mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-10-14 18:07:58 +00:00
d303739228
1. JWKS fetch/parse errors now wrapped as OidcError instead of escaping as raw exceptions. Transient network failures, HTTP errors, and bad JSON responses from the JWKS endpoint all produce a controlled OidcError, which the callback route already redirects to /login?error=oidc_failed instead of a 500. 2. exchange_code() now extracts the stored redirect_uri from the Fernet-encrypted state token and rejects any callback-derived redirect_uri that differs. The token exchange POSTs the stored value — the one the IdP saw in the authorization request — removing the last callback dependence on request-derived URI behaviour. Tests: 5 new (3 JWKS error wrapping + 2 redirect_uri binding) Total: 130 passing (81 OIDC + 49 regression), 0 failures. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| atomic_io.py | ||
| auth.py | ||
| constants.py | ||
| database.py | ||
| exceptions.py | ||
| log_safety.py | ||
| middleware.py | ||
| models.py | ||
| oidc.py | ||
| platform_compat.py | ||
| session_manager.py | ||