§
    öŽ’j4  ã                   óô   — d dl Z d dlZd dlmZmZ d dlmZ d dlmZm	Z	m
Z
 d dlmZ d dlmZmZmZ d dlmZmZ  G d„ d	e
¦  «        Z G d
„ de¦  «        Zdedefd„Z G d„ de	¦  «        Z G d„ d¦  «        ZdS )é    N)ÚAnyÚ	TypedDict)Ú
AnyHttpUrl)ÚAuthCredentialsÚAuthenticationBackendÚ
SimpleUser)ÚHTTPConnection)ÚReceiveÚScopeÚSend)ÚAccessTokenÚTokenVerifierc                   ó(   ‡ — e Zd ZdZdefˆ fd„Zˆ xZS )ÚAuthenticatedUserzUser with authentication info.Ú	auth_infoc                 óz   •— t          ¦   «                              |j        ¦  «         || _        |j        | _        d S ©N)ÚsuperÚ__init__Ú	client_idÚaccess_tokenÚscopes)Úselfr   Ú	__class__s     €úTC:\Projects\DSCons\.venv\Lib\site-packages\mcp\server\auth\middleware\bearer_auth.pyr   zAuthenticatedUser.__init__   s4   ø€ Ý‰Œ×Ò˜Ô,Ñ-Ô-Ð-Ø%ˆÔØÔ&ˆŒˆˆó    )Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   r   Ú__classcell__)r   s   @r   r   r      sJ   ø€ € € € € Ø(Ð(ð' +ð 'ð 'ð 'ð 'ð 'ð 'ð 'ð 'ð 'ð 'r   r   c                   ó:   — e Zd ZU eed<   edz  ed<   edz  ed<   dS )ÚAuthorizationContextr   NÚissuerÚsubject)r   r   r   ÚstrÚ__annotations__© r   r   r#   r#      s;   € € € € € € Ø€N€N�NØ�$‰JÐÐÑØ�4‰ZÐÐÑÐÐr   r#   ÚuserÚreturnc                 ó¢   — | j         }|j        pi                      d¦  «        }t          |j        |�t          |¦  «        nd|j        ¬¦  «        S )a–  Identify the principal `user` represents, for transports to compare
    against the principal that created a session. Components the token
    verifier does not supply are `None`, so the comparison degrades to the
    remaining components.

    See `examples/servers/simple-auth/mcp_simple_auth/token_verifier.py` for
    a verifier that populates `subject` and `claims` from an introspection
    response.ÚissN)r   r$   r%   )r   ÚclaimsÚgetr#   r   r&   r%   )r)   Útokenr$   s      r   Úauthorization_contextr0      sY   € ð Ô€EØŒlÐ ˜b×%Ò% eÑ,Ô,€FÝØ”/Ø$Ð0�s�6‰{Œ{ˆ{°dØ”ðñ ô ð r   c                   ó*   — e Zd ZdZdefd„Zdefd„ZdS )ÚBearerAuthBackendzT
    Authentication backend that validates Bearer tokens using a TokenVerifier.
    Útoken_verifierc                 ó   — || _         d S r   )r3   )r   r3   s     r   r   zBearerAuthBackend.__init__3   s   € Ø,ˆÔÐÐr   Úconnc              ƒ   ó¦  ‡K  — t          ˆfd„‰j        D ¦   «         d ¦  «        }|r'|                     ¦   «                              d¦  «        sd S |dd …         }| j                             |¦  «        ƒ d {V —†}|sd S |j        r+|j        t          t          j        ¦   «         ¦  «        k     rd S t          |j
        ¦  «        t          |¦  «        fS )Nc              3   ó|   •K  — | ]6}|                      ¦   «         d k    ¯‰j                             |¦  «        V — Œ7dS )ÚauthorizationN)ÚlowerÚheadersr.   )Ú.0Úkeyr5   s     €r   ú	<genexpr>z1BearerAuthBackend.authenticate.<locals>.<genexpr>8   sE   øè è € Ð]Ð] s¸c¿iºi¹k¼kÈ_Ò>\Ð>\ˆTŒ\×Ò˜cÑ"Ô"Ð>\Ð>\Ð>\Ð>\Ð]Ð]r   zbearer é   )Únextr:   r9   Ú
startswithr3   Úverify_tokenÚ
expires_atÚintÚtimer   r   r   )r   r5   Úauth_headerr/   r   s    `   r   ÚauthenticatezBearerAuthBackend.authenticate6   sð   øè è € ÝØ]Ð]Ð]Ð]¨d¬lÐ]Ñ]Ô]Øñ
ô 
ˆð ð 	 +×"3Ò"3Ñ"5Ô"5×"@Ò"@ÀÑ"KÔ"Kð 	Ø�4à˜A˜B˜B”ˆð Ô-×:Ò:¸5ÑAÔAÐAÐAÐAÐAÐAÐAˆ	àð 	Ø�4àÔð 	 IÔ$8½3½t¼y¹{¼{Ñ;KÔ;KÒ$KÐ$KØ�4å˜yÔ/Ñ0Ô0Õ2CÀIÑ2NÔ2NÐNÐNr   N)r   r   r   r    r   r   r	   rF   r(   r   r   r2   r2   .   s[   € € € € € ðð ð- }ð -ð -ð -ð -ðO ~ð Oð Oð Oð Oð Oð Or   r2   c            
       óp   — e Zd ZdZ	 ddedee         dedz  fd„Zde	de
d	ed
dfd„Zd	edededed
df
d„ZdS )ÚRequireAuthMiddlewarezÉ
    Middleware that requires a valid Bearer token in the Authorization header.

    This will validate the token with the auth provider and store the resulting
    auth info in the request state.
    NÚappÚrequired_scopesÚresource_metadata_urlc                 ó0   — || _         || _        || _        dS )a
  
        Initialize the middleware.

        Args:
            app: ASGI application
            required_scopes: List of scopes that the token must have
            resource_metadata_url: Optional protected resource metadata URL for WWW-Authenticate header
        N)rI   rJ   rK   )r   rI   rJ   rK   s       r   r   zRequireAuthMiddleware.__init__T   s!   € ð ˆŒØ.ˆÔØ%:ˆÔ"Ð"Ð"r   ÚscopeÚreceiveÚsendr*   c              ƒ   óx  K  — |                      d¦  «        }t          |t          ¦  «        s!|                      |ddd¬¦  «        ƒ d {V —† d S |                      d¦  «        }| j        D ]2}|�	||j        vr%|                      |ddd	|› �¬¦  «        ƒ d {V —†  d S Œ3|                      |||¦  «        ƒ d {V —† d S )
Nr)   i‘  Úinvalid_tokenzAuthentication required)Ústatus_codeÚerrorÚdescriptionÚauthi“  Úinsufficient_scopezRequired scope: )r.   Ú
isinstancer   Ú_send_auth_errorrJ   r   rI   )r   rM   rN   rO   Ú	auth_userÚauth_credentialsÚrequired_scopes          r   Ú__call__zRequireAuthMiddleware.__call__f   s<  è è € Ø—I’I˜fÑ%Ô%ˆ	Ý˜)Õ%6Ñ7Ô7ð 	Ø×'Ò'Ø #¨_ÐJcð (ñ ô ð ð ð ð ð ð ð ð ˆFà Ÿ9š9 VÑ,Ô,Ðà"Ô2ð 	ð 	ˆNàÐ'¨>ÐAQÔAXÐ+XÐ+XØ×+Ò+Ø cÐ1EÐSvÐftÐSvÐSvð ,ñ ô ð ð ð ð ð ð ð ð ��ð	 ,Yð �hŠh�u˜g tÑ,Ô,Ð,Ð,Ð,Ð,Ð,Ð,Ð,Ð,Ð,r   rR   rS   rT   c              ƒ   óÎ  K  — d|› d�d|› d�g}| j         r|                     d| j         › d�¦  «         dd                     |¦  «        › �}||dœ}t          j        |¦  «                             ¦   «         } |d|d	d
t          t          |¦  «        ¦  «                             ¦   «         fd|                     ¦   «         fgdœ¦  «        ƒ d{V —†  |d|dœ¦  «        ƒ d{V —† dS )zCSend an authentication error response with WWW-Authenticate header.zerror="ú"zerror_description="zresource_metadata="zBearer z, )rS   Úerror_descriptionzhttp.response.start)s   content-types   application/jsons   content-lengths   www-authenticate)ÚtypeÚstatusr:   Nzhttp.response.body)r`   Úbody)rK   ÚappendÚjoinÚjsonÚdumpsÚencoder&   Úlen)	r   rO   rR   rS   rT   Úwww_auth_partsÚwww_authenticaterb   Ú
body_bytess	            r   rX   z&RequireAuthMiddleware._send_auth_errorz   sk  è è € ð - EÐ,Ð,Ð,Ð.RÀKÐ.RÐ.RÐ.RÐSˆØÔ%ð 	WØ×!Ò!Ð"U¸Ô8RÐ"UÐ"UÐ"UÑVÔVÐVà@ T§Y¢Y¨~Ñ%>Ô%>Ð@Ð@Ðð °[ÐAÐAˆÝ”Z Ñ%Ô%×,Ò,Ñ.Ô.ˆ
àˆdà-Ø%à:Ø&­­C°
©O¬OÑ(<Ô(<×(CÒ(CÑ(EÔ(EÐFØ(Ð*:×*AÒ*AÑ*CÔ*CÐDððð ñ

ô 

ð 
	
ð 
	
ð 
	
ð 
	
ð 
	
ð 
	
ð 
	
ð ˆdà,Ø"ðð ñ
ô 
ð 	
ð 	
ð 	
ð 	
ð 	
ð 	
ð 	
ð 	
ð 	
r   r   )r   r   r   r    r   Úlistr&   r   r   r   r
   r   r\   rC   rX   r(   r   r   rH   rH   L   sÊ   € € € € € ðð ð 48ð	;ð ;àð;ð ˜cœð;ð  *¨DÑ0ð	;ð ;ð ;ð ;ð$- Eð -°Gð -À4ð -ÈDð -ð -ð -ð -ð(
¨4ð 
¸cð 
È#ð 
Ð\_ð 
Ðdhð 
ð 
ð 
ð 
ð 
ð 
r   rH   )re   rD   Útypingr   r   Úpydanticr   Ústarlette.authenticationr   r   r   Ústarlette.requestsr	   Ústarlette.typesr
   r   r   Úmcp.server.auth.providerr   r   r   r#   r0   r2   rH   r(   r   r   ú<module>rs      sŽ  ðØ €€€Ø €€€Ø !Ð !Ð !Ð !Ð !Ð !Ð !Ð !à Ð Ð Ð Ð Ð Ø WÐ WÐ WÐ WÐ WÐ WÐ WÐ WÐ WÐ WØ -Ð -Ð -Ð -Ð -Ð -Ø 0Ð 0Ð 0Ð 0Ð 0Ð 0Ð 0Ð 0Ð 0Ð 0à ?Ð ?Ð ?Ð ?Ð ?Ð ?Ð ?Ð ?ð'ð 'ð 'ð 'ð '˜
ñ 'ô 'ð 'ðð ð ð ð ˜9ñ ô ð ðÐ 1ð Ð6Jð ð ð ð ð$Oð Oð Oð Oð OÐ-ñ Oô Oð Oð<L
ð L
ð L
ð L
ð L
ñ L
ô L
ð L
ð L
ð L
r   