Skip to content

Fix auth0-python: SignatureVerifier.verify_signature is sync, not async#15468

Open
cadupont wants to merge 1 commit intopython:mainfrom
cadupont:fix-auth0-verify-signature-sync
Open

Fix auth0-python: SignatureVerifier.verify_signature is sync, not async#15468
cadupont wants to merge 1 commit intopython:mainfrom
cadupont:fix-auth0-verify-signature-sync

Conversation

@cadupont
Copy link

Summary

The typeshed stub for auth0-python incorrectly declares SignatureVerifier.verify_signature as async def. The actual implementation is synchronous.

Evidence

The auth0-python implementation uses a regular def:

    def verify_signature(self, token: str) -> dict[str, Any]:
        """Verifies the signature of the given JSON web token.
        ...
        """
        kid = self._get_kid(token)
        ...
        return self._decode_jwt(token, secret_or_certificate)

Impact

With the current stub, mypy reports:

  • Argument 1 to "_verify_claims" has incompatible type "Coroutine[Any, Any, dict[str, Any]"; expected "dict[str, Any]"
  • Maybe you forgot to use "await"?

This forces downstream code to use cast() or # type: ignore as a workaround, when the correct fix is to align the stub with the runtime.

Change

Change async def verify_signature to def verify_signature in the SignatureVerifier class.

The typeshed stub incorrectly declares verify_signature as async def.
The actual auth0-python implementation is synchronous.

See: https://github.com/auth0/auth0-python/blob/master/auth0/authentication/token_verifier.py#L103
@github-actions
Copy link
Contributor

According to mypy_primer, this change has no effect on the checked open source code. 🤖🎉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant