gpsoauth 2.0.0__tar.gz → 3.0.0__tar.gz

{gpsoauth-2.0.0 → gpsoauth-3.0.0}/PKG-INFO

@@ -1,22 +1,24 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: gpsoauth
-Version: 2.0.0
+Version: 3.0.0
 Summary: A python client library for Google Play Services OAuth.
 License: MIT
+License-File: LICENSE
 Author: Simon Weber
 Author-email: simon@simonmweber.com
-Requires-Python: >=3.9,<4.0
+Requires-Python: >=3.10,<4.0
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Typing :: Typed
 Requires-Dist: pycryptodomex (>=3.0)
 Requires-Dist: requests (>=2.0.0)
@@ -89,8 +91,40 @@ auth_response = gpsoauth.perform_oauth(
 token = auth_response['Auth']
 ```
 
+## Using another HTTP client
+
+`perform_master_login()`, `exchange_token()` and `perform_oauth()` send their requests with [requests](https://requests.readthedocs.io/). To send them with another HTTP client, such as an async one, build the form fields with `build_master_login_data()`, `build_exchange_token_data()` or `build_oauth_data()`, which take the same arguments except `proxy`. For example, with [aiohttp](https://docs.aiohttp.org/):
+
+```python
+from urllib.parse import urlencode
+
+import aiohttp
+import gpsoauth
+
+# Loading the certificates blocks: create the context once, outside the event loop.
+ssl_context = gpsoauth.create_ssl_context()
+
+async def perform_oauth(email, master_token, android_id):
+    data = gpsoauth.build_oauth_data(
+        email, master_token, android_id,
+        service='sj', app='com.google.android.music',
+        client_sig='...')
+    async with aiohttp.ClientSession() as session, session.post(
+        gpsoauth.AUTH_URL,
+        data=urlencode(data).encode('ascii'),
+        headers=gpsoauth.build_auth_headers(),
+        ssl=ssl_context,
+    ) as response:
+        return gpsoauth.google.parse_auth_response(await response.text())
+```
+
+These functions give you the form fields, the headers gpsoauth sets and its TLS settings. Your client still adds its own default headers, and handles proxies, timeouts and HTTP errors as it does for its other requests. It must also URL-encode the fields, as in the example: `build_master_login_data()` returns `EncryptedPasswd` as bytes, which aiohttp would otherwise send as a file upload.
+
+`create_ssl_context()` checks the server's certificate and hostname, and trusts the system's certificate authorities. gpsoauth's own functions may also trust the CA bundle requests uses, depending on its version and settings: certifi's, or the file named by `REQUESTS_CA_BUNDLE` or `CURL_CA_BUNDLE`. So a certificate that gpsoauth's functions accept can fail with another client. To trust the same certificates, add that bundle with `ssl_context.load_verify_locations()`, for example `ssl_context.load_verify_locations(requests.certs.where())` for certifi's. This also blocks, so do it where you create the context, outside the event loop.
+
 ## Ports
 
+- Typescript: <https://github.com/billgreenwald/gpsoauth-js>
 - C\#: <https://github.com/vemacs/GPSOAuthSharp>
 - Ruby: <https://github.com/bryanmytko/gpsoauth>
 - Java: <https://github.com/svarzee/gpsoauth-java>

{gpsoauth-2.0.0 → gpsoauth-3.0.0}/README.md

@@ -62,8 +62,40 @@ auth_response = gpsoauth.perform_oauth(
 token = auth_response['Auth']
 ```
 
+## Using another HTTP client
+
+`perform_master_login()`, `exchange_token()` and `perform_oauth()` send their requests with [requests](https://requests.readthedocs.io/). To send them with another HTTP client, such as an async one, build the form fields with `build_master_login_data()`, `build_exchange_token_data()` or `build_oauth_data()`, which take the same arguments except `proxy`. For example, with [aiohttp](https://docs.aiohttp.org/):
+
+```python
+from urllib.parse import urlencode
+
+import aiohttp
+import gpsoauth
+
+# Loading the certificates blocks: create the context once, outside the event loop.
+ssl_context = gpsoauth.create_ssl_context()
+
+async def perform_oauth(email, master_token, android_id):
+    data = gpsoauth.build_oauth_data(
+        email, master_token, android_id,
+        service='sj', app='com.google.android.music',
+        client_sig='...')
+    async with aiohttp.ClientSession() as session, session.post(
+        gpsoauth.AUTH_URL,
+        data=urlencode(data).encode('ascii'),
+        headers=gpsoauth.build_auth_headers(),
+        ssl=ssl_context,
+    ) as response:
+        return gpsoauth.google.parse_auth_response(await response.text())
+```
+
+These functions give you the form fields, the headers gpsoauth sets and its TLS settings. Your client still adds its own default headers, and handles proxies, timeouts and HTTP errors as it does for its other requests. It must also URL-encode the fields, as in the example: `build_master_login_data()` returns `EncryptedPasswd` as bytes, which aiohttp would otherwise send as a file upload.
+
+`create_ssl_context()` checks the server's certificate and hostname, and trusts the system's certificate authorities. gpsoauth's own functions may also trust the CA bundle requests uses, depending on its version and settings: certifi's, or the file named by `REQUESTS_CA_BUNDLE` or `CURL_CA_BUNDLE`. So a certificate that gpsoauth's functions accept can fail with another client. To trust the same certificates, add that bundle with `ssl_context.load_verify_locations()`, for example `ssl_context.load_verify_locations(requests.certs.where())` for certifi's. This also blocks, so do it where you create the context, outside the event loop.
+
 ## Ports
 
+- Typescript: <https://github.com/billgreenwald/gpsoauth-js>
 - C\#: <https://github.com/vemacs/GPSOAuthSharp>
 - Ruby: <https://github.com/bryanmytko/gpsoauth>
 - Java: <https://github.com/svarzee/gpsoauth-java>

{gpsoauth-2.0.0 → gpsoauth-3.0.0}/gpsoauth/__init__.py

@@ -62,24 +62,61 @@ class SSLContext(ssl.SSLContext):
         """
 
 
+def create_ssl_context() -> ssl.SSLContext:
+    """
+    Return a new SSL context with the TLS settings gpsoauth uses for AUTH_URL.
+
+    It is built as the one gpsoauth's own requests use: SSLContext() without a
+    protocol argument, with urllib3's ciphers if urllib3 < 2. It requires a
+    valid certificate for the server's hostname and trusts the system's
+    certificate authorities. Unlike urllib3's default context, it allows TLS
+    session tickets, and unlike urllib3's and aiohttp's, it offers no ALPN
+    (its set_alpn_protocols() does nothing): Google returns 403 Bad
+    Authentication if tickets are disabled or ALPN is offered.
+
+    gpsoauth's own functions may also trust the CA bundle requests uses,
+    depending on its version and settings: certifi's, or the file named by
+    REQUESTS_CA_BUNDLE or CURL_CA_BUNDLE. To trust the same certificates, add
+    that bundle with the context's load_verify_locations().
+
+    Loading certificates blocks, so in async code create the context once,
+    outside the event loop, and add any bundle there too.
+    """
+    context = SSLContext()
+    if SSL_DEFAULT_CIPHERS:
+        context.set_ciphers(SSL_DEFAULT_CIPHERS)
+    context.verify_mode = ssl.CERT_REQUIRED
+    context.check_hostname = True
+    context.options &= ~ssl.OP_NO_TICKET  # pylint: disable=E1101
+    context.load_default_certs()
+    return context
+
+
 class AuthHTTPAdapter(requests.adapters.HTTPAdapter):
     """TLS tweaks."""
 
     def init_poolmanager(self, *args: Any, **kwargs: Any) -> None:
-        """
-        Secure settings from ssl.create_default_context(), but without
-        ssl.OP_NO_TICKET which causes Google to return 403 Bad
-        Authentication.
-        """
-        context = SSLContext()
-        if SSL_DEFAULT_CIPHERS:
-            context.set_ciphers(SSL_DEFAULT_CIPHERS)
-        context.verify_mode = ssl.CERT_REQUIRED
-        context.options &= ~ssl.OP_NO_TICKET  # pylint: disable=E1101
-        context.load_default_certs()
+        """Use the TLS settings of create_ssl_context()."""
+        context = create_ssl_context()
+        # Leave the hostname check to urllib3, as gpsoauth always has: its
+        # matching differs from the ssl module's, e.g. for partial wildcards.
+        context.check_hostname = False
         self.poolmanager = PoolManager(*args, ssl_context=context, **kwargs)
 
 
+def build_auth_headers() -> dict[str, str]:
+    """
+    Return the headers gpsoauth sets on its requests to AUTH_URL.
+
+    HTTP clients add their own default headers to these, such as Accept.
+    """
+    return {
+        "Accept-Encoding": "identity",
+        "Content-type": "application/x-www-form-urlencoded",
+        "User-Agent": USER_AGENT,
+    }
+
+
 def _perform_auth_request(
     data: dict[str, int | str | bytes], proxies: MutableMapping[str, str] | None = None
 ) -> dict[str, str]:
@@ -87,19 +124,52 @@ def _perform_auth_request(
     session.mount(AUTH_URL, AuthHTTPAdapter())
     if proxies:
         session.proxies = proxies
-    session.headers.update(
-        {
-            "Accept-Encoding": "identity",
-            "Content-type": "application/x-www-form-urlencoded",
-            "User-Agent": USER_AGENT,
-        }
-    )
+    session.headers.update(build_auth_headers())
 
     res = session.post(AUTH_URL, data=data, verify=True)
 
     return google.parse_auth_response(res.text)
 
 
+def build_master_login_data(
+    email: str,
+    password: str,
+    android_id: str,
+    service: str = "ac2dm",
+    device_country: str = "us",
+    operator_country: str = "us",
+    lang: str = "en",
+    sdk_version: int = 17,
+    client_sig: str = "38918a453d07199354f8b19af05ec6562ced5788",
+) -> dict[str, int | str | bytes]:
+    """
+    Return the form fields perform_master_login() posts to AUTH_URL, as a new dict.
+
+    It takes the same arguments, except proxy. EncryptedPasswd differs on each
+    call, as the encryption is randomized.
+    """
+    return {
+        "accountType": "HOSTED_OR_GOOGLE",
+        "Email": email,
+        "has_permission": 1,
+        "add_account": 1,
+        "EncryptedPasswd": google.construct_signature(
+            email, password, ANDROID_KEY_7_3_29
+        ),
+        "service": service,
+        "source": "android",
+        "androidId": android_id,
+        "device_country": device_country,
+        "operatorCountry": operator_country,
+        "lang": lang,
+        "sdk_version": sdk_version,
+        "google_play_services_version": 240913000,
+        "client_sig": client_sig,
+        "callerSig": client_sig,
+        "droidguard_results": "dummy123",
+    }
+
+
 def perform_master_login(
     email: str,
     password: str,
@@ -132,14 +202,44 @@ def perform_master_login(
         }
     """
 
-    data: dict[str, int | str | bytes] = {
+    data = build_master_login_data(
+        email,
+        password,
+        android_id,
+        service=service,
+        device_country=device_country,
+        operator_country=operator_country,
+        lang=lang,
+        sdk_version=sdk_version,
+        client_sig=client_sig,
+    )
+
+    return _perform_auth_request(data, proxy)
+
+
+def build_exchange_token_data(
+    email: str,
+    token: str,
+    android_id: str,
+    service: str = "ac2dm",
+    device_country: str = "us",
+    operator_country: str = "us",
+    lang: str = "en",
+    sdk_version: int = 17,
+    client_sig: str = "38918a453d07199354f8b19af05ec6562ced5788",
+) -> dict[str, int | str | bytes]:
+    """
+    Return the form fields exchange_token() posts to AUTH_URL, as a new dict.
+
+    It takes the same arguments, except proxy.
+    """
+    return {
         "accountType": "HOSTED_OR_GOOGLE",
         "Email": email,
         "has_permission": 1,
         "add_account": 1,
-        "EncryptedPasswd": google.construct_signature(
-            email, password, ANDROID_KEY_7_3_29
-        ),
+        "ACCESS_TOKEN": 1,
+        "Token": token,
         "service": service,
         "source": "android",
         "androidId": android_id,
@@ -153,8 +253,6 @@ def perform_master_login(
         "droidguard_results": "dummy123",
     }
 
-    return _perform_auth_request(data, proxy)
-
 
 def exchange_token(
     email: str,
@@ -188,28 +286,55 @@ def exchange_token(
         }
     """
 
-    data: dict[str, int | str | bytes] = {
+    data = build_exchange_token_data(
+        email,
+        token,
+        android_id,
+        service=service,
+        device_country=device_country,
+        operator_country=operator_country,
+        lang=lang,
+        sdk_version=sdk_version,
+        client_sig=client_sig,
+    )
+
+    return _perform_auth_request(data, proxy)
+
+
+def build_oauth_data(
+    email: str,
+    master_token: str,
+    android_id: str,
+    service: str,
+    app: str,
+    client_sig: str,
+    device_country: str = "us",
+    operator_country: str = "us",
+    lang: str = "en",
+    sdk_version: int = 17,
+) -> dict[str, int | str | bytes]:
+    """
+    Return the form fields perform_oauth() posts to AUTH_URL, as a new dict.
+
+    It takes the same arguments, except proxy.
+    """
+    return {
         "accountType": "HOSTED_OR_GOOGLE",
         "Email": email,
         "has_permission": 1,
-        "add_account": 1,
-        "ACCESS_TOKEN": 1,
-        "Token": token,
+        "EncryptedPasswd": master_token,
         "service": service,
         "source": "android",
         "androidId": android_id,
+        "app": app,
+        "client_sig": client_sig,
         "device_country": device_country,
         "operatorCountry": operator_country,
         "lang": lang,
         "sdk_version": sdk_version,
         "google_play_services_version": 240913000,
-        "client_sig": client_sig,
-        "callerSig": client_sig,
-        "droidguard_results": "dummy123",
     }
 
-    return _perform_auth_request(data, proxy)
-
 
 def perform_oauth(
     email: str,
@@ -241,21 +366,17 @@ def perform_oauth(
     ``Authorization: GoogleLogin auth=res['Auth']``.
     """
 
-    data: dict[str, int | str | bytes] = {
-        "accountType": "HOSTED_OR_GOOGLE",
-        "Email": email,
-        "has_permission": 1,
-        "EncryptedPasswd": master_token,
-        "service": service,
-        "source": "android",
-        "androidId": android_id,
-        "app": app,
-        "client_sig": client_sig,
-        "device_country": device_country,
-        "operatorCountry": operator_country,
-        "lang": lang,
-        "sdk_version": sdk_version,
-        "google_play_services_version": 240913000,
-    }
+    data = build_oauth_data(
+        email,
+        master_token,
+        android_id,
+        service=service,
+        app=app,
+        client_sig=client_sig,
+        device_country=device_country,
+        operator_country=operator_country,
+        lang=lang,
+        sdk_version=sdk_version,
+    )
 
     return _perform_auth_request(data, proxy)

{gpsoauth-2.0.0 → gpsoauth-3.0.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "gpsoauth"
-version = "2.0.0"
+version = "3.0.0"
 description = "A python client library for Google Play Services OAuth."
 authors = ["Simon Weber <simon@simonmweber.com>"]
 license = "MIT"
@@ -11,11 +11,11 @@ classifiers = [
     "Operating System :: OS Independent",
     "Programming Language :: Python",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Typing :: Typed",
 ]
 readme = "README.md"
@@ -24,7 +24,7 @@ repository = "https://github.com/simon-weber/gpsoauth"
 include = ["gpsoauth/py.typed"]
 
 [tool.poetry.dependencies]
-python = "^3.9"
+python = "^3.10"
 pycryptodomex = ">= 3.0"
 requests = ">= 2.0.0"
 urllib3 = ">= 1.26.0"
@@ -33,7 +33,7 @@ urllib3 = ">= 1.26.0"
 pre-commit = "^2.11.1"
 black = "^22.3.0"
 isort = "^5.8.0"
-pytest = "^6.2.2"
+pytest = "^8.4"
 flake8 = "^7.0"
 flake8-bugbear = ">= 21.4.1"
 flake8-comprehensions = ">= 3.4.0"