Repository Analysis

django-oauth/django-oauth-toolkit

OAuth2 goodies for the Djangonauts!

20.9 Moderate AI signal View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of django-oauth/django-oauth-toolkit, a Python project with 3,334 GitHub stars. SynthScan v2.0 examined 104,166 lines of code across 336 source files, recording 1647 pattern matches distributed across 17 syntactic categories. The overall adjusted score of 20.9 places this repository in the Moderate AI signal band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

20.9
Adjusted Score
20.9
Raw Score
100%
Time Factor
2026-08-23
Last Push
3.3K
Stars
Python
Language
104.2K
Lines of Code
336
Files
1.6K
Pattern Hits
2026-08-29
Scan Date
0.21
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 14HIGH 56MEDIUM 103LOW 1474

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 1647 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Hyper-Verbose Identifiers1249 hits · 1115 pts
SeverityFileLineSnippetContext
LOWtests/test_www_authenticate.py24 def test_bare_bearer_when_nothing_to_advertise(self):CODE
LOWtests/test_www_authenticate.py28 def test_includes_error_and_resource_metadata(self):CODE
LOWtests/test_www_authenticate.py42 def test_explicit_resource_metadata_url_overrides_default(self):CODE
LOWtests/test_www_authenticate.py50 def test_explicit_none_omits_resource_metadata(self):CODE
LOWtests/test_www_authenticate.py55 def test_quoted_string_values_are_escaped(self):CODE
LOWtests/test_oauth2_provider_middleware.py32 def test_malformed_bearer_header_no_token(self):CODE
LOWtests/test_oauth2_provider_middleware.py42 def test_malformed_bearer_header_empty_token(self):CODE
LOWtests/test_oauth2_provider_middleware.py74 def test_invalid_bearer_token(self):CODE
LOWtests/test_oauth2_provider_middleware.py84 def test_invalid_bearer_token_logs_at_debug_level(self):CODE
LOWtests/test_oauth2_provider_middleware.py98 def test_no_authorization_header(self):CODE
LOWtests/test_oauth2_provider_middleware.py107 def test_non_bearer_authorization_header(self):CODE
LOWtests/test_oauth2_provider_middleware.py127 def test_case_insensitive_bearer_scheme(self):CODE
LOWtests/test_oauth2_provider_middleware.py140 def test_scheme_starting_with_bearer_is_rejected(self):CODE
LOWtests/test_oauth2_provider_middleware.py150 def test_whitespace_variations(self):CODE
LOWtests/test_form_encoded_requests.py69 def test_json_body_keeps_legacy_error(self):CODE
LOWtests/test_form_encoded_requests.py82 def test_multipart_body_is_accepted(self):CODE
LOWtests/test_form_encoded_requests.py88 def test_non_compliant_body_warns_about_the_coming_default(self):CODE
LOWtests/test_form_encoded_requests.py101 def test_compliant_body_does_not_warn(self):CODE
LOWtests/test_form_encoded_requests.py112 def test_get_request_does_not_warn(self):CODE
LOWtests/test_form_encoded_requests.py134 def test_form_encoded_body_is_accepted(self):CODE
LOWtests/test_form_encoded_requests.py141 def test_charset_parameter_is_accepted(self):CODE
LOWtests/test_form_encoded_requests.py150 def test_json_body_is_rejected(self):CODE
LOWtests/test_form_encoded_requests.py162 def test_multipart_body_is_rejected(self):CODE
LOWtests/test_form_encoded_requests.py168 def test_missing_content_type_is_rejected(self):CODE
LOWtests/test_form_encoded_requests.py174 def test_every_form_encoded_endpoint_is_covered(self):CODE
LOWtests/test_form_encoded_requests.py184 def test_get_requests_are_unaffected(self):CODE
LOWtests/test_form_encoded_requests.py196 def test_disabled_endpoint_still_reports_not_found(self):CODE
LOWtests/test_form_encoded_requests.py214 def test_json_registration_still_succeeds(self):CODE
LOWtests/test_form_encoded_requests.py239 def test_userinfo_post_is_not_rejected(self):CODE
LOWtests/test_form_encoded_requests.py254 def test_no_error_when_only_the_gate_is_set(self):CODE
LOWtests/test_form_encoded_requests.py259 def test_no_error_when_only_the_json_backend_is_set(self):CODE
LOWtests/test_form_encoded_requests.py264 def test_error_when_the_json_backend_can_never_be_reached(self):CODE
LOWtests/test_admin.py61def test_mask_credential_hides_the_secret():CODE
LOWtests/test_admin.py80def _assert_hidden_on_change_form(admin_class, model, field, masked_field):CODE
LOWtests/test_admin.py94def test_credential_admins_disable_add():CODE
LOWtests/test_admin.py107def test_admin_overrides_preserve_subclass_config():CODE
LOWtests/test_admin.py128def _assert_searchable_by_app_and_user(admin_class):CODE
LOWtests/test_admin.py136def test_access_token_admin_does_not_expose_token():CODE
LOWtests/test_admin.py143def test_refresh_token_admin_does_not_expose_token():CODE
LOWtests/test_admin.py150def test_grant_admin_does_not_expose_code():CODE
LOWtests/test_admin.py157def test_par_admin_does_not_expose_request_uri():CODE
LOWtests/test_admin.py166def test_id_token_admin_searchable_by_app_and_user():CODE
LOWtests/test_admin.py172def test_credential_admins_delete_policy():CODE
LOWtests/test_admin.py214def test_access_token_admin_revoke_action_revokes_token_family():CODE
LOWtests/test_admin.py238def test_access_token_admin_revoke_action_without_refresh_token_deletes():CODE
LOWtests/test_admin.py255def test_refresh_token_admin_revoke_action_revokes_token_family():CODE
LOWtests/test_oauth2_validators.py140 def test_authenticate_basic_auth_hashed_secret(self):CODE
LOWtests/test_oauth2_validators.py145 def test_authenticate_basic_auth_unhashed_secret(self):CODE
LOWtests/test_oauth2_validators.py154 def test_authenticate_basic_auth_default_encoding(self):CODE
LOWtests/test_oauth2_validators.py159 def test_authenticate_basic_auth_wrong_client_id(self):CODE
LOWtests/test_oauth2_validators.py164 def test_authenticate_basic_auth_wrong_client_secret(self):CODE
LOWtests/test_oauth2_validators.py169 def test_authenticate_basic_auth_wrong_client_secret_not_logged(self):CODE
LOWtests/test_oauth2_validators.py177 def test_authenticate_request_body_wrong_client_secret_not_logged(self):CODE
LOWtests/test_oauth2_validators.py185 def test_authenticate_basic_auth_undecodable_credentials_not_logged(self):CODE
LOWtests/test_oauth2_validators.py227 def test_authenticate_basic_auth_public_app_with_device_code(self):CODE
LOWtests/test_oauth2_validators.py233 def test_authenticate_check_secret(self):CODE
LOWtests/test_oauth2_validators.py240 def test_authenticate_client_id(self):CODE
LOWtests/test_oauth2_validators.py243 def test_authenticate_client_id_fail(self):CODE
LOWtests/test_oauth2_validators.py249 def test_client_authentication_required(self):CODE
LOWtests/test_oauth2_validators.py263 def test_load_application_loads_client_id_when_request_has_no_client(self):CODE
1189 more matches not shown…
Decorative Section Separators94 hits · 351 pts
SeverityFileLineSnippetContext
MEDIUMtests/test_bcp_rfc9700.py76# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_bcp_rfc9700.py78# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_bcp_rfc9700.py246# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_bcp_rfc9700.py248# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_bcp_rfc9700.py562# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_bcp_rfc9700.py564# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_bcp_rfc9700.py41# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_bcp_rfc9700.py43# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_bcp_rfc9700.py121# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_bcp_rfc9700.py123# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_bcp_rfc9700.py202# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_bcp_rfc9700.py204# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_bcp_rfc9700.py421# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_bcp_rfc9700.py423# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_device.py256 # --------------------------------------------------------------------------------COMMENT
MEDIUMtests/test_device.py258 # --------------------------------------------------------------------------------COMMENT
MEDIUMtests/test_device.py268 # -------------------------COMMENT
MEDIUMtests/test_device.py270 # -------------------------COMMENT
MEDIUMtests/test_device.py139 # -----------------------COMMENT
MEDIUMtests/test_device.py142 # -----------------------COMMENT
MEDIUMtests/test_device.py197 # --------------------------------------------------------------------------------COMMENT
MEDIUMtests/test_device.py200 # --------------------------------------------------------------------------------COMMENT
MEDIUMtests/test_device.py242 # --------------------------------------------------------------------------------COMMENT
MEDIUMtests/test_device.py245 # --------------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py347# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py349# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py450# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py452# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py784# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py786# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py23# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py25# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py49# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py51# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py374# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py377# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py883# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py885# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py909# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py911# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py969# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py971# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py1048# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_dcr_views.py1050# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py169# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py171# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py251# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py253# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py292# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py294# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py308# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py310# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py408# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py410# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py543# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py545# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py582# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py584# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py787# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_cimd.py789# ---------------------------------------------------------------------------COMMENT
34 more matches not shown…
Cross-File Repetition45 hits · 225 pts
SeverityFileLineSnippetContext
HIGHtests/test_implicit.py0test for default redirect uri if omitted from query string with response_type: codeSTRING
HIGHtests/test_authorization_code.py0test for default redirect uri if omitted from query string with response_type: codeSTRING
HIGHtests/test_hybrid.py0test for default redirect uri if omitted from query string with response_type: codeSTRING
HIGHtests/test_implicit.py0test error when passing a forbidden redirect_uri in query string with response_type: codeSTRING
HIGHtests/test_authorization_code.py0test error when passing a forbidden redirect_uri in query string with response_type: codeSTRING
HIGHtests/test_hybrid.py0test error when passing a forbidden redirect_uri in query string with response_type: codeSTRING
HIGHtests/test_implicit.py0test authorization code is given for an allowed request with response_type: codeSTRING
HIGHtests/test_authorization_code.py0test authorization code is given for an allowed request with response_type: codeSTRING
HIGHtests/test_hybrid.py0test authorization code is given for an allowed request with response_type: codeSTRING
HIGHtests/test_implicit.py0if application.skip_authorization = true, should skip the authorization page.STRING
HIGHtests/test_authorization_code.py0if application.skip_authorization = true, should skip the authorization page.STRING
HIGHtests/test_hybrid.py0if application.skip_authorization = true, should skip the authorization page.STRING
HIGHtests/test_implicit.py0tests that a redirection uri with query string is allowed and query string is retained on redirection. see https://rfc-eSTRING
HIGHtests/test_authorization_code.py0tests that a redirection uri with query string is allowed and query string is retained on redirection. see https://rfc-eSTRING
HIGHtests/test_hybrid.py0tests that a redirection uri with query string is allowed and query string is retained on redirection. see https://rfc-eSTRING
HIGHtests/test_implicit.py0tests that a redirection uri is matched using scheme + netloc + pathSTRING
HIGHtests/test_authorization_code.py0tests that a redirection uri is matched using scheme + netloc + pathSTRING
HIGHtests/test_hybrid.py0tests that a redirection uri is matched using scheme + netloc + pathSTRING
HIGHoauth2_provider/scopes.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/signals.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/compat.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/oauth2_backends.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/checks.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/bcp.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/forms.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/backends.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/utils.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/http.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/exceptions.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/cimd.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/www_authenticate.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/middleware.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/dcr.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/decorators.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/views/oidc.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/views/token.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/views/device.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/views/generic.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/views/dynamic_client_registration.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/views/introspect.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/views/application.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/views/base.py0backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.viewSTRING
HIGHoauth2_provider/core/backends_oauthlib.py0a wrapper method that calls create_userinfo_response on the `server_class` instance. :param request: the current django.STRING
HIGHoauth2_provider/authorization_server/views/mixins.py0a wrapper method that calls create_userinfo_response on the `server_class` instance. :param request: the current django.STRING
HIGHoauth2_provider/resource_server/mixins.py0a wrapper method that calls create_userinfo_response on the `server_class` instance. :param request: the current django.STRING
Hallucination Indicators14 hits · 155 pts
SeverityFileLineSnippetContext
CRITICALtests/test_oauth2_validators.py18from oauth2_provider.core.exceptions import FatalClientErrorCODE
CRITICALtests/test_dcr_views.py338 from django.core.exceptions import ValidationErrorCODE
CRITICALtests/test_resource_validators.py436 from django.core.exceptions import ValidationErrorCODE
CRITICALtests/test_resource_validators.py442 from django.core.exceptions import ValidationErrorCODE
CRITICALoauth2_provider/models.py426 from django.core.exceptions import ValidationErrorCODE
CRITICALoauth2_provider/validators.py5from django.core.exceptions import ValidationErrorCODE
CRITICALoauth2_provider/core/backends_oauthlib.py13from oauth2_provider.core.exceptions import FatalClientError, OAuthToolkitErrorCODE
CRITICAL…uth2_provider/management/commands/createapplication.py1from django.core.exceptions import ValidationErrorCODE
CRITICALoauth2_provider/authorization_server/cimd.py28from django.core.exceptions import ValidationErrorCODE
CRITICALoauth2_provider/authorization_server/views/mixins.py11from oauth2_provider.core.exceptions import FatalClientErrorCODE
CRITICALoauth2_provider/authorization_server/views/device.py5from django.core.exceptions import ValidationErrorCODE
CRITICAL…horization_server/views/dynamic_client_registration.py17from django.core.exceptions import ValidationErrorCODE
CRITICALoauth2_provider/authorization_server/views/par.py10from oauth2_provider.core.exceptions import OAuthToolkitErrorCODE
CRITICALoauth2_provider/authorization_server/views/base.py25from oauth2_provider.core.exceptions import FatalClientError, OAuthToolkitErrorCODE
Unused Imports81 hits · 73 pts
SeverityFileLineSnippetContext
LOWtests/mysql_settings.py5CODE
LOWtests/settings_swapped.py1CODE
LOWtests/test_import_compat.py236CODE
LOWtests/test_import_compat.py237CODE
LOWtests/multi_db_settings.py3CODE
LOWtests/mysql_pr_settings.py5CODE
LOWtests/multi_db_settings_invalid_token_configuration.py1CODE
LOWtests/postgres_pr_settings.py3CODE
LOWtests/postgres_settings.py3CODE
LOWoauth2_provider/models.py37CODE
LOWoauth2_provider/validators.py13CODE
LOWoauth2_provider/apps.py10CODE
LOWoauth2_provider/oauth2_validators.py51CODE
LOWoauth2_provider/oauth2_validators.py51CODE
LOWoauth2_provider/oauth2_validators.py51CODE
LOWoauth2_provider/core/compat.py8CODE
LOWoauth2_provider/resource_server/__init__.py14CODE
LOWoauth2_provider/resource_server/__init__.py14CODE
LOWoauth2_provider/contrib/ninja/__init__.py1CODE
LOWoauth2_provider/contrib/ninja/__init__.py2CODE
LOWoauth2_provider/contrib/ninja/__init__.py2CODE
LOWoauth2_provider/contrib/rest_framework/__init__.py2CODE
LOWoauth2_provider/contrib/rest_framework/__init__.py2CODE
LOWoauth2_provider/contrib/rest_framework/__init__.py3CODE
LOWoauth2_provider/contrib/rest_framework/__init__.py3CODE
LOWoauth2_provider/contrib/rest_framework/__init__.py3CODE
LOWoauth2_provider/contrib/rest_framework/__init__.py3CODE
LOWoauth2_provider/contrib/rest_framework/__init__.py3CODE
LOWoauth2_provider/contrib/rest_framework/__init__.py10CODE
LOWoauth2_provider/contrib/rest_framework/__init__.py10CODE
LOWoauth2_provider/views/mixins.py19CODE
LOWoauth2_provider/views/mixins.py19CODE
LOWoauth2_provider/views/mixins.py24CODE
LOWoauth2_provider/views/mixins.py25CODE
LOWoauth2_provider/views/mixins.py25CODE
LOWoauth2_provider/views/mixins.py25CODE
LOWoauth2_provider/views/mixins.py25CODE
LOWoauth2_provider/views/mixins.py25CODE
LOWoauth2_provider/views/mixins.py25CODE
LOWoauth2_provider/views/metadata.py16CODE
LOWoauth2_provider/views/metadata.py16CODE
LOWoauth2_provider/views/metadata.py16CODE
LOWoauth2_provider/views/metadata.py16CODE
LOWoauth2_provider/views/metadata.py16CODE
LOWoauth2_provider/views/metadata.py23CODE
LOWoauth2_provider/views/__init__.py10CODE
LOWoauth2_provider/views/__init__.py10CODE
LOWoauth2_provider/views/__init__.py10CODE
LOWoauth2_provider/views/__init__.py10CODE
LOWoauth2_provider/views/__init__.py16CODE
LOWoauth2_provider/views/__init__.py16CODE
LOWoauth2_provider/views/__init__.py16CODE
LOWoauth2_provider/views/__init__.py16CODE
LOWoauth2_provider/views/__init__.py16CODE
LOWoauth2_provider/views/__init__.py23CODE
LOWoauth2_provider/views/__init__.py23CODE
LOWoauth2_provider/views/__init__.py23CODE
LOWoauth2_provider/views/__init__.py24CODE
LOWoauth2_provider/views/__init__.py24CODE
LOWoauth2_provider/views/__init__.py24CODE
21 more matches not shown…
Cross-Language Confusion11 hits · 71 pts
SeverityFileLineSnippetContext
HIGHtests/test_oidc_views.py183 """Required OIDC endpoints must fail fast, not emit null, when unreversible."""STRING
HIGHtests/test_pushed_authorization_request.py108 response = self.push(extra={"request_uri": f"{REQUEST_URI_PREFIX}abc"})CODE
HIGHtests/test_pushed_authorization_request.py113 response = self.push(extra={"request": "eyJ.abc.def"})CODE
HIGHtests/test_pushed_authorization_request.py150 response = self.push(auth=False)CODE
HIGHtests/test_pushed_authorization_request.py189 response = self.push(extra={"redirect_uri": "http://not-registered.example"})CODE
HIGHtests/test_pushed_authorization_request.py194 response = self.push(extra={"client_id": self.public_application.client_id})CODE
HIGHtests/test_pushed_authorization_request.py201 response = self.push()CODE
HIGHtests/test_pushed_authorization_request.py434 push = self.push()CODE
HIGHtests/test_pushed_authorization_request.py90 response = self.push()CODE
HIGHtests/test_pushed_authorization_request.py265 response = self.push(CODE
HIGHtests/test_pushed_authorization_request.py294 push = self.push()CODE
Verbosity Indicators30 hits · 35 pts
SeverityFileLineSnippetContext
LOWtests/test_rfc8707_integration.py96 # Step 3: Verify access token has resource binding (JSON array format)COMMENT
LOWtests/test_rfc8707_integration.py101 # Step 4: Verify audience validationCOMMENT
LOWtests/test_rfc8707_integration.py45 # Step 1: Authorization request with resource parameterCOMMENT
LOWtests/test_rfc8707_integration.py78 # Step 2: Token request with resource parameterCOMMENT
LOWtests/test_rfc8707_integration.py396 # Step 1: Authorization request with limited resourcesCOMMENT
LOWtests/test_rfc8707_integration.py411 # Step 2: Token request trying to escalate to unauthorized resourceCOMMENT
LOWtests/test_rfc8707_integration.py462 # Step 1: Authorization with multiple resourcesCOMMENT
LOWtests/test_rfc8707_integration.py479 # Step 2: Token request WITHOUT resource parameterCOMMENT
LOWtests/test_rfc8707_integration.py534 # Step 1: Authorization with three resourcesCOMMENT
LOWtests/test_rfc8707_integration.py553 # Step 2: Token request repeating the resource parameter to narrow to twoCOMMENT
LOWtests/test_rfc8707_integration.py606 # Step 1: Authorization with a single resourceCOMMENT
LOWtests/test_rfc8707_integration.py620 # Step 2: Token request repeating resource params, one outside the grantCOMMENT
LOWtests/test_rfc8707_integration.py670 # Step 1: Authorization with resourceCOMMENT
LOWtests/test_rfc8707_integration.py685 # Step 2: Exchange code for tokensCOMMENT
LOWtests/test_rfc8707_integration.py712 # Step 3: Use refresh token to get new access tokenCOMMENT
LOWtests/test_rfc8707_integration.py726 # Step 4: Verify new access token preserves resource from refresh tokenCOMMENT
LOWtests/test_rfc8707_integration.py762 # Step 1: Authorization with specific resourcesCOMMENT
LOWtests/test_rfc8707_integration.py782 # Step 2: Exchange code for tokensCOMMENT
LOWtests/test_rfc8707_integration.py805 # Step 3: Attempt refresh with unauthorized resource - should failCOMMENT
LOWtests/test_rfc8707_integration.py822 # Step 4: Get fresh token to test narrowing (previous refresh may have consumed token)COMMENT
LOWtests/test_rfc8707_integration.py840 # Step 5: Refresh with subset (resource1 only) - should succeedCOMMENT
LOWtests/test_rfc8707_integration.py888 # Step 1: Authorization with resourceCOMMENT
LOWtests/test_rfc8707_integration.py903 # Step 2: Exchange code for tokensCOMMENT
LOWtests/test_rfc8707_integration.py924 # Step 3: Use refresh token (should rotate and create new refresh token)COMMENT
LOWtests/test_rfc8707_integration.py977 # Step 1: Authorization with resourceCOMMENT
LOWtests/test_rfc8707_integration.py991 # Step 2: Exchange code for tokensCOMMENT
LOWtests/test_rfc8707_integration.py1008 # Step 3: Refresh (non-rotating — same refresh token reused, access token updated in place)COMMENT
LOWtests/e2e/browser_rp/test_browser_par.py25 # Step 1: the RP server pushes the request (back channel) and returns a request_uri.COMMENT
LOWtests/e2e/browser_rp/test_browser_par.py30 # Step 2: only client_id + request_uri travel through the browser to /authorize.COMMENT
LOWtests/e2e/browser_rp/test_browser_par.py43 # Step 3: the RP server exchanged the code; the token response is displayed.COMMENT
Structural Annotation Overuse30 hits · 35 pts
SeverityFileLineSnippetContext
LOWtests/test_rfc8707_integration.py96 # Step 3: Verify access token has resource binding (JSON array format)COMMENT
LOWtests/test_rfc8707_integration.py101 # Step 4: Verify audience validationCOMMENT
LOWtests/test_rfc8707_integration.py45 # Step 1: Authorization request with resource parameterCOMMENT
LOWtests/test_rfc8707_integration.py78 # Step 2: Token request with resource parameterCOMMENT
LOWtests/test_rfc8707_integration.py396 # Step 1: Authorization request with limited resourcesCOMMENT
LOWtests/test_rfc8707_integration.py411 # Step 2: Token request trying to escalate to unauthorized resourceCOMMENT
LOWtests/test_rfc8707_integration.py462 # Step 1: Authorization with multiple resourcesCOMMENT
LOWtests/test_rfc8707_integration.py479 # Step 2: Token request WITHOUT resource parameterCOMMENT
LOWtests/test_rfc8707_integration.py534 # Step 1: Authorization with three resourcesCOMMENT
LOWtests/test_rfc8707_integration.py553 # Step 2: Token request repeating the resource parameter to narrow to twoCOMMENT
LOWtests/test_rfc8707_integration.py606 # Step 1: Authorization with a single resourceCOMMENT
LOWtests/test_rfc8707_integration.py620 # Step 2: Token request repeating resource params, one outside the grantCOMMENT
LOWtests/test_rfc8707_integration.py670 # Step 1: Authorization with resourceCOMMENT
LOWtests/test_rfc8707_integration.py685 # Step 2: Exchange code for tokensCOMMENT
LOWtests/test_rfc8707_integration.py712 # Step 3: Use refresh token to get new access tokenCOMMENT
LOWtests/test_rfc8707_integration.py726 # Step 4: Verify new access token preserves resource from refresh tokenCOMMENT
LOWtests/test_rfc8707_integration.py762 # Step 1: Authorization with specific resourcesCOMMENT
LOWtests/test_rfc8707_integration.py782 # Step 2: Exchange code for tokensCOMMENT
LOWtests/test_rfc8707_integration.py805 # Step 3: Attempt refresh with unauthorized resource - should failCOMMENT
LOWtests/test_rfc8707_integration.py822 # Step 4: Get fresh token to test narrowing (previous refresh may have consumed token)COMMENT
LOWtests/test_rfc8707_integration.py840 # Step 5: Refresh with subset (resource1 only) - should succeedCOMMENT
LOWtests/test_rfc8707_integration.py888 # Step 1: Authorization with resourceCOMMENT
LOWtests/test_rfc8707_integration.py903 # Step 2: Exchange code for tokensCOMMENT
LOWtests/test_rfc8707_integration.py924 # Step 3: Use refresh token (should rotate and create new refresh token)COMMENT
LOWtests/test_rfc8707_integration.py977 # Step 1: Authorization with resourceCOMMENT
LOWtests/test_rfc8707_integration.py991 # Step 2: Exchange code for tokensCOMMENT
LOWtests/test_rfc8707_integration.py1008 # Step 3: Refresh (non-rotating — same refresh token reused, access token updated in place)COMMENT
LOWtests/e2e/browser_rp/test_browser_par.py25 # Step 1: the RP server pushes the request (back channel) and returns a request_uri.COMMENT
LOWtests/e2e/browser_rp/test_browser_par.py30 # Step 2: only client_id + request_uri travel through the browser to /authorize.COMMENT
LOWtests/e2e/browser_rp/test_browser_par.py43 # Step 3: the RP server exchanged the code; the token response is displayed.COMMENT
Over-Commented Block24 hits · 24 pts
SeverityFileLineSnippetContext
LOWpyproject.toml101[tool.pytest.ini_options]COMMENT
LOWtox.ini1[tox]COMMENT
LOWtox.ini221# registrable domains over TLS, in both Chromium and Firefox, to pin howCOMMENT
LOWdocker-compose.yml21 condition: service_completed_successfullyCOMMENT
LOWtests/app/rp/src/lib/oidc-config.js1import { env } from '$env/dynamic/public';COMMENT
LOWdocs/conf.py1# Django OAuth Toolkit documentation build configuration file, created byCOMMENT
LOWdocs/conf.py81# There are two options for replacing |today|: either, you set today to someCOMMENT
LOWdocs/conf.py121COMMENT
LOWdocs/conf.py141# A shorter title for the navigation bar. Default is the same as html_title.COMMENT
LOWdocs/conf.py161COMMENT
LOWdocs/conf.py181COMMENT
LOWdocs/conf.py221# the title page.COMMENT
LOWoauth2_provider/models.py1781COMMENT
LOWoauth2_provider/validators.py21 (r"(?:" + URLValidator.host_re, URLValidator.ipv4_re, URLValidator.ipv6_re, dotless_domain_re + ")")COMMENT
LOWoauth2_provider/oauth2_validators.py781COMMENT
LOWoauth2_provider/oauth2_validators.py1021 u = NoneCOMMENT
LOWoauth2_provider/oauth2_validators.py1061 rt = RefreshToken.objects.filter(token_checksum=token_checksum).select_related("access_token").first()COMMENT
LOWoauth2_provider/oauth2_validators.py1081 # rotated chain, whose access token a later rotation has since revokedCOMMENT
LOWoauth2_provider/settings.py41PAR_REQUEST_MODEL = getattr(COMMENT
LOWoauth2_provider/settings.py141 # device authorization and PAR) reject a POST sent with any other media type, withCOMMENT
LOW…_provider/management/commands/clearcimdapplications.py41 while True:COMMENT
LOW…provider/static/oauth2_provider/js/application_form.js1// Live client-secret UX for the Application form.COMMENT
LOWoauth2_provider/authorization_server/oidc/views.py241 # Assumption: the `sub` claim and `user` property of the corresponding IDToken Object point to theCOMMENT
LOWoauth2_provider/authorization_server/views/base.py481 """COMMENT
AI Slop Vocabulary6 hits · 16 pts
SeverityFileLineSnippetContext
MEDIUMtests/test_admin.py178 # request has none, so attach a permissive stub (no DB needed) to keep the assertion robust.COMMENT
MEDIUMtests/test_import_compat.py196 # test asserts only on the subclass-time warning below (and stays robust if theCOMMENT
MEDIUMtests/multi_db_settings.py15 # Keep ``default`` concrete so Django's test harness can use standard multi-dbCOMMENT
LOWtests/test_device.py1087 # values take effect without wiping the overrides we just set above.COMMENT
MEDIUMtests/app/idp/idp/settings.py346 # log oauth2_provider issues to facilitate troubleshootingCOMMENT
LOWtests/app/idp/idp/oauth.py11# the way we're using it, so we just use a lambda that returns NoneCOMMENT
Fake / Example Data15 hits · 16 pts
SeverityFileLineSnippetContext
LOWtests/test_application_views.py541 cls.admin_user = UserModel.objects.create_superuser("admin_user", "admin@example.com", "123456")CODE
LOWtests/test_rest_framework.py187 auth = self._create_authorization_header("fake-token")CODE
LOWtests/test_rest_framework.py207 auth = self._create_authorization_header("fake-token")CODE
LOWtests/test_rest_framework.py236 auth = self._create_authorization_header("fake-token")CODE
LOWtests/test_rest_framework.py262 auth = self._create_authorization_header("fake-token")CODE
LOWtests/test_rest_framework.py278 auth = self._create_authorization_header("fake-token")CODE
LOWtests/test_rest_framework.py471 auth = self._create_authorization_header("fake-token")CODE
LOWtests/test_settings.py235 admin_user = UserModel.objects.create_superuser("admin", "admin@example.com", "password")CODE
LOWrfcs/openid-connect-core-1_0.txt3371 "name": "Jane Doe",CODE
LOWrfcs/openid-connect-core-1_0.txt3796 "name": "Jane Doe",CODE
LOWrfcs/openid-connect-core-1_0.txt3936 "name": "Jane Doe",CODE
LOWrfcs/openid-connect-core-1_0.txt3998 "name": "Jane Doe",CODE
LOWrfcs/openid-connect-core-1_0.txt7742 "name": "Jane Doe",CODE
LOWrfcs/openid-connect-discovery-1_0.txt650 Such an example is "acct:joe%40example.com@example.org". End-UsersCODE
LOWrfcs/openid-connect-discovery-1_0.txt651 MAY input values like "joe@example.com@example.org" to initiateCODE
Self-Referential Comments5 hits · 15 pts
SeverityFileLineSnippetContext
MEDIUMtests/test_oauth2_provider_middleware.py54 # Create a valid access tokenCOMMENT
MEDIUMtests/test_application_views.py35 # Create a registration view and tests that the model form is boundCOMMENT
MEDIUMtests/test_dcr_views.py622 # Create a second application with its own tokenCOMMENT
MEDIUMdocs/conf.py4# This file is execfile()d with the current directory set to its containing dir.COMMENT
MEDIUMoauth2_provider/oauth2_validators.py842 # Creating a fresh *access* token here would violate the OneToOneCOMMENT
Deep Nesting15 hits · 12 pts
SeverityFileLineSnippetContext
LOWtests/test_import_compat.py277CODE
LOWtests/test_import_compat.py323CODE
LOWtests/e2e/conftest.py78CODE
LOWtests/e2e/compliance.py109CODE
LOWoauth2_provider/models.py519CODE
LOWoauth2_provider/oauth2_validators.py160CODE
LOWoauth2_provider/oauth2_validators.py226CODE
LOWoauth2_provider/oauth2_validators.py265CODE
LOWoauth2_provider/oauth2_validators.py525CODE
LOWoauth2_provider/oauth2_validators.py642CODE
LOWoauth2_provider/oauth2_validators.py726CODE
LOWoauth2_provider/settings.py445CODE
LOWoauth2_provider/contrib/rest_framework/permissions.py152CODE
LOWoauth2_provider/authorization_server/views/base.py230CODE
LOWoauth2_provider/authorization_server/views/base.py570CODE
Modern Structural Boilerplate11 hits · 11 pts
SeverityFileLineSnippetContext
LOWoauth2_provider/models.py40logger = logging.getLogger(__name__)CODE
LOWoauth2_provider/models.py109def set_token_value(token_instance: "AbstractAccessToken | AbstractRefreshToken", raw_token: str) -> None:CODE
LOWoauth2_provider/oauth2_validators.py65__all__ = [CODE
LOWoauth2_provider/core/compat.py15__all__ = ["login_not_required"]CODE
LOWoauth2_provider/core/utils.py122def set_oauthlib_user_to_device_request_user(request: Request) -> None:CODE
LOWoauth2_provider/resource_server/__init__.py50__all__ = ["build_bearer_challenge", "challenge_status", *sorted(_LAZY)]CODE
LOWoauth2_provider/contrib/ninja/__init__.py5__all__ = ["HttpOAuth2", "OAuth2ClientRateThrottle", "OAuth2UserOrClientRateThrottle"]CODE
LOWoauth2_provider/views/mixins.py36__all__ = [CODE
LOWoauth2_provider/views/metadata.py26__all__ = [CODE
LOWoauth2_provider/client/__init__.py22__all__ = ["make_client_assertion"]CODE
LOWoauth2_provider/client/client_assertions.py22__all__ = ["make_client_assertion"]CODE
Excessive Try-Catch Wrapping10 hits · 10 pts
SeverityFileLineSnippetContext
LOWtests/e2e/browser_cross_site/conftest.py107 except Exception as exc: # pragma: no cover - environment guardCODE
LOWtests/e2e/browser_cross_site/conftest.py135 except Exception as exc: # pragma: no cover - environment guardCODE
LOWtests/e2e/browser_cross_site/conftest.py159 except Exception as exc: # pragma: no cover - environment guardCODE
LOW…e2e/browser_cross_site/test_silent_login_cross_site.py73 except Exception as exc:CODE
LOWtests/e2e/browser_rp/conftest.py45 except Exception as exc: # pragma: no cover - environment guardCODE
LOWtests/e2e/browser_rp/conftest.py67 except Exception as exc: # pragma: no cover - environment guardCODE
LOWtests/e2e/browser_rp/conftest.py80 except Exception as exc: # pragma: no cover - environment guardCODE
LOWtests/e2e/helpers/browser.py47 except Exception as exc: # Playwright TimeoutError (or the check's own AssertionError)CODE
LOW…th2_provider/authorization_server/client_assertions.py277 except Exception:CODE
LOWoauth2_provider/authorization_server/cimd.py425 except Exception:CODE
Redundant / Tautological Comments3 hits · 4 pts
SeverityFileLineSnippetContext
LOWoauth2_provider/settings.py449 # Check if present in user settingsCOMMENT
LOWoauth2_provider/resource_server/decorators.py121 # Check if provided scopes are acceptableCOMMENT
LOWoauth2_provider/resource_server/decorators.py131 # Check if method is safe. Build a fresh list per request so the read/writeCOMMENT
AI Structural Patterns4 hits · 4 pts
SeverityFileLineSnippetContext
LOWtests/e2e/helpers/oauth_client.py147CODE
LOWtests/e2e/helpers/oauth_client.py184CODE
LOWtests/e2e/helpers/idp_process.py67CODE
LOWoauth2_provider/resource_server/middleware.py65CODE