웹 반환 주소를 정확히 비교하는 작은 계약

"""Pure, deliberately narrow comparison contract; not an OAuth server."""
from dataclasses import dataclass
from urllib.parse import urlsplit


def _plain(value, limit=2048):
    return (isinstance(value, str) and 0 < len(value) <= limit
            and value.isascii() and all(32 < ord(c) < 127 for c in value))


def _configured_web_uri(value):
    if not _plain(value):
        return False
    try:
        p = urlsplit(value)
        return (p.scheme == 'https' and p.hostname is not None
                and p.netloc == p.hostname and p.path.startswith('/')
                and not p.query and not p.fragment
                and '?' not in value and '#' not in value
                and '%' not in value and '\\' not in value
                and all(part not in ('.', '..') for part in p.path.split('/')))
    except ValueError:
        return False


@dataclass(frozen=True)
class WebReturnPolicy:
    """Load only from trusted configuration, never from the current request.

    This example's configuration subset excludes query strings, fragments,
    ports, user information, Unicode and encoded path characters. This is
    narrower than the full set of valid OAuth redirect URI configurations.
    """
    client_id: str
    resource_id: str
    redirects: tuple[str, ...]

    def __post_init__(self):
        if not _plain(self.client_id, 128) or not _plain(self.resource_id, 128):
            raise ValueError('Invalid trusted binding label')
        if not isinstance(self.redirects, (tuple, list)):
            raise ValueError('Expected a configured sequence')
        values = tuple(self.redirects)
        if not 1 <= len(values) <= 4:
            raise ValueError('Expected one to four distinct configured URIs')
        if not all(_configured_web_uri(v) for v in values):
            raise ValueError('Configured URI outside this example subset')
        if len(set(values)) != len(values):
            raise ValueError('Expected distinct configured URIs')
        object.__setattr__(self, 'redirects', values)

    def compare(self, *, client_id, resource_id, redirect_uri):
        # No parsing, stripping, decoding or canonicalizing request values.
        client = isinstance(client_id, str) and client_id == self.client_id
        resource = isinstance(resource_id, str) and resource_id == self.resource_id
        callback = _plain(redirect_uri) and redirect_uri in self.redirects
        return {
            'contract_match': bool(client and resource and callback),
            'client_match': client,
            'resource_match': resource,
            'callback_match': callback,
            'consent_verified': False,
            'authenticated': False,
            'token_issued': False,
            'scope': 'Synthetic configured web-return comparison only',
        }