coulomb/coulomb-social
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Register coulomb-social OIDC client on live KeyCape (CSOC-WP-0002-T03)

Browse source 
Public PKCE client on kc.coulomb.social with local and production redirect
URIs. Add register-keycape-client.sh, document env, and harden public-client
token exchange (no secret). Authorize probe verified registered vs reject.
This commit is contained in:
tegwick 2026-08-09 01:50:51 +02:00
parent 179b20ceed
commit 76ec8cfe41
7 changed files with 138 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

31
coulomb_social/apps/identity/oidc.py
View file

@ -35,18 +35,29 @@ def discovery_document() -> dict[str, Any]:
return resp.json()
def _oauth_client() -> OAuth2Client:
"""Public clients (KeyCape default for browser apps) use PKCE without a secret."""
secret = (settings.OIDC_CLIENT_SECRET or "").strip() or None
kwargs: dict[str, Any] = {
"client_id": settings.OIDC_CLIENT_ID,
"redirect_uri": settings.OIDC_REDIRECT_URI,
"scope": settings.OIDC_SCOPES,
"code_challenge_method": "S256",
}
if secret:
kwargs["client_secret"] = secret
else:
# Authlib: omit secret for public clients
kwargs["token_endpoint_auth_method"] = "none"
return OAuth2Client(**kwargs)
def build_authorization_url(*, state: str, code_verifier: str) -> str:
if not oidc_configured():
raise OIDCConfigurationError("OIDC is not enabled/configured")
doc = discovery_document()
auth_endpoint = doc["authorization_endpoint"]
client = OAuth2Client(
client_id=settings.OIDC_CLIENT_ID,
client_secret=settings.OIDC_CLIENT_SECRET or None,
redirect_uri=settings.OIDC_REDIRECT_URI,
scope=settings.OIDC_SCOPES,
code_challenge_method="S256",
)
client = _oauth_client()
uri, _ = client.create_authorization_url(
auth_endpoint,
state=state,
@ -58,11 +69,7 @@ def build_authorization_url(*, state: str, code_verifier: str) -> str:
def exchange_code(code: str, *, code_verifier: str) -> dict[str, Any]:
doc = discovery_document()
token_endpoint = doc["token_endpoint"]
client = OAuth2Client(
client_id=settings.OIDC_CLIENT_ID,
client_secret=settings.OIDC_CLIENT_SECRET or None,
redirect_uri=settings.OIDC_REDIRECT_URI,
)
client = _oauth_client()
token = client.fetch_token(
token_endpoint,
code=code,