tegwick
6cd89f0a7a
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
56 lines
2.3 KiB
Python
56 lines
2.3 KiB
Python
#!/usr/bin/env python3
|
|
"""Read-only native authorize checks; print no state, cookies or auth tokens."""
|
|
import base64
|
|
import hashlib
|
|
import json
|
|
import secrets
|
|
from urllib.error import HTTPError
|
|
from urllib.parse import urlencode, urlsplit
|
|
from urllib.request import HTTPRedirectHandler, build_opener
|
|
|
|
|
|
class NoRedirect(HTTPRedirectHandler):
|
|
def redirect_request(self, req, fp, code, msg, headers, newurl):
|
|
return None
|
|
|
|
|
|
def verify():
|
|
opener = build_opener(NoRedirect)
|
|
base = {
|
|
"client_id": "user-engine-portal", "response_type": "code",
|
|
"redirect_uri": "https://users.92-205-62-239.nip.io/oidc/callback",
|
|
"scope": "openid profile email groups", "state": secrets.token_urlsafe(24),
|
|
"code_challenge": base64.urlsafe_b64encode(
|
|
hashlib.sha256(secrets.token_bytes(32)).digest()
|
|
).rstrip(b"=").decode(), "code_challenge_method": "S256",
|
|
}
|
|
results = []
|
|
for name in ("valid", "wrong_callback", "missing_pkce"):
|
|
params = dict(base)
|
|
if name == "wrong_callback":
|
|
params["redirect_uri"] = "https://invalid.example/oidc/callback"
|
|
if name == "missing_pkce":
|
|
params.pop("code_challenge")
|
|
params.pop("code_challenge_method")
|
|
try:
|
|
response = opener.open("https://kc.coulomb.social/authorize?" + urlencode(params), timeout=20)
|
|
except HTTPError as error:
|
|
response = error
|
|
with response:
|
|
row = {"check": name, "status": response.code}
|
|
if name == "valid":
|
|
location = urlsplit(response.headers.get("Location", ""))
|
|
row["redirect_origin"] = location.scheme + "://" + location.netloc
|
|
row["passed"] = response.code == 302 and row["redirect_origin"] == "https://auth.coulomb.social"
|
|
else:
|
|
body = json.loads(response.read(4096))
|
|
row.update(error=body.get("error"), feature=body.get("feature"))
|
|
expected = "redirect_uri" if name == "wrong_callback" else "missing_pkce"
|
|
row["passed"] = response.code == 400 and row["error"] == "invalid_profile_usage" and row["feature"] == expected
|
|
results.append(row)
|
|
print(json.dumps(results, indent=2))
|
|
return all(row["passed"] for row in results)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(0 if verify() else 1)
|