#NEWLINE# def _access_token_endpoint( self , req , **kwargs ) : #NEWLINE# #INDENT# _sdb = self . sdb #NEWLINE# _log_debug = logger . debug #NEWLINE# client_info = self . cdb [ str ( req [ 'client_id' ] ) ] #NEWLINE# assert ( req [ 'grant_type' ] == 'authorization_code' ) #NEWLINE# _access_code = req [ 'code' ] . replace ( ' ' , '+' ) #NEWLINE# if self . sdb . is_revoked ( _access_code ) : #NEWLINE# #INDENT# return self . _error ( error = 'access_denied' , descr = 'Token is revoked' ) #NEWLINE# #UNINDENT# try : #NEWLINE# #INDENT# _info = _sdb [ _access_code ] #NEWLINE# #UNINDENT# except KeyError : #NEWLINE# #INDENT# return self . _error ( error = 'access_denied' , descr = 'Token is invalid' ) #NEWLINE# #UNINDENT# if ( 'redirect_uri' in _info ) : #NEWLINE# #INDENT# try : #NEWLINE# #INDENT# assert ( req [ 'redirect_uri' ] == _info [ 'redirect_uri' ] ) #NEWLINE# #UNINDENT# except AssertionError : #NEWLINE# #INDENT# return self . _error ( error = 'access_denied' , descr = 'redirect_uri mismatch' ) #NEWLINE# #UNINDENT# #UNINDENT# _log_debug ( 'All checks OK' ) #NEWLINE# issue_refresh = False #NEWLINE# if ( 'issue_refresh' in kwargs ) : #NEWLINE# #INDENT# issue_refresh = kwargs [ 'issue_refresh' ] #NEWLINE# #UNINDENT# permissions = ( _info . get ( 'permission' , [ 'offline_access' ] ) or [ 'offline_access' ] ) #NEWLINE# if ( ( 'offline_access' in _info [ 'scope' ] ) and ( 'offline_access' in permissions ) ) : #NEWLINE# #INDENT# issue_refresh = True #NEWLINE# #UNINDENT# try : #NEWLINE# #INDENT# _tinfo = _sdb . upgrade_to_token ( client_info , issue_refresh = issue_refresh ) #NEWLINE# #UNINDENT# except AccessCodeUsed as err : #NEWLINE# #INDENT# logger . error ( ( '%s' % err ) ) #NEWLINE# _sdb . revoke_all_tokens ( _access_code ) #NEWLINE# return self . _error ( error = 'access_denied' , descr = ( '%s' % err ) ) #NEWLINE# #UNINDENT# if ( 'openid' in _info [ 'scope' ] ) : #NEWLINE# #INDENT# userinfo = self . userinfo_in_id_token_claims ( _info ) #NEWLINE# try : #NEWLINE# #INDENT# _idtoken = self . sign_encrypt_id_token ( _info , client_info , req , user_info = userinfo ) #NEWLINE# #UNINDENT# except ( JWEException , NoSuitableSigningKeys ) as err : #NEWLINE# #INDENT# logger . warning ( str ( err ) ) #NEWLINE# return self . _error ( error = 'access_denied' , descr = 'Could not sign/encrypt id_token' ) #NEWLINE# #UNINDENT# _sdb . update_by_token ( _access_code , 'id_token' , _idtoken ) #NEWLINE# #UNINDENT# _tinfo = _sdb [ _access_code ] #NEWLINE# _log_debug ( ( '_tinfo: %s' % _tinfo ) ) #NEWLINE# atr = AccessTokenResponse ( ** by_schema ( AccessTokenResponse , ** _tinfo ) ) #NEWLINE# logger . info ( ( 'access_token_response: %s' % atr . to_dict ( ) ) ) #NEWLINE# return Response ( atr . to_json ( ) , content = 'application/json' )