From 3ed13c7e3ce2b9d8e5e66776ceb6487c88303f7a Mon Sep 17 00:00:00 2001 From: David Muller Date: Mon, 29 Sep 2014 13:57:50 -0700 Subject: Add refresh_token keyword arg --- .../oauth2/rfc6749/grant_types/resource_owner_password_credentials.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py b/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py index f1e3dd5..c5b1693 100644 --- a/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py +++ b/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py @@ -70,8 +70,9 @@ class ResourceOwnerPasswordCredentialsGrant(GrantTypeBase): .. _`Resource Owner Password Credentials Grant`: http://tools.ietf.org/html/rfc6749#section-4.3 """ - def __init__(self, request_validator=None): + def __init__(self, request_validator=None, refresh_token=True): self.request_validator = request_validator or RequestValidator() + self.refresh_token = refresh_token def create_token_response(self, request, token_handler): """Return token or error in json format. -- cgit v1.2.1 From ae21c1f92aed9f6d0e589cafe3dcdc86fe692d6b Mon Sep 17 00:00:00 2001 From: David Muller Date: Mon, 29 Sep 2014 13:58:39 -0700 Subject: create/don't create refresh_token based on self.refresh_token --- .../oauth2/rfc6749/grant_types/resource_owner_password_credentials.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py b/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py index c5b1693..fb3d12a 100644 --- a/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py +++ b/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py @@ -106,7 +106,7 @@ class ResourceOwnerPasswordCredentialsGrant(GrantTypeBase): log.debug('Client error in token request, %s.', e) return headers, e.json, e.status_code - token = token_handler.create_token(request, refresh_token=True) + token = token_handler.create_token(request, self.refresh_token) log.debug('Issuing token %r to client id %r (%r) and username %s.', token, request.client_id, request.client, request.username) return headers, json.dumps(token), 200 -- cgit v1.2.1 From 6dee915acf998c5fbc18d7a342dc9ca570127dfa Mon Sep 17 00:00:00 2001 From: David Muller Date: Mon, 29 Sep 2014 14:08:48 -0700 Subject: Test ResourceOwnerPasswordCredentialsGrant generates no refresh token --- .../grant_types/test_resource_owner_password.py | 26 ++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/tests/oauth2/rfc6749/grant_types/test_resource_owner_password.py b/tests/oauth2/rfc6749/grant_types/test_resource_owner_password.py index eeb13c1..dad668b 100644 --- a/tests/oauth2/rfc6749/grant_types/test_resource_owner_password.py +++ b/tests/oauth2/rfc6749/grant_types/test_resource_owner_password.py @@ -52,6 +52,32 @@ class ResourceOwnerPasswordCredentialsGrantTest(TestCase): status_code = self.auth.create_token_response(self.request, bearer)[2] self.assertEqual(status_code, 401) + def test_create_token_response_without_refresh_token(self): + # self.auth.refresh_token = False so we don't generate a refresh token + self.auth = ResourceOwnerPasswordCredentialsGrant( + request_validator=self.mock_validator, refresh_token=False) + bearer = BearerToken(self.mock_validator) + headers, body, status_code = self.auth.create_token_response( + self.request, bearer) + token = json.loads(body) + self.assertIn('access_token', token) + self.assertIn('token_type', token) + self.assertIn('expires_in', token) + # ensure no refresh token is generated + self.assertNotIn('refresh_token', token) + # ensure client_authentication_required() is properly called + self.mock_validator.client_authentication_required.assert_called_once_with(self.request) + # fail client authentication + self.mock_validator.validate_user.return_value = True + self.mock_validator.authenticate_client.return_value = False + status_code = self.auth.create_token_response(self.request, bearer)[2] + self.assertEqual(status_code, 401) + # mock client_authentication_required() returning False then fail + self.mock_validator.client_authentication_required.return_value = False + self.mock_validator.authenticate_client_id.return_value = False + status_code = self.auth.create_token_response(self.request, bearer)[2] + self.assertEqual(status_code, 401) + def test_error_response(self): pass -- cgit v1.2.1 From 2e4e232ade206962b7979e7c0299d7ff0cd4ad41 Mon Sep 17 00:00:00 2001 From: David Muller Date: Mon, 29 Sep 2014 14:27:39 -0700 Subject: Add docstring for ResourceOwnerPasswordCredentialsGrant __init__ --- .../oauth2/rfc6749/grant_types/resource_owner_password_credentials.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py b/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py index fb3d12a..27df062 100644 --- a/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py +++ b/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py @@ -71,6 +71,10 @@ class ResourceOwnerPasswordCredentialsGrant(GrantTypeBase): """ def __init__(self, request_validator=None, refresh_token=True): + """ + If the refresh_token keyword argument is False, do not return + a refresh token in the response. + """ self.request_validator = request_validator or RequestValidator() self.refresh_token = refresh_token -- cgit v1.2.1