Allow custom provider to override oauthlib valuesoauth-metadata

See https://github.com/oauthlib/oauthlib/pull/605#discussion_r234438151

2 files changed, 18 insertions, 6 deletions

diff --git a/oauthlib/oauth2/rfc6749/endpoints/metadata.py b/oauthlib/oauth2/rfc6749/endpoints/metadata.py
index 8c7699b..6d77b9f 100644
--- a/oauthlib/oauth2/rfc6749/endpoints/metadata.py
+++ b/oauthlib/oauth2/rfc6749/endpoints/metadata.py
@@ -89,8 +89,8 @@ class MetadataEndpoint(BaseEndpoint):
                     raise ValueError("array {}: {} must contains only string (not {})".format(key, array[key], elem))
 
     def validate_metadata_token(self, claims, endpoint):
-        claims["grant_types_supported"] = list(endpoint._grant_types.keys())
-        claims["token_endpoint_auth_methods_supported"] = ["client_secret_post", "client_secret_basic"]
+        claims.setdefault("grant_types_supported", list(endpoint._grant_types.keys()))
+        claims.setdefault("token_endpoint_auth_methods_supported", ["client_secret_post", "client_secret_basic"])
 
         self.validate_metadata(claims, "grant_types_supported", is_list=True)
         self.validate_metadata(claims, "token_endpoint_auth_methods_supported", is_list=True)
@@ -98,8 +98,8 @@ class MetadataEndpoint(BaseEndpoint):
         self.validate_metadata(claims, "token_endpoint", is_required=True, is_url=True)
 
     def validate_metadata_authorization(self, claims, endpoint):
-        claims["response_types_supported"] = list(self._response_types.keys())
-        claims["response_modes_supported"] = ["query", "fragment"]
+        claims.setdefault("response_types_supported", list(self._response_types.keys()))
+        claims.setdefault("response_modes_supported", ["query", "fragment"])
 
         self.validate_metadata(claims, "response_types_supported", is_required=True, is_list=True)
         self.validate_metadata(claims, "response_modes_supported", is_list=True)
@@ -108,14 +108,16 @@ class MetadataEndpoint(BaseEndpoint):
         self.validate_metadata(claims, "authorization_endpoint", is_required=True, is_url=True)
 
     def validate_metadata_revocation(self, claims, endpoint):
-        claims["revocation_endpoint_auth_methods_supported"] = ["client_secret_post", "client_secret_basic"]
+        claims.setdefault("revocation_endpoint_auth_methods_supported",
+                          ["client_secret_post", "client_secret_basic"])
 
         self.validate_metadata(claims, "revocation_endpoint_auth_methods_supported", is_list=True)
         self.validate_metadata(claims, "revocation_endpoint_auth_signing_alg_values_supported", is_list=True)
         self.validate_metadata(claims, "revocation_endpoint", is_required=True, is_url=True)
 
     def validate_metadata_introspection(self, claims, endpoint):
-        claims["introspection_endpoint_auth_methods_supported"] = ["client_secret_post", "client_secret_basic"]
+        claims.setdefault("introspection_endpoint_auth_methods_supported",
+                          ["client_secret_post", "client_secret_basic"])
 
         self.validate_metadata(claims, "introspection_endpoint_auth_methods_supported", is_list=True)
         self.validate_metadata(claims, "introspection_endpoint_auth_signing_alg_values_supported", is_list=True)
diff --git a/tests/oauth2/rfc6749/endpoints/test_metadata.py b/tests/oauth2/rfc6749/endpoints/test_metadata.py
index a07ba63..301e846 100644
--- a/tests/oauth2/rfc6749/endpoints/test_metadata.py
+++ b/tests/oauth2/rfc6749/endpoints/test_metadata.py
@@ -22,6 +22,16 @@ class MetadataEndpointTest(TestCase):
         self.assertIn("grant_types_supported", metadata.claims)
         self.assertEqual(metadata.claims["grant_types_supported"], ["password"])
 
+    def test_token_endpoint_overridden(self):
+        endpoint = TokenEndpoint(None, None, grant_types={"password": None})
+        metadata = MetadataEndpoint([endpoint], {
+            "issuer": 'https://foo.bar',
+            "token_endpoint": "https://foo.bar/token",
+            "grant_types_supported": ["pass_word_special_provider"]
+        })
+        self.assertIn("grant_types_supported", metadata.claims)
+        self.assertEqual(metadata.claims["grant_types_supported"], ["pass_word_special_provider"])
+
     def test_mandatory_fields(self):
         metadata = MetadataEndpoint([], self.metadata)
         self.assertIn("issuer", metadata.claims)