
    {h'              
       f   d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl	m
Z
mZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d d	lmZmZmZ d d
lmZ  G d de      Z G d de      Z  G d deeee z   ed      f            Z! G d de      Z" G d dee         Z#e G d d             Z$y)    N)	dataclass)	AnnotatedAnyLiteral)
AnyHttpUrlAnyUrl	BaseModelField	RootModelValidationError)Request)stringify_pydantic_error)PydanticJSONResponse)AuthenticationErrorClientAuthenticator) OAuthAuthorizationServerProvider
TokenErrorTokenErrorCode)
OAuthTokenc                       e Zd ZU ed   ed<    edd      Zeed<    edd      Ze	dz  ed	<   eed
<   dZ
edz  ed<    edd      Zeed<    edd      Zedz  ed<   y)AuthorizationCodeRequestauthorization_code
grant_type.zThe authorization codedescriptioncodeNz7Must be the same as redirect URI provided in /authorizeredirect_uri	client_idclient_secretzPKCE code verifiercode_verifier Resource indicator for the tokenresource)__name__
__module____qualname__r   __annotations__r
   r   strr   r   r   r    r"        _/var/www/html/hubwallet-dev/venv/lib/python3.12/site-packages/mcp/server/auth/handlers/token.pyr   r      sq    ,--c'?@D#@"':s"tL&4-tN $M3:$s0DEM3E 3UVHcDjVr)   r   c                       e Zd ZU ed   ed<    edd      Zeed<    edd      Zedz  ed<   eed	<   dZ	edz  ed
<    edd      Z
edz  ed<   y)RefreshTokenRequestrefresh_tokenr   .zThe refresh tokenr   NzOptional scope parameterscoper   r   r!   r"   )r#   r$   r%   r   r&   r
   r-   r'   r.   r   r"   r(   r)   r*   r,   r,      s^    ((s0CDM3Dd0JKE3:KN $M3:$ 3UVHcDjVr)   r,   c                   6    e Zd ZU eeez   ed      f   ed<   y)TokenRequestr   discriminatorrootN)r#   r$   r%   r   r   r,   r
   r&   r(   r)   r*   r0   r0   +   s'      #66L)	+ r)   r0   r   r1   c                   D    e Zd ZU dZeed<   dZedz  ed<   dZe	dz  ed<   y)TokenErrorResponsezG
    See https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
    errorNerror_description	error_uri)
r#   r$   r%   __doc__r   r&   r7   r'   r8   r   r(   r)   r*   r5   r5   9   s-     $(sTz(#'IzD 'r)   r5   c                       e Zd ZU eed<   y)TokenSuccessResponser3   N)r#   r$   r%   r   r&   r(   r)   r*   r;   r;   C   s
     r)   r;   c                   L    e Zd ZU eeeef   ed<   eed<   deez  fdZ	de
fdZy)TokenHandlerproviderclient_authenticatorobjc                 L    d}t        |t              rd}t        ||ddd      S )N   i  zno-storezno-cache)zCache-ControlPragma)contentstatus_codeheaders)
isinstancer5   r   )selfr@   rE   s      r*   responsezTokenHandler.responseO   s5    c-.K##!+$
 	
r)   requestc           	      8
  K   	 |j                          d {   }t        j                  t        |            j                  }	 | j                  j                  |j                  |j                         d {   }|j                  |j                   vr*| j                  t        dd|j                    d            S |xt"        d x\    | j$                  j'                  ||j(                         d {   }||j                  |j                  k7  r| j                  t        d	d
            S |j*                  t-        j,                         k  r| j                  t        d	d            S |j.                  r|j0                  }nd }|j0                  t3        |j0                        nd }	|t3        |      nd }
|	|
k7  r| j                  t        dd            S t5        j6                  |j8                  j;                               j=                         }t?        j@                  |      jC                         jE                  d      }||jF                  k7  r| j                  t        d	d            S 	 | j$                  jI                  ||       d {   }nM tP        d xA\   | j$                  jS                  ||jT                         d {   }||j                  |j                  k7  r| j                  t        d	d            S |j*                  r=|j*                  t-        j,                         k  r| j                  t        d	d            S |jV                  r|jV                  jY                  d      n|jZ                  }|D ]2  }||jZ                  vs| j                  t        dd| d            c S  	 | j$                  j]                  |||       d {   }n | j                  t_                    S 7 # t
        $ r/}| j                  t        dt        |                  cY d }~S d }~ww xY w7 # t        $ r0}| j                  t        d|j                              cY d }~S d }~ww xY w7 7 # tJ        $ r:}| j                  t        |jL                  |jN                              cY d }~S d }~ww xY w7 7 # tJ        $ r:}| j                  t        |jL                  |jN                              cY d }~S d }~ww xY ww)Ninvalid_request)r6   r7   )r   r   unauthorized_clientunsupported_grant_typez2Unsupported grant type (supported grant types are )r(   invalid_grantz!authorization code does not existzauthorization code has expiredz?redirect_uri did not match the one used when creating auth code=zincorrect code_verifierzrefresh token does not existzrefresh token has expired invalid_scopezcannot request scope `z` not provided by refresh token)r3   )0formr0   model_validatedictr3   r   rI   r5   r   r?   authenticater   r   r   messager   grant_typesr   r>   load_authorization_coder   
expires_attime redirect_uri_provided_explicitlyr   r'   hashlibsha256r    encodedigestbase64urlsafe_b64encodedecoderstripcode_challengeexchange_authorization_coder   r6   r7   r,   load_refresh_tokenr-   r.   splitscopesexchange_refresh_tokenr;   )rH   rJ   	form_datatoken_requestvalidation_errorclient_infoe	auth_codeauthorize_request_redirect_uritoken_redirect_strauth_redirect_strr_   hashed_code_verifiertokensr-   rj   r.   s                    r*   handlezTokenHandler.handle]   s    		%lln,I(77YHMMM	 $ 9 9 F F'11+99 !G ! K ##;+B+BB=="2)[\g\s\s[ttu'v  +)+"&--"G"GUbUgUg"hh	$	(;(;}?V?V(V==*"1.Q  ''$))+5==*"1.N  ==5>5K5K2592 IVHbHbHnS)C)C%Dtx";Y;eC67ko " &)::==*"3/p  !(C(C(J(J(LMTTV'-'?'?'G'N'N'P'W'WX['\$'9+C+CC==*"1.G 	#'==#L#L[Zc#ddFs ,D %&&*mm&F&F{TaToTo&p p (M,C,C}G^G^,^==*"1.L  !++0H0H499;0V==*"1.I  <I;N;N,,2237TaThTh# EM$8$88#}}.&55KE7Rq3r  	#'==#G#GUbdj#kkFE 'V }}1v>??_ - 	=="+&>?O&P 	 # 	=="/&'ii 	( ip e! ==*"#''./.A.A  !qB l! ==*"#''./.A.A s%  TP	 P,P	 4Q 9Q:Q >A:T8R9E>T8R	 RR	 8TSC
T #T S $S%S )TP	 		Q$P<6Q7T<QTQ 	R %Q;5R 6T;R  TR	 		S/SSTSTS 	T/TTTTTN)r#   r$   r%   r   r   r&   r   r;   r5   rI   r   rw   r(   r)   r*   r=   r=   J   s<    .sC}==--
03EE 
Q@G Q@r)   r=   )%rb   r^   r\   dataclassesr   typingr   r   r   pydanticr   r   r	   r
   r   r   starlette.requestsr   mcp.server.auth.errorsr   mcp.server.auth.json_responser   &mcp.server.auth.middleware.client_authr   r   mcp.server.auth.providerr   r   r   mcp.shared.authr   r   r,   r0   r5   r;   r=   r(   r)   r*   <module>r      s       ! * * U U & ; > [ a a &Wy W	W) 	W$'::-/	
( (9Z0  c@ c@ c@r)   