Split out token validation

Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>

Author: puiterwijk

flask_oidc/__init__.py

@@ -716,7 +716,7 @@ def decorated(*args, **kwargs):
                     token = request.args['access_token']
 
                 validity = self.validate_token(token, scopes_required)
-                if (validity is True) or not require_token:
+                if (validity is True) or (not require_token):
                     return view_func(*args, **kwargs)
                 else:
                     return (json.dumps(

tests/test_flask_oidc.py

@@ -196,4 +196,7 @@ def test_api_token():
 
     # Test with token for another audience
     resp = test_client.get('/api?access_token=some_elses_token')
+    assert resp.status_code == 200, 'Token should be accepted'
+    test_client.application.config['OIDC_RESOURCE_CHECK_AUD'] = True
+    resp = test_client.get('/api?access_token=some_elses_token')
     assert resp.status_code == 401, 'Token should be refused'