python-siseli 0.1.2__py3-none-any.whl → 0.2.0__py3-none-any.whl

{python_siseli-0.1.2.dist-info → python_siseli-0.2.0.dist-info}/METADATA

@@ -1,11 +1,12 @@
 Metadata-Version: 2.4
 Name: python-siseli
-Version: 0.1.2
+Version: 0.2.0
 Summary: Python SDK for Siseli Cloud
 License: MIT
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 Requires-Dist: httpx>=0.27
+Requires-Dist: cryptography>=42
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"

{python_siseli-0.1.2.dist-info → python_siseli-0.2.0.dist-info}/RECORD

@@ -1,15 +1,16 @@
-siseli/__init__.py,sha256=_sHO0M0medXnJz_ZTtHKyy8DP6e40wuf5ubEGLC1kBs,1035
+siseli/__init__.py,sha256=F4eW-gk3BGfcBhVgDCyqotYgCcibac6iSEgyp_px8Ug,1099
 siseli/_utils.py,sha256=QT-ooemKKAIEHICNI2QErPvRkFIkUGo6ncUFCJM1kGc,727
 siseli/alarms.py,sha256=Mc_CV8kUBFTXu8c48NstX8Lc6Q0bPTnhjwehx9sbCkQ,4853
 siseli/auth.py,sha256=I8WwJgy1go1MGxjowkVx-lvCtneh5rRtbs9DV9yO4T8,6470
 siseli/client.py,sha256=Eap7MTrnctdskt6kOzbns7SqUt27ZDjMlIKVshfcfN8,14200
 siseli/config.py,sha256=J8raq7Yf4gCyjO9ISNoTrk_EYNEGrESV56O-aHfDvBU,3278
-siseli/const.py,sha256=M8bBrc8cH0OyEGb9158_emux_dfknvikGQqm09iQ8CA,174
+siseli/const.py,sha256=9qk2YEaDELKmn7xRsvxlnHh9nUGFymN1DWnulfQG4w4,364
 siseli/dashboard.py,sha256=JQHfi8orKs5uWsGGfoTvA14A9M_R9yIAYuGCxb4zTsM,3325
 siseli/device.py,sha256=crix14pYakrDaFmomPC3Uwgdq-1boZ-ZaEg2HgzXibs,2762
 siseli/dictionary.py,sha256=VSO83uXPaGLPzKGRmpROuWQKivXN7DNOmXN8QQJ-Y-w,1120
 siseli/exceptions.py,sha256=y9ws9c2vr5Q3bZxLwkXybUqQooq57YEEXAN0wO3_fxk,1420
 siseli/history.py,sha256=CgBvDfZBIrrewu7PeRv08-Zr4boEVOY8Xevruu-ge-I,3869
+siseli/open_auth.py,sha256=t64FrrzS-edsQlLr-tY0MHVvHP0nfNJEd1LcZPw_yXQ,5857
 siseli/state.py,sha256=d7Exlf7FzF8O_CcF-NbAt6kq8qaR4fFhjGW8028kbrM,5800
 siseli/station.py,sha256=e1OK4OIry9WUjT8KggQI5b4Acypm9D31mWAMTjDGFew,5531
 siseli/models/__init__.py,sha256=WSIXRM_JRKNhB_hDwxrpeQgdqKUHdbT3KiFvdrLrrzY,1242
@@ -23,7 +24,7 @@ siseli/models/dictionary.py,sha256=d6KCu77UMlPcIDON8G3sjuytkSfbI5go1y3I_jAGTX8,4
 siseli/models/history.py,sha256=dx26VWLJosucMvwL36vojvAguvkMiv5GEKTllUtZV0Y,791
 siseli/models/state.py,sha256=VK5CNqMLRkY1w9HrcUhvaO_6J-rjqP7VwvbppCFpucI,2393
 siseli/models/station.py,sha256=02OLINAVblnKkF73ZwKxYvPtUFROsu4-g544oDg8ApA,1783
-python_siseli-0.1.2.dist-info/METADATA,sha256=xnZJLpywI8nzDQEqwUgUsN9Pbx5iL7bnSqV3v326MFs,1407
-python_siseli-0.1.2.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
-python_siseli-0.1.2.dist-info/top_level.txt,sha256=Dofr9c7hGvRRV6ij6aoPuAZqxEjkgtsBeN4KtFHbGgo,7
-python_siseli-0.1.2.dist-info/RECORD,,
+python_siseli-0.2.0.dist-info/METADATA,sha256=qHA8H1BcZ_7_LZKWG7mBP5sw61JOUuWXSXHzF58hRFg,1439
+python_siseli-0.2.0.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+python_siseli-0.2.0.dist-info/top_level.txt,sha256=Dofr9c7hGvRRV6ij6aoPuAZqxEjkgtsBeN4KtFHbGgo,7
+python_siseli-0.2.0.dist-info/RECORD,,

siseli/__init__.py

@@ -1,6 +1,7 @@
 """python-siseli — Python SDK for Siseli Cloud."""
 
 from .client import SiseliClient
+from .open_auth import attach_open_auth
 from .exceptions import ApiError, AuthenticationError, NetworkError, SiseliError, TokenExpiredError
 from .models import (
     Alarm,
@@ -25,6 +26,7 @@ from .models import (
 
 __all__ = [
     "SiseliClient",
+    "attach_open_auth",
     "SiseliError",
     "AuthenticationError",
     "TokenExpiredError",

siseli/const.py

@@ -3,3 +3,7 @@ DEFAULT_TIMEOUT = 30.0
 DEFAULT_PAGE_SIZE = 20
 # dataSource=1 observed in all telemetry requests in HAR captures
 DEFAULT_DATA_SOURCE = 1
+
+# Production Siseli Open API application credentials from the official web client.
+SISELI_APP_ID = "rBrTRfAPXz"
+SISELI_APP_SECRET_ENCRYPTED = "I4D0KRr2339z3pQ/at91V9BpFAOe54DaTafwSm6suIQ="

siseli/open_auth.py

@@ -0,0 +1,177 @@
+"""Siseli Open API request signing helpers.
+
+Every API request must carry IOT-Open-* headers that prove the caller holds a
+valid application credential.  The signing algorithm mirrors the official web
+client (CryptoJS-based) exactly:
+
+1. Decrypt the base64-encoded app secret with AES-128-CBC.
+   Key and IV are derived from MD5(app_id) as ASCII hex chars.
+2. Compute a body hash: empty string for GET; SHA-256 hex for everything else.
+3. Collect query params, inject the three open-auth fields, sort by key,
+   serialise without URL-encoding, hex-encode the UTF-8 bytes.
+4. Sign: HMAC-SHA256(hex_string, secret) → MD5 → lowercase hex.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import uuid
+from typing import TYPE_CHECKING, Any
+from urllib.parse import parse_qs
+
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+
+from .const import SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED
+
+if TYPE_CHECKING:
+    import httpx
+
+
+def decrypt_open_secret(app_id: str, encrypted_secret_b64: str) -> str:
+    """Decrypt the base64-encoded app secret using AES-128-CBC.
+
+    The AES key and IV are derived from MD5(app_id).lower():
+    - first 16 hex chars → 16 ASCII bytes → AES key
+    - last  16 hex chars → 16 ASCII bytes → IV
+
+    ZeroPadding is assumed: trailing null bytes are stripped from the output.
+    """
+    import base64
+
+    md5_hex = hashlib.md5(app_id.encode()).hexdigest()  # noqa: S324
+    key = md5_hex[:16].encode("ascii")
+    iv = md5_hex[16:].encode("ascii")
+
+    encrypted_bytes = base64.b64decode(encrypted_secret_b64)
+    cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
+    decryptor = cipher.decryptor()
+    plaintext = decryptor.update(encrypted_bytes) + decryptor.finalize()
+    return plaintext.rstrip(b"\x00").decode("utf-8")
+
+
+def _sha256_hex(data: bytes) -> str:
+    """Return the lowercase hex SHA-256 digest of *data*."""
+    return hashlib.sha256(data).hexdigest()
+
+
+def build_open_headers(
+    *,
+    method: str,
+    query: str,
+    body: bytes | None,
+    app_id: str,
+    app_secret: str,
+    timezone: str,
+    nonce: str,
+) -> dict[str, str]:
+    """Build the IOT-Open-* headers (and IOT-Time-Zone) for a single request.
+
+    Parameters
+    ----------
+    method:
+        HTTP method ("GET", "POST", …).
+    query:
+        The raw query string portion of the URL (without the leading "?").
+    body:
+        Raw request body bytes, or *None* / empty for GET requests.
+    app_id:
+        The application ID (``IOT-Open-AppID``).
+    app_secret:
+        The *decrypted* application secret used as the HMAC key.
+    timezone:
+        The client timezone string, e.g. "UTC" or "Europe/Moscow".
+    nonce:
+        A unique string per request (UUID hex recommended).
+    """
+    # --- body hash -----------------------------------------------------------
+    if method.upper() == "GET":
+        body_hash = ""
+    else:
+        body_hash = _sha256_hex(body if body else b"")
+
+    # --- params for the sign input -------------------------------------------
+    params: dict[str, str] = {}
+    if query:
+        for key, values in parse_qs(query, keep_blank_values=True).items():
+            params[key] = values[0]
+
+    # Remove any stale open-auth fields so they cannot influence the new sign.
+    for field in ("IOT-Open-AppID", "IOT-Open-Nonce", "IOT-Open-Sign", "IOT-Open-Body-Hash"):
+        params.pop(field, None)
+
+    params["IOT-Open-AppID"] = app_id
+    params["IOT-Open-Nonce"] = nonce
+    params["IOT-Open-Body-Hash"] = body_hash
+
+    # Sort alphabetically (case-sensitive, matching JS default sort order).
+    query_str = "&".join(f"{k}={v}" for k, v in sorted(params.items()))
+
+    # --- sign ----------------------------------------------------------------
+    # CryptoJS: Utf8.parse(query_str) → Hex.stringify → hex_string
+    # Then: HmacSHA256(hex_string, secret) → MD5 → hex
+    hex_str = query_str.encode("utf-8").hex()
+    hmac_digest = hmac.new(
+        app_secret.encode("utf-8"),
+        hex_str.encode("utf-8"),
+        hashlib.sha256,
+    ).digest()
+    sign = hashlib.md5(hmac_digest).hexdigest()  # noqa: S324
+
+    return {
+        "IOT-Time-Zone": timezone,
+        "IOT-Open-AppID": app_id,
+        "IOT-Open-Nonce": nonce,
+        "IOT-Open-Body-Hash": body_hash,
+        "IOT-Open-Sign": sign,
+    }
+
+
+def attach_open_auth(
+    client: Any,
+    *,
+    app_id: str = SISELI_APP_ID,
+    encrypted_secret: str = SISELI_APP_SECRET_ENCRYPTED,
+) -> None:
+    """Attach an httpx request hook that adds Open API signing headers.
+
+    The hook is appended to ``client._http.event_hooks["request"]`` and runs
+    before every outgoing request, injecting:
+
+    - ``IOT-Time-Zone``
+    - ``IOT-Open-AppID``
+    - ``IOT-Open-Nonce``
+    - ``IOT-Open-Body-Hash``
+    - ``IOT-Open-Sign``
+
+    Parameters
+    ----------
+    client:
+        A :class:`~siseli.SiseliClient` instance (or any object with
+        ``._http.event_hooks`` and ``._timezone``).
+    app_id:
+        Override the default production App ID.
+    encrypted_secret:
+        Override the default production encrypted secret.
+    """
+    secret = decrypt_open_secret(app_id, encrypted_secret)
+    timezone = getattr(client, "_timezone", "UTC")
+
+    async def _sign_request(request: "httpx.Request") -> None:
+        nonce = uuid.uuid4().hex
+        query = request.url.query
+        if isinstance(query, bytes):
+            query = query.decode("utf-8")
+        body = request.content if request.method.upper() != "GET" else None
+        headers = build_open_headers(
+            method=request.method,
+            query=query,
+            body=body,
+            app_id=app_id,
+            app_secret=secret,
+            timezone=timezone,
+            nonce=nonce,
+        )
+        request.headers.update(headers)
+
+    client._http.event_hooks["request"].append(_sign_request)