Merge branch 'develop' into main

Author: LJFCoding

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.1.2
+
+- Clear the request-cached GitHubKit client on logout, so logging out
+  takes effect immediately in the same request.
+- Keep request-cached clients separate for each `GitHub` extension
+  instance.
+
 ## 0.1.1
 
 - `@github.login` marks the view it decorates, and an expired refresh

README.md

@@ -9,7 +9,7 @@ refresh and stores tokens in `flask.session`.
 Install the release directly from GitHub:
 
 ```console
-pip install "flask-githubkit @ git+https://github.com/LJFCoding/flask-githubkit.git@v0.1.1"
+pip install "flask-githubkit @ git+https://github.com/LJFCoding/flask-githubkit.git@v0.1.2"
 ```
 
 It is not published on PyPI yet, so `pip install flask-githubkit` will not

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "flask-githubkit"
-version = "0.1.1"
+version = "0.1.2"
 description = "Flask extension for GitHub OAuth login, built on GitHubKit. Handles expiring-token refresh and server-side sessions."
 readme = "README.md"
 requires-python = ">=3.10"

src/flask_githubkit/auth.py

@@ -133,9 +133,14 @@ def client(self) -> "githubkit.GitHub[typing.Any] | None":
         refreshes an expired access token itself; the refreshed values
         are saved to the session at the end of the request.
         """
-        cached: githubkit.GitHub[typing.Any] | None = getattr(
+        clients: dict[GitHub, githubkit.GitHub[typing.Any]] | None = getattr(
             flask.g, CLIENT_ATTR, None
         )
+        if clients is None:
+            clients = {}
+            setattr(flask.g, CLIENT_ATTR, clients)
+
+        cached = clients.get(self)
         if cached is not None:
             return cached
 
@@ -155,11 +160,12 @@ def _save(
 
         flask.after_this_request(_save)
         github = githubkit.GitHub(auth=strategy)
-        setattr(flask.g, CLIENT_ATTR, github)
+        clients[self] = github
         return github
 
     def logout(self) -> None:
         flask_githubkit.store.Token.clear()
+        flask.g.pop(CLIENT_ATTR, None)
 
     @staticmethod
     def _config() -> flask_githubkit.config.Config | None:

tests/test_auth.py

@@ -141,6 +141,21 @@ def test_client_is_cached_per_request(app, github):
         assert github.client() is github.client()
 
 
+def test_clients_are_cached_per_extension_instance(app):
+    first = flask_githubkit.GitHub()
+    second = flask_githubkit.GitHub()
+
+    with app.test_request_context():
+        flask.session["flask_githubkit.token"] = SAMPLE_TOKEN
+
+        first_client = first.client()
+        second_client = second.client()
+
+        assert first_client is not second_client
+        assert first.client() is first_client
+        assert second.client() is second_client
+
+
 def test_invalid_stored_token_is_cleared(app, github):
     with app.test_request_context():
         flask.session["flask_githubkit.token"] = {
@@ -186,6 +201,32 @@ def test_logout_removes_stored_token(app, github):
         assert "flask_githubkit.token" not in flask.session
 
 
+def test_logout_invalidates_cached_client_in_the_same_request(app, github):
+    with app.test_request_context():
+        flask.session["flask_githubkit.token"] = SAMPLE_TOKEN
+        client = github.client()
+        assert client is not None
+
+        github.logout()
+
+        assert github.client() is None
+
+
+def test_logout_invalidates_all_cached_clients(app):
+    first = flask_githubkit.GitHub()
+    second = flask_githubkit.GitHub()
+
+    with app.test_request_context():
+        flask.session["flask_githubkit.token"] = SAMPLE_TOKEN
+        assert first.client() is not None
+        assert second.client() is not None
+
+        first.logout()
+
+        assert first.client() is None
+        assert second.client() is None
+
+
 def test_expired_refresh_token_clears_session_and_redirects_to_login(
     app, http_client
 ):