python-siseli 0.1.0__tar.gz → 0.2.0__tar.gz

{python_siseli-0.1.0 → python_siseli-0.2.0}/PKG-INFO

@@ -1,11 +1,12 @@
 Metadata-Version: 2.4
 Name: python-siseli
-Version: 0.1.0
+Version: 0.2.0
 Summary: Python SDK for Siseli Cloud
 License: MIT
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 Requires-Dist: httpx>=0.27
+Requires-Dist: cryptography>=42
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"

{python_siseli-0.1.0 → python_siseli-0.2.0}/pyproject.toml

@@ -4,13 +4,14 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-siseli"
-version = "0.1.0"
+version = "0.2.0"
 description = "Python SDK for Siseli Cloud"
 readme = "README.md"
 requires-python = ">=3.11"
 license = { text = "MIT" }
 dependencies = [
     "httpx>=0.27",
+    "cryptography>=42",
 ]
 
 [project.optional-dependencies]

{python_siseli-0.1.0 → python_siseli-0.2.0}/python_siseli.egg-info/PKG-INFO

@@ -1,11 +1,12 @@
 Metadata-Version: 2.4
 Name: python-siseli
-Version: 0.1.0
+Version: 0.2.0
 Summary: Python SDK for Siseli Cloud
 License: MIT
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 Requires-Dist: httpx>=0.27
+Requires-Dist: cryptography>=42
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"

{python_siseli-0.1.0 → python_siseli-0.2.0}/python_siseli.egg-info/SOURCES.txt

@@ -17,6 +17,7 @@ siseli/device.py
 siseli/dictionary.py
 siseli/exceptions.py
 siseli/history.py
+siseli/open_auth.py
 siseli/state.py
 siseli/station.py
 siseli/models/__init__.py
@@ -30,4 +31,6 @@ siseli/models/dictionary.py
 siseli/models/history.py
 siseli/models/state.py
 siseli/models/station.py
+tests/test_auth.py
+tests/test_open_auth.py
 tests/test_phase3.py

{python_siseli-0.1.0 → python_siseli-0.2.0}/python_siseli.egg-info/requires.txt

@@ -1,4 +1,5 @@
 httpx>=0.27
+cryptography>=42
 
 [dev]
 pytest>=8

{python_siseli-0.1.0 → python_siseli-0.2.0}/siseli/__init__.py

@@ -1,6 +1,7 @@
 """python-siseli — Python SDK for Siseli Cloud."""
 
 from .client import SiseliClient
+from .open_auth import attach_open_auth
 from .exceptions import ApiError, AuthenticationError, NetworkError, SiseliError, TokenExpiredError
 from .models import (
     Alarm,
@@ -25,6 +26,7 @@ from .models import (
 
 __all__ = [
     "SiseliClient",
+    "attach_open_auth",
     "SiseliError",
     "AuthenticationError",
     "TokenExpiredError",

python_siseli-0.2.0/siseli/auth.py

@@ -0,0 +1,169 @@
+"""Authentication: login and token lifecycle management."""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+from datetime import UTC, datetime
+
+import httpx
+
+from .exceptions import AuthenticationError, NetworkError
+from .models.auth import TokenInfo
+
+_LOGGER = logging.getLogger(__name__)
+
+
+def _md5(text: str) -> str:
+    # The Siseli Cloud API requires the MD5 hash of the plaintext password.
+    # This is a protocol constraint imposed by the server, not a local
+    # password-storage decision.  The hash is sent over HTTPS and is never
+    # stored on disk.
+    return hashlib.md5(text.encode()).hexdigest()  # noqa: S324
+
+
+def _parse_dt(value: str | None) -> datetime | None:
+    if not value:
+        return None
+    return datetime.fromisoformat(value.replace("Z", "+00:00"))
+
+
+def _extract_api_message(response: httpx.Response) -> str | None:
+    """Extract a safe, short error message from an HTTP error response.
+
+    Tries to parse the body as JSON and returns the value of the first
+    recognised error field (``error``, ``message``, ``detail``).  Falls back
+    to the first 200 characters of the raw text body so there is always
+    *something* useful in logs.  Never returns passwords, tokens, or auth
+    headers — those are never present in response bodies.
+    """
+    try:
+        body = response.json()
+        if isinstance(body, dict):
+            for key in ("error", "message", "detail"):
+                value = body.get(key)
+                if value and isinstance(value, str):
+                    return value[:200]
+    except Exception:  # noqa: BLE001
+        pass
+    text = (response.text or "").strip()
+    return text[:200] if text else None
+
+
+class Auth:
+    """Manages credentials and the current access token.
+
+    The password is hashed with MD5 before being sent to the API, which
+    matches the behaviour observed in the browser client.
+    """
+
+    def __init__(self, account: str, password: str) -> None:
+        self._account = account
+        # The web client sends the MD5 hash of the plaintext password.
+        self._password_hash = _md5(password)
+        self._token_info: TokenInfo | None = None
+
+    async def login(self, http: httpx.AsyncClient) -> TokenInfo:
+        """Authenticate and store the returned tokens.
+
+        Raises :exc:`~siseli.exceptions.AuthenticationError` on HTTP-level
+        auth failures (4xx).  Raises :exc:`~siseli.exceptions.NetworkError`
+        on network / timeout errors so callers can distinguish the two cases.
+        """
+        endpoint = "/apis/login/account"
+        _LOGGER.debug("Siseli auth: POST %s (account=%r)", endpoint, self._account)
+
+        try:
+            response = await http.post(
+                endpoint,
+                json={"account": self._account, "password": self._password_hash},
+            )
+        except httpx.TimeoutException as exc:
+            _LOGGER.warning("Siseli auth: request timed out for account=%r", self._account)
+            raise NetworkError(f"Login request timed out: {exc}") from exc
+        except httpx.HTTPError as exc:
+            _LOGGER.warning(
+                "Siseli auth: network error for account=%r: %s", self._account, exc
+            )
+            raise NetworkError(f"Login request failed: {exc}") from exc
+
+        http_status = response.status_code
+        _LOGGER.debug(
+            "Siseli auth: response status=%d for account=%r", http_status, self._account
+        )
+
+        # For HTTP error responses, extract a safe diagnostic message and raise
+        # AuthenticationError (4xx) or NetworkError (5xx).
+        if not response.is_success:
+            api_message = _extract_api_message(response)
+            _LOGGER.warning(
+                "Siseli auth: failed for account=%r — HTTP %d%s",
+                self._account,
+                http_status,
+                f", api_message={api_message!r}" if api_message else "",
+            )
+            diag = f"HTTP {http_status}"
+            if api_message:
+                diag = f"{diag}: {api_message}"
+            if http_status >= 500:
+                raise NetworkError(f"Login request failed: {diag}")
+            raise AuthenticationError(
+                f"Login failed: {diag}",
+                http_status=http_status,
+                api_message=api_message,
+            )
+
+        body = response.json()
+        if body.get("code") != 0:
+            api_message = body.get("message") or body.get("error") or body.get("detail")
+            if api_message:
+                api_message = str(api_message)
+            _LOGGER.warning(
+                "Siseli auth: API returned non-zero code=%r for account=%r, message=%r",
+                body.get("code"),
+                self._account,
+                api_message,
+            )
+            raise AuthenticationError(
+                f"Login failed (code {body.get('code')}): {api_message}",
+                http_status=http_status,
+                api_message=api_message,
+            )
+
+        data = body["data"]
+        self._token_info = TokenInfo(
+            access_token=data["accessToken"],
+            refresh_token=data["refreshToken"],
+            access_token_expires_at=_parse_dt(data.get("accessTokenWillExpiredAt")),
+            refresh_token_expires_at=_parse_dt(data.get("refreshTokenWillExpiredAt")),
+            auth_id=data.get("authId", ""),
+            account=data.get("account", self._account),
+            user_id=data.get("userId", ""),
+        )
+        _LOGGER.debug("Siseli auth: login successful for account=%r", self._account)
+        return self._token_info
+
+    @property
+    def access_token(self) -> str:
+        """Return the current access token.
+
+        Raises :exc:`~siseli.exceptions.AuthenticationError` if not yet
+        authenticated.
+        """
+        if self._token_info is None:
+            raise AuthenticationError("Not authenticated — call authenticate() first")
+        return self._token_info.access_token
+
+    @property
+    def token_info(self) -> TokenInfo | None:
+        """Return token metadata, or *None* if not authenticated."""
+        return self._token_info
+
+    def is_authenticated(self) -> bool:
+        """Return *True* when there is a valid, non-expired access token."""
+        if self._token_info is None:
+            return False
+        expires_at = self._token_info.access_token_expires_at
+        if expires_at is None:
+            return True
+        return datetime.now(UTC) < expires_at

python_siseli-0.2.0/siseli/const.py

@@ -0,0 +1,9 @@
+BASE_URL = "https://solar.siseli.com"
+DEFAULT_TIMEOUT = 30.0
+DEFAULT_PAGE_SIZE = 20
+# dataSource=1 observed in all telemetry requests in HAR captures
+DEFAULT_DATA_SOURCE = 1
+
+# Production Siseli Open API application credentials from the official web client.
+SISELI_APP_ID = "rBrTRfAPXz"
+SISELI_APP_SECRET_ENCRYPTED = "I4D0KRr2339z3pQ/at91V9BpFAOe54DaTafwSm6suIQ="

{python_siseli-0.1.0 → python_siseli-0.2.0}/siseli/exceptions.py

@@ -8,7 +8,26 @@ class SiseliError(Exception):
 
 
 class AuthenticationError(SiseliError):
-    """Raised when authentication fails."""
+    """Raised when authentication fails.
+
+    Attributes:
+        http_status: HTTP status code returned by the server, or *None* when
+            the failure occurred before a response was received.
+        api_message: Short error message extracted from the API response body
+            (e.g. the ``message`` or ``error`` field), or *None* when
+            unavailable.  Never contains passwords, tokens, or other secrets.
+    """
+
+    def __init__(
+        self,
+        message: str,
+        *,
+        http_status: int | None = None,
+        api_message: str | None = None,
+    ) -> None:
+        self.http_status = http_status
+        self.api_message = api_message
+        super().__init__(message)
 
 
 class TokenExpiredError(AuthenticationError):

python_siseli-0.2.0/siseli/open_auth.py

@@ -0,0 +1,177 @@
+"""Siseli Open API request signing helpers.
+
+Every API request must carry IOT-Open-* headers that prove the caller holds a
+valid application credential.  The signing algorithm mirrors the official web
+client (CryptoJS-based) exactly:
+
+1. Decrypt the base64-encoded app secret with AES-128-CBC.
+   Key and IV are derived from MD5(app_id) as ASCII hex chars.
+2. Compute a body hash: empty string for GET; SHA-256 hex for everything else.
+3. Collect query params, inject the three open-auth fields, sort by key,
+   serialise without URL-encoding, hex-encode the UTF-8 bytes.
+4. Sign: HMAC-SHA256(hex_string, secret) → MD5 → lowercase hex.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import uuid
+from typing import TYPE_CHECKING, Any
+from urllib.parse import parse_qs
+
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+
+from .const import SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED
+
+if TYPE_CHECKING:
+    import httpx
+
+
+def decrypt_open_secret(app_id: str, encrypted_secret_b64: str) -> str:
+    """Decrypt the base64-encoded app secret using AES-128-CBC.
+
+    The AES key and IV are derived from MD5(app_id).lower():
+    - first 16 hex chars → 16 ASCII bytes → AES key
+    - last  16 hex chars → 16 ASCII bytes → IV
+
+    ZeroPadding is assumed: trailing null bytes are stripped from the output.
+    """
+    import base64
+
+    md5_hex = hashlib.md5(app_id.encode()).hexdigest()  # noqa: S324
+    key = md5_hex[:16].encode("ascii")
+    iv = md5_hex[16:].encode("ascii")
+
+    encrypted_bytes = base64.b64decode(encrypted_secret_b64)
+    cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
+    decryptor = cipher.decryptor()
+    plaintext = decryptor.update(encrypted_bytes) + decryptor.finalize()
+    return plaintext.rstrip(b"\x00").decode("utf-8")
+
+
+def _sha256_hex(data: bytes) -> str:
+    """Return the lowercase hex SHA-256 digest of *data*."""
+    return hashlib.sha256(data).hexdigest()
+
+
+def build_open_headers(
+    *,
+    method: str,
+    query: str,
+    body: bytes | None,
+    app_id: str,
+    app_secret: str,
+    timezone: str,
+    nonce: str,
+) -> dict[str, str]:
+    """Build the IOT-Open-* headers (and IOT-Time-Zone) for a single request.
+
+    Parameters
+    ----------
+    method:
+        HTTP method ("GET", "POST", …).
+    query:
+        The raw query string portion of the URL (without the leading "?").
+    body:
+        Raw request body bytes, or *None* / empty for GET requests.
+    app_id:
+        The application ID (``IOT-Open-AppID``).
+    app_secret:
+        The *decrypted* application secret used as the HMAC key.
+    timezone:
+        The client timezone string, e.g. "UTC" or "Europe/Moscow".
+    nonce:
+        A unique string per request (UUID hex recommended).
+    """
+    # --- body hash -----------------------------------------------------------
+    if method.upper() == "GET":
+        body_hash = ""
+    else:
+        body_hash = _sha256_hex(body if body else b"")
+
+    # --- params for the sign input -------------------------------------------
+    params: dict[str, str] = {}
+    if query:
+        for key, values in parse_qs(query, keep_blank_values=True).items():
+            params[key] = values[0]
+
+    # Remove any stale open-auth fields so they cannot influence the new sign.
+    for field in ("IOT-Open-AppID", "IOT-Open-Nonce", "IOT-Open-Sign", "IOT-Open-Body-Hash"):
+        params.pop(field, None)
+
+    params["IOT-Open-AppID"] = app_id
+    params["IOT-Open-Nonce"] = nonce
+    params["IOT-Open-Body-Hash"] = body_hash
+
+    # Sort alphabetically (case-sensitive, matching JS default sort order).
+    query_str = "&".join(f"{k}={v}" for k, v in sorted(params.items()))
+
+    # --- sign ----------------------------------------------------------------
+    # CryptoJS: Utf8.parse(query_str) → Hex.stringify → hex_string
+    # Then: HmacSHA256(hex_string, secret) → MD5 → hex
+    hex_str = query_str.encode("utf-8").hex()
+    hmac_digest = hmac.new(
+        app_secret.encode("utf-8"),
+        hex_str.encode("utf-8"),
+        hashlib.sha256,
+    ).digest()
+    sign = hashlib.md5(hmac_digest).hexdigest()  # noqa: S324
+
+    return {
+        "IOT-Time-Zone": timezone,
+        "IOT-Open-AppID": app_id,
+        "IOT-Open-Nonce": nonce,
+        "IOT-Open-Body-Hash": body_hash,
+        "IOT-Open-Sign": sign,
+    }
+
+
+def attach_open_auth(
+    client: Any,
+    *,
+    app_id: str = SISELI_APP_ID,
+    encrypted_secret: str = SISELI_APP_SECRET_ENCRYPTED,
+) -> None:
+    """Attach an httpx request hook that adds Open API signing headers.
+
+    The hook is appended to ``client._http.event_hooks["request"]`` and runs
+    before every outgoing request, injecting:
+
+    - ``IOT-Time-Zone``
+    - ``IOT-Open-AppID``
+    - ``IOT-Open-Nonce``
+    - ``IOT-Open-Body-Hash``
+    - ``IOT-Open-Sign``
+
+    Parameters
+    ----------
+    client:
+        A :class:`~siseli.SiseliClient` instance (or any object with
+        ``._http.event_hooks`` and ``._timezone``).
+    app_id:
+        Override the default production App ID.
+    encrypted_secret:
+        Override the default production encrypted secret.
+    """
+    secret = decrypt_open_secret(app_id, encrypted_secret)
+    timezone = getattr(client, "_timezone", "UTC")
+
+    async def _sign_request(request: "httpx.Request") -> None:
+        nonce = uuid.uuid4().hex
+        query = request.url.query
+        if isinstance(query, bytes):
+            query = query.decode("utf-8")
+        body = request.content if request.method.upper() != "GET" else None
+        headers = build_open_headers(
+            method=request.method,
+            query=query,
+            body=body,
+            app_id=app_id,
+            app_secret=secret,
+            timezone=timezone,
+            nonce=nonce,
+        )
+        request.headers.update(headers)
+
+    client._http.event_hooks["request"].append(_sign_request)

python_siseli-0.2.0/tests/test_auth.py

@@ -0,0 +1,297 @@
+"""Tests for diagnostic logging and error handling in Auth.login()."""
+
+from __future__ import annotations
+
+import pytest
+import httpx
+
+from siseli.auth import Auth, _extract_api_message
+from siseli.exceptions import AuthenticationError, NetworkError
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+_GOOD_BODY = {
+    "code": 0,
+    "data": {
+        "accessToken": "tok-access",
+        "refreshToken": "tok-refresh",
+        "accessTokenWillExpiredAt": None,
+        "refreshTokenWillExpiredAt": None,
+        "authId": "auth-1",
+        "account": "user@example.com",
+        "userId": "uid-1",
+    },
+}
+
+
+def _make_response(status_code: int, json_body: object | None = None, text: str = "") -> httpx.Response:
+    """Build a minimal fake httpx.Response."""
+    import json as _json
+
+    if json_body is not None:
+        content = _json.dumps(json_body).encode()
+        headers = {"content-type": "application/json"}
+    else:
+        content = text.encode()
+        headers = {"content-type": "text/plain"}
+
+    return httpx.Response(
+        status_code=status_code,
+        content=content,
+        headers=headers,
+        request=httpx.Request("POST", "https://example.com/apis/login/account"),
+    )
+
+
+class _FakeAsyncClient:
+    """Minimal async HTTP client stub."""
+
+    def __init__(self, response: httpx.Response | Exception) -> None:
+        self._response = response
+        self.last_request_json: dict | None = None
+
+    async def post(self, url: str, *, json: dict | None = None, **_: object) -> httpx.Response:
+        self.last_request_json = json
+        if isinstance(self._response, Exception):
+            raise self._response
+        return self._response
+
+
+# ---------------------------------------------------------------------------
+# _extract_api_message
+# ---------------------------------------------------------------------------
+
+
+def test_extract_api_message_json_error_field() -> None:
+    resp = _make_response(401, json_body={"error": "invalid_credentials"})
+    assert _extract_api_message(resp) == "invalid_credentials"
+
+
+def test_extract_api_message_json_message_field() -> None:
+    resp = _make_response(401, json_body={"message": "Bad password"})
+    assert _extract_api_message(resp) == "Bad password"
+
+
+def test_extract_api_message_json_detail_field() -> None:
+    resp = _make_response(403, json_body={"detail": "Account locked"})
+    assert _extract_api_message(resp) == "Account locked"
+
+
+def test_extract_api_message_prefers_error_over_message() -> None:
+    resp = _make_response(401, json_body={"error": "first", "message": "second"})
+    assert _extract_api_message(resp) == "first"
+
+
+def test_extract_api_message_plain_text_fallback() -> None:
+    resp = _make_response(500, text="Internal Server Error")
+    assert _extract_api_message(resp) == "Internal Server Error"
+
+
+def test_extract_api_message_truncates_long_text() -> None:
+    long_text = "x" * 300
+    resp = _make_response(500, text=long_text)
+    result = _extract_api_message(resp)
+    assert result is not None
+    assert len(result) == 200
+
+
+def test_extract_api_message_empty_body() -> None:
+    resp = _make_response(401, text="")
+    assert _extract_api_message(resp) is None
+
+
+# ---------------------------------------------------------------------------
+# Auth.login — HTTP error status codes
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_login_401_raises_authentication_error_with_status() -> None:
+    response = _make_response(401, json_body={"error": "invalid_credentials"})
+    client = _FakeAsyncClient(response)
+
+    auth = Auth("user@example.com", "secret")
+    with pytest.raises(AuthenticationError) as exc_info:
+        await auth.login(client)
+
+    err = exc_info.value
+    assert err.http_status == 401
+    assert err.api_message == "invalid_credentials"
+    assert "401" in str(err)
+    assert "invalid_credentials" in str(err)
+
+
+@pytest.mark.asyncio
+async def test_login_403_raises_authentication_error() -> None:
+    response = _make_response(403, json_body={"message": "Account disabled"})
+    client = _FakeAsyncClient(response)
+
+    auth = Auth("user@example.com", "secret")
+    with pytest.raises(AuthenticationError) as exc_info:
+        await auth.login(client)
+
+    err = exc_info.value
+    assert err.http_status == 403
+    assert err.api_message == "Account disabled"
+    assert "403" in str(err)
+
+
+@pytest.mark.asyncio
+async def test_login_429_raises_authentication_error() -> None:
+    response = _make_response(429, json_body={"message": "Too Many Requests"})
+    client = _FakeAsyncClient(response)
+
+    auth = Auth("user@example.com", "secret")
+    with pytest.raises(AuthenticationError) as exc_info:
+        await auth.login(client)
+
+    err = exc_info.value
+    assert err.http_status == 429
+    assert err.api_message == "Too Many Requests"
+
+
+@pytest.mark.asyncio
+async def test_login_5xx_raises_network_error() -> None:
+    response = _make_response(503, json_body={"error": "Service unavailable"})
+    client = _FakeAsyncClient(response)
+
+    auth = Auth("user@example.com", "secret")
+    with pytest.raises(NetworkError) as exc_info:
+        await auth.login(client)
+
+    assert "503" in str(exc_info.value)
+
+
+@pytest.mark.asyncio
+async def test_login_500_raises_network_error_not_auth_error() -> None:
+    response = _make_response(500, text="Internal Server Error")
+    client = _FakeAsyncClient(response)
+
+    auth = Auth("user@example.com", "secret")
+    with pytest.raises(NetworkError):
+        await auth.login(client)
+
+
+# ---------------------------------------------------------------------------
+# Auth.login — network / timeout errors
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_login_timeout_raises_network_error() -> None:
+    client = _FakeAsyncClient(httpx.TimeoutException("timed out"))
+
+    auth = Auth("user@example.com", "secret")
+    with pytest.raises(NetworkError) as exc_info:
+        await auth.login(client)
+
+    assert "timed out" in str(exc_info.value).lower() or "timeout" in str(exc_info.value).lower()
+
+
+@pytest.mark.asyncio
+async def test_login_connection_error_raises_network_error() -> None:
+    client = _FakeAsyncClient(httpx.ConnectError("connection refused"))
+
+    auth = Auth("user@example.com", "secret")
+    with pytest.raises(NetworkError):
+        await auth.login(client)
+
+
+# ---------------------------------------------------------------------------
+# Auth.login — non-zero API code (HTTP 200 but code != 0)
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_login_api_nonzero_code_raises_auth_error() -> None:
+    response = _make_response(200, json_body={"code": 10001, "message": "Wrong credentials"})
+    client = _FakeAsyncClient(response)
+
+    auth = Auth("user@example.com", "secret")
+    with pytest.raises(AuthenticationError) as exc_info:
+        await auth.login(client)
+
+    err = exc_info.value
+    assert err.http_status == 200
+    assert err.api_message == "Wrong credentials"
+    assert "10001" in str(err)
+    assert "Wrong credentials" in str(err)
+
+
+# ---------------------------------------------------------------------------
+# Auth.login — no secrets in error messages
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_login_error_message_does_not_contain_password() -> None:
+    response = _make_response(401, json_body={"error": "invalid_credentials"})
+    client = _FakeAsyncClient(response)
+
+    password = "s3cr3tpassword"
+    auth = Auth("user@example.com", password)
+    with pytest.raises(AuthenticationError) as exc_info:
+        await auth.login(client)
+
+    assert password not in str(exc_info.value)
+    # MD5 hash should not appear either (it's the sent value, not in response)
+    import hashlib
+    md5_hash = hashlib.md5(password.encode()).hexdigest()  # noqa: S324
+    assert md5_hash not in str(exc_info.value)
+
+
+@pytest.mark.asyncio
+async def test_login_request_does_not_send_plaintext_password() -> None:
+    """Verify the login request sends MD5 hash, not the plaintext password."""
+    response = _make_response(200, json_body=_GOOD_BODY)
+    client = _FakeAsyncClient(response)
+
+    password = "plaintext_password"
+    auth = Auth("user@example.com", password)
+    await auth.login(client)
+
+    assert client.last_request_json is not None
+    assert client.last_request_json.get("password") != password
+
+
+# ---------------------------------------------------------------------------
+# Auth.login — successful login
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_login_success_returns_token_info() -> None:
+    response = _make_response(200, json_body=_GOOD_BODY)
+    client = _FakeAsyncClient(response)
+
+    auth = Auth("user@example.com", "secret")
+    token_info = await auth.login(client)
+
+    assert token_info.access_token == "tok-access"
+    assert token_info.refresh_token == "tok-refresh"
+    assert auth.is_authenticated()
+
+
+# ---------------------------------------------------------------------------
+# AuthenticationError attributes
+# ---------------------------------------------------------------------------
+
+
+def test_authentication_error_attributes() -> None:
+    err = AuthenticationError(
+        "Login failed: HTTP 401: invalid_credentials",
+        http_status=401,
+        api_message="invalid_credentials",
+    )
+    assert err.http_status == 401
+    assert err.api_message == "invalid_credentials"
+    assert "401" in str(err)
+
+
+def test_authentication_error_defaults() -> None:
+    err = AuthenticationError("Not authenticated")
+    assert err.http_status is None
+    assert err.api_message is None

python_siseli-0.2.0/tests/test_open_auth.py

@@ -0,0 +1,137 @@
+"""Tests for Siseli Open API signing helpers."""
+
+from __future__ import annotations
+
+import hashlib
+
+import httpx
+import pytest
+
+from siseli.const import SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED
+from siseli.open_auth import (
+    _sha256_hex,
+    attach_open_auth,
+    build_open_headers,
+    decrypt_open_secret,
+)
+
+
+class _MockHttpClient:
+    def __init__(self) -> None:
+        self.event_hooks = {"request": []}
+
+
+class _MockSiseliClient:
+    _timezone = "Europe/Moscow"
+
+    def __init__(self) -> None:
+        self._http = _MockHttpClient()
+
+
+def test_decrypt_open_secret_with_app_id() -> None:
+    """Encrypted Open secret is decrypted with AppID-derived key/IV."""
+    assert (
+        decrypt_open_secret(SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED)
+        == "CJbrtLtqFES62bJ3ZW7c"
+    )
+
+
+def test_get_request_signing_uses_empty_body_hash() -> None:
+    """GET requests must sign with an empty body hash."""
+    secret = decrypt_open_secret(SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED)
+    headers = build_open_headers(
+        method="GET",
+        query="b=2&a=1",
+        body=None,
+        app_id=SISELI_APP_ID,
+        app_secret=secret,
+        timezone="UTC",
+        nonce="nonce-123",
+    )
+    assert headers["IOT-Open-Body-Hash"] == ""
+    assert headers["IOT-Open-Sign"] == "bee1c1c32629baf72be698fbe53fdc11"
+
+
+def test_post_request_signing_with_json_body() -> None:
+    """POST requests must hash and sign the raw JSON body bytes."""
+    secret = decrypt_open_secret(SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED)
+    body = b'{"name":"abc","value":123}'
+    headers = build_open_headers(
+        method="POST",
+        query="z=9",
+        body=body,
+        app_id=SISELI_APP_ID,
+        app_secret=secret,
+        timezone="UTC",
+        nonce="nonce-123",
+    )
+    assert headers["IOT-Open-Body-Hash"] == hashlib.sha256(body).hexdigest()
+    assert headers["IOT-Open-Sign"] == "1f3525cce7ea5fa378409070c17f0076"
+
+
+def test_unicode_json_body_signing() -> None:
+    """Unicode body content must be hashed/signatured as UTF-8 bytes."""
+    secret = decrypt_open_secret(SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED)
+    body = '{"text":"Привет 🌞"}'.encode()
+    headers = build_open_headers(
+        method="POST",
+        query="",
+        body=body,
+        app_id=SISELI_APP_ID,
+        app_secret=secret,
+        timezone="UTC",
+        nonce="nonce-123",
+    )
+    assert headers["IOT-Open-Body-Hash"] == hashlib.sha256(body).hexdigest()
+    assert headers["IOT-Open-Sign"] == "8d4c8f2771f9f7f419fd4cbec1d0f1e6"
+
+
+def test_empty_post_body_signing() -> None:
+    """Empty POST body must use SHA256 of empty bytes."""
+    secret = decrypt_open_secret(SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED)
+    headers = build_open_headers(
+        method="POST",
+        query="x=",
+        body=b"",
+        app_id=SISELI_APP_ID,
+        app_secret=secret,
+        timezone="UTC",
+        nonce="nonce-123",
+    )
+    assert (
+        headers["IOT-Open-Body-Hash"]
+        == "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    )
+    assert headers["IOT-Open-Sign"] == "9f8506bc2a8f3da76eebc4f99691d271"
+
+
+@pytest.mark.asyncio
+async def test_header_generation_includes_required_iot_open_values() -> None:
+    """Request hook injects required IOT-Open-* and timezone headers."""
+    secret = decrypt_open_secret(SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED)
+
+    client = _MockSiseliClient()
+    attach_open_auth(client)
+    assert len(client._http.event_hooks["request"]) == 1
+
+    request = httpx.Request(
+        "POST",
+        "https://solar.siseli.com/apis/login/account",
+        content=b'{"account":"u","password":"p"}',
+    )
+    await client._http.event_hooks["request"][0](request)
+
+    for key in (
+        "IOT-Time-Zone",
+        "IOT-Open-AppID",
+        "IOT-Open-Nonce",
+        "IOT-Open-Body-Hash",
+        "IOT-Open-Sign",
+    ):
+        assert key in request.headers
+    assert request.headers["IOT-Time-Zone"] == "Europe/Moscow"
+    assert request.headers["IOT-Open-AppID"] == SISELI_APP_ID
+    expected_hash = _sha256_hex(request.content)
+    assert request.headers["IOT-Open-Body-Hash"] == expected_hash
+    assert request.headers["IOT-Open-Sign"]
+    assert request.headers["IOT-Open-Sign"] != secret

python_siseli-0.1.0/siseli/auth.py

@@ -1,96 +0,0 @@
-"""Authentication: login and token lifecycle management."""
-
-from __future__ import annotations
-
-import hashlib
-from datetime import UTC, datetime
-
-import httpx
-
-from .exceptions import AuthenticationError
-from .models.auth import TokenInfo
-
-
-def _md5(text: str) -> str:
-    # The Siseli Cloud API requires the MD5 hash of the plaintext password.
-    # This is a protocol constraint imposed by the server, not a local
-    # password-storage decision.  The hash is sent over HTTPS and is never
-    # stored on disk.
-    return hashlib.md5(text.encode()).hexdigest()  # noqa: S324
-
-
-def _parse_dt(value: str | None) -> datetime | None:
-    if not value:
-        return None
-    return datetime.fromisoformat(value.replace("Z", "+00:00"))
-
-
-class Auth:
-    """Manages credentials and the current access token.
-
-    The password is hashed with MD5 before being sent to the API, which
-    matches the behaviour observed in the browser client.
-    """
-
-    def __init__(self, account: str, password: str) -> None:
-        self._account = account
-        # The web client sends the MD5 hash of the plaintext password.
-        self._password_hash = _md5(password)
-        self._token_info: TokenInfo | None = None
-
-    async def login(self, http: httpx.AsyncClient) -> TokenInfo:
-        """Authenticate and store the returned tokens.
-
-        Raises :exc:`~siseli.exceptions.AuthenticationError` on failure.
-        """
-        try:
-            response = await http.post(
-                "/apis/login/account",
-                json={"account": self._account, "password": self._password_hash},
-            )
-            response.raise_for_status()
-        except httpx.HTTPError as exc:
-            raise AuthenticationError(f"Login request failed: {exc}") from exc
-
-        body = response.json()
-        if body.get("code") != 0:
-            raise AuthenticationError(
-                f"Login failed (code {body.get('code')}): {body.get('message')}"
-            )
-
-        data = body["data"]
-        self._token_info = TokenInfo(
-            access_token=data["accessToken"],
-            refresh_token=data["refreshToken"],
-            access_token_expires_at=_parse_dt(data.get("accessTokenWillExpiredAt")),
-            refresh_token_expires_at=_parse_dt(data.get("refreshTokenWillExpiredAt")),
-            auth_id=data.get("authId", ""),
-            account=data.get("account", self._account),
-            user_id=data.get("userId", ""),
-        )
-        return self._token_info
-
-    @property
-    def access_token(self) -> str:
-        """Return the current access token.
-
-        Raises :exc:`~siseli.exceptions.AuthenticationError` if not yet
-        authenticated.
-        """
-        if self._token_info is None:
-            raise AuthenticationError("Not authenticated — call authenticate() first")
-        return self._token_info.access_token
-
-    @property
-    def token_info(self) -> TokenInfo | None:
-        """Return token metadata, or *None* if not authenticated."""
-        return self._token_info
-
-    def is_authenticated(self) -> bool:
-        """Return *True* when there is a valid, non-expired access token."""
-        if self._token_info is None:
-            return False
-        expires_at = self._token_info.access_token_expires_at
-        if expires_at is None:
-            return True
-        return datetime.now(UTC) < expires_at

python_siseli-0.1.0/siseli/const.py

@@ -1,5 +0,0 @@
-BASE_URL = "https://solar.siseli.com"
-DEFAULT_TIMEOUT = 30.0
-DEFAULT_PAGE_SIZE = 20
-# dataSource=1 observed in all telemetry requests in HAR captures
-DEFAULT_DATA_SOURCE = 1