Move default JWT validation to general OIDC handler function

Author: th3coop

tests/unit/oidc/test_views.py

@@ -122,7 +122,8 @@ def body(self):
             return json.dumps(body)
 
     req = Request()
-    resp = views.mint_token_from_oidc_github(req)
+    oidc_service = pretend.stub()
+    resp = views.mint_token(oidc_service, req)
 
     assert req.response.status == 422
     assert resp["message"] == "Token request failed"
@@ -144,7 +145,7 @@ def test_mint_token_from_trusted_publisher_verify_jwt_signature_fails():
         flags=pretend.stub(disallow_oidc=lambda *a: False),
     )
 
-    response = views.mint_token(oidc_service, request, "faketoken")
+    response = views.mint_token(oidc_service, request)
     assert request.response.status == 422
     assert response == {
         "message": "Token request failed",
@@ -210,7 +211,7 @@ def test_mint_token_from_oidc_pending_publisher_project_already_exists(db_reques
     )
     db_request.find_service = pretend.call_recorder(lambda *a, **kw: oidc_service)
 
-    resp = views.mint_token(oidc_service, db_request, "faketoken")
+    resp = views.mint_token(oidc_service, db_request)
     assert db_request.response.status_code == 422
     assert resp == {
         "message": "Token request failed",
@@ -346,7 +347,7 @@ def test_mint_token_from_pending_trusted_publisher_invalidates_others(
 
     oidc_service = db_request.find_service(IOIDCPublisherService, name="github")
 
-    resp = views.mint_token(oidc_service, db_request, token)
+    resp = views.mint_token(oidc_service, db_request)
     assert resp["success"]
     assert resp["token"].startswith("pypi-")
 
@@ -424,7 +425,7 @@ def find_service(iface, **kw):
         flags=pretend.stub(disallow_oidc=lambda *a: False),
     )
 
-    response = views.mint_token(oidc_service, request, "faketoken")
+    response = views.mint_token(oidc_service, request)
     assert response == {
         "success": True,
         "token": "raw-macaroon",

warehouse/oidc/views.py

@@ -107,28 +107,27 @@ def mint_token_from_oidc_github(request: Request):
             request=request,
         )
 
-    try:
-        payload = TokenPayload.parse_raw(request.body)
-        unverified_jwt = payload.token
-    except ValidationError as exc:
-        return _invalid(
-            errors=[{"code": "invalid-payload", "description": str(exc)}],
-            request=request,
-        )
-
     # For the time being, GitHub is our only OIDC publisher.
     # In the future, this should locate the correct service based on an
     # identifier in the request body.
     oidc_service: OIDCPublisherService = request.find_service(
         IOIDCPublisherService, name="github"
     )
 
-    return mint_token(oidc_service, request, unverified_jwt)
+    return mint_token(oidc_service, request)
 
 
-def mint_token(
-    oidc_service: OIDCPublisherService, request: Request, unverified_jwt: str
-) -> JsonRespone:
+def mint_token(oidc_service: OIDCPublisherService, request: Request) -> JsonRespone:
+    unverified_jwt: str
+    try:
+        payload = TokenPayload.parse_raw(request.body)
+        unverified_jwt = payload.token
+    except ValidationError as exc:
+        return _invalid(
+            errors=[{"code": "invalid-payload", "description": str(exc)}],
+            request=request,
+        )
+
     claims = oidc_service.verify_jwt_signature(unverified_jwt)
     if not claims:
         return _invalid(