RFC7591: Use default values for 'response_types' and 'grant_types'

authlib/oauth2/rfc7591/endpoint.py

@@ -108,15 +108,21 @@ def _validate_scope(claims, value):
             response_types_supported = set(response_types_supported)
 
             def _validate_response_types(claims, value):
-                return response_types_supported.issuperset(set(value))
+                # If omitted, the default is that the client will use only the "code"
+                # response type.
+                response_types = set(value) if value else {"code"}
+                return response_types_supported.issuperset(response_types)
 
             options['response_types'] = {'validate': _validate_response_types}
 
         if grant_types_supported is not None:
             grant_types_supported = set(grant_types_supported)
 
             def _validate_grant_types(claims, value):
-                return grant_types_supported.issuperset(set(value))
+                # If omitted, the default behavior is that the client will use only
+                # the "authorization_code" Grant Type.
+                grant_types = set(value) if value else {"authorization_code"}
+                return grant_types_supported.issuperset(grant_types)
 
             options['grant_types'] = {'validate': _validate_grant_types}
 

authlib/oauth2/rfc7592/endpoint.py

@@ -138,15 +138,21 @@ def _validate_scope(claims, value):
             response_types_supported = set(response_types_supported)
 
             def _validate_response_types(claims, value):
-                return response_types_supported.issuperset(set(value))
+                # If omitted, the default is that the client will use only the "code"
+                # response type.
+                response_types = set(value) if value else {"code"}
+                return response_types_supported.issuperset(response_types)
 
             options['response_types'] = {'validate': _validate_response_types}
 
         if grant_types_supported is not None:
             grant_types_supported = set(grant_types_supported)
 
             def _validate_grant_types(claims, value):
-                return grant_types_supported.issuperset(set(value))
+                # If omitted, the default behavior is that the client will use only
+                # the "authorization_code" Grant Type.
+                grant_types = set(value) if value else {"authorization_code"}
+                return grant_types_supported.issuperset(grant_types)
 
             options['grant_types'] = {'validate': _validate_grant_types}
 

docs/changelog.rst

@@ -6,6 +6,11 @@ Changelog
 
 Here you can see the full list of changes between each Authlib release.
 
+Version x.x.x
+-------------
+
+- Fixed RFC7591 and RFC7592 ``grant_types`` and ``response_types`` default values, via :gh:`PR#509`.
+
 Version 1.2.0
 -------------
 

tests/flask/test_oauth2/test_client_registration_endpoint.py

@@ -137,6 +137,15 @@ def test_response_types_supported(self):
         self.assertIn('client_id', resp)
         self.assertEqual(resp['client_name'], 'Authlib')
 
+        # https://www.rfc-editor.org/rfc/rfc7591.html#section-2
+        # If omitted, the default is that the client will use only the "code"
+        # response type.
+        body = {'client_name': 'Authlib'}
+        rv = self.client.post('/create_client', json=body, headers=headers)
+        resp = json.loads(rv.data)
+        self.assertIn('client_id', resp)
+        self.assertEqual(resp['client_name'], 'Authlib')
+
         body = {'response_types': ['code', 'token'], 'client_name': 'Authlib'}
         rv = self.client.post('/create_client', json=body, headers=headers)
         resp = json.loads(rv.data)
@@ -153,6 +162,15 @@ def test_grant_types_supported(self):
         self.assertIn('client_id', resp)
         self.assertEqual(resp['client_name'], 'Authlib')
 
+        # https://www.rfc-editor.org/rfc/rfc7591.html#section-2
+        # If omitted, the default behavior is that the client will use only
+        # the "authorization_code" Grant Type.
+        body = {'client_name': 'Authlib'}
+        rv = self.client.post('/create_client', json=body, headers=headers)
+        resp = json.loads(rv.data)
+        self.assertIn('client_id', resp)
+        self.assertEqual(resp['client_name'], 'Authlib')
+
         body = {'grant_types': ['client_credentials'], 'client_name': 'Authlib'}
         rv = self.client.post('/create_client', json=body, headers=headers)
         resp = json.loads(rv.data)