kKj$"dZddlmZddlZddlmZddlmZddlm Z ddl m Z m Z ddl mZdd lmZdd lmZeeZGd d e Zy) aScalekit authentication provider for FastMCP. This module provides ScalekitProvider - a complete authentication solution that integrates with Scalekit's OAuth 2.1 and OpenID Connect services, supporting Resource Server authentication for seamless MCP client authentication. ) annotationsN) AnyHttpUrl) JSONResponse)Route)RemoteAuthProvider TokenVerifier) JWTVerifier) parse_scopes) get_loggerc teZdZdZddddddddd dfdZ d dfd ZxZS) ScalekitProvideraScalekit resource server provider for OAuth 2.1 authentication. This provider implements Scalekit integration using resource server pattern. FastMCP acts as a protected resource server that validates access tokens issued by Scalekit's authorization server. IMPORTANT SETUP REQUIREMENTS: 1. Create an MCP Server in Scalekit Dashboard: - Go to your [Scalekit Dashboard](https://app.scalekit.com/) - Navigate to MCP Servers section - Register a new MCP Server with appropriate scopes - Ensure the Resource Identifier matches exactly what you configure as MCP URL - Note the Resource ID 2. Environment Configuration: - Set SCALEKIT_ENVIRONMENT_URL (e.g., https://your-env.scalekit.com) - Set SCALEKIT_RESOURCE_ID from your created resource - Set BASE_URL to your FastMCP server's public URL For detailed setup instructions, see: https://docs.scalekit.com/mcp/overview/ Example: ```python from fastmcp.server.auth.providers.scalekit import ScalekitProvider # Create Scalekit resource server provider scalekit_auth = ScalekitProvider( environment_url="https://your-env.scalekit.com", resource_id="sk_resource_...", base_url="https://your-fastmcp-server.com", ) # Use with FastMCP mcp = FastMCP("My App", auth=scalekit_auth) ``` N)base_urlmcp_url client_idrequired_scopesscopes_supported resource_nameresource_documentationtoken_verifierc |xs|} | s td|tjd|tjdt|j d|_||_| t|ng} | |_t| } tjd|j |j | |j| ytjd|j d|j |jt|j d|j d |j |jxsd } ntjd t|1| t|j d |j g| ||| y)aLInitialize Scalekit resource server provider. Args: environment_url: Your Scalekit environment URL (e.g., "https://your-env.scalekit.com") resource_id: Your Scalekit resource ID base_url: Public URL of this FastMCP server (or use mcp_url for backwards compatibility) mcp_url: Deprecated alias for base_url. Will be removed in a future release. client_id: Deprecated parameter, no longer required. Will be removed in a future release. required_scopes: Optional list of scopes that must be present in tokens scopes_supported: Optional list of scopes to advertise in OAuth metadata. If None, uses required_scopes. Use this when the scopes clients should request differ from the scopes enforced on tokens. resource_name: Optional name for the protected resource metadata. resource_documentation: Optional documentation URL for the protected resource. token_verifier: Optional token verifier. If None, creates JWT verifier for Scalekit z+Either base_url or mcp_url must be providedNztScalekitProvider parameter 'mcp_url' is deprecated and will be removed in a future release. Rename it to 'base_url'.zScalekitProvider no longer requires 'client_id'. The parameter is accepted only for backward compatibility and will be removed in a future release./z_Initializing ScalekitProvider: environment_url=%s resource_id=%s base_url=%s required_scopes=%szSCreating default JWTVerifier for Scalekit: jwks_uri=%s issuer=%s required_scopes=%sz/keysRS256)jwks_uriissuer algorithmaudiencerz0Using custom token verifier for ScalekitProviderz /resources/)rauthorization_serversrrrr) ValueErrorloggerwarningstrrstripenvironment_url resource_idr rdebugr super__init__r)selfr#r$rrrrrrrrresolved_base_url parsed_scopesbase_url_value __class__s w/Users/ahmed/devFolder/Ultron/claude-voice/.venv/lib/python3.12/site-packages/fastmcp/server/auth/providers/scalekit.pyr'zScalekitProvider.__init__?s>%/ JK K   NN+   NNI  #?3::3?&-<-HL )b  -./ m          ! LLe''(.$$$$   ) 0017++!)) $ 4 4 < N LLK L )d223;t?O?O>PQR#$-'#9  ct|}tjd|jfd}|j t d|dg|S)aGet OAuth routes including Scalekit authorization server metadata forwarding. This returns the standard protected resource routes plus an authorization server metadata endpoint that forwards Scalekit's OAuth metadata to clients. Args: mcp_path: The path where the MCP endpoint is mounted (e.g., "/mcp") This is used to advertise the resource URL in metadata. z>Preparing Scalekit metadata routes: mcp_path=%s resource_id=%scfK jdj}tjd|t j 4d{}|j |d{}|j|j}tjdt|jt|cdddd{S77o7 #1d{7swYyxYw#t$r5}tjd|tdd|dd cYd}~Sd}~wwxYww) zQForward Scalekit OAuth authorization server metadata with FastMCP customizations.z2/.well-known/oauth-authorization-server/resources/z1Fetching Scalekit OAuth metadata: metadata_url=%sNz8Scalekit metadata fetched successfully: metadata_keys=%sz#Failed to fetch Scalekit metadata: server_error)errorerror_descriptioni) status_code)r#r$rr%httpx AsyncClientgetraise_for_statusjsonlistkeysr Exceptionr2)request metadata_urlclientresponsemetadataer(s r-#oauth_authorization_server_metadatazHScalekitProvider.get_routes..oauth_authorization_server_metadatas  "&"6"6!77ijnjzjzi{|  G!,,..&%+ZZ %==H--/'}}HLLRX]]_-(1/..=/...  B1#FG#!//RSTRU-V!$  sD1A C0CC0C'C(AC C0CC0D1C0CC0C-!C$ "C-)C0,D1-C00 D.9*D)#D.$D1)D..D1z'/.well-known/oauth-authorization-serverGET)endpointmethods)r& get_routesrr%r$appendr)r(mcp_pathroutesrCr,s` r-rGzScalekitProvider.get_routess\#H- L      6  9<   r.)r#zAnyHttpUrl | strr$r!rAnyHttpUrl | str | NonerrKr str | Nonerlist[str] | NonerrMrrLrzAnyHttpUrl | NonerzTokenVerifier | None)N)rIrLreturnz list[Route])__name__ __module__ __qualname____doc__r'rG __classcell__)r,s@r-r r s%X-1+/ $,0-1$(48/3[ *[  [ * [ ) [ [ *[ +[ "[ !2[ -[ ~ $88 88r.r )rR __future__rr5pydanticrstarlette.responsesrstarlette.routingrfastmcp.server.authrr!fastmcp.server.auth.providers.jwtr fastmcp.utilities.authr fastmcp.utilities.loggingr rOrr r.r-r]s@# ,#A9/0 H })}r.