Mastodon#

Helper routines for authorizing against Mastodon instances.

from jupyterhub_oauthenticator_authz_helpers.mastodon import get_followed_groups, build_auth_urls

mastodon_url = "<MASTODON_URL>"

id_to_alias = {
     "<ACCOUNT-ID-1>": "group-one",
     "<ACCOUNT-ID-2>": "group-two",
}

async def auth_state_hook(authenticator, auth_state):
  if auth_state is None:
    return None

  access_token = auth_state["access_token"]
  auth_state[authenticator.auth_state_groups_key] = [
    # Populate groups from Canvas courses, using the scheme defined in get_course_groups
    *await get_followed_groups(mastodon_url, access_token, allow_list=id_to_alias),
  ]
  return auth_state

cfg = c.GenericOAuthenticator
# Inject auth state
cfg.modify_auth_state_hook = auth_state_hook
# Define a custom key for auth groups
cfg.auth_state_groups_key = "custom-groups"
# Configure auth and other URLs
cfg.authorize_url, cfg.token_url, cfg.userdata_url = build_auth_urls(mastodon_url)
# Scopes that this token will need, pulled from functions that we've used above
cfg.scope = [*build_auth_urls.scopes, *get_followed_groups.scopes]

class jupyterhub_oauthenticator_authz_helpers.mastodon.Relationship#

jupyterhub_oauthenticator_authz_helpers.mastodon.build_auth_urls(mastodon_url: str) → AuthURLs#

Return a named tuple of the (auth, token, userdata) URLs for the given Mastodon instance.

Examples

>>> cfg = c.GenericOAuthenticator
>>> cfg.authorize_url, cfg.token_url, cfg.userdata_url = build_auth_urls(mastodon_url)  # noqa: B950

Parameters:: canvas_url – URL to Mastodon instance

async jupyterhub_oauthenticator_authz_helpers.mastodon.get_followed_groups(mastodon_url: str, token: str, *, allow_list: dict[str, Any] | Collection[str]) → list[str]#

Get list of account IDs that are followed by the user identified by the given token, from a pre-determined allow-list of accounts.

This security model assumes that each account in the allow-list has control over its follow requests.

For example, if user “A” follows user “GPU” and user “HighCPU”, they will be granted both groups.

Parameters:

mastodon_url – URL to Mastodon instance
token – Bearer token for authorization
allow_list – collection of server account IDs representing distinct groups, or

mapping from such IDs to user-friendly names, e.g. XXXXX → GPU

See https://docs.joinmastodon.org/methods/accounts/#relationships.