Add the base code and Google oauth

wu-clan · wu-clan · commit ea91d57de970 · 2024-02-04T19:27:14.000+08:00
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1,12 @@
+__pycache__/
+.pytest_cache/
+.pdm.toml
+.pdm-python
+.pdm-build/
+.env
+.venv
+venv/
+.idea/
+.vscode/
+.ruff_cache/
+dist/
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -0,0 +1,20 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-toml
+
+  - repo: https://github.com/charliermarsh/ruff-pre-commit
+    rev: v0.2.0
+    hooks:
+      - id: ruff
+        args:
+          - '--fix'
+      - id: ruff-format
+
+  - repo: https://github.com/pdm-project/pdm
+    rev: 2.12.3
+    hooks:
+      - id: pdm-lock-check
diff --git a/README.md b/README.md
@@ -0,0 +1,26 @@
+# fastapi_oauth20
+
+在 fastapi 中轻松集成 OAuth 2.0 客户端
+
+**WIP.**
+
+我们的目标是集成多个 CN 第三方客户端，敬请期待
+
+感谢 [httpx_oauth](https://github.com/frankie567/httpx-oauth) 鼎力相助
+
+#### TODO:
+
+如果我们能够很容易获取测试客户端，对接将会很快发生
+
+- [ ] 微信
+- [ ] QQ
+- [ ] 抖音
+- [ ] 飞书
+- [ ] 钉钉
+- [ ] 微博
+- [ ] 百度
+- [ ] Gitee
+- [ ] Github
+- [ ] 开源中国
+- [ ] 阿里云
+- [ ] TestHome
diff --git a/example/__init__.py b/example/__init__.py
@@ -0,0 +1,2 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
diff --git a/example/fastapi.py b/example/fastapi.py
@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+import os
+
+from fastapi import Depends, FastAPI
+from fastapi_oauth20.clients.google import GoogleOAuth20
+from fastapi_oauth20.integrations.fastapi import OAuth20
+from starlette.responses import PlainTextResponse
+
+app = FastAPI()
+
+GOOGLE_CLIENT_ID = os.environ.get('GOOGLE_CLIENT_ID')
+GOOGLE_CLIENT_SECRET = os.environ.get('GOOGLE_CLIENT_SECRET')
+GOOGLE_REDIRECT_URI = 'http://localhost:8000/auth/google'
+
+GOOGLE_OAUTH2 = GoogleOAuth20(GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET)
+
+
+@app.get('/login/google')
+async def login_google():
+    return GOOGLE_OAUTH2.get_authorization_url(redirect_uri='GOOGLE_REDIRECT_URI')
+
+
+@app.get('/auth/google')
+async def auth_google(oauth: OAuth20 = Depends()):
+    token, state = oauth
+    access_token = token['access_token']
+    print(access_token)
+    # do something
+    userinfo = GOOGLE_OAUTH2.get_userinfo(access_token)
+    print(userinfo)
+    # do something
+    return PlainTextResponse(content='恭喜你，OAuth2 登录成功', status_code=200)
diff --git a/pdm.lock b/pdm.lock
diff --git a/pre-commit.sh b/pre-commit.sh
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+pre-commit run --all-files --verbose --show-diff-on-failure
diff --git a/pyproject.toml b/pyproject.toml
@@ -0,0 +1,41 @@
+[project]
+name = "fastapi_oauth20"
+version = "0.0.1"
+description = "FastAPI easily integrates with clients OAuth 2.0"
+authors = [
+    { name = "Wu Clan", email = "jianhengwu0407@gmail.com" },
+]
+dependencies = [
+    "httpx>=0.18.0",
+    "fastapi>=0.100.0",
+]
+requires-python = ">=3.8"
+readme = "README.md"
+license = { text = "MIT" }
+
+[tool.pdm.dev-dependencies]
+lint = [
+    "ruff>=0.2.0",
+    "pre-commit>=3.5.0",
+]
+
+[tool.ruff]
+line-length = 120
+cache-dir = "./.ruff_cache"
+
+[tool.ruff.lint]
+extend-select = ["I"]
+
+[tool.ruff.lint.isort]
+lines-between-types = 1
+order-by-type = true
+
+[tool.ruff.format]
+quote-style = "single"
+
+[tool.pdm]
+package-type = "library"
+
+[build-system]
+requires = ["pdm-backend"]
+build-backend = "pdm.backend"
diff --git a/src/fastapi_oauth20/__init__.py b/src/fastapi_oauth20/__init__.py
diff --git a/src/fastapi_oauth20/clients/__init__.py b/src/fastapi_oauth20/clients/__init__.py
@@ -0,0 +1,2 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
diff --git a/src/fastapi_oauth20/clients/google.py b/src/fastapi_oauth20/clients/google.py
@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+import httpx
+
+from fastapi_oauth20.oauth20 import OAuth20Base
+
+AUTHORIZE_ENDPOINT = 'https://accounts.google.com/o/oauth2/v2/auth'
+ACCESS_TOKEN_ENDPOINT = 'https://oauth2.googleapis.com/token'
+REFRESH_TOKEN_ENDPOINT = ACCESS_TOKEN_ENDPOINT
+REVOKE_TOKEN_ENDPOINT = 'https://accounts.google.com/o/oauth2/revoke'
+DEFAULT_SCOPES = [
+    'OpenID',
+    'https://www.googleapis.com/auth/userinfo.email',
+    'https://www.googleapis.com/auth/userinfo.profile',
+]
+PROFILE_ENDPOINT = 'https://www.googleapis.com/oauth2/v1/userinfo'
+
+
+class GoogleOAuth20(OAuth20Base):
+    def __init__(self, client_id: str, client_secret: str):
+        super().__init__(
+            client_id=client_id,
+            client_secret=client_secret,
+            authorize_endpoint=AUTHORIZE_ENDPOINT,
+            access_token_endpoint=ACCESS_TOKEN_ENDPOINT,
+            refresh_token_endpoint=REFRESH_TOKEN_ENDPOINT,
+            revoke_token_endpoint=REVOKE_TOKEN_ENDPOINT,
+            oauth_callback_route_name='google',
+            default_scopes=DEFAULT_SCOPES,
+        )
+
+    async def get_userinfo(self, access_token: str) -> dict:
+        """Gets user info from Google"""
+        headers = {'Authorization': f'Bearer {access_token}'}
+        async with httpx.AsyncClient() as client:
+            response = await client.post(PROFILE_ENDPOINT, headers=headers)
+            await self.raise_httpx_oauth20_errors(response)
+
+        res = response.json()
+
+        return res
diff --git a/src/fastapi_oauth20/errors.py b/src/fastapi_oauth20/errors.py
@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+
+class HTTPXOAuth20Error(Exception):
+    """OAuth2 error for httpx raise for status"""
+
+    pass
+
+
+class RefreshTokenError(Exception):
+    """Refresh token error if the refresh endpoint is missing"""
+
+    pass
+
+
+class RevokeTokenError(Exception):
+    """Revoke token error if the revoke endpoint is missing"""
+
+    pass
diff --git a/src/fastapi_oauth20/integrations/__init__.py b/src/fastapi_oauth20/integrations/__init__.py
@@ -0,0 +1,2 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
diff --git a/src/fastapi_oauth20/integrations/fastapi.py b/src/fastapi_oauth20/integrations/fastapi.py
@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+from fastapi import Request
+
+from fastapi_oauth20.oauth20 import OAuth20Base
+
+
+class OAuth20:
+    def __init__(
+        self,
+        client: OAuth20Base,
+        redirect_uri: str | None = None,
+        oauth_callback_route_name: str | None = None,
+    ):
+        self.client = client
+        self.oauth_callback_route_name = oauth_callback_route_name
+        self.redirect_uri = redirect_uri
+
+    async def __call__(
+        self, request: Request, code: str, state: str | None, code_verifier: str | None = None
+    ) -> tuple[dict, str]:
+        if self.redirect_uri is None:
+            self.redirect_uri = str(request.url_for(self.oauth_callback_route_name))
+
+        access_token = await self.client.get_access_token(
+            code=code, redirect_uri=self.redirect_uri, code_verifier=code_verifier
+        )
+
+        return access_token, state
diff --git a/src/fastapi_oauth20/oauth20.py b/src/fastapi_oauth20/oauth20.py
@@ -0,0 +1,132 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+from urllib.parse import urlencode, urljoin
+
+import httpx
+
+from fastapi_oauth20.errors import HTTPXOAuth20Error, RefreshTokenError, RevokeTokenError
+
+
+class OAuth20Base:
+    def __init__(
+        self,
+        client_id: str,
+        client_secret: str,
+        authorize_endpoint: str,
+        access_token_endpoint: str,
+        refresh_token_endpoint: str | None = None,
+        revoke_token_endpoint: str | None = None,
+        oauth_callback_route_name: str = 'oauth20',
+        default_scopes: list[str] | None = None,
+    ):
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.authorize_endpoint = authorize_endpoint
+        self.access_token_endpoint = access_token_endpoint
+        self.refresh_token_endpoint = refresh_token_endpoint
+        self.revoke_token_endpoint = revoke_token_endpoint
+        self.oauth_callback_route_name = oauth_callback_route_name
+        self.default_scopes = default_scopes
+
+    async def get_authorization_url(
+        self,
+        redirect_uri: str,
+        state: str | None = None,
+        scope: list[str] | None = None,
+        extras_params: dict = None,
+    ) -> str:
+        """
+        Get authorization url for given.
+
+        :param redirect_uri: redirect uri
+        :param state: state to use
+        :param scope: scopes to use
+        :param extras_params: authorization url params
+        :return:
+        """
+        params = {
+            'client_id': self.client_id,
+            'redirect_uri': redirect_uri,
+            'response_type': 'code',
+        }
+
+        if state is not None:
+            params.update({'state': state})
+
+        _scope = scope or self.default_scopes
+        if _scope is not None:
+            params.update({'scope': ' '.join(_scope)})
+
+        if extras_params is not None:
+            params = params.update(extras_params)
+
+        authorization_url = urljoin(self.authorize_endpoint, '?' + urlencode(params))
+
+        return authorization_url
+
+    async def get_access_token(self, code: str, redirect_uri: str, code_verifier: str | None = None) -> dict:
+        """
+        Get access token for given.
+
+        :param code: authorization code
+        :param redirect_uri: redirect uri
+        :param code_verifier: the code verifier for the PKCE request
+        :return:
+        """
+        data = {
+            'code': code,
+            'client_id': self.client_id,
+            'client_secret': self.client_secret,
+            'redirect_uri': redirect_uri,
+            'grant_type': 'authorization_code',
+        }
+
+        if code_verifier:
+            data.update({'code_verifier': code_verifier})
+        async with httpx.AsyncClient() as client:
+            response = await client.post(self.access_token_endpoint, data=data)
+            await self.raise_httpx_oauth20_errors(response)
+
+            res = response.json()
+
+            return res
+
+    async def refresh_token(self, refresh_token: str) -> dict:
+        """Refresh the access token"""
+        if self.refresh_token_endpoint is None:
+            raise RefreshTokenError('The refresh token address is missing')
+        data = {
+            'client_id': self.client_id,
+            'client_secret': self.client_secret,
+            'refresh_token': refresh_token,
+            'grant_type': 'refresh_token',
+        }
+        async with httpx.AsyncClient() as client:
+            response = await client.post(self.refresh_token_endpoint, data=data)
+            await self.raise_httpx_oauth20_errors(response)
+
+            res = response.json()
+
+            return res
+
+    async def revoke_token(self, token: str, token_type_hint: str | None = None) -> None:
+        """Revoke the access token"""
+        if self.revoke_token_endpoint is None:
+            raise RevokeTokenError('The revoke token address is missing')
+
+        async with httpx.AsyncClient() as client:
+            data = {'token': token}
+
+            if token_type_hint is not None:
+                data.update({'token_type_hint': token_type_hint})
+
+            response = await client.post(self.revoke_token_endpoint, data=data)
+
+            await self.raise_httpx_oauth20_errors(response)
+
+    @staticmethod
+    async def raise_httpx_oauth20_errors(response: httpx.Response) -> None:
+        try:
+            response.raise_for_status()
+        except httpx.HTTPStatusError as e:
+            raise HTTPXOAuth20Error(e) from e
diff --git a/src/fastapi_oauth20/py.typed b/src/fastapi_oauth20/py.typed
diff --git a/tests/__init__.py b/tests/__init__.py

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+#!/usr/bin/env python3`
	`2`	`+# -- coding: utf-8 --`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+#!/usr/bin/env bash`
	`2`	`+`
	`3`	`+pre-commit run --all-files --verbose --show-diff-on-failure`