fix: client authentication

README.md

@@ -1,5 +1,5 @@
 [![PyPI](https://img.shields.io/pypi/v/flame-hub-client?label=PyPI&cacheSeconds=0)](https://pypi.org/project/flame-hub-client/)
-![Code Coverage](https://img.shields.io/badge/Coverage-97%25-brightgreen.svg)
+![Code Coverage](https://img.shields.io/badge/Coverage-98%25-brightgreen.svg)
 ![Python versions](https://img.shields.io/badge/Python->=3.10-blue)
 [![License](https://img.shields.io/pypi/l/flame-hub-client?label=License&cacheSeconds=0)](https://pypi.org/project/flame-hub-client/)
 [![Conventional Commits](https://img.shields.io/badge/Conventional%20Commits-1.0.0-%23FE5196?logo=conventionalcommits&logoColor=white)](https://conventionalcommits.org)

flame_hub/_auth_client.py

@@ -182,6 +182,10 @@ class UserRole(CreateUserRole):
     role_realm: t.Annotated[Realm | None, IsIncludable] = None
 
 
+ClientAuthMethod = t.Literal["none", "secret", "tls"]
+ClientTokenBindingMethod = t.Literal["none", "tls"]
+
+
 class CreateClient(AuthBaseModel):
     name: str
     secret: str | None
@@ -192,6 +196,8 @@ class CreateClient(AuthBaseModel):
     is_confidential: bool
     secret_hashed: bool
     grant_types: str | None
+    auth_method: ClientAuthMethod
+    token_binding_method: ClientTokenBindingMethod
     realm_id: t.Annotated[uuid.UUID, Field(), WrapValidator(uuid_validator)]
 
 
@@ -209,6 +215,8 @@ class Client(AuthBaseModel):
     scope: str | None
     base_url: str | None
     root_url: str | None
+    auth_method: ClientAuthMethod
+    token_binding_method: ClientTokenBindingMethod
     created_at: datetime
     updated_at: datetime
     realm_id: uuid.UUID
@@ -225,6 +233,8 @@ class UpdateClient(AuthBaseModel):
     is_confidential: bool | UNSET_T = UNSET
     secret_hashed: bool | UNSET_T = UNSET
     grant_types: str | None | UNSET_T = UNSET
+    auth_method: ClientAuthMethod | UNSET_T = UNSET
+    token_binding_method: ClientTokenBindingMethod | UNSET_T = UNSET
 
 
 class AuthClient(BaseClient):
@@ -593,6 +603,8 @@ def create_client(
         is_confidential: bool = True,
         secret_hashed: bool = False,
         grant_types: str | None = None,
+        auth_method: ClientAuthMethod = "secret",
+        token_binding_method: ClientTokenBindingMethod = "none",
         **params: te.Unpack[BaseKwargs],
     ) -> Client:
         return self._create_resource(
@@ -608,6 +620,8 @@ def create_client(
                 is_confidential=is_confidential,
                 secret_hashed=secret_hashed,
                 grant_types=grant_types,
+                auth_method=auth_method,
+                token_binding_method=token_binding_method,
             ),
             "clients",
             **params,
@@ -637,6 +651,8 @@ def update_client(
         is_confidential: bool | UNSET_T = UNSET,
         secret_hashed: bool | UNSET_T = UNSET,
         grant_types: str | None | UNSET_T = UNSET,
+        auth_method: ClientAuthMethod | UNSET_T = UNSET,
+        token_binding_method: ClientTokenBindingMethod | UNSET_T = UNSET,
         **params: te.Unpack[BaseKwargs],
     ) -> Client:
         return self._update_resource(
@@ -651,6 +667,8 @@ def update_client(
                 is_confidential=is_confidential,
                 secret_hashed=secret_hashed,
                 grant_types=grant_types,
+                auth_method=auth_method,
+                token_binding_method=token_binding_method,
             ),
             "clients",
             client_id,

tests/test_flow.py

@@ -27,7 +27,6 @@ def test_password_auth_reissue(password_auth, auth_base_url):
     assert client.auth._current_token.access_token != old_token
 
 
-@pytest.mark.xfail(reason="Bug in client authentication")
 def test_client_auth(auth_client, auth_base_url, master_realm):
     client_secret = next_random_string(length=64)
     client_resource = auth_client.create_client(name=next_random_string(), realm_id=master_realm, secret=client_secret)