Skip to content

Commit 2e8427e

Browse files
committed
oidc-exhcange: factor out audience call check
Signed-off-by: William Woodruff <[email protected]>
1 parent 5fb36eb commit 2e8427e

File tree

1 file changed

+26
-22
lines changed

1 file changed

+26
-22
lines changed

oidc-exchange.py

Lines changed: 26 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,31 @@ def get_normalized_input(name: str) -> str | None:
4747
return os.getenv(name.replace("-", "_"))
4848

4949

50+
def assert_successful_audience_call(resp: requests.Response, domain: str):
51+
if resp.ok:
52+
return
53+
54+
match resp.status_code:
55+
case 403:
56+
# This index supports OIDC, but forbids the client from using
57+
# it (either because it's disabled, ratelimited, etc.)
58+
die(f"audience retrieval failed: repository at {domain} has OIDC disabled")
59+
case 404:
60+
# This index does not support OIDC.
61+
die(
62+
"audience retrieval failed: repository at "
63+
f"{domain} does not indicate OIDC support"
64+
)
65+
case other:
66+
# Unknown: the index may or may not support OIDC, but didn't respond with
67+
# something we expect. This can happen if the index is broken, in maintenance mode,
68+
# misconfigured, etc.
69+
die(
70+
"audience retrieval failed: repository at "
71+
f"{domain} responded with unexpected {other}"
72+
)
73+
74+
5075
repository_url = get_normalized_input("repository-url")
5176
if not repository_url:
5277
# Easy case: no explicit repository URL, which means we're using PyPI and we can just
@@ -61,28 +86,7 @@ def get_normalized_input(name: str) -> str | None:
6186
# which tells OIDC exchange clients which audience to use.
6287
audience_url = f"https://{repository_domain}/_/oidc/audience"
6388
audience_resp = requests.get(audience_url)
64-
65-
if not audience_resp.ok:
66-
if audience_resp.status_code == 403:
67-
# This index supports OIDC, but forbids the client from using
68-
# it (either because it's disabled, ratelimited, etc.)
69-
die(
70-
f"audience retrieval failed: repository at {repository_domain} has OIDC disabled"
71-
)
72-
elif audience_resp.status_code == 404:
73-
# This index does not support OIDC.
74-
die(
75-
"audience retrieval failed: repository at "
76-
f"{repository_domain} does not indicate OIDC support"
77-
)
78-
else:
79-
# Unknown: the index may or may not support OIDC, but didn't respond with
80-
# something we expect. This can happen if the index is broken, in maintenance mode,
81-
# misconfigured, etc.
82-
die(
83-
"audience retrieval failed: repository at "
84-
f"{repository_domain} responded with unexpected {audience_resp.status_code}"
85-
)
89+
assert_successful_audience_call(audience_resp, repository_domain)
8690

8791
oidc_audience = audience_resp.json()["audience"]
8892

0 commit comments

Comments
 (0)