o
    c۷i'                  	   @   s,  d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl	m
Z
mZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d d	lmZmZmZ d d
lmZ G dd deZG dd deZ G dd deeee B eddf  Z!G dd deZ"G dd dee Z#eG dd dZ$dS )    N)	dataclass)	AnnotatedAnyLiteral)
AnyHttpUrlAnyUrl	BaseModelField	RootModelValidationError)Request)stringify_pydantic_error)PydanticJSONResponse)AuthenticationErrorClientAuthenticator) OAuthAuthorizationServerProvider
TokenErrorTokenErrorCode)
OAuthTokenc                   @   s   e Zd ZU ed ed< edddZeed< edddZe	dB ed	< eed
< dZ
edB ed< edddZeed< edddZedB ed< dS )AuthorizationCodeRequestauthorization_code
grant_type.zThe authorization codedescriptioncodeNz7Must be the same as redirect URI provided in /authorizeredirect_uri	client_idclient_secretzPKCE code verifiercode_verifier Resource indicator for the tokenresource)__name__
__module____qualname__r   __annotations__r	   r   strr   r   r   r   r     r&   r&   T/home/ubuntu/vllm_env/lib/python3.10/site-packages/mcp/server/auth/handlers/token.pyr      s   
 r   c                   @   sv   e Zd ZU ed ed< edddZeed< edddZedB ed< eed	< dZ	edB ed
< edddZ
edB ed< dS )RefreshTokenRequestrefresh_tokenr   .zThe refresh tokenr   NzOptional scope parameterscoper   r   r   r    )r!   r"   r#   r   r$   r	   r)   r%   r*   r   r    r&   r&   r&   r'   r(      s   
 r(   c                   @   s(   e Zd ZU eeeB eddf ed< dS )TokenRequestr   discriminatorrootN)r!   r"   r#   r   r   r(   r	   r$   r&   r&   r&   r'   r+   +   s   
 r+   r   r,   c                   @   s:   e Zd ZU dZeed< dZedB ed< dZe	dB ed< dS )TokenErrorResponsezG
    See https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
    errorNerror_description	error_uri)
r!   r"   r#   __doc__r   r$   r1   r%   r2   r   r&   r&   r&   r'   r/   9   s
   
 r/   c                   @   s   e Zd ZU eed< dS )TokenSuccessResponser.   N)r!   r"   r#   r   r$   r&   r&   r&   r'   r4   C   s   
 r4   c                   @   sH   e Zd ZU eeeef ed< eed< deeB fddZ	de
fddZd	S )
TokenHandlerproviderclient_authenticatorobjc                 C   s&   d}t |tr	d}t||ddddS )N   i  no-storeno-cachezCache-ControlPragmacontentstatus_codeheaders)
isinstancer/   r   )selfr8   r@   r&   r&   r'   responseO   s   
zTokenHandler.responserequestc              
      st  z| j |I d H }W n! ty- } zttd|jddddddW  Y d }~S d }~ww z| I d H }tt	|j
}W n ty\ } z| tdt|dW  Y d }~S d }~ww |j|jvrq| td	d
|j ddS | td r!  | j||jI d H }|d u s|j|jkr| tdddS |jt k r| tdddS |jr|j}nd }|jd urt|jnd }	|d urt|nd }
|	|
kr| tdddS t|j  }t |! "d}||j#kr| tdddS z| j$||I d H }W n t%y  } z| t|j&|j'dW  Y d }~S d }~ww  t(d r | j)||j*I d H }|d u s?|j|jkrH| tdddS |jr]|jt k r]| tdddS |j+rg|j+,dn|j-}|D ]}||j-vr| tdd| dd  S qlz| j.|||I d H }W n t%y } z| t|j&|j'dW  Y d }~S d }~ww  | t/|dS )Nunauthorized_client)r0   r1   i  r:   r;   r<   r>   invalid_requestunsupported_grant_typez2Unsupported grant type (supported grant types are )r&   invalid_grantz!authorization code does not existzauthorization code has expiredz?redirect_uri did not match the one used when creating auth code=zincorrect code_verifierzrefresh token does not existzrefresh token has expired invalid_scopezcannot request scope `z` not provided by refresh token)r.   )0r7   authenticate_requestr   r   r/   messageformr+   model_validatedictr.   r   rD   r   r   grant_typesr   r6   load_authorization_coder   r   
expires_attime redirect_uri_provided_explicitlyr   r%   hashlibsha256r   encodedigestbase64urlsafe_b64encodedecoderstripcode_challengeexchange_authorization_coder   r0   r1   r(   load_refresh_tokenr)   r*   splitscopesexchange_refresh_tokenr4   )rC   rE   client_infoe	form_datatoken_requestvalidation_error	auth_codeauthorize_request_redirect_uritoken_redirect_strauth_redirect_strrY   hashed_code_verifiertokensr)   rd   r*   r&   r&   r'   handle]   s   			
B
+zTokenHandler.handleN)r!   r"   r#   r   r   r$   r   r4   r/   rD   r   rq   r&   r&   r&   r'   r5   J   s
   
 r5   )%r\   rX   rV   dataclassesr   typingr   r   r   pydanticr   r   r   r	   r
   r   starlette.requestsr   mcp.server.auth.errorsr   mcp.server.auth.json_responser   &mcp.server.auth.middleware.client_authr   r   mcp.server.auth.providerr   r   r   mcp.shared.authr   r   r(   r+   r/   r4   r5   r&   r&   r&   r'   <module>   s6     

