
    {h                        d dl mZmZ d dlmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dl m!Z!m"Z" d dl#m$Z$ d dl%m&Z& defdZ'dZ(dZ)dZ*dZ+dee
geee   z  f   de,e-   defdZ.	 	 	 d+deeeef   ded edz  d!e!dz  d"e"dz  de,e   fd#Z/ded edz  d!e!d"e"de&f
d$Z0	 	 	 d+d%ed&e,e   d'e,e-   dz  d(e-dz  d)edz  de,e   fd*Z1y),    )	AwaitableCallable)Any)
AnyHttpUrl)CORSMiddleware)Request)Response)Routerequest_response)ASGIApp)AuthorizationHandler)MetadataHandler)RegistrationHandler)RevocationHandler)TokenHandler)ClientAuthenticator) OAuthAuthorizationServerProvider)ClientRegistrationOptionsRevocationOptions)MCP_PROTOCOL_VERSION_HEADER)OAuthMetadataurlc                     | j                   dk7  rA| j                  dk7  r2| j                  &| j                  j                  d      st        d      | j                  rt        d      | j
                  rt        d      y)z
    Validate that the issuer URL meets OAuth 2.0 requirements.

    Args:
        url: The issuer URL to validate

    Raises:
        ValueError: If the issuer URL is invalid
    https	localhostNz	127.0.0.1zIssuer URL must be HTTPSz#Issuer URL must not have a fragmentz'Issuer URL must not have a query string)schemehost
startswith
ValueErrorfragmentquery)r   s    W/var/www/html/hubwallet-dev/venv/lib/python3.12/site-packages/mcp/server/auth/routes.pyvalidate_issuer_urlr#      sp     	

gHH#XX!#((*=*=k*J344 ||>??
yyBCC     z
/authorizez/tokenz	/registerz/revokehandlerallow_methodsreturnc                 @    t        t        |       d|t        g      }|S )N*)appallow_originsr&   allow_headers)r   r   r   )r%   r&   cors_apps      r"   cors_middlewarer.   7   s)     W%#23	H Or$   Nprovider
issuer_urlservice_documentation_urlclient_registration_optionsrevocation_optionsc                    t        |       |xs
 t               }|xs
 t               }t        ||||      }t	        |       }t        dt        t        |      j                  ddg      ddg      t        t        t        |       j                  ddg      t        t        t        t        | |      j                  ddg      ddg      g}|j                  rFt        | |      }|j                  t        t         t        |j                  ddg      ddg             |j                  rEt#        | |      }	|j                  t        t$        t        |	j                  ddg      ddg             |S )Nz'/.well-known/oauth-authorization-serverGETOPTIONSendpointmethodsPOST)options)r#   r   r   build_metadatar   r
   r.   r   handleAUTHORIZATION_PATHr   
TOKEN_PATHr   enabledr   appendREGISTRATION_PATHr   REVOCATION_PATH)
r/   r0   r1   r2   r3   metadataclient_authenticatorroutesregistration_handlerrevocation_handlers
             r"   create_auth_routesrI   D   s    
#"="\AZA\+B/@/B!#	H /x8 	5$)00	" I&	
 	 *(3::FO	
 	$X';<CC# Y'	
!F4 #**2/ 
 	!((//Y'  +		
 !!.x9MN(&--Y'  +		
 Mr$   c                    t        t        |       j                  d      t        z         }t        t        |       j                  d      t        z         }t        | |||j                  dgd ddgdgd |d d d d dg      }|j                  r/t        t        |       j                  d      t        z         |_	        |j                  r7t        t        |       j                  d      t        z         |_        dg|_        |S )N/codeauthorization_coderefresh_tokenclient_secret_postS256)issuerauthorization_endpointtoken_endpointscopes_supportedresponse_types_supportedresponse_modes_supportedgrant_types_supported%token_endpoint_auth_methods_supported0token_endpoint_auth_signing_alg_values_supportedservice_documentationui_locales_supportedop_policy_uri
op_tos_uriintrospection_endpoint code_challenge_methods_supported)r   strrstripr>   r?   r   valid_scopesr@   rB   registration_endpointrC   revocation_endpoint*revocation_endpoint_auth_methods_supported)r0   r1   r2   r3   authorization_url	token_urlrD   s          r"   r<   r<      s     #3z?#9#9##>AS#ST3z?11#6CDI 0 4AA"(!%3_E/C.D9=7!#*0H& #**)3C
O4J4J34ORc4c)d& !!'1#j/2H2H2MP_2_'`$?S>T;Or$   resource_urlauthorization_serversrT   resource_nameresource_documentationc                     ddl m} ddlm}  || ||||      } ||      }t	        dt        |j                  ddg      ddg      gS )	a}  
    Create routes for OAuth 2.0 Protected Resource Metadata (RFC 9728).

    Args:
        resource_url: The URL of this resource server
        authorization_servers: List of authorization servers that can issue tokens
        scopes_supported: Optional list of scopes supported by this resource

    Returns:
        List of Starlette routes for protected resource metadata
    r   ) ProtectedResourceMetadataHandler)ProtectedResourceMetadata)resourceri   rT   rj   rk   z%/.well-known/oauth-protected-resourcer5   r6   r7   )!mcp.server.auth.handlers.metadatarm   mcp.shared.authrn   r
   r.   r=   )	rh   ri   rT   rj   rk   rm   rn   rD   r%   s	            r"    create_protected_resource_routesrr      sb    $ S9(3)#5H /x8G 	3$W^^eY5GHI&	
 r$   )NNN)2collections.abcr   r   typingr   pydanticr   starlette.middleware.corsr   starlette.requestsr   starlette.responsesr	   starlette.routingr
   r   starlette.typesr   "mcp.server.auth.handlers.authorizer   rp   r   !mcp.server.auth.handlers.registerr   mcp.server.auth.handlers.revoker   mcp.server.auth.handlers.tokenr   &mcp.server.auth.middleware.client_authr   mcp.server.auth.providerr   mcp.server.auth.settingsr   r   mcp.server.streamable_httpr   rq   r   r#   r>   r?   rB   rC   listr`   r.   rI   r<   rr    r$   r"   <module>r      s   /   4 & ( 5 # C = A = 7 F E Q B )DZ D4 " 
 
wiIh,?!??@
9
 
  48DH37N.sC}=NN  *D0N ";T!A	N
 *D0N 
%[Nb%%)D0% ";% *	%
 %V *. $04&&
+& 3i$&& :	&
 '-& 
%[&r$   