blockauth-sdk 0.5.0__py3-none-any.whl

blockauth_sdk/__init__.py

@@ -0,0 +1,27 @@
+from .errors import BlockAuthError, NotConnectedError
+from .protocol import BlockAuthProvider, RpcClient, WsClient
+from .protocol.roles import (
+    get_user_role_names,
+    get_user_role_slugs,
+    get_user_roles,
+    has_any_role,
+    has_any_role_by_slug,
+    has_role,
+    has_role_by_slug,
+)
+
+__all__ = [
+    "BlockAuthProvider",
+    "RpcClient",
+    "WsClient",
+    "BlockAuthError",
+    "NotConnectedError",
+    "get_user_roles",
+    "get_user_role_names",
+    "get_user_role_slugs",
+    "has_role",
+    "has_role_by_slug",
+    "has_any_role",
+    "has_any_role_by_slug",
+]
+__version__ = "0.5.0"

blockauth_sdk/api_bridge.py

@@ -0,0 +1,45 @@
+import json
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any
+
+from .errors import BlockAuthError
+
+DEFAULT_WS_URL = "wss://wss.block-auth.io"
+
+
+def build_ws_server_api_url(path: str, ws_url: str = "") -> str:
+    parsed = urllib.parse.urlsplit(ws_url or DEFAULT_WS_URL)
+    scheme = "https" if parsed.scheme == "wss" else "http"
+    return urllib.parse.urlunsplit((scheme, parsed.netloc, "/api" + path, "", ""))
+
+
+def create_browser_token(api_key: str, api_secret_hash: str, ws_url: str = "", timeout: float = 10.0) -> str:
+    body = json.dumps({"apiKey": api_key, "apiSecret": api_secret_hash}).encode("utf-8")
+    request = urllib.request.Request(
+        build_ws_server_api_url("/browser-token", ws_url),
+        data=body,
+        headers={"Content-Type": "application/json"},
+        method="POST",
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            payload = _read_json(response)
+    except urllib.error.HTTPError as err:
+        payload = _read_json(err)
+    except (urllib.error.URLError, OSError) as err:
+        raise BlockAuthError(f"Browser token request failed: {err}") from err
+
+    message = payload.get("message")
+    if not payload.get("success") or not isinstance(message, dict) or not message.get("accessToken"):
+        raise BlockAuthError(str(message or "Failed to create browser token"))
+    return message["accessToken"]
+
+
+def _read_json(response: Any) -> dict:
+    try:
+        data = json.loads(response.read().decode("utf-8"))
+    except (ValueError, OSError):
+        return {}
+    return data if isinstance(data, dict) else {}

blockauth_sdk/crypto.py

@@ -0,0 +1,9 @@
+import hashlib
+
+
+def sha256_hex(text: str) -> str:
+    """SHA256 del texto (UTF-8) como hex en minúsculas.
+
+    Equivalente a crypto-js `SHA256(text).toString()` usado por el SDK TS.
+    """
+    return hashlib.sha256(text.encode("utf-8")).hexdigest()

blockauth_sdk/errors.py

@@ -0,0 +1,9 @@
+class BlockAuthError(Exception):
+    """Base error for the BlockAuth SDK."""
+
+
+class NotConnectedError(BlockAuthError):
+    """Raised when an operation needs an active WebSocket connection."""
+
+    def __init__(self, message: str = "Not connected") -> None:
+        super().__init__(message)

blockauth_sdk/protocol/__init__.py

@@ -0,0 +1,29 @@
+# Espejo de packages/core/src/protocol del SDK TypeScript (@block-auth.io/core).
+from .provider import BlockAuthProvider
+from .roles import (
+    get_user_role_names,
+    get_user_role_slugs,
+    get_user_roles,
+    has_any_role,
+    has_any_role_by_slug,
+    has_role,
+    has_role_by_slug,
+)
+from .rpc_client import RpcClient
+from .transport import SocketIOTransport, Transport
+from .ws_client import WsClient
+
+__all__ = [
+    "BlockAuthProvider",
+    "RpcClient",
+    "WsClient",
+    "Transport",
+    "SocketIOTransport",
+    "get_user_roles",
+    "get_user_role_names",
+    "get_user_role_slugs",
+    "has_role",
+    "has_role_by_slug",
+    "has_any_role",
+    "has_any_role_by_slug",
+]

blockauth_sdk/protocol/provider.py

@@ -0,0 +1,195 @@
+from typing import Any, Optional
+
+from ..api_bridge import create_browser_token
+from ..crypto import sha256_hex
+from ..errors import BlockAuthError, NotConnectedError
+from .rpc_client import RpcClient
+from .ws_client import WsClient
+from .roles import (
+    get_user_role_names,
+    get_user_role_slugs,
+    has_any_role,
+    has_any_role_by_slug,
+    has_role,
+    has_role_by_slug,
+)
+
+
+class BlockAuthProvider:
+    def __init__(
+        self,
+        api_key: str = "",
+        api_secret: str = "",
+        ws_url: str = "wss://wss.block-auth.io",
+        browser_token: str = "",
+        transport: Optional[Any] = None,
+    ) -> None:
+        self._rpc = RpcClient()
+        self._wsc = WsClient(ws_url, True, transport=transport)
+        self._api_key = api_key
+        self._api_secret = api_secret
+        self._browser_token = browser_token or ""
+        self._ws_url = ws_url
+
+    # --- browser token ---
+    @property
+    def browser_token(self) -> str:
+        return self._browser_token
+
+    @browser_token.setter
+    def browser_token(self, token: str) -> None:
+        self._browser_token = token or ""
+
+    def create_browser_token(self) -> str:
+        if not self._api_secret:
+            raise BlockAuthError("API secret required to create a browser token")
+        return create_browser_token(self._api_key, sha256_hex(self._api_secret), self._ws_url)
+
+    # --- conexión ---
+    def connect(self, wait_ms: int = 1000, url: str = "", retries: int = 3) -> None:
+        self._wsc.connect(url, wait_ms, retries)
+
+    def disconnect(self) -> None:
+        self._wsc.close()
+
+    def is_connected(self) -> bool:
+        return self._wsc.is_connected()
+
+    def _require_connection(self) -> None:
+        if not self.is_connected():
+            raise NotConnectedError()
+
+    # --- métodos del protocolo ---
+    def signin(self) -> Any:
+        self._require_connection()
+        credentials = {"apiKey": self._api_key}
+        if self._browser_token:
+            credentials["browserToken"] = self._browser_token
+        elif self._api_secret:
+            credentials["apiSecret"] = sha256_hex(self._api_secret)
+        data = self._wsc.request("sdk:signin", "sdk:signin", credentials)
+        return {"success": data.get("success"), "message": data.get("message")}
+
+    def refresh(self, refresh_token: Optional[str] = None) -> Any:
+        self._require_connection()
+        token = refresh_token or self._wsc.refresh_token
+        if not token:
+            raise BlockAuthError("No refresh token provided")
+        data = self._wsc.request("sdk:refresh", "sdk:refresh", {"refreshToken": token})
+        if not data.get("success"):
+            raise BlockAuthError(str(data.get("message")))
+        return data.get("message")
+
+    def is_address_signed(self, address: str, token: Optional[str] = None) -> Any:
+        self._require_connection()
+        _token = token or self._wsc.access_token
+        data = self._wsc.request("sdk:sign", "sdk:sign", {"token": _token, "address": address})
+        return {"success": data.get("success"), "message": data.get("message")}
+
+    def app(self, token: Optional[str] = None) -> Any:
+        self._require_connection()
+        _token = token or self._wsc.access_token
+        data = self._wsc.request("sdk:app", "sdk:app", {"token": _token})
+        if not data.get("success"):
+            raise BlockAuthError(str(data.get("message")))
+        return data.get("message")
+
+    def user(self, address: str, token: Optional[str] = None) -> Any:
+        self._require_connection()
+        _token = token or self._wsc.access_token
+        data = self._wsc.request("sdk:user", "sdk:user", {"token": _token, "address": address})
+        return {"success": data.get("success"), "message": data.get("message")}
+
+    def users(self, token: Optional[str] = None, data: Optional[dict] = None) -> Any:
+        self._require_connection()
+        _token = token or self._wsc.access_token
+        payload = {"token": _token, **(data or {})}
+        resp = self._wsc.request("sdk:users", "sdk:users", payload)
+        if not resp.get("success"):
+            raise BlockAuthError(str(resp.get("message")))
+        return resp.get("message")
+
+    def roles(self, token: Optional[str] = None, data: Optional[dict] = None) -> Any:
+        self._require_connection()
+        _token = token or self._wsc.access_token
+        payload = {"token": _token, **(data or {})}
+        resp = self._wsc.request("sdk:roles", "sdk:roles", payload)
+        if not resp.get("success"):
+            raise BlockAuthError(str(resp.get("message")))
+        return resp.get("message")
+
+    def logs(self, token: Optional[str] = None, data: Optional[dict] = None) -> Any:
+        self._require_connection()
+        _token = token or self._wsc.access_token
+        payload = {"token": _token, **(data or {})}
+        resp = self._wsc.request("sdk:logs", "sdk:logs", payload)
+        if not resp.get("success"):
+            raise BlockAuthError(str(resp.get("message")))
+        return resp.get("message")
+
+    def kyc_issuer(self, address: str, data: Optional[dict] = None, token: Optional[str] = None) -> Any:
+        self._require_connection()
+        _token = token or self._wsc.access_token
+        payload = {"token": _token, "address": address, "details": {**(data or {})}}
+        resp = self._wsc.request("sdk:kyc:issuer", "sdk:kyc:issuer", payload)
+        if not resp.get("success"):
+            raise BlockAuthError(str(resp.get("message")))
+        return resp.get("message")
+
+    # --- getters ---
+    @property
+    def rpc(self) -> RpcClient:
+        return self._rpc
+
+    @property
+    def wsc(self) -> WsClient:
+        return self._wsc
+
+    @property
+    def socket(self) -> Any:
+        return self._wsc.ws
+
+    @property
+    def ui_config(self) -> dict:
+        return self._wsc.ui_config
+
+    @property
+    def app_users(self) -> list:
+        return self._wsc.users
+
+    @property
+    def app_roles(self) -> list:
+        return self._wsc.roles
+
+    @property
+    def app_logs(self) -> list:
+        return self._wsc.logs
+
+    @property
+    def app_kyc_issuer_by_address(self) -> dict:
+        return self._wsc.kyc_issuer_by_address
+
+    @property
+    def current_user(self) -> dict:
+        return self._wsc.user
+
+    @property
+    def role_names(self) -> list:
+        return get_user_role_names(self.current_user)
+
+    @property
+    def role_slugs(self) -> list:
+        return get_user_role_slugs(self.current_user)
+
+    # --- helpers de roles ---
+    def has_role(self, role_name: str) -> bool:
+        return has_role(self.current_user, role_name)
+
+    def has_role_by_slug(self, role_slug: str) -> bool:
+        return has_role_by_slug(self.current_user, role_slug)
+
+    def has_any_role(self, role_names: list) -> bool:
+        return has_any_role(self.current_user, role_names)
+
+    def has_any_role_by_slug(self, role_slugs: list) -> bool:
+        return has_any_role_by_slug(self.current_user, role_slugs)

blockauth_sdk/protocol/roles.py

@@ -0,0 +1,55 @@
+from typing import Any, Optional
+
+
+def _normalize(value: Any) -> str:
+    return str(value if value is not None else "").strip().lower()
+
+
+def _is_valid_role(role: Any) -> bool:
+    return (
+        isinstance(role, dict)
+        and isinstance(role.get("name"), str)
+        and role["name"].strip() != ""
+        and isinstance(role.get("slug"), str)
+        and role["slug"].strip() != ""
+    )
+
+
+def get_user_roles(user: Optional[dict]) -> list:
+    if not user or not isinstance(user.get("roles"), list):
+        return []
+    return [role for role in user["roles"] if _is_valid_role(role)]
+
+
+def get_user_role_names(user: Optional[dict]) -> list:
+    return [role["name"] for role in get_user_roles(user)]
+
+
+def get_user_role_slugs(user: Optional[dict]) -> list:
+    return [role["slug"] for role in get_user_roles(user) if role["slug"]]
+
+
+def has_role(user: Optional[dict], role_name: str) -> bool:
+    target = _normalize(role_name)
+    if not target:
+        return False
+    return any(_normalize(name) == target for name in get_user_role_names(user))
+
+
+def has_role_by_slug(user: Optional[dict], role_slug: str) -> bool:
+    target = _normalize(role_slug)
+    if not target:
+        return False
+    return any(_normalize(slug) == target for slug in get_user_role_slugs(user))
+
+
+def has_any_role(user: Optional[dict], role_names: list) -> bool:
+    if not isinstance(role_names, list) or len(role_names) == 0:
+        return False
+    return any(has_role(user, name) for name in role_names)
+
+
+def has_any_role_by_slug(user: Optional[dict], role_slugs: list) -> bool:
+    if not isinstance(role_slugs, list) or len(role_slugs) == 0:
+        return False
+    return any(has_role_by_slug(user, slug) for slug in role_slugs)

blockauth_sdk/protocol/rpc_client.py

@@ -0,0 +1,9 @@
+class RpcClient:
+    """Stub del cliente RPC (paridad con el TS; hoy solo guarda la URL)."""
+
+    def __init__(self) -> None:
+        self._rpc_url = "https://rpc.block-auth.io/"
+
+    @property
+    def rpc_url(self) -> str:
+        return self._rpc_url

blockauth_sdk/protocol/transport.py

@@ -0,0 +1,92 @@
+from typing import Any, Callable, Dict, List, Optional
+
+try:
+    from typing import Protocol, runtime_checkable
+except ImportError:  # pragma: no cover
+    from typing_extensions import Protocol, runtime_checkable  # type: ignore
+
+
+@runtime_checkable
+class Transport(Protocol):
+    @property
+    def connected(self) -> bool: ...
+    def connect(self, url: str, config: dict, wait_ms: int = 5000) -> None: ...
+    def on(self, event: str, handler: Callable) -> None: ...
+    def once(self, event: str, handler: Callable) -> None: ...
+    def off(self, event: str, handler: Optional[Callable] = None) -> None: ...
+    def emit(self, event: str, data: Any) -> None: ...
+    def has_listeners(self, event: str) -> bool: ...
+    def disconnect(self) -> None: ...
+    def close(self) -> None: ...
+
+
+class SocketIOTransport:
+    """Transporte real sobre python-socketio (Socket.IO v4).
+
+    python-socketio no ofrece `once` ni `has_listeners`, así que los
+    implementamos con un registro propio de listeners.
+    """
+
+    def __init__(self) -> None:
+        import socketio  # import perezoso: solo si se usa el transporte real
+
+        self._sio = socketio.Client(reconnection=True)
+        self._listeners: Dict[str, List[Callable]] = {}
+
+    @property
+    def connected(self) -> bool:
+        return bool(getattr(self._sio, "connected", False))
+
+    def connect(self, url: str, config: dict, wait_ms: int = 5000) -> None:
+        transports = config.get("transports", ["websocket"])
+        # wait_ms (ms) -> wait_timeout de socketio (segundos, mínimo 1).
+        self._sio.connect(
+            url,
+            transports=transports,
+            wait=True,
+            wait_timeout=max(1, wait_ms // 1000),
+        )
+
+    def _register(self, event: str) -> None:
+        # Registra un único dispatcher en socketio por evento; reenvía a
+        # nuestros listeners (permite múltiples handlers + once).
+        if event in self._listeners:
+            return
+        self._listeners[event] = []
+
+        def dispatcher(data=None):
+            for handler in list(self._listeners.get(event, [])):
+                handler(data)
+
+        self._sio.on(event, dispatcher)
+
+    def on(self, event: str, handler: Callable) -> None:
+        self._register(event)
+        self._listeners[event].append(handler)
+
+    def once(self, event: str, handler: Callable) -> None:
+        def wrapper(data=None):
+            self.off(event, wrapper)
+            handler(data)
+
+        self.on(event, wrapper)
+
+    def off(self, event: str, handler: Optional[Callable] = None) -> None:
+        if event not in self._listeners:
+            return
+        if handler is None:
+            self._listeners[event] = []
+        elif handler in self._listeners[event]:
+            self._listeners[event].remove(handler)
+
+    def emit(self, event: str, data: Any) -> None:
+        self._sio.emit(event, data)
+
+    def has_listeners(self, event: str) -> bool:
+        return len(self._listeners.get(event, [])) > 0
+
+    def disconnect(self) -> None:
+        self._sio.disconnect()
+
+    def close(self) -> None:
+        self._sio.disconnect()

blockauth_sdk/protocol/ws_client.py

@@ -0,0 +1,220 @@
+import threading
+from typing import Any, Callable, List, Optional
+
+from ..errors import BlockAuthError
+from .transport import SocketIOTransport, Transport
+
+DEFAULT_WS_URL = "wss://wss.block-auth.io/"
+
+
+class WsClient:
+    def __init__(
+        self,
+        url: str = "",
+        reconnect: bool = False,
+        transport: Optional[Transport] = None,
+    ) -> None:
+        self._ws_url = url or DEFAULT_WS_URL
+        self._ws_config = {
+            "transports": ["websocket"],
+            "reconnection": reconnect,
+            "reconnectionDelay": 100,
+            "reconnectionDelayMax": 3000,
+            "reconnectionAttempts": 30,
+        }
+        self._transport: Transport = transport or SocketIOTransport()
+        self._handlers_wired = False
+        self._access_token = ""
+        self._refresh_token = ""
+        self._ui_config: dict = {}
+        self._user: dict = {}
+        self._users: List[Any] = []
+        self._roles: List[Any] = []
+        self._logs: List[Any] = []
+        self._kyc_issuer_by_address: dict = {}
+
+    # --- conexión ---
+    def is_connected(self) -> bool:
+        return bool(self._transport) and bool(self._transport.connected)
+
+    def connect(self, url: str = "", wait_ms: int = 5000, retries: int = 3) -> None:
+        target = url or self._ws_url
+        attempts = max(1, retries)
+        for attempt in range(attempts):
+            if self._transport.connected:
+                break
+            try:
+                self._transport.connect(target, self._ws_config, wait_ms)
+            except Exception:
+                # Reintenta hasta agotar `retries`; en el último intento propaga.
+                if attempt >= attempts - 1:
+                    raise
+                continue
+            if self._transport.connected:
+                break
+        self._wire_handlers()
+
+    def _wire_handlers(self) -> None:
+        if self._handlers_wired:
+            return
+        self._handlers_wired = True
+        handlers = {
+            "sdk:signin": self.on_sdk_signin,
+            "sdk:refresh": self.on_sdk_refresh,
+            "sdk:sign": self.on_sdk_sign,
+            "sdk:app": self.on_sdk_app,
+            "sdk:user": self.on_sdk_user,
+            "sdk:users": self.on_sdk_users,
+            "sdk:roles": self.on_sdk_roles,
+            "sdk:logs": self.on_sdk_logs,
+            "sdk:kyc:issuer": self.on_sdk_kyc_issuer,
+        }
+        for event, handler in handlers.items():
+            self._transport.on(event, handler)
+
+    def on(self, event: str, handler: Callable) -> None:
+        self._transport.on(event, handler)
+
+    def off(self, event: str, handler: Callable) -> None:
+        self._transport.off(event, handler)
+
+    def emit(self, event: str, data: Any) -> None:
+        self._transport.emit(event, data)
+
+    def request(
+        self,
+        emit_event: str,
+        response_event: str,
+        payload: dict,
+        timeout: float = 10.0,
+    ) -> Any:
+        holder: dict = {}
+        done = threading.Event()
+
+        # Se registra con `on` (no `once`) para que el callable registrado sea
+        # exactamente `handler`: así `off(handler)` lo elimina de verdad tanto en
+        # éxito como en timeout. (El `once` del transporte envuelve el handler en
+        # un wrapper interno que `off(handler)` no encontraría → fuga de listener.)
+        def handler(data=None):
+            holder["data"] = data
+            self._transport.off(response_event, handler)
+            done.set()
+
+        self._transport.on(response_event, handler)
+        self._transport.emit(emit_event, payload)
+        if not done.wait(timeout):
+            self._transport.off(response_event, handler)
+            raise BlockAuthError(f"Timeout waiting for {response_event}")
+        return holder.get("data")
+
+    def close(self) -> None:
+        if self.is_connected():
+            self._transport.close()
+        self._access_token = ""
+        self._refresh_token = ""
+
+    # --- handlers de estado (solo mutan estado; nunca lanzan) ---
+    def on_sdk_signin(self, data: Any) -> None:
+        if not isinstance(data, dict) or not data.get("success"):
+            return
+        message = data.get("message") or {}
+        self._access_token = message.get("accessToken", self._access_token)
+        self._refresh_token = message.get("refreshToken", self._refresh_token)
+
+    def on_sdk_refresh(self, data: Any) -> None:
+        if not isinstance(data, dict) or not data.get("success"):
+            return
+        message = data.get("message") or {}
+        access = message.get("accessToken")
+        refresh = message.get("refreshToken")
+        # Guardia anti-replay (fiel al TS): solo se actualiza si AMBOS tokens
+        # cambian; si cualquiera coincide con el actual, se ignora (no-op).
+        if access and refresh and access != self._access_token and refresh != self._refresh_token:
+            self._access_token = access
+            self._refresh_token = refresh
+
+    def on_sdk_sign(self, data: Any) -> None:
+        if isinstance(data, dict) and not data.get("success") and data.get("message") == "Bad sign":
+            self._transport.emit("sdk:refresh", {"refreshToken": self._refresh_token})
+
+    def on_sdk_app(self, data: Any) -> None:
+        if not isinstance(data, dict) or not data.get("success"):
+            return
+        message = data.get("message") or {}
+        config = message.get("config") or {}
+        self._ui_config = {
+            "domain": message.get("domain"),
+            "signinCallbackUrl": message.get("signinCallbackUrl"),
+            **config,
+        }
+
+    def on_sdk_user(self, data: Any) -> None:
+        if not isinstance(data, dict) or not data.get("success") or not data.get("message"):
+            self._user = {}
+            return
+        message = data["message"]
+        items = message.get("items") if isinstance(message, dict) else None
+        # `items` solo se usa si es una lista no vacía (un items no-lista, p.ej. dict,
+        # haría fallar items[0]); si no, se usa el propio message.
+        user = items[0] if isinstance(items, list) and items else message
+        # Si el usuario resuelto no es un dict (mensaje malformado), no se propaga
+        # ni se lanza: se resetea a {} (los handlers nunca lanzan por control de flujo).
+        if not isinstance(user, dict):
+            self._user = {}
+            return
+        roles = user.get("roles")
+        self._user = {**user, "roles": roles if isinstance(roles, list) else []}
+
+    def on_sdk_users(self, data: Any) -> None:
+        if isinstance(data, dict) and data.get("success"):
+            self._users = list((data.get("message") or {}).get("items", []))
+
+    def on_sdk_roles(self, data: Any) -> None:
+        if isinstance(data, dict) and data.get("success"):
+            self._roles = list((data.get("message") or {}).get("items", []))
+
+    def on_sdk_logs(self, data: Any) -> None:
+        if isinstance(data, dict) and data.get("success"):
+            self._logs = list((data.get("message") or {}).get("items", []))
+
+    def on_sdk_kyc_issuer(self, data: Any) -> None:
+        if isinstance(data, dict) and data.get("success"):
+            items = (data.get("message") or {}).get("items", [])
+            self._kyc_issuer_by_address = dict(items[0]) if items else {}
+
+    # --- propiedades ---
+    @property
+    def ws(self) -> Transport:
+        return self._transport
+
+    @property
+    def access_token(self) -> str:
+        return self._access_token
+
+    @property
+    def refresh_token(self) -> str:
+        return self._refresh_token
+
+    @property
+    def ui_config(self) -> dict:
+        return self._ui_config
+
+    @property
+    def user(self) -> dict:
+        return self._user
+
+    @property
+    def users(self) -> list:
+        return self._users
+
+    @property
+    def roles(self) -> list:
+        return self._roles
+
+    @property
+    def logs(self) -> list:
+        return self._logs
+
+    @property
+    def kyc_issuer_by_address(self) -> dict:
+        return self._kyc_issuer_by_address

blockauth_sdk-0.5.0.dist-info/METADATA

@@ -0,0 +1,161 @@
+Metadata-Version: 2.4
+Name: blockauth-sdk
+Version: 0.5.0
+Summary: BlockAuth Auth SDK (Python) — blockchain-based authentication client.
+Author: Block-Auth.io Team
+License-Expression: ISC
+Project-URL: Homepage, https://block-auth.io
+Project-URL: Repository, https://gitlab.com/blockauthio/blockauth-sdk-python
+Project-URL: Issues, https://gitlab.com/blockauthio/blockauth-sdk-python/-/issues
+Keywords: blockauth,authentication,blockchain,web3,socket.io,sdk
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: python-socketio[client]<6,>=5.11
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: pytest-cov>=5; extra == "dev"
+Dynamic: license-file
+
+# BlockAuth SDK (Python)
+
+Cliente headless del servicio de autenticación BlockAuth (Socket.IO v4).
+Puerto de referencia de la capa de protocolo de `@block-auth.io/core`
+(monorepo `blockauth-sdk`, patrón *headless core + thin per-framework adapters*).
+
+## Arquitectura
+
+Este puerto replica la capa `protocol/` del core TypeScript; la reactividad y
+la UI de los bindings (React/Vue/Angular) quedan fuera de alcance.
+
+| Este repo | Upstream (`blockauth-sdk`) |
+| :--- | :--- |
+| `blockauth_sdk/protocol/provider.py` | `packages/core/src/protocol/BlockAuthProvider.ts` |
+| `blockauth_sdk/protocol/ws_client.py` | `packages/core/src/protocol/WsClient.ts` |
+| `blockauth_sdk/protocol/rpc_client.py` | `packages/core/src/protocol/RpcClient.ts` |
+| `blockauth_sdk/protocol/roles.py` | `packages/core/src/protocol/roles.ts` |
+| `blockauth_sdk/protocol/transport.py` | — (abstracción propia del puerto; upstream usa socket.io directo) |
+| `blockauth_sdk/api_bridge.py` | `packages/core/src/utils/apiBridge.ts` (solo la emisión del browser token) |
+| `blockauth_sdk/crypto.py`, `blockauth_sdk/errors.py` | — (infra propia del puerto) |
+
+La API pública se re-exporta desde la raíz del paquete (`from blockauth_sdk import
+BlockAuthProvider`), igual que hace el `index.ts` del core.
+
+## Instalación
+
+```bash
+pip install blockauth-sdk
+```
+
+## Uso
+
+Un backend se autentica con su `apiKey` y su `apiSecret`. El `apiSecret` solo
+vive en el backend.
+
+```python
+from blockauth_sdk import BlockAuthProvider
+
+provider = BlockAuthProvider(api_key="YOUR_API_KEY", api_secret="YOUR_API_SECRET")
+provider.connect()
+
+result = provider.signin()
+if result["success"]:
+    profile = provider.user("0xUserAddress")
+    print(provider.role_names)
+
+provider.disconnect()
+```
+
+No autentiques un backend con un browser token: el ws-server lo rechaza (exige
+un `Origin` de confianza y su scope no da acceso a `user`, `users`, `roles` ni
+`logs`).
+
+### Login por redirección
+
+Para que tus usuarios inicien sesión con BlockAuth, tu backend los manda al
+login alojado y recibe de vuelta un código de un solo uso, que canjea por la
+dirección y los roles del usuario. La dirección la da el ws-server, nunca el
+navegador.
+
+```python
+import json
+import secrets
+import urllib.error
+import urllib.request
+
+from blockauth_sdk.api_bridge import build_ws_server_api_url
+from blockauth_sdk.crypto import sha256_hex
+
+
+def post(path, body):
+    request = urllib.request.Request(
+        build_ws_server_api_url(path),
+        data=json.dumps(body).encode("utf-8"),
+        headers={"Content-Type": "application/json"},
+    )
+    try:
+        with urllib.request.urlopen(request) as response:
+            data = json.load(response)
+    except urllib.error.HTTPError as err:  # los errores llegan como 400 con el mismo JSON
+        data = json.load(err)
+    if not data.get("success"):
+        raise RuntimeError(data.get("message"))
+    return data["message"]
+
+
+credentials = {"apiKey": "YOUR_API_KEY", "apiSecret": sha256_hex("YOUR_API_SECRET")}
+redirect_uri = "https://tuapp.com/callback"
+
+# 1. Pide el enlace de login y redirige al usuario a él.
+state = secrets.token_hex(16)  # guárdalo en la sesión
+link = post("/auth/authorize", {**credentials, "redirectUri": redirect_uri, "state": state})["url"]
+
+# 2. El usuario vuelve a redirect_uri?code=...&state=... Comprueba que el state es el de la sesión.
+
+# 3. Canjea el código (válido 60 s, un solo uso).
+user = post("/auth/token", {**credentials, "code": code, "redirectUri": redirect_uri})
+address = user["address"]  # también: roles, signedExpiredAt
+```
+
+- El `redirect_uri` tiene que ser `https` en el dominio (o el dominio de
+  desarrollo) de la app; `http` solo en `localhost`.
+- Para cerrar la sesión del usuario en tu app: `post("/auth/signout",
+  {**credentials, "address": address})`.
+
+### Browser token para tu frontend
+
+Si tu frontend usa `@block-auth.io/core`, el backend le emite un browser token
+para que el `apiSecret` no salga nunca del backend:
+
+```python
+provider = BlockAuthProvider(api_key="YOUR_API_KEY", api_secret="YOUR_API_SECRET")
+browser_token = provider.create_browser_token()
+```
+
+El frontend lo usa como `browserToken` en `@block-auth.io/core`.
+
+## API
+
+`BlockAuthProvider`: `connect`, `disconnect`, `is_connected`, `signin`, `create_browser_token`, `refresh`,
+`is_address_signed`, `app`, `user`, `users`, `roles`, `logs`, `kyc_issuer`,
+helpers de roles (`has_role`, `has_role_by_slug`, `has_any_role`,
+`has_any_role_by_slug`) y getters (`current_user`, `role_names`, `ui_config`, …).
+
+## Tests
+
+```bash
+pip install -e ".[dev]"
+pytest
+```
+
+## Smoke test contra un servidor real
+
+Los tests usan un transporte simulado. Para probar el SDK contra el ws-server
+de PRE (transporte real, login por redirección y canje del código), usa la app
+de prueba de [`examples/test_app/`](https://gitlab.com/blockauthio/blockauth-sdk-python/-/tree/main/examples/test_app).

blockauth_sdk-0.5.0.dist-info/RECORD

@@ -0,0 +1,15 @@
+blockauth_sdk/__init__.py,sha256=eJEHy0xkg0Jb3H8vUu8jEHjXzJQTQke0sDxFmxlt20I,603
+blockauth_sdk/api_bridge.py,sha256=Gc5os7anyrPaZFm8RoM1Vkcb114qc-LVJDcIPLLcKqk,1644
+blockauth_sdk/crypto.py,sha256=IMc-xCQ7pUv42sTDw83jThKckwQCpdNa7448QxR4lA0,252
+blockauth_sdk/errors.py,sha256=oqDMg7QWZSp8_sbrBck10dYpqv2aavHZZxO3gp--q6Q,292
+blockauth_sdk/protocol/__init__.py,sha256=dbUSL8v46WwfpXOFpA0GGbv33TlJV5vbykoZPAkF744,691
+blockauth_sdk/protocol/provider.py,sha256=XDo2Xg9F0BEp3BfH_ravBSRnJoBMvVTb4DerOdlO7rU,6958
+blockauth_sdk/protocol/roles.py,sha256=VIh5dSsAp-a_lCXUUWa7zvYfYdlxCERGf2_Dr8LSZAI,1732
+blockauth_sdk/protocol/rpc_client.py,sha256=txDuuv92x3w9yO6wsQBsE3QhlxRmsaVYPepR0dBldqY,253
+blockauth_sdk/protocol/transport.py,sha256=H84yps5kplv3ZciqEGtyrEbh-tZJsjHxrndLt2yiG78,3116
+blockauth_sdk/protocol/ws_client.py,sha256=tM8gYEtPapPK4N4SkW8jYO74BjSdssRksUKpbcBAgrE,8009
+blockauth_sdk-0.5.0.dist-info/licenses/LICENSE,sha256=mXOK634s7KQHauR30-L3jKdDt6dF2MTQUQAklLpSbmU,757
+blockauth_sdk-0.5.0.dist-info/METADATA,sha256=XWVrk717r05CX4NqQZkjOf8oJfge6UD9XkQXSMuknMc,5899
+blockauth_sdk-0.5.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+blockauth_sdk-0.5.0.dist-info/top_level.txt,sha256=300jLVbaYrygxtD8YWV8RpjDR3pmNeUKCk-RqPMbvk4,14
+blockauth_sdk-0.5.0.dist-info/RECORD,,

blockauth_sdk-0.5.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

blockauth_sdk-0.5.0.dist-info/licenses/LICENSE

@@ -0,0 +1,15 @@
+ISC License
+
+Copyright (c) 2026 Block-Auth (block-auth.io)
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

blockauth_sdk-0.5.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+blockauth_sdk