kKj<dZddlmZddlmZddlZddlmZddlm Z ddl m Z ddl m Z mZdd lmZdd lmZdd lmZeeZGd d e Zy)aSupabase authentication provider for FastMCP. This module provides SupabaseProvider - a complete authentication solution that integrates with Supabase Auth's JWT verification, supporting Dynamic Client Registration (DCR) for seamless MCP client authentication. ) annotations)LiteralN) AnyHttpUrl) JSONResponse)Route)RemoteAuthProvider TokenVerifier) JWTVerifier) parse_scopes) get_loggercneZdZdZdddddddd dfdZ d d fd ZxZS) SupabaseProvideraSupabase metadata provider for DCR (Dynamic Client Registration). This provider implements Supabase Auth integration using metadata forwarding. This approach allows Supabase to handle the OAuth flow directly while FastMCP acts as a resource server, verifying JWTs issued by Supabase Auth. IMPORTANT SETUP REQUIREMENTS: 1. Supabase Project Setup: - Create a Supabase project at https://supabase.com - Note your project URL (e.g., "https://abc123.supabase.co") - Configure your JWT algorithm in Supabase Auth settings (RS256 or ES256) - Asymmetric keys (RS256/ES256) are recommended for production 2. JWT Verification: - FastMCP verifies JWTs using the JWKS endpoint at {project_url}{auth_route}/.well-known/jwks.json - JWTs are issued by {project_url}{auth_route} - Default auth_route is "/auth/v1" (can be customized for self-hosted setups) - Tokens are cached for up to 10 minutes by Supabase's edge servers - Algorithm must match your Supabase Auth configuration 3. Authorization: - Supabase uses Row Level Security (RLS) policies for database authorization - OAuth-level scopes are an upcoming feature in Supabase Auth - Both approaches will be supported once scope handling is available For detailed setup instructions, see: https://supabase.com/docs/guides/auth/jwts Example: ```python from fastmcp.server.auth.providers.supabase import SupabaseProvider # Create Supabase metadata provider (JWT verifier created automatically) supabase_auth = SupabaseProvider( project_url="https://abc123.supabase.co", base_url="https://your-fastmcp-server.com", algorithm="ES256", # Match your Supabase Auth configuration ) # Use with FastMCP mcp = FastMCP("My App", auth=supabase_auth) ``` z/auth/v1ES256N) auth_route algorithmrequired_scopesscopes_supported resource_nameresource_documentationtoken_verifierc t|jd|_tt|jd|_|j d|_| t|nd} | Xtjdt|jd|j d|jd|j |d| } t |1| t|jd|j g|j|||y)aInitialize Supabase metadata provider. Args: project_url: Your Supabase project URL (e.g., "https://abc123.supabase.co") base_url: Public URL of this FastMCP server auth_route: Supabase Auth route. Defaults to "/auth/v1". Can be customized for self-hosted Supabase Auth setups using custom routes. algorithm: JWT signing algorithm (RS256 or ES256). Must match your Supabase Auth configuration. Defaults to ES256. required_scopes: Optional list of scopes to require for all requests. Note: Supabase currently uses RLS policies for authorization. OAuth-level scopes are an upcoming feature. scopes_supported: Optional list of scopes to advertise in OAuth metadata. If None, uses required_scopes. Use this when the scopes clients should request differ from the scopes enforced on tokens. resource_name: Optional name for the protected resource metadata. resource_documentation: Optional documentation URL for the protected resource. token_verifier: Optional token verifier. If None, creates JWT verifier for Supabase /NzSupabaseProvider cannot validate token audience for the specific resource because Supabase Auth does not support RFC 8707 resource indicators. This may leave the server vulnerable to cross-server token replay.z/.well-known/jwks.json authenticated)jwks_uriissuerraudiencer)rauthorization_serversbase_urlrrr) strrstrip project_urlrrstriprr loggerwarningr super__init__) selfr!rrrrrrrr parsed_scopes __class__s w/Users/ahmed/devFolder/Ultron/claude-voice/.venv/lib/python3.12/site-packages/fastmcp/server/auth/providers/supabase.pyr&zSupabaseProvider.__init__Gs@{+2237"3x=#7#7#<= $**3/.=-HL )d   ! NNU  ) ,,-Qt.??UV**+1T__,=>#( - N )#-1A1A0B!DOOCT.U#V"W]]-'#9  cnt|}fd}|jtd|dg|S)aGet OAuth routes including Supabase authorization server metadata forwarding. This returns the standard protected resource routes plus an authorization server metadata endpoint that forwards Supabase's OAuth metadata to clients. Args: mcp_path: The path where the MCP endpoint is mounted (e.g., "/mcp") This is used to advertise the resource URL in metadata. cK tj4d{}|jjdjdd{}|j |j }t|cdddd{S7s7B7 #1d{7swYyxYw#t$r}tdd|ddcYd}~Sd}~wwxYww) zQForward Supabase OAuth authorization server metadata with FastMCP customizations.Nr'/.well-known/oauth-authorization-server server_errorz#Failed to fetch Supabase metadata: )errorerror_descriptioni) status_code) httpx AsyncClientgetr!rraise_for_statusjsonr Exception)requestclientresponsemetadataer's r*#oauth_authorization_server_metadatazHSupabaseProvider.get_routes..oauth_authorization_server_metadatas  ,,..&%+ZZ++,Adoo->>ef& H--/'}}H'1 /.. /... #!//RSTRU-V!$  sCB,BB,/BB.B? B, B B,CB,BB,B)B B)%B,(C)B,, C5C CC CCr.GET)endpointmethods)r% get_routesappendr)r'mcp_pathroutesr>r)s` r*rBzSupabaseProvider.get_routessA#H- (  9<   r+)r!AnyHttpUrl | strrrFrrrzLiteral['RS256', 'ES256']rlist[str] | NonerrGr str | NonerzAnyHttpUrl | NonerzTokenVerifier | None)N)rDrHreturnz list[Route])__name__ __module__ __qualname____doc__r&rB __classcell__)r)s@r*rrs+d%/6,0-1$(48/3@ &@ # @  @ - @ *@ +@ "@ !2@ -@ H $,, ,,r+r)rM __future__rtypingrr3pydanticrstarlette.responsesrstarlette.routingrfastmcp.server.authrr !fastmcp.server.auth.providers.jwtr fastmcp.utilities.authr fastmcp.utilities.loggingr rJr#rr+r*rYsC# ,#A9/0 H \)\r+