Validate access token against the current OIDC provider's JWKS. Returns False when the signature or expiry check fails (wrong provider, expired, tampered). Returns True on network errors so the caller can fall through to the API and let the server decide.
(access_token: str)
| 100 | |
| 101 | |
| 102 | def _validate_access_token(access_token: str) -> bool: |
| 103 | """Validate access token against the current OIDC provider's JWKS. |
| 104 | |
| 105 | Returns False when the signature or expiry check fails (wrong provider, |
| 106 | expired, tampered). Returns True on network errors so the caller can |
| 107 | fall through to the API and let the server decide. |
| 108 | """ |
| 109 | try: |
| 110 | discovery = _discover_endpoints() |
| 111 | jwks_resp = requests.get(discovery["jwks_uri"]) |
| 112 | jwks_resp.raise_for_status() |
| 113 | keyset = KeySet.import_key_set(jwks_resp.json()) |
| 114 | token = jose_jwt.decode(access_token, keyset) |
| 115 | jose_jwt.JWTClaimsRegistry().validate(token.claims) |
| 116 | return True |
| 117 | except requests.RequestException as exc: |
| 118 | logger.warning( |
| 119 | "Skipping local access token validation because the auth server is " |
| 120 | "unreachable; the API will validate the token. Error: %s", |
| 121 | exc, |
| 122 | ) |
| 123 | return True # Can't reach auth server — let the API handle it |
| 124 | except Exception: |
| 125 | return False |
| 126 | |
| 127 | |
| 128 | def _refresh_tokens(refresh_token: str) -> dict: |
no test coverage detected
searching dependent graphs…