
    Ki'              
       f   d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl	m
Z
mZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d d	lmZmZmZ d d
lmZ  G d de      Z G d de      Z  G d deeee z   ed      f            Z! G d de      Z" G d dee         Z#e G d d             Z$y)    N)	dataclass)	AnnotatedAnyLiteral)
AnyHttpUrlAnyUrl	BaseModelField	RootModelValidationError)Request)stringify_pydantic_error)PydanticJSONResponse)AuthenticationErrorClientAuthenticator) OAuthAuthorizationServerProvider
TokenErrorTokenErrorCode)
OAuthTokenc                       e Zd ZU ed   ed<    edd      Zeed<    edd      Ze	dz  ed	<   eed
<   dZ
edz  ed<    edd      Zeed<    edd      Zedz  ed<   y)AuthorizationCodeRequestauthorization_code
grant_type.zThe authorization codedescriptioncodeNz7Must be the same as redirect URI provided in /authorizeredirect_uri	client_idclient_secretzPKCE code verifiercode_verifier Resource indicator for the tokenresource)__name__
__module____qualname__r   __annotations__r
   r   strr   r   r   r    r"        j/home/jay/workspace/scripts/.codegraph-venv/lib/python3.12/site-packages/mcp/server/auth/handlers/token.pyr   r      sq    ,--c'?@D#@"':s"tL&4-tN $M3:$s0DEM3E 3UVHcDjVr)   r   c                       e Zd ZU ed   ed<    edd      Zeed<    edd      Zedz  ed<   eed	<   dZ	edz  ed
<    edd      Z
edz  ed<   y)RefreshTokenRequestrefresh_tokenr   .zThe refresh tokenr   NzOptional scope parameterscoper   r   r!   r"   )r#   r$   r%   r   r&   r
   r-   r'   r.   r   r"   r(   r)   r*   r,   r,      s^    ((s0CDM3Dd0JKE3:KN $M3:$ 3UVHcDjVr)   r,   c                   6    e Zd ZU eeez   ed      f   ed<   y)TokenRequestr   discriminatorrootN)r#   r$   r%   r   r   r,   r
   r&   r(   r)   r*   r0   r0   +   s'      #66L)	+ r)   r0   r   r1   c                   D    e Zd ZU dZeed<   dZedz  ed<   dZe	dz  ed<   y)TokenErrorResponsezG
    See https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
    errorNerror_description	error_uri)
r#   r$   r%   __doc__r   r&   r7   r'   r8   r   r(   r)   r*   r5   r5   9   s-     $(sTz(#'IzD 'r)   r5   c                       e Zd ZU eed<   y)TokenSuccessResponser3   N)r#   r$   r%   r   r&   r(   r)   r*   r;   r;   C   s
     r)   r;   c                   L    e Zd ZU eeeef   ed<   eed<   deez  fdZ	de
fdZy)TokenHandlerproviderclient_authenticatorobjc                 L    d}t        |t              rd}t        ||ddd      S )N   i  no-storeno-cachezCache-ControlPragmacontentstatus_codeheaders)
isinstancer5   r   )selfr@   rI   s      r*   responsezTokenHandler.responseO   s5    c-.K##!+$
 	
r)   requestc           	      
  K   	 | j                   j                  |       d {   }	 |j                          d {   }t        j                  t        |            j                  }|j                  |j                  vr*| j                  t	        d	d
|j                   d            S |xt         d x\    | j"                  j%                  ||j&                         d {   }||j(                  |j(                  k7  r| j                  t	        dd            S |j*                  t-        j,                         k  r| j                  t	        dd            S |j.                  r|j0                  }nd }|j0                  t3        |j0                        nd }	|t3        |      nd }
|	|
k7  r| j                  t	        dd            S t5        j6                  |j8                  j;                               j=                         }t?        j@                  |      jC                         jE                  d      }||jF                  k7  r| j                  t	        dd            S 	 | j"                  jI                  ||       d {   }nM tP        d xA\   | j"                  jS                  ||jT                         d {   }||j(                  |j(                  k7  r| j                  t	        dd            S |j*                  r=|j*                  t-        j,                         k  r| j                  t	        dd            S |jV                  r|jV                  jY                  d      n|jZ                  }|D ]2  }||jZ                  vs| j                  t	        dd| d            c S  	 | j"                  j]                  |||       d {   }n | j                  t_                    S 7 # t        $ r0}t        t	        d|j
                        dddd      cY d }~S d }~ww xY w7 # t        $ r/}| j                  t	        dt        |                  cY d }~S d }~ww xY w7 7 # tJ        $ r:}| j                  t	        |jL                  |jN                              cY d }~S d }~ww xY w7 7 # tJ        $ r:}| j                  t	        |jL                  |jN                              cY d }~S d }~ww xY ww)Nunauthorized_client)r6   r7   i  rC   rD   rE   rG   invalid_requestunsupported_grant_typez2Unsupported grant type (supported grant types are )r(   invalid_grantz!authorization code does not existzauthorization code has expiredz?redirect_uri did not match the one used when creating auth code=zincorrect code_verifierzrefresh token does not existzrefresh token has expired invalid_scopezcannot request scope `z` not provided by refresh token)r3   )0r?   authenticate_requestr   r   r5   messageformr0   model_validatedictr3   r   rM   r   r   grant_typesr   r>   load_authorization_coder   r   
expires_attime redirect_uri_provided_explicitlyr   r'   hashlibsha256r    encodedigestbase64urlsafe_b64encodedecoderstripcode_challengeexchange_authorization_coder   r6   r7   r,   load_refresh_tokenr-   r.   splitscopesexchange_refresh_tokenr;   )rL   rN   client_infoe	form_datatoken_requestvalidation_error	auth_codeauthorize_request_redirect_uritoken_redirect_strauth_redirect_strrc   hashed_code_verifiertokensr-   rn   r.   s                    r*   handlezTokenHandler.handle]   s    	 $ 9 9 N Nw WWK		%lln,I(77YHMMM ##;+B+BB=="2)[\g\s\s[ttu'v  +)+"&--"G"GUbUgUg"hh	$	(;(;}?V?V(V==*"1.Q  ''$))+5==*"1.N  ==5>5K5K2592 IVHbHbHnS)C)C%Dtx";Y;eC67ko " &)::==*"3/p  !(C(C(J(J(LMTTV'-'?'?'G'N'N'P'W'WX['\$'9+C+CC==*"1.G 	#'==#L#L[Zc#ddFs ,D %&&*mm&F&F{TaToTo&p p (M,C,C}G^G^,^==*"1.L  !++0H0H499;0V==*"1.I  <I;N;N,,2237TaThTh# EM$8$88#}}.&55KE7Rq3r  	#'==#G#GUbdj#kkFE 'V }}1v>??e X" 	'*/&'ii  %/(
 
	 - 	=="+&>?O&P 	( ip e! ==*"#''./.A.A  !qB l! ==*"#''./.A.A s"  TO3 O0O3 P2 P/,P2 (A:T"Q-#E>T"Q3 Q0Q3 8T>R9?C
T
#T. R> R<R> T0O3 3	P,<%P'!P,"T'P,,T/P2 2	Q*;$Q%Q* T%Q**T0Q3 3	R6</R1+R6,T1R66T<R> >	T/S<6T7T<TTN)r#   r$   r%   r   r   r&   r   r;   r5   rM   r   r{   r(   r)   r*   r=   r=   J   s<    .sC}==--
03EE 
T@G T@r)   r=   )%rf   rb   r`   dataclassesr   typingr   r   r   pydanticr   r   r	   r
   r   r   starlette.requestsr   mcp.server.auth.errorsr   mcp.server.auth.json_responser   &mcp.server.auth.middleware.client_authr   r   mcp.server.auth.providerr   r   r   mcp.shared.authr   r   r,   r0   r5   r;   r=   r(   r)   r*   <module>r      s       ! * * U U & ; > [ a a &Wy W	W) 	W$'::-/	
( (9Z0  f@ f@ f@r)   