python · srittau · May 13, 2025 · May 9, 2025
diff --git a/stubs/oauthlib/oauthlib/openid/connect/core/endpoints/pre_configured.pyi b/stubs/oauthlib/oauthlib/openid/connect/core/endpoints/pre_configured.pyi
@@ -1,36 +1,53 @@
-from _typeshed import Incomplete
+from collections.abc import Callable
 from typing import Any

+from oauthlib.common import Request
 from oauthlib.oauth2.rfc6749.endpoints import (
-    AuthorizationEndpoint as AuthorizationEndpoint,
-    IntrospectEndpoint as IntrospectEndpoint,
-    ResourceEndpoint as ResourceEndpoint,
-    RevocationEndpoint as RevocationEndpoint,
-    TokenEndpoint as TokenEndpoint,
+    AuthorizationEndpoint,
+    IntrospectEndpoint,
+    ResourceEndpoint,
+    RevocationEndpoint,
+    TokenEndpoint,
 )
+from oauthlib.oauth2.rfc6749.grant_types import (
+    AuthorizationCodeGrant as OAuth2AuthorizationCodeGrant,
+    ClientCredentialsGrant,
+    ImplicitGrant as OAuth2ImplicitGrant,
+    RefreshTokenGrant,
+    ResourceOwnerPasswordCredentialsGrant,
+)
+from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator
+from oauthlib.oauth2.rfc6749.tokens import BearerToken

-from .userinfo import UserInfoEndpoint as UserInfoEndpoint
+from ..grant_types import AuthorizationCodeGrant, HybridGrant, ImplicitGrant
+from ..grant_types.dispatchers import (
+    AuthorizationCodeGrantDispatcher,
+    AuthorizationTokenGrantDispatcher,
+    ImplicitTokenGrantDispatcher,
+)
+from ..tokens import JWTToken
+from .userinfo import UserInfoEndpoint

 class Server(AuthorizationEndpoint, IntrospectEndpoint, TokenEndpoint, ResourceEndpoint, RevocationEndpoint, UserInfoEndpoint):
-    auth_grant: Any
-    implicit_grant: Any
-    password_grant: Any
-    credentials_grant: Any
-    refresh_grant: Any
-    openid_connect_auth: Any
-    openid_connect_implicit: Any
-    openid_connect_hybrid: Any
-    bearer: Any
-    jwt: Any
-    auth_grant_choice: Any
-    implicit_grant_choice: Any
-    token_grant_choice: Any
+    auth_grant: OAuth2AuthorizationCodeGrant
+    implicit_grant: OAuth2ImplicitGrant
+    password_grant: ResourceOwnerPasswordCredentialsGrant
+    credentials_grant: ClientCredentialsGrant
+    refresh_grant: RefreshTokenGrant
+    openid_connect_auth: AuthorizationCodeGrant
+    openid_connect_implicit: ImplicitGrant
+    openid_connect_hybrid: HybridGrant
+    bearer: BearerToken
+    jwt: JWTToken
+    auth_grant_choice: AuthorizationCodeGrantDispatcher
+    implicit_grant_choice: ImplicitTokenGrantDispatcher
+    token_grant_choice: AuthorizationTokenGrantDispatcher
    def __init__(
        self,
-        request_validator,
-        token_expires_in: Incomplete | None = None,
-        token_generator: Incomplete | None = None,
-        refresh_token_generator: Incomplete | None = None,
-        *args,
-        **kwargs,
+        request_validator: OAuth2RequestValidator,
+        token_expires_in: int | Callable[[Request], int] | None = None,
+        token_generator: Callable[[Request], str] | None = None,
+        refresh_token_generator: Callable[[Request], str] | None = None,
+        *args: Any,  # actually, these are not used
+        **kwargs: Any,  # actually, these are not used
    ) -> None: ...
diff --git a/stubs/oauthlib/oauthlib/openid/connect/core/endpoints/userinfo.pyi b/stubs/oauthlib/oauthlib/openid/connect/core/endpoints/userinfo.pyi
@@ -1,16 +1,22 @@
-from _typeshed import Incomplete
+from collections.abc import Mapping
 from logging import Logger
-from typing import Any

-from oauthlib.oauth2.rfc6749.endpoints.base import BaseEndpoint as BaseEndpoint
+from oauthlib.common import Request, _HTTPMethod
+from oauthlib.oauth2.rfc6749.endpoints.base import BaseEndpoint
+from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator
+from oauthlib.oauth2.rfc6749.tokens import BearerToken

 log: Logger

 class UserInfoEndpoint(BaseEndpoint):
-    bearer: Any
-    request_validator: Any
-    def __init__(self, request_validator) -> None: ...
+    bearer: BearerToken
+    request_validator: OAuth2RequestValidator
+    def __init__(self, request_validator: OAuth2RequestValidator) -> None: ...
    def create_userinfo_response(
-        self, uri, http_method: str = "GET", body: Incomplete | None = None, headers: Incomplete | None = None
-    ): ...
-    def validate_userinfo_request(self, request) -> None: ...
+        self,
+        uri: str,
+        http_method: _HTTPMethod = "GET",
+        body: str | dict[str, str] | list[tuple[str, str]] | None = None,
+        headers: Mapping[str, str] | None = None,
+    ) -> tuple[dict[str, str], str, int]: ...
+    def validate_userinfo_request(self, request: Request) -> None: ...
diff --git a/stubs/oauthlib/oauthlib/openid/connect/core/exceptions.pyi b/stubs/oauthlib/oauthlib/openid/connect/core/exceptions.pyi
@@ -1,6 +1,4 @@
-from _typeshed import Incomplete
-
-from oauthlib.oauth2.rfc6749.errors import FatalClientError as FatalClientError, OAuth2Error as OAuth2Error
+from oauthlib.oauth2.rfc6749.errors import FatalClientError, OAuth2Error

 class FatalOpenIDClientError(FatalClientError): ...
 class OpenIDClientError(OAuth2Error): ...
@@ -50,4 +48,4 @@ class InsufficientScopeError(OAuth2Error):
    status_code: int
    description: str

-def raise_from_error(error, params: Incomplete | None = None) -> None: ...
+def raise_from_error(error: object, params: dict[str, str] | None = None) -> None: ...
diff --git a/stubs/oauthlib/oauthlib/openid/connect/core/grant_types/authorization_code.pyi b/stubs/oauthlib/oauthlib/openid/connect/core/grant_types/authorization_code.pyi
@@ -1,12 +1,25 @@
-from _typeshed import Incomplete
+from collections.abc import Iterable
 from logging import Logger
-from typing import Any

-from .base import GrantTypeBase as GrantTypeBase
+from oauthlib.common import Request
+from oauthlib.oauth2.rfc6749.grant_types.authorization_code import AuthorizationCodeGrant as OAuth2AuthorizationCodeGrant
+from oauthlib.oauth2.rfc6749.grant_types.base import _AuthValidator, _TokenValidator
+from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator
+
+from .base import GrantTypeBase

 log: Logger

 class AuthorizationCodeGrant(GrantTypeBase):
-    proxy_target: Any
-    def __init__(self, request_validator: Incomplete | None = None, **kwargs) -> None: ...
-    def add_id_token(self, token, token_handler, request): ...  # type: ignore[override]
+    proxy_target: OAuth2AuthorizationCodeGrant
+    def __init__(
+        self,
+        request_validator: OAuth2RequestValidator | None = None,
+        *,
+        post_auth: Iterable[_AuthValidator] | None = None,
+        post_token: Iterable[_TokenValidator] | None = None,
+        pre_auth: Iterable[_AuthValidator] | None = None,
+        pre_token: Iterable[_TokenValidator] | None = None,
+        **kwargs,
+    ) -> None: ...
+    def add_id_token(self, token, token_handler, request: Request): ...  # type: ignore[override]
diff --git a/stubs/oauthlib/oauthlib/openid/connect/core/grant_types/base.pyi b/stubs/oauthlib/oauthlib/openid/connect/core/grant_types/base.pyi
@@ -1,14 +1,20 @@
+from _hashlib import HASH
 from _typeshed import Incomplete
+from collections.abc import Callable
 from logging import Logger

+from oauthlib.common import Request
+
 log: Logger

 class GrantTypeBase:
    def __getattr__(self, attr: str): ...
    def __setattr__(self, attr: str, value) -> None: ...
-    def validate_authorization_request(self, request): ...
-    def id_token_hash(self, value, hashfunc=...): ...
-    def add_id_token(self, token, token_handler, request, nonce: Incomplete | None = None): ...
-    def openid_authorization_validator(self, request): ...
+    def validate_authorization_request(self, request: Request): ...
+    def id_token_hash(
+        self, value: str, hashfunc: Callable[..., HASH] = ...  # Arguments: ReadableBuffer (string) and bool (usedforsecurity)
+    ) -> str: ...
+    def add_id_token(self, token, token_handler, request: Request, nonce: Incomplete | None = None): ...
+    def openid_authorization_validator(self, request: Request): ...

 OpenIDConnectBase = GrantTypeBase
diff --git a/stubs/oauthlib/oauthlib/openid/connect/core/grant_types/dispatchers.pyi b/stubs/oauthlib/oauthlib/openid/connect/core/grant_types/dispatchers.pyi
@@ -1,32 +1,37 @@
 from _typeshed import Incomplete
 from logging import Logger
-from typing import Any
+
+from oauthlib.common import Request
+from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator

 log: Logger

 class Dispatcher:
-    default_grant: Any
-    oidc_grant: Any
+    default_grant: Incomplete | None
+    oidc_grant: Incomplete | None

 class AuthorizationCodeGrantDispatcher(Dispatcher):
-    default_grant: Any
-    oidc_grant: Any
+    default_grant: Incomplete | None
+    oidc_grant: Incomplete | None
    def __init__(self, default_grant: Incomplete | None = None, oidc_grant: Incomplete | None = None) -> None: ...
-    def create_authorization_response(self, request, token_handler): ...
-    def validate_authorization_request(self, request): ...
+    def create_authorization_response(self, request: Request, token_handler): ...
+    def validate_authorization_request(self, request: Request): ...

 class ImplicitTokenGrantDispatcher(Dispatcher):
-    default_grant: Any
-    oidc_grant: Any
+    default_grant: Incomplete | None
+    oidc_grant: Incomplete | None
    def __init__(self, default_grant: Incomplete | None = None, oidc_grant: Incomplete | None = None) -> None: ...
-    def create_authorization_response(self, request, token_handler): ...
-    def validate_authorization_request(self, request): ...
+    def create_authorization_response(self, request: Request, token_handler): ...
+    def validate_authorization_request(self, request: Request): ...

 class AuthorizationTokenGrantDispatcher(Dispatcher):
-    default_grant: Any
-    oidc_grant: Any
-    request_validator: Any
+    default_grant: Incomplete | None
+    oidc_grant: Incomplete | None
+    request_validator: OAuth2RequestValidator
    def __init__(
-        self, request_validator, default_grant: Incomplete | None = None, oidc_grant: Incomplete | None = None
+        self,
+        request_validator: OAuth2RequestValidator,
+        default_grant: Incomplete | None = None,
+        oidc_grant: Incomplete | None = None,
    ) -> None: ...
-    def create_token_response(self, request, token_handler): ...
+    def create_token_response(self, request: Request, token_handler): ...
diff --git a/stubs/oauthlib/oauthlib/openid/connect/core/grant_types/hybrid.pyi b/stubs/oauthlib/oauthlib/openid/connect/core/grant_types/hybrid.pyi
@@ -1,17 +1,29 @@
-from _typeshed import Incomplete
+from collections.abc import Iterable
 from logging import Logger
-from typing import Any

+from oauthlib.common import Request
 from oauthlib.oauth2.rfc6749.errors import InvalidRequestError as InvalidRequestError
+from oauthlib.oauth2.rfc6749.grant_types.authorization_code import AuthorizationCodeGrant as OAuth2AuthorizationCodeGrant
+from oauthlib.oauth2.rfc6749.grant_types.base import _AuthValidator, _TokenValidator
+from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator

-from ..request_validator import RequestValidator as RequestValidator
-from .base import GrantTypeBase as GrantTypeBase
+from ..request_validator import RequestValidator
+from .base import GrantTypeBase

 log: Logger

 class HybridGrant(GrantTypeBase):
-    request_validator: Any
-    proxy_target: Any
-    def __init__(self, request_validator: Incomplete | None = None, **kwargs) -> None: ...
-    def add_id_token(self, token, token_handler, request): ...  # type: ignore[override]
-    def openid_authorization_validator(self, request): ...
+    request_validator: OAuth2RequestValidator | RequestValidator
+    proxy_target: OAuth2AuthorizationCodeGrant
+    def __init__(
+        self,
+        request_validator: OAuth2RequestValidator | RequestValidator | None = None,
+        *,
+        post_auth: Iterable[_AuthValidator] | None = None,
+        post_token: Iterable[_TokenValidator] | None = None,
+        pre_auth: Iterable[_AuthValidator] | None = None,
+        pre_token: Iterable[_TokenValidator] | None = None,
+        **kwargs,
+    ) -> None: ...
+    def add_id_token(self, token, token_handler, request: Request): ...  # type: ignore[override]
+    def openid_authorization_validator(self, request: Request): ...
diff --git a/stubs/oauthlib/oauthlib/openid/connect/core/grant_types/implicit.pyi b/stubs/oauthlib/oauthlib/openid/connect/core/grant_types/implicit.pyi
@@ -1,13 +1,26 @@
-from _typeshed import Incomplete
+from collections.abc import Iterable
 from logging import Logger
-from typing import Any

-from .base import GrantTypeBase as GrantTypeBase
+from oauthlib.common import Request
+from oauthlib.oauth2.rfc6749.grant_types.base import _AuthValidator, _TokenValidator
+from oauthlib.oauth2.rfc6749.grant_types.implicit import ImplicitGrant as OAuth2ImplicitGrant
+from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator
+
+from .base import GrantTypeBase

 log: Logger

 class ImplicitGrant(GrantTypeBase):
-    proxy_target: Any
-    def __init__(self, request_validator: Incomplete | None = None, **kwargs) -> None: ...
-    def add_id_token(self, token, token_handler, request): ...  # type: ignore[override]
-    def openid_authorization_validator(self, request): ...
+    proxy_target: OAuth2ImplicitGrant
+    def __init__(
+        self,
+        request_validator: OAuth2RequestValidator | None = None,
+        *,
+        post_auth: Iterable[_AuthValidator] | None = None,
+        post_token: Iterable[_TokenValidator] | None = None,
+        pre_auth: Iterable[_AuthValidator] | None = None,
+        pre_token: Iterable[_TokenValidator] | None = None,
+        **kwargs,
+    ) -> None: ...
+    def add_id_token(self, token, token_handler, request: Request): ...  # type: ignore[override]
+    def openid_authorization_validator(self, request: Request): ...
diff --git a/stubs/oauthlib/oauthlib/openid/connect/core/grant_types/refresh_token.pyi b/stubs/oauthlib/oauthlib/openid/connect/core/grant_types/refresh_token.pyi
@@ -1,11 +1,25 @@
-from _typeshed import Incomplete
+from collections.abc import Iterable
 from logging import Logger

+from oauthlib.common import Request
+from oauthlib.oauth2.rfc6749.grant_types.base import _AuthValidator, _TokenValidator
+from oauthlib.oauth2.rfc6749.grant_types.refresh_token import RefreshTokenGrant as OAuth2RefreshTokenGrant
+from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator
+
 from .base import GrantTypeBase

 log: Logger

 class RefreshTokenGrant(GrantTypeBase):
-    proxy_target: Incomplete
-    def __init__(self, request_validator: Incomplete | None = None, **kwargs) -> None: ...
-    def add_id_token(self, token, token_handler, request): ...  # type: ignore[override]
+    proxy_target: OAuth2RefreshTokenGrant
+    def __init__(
+        self,
+        request_validator: OAuth2RequestValidator | None = None,
+        *,
+        post_auth: Iterable[_AuthValidator] | None = None,
+        post_token: Iterable[_TokenValidator] | None = None,
+        pre_auth: Iterable[_AuthValidator] | None = None,
+        pre_token: Iterable[_TokenValidator] | None = None,
+        **kwargs,
+    ) -> None: ...
+    def add_id_token(self, token, token_handler, request: Request): ...  # type: ignore[override]
diff --git a/stubs/oauthlib/oauthlib/openid/connect/core/request_validator.pyi b/stubs/oauthlib/oauthlib/openid/connect/core/request_validator.pyi
@@ -1,18 +1,24 @@
+from _typeshed import Incomplete
+from collections.abc import Callable
 from logging import Logger

+from oauthlib.common import Request
 from oauthlib.oauth2.rfc6749.request_validator import RequestValidator as OAuth2RequestValidator

 log: Logger

 class RequestValidator(OAuth2RequestValidator):
-    def get_authorization_code_scopes(self, client_id, code, redirect_uri, request) -> None: ...
-    def get_authorization_code_nonce(self, client_id, code, redirect_uri, request) -> None: ...
-    def get_jwt_bearer_token(self, token, token_handler, request) -> None: ...
-    def get_id_token(self, token, token_handler, request) -> None: ...
-    def finalize_id_token(self, id_token, token, token_handler, request) -> None: ...
-    def validate_jwt_bearer_token(self, token, scopes, request) -> None: ...
-    def validate_id_token(self, token, scopes, request) -> None: ...
-    def validate_silent_authorization(self, request) -> None: ...
-    def validate_silent_login(self, request) -> None: ...
-    def validate_user_match(self, id_token_hint, scopes, claims, request) -> None: ...
-    def get_userinfo_claims(self, request) -> None: ...
+    def get_authorization_code_scopes(self, client_id: str, code: str, redirect_uri: str, request) -> list[str]: ...
+    def get_authorization_code_nonce(self, client_id: str, code: str, redirect_uri: str, request) -> str: ...
+    def get_jwt_bearer_token(self, token: dict[str, Incomplete], token_handler, request: Request) -> str: ...
+    def get_id_token(self, token: dict[str, Incomplete], token_handler, request: Request) -> str: ...
+    def finalize_id_token(
+        self, id_token: dict[str, Incomplete], token: dict[str, Incomplete], token_handler: Callable[..., str], request: Request
+    ) -> str: ...
+    def validate_jwt_bearer_token(self, token: str, scopes, request: Request) -> bool: ...
+    def validate_id_token(self, token: str, scopes, request: Request) -> bool: ...
+    def validate_silent_authorization(self, request: Request) -> bool: ...
+    def validate_silent_login(self, request: Request) -> bool: ...
+    def validate_user_match(self, id_token_hint: str, scopes, claims: dict[str, Incomplete], request: Request) -> bool: ...
+    def get_userinfo_claims(self, request: Request) -> dict[str, Incomplete] | str: ...
+    def refresh_id_token(self, request: Request) -> bool: ...