kKj#dZddlmZddlmZddlZddlmZmZddl m Z ddl m Z ddl mZmZdd lmZdd lmZeeZGd d ed ZGddeZy)aPropelAuth authentication provider for FastMCP. Example: ```python from fastmcp import FastMCP from fastmcp.server.auth.providers.propelauth import PropelAuthProvider auth = PropelAuthProvider( auth_url="https://auth.yourdomain.com", introspection_client_id="your-client-id", introspection_client_secret="your-client-secret", base_url="https://your-fastmcp-server.com", required_scopes=["read:user_data"], ) mcp = FastMCP("My App", auth=auth) ``` ) annotations) TypedDictN) AnyHttpUrl SecretStr) JSONResponse)Route) AccessTokenRemoteAuthProviderIntrospectionTokenVerifier) get_loggerc6eZdZUded<ded<ded<ded<y) %PropelAuthTokenIntrospectionOverridesinttimeout_secondsz int | Nonecache_ttl_secondsmax_cache_sizezhttpx.AsyncClient | None http_clientN)__name__ __module__ __qualname____annotations__y/Users/ahmed/devFolder/Ultron/claude-voice/.venv/lib/python3.12/site-packages/fastmcp/server/auth/providers/propelauth.pyrr$s!!))rrF)totalceZdZdZddddddd dfdZ d d fd Zd fd Z d dZxZS) PropelAuthProvideramPropelAuth resource server provider using OAuth 2.1 token introspection. This provider validates access tokens via PropelAuth's introspection endpoint and forwards authorization server metadata for OAuth discovery. Setup: 1. Enable MCP authentication in the PropelAuth Dashboard 2. Configure scopes on the MCP page 3. Select which redirect URIs to enable by picking which clients you support 4. Generate introspection credentials (Client ID + Client Secret) For detailed setup instructions, see: https://docs.propelauth.com/mcp-authentication/overview Example: ```python from fastmcp import FastMCP from fastmcp.server.auth.providers.propelauth import PropelAuthProvider auth = PropelAuthProvider( auth_url="https://auth.yourdomain.com", introspection_client_id="your-client-id", introspection_client_secret="your-client-secret", base_url="https://your-fastmcp-server.com", required_scopes=["read:user_data"], ) mcp = FastMCP("My App", auth=auth) ``` N)required_scopesscopes_supported resource_nameresource_documentationresourcetoken_introspection_overridesc $t|jd} | d} t| d} | d|_tj dnt| |_|j | |||| }| |_t|%|| g||||y)aLInitialize PropelAuth provider. Args: auth_url: Your PropelAuth Auth URL (from the Backend Integration page) introspection_client_id: Introspection Client ID from the PropelAuth Dashboard introspection_client_secret: Introspection Client Secret from the PropelAuth Dashboard base_url: Public URL of this FastMCP server required_scopes: Optional list of scopes that must be present in tokens scopes_supported: Optional list of scopes to advertise in OAuth metadata. If None, uses required_scopes. Use this when the scopes clients should request differ from the scopes enforced on tokens. resource_name: Optional name for the protected resource metadata. resource_documentation: Optional documentation URL for the protected resource. resource: Optional resource URI (RFC 8707) identifying this MCP server. Use this when multiple MCP servers share the same PropelAuth authorization server (e.g. ``resource="https://api.example.com/mcp"``), so only tokens intended for this MCP server are accepted. token_introspection_overrides: Optional overrides for the underlying IntrospectionTokenVerifier (timeout, caching, http_client) /z/oauth/2.1/introspectz /oauth/2.1NzFPropelAuthProvider: no resource configured, audience checking disabled)introspection_url client_id client_secretrintrospection_overrides)token_verifierauthorization_serversbase_urlr r!r") strrstripr _resourceloggerdebug_create_token_verifier_normalized_auth_urlsuper__init__)selfauth_urlintrospection_client_idintrospection_client_secretr-rr r!r"r#r$normalized_auth_urlr'authorization_server_urlr+ __class__s rr6zPropelAuthProvider.__init__KsH"(m2237233HI#-1D0EZ.P#Q  !DN LLX !]DN44/-5+$A 5 %8! )#;"<-'#9  rcnt|}fd}|jtd|dg|S)aGet routes for this provider. Includes the standard routes from the RemoteAuthProvider (protected resource metadata routes (RFC 9728)), and creates an authorization server metadata route that forwards to PropelAuth's route Args: mcp_path: The path where the MCP endpoint is mounted (e.g., "/mcp") This is used to advertise the resource URL in metadata. cK tj4d{}|jjdd{}|j |j }t |cdddd{S7f7B7 #1d{7swYyxYw#t$r}t dd|ddcYd}~Sd}~wwxYww)z6Forward PropelAuth OAuth authorization server metadataNz1/.well-known/oauth-authorization-server/oauth/2.1 server_errorz%Failed to fetch PropelAuth metadata: )errorerror_descriptioni) status_code)httpx AsyncClientgetr4raise_for_statusjsonr Exception)requestclientresponsemetadataer7s r#oauth_authorization_server_metadatazJPropelAuthProvider.get_routes..oauth_authorization_server_metadatas  ,,..&%+ZZ4455fg& H--/'}}H'1 /.. /... #!//TUVTW-X!$  sCBBB"B B.B 2 B>B?BCBB B BB BBCB C(C:C;CCCz'/.well-known/oauth-authorization-serverGET)endpointmethods)r5 get_routesappendr)r7mcp_pathroutesrOr=s` rrSzPropelAuthProvider.get_routessA#H- &  9<   rcKt||d{}| |j|S|jj d}||jk7r"t j d||jy|S7bw)zIVerify token and check the ``aud`` claim against the configured resource.Naudz@PropelAuthProvider: token audience %r does not match resource %s)r5 verify_tokenr0claimsrFr1r2)r7tokenresultrXr=s rrYzPropelAuthProvider.verify_tokenstw+E22 >T^^3Mmm& $.. LLR   3sA;A9A#A;ci}|0d|vr|d|d<d|vr|d|d<d|vr|d|d<d|vr|d|d<td||||d|S)Nrrrr)r'r(r)rrr )r7r'r(r)rr*safe_overridess rr3z)PropelAuthProvider._create_token_verifiersAC " . $;;4K%501#&==6M'723 #::3J$4/0 770G 0V}-) /'+     r)r8AnyHttpUrl | strr9r.r:str | SecretStrr-r_rlist[str] | Noner rar! str | Noner"zAnyHttpUrl | Noner#zAnyHttpUrl | str | Noner$,PropelAuthTokenIntrospectionOverrides | None)N)rUrbreturnz list[Route])r[r.rdzAccessToken | None) r'r.r(r.r)r`rrar*rcrdr ) rrr__doc__r6rSrYr3 __classcell__)r=s@rrr+sL-1-1$(48,0 @ #@ "% @ &5 @ # @ *@ +@ "@ !2@ *@  9@ H $** *X"      '  *  "N   $  rr)re __future__rtypingrrDpydanticrrstarlette.responsesrstarlette.routingrfastmcp.server.authr r +fastmcp.server.auth.providers.introspectionr fastmcp.utilities.loggingr rr1rrrrrrosN&# *,#?R0 H *IU* + r