Gj%/ fSSKrSSKrSSKJrJr SSKJrJr SSKJ r J r SSK J r J r SSKJr SSKJrJrJrJrJr SSKJr \R0"\5rS \S \S \S-4S jrS \S \S-4S jrS \S \S-4SjrS\S-S\S \\4Sjr S(S\S-S\S-S\S-S \S-4Sjjr!S\S-S\S \\4Sjr"S \S \S-4Sjr#S \S \$\%\S-44Sjr&S\S \4Sjr'S\S-S\S\S \4Sjr(S \S \4S jr)S\S-S \%4S!jr*S"\S-S#\S-S \%4S$jr+S(S#\S%\\ S-S \4S&jjr,S \S \4S'jr-g))N)urljoinurlparse)RequestResponse)AnyUrlValidationError)OAuthRegistrationErrorOAuthTokenError)MCP_PROTOCOL_VERSION)OAuthClientInformationFullOAuthClientMetadata OAuthMetadata OAuthTokenProtectedResourceMetadata)LATEST_PROTOCOL_VERSIONresponse field_namereturncURRS5nU(dgUS3n[R"X25nU(a)UR S5=(d UR S5$g)z{ Extract field from WWW-Authenticate header. Returns: Field value if found in WWW-Authenticate header, None otherwise zWWW-AuthenticateNz=(?:"([^"]+)"|([^\s,]+)))headersgetresearchgroup)rrwww_auth_headerpatternmatchs W/Users/admin/workspace/tools/venv/lib/python3.13/site-packages/mcp/client/auth/utils.pyextract_field_from_www_authr!s_&&**+=>O 56G IIg /E {{1~/Q/ c[US5$)z Extract scope parameter from WWW-Authenticate header as per RFC6750. Returns: Scope string if found in WWW-Authenticate header, None otherwise scope)r!rs r extract_scope_from_www_authr&,s 'x 99r"cJU(aURS:wag[US5$)z Extract protected resource metadata URL from WWW-Authenticate header as per RFC9728. Returns: Resource metadata URL if found in WWW-Authenticate header, None otherwise iNresource_metadata) status_coder!r%s r 'extract_resource_metadata_from_www_authr*6s% x++s2 &x1D EEr" www_auth_url server_urlcV/nU(aURU5 [U5nURSUR3nUR(a:URS:wa*[ USUR35nURU5 [ US5nURU5 U$)a Build ordered list of URLs to try for protected resource metadata discovery. Per SEP-985, the client MUST: 1. Try resource_metadata from WWW-Authenticate header (if present) 2. Fall back to path-based well-known URI: /.well-known/oauth-protected-resource/{path} 3. Fall back to root-based well-known URI: /.well-known/oauth-protected-resource Args: www_auth_url: optional resource_metadata url extracted from the WWW-Authenticate header server_url: server url Returns: Ordered list of URLs to try for discovery :///z%/.well-known/oauth-protected-resource)appendrschemenetlocpathr)r+r,urlsparsedbase_urlpath_based_urlroot_based_urls r 0build_protected_resource_metadata_discovery_urlsr9Cs D L!j !F--FMM?3H{{v{{c) -RSYS^S^R_+`a N#X'NONKK Kr"www_authenticate_scopeprotected_resource_metadataauthorization_server_metadatacUbU$Ub(URbSRUR5$Ub(URbSRUR5$g)zLSelect scopes as outlined in the 'Scope Selection Strategy' in the MCP spec.N )scopes_supportedjoin)r:r;r<s r get_client_metadata_scopesrAise)%% $ 05P5a5a5mxx3DDEE & 27T7e7e7qxx5FFGGr"auth_server_urlcU(d([U5nURSURS3/$/n[U5nURSUR3nUR(aURS:waSURR S53nUR [ XE55 SURR S53nUR [ XF55 URR S5S3nUR [ XF55 U$UR [ US55 UR [ US55 U$)z Generate ordered list of (url, type) tuples for discovery attempts. Args: auth_server_url: URL for the OAuth Authorization Metadata URL if found, otherwise None server_url: URL for the MCP server, used as a fallback if auth_server_url is None r.z'/.well-known/oauth-authorization-serverr/z!/.well-known/openid-configuration)rr1r2r3rstripr0r)rBr,r5r4r6 oauth_path oidc_paths r 8build_oauth_authorization_server_metadata_discovery_urlsrGs0 *%==/V]]O3Z[\\D o &F--FMM?3H{{v{{c)>v{{?Q?QRU?V>WX  GH128 8J8J38O7PQ  GH01{{))#.//PQ  GH01  KK"KLM KK"EFG Kr"c# URS:Xa1UR5IShvN n[R"U5nU$gN![a gf=f7f)z Handle protected resource metadata discovery response. Per SEP-985, supports fallback when discovery fails at one URL. Returns: True if metadata was successfully discovered, False if we should try next URL N)r)areadrmodel_validate_jsonr)rcontentmetadatas r "handle_protected_resource_responserNs[s" $NN,,G0DDWMHO-  s8AAAAAA AAAAc# URS:Xa3UR5IShvN n[R"U5nSU4$URS:dURS:aggN@![a gf=f7f)NrIT)TNii)FN)r)rJrrKr)rrLasms r handle_auth_metadata_responserQs|s" $NN,,G33GU'V WWr"auth_server_metadataclient_metadata auth_base_urlcU(a'UR(a[UR5nO [US5nURSSSS9n[ SX4SS0S9$) z9Build registration request or skip if already registered.z /registerTjson)by_aliasmode exclude_nonePOSTz Content-Typezapplication/json)rZr)registration_endpointstrr model_dumpr)rVrWrXregistration_urlregistration_datas r "create_client_registration_requestrds^  4 J J3IIJ"=+>'22Dv\`2a 6+n^pMq rrr"cN# URS;a=UR5IShvN [SURSUR35eUR5IShvN n[R "U5nU$NZN![ an[SU35eSnAff=f7f)zHandle registration response.)rINzRegistration failed: r>zInvalid registration response: )r)rJr textr rKr)rrL client_infoes r handle_registration_responserjs:-nn$'U(dgU(dgURSL$)aDetermine if URL-based client ID (CIMD) should be used instead of DCR. URL-based client IDs should be used when: 1. The server advertises client_id_metadata_document_supported=true 2. The client has a valid client_metadata_url configured Args: oauth_metadata: OAuth authorization server metadata client_metadata_url: URL-based client ID (already validated) Returns: True if CIMD should be used, False if DCR should be used FT)%client_id_metadata_document_supported)rprqs r should_use_client_metadata_urlrt s!"    ? ?4 GGr" redirect_urisc[USUS9$)aCreate client information using a URL-based client ID (CIMD). When using URL-based client IDs, the URL itself becomes the client_id and no client_secret is used (token_endpoint_auth_method="none"). Args: client_metadata_url: The URL to use as the client_id redirect_uris: The redirect URIs from the client metadata (passed through for compatibility with OAuthClientInformationFull which inherits from OAuthClientMetadata) Returns: OAuthClientInformationFull with the URL as client_id none) client_idtoken_endpoint_auth_methodru)r )rqrus r $create_client_info_from_metadata_urlrz$s &%#)# r"c# UR5IShvN n[R"U5nU$N![an[ SU35eSnAff=f7f)aVParse and validate token response with optional scope validation. Parses token response JSON. Callers should check response.status_code before calling. Args: response: HTTP response from token endpoint (status already checked by caller) Returns: Validated OAuthToken model Raises: OAuthTokenError: If response JSON is invalid NzInvalid token response: )rJrrKrr )rrLtoken_responseris r handle_token_response_scopesr};sX > ((#77@) > 8<==>s1A646A6 AAAA)N).loggingr urllib.parserrhttpxrrpydanticrrmcp.client.authr r mcp.client.streamable_httpr mcp.shared.authr r rrr mcp.typesr getLogger__name__loggerr`r!r&r*listr9rArGrNtupleboolrQrUrdrjrortrzr}r"r rs5 *#,C;.   8 $(d ,:(:sTz: Fh F3: F#3:#[^#cghkcl#R;?$J!:T!A$14#7 4Z 0)cTXj)fi)nrsvnw)X%2 ( uT=[_K_E_?` XsXwX s'$. sAT seh s  s L L>X L cDjT(H!D(HtH H6DH-1&\D-@.>>>r"