codosdk 1.0.56__tar.gz → 1.0.57__tar.gz

{codosdk-1.0.56 → codosdk-1.0.57}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codosdk
-Version: 1.0.56
+Version: 1.0.57
 Summary: CODO项目的Python SDK
 Home-page: https://github.com/ss1917/codo_sdk/
 Author: shenshuo

{codosdk-1.0.56 → codosdk-1.0.57}/README.md

@@ -99,6 +99,22 @@ token = auth.encode_auth_token(
 user_info = auth.decode_auth_token(token)
 ```
 
+### 开放 API（AK/SK）
+
+适用于 CI、集成方等编程访问。网关校验 `CODO1-HMAC-SHA256` 签名后签发短时内部 JWT。
+
+```python
+from websdk2.openapi_client import OpenAPIClient
+
+client = OpenAPIClient(
+    endpoint="https://gw.example.com",
+    access_key="your-ak",
+    secret_key="your-sk",
+)
+resp = client.request("GET", "/api/p/v4/biz/list/")
+print(resp.status_code, resp.text)
+```
+
 ### 消息队列
 
 ```python

{codosdk-1.0.56 → codosdk-1.0.57}/codosdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codosdk
-Version: 1.0.56
+Version: 1.0.57
 Summary: CODO项目的Python SDK
 Home-page: https://github.com/ss1917/codo_sdk/
 Author: shenshuo

{codosdk-1.0.56 → codosdk-1.0.57}/codosdk.egg-info/SOURCES.txt

@@ -10,6 +10,8 @@ codosdk.egg-info/requires.txt
 codosdk.egg-info/top_level.txt
 opssdk/__init__.py
 opssdk/utils/__init__.py
+tests/__init__.py
+tests/test_openapi_sign.py
 websdk2/__init__.py
 websdk2/api_set.py
 websdk2/application.py
@@ -29,6 +31,8 @@ websdk2/ldap.py
 websdk2/logger.py
 websdk2/model_utils.py
 websdk2/mqhelper.py
+websdk2/openapi_client.py
+websdk2/openapi_sign.py
 websdk2/program.py
 websdk2/salt_api.py
 websdk2/sqlalchemy_pagination.py

{codosdk-1.0.56 → codosdk-1.0.57}/codosdk.egg-info/top_level.txt

@@ -1,2 +1,3 @@
 opssdk
+tests
 websdk2

{codosdk-1.0.56 → codosdk-1.0.57}/setup.py

@@ -2,14 +2,14 @@
 # -*-coding:utf-8-*-
 """"
 author : shenshuo
-date   : 2024年12月12日
+date   : 2026年07月29日
 desc   : CODO SDK
 """
 
 import sys
 from setuptools import setup, find_packages
 
-VERSION = '1.0.56'
+VERSION = '1.0.57'
 
 if sys.version_info < (2, 7) or (3, 0) <= sys.version_info < (3, 6):
     print('This program requires at least Python 2.7 or 3.6 to run.')

codosdk-1.0.57/tests/test_openapi_sign.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+from websdk2.openapi_sign import build_auth_headers, sign
+
+
+def test_get_vector():
+    ak = "codoAKTEST0001"
+    sk = "testSecretKeyForOpenAPISign0001"
+    ts = "1700000000"
+    nonce = "nonce-fixed-001"
+    headers = {
+        "x-codo-access-key": ak,
+        "x-codo-timestamp": ts,
+        "x-codo-nonce": nonce,
+    }
+    sig = sign(sk, "GET", "/api/p/v4/biz/list/", {}, headers, b"", ts)
+    assert sig == "ce94e413a8f752ed75a7c129c184f14892d8b24f30222607994276174339e07f"
+
+
+def test_post_vector():
+    ak = "codoAKTEST0001"
+    sk = "testSecretKeyForOpenAPISign0001"
+    ts = "1700000000"
+    nonce = "nonce-fixed-001"
+    headers = {
+        "content-type": "application/json",
+        "x-codo-access-key": ak,
+        "x-codo-timestamp": ts,
+        "x-codo-nonce": nonce,
+    }
+    body = b'{"page":1}'
+    sig = sign(sk, "POST", "/api/p/v4/user/", {}, headers, body, ts)
+    assert sig == "4a2adef69ff58b92bc99c04474811e78082a5e3f5675a3c1d26e19ed3e7dc163"
+
+
+def test_build_auth_headers_keys():
+    h = build_auth_headers(
+        "ak", "sk", "GET", "/api/x/", query=None, body=None, timestamp=1700000000, nonce="n1"
+    )
+    assert "X-Codo-Access-Key" in h
+    assert "X-Codo-Signature" in h

codosdk-1.0.57/websdk2/openapi_client.py

@@ -0,0 +1,127 @@
+# -*- coding: utf-8 -*-
+"""开放 API 客户端：AK/SK 签名请求 CODO 网关。"""
+
+import json
+import logging
+from typing import Any, Dict, Optional
+from urllib.parse import urlencode, urlparse
+import requests
+from .configs import configs
+from .consts import const
+from .openapi_sign import build_auth_headers
+
+logger = logging.getLogger(__name__)
+
+
+class OpenAPIClient:
+    def __init__(
+        self,
+        access_key: str,
+        secret_key: str,
+        endpoint: str = None,
+        request_timeout: int = 10,
+    ):
+        self.access_key = access_key
+        self.secret_key = secret_key
+        self.request_timeout = request_timeout
+        if endpoint:
+            self.endpoint = endpoint.rstrip("/")
+        else:
+            self.endpoint = (configs.get(const.WEBSITE_API_GW_URL) or "http://gw.opendevops.cn").rstrip(
+                "/"
+            )
+
+    def _path_and_query(self, url: str, params: Optional[dict]):
+        if url.startswith("http://") or url.startswith("https://"):
+            parsed = urlparse(url)
+            path = parsed.path or "/"
+            # merge query from url
+            q = {}
+            if parsed.query:
+                from urllib.parse import parse_qs
+
+                for k, vs in parse_qs(parsed.query, keep_blank_values=True).items():
+                    q[k] = vs[0] if len(vs) == 1 else vs
+            if params:
+                q.update(params)
+            return path, q, f"{parsed.scheme}://{parsed.netloc}"
+        path = url if url.startswith("/") else "/" + url
+        return path, params or {}, self.endpoint
+
+    def request(
+        self,
+        method: str,
+        url: str,
+        params: dict = None,
+        data: Any = None,
+        json_body: Any = None,
+        headers: dict = None,
+    ) -> requests.Response:
+        path, query, base = self._path_and_query(url, params)
+        method_u = method.upper()
+        body_bytes = None
+        content_type = None
+        if json_body is not None:
+            body_bytes = json.dumps(json_body, ensure_ascii=False, separators=(",", ":")).encode(
+                "utf-8"
+            )
+            content_type = "application/json"
+        elif data is not None:
+            if isinstance(data, (dict, list)):
+                body_bytes = json.dumps(data, ensure_ascii=False, separators=(",", ":")).encode(
+                    "utf-8"
+                )
+                content_type = "application/json"
+            elif isinstance(data, str):
+                body_bytes = data.encode("utf-8")
+            else:
+                body_bytes = data
+
+        auth_headers = build_auth_headers(
+            self.access_key,
+            self.secret_key,
+            method_u,
+            path,
+            query=query,
+            body=body_bytes,
+            content_type=content_type,
+        )
+        final_headers = dict(headers or {})
+        final_headers.update(auth_headers)
+
+        full_url = f"{base}{path}"
+        if query:
+            full_url = f"{full_url}?{urlencode(query, doseq=True)}"
+
+        return requests.request(
+            method_u,
+            full_url,
+            headers=final_headers,
+            data=body_bytes,
+            timeout=self.request_timeout,
+        )
+
+    def with_params_data_url(self, **kwargs):
+        url = kwargs.get("url")
+        method = kwargs.get("method") or "GET"
+        params = kwargs.get("params")
+        body = kwargs.get("body")
+        req_json = kwargs.get("json")
+        if method.upper() in ("GET", "DELETE", "HEAD"):
+            return dict(method=method, url=url, params=params)
+        return dict(method=method, url=url, params=params, body=body, json=req_json)
+
+    def do_action(self, **kwargs) -> str:
+        return self.do_action_v2(**kwargs).text
+
+    def do_action_v2(self, **kwargs) -> requests.Response:
+        return self.do_action_v3(**kwargs)
+
+    def do_action_v3(self, **kwargs) -> requests.Response:
+        method = kwargs.get("method") or "GET"
+        url = kwargs.get("url")
+        params = kwargs.get("params")
+        if kwargs.get("json") is not None:
+            return self.request(method, url, params=params, json_body=kwargs.get("json"))
+        body = kwargs.get("body")
+        return self.request(method, url, params=params, data=body)

codosdk-1.0.57/websdk2/openapi_sign.py

@@ -0,0 +1,120 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+"""CODO1-HMAC-SHA256 签名（与网关 / Go SDK 对齐）。"""
+
+import hashlib
+import hmac
+import secrets
+import time
+from typing import Dict, Mapping, Optional, Union
+from urllib.parse import quote
+
+
+def sha256_hex(data: Union[bytes, str, None]) -> str:
+    if data is None:
+        data = b""
+    if isinstance(data, str):
+        data = data.encode("utf-8")
+    return hashlib.sha256(data).hexdigest()
+
+
+def hmac_sha256_hex(key: str, msg: str) -> str:
+    return hmac.new(key.encode("utf-8"), msg.encode("utf-8"), hashlib.sha256).hexdigest()
+
+
+def canonical_query(params: Optional[Mapping] = None) -> str:
+    if not params:
+        return ""
+    items = []
+    for k in sorted(params.keys()):
+        v = params[k]
+        if isinstance(v, (list, tuple)):
+            for vv in sorted(str(x) for x in v):
+                items.append(f"{quote(str(k), safe='-_.~')}={quote(str(vv), safe='-_.~')}")
+        elif v is None:
+            continue
+        else:
+            items.append(f"{quote(str(k), safe='-_.~')}={quote(str(v), safe='-_.~')}")
+    return "&".join(items)
+
+
+def build_canonical_request(
+    method: str,
+    uri: str,
+    query: Optional[Mapping],
+    headers: Mapping[str, str],
+    body: Union[bytes, str, None],
+) -> str:
+    if body is None:
+        body_b = b""
+    elif isinstance(body, str):
+        body_b = body.encode("utf-8")
+    else:
+        body_b = body
+    normalized = {str(k).lower(): str(v).strip() for k, v in headers.items()}
+    names = sorted(normalized.keys())
+    canonical_headers = "".join(f"{n}:{normalized[n]}\n" for n in names)
+    signed_headers = ";".join(names)
+    return "\n".join(
+        [
+            method.upper(),
+            uri,
+            canonical_query(query),
+            canonical_headers,
+            signed_headers,
+            sha256_hex(body_b),
+        ]
+    )
+
+
+def build_string_to_sign(timestamp: Union[str, int], canonical_request: str) -> str:
+    return "\n".join(
+        ["CODO1-HMAC-SHA256", str(timestamp), sha256_hex(canonical_request.encode("utf-8"))]
+    )
+
+
+def sign(
+    secret_key: str,
+    method: str,
+    uri: str,
+    query: Optional[Mapping],
+    headers: Mapping[str, str],
+    body: Union[bytes, str, None],
+    timestamp: Union[str, int],
+) -> str:
+    cr = build_canonical_request(method, uri, query, headers, body)
+    sts = build_string_to_sign(timestamp, cr)
+    return hmac_sha256_hex(secret_key, sts)
+
+
+def build_auth_headers(
+    access_key: str,
+    secret_key: str,
+    method: str,
+    uri: str,
+    query: Optional[Mapping] = None,
+    body: Union[bytes, str, None] = None,
+    content_type: Optional[str] = None,
+    timestamp: Optional[Union[str, int]] = None,
+    nonce: Optional[str] = None,
+) -> Dict[str, str]:
+    ts = str(timestamp if timestamp is not None else int(time.time()))
+    n = nonce or secrets.token_hex(8)
+    sign_headers = {
+        "x-codo-access-key": access_key,
+        "x-codo-timestamp": ts,
+        "x-codo-nonce": n,
+    }
+    body_b = b"" if body is None else (body.encode("utf-8") if isinstance(body, str) else body)
+    if content_type and body_b:
+        sign_headers["content-type"] = content_type
+    signature = sign(secret_key, method, uri, query, sign_headers, body_b, ts)
+    out = {
+        "X-Codo-Access-Key": access_key,
+        "X-Codo-Timestamp": ts,
+        "X-Codo-Nonce": n,
+        "X-Codo-Signature": signature,
+    }
+    if content_type:
+        out["Content-Type"] = content_type
+    return out