import time from secrets import token_urlsafe from typing import Any, Optional import orjson from authlib.integrations.starlette_client import OAuth from authlib.oauth2.rfc7636 import create_s256_code_challenge from graphql import GraphQLResolveInfo from starlette.requests import Request from starlette.responses import JSONResponse, RedirectResponse from auth.orm import Author from auth.tokenstorage import TokenStorage from resolvers.auth import generate_unique_slug from services.db import local_session from services.redis import redis from settings import FRONTEND_URL, OAUTH_CLIENTS from utils.logger import root_logger as logger oauth = OAuth() # OAuth state management через Redis (TTL 10 минут) OAUTH_STATE_TTL = 600 # 10 минут # Конфигурация провайдеров PROVIDERS = { "google": { "name": "google", "server_metadata_url": "https://accounts.google.com/.well-known/openid-configuration", "client_kwargs": {"scope": "openid email profile", "prompt": "select_account"}, }, "github": { "name": "github", "access_token_url": "https://github.com/login/oauth/access_token", "authorize_url": "https://github.com/login/oauth/authorize", "api_base_url": "https://api.github.com/", "client_kwargs": {"scope": "user:email"}, }, "facebook": { "name": "facebook", "access_token_url": "https://graph.facebook.com/v13.0/oauth/access_token", "authorize_url": "https://www.facebook.com/v13.0/dialog/oauth", "api_base_url": "https://graph.facebook.com/", "client_kwargs": {"scope": "public_profile email"}, }, "x": { "name": "x", "access_token_url": "https://api.twitter.com/2/oauth2/token", "authorize_url": "https://twitter.com/i/oauth2/authorize", "api_base_url": "https://api.twitter.com/2/", "client_kwargs": {"scope": "tweet.read users.read offline.access"}, }, "telegram": { "name": "telegram", "authorize_url": "https://oauth.telegram.org/auth", "api_base_url": "https://api.telegram.org/", "client_kwargs": {"scope": "user:read"}, }, "vk": { "name": "vk", "access_token_url": "https://oauth.vk.com/access_token", "authorize_url": "https://oauth.vk.com/authorize", "api_base_url": "https://api.vk.com/method/", "client_kwargs": {"scope": "email", "v": "5.131"}, }, "yandex": { "name": "yandex", "access_token_url": "https://oauth.yandex.ru/token", "authorize_url": "https://oauth.yandex.ru/authorize", "api_base_url": "https://login.yandex.ru/info", "client_kwargs": {"scope": "login:email login:info"}, }, } # Регистрация провайдеров for provider, config in PROVIDERS.items(): if provider in OAUTH_CLIENTS and OAUTH_CLIENTS[provider.upper()]: client_config = OAUTH_CLIENTS[provider.upper()] if "id" in client_config and "key" in client_config: try: # Регистрируем провайдеров вручную для избежания проблем типизации if provider == "google": oauth.register( name="google", client_id=client_config["id"], client_secret=client_config["key"], server_metadata_url="https://accounts.google.com/.well-known/openid-configuration", ) elif provider == "github": oauth.register( name="github", client_id=client_config["id"], client_secret=client_config["key"], access_token_url="https://github.com/login/oauth/access_token", authorize_url="https://github.com/login/oauth/authorize", api_base_url="https://api.github.com/", ) elif provider == "facebook": oauth.register( name="facebook", client_id=client_config["id"], client_secret=client_config["key"], access_token_url="https://graph.facebook.com/v13.0/oauth/access_token", authorize_url="https://www.facebook.com/v13.0/dialog/oauth", api_base_url="https://graph.facebook.com/", ) elif provider == "x": oauth.register( name="x", client_id=client_config["id"], client_secret=client_config["key"], access_token_url="https://api.twitter.com/2/oauth2/token", authorize_url="https://twitter.com/i/oauth2/authorize", api_base_url="https://api.twitter.com/2/", ) elif provider == "telegram": oauth.register( name="telegram", client_id=client_config["id"], client_secret=client_config["key"], authorize_url="https://oauth.telegram.org/auth", api_base_url="https://api.telegram.org/", ) elif provider == "vk": oauth.register( name="vk", client_id=client_config["id"], client_secret=client_config["key"], access_token_url="https://oauth.vk.com/access_token", authorize_url="https://oauth.vk.com/authorize", api_base_url="https://api.vk.com/method/", ) elif provider == "yandex": oauth.register( name="yandex", client_id=client_config["id"], client_secret=client_config["key"], access_token_url="https://oauth.yandex.ru/token", authorize_url="https://oauth.yandex.ru/authorize", api_base_url="https://login.yandex.ru/info", ) logger.info(f"OAuth provider {provider} registered successfully") except Exception as e: logger.error(f"Failed to register OAuth provider {provider}: {e}") continue async def get_user_profile(provider: str, client, token) -> dict: """Получает профиль пользователя от провайдера OAuth""" if provider == "google": userinfo = token.get("userinfo", {}) return { "id": userinfo.get("sub"), "email": userinfo.get("email"), "name": userinfo.get("name"), "picture": userinfo.get("picture", "").replace("=s96", "=s600"), } if provider == "github": profile = await client.get("user", token=token) profile_data = profile.json() emails = await client.get("user/emails", token=token) emails_data = emails.json() primary_email = next((email["email"] for email in emails_data if email["primary"]), None) return { "id": str(profile_data["id"]), "email": primary_email or profile_data.get("email"), "name": profile_data.get("name") or profile_data.get("login"), "picture": profile_data.get("avatar_url"), } if provider == "facebook": profile = await client.get("me?fields=id,name,email,picture.width(600)", token=token) profile_data = profile.json() return { "id": profile_data["id"], "email": profile_data.get("email"), "name": profile_data.get("name"), "picture": profile_data.get("picture", {}).get("data", {}).get("url"), } if provider == "x": # Twitter/X API v2 profile = await client.get("users/me?user.fields=id,name,username,profile_image_url", token=token) profile_data = profile.json() user_data = profile_data.get("data", {}) return { "id": user_data.get("id"), "email": None, # X не предоставляет email через API "name": user_data.get("name") or user_data.get("username"), "picture": user_data.get("profile_image_url", "").replace("_normal", "_400x400"), } if provider == "telegram": # Telegram OAuth (через Telegram Login Widget) # Данные обычно приходят в token параметрах return { "id": str(token.get("id", "")), "email": None, # Telegram не предоставляет email "phone": str(token.get("phone_number", "")), "name": token.get("first_name", "") + " " + token.get("last_name", ""), "picture": token.get("photo_url"), } if provider == "vk": # VK API profile = await client.get("users.get?fields=photo_400_orig,contacts&v=5.131", token=token) profile_data = profile.json() if profile_data.get("response"): user_data = profile_data["response"][0] return { "id": str(user_data["id"]), "email": user_data.get("contacts", {}).get("email"), "name": f"{user_data.get('first_name', '')} {user_data.get('last_name', '')}".strip(), "picture": user_data.get("photo_400_orig"), } if provider == "yandex": # Yandex API profile = await client.get("?format=json", token=token) profile_data = profile.json() return { "id": profile_data.get("id"), "email": profile_data.get("default_email"), "name": profile_data.get("display_name") or profile_data.get("real_name"), "picture": f"https://avatars.yandex.net/get-yapic/{profile_data.get('default_avatar_id')}/islands-200" if profile_data.get("default_avatar_id") else None, } return {} async def oauth_login(_: None, _info: GraphQLResolveInfo, provider: str, callback_data: dict[str, Any]) -> JSONResponse: """ Обработка OAuth авторизации Args: provider: Провайдер OAuth (google, github, etc.) callback_data: Данные из callback-а Returns: dict: Результат авторизации с токеном или ошибкой """ if provider not in PROVIDERS: return JSONResponse({"error": "Invalid provider"}, status_code=400) client = oauth.create_client(provider) if not client: return JSONResponse({"error": "Provider not configured"}, status_code=400) # Получаем параметры из query string state = callback_data.get("state") redirect_uri = callback_data.get("redirect_uri", FRONTEND_URL) if not state: return JSONResponse({"error": "State parameter is required"}, status_code=400) # Генерируем PKCE challenge code_verifier = token_urlsafe(32) code_challenge = create_s256_code_challenge(code_verifier) # Сохраняем состояние OAuth в Redis oauth_data = { "code_verifier": code_verifier, "provider": provider, "redirect_uri": redirect_uri, "created_at": int(time.time()), } await store_oauth_state(state, oauth_data) # Используем URL из фронтенда для callback oauth_callback_uri = f"{callback_data['base_url']}oauth/{provider}/callback" try: return await client.authorize_redirect( callback_data["request"], oauth_callback_uri, code_challenge=code_challenge, code_challenge_method="S256", state=state, ) except Exception as e: logger.error(f"OAuth redirect error for {provider}: {e!s}") return JSONResponse({"error": str(e)}, status_code=500) async def oauth_callback(request): """Обрабатывает callback от OAuth провайдера""" try: # Получаем state из query параметров state = request.query_params.get("state") if not state: return JSONResponse({"error": "State parameter missing"}, status_code=400) # Получаем сохраненные данные OAuth из Redis oauth_data = await get_oauth_state(state) if not oauth_data: return JSONResponse({"error": "Invalid or expired OAuth state"}, status_code=400) provider = oauth_data.get("provider") code_verifier = oauth_data.get("code_verifier") stored_redirect_uri = oauth_data.get("redirect_uri", FRONTEND_URL) if not provider: return JSONResponse({"error": "No active OAuth session"}, status_code=400) client = oauth.create_client(provider) if not client: return JSONResponse({"error": "Provider not configured"}, status_code=400) # Получаем токен с PKCE verifier token = await client.authorize_access_token(request, code_verifier=code_verifier) # Получаем профиль пользователя profile = await get_user_profile(provider, client, token) # Для некоторых провайдеров (X, Telegram) email может отсутствовать email = profile.get("email") if not email: # Генерируем временный email на основе провайдера и ID email = f"{provider}_{profile.get('id', 'unknown')}@oauth.local" logger.info(f"Generated temporary email for {provider} user: {email}") # Создаем или обновляем пользователя with local_session() as session: # Сначала ищем пользователя по OAuth author = Author.find_by_oauth(provider, profile["id"], session) if author: # Пользователь найден по OAuth - обновляем данные author.set_oauth_account(provider, profile["id"], email=profile.get("email")) # Обновляем основные данные автора если они пустые if profile.get("name") and not author.name: author.name = profile["name"] # type: ignore[assignment] if profile.get("picture") and not author.pic: author.pic = profile["picture"] # type: ignore[assignment] author.updated_at = int(time.time()) # type: ignore[assignment] author.last_seen = int(time.time()) # type: ignore[assignment] else: # Ищем пользователя по email если есть настоящий email author = None if email and email != f"{provider}_{profile.get('id', 'unknown')}@oauth.local": author = session.query(Author).filter(Author.email == email).first() if author: # Пользователь найден по email - добавляем OAuth данные author.set_oauth_account(provider, profile["id"], email=profile.get("email")) # Обновляем данные автора если нужно if profile.get("name") and not author.name: author.name = profile["name"] # type: ignore[assignment] if profile.get("picture") and not author.pic: author.pic = profile["picture"] # type: ignore[assignment] author.updated_at = int(time.time()) # type: ignore[assignment] author.last_seen = int(time.time()) # type: ignore[assignment] else: # Создаем нового пользователя slug = generate_unique_slug(profile["name"] or f"{provider}_{profile.get('id', 'user')}") author = Author( email=email, name=profile["name"] or f"{provider.title()} User", slug=slug, pic=profile.get("picture"), email_verified=True if profile.get("email") else False, created_at=int(time.time()), updated_at=int(time.time()), last_seen=int(time.time()), ) session.add(author) session.flush() # Получаем ID автора # Добавляем OAuth данные для нового пользователя author.set_oauth_account(provider, profile["id"], email=profile.get("email")) session.commit() # Создаем токен сессии session_token = await TokenStorage.create_session(str(author.id)) # Формируем URL для редиректа с токеном redirect_url = f"{stored_redirect_uri}?state={state}&access_token={session_token}" response = RedirectResponse(url=redirect_url) response.set_cookie( "session_token", session_token, httponly=True, secure=True, samesite="lax", max_age=30 * 24 * 60 * 60, # 30 days ) return response except Exception as e: logger.error(f"OAuth callback error: {e!s}") # В случае ошибки редиректим на фронтенд с ошибкой fallback_redirect = request.query_params.get("redirect_uri", FRONTEND_URL) return RedirectResponse(url=f"{fallback_redirect}?error=oauth_failed&message={e!s}") async def store_oauth_state(state: str, data: dict) -> None: """Сохраняет OAuth состояние в Redis с TTL""" key = f"oauth_state:{state}" await redis.execute("SETEX", key, OAUTH_STATE_TTL, orjson.dumps(data)) async def get_oauth_state(state: str) -> Optional[dict]: """Получает и удаляет OAuth состояние из Redis (one-time use)""" key = f"oauth_state:{state}" data = await redis.execute("GET", key) if data: await redis.execute("DEL", key) # Одноразовое использование return orjson.loads(data) return None # HTTP handlers для тестирования async def oauth_login_http(request: Request) -> JSONResponse | RedirectResponse: """HTTP handler для OAuth login""" try: provider = request.path_params.get("provider") if not provider or provider not in PROVIDERS: return JSONResponse({"error": "Invalid provider"}, status_code=400) client = oauth.create_client(provider) if not client: return JSONResponse({"error": "Provider not configured"}, status_code=400) # Генерируем PKCE challenge code_verifier = token_urlsafe(32) code_challenge = create_s256_code_challenge(code_verifier) state = token_urlsafe(32) # Сохраняем состояние в сессии request.session["code_verifier"] = code_verifier request.session["provider"] = provider request.session["state"] = state # Сохраняем состояние OAuth в Redis oauth_data = { "code_verifier": code_verifier, "provider": provider, "redirect_uri": FRONTEND_URL, "created_at": int(time.time()), } await store_oauth_state(state, oauth_data) # URL для callback callback_uri = f"{FRONTEND_URL}oauth/{provider}/callback" return await client.authorize_redirect( request, callback_uri, code_challenge=code_challenge, code_challenge_method="S256", state=state, ) except Exception as e: logger.error(f"OAuth login error: {e}") return JSONResponse({"error": "OAuth login failed"}, status_code=500) async def oauth_callback_http(request: Request) -> JSONResponse | RedirectResponse: """HTTP handler для OAuth callback""" try: # Используем GraphQL resolver логику provider = request.session.get("provider") if not provider: return JSONResponse({"error": "No OAuth session found"}, status_code=400) state = request.query_params.get("state") session_state = request.session.get("state") if not state or state != session_state: return JSONResponse({"error": "Invalid or expired OAuth state"}, status_code=400) oauth_data = await get_oauth_state(state) if not oauth_data: return JSONResponse({"error": "Invalid or expired OAuth state"}, status_code=400) # Используем существующую логику client = oauth.create_client(provider) token = await client.authorize_access_token(request) profile = await get_user_profile(provider, client, token) if not profile: return JSONResponse({"error": "Failed to get user profile"}, status_code=400) # Для некоторых провайдеров (X, Telegram) email может отсутствовать email = profile.get("email") if not email: # Генерируем временный email на основе провайдера и ID email = f"{provider}_{profile.get('id', 'unknown')}@oauth.local" # Регистрируем/обновляем пользователя with local_session() as session: # Сначала ищем пользователя по OAuth author = Author.find_by_oauth(provider, profile["id"], session) if author: # Пользователь найден по OAuth - обновляем данные author.set_oauth_account(provider, profile["id"], email=profile.get("email")) # Обновляем основные данные автора если они пустые if profile.get("name") and not author.name: author.name = profile["name"] # type: ignore[assignment] if profile.get("picture") and not author.pic: author.pic = profile["picture"] # type: ignore[assignment] author.updated_at = int(time.time()) # type: ignore[assignment] author.last_seen = int(time.time()) # type: ignore[assignment] else: # Ищем пользователя по email если есть настоящий email author = None if email and email != f"{provider}_{profile.get('id', 'unknown')}@oauth.local": author = session.query(Author).filter(Author.email == email).first() if author: # Пользователь найден по email - добавляем OAuth данные author.set_oauth_account(provider, profile["id"], email=profile.get("email")) # Обновляем данные автора если нужно if profile.get("name") and not author.name: author.name = profile["name"] # type: ignore[assignment] if profile.get("picture") and not author.pic: author.pic = profile["picture"] # type: ignore[assignment] author.updated_at = int(time.time()) # type: ignore[assignment] author.last_seen = int(time.time()) # type: ignore[assignment] else: # Создаем нового пользователя slug = generate_unique_slug(profile["name"] or f"{provider}_{profile.get('id', 'user')}") author = Author( email=email, name=profile["name"] or f"{provider.title()} User", slug=slug, pic=profile.get("picture"), email_verified=True if profile.get("email") else False, created_at=int(time.time()), updated_at=int(time.time()), last_seen=int(time.time()), ) session.add(author) session.flush() # Получаем ID автора # Добавляем OAuth данные для нового пользователя author.set_oauth_account(provider, profile["id"], email=profile.get("email")) session.commit() # Создаем токен сессии session_token = await TokenStorage.create_session(str(author.id)) # Очищаем OAuth сессию request.session.pop("code_verifier", None) request.session.pop("provider", None) request.session.pop("state", None) # Возвращаем redirect с cookie response = RedirectResponse(url="/auth/success", status_code=307) response.set_cookie( "session_token", session_token, httponly=True, secure=True, samesite="lax", max_age=30 * 24 * 60 * 60, # 30 дней ) return response except Exception as e: logger.error(f"OAuth callback error: {e}") return JSONResponse({"error": "OAuth callback failed"}, status_code=500)