@mongoui/skills 0.2.0 → 0.2.1

package/skills/bms-api/references/source-manifest.json

@@ -0,0 +1,5 @@
+{
+  "api_version": "1.4.0",
+  "operation_count": 131,
+  "source_sha256": "2d220ee1629074fd0af5914ff4b78be813dcc39e4e68f7e686863ce5948da5a2"
+}

package/skills/bms-api/scripts/bms_signed_request.py

@@ -0,0 +1,103 @@
+#!/usr/bin/env python3
+"""Sign BMS JSON requests offline; use --send explicitly for a network request."""
+import argparse
+import hashlib
+import hmac
+import json
+import os
+from pathlib import Path
+import sys
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+import uuid
+
+TOKEN_EXCEPTIONS = {'/openapi/v1/bms/auth/token', '/openapi/v1/bms/auth/customer/register'}
+
+def canonical_query(raw):
+    # Match pkg/crypto/signature.go: decode form query before sorting; no re-encoding.
+    return '&'.join(key+'='+value for key, value in sorted(urllib.parse.parse_qsl(raw, keep_blank_values=True)))
+
+def sign_request(method, path, raw_query, body, app_id, secret, timestamp, nonce):
+    canonical = '\n'.join([method.upper(), path, canonical_query(raw_query), hashlib.sha256(body).hexdigest(), timestamp.strip(), nonce.strip(), app_id.strip()])
+    signature = hmac.new(secret.encode(), canonical.encode(), hashlib.sha256).hexdigest()
+    return canonical, {'X-OP-App-Key': app_id.strip(), 'X-OP-Timestamp': timestamp.strip(), 'X-OP-Nonce': nonce.strip(), 'X-OP-Sign': signature}
+
+def redact(value):
+    if isinstance(value, dict):
+        return {key: '<redacted>' if any(word in key.lower() for word in ['secret', 'token', 'password', 'aeskey', 'sign']) else redact(item) for key, item in value.items()}
+    if isinstance(value, list):
+        return [redact(item) for item in value]
+    return value
+
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--method', required=True)
+    parser.add_argument('--path', required=True, help='Complete public path without query')
+    parser.add_argument('--query', default='', help='Actual URL query string; percent-encoded when needed')
+    body_group = parser.add_mutually_exclusive_group()
+    body_group.add_argument('--body-json')
+    body_group.add_argument('--body-file', type=Path, help='Exact UTF-8 JSON body bytes')
+    parser.add_argument('--base-url', default=os.getenv('OPEN_API_BASE_URL'))
+    parser.add_argument('--timestamp', default=str(int(time.time())))
+    parser.add_argument('--nonce', default=uuid.uuid4().hex)
+    parser.add_argument('--send', action='store_true')
+    parser.add_argument('--timeout', type=float, default=20)
+    args = parser.parse_args()
+    app_id = os.getenv('OPEN_APP_ID', '').strip()
+    secret = os.getenv('OPEN_APP_SECRET', '')
+    token = os.getenv('BMS_TOKEN', '').strip()
+    if not app_id or not secret:
+        parser.error('Set OPEN_APP_ID and OPEN_APP_SECRET in the server environment.')
+    if not args.path.startswith('/openapi/v1/bms/') or '?' in args.path or '#' in args.path:
+        parser.error('--path must be the full public BMS path, without query or fragment.')
+    try:
+        if args.body_file:
+            body = args.body_file.read_bytes()
+            json.loads(body)
+        elif args.body_json is not None:
+            body = json.dumps(json.loads(args.body_json), ensure_ascii=False, separators=(',', ':')).encode()
+        else:
+            body = b''
+    except (OSError, ValueError):
+        parser.error('Body must be valid JSON; multipart and file downloads need a separate client.')
+    canonical, headers = sign_request(args.method, args.path, args.query, body, app_id, secret, args.timestamp, args.nonce)
+    headers['Accept'] = 'application/json'
+    if body:
+        headers['Content-Type'] = 'application/json'
+    if args.path not in TOKEN_EXCEPTIONS:
+        if args.send and not token:
+            parser.error('Business requests require BMS_TOKEN from this environment.')
+        if token:
+            headers['token'] = token
+    if not args.send:
+        print(json.dumps({'mode':'offline', 'method':args.method.upper(), 'path':args.path, 'canonical_string':canonical, 'headers':redact(headers), 'body_bytes':len(body), 'token_required':args.path not in TOKEN_EXCEPTIONS}, ensure_ascii=False, indent=2))
+        return 0
+    parsed = urllib.parse.urlsplit(args.base_url or '')
+    if parsed.scheme not in {'http','https'} or not parsed.netloc or parsed.username or parsed.query or parsed.fragment or parsed.path.rstrip('/'):
+        parser.error('Set OPEN_API_BASE_URL to the selected Open Platform gateway origin, without credentials, path, query or fragment.')
+    url = args.base_url.rstrip('/')+args.path+('?' + args.query if args.query else '')
+    request = urllib.request.Request(url, data=body if body else None, headers=headers, method=args.method.upper())
+    try:
+        response = urllib.request.build_opener(NoRedirect()).open(request, timeout=args.timeout)
+        with response:
+            status, data = response.status, response.read()
+    except urllib.error.HTTPError as error:
+        status, data = error.code, error.read()
+    except (urllib.error.URLError, TimeoutError):
+        print('Request outcome unknown. Query the business record before replaying a write.', file=sys.stderr)
+        return 1
+    print('HTTP', status)
+    try:
+        print(json.dumps(redact(json.loads(data)), ensure_ascii=False, indent=2))
+    except (ValueError, UnicodeError):
+        print('Non-JSON response; use a binary-capable client for exports.')
+    return 0 if 200 <= status < 300 else 1
+
+if __name__ == '__main__':
+    raise SystemExit(main())