kinde-python-sdk 2.0.8__tar.gz → 2.0.9__tar.gz

{kinde_python_sdk-2.0.8/kinde_python_sdk.egg-info → kinde_python_sdk-2.0.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kinde-python-sdk
-Version: 2.0.8
+Version: 2.0.9
 Summary: Connect your app to the Kinde platform
 Author-email: Kinde Engineering <engineering@kinde.com>
 Project-URL: Homepage, https://github.com/kinde-oss/kinde-python-sdk

{kinde_python_sdk-2.0.8 → kinde_python_sdk-2.0.9}/kinde_fastapi/examples/example_app.py

@@ -9,6 +9,8 @@ import logging
 from kinde_sdk.auth.oauth import OAuth
 from kinde_sdk.auth import claims, feature_flags, permissions, tokens
 from kinde_sdk.management import ManagementClient;
+from kinde_sdk.management.management_token_manager import ManagementTokenManager
+import requests
 
 logger = logging.getLogger(__name__)
 
@@ -78,6 +80,7 @@ async def home(request: Request):
                 <p>tokens: {tokens.get_token_manager().get_access_token()}</p>
                 <p>users: {user_count} user(s) found</p>
                 <p>You are logged in.</p>
+                <a href="/call_management_users">Call Management Users</a>
                 <a href="/logout">Logout</a>
             </body>
         </html>
@@ -92,6 +95,36 @@ async def home(request: Request):
     </html>
     """
 
+@app.get("/call_management_users")
+async def call_management_users():
+    if not kinde_oauth.is_authenticated():
+        return {"error": "Not authenticated"}
+    
+    domain = os.getenv("KINDE_DOMAIN")
+    client_id = os.getenv("KINDE_MANAGEMENT_CLIENT_ID")
+    client_secret = os.getenv("KINDE_MANAGEMENT_CLIENT_SECRET")
+    
+    if not all([domain, client_id, client_secret]):
+        return {"error": "Missing management credentials"}
+    
+    try:
+        token_manager = ManagementTokenManager(
+            domain=domain,
+            client_id=client_id,
+            client_secret=client_secret
+        )
+        access_token = token_manager.get_access_token()
+        
+        headers = {
+            "Authorization": f"Bearer {access_token}"
+        }
+        response = requests.get("http://localhost:8000/management/users", headers=headers)
+        response.raise_for_status()
+        return response.json()
+    except Exception as e:
+        logger.error(f"Failed to call management users: {e}")
+        return {"error": str(e)}
+
 if __name__ == "__main__":
     import uvicorn
     uvicorn.run(app, host="127.0.0.1", port=5000) 

kinde_python_sdk-2.0.9/kinde_fastapi/examples/management_token_example.py

@@ -0,0 +1,119 @@
+from fastapi import FastAPI, Depends, HTTPException, status
+from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
+import os
+import requests
+from dotenv import load_dotenv
+from kinde_sdk.management.management_token_manager import ManagementTokenManager
+from kinde_sdk.management import ManagementClient
+from typing import Dict, Any
+import time
+
+import logging
+
+# Load environment variables
+load_dotenv()
+
+# Setup logging
+logging.basicConfig(level=logging.DEBUG)
+logger = logging.getLogger(__name__)
+
+# Initialize FastAPI app
+app = FastAPI(title="Kinde Management Token Example with Introspection")
+
+# Security scheme for bearer token
+security = HTTPBearer()
+
+# Extract, introspect, and validate management token from header
+def get_management_token(credentials: HTTPAuthorizationCredentials = Depends(security)) -> ManagementTokenManager:
+    logger.debug("Starting token validation")
+    bearer_token = credentials.credentials
+    logger.debug(f"Received bearer token (first 20 chars): {bearer_token[:20]}...")
+    
+    # SDK config from env
+    domain = os.getenv("KINDE_HOST", "https://app.kinde.com")
+    logger.debug(f"Raw domain from env: {domain}")
+    if domain.startswith(('http://', 'https://')):
+        domain = domain.split('://', 1)[1]
+    logger.debug(f"Normalized domain: {domain}")
+    client_id = os.getenv("KINDE_MANAGEMENT_CLIENT_ID")
+    client_secret = os.getenv("KINDE_MANAGEMENT_CLIENT_SECRET")
+    logger.debug(f"Client ID: {client_id}")
+    # Not logging secret for security
+    
+    if not all([domain, client_id, client_secret]):
+        logger.error("Missing Kinde management credentials")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="Missing Kinde management credentials in environment"
+        )
+    
+    try:
+        token_manager = ManagementTokenManager(
+            domain=domain,
+            client_id=client_id,
+            client_secret=client_secret
+        )
+        logger.debug(f"ManagementTokenManager instantiated {bearer_token}")
+        
+        introspection_result = token_manager.validate_and_set_via_introspection(bearer_token)
+        logger.debug(f"Introspection result: {introspection_result}")
+        
+        access_token = token_manager.get_access_token()
+        if not access_token:
+            logger.error("No access token after introspection")
+            raise ValueError("Invalid management token after introspection")
+        logger.debug("Access token obtained successfully")
+        
+        return token_manager
+    
+    except ValueError as e:
+        logger.error(f"ValueError in token validation: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=str(e),
+            headers={"WWW-Authenticate": "Bearer"}
+        )
+    except Exception as e:
+        logger.error(f"Exception in token validation: {str(e)}", exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=f"Token introspection failed: {str(e)}",
+            headers={"WWW-Authenticate": "Bearer"}
+        )
+
+# Example route using the validated management token
+@app.get("/management/users")
+async def get_users(token_manager: ManagementTokenManager = Depends(get_management_token)):
+    logger.debug("Entering get_users endpoint")
+    try:
+        # Create ManagementClient with the token manager
+        management_client = ManagementClient(
+            domain=token_manager.domain,
+            client_id=token_manager.client_id,
+            client_secret=token_manager.client_secret
+        )
+        logger.debug("ManagementClient created")
+        
+        # Fetch users (example API call)
+        users_response = management_client.get_users()
+        
+        # Get the user count from the response
+        user_count = len(users_response.users) if users_response.users else 0
+        logger.debug(f"Fetched {user_count} users")
+        
+        return {
+            "message": "Users fetched successfully",
+            "user_count": user_count,
+            "users": users_response.users if users_response.users else []  # In production, filter sensitive data
+        }
+    except Exception as e:
+        logger.error(f"Error in get_users: {str(e)}", exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to fetch users: {str(e)}"
+        ) from e
+
+# Run the app
+if __name__ == "__main__":
+    import uvicorn
+    uvicorn.run(app, host="0.0.0.0", port=8000) 

{kinde_python_sdk-2.0.8 → kinde_python_sdk-2.0.9/kinde_python_sdk.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kinde-python-sdk
-Version: 2.0.8
+Version: 2.0.9
 Summary: Connect your app to the Kinde platform
 Author-email: Kinde Engineering <engineering@kinde.com>
 Project-URL: Homepage, https://github.com/kinde-oss/kinde-python-sdk

{kinde_python_sdk-2.0.8 → kinde_python_sdk-2.0.9}/kinde_python_sdk.egg-info/SOURCES.txt

@@ -4,6 +4,7 @@ README.md
 pyproject.toml
 ./kinde_fastapi/__init__.py
 ./kinde_fastapi/examples/example_app.py
+./kinde_fastapi/examples/management_token_example.py
 ./kinde_fastapi/examples/session.py
 ./kinde_fastapi/framework/__init__.py
 ./kinde_fastapi/framework/fastapi_framework.py
@@ -727,6 +728,7 @@ pyproject.toml
 ./kinde_sdk/test/test_models/test_webhook.py
 kinde_fastapi/__init__.py
 kinde_fastapi/examples/example_app.py
+kinde_fastapi/examples/management_token_example.py
 kinde_fastapi/examples/session.py
 kinde_fastapi/framework/__init__.py
 kinde_fastapi/framework/fastapi_framework.py

{kinde_python_sdk-2.0.8 → kinde_python_sdk-2.0.9}/kinde_sdk/management/management_token_manager.py

@@ -209,13 +209,15 @@ class ManagementTokenManager:
     def set_tokens(self, token_data: Dict[str, Any]):
         """ Store tokens with expiration. """
         with self.lock:
-            # Handle None values by using default
-            expires_in = token_data.get("expires_in") or 3600
+            # Handle None values by using default, but allow 0
+            expires_in = token_data.get("expires_in")
+            if expires_in is None:
+                expires_in = 3600
             token_type = token_data.get("token_type") or "Bearer"
             self.tokens = {
-            "access_token": token_data.get("access_token"),
-            "expires_at": time.time() + expires_in,
-            "token_type": token_type
+                "access_token": token_data.get("access_token"),
+                "expires_at": time.time() + expires_in,
+                "token_type": token_type
             }
 
     def get_access_token(self):
@@ -265,9 +267,64 @@ class ManagementTokenManager:
         except requests.exceptions.Timeout:
             raise Exception(f"Token request timed out after 30 seconds for domain {self.domain}")
         except requests.exceptions.RequestException as e:
-            raise Exception(f"Token request failed for domain {self.domain}: {str(e)}")
+            raise Exception(f"Token request failed for domain {self.domain}: {str(e)}") from e
 
     def clear_tokens(self):
         """ Clear stored tokens. """
         with self.lock:
-            self.tokens = {}
+            self.tokens = {}
+
+    def validate_and_set_via_introspection(self, bearer_token: str) -> Dict[str, Any]:
+        """
+        Validate a bearer token via introspection and set it if valid.
+        
+        Args:
+            bearer_token: The bearer token to introspect and validate.
+        
+        Returns:
+            Dict: The introspection result if valid.
+        
+        Raises:
+            Exception: If introspection fails or token is invalid.
+        """
+        # First, get a management token using client credentials
+        management_token = self.get_access_token()
+        
+        introspection_url = f"https://{self.domain}/oauth2/introspect"
+        introspect_data = {
+            "token": bearer_token
+        }
+        
+        try:
+            response = requests.post(
+                introspection_url, 
+                data=introspect_data,
+                headers={
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    "Authorization": f"Bearer {management_token}",
+                    "Kinde-SDK": self._generate_tracking_header()
+                },
+                timeout=30
+            )
+            response.raise_for_status()
+            introspection_result = response.json()
+            
+            if not introspection_result.get("active", False):
+                raise ValueError("Token is inactive or invalid")
+            
+            # Set the validated token - calculate proper expiration
+            exp_time = introspection_result.get("exp")
+            expires_in = max(0, exp_time - int(time.time())) if exp_time else 3600
+            
+            token_data = {
+                "access_token": bearer_token,
+                "expires_in": expires_in
+            }
+            self.set_tokens(token_data)
+            
+            return introspection_result
+            
+        except requests.exceptions.Timeout:
+            raise Exception(f"Introspection request timed out after 30 seconds for domain {self.domain}") from None
+        except requests.exceptions.RequestException as e:
+            raise Exception(f"Introspection request failed for domain {self.domain}: {str(e)}") from e

{kinde_python_sdk-2.0.8 → kinde_python_sdk-2.0.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kinde-python-sdk"
-version = "2.0.8"
+version = "2.0.9"
 authors = [
     { name = "Kinde Engineering", email = "engineering@kinde.com" },
 ]