kinde-python-sdk 2.0.8__tar.gz → 2.0.10__tar.gz

{kinde_python_sdk-2.0.8/kinde_python_sdk.egg-info → kinde_python_sdk-2.0.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kinde-python-sdk
-Version: 2.0.8
+Version: 2.0.10
 Summary: Connect your app to the Kinde platform
 Author-email: Kinde Engineering <engineering@kinde.com>
 Project-URL: Homepage, https://github.com/kinde-oss/kinde-python-sdk
@@ -30,7 +30,7 @@ Requires-Dist: cryptography<42.0.0,>=41.0.0
 Requires-Dist: python-dotenv<2.0.0,>=1.0.0
 Requires-Dist: itsdangerous<3.0.0,>=2.2.0
 Requires-Dist: nest-asyncio<2.0.0,>=1.5.8
-Requires-Dist: httpx<0.26.0,>=0.25.0
+Requires-Dist: httpx<0.29.0,>=0.25.0
 Requires-Dist: pydantic<3.0.0,>=2.0.0
 Provides-Extra: fastapi
 Requires-Dist: fastapi<1.0.0,>=0.110.0; extra == "fastapi"
@@ -128,7 +128,7 @@ The FastAPI integration automatically provides these routes:
 
 ```python
 from fastapi import Depends
-from kinde_sdk.kinde_api_client import KindeApiClient
+from kinde_sdk.management.kinde_api_client import KindeApiClient
 
 @router.get("/protected")
 async def protected_route(
@@ -253,7 +253,7 @@ The Management API client requires:
 You can access the Management API through the existing `KindeApiClient`:
 
 ```python
-from kinde_sdk.kinde_api_client import KindeApiClient
+from kinde_sdk.management.kinde_api_client import KindeApiClient
 from kinde_sdk.enums import GrantType
 
 # Initialize the client with client credentials
@@ -396,7 +396,7 @@ except Exception as e:
 Complete example given below
 
 ```python
-from kinde_sdk.kinde_api_client import KindeApiClient
+from kinde_sdk.management.kinde_api_client import KindeApiClient
 from kinde_sdk.enums import GrantType
 
 def main():

{kinde_python_sdk-2.0.8 → kinde_python_sdk-2.0.10}/README.md

@@ -86,7 +86,7 @@ The FastAPI integration automatically provides these routes:
 
 ```python
 from fastapi import Depends
-from kinde_sdk.kinde_api_client import KindeApiClient
+from kinde_sdk.management.kinde_api_client import KindeApiClient
 
 @router.get("/protected")
 async def protected_route(
@@ -211,7 +211,7 @@ The Management API client requires:
 You can access the Management API through the existing `KindeApiClient`:
 
 ```python
-from kinde_sdk.kinde_api_client import KindeApiClient
+from kinde_sdk.management.kinde_api_client import KindeApiClient
 from kinde_sdk.enums import GrantType
 
 # Initialize the client with client credentials
@@ -354,7 +354,7 @@ except Exception as e:
 Complete example given below
 
 ```python
-from kinde_sdk.kinde_api_client import KindeApiClient
+from kinde_sdk.management.kinde_api_client import KindeApiClient
 from kinde_sdk.enums import GrantType
 
 def main():

{kinde_python_sdk-2.0.8 → kinde_python_sdk-2.0.10}/kinde_fastapi/examples/example_app.py

@@ -6,9 +6,11 @@ from pathlib import Path
 import os
 from dotenv import load_dotenv
 import logging
-from kinde_sdk.auth.oauth import OAuth
+from kinde_sdk import OAuth
 from kinde_sdk.auth import claims, feature_flags, permissions, tokens
 from kinde_sdk.management import ManagementClient;
+from kinde_sdk.management.management_token_manager import ManagementTokenManager
+import requests
 
 logger = logging.getLogger(__name__)
 
@@ -78,6 +80,7 @@ async def home(request: Request):
                 <p>tokens: {tokens.get_token_manager().get_access_token()}</p>
                 <p>users: {user_count} user(s) found</p>
                 <p>You are logged in.</p>
+                <a href="/call_management_users">Call Management Users</a>
                 <a href="/logout">Logout</a>
             </body>
         </html>
@@ -92,6 +95,36 @@ async def home(request: Request):
     </html>
     """
 
+@app.get("/call_management_users")
+async def call_management_users():
+    if not kinde_oauth.is_authenticated():
+        return {"error": "Not authenticated"}
+    
+    domain = os.getenv("KINDE_DOMAIN")
+    client_id = os.getenv("KINDE_MANAGEMENT_CLIENT_ID")
+    client_secret = os.getenv("KINDE_MANAGEMENT_CLIENT_SECRET")
+    
+    if not all([domain, client_id, client_secret]):
+        return {"error": "Missing management credentials"}
+    
+    try:
+        token_manager = ManagementTokenManager(
+            domain=domain,
+            client_id=client_id,
+            client_secret=client_secret
+        )
+        access_token = token_manager.get_access_token()
+        
+        headers = {
+            "Authorization": f"Bearer {access_token}"
+        }
+        response = requests.get("http://localhost:8000/management/users", headers=headers)
+        response.raise_for_status()
+        return response.json()
+    except Exception as e:
+        logger.error(f"Failed to call management users: {e}")
+        return {"error": str(e)}
+
 if __name__ == "__main__":
     import uvicorn
     uvicorn.run(app, host="127.0.0.1", port=5000) 

kinde_python_sdk-2.0.10/kinde_fastapi/examples/management_token_example.py

@@ -0,0 +1,119 @@
+from fastapi import FastAPI, Depends, HTTPException, status
+from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
+import os
+import requests
+from dotenv import load_dotenv
+from kinde_sdk.management.management_token_manager import ManagementTokenManager
+from kinde_sdk.management import ManagementClient
+from typing import Dict, Any
+import time
+
+import logging
+
+# Load environment variables
+load_dotenv()
+
+# Setup logging
+logging.basicConfig(level=logging.DEBUG)
+logger = logging.getLogger(__name__)
+
+# Initialize FastAPI app
+app = FastAPI(title="Kinde Management Token Example with Introspection")
+
+# Security scheme for bearer token
+security = HTTPBearer()
+
+# Extract, introspect, and validate management token from header
+def get_management_token(credentials: HTTPAuthorizationCredentials = Depends(security)) -> ManagementTokenManager:
+    logger.debug("Starting token validation")
+    bearer_token = credentials.credentials
+    logger.debug(f"Received bearer token (first 20 chars): {bearer_token[:20]}...")
+    
+    # SDK config from env
+    domain = os.getenv("KINDE_HOST", "https://app.kinde.com")
+    logger.debug(f"Raw domain from env: {domain}")
+    if domain.startswith(('http://', 'https://')):
+        domain = domain.split('://', 1)[1]
+    logger.debug(f"Normalized domain: {domain}")
+    client_id = os.getenv("KINDE_MANAGEMENT_CLIENT_ID")
+    client_secret = os.getenv("KINDE_MANAGEMENT_CLIENT_SECRET")
+    logger.debug(f"Client ID: {client_id}")
+    # Not logging secret for security
+    
+    if not all([domain, client_id, client_secret]):
+        logger.error("Missing Kinde management credentials")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="Missing Kinde management credentials in environment"
+        )
+    
+    try:
+        token_manager = ManagementTokenManager(
+            domain=domain,
+            client_id=client_id,
+            client_secret=client_secret
+        )
+        logger.debug(f"ManagementTokenManager instantiated {bearer_token}")
+        
+        introspection_result = token_manager.validate_and_set_via_introspection(bearer_token)
+        logger.debug(f"Introspection result: {introspection_result}")
+        
+        access_token = token_manager.get_access_token()
+        if not access_token:
+            logger.error("No access token after introspection")
+            raise ValueError("Invalid management token after introspection")
+        logger.debug("Access token obtained successfully")
+        
+        return token_manager
+    
+    except ValueError as e:
+        logger.error(f"ValueError in token validation: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=str(e),
+            headers={"WWW-Authenticate": "Bearer"}
+        )
+    except Exception as e:
+        logger.error(f"Exception in token validation: {str(e)}", exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=f"Token introspection failed: {str(e)}",
+            headers={"WWW-Authenticate": "Bearer"}
+        )
+
+# Example route using the validated management token
+@app.get("/management/users")
+async def get_users(token_manager: ManagementTokenManager = Depends(get_management_token)):
+    logger.debug("Entering get_users endpoint")
+    try:
+        # Create ManagementClient with the token manager
+        management_client = ManagementClient(
+            domain=token_manager.domain,
+            client_id=token_manager.client_id,
+            client_secret=token_manager.client_secret
+        )
+        logger.debug("ManagementClient created")
+        
+        # Fetch users (example API call)
+        users_response = management_client.get_users()
+        
+        # Get the user count from the response
+        user_count = len(users_response.users) if users_response.users else 0
+        logger.debug(f"Fetched {user_count} users")
+        
+        return {
+            "message": "Users fetched successfully",
+            "user_count": user_count,
+            "users": users_response.users if users_response.users else []  # In production, filter sensitive data
+        }
+    except Exception as e:
+        logger.error(f"Error in get_users: {str(e)}", exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to fetch users: {str(e)}"
+        ) from e
+
+# Run the app
+if __name__ == "__main__":
+    import uvicorn
+    uvicorn.run(app, host="0.0.0.0", port=8000) 

{kinde_python_sdk-2.0.8 → kinde_python_sdk-2.0.10}/kinde_fastapi/framework/fastapi_framework.py

@@ -7,6 +7,10 @@ from ..middleware.framework_middleware import FrameworkMiddleware
 import os
 import uuid
 import logging
+import base64
+import json
+from urllib.parse import urlparse, parse_qs
+from urllib.parse import urlencode, urlunparse
 
 logger = logging.getLogger(__name__)
 
@@ -133,30 +137,78 @@ class FastAPIFramework(FrameworkInterface):
         
         # Callback route
         @self.app.get("/callback")
-        async def callback(request: Request, code: str, state: Optional[str] = None):
+        async def callback(request: Request, code: Optional[str] = None, state: Optional[str] = None):
             """Handle the OAuth callback from Kinde."""
+            error = request.query_params.get('error')
+            if error and error.lower() == 'login_link_expired':
+                reauth_state = request.query_params.get('reauth_state')
+                if reauth_state:
+                    try:
+                        decoded_auth_state = base64.b64decode(reauth_state).decode('utf-8')
+                        reauth_dict = json.loads(decoded_auth_state)
+
+                        # Get the redirect URL from config
+                        redirect_url = os.getenv("KINDE_REDIRECT_URI")
+                        base_url = redirect_url.replace("/callback", "")
+
+                        # Build the login route URL
+                        login_route_url = f"{base_url}/login"
+
+                        # Parse and add parameters properly
+                        parsed = urlparse(login_route_url)
+                        query_dict = parse_qs(parsed.query)
+
+                        # Add reauth parameters
+                        for key, value in reauth_dict.items():
+                            query_dict[key] = [value]
+
+                        # Build final URL
+                        new_query = urlencode(query_dict, doseq=True)
+                        login_url = urlunparse((
+                            parsed.scheme,
+                            parsed.netloc,
+                            parsed.path,
+                            parsed.params,
+                            new_query,
+                            parsed.fragment
+                        ))
+
+                        return RedirectResponse(login_url)
+                    except Exception as ex:
+                        return HTMLResponse(f"Error parsing reauth state: {str(ex)}", status_code=400)
+
+            user_id = request.session.get('user_id') or str(uuid.uuid4())
+
             try:
-                # Generate a unique user ID for the session
-                logger.warning(f"[Callback] Request session is: {request.session}")
-                user_id = request.session.get("user_id") or str(uuid.uuid4())
-                
-                # Use OAuth's handle_redirect method to process the callback
-                logger.warning(f"[Callback] code[{code}] state[{state}] user_id[{user_id}]")
-                result = await self._oauth.handle_redirect(code, user_id, state)
-                
-                # Store user ID in session
-                logger.warning(f"[Callback] Storing user ID in session: {user_id}")
-                request.session["user_id"] = user_id
-                
-                # Create response with explicit session cookie settings
-                self._logger.warning(f"[Callback] Request session is: {request.session}")
-                self._logger.warning(f"[Callback] The full result: {result}")
-                response = RedirectResponse(url="/")
-                
-                return response
+                assert self._oauth is not None
+                await self._oauth.handle_redirect(code, user_id, state)
             except Exception as e:
-                logger.error(f"Authentication failed: {str(e)}")
-                return HTMLResponse(f"Authentication failed: {str(e)}")
+                if "State not found" in str(e):
+                    return HTMLResponse("Error: State not found. Please check Kinde Python SDK documentation.\n" + str(e), status_code=500)
+                raise e
+
+            request.session['user_id'] = user_id
+
+            # Initialize post_login_redirect
+            post_login_redirect = request.session.pop('post_login_redirect_url', None)
+            if post_login_redirect:
+                post_login_redirect = post_login_redirect.get('url', '/')
+            else:
+                post_login_redirect = '/'
+
+            if not post_login_redirect.startswith('http'):
+                post_login_redirect = str(request.base_url).rstrip('/') + post_login_redirect
+
+            parsed = urlparse(post_login_redirect)
+            if state:
+                query_dict = parse_qs(parsed.query)
+                query_dict['state'] = [state]
+                new_query = urlencode(query_dict, doseq=True)
+                redirect_url = urlunparse((parsed.scheme, parsed.netloc, parsed.path, parsed.params, new_query, parsed.fragment))
+            else:
+                redirect_url = post_login_redirect
+
+            return RedirectResponse(redirect_url)
         
         # Logout route
         @self.app.get("/logout")

{kinde_python_sdk-2.0.8 → kinde_python_sdk-2.0.10}/kinde_flask/framework/flask_framework.py

@@ -132,32 +132,85 @@ class FlaskFramework(FrameworkInterface):
             loop = asyncio.get_event_loop()
             login_url = loop.run_until_complete(self._oauth.login())
             return redirect(login_url)
-        
 
         # Callback route
-        @self.app.route('/callback')
+        @self.app.route("/callback")
         def callback():
             """Handle the OAuth callback from Kinde."""
+            import base64
+            import json
+            from urllib.parse import urlencode, urlparse, parse_qs, urlunparse
+            
+            error = request.args.get('error')
+            if error and error.lower() == 'login_link_expired':
+                reauth_state = request.args.get('reauth_state')
+                if reauth_state:
+                    try:
+                        decoded_auth_state = base64.b64decode(reauth_state).decode('utf-8')
+                        reauth_dict = json.loads(decoded_auth_state)
+
+                        # Get the redirect URL from config
+                        redirect_url = os.getenv("KINDE_REDIRECT_URI")
+                        base_url = redirect_url.replace("/callback", "")
+
+                        # Build the login route URL
+                        login_route_url = f"{base_url}/login"
+
+                        # Parse and add parameters properly
+                        parsed = urlparse(login_route_url)
+                        query_dict = parse_qs(parsed.query)
+
+                        # Add reauth parameters
+                        for key, value in reauth_dict.items():
+                            query_dict[key] = [value]
+
+                        # Build final URL
+                        new_query = urlencode(query_dict, doseq=True)
+                        login_url = urlunparse((
+                            parsed.scheme,
+                            parsed.netloc,
+                            parsed.path,
+                            parsed.params,
+                            new_query,
+                            parsed.fragment
+                        ))
+
+                        return redirect(login_url)
+                    except Exception as ex:
+                        return f"Error parsing reauth state: {str(ex)}", 400
+
+            post_login_redirect = session.pop('post_login_redirect_url', None)
+            if post_login_redirect:
+                post_login_redirect = post_login_redirect.get('url', '/')
+            else:
+                post_login_redirect = '/'
+
+            code = request.args.get('code')
+            state = request.args.get('state')
+            
+            # Validate required code parameter
+            if not code:
+                return "Authentication failed: Missing authorization code", 400
+            
+            # Get or generate user_id
+            user_id = session.get('user_id', str(uuid.uuid4()))
+            session['user_id'] = user_id
+            
+            # Handle async call to handle_redirect
             try:
-                code = request.args.get('code')
-                state = request.args.get('state')
-                
-                if not code:
-                    return "Authentication failed: No code provided", 400
-                
-                # Generate a unique user ID for the session
-                user_id = session.get('user_id') or str(uuid.uuid4())
-                
-                # Use OAuth's handle_redirect method to process the callback
-                loop = asyncio.get_event_loop()
-                result = loop.run_until_complete(self._oauth.handle_redirect(code, user_id, state))
-                
-                # Store user ID in session
-                session['user_id'] = user_id
-                
-                return redirect('/')
+                loop = asyncio.new_event_loop()
+                asyncio.set_event_loop(loop)
+                loop.run_until_complete(self._oauth.handle_redirect(code, user_id, state))
+                loop.close()
             except Exception as e:
                 return f"Authentication failed: {str(e)}", 400
+
+            if not post_login_redirect.startswith('http'):
+                # Use url_root to get just the scheme and host without the current path
+                post_login_redirect = str(request.url_root).rstrip('/') + post_login_redirect
+
+            # After successful authentication, simply redirect to the destination
+            return redirect(post_login_redirect)
         
         # Logout route
         @self.app.route('/logout')
@@ -206,4 +259,4 @@ class FlaskFramework(FrameworkInterface):
             import flask
             return True
         except ImportError:
-            return False 
+            return False

{kinde_python_sdk-2.0.8 → kinde_python_sdk-2.0.10/kinde_python_sdk.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kinde-python-sdk
-Version: 2.0.8
+Version: 2.0.10
 Summary: Connect your app to the Kinde platform
 Author-email: Kinde Engineering <engineering@kinde.com>
 Project-URL: Homepage, https://github.com/kinde-oss/kinde-python-sdk
@@ -30,7 +30,7 @@ Requires-Dist: cryptography<42.0.0,>=41.0.0
 Requires-Dist: python-dotenv<2.0.0,>=1.0.0
 Requires-Dist: itsdangerous<3.0.0,>=2.2.0
 Requires-Dist: nest-asyncio<2.0.0,>=1.5.8
-Requires-Dist: httpx<0.26.0,>=0.25.0
+Requires-Dist: httpx<0.29.0,>=0.25.0
 Requires-Dist: pydantic<3.0.0,>=2.0.0
 Provides-Extra: fastapi
 Requires-Dist: fastapi<1.0.0,>=0.110.0; extra == "fastapi"
@@ -128,7 +128,7 @@ The FastAPI integration automatically provides these routes:
 
 ```python
 from fastapi import Depends
-from kinde_sdk.kinde_api_client import KindeApiClient
+from kinde_sdk.management.kinde_api_client import KindeApiClient
 
 @router.get("/protected")
 async def protected_route(
@@ -253,7 +253,7 @@ The Management API client requires:
 You can access the Management API through the existing `KindeApiClient`:
 
 ```python
-from kinde_sdk.kinde_api_client import KindeApiClient
+from kinde_sdk.management.kinde_api_client import KindeApiClient
 from kinde_sdk.enums import GrantType
 
 # Initialize the client with client credentials
@@ -396,7 +396,7 @@ except Exception as e:
 Complete example given below
 
 ```python
-from kinde_sdk.kinde_api_client import KindeApiClient
+from kinde_sdk.management.kinde_api_client import KindeApiClient
 from kinde_sdk.enums import GrantType
 
 def main():