Google Sign-In: iOS va Android tokenini backend'da to'g'ri tekshirish

Mobil ilova ──(Google SDK)──► Google ──► id_token (JWT)
     │
     └──POST /api/auth/google/ {"id_token": "..."}──► bizning backend
                                                          │
                                     1) token imzosini Google kaliti bilan tekshirish
                                     2) token AYNAN BIZNING ilovaga berilganini tekshirish
                                     3) foydalanuvchini topish/yaratish
                                     4) o'zimizning access/refresh JWT'ni qaytarish

uv add google-auth djangorestframework-simplejwt

# config/settings.py
import os

# vergul bilan: "123-android.apps.googleusercontent.com,123-ios.apps.googleusercontent.com"
GOOGLE_CLIENT_IDS = [
    cid.strip() for cid in os.environ.get("GOOGLE_CLIENT_IDS", "").split(",") if cid.strip()
]

apps/accounts/
├── __init__.py
├── models.py        ← standart User (yoki custom) — bu maqolada o'zgarmaydi
├── google.py        ← id_token tekshiruvi (hozir shu yerdamiz)
├── serializers.py
├── views.py
└── tests.py

# apps/accounts/google.py
from dataclasses import dataclass

from django.conf import settings
from google.auth.transport import requests as google_requests
from google.oauth2 import id_token as google_id_token


class GoogleAuthError(Exception):
    """Token yaroqsiz — sababi foydalanuvchiga batafsil aytilmaydi."""


@dataclass(frozen=True)
class GoogleIdentity:
    sub: str  # Google'ning O'ZGARMAS foydalanuvchi ID'si
    email: str
    name: str
    picture: str


def verify_google_token(raw_token: str) -> GoogleIdentity:
    try:
        # verify_oauth2_token uch ishni birdan qiladi:
        # 1) Google JWKS kalitlari bilan IMZO tekshiruvi (kalitlarni keshlaydi)
        # 2) muddat (exp) tekshiruvi
        # 3) issuer accounts.google.com ekani
        claims = google_id_token.verify_oauth2_token(
            raw_token,
            google_requests.Request(),
            # audience=None — aud'ni o'zimiz tekshiramiz (ro'yxat bilan)
            audience=None,
        )
    except ValueError as exc:
        raise GoogleAuthError("token imzosi yoki muddati yaroqsiz") from exc

    # aud — token qaysi ilovaga berilgan. Bizning ikki client ID'dan biri
    # bo'lmasa, bu token BOSHQA ilova uchun olingan — qabul qilmaymiz
    if claims.get("aud") not in settings.GOOGLE_CLIENT_IDS:
        raise GoogleAuthError("token boshqa ilovaga tegishli")

    if not claims.get("email_verified", False):
        raise GoogleAuthError("email tasdiqlanmagan")

    return GoogleIdentity(
        sub=claims["sub"],
        email=claims["email"],
        name=claims.get("name", ""),
        picture=claims.get("picture", ""),
    )

# apps/accounts/serializers.py
from rest_framework import serializers


class GoogleAuthSerializer(serializers.Serializer):
    id_token = serializers.CharField()

# apps/accounts/views.py
from django.contrib.auth import get_user_model
from rest_framework import status
from rest_framework.permissions import AllowAny
from rest_framework.response import Response
from rest_framework.views import APIView
from rest_framework_simplejwt.tokens import RefreshToken

from .google import GoogleAuthError, verify_google_token
from .serializers import GoogleAuthSerializer

User = get_user_model()


class GoogleAuthView(APIView):
    permission_classes = [AllowAny]

    def post(self, request):
        serializer = GoogleAuthSerializer(data=request.data)
        serializer.is_valid(raise_exception=True)

        try:
            identity = verify_google_token(serializer.validated_data["id_token"])
        except GoogleAuthError:
            # sababni ochmaymiz — hujumchi uchun qimmatli ma'lumot bo'lardi
            return Response(
                {"detail": "Google token yaroqsiz"},
                status=status.HTTP_401_UNAUTHORIZED,
            )

        # username sifatida sub — o'zgarmas kalit (yuqoridagi eslatma).
        # email/ism har kirishda yangilanadi: foydalanuvchi Google'da
        # o'zgartirgan bo'lsa, bizda ham yangi ko'rinadi
        user, _ = User.objects.update_or_create(
            username=f"google:{identity.sub}",
            defaults={"email": identity.email, "first_name": identity.name[:150]},
        )

        refresh = RefreshToken.for_user(user)
        return Response({"access": str(refresh.access_token), "refresh": str(refresh)})

# apps/accounts/urls.py
from django.urls import path

from .views import GoogleAuthView

urlpatterns = [
    path("auth/google/", GoogleAuthView.as_view()),
]

curl -X POST http://127.0.0.1:8000/api/auth/google/ \
  -H "Content-Type: application/json" \
  -d '{"id_token": "eyJhbGciOiJSUzI1NiIs..."}'

# javob:
# {"access": "eyJ...", "refresh": "eyJ..."}

# apps/accounts/tests.py
from unittest.mock import patch

import pytest
from django.contrib.auth import get_user_model

CLAIMS = {
    "sub": "1122334455",
    "aud": "test-android.apps.googleusercontent.com",
    "email": "user@misol.uz",
    "email_verified": True,
    "name": "Test User",
}


@pytest.fixture
def client_ids(settings):
    settings.GOOGLE_CLIENT_IDS = ["test-android.apps.googleusercontent.com"]


@patch("apps.accounts.google.google_id_token.verify_oauth2_token", return_value=CLAIMS)
def test_valid_token_creates_user_and_returns_jwt(mock_verify, client, client_ids, db):
    response = client.post(
        "/api/auth/google/", {"id_token": "raw"}, content_type="application/json"
    )
    assert response.status_code == 200
    assert {"access", "refresh"} <= response.json().keys()
    user = get_user_model().objects.get(username="google:1122334455")
    assert user.email == "user@misol.uz"


@patch(
    "apps.accounts.google.google_id_token.verify_oauth2_token",
    return_value={**CLAIMS, "aud": "hujumchi-ilova.apps.googleusercontent.com"},
)
def test_foreign_audience_rejected(mock_verify, client, client_ids, db):
    response = client.post(
        "/api/auth/google/", {"id_token": "raw"}, content_type="application/json"
    )
    assert response.status_code == 401
    assert get_user_model().objects.count() == 0