authly-sso 0.4.0__py3-none-any.whl

authly/__init__.py

@@ -0,0 +1,37 @@
+from .client import (
+    AuthlyClient,
+    calculate_signature,
+    verify_webhook_signature,
+)
+from .exceptions import (
+    AuthlySDKError,
+    AuthlyTokenExchangeError,
+    AuthlyProfileFetchError,
+    AuthlyWebhookSignatureError,
+)
+from .services import (
+    AuthlyService,
+    get_authly_client,
+    populate_user_fields,
+    find_or_create_user,
+    generate_user_jwt_tokens,
+    extract_user_payload,
+)
+
+__version__ = "0.4.0"
+
+__all__ = [
+    "AuthlyClient",
+    "AuthlyService",
+    "get_authly_client",
+    "populate_user_fields",
+    "find_or_create_user",
+    "generate_user_jwt_tokens",
+    "extract_user_payload",
+    "AuthlySDKError",
+    "AuthlyTokenExchangeError",
+    "AuthlyProfileFetchError",
+    "AuthlyWebhookSignatureError",
+    "calculate_signature",
+    "verify_webhook_signature",
+]

authly/client.py

@@ -0,0 +1,178 @@
+import hashlib
+import hmac
+import requests
+from urllib.parse import urlencode
+from typing import Dict, Any, Optional, Tuple
+from .exceptions import (
+    AuthlySDKError,
+    AuthlyTokenExchangeError,
+    AuthlyProfileFetchError,
+    AuthlyWebhookSignatureError,
+)
+
+
+def calculate_signature(secret: str, payload_bytes: bytes) -> str:
+    """HMAC-SHA256 yordamida payload imzosini hisoblaydi."""
+    digest = hmac.new(
+        key=secret.encode("utf-8"),
+        msg=payload_bytes,
+        digestmod=hashlib.sha256,
+    ).hexdigest()
+    return f"sha256={digest}"
+
+
+def verify_webhook_signature(secret: str, payload_bytes: bytes, signature: str) -> bool:
+    """Webhook so'rovidan kelgan imzoni tekshiradi."""
+    if not secret or not signature:
+        return False
+    expected = calculate_signature(secret, payload_bytes)
+    return hmac.compare_digest(expected, signature)
+
+
+class AuthlyClient:
+    """
+    Authly SSO (OAuth2) bilan aloqa o'rnatuvchi mijoz klassi.
+    Sof Python, FastAPI, Flask yoki Django loyihalarida to'g'ridan-to'g'ri ishlatilishi mumkin.
+    """
+
+    def __init__(
+        self,
+        backend_url: Optional[str] = None,
+        frontend_url: Optional[str] = None,
+        client_id: str = "",
+        client_secret: str = "",
+        redirect_uri: str = "",
+        timeout: int = 10,
+        webhook_secret: Optional[str] = None,
+    ):
+        clean_backend = (backend_url or "").rstrip("/")
+        clean_frontend = (frontend_url or clean_backend).rstrip("/")
+
+        self.backend_url = clean_backend
+        self.frontend_url = clean_frontend
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.redirect_uri = redirect_uri
+        self.timeout = timeout
+        self.webhook_secret = webhook_secret
+
+    def get_authorization_url(
+        self,
+        scope: str = "read",
+        state: Optional[str] = None,
+        redirect_uri: Optional[str] = None,
+    ) -> str:
+        """Foydalanuvchini Authly SSO login sahifasiga yo'naltiruvchi havola yasaydi."""
+        target_redirect_uri = redirect_uri or self.redirect_uri
+        if not target_redirect_uri:
+            raise AuthlySDKError(
+                "'redirect_uri' ko'rsatilmadi. Metodga 'redirect_uri' uzating yoki sozlamalarda 'redirect_uri' ni belgilang."
+            )
+        params = {
+            "client_id": self.client_id,
+            "redirect_uri": target_redirect_uri,
+            "scope": scope,
+        }
+        if state:
+            params["state"] = state
+        return f"{self.frontend_url}/login?{urlencode(params)}"
+
+    def exchange_code_for_token(
+        self,
+        code: str,
+        code_verifier: Optional[str] = None,
+        redirect_uri: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        """Bir martalik avtorizatsiya kodini OAuth tokenlarga almashtiradi."""
+        target_redirect_uri = redirect_uri or self.redirect_uri
+        if not target_redirect_uri:
+            raise AuthlyTokenExchangeError(
+                "'redirect_uri' ko'rsatilmadi. Metodga 'redirect_uri' uzating yoki sozlamalarda 'redirect_uri' ni belgilang."
+            )
+        token_endpoint = f"{self.backend_url}/oauth/token/"
+        payload = {
+            "grant_type": "authorization_code",
+            "code": code,
+            "redirect_uri": target_redirect_uri,
+            "client_id": self.client_id,
+            "client_secret": self.client_secret,
+        }
+        if code_verifier:
+            payload["code_verifier"] = code_verifier
+
+        headers = {
+            "Content-Type": "application/x-www-form-urlencoded",
+            "User-Agent": "Authly-Python-SDK/0.4.0",
+        }
+
+        try:
+            response = requests.post(
+                token_endpoint, data=payload, headers=headers, timeout=self.timeout
+            )
+            if response.status_code != 200:
+                raise AuthlyTokenExchangeError(
+                    message="Token olishda xatolik yuz berdi",
+                    status_code=response.status_code,
+                    details=response.text,
+                )
+            return response.json()
+        except requests.RequestException as e:
+            raise AuthlyTokenExchangeError(
+                f"Authly serveriga bog'lanishda xatolik: {str(e)}"
+            )
+
+    def get_user_profile(self, access_token: str) -> Dict[str, Any]:
+        """OAuth access_token orqali foydalanuvchi ma'lumotlarini yuklaydi."""
+        profile_endpoint = f"{self.backend_url}/api/v1/sso/profile/"
+        headers = {
+            "Authorization": f"Bearer {access_token}",
+            "User-Agent": "Authly-Python-SDK/0.4.0",
+        }
+
+        try:
+            response = requests.get(
+                profile_endpoint, headers=headers, timeout=self.timeout
+            )
+            if response.status_code != 200:
+                raise AuthlyProfileFetchError(
+                    message="Profil ma'lumotlarini olish imkoni bo'lmadi",
+                    status_code=response.status_code,
+                    details=response.text,
+                )
+            data = response.json()
+            if isinstance(data, dict):
+                if "data" in data and isinstance(data["data"], dict):
+                    return data["data"]
+                if "user" in data and isinstance(data["user"], dict):
+                    return data["user"]
+            return data
+        except requests.RequestException as e:
+            raise AuthlyProfileFetchError(
+                f"Authly serveriga bog'lanishda xatolik: {str(e)}"
+            )
+
+    def authenticate_code(
+        self,
+        code: str,
+        code_verifier: Optional[str] = None,
+        redirect_uri: Optional[str] = None,
+    ) -> Tuple[Dict[str, Any], str]:
+        """
+        Kodni berib, foydalanuvchi profili va Authly access_token ni qaytaruvchi metod.
+        Qaytaradi: (profile_dict, access_token_str)
+        """
+        token_data = self.exchange_code_for_token(
+            code, code_verifier=code_verifier, redirect_uri=redirect_uri
+        )
+        access_token = token_data.get("access_token")
+        profile = self.get_user_profile(access_token)
+        return profile, access_token
+
+    def verify_webhook_signature(
+        self, payload_bytes: bytes, signature: str, secret: Optional[str] = None
+    ) -> bool:
+        """Kelgan webhook so'rovining imzosini tekshiradi."""
+        target_secret = secret or self.webhook_secret
+        return verify_webhook_signature(target_secret, payload_bytes, signature)
+
+

authly/exceptions.py

@@ -0,0 +1,28 @@
+class AuthlySDKError(Exception):
+    """Asosiy SDK xatoligi."""
+
+    pass
+
+
+class AuthlyTokenExchangeError(AuthlySDKError):
+    """Kodni tokenga almashtirishda xatolik yuz berganda."""
+
+    def __init__(self, message, status_code=None, details=None):
+        super().__init__(message)
+        self.status_code = status_code
+        self.details = details
+
+
+class AuthlyProfileFetchError(AuthlySDKError):
+    """Foydalanuvchi profilini olishda xatolik yuz berganda."""
+
+    def __init__(self, message, status_code=None, details=None):
+        super().__init__(message)
+        self.status_code = status_code
+        self.details = details
+
+
+class AuthlyWebhookSignatureError(AuthlySDKError):
+    """Webhook imzosini tekshirishda xatolik yuz berganda."""
+
+    pass

authly/services.py

@@ -0,0 +1,281 @@
+import logging
+import os
+from typing import Tuple, List, Dict, Any, Optional
+from urllib.parse import urlparse
+
+import requests
+
+try:
+    from django.conf import settings
+except ImportError:
+    settings = None
+
+from .client import AuthlyClient
+from .exceptions import AuthlySDKError
+
+logger = logging.getLogger(__name__)
+
+
+def get_authly_client() -> AuthlyClient:
+    """AuthlyClient instansiyasini Django sozlamalari asosida qaytaradi."""
+    if settings is None:
+        raise AuthlySDKError("Django o'rnatilmagan yoki sozlanmagan.")
+
+    backend_url = getattr(settings, "AUTHLY_BACKEND_URL", "")
+    frontend_url = getattr(settings, "AUTHLY_FRONTEND_URL", None) or backend_url
+    client_id = getattr(settings, "AUTHLY_CLIENT_ID", "")
+    client_secret = getattr(settings, "AUTHLY_CLIENT_SECRET", "")
+    redirect_uri = getattr(settings, "AUTHLY_REDIRECT_URI", "")
+    timeout = getattr(settings, "AUTHLY_TIMEOUT", 10)
+    webhook_secret = getattr(settings, "AUTHLY_WEBHOOK_SECRET", None)
+
+    return AuthlyClient(
+        backend_url=backend_url,
+        frontend_url=frontend_url,
+        client_id=client_id,
+        client_secret=client_secret,
+        redirect_uri=redirect_uri,
+        timeout=timeout,
+        webhook_secret=webhook_secret,
+    )
+
+
+def extract_user_payload(data: dict) -> dict:
+    """Authly API yoki webhook payload ichidan user ma'lumotlarini ajratib oladi."""
+    if not isinstance(data, dict):
+        return {}
+    if "data" in data and isinstance(data["data"], dict):
+        return data["data"]
+    if "user" in data and isinstance(data["user"], dict):
+        return data["user"]
+    return data
+
+
+def populate_user_fields(user, user_data: dict) -> List[str]:
+    """
+    Authly SSO dan kelgan ma'lumotlarni User obyektiga moslab to'ldiradi.
+    Lokal modelda mavjud bo'lgan barcha mos maydonlar avtomatik to'ldiriladi:
+    - authly_id
+    - first_name, last_name, email
+    - phone / phone_number
+    - avatar
+    - birth_date
+    """
+    clean_data = extract_user_payload(user_data)
+    updated_fields = []
+
+    raw_authly_id = clean_data.get("authly_id") or clean_data.get("id")
+    authly_id = (
+        str(raw_authly_id).strip()
+        if raw_authly_id and str(raw_authly_id).strip()
+        else None
+    )
+
+    if authly_id and hasattr(user, "authly_id") and getattr(user, "authly_id") != authly_id:
+        user.authly_id = authly_id
+        updated_fields.append("authly_id")
+
+    first_name = (clean_data.get("first_name") or "").strip()
+    if (
+        first_name
+        and hasattr(user, "first_name")
+        and getattr(user, "first_name") != first_name
+    ):
+        user.first_name = first_name
+        updated_fields.append("first_name")
+
+    last_name = (clean_data.get("last_name") or "").strip()
+    if (
+        last_name
+        and hasattr(user, "last_name")
+        and getattr(user, "last_name") != last_name
+    ):
+        user.last_name = last_name
+        updated_fields.append("last_name")
+
+    raw_email = clean_data.get("email")
+    email = (
+        raw_email.strip()
+        if isinstance(raw_email, str) and raw_email.strip()
+        else None
+    )
+    if email and hasattr(user, "email") and getattr(user, "email") != email:
+        user.email = email
+        updated_fields.append("email")
+
+    raw_phone = clean_data.get("phone") or clean_data.get("phone_number")
+    phone = (
+        str(raw_phone).strip() if raw_phone and str(raw_phone).strip() else None
+    )
+    if phone:
+        if hasattr(user, "phone_number") and getattr(user, "phone_number") != phone:
+            user.phone_number = phone
+            updated_fields.append("phone_number")
+        elif hasattr(user, "phone") and getattr(user, "phone") != phone:
+            user.phone = phone
+            updated_fields.append("phone")
+
+    avatar = (
+        clean_data.get("avatar")
+        or clean_data.get("image")
+        or clean_data.get("photo")
+        or ""
+    )
+    avatar_field_name = None
+    for fname in ["avatar", "image", "photo", "profile_image", "profile_photo"]:
+        if hasattr(user, fname):
+            avatar_field_name = fname
+            break
+
+    if avatar and avatar_field_name:
+        is_file_field = False
+        try:
+            from django.db.models import FileField
+
+            field = user._meta.get_field(avatar_field_name)
+            is_file_field = isinstance(field, FileField)
+        except Exception:
+            pass
+
+        if is_file_field:
+            if isinstance(avatar, str) and (
+                avatar.startswith("http://") or avatar.startswith("https://")
+            ):
+                try:
+                    res = requests.get(avatar, timeout=5)
+                    if res.status_code == 200:
+                        from django.core.files.base import ContentFile
+
+                        path = urlparse(avatar).path
+                        ext = os.path.splitext(path)[1] or ".jpg"
+                        filename = f"authly_{authly_id or user.pk or 'avatar'}{ext}"
+                        getattr(user, avatar_field_name).save(
+                            filename, ContentFile(res.content), save=False
+                        )
+                        updated_fields.append(avatar_field_name)
+                except Exception as exc:
+                    logger.warning("Avatar yuklab olishda xatolik yuz berdi: %s", exc)
+        else:
+            if getattr(user, avatar_field_name) != avatar:
+                setattr(user, avatar_field_name, avatar)
+                updated_fields.append(avatar_field_name)
+
+    birth_date = clean_data.get("birth_date")
+    if (
+        birth_date
+        and hasattr(user, "birth_date")
+        and getattr(user, "birth_date") != birth_date
+    ):
+        user.birth_date = birth_date
+        updated_fields.append("birth_date")
+
+    return updated_fields
+
+
+def find_or_create_user(user_model, user_data: dict) -> Tuple[Any, bool]:
+    """
+    Authly ma'lumotlari orqali foydalanuvchini topadi yoki yangi yaratadi.
+    Qidirish tartibi:
+    1. authly_id
+    2. username ("authly_{authly_id}")
+    3. phone / phone_number
+    4. email
+    """
+    clean_data = extract_user_payload(user_data)
+    raw_authly_id = clean_data.get("authly_id") or clean_data.get("id")
+    authly_id = (
+        str(raw_authly_id).strip()
+        if raw_authly_id and str(raw_authly_id).strip()
+        else None
+    )
+    user = None
+
+    if authly_id and hasattr(user_model, "authly_id"):
+        user = user_model.objects.filter(authly_id=authly_id).first()
+
+    if not user and authly_id and hasattr(user_model, "username"):
+        user = user_model.objects.filter(username=f"authly_{authly_id}").first()
+
+    raw_phone = clean_data.get("phone") or clean_data.get("phone_number")
+    phone = (
+        str(raw_phone).strip() if raw_phone and str(raw_phone).strip() else None
+    )
+    if not user and phone:
+        if hasattr(user_model, "phone_number"):
+            user = user_model.objects.filter(phone_number=phone).first()
+        elif hasattr(user_model, "phone"):
+            user = user_model.objects.filter(phone=phone).first()
+
+    raw_email = clean_data.get("email")
+    email = (
+        raw_email.strip()
+        if isinstance(raw_email, str) and raw_email.strip()
+        else None
+    )
+    if not user and email and hasattr(user_model, "email"):
+        user = user_model.objects.filter(email=email).first()
+
+    if user:
+        created = False
+        updated = populate_user_fields(user, clean_data)
+        if updated:
+            user.save()
+        return user, created
+
+    created = True
+    user = user_model()
+    if hasattr(user, "username"):
+        user.username = (
+            f"authly_{authly_id}"
+            if authly_id
+            else (clean_data.get("username") or phone or email)
+        )
+
+    populate_user_fields(user, clean_data)
+    if hasattr(user, "set_unusable_password"):
+        user.set_unusable_password()
+
+    user.save()
+    return user, created
+
+
+def generate_user_jwt_tokens(user) -> Dict[str, str]:
+    """
+    Agar rest_framework_simplejwt o'rnatilgan bo'lsa,
+    user uchun access va refresh tokenlarni generatsiya qiladi.
+    """
+    tokens = {}
+    try:
+        from rest_framework_simplejwt.tokens import RefreshToken
+
+        refresh = RefreshToken.for_user(user)
+        tokens = {
+            "refresh": str(refresh),
+            "access": str(refresh.access_token),
+        }
+    except ImportError:
+        pass
+    return tokens
+
+
+class AuthlyService:
+    """
+    Authly SSO uchun servis klassi.
+    Biznes mantiqini bitta joyda jamlaydi.
+    """
+
+    @staticmethod
+    def get_client() -> AuthlyClient:
+        return get_authly_client()
+
+    @staticmethod
+    def populate_user(user, user_data: dict) -> List[str]:
+        return populate_user_fields(user, user_data)
+
+    @staticmethod
+    def get_or_create_user(user_model, user_data: dict) -> Tuple[Any, bool]:
+        return find_or_create_user(user_model, user_data)
+
+    @staticmethod
+    def generate_tokens(user) -> Dict[str, str]:
+        return generate_user_jwt_tokens(user)

authly/urls.py

@@ -0,0 +1,16 @@
+from django.urls import path
+from .views import (
+    AuthlyAuthorizeURLAPIView,
+    AuthlyCallbackAPIView,
+    AuthlyWebhookAPIView,
+    AuthlySyncProfileAPIView,
+)
+
+app_name = "authly"
+
+urlpatterns = [
+    path("login-url/", AuthlyAuthorizeURLAPIView.as_view(), name="authly_login_url"),
+    path("callback/", AuthlyCallbackAPIView.as_view(), name="authly_callback"),
+    path("webhook/", AuthlyWebhookAPIView.as_view(), name="authly_webhook"),
+    path("sync/", AuthlySyncProfileAPIView.as_view(), name="authly_sync"),
+]