authentik/passbook/providers/oauth2/errors.py

"""OAuth errors"""
from urllib.parse import quote


class OAuth2Error(Exception):
    """Base class for all OAuth2 Errors"""

    error: str
    description: str

    def create_dict(self):
        """Return error as dict for JSON Rendering"""
        return {
            "error": self.error,
            "error_description": self.description,
        }

    def __repr__(self) -> str:
        return self.error


class RedirectUriError(OAuth2Error):
    """The request fails due to a missing, invalid, or mismatching
    redirection URI (redirect_uri)."""

    error = "Redirect URI Error"
    description = (
        "The request fails due to a missing, invalid, or mismatching"
        " redirection URI (redirect_uri)."
    )


class ClientIdError(OAuth2Error):
    """The client identifier (client_id) is missing or invalid."""

    error = "Client ID Error"
    description = "The client identifier (client_id) is missing or invalid."


class UserAuthError(OAuth2Error):
    """
    Specific to the Resource Owner Password Credentials flow when
    the Resource Owners credentials are not valid.
    """

    error = "access_denied"
    description = "The resource owner or authorization server denied the request."


class TokenIntrospectionError(OAuth2Error):
    """
    Specific to the introspection endpoint. This error will be converted
    to an "active: false" response, as per the spec.
    See https://tools.ietf.org/html/rfc7662
    """


class AuthorizeError(OAuth2Error):
    """General Authorization Errors"""

    _errors = {
        # OAuth2 errors.
        # https://tools.ietf.org/html/rfc6749#section-4.1.2.1
        "invalid_request": "The request is otherwise malformed",
        "unauthorized_client": "The client is not authorized to request an "
        "authorization code using this method",
        "access_denied": "The resource owner or authorization server denied "
        "the request",
        "unsupported_response_type": "The authorization server does not "
        "support obtaining an authorization code "
        "using this method",
        "invalid_scope": "The requested scope is invalid, unknown, or " "malformed",
        "server_error": "The authorization server encountered an error",
        "temporarily_unavailable": "The authorization server is currently "
        "unable to handle the request due to a "
        "temporary overloading or maintenance of "
        "the server",
        # OpenID errors.
        # http://openid.net/specs/openid-connect-core-1_0.html#AuthError
        "interaction_required": "The Authorization Server requires End-User "
        "interaction of some form to proceed",
        "login_required": "The Authorization Server requires End-User "
        "authentication",
        "account_selection_required": "The End-User is required to select a "
        "session at the Authorization Server",
        "consent_required": "The Authorization Server requires End-User" "consent",
        "invalid_request_uri": "The request_uri in the Authorization Request "
        "returns an error or contains invalid data",
        "invalid_request_object": "The request parameter contains an invalid "
        "Request Object",
        "request_not_supported": "The provider does not support use of the "
        "request parameter",
        "request_uri_not_supported": "The provider does not support use of the "
        "request_uri parameter",
        "registration_not_supported": "The provider does not support use of "
        "the registration parameter",
    }

    def __init__(self, redirect_uri, error, grant_type):
        super().__init__()
        self.error = error
        self.description = self._errors[error]
        self.redirect_uri = redirect_uri
        self.grant_type = grant_type

    def create_uri(self, redirect_uri: str, state: str) -> str:
        """Get a redirect URI with the error message"""
        description = quote(str(self.description))

        # See:
        # http://openid.net/specs/openid-connect-core-1_0.html#ImplicitAuthError
        hash_or_question = "#" if self.grant_type == "implicit" else "?"

        uri = "{0}{1}error={2}&error_description={3}".format(
            redirect_uri, hash_or_question, self.error, description
        )

        # Add state if present.
        uri = uri + ("&state={0}".format(state) if state else "")

        return uri


class TokenError(OAuth2Error):
    """
    OAuth2 token endpoint errors.
    https://tools.ietf.org/html/rfc6749#section-5.2
    """

    _errors = {
        "invalid_request": "The request is otherwise malformed",
        "invalid_client": "Client authentication failed (e.g., unknown client, "
        "no client authentication included, or unsupported "
        "authentication method)",
        "invalid_grant": "The provided authorization grant or refresh token is "
        "invalid, expired, revoked, does not match the "
        "redirection URI used in the authorization request, "
        "or was issued to another client",
        "unauthorized_client": "The authenticated client is not authorized to "
        "use this authorization grant type",
        "unsupported_grant_type": "The authorization grant type is not "
        "supported by the authorization server",
        "invalid_scope": "The requested scope is invalid, unknown, malformed, "
        "or exceeds the scope granted by the resource owner",
    }

    def __init__(self, error):
        super().__init__()
        self.error = error
        self.description = self._errors[error]


class BearerTokenError(OAuth2Error):
    """
    OAuth2 errors.
    https://tools.ietf.org/html/rfc6750#section-3.1
    """

    _errors = {
        "invalid_request": ("The request is otherwise malformed", 400),
        "invalid_token": (
            "The access token provided is expired, revoked, malformed, "
            "or invalid for other reasons",
            401,
        ),
        "insufficient_scope": (
            "The request requires higher privileges than provided by "
            "the access token",
            403,
        ),
    }

    def __init__(self, code):
        super().__init__()
        self.code = code
        error_tuple = self._errors.get(code, ("", ""))
        self.description = error_tuple[0]
        self.status = error_tuple[1]