U)jdZddlmZddlZddlZddlZddlZddlZddlm Z ddl Z eje Z dZdZdZddZ dd Zef dd ZGd d Zef dd Zy)zeBay OAuth2 token management: exchange, refresh, and secure file-based storage. Tokens are stored in a JSON file outside the repo (default: /var/lib/agent-samochodowy/ebay_tokens.json) with 600 permissions so only the service user can read them. ) annotationsN)Pathz-https://api.ebay.com/identity/v1/oauth2/tokenahttps://api.ebay.com/oauth/api_scope https://api.ebay.com/oauth/api_scope/sell.inventory.readonly https://api.ebay.com/oauth/api_scope/sell.inventory https://api.ebay.com/oauth/api_scope/sell.account.readonly https://api.ebay.com/oauth/api_scope/sell.accountz+/var/lib/agent-samochodowy/ebay_tokens.jsoncx|d|}dtj|jjzS)z#Build HTTP Basic auth header value.:zBasic )base64 b64encodeencodedecode) client_id client_secretcredss N/var/www/html/agent.samochodowy/src/agent_samochodowy/compliance/ebay_oauth.py _basic_authr"s7k=/ *E f&&u||~6==? ??ctjtdt||dd||dd}|j |j S)ztExchange an authorization code for access_token + refresh_token. Returns the raw eBay token response dict. !application/x-www-form-urlencodedz Content-Type Authorizationauthorization_code) grant_typecode redirect_uriheadersdatatimeouthttpxpostEBAY_TOKEN_URLrraise_for_statusjson)rr r rresps rexchange_code_for_tokensr%(sV ::?(MB /(  D  99;rctjtdt||dd||dd}|j |j S)zeUse a refresh_token to obtain a new access_token. Returns the raw eBay token response dict. rr refresh_token)rr'scoperrr)r'r r scopesr$s rrefresh_access_tokenr*CsV ::?(MB **  D  99;rcbeZdZdZefd dZd dZd dZed dZ ed dZ ed dZ y)EbayTokenStorezKManages eBay OAuth tokens in a local JSON file with restricted permissions.c$t||_y)N)rpath)selfr.s r__init__zEbayTokenStore.__init__es J rc|j}|j|tj|d<|jjj dd|jj tj|dtj|jdtjd|jy) zPersist token data to disk. Merges with existing data so that a refresh (which does NOT return a new refresh_token) does not overwrite the stored refresh_token. updated_atT)parentsexist_ok)indentizeBay tokens saved to %sN) loadupdatetimer.parentmkdir write_textr#dumpsoschmodloggerinfo)r/ token_dataexistings rsavezEbayTokenStore.savehs 99; #!% td; TZZ;< E" -tyy9rc(|jjsiS tj|jj S#tj t f$r-}tjd|j|icYd}~Sd}~wwxYw)z7Load stored tokens. Returns empty dict if file missing.z Failed to read token file %s: %sN) r.existsr#loads read_textJSONDecodeErrorOSErrorr@warning)r/es rr7zEbayTokenStore.loadwsmyy!I ::dii1134 4$$g.  NN=tyy! LI s,A B$"B B BcD|j}|jdS)N access_tokenr7getr/rs rrNzEbayTokenStore.access_tokensyy{xx''rcD|j}|jdS)Nr'rOrQs rr'zEbayTokenStore.refresh_tokensyy{xx((rc|j}|jdd}|jdd}|r|sytj||zdz kDS)zFConservative check: treat token as expired 5 min before actual expiry.r2r expires_inTi,)r7rPr9)r/rupdatedrTs r is_expiredzEbayTokenStore.is_expiredsRyy{((<+XXlA. jyy{g 2S899rN)r.strreturnNone)rBdictrXrY)rXrZ)rXz str | None)rXbool) __name__ __module__ __qualname____doc__DEFAULT_TOKEN_PATHr0rDr7propertyrNr'rVrrr,r,bsSU#5 :(())::rr,c|js|j}|r|S|j}|s tdtj dt ||||}|j|tj d|dS)zuReturn a valid access token, refreshing if necessary. Raises RuntimeError if no refresh_token is available. z^No refresh_token available. Run the OAuth consent flow first: python scripts/ebay_authorize.pyz(eBay access token expired, refreshing...z(eBay access token refreshed successfullyrN)rVrNr' RuntimeErrorr@rAr*rD)r r token_storer)token refresh_tokrBs rget_valid_access_tokenrhs  ! !(( L++K  /   KK:;%k9mVTJZ  KK:; n %%r)r rWr rWrXrW) rrWr rWr rWrrWrXrZ) r'rWr rWr rWr)rWrXrZ) r rWr rWrer,r)rWrXrW)r_ __future__rrr#loggingr>r9pathlibrr getLoggerr\r@r!DEFAULT_SCOPESr`rr%r*r,rhrbrrrns #     8 $@8C@     >!     >1:1:p! &&& &  &  &r