Skip to content

Commit 239e81e

Browse files
kishore7snehilkishore7snehil
authored
Merge branch 'master' into fix-codecov-issue
Signed-off-by: Snehil Kishore <[email protected]>
2 parents faf522e + 6ef05d4 commit 239e81e

File tree

16 files changed

+1294
-692
lines changed

16 files changed

+1294
-692
lines changed

‎.github/actions/rl-scanner/action.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: "Reversing Labs Scanner"
2+
description: "Runs the Reversing Labs scanner on a specified artifact."
3+
inputs:
4+
artifact-path:
5+
description: "Path to the artifact to be scanned."
6+
required: true
7+
version:
8+
description: "Version of the artifact."
9+
required: true
10+
11+
runs:
12+
using: "composite"
13+
steps:
14+
- name: Set up Python
15+
uses: actions/setup-python@v4
16+
with:
17+
python-version: "3.10"
18+
19+
- name: Install Python dependencies
20+
shell: bash
21+
run: |
22+
pip install boto3 requests
23+
24+
- name: Configure AWS credentials
25+
uses: aws-actions/configure-aws-credentials@v1
26+
with:
27+
role-to-assume: ${{ env.PRODSEC_TOOLS_ARN }}
28+
aws-region: us-east-1
29+
mask-aws-account-id: true
30+
31+
- name: Install RL Wrapper
32+
shell: bash
33+
run: |
34+
pip install rl-wrapper>=1.0.0 --index-url "https://${{ env.PRODSEC_TOOLS_USER }}:${{ env.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
35+
36+
- name: Run RL Scanner
37+
shell: bash
38+
env:
39+
RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }}
40+
RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }}
41+
SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }}
42+
PYTHONUNBUFFERED: 1
43+
run: |
44+
if [ ! -f "${{ inputs.artifact-path }}" ]; then
45+
echo "Artifact not found: ${{ inputs.artifact-path }}"
46+
exit 1
47+
fi
48+
49+
rl-wrapper \
50+
--artifact "${{ inputs.artifact-path }}" \
51+
--name "${{ github.event.repository.name }}" \
52+
--version "${{ inputs.version }}" \
53+
--repository "${{ github.repository }}" \
54+
--commit "${{ github.sha }}" \
55+
--build-env "github_actions" \
56+
--suppress_output
57+
58+
# Check the outcome of the scanner
59+
if [ $? -ne 0 ]; then
60+
echo "RL Scanner failed."
61+
echo "scan-status=failed" >> $GITHUB_ENV
62+
exit 1
63+
else
64+
echo "RL Scanner passed."
65+
echo "scan-status=success" >> $GITHUB_ENV
66+
fi
67+
68+
outputs:
69+
scan-status:
70+
description: "The outcome of the scan process."
71+
value: ${{ env.scan-status }}

‎.github/workflows/docs.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
uses: actions/checkout@v4
2323

2424
- name: Setup Pages
25-
uses: actions/configure-pages@v4
25+
uses: actions/configure-pages@v5
2626

2727
- name: Configure Python
2828
uses: actions/setup-python@v5
@@ -42,7 +42,7 @@ jobs:
4242
sphinx-build ./docs/source ./docs/build --keep-going -n -a -b html
4343
4444
- name: Upload artifact
45-
uses: actions/upload-pages-artifact@v2
45+
uses: actions/upload-pages-artifact@v3
4646
with:
4747
path: "./docs/build"
4848

@@ -56,4 +56,4 @@ jobs:
5656
steps:
5757
- id: deployment
5858
name: Deploy to GitHub Pages
59-
uses: actions/deploy-pages@v3
59+
uses: actions/deploy-pages@v4

‎.github/workflows/publish.yml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,23 @@ permissions:
1111
id-token: write # Required for trusted publishing to PyPI
1212

1313
jobs:
14+
rl-scanner:
15+
uses: ./.github/workflows/rl-scanner
16+
with:
17+
python-version: 3.10
18+
artifact-name: "auth0-python.tgz"
19+
secrets:
20+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
21+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
22+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
23+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
24+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
25+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
1426
publish-pypi:
1527
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
1628
name: "PyPI"
1729
runs-on: ubuntu-latest
30+
needs: rl-scanner
1831
environment: release
1932

2033
steps:
@@ -23,7 +36,7 @@ jobs:
2336
with:
2437
fetch-depth: 0
2538
fetch-tags: true
26-
39+
2740
# Get the version from the branch name
2841
- id: get_version
2942
uses: ./.github/actions/get-version

‎.github/workflows/rl-scanner.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: RL-Secure Workflow
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
python-version:
7+
required: true
8+
type: string
9+
artifact-name:
10+
required: true
11+
type: string
12+
secrets:
13+
RLSECURE_LICENSE:
14+
required: true
15+
RLSECURE_SITE_KEY:
16+
required: true
17+
SIGNAL_HANDLER_TOKEN:
18+
required: true
19+
PRODSEC_TOOLS_USER:
20+
required: true
21+
PRODSEC_TOOLS_TOKEN:
22+
required: true
23+
PRODSEC_TOOLS_ARN:
24+
required: true
25+
26+
jobs:
27+
checkout-build-scan-only:
28+
runs-on: ubuntu-latest
29+
30+
permissions:
31+
pull-requests: write
32+
id-token: write
33+
34+
steps:
35+
- uses: actions/checkout@v4
36+
with:
37+
fetch-depth: 0
38+
fetch-tags: true
39+
40+
- name: Configure Python
41+
uses: actions/setup-python@v5
42+
with:
43+
python-version: ${{ inputs.python-version }}
44+
45+
- name: Configure dependencies
46+
run: |
47+
pip install --user --upgrade pip
48+
pip install --user pipx
49+
pipx ensurepath
50+
pipx install poetry==1.4.2
51+
pip install --upgrade pip
52+
pip install boto3 requests
53+
poetry config virtualenvs.in-project true
54+
poetry install --with dev
55+
poetry self add "poetry-dynamic-versioning[plugin]==1.1.1"
56+
57+
- name: Build release
58+
run: |
59+
poetry build
60+
61+
- name: Create tgz build artifact
62+
run: |
63+
tar -czvf ${{ inputs.artifact-name }} *
64+
65+
- name: Get Artifact Version
66+
id: get_version
67+
run: echo "version=$(cat .version)" >> $GITHUB_ENV
68+
69+
- name: Run RL Scanner
70+
id: rl-scan-conclusion
71+
uses: ./.github/actions/rl-scanner
72+
with:
73+
artifact-path: "$(pwd)/${{ inputs.artifact-name }}"
74+
version: "${{ steps.get_version.outputs.version }}"
75+
env:
76+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
77+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
78+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
79+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
80+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
81+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
82+
83+
- name: Output scan result
84+
run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV

‎.github/workflows/semgrep.yml‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: Semgrep
22

33
on:
44
merge_group:
5-
pull_request_target:
5+
pull_request:
66
types:
77
- opened
88
- synchronize
@@ -20,16 +20,7 @@ concurrency:
2020
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
2121

2222
jobs:
23-
authorize:
24-
name: Authorize
25-
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
26-
runs-on: ubuntu-latest
27-
steps:
28-
- run: true
29-
3023
run:
31-
needs: authorize # Require approval before running on forked pull requests
32-
3324
name: Check for Vulnerabilities
3425
runs-on: ubuntu-latest
3526

‎.github/workflows/snyk.yml‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: Snyk
22

33
on:
44
merge_group:
5-
pull_request_target:
5+
pull_request:
66
types:
77
- opened
88
- synchronize
@@ -22,16 +22,7 @@ concurrency:
2222
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
2323

2424
jobs:
25-
authorize:
26-
name: Authorize
27-
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
28-
runs-on: ubuntu-latest
29-
steps:
30-
- run: true
31-
3225
check:
33-
needs: authorize
34-
3526
name: Check for Vulnerabilities
3627
runs-on: ubuntu-latest
3728

@@ -43,7 +34,7 @@ jobs:
4334
with:
4435
ref: ${{ github.event.pull_request.head.sha || github.ref }}
4536

46-
- uses: snyk/actions/python-3.7@b98d498629f1c368650224d6d212bf7dfa89e4bf # [email protected]
37+
- uses: snyk/actions/python-3.8@cdb760004ba9ea4d525f2e043745dfe85bb9077e # pinned 2023-06-13
4738
continue-on-error: true # Make sure the SARIF upload is called
4839
env:
4940
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

‎.github/workflows/test.yml‎

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: Build and Test
22

33
on:
44
merge_group:
5-
pull_request_target:
5+
pull_request:
66
types:
77
- opened
88
- synchronize
@@ -18,16 +18,7 @@ concurrency:
1818
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
1919

2020
jobs:
21-
authorize:
22-
name: Authorize
23-
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
24-
runs-on: ubuntu-latest
25-
steps:
26-
- run: true
27-
2821
run:
29-
needs: authorize # Require approval before running on forked pull requests
30-
3122
name: Run
3223
runs-on: ubuntu-latest
3324

@@ -70,7 +61,7 @@ jobs:
7061
pipx install poetry
7162
poetry config virtualenvs.in-project true
7263
poetry install --with dev
73-
poetry self add "poetry-dynamic-versioning[plugin]==1.1.1"
64+
poetry self add "poetry-dynamic-versioning[plugin]"
7465
7566
- name: Run tests
7667
run: |
@@ -89,6 +80,6 @@ jobs:
8980

9081
- if: ${{ matrix.python-version == '3.10' }}
9182
name: Upload coverage
92-
uses: codecov/codecov-action@4fe8c5f003fae66aa5ebb77cfd3e7bfbbda0b6b0 # [email protected].5
83+
uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # pin@5.3.1
9384
with:
94-
token: ${{ secrets.CODECOV_TOKEN }}
85+
token: ${{ secrets.CODECOV_TOKEN }}

‎.version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
4.7.1
1+
4.7.2

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Change Log
22

3+
## [4.7.2](https://github.com/auth0/auth0-python/tree/4.7.2) (2024-09-10)
4+
[Full Changelog](https://github.com/auth0/auth0-python/compare/4.7.1...4.7.2)
5+
6+
**Security**
7+
- Update cryptography requirements.txt [\#630](https://github.com/auth0/auth0-python/pull/630) ([duedares-rvj](https://github.com/duedares-rvj))
8+
39
## [4.7.1](https://github.com/auth0/auth0-python/tree/4.7.1) (2024-02-26)
410
[Full Changelog](https://github.com/auth0/auth0-python/compare/4.7.0...4.7.1)
511

‎auth0/authentication/back_channel_login.py‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
from typing import Any
2+
3+
from .base import AuthenticationBase
4+
5+
6+
class BackChannelLogin(AuthenticationBase):
7+
"""Back-Channel Login endpoint"""
8+
9+
def back_channel_login(
10+
self, binding_message: str, login_hint: str, scope: str, **kwargs
11+
) -> Any:
12+
"""Send a Back-Channel Login.
13+
14+
Args:
15+
binding_message (str): Human-readable string displayed on both the device calling /bc-authorize and the user’s
16+
authentication device to ensure the user is approves the correct request.
17+
18+
login_hint (str): String containing information about the user to contact for authentication.
19+
20+
scope(str): "openid" is a required scope.Multiple scopes are separated
21+
with whitespace.
22+
23+
**kwargs: Other fields to send along with the PAR.
24+
25+
Returns:
26+
auth_req_id, expires_in, interval
27+
"""
28+
return self.authenticated_post(
29+
f"{self.protocol}://{self.domain}/bc-authorize",
30+
data={
31+
"client_id": self.client_id,
32+
"binding_message": binding_message,
33+
"login_hint": login_hint,
34+
"scope": scope,
35+
**kwargs,
36+
},
37+
)

0 commit comments

Comments
 (0)