[ShimonaR-MC]

Summary

Introduces the Mastercard OAuth 2.0 client library for Python, including FAPI 2.0, DPoP, token caching, key management, and integrations for HTTPX, aiohttp, and OpenAPI-generated clients.

Adds opt-in Mastercard sandbox tests for all supported integrations, with manual and scheduled GitHub Actions execution.

See the README for installation, configuration, supported clients, and usage examples.

Jira

• Initial implementation: G1548-11447
• HTTP client integrations: G1548-11181
• Umbrella feature: G1548-11180

Pending Work

Public release and release gates are tracked separately under G1548-11182.

Validation

• 310 deterministic tests passed
• Ruff and mypy passed
• Distribution build, Twine, and wheel checks passed
• Mastercard sandbox matrix passed for all required client and DPoP combinations
• SonarQube analysis completed with no security hotspots

[joseph-neeraj]

LGTM

[jaaufauvre]

Don't forget to book the name mastercard-oauth2-client asap on PyPI (https://pypi.org/project/mastercard-oauth2-client/ returns 404). Once the repo is public, anyone can publish under this name before we do.

[ShimonaR-MC]

Do you mean we should publish a prerelease to claim the name, or is there another way to reserve it on PyPI?

[jaaufauvre]

Maybe publish and then make the repo public. Or publish soon enough. I've read something the other day about bots stealing package names like that.

[ShimonaR-MC]

Fix for defect https://mastercard.atlassian.net/browse/G1548-13582 [Python OAuth2 Library] Failed token request is returned as the resource response instead of raising an error. Addressed by cecee4c.

[ShimonaR-MC]

Review comment (offline from Marco): A DPoP challenge from a redirect destination could cause the original request to be sent again.

Fix: The handler now verifies that the response belongs to the request it is handling before retrying the request or storing the returned nonce. Tests cover both same-origin and cross-origin redirects. Addressed by 470c6e1.

[ech0s7r]

Review comment (offline from Marco): A DPoP challenge from a redirect destination could cause the original request to be sent again.

Fix: The handler now verifies that the response belongs to the request it is handling before retrying the request or storing the returned nonce. Tests cover both same-origin and cross-origin redirects. Addressed by 470c6e1.

Thanks @ShimonaR-MC.

[Akshaykdubey]

LGTM