Skip to content

Commit 7d4ec96

Browse files
roherohe
committed
Basing SessionManager on GrantManager - All the tests are working now.
1 parent e42abb8 commit 7d4ec96

22 files changed

Lines changed: 400 additions & 529 deletions

‎src/idpyoidc/server/exception.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,3 +124,7 @@ class CapabilitiesMisMatch(OidcEndpointError):
124124

125125
class MultipleCodeUsage(OidcEndpointError):
126126
pass
127+
128+
129+
class InvalidBranchID(OidcEndpointError):
130+
pass

‎src/idpyoidc/server/oauth2/authorization.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -768,7 +768,7 @@ def create_authn_response(self, request: Union[dict, Message], sid: str) -> dict
768768
_code = self.mint_token(
769769
token_class="authorization_code",
770770
grant=grant,
771-
session_id=_sinfo["session_id"],
771+
session_id=_sinfo["branch_id"],
772772
)
773773
aresp["code"] = _code.value
774774
handled_response_type.append("code")
@@ -779,7 +779,7 @@ def create_authn_response(self, request: Union[dict, Message], sid: str) -> dict
779779
_access_token = self.mint_token(
780780
token_class="access_token",
781781
grant=grant,
782-
session_id=_sinfo["session_id"],
782+
session_id=_sinfo["branch_id"],
783783
)
784784
aresp["access_token"] = _access_token.value
785785
aresp["token_type"] = "Bearer"
@@ -805,7 +805,7 @@ def create_authn_response(self, request: Union[dict, Message], sid: str) -> dict
805805
id_token = self.mint_token(
806806
token_class="id_token",
807807
grant=grant,
808-
session_id=_sinfo["session_id"],
808+
session_id=_sinfo["branch_id"],
809809
scope=request["scope"],
810810
**kwargs,
811811
)
@@ -995,7 +995,7 @@ def process_request(
995995
cinfo = _context.cdb[_cid]
996996
# logger.debug("client {}: {}".format(_cid, cinfo))
997997

998-
# this applies the default optionally deny_unknown_scopes policy
998+
# this applies the default option deny_unknown_scopes policy
999999
check_unknown_scopes_policy(request, _cid, _context)
10001000

10011001
if http_info is None:

‎src/idpyoidc/server/oauth2/introspection.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ def process_request(self, request=None, release: Optional[list] = None, **kwargs
124124
_resp.weed()
125125

126126
_claims_restriction = _context.claims_interface.get_claims(
127-
_session_info["session_id"], scopes=_token.scope, claims_release_point="introspection"
127+
_session_info["branch_id"], scopes=_token.scope, claims_release_point="introspection"
128128
)
129129
if _claims_restriction:
130130
user_info = _context.claims_interface.get_user_claims(

‎src/idpyoidc/server/oauth2/token_helper.py‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
163163
token = self._mint_token(
164164
token_class="access_token",
165165
grant=grant,
166-
session_id=_session_info["session_id"],
166+
session_id=_session_info["branch_id"],
167167
client_id=_session_info["client_id"],
168168
based_on=_based_on,
169169
)
@@ -183,7 +183,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
183183
refresh_token = self._mint_token(
184184
token_class="refresh_token",
185185
grant=grant,
186-
session_id=_session_info["session_id"],
186+
session_id=_session_info["branch_id"],
187187
client_id=_session_info["client_id"],
188188
based_on=_based_on,
189189
)
@@ -193,7 +193,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
193193
_response["refresh_token"] = refresh_token.value
194194

195195
# since the grant content has changed. Make sure it's stored
196-
_mngr[_session_info["session_id"]] = grant
196+
_mngr[_session_info["branch_id"]] = grant
197197

198198
_based_on.register_usage()
199199

@@ -275,7 +275,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
275275
access_token = self._mint_token(
276276
token_class="access_token",
277277
grant=_grant,
278-
session_id=_session_info["session_id"],
278+
session_id=_session_info["branch_id"],
279279
client_id=_session_info["client_id"],
280280
based_on=token,
281281
scope=scope,
@@ -297,7 +297,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
297297
refresh_token = self._mint_token(
298298
token_class="refresh_token",
299299
grant=_grant,
300-
session_id=_session_info["session_id"],
300+
session_id=_session_info["branch_id"],
301301
client_id=_session_info["client_id"],
302302
based_on=token,
303303
scope=scope,
@@ -435,7 +435,7 @@ def post_parse_request(self, request, client_id="", **kwargs):
435435
)
436436

437437
# Find the token instance based on the token value
438-
token = _mngr.find_token(_session_info["session_id"], request["subject_token"])
438+
token = _mngr.find_token(_session_info["branch_id"], request["subject_token"])
439439
if token.is_active() is False:
440440
return self.error_cls(
441441
error="invalid_request", error_description="Subject token inactive"
@@ -535,14 +535,14 @@ def process_request(self, request, **kwargs):
535535
error="invalid_request", error_description="Subject token invalid"
536536
)
537537

538-
token = _mngr.find_token(_session_info["session_id"], request["subject_token"])
538+
token = _mngr.find_token(_session_info["branch_id"], request["subject_token"])
539539
_requested_token_type = request.get(
540540
"requested_token_type", "urn:ietf:params:oauth:token-type:access_token"
541541
)
542542

543543
_token_class = self.token_types_mapping[_requested_token_type]
544544

545-
sid = _session_info["session_id"]
545+
sid = _session_info["branch_id"]
546546

547547
_token_type = "Bearer"
548548
# Is DPOP supported

‎src/idpyoidc/server/oidc/backchannel_authentication.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
239239
token = self._mint_token(
240240
token_class="access_token",
241241
grant=grant,
242-
session_id=_session_info["session_id"],
242+
session_id=_session_info["branch_id"],
243243
client_id=_session_info["client_id"],
244244
token_type=token_type,
245245
)
@@ -255,7 +255,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
255255
refresh_token = self._mint_token(
256256
token_class="refresh_token",
257257
grant=grant,
258-
session_id=_session_info["session_id"],
258+
session_id=_session_info["branch_id"],
259259
client_id=_session_info["client_id"],
260260
)
261261
except MintingNotAllowed as err:
@@ -264,14 +264,14 @@ def process_request(self, req: Union[Message, dict], **kwargs):
264264
_response["refresh_token"] = refresh_token.value
265265

266266
# since the grant content has changed. Make sure it's stored
267-
_mngr[_session_info["session_id"]] = grant
267+
_mngr[_session_info["branch_id"]] = grant
268268

269269
if "openid" in _authn_req["scope"]:
270270
try:
271271
_idtoken = self._mint_token(
272272
token_class="id_token",
273273
grant=grant,
274-
session_id=_session_info["session_id"],
274+
session_id=_session_info["branch_id"],
275275
client_id=_session_info["client_id"],
276276
)
277277
except (JWEException, NoSuitableSigningKeys) as err:

‎src/idpyoidc/server/oidc/session.py‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -149,9 +149,7 @@ def clean_sessions(self, usids):
149149
def logout_all_clients(self, sid):
150150
_context = self.server_get("endpoint_context")
151151
_mngr = _context.session_manager
152-
_session_info = _mngr.get_session_info(
153-
sid, user_session_info=True, client_session_info=True, grant=True
154-
)
152+
_session_info = _mngr.get_session_info(sid)
155153

156154
# Front-/Backchannel logout ?
157155
_cdb = _context.cdb
@@ -165,12 +163,14 @@ def logout_all_clients(self, sid):
165163
bc_logouts = {}
166164
fc_iframes = {}
167165
_rel_sid = []
168-
for _client_id in _session_info["user_session_info"].subordinate:
166+
for _client_key in _session_info["user"].subordinate:
167+
_path = _mngr.unpack_branch_key(_client_key)
168+
_client_id = _path[-1]
169169
# I prefer back-channel. Should it be configurable ?
170170
if "backchannel_logout_uri" in _cdb[_client_id]:
171-
_cli = _mngr.get([_user_id, _client_id])
171+
_cli = _mngr.get(_path)
172172
for gid in _cli.subordinate:
173-
grant = _mngr.get([_user_id, _client_id, gid])
173+
grant = _mngr.get(_mngr.unpack_branch_key(gid))
174174
# Has to be connected to an authentication event
175175
if not grant.authentication_event:
176176
continue
@@ -182,9 +182,9 @@ def logout_all_clients(self, sid):
182182
bc_logouts[_client_id] = _spec
183183
break
184184
elif "frontchannel_logout_uri" in _cdb[_client_id]:
185-
_cli = _mngr.get([_user_id, _client_id])
185+
_cli = _mngr.get(_path)
186186
for gid in _cli.subordinate:
187-
grant = _mngr.get([_user_id, _client_id, gid])
187+
grant = _mngr.get(_mngr.unpack_branch_key(gid))
188188
# Has to be connected to an authentication event
189189
if not grant.authentication_event:
190190
continue
@@ -324,7 +324,7 @@ def process_request(
324324
)
325325

326326
payload = {
327-
"sid": _session_info["session_id"],
327+
"sid": _session_info["branch_id"],
328328
}
329329

330330
# redirect user to OP logout verification page

‎src/idpyoidc/server/oidc/token_helper.py‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
107107
token = self._mint_token(
108108
token_class="access_token",
109109
grant=grant,
110-
session_id=_session_info["session_id"],
110+
session_id=_session_info["branch_id"],
111111
client_id=_session_info["client_id"],
112112
based_on=_based_on,
113113
token_type=token_type,
@@ -128,7 +128,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
128128
refresh_token = self._mint_token(
129129
token_class="refresh_token",
130130
grant=grant,
131-
session_id=_session_info["session_id"],
131+
session_id=_session_info["branch_id"],
132132
client_id=_session_info["client_id"],
133133
based_on=_based_on,
134134
)
@@ -138,15 +138,15 @@ def process_request(self, req: Union[Message, dict], **kwargs):
138138
_response["refresh_token"] = refresh_token.value
139139

140140
# since the grant content has changed. Make sure it's stored
141-
_mngr[_session_info["session_id"]] = grant
141+
_mngr[_session_info["branch_id"]] = grant
142142

143143
if "openid" in _authn_req["scope"] and "id_token" in _supports_minting:
144144
if "id_token" in _based_on.usage_rules.get("supports_minting"):
145145
try:
146146
_idtoken = self._mint_token(
147147
token_class="id_token",
148148
grant=grant,
149-
session_id=_session_info["session_id"],
149+
session_id=_session_info["branch_id"],
150150
client_id=_session_info["client_id"],
151151
based_on=_based_on,
152152
)
@@ -243,7 +243,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
243243
access_token = self._mint_token(
244244
token_class="access_token",
245245
grant=_grant,
246-
session_id=_session_info["session_id"],
246+
session_id=_session_info["branch_id"],
247247
client_id=_session_info["client_id"],
248248
based_on=token,
249249
scope=scope,
@@ -270,7 +270,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
270270
refresh_token = self._mint_token(
271271
token_class="refresh_token",
272272
grant=_grant,
273-
session_id=_session_info["session_id"],
273+
session_id=_session_info["branch_id"],
274274
client_id=_session_info["client_id"],
275275
based_on=token,
276276
scope=scope,
@@ -283,7 +283,7 @@ def process_request(self, req: Union[Message, dict], **kwargs):
283283
_idtoken = self._mint_token(
284284
token_class="id_token",
285285
grant=_grant,
286-
session_id=_session_info["session_id"],
286+
session_id=_session_info["branch_id"],
287287
client_id=_session_info["client_id"],
288288
based_on=token,
289289
scope=scope,

‎src/idpyoidc/server/oidc/userinfo.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,7 @@ def process_request(self, request=None, **kwargs):
150150
if allowed:
151151
_cntxt = self.server_get("endpoint_context")
152152
_claims_restriction = _cntxt.claims_interface.get_claims(
153-
_session_info["session_id"], scopes=token.scope, claims_release_point="userinfo"
153+
_session_info["branch_id"], scopes=token.scope, claims_release_point="userinfo"
154154
)
155155
info = _cntxt.claims_interface.get_user_claims(
156156
_session_info["user_id"], claims_restriction=_claims_restriction

0 commit comments

Comments
 (0)