From 42101addad8a7e93d4c11b009811adcf85288390 Mon Sep 17 00:00:00 2001
From: Phuoc Cao <phuoc@caotek.fr>
Date: Tue, 6 Oct 2026 18:03:13 +0200
Subject: [PATCH] test Google Oauth successful

---
 ctp_blogr.sqlite                   | Bin 1105920 -> 1105920 bytes
 ctp_blogr/__init__.py              |   1 -
 ctp_blogr/services/google_oauth.py |   7 ++++++-
 ctp_blogr/views/default.py         |   1 -
 4 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/ctp_blogr.sqlite b/ctp_blogr.sqlite
index 2c95bfaa3bd4f3abe08b8b2867232aafff81497f..2f8e1871ff68cff35abb9000ab0b70ccc3e9cb88 100644
GIT binary patch
delta 419
zcmZvYzfZzI0ELf25nAwMQlkmPl~C?_z223HrnvJjkfK14A2I0aIe10~q9(@47)NKL
zOeQ2Ql4#<<U*PV{;@~AN8X4aDz3)9S4#YS(TZ;_O*8_bBtjpKK`cXadP}i=Z3EzPR
zD*#sD$$cir;Xx45L7w^j=3Xx>hqc~dt8H!XVvHz9j_Y8=2&R;{4s&c|y9JC2$jxC^
zqD~3h7N^MZ>`hGvMdpWtA55cDYwcKJuY)n+j366vk8n;riaeYA!DLF5lrU2q&qEXd
zfR3kGO(m)lQ_)A$Y`jo4;g=Gh062jkO8g13l_*Qj)m)9T$lPL0;bT(7rC5+6Aw^OO
zLkd%hloV+x7NvlXVo9&+#taxU)$(biPU8a;<S&T7>=#G3FNvF&o;K1(;i~+W*kHfz
da9p*-qKvDn{{1khb(`&GuiNPFw)UUzz5$H2afbi^

delta 202
zcmZoT;M{P)d4e=!=R_H2)=mb!yj_hcttpIKQ<&!Rb2Bh7F!9f0;J?5>Z?mAnBz`jk
zCRPT02FK)*f{fDqWQX+J#LOJM<osMC10yqCLjzp{Qw2jKD??)|0|Px16GIb2Gd)ID
zhW0D+OhC*G#4JF}y8Vhgn{EKa^zRJ(fB3&|7EE}}&&k5fz{teR%)r^!z}D8l-qyg;
u)&OL4wKZ_JHSn}G@U}JZwKec>YY<=!VCCju;N}3j>L1tksV6voumAuA`8q5B

diff --git a/ctp_blogr/__init__.py b/ctp_blogr/__init__.py
index b63beb8..e9c9598 100644
--- a/ctp_blogr/__init__.py
+++ b/ctp_blogr/__init__.py
@@ -28,7 +28,6 @@ def read_google_settings(settings):
     # Returnne un dict {google.client_id, google.client_secret}.
     # Le reglage de l'ini, s'il existe, l'emporte sur l'environnement.
     google = {}
-    # import pdb;pdb.set_trace()
     key = 'google.client_id'
     google[key] = settings.get(key)
     key = 'google.client_secret'
diff --git a/ctp_blogr/services/google_oauth.py b/ctp_blogr/services/google_oauth.py
index 7b88843..003f1f6 100644
--- a/ctp_blogr/services/google_oauth.py
+++ b/ctp_blogr/services/google_oauth.py
@@ -133,13 +133,18 @@ class GoogleOAuth(object):
 
     def verify_id_token(self, id_token, nonce):
         metadata = self.metadata()
+        # jwt.decode ne valide aucun claim : `registry` y est un JWSRegistry.
+        # La validation des claims se fait donc explicitement, apres decode.
         registry = joserfc_jwt.JWTClaimsRegistry(
+            leeway=60,
             iss={'essential': True, 'value': metadata.get('issuer')},
             aud={'essential': True, 'value': self.client_id},
+            exp={'essential': True},
         )
         try:
             token = joserfc_jwt.decode(
-                id_token, self.key_set(), algorithms=['RS256'], registry=registry)
+                id_token, self.key_set(), algorithms=['RS256'])
+            registry.validate(token.claims)
         except Exception as exc:
             raise GoogleOAuthError("Le id_token renvoye par Google est invalide : %s" % exc)
 
diff --git a/ctp_blogr/views/default.py b/ctp_blogr/views/default.py
index e312029..e6c5b0a 100644
--- a/ctp_blogr/views/default.py
+++ b/ctp_blogr/views/default.py
@@ -48,7 +48,6 @@ def login(request):
         session['oauth_nonce'] = nonce
         session['oauth_code_verifier'] = code_verifier
 
-        import pdb;pdb.set_trace()
         url = request.registry.google_oauth.create_authorization_url(
             redirect_uri=request.route_url('login_google_callback'),
             state=state,