splent-feature-github 0.1.0__py3-none-any.whl

splent_io/splent_feature_github/services.py

@@ -0,0 +1,305 @@
+import secrets
+
+from flask import current_app
+from splent_framework.services.BaseService import BaseService
+from sqlalchemy.exc import IntegrityError, SQLAlchemyError
+
+from splent_io.splent_feature_auth.models import User
+from splent_io.splent_feature_auth.repositories import UserRepository
+from splent_io.splent_feature_github.repositories import GithubRepository
+from splent_io.splent_feature_identities.oauth import oauth_for
+from splent_io.splent_feature_identities.services import IdentitiesService
+from splent_io.splent_feature_profile.repositories import UserProfileRepository
+
+PROVIDER = "github"
+# The name people know the provider by, in the messages they read.
+PROVIDER_NAME = "GitHub"
+
+# The refusal in a product without signup, when identities is too old to
+# word it (see new_account_refusal).
+CLOSED_REGISTRATION_FALLBACK = (
+    "New accounts are opened by an administrator. Ask an administrator for access."
+)
+
+
+def opens_accounts(identities=None) -> bool:
+    """Whether signing in with GitHub may open a new account here.
+
+    identities decides, for every provider alike: only a product that
+    installs signup opens accounts. registration_is_open is new in the
+    identities released with this version of github. Against an older
+    identities, which has no such method, the same question is asked here
+    (is signup's blueprint registered) instead of raising AttributeError.
+    """
+    identities = IdentitiesService() if identities is None else identities
+    if hasattr(identities, "registration_is_open"):
+        return identities.registration_is_open()
+    return "signup" in current_app.blueprints
+
+
+def new_account_refusal(identities=None) -> str | None:
+    """None when signing in with GitHub may open an account here, otherwise
+    the translated message that refuses it.
+
+    The message is identities', the same for every provider.
+    closed_registration_message is new in the identities released with this
+    version of github, so against an older one, which has no such method,
+    the refusal is a plain English sentence instead of an AttributeError.
+    """
+    identities = IdentitiesService() if identities is None else identities
+    if opens_accounts(identities):
+        return None
+    if hasattr(identities, "closed_registration_message"):
+        return identities.closed_registration_message(PROVIDER_NAME)
+    return CLOSED_REGISTRATION_FALLBACK
+
+
+def register_github_client(app):
+    """Register GitHub on the product's Authlib registry, once per app."""
+    oauth_for(app).register(
+        name=PROVIDER,
+        client_id=app.config.get("GITHUB_CLIENT_ID") or None,
+        client_secret=app.config.get("GITHUB_CLIENT_SECRET") or None,
+        access_token_url="https://github.com/login/oauth/access_token",
+        authorize_url="https://github.com/login/oauth/authorize",
+        client_kwargs={"scope": "user:email"},
+    )
+    if not app.config.get("GITHUB_CLIENT_ID") or not app.config.get(
+        "GITHUB_CLIENT_SECRET"
+    ):
+        app.logger.warning(
+            "GITHUB_CLIENT_ID/GITHUB_CLIENT_SECRET not configured; GitHub login disabled"
+        )
+
+
+class GithubService(BaseService):
+    def __init__(self):
+        super().__init__(GithubRepository())
+        self.user_repository = UserRepository()
+        self.user_profile_repository = UserProfileRepository()
+        self.identities = IdentitiesService()
+
+    @property
+    def github_client(self):
+        return oauth_for(current_app).create_client(PROVIDER)
+
+    def new_account_refusal(self) -> str | None:
+        return new_account_refusal(self.identities)
+
+    def get_github_user_info(self, token):
+        try:
+            resp = self.github_client.get("https://api.github.com/user", token=token)
+        except Exception as exc:
+            current_app.logger.exception("GitHub userinfo request failed: %s", exc)
+            return None, "Could not reach GitHub. Please try again."
+
+        if not resp:
+            current_app.logger.error("GitHub userinfo empty response")
+            return None, "GitHub did not return user information. Please try again."
+
+        if resp.status_code != 200:
+            current_app.logger.error(
+                "GitHub userinfo failed (%s): %s",
+                resp.status_code,
+                getattr(resp, "text", None),
+            )
+            if resp.status_code == 429:
+                return (
+                    None,
+                    "GitHub is rate-limiting requests. Please try again in a minute.",
+                )
+            return None, "GitHub user information request failed. Please try again."
+
+        data = resp.json() or {}
+        github_id = data.get("id")
+        if not github_id:
+            current_app.logger.error("GitHub userinfo missing 'id': %s", data)
+            return None, "GitHub did not provide a user ID. Please try again."
+
+        # A GitHub profile email is private by default, so /user often omits it.
+        # Without an email there is nothing to converge an existing account on,
+        # so fall back to the verified primary address from /user/emails (the
+        # granted ``user:email`` scope covers this).
+        if not data.get("email"):
+            data["email"] = self.get_primary_verified_email(token)
+
+        return data, None
+
+    def get_primary_verified_email(self, token):
+        try:
+            resp = self.github_client.get(
+                "https://api.github.com/user/emails", token=token
+            )
+        except Exception as exc:
+            current_app.logger.warning("GitHub user/emails request failed: %s", exc)
+            return None
+
+        if not resp or resp.status_code != 200:
+            current_app.logger.warning(
+                "GitHub user/emails failed (%s)", getattr(resp, "status_code", None)
+            )
+            return None
+
+        emails = resp.json() or []
+        if not isinstance(emails, list):
+            return None
+        entries = [e for e in emails if isinstance(e, dict)]
+        primary = next(
+            (e.get("email") for e in entries if e.get("primary") and e.get("verified")),
+            None,
+        )
+        return primary or next(
+            (e.get("email") for e in entries if e.get("verified")), None
+        )
+
+    def _existing_user_for_github(self, github_id: int):
+        github_record = self.repository.get_by_github_id(github_id)
+        if not github_record:
+            return None, github_record
+        profile = self.user_profile_repository.get_by_id(github_record.profile_id)
+        user = self.user_repository.get_by_id(profile.user_id) if profile else None
+        return user, github_record
+
+    def get_or_create_user(self, user_info):
+        if not user_info:
+            return None, "Missing GitHub user information."
+
+        github_id = user_info.get("id")
+        if not github_id:
+            return None, "Missing GitHub ID."
+
+        github_login = (user_info.get("login") or "").strip()
+        name = (user_info.get("name") or "").strip()
+        if not name:
+            name = github_login
+
+        email = (
+            (user_info.get("email") or "").strip().lower()
+            if user_info.get("email")
+            else None
+        )
+
+        try:
+            # 1. Check if this GitHub ID already exists
+            user = self.identities.linked_user(PROVIDER, github_id)
+            if user:
+                return user, None
+
+            # 2. A product without signup is closed: an administrator opens
+            # its accounts, and GitHub is not a way around that. Asked before
+            # the email, so the refusal says nothing about who has an account.
+            refusal = self.new_account_refusal()
+            if refusal:
+                return None, refusal
+
+            # 3. Never link to an existing account by email. GitHub has verified
+            # the address, but nothing verified the account's own email (a
+            # password signup or an ORCID sign-in can claim any address), so
+            # linking would hand this GitHub user someone else's account, or the
+            # other way round. Linking goes through the connect flow instead.
+            if self.identities.email_in_use(email):
+                return None, (
+                    "An account with this email already exists. Sign in with your usual method "
+                    "and connect GitHub from your profile."
+                )
+
+            # 4. Create new user if nothing found
+            user = self.user_repository.create(
+                commit=False,
+                password=secrets.token_urlsafe(24),
+                active=True,
+                email=email,
+            )
+            profile = self.user_profile_repository.create(
+                commit=False, user_id=user.id, name=name, surname=""
+            )
+            self.repository.create(
+                commit=False,
+                github_id=github_id,
+                github_login=github_login,
+                profile_id=profile.id,
+            )
+            # The username goes in here too, not only in the connect flow, or the
+            # profile would show the numeric id after a GitHub sign-up.
+            self.identities.add_identity(
+                user.id,
+                PROVIDER,
+                github_id,
+                provider_username=github_login,
+                email=email,
+                commit=False,
+            )
+            self.repository.session.commit()
+            return user, None
+        except IntegrityError as exc:
+            current_app.logger.warning(
+                "IntegrityError creating GitHub user (%s): %s", github_id, exc
+            )
+            self.repository.session.rollback()
+            user, _ = self._existing_user_for_github(github_id)
+            if user:
+                return user, None
+            return (
+                None,
+                "Could not create your account due to a concurrency issue. Please try again.",
+            )
+
+        except SQLAlchemyError as exc:
+            current_app.logger.exception(
+                "Database error creating GitHub user (%s): %s", github_id, exc
+            )
+            self.repository.session.rollback()
+            return (
+                None,
+                "Could not create your account due to a database error. Please try again.",
+            )
+
+    def link_identity(self, user: User, user_info):
+        """Attach a GitHub identity to an already-authenticated user.
+
+        Writes both the identity row (used to resolve future logins) and the
+        ``Github`` domain row (used by ``profile.get_github``), so the connect
+        flow leaves the account in the same shape a GitHub login would.
+        """
+        github_id = user_info.get("id")
+        if not github_id:
+            return None, "Missing GitHub ID."
+
+        github_login = (user_info.get("login") or "").strip()
+        email = (user_info.get("email") or "").strip().lower() or None
+
+        existing = self.identities.get_identity(PROVIDER, github_id)
+        if existing and existing.user_id and existing.user_id != user.id:
+            return None, "This GitHub account is already linked to another user."
+
+        try:
+            if not existing:
+                self.identities.add_identity(
+                    user.id,
+                    PROVIDER,
+                    github_id,
+                    provider_username=github_login,
+                    email=email,
+                    commit=False,
+                )
+            profile = getattr(user, "profile", None)
+            if profile and not self.repository.get_by_github_id(github_id):
+                self.repository.create(
+                    commit=False,
+                    github_id=github_id,
+                    github_login=github_login,
+                    profile_id=profile.id,
+                )
+            self.repository.session.commit()
+            return user, None
+        except (IntegrityError, SQLAlchemyError) as exc:
+            current_app.logger.warning("Could not link GitHub %s: %s", github_id, exc)
+            self.repository.session.rollback()
+            return None, "Could not connect GitHub. Please try again."
+
+    def forget(self, user: User, github_id: int) -> None:
+        """Drop the profile's GitHub row after the identity was disconnected."""
+        record = self.repository.get_by_github_id(github_id)
+        profile = getattr(user, "profile", None)
+        if record and profile and record.profile_id == profile.id:
+            self.repository.delete(record.id)

splent_io/splent_feature_github/signals.py

@@ -0,0 +1,14 @@
+"""Signal handlers for splent_feature_github."""
+
+from splent_framework.signals.signal_utils import connect_signal
+
+
+@connect_signal("identity-disconnected", "splent_feature_github")
+def on_identity_disconnected(sender, user, provider, provider_id, **kwargs):
+    # Drop the profile's GitHub row too, or a later sign-in with the same
+    # account would still resolve this user through it.
+    if provider != "github" or not str(provider_id).isdigit():
+        return
+    from splent_io.splent_feature_github.services import GithubService
+
+    GithubService().forget(user, int(provider_id))

splent_io/splent_feature_github/templates/hooks/github_login_button.html

@@ -0,0 +1,7 @@
+{# In auth.login.providers and signup.providers. GitHub's dark grey comes
+   from assets/css/github.css (.btn-github), so the button looks like
+   GitHub's in any shell. #}
+<a href="{{ url_for('github.login', next=next_url) if next_url else url_for('github.login') }}"
+class="btn btn-github d-flex align-items-center">
+    GitHub
+</a>

splent_io/splent_feature_github/templates/hooks/github_profile_row.html

@@ -0,0 +1,31 @@
+{# A section of profile's edit page (profile.edit.sections), below the
+   profile form. The disconnect button opens identities' modal, which posts
+   the provider and account id it carries. The colours are in
+   assets/css/github.css, and the mark is drawn in currentColor. #}
+{% if identity %}
+<div class="mb-4 profile-identity" data-identity="github">
+    <label class="form-label fw-semibold">GitHub</label>
+    <div class="form-control d-flex align-items-center gap-2 github-identity__field">
+        <svg class="github-mark" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true">
+            <path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v 3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"/>
+        </svg>
+        <span class="github-identity__value">{{ identity.provider_username or identity.provider_id }}</span>
+        <button type="button" class="btn btn-sm p-0 github-identity__disconnect" title="{{ _('Disconnect') }}" aria-label="{{ _('Disconnect') }}" data-bs-toggle="modal" data-bs-target="#disconnectModal" data-provider="github" data-provider-id="{{ identity.provider_id }}">
+            <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+                <line x1="18" y1="6" x2="6" y2="18"></line>
+                <line x1="6" y1="6" x2="18" y2="18"></line>
+            </svg>
+        </button>
+    </div>
+</div>
+{% else %}
+<div class="mb-4 profile-identity" data-identity="github">
+    <label class="form-label fw-semibold">GitHub</label>
+    <a href="{{ url_for('github.connect_github') }}" class="form-control text-decoration-none d-flex align-items-center gap-2 github-identity__field github-identity__connect">
+        <svg class="github-mark" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true">
+            <path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v 3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"/>
+        </svg>
+        <span>{{ _('Connect GitHub') }}</span>
+    </a>
+</div>
+{% endif %}

splent_io/splent_feature_github/translations/es/LC_MESSAGES/messages.po

@@ -0,0 +1,28 @@
+# Spanish translations for PROJECT.
+# Copyright (C) 2026 ORGANIZATION
+# This file is distributed under the same license as the PROJECT project.
+# FIRST AUTHOR <EMAIL@ADDRESS>, 2026.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: PROJECT VERSION\n"
+"Report-Msgid-Bugs-To: EMAIL@ADDRESS\n"
+"POT-Creation-Date: 2026-10-21 00:49+0200\n"
+"PO-Revision-Date: 2026-10-21 00:18+0200\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language: es\n"
+"Language-Team: es <LL@li.org>\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=utf-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Generated-By: Babel 2.18.0\n"
+
+#: src/splent_io/splent_feature_github/templates/hooks/github_profile_row.html:12
+msgid "Disconnect"
+msgstr "Desconectar"
+
+#: src/splent_io/splent_feature_github/templates/hooks/github_profile_row.html:27
+msgid "Connect GitHub"
+msgstr "Conectar GitHub"
+