reflex-google-auth 0.1.0__py3-none-any.whl → 0.2.0a1__py3-none-any.whl

reflex_google_auth/google_auth.py

@@ -43,8 +43,18 @@ google_login = GoogleLogin.create
 
 
 def handle_google_login(
+    scope: str | list[str] | rx.Var[str] | rx.Var[list[str]] = "openid profile email",
     on_success: EventType[dict] = GoogleAuthState.on_success,
 ) -> rx.Var[rx.EventChain]:
+    """Create a login event chain to handle Google login.
+
+    Args:
+        scope: The space-separated OAuth scopes to request (default "openid profile email").
+        on_success: The event to call on successful login (default GoogleAuthState.on_success).
+
+    Returns:
+        An event chain that handles the login process.
+    """
     on_success_event_chain = rx.Var.create(
         rx.EventChain.create(
             value=on_success,  # type: ignore
@@ -52,6 +62,9 @@ def handle_google_login(
             key="on_success",
         )
     )
+    scope = rx.Var.create(scope) if not isinstance(scope, rx.Var) else scope
+    if isinstance(scope, rx.vars.ArrayVar):
+        scope = scope.join(" ")
     return rx.Var(
         "() => login()",
         _var_type=rx.EventChain,
@@ -61,8 +74,12 @@ def handle_google_login(
 const login = useGoogleLogin({
   onSuccess: %s,
   flow: 'auth-code',
+  scope: %s,
 });"""
-                % on_success_event_chain: on_success_event_chain._get_all_var_data(),
+                % (on_success_event_chain, scope): rx.vars.VarData.merge(
+                    on_success_event_chain._get_all_var_data(),
+                    scope._get_all_var_data(),
+                ),
             },
             imports={LIBRARY: "useGoogleLogin"},
         ),

reflex_google_auth/state.py

@@ -3,6 +3,7 @@
 import json
 import os
 import time
+from typing import TypedDict
 
 import reflex as rx
 from google.auth.transport import requests
@@ -21,14 +22,42 @@ def set_client_id(client_id: str):
     CLIENT_ID = client_id
 
 
-async def get_id_token(auth_code) -> str:
-    """Get the id token credential from an auth code.
+class TokenResponse(TypedDict, total=False):
+    access_token: str
+    expires_in: int
+    refresh_token: str
+    scope: str
+    token_type: str
+    id_token: str
+
+
+class TokenCredential(TypedDict, total=False):
+    iss: str
+    azp: str
+    aud: str
+    sub: str
+    hd: str
+    email: str
+    email_verified: bool
+    at_hash: str
+    nbf: int
+    name: str
+    picture: str
+    given_name: str
+    family_name: str
+    iat: int
+    exp: int
+    jti: str
+
+
+async def get_token(auth_code) -> TokenResponse:
+    """Get the token(s) from an auth code.
 
     Args:
         auth_code: Returned from an 'auth-code' flow.
 
     Returns:
-        The id token credential.
+        The token response, containing access_token, refresh_token and id_token.
     """
     async with AsyncClient() as client:
         response = await client.post(
@@ -43,40 +72,121 @@ async def get_id_token(auth_code) -> str:
         )
         response.raise_for_status()
         response_data = response.json()
-        return response_data.get("id_token")
+        return TokenResponse(response_data)
+
+
+async def get_id_token(auth_code: str) -> str:
+    token_data = await get_token(auth_code)
+    if "id_token" not in token_data:
+        raise ValueError("No id_token in token response")
+    return token_data["id_token"]
 
 
 class GoogleAuthState(rx.State):
-    id_token_json: str = rx.LocalStorage()
+    token_response_json: str = rx.LocalStorage()
+    refresh_token: str = rx.LocalStorage()
+
+    @rx.var
+    def id_token_json(self) -> str:
+        """For compatibility only. Use token_response_json instead."""
+        try:
+            return json.dumps(
+                {"credential": json.loads(self.token_response_json).get("id_token", "")}
+            )
+        except Exception:
+            return ""
 
     @rx.event
-    async def on_success(self, id_token: dict):
-        if "code" in id_token:
+    async def on_success(self, response: dict):
+        if "code" in response:
             # Handle auth-code flow
-            id_token["credential"] = await get_id_token(id_token["code"])
-        self.id_token_json = json.dumps(id_token)
+            token_response = await get_token(response["code"])
+            self.token_response_json = json.dumps(token_response)
+            if "refresh_token" in token_response:
+                self.refresh_token = token_response["refresh_token"]
+        elif "credential" in response:
+            # Handle id-token flow
+            self.token_response_json = json.dumps({"id_token": response["credential"]})
+            self.refresh_token = ""
+        else:
+            self.token_response_json = ""
+            self.refresh_token = ""
+            raise ValueError("No code or credential in response")
+
+    @rx.event
+    async def refresh_access_token(self):
+        try:
+            if not self.access_token:
+                return  # no token to refresh
+            if not self.refresh_token:
+                # token not available, must re-auth
+                self.token_response_json = ""
+                return
+            async with AsyncClient() as client:
+                response = await client.post(
+                    TOKEN_URI,
+                    data={
+                        "client_id": CLIENT_ID,
+                        "client_secret": CLIENT_SECRET,
+                        "refresh_token": self.refresh_token,
+                        "grant_type": "refresh_token",
+                    },
+                )
+                response.raise_for_status()
+                new_token_data = response.json()
+                # Save the new refresh token if provided
+                if "refresh_token" in new_token_data:
+                    self.refresh_token = new_token_data["refresh_token"]
+                self.token_response_json = json.dumps(new_token_data)
+        except Exception as exc:
+            print(f"Error refreshing token: {exc!r}")  # noqa: T201
 
     @rx.var(cache=True)
     def client_id(self) -> str:
         return CLIENT_ID or os.environ.get("GOOGLE_CLIENT_ID", "")
 
+    @rx.var
+    def scopes(self) -> list[str]:
+        try:
+            scope_str = json.loads(self.token_response_json).get("scope", "")
+            return scope_str.split(" ") if scope_str else []
+        except Exception:
+            return []
+
+    @rx.var
+    def access_token(self) -> str:
+        try:
+            return json.loads(self.token_response_json).get("access_token", "")
+        except Exception:
+            return ""
+
+    @rx.var
+    def id_token(self) -> str:
+        try:
+            return json.loads(self.token_response_json).get("id_token", "")
+        except Exception:
+            return ""
+
     @rx.var(cache=True)
-    def tokeninfo(self) -> dict[str, str]:
+    def tokeninfo(self) -> TokenCredential:
         try:
-            return verify_oauth2_token(
-                json.loads(self.id_token_json)["credential"],
-                requests.Request(),
-                self.client_id,
+            return TokenCredential(
+                verify_oauth2_token(
+                    self.id_token,
+                    requests.Request(),
+                    self.client_id,
+                )
             )
         except Exception as exc:
-            if self.id_token_json:
+            if self.token_response_json:
                 print(f"Error verifying token: {exc!r}")  # noqa: T201
-                self.id_token_json = ""
+                self.token_response_json = ""
         return {}
 
     @rx.event
     def logout(self):
-        self.id_token_json = ""
+        self.token_response_json = ""
+        self.refresh_token = ""
 
     @rx.var(cache=False)
     def token_is_valid(self) -> bool:

{reflex_google_auth-0.1.0.dist-info → reflex_google_auth-0.2.0a1.dist-info}/METADATA

@@ -1,6 +1,6 @@
-Metadata-Version: 2.2
+Metadata-Version: 2.4
 Name: reflex-google-auth
-Version: 0.1.0
+Version: 0.2.0a1
 Summary: Sign in with Google
 Author-email: Masen Furer <m_github@0x26.net>
 License: Apache-2.0
@@ -127,3 +127,18 @@ def custom_button() -> rx.Component:
         f"{GoogleAuthState.tokeninfo['email']} clicked a custom button to login, nice",
     )
 ```
+
+### Requesting Scopes
+
+By default, only the basic profile scopes are requested. To request additional
+scopes for accessing other Google APIs in the context of the authenticated user:
+
+1. Update your app registration in the Google Cloud Console to add the additional scopes
+   you want to request.
+2. Pass the `scope` parameter to `handle_google_login` event handler. NOTE:
+   scopes can only be requested with the `auth-code` flow, so you must set
+   `GOOGLE_CLIENT_SECRET` and `GOOGLE_REDIRECT_URI` environment variables as
+   described above.
+
+See the `custom_scope` example in `google_auth_demo.py` for how to request
+Drive scopes and and then use Google Drive API to store and retrieve app data.

reflex_google_auth-0.2.0a1.dist-info/RECORD

@@ -0,0 +1,8 @@
+reflex_google_auth/__init__.py,sha256=A3PO7fwBSKoX2nPN5JohqrnZ1cu9nLaP5JsLR9SjbZI,339
+reflex_google_auth/decorator.py,sha256=xjlC4AgU5lX4CyTjM67hTQUFIc_0I1JBC8V4CqvJtM0,1763
+reflex_google_auth/google_auth.py,sha256=sdg3UlON3UYL6GtA9i8yCyjqSpLgNZOKEhJePzzxjvE,2402
+reflex_google_auth/state.py,sha256=fXK2TtPUT4YdUxe5BrtyWwzHJ5GGZbD7rLisr3GzmBI,6164
+reflex_google_auth-0.2.0a1.dist-info/METADATA,sha256=COQ0FYWkpCMESwlOKye1EGAMsGz9PeEJTYaCNDNli44,5562
+reflex_google_auth-0.2.0a1.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+reflex_google_auth-0.2.0a1.dist-info/top_level.txt,sha256=JB7Letu_7VOfOx5EhyGn_bElQjzSq43-LHafE90wqyM,19
+reflex_google_auth-0.2.0a1.dist-info/RECORD,,

{reflex_google_auth-0.1.0.dist-info → reflex_google_auth-0.2.0a1.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (75.8.0)
+Generator: setuptools (80.9.0)
 Root-Is-Purelib: true
 Tag: py3-none-any
 

reflex_google_auth-0.1.0.dist-info/RECORD

@@ -1,8 +0,0 @@
-reflex_google_auth/__init__.py,sha256=A3PO7fwBSKoX2nPN5JohqrnZ1cu9nLaP5JsLR9SjbZI,339
-reflex_google_auth/decorator.py,sha256=xjlC4AgU5lX4CyTjM67hTQUFIc_0I1JBC8V4CqvJtM0,1763
-reflex_google_auth/google_auth.py,sha256=PG2QUFcCVQDtUKGqfJ0DabrIOvO6jthNxdXWPPoB-8Y,1696
-reflex_google_auth/state.py,sha256=-rQTvZjkUYiOgYzUkEJNwgMY7V2lgDLA4D94yNUmHQ8,2691
-reflex_google_auth-0.1.0.dist-info/METADATA,sha256=aGXubR8qOuOo5Qo3a5FZrZCWKsuQQPAn7mUVELQKduQ,4859
-reflex_google_auth-0.1.0.dist-info/WHEEL,sha256=In9FTNxeP60KnTkGw7wk6mJPYd_dQSjEZmXdBdMCI-8,91
-reflex_google_auth-0.1.0.dist-info/top_level.txt,sha256=JB7Letu_7VOfOx5EhyGn_bElQjzSq43-LHafE90wqyM,19
-reflex_google_auth-0.1.0.dist-info/RECORD,,