Class AuthFlow

dwave/cloud/auth/flows.py:47–289

`OAuth 2.0 Authorization Code`_ exchange flow with `PKCE`_ extension for public (secretless) clients. Args: client_id: OAuth 2.0 Client ID. scopes: List of requested scopes. redirect_uri: Redirect URI that was registered as callbac

class AuthFlow:
    """`OAuth 2.0 Authorization Code`_ exchange flow with `PKCE`_ extension
    for public (secretless) clients.

    Args:
        client_id:
            OAuth 2.0 Client ID.
        scopes:
            List of requested scopes.
        redirect_uri:
            Redirect URI that was registered as callback for client identified
            with ``client_id``.
        authorization_endpoint:
            URL of the authorization server's authorization endpoint.
        token_endpoint:
            URL of the authorization server's token endpoint.
        revocation_endpoint:
            URL of the authorization server's OAuth 2.0 revocation endpoint.
        session_config:
            Configuration options for the low-level ``requests.Session`` used
            for all OAuth 2 requests. Supported options are: ``cert``,
            ``cookies``, ``headers``, ``proxies``, ``timeout``, ``verify``.
        leap_api_endpoint:
            Leap API endpoint, optional. Used to scope the token in credentials
            store.
        creds:
            :class:`~dwave.cloud.auth.creds.Credentials` store used to persist
            the token fetched.

    .. _OAuth 2.0 Authorization Code:
        https://datatracker.ietf.org/doc/html/rfc6749#section-4.1
    .. _PKCE:
        https://datatracker.ietf.org/doc/html/rfc7636
    """

    def __init__(self, *,
                 client_id: str,
                 scopes: abc.Sequence[str],
                 redirect_uri: str,
                 authorization_endpoint: str,
                 token_endpoint: str,
                 revocation_endpoint: Optional[str] = None,
                 session_config: Optional[abc.Mapping[str, Any]] = None,
                 leap_api_endpoint: Optional[str] = None,
                 creds: Optional[Credentials] = None
                 ):
        self.client_id = client_id
        self.scopes = ' '.join(scopes)
        self.authorization_endpoint = authorization_endpoint
        self.token_endpoint = token_endpoint
        self.revocation_endpoint = revocation_endpoint
        self.leap_api_endpoint = leap_api_endpoint
        self.creds = creds

        # TODO: verify authorization/token/revocation endpoints are https

        self.session = OAuth2Session(
            client_id=client_id, scope=scopes, redirect_uri=redirect_uri,