kKjGrddlmZddlZddlZddlmZddlmZddlm Z ddl Z ddl Z ddl m Z ddlmZddlmZdd lmZmZdd lmZdd lmZmZmZdd lmZdd lmZddlm Z ddl!m"Z"m#Z#ddl$m%Z%ddl&m'Z'dgZ(e'e)Z*ddZ+ddZ,Gdde-Z. d ddZ/GddeZ0GddeZ1y)) annotationsN)AsyncGenerator)aclosing)Any)PydanticAdapter) AsyncKeyValue) MemoryStore)OAuthClientProvider TokenStorage)McpHttpClientFactory)OAuthClientInformationFullOAuthClientMetadata OAuthToken) AnyHttpUrl)override)Server)OAuthCallbackResultcreate_oauth_callback_server)find_available_port) get_loggerOAuthcT|jdr|jdr|ddS|S)N[]) startswithendswithhosts j/Users/ahmed/devFolder/Ultron/claude-voice/.venv/lib/python3.12/site-packages/fastmcp/client/auth/oauth.py!_normalize_callback_host_for_bindr"%s* s c 2Abz Kcd|vrd|dS|S)N:rrrs r!_format_callback_host_for_urlr'+s d{4&{ Kr#ceZdZdZy)ClientNotFoundErrorzARaised when OAuth client credentials are not found on the server.N)__name__ __module__ __qualname____doc__r&r#r!r)r)1sKr#r)cKtjdi|xsi4d{} |j|dd{}|jdvr dddd{yd|jvr dddd{y dddd{y7r7X7;77 #tj $rYdddd{7ywxYw#1d{7swYyxYww) z Check if the MCP endpoint requires authentication by making a test request. Returns: True if auth appears to be required, False otherwise Ng@)timeout)iiTzWWW-AuthenticateFr&)httpx AsyncClientget status_codeheaders RequestError)mcp_url httpx_kwargsclientresponses r!check_if_auth_requiredr:5s  8L$6B88F #ZZZ==H##z1988"X%5%55988988>988 !! %988  !988sCBCCBBB CBC!B0 C;B<C C BCBCCCC0C1 C<B?=CCCC C CCceZdZUded<ded<ded<ded<dd Zdd Zdd Zdd Zdd Ze ddZ e ddZ ddZ e ddZ e ddZy)TokenStorageAdapterstr _server_urlr_key_value_storezPydanticAdapter[OAuthToken]_storage_oauth_tokenz+PydanticAdapter[OAuthClientInformationFull]_storage_client_infoc||_||_ttd|td|_tt d|t d|_y)Nzmcp-oauth-tokenT)default_collection key_valuepydantic_modelraise_on_validation_errorzmcp-oauth-client-info)r>r?rrr@r rA)selfasync_key_value server_urls r!__init__zTokenStorageAdapter.__init__YsQ% /$3J$?0%%&* % ! %44N$O6%5&* % !r#c |jdS)Nz/tokensr>rGs r!_get_token_cache_keyz(TokenStorageAdapter._get_token_cache_keyis""#7++r#c |jdS)Nz /client_inforLrMs r!_get_client_info_cache_keyz.TokenStorageAdapter._get_client_info_cache_keyls""#<00r#c |jdS)Nz /token_expiryrLrMs r!_get_token_expiry_cache_keyz/TokenStorageAdapter._get_token_expiry_cache_keyos""#=11r#cFK|jj|jd{|jj|j d{|j j|j dd{y7j7:7 w)Nkeymcp-oauth-token-expiryrU collection)r@deleterNrArPr?rRrMs r!clearzTokenStorageAdapter.clearrs''..43L3L3N.OOO''..43R3R3T.UUU##**002/+    PU s3.B!B1B!"B#2B!BB!B!B!crK|jj|jd{S7wNrT)r@r2rNrMs r! get_tokenszTokenStorageAdapter.get_tokenszs/..22t7P7P7R2SSSS .757cXK|jj|j|dd{|jbt jt |jz}|j j|jd|iddd{yy7s7w)Ni3rUvaluettl expires_atrV)rUrarXrb)r@putrN expires_intimeintr?rR)rGtokensrcs r! set_tokenszTokenStorageAdapter.set_tokens~s ''++))+",       (s6+<+<'==J''++446#Z03& ,   )  s"0B*B&A,B*B( B*(B*cK|jj|jdd{}|t|dSy7w)NrVrWrc)r?r2rRfloat)rGraws r!get_token_expiryz$TokenStorageAdapter.get_token_expirysT))--002/.   ?\*+ +  s/A AA crK|jj|jd{S7wr\)rAr2rPrMs r!get_client_infoz#TokenStorageAdapter.get_client_infos:..22//13    r^cKd}|jr*|jttjz }|jj |j ||d{y7w)Nr`)client_secret_expires_atrgrfrArdrP)rG client_inforbs r!set_client_infoz#TokenStorageAdapter.set_client_infosd  / /66TYY[9IIC''++//1,   sA(A2*A0+A2N)rHrrIr=)returnr=rtNone)rtzOAuthToken | None)rhrrtrv)rtz float | None)rtz!OAuthClientInformationFull | None)rrr rtrv)r*r+r,__annotations__rJrNrPrRrZrr]rirmrorsr&r#r!r<r<Ss##55EE ,12 TT(      r#r<ceZdZUdZded< d d dZd fd Zd fd ZddZddZ dfd Z xZ S)rz OAuth client provider for MCP servers with browser-based authentication. This class provides OAuth authentication for FastMCP clients by opening a browser for user authorization and running a local callback server. bool_boundc ||_||_||_||_||_t ||_||_| |_| |_ | |_ d|_ | xstj|_d|_||j!|yy)a Initialize OAuth client provider for an MCP server. Args: mcp_url: Full URL to the MCP endpoint (e.g. "http://host/mcp/sse/"). Optional when OAuth is passed to Client(auth=...), which provides the URL automatically from the transport. scopes: OAuth scopes to request. Can be a space-separated string or a list of strings. client_name: Name for this client during registration token_storage: An AsyncKeyValue-compatible token store, tokens are stored in memory if not provided additional_client_metadata: Extra fields for OAuthClientMetadata callback_port: Fixed port for OAuth callback (default: random available port) callback_host: Hostname used for OAuth redirect URI and callback server. callback_timeout: Seconds to wait for OAuth callback before timing out. client_metadata_url: A CIMD (Client ID Metadata Document) URL. When provided, this URL is used as the client_id instead of performing Dynamic Client Registration. Must be an HTTPS URL with a non-root path (e.g. "https://myapp.example.com/oauth/client.json"). client_id: Pre-registered OAuth client ID. When provided, skips dynamic client registration and uses these static credentials instead. client_secret: OAuth client secret (optional, used with client_id) NF)_scopes _client_name_token_storage_additional_client_metadata_callback_portr"_callback_host_callback_timeout_client_metadata_url _client_id_client_secret_static_client_infor0r1httpx_client_factoryrz_bind) rGr6scopes client_name token_storageadditional_client_metadata callback_port callback_hostcallback_timeoutrclient_metadata_url client_id client_secrets r!rJzOAuth.__init__sT '++E(+? N!1$7!#+#' $8$ME|j@|jBd |_y)zBind this OAuth provider to a specific MCP server URL. Called automatically when mcp_url is provided to __init__, or by the transport when OAuth is used without an explicit URL. N/rzhttp://r%z /callback authorization_code refresh_tokencode)r redirect_uris grant_typesresponse_typesscopeT) exclude_nonetoken_endpoint_auth_methodclient_secret_postnone)rrr)warnzUsing in-memory token storage -- tokens will be lost when the client restarts. For persistent storage across multiple MCP servers, provide an encrypted AsyncKeyValue backend. See https://gofastmcp.com/clients/auth/oauth#token-storage for details.)message stacklevel)rHrI)rIclient_metadatastorageredirect_handlercallback_handlerr/rr&)"rzrstriprrr redirect_portr' isinstancer|listjoinr=rr}rrr model_dumprr rr~r warningsrr<token_storage_adapterr6superrJrrrr) rGr6 redirect_host redirect_uri scopes_strrmetadatarr __class__s r!rz OAuth._binds ;; ..%!00 4G$$5 6d6I6IJ  q1C1C0DIN  dllD )$,,/J \\ %T\\*JJ- ))%l34-?"8  //52   ??'11t1DH,8;,0,?,?(V56(B(//"11((D $ ++<{} m[ 1 % Z  ;N)g; "  +..!22!22** $ 9 9   r#c(Kt|d{|jH|j|j_|j j |jd{|jjr|jjjrf|j jd{}|||j_ y|jj|jjyyy777Nw)zBLoad stored tokens and client info, properly setting token expiry.N) r _initializercontextrrrrscurrent_tokensrermtoken_expiry_timeupdate_token_expiry)rG stored_expiryrs r!rzOAuth._initializeGsg!###  # # /'+'?'?DLL $,,< . 001L1LM ,R & $ WPs6DD AD)D*ADDA DDDcK|j4d{}|j|dd{}|jdk(r td|jdvrt d|jdddd{t j d|tj|y7776#1d{7swYFxYww) zIOpen browser for authorization, with pre-flight check for invalid client.NF)follow_redirectsiz8OAuth client not found - cached credentials may be stale)i.i/i3i4z#Unexpected authorization response: zOAuth authorization URL: ) rr2r3r) RuntimeErrorloggerinfo webbrowseropen)rGauthorization_urlr8r9s r!rzOAuth.redirect_handlerVs,,..&#ZZ(9EZRRH##s*)N ##+DD"9(:N:N9OP/.  /0A/BCD)*!/R/...sUCB5CB;B7AB;7 CB93C7B;9C;C C C  CcKt}tj}t|j|j |j ||}tj4d{}|j|jtjd|j d|j tj|j5|jd{|jr |j|j |j"fcdddd|_tj&dd{|j(j+cdddd{S77757 #1swYnxYwn+#t,$r}t-d|jd|d}~wwxYw d|_tj&dd{7|j(j+nD#d|_tj&dd{7|j(j+wxYwdddd{7t/d #1d{7swYt/d xYww) z4Handle OAuth callback and return (auth_code, state).)portr rIresult_container result_readyNu-🎧 OAuth callback server started on http://r%Tg?zOAuth callback timed out after z secondsz+OAuth callback handler could not be started)ranyioEventrrrr6create_task_group start_soonserverr fail_afterrwaiterrorrstate should_exitsleep cancel_scopecancel TimeoutErrorr)rGresultrservertges r!rzOAuth.callback_handlerks%&{{} 6##$$||#%  **,, MM&,, ' KK?@S@S?TTUVZVhVhUij  )%%d&<&<=&++---||$ll*!;; 4 >=&*"kk#&&&&&('-,,.'%->==   "5d6L6L5MXV  >&*"kk#&&&&&(&*"kk#&&&&&('-,,*HII+-,,*HIIsA%I8'E7(I8+A I7F F*E:+3F F 'IE<I% I81E>2I8:F<I>I8F F  G9 F5F00F55G99IG I9 H:H  H::I= I8I  I8I5I" I5'I8cK|js td tt||4d{}d} |j |d{}|} 7'7 #t $rYnwxYwdddd{7y#1d{7swYyxYw#t$r|j tddtjdd|_ |jjd{7tt||4d{7}d} |j |d{7}|}n#t $rYnwxYw1dddd{7Yy#1d{7swYYyxYwwxYww)zHTTPX auth flow with automatic retry on stale cached credentials. If the OAuth flow fails due to invalid/stale client credentials, clears the cache and retries once with fresh registration. zOAuth provider has no server URL. Either pass mcp_url to OAuth() or use it with Client(auth=...) which provides the URL automatically.NzOAuth server rejected the static client credentials. Verify that the client_id (and client_secret, if provided) are correct and that the client is registered with the server.z@OAuth client not found on server, clearing cache and retrying...F)rzrrrasync_auth_flowasendStopAsyncIterationr)rrdebug _initializedrrZ)rGrequestgenr9yielded_requestrs r!rzOAuth.async_auth_flowsp{{X %  7 @AAS03 (0C*C)8#8 B +D-BAAAA# ''3)U  LLR !&D ,,224 4 4  7 @AAS03 (0C*C*C)8#8- BAAAA% s(E=BA BBA$A" A$B B"A$$ A0-B/A00B3 B>B?BE=B B BBE=BAE:4C75!E:DE:E# E4D75 E?E# E  E# E  E# E:EE:!E=#E6 )E,*E6 1E:4E=6E::E=) NNzFastMCP ClientNNN localhostgr@NNNN)r6 str | Nonerzstr | list[str] | Nonerr=rzAsyncKeyValue | Nonerdict[str, Any] | Nonerz int | Nonerr=rrkrzMcpHttpClientFactory | Nonerrrrrr)r6r=rtrvru)rr=rtrv)rtztuple[str, str | None])rz httpx.Requestrtz-AsyncGenerator[httpx.Request, httpx.Response]) r*r+r,r-rwrJrrrrr __classcell__)rs@r!rrs L#)-+.2<@$(("'<@+/ $$(!9 9 '9  9 , 9 %: 9 "9 9  9 :9 (9 9 "!9 vPd N+*%JN2$2 622r#)r r=rtr=)N)r6r=r7rrtry)2 __future__rrfrcollections.abcr contextlibrtypingrrr0key_value.aio.adapters.pydanticrkey_value.aio.protocolsrkey_value.aio.stores.memoryr mcp.client.authr r mcp.shared._httpx_utilsr mcp.shared.authr rrpydanticrtyping_extensionsruvicorn.serverrfastmcp.client.oauth_callbackrrfastmcp.utilities.httprfastmcp.utilities.loggingr__all__r*rr"r' Exceptionr)r:r<rr&r#r!rs" * ;13=8  &!70 ) H   L)L 9=  5