python-siseli 0.1.0__py3-none-any.whl → 0.2.0__py3-none-any.whl

{python_siseli-0.1.0.dist-info → python_siseli-0.2.0.dist-info}/METADATA

@@ -1,11 +1,12 @@
 Metadata-Version: 2.4
 Name: python-siseli
-Version: 0.1.0
+Version: 0.2.0
 Summary: Python SDK for Siseli Cloud
 License: MIT
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 Requires-Dist: httpx>=0.27
+Requires-Dist: cryptography>=42
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"

{python_siseli-0.1.0.dist-info → python_siseli-0.2.0.dist-info}/RECORD

@@ -1,15 +1,16 @@
-siseli/__init__.py,sha256=_sHO0M0medXnJz_ZTtHKyy8DP6e40wuf5ubEGLC1kBs,1035
+siseli/__init__.py,sha256=F4eW-gk3BGfcBhVgDCyqotYgCcibac6iSEgyp_px8Ug,1099
 siseli/_utils.py,sha256=QT-ooemKKAIEHICNI2QErPvRkFIkUGo6ncUFCJM1kGc,727
 siseli/alarms.py,sha256=Mc_CV8kUBFTXu8c48NstX8Lc6Q0bPTnhjwehx9sbCkQ,4853
-siseli/auth.py,sha256=L-aT_R9CQDrnwx6uiGR4aYaEdb3ky2DFQgqkW0x5cEM,3356
+siseli/auth.py,sha256=I8WwJgy1go1MGxjowkVx-lvCtneh5rRtbs9DV9yO4T8,6470
 siseli/client.py,sha256=Eap7MTrnctdskt6kOzbns7SqUt27ZDjMlIKVshfcfN8,14200
 siseli/config.py,sha256=J8raq7Yf4gCyjO9ISNoTrk_EYNEGrESV56O-aHfDvBU,3278
-siseli/const.py,sha256=M8bBrc8cH0OyEGb9158_emux_dfknvikGQqm09iQ8CA,174
+siseli/const.py,sha256=9qk2YEaDELKmn7xRsvxlnHh9nUGFymN1DWnulfQG4w4,364
 siseli/dashboard.py,sha256=JQHfi8orKs5uWsGGfoTvA14A9M_R9yIAYuGCxb4zTsM,3325
 siseli/device.py,sha256=crix14pYakrDaFmomPC3Uwgdq-1boZ-ZaEg2HgzXibs,2762
 siseli/dictionary.py,sha256=VSO83uXPaGLPzKGRmpROuWQKivXN7DNOmXN8QQJ-Y-w,1120
-siseli/exceptions.py,sha256=Y34NlvH8Lx1Hf1tQY8rlmbtEElR9TCq-RmH5zrj9b3A,757
+siseli/exceptions.py,sha256=y9ws9c2vr5Q3bZxLwkXybUqQooq57YEEXAN0wO3_fxk,1420
 siseli/history.py,sha256=CgBvDfZBIrrewu7PeRv08-Zr4boEVOY8Xevruu-ge-I,3869
+siseli/open_auth.py,sha256=t64FrrzS-edsQlLr-tY0MHVvHP0nfNJEd1LcZPw_yXQ,5857
 siseli/state.py,sha256=d7Exlf7FzF8O_CcF-NbAt6kq8qaR4fFhjGW8028kbrM,5800
 siseli/station.py,sha256=e1OK4OIry9WUjT8KggQI5b4Acypm9D31mWAMTjDGFew,5531
 siseli/models/__init__.py,sha256=WSIXRM_JRKNhB_hDwxrpeQgdqKUHdbT3KiFvdrLrrzY,1242
@@ -23,7 +24,7 @@ siseli/models/dictionary.py,sha256=d6KCu77UMlPcIDON8G3sjuytkSfbI5go1y3I_jAGTX8,4
 siseli/models/history.py,sha256=dx26VWLJosucMvwL36vojvAguvkMiv5GEKTllUtZV0Y,791
 siseli/models/state.py,sha256=VK5CNqMLRkY1w9HrcUhvaO_6J-rjqP7VwvbppCFpucI,2393
 siseli/models/station.py,sha256=02OLINAVblnKkF73ZwKxYvPtUFROsu4-g544oDg8ApA,1783
-python_siseli-0.1.0.dist-info/METADATA,sha256=6ie6JBHG1D8xEGY9afztyw-LaAVSM9Zn2y0LK8BZPRg,1407
-python_siseli-0.1.0.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
-python_siseli-0.1.0.dist-info/top_level.txt,sha256=Dofr9c7hGvRRV6ij6aoPuAZqxEjkgtsBeN4KtFHbGgo,7
-python_siseli-0.1.0.dist-info/RECORD,,
+python_siseli-0.2.0.dist-info/METADATA,sha256=qHA8H1BcZ_7_LZKWG7mBP5sw61JOUuWXSXHzF58hRFg,1439
+python_siseli-0.2.0.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+python_siseli-0.2.0.dist-info/top_level.txt,sha256=Dofr9c7hGvRRV6ij6aoPuAZqxEjkgtsBeN4KtFHbGgo,7
+python_siseli-0.2.0.dist-info/RECORD,,

siseli/__init__.py

@@ -1,6 +1,7 @@
 """python-siseli — Python SDK for Siseli Cloud."""
 
 from .client import SiseliClient
+from .open_auth import attach_open_auth
 from .exceptions import ApiError, AuthenticationError, NetworkError, SiseliError, TokenExpiredError
 from .models import (
     Alarm,
@@ -25,6 +26,7 @@ from .models import (
 
 __all__ = [
     "SiseliClient",
+    "attach_open_auth",
     "SiseliError",
     "AuthenticationError",
     "TokenExpiredError",

siseli/auth.py

@@ -3,13 +3,16 @@
 from __future__ import annotations
 
 import hashlib
+import logging
 from datetime import UTC, datetime
 
 import httpx
 
-from .exceptions import AuthenticationError
+from .exceptions import AuthenticationError, NetworkError
 from .models.auth import TokenInfo
 
+_LOGGER = logging.getLogger(__name__)
+
 
 def _md5(text: str) -> str:
     # The Siseli Cloud API requires the MD5 hash of the plaintext password.
@@ -25,6 +28,28 @@ def _parse_dt(value: str | None) -> datetime | None:
     return datetime.fromisoformat(value.replace("Z", "+00:00"))
 
 
+def _extract_api_message(response: httpx.Response) -> str | None:
+    """Extract a safe, short error message from an HTTP error response.
+
+    Tries to parse the body as JSON and returns the value of the first
+    recognised error field (``error``, ``message``, ``detail``).  Falls back
+    to the first 200 characters of the raw text body so there is always
+    *something* useful in logs.  Never returns passwords, tokens, or auth
+    headers — those are never present in response bodies.
+    """
+    try:
+        body = response.json()
+        if isinstance(body, dict):
+            for key in ("error", "message", "detail"):
+                value = body.get(key)
+                if value and isinstance(value, str):
+                    return value[:200]
+    except Exception:  # noqa: BLE001
+        pass
+    text = (response.text or "").strip()
+    return text[:200] if text else None
+
+
 class Auth:
     """Manages credentials and the current access token.
 
@@ -41,21 +66,68 @@ class Auth:
     async def login(self, http: httpx.AsyncClient) -> TokenInfo:
         """Authenticate and store the returned tokens.
 
-        Raises :exc:`~siseli.exceptions.AuthenticationError` on failure.
+        Raises :exc:`~siseli.exceptions.AuthenticationError` on HTTP-level
+        auth failures (4xx).  Raises :exc:`~siseli.exceptions.NetworkError`
+        on network / timeout errors so callers can distinguish the two cases.
         """
+        endpoint = "/apis/login/account"
+        _LOGGER.debug("Siseli auth: POST %s (account=%r)", endpoint, self._account)
+
         try:
             response = await http.post(
-                "/apis/login/account",
+                endpoint,
                 json={"account": self._account, "password": self._password_hash},
             )
-            response.raise_for_status()
+        except httpx.TimeoutException as exc:
+            _LOGGER.warning("Siseli auth: request timed out for account=%r", self._account)
+            raise NetworkError(f"Login request timed out: {exc}") from exc
         except httpx.HTTPError as exc:
-            raise AuthenticationError(f"Login request failed: {exc}") from exc
+            _LOGGER.warning(
+                "Siseli auth: network error for account=%r: %s", self._account, exc
+            )
+            raise NetworkError(f"Login request failed: {exc}") from exc
+
+        http_status = response.status_code
+        _LOGGER.debug(
+            "Siseli auth: response status=%d for account=%r", http_status, self._account
+        )
+
+        # For HTTP error responses, extract a safe diagnostic message and raise
+        # AuthenticationError (4xx) or NetworkError (5xx).
+        if not response.is_success:
+            api_message = _extract_api_message(response)
+            _LOGGER.warning(
+                "Siseli auth: failed for account=%r — HTTP %d%s",
+                self._account,
+                http_status,
+                f", api_message={api_message!r}" if api_message else "",
+            )
+            diag = f"HTTP {http_status}"
+            if api_message:
+                diag = f"{diag}: {api_message}"
+            if http_status >= 500:
+                raise NetworkError(f"Login request failed: {diag}")
+            raise AuthenticationError(
+                f"Login failed: {diag}",
+                http_status=http_status,
+                api_message=api_message,
+            )
 
         body = response.json()
         if body.get("code") != 0:
+            api_message = body.get("message") or body.get("error") or body.get("detail")
+            if api_message:
+                api_message = str(api_message)
+            _LOGGER.warning(
+                "Siseli auth: API returned non-zero code=%r for account=%r, message=%r",
+                body.get("code"),
+                self._account,
+                api_message,
+            )
             raise AuthenticationError(
-                f"Login failed (code {body.get('code')}): {body.get('message')}"
+                f"Login failed (code {body.get('code')}): {api_message}",
+                http_status=http_status,
+                api_message=api_message,
             )
 
         data = body["data"]
@@ -68,6 +140,7 @@ class Auth:
             account=data.get("account", self._account),
             user_id=data.get("userId", ""),
         )
+        _LOGGER.debug("Siseli auth: login successful for account=%r", self._account)
         return self._token_info
 
     @property

siseli/const.py

@@ -3,3 +3,7 @@ DEFAULT_TIMEOUT = 30.0
 DEFAULT_PAGE_SIZE = 20
 # dataSource=1 observed in all telemetry requests in HAR captures
 DEFAULT_DATA_SOURCE = 1
+
+# Production Siseli Open API application credentials from the official web client.
+SISELI_APP_ID = "rBrTRfAPXz"
+SISELI_APP_SECRET_ENCRYPTED = "I4D0KRr2339z3pQ/at91V9BpFAOe54DaTafwSm6suIQ="

siseli/exceptions.py

@@ -8,7 +8,26 @@ class SiseliError(Exception):
 
 
 class AuthenticationError(SiseliError):
-    """Raised when authentication fails."""
+    """Raised when authentication fails.
+
+    Attributes:
+        http_status: HTTP status code returned by the server, or *None* when
+            the failure occurred before a response was received.
+        api_message: Short error message extracted from the API response body
+            (e.g. the ``message`` or ``error`` field), or *None* when
+            unavailable.  Never contains passwords, tokens, or other secrets.
+    """
+
+    def __init__(
+        self,
+        message: str,
+        *,
+        http_status: int | None = None,
+        api_message: str | None = None,
+    ) -> None:
+        self.http_status = http_status
+        self.api_message = api_message
+        super().__init__(message)
 
 
 class TokenExpiredError(AuthenticationError):

siseli/open_auth.py

@@ -0,0 +1,177 @@
+"""Siseli Open API request signing helpers.
+
+Every API request must carry IOT-Open-* headers that prove the caller holds a
+valid application credential.  The signing algorithm mirrors the official web
+client (CryptoJS-based) exactly:
+
+1. Decrypt the base64-encoded app secret with AES-128-CBC.
+   Key and IV are derived from MD5(app_id) as ASCII hex chars.
+2. Compute a body hash: empty string for GET; SHA-256 hex for everything else.
+3. Collect query params, inject the three open-auth fields, sort by key,
+   serialise without URL-encoding, hex-encode the UTF-8 bytes.
+4. Sign: HMAC-SHA256(hex_string, secret) → MD5 → lowercase hex.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import uuid
+from typing import TYPE_CHECKING, Any
+from urllib.parse import parse_qs
+
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+
+from .const import SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED
+
+if TYPE_CHECKING:
+    import httpx
+
+
+def decrypt_open_secret(app_id: str, encrypted_secret_b64: str) -> str:
+    """Decrypt the base64-encoded app secret using AES-128-CBC.
+
+    The AES key and IV are derived from MD5(app_id).lower():
+    - first 16 hex chars → 16 ASCII bytes → AES key
+    - last  16 hex chars → 16 ASCII bytes → IV
+
+    ZeroPadding is assumed: trailing null bytes are stripped from the output.
+    """
+    import base64
+
+    md5_hex = hashlib.md5(app_id.encode()).hexdigest()  # noqa: S324
+    key = md5_hex[:16].encode("ascii")
+    iv = md5_hex[16:].encode("ascii")
+
+    encrypted_bytes = base64.b64decode(encrypted_secret_b64)
+    cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
+    decryptor = cipher.decryptor()
+    plaintext = decryptor.update(encrypted_bytes) + decryptor.finalize()
+    return plaintext.rstrip(b"\x00").decode("utf-8")
+
+
+def _sha256_hex(data: bytes) -> str:
+    """Return the lowercase hex SHA-256 digest of *data*."""
+    return hashlib.sha256(data).hexdigest()
+
+
+def build_open_headers(
+    *,
+    method: str,
+    query: str,
+    body: bytes | None,
+    app_id: str,
+    app_secret: str,
+    timezone: str,
+    nonce: str,
+) -> dict[str, str]:
+    """Build the IOT-Open-* headers (and IOT-Time-Zone) for a single request.
+
+    Parameters
+    ----------
+    method:
+        HTTP method ("GET", "POST", …).
+    query:
+        The raw query string portion of the URL (without the leading "?").
+    body:
+        Raw request body bytes, or *None* / empty for GET requests.
+    app_id:
+        The application ID (``IOT-Open-AppID``).
+    app_secret:
+        The *decrypted* application secret used as the HMAC key.
+    timezone:
+        The client timezone string, e.g. "UTC" or "Europe/Moscow".
+    nonce:
+        A unique string per request (UUID hex recommended).
+    """
+    # --- body hash -----------------------------------------------------------
+    if method.upper() == "GET":
+        body_hash = ""
+    else:
+        body_hash = _sha256_hex(body if body else b"")
+
+    # --- params for the sign input -------------------------------------------
+    params: dict[str, str] = {}
+    if query:
+        for key, values in parse_qs(query, keep_blank_values=True).items():
+            params[key] = values[0]
+
+    # Remove any stale open-auth fields so they cannot influence the new sign.
+    for field in ("IOT-Open-AppID", "IOT-Open-Nonce", "IOT-Open-Sign", "IOT-Open-Body-Hash"):
+        params.pop(field, None)
+
+    params["IOT-Open-AppID"] = app_id
+    params["IOT-Open-Nonce"] = nonce
+    params["IOT-Open-Body-Hash"] = body_hash
+
+    # Sort alphabetically (case-sensitive, matching JS default sort order).
+    query_str = "&".join(f"{k}={v}" for k, v in sorted(params.items()))
+
+    # --- sign ----------------------------------------------------------------
+    # CryptoJS: Utf8.parse(query_str) → Hex.stringify → hex_string
+    # Then: HmacSHA256(hex_string, secret) → MD5 → hex
+    hex_str = query_str.encode("utf-8").hex()
+    hmac_digest = hmac.new(
+        app_secret.encode("utf-8"),
+        hex_str.encode("utf-8"),
+        hashlib.sha256,
+    ).digest()
+    sign = hashlib.md5(hmac_digest).hexdigest()  # noqa: S324
+
+    return {
+        "IOT-Time-Zone": timezone,
+        "IOT-Open-AppID": app_id,
+        "IOT-Open-Nonce": nonce,
+        "IOT-Open-Body-Hash": body_hash,
+        "IOT-Open-Sign": sign,
+    }
+
+
+def attach_open_auth(
+    client: Any,
+    *,
+    app_id: str = SISELI_APP_ID,
+    encrypted_secret: str = SISELI_APP_SECRET_ENCRYPTED,
+) -> None:
+    """Attach an httpx request hook that adds Open API signing headers.
+
+    The hook is appended to ``client._http.event_hooks["request"]`` and runs
+    before every outgoing request, injecting:
+
+    - ``IOT-Time-Zone``
+    - ``IOT-Open-AppID``
+    - ``IOT-Open-Nonce``
+    - ``IOT-Open-Body-Hash``
+    - ``IOT-Open-Sign``
+
+    Parameters
+    ----------
+    client:
+        A :class:`~siseli.SiseliClient` instance (or any object with
+        ``._http.event_hooks`` and ``._timezone``).
+    app_id:
+        Override the default production App ID.
+    encrypted_secret:
+        Override the default production encrypted secret.
+    """
+    secret = decrypt_open_secret(app_id, encrypted_secret)
+    timezone = getattr(client, "_timezone", "UTC")
+
+    async def _sign_request(request: "httpx.Request") -> None:
+        nonce = uuid.uuid4().hex
+        query = request.url.query
+        if isinstance(query, bytes):
+            query = query.decode("utf-8")
+        body = request.content if request.method.upper() != "GET" else None
+        headers = build_open_headers(
+            method=request.method,
+            query=query,
+            body=body,
+            app_id=app_id,
+            app_secret=secret,
+            timezone=timezone,
+            nonce=nonce,
+        )
+        request.headers.update(headers)
+
+    client._http.event_hooks["request"].append(_sign_request)