@danhachuel/thunderbolt 0.5.1 → 0.5.3

package/app/main.py

@@ -7199,7 +7199,7 @@ def _render_media_provider_card(settings: dict[str, Any], cards: list[dict[str,
                         state = create_state()
                         st.session_state[f"canva_verifier_{card_id}"] = verifier
                         st.session_state[f"canva_state_{card_id}"] = state
-                        st.session_state[f"canva_authorization_url_{card_id}"] = authorization_url(client_id, redirect_uri, "design:content:read design:content:write", state, challenge)
+                        st.session_state[f"canva_authorization_url_{card_id}"] = authorization_url(client_id, redirect_uri, state=state, code_challenge=challenge)
                     authorization_link = str(st.session_state.get(f"canva_authorization_url_{card_id}") or "")
                     if authorization_link:
                         st.markdown(f"[Abrir autorização Canva]({authorization_link})")

package/hermes_ui/canva_auth.py

@@ -11,27 +11,58 @@ import requests
 
 AUTHORIZE_URL = "https://www.canva.com/api/oauth/authorize"
 TOKEN_URL = "https://api.canva.com/rest/v1/oauth/token"
+_PKCE_MIN_LENGTH = 43
+_PKCE_MAX_LENGTH = 128
+CANVA_OAUTH_SCOPES = (
+    "asset:read",
+    "asset:write",
+    "design:meta:read",
+    "design:content:read",
+    "design:content:write",
+)
 
 
 def _b64(value: bytes) -> str:
     return base64.urlsafe_b64encode(value).rstrip(b"=").decode("ascii")
 
 
-def create_pkce_pair() -> tuple[str, str]:
-    verifier = _b64(secrets.token_bytes(64))
+def generate_code_verifier() -> str:
+    """Create a RFC 7636 verifier using a cryptographically secure source."""
+    verifier = _b64(secrets.token_bytes(32))
+    if not _PKCE_MIN_LENGTH <= len(verifier) <= _PKCE_MAX_LENGTH:
+        raise RuntimeError("Falha ao gerar um code_verifier PKCE válido.")
+    return verifier
+
+
+def generate_code_challenge(code_verifier: str) -> str:
+    """Derive the S256 Base64URL-without-padding PKCE challenge."""
+    verifier = str(code_verifier or "")
+    if not _PKCE_MIN_LENGTH <= len(verifier) <= _PKCE_MAX_LENGTH:
+        raise ValueError("code_verifier PKCE inválido.")
     challenge = _b64(hashlib.sha256(verifier.encode("ascii")).digest())
-    return verifier, challenge
+    if challenge == "<CODE_CHALLENGE>":
+        raise RuntimeError("Foi detectado um placeholder de code_challenge.")
+    return challenge
+
+
+def create_pkce_pair() -> tuple[str, str]:
+    verifier = generate_code_verifier()
+    return verifier, generate_code_challenge(verifier)
 
 
 def create_state() -> str:
     return _b64(secrets.token_bytes(48))
 
 
-def authorization_url(client_id: str, redirect_uri: str, scope: str, state: str, code_challenge: str) -> str:
+def authorization_url(client_id: str, redirect_uri: str, scope: str | list[str] | tuple[str, ...] | None = None, state: str = "", code_challenge: str = "") -> str:
+    if not code_challenge or code_challenge == "<CODE_CHALLENGE>":
+        raise ValueError("Não é permitido iniciar Canva com code_challenge placeholder.")
+    scope_value = CANVA_OAUTH_SCOPES if scope is None else scope
+    scope_string = " ".join(scope_value) if isinstance(scope_value, (list, tuple)) else " ".join(str(scope_value or "").split())
     params = {
         "code_challenge": code_challenge,
-        "code_challenge_method": "S256",
-        "scope": " ".join(str(scope or "").split()),
+        "code_challenge_method": "s256",
+        "scope": scope_string,
         "response_type": "code",
         "client_id": str(client_id).strip(),
         "state": str(state).strip(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danhachuel/thunderbolt",
-  "version": "0.5.01",
+  "version": "0.5.3",
   "description": "Thunderbolt — interface local para operação de canais faceless e motor MoneyPrinterTurbo",
   "license": "MIT",
   "main": "scripts/cli.mjs",