khoj 1.31.0__py3-none-any.whl → 1.31.1.dev62__py3-none-any.whl

khoj/routers/auth.py

@@ -4,7 +4,8 @@ import logging
 import os
 from typing import Optional
 
-from fastapi import APIRouter
+import requests
+from fastapi import APIRouter, Depends
 from pydantic import BaseModel, EmailStr
 from starlette.authentication import requires
 from starlette.config import Config
@@ -21,7 +22,11 @@ from khoj.database.adapters import (
     get_or_create_user,
 )
 from khoj.routers.email import send_magic_link_email, send_welcome_email
-from khoj.routers.helpers import get_next_url, update_telemetry_state
+from khoj.routers.helpers import (
+    EmailVerificationApiRateLimiter,
+    get_next_url,
+    update_telemetry_state,
+)
 from khoj.utils import state
 
 logger = logging.getLogger(__name__)
@@ -98,16 +103,28 @@ async def login_magic_link(request: Request, form: MagicLinkForm):
 
 
 @auth_router.get("/magic")
-async def sign_in_with_magic_link(request: Request, code: str):
-    user = await aget_user_validated_by_email_verification_code(code)
+async def sign_in_with_magic_link(
+    request: Request,
+    code: str,
+    email: str,
+    rate_limiter=Depends(
+        EmailVerificationApiRateLimiter(requests=10, window=60 * 60 * 24, slug="magic_link_verification")
+    ),
+):
+    user, code_is_expired = await aget_user_validated_by_email_verification_code(code, email)
+
     if user:
+        if code_is_expired:
+            request.session["user"] = {}
+            return Response(status_code=403)
+
         id_info = {
             "email": user.email,
         }
 
         request.session["user"] = dict(id_info)
         return RedirectResponse(url="/")
-    return RedirectResponse(request.app.url_path_for("login_page"))
+    return Response(status_code=401)
 
 
 @auth_router.post("/token")
@@ -140,11 +157,12 @@ async def delete_token(request: Request, token: str):
 
 
 @auth_router.post("/redirect")
-async def auth(request: Request):
+async def auth_post(request: Request):
+    # This is maintained for compatibility with the /login endpoint
     form = await request.form()
     next_url = get_next_url(request)
     for q in request.query_params:
-        if not q == "next":
+        if q != "next":
             next_url += f"&{q}={request.query_params[q]}"
 
     credential = form.get("credential")
@@ -183,7 +201,76 @@ async def auth(request: Request):
     return RedirectResponse(url=next_url, status_code=HTTP_302_FOUND)
 
 
+@auth_router.get("/redirect")
+async def auth(request: Request):
+    next_url = get_next_url(request)
+    for q in request.query_params:
+        if q in ["code", "state", "scope", "authuser", "prompt", "session_state", "access_type"]:
+            continue
+        if q != "next":
+            next_url += f"&{q}={request.query_params[q]}"
+
+    code = request.query_params.get("code")
+
+    # 1. Construct the full redirect URI including domain
+    base_url = str(request.base_url).rstrip("/")
+    redirect_uri = f"{base_url}{request.app.url_path_for('auth')}"
+
+    verified_data = requests.post(
+        "https://oauth2.googleapis.com/token",
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        data={
+            "code": code,
+            "client_id": os.environ["GOOGLE_CLIENT_ID"],
+            "client_secret": os.environ["GOOGLE_CLIENT_SECRET"],
+            "redirect_uri": redirect_uri,
+            "grant_type": "authorization_code",
+        },
+    )
+
+    verified_data.raise_for_status()
+
+    credential = verified_data.json().get("id_token")
+
+    if not credential:
+        logger.error("Missing id_token in OAuth response")
+        return RedirectResponse(url="/login?error=invalid_token", status_code=HTTP_302_FOUND)
+
+    try:
+        idinfo = id_token.verify_oauth2_token(credential, google_requests.Request(), os.environ["GOOGLE_CLIENT_ID"])
+    except OAuthError as error:
+        return HTMLResponse(f"<h1>{error.error}</h1>")
+    khoj_user = await get_or_create_user(idinfo)
+
+    if khoj_user:
+        request.session["user"] = dict(idinfo)
+
+        if datetime.timedelta(minutes=3) > (datetime.datetime.now(datetime.timezone.utc) - khoj_user.date_joined):
+            asyncio.create_task(send_welcome_email(idinfo["name"], idinfo["email"]))
+            update_telemetry_state(
+                request=request,
+                telemetry_type="api",
+                api="create_user__google",
+                metadata={"server_id": str(khoj_user.uuid)},
+            )
+            logger.log(logging.INFO, f"🥳 New User Created: {khoj_user.uuid}")
+
+    return RedirectResponse(url=next_url, status_code=HTTP_302_FOUND)
+
+
 @auth_router.get("/logout")
 async def logout(request: Request):
     request.session.pop("user", None)
     return RedirectResponse(url="/")
+
+
+@auth_router.get("/oauth/metadata")
+async def oauth_metadata(request: Request):
+    redirect_uri = str(request.app.url_path_for("auth"))
+
+    return {
+        "google": {
+            "client_id": os.environ.get("GOOGLE_CLIENT_ID"),
+            "redirect_uri": f"{redirect_uri}",
+        }
+    }

khoj/routers/email.py

@@ -1,12 +1,8 @@
 import logging
 import os
 
-try:
-    import resend
-except ImportError:
-    pass
-
 import markdown_it
+import resend
 from django.conf import settings
 from jinja2 import Environment, FileSystemLoader
 
@@ -23,7 +19,7 @@ static_files = os.path.join(settings.BASE_DIR, "static")
 env = Environment(loader=FileSystemLoader(static_files))
 
 if not RESEND_API_KEY:
-    logger.warn("RESEND_API_KEY not set - email sending disabled")
+    logger.warning("RESEND_API_KEY not set - email sending disabled")
 else:
     resend.api_key = RESEND_API_KEY
 
@@ -33,7 +29,7 @@ def is_resend_enabled():
 
 
 async def send_magic_link_email(email, unique_id, host):
-    sign_in_link = f"{host}auth/magic?code={unique_id}"
+    sign_in_link = f"{host}auth/magic?code={unique_id}&email={email}"
 
     if not is_resend_enabled():
         logger.debug(f"Email sending disabled. Share this sign-in link with the user: {sign_in_link}")
@@ -41,13 +37,13 @@ async def send_magic_link_email(email, unique_id, host):
 
     template = env.get_template("magic_link.html")
 
-    html_content = template.render(link=f"{host}auth/magic?code={unique_id}")
+    html_content = template.render(link=f"{host}auth/magic?code={unique_id}", code=unique_id)
 
     resend.Emails.send(
         {
             "sender": os.environ.get("RESEND_EMAIL", "noreply@khoj.dev"),
             "to": email,
-            "subject": "Your Sign-In Link for Khoj 🚀",
+            "subject": f"Your login code to Khoj",
             "html": html_content,
         }
     )
@@ -64,7 +60,7 @@ async def send_welcome_email(name, email):
 
     resend.Emails.send(
         {
-            "sender": "team@khoj.dev",
+            "sender": os.environ.get("RESEND_EMAIL", "team@khoj.dev"),
             "to": email,
             "subject": f"{name}, four ways to use Khoj" if name else "Four ways to use Khoj",
             "html": html_content,
@@ -92,7 +88,7 @@ async def send_query_feedback(uquery, kquery, sentiment, user_email):
 
     logger.info(f"Sending feedback email for query {uquery}")
 
-    # rendering feedback email using feedback.html as template
+    # render feedback email using feedback.html as template
     template = env.get_template("feedback.html")
     html_content = template.render(
         uquery=uquery if not is_none_or_empty(uquery) else "N/A",
@@ -100,10 +96,10 @@ async def send_query_feedback(uquery, kquery, sentiment, user_email):
         sentiment=sentiment if not is_none_or_empty(sentiment) else "N/A",
         user_email=user_email if not is_none_or_empty(user_email) else "N/A",
     )
-    # send feedback from two fixed accounts
+    # send feedback to fixed account
     r = resend.Emails.send(
         {
-            "sender": "saba@khoj.dev",
+            "sender": os.environ.get("RESEND_EMAIL", "noreply@khoj.dev"),
             "to": "team@khoj.dev",
             "subject": f"User Feedback",
             "html": html_content,
@@ -130,7 +126,7 @@ def send_task_email(name, email, query, result, subject, is_image=False):
 
     r = resend.Emails.send(
         {
-            "sender": "Khoj <khoj@khoj.dev>",
+            "sender": f'Khoj <{os.environ.get("RESEND_EMAIL", "khoj@khoj.dev")}>',
             "to": email,
             "subject": f"✨ {subject}",
             "html": html_content,