Disable certain functionalities in RemoteOAuth2Mixin

Aperta
#176 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Refactoring
Chiarezza
Da chiarire
Stato di attività
Ferma
Stack tecnologico
python
Ambito
api, authentication, security

Direzione di ricerca

Inizia leggendo RemoteOAuth2Mixin e DeveloperTokenAuth, quindi esamina la proposta di base comune nell’issue #173. Stabilisci se revoke() e le opzioni del costruttore elencate debbano essere disabilitate o rimosse, e definisci il comportamento previsto per le breaking change nella release 2.0.0.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

breaking enhancement

When using RemoteOAuth2Mixin, all /token calls are delegated to another process or server. Thus:

  • The client_id and client_secret shouldn't be required. In fact, they perhaps shouldn't even be allowed to be passed. Clients that need to do remote auth should be discouraged from having any of their credentials hard-coded, especially since they aren't even needed.
  • store_tokens should perhaps be disallowed. Since the tokens are owned by the remote process, it should be in control of where its tokens go. If a client needs to restart, it should get its tokens from the remote process/server, not from its own token store.
  • box_device_id and box_device_name are useless if we're not making /token calls.
  • refresh_token should never be available to the client, so it shouldn't be possible to pass this.

Also, since the remote process/server owns the tokens, we should possibly disable revoke(). If we do that, then:

  • We definitely don't need client_id and client_secret anymore, since they would never be used.
  • For the same reason, we also don't need network_layer anymore.
  • We might not need refresh_lock anymore. Presumably, the remote server can handle its own locking, without the clients needing to coordinate.

revoke could be made to pass (DeveloperTokenAuth does this) or raise, and the unneeded constructor arguments can be passed as None to the super-class, so that TypeError is raised if a user tries passing any of them.

Alternatively, factor this into #173, and create a common base-class that doesn't have any of these functionalities.

This would be a breaking change, so consider this for 2.0.0.

Lingua principale
Python
Stelle
460
Fork
223
Merge medio
14h 18m
PR unite (30g)
21

Guida per i contributori

Apri la guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di box/box-python-sdk

Tutte le issue di box/box-python-sdk

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.