OIDC authentication works, remove debug.

paskia/fastapi/oid.py

@@ -401,78 +401,37 @@ async def userinfo(
     Returns claims about the authenticated user.
     Requires Bearer token from /token endpoint.
     """
-    print(f"DEBUG UserInfo: Received request from {request.client.host}")
-    print(f"DEBUG UserInfo: Authorization header present: {bool(credentials)}")
-    
     if not credentials:
-        print("DEBUG UserInfo: No credentials provided")
         raise HTTPException(401, "Bearer token required")
 
-    print(f"DEBUG UserInfo: Token length: {len(credentials.credentials)}")
-    print(f"DEBUG UserInfo: Token prefix: {credentials.credentials[:50]}...")
-
     issuer = _get_issuer(request)
-    print(f"DEBUG UserInfo: Computed issuer: {issuer}")
-    
-    # Try to decode without verification to see token contents
-    try:
-        import jwt
-        unverified_payload = jwt.decode(credentials.credentials, options={"verify_signature": False})
-        print(f"DEBUG UserInfo: Unverified payload: {unverified_payload}")
-        print(f"DEBUG UserInfo: Token issuer claim: {unverified_payload.get('iss')}")
-        print(f"DEBUG UserInfo: Token audience claim: {unverified_payload.get('aud')}")
-    except Exception as e:
-        print(f"DEBUG UserInfo: Failed to decode unverified: {e}")
-    
     payload = oidjwt.decode_access_token(credentials.credentials, issuer)
-    print(f"DEBUG UserInfo: JWT decode result: {payload is not None}")
-    
     if not payload:
-        print("DEBUG UserInfo: JWT decode failed")
         raise HTTPException(401, "Invalid or expired token")
 
-    print(f"DEBUG UserInfo: Decoded payload: {payload}")
-
     # Verify audience is a valid client
     aud = payload.get("aud")
-    print(f"DEBUG UserInfo: Audience claim: {aud}")
-    
     if not aud:
-        print("DEBUG UserInfo: Missing aud claim")
         raise HTTPException(401, "Invalid token (missing aud claim)")
 
     try:
         client_uuid = UUID(aud)
-        print(f"DEBUG UserInfo: Client UUID: {client_uuid}")
     except ValueError:
-        print(f"DEBUG UserInfo: Invalid UUID format: {aud}")
         raise HTTPException(401, "Invalid token (invalid aud format)")
 
-    client = db.data().oid_clients.get(client_uuid)
-    print(f"DEBUG UserInfo: Client found: {client is not None}")
-    if not client:
-        print(f"DEBUG UserInfo: Unknown client UUID: {client_uuid}")
+    if not db.data().oid_clients.get(client_uuid):
         raise HTTPException(401, "Invalid token (unknown client)")
 
     # Get user
-    sub = payload.get("sub")
-    print(f"DEBUG UserInfo: Subject claim: {sub}")
-    
     try:
-        user_uuid = UUID(sub)
-        print(f"DEBUG UserInfo: User UUID: {user_uuid}")
-    except (KeyError, ValueError) as e:
-        print(f"DEBUG UserInfo: Invalid sub claim: {e}")
+        user_uuid = UUID(payload["sub"])
+    except (KeyError, ValueError):
         raise HTTPException(401, "Invalid token")
 
     user = db.data().users.get(user_uuid)
-    print(f"DEBUG UserInfo: User found: {user is not None}")
     if not user:
-        print(f"DEBUG UserInfo: Unknown user UUID: {user_uuid}")
         raise HTTPException(401, "User not found")
 
-    print("DEBUG UserInfo: All validations passed, proceeding with response")
-
     # Get user's permissions scoped to this OIDC client (domain == client UUID)
     role = user.role
     org = role.org

paskia/util/oidjwt.py

@@ -204,6 +204,5 @@ def decode_access_token(
             options=options,
             **decode_kwargs
         )
-    except jwt.PyJWTError as e:
-        print(f"DEBUG JWT decode error: {e}")
+    except jwt.PyJWTError:
         return None