Add OIDCLogoutOnlyMixin to RPInitiatedLogoutView

Author: Qup42

oauth2_provider/views/mixins.py

@@ -326,3 +326,27 @@ def dispatch(self, *args, **kwargs):
             log.warning(self.debug_error_message)
             return HttpResponseNotFound()
         return super().dispatch(*args, **kwargs)
+
+
+class OIDCLogoutOnlyMixin(OIDCOnlyMixin):
+    """
+    Mixin for views that should only be accessible when OIDC and OIDC RP-Initiated Logout are enabled.
+
+    If either is not enabled:
+
+    * if DEBUG is True, raises an ImproperlyConfigured exception explaining why
+    * otherwise, returns a 404 response, logging the same warning
+    """
+
+    debug_error_message = (
+        "The django-oauth-toolkit OIDC RP-Initiated Logout view is not enabled unless you "
+        "have configured OIDC_RP_INITIATED_LOGOUT_ENABLED in the settings"
+    )
+
+    def dispatch(self, *args, **kwargs):
+        if not oauth2_settings.OIDC_RP_INITIATED_LOGOUT_ENABLED:
+            if settings.DEBUG:
+                raise ImproperlyConfigured(self.debug_error_message)
+            log.warning(self.debug_error_message)
+            return HttpResponseNotFound()
+        return super().dispatch(*args, **kwargs)

oauth2_provider/views/oidc.py

@@ -22,7 +22,7 @@
 from ..http import OAuth2ResponseRedirect
 from ..models import get_application_model
 from ..settings import oauth2_settings
-from .mixins import OAuthLibMixin, OIDCOnlyMixin
+from .mixins import OAuthLibMixin, OIDCLogoutOnlyMixin, OIDCOnlyMixin
 
 
 Application = get_application_model()
@@ -206,7 +206,7 @@ def validate_logout_request(user, id_token_hint, client_id, post_logout_redirect
     return prompt_logout, (post_logout_redirect_uri, application)
 
 
-class RPInitiatedLogoutView(OIDCOnlyMixin, FormView):
+class RPInitiatedLogoutView(OIDCLogoutOnlyMixin, FormView):
     template_name = "oauth2_provider/logout_confirm.html"
     form_class = ConfirmLogoutForm
 

tests/test_mixins.py

@@ -11,6 +11,7 @@
 from oauth2_provider.oauth2_validators import OAuth2Validator
 from oauth2_provider.views.mixins import (
     OAuthLibMixin,
+    OIDCLogoutOnlyMixin,
     OIDCOnlyMixin,
     ProtectedResourceMixin,
     ScopedResourceMixin,
@@ -145,6 +146,15 @@ def get(self, *args, **kwargs):
     return TView.as_view()
 
 
+@pytest.fixture
+def oidc_logout_only_view():
+    class TView(OIDCLogoutOnlyMixin, View):
+        def get(self, *args, **kwargs):
+            return HttpResponse("OK")
+
+    return TView.as_view()
+
+
 @pytest.mark.oauth2_settings(presets.OIDC_SETTINGS_RW)
 def test_oidc_only_mixin_oidc_enabled(oauth2_settings, rf, oidc_only_view):
     assert oauth2_settings.OIDC_ENABLED
@@ -153,6 +163,14 @@ def test_oidc_only_mixin_oidc_enabled(oauth2_settings, rf, oidc_only_view):
     assert rsp.content.decode("utf-8") == "OK"
 
 
+@pytest.mark.oauth2_settings(presets.OIDC_SETTINGS_RP_LOGOUT)
+def test_oidc_logout_only_mixin_oidc_enabled(oauth2_settings, rf, oidc_only_view):
+    assert oauth2_settings.OIDC_RP_INITIATED_LOGOUT_ENABLED
+    rsp = oidc_only_view(rf.get("/"))
+    assert rsp.status_code == 200
+    assert rsp.content.decode("utf-8") == "OK"
+
+
 def test_oidc_only_mixin_oidc_disabled_debug(oauth2_settings, rf, settings, oidc_only_view):
     assert oauth2_settings.OIDC_ENABLED is False
     settings.DEBUG = True
@@ -161,6 +179,14 @@ def test_oidc_only_mixin_oidc_disabled_debug(oauth2_settings, rf, settings, oidc
     assert "OIDC views are not enabled" in str(exc.value)
 
 
+def test_oidc_logout_only_mixin_oidc_disabled_debug(oauth2_settings, rf, settings, oidc_logout_only_view):
+    assert oauth2_settings.OIDC_RP_INITIATED_LOGOUT_ENABLED is False
+    settings.DEBUG = True
+    with pytest.raises(ImproperlyConfigured) as exc:
+        oidc_logout_only_view(rf.get("/"))
+        assert str(exc.value) == OIDCLogoutOnlyMixin.debug_error_message
+
+
 def test_oidc_only_mixin_oidc_disabled_no_debug(oauth2_settings, rf, settings, oidc_only_view, caplog):
     assert oauth2_settings.OIDC_ENABLED is False
     settings.DEBUG = False
@@ -169,3 +195,15 @@ def test_oidc_only_mixin_oidc_disabled_no_debug(oauth2_settings, rf, settings, o
     assert rsp.status_code == 404
     assert len(caplog.records) == 1
     assert "OIDC views are not enabled" in caplog.records[0].message
+
+
+def test_oidc_logout_only_mixin_oidc_disabled_no_debug(
+    oauth2_settings, rf, settings, oidc_logout_only_view, caplog
+):
+    assert oauth2_settings.OIDC_RP_INITIATED_LOGOUT_ENABLED is False
+    settings.DEBUG = False
+    with caplog.at_level(logging.WARNING, logger="oauth2_provider"):
+        rsp = oidc_logout_only_view(rf.get("/"))
+        assert rsp.status_code == 404
+        assert len(caplog.records) == 1
+        assert caplog.records[0].message == OIDCLogoutOnlyMixin.debug_error_message