
    Ch3                         S SK r S SKrS SKJr  S SKJr  S SKJrJrJ	r	  S SK
Jr  S SKJrJrJr  S SKJrJr   " S S	\	5      r " S
 S\5      r " S S5      rg)    N)Any)
AnyHttpUrl)AuthCredentialsAuthenticationBackend
SimpleUser)HTTPConnection)ReceiveScopeSend)AccessTokenTokenVerifierc                   4   ^  \ rS rSrSrS\4U 4S jjrSrU =r$ )AuthenticatedUser   zUser with authentication info.	auth_infoc                 f   > [         TU ]  UR                  5        Xl        UR                  U l        g N)super__init__	client_idaccess_tokenscopes)selfr   	__class__s     `/home/james-whalen/.local/lib/python3.13/site-packages/mcp/server/auth/middleware/bearer_auth.pyr   AuthenticatedUser.__init__   s)    ,,-%&&    )r   r   )	__name__
__module____qualname____firstlineno____doc__r   r   __static_attributes____classcell__)r   s   @r   r   r      s    ('+ ' 'r   r   c                   4    \ rS rSrSrS\4S jrS\4S jrSr	g)	BearerAuthBackend   zL
Authentication backend that validates Bearer tokens using a TokenVerifier.
token_verifierc                     Xl         g r   r(   )r   r(   s     r   r   BearerAuthBackend.__init__   s    ,r   connc                   ^#    [        U4S jTR                   5       S 5      nU(       a$  UR                  5       R                  S5      (       d  g USS  nU R                  R                  U5      I S h  vN nU(       d  g UR                  (       a-  UR                  [        [        R                  " 5       5      :  a  g [        UR                  5      [        U5      4$  Nj7f)Nc              3      >#    U  H5  oR                  5       S :X  d  M  TR                  R                  U5      v   M7     g7f)authorizationN)lowerheadersget).0keyr,   s     r   	<genexpr>1BearerAuthBackend.authenticate.<locals>.<genexpr>    s1     ]lsiik_>\"T\\c""ls
   A "A zbearer    )nextr1   r0   
startswithr(   verify_token
expires_atinttimer   r   r   )r   r,   auth_headertokenr   s    `   r   authenticateBearerAuthBackend.authenticate   s     ]dll]
 +"3"3"5"@"@"K"KAB --::5AA	I$8$83tyy{;K$Ky//02CI2NNN Bs   A0C 3C4A+C r*   N)
r   r   r    r!   r"   r   r   r   r@   r#    r   r   r&   r&      s!    -} -O~ Or   r&   c            
       x    \ rS rSrSr SS\S\\   S\S-  4S jjr	S\
S	\S
\SS4S jrS
\S\S\S\SS4
S jrSrg)RequireAuthMiddleware4   z
Middleware that requires a valid Bearer token in the Authorization header.

This will validate the token with the auth provider and store the resulting
auth info in the request state.
Napprequired_scopesresource_metadata_urlc                 (    Xl         X l        X0l        g)z
Initialize the middleware.

Args:
    app: ASGI application
    required_scopes: List of scopes that the token must have
    resource_metadata_url: Optional protected resource metadata URL for WWW-Authenticate header
NrF   rG   rH   )r   rF   rG   rH   s       r   r   RequireAuthMiddleware.__init__<   s     .%:"r   scopereceivesendreturnc                 x  #    UR                  S5      n[        U[        5      (       d  U R                  USSSS9I S h  vN   g UR                  S5      nU R                   H4  nUb  XeR
                  ;  d  M  U R                  USSS	U 3S9I S h  vN     g    U R                  XU5      I S h  vN   g  Nu N% N	7f)
Nuseri  invalid_tokenzAuthentication required)status_codeerrordescriptionauthi  insufficient_scopezRequired scope: )r2   
isinstancer   _send_auth_errorrG   r   rF   )r   rL   rM   rN   	auth_userauth_credentialsrequired_scopes          r   __call__RequireAuthMiddleware.__call__N   s     IIf%	)%677''#_Jc (     99V,"22N'>AXAX+X++c1EUefteuSv ,     3 hhut,,,
 	-s9   <B:B45B:8B:B6B:.B8/B:6B:8B:rS   rT   rU   c                   #    SU S3SU S3/nU R                   (       a  UR                  SU R                    S35        SSR                  U5       3nX4S.n[        R                  " U5      R                  5       nU" SUS	S
[        [        U5      5      R                  5       4SUR                  5       4/S.5      I Sh  vN   U" SUS.5      I Sh  vN   g N N7f)zCSend an authentication error response with WWW-Authenticate header.zerror=""zerror_description="zresource_metadata="zBearer z, )rT   error_descriptionzhttp.response.start)s   content-types   application/jsons   content-lengths   www-authenticate)typestatusr1   Nzhttp.response.body)rb   body)rH   appendjoinjsondumpsencodestrlen)	r   rN   rS   rT   rU   www_auth_partswww_authenticaterd   
body_bytess	            r   rY   &RequireAuthMiddleware._send_auth_errorb   s      $E7!,0CK=PQ.RS%%!!$78R8R7SST"UV$TYY~%>$?@ AZZ%,,.
-%:&C
O(<(C(C(EF(*:*A*A*CD

 
	
 
	
 ,"
 	
 	

	
	
s$   B=C?C CCCCrJ   r   )r   r   r    r!   r"   r   listrj   r   r   r
   r	   r   r]   r<   rY   r#   rB   r   r   rD   rD   4   s     48	;; c;  *D0	;$-E -G -4 -D -(
4 
c 
# 
\_ 
dh 
r   rD   )rg   r=   typingr   pydanticr   starlette.authenticationr   r   r   starlette.requestsr   starlette.typesr	   r
   r   mcp.server.auth.providerr   r   r   r&   rD   rB   r   r   <module>rw      sJ        W W - 0 0 ?'
 'O- O<L
 L
r   