Disable certain functionalities in RemoteOAuth2Mixin
- Lingua principale
- Python
- Stelle
- 459
- Fork
- 223
- Merge medio
- 8h 57m
- PR unite (30g)
- 13
Descrizione
When using RemoteOAuth2Mixin, all `/token` calls are delegated to another process or server. Thus:
- The `client_id` and `client_secret` shouldn't be required. In fact, they perhaps shouldn't even be allowed to be passed. Clients that need to do remote auth should be discouraged from having any of their credentials hard-coded, especially since they aren't even needed.
- `store_tokens` should perhaps be disallowed. Since the tokens are owned by the remote process, it should be in control of where its tokens go. If a client needs to restart, it should get its tokens from the remote process/server, not from its own token store.
- `box_device_id` and `box_device_name` are useless if we're not making `/token` calls.
- `refresh_token` should never be available to the client, so it shouldn't be possible to pass this.
Also, since the remote process/server owns the tokens, we should possibly disable `revoke()`. If we do that, then:
- We definitely don't need `client_id` and `client_secret` anymore, since they would never be used.
- For the same reason, we also don't need `network_layer` anymore.
- We might not need `refresh_lock` anymore. Presumably, the remote server can handle its own locking, without the clients needing to coordinate.
`revoke` could be made to `pass` (`DeveloperTokenAuth` does this) or `raise`, and the unneeded constructor arguments can be passed as `None` to the super-class, so that `TypeError` is raised if a user tries passing any of them.
Alternatively, factor this into #173, and create a common base-class that doesn't have any of these functionalities.
This would be a breaking change, so consider this for 2.0.0.
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Inizia leggendo RemoteOAuth2Mixin e DeveloperTokenAuth, quindi esamina la proposta di base comune nell’issue #173. Stabilisci se revoke() e le opzioni del costruttore elencate debbano essere disabilitate o rimosse, e definisci il comportamento previsto per le breaking change nella release 2.0.0.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- python
- Ambito
- api, authentication, security
- Tipo di issue
- Refactoring
- Difficoltà
- 5/5
- Tempo stimato
- Più di una settimana
- Stato di attività
- Ferma
- Chiarezza
- Da chiarire
- Idoneità per principianti
- 25/100