oauthlib · bennr01 · Mar 17, 2022 · Mar 17, 2022
diff --git a/oauthlib/oauth2/rfc6749/endpoints/metadata.py b/oauthlib/oauth2/rfc6749/endpoints/metadata.py
@@ -91,7 +91,7 @@ def validate_metadata_token(self, claims, endpoint):
         parameter passed to the token endpoint defined in the grant type
         definition.
         """
-        self._grant_types.extend(endpoint._grant_types.keys())
+        self._grant_types_supported.extend(endpoint._grant_types.keys())
         claims.setdefault("token_endpoint_auth_methods_supported", ["client_secret_post", "client_secret_basic"])
 
         self.validate_metadata(claims, "token_endpoint_auth_methods_supported", is_list=True)
@@ -107,7 +107,7 @@ def validate_metadata_authorization(self, claims, endpoint):
         # using the "token" endpoint, as such, we have to add it explicitly to
         # the list of "grant_types_supported" when enabled.
         if "token" in claims["response_types_supported"]:
-            self._grant_types.append("implicit")
+            self._grant_types_supported.append("implicit")
 
         self.validate_metadata(claims, "response_types_supported", is_required=True, is_list=True)
         self.validate_metadata(claims, "response_modes_supported", is_list=True)
@@ -220,7 +220,7 @@ def validate_metadata_server(self):
         self.validate_metadata(claims, "op_policy_uri", is_url=True)
         self.validate_metadata(claims, "op_tos_uri", is_url=True)
 
-        self._grant_types = []
+        self._grant_types_supported = []
         for endpoint in self.endpoints:
             if isinstance(endpoint, TokenEndpoint):
                 self.validate_metadata_token(claims, endpoint)
@@ -233,6 +233,6 @@ def validate_metadata_server(self):
 
         # "grant_types_supported" is a combination of all OAuth2 grant types
         # allowed in the current provider implementation.
-        claims.setdefault("grant_types_supported", self._grant_types)
+        claims.setdefault("grant_types_supported", self._grant_types_supported)
         self.validate_metadata(claims, "grant_types_supported", is_list=True)
         return claims
diff --git a/tests/oauth2/rfc6749/endpoints/test_metadata.py b/tests/oauth2/rfc6749/endpoints/test_metadata.py
@@ -5,6 +5,43 @@
 from tests.unittest import TestCase
 
 
+from oauthlib import oauth2
+
+
+class ServerWithMetadata(oauth2.Server, oauth2.MetadataEndpoint):
+    """
+    A helper class for testing compatibility between MetadataEndpoint and
+    the Server class when inheriting from both.
+
+    This is used for the regression test for https://github.com/oauthlib/oauthlib/pull/808 .
+    """
+    def __init__(
+        self,
+        request_validator,
+        token_expires_in=None,
+        token_generator=None,
+        refresh_token_generator=None,
+        claims={},
+        *args,
+        **kwargs,
+    ):
+        oauth2.Server.__init__(
+            self,
+            request_validator,
+            token_expires_in=token_expires_in,
+            token_generator=token_generator,
+            refresh_token_generator=refresh_token_generator,
+            *args,
+            **kwargs,
+        )
+        oauth2.MetadataEndpoint.__init__(
+            self,
+            [self],
+            claims=claims,
+            raise_errors=True,
+        )
+
+
 class MetadataEndpointTest(TestCase):
     def setUp(self):
         self.metadata = {
@@ -145,3 +182,30 @@ def test_metadata_validate_issuer(self):
                 "issuer": 'http://foo.bar',
                 "token_endpoint": "https://foo.bar/token",
             })
+
+    def test_inheritance_compatibility_with_server(self):
+        """
+        Test compatibility between the MetadataEndpoint and Server in subclasses
+        inheriting from both classes.
+
+        This is a regression test for https://github.com/oauthlib/oauthlib/pull/808 .
+        The bug fixed in the linked PR occured when a class inheriting from both Server
+        and MetadataEndpoint called MetadataEndpoint.__init__() and passing itself as an
+        argument.
+        The underlying cause of the bug was an attribute collision between the
+        TokenEndpoint and the MetadataEndpoint, both of which use the _grant_types
+        attribute, but using different types (list and dict).
+        """
+        # checking against a regression is rather simple in this case, as the bug happens
+        # during __init__ of the MetadataEndpoint.
+        # we can just create an instance of ServerWithMetadata. If this succeeds without
+        # a bug, then this test was successful.
+        validator = None
+        claims = {
+            "issuer": 'https://foo.bar',
+            "authorization_endpoint": "https://foo.bar/authorize",
+            "revocation_endpoint": "https://foo.bar/revoke",
+            "introspection_endpoint": "https://foo.bar/introspect",
+            "token_endpoint": "https://foo.bar/token"
+        }
+        ServerWithMetadata(validator, claims=claims)