I've run into some issues adding typing to a project that uses oauthlib.

The first issue is regarding oauthlib.common.Request.

The package is managing many object attributes through a dict, which creates issues with typing. See https://github.com/oauthlib/oauthlib/blob/master/oauthlib/common.py#L360-L401

I initially opened a PR against the stubs here (python/typeshed#10613), however typeshed noticed this section of code appears to be designed to handle parsed http(s) request data and should be strints.

This pattern is not shared across the library.

For example, Reference the docs:

# oauthlib_request has a few convenient attributes set such as
# oauthlib_request.client = the client associated with the token
# oauthlib_request.user = the user associated with the token
# oauthlib_request.scopes = the scopes bound to this token

And then again here, we see that request.client should be an object:

This is repeated often throughout the code.

It's been a few years since I've worked much with this library, but I believe the following are supposed to be objects:

• client
• user
• refresh_token

And several others should be Lists of strings.

IMHO, the Request class should have declared attributes for the objects, lists and strings that are not simply decoded from the http(s) query.