(".md-typeset",f),R(`:scope > li:nth-child(${l})`,e)]);return o.pipe(U(p)).subscribe(l=>{e.hidden=!l,e.classList.toggle("md-annotation-list",l);for(let[f,u]of c)l?kn(f,u):kn(u,f)}),O(...[...a].map(([,l])=>Cn(l,t,{target$:r}))).pipe(_(()=>s.complete()),pe())})}function Hn(e){if(e.nextElementSibling){let t=e.nextElementSibling;if(t.tagName==="OL")return t;if(t.tagName==="P"&&!t.children.length)return Hn(t)}}function $n(e,t){return C(()=>{let r=Hn(e);return typeof r!="undefined"?fr(r,e,t):S})}var Pn=Lt(Br());var Ua=0;function Rn(e){if(e.nextElementSibling){let t=e.nextElementSibling;if(t.tagName==="OL")return t;if(t.tagName==="P"&&!t.children.length)return Rn(t)}}function Da(e){return ge(e).pipe(m(({width:t})=>({scrollable:St(e).width>t})),ee("scrollable"))}function In(e,t){let{matches:r}=matchMedia("(hover)"),o=C(()=>{let n=new g,i=n.pipe(jr(1));n.subscribe(({scrollable:c})=>{c&&r?e.setAttribute("tabindex","0"):e.removeAttribute("tabindex")});let a=[];if(Pn.default.isSupported()&&(e.closest(".copy")||B("content.code.copy")&&!e.closest(".no-copy"))){let c=e.closest("pre");c.id=`__code_${Ua++}`;let l=Tn(c.id);c.insertBefore(l,e),B("content.tooltips")&&a.push(mt(l,{viewport$}))}let s=e.closest(".highlight");if(s instanceof HTMLElement){let c=Rn(s);if(typeof c!="undefined"&&(s.classList.contains("annotate")||B("content.code.annotate"))){let l=fr(c,e,t);a.push(ge(s).pipe(U(i),m(({width:f,height:u})=>f&&u),K(),v(f=>f?l:S)))}}return P(":scope > span[id]",e).length&&e.classList.add("md-code__content"),Da(e).pipe(w(c=>n.next(c)),_(()=>n.complete()),m(c=>$({ref:e},c)),Re(...a))});return B("content.lazy")?tt(e).pipe(b(n=>n),Te(1),v(()=>o)):o}function Va(e,{target$:t,print$:r}){let o=!0;return O(t.pipe(m(n=>n.closest("details:not([open])")),b(n=>e===n),m(()=>({action:"open",reveal:!0}))),r.pipe(b(n=>n||!o),w(()=>o=e.open),m(n=>({action:n?"open":"close"}))))}function jn(e,t){return C(()=>{let r=new g;return r.subscribe(({action:o,reveal:n})=>{e.toggleAttribute("open",o==="open"),n&&e.scrollIntoView()}),Va(e,t).pipe(w(o=>r.next(o)),_(()=>r.complete()),m(o=>$({ref:e},o)))})}var Fn=".node circle,.node ellipse,.node path,.node polygon,.node rect{fill:var(--md-mermaid-node-bg-color);stroke:var(--md-mermaid-node-fg-color)}marker{fill:var(--md-mermaid-edge-color)!important}.edgeLabel .label rect{fill:#0000}.label{color:var(--md-mermaid-label-fg-color);font-family:var(--md-mermaid-font-family)}.label foreignObject{line-height:normal;overflow:visible}.label div .edgeLabel{color:var(--md-mermaid-label-fg-color)}.edgeLabel,.edgeLabel p,.label div .edgeLabel{background-color:var(--md-mermaid-label-bg-color)}.edgeLabel,.edgeLabel p{fill:var(--md-mermaid-label-bg-color);color:var(--md-mermaid-edge-color)}.edgePath .path,.flowchart-link{stroke:var(--md-mermaid-edge-color);stroke-width:.05rem}.edgePath .arrowheadPath{fill:var(--md-mermaid-edge-color);stroke:none}.cluster rect{fill:var(--md-default-fg-color--lightest);stroke:var(--md-default-fg-color--lighter)}.cluster span{color:var(--md-mermaid-label-fg-color);font-family:var(--md-mermaid-font-family)}g #flowchart-circleEnd,g #flowchart-circleStart,g #flowchart-crossEnd,g #flowchart-crossStart,g #flowchart-pointEnd,g #flowchart-pointStart{stroke:none}g.classGroup line,g.classGroup rect{fill:var(--md-mermaid-node-bg-color);stroke:var(--md-mermaid-node-fg-color)}g.classGroup text{fill:var(--md-mermaid-label-fg-color);font-family:var(--md-mermaid-font-family)}.classLabel .box{fill:var(--md-mermaid-label-bg-color);background-color:var(--md-mermaid-label-bg-color);opacity:1}.classLabel .label{fill:var(--md-mermaid-label-fg-color);font-family:var(--md-mermaid-font-family)}.node .divider{stroke:var(--md-mermaid-node-fg-color)}.relation{stroke:var(--md-mermaid-edge-color)}.cardinality{fill:var(--md-mermaid-label-fg-color);font-family:var(--md-mermaid-font-family)}.cardinality text{fill:inherit!important}defs #classDiagram-compositionEnd,defs #classDiagram-compositionStart,defs #classDiagram-dependencyEnd,defs #classDiagram-dependencyStart,defs #classDiagram-extensionEnd,defs #classDiagram-extensionStart{fill:var(--md-mermaid-edge-color)!important;stroke:var(--md-mermaid-edge-color)!important}defs #classDiagram-aggregationEnd,defs #classDiagram-aggregationStart{fill:var(--md-mermaid-label-bg-color)!important;stroke:var(--md-mermaid-edge-color)!important}g.stateGroup rect{fill:var(--md-mermaid-node-bg-color);stroke:var(--md-mermaid-node-fg-color)}g.stateGroup .state-title{fill:var(--md-mermaid-label-fg-color)!important;font-family:var(--md-mermaid-font-family)}g.stateGroup .composit{fill:var(--md-mermaid-label-bg-color)}.nodeLabel,.nodeLabel p{color:var(--md-mermaid-label-fg-color);font-family:var(--md-mermaid-font-family)}a .nodeLabel{text-decoration:underline}.node circle.state-end,.node circle.state-start,.start-state{fill:var(--md-mermaid-edge-color);stroke:none}.end-state-inner,.end-state-outer{fill:var(--md-mermaid-edge-color)}.end-state-inner,.node circle.state-end{stroke:var(--md-mermaid-label-bg-color)}.transition{stroke:var(--md-mermaid-edge-color)}[id^=state-fork] rect,[id^=state-join] rect{fill:var(--md-mermaid-edge-color)!important;stroke:none!important}.statediagram-cluster.statediagram-cluster .inner{fill:var(--md-default-bg-color)}.statediagram-cluster rect{fill:var(--md-mermaid-node-bg-color);stroke:var(--md-mermaid-node-fg-color)}.statediagram-state rect.divider{fill:var(--md-default-fg-color--lightest);stroke:var(--md-default-fg-color--lighter)}defs #statediagram-barbEnd{stroke:var(--md-mermaid-edge-color)}.attributeBoxEven,.attributeBoxOdd{fill:var(--md-mermaid-node-bg-color);stroke:var(--md-mermaid-node-fg-color)}.entityBox{fill:var(--md-mermaid-label-bg-color);stroke:var(--md-mermaid-node-fg-color)}.entityLabel{fill:var(--md-mermaid-label-fg-color);font-family:var(--md-mermaid-font-family)}.relationshipLabelBox{fill:var(--md-mermaid-label-bg-color);fill-opacity:1;background-color:var(--md-mermaid-label-bg-color);opacity:1}.relationshipLabel{fill:var(--md-mermaid-label-fg-color)}.relationshipLine{stroke:var(--md-mermaid-edge-color)}defs #ONE_OR_MORE_END *,defs #ONE_OR_MORE_START *,defs #ONLY_ONE_END *,defs #ONLY_ONE_START *,defs #ZERO_OR_MORE_END *,defs #ZERO_OR_MORE_START *,defs #ZERO_OR_ONE_END *,defs #ZERO_OR_ONE_START *{stroke:var(--md-mermaid-edge-color)!important}defs #ZERO_OR_MORE_END circle,defs #ZERO_OR_MORE_START circle{fill:var(--md-mermaid-label-bg-color)}.actor{fill:var(--md-mermaid-sequence-actor-bg-color);stroke:var(--md-mermaid-sequence-actor-border-color)}text.actor>tspan{fill:var(--md-mermaid-sequence-actor-fg-color);font-family:var(--md-mermaid-font-family)}line{stroke:var(--md-mermaid-sequence-actor-line-color)}.actor-man circle,.actor-man line{fill:var(--md-mermaid-sequence-actorman-bg-color);stroke:var(--md-mermaid-sequence-actorman-line-color)}.messageLine0,.messageLine1{stroke:var(--md-mermaid-sequence-message-line-color)}.note{fill:var(--md-mermaid-sequence-note-bg-color);stroke:var(--md-mermaid-sequence-note-border-color)}.loopText,.loopText>tspan,.messageText,.noteText>tspan{stroke:none;font-family:var(--md-mermaid-font-family)!important}.messageText{fill:var(--md-mermaid-sequence-message-fg-color)}.loopText,.loopText>tspan{fill:var(--md-mermaid-sequence-loop-fg-color)}.noteText>tspan{fill:var(--md-mermaid-sequence-note-fg-color)}#arrowhead path{fill:var(--md-mermaid-sequence-message-line-color);stroke:none}.loopLine{fill:var(--md-mermaid-sequence-loop-bg-color);stroke:var(--md-mermaid-sequence-loop-border-color)}.labelBox{fill:var(--md-mermaid-sequence-label-bg-color);stroke:none}.labelText,.labelText>span{fill:var(--md-mermaid-sequence-label-fg-color);font-family:var(--md-mermaid-font-family)}.sequenceNumber{fill:var(--md-mermaid-sequence-number-fg-color)}rect.rect{fill:var(--md-mermaid-sequence-box-bg-color);stroke:none}rect.rect+text.text{fill:var(--md-mermaid-sequence-box-fg-color)}defs #sequencenumber{fill:var(--md-mermaid-sequence-number-bg-color)!important}";var Gr,za=0;function qa(){return typeof mermaid=="undefined"||mermaid instanceof Element?Tt("https://unpkg.com/mermaid@11/dist/mermaid.min.js"):I(void 0)}function Wn(e){return e.classList.remove("mermaid"),Gr||(Gr=qa().pipe(w(()=>mermaid.initialize({startOnLoad:!1,themeCSS:Fn,sequence:{actorFontSize:"16px",messageFontSize:"16px",noteFontSize:"16px"}})),m(()=>{}),G(1))),Gr.subscribe(()=>so(this,null,function*(){e.classList.add("mermaid");let t=`__mermaid_${za++}`,r=x("div",{class:"mermaid"}),o=e.textContent,{svg:n,fn:i}=yield mermaid.render(t,o),a=r.attachShadow({mode:"closed"});a.innerHTML=n,e.replaceWith(r),i==null||i(a)})),Gr.pipe(m(()=>({ref:e})))}var Un=x("table");function Dn(e){return e.replaceWith(Un),Un.replaceWith(_n(e)),I({ref:e})}function Qa(e){let t=e.find(r=>r.checked)||e[0];return O(...e.map(r=>h(r,"change").pipe(m(()=>R(`label[for="${r.id}"]`))))).pipe(Q(R(`label[for="${t.id}"]`)),m(r=>({active:r})))}function Vn(e,{viewport$:t,target$:r}){let o=R(".tabbed-labels",e),n=P(":scope > input",e),i=Kr("prev");e.append(i);let a=Kr("next");return e.append(a),C(()=>{let s=new g,p=s.pipe(Z(),ie(!0));z([s,ge(e),tt(e)]).pipe(U(p),Le(1,me)).subscribe({next([{active:c},l]){let f=Ve(c),{width:u}=ce(c);e.style.setProperty("--md-indicator-x",`${f.x}px`),e.style.setProperty("--md-indicator-width",`${u}px`);let d=pr(o);(f.xd.x+l.width)&&o.scrollTo({left:Math.max(0,f.x-16),behavior:"smooth"})},complete(){e.style.removeProperty("--md-indicator-x"),e.style.removeProperty("--md-indicator-width")}}),z([Ne(o),ge(o)]).pipe(U(p)).subscribe(([c,l])=>{let f=St(o);i.hidden=c.x<16,a.hidden=c.x>f.width-l.width-16}),O(h(i,"click").pipe(m(()=>-1)),h(a,"click").pipe(m(()=>1))).pipe(U(p)).subscribe(c=>{let{width:l}=ce(o);o.scrollBy({left:l*c,behavior:"smooth"})}),r.pipe(U(p),b(c=>n.includes(c))).subscribe(c=>c.click()),o.classList.add("tabbed-labels--linked");for(let c of n){let l=R(`label[for="${c.id}"]`);l.replaceChildren(x("a",{href:`#${l.htmlFor}`,tabIndex:-1},...Array.from(l.childNodes))),h(l.firstElementChild,"click").pipe(U(p),b(f=>!(f.metaKey||f.ctrlKey)),w(f=>{f.preventDefault(),f.stopPropagation()})).subscribe(()=>{history.replaceState({},"",`#${l.htmlFor}`),l.click()})}return B("content.tabs.link")&&s.pipe(Ce(1),re(t)).subscribe(([{active:c},{offset:l}])=>{let f=c.innerText.trim();if(c.hasAttribute("data-md-switching"))c.removeAttribute("data-md-switching");else{let u=e.offsetTop-l.y;for(let y of P("[data-tabs]"))for(let M of P(":scope > input",y)){let X=R(`label[for="${M.id}"]`);if(X!==c&&X.innerText.trim()===f){X.setAttribute("data-md-switching",""),M.click();break}}window.scrollTo({top:e.offsetTop-u});let d=__md_get("__tabs")||[];__md_set("__tabs",[...new Set([f,...d])])}}),s.pipe(U(p)).subscribe(()=>{for(let c of P("audio, video",e))c.pause()}),Qa(n).pipe(w(c=>s.next(c)),_(()=>s.complete()),m(c=>$({ref:e},c)))}).pipe(Ke(se))}function Nn(e,{viewport$:t,target$:r,print$:o}){return O(...P(".annotate:not(.highlight)",e).map(n=>$n(n,{target$:r,print$:o})),...P("pre:not(.mermaid) > code",e).map(n=>In(n,{target$:r,print$:o})),...P("pre.mermaid",e).map(n=>Wn(n)),...P("table:not([class])",e).map(n=>Dn(n)),...P("details",e).map(n=>jn(n,{target$:r,print$:o})),...P("[data-tabs]",e).map(n=>Vn(n,{viewport$:t,target$:r})),...P("[title]",e).filter(()=>B("content.tooltips")).map(n=>mt(n,{viewport$:t})))}function Ka(e,{alert$:t}){return t.pipe(v(r=>O(I(!0),I(!1).pipe(Ge(2e3))).pipe(m(o=>({message:r,active:o})))))}function zn(e,t){let r=R(".md-typeset",e);return C(()=>{let o=new g;return o.subscribe(({message:n,active:i})=>{e.classList.toggle("md-dialog--active",i),r.textContent=n}),Ka(e,t).pipe(w(n=>o.next(n)),_(()=>o.complete()),m(n=>$({ref:e},n)))})}var Ya=0;function Ba(e,t){document.body.append(e);let{width:r}=ce(e);e.style.setProperty("--md-tooltip-width",`${r}px`),e.remove();let o=cr(t),n=typeof o!="undefined"?Ne(o):I({x:0,y:0}),i=O(et(t),$t(t)).pipe(K());return z([i,n]).pipe(m(([a,s])=>{let{x:p,y:c}=Ve(t),l=ce(t),f=t.closest("table");return f&&t.parentElement&&(p+=f.offsetLeft+t.parentElement.offsetLeft,c+=f.offsetTop+t.parentElement.offsetTop),{active:a,offset:{x:p-s.x+l.width/2-r/2,y:c-s.y+l.height+8}}}))}function qn(e){let t=e.title;if(!t.length)return S;let r=`__tooltip_${Ya++}`,o=Rt(r,"inline"),n=R(".md-typeset",o);return n.innerHTML=t,C(()=>{let i=new g;return i.subscribe({next({offset:a}){o.style.setProperty("--md-tooltip-x",`${a.x}px`),o.style.setProperty("--md-tooltip-y",`${a.y}px`)},complete(){o.style.removeProperty("--md-tooltip-x"),o.style.removeProperty("--md-tooltip-y")}}),O(i.pipe(b(({active:a})=>a)),i.pipe(_e(250),b(({active:a})=>!a))).subscribe({next({active:a}){a?(e.insertAdjacentElement("afterend",o),e.setAttribute("aria-describedby",r),e.removeAttribute("title")):(o.remove(),e.removeAttribute("aria-describedby"),e.setAttribute("title",t))},complete(){o.remove(),e.removeAttribute("aria-describedby"),e.setAttribute("title",t)}}),i.pipe(Le(16,me)).subscribe(({active:a})=>{o.classList.toggle("md-tooltip--active",a)}),i.pipe(pt(125,me),b(()=>!!e.offsetParent),m(()=>e.offsetParent.getBoundingClientRect()),m(({x:a})=>a)).subscribe({next(a){a?o.style.setProperty("--md-tooltip-0",`${-a}px`):o.style.removeProperty("--md-tooltip-0")},complete(){o.style.removeProperty("--md-tooltip-0")}}),Ba(o,e).pipe(w(a=>i.next(a)),_(()=>i.complete()),m(a=>$({ref:e},a)))}).pipe(Ke(se))}function Ga({viewport$:e}){if(!B("header.autohide"))return I(!1);let t=e.pipe(m(({offset:{y:n}})=>n),Be(2,1),m(([n,i])=>[nMath.abs(i-n.y)>100),m(([,[n]])=>n),K()),o=ze("search");return z([e,o]).pipe(m(([{offset:n},i])=>n.y>400&&!i),K(),v(n=>n?r:I(!1)),Q(!1))}function Qn(e,t){return C(()=>z([ge(e),Ga(t)])).pipe(m(([{height:r},o])=>({height:r,hidden:o})),K((r,o)=>r.height===o.height&&r.hidden===o.hidden),G(1))}function Kn(e,{header$:t,main$:r}){return C(()=>{let o=new g,n=o.pipe(Z(),ie(!0));o.pipe(ee("active"),He(t)).subscribe(([{active:a},{hidden:s}])=>{e.classList.toggle("md-header--shadow",a&&!s),e.hidden=s});let i=ue(P("[title]",e)).pipe(b(()=>B("content.tooltips")),ne(a=>qn(a)));return r.subscribe(o),t.pipe(U(n),m(a=>$({ref:e},a)),Re(i.pipe(U(n))))})}function Ja(e,{viewport$:t,header$:r}){return mr(e,{viewport$:t,header$:r}).pipe(m(({offset:{y:o}})=>{let{height:n}=ce(e);return{active:o>=n}}),ee("active"))}function Yn(e,t){return C(()=>{let r=new g;r.subscribe({next({active:n}){e.classList.toggle("md-header__title--active",n)},complete(){e.classList.remove("md-header__title--active")}});let o=fe(".md-content h1");return typeof o=="undefined"?S:Ja(o,t).pipe(w(n=>r.next(n)),_(()=>r.complete()),m(n=>$({ref:e},n)))})}function Bn(e,{viewport$:t,header$:r}){let o=r.pipe(m(({height:i})=>i),K()),n=o.pipe(v(()=>ge(e).pipe(m(({height:i})=>({top:e.offsetTop,bottom:e.offsetTop+i})),ee("bottom"))));return z([o,n,t]).pipe(m(([i,{top:a,bottom:s},{offset:{y:p},size:{height:c}}])=>(c=Math.max(0,c-Math.max(0,a-p,i)-Math.max(0,c+p-s)),{offset:a-i,height:c,active:a-i<=p})),K((i,a)=>i.offset===a.offset&&i.height===a.height&&i.active===a.active))}function Xa(e){let t=__md_get("__palette")||{index:e.findIndex(o=>matchMedia(o.getAttribute("data-md-color-media")).matches)},r=Math.max(0,Math.min(t.index,e.length-1));return I(...e).pipe(ne(o=>h(o,"change").pipe(m(()=>o))),Q(e[r]),m(o=>({index:e.indexOf(o),color:{media:o.getAttribute("data-md-color-media"),scheme:o.getAttribute("data-md-color-scheme"),primary:o.getAttribute("data-md-color-primary"),accent:o.getAttribute("data-md-color-accent")}})),G(1))}function Gn(e){let t=P("input",e),r=x("meta",{name:"theme-color"});document.head.appendChild(r);let o=x("meta",{name:"color-scheme"});document.head.appendChild(o);let n=Pt("(prefers-color-scheme: light)");return C(()=>{let i=new g;return i.subscribe(a=>{if(document.body.setAttribute("data-md-color-switching",""),a.color.media==="(prefers-color-scheme)"){let s=matchMedia("(prefers-color-scheme: light)"),p=document.querySelector(s.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");a.color.scheme=p.getAttribute("data-md-color-scheme"),a.color.primary=p.getAttribute("data-md-color-primary"),a.color.accent=p.getAttribute("data-md-color-accent")}for(let[s,p]of Object.entries(a.color))document.body.setAttribute(`data-md-color-${s}`,p);for(let s=0;sa.key==="Enter"),re(i,(a,s)=>s)).subscribe(({index:a})=>{a=(a+1)%t.length,t[a].click(),t[a].focus()}),i.pipe(m(()=>{let a=Se("header"),s=window.getComputedStyle(a);return o.content=s.colorScheme,s.backgroundColor.match(/\d+/g).map(p=>(+p).toString(16).padStart(2,"0")).join("")})).subscribe(a=>r.content=`#${a}`),i.pipe(ve(se)).subscribe(()=>{document.body.removeAttribute("data-md-color-switching")}),Xa(t).pipe(U(n.pipe(Ce(1))),ct(),w(a=>i.next(a)),_(()=>i.complete()),m(a=>$({ref:e},a)))})}function Jn(e,{progress$:t}){return C(()=>{let r=new g;return r.subscribe(({value:o})=>{e.style.setProperty("--md-progress-value",`${o}`)}),t.pipe(w(o=>r.next({value:o})),_(()=>r.complete()),m(o=>({ref:e,value:o})))})}var Jr=Lt(Br());function Za(e){e.setAttribute("data-md-copying","");let t=e.closest("[data-copy]"),r=t?t.getAttribute("data-copy"):e.innerText;return e.removeAttribute("data-md-copying"),r.trimEnd()}function Xn({alert$:e}){Jr.default.isSupported()&&new j(t=>{new Jr.default("[data-clipboard-target], [data-clipboard-text]",{text:r=>r.getAttribute("data-clipboard-text")||Za(R(r.getAttribute("data-clipboard-target")))}).on("success",r=>t.next(r))}).pipe(w(t=>{t.trigger.focus()}),m(()=>Ee("clipboard.copied"))).subscribe(e)}function Zn(e,t){return e.protocol=t.protocol,e.hostname=t.hostname,e}function es(e,t){let r=new Map;for(let o of P("url",e)){let n=R("loc",o),i=[Zn(new URL(n.textContent),t)];r.set(`${i[0]}`,i);for(let a of P("[rel=alternate]",o)){let s=a.getAttribute("href");s!=null&&i.push(Zn(new URL(s),t))}}return r}function ur(e){return fn(new URL("sitemap.xml",e)).pipe(m(t=>es(t,new URL(e))),de(()=>I(new Map)))}function ts(e,t){if(!(e.target instanceof Element))return S;let r=e.target.closest("a");if(r===null)return S;if(r.target||e.metaKey||e.ctrlKey)return S;let o=new URL(r.href);return o.search=o.hash="",t.has(`${o}`)?(e.preventDefault(),I(new URL(r.href))):S}function ei(e){let t=new Map;for(let r of P(":scope > *",e.head))t.set(r.outerHTML,r);return t}function ti(e){for(let t of P("[href], [src]",e))for(let r of["href","src"]){let o=t.getAttribute(r);if(o&&!/^(?:[a-z]+:)?\/\//i.test(o)){t[r]=t[r];break}}return I(e)}function rs(e){for(let o of["[data-md-component=announce]","[data-md-component=container]","[data-md-component=header-topic]","[data-md-component=outdated]","[data-md-component=logo]","[data-md-component=skip]",...B("navigation.tabs.sticky")?["[data-md-component=tabs]"]:[]]){let n=fe(o),i=fe(o,e);typeof n!="undefined"&&typeof i!="undefined"&&n.replaceWith(i)}let t=ei(document);for(let[o,n]of ei(e))t.has(o)?t.delete(o):document.head.appendChild(n);for(let o of t.values()){let n=o.getAttribute("name");n!=="theme-color"&&n!=="color-scheme"&&o.remove()}let r=Se("container");return Ue(P("script",r)).pipe(v(o=>{let n=e.createElement("script");if(o.src){for(let i of o.getAttributeNames())n.setAttribute(i,o.getAttribute(i));return o.replaceWith(n),new j(i=>{n.onload=()=>i.complete()})}else return n.textContent=o.textContent,o.replaceWith(n),S}),Z(),ie(document))}function ri({location$:e,viewport$:t,progress$:r}){let o=xe();if(location.protocol==="file:")return S;let n=ur(o.base);I(document).subscribe(ti);let i=h(document.body,"click").pipe(He(n),v(([p,c])=>ts(p,c)),pe()),a=h(window,"popstate").pipe(m(ye),pe());i.pipe(re(t)).subscribe(([p,{offset:c}])=>{history.replaceState(c,""),history.pushState(null,"",p)}),O(i,a).subscribe(e);let s=e.pipe(ee("pathname"),v(p=>mn(p,{progress$:r}).pipe(de(()=>(lt(p,!0),S)))),v(ti),v(rs),pe());return O(s.pipe(re(e,(p,c)=>c)),s.pipe(v(()=>e),ee("pathname"),v(()=>e),ee("hash")),e.pipe(K((p,c)=>p.pathname===c.pathname&&p.hash===c.hash),v(()=>i),w(()=>history.back()))).subscribe(p=>{var c,l;history.state!==null||!p.hash?window.scrollTo(0,(l=(c=history.state)==null?void 0:c.y)!=null?l:0):(history.scrollRestoration="auto",cn(p.hash),history.scrollRestoration="manual")}),e.subscribe(()=>{history.scrollRestoration="manual"}),h(window,"beforeunload").subscribe(()=>{history.scrollRestoration="auto"}),t.pipe(ee("offset"),_e(100)).subscribe(({offset:p})=>{history.replaceState(p,"")}),s}var oi=Lt(qr());function ni(e){let t=e.separator.split("|").map(n=>n.replace(/(\(\?[!=<][^)]+\))/g,"").length===0?"\uFFFD":n).join("|"),r=new RegExp(t,"img"),o=(n,i,a)=>`${i}${a}`;return n=>{n=n.replace(/[\s*+\-:~^]+/g," ").trim();let i=new RegExp(`(^|${e.separator}|)(${n.replace(/[|\\{}()[\]^$+*?.-]/g,"\\$&").replace(r,"|")})`,"img");return a=>(0,oi.default)(a).replace(i,o).replace(/<\/mark>(\s+)]*>/img,"$1")}}function jt(e){return e.type===1}function dr(e){return e.type===3}function ii(e,t){let r=gn(e);return O(I(location.protocol!=="file:"),ze("search")).pipe(Ae(o=>o),v(()=>t)).subscribe(({config:o,docs:n})=>r.next({type:0,data:{config:o,docs:n,options:{suggest:B("search.suggest")}}})),r}function ai({document$:e}){let t=xe(),r=je(new URL("../versions.json",t.base)).pipe(de(()=>S)),o=r.pipe(m(n=>{let[,i]=t.base.match(/([^/]+)\/?$/);return n.find(({version:a,aliases:s})=>a===i||s.includes(i))||n[0]}));r.pipe(m(n=>new Map(n.map(i=>[`${new URL(`../${i.version}/`,t.base)}`,i]))),v(n=>h(document.body,"click").pipe(b(i=>!i.metaKey&&!i.ctrlKey),re(o),v(([i,a])=>{if(i.target instanceof Element){let s=i.target.closest("a");if(s&&!s.target&&n.has(s.href)){let p=s.href;return!i.target.closest(".md-version")&&n.get(p)===a?S:(i.preventDefault(),I(p))}}return S}),v(i=>ur(new URL(i)).pipe(m(a=>{let p=ye().href.replace(t.base,i);return a.has(p.split("#")[0])?new URL(p):new URL(i)})))))).subscribe(n=>lt(n,!0)),z([r,o]).subscribe(([n,i])=>{R(".md-header__topic").appendChild(An(n,i))}),e.pipe(v(()=>o)).subscribe(n=>{var a;let i=__md_get("__outdated",sessionStorage);if(i===null){i=!0;let s=((a=t.version)==null?void 0:a.default)||"latest";Array.isArray(s)||(s=[s]);e:for(let p of s)for(let c of n.aliases.concat(n.version))if(new RegExp(p,"i").test(c)){i=!1;break e}__md_set("__outdated",i,sessionStorage)}if(i)for(let s of ae("outdated"))s.hidden=!1})}function is(e,{worker$:t}){let{searchParams:r}=ye();r.has("q")&&(Je("search",!0),e.value=r.get("q"),e.focus(),ze("search").pipe(Ae(i=>!i)).subscribe(()=>{let i=ye();i.searchParams.delete("q"),history.replaceState({},"",`${i}`)}));let o=et(e),n=O(t.pipe(Ae(jt)),h(e,"keyup"),o).pipe(m(()=>e.value),K());return z([n,o]).pipe(m(([i,a])=>({value:i,focus:a})),G(1))}function si(e,{worker$:t}){let r=new g,o=r.pipe(Z(),ie(!0));z([t.pipe(Ae(jt)),r],(i,a)=>a).pipe(ee("value")).subscribe(({value:i})=>t.next({type:2,data:i})),r.pipe(ee("focus")).subscribe(({focus:i})=>{i&&Je("search",i)}),h(e.form,"reset").pipe(U(o)).subscribe(()=>e.focus());let n=R("header [for=__search]");return h(n,"click").subscribe(()=>e.focus()),is(e,{worker$:t}).pipe(w(i=>r.next(i)),_(()=>r.complete()),m(i=>$({ref:e},i)),G(1))}function ci(e,{worker$:t,query$:r}){let o=new g,n=rn(e.parentElement).pipe(b(Boolean)),i=e.parentElement,a=R(":scope > :first-child",e),s=R(":scope > :last-child",e);ze("search").subscribe(l=>s.setAttribute("role",l?"list":"presentation")),o.pipe(re(r),Ur(t.pipe(Ae(jt)))).subscribe(([{items:l},{value:f}])=>{switch(l.length){case 0:a.textContent=f.length?Ee("search.result.none"):Ee("search.result.placeholder");break;case 1:a.textContent=Ee("search.result.one");break;default:let u=sr(l.length);a.textContent=Ee("search.result.other",u)}});let p=o.pipe(w(()=>s.innerHTML=""),v(({items:l})=>O(I(...l.slice(0,10)),I(...l.slice(10)).pipe(Be(4),Vr(n),v(([f])=>f)))),m(Mn),pe());return p.subscribe(l=>s.appendChild(l)),p.pipe(ne(l=>{let f=fe("details",l);return typeof f=="undefined"?S:h(f,"toggle").pipe(U(o),m(()=>f))})).subscribe(l=>{l.open===!1&&l.offsetTop<=i.scrollTop&&i.scrollTo({top:l.offsetTop})}),t.pipe(b(dr),m(({data:l})=>l)).pipe(w(l=>o.next(l)),_(()=>o.complete()),m(l=>$({ref:e},l)))}function as(e,{query$:t}){return t.pipe(m(({value:r})=>{let o=ye();return o.hash="",r=r.replace(/\s+/g,"+").replace(/&/g,"%26").replace(/=/g,"%3D"),o.search=`q=${r}`,{url:o}}))}function pi(e,t){let r=new g,o=r.pipe(Z(),ie(!0));return r.subscribe(({url:n})=>{e.setAttribute("data-clipboard-text",e.href),e.href=`${n}`}),h(e,"click").pipe(U(o)).subscribe(n=>n.preventDefault()),as(e,t).pipe(w(n=>r.next(n)),_(()=>r.complete()),m(n=>$({ref:e},n)))}function li(e,{worker$:t,keyboard$:r}){let o=new g,n=Se("search-query"),i=O(h(n,"keydown"),h(n,"focus")).pipe(ve(se),m(()=>n.value),K());return o.pipe(He(i),m(([{suggest:s},p])=>{let c=p.split(/([\s-]+)/);if(s!=null&&s.length&&c[c.length-1]){let l=s[s.length-1];l.startsWith(c[c.length-1])&&(c[c.length-1]=l)}else c.length=0;return c})).subscribe(s=>e.innerHTML=s.join("").replace(/\s/g," ")),r.pipe(b(({mode:s})=>s==="search")).subscribe(s=>{switch(s.type){case"ArrowRight":e.innerText.length&&n.selectionStart===n.value.length&&(n.value=e.innerText);break}}),t.pipe(b(dr),m(({data:s})=>s)).pipe(w(s=>o.next(s)),_(()=>o.complete()),m(()=>({ref:e})))}function mi(e,{index$:t,keyboard$:r}){let o=xe();try{let n=ii(o.search,t),i=Se("search-query",e),a=Se("search-result",e);h(e,"click").pipe(b(({target:p})=>p instanceof Element&&!!p.closest("a"))).subscribe(()=>Je("search",!1)),r.pipe(b(({mode:p})=>p==="search")).subscribe(p=>{let c=Ie();switch(p.type){case"Enter":if(c===i){let l=new Map;for(let f of P(":first-child [href]",a)){let u=f.firstElementChild;l.set(f,parseFloat(u.getAttribute("data-md-score")))}if(l.size){let[[f]]=[...l].sort(([,u],[,d])=>d-u);f.click()}p.claim()}break;case"Escape":case"Tab":Je("search",!1),i.blur();break;case"ArrowUp":case"ArrowDown":if(typeof c=="undefined")i.focus();else{let l=[i,...P(":not(details) > [href], summary, details[open] [href]",a)],f=Math.max(0,(Math.max(0,l.indexOf(c))+l.length+(p.type==="ArrowUp"?-1:1))%l.length);l[f].focus()}p.claim();break;default:i!==Ie()&&i.focus()}}),r.pipe(b(({mode:p})=>p==="global")).subscribe(p=>{switch(p.type){case"f":case"s":case"/":i.focus(),i.select(),p.claim();break}});let s=si(i,{worker$:n});return O(s,ci(a,{worker$:n,query$:s})).pipe(Re(...ae("search-share",e).map(p=>pi(p,{query$:s})),...ae("search-suggest",e).map(p=>li(p,{worker$:n,keyboard$:r}))))}catch(n){return e.hidden=!0,Ye}}function fi(e,{index$:t,location$:r}){return z([t,r.pipe(Q(ye()),b(o=>!!o.searchParams.get("h")))]).pipe(m(([o,n])=>ni(o.config)(n.searchParams.get("h"))),m(o=>{var a;let n=new Map,i=document.createNodeIterator(e,NodeFilter.SHOW_TEXT);for(let s=i.nextNode();s;s=i.nextNode())if((a=s.parentElement)!=null&&a.offsetHeight){let p=s.textContent,c=o(p);c.length>p.length&&n.set(s,c)}for(let[s,p]of n){let{childNodes:c}=x("span",null,p);s.replaceWith(...Array.from(c))}return{ref:e,nodes:n}}))}function ss(e,{viewport$:t,main$:r}){let o=e.closest(".md-grid"),n=o.offsetTop-o.parentElement.offsetTop;return z([r,t]).pipe(m(([{offset:i,height:a},{offset:{y:s}}])=>(a=a+Math.min(n,Math.max(0,s-i))-n,{height:a,locked:s>=i+n})),K((i,a)=>i.height===a.height&&i.locked===a.locked))}function Xr(e,o){var n=o,{header$:t}=n,r=ao(n,["header$"]);let i=R(".md-sidebar__scrollwrap",e),{y:a}=Ve(i);return C(()=>{let s=new g,p=s.pipe(Z(),ie(!0)),c=s.pipe(Le(0,me));return c.pipe(re(t)).subscribe({next([{height:l},{height:f}]){i.style.height=`${l-2*a}px`,e.style.top=`${f}px`},complete(){i.style.height="",e.style.top=""}}),c.pipe(Ae()).subscribe(()=>{for(let l of P(".md-nav__link--active[href]",e)){if(!l.clientHeight)continue;let f=l.closest(".md-sidebar__scrollwrap");if(typeof f!="undefined"){let u=l.offsetTop-f.offsetTop,{height:d}=ce(f);f.scrollTo({top:u-d/2})}}}),ue(P("label[tabindex]",e)).pipe(ne(l=>h(l,"click").pipe(ve(se),m(()=>l),U(p)))).subscribe(l=>{let f=R(`[id="${l.htmlFor}"]`);R(`[aria-labelledby="${l.id}"]`).setAttribute("aria-expanded",`${f.checked}`)}),ss(e,r).pipe(w(l=>s.next(l)),_(()=>s.complete()),m(l=>$({ref:e},l)))})}function ui(e,t){if(typeof t!="undefined"){let r=`https://api.github.com/repos/${e}/${t}`;return st(je(`${r}/releases/latest`).pipe(de(()=>S),m(o=>({version:o.tag_name})),De({})),je(r).pipe(de(()=>S),m(o=>({stars:o.stargazers_count,forks:o.forks_count})),De({}))).pipe(m(([o,n])=>$($({},o),n)))}else{let r=`https://api.github.com/users/${e}`;return je(r).pipe(m(o=>({repositories:o.public_repos})),De({}))}}function di(e,t){let r=`https://${e}/api/v4/projects/${encodeURIComponent(t)}`;return st(je(`${r}/releases/permalink/latest`).pipe(de(()=>S),m(({tag_name:o})=>({version:o})),De({})),je(r).pipe(de(()=>S),m(({star_count:o,forks_count:n})=>({stars:o,forks:n})),De({}))).pipe(m(([o,n])=>$($({},o),n)))}function hi(e){let t=e.match(/^.+github\.com\/([^/]+)\/?([^/]+)?/i);if(t){let[,r,o]=t;return ui(r,o)}if(t=e.match(/^.+?([^/]*gitlab[^/]+)\/(.+?)\/?$/i),t){let[,r,o]=t;return di(r,o)}return S}var cs;function ps(e){return cs||(cs=C(()=>{let t=__md_get("__source",sessionStorage);if(t)return I(t);if(ae("consent").length){let o=__md_get("__consent");if(!(o&&o.github))return S}return hi(e.href).pipe(w(o=>__md_set("__source",o,sessionStorage)))}).pipe(de(()=>S),b(t=>Object.keys(t).length>0),m(t=>({facts:t})),G(1)))}function bi(e){let t=R(":scope > :last-child",e);return C(()=>{let r=new g;return r.subscribe(({facts:o})=>{t.appendChild(Ln(o)),t.classList.add("md-source__repository--active")}),ps(e).pipe(w(o=>r.next(o)),_(()=>r.complete()),m(o=>$({ref:e},o)))})}function ls(e,{viewport$:t,header$:r}){return ge(document.body).pipe(v(()=>mr(e,{header$:r,viewport$:t})),m(({offset:{y:o}})=>({hidden:o>=10})),ee("hidden"))}function vi(e,t){return C(()=>{let r=new g;return r.subscribe({next({hidden:o}){e.hidden=o},complete(){e.hidden=!1}}),(B("navigation.tabs.sticky")?I({hidden:!1}):ls(e,t)).pipe(w(o=>r.next(o)),_(()=>r.complete()),m(o=>$({ref:e},o)))})}function ms(e,{viewport$:t,header$:r}){let o=new Map,n=P(".md-nav__link",e);for(let s of n){let p=decodeURIComponent(s.hash.substring(1)),c=fe(`[id="${p}"]`);typeof c!="undefined"&&o.set(s,c)}let i=r.pipe(ee("height"),m(({height:s})=>{let p=Se("main"),c=R(":scope > :first-child",p);return s+.8*(c.offsetTop-p.offsetTop)}),pe());return ge(document.body).pipe(ee("height"),v(s=>C(()=>{let p=[];return I([...o].reduce((c,[l,f])=>{for(;p.length&&o.get(p[p.length-1]).tagName>=f.tagName;)p.pop();let u=f.offsetTop;for(;!u&&f.parentElement;)f=f.parentElement,u=f.offsetTop;let d=f.offsetParent;for(;d;d=d.offsetParent)u+=d.offsetTop;return c.set([...p=[...p,l]].reverse(),u)},new Map))}).pipe(m(p=>new Map([...p].sort(([,c],[,l])=>c-l))),He(i),v(([p,c])=>t.pipe(Fr(([l,f],{offset:{y:u},size:d})=>{let y=u+d.height>=Math.floor(s.height);for(;f.length;){let[,M]=f[0];if(M-c=u&&!y)f=[l.pop(),...f];else break}return[l,f]},[[],[...p]]),K((l,f)=>l[0]===f[0]&&l[1]===f[1])))))).pipe(m(([s,p])=>({prev:s.map(([c])=>c),next:p.map(([c])=>c)})),Q({prev:[],next:[]}),Be(2,1),m(([s,p])=>s.prev.length{let i=new g,a=i.pipe(Z(),ie(!0));if(i.subscribe(({prev:s,next:p})=>{for(let[c]of p)c.classList.remove("md-nav__link--passed"),c.classList.remove("md-nav__link--active");for(let[c,[l]]of s.entries())l.classList.add("md-nav__link--passed"),l.classList.toggle("md-nav__link--active",c===s.length-1)}),B("toc.follow")){let s=O(t.pipe(_e(1),m(()=>{})),t.pipe(_e(250),m(()=>"smooth")));i.pipe(b(({prev:p})=>p.length>0),He(o.pipe(ve(se))),re(s)).subscribe(([[{prev:p}],c])=>{let[l]=p[p.length-1];if(l.offsetHeight){let f=cr(l);if(typeof f!="undefined"){let u=l.offsetTop-f.offsetTop,{height:d}=ce(f);f.scrollTo({top:u-d/2,behavior:c})}}})}return B("navigation.tracking")&&t.pipe(U(a),ee("offset"),_e(250),Ce(1),U(n.pipe(Ce(1))),ct({delay:250}),re(i)).subscribe(([,{prev:s}])=>{let p=ye(),c=s[s.length-1];if(c&&c.length){let[l]=c,{hash:f}=new URL(l.href);p.hash!==f&&(p.hash=f,history.replaceState({},"",`${p}`))}else p.hash="",history.replaceState({},"",`${p}`)}),ms(e,{viewport$:t,header$:r}).pipe(w(s=>i.next(s)),_(()=>i.complete()),m(s=>$({ref:e},s)))})}function fs(e,{viewport$:t,main$:r,target$:o}){let n=t.pipe(m(({offset:{y:a}})=>a),Be(2,1),m(([a,s])=>a>s&&s>0),K()),i=r.pipe(m(({active:a})=>a));return z([i,n]).pipe(m(([a,s])=>!(a&&s)),K(),U(o.pipe(Ce(1))),ie(!0),ct({delay:250}),m(a=>({hidden:a})))}function yi(e,{viewport$:t,header$:r,main$:o,target$:n}){let i=new g,a=i.pipe(Z(),ie(!0));return i.subscribe({next({hidden:s}){e.hidden=s,s?(e.setAttribute("tabindex","-1"),e.blur()):e.removeAttribute("tabindex")},complete(){e.style.top="",e.hidden=!0,e.removeAttribute("tabindex")}}),r.pipe(U(a),ee("height")).subscribe(({height:s})=>{e.style.top=`${s+16}px`}),h(e,"click").subscribe(s=>{s.preventDefault(),window.scrollTo({top:0})}),fs(e,{viewport$:t,main$:o,target$:n}).pipe(w(s=>i.next(s)),_(()=>i.complete()),m(s=>$({ref:e},s)))}function xi({document$:e,viewport$:t}){e.pipe(v(()=>P(".md-ellipsis")),ne(r=>tt(r).pipe(U(e.pipe(Ce(1))),b(o=>o),m(()=>r),Te(1))),b(r=>r.offsetWidth{let o=r.innerText,n=r.closest("a")||r;return n.title=o,B("content.tooltips")?mt(n,{viewport$:t}).pipe(U(e.pipe(Ce(1))),_(()=>n.removeAttribute("title"))):S})).subscribe(),B("content.tooltips")&&e.pipe(v(()=>P(".md-status")),ne(r=>mt(r,{viewport$:t}))).subscribe()}function Ei({document$:e,tablet$:t}){e.pipe(v(()=>P(".md-toggle--indeterminate")),w(r=>{r.indeterminate=!0,r.checked=!1}),ne(r=>h(r,"change").pipe(Dr(()=>r.classList.contains("md-toggle--indeterminate")),m(()=>r))),re(t)).subscribe(([r,o])=>{r.classList.remove("md-toggle--indeterminate"),o&&(r.checked=!1)})}function us(){return/(iPad|iPhone|iPod)/.test(navigator.userAgent)}function wi({document$:e}){e.pipe(v(()=>P("[data-md-scrollfix]")),w(t=>t.removeAttribute("data-md-scrollfix")),b(us),ne(t=>h(t,"touchstart").pipe(m(()=>t)))).subscribe(t=>{let r=t.scrollTop;r===0?t.scrollTop=1:r+t.offsetHeight===t.scrollHeight&&(t.scrollTop=r-1)})}function Ti({viewport$:e,tablet$:t}){z([ze("search"),t]).pipe(m(([r,o])=>r&&!o),v(r=>I(r).pipe(Ge(r?400:100))),re(e)).subscribe(([r,{offset:{y:o}}])=>{if(r)document.body.setAttribute("data-md-scrolllock",""),document.body.style.top=`-${o}px`;else{let n=-1*parseInt(document.body.style.top,10);document.body.removeAttribute("data-md-scrolllock"),document.body.style.top="",n&&window.scrollTo(0,n)}})}Object.entries||(Object.entries=function(e){let t=[];for(let r of Object.keys(e))t.push([r,e[r]]);return t});Object.values||(Object.values=function(e){let t=[];for(let r of Object.keys(e))t.push(e[r]);return t});typeof Element!="undefined"&&(Element.prototype.scrollTo||(Element.prototype.scrollTo=function(e,t){typeof e=="object"?(this.scrollLeft=e.left,this.scrollTop=e.top):(this.scrollLeft=e,this.scrollTop=t)}),Element.prototype.replaceWith||(Element.prototype.replaceWith=function(...e){let t=this.parentNode;if(t){e.length===0&&t.removeChild(this);for(let r=e.length-1;r>=0;r--){let o=e[r];typeof o=="string"?o=document.createTextNode(o):o.parentNode&&o.parentNode.removeChild(o),r?t.insertBefore(this.previousSibling,o):t.replaceChild(o,this)}}}));function ds(){return location.protocol==="file:"?Tt(`${new URL("search/search_index.js",Zr.base)}`).pipe(m(()=>__index),G(1)):je(new URL("search/search_index.json",Zr.base))}document.documentElement.classList.remove("no-js");document.documentElement.classList.add("js");var ot=Bo(),Wt=an(),Mt=pn(Wt),eo=nn(),Oe=vn(),hr=Pt("(min-width: 960px)"),Oi=Pt("(min-width: 1220px)"),Mi=ln(),Zr=xe(),Li=document.forms.namedItem("search")?ds():Ye,to=new g;Xn({alert$:to});var ro=new g;B("navigation.instant")&&ri({location$:Wt,viewport$:Oe,progress$:ro}).subscribe(ot);var Si;((Si=Zr.version)==null?void 0:Si.provider)==="mike"&&ai({document$:ot});O(Wt,Mt).pipe(Ge(125)).subscribe(()=>{Je("drawer",!1),Je("search",!1)});eo.pipe(b(({mode:e})=>e==="global")).subscribe(e=>{switch(e.type){case"p":case",":let t=fe("link[rel=prev]");typeof t!="undefined"&<(t);break;case"n":case".":let r=fe("link[rel=next]");typeof r!="undefined"&<(r);break;case"Enter":let o=Ie();o instanceof HTMLLabelElement&&o.click()}});xi({viewport$:Oe,document$:ot});Ei({document$:ot,tablet$:hr});wi({document$:ot});Ti({viewport$:Oe,tablet$:hr});var rt=Qn(Se("header"),{viewport$:Oe}),Ft=ot.pipe(m(()=>Se("main")),v(e=>Bn(e,{viewport$:Oe,header$:rt})),G(1)),hs=O(...ae("consent").map(e=>xn(e,{target$:Mt})),...ae("dialog").map(e=>zn(e,{alert$:to})),...ae("header").map(e=>Kn(e,{viewport$:Oe,header$:rt,main$:Ft})),...ae("palette").map(e=>Gn(e)),...ae("progress").map(e=>Jn(e,{progress$:ro})),...ae("search").map(e=>mi(e,{index$:Li,keyboard$:eo})),...ae("source").map(e=>bi(e))),bs=C(()=>O(...ae("announce").map(e=>yn(e)),...ae("content").map(e=>Nn(e,{viewport$:Oe,target$:Mt,print$:Mi})),...ae("content").map(e=>B("search.highlight")?fi(e,{index$:Li,location$:Wt}):S),...ae("header-title").map(e=>Yn(e,{viewport$:Oe,header$:rt})),...ae("sidebar").map(e=>e.getAttribute("data-md-type")==="navigation"?Nr(Oi,()=>Xr(e,{viewport$:Oe,header$:rt,main$:Ft})):Nr(hr,()=>Xr(e,{viewport$:Oe,header$:rt,main$:Ft}))),...ae("tabs").map(e=>vi(e,{viewport$:Oe,header$:rt})),...ae("toc").map(e=>gi(e,{viewport$:Oe,header$:rt,main$:Ft,target$:Mt})),...ae("top").map(e=>yi(e,{viewport$:Oe,header$:rt,main$:Ft,target$:Mt})))),_i=ot.pipe(v(()=>bs),Re(hs),G(1));_i.subscribe();window.document$=ot;window.location$=Wt;window.target$=Mt;window.keyboard$=eo;window.viewport$=Oe;window.tablet$=hr;window.screen$=Oi;window.print$=Mi;window.alert$=to;window.progress$=ro;window.component$=_i;})(); +//# sourceMappingURL=bundle.56dfad97.min.js.map + diff --git a/assets/javascripts/bundle.56dfad97.min.js.map b/assets/javascripts/bundle.56dfad97.min.js.map new file mode 100644 index 0000000..eb83bdb --- /dev/null +++ b/assets/javascripts/bundle.56dfad97.min.js.map @@ -0,0 +1,7 @@ +{ + "version": 3, + "sources": ["node_modules/focus-visible/dist/focus-visible.js", "node_modules/escape-html/index.js", "node_modules/clipboard/dist/clipboard.js", "src/templates/assets/javascripts/bundle.ts", "node_modules/tslib/tslib.es6.mjs", "node_modules/rxjs/src/internal/util/isFunction.ts", "node_modules/rxjs/src/internal/util/createErrorClass.ts", "node_modules/rxjs/src/internal/util/UnsubscriptionError.ts", "node_modules/rxjs/src/internal/util/arrRemove.ts", "node_modules/rxjs/src/internal/Subscription.ts", "node_modules/rxjs/src/internal/config.ts", "node_modules/rxjs/src/internal/scheduler/timeoutProvider.ts", "node_modules/rxjs/src/internal/util/reportUnhandledError.ts", "node_modules/rxjs/src/internal/util/noop.ts", "node_modules/rxjs/src/internal/NotificationFactories.ts", "node_modules/rxjs/src/internal/util/errorContext.ts", "node_modules/rxjs/src/internal/Subscriber.ts", "node_modules/rxjs/src/internal/symbol/observable.ts", "node_modules/rxjs/src/internal/util/identity.ts", "node_modules/rxjs/src/internal/util/pipe.ts", "node_modules/rxjs/src/internal/Observable.ts", "node_modules/rxjs/src/internal/util/lift.ts", "node_modules/rxjs/src/internal/operators/OperatorSubscriber.ts", "node_modules/rxjs/src/internal/scheduler/animationFrameProvider.ts", "node_modules/rxjs/src/internal/util/ObjectUnsubscribedError.ts", "node_modules/rxjs/src/internal/Subject.ts", "node_modules/rxjs/src/internal/BehaviorSubject.ts", "node_modules/rxjs/src/internal/scheduler/dateTimestampProvider.ts", "node_modules/rxjs/src/internal/ReplaySubject.ts", "node_modules/rxjs/src/internal/scheduler/Action.ts", "node_modules/rxjs/src/internal/scheduler/intervalProvider.ts", "node_modules/rxjs/src/internal/scheduler/AsyncAction.ts", "node_modules/rxjs/src/internal/Scheduler.ts", "node_modules/rxjs/src/internal/scheduler/AsyncScheduler.ts", "node_modules/rxjs/src/internal/scheduler/async.ts", "node_modules/rxjs/src/internal/scheduler/QueueAction.ts", "node_modules/rxjs/src/internal/scheduler/QueueScheduler.ts", "node_modules/rxjs/src/internal/scheduler/queue.ts", "node_modules/rxjs/src/internal/scheduler/AnimationFrameAction.ts", "node_modules/rxjs/src/internal/scheduler/AnimationFrameScheduler.ts", "node_modules/rxjs/src/internal/scheduler/animationFrame.ts", "node_modules/rxjs/src/internal/observable/empty.ts", "node_modules/rxjs/src/internal/util/isScheduler.ts", "node_modules/rxjs/src/internal/util/args.ts", "node_modules/rxjs/src/internal/util/isArrayLike.ts", "node_modules/rxjs/src/internal/util/isPromise.ts", "node_modules/rxjs/src/internal/util/isInteropObservable.ts", "node_modules/rxjs/src/internal/util/isAsyncIterable.ts", "node_modules/rxjs/src/internal/util/throwUnobservableError.ts", "node_modules/rxjs/src/internal/symbol/iterator.ts", "node_modules/rxjs/src/internal/util/isIterable.ts", "node_modules/rxjs/src/internal/util/isReadableStreamLike.ts", "node_modules/rxjs/src/internal/observable/innerFrom.ts", "node_modules/rxjs/src/internal/util/executeSchedule.ts", "node_modules/rxjs/src/internal/operators/observeOn.ts", "node_modules/rxjs/src/internal/operators/subscribeOn.ts", "node_modules/rxjs/src/internal/scheduled/scheduleObservable.ts", "node_modules/rxjs/src/internal/scheduled/schedulePromise.ts", "node_modules/rxjs/src/internal/scheduled/scheduleArray.ts", "node_modules/rxjs/src/internal/scheduled/scheduleIterable.ts", "node_modules/rxjs/src/internal/scheduled/scheduleAsyncIterable.ts", "node_modules/rxjs/src/internal/scheduled/scheduleReadableStreamLike.ts", "node_modules/rxjs/src/internal/scheduled/scheduled.ts", "node_modules/rxjs/src/internal/observable/from.ts", "node_modules/rxjs/src/internal/observable/of.ts", "node_modules/rxjs/src/internal/observable/throwError.ts", "node_modules/rxjs/src/internal/util/EmptyError.ts", "node_modules/rxjs/src/internal/util/isDate.ts", "node_modules/rxjs/src/internal/operators/map.ts", "node_modules/rxjs/src/internal/util/mapOneOrManyArgs.ts", "node_modules/rxjs/src/internal/util/argsArgArrayOrObject.ts", "node_modules/rxjs/src/internal/util/createObject.ts", "node_modules/rxjs/src/internal/observable/combineLatest.ts", "node_modules/rxjs/src/internal/operators/mergeInternals.ts", "node_modules/rxjs/src/internal/operators/mergeMap.ts", "node_modules/rxjs/src/internal/operators/mergeAll.ts", "node_modules/rxjs/src/internal/operators/concatAll.ts", "node_modules/rxjs/src/internal/observable/concat.ts", "node_modules/rxjs/src/internal/observable/defer.ts", "node_modules/rxjs/src/internal/observable/fromEvent.ts", "node_modules/rxjs/src/internal/observable/fromEventPattern.ts", "node_modules/rxjs/src/internal/observable/timer.ts", "node_modules/rxjs/src/internal/observable/merge.ts", "node_modules/rxjs/src/internal/observable/never.ts", "node_modules/rxjs/src/internal/util/argsOrArgArray.ts", "node_modules/rxjs/src/internal/operators/filter.ts", "node_modules/rxjs/src/internal/observable/zip.ts", "node_modules/rxjs/src/internal/operators/audit.ts", "node_modules/rxjs/src/internal/operators/auditTime.ts", "node_modules/rxjs/src/internal/operators/bufferCount.ts", "node_modules/rxjs/src/internal/operators/catchError.ts", "node_modules/rxjs/src/internal/operators/scanInternals.ts", "node_modules/rxjs/src/internal/operators/combineLatest.ts", "node_modules/rxjs/src/internal/operators/combineLatestWith.ts", "node_modules/rxjs/src/internal/operators/debounce.ts", "node_modules/rxjs/src/internal/operators/debounceTime.ts", "node_modules/rxjs/src/internal/operators/defaultIfEmpty.ts", "node_modules/rxjs/src/internal/operators/take.ts", "node_modules/rxjs/src/internal/operators/ignoreElements.ts", "node_modules/rxjs/src/internal/operators/mapTo.ts", "node_modules/rxjs/src/internal/operators/delayWhen.ts", "node_modules/rxjs/src/internal/operators/delay.ts", "node_modules/rxjs/src/internal/operators/distinctUntilChanged.ts", "node_modules/rxjs/src/internal/operators/distinctUntilKeyChanged.ts", "node_modules/rxjs/src/internal/operators/throwIfEmpty.ts", "node_modules/rxjs/src/internal/operators/endWith.ts", "node_modules/rxjs/src/internal/operators/finalize.ts", "node_modules/rxjs/src/internal/operators/first.ts", "node_modules/rxjs/src/internal/operators/takeLast.ts", "node_modules/rxjs/src/internal/operators/merge.ts", "node_modules/rxjs/src/internal/operators/mergeWith.ts", "node_modules/rxjs/src/internal/operators/repeat.ts", "node_modules/rxjs/src/internal/operators/scan.ts", "node_modules/rxjs/src/internal/operators/share.ts", "node_modules/rxjs/src/internal/operators/shareReplay.ts", "node_modules/rxjs/src/internal/operators/skip.ts", "node_modules/rxjs/src/internal/operators/skipUntil.ts", "node_modules/rxjs/src/internal/operators/startWith.ts", "node_modules/rxjs/src/internal/operators/switchMap.ts", "node_modules/rxjs/src/internal/operators/takeUntil.ts", "node_modules/rxjs/src/internal/operators/takeWhile.ts", "node_modules/rxjs/src/internal/operators/tap.ts", "node_modules/rxjs/src/internal/operators/throttle.ts", "node_modules/rxjs/src/internal/operators/throttleTime.ts", "node_modules/rxjs/src/internal/operators/withLatestFrom.ts", "node_modules/rxjs/src/internal/operators/zip.ts", "node_modules/rxjs/src/internal/operators/zipWith.ts", "src/templates/assets/javascripts/browser/document/index.ts", "src/templates/assets/javascripts/browser/element/_/index.ts", "src/templates/assets/javascripts/browser/element/focus/index.ts", "src/templates/assets/javascripts/browser/element/hover/index.ts", "src/templates/assets/javascripts/utilities/h/index.ts", "src/templates/assets/javascripts/utilities/round/index.ts", "src/templates/assets/javascripts/browser/script/index.ts", "src/templates/assets/javascripts/browser/element/size/_/index.ts", "src/templates/assets/javascripts/browser/element/size/content/index.ts", "src/templates/assets/javascripts/browser/element/offset/_/index.ts", "src/templates/assets/javascripts/browser/element/offset/content/index.ts", "src/templates/assets/javascripts/browser/element/visibility/index.ts", "src/templates/assets/javascripts/browser/toggle/index.ts", "src/templates/assets/javascripts/browser/keyboard/index.ts", "src/templates/assets/javascripts/browser/location/_/index.ts", "src/templates/assets/javascripts/browser/location/hash/index.ts", "src/templates/assets/javascripts/browser/media/index.ts", "src/templates/assets/javascripts/browser/request/index.ts", "src/templates/assets/javascripts/browser/viewport/offset/index.ts", "src/templates/assets/javascripts/browser/viewport/size/index.ts", "src/templates/assets/javascripts/browser/viewport/_/index.ts", "src/templates/assets/javascripts/browser/viewport/at/index.ts", "src/templates/assets/javascripts/browser/worker/index.ts", "src/templates/assets/javascripts/_/index.ts", "src/templates/assets/javascripts/components/_/index.ts", "src/templates/assets/javascripts/components/announce/index.ts", "src/templates/assets/javascripts/components/consent/index.ts", "src/templates/assets/javascripts/templates/tooltip/index.tsx", "src/templates/assets/javascripts/templates/annotation/index.tsx", "src/templates/assets/javascripts/templates/clipboard/index.tsx", "src/templates/assets/javascripts/templates/search/index.tsx", "src/templates/assets/javascripts/templates/source/index.tsx", "src/templates/assets/javascripts/templates/tabbed/index.tsx", "src/templates/assets/javascripts/templates/table/index.tsx", "src/templates/assets/javascripts/templates/version/index.tsx", "src/templates/assets/javascripts/components/tooltip2/index.ts", "src/templates/assets/javascripts/components/content/annotation/_/index.ts", "src/templates/assets/javascripts/components/content/annotation/list/index.ts", "src/templates/assets/javascripts/components/content/annotation/block/index.ts", "src/templates/assets/javascripts/components/content/code/_/index.ts", "src/templates/assets/javascripts/components/content/details/index.ts", "src/templates/assets/javascripts/components/content/mermaid/index.css", "src/templates/assets/javascripts/components/content/mermaid/index.ts", "src/templates/assets/javascripts/components/content/table/index.ts", "src/templates/assets/javascripts/components/content/tabs/index.ts", "src/templates/assets/javascripts/components/content/_/index.ts", "src/templates/assets/javascripts/components/dialog/index.ts", "src/templates/assets/javascripts/components/tooltip/index.ts", "src/templates/assets/javascripts/components/header/_/index.ts", "src/templates/assets/javascripts/components/header/title/index.ts", "src/templates/assets/javascripts/components/main/index.ts", "src/templates/assets/javascripts/components/palette/index.ts", "src/templates/assets/javascripts/components/progress/index.ts", "src/templates/assets/javascripts/integrations/clipboard/index.ts", "src/templates/assets/javascripts/integrations/sitemap/index.ts", "src/templates/assets/javascripts/integrations/instant/index.ts", "src/templates/assets/javascripts/integrations/search/highlighter/index.ts", "src/templates/assets/javascripts/integrations/search/worker/message/index.ts", "src/templates/assets/javascripts/integrations/search/worker/_/index.ts", "src/templates/assets/javascripts/integrations/version/index.ts", "src/templates/assets/javascripts/components/search/query/index.ts", "src/templates/assets/javascripts/components/search/result/index.ts", "src/templates/assets/javascripts/components/search/share/index.ts", "src/templates/assets/javascripts/components/search/suggest/index.ts", "src/templates/assets/javascripts/components/search/_/index.ts", "src/templates/assets/javascripts/components/search/highlight/index.ts", "src/templates/assets/javascripts/components/sidebar/index.ts", "src/templates/assets/javascripts/components/source/facts/github/index.ts", "src/templates/assets/javascripts/components/source/facts/gitlab/index.ts", "src/templates/assets/javascripts/components/source/facts/_/index.ts", "src/templates/assets/javascripts/components/source/_/index.ts", "src/templates/assets/javascripts/components/tabs/index.ts", "src/templates/assets/javascripts/components/toc/index.ts", "src/templates/assets/javascripts/components/top/index.ts", "src/templates/assets/javascripts/patches/ellipsis/index.ts", "src/templates/assets/javascripts/patches/indeterminate/index.ts", "src/templates/assets/javascripts/patches/scrollfix/index.ts", "src/templates/assets/javascripts/patches/scrolllock/index.ts", "src/templates/assets/javascripts/polyfills/index.ts"], + "sourcesContent": ["(function (global, factory) {\n typeof exports === 'object' && typeof module !== 'undefined' ? factory() :\n typeof define === 'function' && define.amd ? define(factory) :\n (factory());\n}(this, (function () { 'use strict';\n\n /**\n * Applies the :focus-visible polyfill at the given scope.\n * A scope in this case is either the top-level Document or a Shadow Root.\n *\n * @param {(Document|ShadowRoot)} scope\n * @see https://github.com/WICG/focus-visible\n */\n function applyFocusVisiblePolyfill(scope) {\n var hadKeyboardEvent = true;\n var hadFocusVisibleRecently = false;\n var hadFocusVisibleRecentlyTimeout = null;\n\n var inputTypesAllowlist = {\n text: true,\n search: true,\n url: true,\n tel: true,\n email: true,\n password: true,\n number: true,\n date: true,\n month: true,\n week: true,\n time: true,\n datetime: true,\n 'datetime-local': true\n };\n\n /**\n * Helper function for legacy browsers and iframes which sometimes focus\n * elements like document, body, and non-interactive SVG.\n * @param {Element} el\n */\n function isValidFocusTarget(el) {\n if (\n el &&\n el !== document &&\n el.nodeName !== 'HTML' &&\n el.nodeName !== 'BODY' &&\n 'classList' in el &&\n 'contains' in el.classList\n ) {\n return true;\n }\n return false;\n }\n\n /**\n * Computes whether the given element should automatically trigger the\n * `focus-visible` class being added, i.e. whether it should always match\n * `:focus-visible` when focused.\n * @param {Element} el\n * @return {boolean}\n */\n function focusTriggersKeyboardModality(el) {\n var type = el.type;\n var tagName = el.tagName;\n\n if (tagName === 'INPUT' && inputTypesAllowlist[type] && !el.readOnly) {\n return true;\n }\n\n if (tagName === 'TEXTAREA' && !el.readOnly) {\n return true;\n }\n\n if (el.isContentEditable) {\n return true;\n }\n\n return false;\n }\n\n /**\n * Add the `focus-visible` class to the given element if it was not added by\n * the author.\n * @param {Element} el\n */\n function addFocusVisibleClass(el) {\n if (el.classList.contains('focus-visible')) {\n return;\n }\n el.classList.add('focus-visible');\n el.setAttribute('data-focus-visible-added', '');\n }\n\n /**\n * Remove the `focus-visible` class from the given element if it was not\n * originally added by the author.\n * @param {Element} el\n */\n function removeFocusVisibleClass(el) {\n if (!el.hasAttribute('data-focus-visible-added')) {\n return;\n }\n el.classList.remove('focus-visible');\n el.removeAttribute('data-focus-visible-added');\n }\n\n /**\n * If the most recent user interaction was via the keyboard;\n * and the key press did not include a meta, alt/option, or control key;\n * then the modality is keyboard. Otherwise, the modality is not keyboard.\n * Apply `focus-visible` to any current active element and keep track\n * of our keyboard modality state with `hadKeyboardEvent`.\n * @param {KeyboardEvent} e\n */\n function onKeyDown(e) {\n if (e.metaKey || e.altKey || e.ctrlKey) {\n return;\n }\n\n if (isValidFocusTarget(scope.activeElement)) {\n addFocusVisibleClass(scope.activeElement);\n }\n\n hadKeyboardEvent = true;\n }\n\n /**\n * If at any point a user clicks with a pointing device, ensure that we change\n * the modality away from keyboard.\n * This avoids the situation where a user presses a key on an already focused\n * element, and then clicks on a different element, focusing it with a\n * pointing device, while we still think we're in keyboard modality.\n * @param {Event} e\n */\n function onPointerDown(e) {\n hadKeyboardEvent = false;\n }\n\n /**\n * On `focus`, add the `focus-visible` class to the target if:\n * - the target received focus as a result of keyboard navigation, or\n * - the event target is an element that will likely require interaction\n * via the keyboard (e.g. a text box)\n * @param {Event} e\n */\n function onFocus(e) {\n // Prevent IE from focusing the document or HTML element.\n if (!isValidFocusTarget(e.target)) {\n return;\n }\n\n if (hadKeyboardEvent || focusTriggersKeyboardModality(e.target)) {\n addFocusVisibleClass(e.target);\n }\n }\n\n /**\n * On `blur`, remove the `focus-visible` class from the target.\n * @param {Event} e\n */\n function onBlur(e) {\n if (!isValidFocusTarget(e.target)) {\n return;\n }\n\n if (\n e.target.classList.contains('focus-visible') ||\n e.target.hasAttribute('data-focus-visible-added')\n ) {\n // To detect a tab/window switch, we look for a blur event followed\n // rapidly by a visibility change.\n // If we don't see a visibility change within 100ms, it's probably a\n // regular focus change.\n hadFocusVisibleRecently = true;\n window.clearTimeout(hadFocusVisibleRecentlyTimeout);\n hadFocusVisibleRecentlyTimeout = window.setTimeout(function() {\n hadFocusVisibleRecently = false;\n }, 100);\n removeFocusVisibleClass(e.target);\n }\n }\n\n /**\n * If the user changes tabs, keep track of whether or not the previously\n * focused element had .focus-visible.\n * @param {Event} e\n */\n function onVisibilityChange(e) {\n if (document.visibilityState === 'hidden') {\n // If the tab becomes active again, the browser will handle calling focus\n // on the element (Safari actually calls it twice).\n // If this tab change caused a blur on an element with focus-visible,\n // re-apply the class when the user switches back to the tab.\n if (hadFocusVisibleRecently) {\n hadKeyboardEvent = true;\n }\n addInitialPointerMoveListeners();\n }\n }\n\n /**\n * Add a group of listeners to detect usage of any pointing devices.\n * These listeners will be added when the polyfill first loads, and anytime\n * the window is blurred, so that they are active when the window regains\n * focus.\n */\n function addInitialPointerMoveListeners() {\n document.addEventListener('mousemove', onInitialPointerMove);\n document.addEventListener('mousedown', onInitialPointerMove);\n document.addEventListener('mouseup', onInitialPointerMove);\n document.addEventListener('pointermove', onInitialPointerMove);\n document.addEventListener('pointerdown', onInitialPointerMove);\n document.addEventListener('pointerup', onInitialPointerMove);\n document.addEventListener('touchmove', onInitialPointerMove);\n document.addEventListener('touchstart', onInitialPointerMove);\n document.addEventListener('touchend', onInitialPointerMove);\n }\n\n function removeInitialPointerMoveListeners() {\n document.removeEventListener('mousemove', onInitialPointerMove);\n document.removeEventListener('mousedown', onInitialPointerMove);\n document.removeEventListener('mouseup', onInitialPointerMove);\n document.removeEventListener('pointermove', onInitialPointerMove);\n document.removeEventListener('pointerdown', onInitialPointerMove);\n document.removeEventListener('pointerup', onInitialPointerMove);\n document.removeEventListener('touchmove', onInitialPointerMove);\n document.removeEventListener('touchstart', onInitialPointerMove);\n document.removeEventListener('touchend', onInitialPointerMove);\n }\n\n /**\n * When the polfyill first loads, assume the user is in keyboard modality.\n * If any event is received from a pointing device (e.g. mouse, pointer,\n * touch), turn off keyboard modality.\n * This accounts for situations where focus enters the page from the URL bar.\n * @param {Event} e\n */\n function onInitialPointerMove(e) {\n // Work around a Safari quirk that fires a mousemove on whenever the\n // window blurs, even if you're tabbing out of the page. \u00AF\\_(\u30C4)_/\u00AF\n if (e.target.nodeName && e.target.nodeName.toLowerCase() === 'html') {\n return;\n }\n\n hadKeyboardEvent = false;\n removeInitialPointerMoveListeners();\n }\n\n // For some kinds of state, we are interested in changes at the global scope\n // only. For example, global pointer input, global key presses and global\n // visibility change should affect the state at every scope:\n document.addEventListener('keydown', onKeyDown, true);\n document.addEventListener('mousedown', onPointerDown, true);\n document.addEventListener('pointerdown', onPointerDown, true);\n document.addEventListener('touchstart', onPointerDown, true);\n document.addEventListener('visibilitychange', onVisibilityChange, true);\n\n addInitialPointerMoveListeners();\n\n // For focus and blur, we specifically care about state changes in the local\n // scope. This is because focus / blur events that originate from within a\n // shadow root are not re-dispatched from the host element if it was already\n // the active element in its own scope:\n scope.addEventListener('focus', onFocus, true);\n scope.addEventListener('blur', onBlur, true);\n\n // We detect that a node is a ShadowRoot by ensuring that it is a\n // DocumentFragment and also has a host property. This check covers native\n // implementation and polyfill implementation transparently. If we only cared\n // about the native implementation, we could just check if the scope was\n // an instance of a ShadowRoot.\n if (scope.nodeType === Node.DOCUMENT_FRAGMENT_NODE && scope.host) {\n // Since a ShadowRoot is a special kind of DocumentFragment, it does not\n // have a root element to add a class to. So, we add this attribute to the\n // host element instead:\n scope.host.setAttribute('data-js-focus-visible', '');\n } else if (scope.nodeType === Node.DOCUMENT_NODE) {\n document.documentElement.classList.add('js-focus-visible');\n document.documentElement.setAttribute('data-js-focus-visible', '');\n }\n }\n\n // It is important to wrap all references to global window and document in\n // these checks to support server-side rendering use cases\n // @see https://github.com/WICG/focus-visible/issues/199\n if (typeof window !== 'undefined' && typeof document !== 'undefined') {\n // Make the polyfill helper globally available. This can be used as a signal\n // to interested libraries that wish to coordinate with the polyfill for e.g.,\n // applying the polyfill to a shadow root:\n window.applyFocusVisiblePolyfill = applyFocusVisiblePolyfill;\n\n // Notify interested libraries of the polyfill's presence, in case the\n // polyfill was loaded lazily:\n var event;\n\n try {\n event = new CustomEvent('focus-visible-polyfill-ready');\n } catch (error) {\n // IE11 does not support using CustomEvent as a constructor directly:\n event = document.createEvent('CustomEvent');\n event.initCustomEvent('focus-visible-polyfill-ready', false, false, {});\n }\n\n window.dispatchEvent(event);\n }\n\n if (typeof document !== 'undefined') {\n // Apply the polyfill to the global document, so that no JavaScript\n // coordination is required to use the polyfill in the top-level document:\n applyFocusVisiblePolyfill(document);\n }\n\n})));\n", "/*!\n * escape-html\n * Copyright(c) 2012-2013 TJ Holowaychuk\n * Copyright(c) 2015 Andreas Lubbe\n * Copyright(c) 2015 Tiancheng \"Timothy\" Gu\n * MIT Licensed\n */\n\n'use strict';\n\n/**\n * Module variables.\n * @private\n */\n\nvar matchHtmlRegExp = /[\"'&<>]/;\n\n/**\n * Module exports.\n * @public\n */\n\nmodule.exports = escapeHtml;\n\n/**\n * Escape special characters in the given string of html.\n *\n * @param {string} string The string to escape for inserting into HTML\n * @return {string}\n * @public\n */\n\nfunction escapeHtml(string) {\n var str = '' + string;\n var match = matchHtmlRegExp.exec(str);\n\n if (!match) {\n return str;\n }\n\n var escape;\n var html = '';\n var index = 0;\n var lastIndex = 0;\n\n for (index = match.index; index < str.length; index++) {\n switch (str.charCodeAt(index)) {\n case 34: // \"\n escape = '"';\n break;\n case 38: // &\n escape = '&';\n break;\n case 39: // '\n escape = ''';\n break;\n case 60: // <\n escape = '<';\n break;\n case 62: // >\n escape = '>';\n break;\n default:\n continue;\n }\n\n if (lastIndex !== index) {\n html += str.substring(lastIndex, index);\n }\n\n lastIndex = index + 1;\n html += escape;\n }\n\n return lastIndex !== index\n ? html + str.substring(lastIndex, index)\n : html;\n}\n", "/*!\n * clipboard.js v2.0.11\n * https://clipboardjs.com/\n *\n * Licensed MIT \u00A9 Zeno Rocha\n */\n(function webpackUniversalModuleDefinition(root, factory) {\n\tif(typeof exports === 'object' && typeof module === 'object')\n\t\tmodule.exports = factory();\n\telse if(typeof define === 'function' && define.amd)\n\t\tdefine([], factory);\n\telse if(typeof exports === 'object')\n\t\texports[\"ClipboardJS\"] = factory();\n\telse\n\t\troot[\"ClipboardJS\"] = factory();\n})(this, function() {\nreturn /******/ (function() { // webpackBootstrap\n/******/ \tvar __webpack_modules__ = ({\n\n/***/ 686:\n/***/ (function(__unused_webpack_module, __webpack_exports__, __webpack_require__) {\n\n\"use strict\";\n\n// EXPORTS\n__webpack_require__.d(__webpack_exports__, {\n \"default\": function() { return /* binding */ clipboard; }\n});\n\n// EXTERNAL MODULE: ./node_modules/tiny-emitter/index.js\nvar tiny_emitter = __webpack_require__(279);\nvar tiny_emitter_default = /*#__PURE__*/__webpack_require__.n(tiny_emitter);\n// EXTERNAL MODULE: ./node_modules/good-listener/src/listen.js\nvar listen = __webpack_require__(370);\nvar listen_default = /*#__PURE__*/__webpack_require__.n(listen);\n// EXTERNAL MODULE: ./node_modules/select/src/select.js\nvar src_select = __webpack_require__(817);\nvar select_default = /*#__PURE__*/__webpack_require__.n(src_select);\n;// CONCATENATED MODULE: ./src/common/command.js\n/**\n * Executes a given operation type.\n * @param {String} type\n * @return {Boolean}\n */\nfunction command(type) {\n try {\n return document.execCommand(type);\n } catch (err) {\n return false;\n }\n}\n;// CONCATENATED MODULE: ./src/actions/cut.js\n\n\n/**\n * Cut action wrapper.\n * @param {String|HTMLElement} target\n * @return {String}\n */\n\nvar ClipboardActionCut = function ClipboardActionCut(target) {\n var selectedText = select_default()(target);\n command('cut');\n return selectedText;\n};\n\n/* harmony default export */ var actions_cut = (ClipboardActionCut);\n;// CONCATENATED MODULE: ./src/common/create-fake-element.js\n/**\n * Creates a fake textarea element with a value.\n * @param {String} value\n * @return {HTMLElement}\n */\nfunction createFakeElement(value) {\n var isRTL = document.documentElement.getAttribute('dir') === 'rtl';\n var fakeElement = document.createElement('textarea'); // Prevent zooming on iOS\n\n fakeElement.style.fontSize = '12pt'; // Reset box model\n\n fakeElement.style.border = '0';\n fakeElement.style.padding = '0';\n fakeElement.style.margin = '0'; // Move element out of screen horizontally\n\n fakeElement.style.position = 'absolute';\n fakeElement.style[isRTL ? 'right' : 'left'] = '-9999px'; // Move element to the same position vertically\n\n var yPosition = window.pageYOffset || document.documentElement.scrollTop;\n fakeElement.style.top = \"\".concat(yPosition, \"px\");\n fakeElement.setAttribute('readonly', '');\n fakeElement.value = value;\n return fakeElement;\n}\n;// CONCATENATED MODULE: ./src/actions/copy.js\n\n\n\n/**\n * Create fake copy action wrapper using a fake element.\n * @param {String} target\n * @param {Object} options\n * @return {String}\n */\n\nvar fakeCopyAction = function fakeCopyAction(value, options) {\n var fakeElement = createFakeElement(value);\n options.container.appendChild(fakeElement);\n var selectedText = select_default()(fakeElement);\n command('copy');\n fakeElement.remove();\n return selectedText;\n};\n/**\n * Copy action wrapper.\n * @param {String|HTMLElement} target\n * @param {Object} options\n * @return {String}\n */\n\n\nvar ClipboardActionCopy = function ClipboardActionCopy(target) {\n var options = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {\n container: document.body\n };\n var selectedText = '';\n\n if (typeof target === 'string') {\n selectedText = fakeCopyAction(target, options);\n } else if (target instanceof HTMLInputElement && !['text', 'search', 'url', 'tel', 'password'].includes(target === null || target === void 0 ? void 0 : target.type)) {\n // If input type doesn't support `setSelectionRange`. Simulate it. https://developer.mozilla.org/en-US/docs/Web/API/HTMLInputElement/setSelectionRange\n selectedText = fakeCopyAction(target.value, options);\n } else {\n selectedText = select_default()(target);\n command('copy');\n }\n\n return selectedText;\n};\n\n/* harmony default export */ var actions_copy = (ClipboardActionCopy);\n;// CONCATENATED MODULE: ./src/actions/default.js\nfunction _typeof(obj) { \"@babel/helpers - typeof\"; if (typeof Symbol === \"function\" && typeof Symbol.iterator === \"symbol\") { _typeof = function _typeof(obj) { return typeof obj; }; } else { _typeof = function _typeof(obj) { return obj && typeof Symbol === \"function\" && obj.constructor === Symbol && obj !== Symbol.prototype ? \"symbol\" : typeof obj; }; } return _typeof(obj); }\n\n\n\n/**\n * Inner function which performs selection from either `text` or `target`\n * properties and then executes copy or cut operations.\n * @param {Object} options\n */\n\nvar ClipboardActionDefault = function ClipboardActionDefault() {\n var options = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};\n // Defines base properties passed from constructor.\n var _options$action = options.action,\n action = _options$action === void 0 ? 'copy' : _options$action,\n container = options.container,\n target = options.target,\n text = options.text; // Sets the `action` to be performed which can be either 'copy' or 'cut'.\n\n if (action !== 'copy' && action !== 'cut') {\n throw new Error('Invalid \"action\" value, use either \"copy\" or \"cut\"');\n } // Sets the `target` property using an element that will be have its content copied.\n\n\n if (target !== undefined) {\n if (target && _typeof(target) === 'object' && target.nodeType === 1) {\n if (action === 'copy' && target.hasAttribute('disabled')) {\n throw new Error('Invalid \"target\" attribute. Please use \"readonly\" instead of \"disabled\" attribute');\n }\n\n if (action === 'cut' && (target.hasAttribute('readonly') || target.hasAttribute('disabled'))) {\n throw new Error('Invalid \"target\" attribute. You can\\'t cut text from elements with \"readonly\" or \"disabled\" attributes');\n }\n } else {\n throw new Error('Invalid \"target\" value, use a valid Element');\n }\n } // Define selection strategy based on `text` property.\n\n\n if (text) {\n return actions_copy(text, {\n container: container\n });\n } // Defines which selection strategy based on `target` property.\n\n\n if (target) {\n return action === 'cut' ? actions_cut(target) : actions_copy(target, {\n container: container\n });\n }\n};\n\n/* harmony default export */ var actions_default = (ClipboardActionDefault);\n;// CONCATENATED MODULE: ./src/clipboard.js\nfunction clipboard_typeof(obj) { \"@babel/helpers - typeof\"; if (typeof Symbol === \"function\" && typeof Symbol.iterator === \"symbol\") { clipboard_typeof = function _typeof(obj) { return typeof obj; }; } else { clipboard_typeof = function _typeof(obj) { return obj && typeof Symbol === \"function\" && obj.constructor === Symbol && obj !== Symbol.prototype ? \"symbol\" : typeof obj; }; } return clipboard_typeof(obj); }\n\nfunction _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError(\"Cannot call a class as a function\"); } }\n\nfunction _defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable || false; descriptor.configurable = true; if (\"value\" in descriptor) descriptor.writable = true; Object.defineProperty(target, descriptor.key, descriptor); } }\n\nfunction _createClass(Constructor, protoProps, staticProps) { if (protoProps) _defineProperties(Constructor.prototype, protoProps); if (staticProps) _defineProperties(Constructor, staticProps); return Constructor; }\n\nfunction _inherits(subClass, superClass) { if (typeof superClass !== \"function\" && superClass !== null) { throw new TypeError(\"Super expression must either be null or a function\"); } subClass.prototype = Object.create(superClass && superClass.prototype, { constructor: { value: subClass, writable: true, configurable: true } }); if (superClass) _setPrototypeOf(subClass, superClass); }\n\nfunction _setPrototypeOf(o, p) { _setPrototypeOf = Object.setPrototypeOf || function _setPrototypeOf(o, p) { o.__proto__ = p; return o; }; return _setPrototypeOf(o, p); }\n\nfunction _createSuper(Derived) { var hasNativeReflectConstruct = _isNativeReflectConstruct(); return function _createSuperInternal() { var Super = _getPrototypeOf(Derived), result; if (hasNativeReflectConstruct) { var NewTarget = _getPrototypeOf(this).constructor; result = Reflect.construct(Super, arguments, NewTarget); } else { result = Super.apply(this, arguments); } return _possibleConstructorReturn(this, result); }; }\n\nfunction _possibleConstructorReturn(self, call) { if (call && (clipboard_typeof(call) === \"object\" || typeof call === \"function\")) { return call; } return _assertThisInitialized(self); }\n\nfunction _assertThisInitialized(self) { if (self === void 0) { throw new ReferenceError(\"this hasn't been initialised - super() hasn't been called\"); } return self; }\n\nfunction _isNativeReflectConstruct() { if (typeof Reflect === \"undefined\" || !Reflect.construct) return false; if (Reflect.construct.sham) return false; if (typeof Proxy === \"function\") return true; try { Date.prototype.toString.call(Reflect.construct(Date, [], function () {})); return true; } catch (e) { return false; } }\n\nfunction _getPrototypeOf(o) { _getPrototypeOf = Object.setPrototypeOf ? Object.getPrototypeOf : function _getPrototypeOf(o) { return o.__proto__ || Object.getPrototypeOf(o); }; return _getPrototypeOf(o); }\n\n\n\n\n\n\n/**\n * Helper function to retrieve attribute value.\n * @param {String} suffix\n * @param {Element} element\n */\n\nfunction getAttributeValue(suffix, element) {\n var attribute = \"data-clipboard-\".concat(suffix);\n\n if (!element.hasAttribute(attribute)) {\n return;\n }\n\n return element.getAttribute(attribute);\n}\n/**\n * Base class which takes one or more elements, adds event listeners to them,\n * and instantiates a new `ClipboardAction` on each click.\n */\n\n\nvar Clipboard = /*#__PURE__*/function (_Emitter) {\n _inherits(Clipboard, _Emitter);\n\n var _super = _createSuper(Clipboard);\n\n /**\n * @param {String|HTMLElement|HTMLCollection|NodeList} trigger\n * @param {Object} options\n */\n function Clipboard(trigger, options) {\n var _this;\n\n _classCallCheck(this, Clipboard);\n\n _this = _super.call(this);\n\n _this.resolveOptions(options);\n\n _this.listenClick(trigger);\n\n return _this;\n }\n /**\n * Defines if attributes would be resolved using internal setter functions\n * or custom functions that were passed in the constructor.\n * @param {Object} options\n */\n\n\n _createClass(Clipboard, [{\n key: \"resolveOptions\",\n value: function resolveOptions() {\n var options = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};\n this.action = typeof options.action === 'function' ? options.action : this.defaultAction;\n this.target = typeof options.target === 'function' ? options.target : this.defaultTarget;\n this.text = typeof options.text === 'function' ? options.text : this.defaultText;\n this.container = clipboard_typeof(options.container) === 'object' ? options.container : document.body;\n }\n /**\n * Adds a click event listener to the passed trigger.\n * @param {String|HTMLElement|HTMLCollection|NodeList} trigger\n */\n\n }, {\n key: \"listenClick\",\n value: function listenClick(trigger) {\n var _this2 = this;\n\n this.listener = listen_default()(trigger, 'click', function (e) {\n return _this2.onClick(e);\n });\n }\n /**\n * Defines a new `ClipboardAction` on each click event.\n * @param {Event} e\n */\n\n }, {\n key: \"onClick\",\n value: function onClick(e) {\n var trigger = e.delegateTarget || e.currentTarget;\n var action = this.action(trigger) || 'copy';\n var text = actions_default({\n action: action,\n container: this.container,\n target: this.target(trigger),\n text: this.text(trigger)\n }); // Fires an event based on the copy operation result.\n\n this.emit(text ? 'success' : 'error', {\n action: action,\n text: text,\n trigger: trigger,\n clearSelection: function clearSelection() {\n if (trigger) {\n trigger.focus();\n }\n\n window.getSelection().removeAllRanges();\n }\n });\n }\n /**\n * Default `action` lookup function.\n * @param {Element} trigger\n */\n\n }, {\n key: \"defaultAction\",\n value: function defaultAction(trigger) {\n return getAttributeValue('action', trigger);\n }\n /**\n * Default `target` lookup function.\n * @param {Element} trigger\n */\n\n }, {\n key: \"defaultTarget\",\n value: function defaultTarget(trigger) {\n var selector = getAttributeValue('target', trigger);\n\n if (selector) {\n return document.querySelector(selector);\n }\n }\n /**\n * Allow fire programmatically a copy action\n * @param {String|HTMLElement} target\n * @param {Object} options\n * @returns Text copied.\n */\n\n }, {\n key: \"defaultText\",\n\n /**\n * Default `text` lookup function.\n * @param {Element} trigger\n */\n value: function defaultText(trigger) {\n return getAttributeValue('text', trigger);\n }\n /**\n * Destroy lifecycle.\n */\n\n }, {\n key: \"destroy\",\n value: function destroy() {\n this.listener.destroy();\n }\n }], [{\n key: \"copy\",\n value: function copy(target) {\n var options = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {\n container: document.body\n };\n return actions_copy(target, options);\n }\n /**\n * Allow fire programmatically a cut action\n * @param {String|HTMLElement} target\n * @returns Text cutted.\n */\n\n }, {\n key: \"cut\",\n value: function cut(target) {\n return actions_cut(target);\n }\n /**\n * Returns the support of the given action, or all actions if no action is\n * given.\n * @param {String} [action]\n */\n\n }, {\n key: \"isSupported\",\n value: function isSupported() {\n var action = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : ['copy', 'cut'];\n var actions = typeof action === 'string' ? [action] : action;\n var support = !!document.queryCommandSupported;\n actions.forEach(function (action) {\n support = support && !!document.queryCommandSupported(action);\n });\n return support;\n }\n }]);\n\n return Clipboard;\n}((tiny_emitter_default()));\n\n/* harmony default export */ var clipboard = (Clipboard);\n\n/***/ }),\n\n/***/ 828:\n/***/ (function(module) {\n\nvar DOCUMENT_NODE_TYPE = 9;\n\n/**\n * A polyfill for Element.matches()\n */\nif (typeof Element !== 'undefined' && !Element.prototype.matches) {\n var proto = Element.prototype;\n\n proto.matches = proto.matchesSelector ||\n proto.mozMatchesSelector ||\n proto.msMatchesSelector ||\n proto.oMatchesSelector ||\n proto.webkitMatchesSelector;\n}\n\n/**\n * Finds the closest parent that matches a selector.\n *\n * @param {Element} element\n * @param {String} selector\n * @return {Function}\n */\nfunction closest (element, selector) {\n while (element && element.nodeType !== DOCUMENT_NODE_TYPE) {\n if (typeof element.matches === 'function' &&\n element.matches(selector)) {\n return element;\n }\n element = element.parentNode;\n }\n}\n\nmodule.exports = closest;\n\n\n/***/ }),\n\n/***/ 438:\n/***/ (function(module, __unused_webpack_exports, __webpack_require__) {\n\nvar closest = __webpack_require__(828);\n\n/**\n * Delegates event to a selector.\n *\n * @param {Element} element\n * @param {String} selector\n * @param {String} type\n * @param {Function} callback\n * @param {Boolean} useCapture\n * @return {Object}\n */\nfunction _delegate(element, selector, type, callback, useCapture) {\n var listenerFn = listener.apply(this, arguments);\n\n element.addEventListener(type, listenerFn, useCapture);\n\n return {\n destroy: function() {\n element.removeEventListener(type, listenerFn, useCapture);\n }\n }\n}\n\n/**\n * Delegates event to a selector.\n *\n * @param {Element|String|Array} [elements]\n * @param {String} selector\n * @param {String} type\n * @param {Function} callback\n * @param {Boolean} useCapture\n * @return {Object}\n */\nfunction delegate(elements, selector, type, callback, useCapture) {\n // Handle the regular Element usage\n if (typeof elements.addEventListener === 'function') {\n return _delegate.apply(null, arguments);\n }\n\n // Handle Element-less usage, it defaults to global delegation\n if (typeof type === 'function') {\n // Use `document` as the first parameter, then apply arguments\n // This is a short way to .unshift `arguments` without running into deoptimizations\n return _delegate.bind(null, document).apply(null, arguments);\n }\n\n // Handle Selector-based usage\n if (typeof elements === 'string') {\n elements = document.querySelectorAll(elements);\n }\n\n // Handle Array-like based usage\n return Array.prototype.map.call(elements, function (element) {\n return _delegate(element, selector, type, callback, useCapture);\n });\n}\n\n/**\n * Finds closest match and invokes callback.\n *\n * @param {Element} element\n * @param {String} selector\n * @param {String} type\n * @param {Function} callback\n * @return {Function}\n */\nfunction listener(element, selector, type, callback) {\n return function(e) {\n e.delegateTarget = closest(e.target, selector);\n\n if (e.delegateTarget) {\n callback.call(element, e);\n }\n }\n}\n\nmodule.exports = delegate;\n\n\n/***/ }),\n\n/***/ 879:\n/***/ (function(__unused_webpack_module, exports) {\n\n/**\n * Check if argument is a HTML element.\n *\n * @param {Object} value\n * @return {Boolean}\n */\nexports.node = function(value) {\n return value !== undefined\n && value instanceof HTMLElement\n && value.nodeType === 1;\n};\n\n/**\n * Check if argument is a list of HTML elements.\n *\n * @param {Object} value\n * @return {Boolean}\n */\nexports.nodeList = function(value) {\n var type = Object.prototype.toString.call(value);\n\n return value !== undefined\n && (type === '[object NodeList]' || type === '[object HTMLCollection]')\n && ('length' in value)\n && (value.length === 0 || exports.node(value[0]));\n};\n\n/**\n * Check if argument is a string.\n *\n * @param {Object} value\n * @return {Boolean}\n */\nexports.string = function(value) {\n return typeof value === 'string'\n || value instanceof String;\n};\n\n/**\n * Check if argument is a function.\n *\n * @param {Object} value\n * @return {Boolean}\n */\nexports.fn = function(value) {\n var type = Object.prototype.toString.call(value);\n\n return type === '[object Function]';\n};\n\n\n/***/ }),\n\n/***/ 370:\n/***/ (function(module, __unused_webpack_exports, __webpack_require__) {\n\nvar is = __webpack_require__(879);\nvar delegate = __webpack_require__(438);\n\n/**\n * Validates all params and calls the right\n * listener function based on its target type.\n *\n * @param {String|HTMLElement|HTMLCollection|NodeList} target\n * @param {String} type\n * @param {Function} callback\n * @return {Object}\n */\nfunction listen(target, type, callback) {\n if (!target && !type && !callback) {\n throw new Error('Missing required arguments');\n }\n\n if (!is.string(type)) {\n throw new TypeError('Second argument must be a String');\n }\n\n if (!is.fn(callback)) {\n throw new TypeError('Third argument must be a Function');\n }\n\n if (is.node(target)) {\n return listenNode(target, type, callback);\n }\n else if (is.nodeList(target)) {\n return listenNodeList(target, type, callback);\n }\n else if (is.string(target)) {\n return listenSelector(target, type, callback);\n }\n else {\n throw new TypeError('First argument must be a String, HTMLElement, HTMLCollection, or NodeList');\n }\n}\n\n/**\n * Adds an event listener to a HTML element\n * and returns a remove listener function.\n *\n * @param {HTMLElement} node\n * @param {String} type\n * @param {Function} callback\n * @return {Object}\n */\nfunction listenNode(node, type, callback) {\n node.addEventListener(type, callback);\n\n return {\n destroy: function() {\n node.removeEventListener(type, callback);\n }\n }\n}\n\n/**\n * Add an event listener to a list of HTML elements\n * and returns a remove listener function.\n *\n * @param {NodeList|HTMLCollection} nodeList\n * @param {String} type\n * @param {Function} callback\n * @return {Object}\n */\nfunction listenNodeList(nodeList, type, callback) {\n Array.prototype.forEach.call(nodeList, function(node) {\n node.addEventListener(type, callback);\n });\n\n return {\n destroy: function() {\n Array.prototype.forEach.call(nodeList, function(node) {\n node.removeEventListener(type, callback);\n });\n }\n }\n}\n\n/**\n * Add an event listener to a selector\n * and returns a remove listener function.\n *\n * @param {String} selector\n * @param {String} type\n * @param {Function} callback\n * @return {Object}\n */\nfunction listenSelector(selector, type, callback) {\n return delegate(document.body, selector, type, callback);\n}\n\nmodule.exports = listen;\n\n\n/***/ }),\n\n/***/ 817:\n/***/ (function(module) {\n\nfunction select(element) {\n var selectedText;\n\n if (element.nodeName === 'SELECT') {\n element.focus();\n\n selectedText = element.value;\n }\n else if (element.nodeName === 'INPUT' || element.nodeName === 'TEXTAREA') {\n var isReadOnly = element.hasAttribute('readonly');\n\n if (!isReadOnly) {\n element.setAttribute('readonly', '');\n }\n\n element.select();\n element.setSelectionRange(0, element.value.length);\n\n if (!isReadOnly) {\n element.removeAttribute('readonly');\n }\n\n selectedText = element.value;\n }\n else {\n if (element.hasAttribute('contenteditable')) {\n element.focus();\n }\n\n var selection = window.getSelection();\n var range = document.createRange();\n\n range.selectNodeContents(element);\n selection.removeAllRanges();\n selection.addRange(range);\n\n selectedText = selection.toString();\n }\n\n return selectedText;\n}\n\nmodule.exports = select;\n\n\n/***/ }),\n\n/***/ 279:\n/***/ (function(module) {\n\nfunction E () {\n // Keep this empty so it's easier to inherit from\n // (via https://github.com/lipsmack from https://github.com/scottcorgan/tiny-emitter/issues/3)\n}\n\nE.prototype = {\n on: function (name, callback, ctx) {\n var e = this.e || (this.e = {});\n\n (e[name] || (e[name] = [])).push({\n fn: callback,\n ctx: ctx\n });\n\n return this;\n },\n\n once: function (name, callback, ctx) {\n var self = this;\n function listener () {\n self.off(name, listener);\n callback.apply(ctx, arguments);\n };\n\n listener._ = callback\n return this.on(name, listener, ctx);\n },\n\n emit: function (name) {\n var data = [].slice.call(arguments, 1);\n var evtArr = ((this.e || (this.e = {}))[name] || []).slice();\n var i = 0;\n var len = evtArr.length;\n\n for (i; i < len; i++) {\n evtArr[i].fn.apply(evtArr[i].ctx, data);\n }\n\n return this;\n },\n\n off: function (name, callback) {\n var e = this.e || (this.e = {});\n var evts = e[name];\n var liveEvents = [];\n\n if (evts && callback) {\n for (var i = 0, len = evts.length; i < len; i++) {\n if (evts[i].fn !== callback && evts[i].fn._ !== callback)\n liveEvents.push(evts[i]);\n }\n }\n\n // Remove event from queue to prevent memory leak\n // Suggested by https://github.com/lazd\n // Ref: https://github.com/scottcorgan/tiny-emitter/commit/c6ebfaa9bc973b33d110a84a307742b7cf94c953#commitcomment-5024910\n\n (liveEvents.length)\n ? e[name] = liveEvents\n : delete e[name];\n\n return this;\n }\n};\n\nmodule.exports = E;\nmodule.exports.TinyEmitter = E;\n\n\n/***/ })\n\n/******/ \t});\n/************************************************************************/\n/******/ \t// The module cache\n/******/ \tvar __webpack_module_cache__ = {};\n/******/ \t\n/******/ \t// The require function\n/******/ \tfunction __webpack_require__(moduleId) {\n/******/ \t\t// Check if module is in cache\n/******/ \t\tif(__webpack_module_cache__[moduleId]) {\n/******/ \t\t\treturn __webpack_module_cache__[moduleId].exports;\n/******/ \t\t}\n/******/ \t\t// Create a new module (and put it into the cache)\n/******/ \t\tvar module = __webpack_module_cache__[moduleId] = {\n/******/ \t\t\t// no module.id needed\n/******/ \t\t\t// no module.loaded needed\n/******/ \t\t\texports: {}\n/******/ \t\t};\n/******/ \t\n/******/ \t\t// Execute the module function\n/******/ \t\t__webpack_modules__[moduleId](module, module.exports, __webpack_require__);\n/******/ \t\n/******/ \t\t// Return the exports of the module\n/******/ \t\treturn module.exports;\n/******/ \t}\n/******/ \t\n/************************************************************************/\n/******/ \t/* webpack/runtime/compat get default export */\n/******/ \t!function() {\n/******/ \t\t// getDefaultExport function for compatibility with non-harmony modules\n/******/ \t\t__webpack_require__.n = function(module) {\n/******/ \t\t\tvar getter = module && module.__esModule ?\n/******/ \t\t\t\tfunction() { return module['default']; } :\n/******/ \t\t\t\tfunction() { return module; };\n/******/ \t\t\t__webpack_require__.d(getter, { a: getter });\n/******/ \t\t\treturn getter;\n/******/ \t\t};\n/******/ \t}();\n/******/ \t\n/******/ \t/* webpack/runtime/define property getters */\n/******/ \t!function() {\n/******/ \t\t// define getter functions for harmony exports\n/******/ \t\t__webpack_require__.d = function(exports, definition) {\n/******/ \t\t\tfor(var key in definition) {\n/******/ \t\t\t\tif(__webpack_require__.o(definition, key) && !__webpack_require__.o(exports, key)) {\n/******/ \t\t\t\t\tObject.defineProperty(exports, key, { enumerable: true, get: definition[key] });\n/******/ \t\t\t\t}\n/******/ \t\t\t}\n/******/ \t\t};\n/******/ \t}();\n/******/ \t\n/******/ \t/* webpack/runtime/hasOwnProperty shorthand */\n/******/ \t!function() {\n/******/ \t\t__webpack_require__.o = function(obj, prop) { return Object.prototype.hasOwnProperty.call(obj, prop); }\n/******/ \t}();\n/******/ \t\n/************************************************************************/\n/******/ \t// module exports must be returned from runtime so entry inlining is disabled\n/******/ \t// startup\n/******/ \t// Load entry module and return exports\n/******/ \treturn __webpack_require__(686);\n/******/ })()\n.default;\n});", "/*\n * Copyright (c) 2016-2024 Martin Donath \n *\n * Permission is hereby granted, free of charge, to any person obtaining a copy\n * of this software and associated documentation files (the \"Software\"), to\n * deal in the Software without restriction, including without limitation the\n * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or\n * sell copies of the Software, and to permit persons to whom the Software is\n * furnished to do so, subject to the following conditions:\n *\n * The above copyright notice and this permission notice shall be included in\n * all copies or substantial portions of the Software.\n *\n * THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL THE\n * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING\n * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS\n * IN THE SOFTWARE.\n */\n\nimport \"focus-visible\"\n\nimport {\n EMPTY,\n NEVER,\n Observable,\n Subject,\n defer,\n delay,\n filter,\n map,\n merge,\n mergeWith,\n shareReplay,\n switchMap\n} from \"rxjs\"\n\nimport { configuration, feature } from \"./_\"\nimport {\n at,\n getActiveElement,\n getOptionalElement,\n requestJSON,\n setLocation,\n setToggle,\n watchDocument,\n watchKeyboard,\n watchLocation,\n watchLocationTarget,\n watchMedia,\n watchPrint,\n watchScript,\n watchViewport\n} from \"./browser\"\nimport {\n getComponentElement,\n getComponentElements,\n mountAnnounce,\n mountBackToTop,\n mountConsent,\n mountContent,\n mountDialog,\n mountHeader,\n mountHeaderTitle,\n mountPalette,\n mountProgress,\n mountSearch,\n mountSearchHiglight,\n mountSidebar,\n mountSource,\n mountTableOfContents,\n mountTabs,\n watchHeader,\n watchMain\n} from \"./components\"\nimport {\n SearchIndex,\n setupClipboardJS,\n setupInstantNavigation,\n setupVersionSelector\n} from \"./integrations\"\nimport {\n patchEllipsis,\n patchIndeterminate,\n patchScrollfix,\n patchScrolllock\n} from \"./patches\"\nimport \"./polyfills\"\n\n/* ----------------------------------------------------------------------------\n * Functions - @todo refactor\n * ------------------------------------------------------------------------- */\n\n/**\n * Fetch search index\n *\n * @returns Search index observable\n */\nfunction fetchSearchIndex(): Observable {\n if (location.protocol === \"file:\") {\n return watchScript(\n `${new URL(\"search/search_index.js\", config.base)}`\n )\n .pipe(\n // @ts-ignore - @todo fix typings\n map(() => __index),\n shareReplay(1)\n )\n } else {\n return requestJSON(\n new URL(\"search/search_index.json\", config.base)\n )\n }\n}\n\n/* ----------------------------------------------------------------------------\n * Application\n * ------------------------------------------------------------------------- */\n\n/* Yay, JavaScript is available */\ndocument.documentElement.classList.remove(\"no-js\")\ndocument.documentElement.classList.add(\"js\")\n\n/* Set up navigation observables and subjects */\nconst document$ = watchDocument()\nconst location$ = watchLocation()\nconst target$ = watchLocationTarget(location$)\nconst keyboard$ = watchKeyboard()\n\n/* Set up media observables */\nconst viewport$ = watchViewport()\nconst tablet$ = watchMedia(\"(min-width: 960px)\")\nconst screen$ = watchMedia(\"(min-width: 1220px)\")\nconst print$ = watchPrint()\n\n/* Retrieve search index, if search is enabled */\nconst config = configuration()\nconst index$ = document.forms.namedItem(\"search\")\n ? fetchSearchIndex()\n : NEVER\n\n/* Set up Clipboard.js integration */\nconst alert$ = new Subject()\nsetupClipboardJS({ alert$ })\n\n/* Set up progress indicator */\nconst progress$ = new Subject()\n\n/* Set up instant navigation, if enabled */\nif (feature(\"navigation.instant\"))\n setupInstantNavigation({ location$, viewport$, progress$ })\n .subscribe(document$)\n\n/* Set up version selector */\nif (config.version?.provider === \"mike\")\n setupVersionSelector({ document$ })\n\n/* Always close drawer and search on navigation */\nmerge(location$, target$)\n .pipe(\n delay(125)\n )\n .subscribe(() => {\n setToggle(\"drawer\", false)\n setToggle(\"search\", false)\n })\n\n/* Set up global keyboard handlers */\nkeyboard$\n .pipe(\n filter(({ mode }) => mode === \"global\")\n )\n .subscribe(key => {\n switch (key.type) {\n\n /* Go to previous page */\n case \"p\":\n case \",\":\n const prev = getOptionalElement(\"link[rel=prev]\")\n if (typeof prev !== \"undefined\")\n setLocation(prev)\n break\n\n /* Go to next page */\n case \"n\":\n case \".\":\n const next = getOptionalElement(\"link[rel=next]\")\n if (typeof next !== \"undefined\")\n setLocation(next)\n break\n\n /* Expand navigation, see https://bit.ly/3ZjG5io */\n case \"Enter\":\n const active = getActiveElement()\n if (active instanceof HTMLLabelElement)\n active.click()\n }\n })\n\n/* Set up patches */\npatchEllipsis({ viewport$, document$ })\npatchIndeterminate({ document$, tablet$ })\npatchScrollfix({ document$ })\npatchScrolllock({ viewport$, tablet$ })\n\n/* Set up header and main area observable */\nconst header$ = watchHeader(getComponentElement(\"header\"), { viewport$ })\nconst main$ = document$\n .pipe(\n map(() => getComponentElement(\"main\")),\n switchMap(el => watchMain(el, { viewport$, header$ })),\n shareReplay(1)\n )\n\n/* Set up control component observables */\nconst control$ = merge(\n\n /* Consent */\n ...getComponentElements(\"consent\")\n .map(el => mountConsent(el, { target$ })),\n\n /* Dialog */\n ...getComponentElements(\"dialog\")\n .map(el => mountDialog(el, { alert$ })),\n\n /* Header */\n ...getComponentElements(\"header\")\n .map(el => mountHeader(el, { viewport$, header$, main$ })),\n\n /* Color palette */\n ...getComponentElements(\"palette\")\n .map(el => mountPalette(el)),\n\n /* Progress bar */\n ...getComponentElements(\"progress\")\n .map(el => mountProgress(el, { progress$ })),\n\n /* Search */\n ...getComponentElements(\"search\")\n .map(el => mountSearch(el, { index$, keyboard$ })),\n\n /* Repository information */\n ...getComponentElements(\"source\")\n .map(el => mountSource(el))\n)\n\n/* Set up content component observables */\nconst content$ = defer(() => merge(\n\n /* Announcement bar */\n ...getComponentElements(\"announce\")\n .map(el => mountAnnounce(el)),\n\n /* Content */\n ...getComponentElements(\"content\")\n .map(el => mountContent(el, { viewport$, target$, print$ })),\n\n /* Search highlighting */\n ...getComponentElements(\"content\")\n .map(el => feature(\"search.highlight\")\n ? mountSearchHiglight(el, { index$, location$ })\n : EMPTY\n ),\n\n /* Header title */\n ...getComponentElements(\"header-title\")\n .map(el => mountHeaderTitle(el, { viewport$, header$ })),\n\n /* Sidebar */\n ...getComponentElements(\"sidebar\")\n .map(el => el.getAttribute(\"data-md-type\") === \"navigation\"\n ? at(screen$, () => mountSidebar(el, { viewport$, header$, main$ }))\n : at(tablet$, () => mountSidebar(el, { viewport$, header$, main$ }))\n ),\n\n /* Navigation tabs */\n ...getComponentElements(\"tabs\")\n .map(el => mountTabs(el, { viewport$, header$ })),\n\n /* Table of contents */\n ...getComponentElements(\"toc\")\n .map(el => mountTableOfContents(el, {\n viewport$, header$, main$, target$\n })),\n\n /* Back-to-top button */\n ...getComponentElements(\"top\")\n .map(el => mountBackToTop(el, { viewport$, header$, main$, target$ }))\n))\n\n/* Set up component observables */\nconst component$ = document$\n .pipe(\n switchMap(() => content$),\n mergeWith(control$),\n shareReplay(1)\n )\n\n/* Subscribe to all components */\ncomponent$.subscribe()\n\n/* ----------------------------------------------------------------------------\n * Exports\n * ------------------------------------------------------------------------- */\n\nwindow.document$ = document$ /* Document observable */\nwindow.location$ = location$ /* Location subject */\nwindow.target$ = target$ /* Location target observable */\nwindow.keyboard$ = keyboard$ /* Keyboard observable */\nwindow.viewport$ = viewport$ /* Viewport observable */\nwindow.tablet$ = tablet$ /* Media tablet observable */\nwindow.screen$ = screen$ /* Media screen observable */\nwindow.print$ = print$ /* Media print observable */\nwindow.alert$ = alert$ /* Alert subject */\nwindow.progress$ = progress$ /* Progress indicator subject */\nwindow.component$ = component$ /* Component observable */\n", "/******************************************************************************\nCopyright (c) Microsoft Corporation.\n\nPermission to use, copy, modify, and/or distribute this software for any\npurpose with or without fee is hereby granted.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH\nREGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY\nAND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,\nINDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM\nLOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR\nOTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR\nPERFORMANCE OF THIS SOFTWARE.\n***************************************************************************** */\n/* global Reflect, Promise, SuppressedError, Symbol, Iterator */\n\nvar extendStatics = function(d, b) {\n extendStatics = Object.setPrototypeOf ||\n ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||\n function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };\n return extendStatics(d, b);\n};\n\nexport function __extends(d, b) {\n if (typeof b !== \"function\" && b !== null)\n throw new TypeError(\"Class extends value \" + String(b) + \" is not a constructor or null\");\n extendStatics(d, b);\n function __() { this.constructor = d; }\n d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());\n}\n\nexport var __assign = function() {\n __assign = Object.assign || function __assign(t) {\n for (var s, i = 1, n = arguments.length; i < n; i++) {\n s = arguments[i];\n for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p)) t[p] = s[p];\n }\n return t;\n }\n return __assign.apply(this, arguments);\n}\n\nexport function __rest(s, e) {\n var t = {};\n for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)\n t[p] = s[p];\n if (s != null && typeof Object.getOwnPropertySymbols === \"function\")\n for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {\n if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))\n t[p[i]] = s[p[i]];\n }\n return t;\n}\n\nexport function __decorate(decorators, target, key, desc) {\n var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;\n if (typeof Reflect === \"object\" && typeof Reflect.decorate === \"function\") r = Reflect.decorate(decorators, target, key, desc);\n else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;\n return c > 3 && r && Object.defineProperty(target, key, r), r;\n}\n\nexport function __param(paramIndex, decorator) {\n return function (target, key) { decorator(target, key, paramIndex); }\n}\n\nexport function __esDecorate(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {\n function accept(f) { if (f !== void 0 && typeof f !== \"function\") throw new TypeError(\"Function expected\"); return f; }\n var kind = contextIn.kind, key = kind === \"getter\" ? \"get\" : kind === \"setter\" ? \"set\" : \"value\";\n var target = !descriptorIn && ctor ? contextIn[\"static\"] ? ctor : ctor.prototype : null;\n var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});\n var _, done = false;\n for (var i = decorators.length - 1; i >= 0; i--) {\n var context = {};\n for (var p in contextIn) context[p] = p === \"access\" ? {} : contextIn[p];\n for (var p in contextIn.access) context.access[p] = contextIn.access[p];\n context.addInitializer = function (f) { if (done) throw new TypeError(\"Cannot add initializers after decoration has completed\"); extraInitializers.push(accept(f || null)); };\n var result = (0, decorators[i])(kind === \"accessor\" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);\n if (kind === \"accessor\") {\n if (result === void 0) continue;\n if (result === null || typeof result !== \"object\") throw new TypeError(\"Object expected\");\n if (_ = accept(result.get)) descriptor.get = _;\n if (_ = accept(result.set)) descriptor.set = _;\n if (_ = accept(result.init)) initializers.unshift(_);\n }\n else if (_ = accept(result)) {\n if (kind === \"field\") initializers.unshift(_);\n else descriptor[key] = _;\n }\n }\n if (target) Object.defineProperty(target, contextIn.name, descriptor);\n done = true;\n};\n\nexport function __runInitializers(thisArg, initializers, value) {\n var useValue = arguments.length > 2;\n for (var i = 0; i < initializers.length; i++) {\n value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);\n }\n return useValue ? value : void 0;\n};\n\nexport function __propKey(x) {\n return typeof x === \"symbol\" ? x : \"\".concat(x);\n};\n\nexport function __setFunctionName(f, name, prefix) {\n if (typeof name === \"symbol\") name = name.description ? \"[\".concat(name.description, \"]\") : \"\";\n return Object.defineProperty(f, \"name\", { configurable: true, value: prefix ? \"\".concat(prefix, \" \", name) : name });\n};\n\nexport function __metadata(metadataKey, metadataValue) {\n if (typeof Reflect === \"object\" && typeof Reflect.metadata === \"function\") return Reflect.metadata(metadataKey, metadataValue);\n}\n\nexport function __awaiter(thisArg, _arguments, P, generator) {\n function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }\n return new (P || (P = Promise))(function (resolve, reject) {\n function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }\n function rejected(value) { try { step(generator[\"throw\"](value)); } catch (e) { reject(e); } }\n function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }\n step((generator = generator.apply(thisArg, _arguments || [])).next());\n });\n}\n\nexport function __generator(thisArg, body) {\n var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === \"function\" ? Iterator : Object).prototype);\n return g.next = verb(0), g[\"throw\"] = verb(1), g[\"return\"] = verb(2), typeof Symbol === \"function\" && (g[Symbol.iterator] = function() { return this; }), g;\n function verb(n) { return function (v) { return step([n, v]); }; }\n function step(op) {\n if (f) throw new TypeError(\"Generator is already executing.\");\n while (g && (g = 0, op[0] && (_ = 0)), _) try {\n if (f = 1, y && (t = op[0] & 2 ? y[\"return\"] : op[0] ? y[\"throw\"] || ((t = y[\"return\"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;\n if (y = 0, t) op = [op[0] & 2, t.value];\n switch (op[0]) {\n case 0: case 1: t = op; break;\n case 4: _.label++; return { value: op[1], done: false };\n case 5: _.label++; y = op[1]; op = [0]; continue;\n case 7: op = _.ops.pop(); _.trys.pop(); continue;\n default:\n if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }\n if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }\n if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }\n if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }\n if (t[2]) _.ops.pop();\n _.trys.pop(); continue;\n }\n op = body.call(thisArg, _);\n } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }\n if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };\n }\n}\n\nexport var __createBinding = Object.create ? (function(o, m, k, k2) {\n if (k2 === undefined) k2 = k;\n var desc = Object.getOwnPropertyDescriptor(m, k);\n if (!desc || (\"get\" in desc ? !m.__esModule : desc.writable || desc.configurable)) {\n desc = { enumerable: true, get: function() { return m[k]; } };\n }\n Object.defineProperty(o, k2, desc);\n}) : (function(o, m, k, k2) {\n if (k2 === undefined) k2 = k;\n o[k2] = m[k];\n});\n\nexport function __exportStar(m, o) {\n for (var p in m) if (p !== \"default\" && !Object.prototype.hasOwnProperty.call(o, p)) __createBinding(o, m, p);\n}\n\nexport function __values(o) {\n var s = typeof Symbol === \"function\" && Symbol.iterator, m = s && o[s], i = 0;\n if (m) return m.call(o);\n if (o && typeof o.length === \"number\") return {\n next: function () {\n if (o && i >= o.length) o = void 0;\n return { value: o && o[i++], done: !o };\n }\n };\n throw new TypeError(s ? \"Object is not iterable.\" : \"Symbol.iterator is not defined.\");\n}\n\nexport function __read(o, n) {\n var m = typeof Symbol === \"function\" && o[Symbol.iterator];\n if (!m) return o;\n var i = m.call(o), r, ar = [], e;\n try {\n while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);\n }\n catch (error) { e = { error: error }; }\n finally {\n try {\n if (r && !r.done && (m = i[\"return\"])) m.call(i);\n }\n finally { if (e) throw e.error; }\n }\n return ar;\n}\n\n/** @deprecated */\nexport function __spread() {\n for (var ar = [], i = 0; i < arguments.length; i++)\n ar = ar.concat(__read(arguments[i]));\n return ar;\n}\n\n/** @deprecated */\nexport function __spreadArrays() {\n for (var s = 0, i = 0, il = arguments.length; i < il; i++) s += arguments[i].length;\n for (var r = Array(s), k = 0, i = 0; i < il; i++)\n for (var a = arguments[i], j = 0, jl = a.length; j < jl; j++, k++)\n r[k] = a[j];\n return r;\n}\n\nexport function __spreadArray(to, from, pack) {\n if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {\n if (ar || !(i in from)) {\n if (!ar) ar = Array.prototype.slice.call(from, 0, i);\n ar[i] = from[i];\n }\n }\n return to.concat(ar || Array.prototype.slice.call(from));\n}\n\nexport function __await(v) {\n return this instanceof __await ? (this.v = v, this) : new __await(v);\n}\n\nexport function __asyncGenerator(thisArg, _arguments, generator) {\n if (!Symbol.asyncIterator) throw new TypeError(\"Symbol.asyncIterator is not defined.\");\n var g = generator.apply(thisArg, _arguments || []), i, q = [];\n return i = Object.create((typeof AsyncIterator === \"function\" ? AsyncIterator : Object).prototype), verb(\"next\"), verb(\"throw\"), verb(\"return\", awaitReturn), i[Symbol.asyncIterator] = function () { return this; }, i;\n function awaitReturn(f) { return function (v) { return Promise.resolve(v).then(f, reject); }; }\n function verb(n, f) { if (g[n]) { i[n] = function (v) { return new Promise(function (a, b) { q.push([n, v, a, b]) > 1 || resume(n, v); }); }; if (f) i[n] = f(i[n]); } }\n function resume(n, v) { try { step(g[n](v)); } catch (e) { settle(q[0][3], e); } }\n function step(r) { r.value instanceof __await ? Promise.resolve(r.value.v).then(fulfill, reject) : settle(q[0][2], r); }\n function fulfill(value) { resume(\"next\", value); }\n function reject(value) { resume(\"throw\", value); }\n function settle(f, v) { if (f(v), q.shift(), q.length) resume(q[0][0], q[0][1]); }\n}\n\nexport function __asyncDelegator(o) {\n var i, p;\n return i = {}, verb(\"next\"), verb(\"throw\", function (e) { throw e; }), verb(\"return\"), i[Symbol.iterator] = function () { return this; }, i;\n function verb(n, f) { i[n] = o[n] ? function (v) { return (p = !p) ? { value: __await(o[n](v)), done: false } : f ? f(v) : v; } : f; }\n}\n\nexport function __asyncValues(o) {\n if (!Symbol.asyncIterator) throw new TypeError(\"Symbol.asyncIterator is not defined.\");\n var m = o[Symbol.asyncIterator], i;\n return m ? m.call(o) : (o = typeof __values === \"function\" ? __values(o) : o[Symbol.iterator](), i = {}, verb(\"next\"), verb(\"throw\"), verb(\"return\"), i[Symbol.asyncIterator] = function () { return this; }, i);\n function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }\n function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }\n}\n\nexport function __makeTemplateObject(cooked, raw) {\n if (Object.defineProperty) { Object.defineProperty(cooked, \"raw\", { value: raw }); } else { cooked.raw = raw; }\n return cooked;\n};\n\nvar __setModuleDefault = Object.create ? (function(o, v) {\n Object.defineProperty(o, \"default\", { enumerable: true, value: v });\n}) : function(o, v) {\n o[\"default\"] = v;\n};\n\nexport function __importStar(mod) {\n if (mod && mod.__esModule) return mod;\n var result = {};\n if (mod != null) for (var k in mod) if (k !== \"default\" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);\n __setModuleDefault(result, mod);\n return result;\n}\n\nexport function __importDefault(mod) {\n return (mod && mod.__esModule) ? mod : { default: mod };\n}\n\nexport function __classPrivateFieldGet(receiver, state, kind, f) {\n if (kind === \"a\" && !f) throw new TypeError(\"Private accessor was defined without a getter\");\n if (typeof state === \"function\" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError(\"Cannot read private member from an object whose class did not declare it\");\n return kind === \"m\" ? f : kind === \"a\" ? f.call(receiver) : f ? f.value : state.get(receiver);\n}\n\nexport function __classPrivateFieldSet(receiver, state, value, kind, f) {\n if (kind === \"m\") throw new TypeError(\"Private method is not writable\");\n if (kind === \"a\" && !f) throw new TypeError(\"Private accessor was defined without a setter\");\n if (typeof state === \"function\" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError(\"Cannot write private member to an object whose class did not declare it\");\n return (kind === \"a\" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;\n}\n\nexport function __classPrivateFieldIn(state, receiver) {\n if (receiver === null || (typeof receiver !== \"object\" && typeof receiver !== \"function\")) throw new TypeError(\"Cannot use 'in' operator on non-object\");\n return typeof state === \"function\" ? receiver === state : state.has(receiver);\n}\n\nexport function __addDisposableResource(env, value, async) {\n if (value !== null && value !== void 0) {\n if (typeof value !== \"object\" && typeof value !== \"function\") throw new TypeError(\"Object expected.\");\n var dispose, inner;\n if (async) {\n if (!Symbol.asyncDispose) throw new TypeError(\"Symbol.asyncDispose is not defined.\");\n dispose = value[Symbol.asyncDispose];\n }\n if (dispose === void 0) {\n if (!Symbol.dispose) throw new TypeError(\"Symbol.dispose is not defined.\");\n dispose = value[Symbol.dispose];\n if (async) inner = dispose;\n }\n if (typeof dispose !== \"function\") throw new TypeError(\"Object not disposable.\");\n if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };\n env.stack.push({ value: value, dispose: dispose, async: async });\n }\n else if (async) {\n env.stack.push({ async: true });\n }\n return value;\n}\n\nvar _SuppressedError = typeof SuppressedError === \"function\" ? SuppressedError : function (error, suppressed, message) {\n var e = new Error(message);\n return e.name = \"SuppressedError\", e.error = error, e.suppressed = suppressed, e;\n};\n\nexport function __disposeResources(env) {\n function fail(e) {\n env.error = env.hasError ? new _SuppressedError(e, env.error, \"An error was suppressed during disposal.\") : e;\n env.hasError = true;\n }\n var r, s = 0;\n function next() {\n while (r = env.stack.pop()) {\n try {\n if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);\n if (r.dispose) {\n var result = r.dispose.call(r.value);\n if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });\n }\n else s |= 1;\n }\n catch (e) {\n fail(e);\n }\n }\n if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();\n if (env.hasError) throw env.error;\n }\n return next();\n}\n\nexport default {\n __extends,\n __assign,\n __rest,\n __decorate,\n __param,\n __metadata,\n __awaiter,\n __generator,\n __createBinding,\n __exportStar,\n __values,\n __read,\n __spread,\n __spreadArrays,\n __spreadArray,\n __await,\n __asyncGenerator,\n __asyncDelegator,\n __asyncValues,\n __makeTemplateObject,\n __importStar,\n __importDefault,\n __classPrivateFieldGet,\n __classPrivateFieldSet,\n __classPrivateFieldIn,\n __addDisposableResource,\n __disposeResources,\n};\n", "/**\n * Returns true if the object is a function.\n * @param value The value to check\n */\nexport function isFunction(value: any): value is (...args: any[]) => any {\n return typeof value === 'function';\n}\n", "/**\n * Used to create Error subclasses until the community moves away from ES5.\n *\n * This is because compiling from TypeScript down to ES5 has issues with subclassing Errors\n * as well as other built-in types: https://github.com/Microsoft/TypeScript/issues/12123\n *\n * @param createImpl A factory function to create the actual constructor implementation. The returned\n * function should be a named function that calls `_super` internally.\n */\nexport function createErrorClass(createImpl: (_super: any) => any): T {\n const _super = (instance: any) => {\n Error.call(instance);\n instance.stack = new Error().stack;\n };\n\n const ctorFunc = createImpl(_super);\n ctorFunc.prototype = Object.create(Error.prototype);\n ctorFunc.prototype.constructor = ctorFunc;\n return ctorFunc;\n}\n", "import { createErrorClass } from './createErrorClass';\n\nexport interface UnsubscriptionError extends Error {\n readonly errors: any[];\n}\n\nexport interface UnsubscriptionErrorCtor {\n /**\n * @deprecated Internal implementation detail. Do not construct error instances.\n * Cannot be tagged as internal: https://github.com/ReactiveX/rxjs/issues/6269\n */\n new (errors: any[]): UnsubscriptionError;\n}\n\n/**\n * An error thrown when one or more errors have occurred during the\n * `unsubscribe` of a {@link Subscription}.\n */\nexport const UnsubscriptionError: UnsubscriptionErrorCtor = createErrorClass(\n (_super) =>\n function UnsubscriptionErrorImpl(this: any, errors: (Error | string)[]) {\n _super(this);\n this.message = errors\n ? `${errors.length} errors occurred during unsubscription:\n${errors.map((err, i) => `${i + 1}) ${err.toString()}`).join('\\n ')}`\n : '';\n this.name = 'UnsubscriptionError';\n this.errors = errors;\n }\n);\n", "/**\n * Removes an item from an array, mutating it.\n * @param arr The array to remove the item from\n * @param item The item to remove\n */\nexport function arrRemove(arr: T[] | undefined | null, item: T) {\n if (arr) {\n const index = arr.indexOf(item);\n 0 <= index && arr.splice(index, 1);\n }\n}\n", "import { isFunction } from './util/isFunction';\nimport { UnsubscriptionError } from './util/UnsubscriptionError';\nimport { SubscriptionLike, TeardownLogic, Unsubscribable } from './types';\nimport { arrRemove } from './util/arrRemove';\n\n/**\n * Represents a disposable resource, such as the execution of an Observable. A\n * Subscription has one important method, `unsubscribe`, that takes no argument\n * and just disposes the resource held by the subscription.\n *\n * Additionally, subscriptions may be grouped together through the `add()`\n * method, which will attach a child Subscription to the current Subscription.\n * When a Subscription is unsubscribed, all its children (and its grandchildren)\n * will be unsubscribed as well.\n *\n * @class Subscription\n */\nexport class Subscription implements SubscriptionLike {\n /** @nocollapse */\n public static EMPTY = (() => {\n const empty = new Subscription();\n empty.closed = true;\n return empty;\n })();\n\n /**\n * A flag to indicate whether this Subscription has already been unsubscribed.\n */\n public closed = false;\n\n private _parentage: Subscription[] | Subscription | null = null;\n\n /**\n * The list of registered finalizers to execute upon unsubscription. Adding and removing from this\n * list occurs in the {@link #add} and {@link #remove} methods.\n */\n private _finalizers: Exclude[] | null = null;\n\n /**\n * @param initialTeardown A function executed first as part of the finalization\n * process that is kicked off when {@link #unsubscribe} is called.\n */\n constructor(private initialTeardown?: () => void) {}\n\n /**\n * Disposes the resources held by the subscription. May, for instance, cancel\n * an ongoing Observable execution or cancel any other type of work that\n * started when the Subscription was created.\n * @return {void}\n */\n unsubscribe(): void {\n let errors: any[] | undefined;\n\n if (!this.closed) {\n this.closed = true;\n\n // Remove this from it's parents.\n const { _parentage } = this;\n if (_parentage) {\n this._parentage = null;\n if (Array.isArray(_parentage)) {\n for (const parent of _parentage) {\n parent.remove(this);\n }\n } else {\n _parentage.remove(this);\n }\n }\n\n const { initialTeardown: initialFinalizer } = this;\n if (isFunction(initialFinalizer)) {\n try {\n initialFinalizer();\n } catch (e) {\n errors = e instanceof UnsubscriptionError ? e.errors : [e];\n }\n }\n\n const { _finalizers } = this;\n if (_finalizers) {\n this._finalizers = null;\n for (const finalizer of _finalizers) {\n try {\n execFinalizer(finalizer);\n } catch (err) {\n errors = errors ?? [];\n if (err instanceof UnsubscriptionError) {\n errors = [...errors, ...err.errors];\n } else {\n errors.push(err);\n }\n }\n }\n }\n\n if (errors) {\n throw new UnsubscriptionError(errors);\n }\n }\n }\n\n /**\n * Adds a finalizer to this subscription, so that finalization will be unsubscribed/called\n * when this subscription is unsubscribed. If this subscription is already {@link #closed},\n * because it has already been unsubscribed, then whatever finalizer is passed to it\n * will automatically be executed (unless the finalizer itself is also a closed subscription).\n *\n * Closed Subscriptions cannot be added as finalizers to any subscription. Adding a closed\n * subscription to a any subscription will result in no operation. (A noop).\n *\n * Adding a subscription to itself, or adding `null` or `undefined` will not perform any\n * operation at all. (A noop).\n *\n * `Subscription` instances that are added to this instance will automatically remove themselves\n * if they are unsubscribed. Functions and {@link Unsubscribable} objects that you wish to remove\n * will need to be removed manually with {@link #remove}\n *\n * @param teardown The finalization logic to add to this subscription.\n */\n add(teardown: TeardownLogic): void {\n // Only add the finalizer if it's not undefined\n // and don't add a subscription to itself.\n if (teardown && teardown !== this) {\n if (this.closed) {\n // If this subscription is already closed,\n // execute whatever finalizer is handed to it automatically.\n execFinalizer(teardown);\n } else {\n if (teardown instanceof Subscription) {\n // We don't add closed subscriptions, and we don't add the same subscription\n // twice. Subscription unsubscribe is idempotent.\n if (teardown.closed || teardown._hasParent(this)) {\n return;\n }\n teardown._addParent(this);\n }\n (this._finalizers = this._finalizers ?? []).push(teardown);\n }\n }\n }\n\n /**\n * Checks to see if a this subscription already has a particular parent.\n * This will signal that this subscription has already been added to the parent in question.\n * @param parent the parent to check for\n */\n private _hasParent(parent: Subscription) {\n const { _parentage } = this;\n return _parentage === parent || (Array.isArray(_parentage) && _parentage.includes(parent));\n }\n\n /**\n * Adds a parent to this subscription so it can be removed from the parent if it\n * unsubscribes on it's own.\n *\n * NOTE: THIS ASSUMES THAT {@link _hasParent} HAS ALREADY BEEN CHECKED.\n * @param parent The parent subscription to add\n */\n private _addParent(parent: Subscription) {\n const { _parentage } = this;\n this._parentage = Array.isArray(_parentage) ? (_parentage.push(parent), _parentage) : _parentage ? [_parentage, parent] : parent;\n }\n\n /**\n * Called on a child when it is removed via {@link #remove}.\n * @param parent The parent to remove\n */\n private _removeParent(parent: Subscription) {\n const { _parentage } = this;\n if (_parentage === parent) {\n this._parentage = null;\n } else if (Array.isArray(_parentage)) {\n arrRemove(_parentage, parent);\n }\n }\n\n /**\n * Removes a finalizer from this subscription that was previously added with the {@link #add} method.\n *\n * Note that `Subscription` instances, when unsubscribed, will automatically remove themselves\n * from every other `Subscription` they have been added to. This means that using the `remove` method\n * is not a common thing and should be used thoughtfully.\n *\n * If you add the same finalizer instance of a function or an unsubscribable object to a `Subscription` instance\n * more than once, you will need to call `remove` the same number of times to remove all instances.\n *\n * All finalizer instances are removed to free up memory upon unsubscription.\n *\n * @param teardown The finalizer to remove from this subscription\n */\n remove(teardown: Exclude): void {\n const { _finalizers } = this;\n _finalizers && arrRemove(_finalizers, teardown);\n\n if (teardown instanceof Subscription) {\n teardown._removeParent(this);\n }\n }\n}\n\nexport const EMPTY_SUBSCRIPTION = Subscription.EMPTY;\n\nexport function isSubscription(value: any): value is Subscription {\n return (\n value instanceof Subscription ||\n (value && 'closed' in value && isFunction(value.remove) && isFunction(value.add) && isFunction(value.unsubscribe))\n );\n}\n\nfunction execFinalizer(finalizer: Unsubscribable | (() => void)) {\n if (isFunction(finalizer)) {\n finalizer();\n } else {\n finalizer.unsubscribe();\n }\n}\n", "import { Subscriber } from './Subscriber';\nimport { ObservableNotification } from './types';\n\n/**\n * The {@link GlobalConfig} object for RxJS. It is used to configure things\n * like how to react on unhandled errors.\n */\nexport const config: GlobalConfig = {\n onUnhandledError: null,\n onStoppedNotification: null,\n Promise: undefined,\n useDeprecatedSynchronousErrorHandling: false,\n useDeprecatedNextContext: false,\n};\n\n/**\n * The global configuration object for RxJS, used to configure things\n * like how to react on unhandled errors. Accessible via {@link config}\n * object.\n */\nexport interface GlobalConfig {\n /**\n * A registration point for unhandled errors from RxJS. These are errors that\n * cannot were not handled by consuming code in the usual subscription path. For\n * example, if you have this configured, and you subscribe to an observable without\n * providing an error handler, errors from that subscription will end up here. This\n * will _always_ be called asynchronously on another job in the runtime. This is because\n * we do not want errors thrown in this user-configured handler to interfere with the\n * behavior of the library.\n */\n onUnhandledError: ((err: any) => void) | null;\n\n /**\n * A registration point for notifications that cannot be sent to subscribers because they\n * have completed, errored or have been explicitly unsubscribed. By default, next, complete\n * and error notifications sent to stopped subscribers are noops. However, sometimes callers\n * might want a different behavior. For example, with sources that attempt to report errors\n * to stopped subscribers, a caller can configure RxJS to throw an unhandled error instead.\n * This will _always_ be called asynchronously on another job in the runtime. This is because\n * we do not want errors thrown in this user-configured handler to interfere with the\n * behavior of the library.\n */\n onStoppedNotification: ((notification: ObservableNotification, subscriber: Subscriber) => void) | null;\n\n /**\n * The promise constructor used by default for {@link Observable#toPromise toPromise} and {@link Observable#forEach forEach}\n * methods.\n *\n * @deprecated As of version 8, RxJS will no longer support this sort of injection of a\n * Promise constructor. If you need a Promise implementation other than native promises,\n * please polyfill/patch Promise as you see appropriate. Will be removed in v8.\n */\n Promise?: PromiseConstructorLike;\n\n /**\n * If true, turns on synchronous error rethrowing, which is a deprecated behavior\n * in v6 and higher. This behavior enables bad patterns like wrapping a subscribe\n * call in a try/catch block. It also enables producer interference, a nasty bug\n * where a multicast can be broken for all observers by a downstream consumer with\n * an unhandled error. DO NOT USE THIS FLAG UNLESS IT'S NEEDED TO BUY TIME\n * FOR MIGRATION REASONS.\n *\n * @deprecated As of version 8, RxJS will no longer support synchronous throwing\n * of unhandled errors. All errors will be thrown on a separate call stack to prevent bad\n * behaviors described above. Will be removed in v8.\n */\n useDeprecatedSynchronousErrorHandling: boolean;\n\n /**\n * If true, enables an as-of-yet undocumented feature from v5: The ability to access\n * `unsubscribe()` via `this` context in `next` functions created in observers passed\n * to `subscribe`.\n *\n * This is being removed because the performance was severely problematic, and it could also cause\n * issues when types other than POJOs are passed to subscribe as subscribers, as they will likely have\n * their `this` context overwritten.\n *\n * @deprecated As of version 8, RxJS will no longer support altering the\n * context of next functions provided as part of an observer to Subscribe. Instead,\n * you will have access to a subscription or a signal or token that will allow you to do things like\n * unsubscribe and test closed status. Will be removed in v8.\n */\n useDeprecatedNextContext: boolean;\n}\n", "import type { TimerHandle } from './timerHandle';\ntype SetTimeoutFunction = (handler: () => void, timeout?: number, ...args: any[]) => TimerHandle;\ntype ClearTimeoutFunction = (handle: TimerHandle) => void;\n\ninterface TimeoutProvider {\n setTimeout: SetTimeoutFunction;\n clearTimeout: ClearTimeoutFunction;\n delegate:\n | {\n setTimeout: SetTimeoutFunction;\n clearTimeout: ClearTimeoutFunction;\n }\n | undefined;\n}\n\nexport const timeoutProvider: TimeoutProvider = {\n // When accessing the delegate, use the variable rather than `this` so that\n // the functions can be called without being bound to the provider.\n setTimeout(handler: () => void, timeout?: number, ...args) {\n const { delegate } = timeoutProvider;\n if (delegate?.setTimeout) {\n return delegate.setTimeout(handler, timeout, ...args);\n }\n return setTimeout(handler, timeout, ...args);\n },\n clearTimeout(handle) {\n const { delegate } = timeoutProvider;\n return (delegate?.clearTimeout || clearTimeout)(handle as any);\n },\n delegate: undefined,\n};\n", "import { config } from '../config';\nimport { timeoutProvider } from '../scheduler/timeoutProvider';\n\n/**\n * Handles an error on another job either with the user-configured {@link onUnhandledError},\n * or by throwing it on that new job so it can be picked up by `window.onerror`, `process.on('error')`, etc.\n *\n * This should be called whenever there is an error that is out-of-band with the subscription\n * or when an error hits a terminal boundary of the subscription and no error handler was provided.\n *\n * @param err the error to report\n */\nexport function reportUnhandledError(err: any) {\n timeoutProvider.setTimeout(() => {\n const { onUnhandledError } = config;\n if (onUnhandledError) {\n // Execute the user-configured error handler.\n onUnhandledError(err);\n } else {\n // Throw so it is picked up by the runtime's uncaught error mechanism.\n throw err;\n }\n });\n}\n", "/* tslint:disable:no-empty */\nexport function noop() { }\n", "import { CompleteNotification, NextNotification, ErrorNotification } from './types';\n\n/**\n * A completion object optimized for memory use and created to be the\n * same \"shape\" as other notifications in v8.\n * @internal\n */\nexport const COMPLETE_NOTIFICATION = (() => createNotification('C', undefined, undefined) as CompleteNotification)();\n\n/**\n * Internal use only. Creates an optimized error notification that is the same \"shape\"\n * as other notifications.\n * @internal\n */\nexport function errorNotification(error: any): ErrorNotification {\n return createNotification('E', undefined, error) as any;\n}\n\n/**\n * Internal use only. Creates an optimized next notification that is the same \"shape\"\n * as other notifications.\n * @internal\n */\nexport function nextNotification(value: T) {\n return createNotification('N', value, undefined) as NextNotification;\n}\n\n/**\n * Ensures that all notifications created internally have the same \"shape\" in v8.\n *\n * TODO: This is only exported to support a crazy legacy test in `groupBy`.\n * @internal\n */\nexport function createNotification(kind: 'N' | 'E' | 'C', value: any, error: any) {\n return {\n kind,\n value,\n error,\n };\n}\n", "import { config } from '../config';\n\nlet context: { errorThrown: boolean; error: any } | null = null;\n\n/**\n * Handles dealing with errors for super-gross mode. Creates a context, in which\n * any synchronously thrown errors will be passed to {@link captureError}. Which\n * will record the error such that it will be rethrown after the call back is complete.\n * TODO: Remove in v8\n * @param cb An immediately executed function.\n */\nexport function errorContext(cb: () => void) {\n if (config.useDeprecatedSynchronousErrorHandling) {\n const isRoot = !context;\n if (isRoot) {\n context = { errorThrown: false, error: null };\n }\n cb();\n if (isRoot) {\n const { errorThrown, error } = context!;\n context = null;\n if (errorThrown) {\n throw error;\n }\n }\n } else {\n // This is the general non-deprecated path for everyone that\n // isn't crazy enough to use super-gross mode (useDeprecatedSynchronousErrorHandling)\n cb();\n }\n}\n\n/**\n * Captures errors only in super-gross mode.\n * @param err the error to capture\n */\nexport function captureError(err: any) {\n if (config.useDeprecatedSynchronousErrorHandling && context) {\n context.errorThrown = true;\n context.error = err;\n }\n}\n", "import { isFunction } from './util/isFunction';\nimport { Observer, ObservableNotification } from './types';\nimport { isSubscription, Subscription } from './Subscription';\nimport { config } from './config';\nimport { reportUnhandledError } from './util/reportUnhandledError';\nimport { noop } from './util/noop';\nimport { nextNotification, errorNotification, COMPLETE_NOTIFICATION } from './NotificationFactories';\nimport { timeoutProvider } from './scheduler/timeoutProvider';\nimport { captureError } from './util/errorContext';\n\n/**\n * Implements the {@link Observer} interface and extends the\n * {@link Subscription} class. While the {@link Observer} is the public API for\n * consuming the values of an {@link Observable}, all Observers get converted to\n * a Subscriber, in order to provide Subscription-like capabilities such as\n * `unsubscribe`. Subscriber is a common type in RxJS, and crucial for\n * implementing operators, but it is rarely used as a public API.\n *\n * @class Subscriber\n */\nexport class Subscriber extends Subscription implements Observer {\n /**\n * A static factory for a Subscriber, given a (potentially partial) definition\n * of an Observer.\n * @param next The `next` callback of an Observer.\n * @param error The `error` callback of an\n * Observer.\n * @param complete The `complete` callback of an\n * Observer.\n * @return A Subscriber wrapping the (partially defined)\n * Observer represented by the given arguments.\n * @nocollapse\n * @deprecated Do not use. Will be removed in v8. There is no replacement for this\n * method, and there is no reason to be creating instances of `Subscriber` directly.\n * If you have a specific use case, please file an issue.\n */\n static create(next?: (x?: T) => void, error?: (e?: any) => void, complete?: () => void): Subscriber {\n return new SafeSubscriber(next, error, complete);\n }\n\n /** @deprecated Internal implementation detail, do not use directly. Will be made internal in v8. */\n protected isStopped: boolean = false;\n /** @deprecated Internal implementation detail, do not use directly. Will be made internal in v8. */\n protected destination: Subscriber | Observer; // this `any` is the escape hatch to erase extra type param (e.g. R)\n\n /**\n * @deprecated Internal implementation detail, do not use directly. Will be made internal in v8.\n * There is no reason to directly create an instance of Subscriber. This type is exported for typings reasons.\n */\n constructor(destination?: Subscriber | Observer) {\n super();\n if (destination) {\n this.destination = destination;\n // Automatically chain subscriptions together here.\n // if destination is a Subscription, then it is a Subscriber.\n if (isSubscription(destination)) {\n destination.add(this);\n }\n } else {\n this.destination = EMPTY_OBSERVER;\n }\n }\n\n /**\n * The {@link Observer} callback to receive notifications of type `next` from\n * the Observable, with a value. The Observable may call this method 0 or more\n * times.\n * @param {T} [value] The `next` value.\n * @return {void}\n */\n next(value?: T): void {\n if (this.isStopped) {\n handleStoppedNotification(nextNotification(value), this);\n } else {\n this._next(value!);\n }\n }\n\n /**\n * The {@link Observer} callback to receive notifications of type `error` from\n * the Observable, with an attached `Error`. Notifies the Observer that\n * the Observable has experienced an error condition.\n * @param {any} [err] The `error` exception.\n * @return {void}\n */\n error(err?: any): void {\n if (this.isStopped) {\n handleStoppedNotification(errorNotification(err), this);\n } else {\n this.isStopped = true;\n this._error(err);\n }\n }\n\n /**\n * The {@link Observer} callback to receive a valueless notification of type\n * `complete` from the Observable. Notifies the Observer that the Observable\n * has finished sending push-based notifications.\n * @return {void}\n */\n complete(): void {\n if (this.isStopped) {\n handleStoppedNotification(COMPLETE_NOTIFICATION, this);\n } else {\n this.isStopped = true;\n this._complete();\n }\n }\n\n unsubscribe(): void {\n if (!this.closed) {\n this.isStopped = true;\n super.unsubscribe();\n this.destination = null!;\n }\n }\n\n protected _next(value: T): void {\n this.destination.next(value);\n }\n\n protected _error(err: any): void {\n try {\n this.destination.error(err);\n } finally {\n this.unsubscribe();\n }\n }\n\n protected _complete(): void {\n try {\n this.destination.complete();\n } finally {\n this.unsubscribe();\n }\n }\n}\n\n/**\n * This bind is captured here because we want to be able to have\n * compatibility with monoid libraries that tend to use a method named\n * `bind`. In particular, a library called Monio requires this.\n */\nconst _bind = Function.prototype.bind;\n\nfunction bind any>(fn: Fn, thisArg: any): Fn {\n return _bind.call(fn, thisArg);\n}\n\n/**\n * Internal optimization only, DO NOT EXPOSE.\n * @internal\n */\nclass ConsumerObserver implements Observer {\n constructor(private partialObserver: Partial>) {}\n\n next(value: T): void {\n const { partialObserver } = this;\n if (partialObserver.next) {\n try {\n partialObserver.next(value);\n } catch (error) {\n handleUnhandledError(error);\n }\n }\n }\n\n error(err: any): void {\n const { partialObserver } = this;\n if (partialObserver.error) {\n try {\n partialObserver.error(err);\n } catch (error) {\n handleUnhandledError(error);\n }\n } else {\n handleUnhandledError(err);\n }\n }\n\n complete(): void {\n const { partialObserver } = this;\n if (partialObserver.complete) {\n try {\n partialObserver.complete();\n } catch (error) {\n handleUnhandledError(error);\n }\n }\n }\n}\n\nexport class SafeSubscriber extends Subscriber {\n constructor(\n observerOrNext?: Partial> | ((value: T) => void) | null,\n error?: ((e?: any) => void) | null,\n complete?: (() => void) | null\n ) {\n super();\n\n let partialObserver: Partial>;\n if (isFunction(observerOrNext) || !observerOrNext) {\n // The first argument is a function, not an observer. The next\n // two arguments *could* be observers, or they could be empty.\n partialObserver = {\n next: (observerOrNext ?? undefined) as (((value: T) => void) | undefined),\n error: error ?? undefined,\n complete: complete ?? undefined,\n };\n } else {\n // The first argument is a partial observer.\n let context: any;\n if (this && config.useDeprecatedNextContext) {\n // This is a deprecated path that made `this.unsubscribe()` available in\n // next handler functions passed to subscribe. This only exists behind a flag\n // now, as it is *very* slow.\n context = Object.create(observerOrNext);\n context.unsubscribe = () => this.unsubscribe();\n partialObserver = {\n next: observerOrNext.next && bind(observerOrNext.next, context),\n error: observerOrNext.error && bind(observerOrNext.error, context),\n complete: observerOrNext.complete && bind(observerOrNext.complete, context),\n };\n } else {\n // The \"normal\" path. Just use the partial observer directly.\n partialObserver = observerOrNext;\n }\n }\n\n // Wrap the partial observer to ensure it's a full observer, and\n // make sure proper error handling is accounted for.\n this.destination = new ConsumerObserver(partialObserver);\n }\n}\n\nfunction handleUnhandledError(error: any) {\n if (config.useDeprecatedSynchronousErrorHandling) {\n captureError(error);\n } else {\n // Ideal path, we report this as an unhandled error,\n // which is thrown on a new call stack.\n reportUnhandledError(error);\n }\n}\n\n/**\n * An error handler used when no error handler was supplied\n * to the SafeSubscriber -- meaning no error handler was supplied\n * do the `subscribe` call on our observable.\n * @param err The error to handle\n */\nfunction defaultErrorHandler(err: any) {\n throw err;\n}\n\n/**\n * A handler for notifications that cannot be sent to a stopped subscriber.\n * @param notification The notification being sent\n * @param subscriber The stopped subscriber\n */\nfunction handleStoppedNotification(notification: ObservableNotification, subscriber: Subscriber) {\n const { onStoppedNotification } = config;\n onStoppedNotification && timeoutProvider.setTimeout(() => onStoppedNotification(notification, subscriber));\n}\n\n/**\n * The observer used as a stub for subscriptions where the user did not\n * pass any arguments to `subscribe`. Comes with the default error handling\n * behavior.\n */\nexport const EMPTY_OBSERVER: Readonly> & { closed: true } = {\n closed: true,\n next: noop,\n error: defaultErrorHandler,\n complete: noop,\n};\n", "/**\n * Symbol.observable or a string \"@@observable\". Used for interop\n *\n * @deprecated We will no longer be exporting this symbol in upcoming versions of RxJS.\n * Instead polyfill and use Symbol.observable directly *or* use https://www.npmjs.com/package/symbol-observable\n */\nexport const observable: string | symbol = (() => (typeof Symbol === 'function' && Symbol.observable) || '@@observable')();\n", "/**\n * This function takes one parameter and just returns it. Simply put,\n * this is like `(x: T): T => x`.\n *\n * ## Examples\n *\n * This is useful in some cases when using things like `mergeMap`\n *\n * ```ts\n * import { interval, take, map, range, mergeMap, identity } from 'rxjs';\n *\n * const source$ = interval(1000).pipe(take(5));\n *\n * const result$ = source$.pipe(\n * map(i => range(i)),\n * mergeMap(identity) // same as mergeMap(x => x)\n * );\n *\n * result$.subscribe({\n * next: console.log\n * });\n * ```\n *\n * Or when you want to selectively apply an operator\n *\n * ```ts\n * import { interval, take, identity } from 'rxjs';\n *\n * const shouldLimit = () => Math.random() < 0.5;\n *\n * const source$ = interval(1000);\n *\n * const result$ = source$.pipe(shouldLimit() ? take(5) : identity);\n *\n * result$.subscribe({\n * next: console.log\n * });\n * ```\n *\n * @param x Any value that is returned by this function\n * @returns The value passed as the first parameter to this function\n */\nexport function identity(x: T): T {\n return x;\n}\n", "import { identity } from './identity';\nimport { UnaryFunction } from '../types';\n\nexport function pipe(): typeof identity;\nexport function pipe(fn1: UnaryFunction): UnaryFunction;\nexport function pipe(fn1: UnaryFunction, fn2: UnaryFunction): UnaryFunction;\nexport function pipe(fn1: UnaryFunction, fn2: UnaryFunction, fn3: UnaryFunction): UnaryFunction;\nexport function pipe(\n fn1: UnaryFunction,\n fn2: UnaryFunction,\n fn3: UnaryFunction,\n fn4: UnaryFunction\n): UnaryFunction;\nexport function pipe(\n fn1: UnaryFunction,\n fn2: UnaryFunction,\n fn3: UnaryFunction,\n fn4: UnaryFunction,\n fn5: UnaryFunction\n): UnaryFunction;\nexport function pipe(\n fn1: UnaryFunction,\n fn2: UnaryFunction,\n fn3: UnaryFunction,\n fn4: UnaryFunction,\n fn5: UnaryFunction,\n fn6: UnaryFunction\n): UnaryFunction;\nexport function pipe(\n fn1: UnaryFunction,\n fn2: UnaryFunction,\n fn3: UnaryFunction,\n fn4: UnaryFunction,\n fn5: UnaryFunction,\n fn6: UnaryFunction,\n fn7: UnaryFunction\n): UnaryFunction;\nexport function pipe(\n fn1: UnaryFunction,\n fn2: UnaryFunction,\n fn3: UnaryFunction,\n fn4: UnaryFunction,\n fn5: UnaryFunction,\n fn6: UnaryFunction,\n fn7: UnaryFunction,\n fn8: UnaryFunction\n): UnaryFunction;\nexport function pipe(\n fn1: UnaryFunction,\n fn2: UnaryFunction,\n fn3: UnaryFunction,\n fn4: UnaryFunction,\n fn5: UnaryFunction,\n fn6: UnaryFunction,\n fn7: UnaryFunction,\n fn8: UnaryFunction,\n fn9: UnaryFunction\n): UnaryFunction;\nexport function pipe(\n fn1: UnaryFunction,\n fn2: UnaryFunction,\n fn3: UnaryFunction,\n fn4: UnaryFunction,\n fn5: UnaryFunction,\n fn6: UnaryFunction,\n fn7: UnaryFunction,\n fn8: UnaryFunction,\n fn9: UnaryFunction,\n ...fns: UnaryFunction[]\n): UnaryFunction;\n\n/**\n * pipe() can be called on one or more functions, each of which can take one argument (\"UnaryFunction\")\n * and uses it to return a value.\n * It returns a function that takes one argument, passes it to the first UnaryFunction, and then\n * passes the result to the next one, passes that result to the next one, and so on. \n */\nexport function pipe(...fns: Array>): UnaryFunction {\n return pipeFromArray(fns);\n}\n\n/** @internal */\nexport function pipeFromArray(fns: Array>): UnaryFunction {\n if (fns.length === 0) {\n return identity as UnaryFunction;\n }\n\n if (fns.length === 1) {\n return fns[0];\n }\n\n return function piped(input: T): R {\n return fns.reduce((prev: any, fn: UnaryFunction) => fn(prev), input as any);\n };\n}\n", "import { Operator } from './Operator';\nimport { SafeSubscriber, Subscriber } from './Subscriber';\nimport { isSubscription, Subscription } from './Subscription';\nimport { TeardownLogic, OperatorFunction, Subscribable, Observer } from './types';\nimport { observable as Symbol_observable } from './symbol/observable';\nimport { pipeFromArray } from './util/pipe';\nimport { config } from './config';\nimport { isFunction } from './util/isFunction';\nimport { errorContext } from './util/errorContext';\n\n/**\n * A representation of any set of values over any amount of time. This is the most basic building block\n * of RxJS.\n *\n * @class Observable\n */\nexport class Observable implements Subscribable {\n /**\n * @deprecated Internal implementation detail, do not use directly. Will be made internal in v8.\n */\n source: Observable | undefined;\n\n /**\n * @deprecated Internal implementation detail, do not use directly. Will be made internal in v8.\n */\n operator: Operator | undefined;\n\n /**\n * @constructor\n * @param {Function} subscribe the function that is called when the Observable is\n * initially subscribed to. This function is given a Subscriber, to which new values\n * can be `next`ed, or an `error` method can be called to raise an error, or\n * `complete` can be called to notify of a successful completion.\n */\n constructor(subscribe?: (this: Observable, subscriber: Subscriber) => TeardownLogic) {\n if (subscribe) {\n this._subscribe = subscribe;\n }\n }\n\n // HACK: Since TypeScript inherits static properties too, we have to\n // fight against TypeScript here so Subject can have a different static create signature\n /**\n * Creates a new Observable by calling the Observable constructor\n * @owner Observable\n * @method create\n * @param {Function} subscribe? the subscriber function to be passed to the Observable constructor\n * @return {Observable} a new observable\n * @nocollapse\n * @deprecated Use `new Observable()` instead. Will be removed in v8.\n */\n static create: (...args: any[]) => any = (subscribe?: (subscriber: Subscriber) => TeardownLogic) => {\n return new Observable(subscribe);\n };\n\n /**\n * Creates a new Observable, with this Observable instance as the source, and the passed\n * operator defined as the new observable's operator.\n * @method lift\n * @param operator the operator defining the operation to take on the observable\n * @return a new observable with the Operator applied\n * @deprecated Internal implementation detail, do not use directly. Will be made internal in v8.\n * If you have implemented an operator using `lift`, it is recommended that you create an\n * operator by simply returning `new Observable()` directly. See \"Creating new operators from\n * scratch\" section here: https://rxjs.dev/guide/operators\n */\n lift(operator?: Operator): Observable {\n const observable = new Observable();\n observable.source = this;\n observable.operator = operator;\n return observable;\n }\n\n subscribe(observerOrNext?: Partial> | ((value: T) => void)): Subscription;\n /** @deprecated Instead of passing separate callback arguments, use an observer argument. Signatures taking separate callback arguments will be removed in v8. Details: https://rxjs.dev/deprecations/subscribe-arguments */\n subscribe(next?: ((value: T) => void) | null, error?: ((error: any) => void) | null, complete?: (() => void) | null): Subscription;\n /**\n * Invokes an execution of an Observable and registers Observer handlers for notifications it will emit.\n *\n * Use it when you have all these Observables, but still nothing is happening.\n *\n * `subscribe` is not a regular operator, but a method that calls Observable's internal `subscribe` function. It\n * might be for example a function that you passed to Observable's constructor, but most of the time it is\n * a library implementation, which defines what will be emitted by an Observable, and when it be will emitted. This means\n * that calling `subscribe` is actually the moment when Observable starts its work, not when it is created, as it is often\n * the thought.\n *\n * Apart from starting the execution of an Observable, this method allows you to listen for values\n * that an Observable emits, as well as for when it completes or errors. You can achieve this in two\n * of the following ways.\n *\n * The first way is creating an object that implements {@link Observer} interface. It should have methods\n * defined by that interface, but note that it should be just a regular JavaScript object, which you can create\n * yourself in any way you want (ES6 class, classic function constructor, object literal etc.). In particular, do\n * not attempt to use any RxJS implementation details to create Observers - you don't need them. Remember also\n * that your object does not have to implement all methods. If you find yourself creating a method that doesn't\n * do anything, you can simply omit it. Note however, if the `error` method is not provided and an error happens,\n * it will be thrown asynchronously. Errors thrown asynchronously cannot be caught using `try`/`catch`. Instead,\n * use the {@link onUnhandledError} configuration option or use a runtime handler (like `window.onerror` or\n * `process.on('error)`) to be notified of unhandled errors. Because of this, it's recommended that you provide\n * an `error` method to avoid missing thrown errors.\n *\n * The second way is to give up on Observer object altogether and simply provide callback functions in place of its methods.\n * This means you can provide three functions as arguments to `subscribe`, where the first function is equivalent\n * of a `next` method, the second of an `error` method and the third of a `complete` method. Just as in case of an Observer,\n * if you do not need to listen for something, you can omit a function by passing `undefined` or `null`,\n * since `subscribe` recognizes these functions by where they were placed in function call. When it comes\n * to the `error` function, as with an Observer, if not provided, errors emitted by an Observable will be thrown asynchronously.\n *\n * You can, however, subscribe with no parameters at all. This may be the case where you're not interested in terminal events\n * and you also handled emissions internally by using operators (e.g. using `tap`).\n *\n * Whichever style of calling `subscribe` you use, in both cases it returns a Subscription object.\n * This object allows you to call `unsubscribe` on it, which in turn will stop the work that an Observable does and will clean\n * up all resources that an Observable used. Note that cancelling a subscription will not call `complete` callback\n * provided to `subscribe` function, which is reserved for a regular completion signal that comes from an Observable.\n *\n * Remember that callbacks provided to `subscribe` are not guaranteed to be called asynchronously.\n * It is an Observable itself that decides when these functions will be called. For example {@link of}\n * by default emits all its values synchronously. Always check documentation for how given Observable\n * will behave when subscribed and if its default behavior can be modified with a `scheduler`.\n *\n * #### Examples\n *\n * Subscribe with an {@link guide/observer Observer}\n *\n * ```ts\n * import { of } from 'rxjs';\n *\n * const sumObserver = {\n * sum: 0,\n * next(value) {\n * console.log('Adding: ' + value);\n * this.sum = this.sum + value;\n * },\n * error() {\n * // We actually could just remove this method,\n * // since we do not really care about errors right now.\n * },\n * complete() {\n * console.log('Sum equals: ' + this.sum);\n * }\n * };\n *\n * of(1, 2, 3) // Synchronously emits 1, 2, 3 and then completes.\n * .subscribe(sumObserver);\n *\n * // Logs:\n * // 'Adding: 1'\n * // 'Adding: 2'\n * // 'Adding: 3'\n * // 'Sum equals: 6'\n * ```\n *\n * Subscribe with functions ({@link deprecations/subscribe-arguments deprecated})\n *\n * ```ts\n * import { of } from 'rxjs'\n *\n * let sum = 0;\n *\n * of(1, 2, 3).subscribe(\n * value => {\n * console.log('Adding: ' + value);\n * sum = sum + value;\n * },\n * undefined,\n * () => console.log('Sum equals: ' + sum)\n * );\n *\n * // Logs:\n * // 'Adding: 1'\n * // 'Adding: 2'\n * // 'Adding: 3'\n * // 'Sum equals: 6'\n * ```\n *\n * Cancel a subscription\n *\n * ```ts\n * import { interval } from 'rxjs';\n *\n * const subscription = interval(1000).subscribe({\n * next(num) {\n * console.log(num)\n * },\n * complete() {\n * // Will not be called, even when cancelling subscription.\n * console.log('completed!');\n * }\n * });\n *\n * setTimeout(() => {\n * subscription.unsubscribe();\n * console.log('unsubscribed!');\n * }, 2500);\n *\n * // Logs:\n * // 0 after 1s\n * // 1 after 2s\n * // 'unsubscribed!' after 2.5s\n * ```\n *\n * @param {Observer|Function} observerOrNext (optional) Either an observer with methods to be called,\n * or the first of three possible handlers, which is the handler for each value emitted from the subscribed\n * Observable.\n * @param {Function} error (optional) A handler for a terminal event resulting from an error. If no error handler is provided,\n * the error will be thrown asynchronously as unhandled.\n * @param {Function} complete (optional) A handler for a terminal event resulting from successful completion.\n * @return {Subscription} a subscription reference to the registered handlers\n * @method subscribe\n */\n subscribe(\n observerOrNext?: Partial> | ((value: T) => void) | null,\n error?: ((error: any) => void) | null,\n complete?: (() => void) | null\n ): Subscription {\n const subscriber = isSubscriber(observerOrNext) ? observerOrNext : new SafeSubscriber(observerOrNext, error, complete);\n\n errorContext(() => {\n const { operator, source } = this;\n subscriber.add(\n operator\n ? // We're dealing with a subscription in the\n // operator chain to one of our lifted operators.\n operator.call(subscriber, source)\n : source\n ? // If `source` has a value, but `operator` does not, something that\n // had intimate knowledge of our API, like our `Subject`, must have\n // set it. We're going to just call `_subscribe` directly.\n this._subscribe(subscriber)\n : // In all other cases, we're likely wrapping a user-provided initializer\n // function, so we need to catch errors and handle them appropriately.\n this._trySubscribe(subscriber)\n );\n });\n\n return subscriber;\n }\n\n /** @internal */\n protected _trySubscribe(sink: Subscriber): TeardownLogic {\n try {\n return this._subscribe(sink);\n } catch (err) {\n // We don't need to return anything in this case,\n // because it's just going to try to `add()` to a subscription\n // above.\n sink.error(err);\n }\n }\n\n /**\n * Used as a NON-CANCELLABLE means of subscribing to an observable, for use with\n * APIs that expect promises, like `async/await`. You cannot unsubscribe from this.\n *\n * **WARNING**: Only use this with observables you *know* will complete. If the source\n * observable does not complete, you will end up with a promise that is hung up, and\n * potentially all of the state of an async function hanging out in memory. To avoid\n * this situation, look into adding something like {@link timeout}, {@link take},\n * {@link takeWhile}, or {@link takeUntil} amongst others.\n *\n * #### Example\n *\n * ```ts\n * import { interval, take } from 'rxjs';\n *\n * const source$ = interval(1000).pipe(take(4));\n *\n * async function getTotal() {\n * let total = 0;\n *\n * await source$.forEach(value => {\n * total += value;\n * console.log('observable -> ' + value);\n * });\n *\n * return total;\n * }\n *\n * getTotal().then(\n * total => console.log('Total: ' + total)\n * );\n *\n * // Expected:\n * // 'observable -> 0'\n * // 'observable -> 1'\n * // 'observable -> 2'\n * // 'observable -> 3'\n * // 'Total: 6'\n * ```\n *\n * @param next a handler for each value emitted by the observable\n * @return a promise that either resolves on observable completion or\n * rejects with the handled error\n */\n forEach(next: (value: T) => void): Promise;\n\n /**\n * @param next a handler for each value emitted by the observable\n * @param promiseCtor a constructor function used to instantiate the Promise\n * @return a promise that either resolves on observable completion or\n * rejects with the handled error\n * @deprecated Passing a Promise constructor will no longer be available\n * in upcoming versions of RxJS. This is because it adds weight to the library, for very\n * little benefit. If you need this functionality, it is recommended that you either\n * polyfill Promise, or you create an adapter to convert the returned native promise\n * to whatever promise implementation you wanted. Will be removed in v8.\n */\n forEach(next: (value: T) => void, promiseCtor: PromiseConstructorLike): Promise;\n\n forEach(next: (value: T) => void, promiseCtor?: PromiseConstructorLike): Promise {\n promiseCtor = getPromiseCtor(promiseCtor);\n\n return new promiseCtor((resolve, reject) => {\n const subscriber = new SafeSubscriber({\n next: (value) => {\n try {\n next(value);\n } catch (err) {\n reject(err);\n subscriber.unsubscribe();\n }\n },\n error: reject,\n complete: resolve,\n });\n this.subscribe(subscriber);\n }) as Promise;\n }\n\n /** @internal */\n protected _subscribe(subscriber: Subscriber): TeardownLogic {\n return this.source?.subscribe(subscriber);\n }\n\n /**\n * An interop point defined by the es7-observable spec https://github.com/zenparsing/es-observable\n * @method Symbol.observable\n * @return {Observable} this instance of the observable\n */\n [Symbol_observable]() {\n return this;\n }\n\n /* tslint:disable:max-line-length */\n pipe(): Observable;\n pipe(op1: OperatorFunction): Observable;\n pipe(op1: OperatorFunction, op2: OperatorFunction): Observable;\n pipe(op1: OperatorFunction, op2: OperatorFunction, op3: OperatorFunction): Observable;\n pipe(\n op1: OperatorFunction,\n op2: OperatorFunction,\n op3: OperatorFunction,\n op4: OperatorFunction\n ): Observable;\n pipe(\n op1: OperatorFunction,\n op2: OperatorFunction,\n op3: OperatorFunction,\n op4: OperatorFunction,\n op5: OperatorFunction\n ): Observable;\n pipe(\n op1: OperatorFunction,\n op2: OperatorFunction,\n op3: OperatorFunction,\n op4: OperatorFunction,\n op5: OperatorFunction,\n op6: OperatorFunction\n ): Observable;\n pipe(\n op1: OperatorFunction,\n op2: OperatorFunction,\n op3: OperatorFunction,\n op4: OperatorFunction,\n op5: OperatorFunction,\n op6: OperatorFunction,\n op7: OperatorFunction\n ): Observable;\n pipe(\n op1: OperatorFunction,\n op2: OperatorFunction,\n op3: OperatorFunction,\n op4: OperatorFunction,\n op5: OperatorFunction,\n op6: OperatorFunction,\n op7: OperatorFunction,\n op8: OperatorFunction\n ): Observable;\n pipe(\n op1: OperatorFunction,\n op2: OperatorFunction,\n op3: OperatorFunction,\n op4: OperatorFunction,\n op5: OperatorFunction,\n op6: OperatorFunction,\n op7: OperatorFunction,\n op8: OperatorFunction,\n op9: OperatorFunction\n ): Observable;\n pipe(\n op1: OperatorFunction,\n op2: OperatorFunction,\n op3: OperatorFunction,\n op4: OperatorFunction,\n op5: OperatorFunction,\n op6: OperatorFunction,\n op7: OperatorFunction,\n op8: OperatorFunction,\n op9: OperatorFunction,\n ...operations: OperatorFunction[]\n ): Observable;\n /* tslint:enable:max-line-length */\n\n /**\n * Used to stitch together functional operators into a chain.\n * @method pipe\n * @return {Observable} the Observable result of all of the operators having\n * been called in the order they were passed in.\n *\n * ## Example\n *\n * ```ts\n * import { interval, filter, map, scan } from 'rxjs';\n *\n * interval(1000)\n * .pipe(\n * filter(x => x % 2 === 0),\n * map(x => x + x),\n * scan((acc, x) => acc + x)\n * )\n * .subscribe(x => console.log(x));\n * ```\n */\n pipe(...operations: OperatorFunction[]): Observable {\n return pipeFromArray(operations)(this);\n }\n\n /* tslint:disable:max-line-length */\n /** @deprecated Replaced with {@link firstValueFrom} and {@link lastValueFrom}. Will be removed in v8. Details: https://rxjs.dev/deprecations/to-promise */\n toPromise(): Promise;\n /** @deprecated Replaced with {@link firstValueFrom} and {@link lastValueFrom}. Will be removed in v8. Details: https://rxjs.dev/deprecations/to-promise */\n toPromise(PromiseCtor: typeof Promise): Promise;\n /** @deprecated Replaced with {@link firstValueFrom} and {@link lastValueFrom}. Will be removed in v8. Details: https://rxjs.dev/deprecations/to-promise */\n toPromise(PromiseCtor: PromiseConstructorLike): Promise;\n /* tslint:enable:max-line-length */\n\n /**\n * Subscribe to this Observable and get a Promise resolving on\n * `complete` with the last emission (if any).\n *\n * **WARNING**: Only use this with observables you *know* will complete. If the source\n * observable does not complete, you will end up with a promise that is hung up, and\n * potentially all of the state of an async function hanging out in memory. To avoid\n * this situation, look into adding something like {@link timeout}, {@link take},\n * {@link takeWhile}, or {@link takeUntil} amongst others.\n *\n * @method toPromise\n * @param [promiseCtor] a constructor function used to instantiate\n * the Promise\n * @return A Promise that resolves with the last value emit, or\n * rejects on an error. If there were no emissions, Promise\n * resolves with undefined.\n * @deprecated Replaced with {@link firstValueFrom} and {@link lastValueFrom}. Will be removed in v8. Details: https://rxjs.dev/deprecations/to-promise\n */\n toPromise(promiseCtor?: PromiseConstructorLike): Promise {\n promiseCtor = getPromiseCtor(promiseCtor);\n\n return new promiseCtor((resolve, reject) => {\n let value: T | undefined;\n this.subscribe(\n (x: T) => (value = x),\n (err: any) => reject(err),\n () => resolve(value)\n );\n }) as Promise;\n }\n}\n\n/**\n * Decides between a passed promise constructor from consuming code,\n * A default configured promise constructor, and the native promise\n * constructor and returns it. If nothing can be found, it will throw\n * an error.\n * @param promiseCtor The optional promise constructor to passed by consuming code\n */\nfunction getPromiseCtor(promiseCtor: PromiseConstructorLike | undefined) {\n return promiseCtor ?? config.Promise ?? Promise;\n}\n\nfunction isObserver(value: any): value is Observer {\n return value && isFunction(value.next) && isFunction(value.error) && isFunction(value.complete);\n}\n\nfunction isSubscriber(value: any): value is Subscriber {\n return (value && value instanceof Subscriber) || (isObserver(value) && isSubscription(value));\n}\n", "import { Observable } from '../Observable';\nimport { Subscriber } from '../Subscriber';\nimport { OperatorFunction } from '../types';\nimport { isFunction } from './isFunction';\n\n/**\n * Used to determine if an object is an Observable with a lift function.\n */\nexport function hasLift(source: any): source is { lift: InstanceType['lift'] } {\n return isFunction(source?.lift);\n}\n\n/**\n * Creates an `OperatorFunction`. Used to define operators throughout the library in a concise way.\n * @param init The logic to connect the liftedSource to the subscriber at the moment of subscription.\n */\nexport function operate(\n init: (liftedSource: Observable, subscriber: Subscriber) => (() => void) | void\n): OperatorFunction {\n return (source: Observable) => {\n if (hasLift(source)) {\n return source.lift(function (this: Subscriber, liftedSource: Observable) {\n try {\n return init(liftedSource, this);\n } catch (err) {\n this.error(err);\n }\n });\n }\n throw new TypeError('Unable to lift unknown Observable type');\n };\n}\n", "import { Subscriber } from '../Subscriber';\n\n/**\n * Creates an instance of an `OperatorSubscriber`.\n * @param destination The downstream subscriber.\n * @param onNext Handles next values, only called if this subscriber is not stopped or closed. Any\n * error that occurs in this function is caught and sent to the `error` method of this subscriber.\n * @param onError Handles errors from the subscription, any errors that occur in this handler are caught\n * and send to the `destination` error handler.\n * @param onComplete Handles completion notification from the subscription. Any errors that occur in\n * this handler are sent to the `destination` error handler.\n * @param onFinalize Additional teardown logic here. This will only be called on teardown if the\n * subscriber itself is not already closed. This is called after all other teardown logic is executed.\n */\nexport function createOperatorSubscriber(\n destination: Subscriber,\n onNext?: (value: T) => void,\n onComplete?: () => void,\n onError?: (err: any) => void,\n onFinalize?: () => void\n): Subscriber {\n return new OperatorSubscriber(destination, onNext, onComplete, onError, onFinalize);\n}\n\n/**\n * A generic helper for allowing operators to be created with a Subscriber and\n * use closures to capture necessary state from the operator function itself.\n */\nexport class OperatorSubscriber extends Subscriber {\n /**\n * Creates an instance of an `OperatorSubscriber`.\n * @param destination The downstream subscriber.\n * @param onNext Handles next values, only called if this subscriber is not stopped or closed. Any\n * error that occurs in this function is caught and sent to the `error` method of this subscriber.\n * @param onError Handles errors from the subscription, any errors that occur in this handler are caught\n * and send to the `destination` error handler.\n * @param onComplete Handles completion notification from the subscription. Any errors that occur in\n * this handler are sent to the `destination` error handler.\n * @param onFinalize Additional finalization logic here. This will only be called on finalization if the\n * subscriber itself is not already closed. This is called after all other finalization logic is executed.\n * @param shouldUnsubscribe An optional check to see if an unsubscribe call should truly unsubscribe.\n * NOTE: This currently **ONLY** exists to support the strange behavior of {@link groupBy}, where unsubscription\n * to the resulting observable does not actually disconnect from the source if there are active subscriptions\n * to any grouped observable. (DO NOT EXPOSE OR USE EXTERNALLY!!!)\n */\n constructor(\n destination: Subscriber,\n onNext?: (value: T) => void,\n onComplete?: () => void,\n onError?: (err: any) => void,\n private onFinalize?: () => void,\n private shouldUnsubscribe?: () => boolean\n ) {\n // It's important - for performance reasons - that all of this class's\n // members are initialized and that they are always initialized in the same\n // order. This will ensure that all OperatorSubscriber instances have the\n // same hidden class in V8. This, in turn, will help keep the number of\n // hidden classes involved in property accesses within the base class as\n // low as possible. If the number of hidden classes involved exceeds four,\n // the property accesses will become megamorphic and performance penalties\n // will be incurred - i.e. inline caches won't be used.\n //\n // The reasons for ensuring all instances have the same hidden class are\n // further discussed in this blog post from Benedikt Meurer:\n // https://benediktmeurer.de/2018/03/23/impact-of-polymorphism-on-component-based-frameworks-like-react/\n super(destination);\n this._next = onNext\n ? function (this: OperatorSubscriber, value: T) {\n try {\n onNext(value);\n } catch (err) {\n destination.error(err);\n }\n }\n : super._next;\n this._error = onError\n ? function (this: OperatorSubscriber, err: any) {\n try {\n onError(err);\n } catch (err) {\n // Send any errors that occur down stream.\n destination.error(err);\n } finally {\n // Ensure finalization.\n this.unsubscribe();\n }\n }\n : super._error;\n this._complete = onComplete\n ? function (this: OperatorSubscriber) {\n try {\n onComplete();\n } catch (err) {\n // Send any errors that occur down stream.\n destination.error(err);\n } finally {\n // Ensure finalization.\n this.unsubscribe();\n }\n }\n : super._complete;\n }\n\n unsubscribe() {\n if (!this.shouldUnsubscribe || this.shouldUnsubscribe()) {\n const { closed } = this;\n super.unsubscribe();\n // Execute additional teardown if we have any and we didn't already do so.\n !closed && this.onFinalize?.();\n }\n }\n}\n", "import { Subscription } from '../Subscription';\n\ninterface AnimationFrameProvider {\n schedule(callback: FrameRequestCallback): Subscription;\n requestAnimationFrame: typeof requestAnimationFrame;\n cancelAnimationFrame: typeof cancelAnimationFrame;\n delegate:\n | {\n requestAnimationFrame: typeof requestAnimationFrame;\n cancelAnimationFrame: typeof cancelAnimationFrame;\n }\n | undefined;\n}\n\nexport const animationFrameProvider: AnimationFrameProvider = {\n // When accessing the delegate, use the variable rather than `this` so that\n // the functions can be called without being bound to the provider.\n schedule(callback) {\n let request = requestAnimationFrame;\n let cancel: typeof cancelAnimationFrame | undefined = cancelAnimationFrame;\n const { delegate } = animationFrameProvider;\n if (delegate) {\n request = delegate.requestAnimationFrame;\n cancel = delegate.cancelAnimationFrame;\n }\n const handle = request((timestamp) => {\n // Clear the cancel function. The request has been fulfilled, so\n // attempting to cancel the request upon unsubscription would be\n // pointless.\n cancel = undefined;\n callback(timestamp);\n });\n return new Subscription(() => cancel?.(handle));\n },\n requestAnimationFrame(...args) {\n const { delegate } = animationFrameProvider;\n return (delegate?.requestAnimationFrame || requestAnimationFrame)(...args);\n },\n cancelAnimationFrame(...args) {\n const { delegate } = animationFrameProvider;\n return (delegate?.cancelAnimationFrame || cancelAnimationFrame)(...args);\n },\n delegate: undefined,\n};\n", "import { createErrorClass } from './createErrorClass';\n\nexport interface ObjectUnsubscribedError extends Error {}\n\nexport interface ObjectUnsubscribedErrorCtor {\n /**\n * @deprecated Internal implementation detail. Do not construct error instances.\n * Cannot be tagged as internal: https://github.com/ReactiveX/rxjs/issues/6269\n */\n new (): ObjectUnsubscribedError;\n}\n\n/**\n * An error thrown when an action is invalid because the object has been\n * unsubscribed.\n *\n * @see {@link Subject}\n * @see {@link BehaviorSubject}\n *\n * @class ObjectUnsubscribedError\n */\nexport const ObjectUnsubscribedError: ObjectUnsubscribedErrorCtor = createErrorClass(\n (_super) =>\n function ObjectUnsubscribedErrorImpl(this: any) {\n _super(this);\n this.name = 'ObjectUnsubscribedError';\n this.message = 'object unsubscribed';\n }\n);\n", "import { Operator } from './Operator';\nimport { Observable } from './Observable';\nimport { Subscriber } from './Subscriber';\nimport { Subscription, EMPTY_SUBSCRIPTION } from './Subscription';\nimport { Observer, SubscriptionLike, TeardownLogic } from './types';\nimport { ObjectUnsubscribedError } from './util/ObjectUnsubscribedError';\nimport { arrRemove } from './util/arrRemove';\nimport { errorContext } from './util/errorContext';\n\n/**\n * A Subject is a special type of Observable that allows values to be\n * multicasted to many Observers. Subjects are like EventEmitters.\n *\n * Every Subject is an Observable and an Observer. You can subscribe to a\n * Subject, and you can call next to feed values as well as error and complete.\n */\nexport class Subject extends Observable implements SubscriptionLike {\n closed = false;\n\n private currentObservers: Observer[] | null = null;\n\n /** @deprecated Internal implementation detail, do not use directly. Will be made internal in v8. */\n observers: Observer[] = [];\n /** @deprecated Internal implementation detail, do not use directly. Will be made internal in v8. */\n isStopped = false;\n /** @deprecated Internal implementation detail, do not use directly. Will be made internal in v8. */\n hasError = false;\n /** @deprecated Internal implementation detail, do not use directly. Will be made internal in v8. */\n thrownError: any = null;\n\n /**\n * Creates a \"subject\" by basically gluing an observer to an observable.\n *\n * @nocollapse\n * @deprecated Recommended you do not use. Will be removed at some point in the future. Plans for replacement still under discussion.\n */\n static create: (...args: any[]) => any = (destination: Observer, source: Observable): AnonymousSubject => {\n return new AnonymousSubject(destination, source);\n };\n\n constructor() {\n // NOTE: This must be here to obscure Observable's constructor.\n super();\n }\n\n /** @deprecated Internal implementation detail, do not use directly. Will be made internal in v8. */\n lift(operator: Operator): Observable {\n const subject = new AnonymousSubject(this, this);\n subject.operator = operator as any;\n return subject as any;\n }\n\n /** @internal */\n protected _throwIfClosed() {\n if (this.closed) {\n throw new ObjectUnsubscribedError();\n }\n }\n\n next(value: T) {\n errorContext(() => {\n this._throwIfClosed();\n if (!this.isStopped) {\n if (!this.currentObservers) {\n this.currentObservers = Array.from(this.observers);\n }\n for (const observer of this.currentObservers) {\n observer.next(value);\n }\n }\n });\n }\n\n error(err: any) {\n errorContext(() => {\n this._throwIfClosed();\n if (!this.isStopped) {\n this.hasError = this.isStopped = true;\n this.thrownError = err;\n const { observers } = this;\n while (observers.length) {\n observers.shift()!.error(err);\n }\n }\n });\n }\n\n complete() {\n errorContext(() => {\n this._throwIfClosed();\n if (!this.isStopped) {\n this.isStopped = true;\n const { observers } = this;\n while (observers.length) {\n observers.shift()!.complete();\n }\n }\n });\n }\n\n unsubscribe() {\n this.isStopped = this.closed = true;\n this.observers = this.currentObservers = null!;\n }\n\n get observed() {\n return this.observers?.length > 0;\n }\n\n /** @internal */\n protected _trySubscribe(subscriber: Subscriber): TeardownLogic {\n this._throwIfClosed();\n return super._trySubscribe(subscriber);\n }\n\n /** @internal */\n protected _subscribe(subscriber: Subscriber): Subscription {\n this._throwIfClosed();\n this._checkFinalizedStatuses(subscriber);\n return this._innerSubscribe(subscriber);\n }\n\n /** @internal */\n protected _innerSubscribe(subscriber: Subscriber) {\n const { hasError, isStopped, observers } = this;\n if (hasError || isStopped) {\n return EMPTY_SUBSCRIPTION;\n }\n this.currentObservers = null;\n observers.push(subscriber);\n return new Subscription(() => {\n this.currentObservers = null;\n arrRemove(observers, subscriber);\n });\n }\n\n /** @internal */\n protected _checkFinalizedStatuses(subscriber: Subscriber) {\n const { hasError, thrownError, isStopped } = this;\n if (hasError) {\n subscriber.error(thrownError);\n } else if (isStopped) {\n subscriber.complete();\n }\n }\n\n /**\n * Creates a new Observable with this Subject as the source. You can do this\n * to create custom Observer-side logic of the Subject and conceal it from\n * code that uses the Observable.\n * @return {Observable} Observable that the Subject casts to\n */\n asObservable(): Observable {\n const observable: any = new Observable();\n observable.source = this;\n return observable;\n }\n}\n\n/**\n * @class AnonymousSubject\n */\nexport class AnonymousSubject extends Subject {\n constructor(\n /** @deprecated Internal implementation detail, do not use directly. Will be made internal in v8. */\n public destination?: Observer,\n source?: Observable\n ) {\n super();\n this.source = source;\n }\n\n next(value: T) {\n this.destination?.next?.(value);\n }\n\n error(err: any) {\n this.destination?.error?.(err);\n }\n\n complete() {\n this.destination?.complete?.();\n }\n\n /** @internal */\n protected _subscribe(subscriber: Subscriber): Subscription {\n return this.source?.subscribe(subscriber) ?? EMPTY_SUBSCRIPTION;\n }\n}\n", "import { Subject } from './Subject';\nimport { Subscriber } from './Subscriber';\nimport { Subscription } from './Subscription';\n\n/**\n * A variant of Subject that requires an initial value and emits its current\n * value whenever it is subscribed to.\n *\n * @class BehaviorSubject\n */\nexport class BehaviorSubject extends Subject {\n constructor(private _value: T) {\n super();\n }\n\n get value(): T {\n return this.getValue();\n }\n\n /** @internal */\n protected _subscribe(subscriber: Subscriber): Subscription {\n const subscription = super._subscribe(subscriber);\n !subscription.closed && subscriber.next(this._value);\n return subscription;\n }\n\n getValue(): T {\n const { hasError, thrownError, _value } = this;\n if (hasError) {\n throw thrownError;\n }\n this._throwIfClosed();\n return _value;\n }\n\n next(value: T): void {\n super.next((this._value = value));\n }\n}\n", "import { TimestampProvider } from '../types';\n\ninterface DateTimestampProvider extends TimestampProvider {\n delegate: TimestampProvider | undefined;\n}\n\nexport const dateTimestampProvider: DateTimestampProvider = {\n now() {\n // Use the variable rather than `this` so that the function can be called\n // without being bound to the provider.\n return (dateTimestampProvider.delegate || Date).now();\n },\n delegate: undefined,\n};\n", "import { Subject } from './Subject';\nimport { TimestampProvider } from './types';\nimport { Subscriber } from './Subscriber';\nimport { Subscription } from './Subscription';\nimport { dateTimestampProvider } from './scheduler/dateTimestampProvider';\n\n/**\n * A variant of {@link Subject} that \"replays\" old values to new subscribers by emitting them when they first subscribe.\n *\n * `ReplaySubject` has an internal buffer that will store a specified number of values that it has observed. Like `Subject`,\n * `ReplaySubject` \"observes\" values by having them passed to its `next` method. When it observes a value, it will store that\n * value for a time determined by the configuration of the `ReplaySubject`, as passed to its constructor.\n *\n * When a new subscriber subscribes to the `ReplaySubject` instance, it will synchronously emit all values in its buffer in\n * a First-In-First-Out (FIFO) manner. The `ReplaySubject` will also complete, if it has observed completion; and it will\n * error if it has observed an error.\n *\n * There are two main configuration items to be concerned with:\n *\n * 1. `bufferSize` - This will determine how many items are stored in the buffer, defaults to infinite.\n * 2. `windowTime` - The amount of time to hold a value in the buffer before removing it from the buffer.\n *\n * Both configurations may exist simultaneously. So if you would like to buffer a maximum of 3 values, as long as the values\n * are less than 2 seconds old, you could do so with a `new ReplaySubject(3, 2000)`.\n *\n * ### Differences with BehaviorSubject\n *\n * `BehaviorSubject` is similar to `new ReplaySubject(1)`, with a couple of exceptions:\n *\n * 1. `BehaviorSubject` comes \"primed\" with a single value upon construction.\n * 2. `ReplaySubject` will replay values, even after observing an error, where `BehaviorSubject` will not.\n *\n * @see {@link Subject}\n * @see {@link BehaviorSubject}\n * @see {@link shareReplay}\n */\nexport class ReplaySubject extends Subject {\n private _buffer: (T | number)[] = [];\n private _infiniteTimeWindow = true;\n\n /**\n * @param bufferSize The size of the buffer to replay on subscription\n * @param windowTime The amount of time the buffered items will stay buffered\n * @param timestampProvider An object with a `now()` method that provides the current timestamp. This is used to\n * calculate the amount of time something has been buffered.\n */\n constructor(\n private _bufferSize = Infinity,\n private _windowTime = Infinity,\n private _timestampProvider: TimestampProvider = dateTimestampProvider\n ) {\n super();\n this._infiniteTimeWindow = _windowTime === Infinity;\n this._bufferSize = Math.max(1, _bufferSize);\n this._windowTime = Math.max(1, _windowTime);\n }\n\n next(value: T): void {\n const { isStopped, _buffer, _infiniteTimeWindow, _timestampProvider, _windowTime } = this;\n if (!isStopped) {\n _buffer.push(value);\n !_infiniteTimeWindow && _buffer.push(_timestampProvider.now() + _windowTime);\n }\n this._trimBuffer();\n super.next(value);\n }\n\n /** @internal */\n protected _subscribe(subscriber: Subscriber): Subscription {\n this._throwIfClosed();\n this._trimBuffer();\n\n const subscription = this._innerSubscribe(subscriber);\n\n const { _infiniteTimeWindow, _buffer } = this;\n // We use a copy here, so reentrant code does not mutate our array while we're\n // emitting it to a new subscriber.\n const copy = _buffer.slice();\n for (let i = 0; i < copy.length && !subscriber.closed; i += _infiniteTimeWindow ? 1 : 2) {\n subscriber.next(copy[i] as T);\n }\n\n this._checkFinalizedStatuses(subscriber);\n\n return subscription;\n }\n\n private _trimBuffer() {\n const { _bufferSize, _timestampProvider, _buffer, _infiniteTimeWindow } = this;\n // If we don't have an infinite buffer size, and we're over the length,\n // use splice to truncate the old buffer values off. Note that we have to\n // double the size for instances where we're not using an infinite time window\n // because we're storing the values and the timestamps in the same array.\n const adjustedBufferSize = (_infiniteTimeWindow ? 1 : 2) * _bufferSize;\n _bufferSize < Infinity && adjustedBufferSize < _buffer.length && _buffer.splice(0, _buffer.length - adjustedBufferSize);\n\n // Now, if we're not in an infinite time window, remove all values where the time is\n // older than what is allowed.\n if (!_infiniteTimeWindow) {\n const now = _timestampProvider.now();\n let last = 0;\n // Search the array for the first timestamp that isn't expired and\n // truncate the buffer up to that point.\n for (let i = 1; i < _buffer.length && (_buffer[i] as number) <= now; i += 2) {\n last = i;\n }\n last && _buffer.splice(0, last + 1);\n }\n }\n}\n", "import { Scheduler } from '../Scheduler';\nimport { Subscription } from '../Subscription';\nimport { SchedulerAction } from '../types';\n\n/**\n * A unit of work to be executed in a `scheduler`. An action is typically\n * created from within a {@link SchedulerLike} and an RxJS user does not need to concern\n * themselves about creating and manipulating an Action.\n *\n * ```ts\n * class Action extends Subscription {\n * new (scheduler: Scheduler, work: (state?: T) => void);\n * schedule(state?: T, delay: number = 0): Subscription;\n * }\n * ```\n *\n * @class Action\n */\nexport class Action extends Subscription {\n constructor(scheduler: Scheduler, work: (this: SchedulerAction, state?: T) => void) {\n super();\n }\n /**\n * Schedules this action on its parent {@link SchedulerLike} for execution. May be passed\n * some context object, `state`. May happen at some point in the future,\n * according to the `delay` parameter, if specified.\n * @param {T} [state] Some contextual data that the `work` function uses when\n * called by the Scheduler.\n * @param {number} [delay] Time to wait before executing the work, where the\n * time unit is implicit and defined by the Scheduler.\n * @return {void}\n */\n public schedule(state?: T, delay: number = 0): Subscription {\n return this;\n }\n}\n", "import type { TimerHandle } from './timerHandle';\ntype SetIntervalFunction = (handler: () => void, timeout?: number, ...args: any[]) => TimerHandle;\ntype ClearIntervalFunction = (handle: TimerHandle) => void;\n\ninterface IntervalProvider {\n setInterval: SetIntervalFunction;\n clearInterval: ClearIntervalFunction;\n delegate:\n | {\n setInterval: SetIntervalFunction;\n clearInterval: ClearIntervalFunction;\n }\n | undefined;\n}\n\nexport const intervalProvider: IntervalProvider = {\n // When accessing the delegate, use the variable rather than `this` so that\n // the functions can be called without being bound to the provider.\n setInterval(handler: () => void, timeout?: number, ...args) {\n const { delegate } = intervalProvider;\n if (delegate?.setInterval) {\n return delegate.setInterval(handler, timeout, ...args);\n }\n return setInterval(handler, timeout, ...args);\n },\n clearInterval(handle) {\n const { delegate } = intervalProvider;\n return (delegate?.clearInterval || clearInterval)(handle as any);\n },\n delegate: undefined,\n};\n", "import { Action } from './Action';\nimport { SchedulerAction } from '../types';\nimport { Subscription } from '../Subscription';\nimport { AsyncScheduler } from './AsyncScheduler';\nimport { intervalProvider } from './intervalProvider';\nimport { arrRemove } from '../util/arrRemove';\nimport { TimerHandle } from './timerHandle';\n\nexport class AsyncAction extends Action {\n public id: TimerHandle | undefined;\n public state?: T;\n // @ts-ignore: Property has no initializer and is not definitely assigned\n public delay: number;\n protected pending: boolean = false;\n\n constructor(protected scheduler: AsyncScheduler, protected work: (this: SchedulerAction, state?: T) => void) {\n super(scheduler, work);\n }\n\n public schedule(state?: T, delay: number = 0): Subscription {\n if (this.closed) {\n return this;\n }\n\n // Always replace the current state with the new state.\n this.state = state;\n\n const id = this.id;\n const scheduler = this.scheduler;\n\n //\n // Important implementation note:\n //\n // Actions only execute once by default, unless rescheduled from within the\n // scheduled callback. This allows us to implement single and repeat\n // actions via the same code path, without adding API surface area, as well\n // as mimic traditional recursion but across asynchronous boundaries.\n //\n // However, JS runtimes and timers distinguish between intervals achieved by\n // serial `setTimeout` calls vs. a single `setInterval` call. An interval of\n // serial `setTimeout` calls can be individually delayed, which delays\n // scheduling the next `setTimeout`, and so on. `setInterval` attempts to\n // guarantee the interval callback will be invoked more precisely to the\n // interval period, regardless of load.\n //\n // Therefore, we use `setInterval` to schedule single and repeat actions.\n // If the action reschedules itself with the same delay, the interval is not\n // canceled. If the action doesn't reschedule, or reschedules with a\n // different delay, the interval will be canceled after scheduled callback\n // execution.\n //\n if (id != null) {\n this.id = this.recycleAsyncId(scheduler, id, delay);\n }\n\n // Set the pending flag indicating that this action has been scheduled, or\n // has recursively rescheduled itself.\n this.pending = true;\n\n this.delay = delay;\n // If this action has already an async Id, don't request a new one.\n this.id = this.id ?? this.requestAsyncId(scheduler, this.id, delay);\n\n return this;\n }\n\n protected requestAsyncId(scheduler: AsyncScheduler, _id?: TimerHandle, delay: number = 0): TimerHandle {\n return intervalProvider.setInterval(scheduler.flush.bind(scheduler, this), delay);\n }\n\n protected recycleAsyncId(_scheduler: AsyncScheduler, id?: TimerHandle, delay: number | null = 0): TimerHandle | undefined {\n // If this action is rescheduled with the same delay time, don't clear the interval id.\n if (delay != null && this.delay === delay && this.pending === false) {\n return id;\n }\n // Otherwise, if the action's delay time is different from the current delay,\n // or the action has been rescheduled before it's executed, clear the interval id\n if (id != null) {\n intervalProvider.clearInterval(id);\n }\n\n return undefined;\n }\n\n /**\n * Immediately executes this action and the `work` it contains.\n * @return {any}\n */\n public execute(state: T, delay: number): any {\n if (this.closed) {\n return new Error('executing a cancelled action');\n }\n\n this.pending = false;\n const error = this._execute(state, delay);\n if (error) {\n return error;\n } else if (this.pending === false && this.id != null) {\n // Dequeue if the action didn't reschedule itself. Don't call\n // unsubscribe(), because the action could reschedule later.\n // For example:\n // ```\n // scheduler.schedule(function doWork(counter) {\n // /* ... I'm a busy worker bee ... */\n // var originalAction = this;\n // /* wait 100ms before rescheduling the action */\n // setTimeout(function () {\n // originalAction.schedule(counter + 1);\n // }, 100);\n // }, 1000);\n // ```\n this.id = this.recycleAsyncId(this.scheduler, this.id, null);\n }\n }\n\n protected _execute(state: T, _delay: number): any {\n let errored: boolean = false;\n let errorValue: any;\n try {\n this.work(state);\n } catch (e) {\n errored = true;\n // HACK: Since code elsewhere is relying on the \"truthiness\" of the\n // return here, we can't have it return \"\" or 0 or false.\n // TODO: Clean this up when we refactor schedulers mid-version-8 or so.\n errorValue = e ? e : new Error('Scheduled action threw falsy error');\n }\n if (errored) {\n this.unsubscribe();\n return errorValue;\n }\n }\n\n unsubscribe() {\n if (!this.closed) {\n const { id, scheduler } = this;\n const { actions } = scheduler;\n\n this.work = this.state = this.scheduler = null!;\n this.pending = false;\n\n arrRemove(actions, this);\n if (id != null) {\n this.id = this.recycleAsyncId(scheduler, id, null);\n }\n\n this.delay = null!;\n super.unsubscribe();\n }\n }\n}\n", "import { Action } from './scheduler/Action';\nimport { Subscription } from './Subscription';\nimport { SchedulerLike, SchedulerAction } from './types';\nimport { dateTimestampProvider } from './scheduler/dateTimestampProvider';\n\n/**\n * An execution context and a data structure to order tasks and schedule their\n * execution. Provides a notion of (potentially virtual) time, through the\n * `now()` getter method.\n *\n * Each unit of work in a Scheduler is called an `Action`.\n *\n * ```ts\n * class Scheduler {\n * now(): number;\n * schedule(work, delay?, state?): Subscription;\n * }\n * ```\n *\n * @class Scheduler\n * @deprecated Scheduler is an internal implementation detail of RxJS, and\n * should not be used directly. Rather, create your own class and implement\n * {@link SchedulerLike}. Will be made internal in v8.\n */\nexport class Scheduler implements SchedulerLike {\n public static now: () => number = dateTimestampProvider.now;\n\n constructor(private schedulerActionCtor: typeof Action, now: () => number = Scheduler.now) {\n this.now = now;\n }\n\n /**\n * A getter method that returns a number representing the current time\n * (at the time this function was called) according to the scheduler's own\n * internal clock.\n * @return {number} A number that represents the current time. May or may not\n * have a relation to wall-clock time. May or may not refer to a time unit\n * (e.g. milliseconds).\n */\n public now: () => number;\n\n /**\n * Schedules a function, `work`, for execution. May happen at some point in\n * the future, according to the `delay` parameter, if specified. May be passed\n * some context object, `state`, which will be passed to the `work` function.\n *\n * The given arguments will be processed an stored as an Action object in a\n * queue of actions.\n *\n * @param {function(state: ?T): ?Subscription} work A function representing a\n * task, or some unit of work to be executed by the Scheduler.\n * @param {number} [delay] Time to wait before executing the work, where the\n * time unit is implicit and defined by the Scheduler itself.\n * @param {T} [state] Some contextual data that the `work` function uses when\n * called by the Scheduler.\n * @return {Subscription} A subscription in order to be able to unsubscribe\n * the scheduled work.\n */\n public schedule(work: (this: SchedulerAction, state?: T) => void, delay: number = 0, state?: T): Subscription {\n return new this.schedulerActionCtor(this, work).schedule(state, delay);\n }\n}\n", "import { Scheduler } from '../Scheduler';\nimport { Action } from './Action';\nimport { AsyncAction } from './AsyncAction';\nimport { TimerHandle } from './timerHandle';\n\nexport class AsyncScheduler extends Scheduler {\n public actions: Array> = [];\n /**\n * A flag to indicate whether the Scheduler is currently executing a batch of\n * queued actions.\n * @type {boolean}\n * @internal\n */\n public _active: boolean = false;\n /**\n * An internal ID used to track the latest asynchronous task such as those\n * coming from `setTimeout`, `setInterval`, `requestAnimationFrame`, and\n * others.\n * @type {any}\n * @internal\n */\n public _scheduled: TimerHandle | undefined;\n\n constructor(SchedulerAction: typeof Action, now: () => number = Scheduler.now) {\n super(SchedulerAction, now);\n }\n\n public flush(action: AsyncAction): void {\n const { actions } = this;\n\n if (this._active) {\n actions.push(action);\n return;\n }\n\n let error: any;\n this._active = true;\n\n do {\n if ((error = action.execute(action.state, action.delay))) {\n break;\n }\n } while ((action = actions.shift()!)); // exhaust the scheduler queue\n\n this._active = false;\n\n if (error) {\n while ((action = actions.shift()!)) {\n action.unsubscribe();\n }\n throw error;\n }\n }\n}\n", "import { AsyncAction } from './AsyncAction';\nimport { AsyncScheduler } from './AsyncScheduler';\n\n/**\n *\n * Async Scheduler\n *\n * Schedule task as if you used setTimeout(task, duration)\n *\n * `async` scheduler schedules tasks asynchronously, by putting them on the JavaScript\n * event loop queue. It is best used to delay tasks in time or to schedule tasks repeating\n * in intervals.\n *\n * If you just want to \"defer\" task, that is to perform it right after currently\n * executing synchronous code ends (commonly achieved by `setTimeout(deferredTask, 0)`),\n * better choice will be the {@link asapScheduler} scheduler.\n *\n * ## Examples\n * Use async scheduler to delay task\n * ```ts\n * import { asyncScheduler } from 'rxjs';\n *\n * const task = () => console.log('it works!');\n *\n * asyncScheduler.schedule(task, 2000);\n *\n * // After 2 seconds logs:\n * // \"it works!\"\n * ```\n *\n * Use async scheduler to repeat task in intervals\n * ```ts\n * import { asyncScheduler } from 'rxjs';\n *\n * function task(state) {\n * console.log(state);\n * this.schedule(state + 1, 1000); // `this` references currently executing Action,\n * // which we reschedule with new state and delay\n * }\n *\n * asyncScheduler.schedule(task, 3000, 0);\n *\n * // Logs:\n * // 0 after 3s\n * // 1 after 4s\n * // 2 after 5s\n * // 3 after 6s\n * ```\n */\n\nexport const asyncScheduler = new AsyncScheduler(AsyncAction);\n\n/**\n * @deprecated Renamed to {@link asyncScheduler}. Will be removed in v8.\n */\nexport const async = asyncScheduler;\n", "import { AsyncAction } from './AsyncAction';\nimport { Subscription } from '../Subscription';\nimport { QueueScheduler } from './QueueScheduler';\nimport { SchedulerAction } from '../types';\nimport { TimerHandle } from './timerHandle';\n\nexport class QueueAction extends AsyncAction {\n constructor(protected scheduler: QueueScheduler, protected work: (this: SchedulerAction, state?: T) => void) {\n super(scheduler, work);\n }\n\n public schedule(state?: T, delay: number = 0): Subscription {\n if (delay > 0) {\n return super.schedule(state, delay);\n }\n this.delay = delay;\n this.state = state;\n this.scheduler.flush(this);\n return this;\n }\n\n public execute(state: T, delay: number): any {\n return delay > 0 || this.closed ? super.execute(state, delay) : this._execute(state, delay);\n }\n\n protected requestAsyncId(scheduler: QueueScheduler, id?: TimerHandle, delay: number = 0): TimerHandle {\n // If delay exists and is greater than 0, or if the delay is null (the\n // action wasn't rescheduled) but was originally scheduled as an async\n // action, then recycle as an async action.\n\n if ((delay != null && delay > 0) || (delay == null && this.delay > 0)) {\n return super.requestAsyncId(scheduler, id, delay);\n }\n\n // Otherwise flush the scheduler starting with this action.\n scheduler.flush(this);\n\n // HACK: In the past, this was returning `void`. However, `void` isn't a valid\n // `TimerHandle`, and generally the return value here isn't really used. So the\n // compromise is to return `0` which is both \"falsy\" and a valid `TimerHandle`,\n // as opposed to refactoring every other instanceo of `requestAsyncId`.\n return 0;\n }\n}\n", "import { AsyncScheduler } from './AsyncScheduler';\n\nexport class QueueScheduler extends AsyncScheduler {\n}\n", "import { QueueAction } from './QueueAction';\nimport { QueueScheduler } from './QueueScheduler';\n\n/**\n *\n * Queue Scheduler\n *\n * Put every next task on a queue, instead of executing it immediately\n *\n * `queue` scheduler, when used with delay, behaves the same as {@link asyncScheduler} scheduler.\n *\n * When used without delay, it schedules given task synchronously - executes it right when\n * it is scheduled. However when called recursively, that is when inside the scheduled task,\n * another task is scheduled with queue scheduler, instead of executing immediately as well,\n * that task will be put on a queue and wait for current one to finish.\n *\n * This means that when you execute task with `queue` scheduler, you are sure it will end\n * before any other task scheduled with that scheduler will start.\n *\n * ## Examples\n * Schedule recursively first, then do something\n * ```ts\n * import { queueScheduler } from 'rxjs';\n *\n * queueScheduler.schedule(() => {\n * queueScheduler.schedule(() => console.log('second')); // will not happen now, but will be put on a queue\n *\n * console.log('first');\n * });\n *\n * // Logs:\n * // \"first\"\n * // \"second\"\n * ```\n *\n * Reschedule itself recursively\n * ```ts\n * import { queueScheduler } from 'rxjs';\n *\n * queueScheduler.schedule(function(state) {\n * if (state !== 0) {\n * console.log('before', state);\n * this.schedule(state - 1); // `this` references currently executing Action,\n * // which we reschedule with new state\n * console.log('after', state);\n * }\n * }, 0, 3);\n *\n * // In scheduler that runs recursively, you would expect:\n * // \"before\", 3\n * // \"before\", 2\n * // \"before\", 1\n * // \"after\", 1\n * // \"after\", 2\n * // \"after\", 3\n *\n * // But with queue it logs:\n * // \"before\", 3\n * // \"after\", 3\n * // \"before\", 2\n * // \"after\", 2\n * // \"before\", 1\n * // \"after\", 1\n * ```\n */\n\nexport const queueScheduler = new QueueScheduler(QueueAction);\n\n/**\n * @deprecated Renamed to {@link queueScheduler}. Will be removed in v8.\n */\nexport const queue = queueScheduler;\n", "import { AsyncAction } from './AsyncAction';\nimport { AnimationFrameScheduler } from './AnimationFrameScheduler';\nimport { SchedulerAction } from '../types';\nimport { animationFrameProvider } from './animationFrameProvider';\nimport { TimerHandle } from './timerHandle';\n\nexport class AnimationFrameAction extends AsyncAction {\n constructor(protected scheduler: AnimationFrameScheduler, protected work: (this: SchedulerAction, state?: T) => void) {\n super(scheduler, work);\n }\n\n protected requestAsyncId(scheduler: AnimationFrameScheduler, id?: TimerHandle, delay: number = 0): TimerHandle {\n // If delay is greater than 0, request as an async action.\n if (delay !== null && delay > 0) {\n return super.requestAsyncId(scheduler, id, delay);\n }\n // Push the action to the end of the scheduler queue.\n scheduler.actions.push(this);\n // If an animation frame has already been requested, don't request another\n // one. If an animation frame hasn't been requested yet, request one. Return\n // the current animation frame request id.\n return scheduler._scheduled || (scheduler._scheduled = animationFrameProvider.requestAnimationFrame(() => scheduler.flush(undefined)));\n }\n\n protected recycleAsyncId(scheduler: AnimationFrameScheduler, id?: TimerHandle, delay: number = 0): TimerHandle | undefined {\n // If delay exists and is greater than 0, or if the delay is null (the\n // action wasn't rescheduled) but was originally scheduled as an async\n // action, then recycle as an async action.\n if (delay != null ? delay > 0 : this.delay > 0) {\n return super.recycleAsyncId(scheduler, id, delay);\n }\n // If the scheduler queue has no remaining actions with the same async id,\n // cancel the requested animation frame and set the scheduled flag to\n // undefined so the next AnimationFrameAction will request its own.\n const { actions } = scheduler;\n if (id != null && actions[actions.length - 1]?.id !== id) {\n animationFrameProvider.cancelAnimationFrame(id as number);\n scheduler._scheduled = undefined;\n }\n // Return undefined so the action knows to request a new async id if it's rescheduled.\n return undefined;\n }\n}\n", "import { AsyncAction } from './AsyncAction';\nimport { AsyncScheduler } from './AsyncScheduler';\n\nexport class AnimationFrameScheduler extends AsyncScheduler {\n public flush(action?: AsyncAction): void {\n this._active = true;\n // The async id that effects a call to flush is stored in _scheduled.\n // Before executing an action, it's necessary to check the action's async\n // id to determine whether it's supposed to be executed in the current\n // flush.\n // Previous implementations of this method used a count to determine this,\n // but that was unsound, as actions that are unsubscribed - i.e. cancelled -\n // are removed from the actions array and that can shift actions that are\n // scheduled to be executed in a subsequent flush into positions at which\n // they are executed within the current flush.\n const flushId = this._scheduled;\n this._scheduled = undefined;\n\n const { actions } = this;\n let error: any;\n action = action || actions.shift()!;\n\n do {\n if ((error = action.execute(action.state, action.delay))) {\n break;\n }\n } while ((action = actions[0]) && action.id === flushId && actions.shift());\n\n this._active = false;\n\n if (error) {\n while ((action = actions[0]) && action.id === flushId && actions.shift()) {\n action.unsubscribe();\n }\n throw error;\n }\n }\n}\n", "import { AnimationFrameAction } from './AnimationFrameAction';\nimport { AnimationFrameScheduler } from './AnimationFrameScheduler';\n\n/**\n *\n * Animation Frame Scheduler\n *\n * Perform task when `window.requestAnimationFrame` would fire\n *\n * When `animationFrame` scheduler is used with delay, it will fall back to {@link asyncScheduler} scheduler\n * behaviour.\n *\n * Without delay, `animationFrame` scheduler can be used to create smooth browser animations.\n * It makes sure scheduled task will happen just before next browser content repaint,\n * thus performing animations as efficiently as possible.\n *\n * ## Example\n * Schedule div height animation\n * ```ts\n * // html:
\n * import { animationFrameScheduler } from 'rxjs';\n *\n * const div = document.querySelector('div');\n *\n * animationFrameScheduler.schedule(function(height) {\n * div.style.height = height + \"px\";\n *\n * this.schedule(height + 1); // `this` references currently executing Action,\n * // which we reschedule with new state\n * }, 0, 0);\n *\n * // You will see a div element growing in height\n * ```\n */\n\nexport const animationFrameScheduler = new AnimationFrameScheduler(AnimationFrameAction);\n\n/**\n * @deprecated Renamed to {@link animationFrameScheduler}. Will be removed in v8.\n */\nexport const animationFrame = animationFrameScheduler;\n", "import { Observable } from '../Observable';\nimport { SchedulerLike } from '../types';\n\n/**\n * A simple Observable that emits no items to the Observer and immediately\n * emits a complete notification.\n *\n * Just emits 'complete', and nothing else.\n *\n * ![](empty.png)\n *\n * A simple Observable that only emits the complete notification. It can be used\n * for composing with other Observables, such as in a {@link mergeMap}.\n *\n * ## Examples\n *\n * Log complete notification\n *\n * ```ts\n * import { EMPTY } from 'rxjs';\n *\n * EMPTY.subscribe({\n * next: () => console.log('Next'),\n * complete: () => console.log('Complete!')\n * });\n *\n * // Outputs\n * // Complete!\n * ```\n *\n * Emit the number 7, then complete\n *\n * ```ts\n * import { EMPTY, startWith } from 'rxjs';\n *\n * const result = EMPTY.pipe(startWith(7));\n * result.subscribe(x => console.log(x));\n *\n * // Outputs\n * // 7\n * ```\n *\n * Map and flatten only odd numbers to the sequence `'a'`, `'b'`, `'c'`\n *\n * ```ts\n * import { interval, mergeMap, of, EMPTY } from 'rxjs';\n *\n * const interval$ = interval(1000);\n * const result = interval$.pipe(\n * mergeMap(x => x % 2 === 1 ? of('a', 'b', 'c') : EMPTY),\n * );\n * result.subscribe(x => console.log(x));\n *\n * // Results in the following to the console:\n * // x is equal to the count on the interval, e.g. (0, 1, 2, 3, ...)\n * // x will occur every 1000ms\n * // if x % 2 is equal to 1, print a, b, c (each on its own)\n * // if x % 2 is not equal to 1, nothing will be output\n * ```\n *\n * @see {@link Observable}\n * @see {@link NEVER}\n * @see {@link of}\n * @see {@link throwError}\n */\nexport const EMPTY = new Observable((subscriber) => subscriber.complete());\n\n/**\n * @param scheduler A {@link SchedulerLike} to use for scheduling\n * the emission of the complete notification.\n * @deprecated Replaced with the {@link EMPTY} constant or {@link scheduled} (e.g. `scheduled([], scheduler)`). Will be removed in v8.\n */\nexport function empty(scheduler?: SchedulerLike) {\n return scheduler ? emptyScheduled(scheduler) : EMPTY;\n}\n\nfunction emptyScheduled(scheduler: SchedulerLike) {\n return new Observable((subscriber) => scheduler.schedule(() => subscriber.complete()));\n}\n", "import { SchedulerLike } from '../types';\nimport { isFunction } from './isFunction';\n\nexport function isScheduler(value: any): value is SchedulerLike {\n return value && isFunction(value.schedule);\n}\n", "import { SchedulerLike } from '../types';\nimport { isFunction } from './isFunction';\nimport { isScheduler } from './isScheduler';\n\nfunction last(arr: T[]): T | undefined {\n return arr[arr.length - 1];\n}\n\nexport function popResultSelector(args: any[]): ((...args: unknown[]) => unknown) | undefined {\n return isFunction(last(args)) ? args.pop() : undefined;\n}\n\nexport function popScheduler(args: any[]): SchedulerLike | undefined {\n return isScheduler(last(args)) ? args.pop() : undefined;\n}\n\nexport function popNumber(args: any[], defaultValue: number): number {\n return typeof last(args) === 'number' ? args.pop()! : defaultValue;\n}\n", "export const isArrayLike = ((x: any): x is ArrayLike => x && typeof x.length === 'number' && typeof x !== 'function');", "import { isFunction } from \"./isFunction\";\n\n/**\n * Tests to see if the object is \"thennable\".\n * @param value the object to test\n */\nexport function isPromise(value: any): value is PromiseLike {\n return isFunction(value?.then);\n}\n", "import { InteropObservable } from '../types';\nimport { observable as Symbol_observable } from '../symbol/observable';\nimport { isFunction } from './isFunction';\n\n/** Identifies an input as being Observable (but not necessary an Rx Observable) */\nexport function isInteropObservable(input: any): input is InteropObservable {\n return isFunction(input[Symbol_observable]);\n}\n", "import { isFunction } from './isFunction';\n\nexport function isAsyncIterable(obj: any): obj is AsyncIterable {\n return Symbol.asyncIterator && isFunction(obj?.[Symbol.asyncIterator]);\n}\n", "/**\n * Creates the TypeError to throw if an invalid object is passed to `from` or `scheduled`.\n * @param input The object that was passed.\n */\nexport function createInvalidObservableTypeError(input: any) {\n // TODO: We should create error codes that can be looked up, so this can be less verbose.\n return new TypeError(\n `You provided ${\n input !== null && typeof input === 'object' ? 'an invalid object' : `'${input}'`\n } where a stream was expected. You can provide an Observable, Promise, ReadableStream, Array, AsyncIterable, or Iterable.`\n );\n}\n", "export function getSymbolIterator(): symbol {\n if (typeof Symbol !== 'function' || !Symbol.iterator) {\n return '@@iterator' as any;\n }\n\n return Symbol.iterator;\n}\n\nexport const iterator = getSymbolIterator();\n", "import { iterator as Symbol_iterator } from '../symbol/iterator';\nimport { isFunction } from './isFunction';\n\n/** Identifies an input as being an Iterable */\nexport function isIterable(input: any): input is Iterable {\n return isFunction(input?.[Symbol_iterator]);\n}\n", "import { ReadableStreamLike } from '../types';\nimport { isFunction } from './isFunction';\n\nexport async function* readableStreamLikeToAsyncGenerator(readableStream: ReadableStreamLike): AsyncGenerator {\n const reader = readableStream.getReader();\n try {\n while (true) {\n const { value, done } = await reader.read();\n if (done) {\n return;\n }\n yield value!;\n }\n } finally {\n reader.releaseLock();\n }\n}\n\nexport function isReadableStreamLike(obj: any): obj is ReadableStreamLike {\n // We don't want to use instanceof checks because they would return\n // false for instances from another Realm, like an