imbi-plugin-google 2.13.3__py3-none-any.whl

imbi_plugin_google/__init__.py

@@ -0,0 +1,7 @@
+"""Imbi Google identity plugin."""
+
+from imbi_plugin_google.plugin import GoogleIdentity, GooglePlugin
+
+PLUGIN = GooglePlugin
+
+__all__ = ['PLUGIN', 'GoogleIdentity', 'GooglePlugin']

imbi_plugin_google/plugin.py

@@ -0,0 +1,276 @@
+"""Google identity plugin.
+
+Sign in with Google (Google Workspace / consumer Google accounts) via the
+OAuth 2.0 authorization-code + PKCE flow. Endpoints are fixed (Google is a
+stable, well-known provider), so unlike the generic OIDC plugin there is no
+discovery round-trip. A Workspace ``hosted_domain`` can be enforced by
+Google itself via the ``hd`` authorization parameter.
+"""
+
+from __future__ import annotations
+
+import base64
+import datetime
+import hashlib
+import logging
+import secrets
+import typing
+import urllib.parse
+
+import httpx
+from imbi_common.plugins.base import (
+    AuthorizationRequest,
+    Capability,
+    CredentialField,
+    IdentityCapability,
+    IdentityCredentials,
+    IdentityProfile,
+    Plugin,
+    PluginContext,
+    PluginManifest,
+    PluginOption,
+)
+
+LOGGER = logging.getLogger(__name__)
+
+AUTHORIZATION_ENDPOINT = 'https://accounts.google.com/o/oauth2/v2/auth'
+TOKEN_ENDPOINT = 'https://oauth2.googleapis.com/token'
+USERINFO_ENDPOINT = 'https://openidconnect.googleapis.com/v1/userinfo'
+REVOCATION_ENDPOINT = 'https://oauth2.googleapis.com/revoke'
+
+DEFAULT_SCOPES = ['openid', 'profile', 'email']
+
+
+def _b64url(value: bytes) -> str:
+    return base64.urlsafe_b64encode(value).rstrip(b'=').decode('ascii')
+
+
+def _generate_pkce() -> tuple[str, str]:
+    """Return ``(code_verifier, code_challenge)`` per RFC 7636 S256."""
+    verifier = _b64url(secrets.token_bytes(64))
+    challenge = _b64url(hashlib.sha256(verifier.encode('ascii')).digest())
+    return verifier, challenge
+
+
+class GoogleIdentity(IdentityCapability):
+    """Authorization-code + PKCE identity handler for Google."""
+
+    async def authorization_request(
+        self,
+        ctx: PluginContext,
+        credentials: dict[str, str],
+        redirect_uri: str,
+        scopes: list[str] | None = None,
+    ) -> AuthorizationRequest:
+        options = ctx.integration_options
+        scope_list = scopes or self._default_scopes(options)
+        pkce_required = bool(options.get('pkce_required', True))
+
+        verifier, challenge = _generate_pkce() if pkce_required else ('', '')
+
+        params: dict[str, str] = {
+            'response_type': 'code',
+            'client_id': credentials['client_id'],
+            'redirect_uri': redirect_uri,
+            'scope': ' '.join(scope_list),
+            'state': secrets.token_urlsafe(16),
+            # Request a refresh token and force the consent screen so one is
+            # reliably returned (Google only issues it on first consent).
+            'access_type': 'offline',
+            'prompt': 'consent',
+        }
+        if pkce_required:
+            params['code_challenge'] = challenge
+            params['code_challenge_method'] = 'S256'
+        hosted_domain = options.get('hosted_domain')
+        if hosted_domain:
+            params['hd'] = str(hosted_domain)
+
+        url = AUTHORIZATION_ENDPOINT + '?' + urllib.parse.urlencode(params)
+        return AuthorizationRequest(
+            authorization_url=url,
+            state=params['state'],
+            code_verifier=verifier or None,
+        )
+
+    async def exchange_code(
+        self,
+        ctx: PluginContext,
+        credentials: dict[str, str],
+        code: str,
+        redirect_uri: str,
+        code_verifier: str | None = None,
+    ) -> tuple[IdentityProfile, IdentityCredentials]:
+        _ = ctx
+        data: dict[str, str] = {
+            'grant_type': 'authorization_code',
+            'code': code,
+            'redirect_uri': redirect_uri,
+            'client_id': credentials['client_id'],
+        }
+        if credentials.get('client_secret'):
+            data['client_secret'] = credentials['client_secret']
+        if code_verifier:
+            data['code_verifier'] = code_verifier
+
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            token_resp = await client.post(TOKEN_ENDPOINT, data=data)
+        if token_resp.status_code != 200:
+            raise ValueError(
+                f'Token exchange failed: {token_resp.status_code} '
+                f'{token_resp.text}'
+            )
+        token = typing.cast('dict[str, typing.Any]', token_resp.json())
+
+        profile = await self._userinfo(token['access_token'])
+        return profile, self._credentials(token)
+
+    async def refresh(
+        self,
+        ctx: PluginContext,
+        credentials: dict[str, str],
+        refresh_token: str,
+    ) -> IdentityCredentials:
+        _ = ctx
+        data: dict[str, str] = {
+            'grant_type': 'refresh_token',
+            'refresh_token': refresh_token,
+            'client_id': credentials['client_id'],
+        }
+        if credentials.get('client_secret'):
+            data['client_secret'] = credentials['client_secret']
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            response = await client.post(TOKEN_ENDPOINT, data=data)
+        if response.status_code != 200:
+            raise ValueError(
+                f'Token refresh failed: {response.status_code} {response.text}'
+            )
+        token = typing.cast('dict[str, typing.Any]', response.json())
+        # Google does not return a new refresh token on refresh; keep the
+        # existing one so the identity stays renewable.
+        return self._credentials(token, fallback_refresh=refresh_token)
+
+    async def revoke(
+        self,
+        ctx: PluginContext,
+        credentials: dict[str, str],
+        token: str,
+    ) -> None:
+        _ = ctx, credentials
+        try:
+            async with httpx.AsyncClient(timeout=10.0) as client:
+                await client.post(REVOCATION_ENDPOINT, data={'token': token})
+        except httpx.HTTPError:
+            LOGGER.warning('Google revocation request failed', exc_info=True)
+
+    async def _userinfo(self, access_token: str) -> IdentityProfile:
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            response = await client.get(
+                USERINFO_ENDPOINT,
+                headers={'Authorization': f'Bearer {access_token}'},
+            )
+        if response.status_code != 200:
+            raise ValueError(
+                f'Userinfo request failed: {response.status_code} '
+                f'{response.text}'
+            )
+        claims = typing.cast('dict[str, typing.Any]', response.json())
+        return IdentityProfile(
+            subject=str(claims.get('sub', '')),
+            email=claims.get('email'),
+            email_verified=bool(claims.get('email_verified', False)),
+            name=claims.get('name'),
+            avatar_url=claims.get('picture'),
+            raw_claims=claims,
+        )
+
+    @staticmethod
+    def _credentials(
+        token: dict[str, typing.Any],
+        fallback_refresh: str | None = None,
+    ) -> IdentityCredentials:
+        expires_at: datetime.datetime | None = None
+        if 'expires_in' in token:
+            expires_at = datetime.datetime.now(
+                datetime.UTC
+            ) + datetime.timedelta(seconds=int(token['expires_in']))
+        scope_str = typing.cast('str', token.get('scope') or '')
+        return IdentityCredentials(
+            access_token=token['access_token'],
+            token_type=token.get('token_type', 'Bearer'),
+            refresh_token=token.get('refresh_token', fallback_refresh),
+            expires_at=expires_at,
+            scopes=scope_str.split(),
+        )
+
+    @staticmethod
+    def _default_scopes(options: dict[str, typing.Any]) -> list[str]:
+        raw = options.get('default_scopes')
+        if isinstance(raw, str) and raw.strip():
+            return raw.split()
+        if isinstance(raw, list):
+            return [str(s) for s in typing.cast('list[typing.Any]', raw)]
+        return list(DEFAULT_SCOPES)
+
+
+class GooglePlugin(Plugin):
+    manifest = PluginManifest(
+        slug='google',
+        name='Google',
+        icon='si-google',
+        description='Sign in with a Google or Google Workspace account.',
+        auth_type='oidc',
+        options=[
+            PluginOption(
+                name='hosted_domain',
+                label='Workspace domain',
+                description=(
+                    'Restrict sign-in to a Google Workspace domain '
+                    '(sent as the `hd` parameter, e.g. example.com). '
+                    'Leave blank to allow any Google account.'
+                ),
+                type='string',
+            ),
+            PluginOption(
+                name='pkce_required',
+                label='Require PKCE',
+                type='boolean',
+                default=True,
+            ),
+            PluginOption(
+                name='default_scopes',
+                label='Default scopes (space-separated)',
+                type='string',
+            ),
+        ],
+        credentials=[
+            CredentialField(
+                name='client_id',
+                label='Client ID',
+                description='Google OAuth client identifier.',
+                required=True,
+                secret=False,
+            ),
+            CredentialField(
+                name='client_secret',
+                label='Client secret',
+                description='Google OAuth client secret.',
+                required=True,
+            ),
+        ],
+        capabilities=[
+            Capability(
+                kind='identity',
+                label='Sign in with Google',
+                description='Google OAuth 2.0 identity provider.',
+                default_enabled=False,
+                project_scoped=False,
+                hints={
+                    'login_capable': True,
+                    'default_scopes': DEFAULT_SCOPES,
+                    'widget_text': 'Sign in with Google',
+                },
+                handler=GoogleIdentity,
+            ),
+        ],
+    )

imbi_plugin_google-2.13.3.dist-info/METADATA

@@ -0,0 +1,44 @@
+Metadata-Version: 2.4
+Name: imbi-plugin-google
+Version: 2.13.3
+Summary: Google identity plugin for Imbi
+Author-email: "Gavin M. Roy" <gavinr@aweber.com>
+License: BSD-3-Clause
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Natural Language :: English
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.14
+Requires-Dist: httpx>=0.27
+Requires-Dist: imbi-common==2.13.3
+Requires-Dist: pydantic>=2
+Description-Content-Type: text/markdown
+
+# imbi-plugin-google
+
+Google identity plugin for Imbi. Implements "Sign in with Google" using the
+OAuth 2.0 authorization-code + PKCE flow against Google's fixed endpoints
+(no discovery round-trip). A Google Workspace domain can be enforced by
+Google itself via the `hd` authorization parameter.
+
+## Manifest options
+
+| Option           | Required | Description                                                                     |
+| ---------------- | -------- | ------------------------------------------------------------------------------- |
+| `hosted_domain`  | no       | Restrict sign-in to a Google Workspace domain (sent as `hd`, e.g. `example.com`).|
+| `pkce_required`  | no       | Use PKCE (default: `true`).                                                      |
+| `default_scopes` | no       | Space-separated default scopes (default: `openid profile email`).               |
+
+## Credentials
+
+| Field           | Required | Secret |
+| --------------- | -------- | ------ |
+| `client_id`     | yes      | no     |
+| `client_secret` | yes      | yes    |
+
+## License
+
+BSD-3-Clause.

imbi_plugin_google-2.13.3.dist-info/RECORD

@@ -0,0 +1,6 @@
+imbi_plugin_google/__init__.py,sha256=II8T2ugMByD11oDaJieq0Tu4JoEM2UStLQRvpnB5gmI,182
+imbi_plugin_google/plugin.py,sha256=gTe7Rti4Ck-GYoJlDSCnid8Jjh0t7ghMXNW-p0PU6wo,9700
+imbi_plugin_google-2.13.3.dist-info/METADATA,sha256=I7d-AQzEw03zRkUtlB8LxorG0yDF0uQyGqi18n2By9s,1719
+imbi_plugin_google-2.13.3.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+imbi_plugin_google-2.13.3.dist-info/licenses/LICENSE,sha256=IR0vx4NgtkggN7vxSSdriTEoiwhNCzQ7816ZTKw_XLg,1535
+imbi_plugin_google-2.13.3.dist-info/RECORD,,

imbi_plugin_google-2.13.3.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.31.0
+Root-Is-Purelib: true
+Tag: py3-none-any

imbi_plugin_google-2.13.3.dist-info/licenses/LICENSE

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2026, AWeber Communications, Inc.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.