Chris Christiansen
9fcb9c354a
Some checks are pending
Check Python Version Consistency / Check Python Version (push) Waiting to run
77 lines
2.5 KiB
Python
77 lines
2.5 KiB
Python
"""
|
|
auth/token_store.py — Lagre og hente OAuth2-tokens per klient i Secret Manager.
|
|
|
|
Hvert token lagres som en JSON-streng under secret-navn:
|
|
osvauco-client-token-{client_id}
|
|
|
|
Bruk:
|
|
from auth.token_store import save_token, load_credentials
|
|
|
|
save_token("klient-abc", token_dict)
|
|
creds = load_credentials("klient-abc") # google.oauth2.credentials.Credentials
|
|
"""
|
|
|
|
import json
|
|
import os
|
|
from google.cloud import secretmanager
|
|
from google.oauth2.credentials import Credentials
|
|
|
|
PROJECT_ID = os.environ.get("PROJECT_ID", "propane-will-491900-m5")
|
|
|
|
|
|
def _secret_name(client_id: str) -> str:
|
|
return f"osvauco-client-token-{client_id}"
|
|
|
|
|
|
def save_token(client_id: str, token_dict: dict) -> None:
|
|
"""
|
|
Lagrer eller oppdaterer OAuth2-token for klient i Secret Manager.
|
|
Oppretter secret hvis den ikke finnes.
|
|
"""
|
|
client = secretmanager.SecretManagerServiceClient()
|
|
parent = f"projects/{PROJECT_ID}"
|
|
secret_id = _secret_name(client_id)
|
|
secret_path = f"{parent}/secrets/{secret_id}"
|
|
payload = json.dumps(token_dict).encode("utf-8")
|
|
|
|
# Opprett secret hvis den ikke finnes
|
|
try:
|
|
client.get_secret(name=secret_path)
|
|
except Exception:
|
|
client.create_secret(
|
|
request={
|
|
"parent": parent,
|
|
"secret_id": secret_id,
|
|
"secret": {"replication": {"automatic": {}}},
|
|
}
|
|
)
|
|
|
|
# Legg til ny versjon (ny verdi)
|
|
client.add_secret_version(
|
|
request={"parent": secret_path, "payload": {"data": payload}}
|
|
)
|
|
|
|
|
|
def load_credentials(client_id: str) -> Credentials:
|
|
"""
|
|
Henter siste token for klient fra Secret Manager.
|
|
Returnerer google.oauth2.credentials.Credentials klar til bruk.
|
|
Kaster KeyError hvis client_id ikke finnes.
|
|
"""
|
|
sm_client = secretmanager.SecretManagerServiceClient()
|
|
secret_path = f"projects/{PROJECT_ID}/secrets/{_secret_name(client_id)}/versions/latest"
|
|
try:
|
|
response = sm_client.access_secret_version(name=secret_path)
|
|
except Exception as exc:
|
|
raise KeyError(f"Ingen token funnet for klient '{client_id}': {exc}") from exc
|
|
|
|
token_dict = json.loads(response.payload.data.decode("utf-8"))
|
|
return Credentials(
|
|
token=token_dict.get("token"),
|
|
refresh_token=token_dict.get("refresh_token"),
|
|
token_uri=token_dict.get("token_uri", "https://oauth2.googleapis.com/token"),
|
|
client_id=token_dict.get("client_id"),
|
|
client_secret=token_dict.get("client_secret"),
|
|
scopes=token_dict.get("scopes"),
|
|
)
|