
    Ch'                     `   S SK r S SKrS SKrS SKJr  S SKJrJrJr  S SK	J
r
JrJrJrJrJr  S SKJr  S SKJr  S SKJr  S SKJrJr  S S	KJrJrJr  S S
KJr   " S S\5      r " S S\5      r  " S S\\\\ -  \" SS94      5      r! " S S\5      r" " S S\\   5      r#\ " S S5      5       r$g)    N)	dataclass)	AnnotatedAnyLiteral)
AnyHttpUrlAnyUrl	BaseModelField	RootModelValidationError)Request)stringify_pydantic_error)PydanticJSONResponse)AuthenticationErrorClientAuthenticator) OAuthAuthorizationServerProvider
TokenErrorTokenErrorCode)
OAuthTokenc                       \ rS rSr% \S   \S'   \" SSS9r\\S'   \" SS	S9r	\
S-  \S
'   \\S'   Sr\S-  \S'   \" SSS9r\\S'   \" SSS9r\S-  \S'   Srg)AuthorizationCodeRequest   authorization_code
grant_type.zThe authorization codedescriptioncodeNz7Must be the same as redirect URI provided in /authorizeredirect_uri	client_idclient_secretzPKCE code verifiercode_verifier Resource indicator for the tokenresource )__name__
__module____qualname____firstlineno__r   __annotations__r
   r   strr   r   r    r!   r#   __static_attributes__r$       X/home/james-whalen/.local/lib/python3.13/site-packages/mcp/server/auth/handlers/token.pyr   r      sq    ,--c'?@D#@"':s"tL&4-tN $M3:$s0DEM3E 3UVHcDjVr,   r   c                       \ rS rSr% \S   \S'   \" SSS9r\\S'   \" SSS9r	\S-  \S	'   \\S
'   Sr
\S-  \S'   \" SSS9r\S-  \S'   Srg)RefreshTokenRequest   refresh_tokenr   .zThe refresh tokenr   NzOptional scope parameterscoper   r    r"   r#   r$   )r%   r&   r'   r(   r   r)   r
   r1   r*   r2   r    r#   r+   r$   r,   r-   r/   r/      s^    ((s0CDM3Dd0JKE3:KN $M3:$ 3UVHcDjVr,   r/   c                   8    \ rS rSr% \\\-  \" SS94   \S'   Sr	g)TokenRequest+   r   discriminatorrootr$   N)
r%   r&   r'   r(   r   r   r/   r
   r)   r+   r$   r,   r-   r4   r4   +   s'      #66L)	+ r,   r4   r   r6   c                   L    \ rS rSr% Sr\\S'   Sr\S-  \S'   Sr	\
S-  \S'   Srg)TokenErrorResponse9   z?
See https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
errorNerror_description	error_urir$   )r%   r&   r'   r(   __doc__r   r)   r=   r*   r>   r   r+   r$   r,   r-   r:   r:   9   s-     $(sTz(#'IzD 'r,   r:   c                        \ rS rSr% \\S'   Srg)TokenSuccessResponseC   r8   r$   N)r%   r&   r'   r(   r   r)   r+   r$   r,   r-   rA   rA   C   s
     r,   rA   c                   X    \ rS rSr% \\\\4   \S'   \\S'   S\\	-  4S jr
S\4S jrSrg	)
TokenHandlerJ   providerclient_authenticatorobjc                 P    Sn[        U[        5      (       a  Sn[        UUSSS.S9$ )N   i  zno-storezno-cache)zCache-ControlPragma)contentstatus_codeheaders)
isinstancer:   r   )selfrH   rM   s      r-   responseTokenHandler.responseO   s8    c-..K##!+$
 	
r,   requestc           	      *
  #     UR                  5       I S h  vN n[        R                  [        U5      5      R                  n U R                  R                  UR                  UR                  S9I S h  vN nUR                  UR                   ;  a'  U R                  [        SSUR                    S3S95      $ U=["        S` =Gb  u     U R$                  R'                  XSR(                  5      I S h  vN nUb  UR                  UR                  :w  a  U R                  [        S	S
S95      $ UR*                  [,        R,                  " 5       :  a  U R                  [        S	SS95      $ UR.                  (       a  UR0                  nOS nUR0                  b  [3        UR0                  5      OS n	Ub  [3        U5      OS n
X:w  a  U R                  [        SSS95      $ [4        R6                  " UR8                  R;                  5       5      R=                  5       n[>        R@                  " U5      RC                  5       RE                  S5      nXRF                  :w  a  U R                  [        S	SS95      $  U R$                  RI                  XW5      I S h  vN nGOU  [P        S` =GbH  u   U R$                  RS                  XSRT                  5      I S h  vN nUb  UR                  UR                  :w  a  U R                  [        S	SS95      $ UR*                  (       a<  UR*                  [,        R,                  " 5       :  a  U R                  [        S	SS95      $ URV                  (       a  URV                  RY                  S5      OURZ                  nU H2  nUURZ                  ;  d  M  U R                  [        SSU S3S95      s  $     U R$                  R]                  X^U5      I S h  vN nO  U R                  [_        WS95      $  GN! [
         a,  nU R                  [        S[        U5      S95      s S nA$ S nAff = f GN! [         a-  nU R                  [        SUR                  S95      s S nA$ S nAff = f GN GN! [J         a7  nU R                  [        URL                  URN                  S95      s S nA$ S nAff = f GN N! [J         a7  nU R                  [        URL                  URN                  S95      s S nA$ S nAff = f7f)Ninvalid_request)r<   r=   )r   r    unauthorized_clientunsupported_grant_typez2Unsupported grant type (supported grant types are )r$   invalid_grantz!authorization code does not existzauthorization code has expiredz?redirect_uri did not match the one used when creating auth code=zincorrect code_verifierzrefresh token does not existzrefresh token has expired invalid_scopezcannot request scope `z` not provided by refresh token)r8   )0formr4   model_validatedictr8   r   rQ   r:   r   rG   authenticater   r    r   messager   grant_typesr   rF   load_authorization_coder   
expires_attime redirect_uri_provided_explicitlyr   r*   hashlibsha256r!   encodedigestbase64urlsafe_b64encodedecoderstripcode_challengeexchange_authorization_coder   r<   r=   r/   load_refresh_tokenr1   r2   splitscopesexchange_refresh_tokenrA   )rP   rS   	form_datatoken_requestvalidation_errorclient_infoe	auth_codeauthorize_request_redirect_uritoken_redirect_strauth_redirect_strrh   hashed_code_verifiertokensr1   rs   r2   s                    r-   handleTokenHandler.handle]   s    		%lln,I(77YHMMM	 $ 9 9 F F'11+99 !G ! K ##;+B+BB=="2)[\g\s\s[ttu'v  +)++"&--"G"GUgUg"hh	$	(;(;}?V?V(V==*"1.Q  ''$))+5==*"1.N  ==5>5K5K2592 IVHbHbHnS)C)C%Dtx";Y;eC67ko " &:==*"3/p  !(C(C(J(J(LMTTV'-'?'?'G'N'N'P'W'WX['\$'+C+CC==*"1.G 	#'==#L#L[#ddFs ,D %&&*mm&F&F{ToTo&p p (M,C,C}G^G^,^==*"1.L  !++0H0H499;0V==*"1.I  <I;N;N,,2237TaThTh#EM$8$88#}}.&55KE7Rq3r   $	#'==#G#Gdj#kkFE 'V }}1v>??_ - 	=="+&>?O&P 	 # 	=="/&'ii 	( ip e! ==*"#''./.A.A  !qB l! ==*"#''./.A.A s%  TP
 P,P
 1Q 6Q7Q ;A9T4R 5E?T5R RR 8TS
CT'!T	S (S)S -TP
 

Q !P;5Q 6T;Q  TQ 
Q="Q82Q=3T8Q==TR 
S,S<S=TSTS 
T,TTTTTr$   N)r%   r&   r'   r(   r   r   r)   r   rA   r:   rQ   r   r   r+   r$   r,   r-   rD   rD   J   s<    .sC}==--
03EE 
Q@G Q@r,   rD   )%rk   rg   re   dataclassesr   typingr   r   r   pydanticr   r   r	   r
   r   r   starlette.requestsr   mcp.server.auth.errorsr   mcp.server.auth.json_responser   &mcp.server.auth.middleware.client_authr   r   mcp.server.auth.providerr   r   r   mcp.shared.authr   r   r/   r4   r:   rA   rD   r$   r,   r-   <module>r      s       ! * * U U & ; > [ a a &Wy W	W) 	W$'::-/	
( (9Z0  c@ c@ c@r,   