Mail

venv/lib/python3.12/site-packages/openid/extensions/__init__.py

@@ -0,0 +1,5 @@
+"""OpenID Extension modules."""
+
+__all__ = ['ax', 'pape', 'sreg']
+
+from openid.extensions.draft import pape5 as pape

venv/lib/python3.12/site-packages/openid/extensions/ax.py

@@ -0,0 +1,781 @@
+# -*- test-case-name: openid.test.test_ax -*-
+"""Implements the OpenID Attribute Exchange specification, version 1.0.
+
+@since: 2.1.0
+"""
+
+__all__ = [
+    'AttributeRequest',
+    'FetchRequest',
+    'FetchResponse',
+    'StoreRequest',
+    'StoreResponse',
+]
+
+from openid import extension
+from openid.server.trustroot import TrustRoot
+from openid.message import NamespaceMap, OPENID_NS
+
+# Use this as the 'count' value for an attribute in a FetchRequest to
+# ask for as many values as the OP can provide.
+UNLIMITED_VALUES = "unlimited"
+
+# Minimum supported alias length in characters.  Here for
+# completeness.
+MINIMUM_SUPPORTED_ALIAS_LENGTH = 32
+
+
+def checkAlias(alias):
+    """
+    Check an alias for invalid characters; raise AXError if any are
+    found.  Return None if the alias is valid.
+    """
+    if ',' in alias:
+        raise AXError("Alias %r must not contain comma" % (alias, ))
+    if '.' in alias:
+        raise AXError("Alias %r must not contain period" % (alias, ))
+
+
+class AXError(ValueError):
+    """Results from data that does not meet the attribute exchange 1.0
+    specification"""
+
+
+class NotAXMessage(AXError):
+    """Raised when there is no Attribute Exchange mode in the message."""
+
+    def __repr__(self):
+        return self.__class__.__name__
+
+    def __str__(self):
+        return self.__class__.__name__
+
+
+class AXMessage(extension.Extension):
+    """Abstract class containing common code for attribute exchange messages
+
+    @cvar ns_alias: The preferred namespace alias for attribute
+        exchange messages
+
+    @cvar mode: The type of this attribute exchange message. This must
+        be overridden in subclasses.
+    """
+
+    # This class is abstract, so it's OK that it doesn't override the
+    # abstract method in Extension:
+    #
+    #pylint:disable-msg=W0223
+
+    ns_alias = 'ax'
+    ns_uri = 'http://openid.net/srv/ax/1.0'
+    mode = None  # NOTE mode is only ever set to a str value, see below
+
+    def _checkMode(self, ax_args):
+        """Raise an exception if the mode in the attribute exchange
+        arguments does not match what is expected for this class.
+
+        @raises NotAXMessage: When there is no mode value in ax_args at all.
+
+        @raises AXError: When mode does not match.
+        """
+        mode = ax_args.get('mode')
+        if isinstance(mode, bytes):
+            mode = str(mode, encoding="utf-8")
+        if mode != self.mode:
+            if not mode:
+                raise NotAXMessage()
+            else:
+                raise AXError('Expected mode %r; got %r' % (self.mode, mode))
+
+    def _newArgs(self):
+        """Return a set of attribute exchange arguments containing the
+        basic information that must be in every attribute exchange
+        message.
+        """
+        return {'mode': self.mode}
+
+
+class AttrInfo(object):
+    """Represents a single attribute in an attribute exchange
+    request. This should be added to an AXRequest object in order to
+    request the attribute.
+
+    @ivar required: Whether the attribute will be marked as required
+        when presented to the subject of the attribute exchange
+        request.
+    @type required: bool
+
+    @ivar count: How many values of this type to request from the
+        subject. Defaults to one.
+    @type count: int
+
+    @ivar type_uri: The identifier that determines what the attribute
+        represents and how it is serialized. For example, one type URI
+        representing dates could represent a Unix timestamp in base 10
+        and another could represent a human-readable string.
+    @type type_uri: str
+
+    @ivar alias: The name that should be given to this alias in the
+        request. If it is not supplied, a generic name will be
+        assigned. For example, if you want to call a Unix timestamp
+        value 'tstamp', set its alias to that value. If two attributes
+        in the same message request to use the same alias, the request
+        will fail to be generated.
+    @type alias: str or NoneType
+    """
+
+    # It's OK that this class doesn't have public methods (it's just a
+    # holder for a bunch of attributes):
+    #
+    #pylint:disable-msg=R0903
+
+    def __init__(self, type_uri, count=1, required=False, alias=None):
+        self.required = required
+        self.count = count
+        self.type_uri = type_uri
+        self.alias = alias
+
+        if self.alias is not None:
+            checkAlias(self.alias)
+
+    def wantsUnlimitedValues(self):
+        """
+        When processing a request for this attribute, the OP should
+        call this method to determine whether all available attribute
+        values were requested.  If self.count == UNLIMITED_VALUES,
+        this returns True.  Otherwise this returns False, in which
+        case self.count is an integer.
+        """
+        return self.count == UNLIMITED_VALUES
+
+
+def toTypeURIs(namespace_map, alias_list_s):
+    """Given a namespace mapping and a string containing a
+    comma-separated list of namespace aliases, return a list of type
+    URIs that correspond to those aliases.
+
+    @param namespace_map: The mapping from namespace URI to alias
+    @type namespace_map: openid.message.NamespaceMap
+
+    @param alias_list_s: The string containing the comma-separated
+        list of aliases. May also be None for convenience.
+    @type alias_list_s: str or NoneType
+
+    @returns: The list of namespace URIs that corresponds to the
+        supplied list of aliases. If the string was zero-length or
+        None, an empty list will be returned.
+
+    @raise KeyError: If an alias is present in the list of aliases but
+        is not present in the namespace map.
+    """
+    uris = []
+
+    if alias_list_s:
+        for alias in alias_list_s.split(','):
+            type_uri = namespace_map.getNamespaceURI(alias)
+            if type_uri is None:
+                raise KeyError('No type is defined for attribute name %r' %
+                               (alias, ))
+            else:
+                uris.append(type_uri)
+
+    return uris
+
+
+class FetchRequest(AXMessage):
+    """An attribute exchange 'fetch_request' message. This message is
+    sent by a relying party when it wishes to obtain attributes about
+    the subject of an OpenID authentication request.
+
+    @ivar requested_attributes: The attributes that have been
+        requested thus far, indexed by the type URI.
+    @type requested_attributes: {str:AttrInfo}
+
+    @ivar update_url: A URL that will accept responses for this
+        attribute exchange request, even in the absence of the user
+        who made this request.
+    """
+    mode = 'fetch_request'
+
+    def __init__(self, update_url=None):
+        AXMessage.__init__(self)
+        self.requested_attributes = {}
+        self.update_url = update_url
+
+    def add(self, attribute):
+        """Add an attribute to this attribute exchange request.
+
+        @param attribute: The attribute that is being requested
+        @type attribute: C{L{AttrInfo}}
+
+        @returns: None
+
+        @raise KeyError: when the requested attribute is already
+            present in this fetch request.
+        """
+        if attribute.type_uri in self.requested_attributes:
+            raise KeyError('The attribute %r has already been requested' %
+                           (attribute.type_uri, ))
+
+        self.requested_attributes[attribute.type_uri] = attribute
+
+    def getExtensionArgs(self):
+        """Get the serialized form of this attribute fetch request.
+
+        @returns: The fetch request message parameters
+        @rtype: {unicode:unicode}
+        """
+        aliases = NamespaceMap()
+
+        required = []
+        if_available = []
+
+        ax_args = self._newArgs()
+
+        for type_uri, attribute in self.requested_attributes.items():
+            if attribute.alias is None:
+                alias = aliases.add(type_uri)
+            else:
+                # This will raise an exception when the second
+                # attribute with the same alias is added. I think it
+                # would be better to complain at the time that the
+                # attribute is added to this object so that the code
+                # that is adding it is identified in the stack trace,
+                # but it's more work to do so, and it won't be 100%
+                # accurate anyway, since the attributes are
+                # mutable. So for now, just live with the fact that
+                # we'll learn about the error later.
+                #
+                # The other possible approach is to hide the error and
+                # generate a new alias on the fly. I think that would
+                # probably be bad.
+                alias = aliases.addAlias(type_uri, attribute.alias)
+
+            if attribute.required:
+                required.append(alias)
+            else:
+                if_available.append(alias)
+
+            if attribute.count != 1:
+                ax_args['count.' + alias] = str(attribute.count)
+
+            ax_args['type.' + alias] = type_uri
+
+        if required:
+            ax_args['required'] = ','.join(required)
+
+        if if_available:
+            ax_args['if_available'] = ','.join(if_available)
+
+        return ax_args
+
+    def getRequiredAttrs(self):
+        """Get the type URIs for all attributes that have been marked
+        as required.
+
+        @returns: A list of the type URIs for attributes that have
+            been marked as required.
+        @rtype: [str]
+        """
+        required = []
+        for type_uri, attribute in self.requested_attributes.items():
+            if attribute.required:
+                required.append(type_uri)
+
+        return required
+
+    def fromOpenIDRequest(cls, openid_request):
+        """Extract a FetchRequest from an OpenID message
+
+        @param openid_request: The OpenID authentication request
+            containing the attribute fetch request
+        @type openid_request: C{L{openid.server.server.CheckIDRequest}}
+
+        @rtype: C{L{FetchRequest}} or C{None}
+        @returns: The FetchRequest extracted from the message or None, if
+            the message contained no AX extension.
+
+        @raises KeyError: if the AuthRequest is not consistent in its use
+            of namespace aliases.
+
+        @raises AXError: When parseExtensionArgs would raise same.
+
+        @see: L{parseExtensionArgs}
+        """
+        message = openid_request.message
+        ax_args = message.getArgs(cls.ns_uri)
+        self = cls()
+        try:
+            self.parseExtensionArgs(ax_args)
+        except NotAXMessage as err:
+            return None
+
+        if self.update_url:
+            # Update URL must match the openid.realm of the underlying
+            # OpenID 2 message.
+            realm = message.getArg(OPENID_NS, 'realm',
+                                   message.getArg(OPENID_NS, 'return_to'))
+
+            if not realm:
+                raise AXError(
+                    ("Cannot validate update_url %r " + "against absent realm")
+                    % (self.update_url, ))
+
+            tr = TrustRoot.parse(realm)
+            if not tr.validateURL(self.update_url):
+                raise AXError(
+                    "Update URL %r failed validation against realm %r" %
+                    (self.update_url, realm, ))
+
+        return self
+
+    fromOpenIDRequest = classmethod(fromOpenIDRequest)
+
+    def parseExtensionArgs(self, ax_args):
+        """Given attribute exchange arguments, populate this FetchRequest.
+
+        @param ax_args: Attribute Exchange arguments from the request.
+            As returned from L{Message.getArgs<openid.message.Message.getArgs>}.
+        @type ax_args: dict
+
+        @raises KeyError: if the message is not consistent in its use
+            of namespace aliases.
+
+        @raises NotAXMessage: If ax_args does not include an Attribute Exchange
+            mode.
+
+        @raises AXError: If the data to be parsed does not follow the
+            attribute exchange specification. At least when
+            'if_available' or 'required' is not specified for a
+            particular attribute type.
+        """
+        # Raises an exception if the mode is not the expected value
+        self._checkMode(ax_args)
+
+        aliases = NamespaceMap()
+
+        for key, value in ax_args.items():
+            if key.startswith('type.'):
+                alias = key[5:]
+                type_uri = value
+                aliases.addAlias(type_uri, alias)
+
+                count_key = 'count.' + alias
+                count_s = ax_args.get(count_key)
+                if count_s:
+                    try:
+                        count = int(count_s)
+                        if count <= 0:
+                            raise AXError(
+                                "Count %r must be greater than zero, got %r" %
+                                (count_key, count_s, ))
+                    except ValueError:
+                        if count_s != UNLIMITED_VALUES:
+                            raise AXError("Invalid count value for %r: %r" %
+                                          (count_key, count_s, ))
+                        count = count_s
+                else:
+                    count = 1
+
+                self.add(AttrInfo(type_uri, alias=alias, count=count))
+
+        required = toTypeURIs(aliases, ax_args.get('required'))
+
+        for type_uri in required:
+            self.requested_attributes[type_uri].required = True
+
+        if_available = toTypeURIs(aliases, ax_args.get('if_available'))
+
+        all_type_uris = required + if_available
+
+        for type_uri in aliases.iterNamespaceURIs():
+            if type_uri not in all_type_uris:
+                raise AXError('Type URI %r was in the request but not '
+                              'present in "required" or "if_available"' %
+                              (type_uri, ))
+
+        self.update_url = ax_args.get('update_url')
+
+    def iterAttrs(self):
+        """Iterate over the AttrInfo objects that are
+        contained in this fetch_request.
+        """
+        return iter(self.requested_attributes.values())
+
+    def __iter__(self):
+        """Iterate over the attribute type URIs in this fetch_request
+        """
+        return iter(self.requested_attributes)
+
+    def has_key(self, type_uri):
+        """Is the given type URI present in this fetch_request?
+        """
+        return type_uri in self.requested_attributes
+
+    __contains__ = has_key
+
+
+class AXKeyValueMessage(AXMessage):
+    """An abstract class that implements a message that has attribute
+    keys and values. It contains the common code between
+    fetch_response and store_request.
+    """
+
+    # This class is abstract, so it's OK that it doesn't override the
+    # abstract method in Extension:
+    #
+    #pylint:disable-msg=W0223
+
+    def __init__(self):
+        AXMessage.__init__(self)
+        self.data = {}
+
+    def addValue(self, type_uri, value):
+        """Add a single value for the given attribute type to the
+        message. If there are already values specified for this type,
+        this value will be sent in addition to the values already
+        specified.
+
+        @param type_uri: The URI for the attribute
+
+        @param value: The value to add to the response to the relying
+            party for this attribute
+        @type value: unicode
+
+        @returns: None
+        """
+        try:
+            values = self.data[type_uri]
+        except KeyError:
+            values = self.data[type_uri] = []
+
+        values.append(value)
+
+    def setValues(self, type_uri, values):
+        """Set the values for the given attribute type. This replaces
+        any values that have already been set for this attribute.
+
+        @param type_uri: The URI for the attribute
+
+        @param values: A list of values to send for this attribute.
+        @type values: [unicode]
+        """
+
+        self.data[type_uri] = values
+
+    def _getExtensionKVArgs(self, aliases=None):
+        """Get the extension arguments for the key/value pairs
+        contained in this message.
+
+        @param aliases: An alias mapping. Set to None if you don't
+            care about the aliases for this request.
+        """
+        if aliases is None:
+            aliases = NamespaceMap()
+
+        ax_args = {}
+
+        for type_uri, values in self.data.items():
+            alias = aliases.add(type_uri)
+
+            ax_args['type.' + alias] = type_uri
+            ax_args['count.' + alias] = str(len(values))
+
+            for i, value in enumerate(values):
+                key = 'value.%s.%d' % (alias, i + 1)
+                ax_args[key] = value
+
+        return ax_args
+
+    def parseExtensionArgs(self, ax_args):
+        """Parse attribute exchange key/value arguments into this
+        object.
+
+        @param ax_args: The attribute exchange fetch_response
+            arguments, with namespacing removed.
+        @type ax_args: {unicode:unicode}
+
+        @returns: None
+
+        @raises ValueError: If the message has bad values for
+            particular fields
+
+        @raises KeyError: If the namespace mapping is bad or required
+            arguments are missing
+        """
+        self._checkMode(ax_args)
+
+        aliases = NamespaceMap()
+
+        for key, value in ax_args.items():
+            if key.startswith('type.'):
+                type_uri = value
+                alias = key[5:]
+                checkAlias(alias)
+                aliases.addAlias(type_uri, alias)
+
+        for type_uri, alias in aliases.items():
+            try:
+                count_s = ax_args['count.' + alias]
+            except KeyError:
+                value = ax_args['value.' + alias]
+
+                if value == '':
+                    values = []
+                else:
+                    values = [value]
+            else:
+                count = int(count_s)
+                values = []
+                for i in range(1, count + 1):
+                    value_key = 'value.%s.%d' % (alias, i)
+                    value = ax_args[value_key]
+                    values.append(value)
+
+            self.data[type_uri] = values
+
+    def getSingle(self, type_uri, default=None):
+        """Get a single value for an attribute. If no value was sent
+        for this attribute, use the supplied default. If there is more
+        than one value for this attribute, this method will fail.
+
+        @type type_uri: str
+        @param type_uri: The URI for the attribute
+
+        @param default: The value to return if the attribute was not
+            sent in the fetch_response.
+
+        @returns: The value of the attribute in the fetch_response
+            message, or the default supplied
+        @rtype: unicode or NoneType
+
+        @raises ValueError: If there is more than one value for this
+            parameter in the fetch_response message.
+        @raises KeyError: If the attribute was not sent in this response
+        """
+        values = self.data.get(type_uri)
+        if not values:
+            return default
+        elif len(values) == 1:
+            return values[0]
+        else:
+            raise AXError('More than one value present for %r' % (type_uri, ))
+
+    def get(self, type_uri):
+        """Get the list of values for this attribute in the
+        fetch_response.
+
+        XXX: what to do if the values are not present? default
+        parameter? this is funny because it's always supposed to
+        return a list, so the default may break that, though it's
+        provided by the user's code, so it might be okay. If no
+        default is supplied, should the return be None or []?
+
+        @param type_uri: The URI of the attribute
+
+        @returns: The list of values for this attribute in the
+            response. May be an empty list.
+        @rtype: [unicode]
+
+        @raises KeyError: If the attribute was not sent in the response
+        """
+        return self.data[type_uri]
+
+    def count(self, type_uri):
+        """Get the number of responses for a particular attribute in
+        this fetch_response message.
+
+        @param type_uri: The URI of the attribute
+
+        @returns: The number of values sent for this attribute
+
+        @raises KeyError: If the attribute was not sent in the
+            response. KeyError will not be raised if the number of
+            values was zero.
+        """
+        return len(self.get(type_uri))
+
+
+class FetchResponse(AXKeyValueMessage):
+    """A fetch_response attribute exchange message
+    """
+    mode = 'fetch_response'
+
+    def __init__(self, request=None, update_url=None):
+        """
+        @param request: When supplied, I will use namespace aliases
+            that match those in this request.  I will also check to
+            make sure I do not respond with attributes that were not
+            requested.
+
+        @type request: L{FetchRequest}
+
+        @param update_url: By default, C{update_url} is taken from the
+            request.  But if you do not supply the request, you may set
+            the C{update_url} here.
+
+        @type update_url: str
+        """
+        AXKeyValueMessage.__init__(self)
+        self.update_url = update_url
+        self.request = request
+
+    def getExtensionArgs(self):
+        """Serialize this object into arguments in the attribute
+        exchange namespace
+
+        @returns: The dictionary of unqualified attribute exchange
+            arguments that represent this fetch_response.
+        @rtype: {unicode;unicode}
+        """
+
+        aliases = NamespaceMap()
+
+        zero_value_types = []
+
+        if self.request is not None:
+            # Validate the data in the context of the request (the
+            # same attributes should be present in each, and the
+            # counts in the response must be no more than the counts
+            # in the request)
+
+            for type_uri in self.data:
+                if type_uri not in self.request:
+                    raise KeyError(
+                        'Response attribute not present in request: %r' %
+                        (type_uri, ))
+
+            for attr_info in self.request.iterAttrs():
+                # Copy the aliases from the request so that reading
+                # the response in light of the request is easier
+                if attr_info.alias is None:
+                    aliases.add(attr_info.type_uri)
+                else:
+                    aliases.addAlias(attr_info.type_uri, attr_info.alias)
+
+                try:
+                    values = self.data[attr_info.type_uri]
+                except KeyError:
+                    values = []
+                    zero_value_types.append(attr_info)
+
+                if (attr_info.count != UNLIMITED_VALUES) and \
+                       (attr_info.count < len(values)):
+                    raise AXError(
+                        'More than the number of requested values were '
+                        'specified for %r' % (attr_info.type_uri, ))
+
+        kv_args = self._getExtensionKVArgs(aliases)
+
+        # Add the KV args into the response with the args that are
+        # unique to the fetch_response
+        ax_args = self._newArgs()
+
+        # For each requested attribute, put its type/alias and count
+        # into the response even if no data were returned.
+        for attr_info in zero_value_types:
+            alias = aliases.getAlias(attr_info.type_uri)
+            kv_args['type.' + alias] = attr_info.type_uri
+            kv_args['count.' + alias] = '0'
+
+        update_url = ((self.request and self.request.update_url) or
+                      self.update_url)
+
+        if update_url:
+            ax_args['update_url'] = update_url
+
+        ax_args.update(kv_args)
+
+        return ax_args
+
+    def parseExtensionArgs(self, ax_args):
+        """@see: {Extension.parseExtensionArgs<openid.extension.Extension.parseExtensionArgs>}"""
+        super(FetchResponse, self).parseExtensionArgs(ax_args)
+        self.update_url = ax_args.get('update_url')
+
+    def fromSuccessResponse(cls, success_response, signed=True):
+        """Construct a FetchResponse object from an OpenID library
+        SuccessResponse object.
+
+        @param success_response: A successful id_res response object
+        @type success_response: openid.consumer.consumer.SuccessResponse
+
+        @param signed: Whether non-signed args should be
+            processsed. If True (the default), only signed arguments
+            will be processsed.
+        @type signed: bool
+
+        @returns: A FetchResponse containing the data from the OpenID
+            message, or None if the SuccessResponse did not contain AX
+            extension data.
+
+        @raises AXError: when the AX data cannot be parsed.
+        """
+        self = cls()
+        ax_args = success_response.extensionResponse(self.ns_uri, signed)
+
+        try:
+            self.parseExtensionArgs(ax_args)
+        except NotAXMessage as err:
+            return None
+        else:
+            return self
+
+    fromSuccessResponse = classmethod(fromSuccessResponse)
+
+
+class StoreRequest(AXKeyValueMessage):
+    """A store request attribute exchange message representation
+    """
+    mode = 'store_request'
+
+    def __init__(self, aliases=None):
+        """
+        @param aliases: The namespace aliases to use when making this
+            store request.  Leave as None to use defaults.
+        """
+        super(StoreRequest, self).__init__()
+        self.aliases = aliases
+
+    def getExtensionArgs(self):
+        """
+        @see: L{Extension.getExtensionArgs<openid.extension.Extension.getExtensionArgs>}
+        """
+        ax_args = self._newArgs()
+        kv_args = self._getExtensionKVArgs(self.aliases)
+        ax_args.update(kv_args)
+        return ax_args
+
+
+class StoreResponse(AXMessage):
+    """An indication that the store request was processed along with
+    this OpenID transaction.
+    """
+
+    SUCCESS_MODE = 'store_response_success'
+    FAILURE_MODE = 'store_response_failure'
+
+    def __init__(self, succeeded=True, error_message=None):
+        AXMessage.__init__(self)
+
+        if succeeded and error_message is not None:
+            raise AXError('An error message may only be included in a '
+                          'failing fetch response')
+        if succeeded:
+            self.mode = self.SUCCESS_MODE
+        else:
+            self.mode = self.FAILURE_MODE
+
+        self.error_message = error_message
+
+    def succeeded(self):
+        """Was this response a success response?"""
+        return self.mode == self.SUCCESS_MODE
+
+    def getExtensionArgs(self):
+        """@see: {Extension.getExtensionArgs<openid.extension.Extension.getExtensionArgs>}"""
+        ax_args = self._newArgs()
+        if not self.succeeded() and self.error_message:
+            ax_args['error'] = self.error_message
+
+        return ax_args

venv/lib/python3.12/site-packages/openid/extensions/draft/pape2.py

@@ -0,0 +1,285 @@
+"""An implementation of the OpenID Provider Authentication Policy
+Extension 1.0
+
+@see: http://openid.net/developers/specs/
+
+@since: 2.1.0
+"""
+
+__all__ = [
+    'Request',
+    'Response',
+    'ns_uri',
+    'AUTH_PHISHING_RESISTANT',
+    'AUTH_MULTI_FACTOR',
+    'AUTH_MULTI_FACTOR_PHYSICAL',
+]
+
+from openid.extension import Extension
+import re
+
+ns_uri = "http://specs.openid.net/extensions/pape/1.0"
+
+AUTH_MULTI_FACTOR_PHYSICAL = \
+    'http://schemas.openid.net/pape/policies/2007/06/multi-factor-physical'
+AUTH_MULTI_FACTOR = \
+    'http://schemas.openid.net/pape/policies/2007/06/multi-factor'
+AUTH_PHISHING_RESISTANT = \
+    'http://schemas.openid.net/pape/policies/2007/06/phishing-resistant'
+
+TIME_VALIDATOR = re.compile('^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$')
+
+
+class Request(Extension):
+    """A Provider Authentication Policy request, sent from a relying
+    party to a provider
+
+    @ivar preferred_auth_policies: The authentication policies that
+        the relying party prefers
+    @type preferred_auth_policies: [str]
+
+    @ivar max_auth_age: The maximum time, in seconds, that the relying
+        party wants to allow to have elapsed before the user must
+        re-authenticate
+    @type max_auth_age: int or NoneType
+    """
+
+    ns_alias = 'pape'
+
+    def __init__(self, preferred_auth_policies=None, max_auth_age=None):
+        super(Request, self).__init__()
+        if not preferred_auth_policies:
+            preferred_auth_policies = []
+
+        self.preferred_auth_policies = preferred_auth_policies
+        self.max_auth_age = max_auth_age
+
+    def __bool__(self):
+        return bool(self.preferred_auth_policies or
+                    self.max_auth_age is not None)
+
+    def addPolicyURI(self, policy_uri):
+        """Add an acceptable authentication policy URI to this request
+
+        This method is intended to be used by the relying party to add
+        acceptable authentication types to the request.
+
+        @param policy_uri: The identifier for the preferred type of
+            authentication.
+        @see: http://openid.net/specs/openid-provider-authentication-policy-extension-1_0-01.html#auth_policies
+        """
+        if policy_uri not in self.preferred_auth_policies:
+            self.preferred_auth_policies.append(policy_uri)
+
+    def getExtensionArgs(self):
+        """@see: C{L{Extension.getExtensionArgs}}
+        """
+        ns_args = {
+            'preferred_auth_policies': ' '.join(self.preferred_auth_policies)
+        }
+
+        if self.max_auth_age is not None:
+            ns_args['max_auth_age'] = str(self.max_auth_age)
+
+        return ns_args
+
+    def fromOpenIDRequest(cls, request):
+        """Instantiate a Request object from the arguments in a
+        C{checkid_*} OpenID message
+        """
+        self = cls()
+        args = request.message.getArgs(self.ns_uri)
+
+        if args == {}:
+            return None
+
+        self.parseExtensionArgs(args)
+        return self
+
+    fromOpenIDRequest = classmethod(fromOpenIDRequest)
+
+    def parseExtensionArgs(self, args):
+        """Set the state of this request to be that expressed in these
+        PAPE arguments
+
+        @param args: The PAPE arguments without a namespace
+
+        @rtype: None
+
+        @raises ValueError: When the max_auth_age is not parseable as
+            an integer
+        """
+
+        # preferred_auth_policies is a space-separated list of policy URIs
+        self.preferred_auth_policies = []
+
+        policies_str = args.get('preferred_auth_policies')
+        if policies_str:
+            if isinstance(policies_str, bytes):
+                policies_str = str(policies_str, encoding="utf-8")
+            for uri in policies_str.split(' '):
+                if uri not in self.preferred_auth_policies:
+                    self.preferred_auth_policies.append(uri)
+
+        # max_auth_age is base-10 integer number of seconds
+        max_auth_age_str = args.get('max_auth_age')
+        self.max_auth_age = None
+
+        if max_auth_age_str:
+            try:
+                self.max_auth_age = int(max_auth_age_str)
+            except ValueError:
+                pass
+
+    def preferredTypes(self, supported_types):
+        """Given a list of authentication policy URIs that a provider
+        supports, this method returns the subsequence of those types
+        that are preferred by the relying party.
+
+        @param supported_types: A sequence of authentication policy
+            type URIs that are supported by a provider
+
+        @returns: The sub-sequence of the supported types that are
+            preferred by the relying party. This list will be ordered
+            in the order that the types appear in the supported_types
+            sequence, and may be empty if the provider does not prefer
+            any of the supported authentication types.
+
+        @returntype: [str]
+        """
+        return list(
+            filter(self.preferred_auth_policies.__contains__, supported_types))
+
+
+Request.ns_uri = ns_uri
+
+
+class Response(Extension):
+    """A Provider Authentication Policy response, sent from a provider
+    to a relying party
+    """
+
+    ns_alias = 'pape'
+
+    def __init__(self,
+                 auth_policies=None,
+                 auth_time=None,
+                 nist_auth_level=None):
+        super(Response, self).__init__()
+        if auth_policies:
+            self.auth_policies = auth_policies
+        else:
+            self.auth_policies = []
+
+        self.auth_time = auth_time
+        self.nist_auth_level = nist_auth_level
+
+    def addPolicyURI(self, policy_uri):
+        """Add a authentication policy to this response
+
+        This method is intended to be used by the provider to add a
+        policy that the provider conformed to when authenticating the user.
+
+        @param policy_uri: The identifier for the preferred type of
+            authentication.
+        @see: http://openid.net/specs/openid-provider-authentication-policy-extension-1_0-01.html#auth_policies
+        """
+        if policy_uri not in self.auth_policies:
+            self.auth_policies.append(policy_uri)
+
+    def fromSuccessResponse(cls, success_response):
+        """Create a C{L{Response}} object from a successful OpenID
+        library response
+        (C{L{openid.consumer.consumer.SuccessResponse}}) response
+        message
+
+        @param success_response: A SuccessResponse from consumer.complete()
+        @type success_response: C{L{openid.consumer.consumer.SuccessResponse}}
+
+        @rtype: Response or None
+        @returns: A provider authentication policy response from the
+            data that was supplied with the C{id_res} response or None
+            if the provider sent no signed PAPE response arguments.
+        """
+        self = cls()
+
+        # PAPE requires that the args be signed.
+        args = success_response.getSignedNS(self.ns_uri)
+
+        # Only try to construct a PAPE response if the arguments were
+        # signed in the OpenID response.  If not, return None.
+        if args is not None:
+            self.parseExtensionArgs(args)
+            return self
+        else:
+            return None
+
+    def parseExtensionArgs(self, args, strict=False):
+        """Parse the provider authentication policy arguments into the
+        internal state of this object
+
+        @param args: unqualified provider authentication policy
+            arguments
+
+        @param strict: Whether to raise an exception when bad data is
+            encountered
+
+        @returns: None. The data is parsed into the internal fields of
+            this object.
+        """
+        policies_str = args.get('auth_policies')
+        if policies_str and policies_str != 'none':
+            self.auth_policies = policies_str.split(' ')
+
+        nist_level_str = args.get('nist_auth_level')
+        if nist_level_str:
+            try:
+                nist_level = int(nist_level_str)
+            except ValueError:
+                if strict:
+                    raise ValueError(
+                        'nist_auth_level must be an integer between '
+                        'zero and four, inclusive')
+                else:
+                    self.nist_auth_level = None
+            else:
+                if 0 <= nist_level < 5:
+                    self.nist_auth_level = nist_level
+
+        auth_time = args.get('auth_time')
+        if auth_time:
+            if TIME_VALIDATOR.match(auth_time):
+                self.auth_time = auth_time
+            elif strict:
+                raise ValueError("auth_time must be in RFC3339 format")
+
+    fromSuccessResponse = classmethod(fromSuccessResponse)
+
+    def getExtensionArgs(self):
+        """@see: C{L{Extension.getExtensionArgs}}
+        """
+        if len(self.auth_policies) == 0:
+            ns_args = {
+                'auth_policies': 'none',
+            }
+        else:
+            ns_args = {
+                'auth_policies': ' '.join(self.auth_policies),
+            }
+
+        if self.nist_auth_level is not None:
+            if self.nist_auth_level not in list(range(0, 5)):
+                raise ValueError('nist_auth_level must be an integer between '
+                                 'zero and four, inclusive')
+            ns_args['nist_auth_level'] = str(self.nist_auth_level)
+
+        if self.auth_time is not None:
+            if not TIME_VALIDATOR.match(self.auth_time):
+                raise ValueError('auth_time must be in RFC3339 format')
+
+            ns_args['auth_time'] = self.auth_time
+
+        return ns_args
+
+
+Response.ns_uri = ns_uri

venv/lib/python3.12/site-packages/openid/extensions/draft/pape5.py

@@ -0,0 +1,481 @@
+"""An implementation of the OpenID Provider Authentication Policy
+Extension 1.0, Draft 5
+
+@see: http://openid.net/developers/specs/
+
+@since: 2.1.0
+"""
+
+__all__ = [
+    'Request',
+    'Response',
+    'ns_uri',
+    'AUTH_PHISHING_RESISTANT',
+    'AUTH_MULTI_FACTOR',
+    'AUTH_MULTI_FACTOR_PHYSICAL',
+    'LEVELS_NIST',
+    'LEVELS_JISA',
+]
+
+from openid.extension import Extension
+import warnings
+import re
+
+ns_uri = "http://specs.openid.net/extensions/pape/1.0"
+
+AUTH_MULTI_FACTOR_PHYSICAL = \
+    'http://schemas.openid.net/pape/policies/2007/06/multi-factor-physical'
+AUTH_MULTI_FACTOR = \
+    'http://schemas.openid.net/pape/policies/2007/06/multi-factor'
+AUTH_PHISHING_RESISTANT = \
+    'http://schemas.openid.net/pape/policies/2007/06/phishing-resistant'
+AUTH_NONE = \
+    'http://schemas.openid.net/pape/policies/2007/06/none'
+
+TIME_VALIDATOR = re.compile(r'^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$')
+
+LEVELS_NIST = 'http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf'
+LEVELS_JISA = 'http://www.jisa.or.jp/spec/auth_level.html'
+
+
+class PAPEExtension(Extension):
+    _default_auth_level_aliases = {
+        'nist': LEVELS_NIST,
+        'jisa': LEVELS_JISA,
+    }
+
+    def __init__(self):
+        self.auth_level_aliases = self._default_auth_level_aliases.copy()
+
+    def _addAuthLevelAlias(self, auth_level_uri, alias=None):
+        """Add an auth level URI alias to this request.
+
+        @param auth_level_uri: The auth level URI to send in the
+            request.
+
+        @param alias: The namespace alias to use for this auth level
+            in this message. May be None if the alias is not
+            important.
+        """
+        if alias is None:
+            try:
+                alias = self._getAlias(auth_level_uri)
+            except KeyError:
+                alias = self._generateAlias()
+        else:
+            existing_uri = self.auth_level_aliases.get(alias)
+            if existing_uri is not None and existing_uri != auth_level_uri:
+                raise KeyError('Attempting to redefine alias %r from %r to %r',
+                               alias, existing_uri, auth_level_uri)
+
+        self.auth_level_aliases[alias] = auth_level_uri
+
+    def _generateAlias(self):
+        """Return an unused auth level alias"""
+        for i in range(1000):
+            alias = 'cust%d' % (i, )
+            if alias not in self.auth_level_aliases:
+                return alias
+
+        raise RuntimeError('Could not find an unused alias (tried 1000!)')
+
+    def _getAlias(self, auth_level_uri):
+        """Return the alias for the specified auth level URI.
+
+        @raises KeyError: if no alias is defined
+        """
+        for (alias, existing_uri) in self.auth_level_aliases.items():
+            if auth_level_uri == existing_uri:
+                return alias
+
+        raise KeyError(auth_level_uri)
+
+
+class Request(PAPEExtension):
+    """A Provider Authentication Policy request, sent from a relying
+    party to a provider
+
+    @ivar preferred_auth_policies: The authentication policies that
+        the relying party prefers
+    @type preferred_auth_policies: [str]
+
+    @ivar max_auth_age: The maximum time, in seconds, that the relying
+        party wants to allow to have elapsed before the user must
+        re-authenticate
+    @type max_auth_age: int or NoneType
+
+    @ivar preferred_auth_level_types: Ordered list of authentication
+        level namespace URIs
+
+    @type preferred_auth_level_types: [str]
+    """
+
+    ns_alias = 'pape'
+
+    def __init__(self,
+                 preferred_auth_policies=None,
+                 max_auth_age=None,
+                 preferred_auth_level_types=None):
+        super(Request, self).__init__()
+        if preferred_auth_policies is None:
+            preferred_auth_policies = []
+
+        self.preferred_auth_policies = preferred_auth_policies
+        self.max_auth_age = max_auth_age
+        self.preferred_auth_level_types = []
+
+        if preferred_auth_level_types is not None:
+            for auth_level in preferred_auth_level_types:
+                self.addAuthLevel(auth_level)
+
+    def __bool__(self):
+        return bool(self.preferred_auth_policies or
+                    self.max_auth_age is not None or
+                    self.preferred_auth_level_types)
+
+    def addPolicyURI(self, policy_uri):
+        """Add an acceptable authentication policy URI to this request
+
+        This method is intended to be used by the relying party to add
+        acceptable authentication types to the request.
+
+        @param policy_uri: The identifier for the preferred type of
+            authentication.
+        @see: http://openid.net/specs/openid-provider-authentication-policy-extension-1_0-05.html#auth_policies
+        """
+        if policy_uri not in self.preferred_auth_policies:
+            self.preferred_auth_policies.append(policy_uri)
+
+    def addAuthLevel(self, auth_level_uri, alias=None):
+        self._addAuthLevelAlias(auth_level_uri, alias)
+        if auth_level_uri not in self.preferred_auth_level_types:
+            self.preferred_auth_level_types.append(auth_level_uri)
+
+    def getExtensionArgs(self):
+        """@see: C{L{Extension.getExtensionArgs}}
+        """
+        ns_args = {
+            'preferred_auth_policies': ' '.join(self.preferred_auth_policies),
+        }
+
+        if self.max_auth_age is not None:
+            ns_args['max_auth_age'] = str(self.max_auth_age)
+
+        if self.preferred_auth_level_types:
+            preferred_types = []
+
+            for auth_level_uri in self.preferred_auth_level_types:
+                alias = self._getAlias(auth_level_uri)
+                ns_args['auth_level.ns.%s' % (alias, )] = auth_level_uri
+                preferred_types.append(alias)
+
+            ns_args['preferred_auth_level_types'] = ' '.join(preferred_types)
+
+        return ns_args
+
+    def fromOpenIDRequest(cls, request):
+        """Instantiate a Request object from the arguments in a
+        C{checkid_*} OpenID message
+        """
+        self = cls()
+        args = request.message.getArgs(self.ns_uri)
+        is_openid1 = request.message.isOpenID1()
+
+        if args == {}:
+            return None
+
+        self.parseExtensionArgs(args, is_openid1)
+        return self
+
+    fromOpenIDRequest = classmethod(fromOpenIDRequest)
+
+    def parseExtensionArgs(self, args, is_openid1, strict=False):
+        """Set the state of this request to be that expressed in these
+        PAPE arguments
+
+        @param args: The PAPE arguments without a namespace
+
+        @param strict: Whether to raise an exception if the input is
+            out of spec or otherwise malformed. If strict is false,
+            malformed input will be ignored.
+
+        @param is_openid1: Whether the input should be treated as part
+            of an OpenID1 request
+
+        @rtype: None
+
+        @raises ValueError: When the max_auth_age is not parseable as
+            an integer
+        """
+
+        # preferred_auth_policies is a space-separated list of policy URIs
+        self.preferred_auth_policies = []
+
+        policies_str = args.get('preferred_auth_policies')
+        if policies_str:
+            if isinstance(policies_str, bytes):
+                policies_str = str(policies_str, encoding="utf-8")
+            for uri in policies_str.split(' '):
+                if uri not in self.preferred_auth_policies:
+                    self.preferred_auth_policies.append(uri)
+
+        # max_auth_age is base-10 integer number of seconds
+        max_auth_age_str = args.get('max_auth_age')
+        self.max_auth_age = None
+
+        if max_auth_age_str:
+            try:
+                self.max_auth_age = int(max_auth_age_str)
+            except ValueError:
+                if strict:
+                    raise
+
+        # Parse auth level information
+        preferred_auth_level_types = args.get('preferred_auth_level_types')
+        if preferred_auth_level_types:
+            aliases = preferred_auth_level_types.strip().split()
+
+            for alias in aliases:
+                key = 'auth_level.ns.%s' % (alias, )
+                try:
+                    uri = args[key]
+                except KeyError:
+                    if is_openid1:
+                        uri = self._default_auth_level_aliases.get(alias)
+                    else:
+                        uri = None
+
+                if uri is None:
+                    if strict:
+                        raise ValueError('preferred auth level %r is not '
+                                         'defined in this message' % (alias, ))
+                else:
+                    self.addAuthLevel(uri, alias)
+
+    def preferredTypes(self, supported_types):
+        """Given a list of authentication policy URIs that a provider
+        supports, this method returns the subsequence of those types
+        that are preferred by the relying party.
+
+        @param supported_types: A sequence of authentication policy
+            type URIs that are supported by a provider
+
+        @returns: The sub-sequence of the supported types that are
+            preferred by the relying party. This list will be ordered
+            in the order that the types appear in the supported_types
+            sequence, and may be empty if the provider does not prefer
+            any of the supported authentication types.
+
+        @returntype: [str]
+        """
+        return list(
+            filter(self.preferred_auth_policies.__contains__, supported_types))
+
+
+Request.ns_uri = ns_uri
+
+
+class Response(PAPEExtension):
+    """A Provider Authentication Policy response, sent from a provider
+    to a relying party
+
+    @ivar auth_policies: List of authentication policies conformed to
+        by this OpenID assertion, represented as policy URIs
+    """
+
+    ns_alias = 'pape'
+
+    def __init__(self, auth_policies=None, auth_time=None, auth_levels=None):
+        super(Response, self).__init__()
+        if auth_policies:
+            self.auth_policies = auth_policies
+        else:
+            self.auth_policies = []
+
+        self.auth_time = auth_time
+        self.auth_levels = {}
+
+        if auth_levels is None:
+            auth_levels = {}
+
+        for uri, level in auth_levels.items():
+            self.setAuthLevel(uri, level)
+
+    def setAuthLevel(self, level_uri, level, alias=None):
+        """Set the value for the given auth level type.
+
+        @param level: string representation of an authentication level
+            valid for level_uri
+
+        @param alias: An optional namespace alias for the given auth
+            level URI. May be omitted if the alias is not
+            significant. The library will use a reasonable default for
+            widely-used auth level types.
+        """
+        self._addAuthLevelAlias(level_uri, alias)
+        self.auth_levels[level_uri] = level
+
+    def getAuthLevel(self, level_uri):
+        """Return the auth level for the specified auth level
+        identifier
+
+        @returns: A string that should map to the auth levels defined
+            for the auth level type
+
+        @raises KeyError: If the auth level type is not present in
+            this message
+        """
+        return self.auth_levels[level_uri]
+
+    def _getNISTAuthLevel(self):
+        try:
+            return int(self.getAuthLevel(LEVELS_NIST))
+        except KeyError:
+            return None
+
+    nist_auth_level = property(
+        _getNISTAuthLevel,
+        doc="Backward-compatibility accessor for the NIST auth level")
+
+    def addPolicyURI(self, policy_uri):
+        """Add a authentication policy to this response
+
+        This method is intended to be used by the provider to add a
+        policy that the provider conformed to when authenticating the user.
+
+        @param policy_uri: The identifier for the preferred type of
+            authentication.
+        @see: http://openid.net/specs/openid-provider-authentication-policy-extension-1_0-01.html#auth_policies
+        """
+        if policy_uri == AUTH_NONE:
+            raise RuntimeError(
+                'To send no policies, do not set any on the response.')
+
+        if policy_uri not in self.auth_policies:
+            self.auth_policies.append(policy_uri)
+
+    def fromSuccessResponse(cls, success_response):
+        """Create a C{L{Response}} object from a successful OpenID
+        library response
+        (C{L{openid.consumer.consumer.SuccessResponse}}) response
+        message
+
+        @param success_response: A SuccessResponse from consumer.complete()
+        @type success_response: C{L{openid.consumer.consumer.SuccessResponse}}
+
+        @rtype: Response or None
+        @returns: A provider authentication policy response from the
+            data that was supplied with the C{id_res} response or None
+            if the provider sent no signed PAPE response arguments.
+        """
+        self = cls()
+
+        # PAPE requires that the args be signed.
+        args = success_response.getSignedNS(self.ns_uri)
+        is_openid1 = success_response.isOpenID1()
+
+        # Only try to construct a PAPE response if the arguments were
+        # signed in the OpenID response.  If not, return None.
+        if args is not None:
+            self.parseExtensionArgs(args, is_openid1)
+            return self
+        else:
+            return None
+
+    def parseExtensionArgs(self, args, is_openid1, strict=False):
+        """Parse the provider authentication policy arguments into the
+        internal state of this object
+
+        @param args: unqualified provider authentication policy
+            arguments
+
+        @param strict: Whether to raise an exception when bad data is
+            encountered
+
+        @returns: None. The data is parsed into the internal fields of
+            this object.
+        """
+        policies_str = args.get('auth_policies')
+        if policies_str:
+            auth_policies = policies_str.split(' ')
+        elif strict:
+            raise ValueError('Missing auth_policies')
+        else:
+            auth_policies = []
+
+        if (len(auth_policies) > 1 and strict and AUTH_NONE in auth_policies):
+            raise ValueError('Got some auth policies, as well as the special '
+                             '"none" URI: %r' % (auth_policies, ))
+
+        if 'none' in auth_policies:
+            msg = '"none" used as a policy URI (see PAPE draft < 5)'
+            if strict:
+                raise ValueError(msg)
+            else:
+                warnings.warn(msg, stacklevel=2)
+
+        auth_policies = [
+            u for u in auth_policies if u not in ['none', AUTH_NONE]
+        ]
+
+        self.auth_policies = auth_policies
+
+        for (key, val) in args.items():
+            if key.startswith('auth_level.'):
+                alias = key[11:]
+
+                # skip the already-processed namespace declarations
+                if alias.startswith('ns.'):
+                    continue
+
+                try:
+                    uri = args['auth_level.ns.%s' % (alias, )]
+                except KeyError:
+                    if is_openid1:
+                        uri = self._default_auth_level_aliases.get(alias)
+                    else:
+                        uri = None
+
+                if uri is None:
+                    if strict:
+                        raise ValueError('Undefined auth level alias: %r' %
+                                         (alias, ))
+                else:
+                    self.setAuthLevel(uri, val, alias)
+
+        auth_time = args.get('auth_time')
+        if auth_time:
+            if TIME_VALIDATOR.match(auth_time):
+                self.auth_time = auth_time
+            elif strict:
+                raise ValueError("auth_time must be in RFC3339 format")
+
+    fromSuccessResponse = classmethod(fromSuccessResponse)
+
+    def getExtensionArgs(self):
+        """@see: C{L{Extension.getExtensionArgs}}
+        """
+        if len(self.auth_policies) == 0:
+            ns_args = {
+                'auth_policies': AUTH_NONE,
+            }
+        else:
+            ns_args = {
+                'auth_policies': ' '.join(self.auth_policies),
+            }
+
+        for level_type, level in self.auth_levels.items():
+            alias = self._getAlias(level_type)
+            ns_args['auth_level.ns.%s' % (alias, )] = level_type
+            ns_args['auth_level.%s' % (alias, )] = str(level)
+
+        if self.auth_time is not None:
+            if not TIME_VALIDATOR.match(self.auth_time):
+                raise ValueError('auth_time must be in RFC3339 format')
+
+            ns_args['auth_time'] = self.auth_time
+
+        return ns_args
+
+
+Response.ns_uri = ns_uri

venv/lib/python3.12/site-packages/openid/extensions/sreg.py

@@ -0,0 +1,529 @@
+"""Simple registration request and response parsing and object representation
+
+This module contains objects representing simple registration requests
+and responses that can be used with both OpenID relying parties and
+OpenID providers.
+
+  1. The relying party creates a request object and adds it to the
+     C{L{AuthRequest<openid.consumer.consumer.AuthRequest>}} object
+     before making the C{checkid_} request to the OpenID provider::
+
+      auth_request.addExtension(SRegRequest(required=['email']))
+
+  2. The OpenID provider extracts the simple registration request from
+     the OpenID request using C{L{SRegRequest.fromOpenIDRequest}},
+     gets the user's approval and data, creates a C{L{SRegResponse}}
+     object and adds it to the C{id_res} response::
+
+      sreg_req = SRegRequest.fromOpenIDRequest(checkid_request)
+      # [ get the user's approval and data, informing the user that
+      #   the fields in sreg_response were requested ]
+      sreg_resp = SRegResponse.extractResponse(sreg_req, user_data)
+      sreg_resp.toMessage(openid_response.fields)
+
+  3. The relying party uses C{L{SRegResponse.fromSuccessResponse}} to
+     extract the data from the OpenID response::
+
+      sreg_resp = SRegResponse.fromSuccessResponse(success_response)
+
+@since: 2.0
+
+@var sreg_data_fields: The names of the data fields that are listed in
+    the sreg spec, and a description of them in English
+
+@var sreg_uri: The preferred URI to use for the simple registration
+    namespace and XRD Type value
+"""
+
+from openid.message import registerNamespaceAlias, \
+     NamespaceAliasRegistrationError
+from openid.extension import Extension
+import logging
+
+logger = logging.getLogger(__name__)
+
+try:
+    str  #pylint:disable-msg=W0104
+except NameError:
+    # For Python 2.2
+    str = (str, str)  #pylint:disable-msg=W0622
+
+__all__ = [
+    'SRegRequest',
+    'SRegResponse',
+    'data_fields',
+    'ns_uri',
+    'ns_uri_1_0',
+    'ns_uri_1_1',
+    'supportsSReg',
+]
+
+# The data fields that are listed in the sreg spec
+data_fields = {
+    'fullname': 'Full Name',
+    'nickname': 'Nickname',
+    'dob': 'Date of Birth',
+    'email': 'E-mail Address',
+    'gender': 'Gender',
+    'postcode': 'Postal Code',
+    'country': 'Country',
+    'language': 'Language',
+    'timezone': 'Time Zone',
+}
+
+
+def checkFieldName(field_name):
+    """Check to see that the given value is a valid simple
+    registration data field name.
+
+    @raise ValueError: if the field name is not a valid simple
+        registration data field name
+    """
+    if field_name not in data_fields:
+        raise ValueError('%r is not a defined simple registration field' %
+                         (field_name, ))
+
+
+# URI used in the wild for Yadis documents advertising simple
+# registration support
+ns_uri_1_0 = 'http://openid.net/sreg/1.0'
+
+# URI in the draft specification for simple registration 1.1
+# <http://openid.net/specs/openid-simple-registration-extension-1_1-01.html>
+ns_uri_1_1 = 'http://openid.net/extensions/sreg/1.1'
+
+# This attribute will always hold the preferred URI to use when adding
+# sreg support to an XRDS file or in an OpenID namespace declaration.
+ns_uri = ns_uri_1_1
+
+try:
+    registerNamespaceAlias(ns_uri_1_1, 'sreg')
+except NamespaceAliasRegistrationError as e:
+    logger.exception('registerNamespaceAlias(%r, %r) failed: %s' %
+                      (ns_uri_1_1, 'sreg', str(e), ))
+
+
+def supportsSReg(endpoint):
+    """Does the given endpoint advertise support for simple
+    registration?
+
+    @param endpoint: The endpoint object as returned by OpenID discovery
+    @type endpoint: openid.consumer.discover.OpenIDEndpoint
+
+    @returns: Whether an sreg type was advertised by the endpoint
+    @rtype: bool
+    """
+    return (endpoint.usesExtension(ns_uri_1_1) or
+            endpoint.usesExtension(ns_uri_1_0))
+
+
+class SRegNamespaceError(ValueError):
+    """The simple registration namespace was not found and could not
+    be created using the expected name (there's another extension
+    using the name 'sreg')
+
+    This is not I{illegal}, for OpenID 2, although it probably
+    indicates a problem, since it's not expected that other extensions
+    will re-use the alias that is in use for OpenID 1.
+
+    If this is an OpenID 1 request, then there is no recourse. This
+    should not happen unless some code has modified the namespaces for
+    the message that is being processed.
+    """
+
+
+def getSRegNS(message):
+    """Extract the simple registration namespace URI from the given
+    OpenID message. Handles OpenID 1 and 2, as well as both sreg
+    namespace URIs found in the wild, as well as missing namespace
+    definitions (for OpenID 1)
+
+    @param message: The OpenID message from which to parse simple
+        registration fields. This may be a request or response message.
+    @type message: C{L{openid.message.Message}}
+
+    @returns: the sreg namespace URI for the supplied message. The
+        message may be modified to define a simple registration
+        namespace.
+    @rtype: C{str}
+
+    @raise ValueError: when using OpenID 1 if the message defines
+        the 'sreg' alias to be something other than a simple
+        registration type.
+    """
+    # See if there exists an alias for one of the two defined simple
+    # registration types.
+    for sreg_ns_uri in [ns_uri_1_1, ns_uri_1_0]:
+        alias = message.namespaces.getAlias(sreg_ns_uri)
+        if alias is not None:
+            break
+    else:
+        # There is no alias for either of the types, so try to add
+        # one. We default to using the modern value (1.1)
+        sreg_ns_uri = ns_uri_1_1
+        try:
+            message.namespaces.addAlias(ns_uri_1_1, 'sreg')
+        except KeyError as why:
+            # An alias for the string 'sreg' already exists, but it's
+            # defined for something other than simple registration
+            raise SRegNamespaceError(why)
+
+    # we know that sreg_ns_uri defined, because it's defined in the
+    # else clause of the loop as well, so disable the warning
+    return sreg_ns_uri  #pylint:disable-msg=W0631
+
+
+class SRegRequest(Extension):
+    """An object to hold the state of a simple registration request.
+
+    @ivar required: A list of the required fields in this simple
+        registration request
+    @type required: [str]
+
+    @ivar optional: A list of the optional fields in this simple
+        registration request
+    @type optional: [str]
+
+    @ivar policy_url: The policy URL that was provided with the request
+    @type policy_url: str or NoneType
+
+    @group Consumer: requestField, requestFields, getExtensionArgs, addToOpenIDRequest
+    @group Server: fromOpenIDRequest, parseExtensionArgs
+    """
+
+    ns_alias = 'sreg'
+
+    def __init__(self,
+                 required=None,
+                 optional=None,
+                 policy_url=None,
+                 sreg_ns_uri=ns_uri):
+        """Initialize an empty simple registration request"""
+        Extension.__init__(self)
+        self.required = []
+        self.optional = []
+        self.policy_url = policy_url
+        self.ns_uri = sreg_ns_uri
+
+        if required:
+            self.requestFields(required, required=True, strict=True)
+
+        if optional:
+            self.requestFields(optional, required=False, strict=True)
+
+    # Assign getSRegNS to a static method so that it can be
+    # overridden for testing.
+    _getSRegNS = staticmethod(getSRegNS)
+
+    def fromOpenIDRequest(cls, request):
+        """Create a simple registration request that contains the
+        fields that were requested in the OpenID request with the
+        given arguments
+
+        @param request: The OpenID request
+        @type request: openid.server.CheckIDRequest
+
+        @returns: The newly created simple registration request
+        @rtype: C{L{SRegRequest}}
+        """
+        self = cls()
+
+        # Since we're going to mess with namespace URI mapping, don't
+        # mutate the object that was passed in.
+        message = request.message.copy()
+
+        self.ns_uri = self._getSRegNS(message)
+        args = message.getArgs(self.ns_uri)
+        self.parseExtensionArgs(args)
+
+        return self
+
+    fromOpenIDRequest = classmethod(fromOpenIDRequest)
+
+    def parseExtensionArgs(self, args, strict=False):
+        """Parse the unqualified simple registration request
+        parameters and add them to this object.
+
+        This method is essentially the inverse of
+        C{L{getExtensionArgs}}. This method restores the serialized simple
+        registration request fields.
+
+        If you are extracting arguments from a standard OpenID
+        checkid_* request, you probably want to use C{L{fromOpenIDRequest}},
+        which will extract the sreg namespace and arguments from the
+        OpenID request. This method is intended for cases where the
+        OpenID server needs more control over how the arguments are
+        parsed than that method provides.
+
+        >>> args = message.getArgs(ns_uri)
+        >>> request.parseExtensionArgs(args)
+
+        @param args: The unqualified simple registration arguments
+        @type args: {str:str}
+
+        @param strict: Whether requests with fields that are not
+            defined in the simple registration specification should be
+            tolerated (and ignored)
+        @type strict: bool
+
+        @returns: None; updates this object
+        """
+        for list_name in ['required', 'optional']:
+            required = (list_name == 'required')
+            items = args.get(list_name)
+            if items:
+                for field_name in items.split(','):
+                    try:
+                        self.requestField(field_name, required, strict)
+                    except ValueError:
+                        if strict:
+                            raise
+
+        self.policy_url = args.get('policy_url')
+
+    def allRequestedFields(self):
+        """A list of all of the simple registration fields that were
+        requested, whether they were required or optional.
+
+        @rtype: [str]
+        """
+        return self.required + self.optional
+
+    def wereFieldsRequested(self):
+        """Have any simple registration fields been requested?
+
+        @rtype: bool
+        """
+        return bool(self.allRequestedFields())
+
+    def __contains__(self, field_name):
+        """Was this field in the request?"""
+        return (field_name in self.required or field_name in self.optional)
+
+    def requestField(self, field_name, required=False, strict=False):
+        """Request the specified field from the OpenID user
+
+        @param field_name: the unqualified simple registration field name
+        @type field_name: str
+
+        @param required: whether the given field should be presented
+            to the user as being a required to successfully complete
+            the request
+
+        @param strict: whether to raise an exception when a field is
+            added to a request more than once
+
+        @raise ValueError: when the field requested is not a simple
+            registration field or strict is set and the field was
+            requested more than once
+        """
+        checkFieldName(field_name)
+
+        if strict:
+            if field_name in self.required or field_name in self.optional:
+                raise ValueError('That field has already been requested')
+        else:
+            if field_name in self.required:
+                return
+
+            if field_name in self.optional:
+                if required:
+                    self.optional.remove(field_name)
+                else:
+                    return
+
+        if required:
+            self.required.append(field_name)
+        else:
+            self.optional.append(field_name)
+
+    def requestFields(self, field_names, required=False, strict=False):
+        """Add the given list of fields to the request
+
+        @param field_names: The simple registration data fields to request
+        @type field_names: [str]
+
+        @param required: Whether these values should be presented to
+            the user as required
+
+        @param strict: whether to raise an exception when a field is
+            added to a request more than once
+
+        @raise ValueError: when a field requested is not a simple
+            registration field or strict is set and a field was
+            requested more than once
+        """
+        if isinstance(field_names, str):
+            raise TypeError('Fields should be passed as a list of '
+                            'strings (not %r)' % (type(field_names), ))
+
+        for field_name in field_names:
+            self.requestField(field_name, required, strict=strict)
+
+    def getExtensionArgs(self):
+        """Get a dictionary of unqualified simple registration
+        arguments representing this request.
+
+        This method is essentially the inverse of
+        C{L{parseExtensionArgs}}. This method serializes the simple
+        registration request fields.
+
+        @rtype: {str:str}
+        """
+        args = {}
+
+        if self.required:
+            args['required'] = ','.join(self.required)
+
+        if self.optional:
+            args['optional'] = ','.join(self.optional)
+
+        if self.policy_url:
+            args['policy_url'] = self.policy_url
+
+        return args
+
+
+class SRegResponse(Extension):
+    """Represents the data returned in a simple registration response
+    inside of an OpenID C{id_res} response. This object will be
+    created by the OpenID server, added to the C{id_res} response
+    object, and then extracted from the C{id_res} message by the
+    Consumer.
+
+    @ivar data: The simple registration data, keyed by the unqualified
+        simple registration name of the field (i.e. nickname is keyed
+        by C{'nickname'})
+
+    @ivar ns_uri: The URI under which the simple registration data was
+        stored in the response message.
+
+    @group Server: extractResponse
+    @group Consumer: fromSuccessResponse
+    @group Read-only dictionary interface: keys, iterkeys, items, iteritems,
+        __iter__, get, __getitem__, keys, has_key
+    """
+
+    ns_alias = 'sreg'
+
+    def __init__(self, data=None, sreg_ns_uri=ns_uri):
+        Extension.__init__(self)
+        if data is None:
+            self.data = {}
+        else:
+            self.data = data
+
+        self.ns_uri = sreg_ns_uri
+
+    def extractResponse(cls, request, data):
+        """Take a C{L{SRegRequest}} and a dictionary of simple
+        registration values and create a C{L{SRegResponse}}
+        object containing that data.
+
+        @param request: The simple registration request object
+        @type request: SRegRequest
+
+        @param data: The simple registration data for this
+            response, as a dictionary from unqualified simple
+            registration field name to string (unicode) value. For
+            instance, the nickname should be stored under the key
+            'nickname'.
+        @type data: {str:str}
+
+        @returns: a simple registration response object
+        @rtype: SRegResponse
+        """
+        self = cls()
+        self.ns_uri = request.ns_uri
+        for field in request.allRequestedFields():
+            value = data.get(field)
+            if value is not None:
+                self.data[field] = value
+        return self
+
+    extractResponse = classmethod(extractResponse)
+
+    # Assign getSRegArgs to a static method so that it can be
+    # overridden for testing
+    _getSRegNS = staticmethod(getSRegNS)
+
+    def fromSuccessResponse(cls, success_response, signed_only=True):
+        """Create a C{L{SRegResponse}} object from a successful OpenID
+        library response
+        (C{L{openid.consumer.consumer.SuccessResponse}}) response
+        message
+
+        @param success_response: A SuccessResponse from consumer.complete()
+        @type success_response: C{L{openid.consumer.consumer.SuccessResponse}}
+
+        @param signed_only: Whether to process only data that was
+            signed in the id_res message from the server.
+        @type signed_only: bool
+
+        @rtype: SRegResponse
+        @returns: A simple registration response containing the data
+            that was supplied with the C{id_res} response.
+        """
+        self = cls()
+        self.ns_uri = self._getSRegNS(success_response.message)
+        if signed_only:
+            args = success_response.getSignedNS(self.ns_uri)
+        else:
+            args = success_response.message.getArgs(self.ns_uri)
+
+        if not args:
+            return None
+
+        for field_name in data_fields:
+            if field_name in args:
+                self.data[field_name] = args[field_name]
+
+        return self
+
+    fromSuccessResponse = classmethod(fromSuccessResponse)
+
+    def getExtensionArgs(self):
+        """Get the fields to put in the simple registration namespace
+        when adding them to an id_res message.
+
+        @see: openid.extension
+        """
+        return self.data
+
+    # Read-only dictionary interface
+    def get(self, field_name, default=None):
+        """Like dict.get, except that it checks that the field name is
+        defined by the simple registration specification"""
+        checkFieldName(field_name)
+        return self.data.get(field_name, default)
+
+    def items(self):
+        """All of the data values in this simple registration response
+        """
+        return list(self.data.items())
+
+    def iteritems(self):
+        return iter(self.data.items())
+
+    def keys(self):
+        return list(self.data.keys())
+
+    def iterkeys(self):
+        return iter(self.data.keys())
+
+    def has_key(self, key):
+        return key in self
+
+    def __contains__(self, field_name):
+        checkFieldName(field_name)
+        return field_name in self.data
+
+    def __iter__(self):
+        return iter(self.data)
+
+    def __getitem__(self, field_name):
+        checkFieldName(field_name)
+        return self.data[field_name]
+
+    def __bool__(self):
+        return bool(self.data)