"""HTTPS origin validation for authenticated resource requests."""
import httpx
[docs]
class SalesforceOriginError(ValueError):
"""A resource request would disclose credentials to an untrusted origin."""
[docs]
class SalesforceIdentityError(ValueError):
"""A verified renewal changed an already established org or user identity."""
def https_origin(url: httpx.URL | str) -> tuple[str, str, int]:
url = httpx.URL(url)
if url.scheme != "https" or not url.host or url.userinfo:
raise SalesforceOriginError(
"Salesforce resource origins must use HTTPS without user information"
)
return url.scheme, url.host, url.port or 443
def trusted_origin(url: httpx.URL | str) -> tuple[str, str, int]:
parsed = httpx.URL(url)
origin = https_origin(parsed)
if parsed.path not in {"", "/"} or parsed.query or parsed.fragment:
raise SalesforceOriginError(
"Trusted resource origins must not contain a path, query or fragment"
)
return origin