Repository: liberapay/liberapay.com

Issue:
Switch to OAuth 2 for OpenStreetMap provider
Switch to OAuth 2 from HTTP Basic Auth and OAuth 1.0a. They are being deprecated.
See https://github.com/openstreetmap/operations/issues/867
Switch to OAuth 2 for OpenStreetMap provider
Switch to OAuth 2 from HTTP Basic Auth and OAuth 1.0a. They are being deprecated.
See https://github.com/openstreetmap/operations/issues/867


Discussion:
https://blog.openstreetmap.org/2024/04/17/oauth-1-0a-and-http-basic-auth-shutdown-on-openstreetmap-org/ lists a couple of milestones that are still to come:

* May 1st, 2024: System administrators will start brownouts to find applications that are still using OAuth 1.0a or HTTP Basic Auth.
* June 1st, 2024: OAuth 1.0a and HTTP Basic Auth will be shut down.
https://blog.openstreetmap.org/2024/04/17/oauth-1-0a-and-http-basic-auth-shutdown-on-openstreetmap-org/ lists a couple of milestones that are still to come:

* May 1st, 2024: System administrators will start brownouts to find applications that are still using OAuth 1.0a or HTTP Basic Auth.
* June 1st, 2024: OAuth 1.0a and HTTP Basic Auth will be shut down.

Resolving patch:
diff --git a/liberapay/elsewhere/_base.py b/liberapay/elsewhere/_base.py
--- a/liberapay/elsewhere/_base.py
+++ b/liberapay/elsewhere/_base.py
@@ -98,7 +98,7 @@ class Platform:
     required_attrs = ('account_url', 'display_name', 'name')
 
     def __init__(self, api_key, api_secret, callback_url, api_url=None, auth_url=None,
-                 api_timeout=20.0, app_name=None, app_url=None):
+                 api_timeout=20.0, app_name=None, app_url=None, access_token_url=None):
         self.api_key = api_key
         self.api_secret = api_secret
         self.callback_url = callback_url
@@ -108,6 +108,8 @@ def __init__(self, api_key, api_secret, callback_url, api_url=None, auth_url=Non
             self.auth_url = auth_url
         elif not getattr(self, 'auth_url', None):
             self.auth_url = self.api_url
+        if access_token_url:
+            self.access_token_url = access_token_url
         self.api_timeout = api_timeout
         self.app_name = app_name
         self.app_url = app_url
diff --git a/liberapay/elsewhere/openstreetmap.py b/liberapay/elsewhere/openstreetmap.py
--- a/liberapay/elsewhere/openstreetmap.py
+++ b/liberapay/elsewhere/openstreetmap.py
@@ -1,15 +1,18 @@
-from liberapay.elsewhere._base import PlatformOAuth1
+from liberapay.elsewhere._base import PlatformOAuth2
 from liberapay.elsewhere._extractors import not_available, xpath
 
 
-class OpenStreetMap(PlatformOAuth1):
+class OpenStreetMap(PlatformOAuth2):
 
     # Platform attributes
     name = 'openstreetmap'
     display_name = 'OpenStreetMap'
     account_url = 'http://www.openstreetmap.org/user/{user_name}'
 
-    # API attributes
+    # Auth attributes - https://wiki.openstreetmap.org/wiki/OAuth
+    oauth_default_scope = ['read_prefs']
+
+    # API attributes - https://wiki.openstreetmap.org/wiki/API_v0.6
     api_format = 'xml'
     api_user_info_path = '/user/{user_id}'
     api_user_self_info_path = '/user/details'
diff --git a/liberapay/wireup.py b/liberapay/wireup.py
--- a/liberapay/wireup.py
+++ b/liberapay/wireup.py
@@ -219,6 +219,7 @@ class AppConf:
         linuxfr_id=str,
         linuxfr_secret=str,
         log_emails=bool,
+        openstreetmap_access_token_url=str,
         openstreetmap_api_url=str,
         openstreetmap_auth_url=str,
         openstreetmap_callback=str,


Test patch: