anyoauth-sdk 0.1.0__tar.gz

anyoauth_sdk-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) AnyOAuth contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

anyoauth_sdk-0.1.0/PKG-INFO

@@ -0,0 +1,8 @@
+Metadata-Version: 2.4
+Name: anyoauth-sdk
+Version: 0.1.0
+Summary: AnyOAuth confidential backend SDK
+License: MIT
+Requires-Python: >=3.10
+License-File: LICENSE
+Dynamic: license-file

anyoauth_sdk-0.1.0/README.md

@@ -0,0 +1,50 @@
+# anyoauth-sdk
+
+Generated AnyOAuth python confidential-backend SDK, version 0.1.0. MIT licensed. Model descriptors are generated from OpenAPI and embedded in the runtime (also published in schema.json). Objects use JSON field names; optional additive response fields are preserved.
+
+## Install / build
+
+Install with `pip install .` from this directory.
+
+From this SDK repository root:
+
+```sh
+python3 -m compileall -q sdks/python
+python3 tests/selftest.py
+python3 tests/conformance.py < input.json
+```
+
+The runner reads one JSON object and prints one JSON result. Example input: `{"action":"pkceChallenge","params":{"codeVerifier":"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"}}`. Tests use a local HTTP server and dummy credentials only.
+
+## Public API
+
+Construct `anyoauth.Client(client_id, client_secret, base_url)`. The origin defaults to https://api.anyoauth.com. Each operation accepts a parameter dictionary.
+
+- `exchange_code`
+- `profile`
+- `revoke`
+- `providers`
+- `pkce_challenge`
+- `authorization_url`
+- `validate_callback`
+- `create_transaction`
+
+Canonical parameters: exchangeCode {code, codeVerifier, redirectUri}; profile/revoke {accessToken}; pkceChallenge {codeVerifier}; authorizationUrl {provider, redirectUri, state, codeChallenge}; validateCallback {callbackUrl, redirectUri, state, expiresAt}; createTransaction {}. Revocation returns null/nil. Errors expose status, code and safe message. Default timeout is 10 seconds with no redirects or retries.
+
+Persist the transaction in the initiating browser's server session, binding it to the exact registered callback. Construct the authorization URL locally, then navigate the browser. Validate the callback and consume the saved transaction atomically (including provider denial). Exchange once with the original verifier, retrieve profile, identify by subject rather than email, and create your application's session. Nullable profile fields are legitimate. Keep secrets on the backend; never put tokens or the verifier in URLs. Helpers do not manage session storage.
+
+Generated reproducibly by `node sdks/generate.mjs --target=python`; edit sdks/templates/server-dynamic.mjs rather than generated sources.
+
+## Standalone conformance
+
+Run `node tests/check.mjs` from this package after installing/building dependencies. The shared suite exercises all eight public actions through the native runtime, schema failures, wire formats, redirects, no retries, and deadlines. Node is a test harness dependency only.
+
+## Source and releases
+
+Repository: https://github.com/AnyOAuth/anyoauth-python
+
+GitHub prerelease: https://github.com/AnyOAuth/anyoauth-python/releases/tag/v0.1.0
+
+Clone this repository, then run `node verify.mjs` with the native toolchain installed to build and execute the package's conformance suite. Source is generated in the AnyOAuth monorepo; propose changes there so every language stays aligned. GitHub hosts source archives and checksums. Package registry publication is separate.
+
+This initial source release has full advertised-method conformance coverage. Runtime line/branch coverage for the whole language matrix remains a separate release gate; see https://anyoauth.com/docs/libraries/.

anyoauth_sdk-0.1.0/anyoauth/__init__.py

@@ -0,0 +1,158 @@
+"""Generated AnyOAuth SDK. Runtime policy: sdks/templates/server-dynamic.mjs."""
+import base64
+import hashlib
+import hmac
+import json
+import re
+import secrets
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+
+DESCRIPTORS = json.loads("{\"schemas\":{\"Provider\":{\"type\":\"string\",\"enum\":[\"google\",\"github\"]},\"RedirectUri\":{\"type\":\"string\",\"format\":\"uri\",\"maxLength\":2048,\"x-validation\":\"redirect\",\"description\":\"Exact registered HTTPS URL or HTTP loopback; no credentials, query or fragment.\"},\"TokenRequest\":{\"type\":\"object\",\"additionalProperties\":false,\"required\":[\"grant_type\",\"client_id\",\"client_secret\",\"code\",\"redirect_uri\",\"code_verifier\"],\"properties\":{\"grant_type\":{\"type\":\"string\",\"const\":\"authorization_code\"},\"client_id\":{\"type\":\"string\",\"maxLength\":100},\"client_secret\":{\"type\":\"string\",\"minLength\":1,\"maxLength\":200},\"code\":{\"type\":\"string\",\"minLength\":1,\"maxLength\":200},\"redirect_uri\":{\"$ref\":\"#/components/schemas/RedirectUri\"},\"code_verifier\":{\"type\":\"string\",\"pattern\":\"^[A-Za-z0-9._~-]{43,128}$\"}}},\"TokenResponse\":{\"type\":\"object\",\"required\":[\"access_token\",\"token_type\",\"expires_in\",\"scope\"],\"properties\":{\"access_token\":{\"type\":\"string\",\"pattern\":\"^aop_[A-Za-z0-9_-]{43}$\"},\"token_type\":{\"type\":\"string\",\"const\":\"Bearer\"},\"expires_in\":{\"type\":\"integer\",\"const\":900},\"scope\":{\"type\":\"string\",\"const\":\"profile\"}}},\"Profile\":{\"type\":\"object\",\"required\":[\"subject\",\"provider\",\"providerSubject\",\"name\",\"username\",\"email\",\"emailVerified\",\"avatarUrl\"],\"properties\":{\"subject\":{\"type\":\"string\"},\"provider\":{\"$ref\":\"#/components/schemas/Provider\"},\"providerSubject\":{\"type\":\"string\"},\"name\":{\"type\":[\"string\",\"null\"]},\"username\":{\"type\":[\"string\",\"null\"]},\"email\":{\"type\":[\"string\",\"null\"]},\"emailVerified\":{\"type\":\"boolean\"},\"avatarUrl\":{\"type\":[\"string\",\"null\"]}}},\"ProviderStatus\":{\"type\":\"object\",\"required\":[\"id\",\"configured\",\"enabled\",\"available\"],\"properties\":{\"id\":{\"$ref\":\"#/components/schemas/Provider\"},\"configured\":{\"type\":\"boolean\"},\"enabled\":{\"type\":\"boolean\"},\"available\":{\"type\":\"boolean\"}}},\"ProviderStatuses\":{\"type\":\"array\",\"items\":{\"$ref\":\"#/components/schemas/ProviderStatus\"}},\"ApiError\":{\"type\":\"object\",\"required\":[\"error\"],\"properties\":{\"error\":{\"type\":\"string\"},\"message\":{\"type\":\"string\"}}},\"Transaction\":{\"type\":\"object\",\"required\":[\"state\",\"codeVerifier\",\"codeChallenge\",\"createdAt\",\"expiresAt\"],\"properties\":{\"state\":{\"type\":\"string\",\"pattern\":\"^[A-Za-z0-9_-]{43}$\"},\"codeVerifier\":{\"type\":\"string\",\"pattern\":\"^[A-Za-z0-9._~-]{43,128}$\"},\"codeChallenge\":{\"type\":\"string\",\"pattern\":\"^[A-Za-z0-9_-]{43}$\"},\"createdAt\":{\"type\":\"integer\"},\"expiresAt\":{\"type\":\"integer\"}}}},\"operations\":{\"exchangeCode\":{\"id\":\"exchangeCode\",\"path\":\"/v1/token\",\"method\":\"POST\",\"auth\":\"client\",\"requestSchema\":\"TokenRequest\",\"responseSchema\":\"TokenResponse\",\"successStatus\":200,\"inputs\":{\"grant_type\":{\"constant\":\"authorization_code\"},\"client_id\":{\"param\":\"clientId\"},\"client_secret\":{\"param\":\"clientSecret\"},\"code\":{\"param\":\"code\"},\"redirect_uri\":{\"param\":\"redirectUri\"},\"code_verifier\":{\"param\":\"codeVerifier\"}}},\"profile\":{\"id\":\"profile\",\"path\":\"/v1/profile\",\"method\":\"GET\",\"auth\":\"bearer\",\"requestSchema\":null,\"responseSchema\":\"Profile\",\"successStatus\":200,\"inputs\":{}},\"revoke\":{\"id\":\"revoke\",\"path\":\"/v1/revoke\",\"method\":\"POST\",\"auth\":\"bearer\",\"requestSchema\":null,\"responseSchema\":null,\"successStatus\":204,\"inputs\":{}},\"providers\":{\"id\":\"providers\",\"path\":\"/api/providers\",\"method\":\"GET\",\"auth\":\"none\",\"requestSchema\":null,\"responseSchema\":\"ProviderStatuses\",\"successStatus\":200,\"inputs\":{}}},\"authorization\":{\"path\":\"/authorize\",\"parameters\":[{\"name\":\"client_id\",\"in\":\"query\",\"required\":true,\"schema\":{\"type\":\"string\",\"minLength\":1}},{\"name\":\"provider\",\"in\":\"query\",\"required\":true,\"schema\":{\"$ref\":\"#/components/schemas/Provider\"}},{\"name\":\"redirect_uri\",\"in\":\"query\",\"required\":true,\"schema\":{\"$ref\":\"#/components/schemas/RedirectUri\"}},{\"name\":\"state\",\"in\":\"query\",\"required\":true,\"schema\":{\"type\":\"string\",\"minLength\":16,\"maxLength\":512}},{\"name\":\"code_challenge\",\"in\":\"query\",\"required\":true,\"schema\":{\"type\":\"string\",\"pattern\":\"^[A-Za-z0-9_-]{43}$\"}},{\"name\":\"code_challenge_method\",\"in\":\"query\",\"required\":true,\"schema\":{\"type\":\"string\",\"const\":\"S256\"}},{\"name\":\"response_type\",\"in\":\"query\",\"required\":true,\"schema\":{\"type\":\"string\",\"const\":\"code\"}}]},\"transaction\":{\"lifetimeSeconds\":600,\"entropyBytes\":32,\"description\":\"Create random state and a PKCE verifier/challenge. Persist this transaction in the initiating browser or app session.\",\"input\":{\"type\":\"object\",\"properties\":{},\"additionalProperties\":false}},\"defaultOrigin\":\"https://api.anyoauth.com\"}")
+SCHEMAS = DESCRIPTORS['schemas']
+
+class Error(Exception):
+    def __init__(self, status=0, code='invalid_argument', message='Invalid input'):
+        super().__init__(message)
+        self.status, self.code, self.message = status, code, message
+
+def _url(value, origin=False):
+    try:
+        if not isinstance(value, str) or re.search(r'[\s\\]', value):
+            raise ValueError()
+        u = urllib.parse.urlsplit(value)
+        _ = u.port
+        if not u.hostname or u.username is not None or u.password is not None or '?' in value or '#' in value:
+            raise ValueError()
+        if u.scheme != 'https' and not (u.scheme == 'http' and u.hostname in ('localhost', '127.0.0.1', '::1')):
+            raise ValueError()
+        if origin and u.path not in ('', '/'):
+            raise ValueError()
+        return value.rstrip('/') if origin else value
+    except (ValueError, TypeError):
+        raise Error()
+
+def validate(value, schema):
+    if '$ref' in schema:
+        return validate(value, SCHEMAS[schema['$ref'].split('/')[-1]])
+    types = schema.get('type', [])
+    if isinstance(types, str): types = [types]
+    matches = {'null': value is None, 'string': isinstance(value, str), 'boolean': type(value) is bool,
+               'integer': type(value) is int or (type(value) is float and value.is_integer()), 'object': isinstance(value, dict), 'array': isinstance(value, list)}
+    if types and not any(matches[t] for t in types): raise Error()
+    if 'const' in schema and (type(value) is bool or value != schema['const']): raise Error()
+    if 'enum' in schema and value not in schema['enum']: raise Error()
+    if isinstance(value, str):
+        if len(value) < schema.get('minLength', 0) or len(value) > schema.get('maxLength', float('inf')): raise Error()
+        if 'pattern' in schema:
+            pattern = schema['pattern']
+            if pattern.endswith('$'): pattern = pattern[:-1] + r'\Z'
+            if not re.search(pattern, value): raise Error()
+        if schema.get('x-validation') == 'redirect': _url(value)
+    if isinstance(value, dict):
+        if any(k not in value for k in schema.get('required', [])): raise Error()
+        props = schema.get('properties', {})
+        if schema.get('additionalProperties') is False and any(k not in props for k in value): raise Error()
+        for k, s in props.items():
+            if k in value: validate(value[k], s)
+    if isinstance(value, list) and 'items' in schema:
+        for item in value: validate(item, schema['items'])
+    return value
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl): return None
+
+class Client:
+    def __init__(self, client_id='', client_secret='', base_url=DESCRIPTORS['defaultOrigin']):
+        self.client_id, self.client_secret = client_id, client_secret
+        self.base_url = _url(base_url, True)
+
+    def _request(self, action, params):
+        op = DESCRIPTORS['operations'][action]
+        headers = {'Accept': 'application/json', 'User-Agent': 'AnyOAuth-python/0.1.0'}
+        body = None
+        if op['auth'] == 'bearer':
+            token = params.get('accessToken')
+            if not isinstance(token, str) or not re.fullmatch(r'[A-Za-z0-9._~+/-]+=*', token): raise Error()
+            headers['Authorization'] = 'Bearer ' + token
+        if op['requestSchema']:
+            values = {**params, 'clientId': self.client_id, 'clientSecret': self.client_secret}
+            data = {k: v['constant'] if 'constant' in v else values.get(v['param']) for k,v in op['inputs'].items()}
+            validate(data, SCHEMAS[op['requestSchema']])
+            body = json.dumps(data).encode()
+            headers['Content-Type'] = 'application/json'
+        req = urllib.request.Request(self.base_url + op['path'], data=body, headers=headers, method=op['method'])
+        try:
+            opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), _NoRedirect())
+            with opener.open(req, timeout=10) as response:
+                status, raw = response.status, response.read()
+        except urllib.error.HTTPError as e:
+            status, raw = e.code, e.read()
+        except Exception:
+            raise Error(0, 'transport_error', 'HTTP request failed')
+        if status != op['successStatus']:
+            if 200 <= status < 300: raise Error(status, 'protocol_error', 'Unexpected response status')
+            code, message = 'protocol_error', 'Invalid error response'
+            try:
+                data = json.loads(raw, parse_constant=lambda _: (_ for _ in ()).throw(ValueError()))
+                validate(data, SCHEMAS['ApiError'])
+                code, message = data['error'], data.get('message', 'HTTP request failed')
+            except Exception: pass
+            raise Error(status, code, message)
+        if not op['responseSchema']: return None
+        try:
+            return validate(json.loads(raw, parse_constant=lambda _: (_ for _ in ()).throw(ValueError())), SCHEMAS[op['responseSchema']])
+        except Exception:
+            raise Error(status, 'protocol_error', 'Invalid API response')
+
+    def exchange_code(self, params=None):
+        return self._request("exchangeCode", params or {})
+
+    def profile(self, params=None):
+        return self._request("profile", params or {})
+
+    def revoke(self, params=None):
+        return self._request("revoke", params or {})
+
+    def providers(self, params=None):
+        return self._request("providers", params or {})
+
+    def pkce_challenge(self, params):
+        verifier = params.get('codeVerifier')
+        if not isinstance(verifier, str) or not re.fullmatch(r'[A-Za-z0-9._~-]{43,128}', verifier): raise Error()
+        return base64.urlsafe_b64encode(hashlib.sha256(verifier.encode('ascii')).digest()).decode().rstrip('=')
+
+    def create_transaction(self, params=None):
+        settings = DESCRIPTORS['transaction']
+        state, verifier = (secrets.token_urlsafe(settings['entropyBytes']) for _ in range(2))
+        now = int(time.time())
+        return validate({'state':state, 'codeVerifier':verifier, 'codeChallenge':self.pkce_challenge({'codeVerifier':verifier}), 'createdAt':now, 'expiresAt':now+settings['lifetimeSeconds']}, SCHEMAS['Transaction'])
+
+    def authorization_url(self, params):
+        values = {**params, 'clientId':self.client_id}
+        query = {}
+        for p in DESCRIPTORS['authorization']['parameters']:
+            s = p['schema']
+            key = re.sub(r'_([a-z])', lambda m: m[1].upper(), p['name'])
+            query[p['name']] = validate(s['const'] if 'const' in s else values.get(key), s)
+        return self.base_url + DESCRIPTORS['authorization']['path'] + '?' + urllib.parse.urlencode(query)
+
+    def validate_callback(self, params):
+        redirect = _url(params.get('redirectUri'))
+        callback = params.get('callbackUrl')
+        state, expiry = params.get('state'), params.get('expiresAt')
+        if not isinstance(state, str) or not state or type(expiry) is not int or expiry <= int(time.time()): raise Error()
+        if not isinstance(callback, str) or '#' in callback or re.search(r'[\s\\]', callback) or callback.split('?',1)[0] != redirect: raise Error()
+        query = callback.partition('?')[2]
+        if re.search(r'%(?![0-9A-Fa-f]{2})', query): raise Error()
+        try: pairs = urllib.parse.parse_qs(query, keep_blank_values=True, errors='strict')
+        except Exception: raise Error()
+        if any(len(pairs.get(k, [])) > 1 for k in ('state','code','error')): raise Error()
+        actual = pairs.get('state', [''])[0]
+        if not hmac.compare_digest(actual.encode(), state.encode()): raise Error()
+        if ('code' in pairs) == ('error' in pairs): raise Error()
+        key = 'code' if 'code' in pairs else 'error'
+        if not pairs[key][0]: raise Error()
+        return {key:pairs[key][0], 'state':actual}

anyoauth_sdk-0.1.0/anyoauth_sdk.egg-info/PKG-INFO

@@ -0,0 +1,8 @@
+Metadata-Version: 2.4
+Name: anyoauth-sdk
+Version: 0.1.0
+Summary: AnyOAuth confidential backend SDK
+License: MIT
+Requires-Python: >=3.10
+License-File: LICENSE
+Dynamic: license-file

anyoauth_sdk-0.1.0/anyoauth_sdk.egg-info/SOURCES.txt

@@ -0,0 +1,8 @@
+LICENSE
+README.md
+pyproject.toml
+anyoauth/__init__.py
+anyoauth_sdk.egg-info/PKG-INFO
+anyoauth_sdk.egg-info/SOURCES.txt
+anyoauth_sdk.egg-info/dependency_links.txt
+anyoauth_sdk.egg-info/top_level.txt

anyoauth_sdk-0.1.0/anyoauth_sdk.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

anyoauth_sdk-0.1.0/anyoauth_sdk.egg-info/top_level.txt

@@ -0,0 +1 @@
+anyoauth

anyoauth_sdk-0.1.0/pyproject.toml

@@ -0,0 +1,13 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "anyoauth-sdk"
+version = "0.1.0"
+description = "AnyOAuth confidential backend SDK"
+requires-python = ">=3.10"
+license = {text = "MIT"}
+
+[tool.setuptools]
+packages = ["anyoauth"]

anyoauth_sdk-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+