fikiri-id-sdk 0.1.0__tar.gz

fikiri_id_sdk-0.1.0/PKG-INFO

@@ -0,0 +1,180 @@
+Metadata-Version: 2.4
+Name: fikiri-id-sdk
+Version: 0.1.0
+Summary: SDK officiel FikiriID — intégration SSO OIDC pour plateformes Python
+License-Expression: MIT
+Keywords: fikiri,oidc,sso,oauth2,authentication
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: httpx>=0.27
+Provides-Extra: dev
+Requires-Dist: pytest; extra == "dev"
+Requires-Dist: pytest-asyncio; extra == "dev"
+Requires-Dist: respx; extra == "dev"
+Provides-Extra: fastapi
+Requires-Dist: fastapi>=0.110; extra == "fastapi"
+Provides-Extra: django
+Requires-Dist: django>=4.2; extra == "django"
+
+# fikiri-id-sdk
+
+SDK officiel FikiriID pour Python. Intègre le flow OAuth2 Authorization Code + PKCE (RFC 7636) avec adaptateurs pour FastAPI et Django.
+
+## Installation
+
+```bash
+pip install fikiri-id-sdk
+# Avec FastAPI :
+pip install "fikiri-id-sdk[fastapi]"
+# Avec Django :
+pip install "fikiri-id-sdk[django]"
+```
+
+## Usage de base
+
+```python
+from fikiri_id_sdk import FikiriIDClient
+
+with FikiriIDClient(
+    base_url="http://77.42.72.129:8094",
+    client_id="fikiri-AbCdEfGhIj",
+    client_secret="votre_secret",
+    redirect_uri="https://market.fikiri.cd/callback",
+    scopes=["openid", "profile", "email", "kyc:status"],
+) as client:
+    # 1. Générer l'URL de redirection (stocker code_verifier en session)
+    url, code_verifier = client.get_authorization_url(state="random-state")
+
+    # 2. Sur la route /callback
+    tokens = client.exchange_code(code="<code>", code_verifier=code_verifier)
+    user = client.get_userinfo(tokens["access_token"])
+    # → {"sub": "d569…", "fikiri_id": "06-002-1-1-1990-0042", "kyc_verified": True}
+```
+
+---
+
+## Intégration FastAPI
+
+```python
+from fastapi import FastAPI, Depends
+from fikiri_id_sdk import FikiriIDClient
+from fikiri_id_sdk.fastapi import make_require_user, make_require_kyc
+
+app = FastAPI()
+
+fikiri = FikiriIDClient(
+    base_url="http://77.42.72.129:8094",
+    client_id="fikiri-AbCdEfGhIj",
+    client_secret="votre_secret",
+    redirect_uri="https://market.fikiri.cd/callback",
+)
+
+require_user = make_require_user(fikiri)
+require_kyc  = make_require_kyc(fikiri, min_level="verifie")
+
+@app.get("/me")
+def me(user=Depends(require_user)):
+    return {"fikiri_id": user["fikiri_id"], "name": user["name"]}
+
+@app.post("/transfert")
+def transfert(user=Depends(require_kyc)):
+    # Accessible uniquement aux utilisateurs KYC vérifié
+    return {"ok": True}
+
+# Callback OAuth
+@app.get("/callback")
+def callback(code: str, state: str, request: Request):
+    code_verifier = request.session["code_verifier"]
+    tokens = fikiri.exchange_code(code=code, code_verifier=code_verifier)
+    return {"access_token": tokens["access_token"]}
+```
+
+---
+
+## Intégration Django
+
+```python
+# settings.py
+from fikiri_id_sdk import FikiriIDClient
+
+FIKIRI_ID_CLIENT = FikiriIDClient(
+    base_url="http://77.42.72.129:8094",
+    client_id="fikiri-AbCdEfGhIj",
+    client_secret="votre_secret",
+    redirect_uri="https://market.fikiri.cd/callback",
+)
+
+MIDDLEWARE = [
+    ...
+    "fikiri_id_sdk.django.FikiriIDMiddleware",
+]
+```
+
+```python
+# views.py
+from django.http import JsonResponse
+from fikiri_id_sdk.django import fikiri_login_required
+
+@fikiri_login_required
+def profil(request):
+    user = request.fikiri_user   # dict introspect — jamais None ici
+    return JsonResponse({"fikiri_id": user["fikiri_id"]})
+
+def publique(request):
+    user = getattr(request, "fikiri_user", None)  # peut être None
+    return JsonResponse({"connecte": user is not None})
+```
+
+---
+
+## Client async (FastAPI / asyncio)
+
+```python
+from fikiri_id_sdk import FikiriIDAsyncClient
+
+async with FikiriIDAsyncClient(
+    base_url="http://77.42.72.129:8094",
+    client_id="fikiri-AbCdEfGhIj",
+    client_secret="votre_secret",
+    redirect_uri="https://market.fikiri.cd/callback",
+) as client:
+    tokens = await client.exchange_code(code, code_verifier)
+    user   = await client.get_userinfo(tokens["access_token"])
+    info   = await client.introspect(tokens["access_token"])
+```
+
+---
+
+## Méthodes disponibles
+
+### `FikiriIDClient` (sync) / `FikiriIDAsyncClient` (async)
+
+| Méthode | Description |
+|---------|-------------|
+| `get_authorization_url(state)` | Retourne `(url, code_verifier)` — stocker le verifier en session |
+| `exchange_code(code, code_verifier)` | Échange le code → `access_token` + `refresh_token` |
+| `get_userinfo(access_token)` | Profil complet selon les scopes accordés |
+| `introspect(token)` | Validation middleware RFC 7662 — `{"active": true/false, ...}` |
+| `refresh_access_token(refresh_token)` | Renouvelle l'access token |
+| `revoke_token(token)` | Révoque access ou refresh token à la déconnexion |
+| `get_discovery()` | Configuration OIDC `/.well-known/openid-configuration` |
+
+### `make_require_user(client)` (FastAPI)
+
+Retourne une dépendance FastAPI qui valide le Bearer token et injecte le profil.
+
+### `make_require_kyc(client, min_level)` (FastAPI)
+
+Variante avec vérification du niveau KYC (`'en_cours'` ou `'verifie'`).
+
+### `FikiriIDMiddleware` (Django)
+
+Injecte `request.fikiri_user` (dict introspect ou `None`) sur toutes les requêtes.
+
+### `fikiri_login_required` (Django)
+
+Décorateur de vue — retourne 401 JSON si `request.fikiri_user` est `None`.
+
+---
+
+Serveur live : **http://77.42.72.129:8094** · [Swagger UI](http://77.42.72.129:8094/docs) · [Guide d'intégration](../../docs/integration.md)

fikiri_id_sdk-0.1.0/README.md

@@ -0,0 +1,162 @@
+# fikiri-id-sdk
+
+SDK officiel FikiriID pour Python. Intègre le flow OAuth2 Authorization Code + PKCE (RFC 7636) avec adaptateurs pour FastAPI et Django.
+
+## Installation
+
+```bash
+pip install fikiri-id-sdk
+# Avec FastAPI :
+pip install "fikiri-id-sdk[fastapi]"
+# Avec Django :
+pip install "fikiri-id-sdk[django]"
+```
+
+## Usage de base
+
+```python
+from fikiri_id_sdk import FikiriIDClient
+
+with FikiriIDClient(
+    base_url="http://77.42.72.129:8094",
+    client_id="fikiri-AbCdEfGhIj",
+    client_secret="votre_secret",
+    redirect_uri="https://market.fikiri.cd/callback",
+    scopes=["openid", "profile", "email", "kyc:status"],
+) as client:
+    # 1. Générer l'URL de redirection (stocker code_verifier en session)
+    url, code_verifier = client.get_authorization_url(state="random-state")
+
+    # 2. Sur la route /callback
+    tokens = client.exchange_code(code="<code>", code_verifier=code_verifier)
+    user = client.get_userinfo(tokens["access_token"])
+    # → {"sub": "d569…", "fikiri_id": "06-002-1-1-1990-0042", "kyc_verified": True}
+```
+
+---
+
+## Intégration FastAPI
+
+```python
+from fastapi import FastAPI, Depends
+from fikiri_id_sdk import FikiriIDClient
+from fikiri_id_sdk.fastapi import make_require_user, make_require_kyc
+
+app = FastAPI()
+
+fikiri = FikiriIDClient(
+    base_url="http://77.42.72.129:8094",
+    client_id="fikiri-AbCdEfGhIj",
+    client_secret="votre_secret",
+    redirect_uri="https://market.fikiri.cd/callback",
+)
+
+require_user = make_require_user(fikiri)
+require_kyc  = make_require_kyc(fikiri, min_level="verifie")
+
+@app.get("/me")
+def me(user=Depends(require_user)):
+    return {"fikiri_id": user["fikiri_id"], "name": user["name"]}
+
+@app.post("/transfert")
+def transfert(user=Depends(require_kyc)):
+    # Accessible uniquement aux utilisateurs KYC vérifié
+    return {"ok": True}
+
+# Callback OAuth
+@app.get("/callback")
+def callback(code: str, state: str, request: Request):
+    code_verifier = request.session["code_verifier"]
+    tokens = fikiri.exchange_code(code=code, code_verifier=code_verifier)
+    return {"access_token": tokens["access_token"]}
+```
+
+---
+
+## Intégration Django
+
+```python
+# settings.py
+from fikiri_id_sdk import FikiriIDClient
+
+FIKIRI_ID_CLIENT = FikiriIDClient(
+    base_url="http://77.42.72.129:8094",
+    client_id="fikiri-AbCdEfGhIj",
+    client_secret="votre_secret",
+    redirect_uri="https://market.fikiri.cd/callback",
+)
+
+MIDDLEWARE = [
+    ...
+    "fikiri_id_sdk.django.FikiriIDMiddleware",
+]
+```
+
+```python
+# views.py
+from django.http import JsonResponse
+from fikiri_id_sdk.django import fikiri_login_required
+
+@fikiri_login_required
+def profil(request):
+    user = request.fikiri_user   # dict introspect — jamais None ici
+    return JsonResponse({"fikiri_id": user["fikiri_id"]})
+
+def publique(request):
+    user = getattr(request, "fikiri_user", None)  # peut être None
+    return JsonResponse({"connecte": user is not None})
+```
+
+---
+
+## Client async (FastAPI / asyncio)
+
+```python
+from fikiri_id_sdk import FikiriIDAsyncClient
+
+async with FikiriIDAsyncClient(
+    base_url="http://77.42.72.129:8094",
+    client_id="fikiri-AbCdEfGhIj",
+    client_secret="votre_secret",
+    redirect_uri="https://market.fikiri.cd/callback",
+) as client:
+    tokens = await client.exchange_code(code, code_verifier)
+    user   = await client.get_userinfo(tokens["access_token"])
+    info   = await client.introspect(tokens["access_token"])
+```
+
+---
+
+## Méthodes disponibles
+
+### `FikiriIDClient` (sync) / `FikiriIDAsyncClient` (async)
+
+| Méthode | Description |
+|---------|-------------|
+| `get_authorization_url(state)` | Retourne `(url, code_verifier)` — stocker le verifier en session |
+| `exchange_code(code, code_verifier)` | Échange le code → `access_token` + `refresh_token` |
+| `get_userinfo(access_token)` | Profil complet selon les scopes accordés |
+| `introspect(token)` | Validation middleware RFC 7662 — `{"active": true/false, ...}` |
+| `refresh_access_token(refresh_token)` | Renouvelle l'access token |
+| `revoke_token(token)` | Révoque access ou refresh token à la déconnexion |
+| `get_discovery()` | Configuration OIDC `/.well-known/openid-configuration` |
+
+### `make_require_user(client)` (FastAPI)
+
+Retourne une dépendance FastAPI qui valide le Bearer token et injecte le profil.
+
+### `make_require_kyc(client, min_level)` (FastAPI)
+
+Variante avec vérification du niveau KYC (`'en_cours'` ou `'verifie'`).
+
+### `FikiriIDMiddleware` (Django)
+
+Injecte `request.fikiri_user` (dict introspect ou `None`) sur toutes les requêtes.
+
+### `fikiri_login_required` (Django)
+
+Décorateur de vue — retourne 401 JSON si `request.fikiri_user` est `None`.
+
+---
+
+Serveur live : **http://77.42.72.129:8094** · [Swagger UI](http://77.42.72.129:8094/docs) · [Guide d'intégration](../../docs/integration.md)

fikiri_id_sdk-0.1.0/fikiri_id_sdk/__init__.py

@@ -0,0 +1,205 @@
+"""
+fikiri-id-sdk — SDK officiel FikiriID (Python)
+
+Intègre le flow OAuth2 Authorization Code + PKCE (RFC 7636) pour les
+plateformes consommatrices Python de l'écosystème FIKIRI.
+
+Usage rapide :
+    from fikiri_id_sdk import FikiriIDClient
+
+    client = FikiriIDClient(
+        base_url="http://77.42.72.129:8094",
+        client_id="fikiri-AbCdEfGhIj",
+        client_secret="votre_secret",
+        redirect_uri="https://market.fikiri.cd/callback",
+    )
+
+    # 1. Générer l'URL de redirection
+    url, code_verifier = client.get_authorization_url(state="random_state")
+    # → rediriger l'utilisateur vers url
+
+    # 2. Traiter le callback
+    tokens = client.exchange_code(code="<code>", code_verifier=code_verifier)
+
+    # 3. Récupérer le profil
+    user = client.get_userinfo(tokens["access_token"])
+    print(user["fikiri_id"], user["kyc_verified"])
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import secrets
+from typing import Any
+
+import httpx
+
+__all__ = ["FikiriIDClient", "FikiriIDAsyncClient", "FikiriIDError"]
+
+
+class FikiriIDError(Exception):
+    """Erreur retournée par FikiriID ou le serveur OIDC."""
+
+    def __init__(self, message: str, error_code: str = "unknown", status: int | None = None):
+        super().__init__(message)
+        self.error_code = error_code
+        self.status = status
+
+
+def _generate_pkce() -> tuple[str, str]:
+    """Retourne (code_verifier, code_challenge) pour le flow PKCE S256."""
+    code_verifier = secrets.token_urlsafe(64)
+    digest = hashlib.sha256(code_verifier.encode()).digest()
+    code_challenge = base64.urlsafe_b64encode(digest).rstrip(b"=").decode()
+    return code_verifier, code_challenge
+
+
+class FikiriIDClient:
+    """
+    Client synchrone FikiriID (utilise httpx en mode sync).
+    Pour un usage async, instanciez avec httpx.AsyncClient et appelez
+    les méthodes préfixées _async (à venir).
+    """
+
+    def __init__(
+        self,
+        base_url: str,
+        client_id: str,
+        client_secret: str,
+        redirect_uri: str,
+        scopes: list[str] | None = None,
+        timeout: float = 10.0,
+    ):
+        self.base_url = base_url.rstrip("/")
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.redirect_uri = redirect_uri
+        self.scopes = scopes or ["openid", "profile", "email"]
+        self._http = httpx.Client(timeout=timeout)
+
+    # ── Authorization URL ──────────────────────────────────────────────────────
+
+    def get_authorization_url(self, state: str) -> tuple[str, str]:
+        """
+        Construit l'URL de redirection vers FikiriID et retourne
+        (url, code_verifier). Stockez code_verifier en session serveur
+        pour l'étape d'échange de code.
+        """
+        code_verifier, code_challenge = _generate_pkce()
+        params = {
+            "response_type": "code",
+            "client_id": self.client_id,
+            "redirect_uri": self.redirect_uri,
+            "scope": " ".join(self.scopes),
+            "state": state,
+            "code_challenge": code_challenge,
+            "code_challenge_method": "S256",
+        }
+        url = str(httpx.URL(f"{self.base_url}/auth/authorize", params=params))
+        return url, code_verifier
+
+    # ── Token endpoints ────────────────────────────────────────────────────────
+
+    def exchange_code(self, code: str, code_verifier: str) -> dict[str, Any]:
+        """
+        Étape 3 du flow PKCE : échange le code d'autorisation contre
+        access_token + refresh_token.
+        """
+        return self._post(
+            "/auth/token",
+            {
+                "grant_type": "authorization_code",
+                "code": code,
+                "redirect_uri": self.redirect_uri,
+                "code_verifier": code_verifier,
+            },
+        )
+
+    def refresh_access_token(self, refresh_token: str) -> dict[str, Any]:
+        """Obtient un nouvel access token depuis le refresh token."""
+        return self._post(
+            "/auth/token",
+            {"grant_type": "refresh_token", "refresh_token": refresh_token},
+        )
+
+    def revoke_token(self, token: str) -> None:
+        """Révoque un access ou refresh token. Appeler à la déconnexion."""
+        self._post("/auth/revoke", {"token": token})
+
+    # ── UserInfo ───────────────────────────────────────────────────────────────
+
+    def get_userinfo(self, access_token: str) -> dict[str, Any]:
+        """
+        Retourne le profil de l'utilisateur selon les scopes accordés.
+        Champs disponibles : sub, name, email, email_verified, fikiri_id,
+        kyc_status, kyc_verified, country_code, place_code, organisations…
+        """
+        res = self._http.get(
+            f"{self.base_url}/auth/userinfo",
+            headers={"Authorization": f"Bearer {access_token}"},
+        )
+        return self._handle(res)
+
+    # ── Introspection RFC 7662 ─────────────────────────────────────────────────
+
+    def introspect(self, token: str) -> dict[str, Any]:
+        """
+        Valide un access token côté serveur (RFC 7662).
+        Retourne {"active": True, "sub": ..., "scope": ..., "fikiri_id": ...}
+        ou {"active": False} si le token est invalide/expiré.
+
+        Préférer cette méthode à get_userinfo() dans les middlewares
+        d'authentification — une seule requête suffit.
+        """
+        return self._post("/auth/token/introspect", {"token": token})
+
+    # ── Discovery ──────────────────────────────────────────────────────────────
+
+    def get_discovery(self) -> dict[str, Any]:
+        """Récupère la configuration OIDC (/.well-known/openid-configuration)."""
+        res = self._http.get(f"{self.base_url}/.well-known/openid-configuration")
+        return self._handle(res)
+
+    # ── Internal ───────────────────────────────────────────────────────────────
+
+    def _post(self, path: str, data: dict[str, str]) -> dict[str, Any]:
+        creds = base64.b64encode(
+            f"{self.client_id}:{self.client_secret}".encode()
+        ).decode()
+        res = self._http.post(
+            f"{self.base_url}{path}",
+            data=data,
+            headers={
+                "Content-Type": "application/x-www-form-urlencoded",
+                "Authorization": f"Basic {creds}",
+            },
+        )
+        return self._handle(res)
+
+    @staticmethod
+    def _handle(res: httpx.Response) -> dict[str, Any]:
+        try:
+            body = res.json()
+        except Exception:
+            body = {"detail": res.text}
+        if not res.is_success:
+            raise FikiriIDError(
+                body.get("error_description") or body.get("detail") or "Erreur FikiriID",
+                error_code=body.get("error", "unknown"),
+                status=res.status_code,
+            )
+        return body  # type: ignore[return-value]
+
+    def close(self) -> None:
+        """Ferme le client HTTP sous-jacent."""
+        self._http.close()
+
+    def __enter__(self) -> "FikiriIDClient":
+        return self
+
+    def __exit__(self, *_: Any) -> None:
+        self.close()
+
+
+from fikiri_id_sdk.async_client import FikiriIDAsyncClient  # noqa: E402

fikiri_id_sdk-0.1.0/fikiri_id_sdk/async_client.py

@@ -0,0 +1,134 @@
+"""Client async FikiriID (httpx.AsyncClient) — pour FastAPI et frameworks async."""
+
+from __future__ import annotations
+
+import base64
+from typing import Any
+
+import httpx
+
+from fikiri_id_sdk import FikiriIDError, _generate_pkce
+
+
+class FikiriIDAsyncClient:
+    """
+    Client async FikiriID.
+
+    Usage dans FastAPI :
+        async with FikiriIDAsyncClient(...) as client:
+            url, verifier = client.get_authorization_url(state="xyz")
+            tokens = await client.exchange_code(code, verifier)
+            user = await client.get_userinfo(tokens["access_token"])
+    """
+
+    def __init__(
+        self,
+        base_url: str,
+        client_id: str,
+        client_secret: str,
+        redirect_uri: str,
+        scopes: list[str] | None = None,
+        timeout: float = 10.0,
+    ):
+        self.base_url = base_url.rstrip("/")
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.redirect_uri = redirect_uri
+        self.scopes = scopes or ["openid", "profile", "email"]
+        self._http = httpx.AsyncClient(timeout=timeout)
+
+    def get_authorization_url(self, state: str) -> tuple[str, str]:
+        """Retourne (url, code_verifier) — synchrone, pas d'I/O."""
+        code_verifier, code_challenge = _generate_pkce()
+        params = {
+            "response_type": "code",
+            "client_id": self.client_id,
+            "redirect_uri": self.redirect_uri,
+            "scope": " ".join(self.scopes),
+            "state": state,
+            "code_challenge": code_challenge,
+            "code_challenge_method": "S256",
+        }
+        url = str(httpx.URL(f"{self.base_url}/auth/authorize", params=params))
+        return url, code_verifier
+
+    async def exchange_code(self, code: str, code_verifier: str) -> dict[str, Any]:
+        """Échange le code d'autorisation contre access_token + refresh_token."""
+        return await self._post(
+            "/auth/token",
+            {
+                "grant_type": "authorization_code",
+                "code": code,
+                "redirect_uri": self.redirect_uri,
+                "code_verifier": code_verifier,
+            },
+        )
+
+    async def refresh_access_token(self, refresh_token: str) -> dict[str, Any]:
+        """Obtient un nouvel access token depuis le refresh token."""
+        return await self._post(
+            "/auth/token",
+            {"grant_type": "refresh_token", "refresh_token": refresh_token},
+        )
+
+    async def revoke_token(self, token: str) -> None:
+        """Révoque un access ou refresh token. Appeler à la déconnexion."""
+        await self._post("/auth/revoke", {"token": token})
+
+    async def get_userinfo(self, access_token: str) -> dict[str, Any]:
+        """Profil de l'utilisateur selon les scopes accordés."""
+        res = await self._http.get(
+            f"{self.base_url}/auth/userinfo",
+            headers={"Authorization": f"Bearer {access_token}"},
+        )
+        return self._handle(res)
+
+    async def introspect(self, token: str) -> dict[str, Any]:
+        """
+        Valide un access token côté serveur (RFC 7662).
+        Retourne {"active": True, "sub": ..., "fikiri_id": ...}
+        ou {"active": False} si invalide/expiré.
+        """
+        return await self._post("/auth/token/introspect", {"token": token})
+
+    async def get_discovery(self) -> dict[str, Any]:
+        """Configuration OIDC /.well-known/openid-configuration."""
+        res = await self._http.get(f"{self.base_url}/.well-known/openid-configuration")
+        return self._handle(res)
+
+    async def _post(self, path: str, data: dict[str, str]) -> dict[str, Any]:
+        creds = base64.b64encode(
+            f"{self.client_id}:{self.client_secret}".encode()
+        ).decode()
+        res = await self._http.post(
+            f"{self.base_url}{path}",
+            data=data,
+            headers={
+                "Content-Type": "application/x-www-form-urlencoded",
+                "Authorization": f"Basic {creds}",
+            },
+        )
+        return self._handle(res)
+
+    @staticmethod
+    def _handle(res: httpx.Response) -> dict[str, Any]:
+        try:
+            body = res.json()
+        except Exception:
+            body = {"detail": res.text}
+        if not res.is_success:
+            raise FikiriIDError(
+                body.get("error_description") or body.get("detail") or "Erreur FikiriID",
+                error_code=body.get("error", "unknown"),
+                status=res.status_code,
+            )
+        return body  # type: ignore[return-value]
+
+    async def close(self) -> None:
+        await self._http.aclose()
+
+    async def __aenter__(self) -> "FikiriIDAsyncClient":
+        return self
+
+    async def __aexit__(self, *_: Any) -> None:
+        await self.close()