first commit

2026-09-14 23:22:10 +09:00
commit 9f9c8fb69b
4207 changed files with 1333187 additions and 0 deletions
@@ -0,0 +1,57 @@
+"""Client metadata for OpenID Connect RP-Initiated Logout 1.0.
+
+https://openid.net/specs/openid-connect-rpinitiated-1_0.html
+"""
+
+from joserfc.errors import InvalidClaimError
+
+from authlib.common.security import is_secure_transport
+from authlib.common.urls import is_valid_url
+from authlib.oauth2.claims import BaseClaims
+
+
+class ClientMetadataClaims(BaseClaims):
+    """Client metadata for OpenID Connect RP-Initiated Logout 1.0.
+
+    This can be used with :ref:`specs/rfc7591` and :ref:`specs/rfc7592` endpoints::
+
+        server.register_endpoint(
+            ClientRegistrationEndpoint(
+                claims_classes=[
+                    rfc7591.ClientMetadataClaims,
+                    oidc.registration.ClientMetadataClaims,
+                    oidc.rpinitiated.ClientMetadataClaims,
+                ]
+            )
+        )
+    """
+
+    REGISTERED_CLAIMS = [
+        "post_logout_redirect_uris",
+    ]
+
+    def validate(self, now=None, leeway=0):
+        super().validate(now, leeway)
+        self._validate_post_logout_redirect_uris()
+
+    def _validate_post_logout_redirect_uris(self):
+        # rpinitiated §3.1: "post_logout_redirect_uris - Array of URLs supplied
+        # by the RP to which it MAY request that the End-User's User Agent be
+        # redirected using the post_logout_redirect_uri parameter after a
+        # logout has been performed. These URLs SHOULD use the https scheme
+        # [...]; however, they MAY use the http scheme, provided that the
+        # Client Type is confidential."
+        uris = self.get("post_logout_redirect_uris")
+        if not uris:
+            return
+
+        is_public = self.get("token_endpoint_auth_method") == "none"
+
+        for uri in uris:
+            if not is_valid_url(uri):
+                raise InvalidClaimError("post_logout_redirect_uris")
+
+            if is_public and not is_secure_transport(uri):
+                raise ValueError(
+                    '"post_logout_redirect_uris" MUST use "https" scheme for public clients'
+                )