Class SameDeviceLoginTokenFetcher

awscli/customizations/login/utils.py:209–263

Logs in using OAuth's auth code and PKCE flow, intended for when the user is on a device with a web browser and the ability to initialize the callback server

class SameDeviceLoginTokenFetcher(BaseLoginTokenFetcher):
    """
    Logs in using OAuth's auth code and PKCE flow,
    intended for when the user is on a device with a web browser and the
    ability to initialize the callback server
    """

    def __init__(
        self,
        client,
        auth_code_fetcher,
        on_pending_authorization,
        private_key=None,
        base_uri_builder=None,
    ):
        super().__init__(
            client,
            on_pending_authorization,
            private_key=private_key,
            base_uri_builder=base_uri_builder,
        )
        self._auth_code_fetcher = auth_code_fetcher

    def fetch_token(self):
        register_feature_id('LOGIN_SAME_DEVICE')
        authorization_uri = self._get_authorization_uri(
            client_id=CLIENT_ID[LoginType.SAME_DEVICE],
            redirect_uri=self._auth_code_fetcher.redirect_uri_with_port(),
            expected_state=self._expected_state,
            code_challenge=self._code_challenge,
        )

        # Open/display the link, then block until the redirect uri is hit
        self._on_pending_authorization(
            **self._get_browser_handler_args(authorization_uri)
        )
        auth_code, state = self._auth_code_fetcher.get_auth_code_and_state()

        if auth_code is None:
            raise LoginAuthorizationCodeError(
                error_msg='Failed to retrieve an authorization code.'
            )

        # The state we get back from the redirect is just a string, so
        # cast our original UUID before comparing
        if state != str(self._expected_state):
            raise LoginAuthorizationCodeError(
                error_msg=f'State parameter {state} does not match expected value {self._expected_state}.'
            )

        return self._exchange_auth_code_for_access_token(
            client_id=CLIENT_ID[LoginType.SAME_DEVICE],
            auth_code=auth_code,
            redirect_uri=self._auth_code_fetcher.redirect_uri_with_port(),
        )


class CrossDeviceLoginTokenFetcher(BaseLoginTokenFetcher):