Edge case fix for Double URL-encoding and extra validation check

Author: rmad17

src/auth0_server_python/auth_schemes/dpop_auth.py

@@ -17,6 +17,10 @@ def __init__(self, token: str, key: "jwk.JWK") -> None:
         public_jwk = key.export_public(as_dict=True)
         if public_jwk.get("kty") != "EC" or public_jwk.get("crv") != "P-256":
             raise ValueError("DPoP key must be an EC P-256 key")
+        try:
+            token.encode("ascii")
+        except UnicodeEncodeError:
+            raise ValueError("Access token must contain only ASCII characters")
         self._token = token
         self._key = key
         self._public_jwk = public_jwk

src/auth0_server_python/auth_server/my_account_client.py

@@ -1,10 +1,8 @@
 import json
 from typing import TYPE_CHECKING, Optional
-from urllib.parse import quote
+from urllib.parse import quote, unquote
 
 import httpx
-from pydantic import ValidationError
-
 from auth0_server_python.auth_schemes.bearer_auth import BearerAuth
 from auth0_server_python.auth_schemes.dpop_auth import DPoPAuth
 from auth0_server_python.auth_types import (
@@ -416,7 +414,7 @@ async def get_factors(
                 return GetFactorsResponse.model_validate(response.json())
 
         except Exception as e:
-            if isinstance(e, (MyAccountApiError, ApiError, ValidationError)):
+            if isinstance(e, (MyAccountApiError, ApiError)):
                 raise
             raise ApiError(
                 "get_factors_error",
@@ -464,7 +462,7 @@ async def list_authentication_methods(
                 return ListAuthenticationMethodsResponse.model_validate(response.json())
 
         except Exception as e:
-            if isinstance(e, (MyAccountApiError, ApiError, ValidationError)):
+            if isinstance(e, (MyAccountApiError, ApiError)):
                 raise
             raise ApiError(
                 "list_authentication_methods_error",
@@ -509,7 +507,7 @@ async def get_authentication_method(
                 return AuthenticationMethod.model_validate(response.json())
 
         except Exception as e:
-            if isinstance(e, (MyAccountApiError, ApiError, ValidationError)):
+            if isinstance(e, (MyAccountApiError, ApiError)):
                 raise
             raise ApiError(
                 "get_authentication_method_error",
@@ -552,7 +550,7 @@ async def delete_authentication_method(
                     )
 
         except Exception as e:
-            if isinstance(e, (MyAccountApiError, ApiError, ValidationError)):
+            if isinstance(e, (MyAccountApiError, ApiError)):
                 raise
             raise ApiError(
                 "delete_authentication_method_error",
@@ -601,7 +599,7 @@ async def update_authentication_method(
                 return AuthenticationMethod.model_validate(response.json())
 
         except Exception as e:
-            if isinstance(e, (MyAccountApiError, ApiError, ValidationError)):
+            if isinstance(e, (MyAccountApiError, ApiError)):
                 raise
             raise ApiError(
                 "update_authentication_method_error",
@@ -661,7 +659,7 @@ async def enroll_authentication_method(
 
                 path = location.split("?")[0].split("#")[0].rstrip("/")
                 segments = path.split("/")
-                authentication_method_id = segments[-1] if len(segments) > 1 else ""
+                authentication_method_id = unquote(segments[-1]) if len(segments) > 1 else ""
                 if not authentication_method_id or authentication_method_id in (
                     "authentication-methods",
                     "v1",
@@ -696,7 +694,7 @@ async def enroll_authentication_method(
                 )
 
         except Exception as e:
-            if isinstance(e, (MyAccountApiError, ApiError, ValidationError)):
+            if isinstance(e, (MyAccountApiError, ApiError)):
                 raise
             raise ApiError(
                 "enroll_authentication_method_error",
@@ -749,7 +747,7 @@ async def verify_authentication_method(
                 return AuthenticationMethod.model_validate(response.json())
 
         except Exception as e:
-            if isinstance(e, (MyAccountApiError, ApiError, ValidationError)):
+            if isinstance(e, (MyAccountApiError, ApiError)):
                 raise
             raise ApiError(
                 "verify_authentication_method_error",

src/auth0_server_python/auth_types/__init__.py

@@ -553,9 +553,9 @@ class VerifyAuthenticationMethodRequest(BaseModel):
     def _check_at_least_one_method(self) -> "VerifyAuthenticationMethodRequest":
         has_method = (
             self.authn_response is not None
-            or self.otp_code is not None
-            or self.recovery_code is not None
-            or self.password is not None
+            or (self.otp_code is not None and self.otp_code.strip() != "")
+            or (self.recovery_code is not None and self.recovery_code.strip() != "")
+            or (self.password is not None and self.password.strip() != "")
         )
         if not has_method:
             raise ValueError(