$j XddlmZddlZddlmZmZmZddlmZddl m Z ddl m Z ddl mZddlmZdd lmZdd lmZmZdd lmZdd lmZdd lmZmZmZddlmZddlm Z m!Z!m"Z"ddl#m$Z$m%Z%ddl&m'Z'ddl(m)Z)m*Z*ddl+m,Z,ddl-m.Z.ddl/m0Z0ddl1m2Z2ddl3m4Z4erddl5m6Z6e4e7Z8GddeZGdde Z dZ9GddeZ:Gd d!eZ;Gd"d#e;ZGd$d%e;Z<Gd&d'e;Z=Gd(d)e;eeeefZ>dS)*) annotationsN) TYPE_CHECKINGAnycast)urlparse)TokenErrorResponse) TokenHandler)PydanticJSONResponse)AuthContextMiddleware)BearerAuthBackend)AuthenticationErrorClientAuthenticator)r) AccessToken)AuthorizationCode OAuthAuthorizationServerProvider RefreshToken) TokenVerifier)cors_middlewarecreate_auth_routes create_protected_resource_routes)ClientRegistrationOptionsRevocationOptions)OAuthClientInformationFull) AnyHttpUrlField) Middleware)AuthenticationMiddleware)Request)Route) get_logger)CIMDClientManagerc6eZdZUdZeeZded<dS)rz)AccessToken that includes all JWT claims.)default_factoryzdict[str, Any]claimsN)__name__ __module__ __qualname____doc__rdictr$__annotations__`/home/rurouni/.hermes/hermes-agent/venv/lib/python3.11/site-packages/fastmcp/server/auth/auth.pyrr6s633"U4888F888888r,rc$eZdZdZdfd ZxZS)r aTokenHandler that returns MCP-compliant error responses. This handler addresses two SDK issues: 1. Error code: The SDK returns `unauthorized_client` for client authentication failures, but RFC 6749 Section 5.2 requires `invalid_client` with HTTP 401. This distinction matters for client re-registration behavior. 2. Status code: The SDK returns HTTP 400 for all token errors including `invalid_grant` (expired/invalid tokens). However, the MCP spec requires: "Invalid or expired tokens MUST receive a HTTP 401 response." This handler transforms responses to be compliant with both OAuth 2.1 and MCP specs. requestrcKt|d{V}|jdkr tj|j}|ddkr7ttd|dddd d  Sn#tj tf$rYnwxYw|jd kr tj|j}|dd kr7ttd |dddd d  Sn#tj tf$rYnwxYw|S)z5Wrap SDK handle() and transform auth error responses.Nierrorunauthorized_clientinvalid_clienterror_description)r1r4zno-storezno-cache)z Cache-ControlPragma)content status_codeheadersi invalid_grant) superhandler7jsonloadsbodygetr rJSONDecodeErrorAttributeError)selfr/responser> __class__s r-r;zTokenHandler.handleLs00000000  3 & & z(-0088G$$(===/ 2"2.2hh7J.K.K!!!%(-7&0!!    >(.9      3 & & z(-0088G$$77/ 2"1.2hh7J.K.K!!!%(-7&0!!    8(.9    s%A(B!!B:9B: A(D33E  E )r/r)r%r&r'r(r; __classcell__rDs@r-r r <sG  ++++++++++r,r z6urn:ietf:params:oauth:client-assertion-type:jwt-bearerc0eZdZdZdfd Zdfd ZxZS) PrivateKeyJWTClientAuthenticatoraClient authenticator with private_key_jwt support for CIMD clients. Extends the SDK's ClientAuthenticator to add support for the `private_key_jwt` authentication method per RFC 7523. This is required for CIMD (Client ID Metadata Document) clients that use asymmetric keys for authentication. The authenticator: 1. Delegates to SDK for standard methods (client_secret_basic, client_secret_post, none) 2. Adds private_key_jwt handling for CIMD clients 3. Validates JWT assertions against client's JWKS provider/OAuthAuthorizationServerProvider[Any, Any, Any] cimd_managerr!token_endpoint_urlstrcft|||_||_dS)zInitialize the authenticator. Args: provider: OAuth provider for client lookups cimd_manager: CIMD manager for private_key_jwt validation token_endpoint_url: Token endpoint URL for audience validation N)r:__init__ _cimd_manager_token_endpoint_url)rBrIrKrLrDs r-rOz)PrivateKeyJWTClientAuthenticator.__init__s3 """)#5   r,r/rreturnrcK|d{V}|d}|s't|d{VS|jt |d{V}|std|jdkr|d}|d}|tkrtdt|rt|t std |j |||j d{Vn%#t$r}td ||d}~wwxYw|St|d{VS) aAuthenticate a client from an HTTP request. Extends SDK authentication to support private_key_jwt for CIMD clients. Delegates to SDK for client_secret_basic (Authorization header) and client_secret_post (form body) authentication. N client_idzInvalid client_idprivate_key_jwtclient_assertion_typeclient_assertionz(Invalid client_assertion_type: expected zMissing client_assertion) assertionclienttoken_endpointzInvalid client assertion: )formr?r:authenticate_requestrI get_clientrMr token_endpoint_auth_methodJWT_BEARER_ASSERTION_TYPE isinstancerPvalidate_private_key_jwtrQ ValueError) rBr/ form_datarTrYassertion_typerXerDs r-r\z5PrivateKeyJWTClientAuthenticator.authenticate_requests",,..(((((( MM+..  ?55g>>>>>>>> >}//I???????? ;%&9:: :  ,0A A A&]]+BCCN! &899I!:::)Z?XZZ FJy#$>$> F)*DEEE S(AA'!#'#;B  S S S)*Jq*J*JKKQRR SMWW11':::::::::s(E E# EE#)rIrJrKr!rLrM)r/rrRr)r%r&r'r(rOr\rErFs@r-rHrH~se  666666"0;0;0;0;0;0;0;0;0;0;r,rHc\eZdZdZ dddZdd ZddZ dddZ dddZd dZ dd!dZ dS)" AuthProvideraFBase class for all FastMCP authentication providers. This class provides a unified interface for all authentication providers, whether they are simple token verifiers or full OAuth authorization servers. All providers must be able to verify tokens and can optionally provide custom authentication routes. Nbase_urlAnyHttpUrl | str | Nonerequired_scopeslist[str] | Noneresource_base_urlct|trt|}t|trt|}||_||_|pg|_d|_d|_dS)ar Initialize the auth provider. Args: base_url: The base URL of this server (e.g., http://localhost:8000). This is used for constructing .well-known endpoints and OAuth metadata. resource_base_url: Optional public base URL for the protected resource. When provided, the resource URL advertised in protected resource metadata (RFC 9728) is derived from this URL instead of ``base_url``, while operational OAuth routes remain rooted at ``base_url``. Providers that mint their own downstream tokens (e.g. ``OAuthProxy``) also use this as the minted token audience. Upstream token audience validation is configured separately on the token verifier. required_scopes: List of OAuth scopes required for all requests. N)r`rMrrhrlrj _mcp_path _resource_url)rBrhrjrls r-rOzAuthProvider.__init__sv* h $ $ ,!(++H ' - - > *+< = =   !2.4"%)04r,tokenrMrRAccessToken | Nonec$Ktd)aVerify a bearer token and return access info if valid. All auth providers must implement token verification. Args: token: The token string to validate Returns: AccessToken object if valid, None if invalid or expired &Subclasses must implement verify_tokenNotImplementedErrorrBrps r- verify_tokenzAuthProvider.verify_tokens""JKKKr,mcp_path str | NoneNonecH||_|||_dS)aSet the MCP endpoint path and compute resource URL. This method is called by get_routes() to configure the expected resource URL before route creation. Subclasses can override to perform additional initialization that depends on knowing the MCP endpoint path. Args: mcp_path: The path where the MCP endpoint is mounted (e.g., "/mcp") N)rn_get_resource_urlrorBrxs r- set_mcp_pathzAuthProvider.set_mcp_paths'"!33H==r, list[Route]cgS)a0Get all routes for this authentication provider. This includes both well-known discovery routes and operational routes. Each provider is responsible for creating whatever routes it needs: - TokenVerifier: typically no routes (default implementation) - RemoteAuthProvider: protected resource metadata routes - OAuthProvider: full OAuth authorization server routes - Custom providers: whatever routes they need Args: mcp_path: The path where the MCP endpoint is mounted (e.g., "/mcp") This is used to advertise the resource URL in metadata, but the provider does not create the actual MCP endpoint route. Returns: List of all routes for this provider (excluding the MCP endpoint itself) r+r}s r- get_routeszAuthProvider.get_routess * r,cD||}d|DS)aGet well-known discovery routes for this authentication provider. This is a utility method that filters get_routes() to return only well-known discovery routes (those starting with /.well-known/). Well-known routes provide OAuth metadata and discovery endpoints that clients use to discover authentication capabilities. These routes should be mounted at the root level of the application to comply with RFC 8414 and RFC 9728. Common well-known routes: - /.well-known/oauth-authorization-server (authorization server metadata) - /.well-known/oauth-protected-resource/* (protected resource metadata) Args: mcp_path: The path where the MCP endpoint is mounted (e.g., "/mcp") This is used to construct path-scoped well-known URLs. Returns: List of well-known discovery routes (typically mounted at root level) cpg|]3}t|t|jd1|4S)z /.well-known/)r`rpath startswith).0routes r- z6AuthProvider.get_well_known_routes..CsR   %'' -2J,A,A/,R,R    r,)r)rBrx all_routess r-get_well_known_routesz"AuthProvider.get_well_known_routes)s62__X..   #    r,listcpttt|ttgS)zGet HTTP application-level middleware for this auth provider. Returns: List of Starlette Middleware instances to apply to the HTTP app )backend)rrr r rBs r-get_middlewarezAuthProvider.get_middlewareIs< ()$//    , - -   r,rAnyHttpUrl | Nonec|jp|j}|dS|rKt|d}|d}t |d|S|S)a4Get the actual resource URL being protected. Uses ``resource_base_url`` if set; otherwise falls back to ``base_url``. Args: path: The path where the resource endpoint is mounted (e.g., "/mcp") Returns: The full URL of the protected resource N/)rlrhrMrstriplstripr)rBrrlprefixsuffixs r-r|zAuthProvider._get_resource_urlWsv!2Cdm  $4  4*++22377F[[%%F22&2233 3  r,NNNrhrirjrkrlrirprMrRrqrxryrRrzNrxryrRr)rRr)rryrRr) r%r&r'r(rOrwr~rrrr|r+r,r-rgrgs-1,059 55555> L L L L > > > > $2 $     @     !!!!!!!r,rgcLeZdZdZ ddfd Zedd ZddZxZS)rzBase class for token verifiers (Resource Servers). This class provides token verification capability without OAuth server functionality. Token verifiers typically don't provide authentication routes by default. NrhrirjrkrlcPt|||dS)u. Initialize the token verifier. Args: base_url: The base URL of this server resource_base_url: Optional public base URL for the protected resource. When provided, the resource URL advertised in protected resource metadata is derived from this URL instead of ``base_url``. Does not configure upstream token audience validation — set ``audience`` on your verifier to match. required_scopes: Scopes that are required for all requests rhrlrjN)r:rO)rBrhrjrlrDs r-rOzTokenVerifier.__init__us9$ /+      r,rR list[str]c|jpgS)aScopes to advertise in OAuth metadata. Defaults to required_scopes. Override in subclasses when the advertised scopes differ from the validation scopes (e.g., Azure AD where tokens contain short-form scopes but clients request full URI scopes). )rjrs r-scopes_supportedzTokenVerifier.scopes_supporteds#)r)r,rprMrqc$Ktd)z6Verify a bearer token and return access info if valid.rsrtrvs r-rwzTokenVerifier.verify_tokens!"JKKKr,rr)rRrr) r%r&r'r(rOpropertyrrwrErFs@r-rrns-1,059        0***X*LLLLLLLLr,rcNeZdZUdZded< ddfd ZddZ dddZxZS) RemoteAuthProvidera&Authentication provider for resource servers that verify tokens from known authorization servers. This provider composes a TokenVerifier with authorization server metadata to create standardized OAuth 2.0 Protected Resource endpoints (RFC 9728). Perfect for: - JWT verification with known issuers - Remote token introspection services - Any resource server that knows where its tokens come from Use this when you have token verification logic and want to advertise the authorization servers that issue valid tokens. rrhNtoken_verifierrauthorization_serverslist[AnyHttpUrl]AnyHttpUrl | strrrkrlri resource_nameryresource_documentationrct|||j||_||_||_||_||_dS)uInitialize the remote auth provider. Args: token_verifier: TokenVerifier instance for token validation authorization_servers: List of authorization servers that issue valid tokens base_url: The base URL of this server resource_base_url: Optional public base URL for the protected resource. When provided, the resource URL advertised in protected resource metadata is derived from this URL instead of ``base_url``. Does not configure the token verifier's audience — set ``audience`` on the verifier to match if you want validated tokens bound to the same resource. scopes_supported: Scopes to advertise in OAuth metadata. If None, uses the token verifier's scopes_supported property. Use this when the scopes clients request differ from the scopes that appear in tokens (e.g., Azure AD full URI scopes vs short-form). resource_name: Optional name for the protected resource resource_documentation: Optional documentation URL for the protected resource rN)r:rOrjrr_scopes_supportedrr) rBrrrhrrlrrrDs r-rOzRemoteAuthProvider.__init__sb: /*:    -%:"!1*&<###r,rprMrRrqcFK|j|d{VS)z1Verify token using the configured token verifier.N)rrwrvs r-rwzRemoteAuthProvider.verify_tokens/(55e<<<<<<<<)>STT T%NV*M&//&7' (. 8F $ $D $ * O,2<&((  '9,     i  (T[-D,0,BDK ),. ; " M  - - - T^,,,,,r,rprMrRrqcK|jD]c} ||d{V}||cS%#t$r2tdt |jdY`wxYwdS)aVerify a token by trying the server, then each verifier in order. Each source is tried independently. If a source raises an exception, it is logged and treated as a non-match so that remaining sources still get a chance to verify the token. Nz4Token verification failed for %s, trying next sourceT)exc_info)rrw Exceptionloggerdebugtyper%)rBrpsourceresults r-rwzMultiAuth.verify_tokenOsm  F %22599999999%!MMM&    JLL)! ts/9A+*A+rxryrzct||j|j||jD]}||dS)z3Propagate MCP path to the server and all verifiers.N)r:r~rr)rBrxverifierrDs r-r~zMultiAuth.set_mcp_pathdsk X&&& ; " K $ $X . . . , ,H  ! !( + + + + , ,r,rcH|j|j|SgS)z&Delegate route creation to the server.)rrr}s r-rzMultiAuth.get_routesls% ; ";))(33 3 r,cH|j|j|SgS)zDelegate well-known route creation to the server. This ensures that server-specific well-known route logic (e.g., OAuthProvider's RFC 8414 path-aware discovery) is preserved. )rrr}s r-rzMultiAuth.get_well_known_routesrs' ; ";44X>> > r,) rrrrrhrirlrirjrkrrrr) r%r&r'r(rOrwr~rrrErFs@r-rrs2'+@D,059,08-8-8-8-8-8-8-8-t*,,,,,, r,rc\eZdZdZddddddddfdZddZ ddfd Z ddfd ZxZS) OAuthProviderzOAuth Authorization Server provider. This class provides full OAuth server functionality including client registration, authorization flows, token issuance, and token verification. N)rl issuer_urlservice_documentation_urlclient_registration_optionsrevocation_optionsrjrhrrlrirrr ClientRegistrationOptions | NonerRevocationOptions | Nonerjrkc @t|||| |j|_n1t |t rt ||_n||_|jd|j]t |jt |jkr3td|jd|jd|jdtj|t |t rt |}||_ ||_ ||_ dS)a Initialize the OAuth provider. Args: base_url: The public URL of this FastMCP server resource_base_url: Optional public base URL for the protected resource. When provided, the protected resource metadata and token audience are derived from this URL instead of ``base_url``. issuer_url: The issuer URL for OAuth metadata (defaults to base_url) service_documentation_url: The URL of the service documentation. client_registration_options: The client registration options. revocation_options: The revocation options. required_scopes: Scopes that are required for all requests. rNzOAuth endpoints at z , issuer at z3. Ensure well-known routes are accessible at root (zY/.well-known/). See: https://gofastmcp.com/deployment/http#mounting-authenticated-servers) r:rOrhrr`rMrrinforrrr) rBrhrlrrrrrjrDs r-rOzOAuthProvider.__init__sD4 /+     "mDOO  C ( ( )(44DOO(DO M %+DM""c$/&:&::: KK]dm]]]]DHO]]]    )1$777 / 5 5 N(23L(M(M %)B&+F("4r,rprMrRrqc<K||d{VS)aX Verify a bearer token and return access info if valid. This method implements the TokenVerifier protocol by delegating to our existing load_access_token method. Args: token: The token string to validate Returns: AccessToken object if valid, None if invalid or expired N)load_access_tokenrvs r-rwzOAuthProvider.verify_tokens.++E222222222r,rxryrc @|||jJ|jJt||j|j|j|j}g}|D]}t|trv|j dkrk|j dd|j vr[t|t|}| tdt|jddgddg| ||jrk|jr|jjr |jjn|j}t'|jt)t*|jg|}|||t/||S) atGet OAuth authorization server routes and optional protected resource routes. This method creates the full set of OAuth routes including: - Standard OAuth authorization server routes (/.well-known/oauth-authorization-server, /authorize, /token, etc.) - Optional protected resource routes Returns: List of OAuth routes N)rIrrrrz/tokenPOST)rIclient_authenticatorOPTIONS)rendpointmethods)rrr)r~rhrrrrrr`rrrr rrrr;ro valid_scopesrjrrrrr:r) rBrx sdk_routes oauth_routesr token_handlersupported_scopesprotected_routesrDs r-rzOAuthProvider.get_routess (### }((( O ' ' '(}&*&D(,(H#6    %'  + +E5%(( +J(**M-em++!-!8KD8Q8Q!!! ##%!0)0692E"""( 3 ##E****   23*4A*0==)  @!/'+J'H'H&I!1        0 1 1 1 EGG..x88999r,ct|}|jrtt |j}|jd}|rd|dkr^g}|D]W}|jdkr5d|}|t||j |j B||X|S|S)aGet well-known discovery routes with RFC 8414 path-aware support. Overrides the base implementation to support path-aware authorization server metadata discovery per RFC 8414. If issuer_url has a path component, the authorization server metadata route is adjusted to include that path. For example, if issuer_url is "http://example.com/api", the discovery endpoint will be at "/.well-known/oauth-authorization-server/api" instead of just "/.well-known/oauth-authorization-server". Args: mcp_path: The path where the MCP endpoint is mounted (e.g., "/mcp") Returns: List of well-known discovery routes rz'/.well-known/oauth-authorization-server)rr) r:rrrrMrrrrrr) rBrxrparsed issuer_path new_routesrnew_pathrDs r-rz#OAuthProvider.get_well_known_routes"s(..x88 ? "c$/2233F +,,S11K "{c11 # 1 1Ez%NNNSkSS!#))! ().(- #))%0000!! r,)rhrrlrirrirrirrrrrjrkrrr) r%r&r'r(rOrwrrrErFs@r-rr}s6:.2=AHL7;,0;5;5;5;5;5;5;5;5z 3 3 3 3" $MMMMMMMb $...........r,r)? __future__rr<typingrrr urllib.parsermcp.server.auth.handlers.tokenrr _SDKTokenHandlermcp.server.auth.json_responser 'mcp.server.auth.middleware.auth_contextr &mcp.server.auth.middleware.bearer_authr &mcp.server.auth.middleware.client_authr r_SDKClientAuthenticatormcp.server.auth.providerr_SDKAccessTokenrrrrTokenVerifierProtocolmcp.server.auth.routesrrrmcp.server.auth.settingsrrmcp.shared.authrpydanticrrstarlette.middlewarer#starlette.middleware.authenticationrstarlette.requestsrstarlette.routingrfastmcp.utilities.loggingr fastmcp.server.auth.cimdr!r%rr_rHrgrrrr+r,r-rs"""""" ++++++++++!!!!!!======KKKKKK>>>>>>IIIIIIDDDDDD  766666&&&&&&&&++++++HHHHHH&&&&&&######000000;:::::: H  99999/999 ;;;;;#;;;~UN;N;N;N;N;'>N;N;N;b\!\!\!\!\!(\!\!\!~,L,L,L,L,LL,L,L,L^^^^^^^^^B||||| |||~SSSSS$%6 k%QRSSSSSr,