o b@s<ddlmZddlmZddlmZmZGdddeZdS))default_json_headers) TokenEndpoint)InvalidRequestErrorUnsupportedTokenTypeErrorc@s4eZdZdZdZddZddZddZd d Zd S) RevocationEndpointzImplementation of revocation endpoint which is described in `RFC7009`_. .. _RFC7009: https://tools.ietf.org/html/rfc7009 Z revocationcCsDd|jvrt|jd}|r||jvrt||jd||S)aThe client constructs the request by including the following parameters using the "application/x-www-form-urlencoded" format in the HTTP request entity-body: token REQUIRED. The token that the client wants to get revoked. token_type_hint OPTIONAL. A hint about the type of the token submitted for revocation. tokentoken_type_hint)formrgetZSUPPORTED_TOKEN_TYPESr query_token)selfrequestclient token_typer`/var/www/secure340b-portal/env/lib/python3.10/site-packages/authlib/oauth2/rfc7009/revocation.py authenticate_endpoint_credentials  z3RevocationEndpoint.authenticate_endpoint_credentialcCs@||}|||}|r|||jjd||dditfS)aValidate revocation request and create the response for revocation. For example, a client may request the revocation of a refresh token with the following request:: POST /revoke HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW token=45ghiukldjahdnhzdauz&token_type_hint=refresh_token :returns: (status_code, body, headers) Zafter_revoke_token)rr)Zauthenticate_endpoint_clientr revoke_tokenserver send_signalr)r rrZ credentialrrrcreate_endpoint_response&s    z+RevocationEndpoint.create_endpoint_responsecCt)adGet the token from database/storage by the given token string. Developers should implement this method:: def query_token(self, token, token_type_hint, client): if token_type_hint == 'access_token': return Token.query_by_access_token(token, client.client_id) if token_type_hint == 'refresh_token': return Token.query_by_refresh_token(token, client.client_id) return Token.query_by_access_token(token, client.client_id) or Token.query_by_refresh_token(token, client.client_id) NotImplementedError)r rr rrrrr Es zRevocationEndpoint.query_tokencCr)aMark token as revoked. Since token MUST be unique, it would be dangerous to delete it. Consider this situation: 1. Jane obtained a token XYZ 2. Jane revoked (deleted) token XYZ 3. Bob generated a new token XYZ 4. Jane can use XYZ to access Bob's resource It would be secure to mark a token as revoked:: def revoke_token(self, token): token.revoked = True token.save() r)r rrrrrSszRevocationEndpoint.revoke_tokenN) __name__ __module__ __qualname____doc__Z ENDPOINT_NAMErrr rrrrrr s rN)Zauthlib.constsrZrfc6749rrrrrrrrs