o
    h'                  	   @   s,  d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl	m
Z
mZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d d	lmZmZmZ d d
lmZ G dd deZG dd deZ G dd deeee B eddf  Z!G dd deZ"G dd dee Z#eG dd dZ$dS )    N)	dataclass)	AnnotatedAnyLiteral)
AnyHttpUrlAnyUrl	BaseModelField	RootModelValidationError)Request)stringify_pydantic_error)PydanticJSONResponse)AuthenticationErrorClientAuthenticator) OAuthAuthorizationServerProvider
TokenErrorTokenErrorCode)
OAuthTokenc                   @   s   e Zd ZU ed ed< edddZeed< edddZe	dB ed	< eed
< dZ
edB ed< edddZeed< edddZedB ed< dS )AuthorizationCodeRequestauthorization_code
grant_type.zThe authorization codedescriptioncodeNz7Must be the same as redirect URI provided in /authorizeredirect_uri	client_idclient_secretzPKCE code verifiercode_verifier Resource indicator for the tokenresource)__name__
__module____qualname__r   __annotations__r	   r   strr   r   r   r   r     r&   r&   _/var/www/html/openai_agents/venv/lib/python3.10/site-packages/mcp/server/auth/handlers/token.pyr      s   
 r   c                   @   sv   e Zd ZU ed ed< edddZeed< edddZedB ed< eed	< dZ	edB ed
< edddZ
edB ed< dS )RefreshTokenRequestrefresh_tokenr   .zThe refresh tokenr   NzOptional scope parameterscoper   r   r   r    )r!   r"   r#   r   r$   r	   r)   r%   r*   r   r    r&   r&   r&   r'   r(      s   
 r(   c                   @   s(   e Zd ZU eeeB eddf ed< dS )TokenRequestr   discriminatorrootN)r!   r"   r#   r   r   r(   r	   r$   r&   r&   r&   r'   r+   +   s   
 r+   r   r,   c                   @   s:   e Zd ZU dZeed< dZedB ed< dZe	dB ed< dS )TokenErrorResponsezG
    See https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
    errorNerror_description	error_uri)
r!   r"   r#   __doc__r   r$   r1   r%   r2   r   r&   r&   r&   r'   r/   9   s
   
 r/   c                   @   s   e Zd ZU eed< dS )TokenSuccessResponser.   N)r!   r"   r#   r   r$   r&   r&   r&   r'   r4   C   s   
 r4   c                   @   sH   e Zd ZU eeeef ed< eed< deeB fddZ	de
fddZd	S )
TokenHandlerproviderclient_authenticatorobjc                 C   s&   d}t |tr	d}t||ddddS )N   i  zno-storezno-cache)zCache-ControlPragma)contentstatus_codeheaders)
isinstancer/   r   )selfr8   r<   r&   r&   r'   responseO   s   
zTokenHandler.responserequestc              
      sr  z|  I d H }tt|j}W n ty/ } z| tdt|dW  Y d }~S d }~ww z| j	j
|j|jdI d H }W n ty[ } z| td|jdW  Y d }~S d }~ww |j|jvrp| tdd|j ddS | td r   | j||jI d H }|d u s|j|jkr| td	d
dS |jt k r| td	ddS |jr|j}nd }|jd urt|jnd }	|d urt|nd }
|	|
kr| tdddS t|j  }t |! "d}||j#kr| td	ddS z| j$||I d H }W n t%y } z| t|j&|j'dW  Y d }~S d }~ww  t(d r | j)||j*I d H }|d u s>|j|jkrG| td	ddS |jr\|jt k r\| td	ddS |j+rf|j+,dn|j-}|D ]}||j-vr| tdd| dd  S qkz| j.|||I d H }W n t%y } z| t|j&|j'dW  Y d }~S d }~ww  | t/|dS )Ninvalid_request)r0   r1   )r   r   unauthorized_clientunsupported_grant_typez2Unsupported grant type (supported grant types are )r&   invalid_grantz!authorization code does not existzauthorization code has expiredz?redirect_uri did not match the one used when creating auth code=zincorrect code_verifierzrefresh token does not existzrefresh token has expired invalid_scopezcannot request scope `z` not provided by refresh token)r.   )0formr+   model_validatedictr.   r   r@   r/   r   r7   authenticater   r   r   messager   grant_typesr   r6   load_authorization_coder   
expires_attime redirect_uri_provided_explicitlyr   r%   hashlibsha256r   encodedigestbase64urlsafe_b64encodedecoderstripcode_challengeexchange_authorization_coder   r0   r1   r(   load_refresh_tokenr)   r*   splitscopesexchange_refresh_tokenr4   )r?   rA   	form_datatoken_requestvalidation_errorclient_infoe	auth_codeauthorize_request_redirect_uritoken_redirect_strauth_redirect_strrU   hashed_code_verifiertokensr)   r`   r*   r&   r&   r'   handle]   s   			
B
+zTokenHandler.handleN)r!   r"   r#   r   r   r$   r   r4   r/   r@   r   rm   r&   r&   r&   r'   r5   J   s
   
 r5   )%rX   rT   rR   dataclassesr   typingr   r   r   pydanticr   r   r   r	   r
   r   starlette.requestsr   mcp.server.auth.errorsr   mcp.server.auth.json_responser   &mcp.server.auth.middleware.client_authr   r   mcp.server.auth.providerr   r   r   mcp.shared.authr   r   r(   r+   r/   r4   r5   r&   r&   r&   r'   <module>   s6     

