first commit

.venv/Lib/site-packages/authlib/oauth2/rfc9207/__init__.py

@@ -0,0 +1,4 @@
+from .discovery import AuthorizationServerMetadata
+from .parameter import IssuerParameter
+
+__all__ = ["AuthorizationServerMetadata", "IssuerParameter"]

.venv/Lib/site-packages/authlib/oauth2/rfc9207/discovery.py

@@ -0,0 +1,25 @@
+from authlib.oauth2.rfc8414.models import validate_boolean_value
+
+
+class AuthorizationServerMetadata(dict):
+    """Authorization Server Metadata extension for RFC9207.
+
+    This class can be used with
+    :meth:`~authlib.oauth2.rfc8414.AuthorizationServerMetadata.validate`
+    to validate RFC9207-specific metadata::
+
+        from authlib.oauth2 import rfc8414, rfc9207
+
+        metadata = rfc8414.AuthorizationServerMetadata(data)
+        metadata.validate(metadata_classes=[rfc9207.AuthorizationServerMetadata])
+    """
+
+    REGISTRY_KEYS = ["authorization_response_iss_parameter_supported"]
+
+    def validate_authorization_response_iss_parameter_supported(self):
+        """Boolean parameter indicating whether the authorization server
+        provides the iss parameter in the authorization response.
+
+        If omitted, the default value is false.
+        """
+        validate_boolean_value(self, "authorization_response_iss_parameter_supported")

.venv/Lib/site-packages/authlib/oauth2/rfc9207/parameter.py

@@ -0,0 +1,43 @@
+from authlib.common.urls import add_params_to_uri
+from authlib.deprecate import deprecate
+from authlib.oauth2.rfc6749.grants import BaseGrant
+
+
+class IssuerParameter:
+    def __call__(self, authorization_server):
+        if isinstance(authorization_server, BaseGrant):
+            deprecate(
+                "IssueParameter should be used as an authorization server extension with 'authorization_server.register_extension(IssueParameter())'.",
+                version="1.8",
+            )
+            authorization_server.register_hook(
+                "after_authorization_response",
+                self.add_issuer_parameter,
+            )
+
+        else:
+            authorization_server.register_hook(
+                "after_create_authorization_response",
+                self.add_issuer_parameter,
+            )
+
+    def add_issuer_parameter(self, authorization_server, response):
+        if self.get_issuer() and response.location:
+            # RFC9207 §2
+            # In authorization responses to the client, including error responses,
+            # an authorization server supporting this specification MUST indicate
+            # its identity by including the iss parameter in the response.
+
+            new_location = add_params_to_uri(
+                response.location, {"iss": self.get_issuer()}
+            )
+            response.location = new_location
+
+    def get_issuer(self) -> str | None:
+        """Return the issuer URL.
+        Developers MAY implement this method if they want to support :rfc:`RFC9207 <9207>`::
+
+            def get_issuer(self) -> str:
+                return "https://auth.example.org"
+        """
+        return None