feat: Private JWT CA support for passwordless - #158
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| "client_secret": client._client_secret, | ||
| "connection": options.connection, | ||
| } | ||
| client._apply_client_authentication(body, f"https://{origin_domain}/", in_body=True) |
There was a problem hiding this comment.
Both this call and the one in verify() go through _apply_client_authentication unconditionally, so a client with no secret and no signing key now hits the ConfigurationError the helper raises. Passkey signin guards the same call with a check for a configured secret or key first, because it allows public clients. Before this change, start sent client_secret as None and still reached Auth0.
If passwordless is meant to always require a confidential client, this is the right behavior and worth a line in the docstring saying so. If public clients should still work here, shall we wrap the call the way passkey does? Either way it reads better as a deliberate choice than as a side effect of the helper.
| "client_secret": client._client_secret, | ||
| "connection": options.connection, | ||
| } | ||
| client._apply_client_authentication(body, f"https://{origin_domain}/", in_body=True) |
There was a problem hiding this comment.
The assertion audience here is built as https://{origin_domain}/, while verify() and the other token calls prefer the discovery issuer and fall back to that. start() has no discovery lookup so it can't read the issuer, and for a standard tenant the two come out the same. Just flagging the difference so it's a known choice.
| assert claims["sub"] == CLIENT_ID | ||
|
|
||
| @pytest.mark.asyncio | ||
| async def test_start_no_client_auth_configured_raises_configuration_error(self): |
There was a problem hiding this comment.
This pins the no-auth-configured path for start(), but verify() takes the same new ConfigurationError path and has no equivalent test. The verify assertion test above also doesn't check that a secret-configured client puts client_secret in the body. This test is copyable for both.
| # ── Private Key JWT (client assertion) client authentication ──────────────── | ||
|
|
||
|
|
||
| def _generate_rsa_private_key_pem() -> str: |
There was a problem hiding this comment.
Optional, and not really about this PR: these two key helpers are copied from test_server_client.py where the same definitions already live. There's no shared test-helpers module yet, so this is the third copy floating around. Might be worth pulling them into a conftest fixture at some point so they don't drift.
3 participants
Changed
PasswordlessClient.start()PasswordlessClient.verify()resolved domain.
Testing
Tested via usual Passwordless flow as described in #153