o
    i'                  	   @   s,  d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl	m
Z
mZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d d	lmZmZmZ d d
lmZ G dd deZG dd deZ G dd deeee B eddf  Z!G dd deZ"G dd dee Z#eG dd dZ$dS )    N)	dataclass)	AnnotatedAnyLiteral)
AnyHttpUrlAnyUrl	BaseModelField	RootModelValidationError)Request)stringify_pydantic_error)PydanticJSONResponse)AuthenticationErrorClientAuthenticator) OAuthAuthorizationServerProvider
TokenErrorTokenErrorCode)
OAuthTokenc                   @   s   e Zd ZU ed ed< edddZeed< edddZe	dB ed	< eed
< dZ
edB ed< edddZeed< edddZedB ed< dS )AuthorizationCodeRequestZauthorization_code
grant_type.zThe authorization codedescriptioncodeNz7Must be the same as redirect URI provided in /authorizeredirect_uri	client_idclient_secretzPKCE code verifiercode_verifier Resource indicator for the tokenresource)__name__
__module____qualname__r   __annotations__r	   r   strr   r   r   r   r    r%   r%   U/home/app/Keep/.python/lib/python3.10/site-packages/mcp/server/auth/handlers/token.pyr      s   
 r   c                   @   sv   e Zd ZU ed ed< edddZeed< edddZedB ed< eed	< dZ	edB ed
< edddZ
edB ed< dS )RefreshTokenRequestrefresh_tokenr   .zThe refresh tokenr   NzOptional scope parameterscoper   r   r   r   )r    r!   r"   r   r#   r	   r(   r$   r)   r   r   r%   r%   r%   r&   r'      s   
 r'   c                   @   s(   e Zd ZU eeeB eddf ed< dS )TokenRequestr   ZdiscriminatorrootN)r    r!   r"   r   r   r'   r	   r#   r%   r%   r%   r&   r*   +   s   
 r*   r   r+   c                   @   s:   e Zd ZU dZeed< dZedB ed< dZe	dB ed< dS )TokenErrorResponsezG
    See https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
    errorNerror_description	error_uri)
r    r!   r"   __doc__r   r#   r/   r$   r0   r   r%   r%   r%   r&   r-   9   s
   
 r-   c                   @   s   e Zd ZU eed< dS )TokenSuccessResponser,   N)r    r!   r"   r   r#   r%   r%   r%   r&   r2   C   s   
 r2   c                   @   sH   e Zd ZU eeeef ed< eed< deeB fddZ	de
fddZd	S )
TokenHandlerproviderclient_authenticatorobjc                 C   s&   d}t |tr	d}t||ddddS )N   i  no-storeno-cachezCache-ControlZPragmacontentstatus_codeheaders)
isinstancer-   r   )selfr6   r=   r%   r%   r&   responseO   s   
zTokenHandler.responserequestc              
      st  z| j |I d H }W n! ty- } zttd|jddddddW  Y d }~S d }~ww z| I d H }tt	|j
}W n ty\ } z| tdt|dW  Y d }~S d }~ww |j|jvrq| td	d
|j ddS | td r!  | j||jI d H }|d u s|j|jkr| tdddS |jt k r| tdddS |jr|j}nd }|jd urt|jnd }	|d urt|nd }
|	|
kr| tdddS t|j  }t |! "d}||j#kr| tdddS z| j$||I d H }W n t%y  } z| t|j&|j'dW  Y d }~S d }~ww  t(d r | j)||j*I d H }|d u s?|j|jkrH| tdddS |jr]|jt k r]| tdddS |j+rg|j+,dn|j-}|D ]}||j-vr| tdd| dd  S qlz| j.|||I d H }W n t%y } z| t|j&|j'dW  Y d }~S d }~ww  | t/|dS )NZunauthorized_client)r.   r/   i  r8   r9   r:   r;   Zinvalid_requestZunsupported_grant_typez2Unsupported grant type (supported grant types are )r%   Zinvalid_grantz!authorization code does not existzauthorization code has expiredz?redirect_uri did not match the one used when creating auth code=zincorrect code_verifierzrefresh token does not existzrefresh token has expired Zinvalid_scopezcannot request scope `z` not provided by refresh token)r,   )0r5   Zauthenticate_requestr   r   r-   messageformr*   Zmodel_validatedictr,   r   rA   r   r   Zgrant_typesr   r4   Zload_authorization_coder   r   Z
expires_attimeZ redirect_uri_provided_explicitlyr   r$   hashlibsha256r   encodedigestbase64urlsafe_b64encodedecoderstripZcode_challengeZexchange_authorization_coder   r.   r/   r'   Zload_refresh_tokenr(   r)   splitscopesZexchange_refresh_tokenr2   )r@   rB   Zclient_infoeZ	form_dataZtoken_requestZvalidation_errorZ	auth_codeZauthorize_request_redirect_uriZtoken_redirect_strZauth_redirect_strrK   Zhashed_code_verifiertokensr(   rS   r)   r%   r%   r&   handle]   s   			
B
+zTokenHandler.handleN)r    r!   r"   r   r   r#   r   r2   r-   rA   r   rV   r%   r%   r%   r&   r3   J   s
   
 r3   )%rN   rJ   rI   dataclassesr   typingr   r   r   Zpydanticr   r   r   r	   r
   r   Zstarlette.requestsr   Zmcp.server.auth.errorsr   Zmcp.server.auth.json_responser   Z&mcp.server.auth.middleware.client_authr   r   Zmcp.server.auth.providerr   r   r   Zmcp.shared.authr   r   r'   r*   r-   r2   r3   r%   r%   r%   r&   <module>   s6     

