§
    t�’j�  ã                  ót   — d dl mZ d dlZd dlmZ d dlZd dlmZ  ej        d¦  «        Z	 G d„ d¦  «        Z
dS )é    )ÚannotationsN)ÚAny)ÚHTTPExceptionzdscons.auth.googlec                  ó0   — e Zd ZdZdd„Zddd„Z	 ddd„ZdS )ÚGoogleOAuthMixinzCGoogle OAuth 2.0 authorization URL and authorization code exchange.Úredirect_uriú
str | NoneÚreturnÚstrc                óÂ   ‡— | j         j        › d�}‰s|S | j         j        dddddf}t          ˆfd„|D ¦   «         ¦  «        r‰S t                               d‰¦  «         |S )zIValidate redirect_uri against permitted origins to prevent Open Redirect.z/v1/auth/google/callbackzhttps://dinhsonconstruction.comz#https://erp.dinhsonconstruction.comzhttp://127.0.0.1:8000zhttp://localhost:8000c              3  óB   •K  — | ]}‰                      |¦  «        V — Œd S ©N)Ú
startswith)Ú.0Úpr   s     €ú4C:\Projects\DSCons\app\services\auth\google_oauth.pyú	<genexpr>z:GoogleOAuthMixin._validate_redirect_uri.<locals>.<genexpr>   s1   øè è € ÐDÐD¨aˆ|×&Ò& qÑ)Ô)ÐDÐDÐDÐDÐDÐDó    z.[SECURITY] Rejected untrusted redirect_uri: %s)ÚsettingsÚapp_public_urlÚanyÚloggerÚwarning)Úselfr   Údefault_callbackÚallowed_prefixess    `  r   Ú_validate_redirect_uriz'GoogleOAuthMixin._validate_redirect_uri   s�   ø€ à"œmÔ:ÐTÐTÐTÐØð 	$Ø#Ð#ð ŒMÔ(Ø-Ø1Ø#Ø#Ø&ð
Ðõ ÐDÐDÐDÐDÐ3CÐDÑDÔDÑDÔDð 	 ØÐå�ŠÐGÈÑVÔVÐVØÐr   Nc                ó–   — | j         j        st          dd¬¦  «        ‚|                      |¦  «        }d}d| j         j        › d|› d|› d�S )	z;Generate Google OAuth 2.0 Authorization Consent Screen URL.é�  ud   GOOGLE_CLIENT_ID chÆ°a Ä‘Æ°á»£c cáº¥u hÃ¬nh trong .env. Vui lÃ²ng cung cáº¥p Google OAuth Client ID.©Ústatus_codeÚdetailzopenid email profilez7https://accounts.google.com/o/oauth2/v2/auth?client_id=z&redirect_uri=z&response_type=code&scope=z#&access_type=offline&prompt=consent)r   Úgoogle_client_idr   r   )r   r   ÚcallbackÚscopes       r   Úget_google_auth_urlz$GoogleOAuthMixin.get_google_auth_url#   sƒ   € àŒ}Ô-ð 	ÝØØ}ðñ ô ð ð
 ×.Ò.¨|Ñ<Ô<ˆØ&ˆðØœÔ7ðð à$ðð ð ð	ð ð ð	
r   Úcodeúdict[str, Any]c           
   ƒ  óŒ  K  — | j         j        r| j         j        st          dd¬¦  «        ‚|                      |¦  «        }d}t          j        d¬¦  «        4 ƒd{V —†}|                     ||| j         j        | j         j        |dd	œ¬
¦  «        ƒ d{V —†}|j        dk    rt          dd|j	        › �¬¦  «        ‚| 
                    ¦   «         }|                     d¦  «        }|                     ddd|› �i¬¦  «        ƒ d{V —†}	|	j        dk    rt          dd¬¦  «        ‚|	 
                    ¦   «         }
ddd¦  «        ƒd{V —† n# 1 ƒd{V —†swxY w Y   |                      |
¦  «        }|                      |¦  «        }d|t          |d         ¦  «        |d         |d         |d         |                     d¦  «        dœdœS )zKExchange Google authorization code for Access Token and fetch User Profile.r   u^   Google OAuth credentials (GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET) chÆ°a Ä‘Æ°á»£c cáº¥u hÃ¬nh.r    z#https://oauth2.googleapis.com/tokeng      .@)ÚtimeoutNÚauthorization_code)r'   Ú	client_idÚclient_secretr   Ú
grant_type)ÚdataéÈ   u(   KhÃ´ng thá»ƒ Ä‘á»•i Google OAuth token: Úaccess_tokenz-https://www.googleapis.com/oauth2/v3/userinfoÚAuthorizationzBearer )Úheadersu2   KhÃ´ng thá»ƒ táº£i thÃ´ng tin tÃ i khoáº£n Google.ÚBearerÚidÚemailÚ	full_nameÚroleÚ
avatar_url)r5   r6   r7   r8   r9   )Ú
token_typer1   Úuser)r   r#   Úgoogle_client_secretr   r   ÚhttpxÚAsyncClientÚpostr!   ÚtextÚjsonÚgetÚget_or_create_google_userÚcreate_jwt_tokenr   )r   r'   r   r$   Útoken_endpointÚclientÚ
token_respÚtokensr1   Úuserinfo_respÚgoogle_profiler;   Ú	jwt_tokens                r   Úexchange_google_codez%GoogleOAuthMixin.exchange_google_code7   sÕ  è è € ð Œ}Ô-ð 	°T´]Ô5Wð 	ÝØØwðñ ô ð ð
 ×.Ò.¨|Ñ<Ô<ˆØ>ˆåÔ$¨TÐ2Ñ2Ô2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2°fØ%Ÿ{š{Øà Ø!%¤Ô!?Ø%)¤]Ô%GØ$,Ø"6ðð ð  +ñ 	 ô 	 ð 	ð 	ð 	ð 	ð 	ð 	ˆJð Ô%¨Ò,Ð,Ý#Ø #ØWÀjÄoÐWÐWðñ ô ð ð
  —_’_Ñ&Ô&ˆFØ!Ÿ:š: nÑ5Ô5ˆLð #)§*¢*Ø?Ø(Ð*B°LÐ*BÐ*BÐCð #-ñ #ô #ð ð ð ð ð ð ˆMð Ô(¨CÒ/Ð/Ý#Ø #Ð,`ðñ ô ð ð +×/Ò/Ñ1Ô1ˆNð=	2ð 	2ð 	2ñ 	2ô 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2ð 	2øøøð 	2ð 	2ð 	2ð 	2ðB ×-Ò-¨nÑ=Ô=ˆØ×)Ò)¨$Ñ/Ô/ˆ	ð #Ø%å˜$˜tœ*‘o”oØ˜gœØ! +Ô.Ø˜VœØ"Ÿhšh |Ñ4Ô4ðð ð

ð 

ð 
	
s   ÁCEÅ
EÅE)r   r	   r
   r   r   )r'   r   r   r	   r
   r(   )Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   r&   rL   © r   r   r   r      se   € € € € € ØMÐMð ð  ð  ð  ð(
ð 
ð 
ð 
ð 
ð* 59ð;
ð ;
ð ;
ð ;
ð ;
ð ;
ð ;
r   r   )Ú
__future__r   ÚloggingÚtypingr   r=   Úfastapir   Ú	getLoggerr   r   rQ   r   r   ú<module>rW      sœ   ðØ "Ð "Ð "Ð "Ð "Ð "à €€€Ø Ð Ð Ð Ð Ð à €€€Ø !Ð !Ð !Ð !Ð !Ð !à	ˆÔ	Ð/Ñ	0Ô	0€ðf
ð f
ð f
ð f
ð f
ñ f
ô f
ð f
ð f
ð f
r   