Google Sign-In: iOS va Android id_token'ini backend'da to'g'ri verify qilish

Mobil ilova ──(Google SDK)──► Google ──► id_token (JWT)
     │
     └──POST /api/auth/google/ {"id_token": "..."}──► bizning backend
                                                          │
                          1) signature — Google'ning public key'i bilan
                          2) audience — token AYNAN BIZNING client ID uchunmi
                          3) iss / exp / iat — kim, qachongacha
                          4) sub bo'yicha identity: topish yoki yaratish
                          5) o'zimizning access/refresh token'ni qaytarish

import os

from django.core.exceptions import ImproperlyConfigured

INSTALLED_APPS = [
    # ...
    "apps.accounts",
]

# vergul bilan: "123-web.apps.googleusercontent.com,123-ios.apps.googleusercontent.com"
GOOGLE_CLIENT_IDS = [
    cid.strip() for cid in os.environ.get("GOOGLE_CLIENT_IDS", "").split(",") if cid.strip()
]
if not GOOGLE_CLIENT_IDS:
    # bo'sh ro'yxat — hamma login yiqiladi. Buni deploy paytida bilgan
    # yaxshi, birinchi foydalanuvchi shikoyat qilganda emas.
    # CI va test muhitiga ham qiymat berib qo'ying (.env.example)
    raise ImproperlyConfigured("GOOGLE_CLIENT_IDS bo'sh")

uv add google-auth cachecontrol djangorestframework-simplejwt

from dataclasses import dataclass

import cachecontrol
import requests
from django.conf import settings
from google.auth import exceptions as google_exceptions
from google.auth.transport import requests as google_requests
from google.oauth2 import id_token as google_id_token


class GoogleAuthError(Exception):
    """id_token yaroqsiz — sababi client'ga ochilmaydi."""


class GoogleUnavailable(Exception):
    """Google'ning certs endpoint'iga yetib bo'lmadi — token aybdor emas."""


@dataclass(frozen=True)
class GoogleIdentity:
    sub: str  # Google hisobining O'ZGARMAS ID'si
    email: str
    name: str
    picture: str


# Bitta session butun process uchun. cachecontrol Google javobidagi
# Cache-Control'ni o'qib, public key'larni xotirada saqlaydi
_cached_session = cachecontrol.CacheControl(requests.Session())
_google_request = google_requests.Request(session=_cached_session)


def verify_google_token(raw_token: str) -> GoogleIdentity:
    try:
        # verify_oauth2_token uch ishni birdan qiladi:
        # 1) Google'ning public key'lari bilan SIGNATURE tekshiruvi
        # 2) exp va iat tekshiruvi
        # 3) iss accounts.google.com (yoki https://accounts.google.com) ekani
        claims = google_id_token.verify_oauth2_token(
            raw_token,
            _google_request,
            # audience list ham bo'ladi — kutubxonaning o'zi allowlist bilan
            # solishtiradi. Bu yerga None yozilsa, `aud` UMUMAN tekshirilmaydi
            audience=settings.GOOGLE_CLIENT_IDS,
            # server soati Google'nikidan bir necha soniya farq qilsa,
            # yangi token "Token used too early" bilan rad etilmasin
            clock_skew_in_seconds=10,
        )
    except google_exceptions.TransportError as exc:
        # Google javob bermadi. Bu "token yaroqsiz" degani EMAS —
        # shuning uchun alohida xato (pastda 503 bo'lib qaytadi)
        raise GoogleUnavailable(str(exc)) from exc
    except (ValueError, google_exceptions.GoogleAuthError) as exc:
        # signature, exp/iat va aud xatolari ValueError bo'lib keladi
        # (InvalidValue, MalformedError — ikkalasi ham ValueError avlodi).
        # Wrong issuer esa sof GoogleAuthError: uni ushlamasak,
        # endpoint 401 o'rniga 500 qaytaradi
        raise GoogleAuthError(str(exc)) from exc

    if not claims.get("email_verified", False):
        raise GoogleAuthError("email_verified = false")

    email = claims.get("email")
    if not email:
        # email scope so'ralmagan bo'lsa, claim umuman kelmaydi:
        # claims["email"] bu yerda KeyError va 500 bo'lardi
        raise GoogleAuthError("email claim yo'q")

    return GoogleIdentity(
        sub=claims["sub"],
        email=email,
        name=claims.get("name", ""),
        picture=claims.get("picture", ""),
    )

from django.conf import settings
from django.db import models


class GoogleAccount(models.Model):
    """Google hisobi ↔ bizning User orasidagi bog'lanish."""

    user = models.OneToOneField(
        settings.AUTH_USER_MODEL,
        on_delete=models.CASCADE,
        related_name="google_account",
    )
    # unique — nafaqat toza ma'lumot uchun: pastda race condition'ni
    # aynan shu constraint to'xtatadi
    sub = models.CharField(max_length=255, unique=True)
    email = models.EmailField()
    created_at = models.DateTimeField(auto_now_add=True)

    def __str__(self):
        return f"{self.email} ({self.sub})"

from django.contrib.auth import get_user_model
from django.db import IntegrityError, transaction

from .google import GoogleIdentity
from .models import GoogleAccount

User = get_user_model()


def get_or_create_user(identity: GoogleIdentity) -> User:
    account = GoogleAccount.objects.select_related("user").filter(sub=identity.sub).first()

    if account is None:
        try:
            with transaction.atomic():
                user = User.objects.create_user(
                    username=f"google-{identity.sub}",
                    email=identity.email,
                    first_name=identity.name[:150],
                )
                account = GoogleAccount.objects.create(
                    user=user, sub=identity.sub, email=identity.email
                )
        except IntegrityError:
            # ikki qurilma bir vaqtda birinchi marta kirdi: ikkovi ham
            # "yo'q ekan" deb topdi, ikkinchi INSERT unique(sub) ga urildi.
            # transaction.atomic bo'lmasa — yarim yaratilgan User qolib ketadi
            account = GoogleAccount.objects.select_related("user").get(sub=identity.sub)

    elif account.email != identity.email:
        account.email = identity.email
        account.save(update_fields=["email"])
        User.objects.filter(pk=account.user_id).update(email=identity.email)

    return account.user

from rest_framework import serializers


class GoogleAuthSerializer(serializers.Serializer):
    id_token = serializers.CharField()

import logging

from rest_framework import status
from rest_framework.permissions import AllowAny
from rest_framework.response import Response
from rest_framework.throttling import AnonRateThrottle
from rest_framework.views import APIView
from rest_framework_simplejwt.tokens import RefreshToken

from .google import GoogleAuthError, GoogleUnavailable, verify_google_token
from .serializers import GoogleAuthSerializer
from .services import get_or_create_user

logger = logging.getLogger(__name__)


class GoogleAuthThrottle(AnonRateThrottle):
    scope = "google_auth"


class GoogleAuthView(APIView):
    permission_classes = [AllowAny]
    throttle_classes = [GoogleAuthThrottle]

    def post(self, request):
        serializer = GoogleAuthSerializer(data=request.data)
        serializer.is_valid(raise_exception=True)

        try:
            identity = verify_google_token(serializer.validated_data["id_token"])
        except GoogleUnavailable as exc:
            # 401 bersak, mobil ilova foydalanuvchini tizimdan chiqarib
            # yuboradi — aybi yo'q odamni. 503 esa "keyinroq urinib ko'ring"
            logger.error("Google certs endpoint javob bermadi: %s", exc)
            return Response(
                {"detail": "Google bilan bog'lanib bo'lmadi"},
                status=status.HTTP_503_SERVICE_UNAVAILABLE,
            )
        except GoogleAuthError as exc:
            # sababni client'ga ochmaymiz — hujumchi uchun qimmatli ma'lumot.
            # Log'ga ham raw token EMAS, faqat sabab yoziladi:
            # log fayli o'g'irlansa, token bilan birga hisob ham ketadi
            logger.warning("id_token rad etildi: %s", exc)
            return Response(
                {"detail": "id_token yaroqsiz"},
                status=status.HTTP_401_UNAUTHORIZED,
            )

        user = get_or_create_user(identity)
        refresh = RefreshToken.for_user(user)
        return Response({"access": str(refresh.access_token), "refresh": str(refresh)})

from django.urls import path

from .views import GoogleAuthView

urlpatterns = [
    path("auth/google/", GoogleAuthView.as_view()),
]

uv run python manage.py makemigrations accounts
uv run python manage.py migrate

curl -X POST http://127.0.0.1:8000/api/auth/google/ \
  -H "Content-Type: application/json" \
  -d '{"id_token": "eyJhbGciOiJSUzI1NiIs..."}'

# javob:
# {"access": "eyJ...", "refresh": "eyJ..."}

REST_FRAMEWORK = {
    "DEFAULT_AUTHENTICATION_CLASSES": [
        "rest_framework_simplejwt.authentication.JWTAuthentication",
    ],
    # GoogleAuthThrottle.scope shu yerdan qiymat oladi
    "DEFAULT_THROTTLE_RATES": {"google_auth": "10/min"},
}

from unittest.mock import patch

import pytest
from django.contrib.auth import get_user_model
from django.core.cache import cache
from google.auth import exceptions as google_exceptions

from apps.accounts.models import GoogleAccount

VERIFY = "apps.accounts.google.google_id_token.verify_oauth2_token"
CLAIMS = {
    "sub": "1122334455",
    "aud": "test-web.apps.googleusercontent.com",
    "email": "user@misol.uz",
    "email_verified": True,
    "name": "Test User",
}


@pytest.fixture
def client_ids(settings):
    settings.GOOGLE_CLIENT_IDS = ["test-web.apps.googleusercontent.com"]
    # throttle hisoblagichi cache'da turadi: tozalamasak, testlar
    # bir-birini 429 qilib yiqitadi
    cache.clear()


def login(client):
    return client.post("/api/auth/google/", {"id_token": "raw"}, content_type="application/json")


@patch(VERIFY, return_value=CLAIMS)
def test_valid_token_creates_user_and_returns_jwt(mock_verify, client, client_ids, db):
    response = login(client)

    assert response.status_code == 200
    assert {"access", "refresh"} <= response.json().keys()
    # aud tekshiruvi kutubxonaga TOPSHIRILGANINI qayd qilamiz
    assert mock_verify.call_args.kwargs["audience"] == ["test-web.apps.googleusercontent.com"]
    assert GoogleAccount.objects.get(sub="1122334455").user.email == "user@misol.uz"


@pytest.mark.parametrize(
    "error",
    [
        google_exceptions.InvalidValue("Token has wrong audience"),
        google_exceptions.GoogleAuthError("Wrong issuer."),
        ValueError("Could not verify token signature."),
    ],
)
def test_invalid_token_is_401_and_creates_nothing(error, client, client_ids, db):
    with patch(VERIFY, side_effect=error):
        response = login(client)

    assert response.status_code == 401
    assert get_user_model().objects.count() == 0


@patch(VERIFY, side_effect=google_exceptions.TransportError("certs unreachable"))
def test_google_down_is_503_not_401(mock_verify, client, client_ids, db):
    # foydalanuvchi aybdor emas — uni tizimdan chiqarib yubormaymiz
    assert login(client).status_code == 503


@patch(VERIFY, return_value={**CLAIMS, "email_verified": False})
def test_unverified_email_rejected(mock_verify, client, client_ids, db):
    assert login(client).status_code == 401


@patch(VERIFY, return_value=CLAIMS)
def test_second_login_reuses_the_same_user(mock_verify, client, client_ids, db):
    login(client)
    login(client)

    assert get_user_model().objects.count() == 1
    assert GoogleAccount.objects.count() == 1

uv run pytest apps/accounts/ -q