python-siseli 0.1.2__tar.gz → 0.2.0__tar.gz

{python_siseli-0.1.2 → python_siseli-0.2.0}/PKG-INFO

@@ -1,11 +1,12 @@
 Metadata-Version: 2.4
 Name: python-siseli
-Version: 0.1.2
+Version: 0.2.0
 Summary: Python SDK for Siseli Cloud
 License: MIT
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 Requires-Dist: httpx>=0.27
+Requires-Dist: cryptography>=42
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"

{python_siseli-0.1.2 → python_siseli-0.2.0}/pyproject.toml

@@ -4,13 +4,14 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-siseli"
-version = "0.1.2"
+version = "0.2.0"
 description = "Python SDK for Siseli Cloud"
 readme = "README.md"
 requires-python = ">=3.11"
 license = { text = "MIT" }
 dependencies = [
     "httpx>=0.27",
+    "cryptography>=42",
 ]
 
 [project.optional-dependencies]

{python_siseli-0.1.2 → python_siseli-0.2.0}/python_siseli.egg-info/PKG-INFO

@@ -1,11 +1,12 @@
 Metadata-Version: 2.4
 Name: python-siseli
-Version: 0.1.2
+Version: 0.2.0
 Summary: Python SDK for Siseli Cloud
 License: MIT
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 Requires-Dist: httpx>=0.27
+Requires-Dist: cryptography>=42
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"

{python_siseli-0.1.2 → python_siseli-0.2.0}/python_siseli.egg-info/SOURCES.txt

@@ -17,6 +17,7 @@ siseli/device.py
 siseli/dictionary.py
 siseli/exceptions.py
 siseli/history.py
+siseli/open_auth.py
 siseli/state.py
 siseli/station.py
 siseli/models/__init__.py
@@ -31,4 +32,5 @@ siseli/models/history.py
 siseli/models/state.py
 siseli/models/station.py
 tests/test_auth.py
+tests/test_open_auth.py
 tests/test_phase3.py

{python_siseli-0.1.2 → python_siseli-0.2.0}/python_siseli.egg-info/requires.txt

@@ -1,4 +1,5 @@
 httpx>=0.27
+cryptography>=42
 
 [dev]
 pytest>=8

{python_siseli-0.1.2 → python_siseli-0.2.0}/siseli/__init__.py

@@ -1,6 +1,7 @@
 """python-siseli — Python SDK for Siseli Cloud."""
 
 from .client import SiseliClient
+from .open_auth import attach_open_auth
 from .exceptions import ApiError, AuthenticationError, NetworkError, SiseliError, TokenExpiredError
 from .models import (
     Alarm,
@@ -25,6 +26,7 @@ from .models import (
 
 __all__ = [
     "SiseliClient",
+    "attach_open_auth",
     "SiseliError",
     "AuthenticationError",
     "TokenExpiredError",

python_siseli-0.2.0/siseli/const.py

@@ -0,0 +1,9 @@
+BASE_URL = "https://solar.siseli.com"
+DEFAULT_TIMEOUT = 30.0
+DEFAULT_PAGE_SIZE = 20
+# dataSource=1 observed in all telemetry requests in HAR captures
+DEFAULT_DATA_SOURCE = 1
+
+# Production Siseli Open API application credentials from the official web client.
+SISELI_APP_ID = "rBrTRfAPXz"
+SISELI_APP_SECRET_ENCRYPTED = "I4D0KRr2339z3pQ/at91V9BpFAOe54DaTafwSm6suIQ="

python_siseli-0.2.0/siseli/open_auth.py

@@ -0,0 +1,177 @@
+"""Siseli Open API request signing helpers.
+
+Every API request must carry IOT-Open-* headers that prove the caller holds a
+valid application credential.  The signing algorithm mirrors the official web
+client (CryptoJS-based) exactly:
+
+1. Decrypt the base64-encoded app secret with AES-128-CBC.
+   Key and IV are derived from MD5(app_id) as ASCII hex chars.
+2. Compute a body hash: empty string for GET; SHA-256 hex for everything else.
+3. Collect query params, inject the three open-auth fields, sort by key,
+   serialise without URL-encoding, hex-encode the UTF-8 bytes.
+4. Sign: HMAC-SHA256(hex_string, secret) → MD5 → lowercase hex.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import uuid
+from typing import TYPE_CHECKING, Any
+from urllib.parse import parse_qs
+
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+
+from .const import SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED
+
+if TYPE_CHECKING:
+    import httpx
+
+
+def decrypt_open_secret(app_id: str, encrypted_secret_b64: str) -> str:
+    """Decrypt the base64-encoded app secret using AES-128-CBC.
+
+    The AES key and IV are derived from MD5(app_id).lower():
+    - first 16 hex chars → 16 ASCII bytes → AES key
+    - last  16 hex chars → 16 ASCII bytes → IV
+
+    ZeroPadding is assumed: trailing null bytes are stripped from the output.
+    """
+    import base64
+
+    md5_hex = hashlib.md5(app_id.encode()).hexdigest()  # noqa: S324
+    key = md5_hex[:16].encode("ascii")
+    iv = md5_hex[16:].encode("ascii")
+
+    encrypted_bytes = base64.b64decode(encrypted_secret_b64)
+    cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
+    decryptor = cipher.decryptor()
+    plaintext = decryptor.update(encrypted_bytes) + decryptor.finalize()
+    return plaintext.rstrip(b"\x00").decode("utf-8")
+
+
+def _sha256_hex(data: bytes) -> str:
+    """Return the lowercase hex SHA-256 digest of *data*."""
+    return hashlib.sha256(data).hexdigest()
+
+
+def build_open_headers(
+    *,
+    method: str,
+    query: str,
+    body: bytes | None,
+    app_id: str,
+    app_secret: str,
+    timezone: str,
+    nonce: str,
+) -> dict[str, str]:
+    """Build the IOT-Open-* headers (and IOT-Time-Zone) for a single request.
+
+    Parameters
+    ----------
+    method:
+        HTTP method ("GET", "POST", …).
+    query:
+        The raw query string portion of the URL (without the leading "?").
+    body:
+        Raw request body bytes, or *None* / empty for GET requests.
+    app_id:
+        The application ID (``IOT-Open-AppID``).
+    app_secret:
+        The *decrypted* application secret used as the HMAC key.
+    timezone:
+        The client timezone string, e.g. "UTC" or "Europe/Moscow".
+    nonce:
+        A unique string per request (UUID hex recommended).
+    """
+    # --- body hash -----------------------------------------------------------
+    if method.upper() == "GET":
+        body_hash = ""
+    else:
+        body_hash = _sha256_hex(body if body else b"")
+
+    # --- params for the sign input -------------------------------------------
+    params: dict[str, str] = {}
+    if query:
+        for key, values in parse_qs(query, keep_blank_values=True).items():
+            params[key] = values[0]
+
+    # Remove any stale open-auth fields so they cannot influence the new sign.
+    for field in ("IOT-Open-AppID", "IOT-Open-Nonce", "IOT-Open-Sign", "IOT-Open-Body-Hash"):
+        params.pop(field, None)
+
+    params["IOT-Open-AppID"] = app_id
+    params["IOT-Open-Nonce"] = nonce
+    params["IOT-Open-Body-Hash"] = body_hash
+
+    # Sort alphabetically (case-sensitive, matching JS default sort order).
+    query_str = "&".join(f"{k}={v}" for k, v in sorted(params.items()))
+
+    # --- sign ----------------------------------------------------------------
+    # CryptoJS: Utf8.parse(query_str) → Hex.stringify → hex_string
+    # Then: HmacSHA256(hex_string, secret) → MD5 → hex
+    hex_str = query_str.encode("utf-8").hex()
+    hmac_digest = hmac.new(
+        app_secret.encode("utf-8"),
+        hex_str.encode("utf-8"),
+        hashlib.sha256,
+    ).digest()
+    sign = hashlib.md5(hmac_digest).hexdigest()  # noqa: S324
+
+    return {
+        "IOT-Time-Zone": timezone,
+        "IOT-Open-AppID": app_id,
+        "IOT-Open-Nonce": nonce,
+        "IOT-Open-Body-Hash": body_hash,
+        "IOT-Open-Sign": sign,
+    }
+
+
+def attach_open_auth(
+    client: Any,
+    *,
+    app_id: str = SISELI_APP_ID,
+    encrypted_secret: str = SISELI_APP_SECRET_ENCRYPTED,
+) -> None:
+    """Attach an httpx request hook that adds Open API signing headers.
+
+    The hook is appended to ``client._http.event_hooks["request"]`` and runs
+    before every outgoing request, injecting:
+
+    - ``IOT-Time-Zone``
+    - ``IOT-Open-AppID``
+    - ``IOT-Open-Nonce``
+    - ``IOT-Open-Body-Hash``
+    - ``IOT-Open-Sign``
+
+    Parameters
+    ----------
+    client:
+        A :class:`~siseli.SiseliClient` instance (or any object with
+        ``._http.event_hooks`` and ``._timezone``).
+    app_id:
+        Override the default production App ID.
+    encrypted_secret:
+        Override the default production encrypted secret.
+    """
+    secret = decrypt_open_secret(app_id, encrypted_secret)
+    timezone = getattr(client, "_timezone", "UTC")
+
+    async def _sign_request(request: "httpx.Request") -> None:
+        nonce = uuid.uuid4().hex
+        query = request.url.query
+        if isinstance(query, bytes):
+            query = query.decode("utf-8")
+        body = request.content if request.method.upper() != "GET" else None
+        headers = build_open_headers(
+            method=request.method,
+            query=query,
+            body=body,
+            app_id=app_id,
+            app_secret=secret,
+            timezone=timezone,
+            nonce=nonce,
+        )
+        request.headers.update(headers)
+
+    client._http.event_hooks["request"].append(_sign_request)

python_siseli-0.2.0/tests/test_open_auth.py

@@ -0,0 +1,137 @@
+"""Tests for Siseli Open API signing helpers."""
+
+from __future__ import annotations
+
+import hashlib
+
+import httpx
+import pytest
+
+from siseli.const import SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED
+from siseli.open_auth import (
+    _sha256_hex,
+    attach_open_auth,
+    build_open_headers,
+    decrypt_open_secret,
+)
+
+
+class _MockHttpClient:
+    def __init__(self) -> None:
+        self.event_hooks = {"request": []}
+
+
+class _MockSiseliClient:
+    _timezone = "Europe/Moscow"
+
+    def __init__(self) -> None:
+        self._http = _MockHttpClient()
+
+
+def test_decrypt_open_secret_with_app_id() -> None:
+    """Encrypted Open secret is decrypted with AppID-derived key/IV."""
+    assert (
+        decrypt_open_secret(SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED)
+        == "CJbrtLtqFES62bJ3ZW7c"
+    )
+
+
+def test_get_request_signing_uses_empty_body_hash() -> None:
+    """GET requests must sign with an empty body hash."""
+    secret = decrypt_open_secret(SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED)
+    headers = build_open_headers(
+        method="GET",
+        query="b=2&a=1",
+        body=None,
+        app_id=SISELI_APP_ID,
+        app_secret=secret,
+        timezone="UTC",
+        nonce="nonce-123",
+    )
+    assert headers["IOT-Open-Body-Hash"] == ""
+    assert headers["IOT-Open-Sign"] == "bee1c1c32629baf72be698fbe53fdc11"
+
+
+def test_post_request_signing_with_json_body() -> None:
+    """POST requests must hash and sign the raw JSON body bytes."""
+    secret = decrypt_open_secret(SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED)
+    body = b'{"name":"abc","value":123}'
+    headers = build_open_headers(
+        method="POST",
+        query="z=9",
+        body=body,
+        app_id=SISELI_APP_ID,
+        app_secret=secret,
+        timezone="UTC",
+        nonce="nonce-123",
+    )
+    assert headers["IOT-Open-Body-Hash"] == hashlib.sha256(body).hexdigest()
+    assert headers["IOT-Open-Sign"] == "1f3525cce7ea5fa378409070c17f0076"
+
+
+def test_unicode_json_body_signing() -> None:
+    """Unicode body content must be hashed/signatured as UTF-8 bytes."""
+    secret = decrypt_open_secret(SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED)
+    body = '{"text":"Привет 🌞"}'.encode()
+    headers = build_open_headers(
+        method="POST",
+        query="",
+        body=body,
+        app_id=SISELI_APP_ID,
+        app_secret=secret,
+        timezone="UTC",
+        nonce="nonce-123",
+    )
+    assert headers["IOT-Open-Body-Hash"] == hashlib.sha256(body).hexdigest()
+    assert headers["IOT-Open-Sign"] == "8d4c8f2771f9f7f419fd4cbec1d0f1e6"
+
+
+def test_empty_post_body_signing() -> None:
+    """Empty POST body must use SHA256 of empty bytes."""
+    secret = decrypt_open_secret(SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED)
+    headers = build_open_headers(
+        method="POST",
+        query="x=",
+        body=b"",
+        app_id=SISELI_APP_ID,
+        app_secret=secret,
+        timezone="UTC",
+        nonce="nonce-123",
+    )
+    assert (
+        headers["IOT-Open-Body-Hash"]
+        == "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    )
+    assert headers["IOT-Open-Sign"] == "9f8506bc2a8f3da76eebc4f99691d271"
+
+
+@pytest.mark.asyncio
+async def test_header_generation_includes_required_iot_open_values() -> None:
+    """Request hook injects required IOT-Open-* and timezone headers."""
+    secret = decrypt_open_secret(SISELI_APP_ID, SISELI_APP_SECRET_ENCRYPTED)
+
+    client = _MockSiseliClient()
+    attach_open_auth(client)
+    assert len(client._http.event_hooks["request"]) == 1
+
+    request = httpx.Request(
+        "POST",
+        "https://solar.siseli.com/apis/login/account",
+        content=b'{"account":"u","password":"p"}',
+    )
+    await client._http.event_hooks["request"][0](request)
+
+    for key in (
+        "IOT-Time-Zone",
+        "IOT-Open-AppID",
+        "IOT-Open-Nonce",
+        "IOT-Open-Body-Hash",
+        "IOT-Open-Sign",
+    ):
+        assert key in request.headers
+    assert request.headers["IOT-Time-Zone"] == "Europe/Moscow"
+    assert request.headers["IOT-Open-AppID"] == SISELI_APP_ID
+    expected_hash = _sha256_hex(request.content)
+    assert request.headers["IOT-Open-Body-Hash"] == expected_hash
+    assert request.headers["IOT-Open-Sign"]
+    assert request.headers["IOT-Open-Sign"] != secret

python_siseli-0.1.2/siseli/const.py

@@ -1,5 +0,0 @@
-BASE_URL = "https://solar.siseli.com"
-DEFAULT_TIMEOUT = 30.0
-DEFAULT_PAGE_SIZE = 20
-# dataSource=1 observed in all telemetry requests in HAR captures
-DEFAULT_DATA_SOURCE = 1