kKj,dZddlmZddlmZddlmZddlmZddl m Z ddl m Z m Z ddlmZdd lmZdd lmZeeZGd d eZGd de Zy)aAWS Cognito OAuth provider for FastMCP. This module provides a complete AWS Cognito OAuth integration that's ready to use with a user pool ID, domain prefix, client ID and client secret. It handles all the complexity of AWS Cognito's OAuth flow, token validation, and user management. Example: ```python from fastmcp import FastMCP from fastmcp.server.auth.providers.aws_cognito import AWSCognitoProvider # Simple AWS Cognito OAuth protection auth = AWSCognitoProvider( user_pool_id="your-user-pool-id", aws_region="eu-central-1", client_id="your-cognito-client-id", client_secret="your-cognito-client-secret" ) mcp = FastMCP("My Protected Server", auth=auth) ``` ) annotations)Literal) AsyncKeyValue) AnyHttpUrl) AccessToken)&DEFAULT_OIDC_DISCOVERY_TIMEOUT_SECONDS OIDCProxy) JWTVerifier) parse_scopes) get_loggerc6eZdZdZdddfdZdfd ZxZS)AWSCognitoTokenVerifieraToken verifier for Cognito access tokens. Cognito access tokens use a ``client_id`` claim instead of the standard ``aud`` claim. This subclass passes ``audience=None`` to the parent (skipping the ``aud`` check) and validates the ``client_id`` claim directly. N)audiencec 6||_t|dddi|y)Nr)_expected_client_idsuper__init__)selfrkwargs __class__s r/Users/ahmed/devFolder/Ultron/claude-voice/.venv/lib/python3.12/site-packages/fastmcp/server/auth/providers/aws.pyrz AWSCognitoTokenVerifier.__init__4s #+  1$1&1clKt||d{}|sy|jr}|jj d}t |jt r||jv}n||jk(}|s(|jjd|j|y|jj d|jj d|jj dgd}t|j|j|j|j|S7w) z:Verify token and filter claims to Cognito-specific subset.N client_idzAToken validation failed: client_id mismatch (expected %s, got %s)subusernamecognito:groups)rrr)tokenrscopes expires_atclaims)r verify_tokenrr"get isinstancelistloggerdebugrrrr r!)rr access_tokentoken_client_idvalidcognito_claimsrs rr#z$AWSCognitoTokenVerifier.verify_token8s"W1%88   # #*1155kBO$22D9'4+C+CC'4+C+CC !!W,,#  &&**51$++// ;*11556FK  $$",,&&#..!   59sD4D1DD4)rzstr | list[str] | None)rstrreturnzAccessToken | None)__name__ __module__ __qualname____doc__rr# __classcell__rs@rrr+s>B2" " rrceZdZdZeddddddddddddddd d fdZddddd  d d ZxZS) AWSCognitoProvidera'Complete AWS Cognito OAuth provider for FastMCP. This provider makes it trivial to add AWS Cognito OAuth protection to any FastMCP server using OIDC Discovery. Just provide your Cognito User Pool details, client credentials, and a base URL, and you're ready to go. Features: - Automatic OIDC Discovery from AWS Cognito User Pool - Automatic JWT token validation via Cognito's public keys - Cognito-specific claim filtering (sub, username, cognito:groups) - Support for Cognito User Pools Example: ```python from fastmcp import FastMCP from fastmcp.server.auth.providers.aws_cognito import AWSCognitoProvider auth = AWSCognitoProvider( user_pool_id="eu-central-1_XXXXXXXXX", aws_region="eu-central-1", client_id="your-cognito-client-id", client_secret="your-cognito-client-secret", base_url="https://my-server.com", redirect_path="/custom/callback", ) mcp = FastMCP("My App", auth=auth) ``` Nz eu-central-1z/auth/callbackTr)timeout_secondsresource_base_url aws_region issuer_url redirect_pathrequired_scopesallowed_client_redirect_urisclient_storagejwt_signing_keyrequire_authorization_consentconsent_csp_policyforward_resource%fallback_refresh_token_expiry_seconds#fastmcp_access_token_expiry_secondstoken_expiry_threshold_secondsc| t| ndg}d|d|d}||_||_||_t|||||d||||| | | | ||||||t jd||y) a Initialize AWS Cognito OAuth provider. Args: user_pool_id: Your Cognito User Pool ID (e.g., "eu-central-1_XXXXXXXXX") client_id: Cognito app client ID client_secret: Cognito app client secret timeout_seconds: Timeout, in seconds, for the OIDC discovery request made during construction. Defaults to 10 seconds so a slow or unreachable issuer cannot block server startup indefinitely. Pass None to fall back to the HTTP client's own default timeout. base_url: Public URL where OAuth endpoints will be accessible (includes any mount path) resource_base_url: Optional public base URL for the protected resource metadata and token audience. Defaults to ``base_url``. aws_region: AWS region where your User Pool is located (defaults to "eu-central-1") issuer_url: Issuer URL for OAuth metadata (defaults to base_url). Use root-level URL to avoid 404s during discovery when mounting under a path. redirect_path: Redirect path configured in Cognito app (defaults to "/auth/callback") required_scopes: Required Cognito scopes (defaults to ["openid"]) allowed_client_redirect_uris: List of allowed redirect URI patterns for MCP clients. If None (default), all URIs are allowed. If empty list, no URIs are allowed. client_storage: Storage backend for OAuth state (client registrations, encrypted tokens). If None, an encrypted file store will be created in the data directory (derived from `platformdirs`). jwt_signing_key: Secret for signing FastMCP JWT tokens (any string or bytes). If bytes are provided, they will be used as is. If a string is provided, it will be derived into a 32-byte key. If not provided, the upstream client secret will be used to derive a 32-byte key using PBKDF2. require_authorization_consent: Whether to require user consent before authorizing clients (default True). When True, users see a consent screen before being redirected to AWS Cognito. When False, authorization proceeds directly without user confirmation. When "external", the built-in consent screen is skipped but no warning is logged, indicating that consent is handled externally (e.g. by the upstream IdP). SECURITY WARNING: Only set to False for local development or testing environments. fallback_refresh_token_expiry_seconds: Lifetime for the FastMCP-issued refresh token when the upstream provider omits `refresh_expires_in` (e.g. Cognito, GitHub, many OIDC IdPs). Defaults to 1 year. The upstream refresh remains the source of truth. See `OAuthProxy` for details. fastmcp_access_token_expiry_seconds: Lifetime for the FastMCP-issued access token, decoupling it from the upstream provider's `expires_in`. Defaults to None (mirror the upstream lifetime). Set this for bridges whose upstream issues short-lived access tokens that some MCP clients can't refresh gracefully (e.g. `mcp-remote`). See `OAuthProxy` for details. token_expiry_threshold_seconds: Number of seconds before actual expiry to treat a token as expired, refreshing early to avoid races. Defaults to 0. Nopenidzhttps://cognito-idp.z.amazonaws.com/z!/.well-known/openid-configurationRS256) config_urlr client_secretr7 algorithmr<base_urlr8r:r;r=r>r?r@rArBrCrDrEzDInitialized AWS Cognito OAuth provider for client %s with scopes: %s)r user_pool_idr9rrrr'r()rrMrrJr7rLr8r9r:r;r<r=r>r?r@rArBrCrDrErequired_scopes_finalrIrs rrzAWSCognitoProvider.__init__|sJ.=-HL )xj  ,J<|nTuv )$" !'+1/!')E)+*G1-2W0S+I'  ,  R  ! r)rKrr<r7ctt|jj|xs |j|t|jj |S)aICreates a Cognito-specific token verifier with claim filtering. Args: algorithm: Optional token verifier algorithm audience: Optional token verifier audience required_scopes: Optional token verifier required_scopes timeout_seconds: HTTP request timeout in seconds )issuerrrKjwks_urir<)rr- oidc_configrPrrQ)rrKrr<r7s rget_token_verifierz%AWSCognitoProvider.get_token_verifiersK 't''..//))223+   r)&rMr-rr-rJr-r7 int | NonerLzAnyHttpUrl | strr8AnyHttpUrl | str | Noner9r-r:rUr;r-r<list[str] | Noner=rVr>zAsyncKeyValue | Noner?zstr | bytes | Noner@z&bool | Literal['remember', 'external']rA str | NonerBboolrCrTrDrTrEint) rKrWrrWr<rVr7rTr.r)r/r0r1r2rrrSr3r4s@rr6r6]sWH'M59(.2-,09=/3.2PT)-!%<@:>./+k k  k  k $ k #k 3k k ,k k *k '7k -k ,k (N!k "'#k $%k &0:'k (.8)k *),+k `!%#,0&*     *  $   ! rr6N)r2 __future__rtypingrkey_value.aio.protocolsrpydanticrfastmcp.server.auth.authrfastmcp.server.auth.oidc_proxyrr !fastmcp.server.auth.providers.jwtr fastmcp.utilities.authr fastmcp.utilities.loggingr r/r'rr6rrrrcsP.#10:/0 H / k/ db b r