coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use KeyCape client-secret Basic authentication for requester exchange

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-04 23:40:38 +02:00
parent 929f6cdff6
commit 03f18d8258
2 changed files with 27 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
informed_decision/requester.py
View file

@ -3,8 +3,9 @@
No access token or credential cache, environment delivery, refresh grant or
browser identity. Public issuer endpoints and claims are pinned locally.
"""
import base64
from pathlib import Path
from urllib.parse import urlencode
from urllib.parse import urlencode, quote_plus
import time
import jwt
@ -36,10 +37,14 @@ class RequesterTokenProvider:
secret = raw.decode("ascii")
if not secret or len(raw) > 4096 or any(c.isspace() for c in secret):
raise ValueError()
credentials = base64.b64encode(
(quote_plus(CLIENT_ID) + ":" + quote_plus(secret)).encode("ascii")
).decode("ascii")
status, result = self.transport.request("POST", self.issuer + "/token",
headers={"Content-Type": "application/x-www-form-urlencoded"},
body=urlencode({"grant_type": "client_credentials", "client_id": CLIENT_ID,
"client_secret": secret, "scope": "approval:create"}).encode())
headers={"Content-Type": "application/x-www-form-urlencoded",
"Authorization": "Basic " + credentials},
body=urlencode({"grant_type": "client_credentials",
"scope": "approval:create"}).encode())
if (status != 200 or not isinstance(result.get("token_type"), str)
or result["token_type"].lower() != "bearer"
or "refresh_token" in result):