fix: migrate authlib.jose to joserfc (#1197)

authlib.jose emits AuthlibDeprecationWarning and will be incompatible
before authlib 2.0.0. Replace with joserfc, the authlib-recommended
successor library.

Changes:
- codecarbon/cli/auth.py: KeySet.import_key_set + jwt.decode +
  JWTClaimsRegistry().validate() for access-token validation
- carbonserver oidc_auth_provider.py: same migration in _decode_token
- Add joserfc>=1.0.0 to lib and server dependencies
- Update cli auth tests to patch joserfc.jwk.KeySet instead of
  authlib.jose.JsonWebKey; token.claims now an attribute, not a dict
  with validate() method

Author: MatthewJamisonJS

carbonserver/carbonserver/api/services/auth_providers/oidc_auth_provider.py

@@ -9,10 +9,10 @@
 from typing import Any, Dict, Optional, Tuple
 
 from authlib.integrations.starlette_client import OAuth
-from authlib.jose import JsonWebKey
-from authlib.jose import jwt as jose_jwt
 from fastapi import Response
 from fief_client import FiefAsync
+from joserfc import jwt as jose_jwt
+from joserfc.jwk import KeySet
 
 from carbonserver.config import settings
 
@@ -63,10 +63,10 @@ async def _decode_token(self, token: str) -> Dict[str, Any]:
             ...
 
         jwks_data = await self.client.fetch_jwk_set()
-        keyset = JsonWebKey.import_key_set(jwks_data)
-        claims = jose_jwt.decode(token, keyset)
-        claims.validate()
-        return dict(claims)
+        keyset = KeySet.import_key_set(jwks_data)
+        decoded = jose_jwt.decode(token, keyset)
+        jose_jwt.JWTClaimsRegistry().validate(decoded.claims)
+        return dict(decoded.claims)
 
     async def validate_access_token(self, token: str) -> bool:
         await self._decode_token(token)

carbonserver/pyproject.toml

@@ -37,6 +37,7 @@ dependencies = [
     "PyJWT",
     "fastapi-oidc>=0.0.9",
     "authlib>=1.6.6",
+    "joserfc>=1.0.0",
     "itsdangerous>=2.2.0",
 ]
 

carbonserver/uv.lock

@@ -16,9 +16,9 @@
 import requests
 from authlib.common.security import generate_token
 from authlib.integrations.requests_client import OAuth2Session
-from authlib.jose import JsonWebKey
-from authlib.jose import jwt as jose_jwt
 from authlib.oauth2.rfc7636 import create_s256_code_challenge
+from joserfc import jwt as jose_jwt
+from joserfc.jwk import KeySet
 
 AUTH_CLIENT_ID = os.environ.get(
     "AUTH_CLIENT_ID",
@@ -110,9 +110,9 @@ def _validate_access_token(access_token: str) -> bool:
         discovery = _discover_endpoints()
         jwks_resp = requests.get(discovery["jwks_uri"])
         jwks_resp.raise_for_status()
-        keyset = JsonWebKey.import_key_set(jwks_resp.json())
-        claims = jose_jwt.decode(access_token, keyset)
-        claims.validate()
+        keyset = KeySet.import_key_set(jwks_resp.json())
+        token = jose_jwt.decode(access_token, keyset)
+        jose_jwt.JWTClaimsRegistry().validate(token.claims)
         return True
     except requests.RequestException as exc:
         logger.warning(

codecarbon/cli/auth.py

@@ -27,6 +27,7 @@ classifiers = [
 dependencies = [
     "arrow",
     "authlib>=1.2.1",
+    "joserfc>=1.0.0",
     "click",
     "pandas>=2.3.3;python_version>='3.14'",
     "pandas;python_version<'3.14'",

pyproject.toml

@@ -90,15 +90,15 @@ def test_save_and_load_credentials(self, mock_open):
             self.assertEqual(loaded, tokens)
 
     @patch("codecarbon.cli.auth.requests.get")
-    @patch("codecarbon.cli.auth.JsonWebKey.import_key_set")
+    @patch("codecarbon.cli.auth.KeySet.import_key_set")
     @patch("codecarbon.cli.auth.jose_jwt.decode")
     def test_validate_access_token_valid(
         self, mock_decode, mock_import_key_set, mock_get
     ):
         mock_get.return_value.json.return_value = {"jwks_uri": "jwks"}
         mock_get.return_value.raise_for_status.return_value = None
         mock_import_key_set.return_value = "keyset"
-        mock_decode.return_value.validate.return_value = None
+        mock_decode.return_value.claims = {}
         with patch(
             "codecarbon.cli.auth._discover_endpoints", return_value={"jwks_uri": "jwks"}
         ):
@@ -119,7 +119,7 @@ def test_validate_access_token_network_error_returns_true(
 
     @patch("codecarbon.cli.auth._discover_endpoints", return_value={"jwks_uri": "jwks"})
     @patch("codecarbon.cli.auth.requests.get")
-    @patch("codecarbon.cli.auth.JsonWebKey.import_key_set")
+    @patch("codecarbon.cli.auth.KeySet.import_key_set")
     @patch(
         "codecarbon.cli.auth.jose_jwt.decode",
         side_effect=Exception("invalid"),