google-reauth

import os from google_reauth import web_reauth_challenge, web_reauth_credential # --- Configuration --- # You must obtain these from your Google Cloud Project's OAuth 2.0 Client IDs. # Set them as environment variables or replace placeholders. GOOGLE_CLIENT_ID = os.environ.get('GOOGLE_CLIENT_ID', 'YOUR_GOOGLE_CLIENT_ID') GOOGLE_CLIENT_SECRET = os.environ.get('GOOGLE_CLIENT_SECRET', 'YOUR_GOOGLE_CLIENT_SECRET') # The URI Google will redirect to after the user completes the reauth challenge. # This MUST exactly match one of the authorized redirect URIs configured in your # Google Cloud Project for the given client ID (e.g., http://localhost:5000/verify-reauth). REDIRECT_URI = "http://localhost:5000/verify-reauth" # --- Step 1: Start the Reauth Challenge Flow --- # This typically happens when a user attempts a sensitive action in your web application. print("\n--- Starting Reauth Challenge ---") try: flow = web_reauth_challenge.start_reauth_challenge_flow( client_id=GOOGLE_CLIENT_ID, client_secret=GOOGLE_CLIENT_SECRET, session_id="user-session-abc-123", # A unique ID for the user's current session redirect_uri=REDIRECT_URI, scopes=["openid", "email", "profile"], # Scopes for the user's identity ) print(f"User needs to re-authenticate. Redirect them to: {flow.redirect_url}") print(f"Store this challenge_id for verification: {flow.challenge_id}") # In a real web application, you would: # 1. Store `flow.challenge_id` in a session or cookie before redirecting. # 2. Redirect the user's browser to `flow.redirect_url`. # 3. The user completes the reauth on Google's side. # 4. Google redirects the user back to your `REDIRECT_URI` with a `code` # and `state` (or similar) in the URL parameters. # --- Step 2: Verify the Credential (Simulated) --- print("\n--- Simulating Verification (after user returns from Google) ---") print("To run this part, you need a 'code' from Google's redirect.") print("Manually complete the reauth flow in a browser using the URL above.") print("Then, uncomment and fill in the 'received_code' to verify the credential.") # Example of how verification would look (requires a real 'code'): # received_code = "_YOUR_AUTH_CODE_FROM_REDIRECT_" # received_challenge_id = flow.challenge_id # Use the one from step 1 # # if received_code and received_challenge_id: # credential = web_reauth_credential.verify_credential( # client_id=GOOGLE_CLIENT_ID, # client_secret=GOOGLE_CLIENT_SECRET, # code=received_code, # redirect_uri=REDIRECT_URI, # challenge_id=received_challenge_id, # ) # print(f"Re-authentication successful! User sub: {credential.id_token_data.get('sub')}") # else: # print("Skipping verification: 'received_code' not set.") except Exception as e: print(f"An error occurred: {e}") print("Ensure GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are set and valid.") print("Also, ensure REDIRECT_URI is registered in your Google Cloud Project.")