+
    win                        R t ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RIHtH	t	H
t
 ^ RIHtHt ^ RIHtHt ^ RIHtHtHtHt ^ RIt^ RIt^ RIHtHtHt ^ RIHtHt ^ RIH t H!t!H"t"H#t#H$t$H%t%H&t&H't'H(t(H)t)H*t*H+t+H,t,H-t-H.t. ^ R	I/H0t0 ^ R
I1H2t2H3t3H4t4H5t5H6t6 ^ RI7H8t8H9t9H:t: ]Pv                  ! ]<4      t= ! R R]4      t> ! R R]4      t?] ! R R4      4       t@ ! R R]P                  4      tBR# )z|
OAuth2 Authentication implementation for HTTPX.

Implements authorization code flow with PKCE and automatic token refresh.
N)AsyncGenerator	AwaitableCallable)	dataclassfield)AnyProtocol)quote	urlencodeurljoinurlparse)	BaseModelFieldValidationError)OAuthFlowErrorOAuthTokenError)8build_oauth_authorization_server_metadata_discovery_urls0build_protected_resource_metadata_discovery_urls$create_client_info_from_metadata_url"create_client_registration_requestcreate_oauth_metadata_requestextract_field_from_www_auth'extract_resource_metadata_from_www_authextract_scope_from_www_authget_client_metadata_scopeshandle_auth_metadata_response"handle_protected_resource_responsehandle_registration_responsehandle_token_response_scopesis_valid_client_metadata_urlshould_use_client_metadata_url)MCP_PROTOCOL_VERSION)OAuthClientInformationFullOAuthClientMetadataOAuthMetadata
OAuthTokenProtectedResourceMetadata)calculate_token_expirycheck_resource_allowedresource_url_from_server_urlc                   x   a  ] tR t^9t o Rt]! R^+^R7      t]! R^+^R7      t]V 3R lR l4       t	V 3R lt
RtV tR# )	PKCEParametersz.PKCE (Proof Key for Code Exchange) parameters..)
min_length
max_lengthc                   < V ^8  d   QhRR/# )   returnr+    )format__classdict__s   "J/home/ubuntu/.local/lib/python3.14/site-packages/mcp/client/auth/oauth2.py__annotate__PKCEParameters.__annotate__@   s     O O) O    c                    RP                  R \        ^4       4       4      p\        P                  ! VP	                  4       4      P                  4       p\        P                  ! V4      P                  4       P                  R4      pV ! WR7      # )zGenerate new PKCE parameters. c              3      "   T FE  p\         P                  ! \        P                  \        P                  ,           R ,           4      x  KG  	  R# 5i)z-._~N)secretschoicestringascii_lettersdigits).0_s   & r4   	<genexpr>*PKCEParameters.generate.<locals>.<genexpr>B   s4     rgqbcv/C/Cfmm/SV\/\ ] ]gqs   AA=)code_verifiercode_challenge)
joinrangehashlibsha256encodedigestbase64urlsafe_b64encodedecoderstrip)clsrE   rL   rF   s   &   r4   generatePKCEParameters.generate?   sn     rglmpgqrr 4 4 67>>@11&9@@BII#NNNr7   c                2   < V ^8  d   Qh/ S[ ;R&   S[ ;R&   # )r/   rE   rF   str)r2   r3   s   "r4   r5   r6   9   s      B  C	 r7   r1   N)__name__
__module____qualname____firstlineno____doc__r   rE   rF   classmethodrR   __annotate_func____static_attributes____classdictcell__r3   s   @r4   r+   r+   9   s?     8srcBMsCNO O  r7   r+   c                   l   a  ] tR t^Ht o RtV 3R lR ltV 3R lR ltV 3R lR ltV 3R lR	 ltR
t	V t
R# )TokenStoragez+Protocol for token storage implementations.c                .   < V ^8  d   QhRS[ R,          /# r/   r0   Nr%   )r2   r3   s   "r4   r5   TokenStorage.__annotate__K   s      *t"3 r7   c                   "   R# 5i)zGet stored tokens.Nr1   selfs   &r4   
get_tokensTokenStorage.get_tokensK           c                $   < V ^8  d   QhRS[ RR/# )r/   tokensr0   Nre   )r2   r3   s   "r4   r5   rf   O   s      z d r7   c                   "   R# 5i)zStore tokens.Nr1   )ri   ro   s   &&r4   
set_tokensTokenStorage.set_tokensO   rl   rm   c                .   < V ^8  d   QhRS[ R,          /# rd   r"   )r2   r3   s   "r4   r5   rf   S   s      'AD'H r7   c                   "   R# 5i)zGet stored client information.Nr1   rh   s   &r4   get_client_infoTokenStorage.get_client_infoS   rl   rm   c                $   < V ^8  d   QhRS[ RR/# )r/   client_infor0   Nrt   )r2   r3   s   "r4   r5   rf   W   s      1K PT r7   c                   "   R# 5i)zStore client information.Nr1   )ri   ry   s   &&r4   set_client_infoTokenStorage.set_client_infoW   rl   rm   r1   N)rW   rX   rY   rZ   r[   rj   rq   rv   r{   r^   r_   r`   s   @r4   rb   rb   H   s0     5    r7   rb   c                     a  ] tR t^\t o RtRtRtRtRtRt	Rt
RtRtRt]! ]P                   R7      tV 3R lR ltV 3R lR ltV 3R	 lR
 ltV 3R lR ltV 3R lR ltV 3R lR ltRV 3R lR lltRV 3R lR lltV 3R ltRtV tR# )OAuthContextzOAuth flow context.     r@N)default_factoryc                &   < V ^8  d   QhRS[ RS[ /# )r/   
server_urlr0   rU   )r2   r3   s   "r4   r5   OAuthContext.__annotate__x   s     4 4S 4S 4r7   c                N    \        V4      pVP                   RVP                   2# )z,Extract base URL by removing path component.z://)r   schemenetloc)ri   r   parseds   && r4   get_authorization_base_url'OAuthContext.get_authorization_base_urlx   s%    *%--FMM?33r7   c                $   < V ^8  d   QhRS[ RR/# )r/   tokenr0   Nre   )r2   r3   s   "r4   r5   r   }   s     J J J Jr7   c                :    \        VP                  4      V n        R# )z4Update token expiry time using shared util function.N)r'   
expires_intoken_expiry_time)ri   r   s   &&r4   update_token_expiry OAuthContext.update_token_expiry}   s    !78H8H!Ir7   c                    < V ^8  d   QhRS[ /# r/   r0   bool)r2   r3   s   "r4   r5   r      s     
 
 
r7   c                    \        V P                  ;'       dZ    V P                  P                  ;'       d<    V P                  '       * ;'       g#    \        P                  ! 4       V P                  8*  4      # )z Check if current token is valid.)r   current_tokensaccess_tokenr   timerh   s   &r4   is_token_validOAuthContext.is_token_valid   sd     V V##00V V+++TTtyy{d>T>T/T
 	
r7   c                    < V ^8  d   QhRS[ /# r   r   )r2   r3   s   "r4   r5   r      s     d d4 dr7   c                    \        V P                  ;'       d+    V P                  P                  ;'       d    V P                  4      # )z Check if token can be refreshed.)r   r   refresh_tokenry   rh   s   &r4   can_refresh_tokenOAuthContext.can_refresh_token   s6    D''bbD,?,?,M,MbbRVRbRbccr7   c                   < V ^8  d   QhRR/# rd   r1   )r2   r3   s   "r4   r5   r      s     & &d &r7   c                "    RV n         RV n        R# )zClear current tokens.Nr   r   rh   s   &r4   clear_tokensOAuthContext.clear_tokens   s    "!%r7   c                    < V ^8  d   QhRS[ /# r   rU   )r2   r3   s   "r4   r5   r      s      # r7   c                    \        V P                  4      pV P                  '       dP   V P                  P                  '       d4   \	        V P                  P                  4      p\        WR7      '       d   TpV# )zoGet resource URL for RFC 8707.

Uses PRM resource if it's a valid parent, otherwise uses canonical server URL.
requested_resourceconfigured_resource)r)   r   protected_resource_metadataresourcerV   r(   )ri   r   prm_resources   &  r4   get_resource_urlOAuthContext.get_resource_url   s\    
 0@ +++0P0P0Y0Y0Yt??HHIL%dd'r7   c                4   < V ^8  d   QhRS[ R,          RS[/# )r/   protocol_versionNr0   )rV   r   )r2   r3   s   "r4   r5   r      s      0 0cDj 0TX 0r7   c                @    V P                   e   R# V'       g   R# VR8  # )zDetermine if the resource parameter should be included in OAuth requests.

Returns True if:
- Protected resource metadata is available, OR
- MCP-Protocol-Version header is 2025-06-18 or later
TFz
2025-06-18)r   )ri   r   s   &&r4   should_include_resource_param*OAuthContext.should_include_resource_param   s(     ++7    <//r7   c          
         < V ^8  d   QhRS[ S[S[3,          RS[ S[S[3,          R,          RS[S[ S[S[3,          S[ S[S[3,          3,          /# )r/   dataheadersNr0   )dictrV   tuple)r2   r3   s   "r4   r5   r      sT     " "cN"-1#s(^d-B"	tCH~tCH~-	."r7   c                   Vf   / pV P                   '       g   W3# V P                   P                  pVR8X  d   V P                   P                  '       d   V P                   P                  '       d   \	        V P                   P                  RR7      p\	        V P                   P                  RR7      pV RV 2p\
        P                  ! VP                  4       4      P                  4       pRV 2VR&   VP                  4        UU	u/ uF  w  rVR8w  g   K  WbK  	  ppp	W3# VR8X  d6   V P                   P                  '       d   V P                   P                  VR&   W3# u up	pi )	zPrepare authentication for token requests.

Args:
    data: The form data to send
    headers: Optional headers dict to update

Returns:
    Tuple of (updated_data, updated_headers)
client_secret_basicr9   )safe:zBasic Authorizationclient_secretclient_secret_post)
ry   token_endpoint_auth_method	client_idr   r	   rM   	b64encoderK   rO   items)
ri   r   r   auth_method
encoded_idencoded_secretcredentialsencoded_credentialskvs
   &&&       r4   prepare_token_authOAuthContext.prepare_token_auth   sI    ?G= &&AA//D4D4D4N4N4NSWScScSqSqSqt//99CJ"4#3#3#A#AKN'L.)9:K"("2"2;3E3E3G"H"O"O"Q)/0C/D'EGO$%)ZZ\J\TQQ/5IDAD\DJ } 00T5E5E5S5S5S$($4$4$B$BD! } Ks   E"E"c                  < V ^8  d   Qh/ S[ ;R&   S[;R&   S[;R&   S[S[ .S[R,          3,          R,          ;R&   S[. S[S[S[ S[ R,          3,          ,          3,          R,          ;R&   S[;R&   S[ R,          ;R&   S[R,          ;R	&   S[R,          ;R
&   S[ R,          ;R&   S[ R,          ;R&   S[	R,          ;R&   S[
R,          ;R&   S[R,          ;R&   S[P                  ;R&   # )r/   r   client_metadatastorageNredirect_handlercallback_handlertimeoutclient_metadata_urlr   oauth_metadataauth_server_urlr   ry   r   r   lock)rV   r#   rb   r   r   r   floatr&   r$   r"   r%   anyioLock)r2   r3   s   "r4   r5   r   \   s%     O	 
 )(    uio56==  r9U3d
?-C#DDELL    t*  ";T!AH  "D(/  4Z&   Dj'! & ,d29' , %,- . t|*/ 4 **85 r7   r   N)rW   rX   rY   rZ   r[   r   r   r   r   r   r   ry   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r]   r^   r_   r`   s   @r4   r~   r~   \   s      G&* EI+/N"&O#' 6:K )-N&* UZZ8D4 4
J J
 
d d& &
 0 0&" "q  r7   r~   c                   0  a  ] tR t^t o RtRtR"V 3R lR lltV 3R lR ltV 3R lR	 ltV 3R
 lR lt	V 3R lR lt
V 3R lR ltR/ /V 3R lR lltV 3R lR ltV 3R lR ltV 3R lR ltV 3R lR ltV 3R lR ltV 3R lR ltV 3R lR  ltR!tV tR# )#OAuthClientProviderzk
OAuth2 authentication for httpx.
Handles OAuth flow with automatic client registration and token storage.
TNc                   < V ^8  d   QhRS[ RS[RS[RS[S[ .S[R,          3,          R,          RS[. S[S[S[ S[ R,          3,          ,          3,          R,          RS[RS[ R,          /# )	r/   r   r   r   r   Nr   r   r   )rV   r#   rb   r   r   r   r   )r2   r3   s   "r4   r5    OAuthClientProvider.__annotate__   s     +" +"+" -+" 	+"
 #C5)D/#9:TA+" #2ysC$J1G'H#HIDP+" +" !4Z+"r7   c           
         Ve    \        V4      '       g   \        RV 24      h\        VVVVVVVR7      V n        RV n        R# )a  Initialize OAuth2 authentication.

Args:
    server_url: The MCP server URL.
    client_metadata: OAuth client metadata for registration.
    storage: Token storage implementation.
    redirect_handler: Handler for authorization redirects.
    callback_handler: Handler for authorization callbacks.
    timeout: Timeout for the OAuth flow.
    client_metadata_url: URL-based client ID. When provided and the server
        advertises client_id_metadata_document_supported=true, this URL will be
        used as the client_id instead of performing dynamic client registration.
        Must be a valid HTTPS URL with a non-root pathname.

Raises:
    ValueError: If client_metadata_url is provided but not a valid HTTPS URL
        with a non-root pathname.
NzMclient_metadata_url must be a valid HTTPS URL with a non-root pathname, got: )r   r   r   r   r   r   r   F)r   
ValueErrorr~   context_initialized)ri   r   r   r   r   r   r   r   s   &&&&&&&&r4   __init__OAuthClientProvider.__init__   s\    : *3OPc3d3d_`s_tu  $!+-- 3
 "r7   c                $   < V ^8  d   QhRS[ RR/# )r/   prmr0   N)r&   )r2   r3   s   "r4   r5   r     s!     r r2K rPT rr7   c                   "   VP                   '       d   \        VP                   4      MRpV'       g   R# \        V P                  P                  4      p\        W2R7      '       g   \        RV RV 24      hR# 5i)z?Validate that PRM resource matches the server URL per RFC 8707.Nr   zProtected resource z does not match expected )r   rV   r)   r   r   r(   r   )ri   r   r   default_resources   &&  r4   _validate_resource_match,OAuthClientProvider._validate_resource_match  sf     ,/LLLs3<<(d78O8OP%9Ill #6|nD]^n]o!pqq ms   1A:AA:c                :   < V ^8  d   QhRS[ P                  RS[/# r/   responser0   httpxResponser   )r2   r3   s   "r4   r5   r     s       %.. UY r7   c                X  "   VP                   ^8X  d    VP                  4       G Rj  xL
 p\        P                  ! V4      pW0P                  n        VP                  '       d,   \        VP                  ^ ,          4      V P                  n        R# VP                   R8X  d0   \        P                  RVP                  P                   R24       R# \        RVP                    24      h L  \         d1    \        P                  RTP                  P                   24        R# i ; i5i)	z
Handle protected resource metadata discovery response.

Per SEP-985, supports fallback when discovery fails at one URL.

Returns:
    True if metadata was successfully discovered, False if we should try next URL
NTz'Invalid protected resource metadata at Fi  z)Protected resource metadata not found at z, trying next URLz,Protected Resource Metadata request failed: )status_codeareadr&   model_validate_jsonr   r   authorization_serversrV   r   r   loggerwarningrequesturldebugr   ri   r   contentmetadatas   &&  r4   #_handle_protected_resource_response7OAuthClientProvider._handle_protected_resource_response  s      3& ( 004HHQ;C811136x7U7UVW7X3YDLL0 !!S(LLDXEUEUEYEYDZZklm !>x?S?S>TU # 1 # !HIYIYI]I]H^_`s:   D*C, C*A'C, AD**C, ,7D'#D*&D''D*c                4   < V ^8  d   QhRS[ P                  /# r   r   Request)r2   r3   s   "r4   r5   r   7  s      emm r7   c                |   "   V P                  4       G Rj  xL
 w  rV P                  W4      G Rj  xL
 pV#  L! L5i)zPerform the authorization flow.N)!_perform_authorization_code_grant"_exchange_token_authorization_code)ri   	auth_coderE   token_requests   &   r4   _perform_authorization*OAuthClientProvider._perform_authorization7  s;     )-)O)O)Q#Q 	"EEi__ $R_s   <8<:<<c                6   < V ^8  d   QhRS[ S[S[3,          /# r   )r   rV   )r2   r3   s   "r4   r5   r   =  s     34 34sCx 34r7   c                F  "   V P                   P                  P                  f   \        R4      hV P                   P                  '       g   \        R4      hV P                   P
                  '       g   \        R4      hV P                   P                  '       dQ   V P                   P                  P                  '       d+   \        V P                   P                  P                  4      pM;V P                   P                  V P                   P                  4      p\        VR4      pV P                   P                  '       g   \        R4      h\        P                  4       p\        P                   ! ^ 4      pRRR	V P                   P                  P"                  R
\        V P                   P                  P                  ^ ,          4      RVRVP$                  RR/pV P                   P'                  V P                   P(                  4      '       d   V P                   P+                  4       VR&   V P                   P                  P,                  '       d$   V P                   P                  P,                  VR&   V R\/        V4       2pV P                   P	                  V4      G Rj  xL
  V P                   P                  4       G Rj  xL
 w  rxVe   \        P0                  ! W4      '       g   \        RV RV 24      hV'       g   \        R4      hWsP2                  3#  Ly LY5i)z5Perform the authorization redirect and get auth code.N6No redirect URIs provided for authorization code grantz9No redirect handler provided for authorization code grantz9No callback handler provided for authorization code grantz
/authorizez*No client info available for authorizationresponse_typecoder   redirect_uristaterF   code_challenge_methodS256r   scope?zState parameter mismatch: z != zNo authorization code received)r   r   redirect_urisr   r   r   r   authorization_endpointrV   r   r   r   ry   r+   rR   r;   token_urlsafer   rF   r   r   r   r  r
   compare_digestrE   )	ri   auth_endpointauth_base_urlpkce_paramsr  auth_paramsauthorization_urlr  returned_states	   &        r4   r  5OAuthClientProvider._perform_authorization_code_grant=  sj    <<''55= !YZZ||,,, !\]]||,,, !\]]<<&&&4<<+F+F+]+]+] ; ; R RSM LLCCDLLD[D[\M#M<@M||''' !MNN %--/%%b) V11;;C < < J J1 MNUk88#V
 <<55dll6S6STT&*ll&C&C&EK
#<<''---#'<<#?#?#E#EK ,oQy/E.FGll++,=>>> +/,,*G*G*I$I!	!)?)?)V)V #=n=MTRWQX!YZZ !ABB 3333 	? %JsQ   A	L!&L!3&L!%L! B L!DL!AL!#L$!L!L>L!L!L!c                    < V ^8  d   QhRS[ /# r   rU   )r2   r3   s   "r4   r5   r   r  s      S r7   c                V   V P                   P                  '       dR   V P                   P                  P                  '       d,   \        V P                   P                  P                  4      pV# V P                   P	                  V P                   P
                  4      p\        VR 4      pV# )/token)r   r   token_endpointrV   r   r   r   )ri   	token_urlr  s   &  r4   _get_token_endpoint'OAuthClientProvider._get_token_endpointr  s{    <<&&&4<<+F+F+U+U+UDLL77FFGI  !LLCCDLLD[D[\Mx8Ir7   
token_datac                j   < V ^8  d   QhRS[ RS[ RS[S[ S[3,          R,          RS[P                  /# )r/   r  rE   r'  Nr0   )rV   r   r   r   r  )r2   r3   s   "r4   r5   r   z  sE     R RR-0RAEc3hRVAVR	Rr7   c                 "   V P                   P                  P                  f   \        R4      hV P                   P                  '       g   \        R4      hV P                  4       pT;'       g    / pVP                  RRRVR\        V P                   P                  P                  ^ ,          4      RV P                   P                  P                  RV/4       V P                   P                  V P                   P                  4      '       d   V P                   P                  4       VR	&   R
R/pV P                   P                  W54      w  r5\        P                  ! RWCVR7      # 5i)z9Build token exchange request for authorization_code flow.r  zMissing client info
grant_typeauthorization_coder  r  r   rE   r   Content-Type!application/x-www-form-urlencodedPOSTr   r   )r   r   r  r   ry   r%  updaterV   r   r   r   r   r   r   r  )ri   r  rE   r'  r$  r   s   &&&$  r4   r  6OAuthClientProvider._exchange_token_authorization_codez  s&     <<''55= !YZZ||''' !677,,.	%%2
2	DLL$@$@$N$Nq$Q RT\\55??	
 <<55dll6S6STT%)\\%B%B%DJz" "#FG"ll==jR
}}VYQQs   A	E&#E&0C6E&c                8   < V ^8  d   QhRS[ P                  RR/# r/   r   r0   Nr   r   )r2   r3   s   "r4   r5   r     s     > >U^^ > >r7   c                  "   VP                   ^8w  dE   VP                  4       G Rj  xL
 pVP                  R4      p\        RVP                    RV 24      h\	        V4      G Rj  xL
 pW@P
                  n        V P
                  P                  V4       V P
                  P                  P                  V4      G Rj  xL
  R#  L L` L
5i)zHandle token exchange response.Nzutf-8zToken exchange failed (z): )
r   r   rO   r   r   r   r   r   r   rq   )ri   r   body	body_texttoken_responses   &&   r4   _handle_token_response*OAuthClientProvider._handle_token_response  s     3&!))DG,I!$;H<P<P;QQTU^T_"`aa  <HEE '5#((8ll""--n=== *
 F
 	>s4   %CC>C&C'AC>C	?CC	Cc                4   < V ^8  d   QhRS[ P                  /# r   r  )r2   r3   s   "r4   r5   r     s     T Temm Tr7   c                ,  "   V P                   P                  '       d'   V P                   P                  P                  '       g   \        R4      hV P                   P                  '       d'   V P                   P                  P
                  '       g   \        R4      hV P                   P                  '       dQ   V P                   P                  P                  '       d+   \        V P                   P                  P                  4      pM;V P                   P                  V P                   P                  4      p\        VR4      pRRRV P                   P                  P                  RV P                   P                  P
                  /pV P                   P                  V P                   P                  4      '       d   V P                   P                  4       VR&   RR	/pV P                   P                  W44      w  r4\         P"                  ! R
WVR7      # 5i)zBuild token refresh request.zNo refresh token availablezNo client info availabler"  r*  r   r   r   r,  r-  r.  r/  )r   r   r   r   ry   r   r   r#  rV   r   r   r   r   r   r   r   r   r  )ri   r$  r  refresh_datar   s   &    r4   _refresh_token"OAuthClientProvider._refresh_token  sw    ||***$,,2M2M2[2[2[!">??||'''t||/G/G/Q/Q/Q!"<==<<&&&4<<+F+F+U+U+UDLL77FFGI LLCCDLLD[D[\Mx8I /T\\88FF11;;(
 <<55dll6S6STT'+||'D'D'FL$ "#FG $ ? ? V}}VY7SSs,   AH&H,%H&H9%HCH=AHc                :   < V ^8  d   QhRS[ P                  RS[/# r   r   )r2   r3   s   "r4   r5   r     s      u~~ $ r7   c                D  "   VP                   ^8w  d?   \        P                  RVP                    24       V P                  P	                  4        R#  VP                  4       G Rj  xL
 p\        P                  ! V4      pW0P                  n        V P                  P                  V4       V P                  P                  P                  V4      G Rj  xL
  R#  Lt L  \         d4    \        P                  R4       T P                  P	                  4         R# i ; i5i)z:Handle token refresh response. Returns True if successful.zToken refresh failed: FNTzInvalid refresh response)r   r   r   r   r   r   r%   r   r   r   r   rq   r   	exception)ri   r   r   r8  s   &&  r4   _handle_refresh_response,OAuthClientProvider._handle_refresh_response  s     3&NN3H4H4H3IJKLL%%'	$NN,,G';;GDN*8LL'LL,,^<,,&&11.AAA -
 B  	78LL%%'	sO   AD C &C'A-C CC D C C :DD DD c                   < V ^8  d   QhRR/# rd   r1   )r2   r3   s   "r4   r5   r     s     ! !4 !r7   c                  "   V P                   P                  P                  4       G Rj  xL
 V P                   n        V P                   P                  P	                  4       G Rj  xL
 V P                   n        RV n        R#  LW L5i)z#Load stored tokens and client info.NT)r   r   rj   r   rv   ry   r   rh   s   &r4   _initializeOAuthClientProvider._initialize  sZ     ,0LL,@,@,K,K,M&M#)-)=)=)M)M)O#O   'N#Os!   (BB:B%B&BBc                8   < V ^8  d   QhRS[ P                  RR/# )r/   r   r0   Nr  )r2   r3   s   "r4   r5   r     s#     d d d$ dr7   c                    V P                   P                  '       d[   V P                   P                  P                  '       d3   RV P                   P                  P                   2VP                  R&   R# R# R# )z<Add authorization header to request if we have valid tokens.zBearer r   N)r   r   r   r   )ri   r   s   &&r4   _add_auth_header$OAuthClientProvider._add_auth_header  sV    <<&&&4<<+F+F+S+S+S189T9T9a9a8b/cGOOO, ,T&r7   c                8   < V ^8  d   QhRS[ P                  RR/# r3  r4  )r2   r3   s   "r4   r5   r     s      / /enn /QU /r7   c                   "   VP                  4       G R j  xL
 p\        P                  ! V4      pW0P                  n        R #  L,5ir   )r   r$   r   r   r   r   s   &&  r4   _handle_oauth_metadata_response3OAuthClientProvider._handle_oauth_metadata_response  s3      (( 44W=&.# )s   AA-Ac                x   < V ^8  d   QhRS[ P                  RS[S[ P                  S[ P                  3,          /# )r/   r   r0   )r   r  r   r   )r2   r3   s   "r4   r5   r     s8     H HU]] H~emm]b]k]kNk?l Hr7   c           	      "   V P                   P                  ;_uu_4       GRj  xL
  V P                  '       g   V P                  4       G Rj  xL
  VP                  P                  \        4      V P                   n        V P                   P                  4       '       gd   V P                   P                  4       '       dD   V P                  4       G Rj  xL
 pV5x pV P                  V4      G Rj  xL
 '       g   RV n        V P                   P                  4       '       d   V P                  V4       V5x pVP                  R8X  Ed    \        V4      p\        WPP                   P                   4      pV F  p\#        V4      pV5x p	\%        V	4      G Rj  xL
 p
V
'       ds   V P'                  V
4      G Rj  xL
  WP                   n        \+        V
P,                  4      ^ 8  g   Q h\/        V
P,                  ^ ,          4      V P                   n         M\2        P5                  RV 24       K  	  \7        V P                   P0                  V P                   P                   4      pV Fl  p\#        V4      pV5x p\9        V4      G Rj  xL
 w  rV'       g    M>V'       d   V'       d   WP                   n         M\2        P5                  RV 24       Kn  	  \=        \?        V4      V P                   P(                  V P                   P:                  4      V P                   P@                  n!        V P                   PD                  '       Eg   \G        V P                   P:                  V P                   PH                  4      '       d   \2        P5                  RV P                   PH                   24       \K        V P                   PH                  V P                   P@                  PL                  R7      pVV P                   n"        V P                   PN                  PQ                  V4      G Rj  xL
  M\S        V P                   P:                  V P                   P@                  V P                   PU                  V P                   P                   4      4      pV5x p\W        V4      G Rj  xL
 pVV P                   n"        V P                   PN                  PQ                  V4      G Rj  xL
  V PY                  4       G Rj  xL
 5x pV P[                  V4      G Rj  xL
  T P                  T4       T5x  MVP                  R	8X  d   \a        VR
4      pVR8X  dx    \=        \?        V4      V P                   P(                  4      V P                   P@                  n!        V PY                  4       G Rj  xL
 5x pV P[                  V4      G Rj  xL
  V P                  V4       V5x  RRR4      GRj  xL
  R#  EL EL EL+ EL ELk ELM EL EL ELi EL. EL EL   \\         d    \2        P_                  R4       h i ; i L Lw  \\         d    \2        P_                  R4       h i ; i Lx  + GRj  xL 
 '       g   i     R# ; i5i)zHTTPX auth flow integration.NFi  z.Protected resource metadata discovery failed: z!OAuth metadata discovery failed: z"Using URL-based client ID (CIMD): )r  zOAuth flow errori  errorinsufficient_scope)1r   r   r   rG  r   getr!   r   r   r   r>  rC  rK  r   r   r   r   r   r   r   r   lenr   rV   r   r   r   r   r   r   r   r   r   r  ry   r    r   r   r  r   r{   r   r   r   r  r9  	ExceptionrB  r   )ri   r   refresh_requestrefresh_responser   www_auth_resource_metadata_urlprm_discovery_urlsr   discovery_requestdiscovery_responser   asm_discovery_urlsoauth_metadata_requestoauth_metadata_responseokasmclient_informationregistration_requestregistration_responser8  rS  s   &&                   r4   async_auth_flow#OAuthClientProvider.async_auth_flow  s#    <<$$$$$$$&&((( -4OO,?,?@T,UDLL)<<..00T\\5S5S5U5U(,(;(;(="=)8#8 !::;KLLL(-D%||**,,%%g.$}H##s*U5\]e5f2 *Z68O8O*&  2,I#,N)3D-D*$FGY$ZZ"&"?"?"DDDGJLLD !$C$=$= > B B <?s?X?XYZ?[;\DLL8!"LL+YZ]Y^)_`'  2* *b44dll6M6M*&
  21Ns1S.8N2N/(EF](^"^!!#:=LL7!"LL+LSE)RS  2 :T3H=@@33:DLL006  <<3339 LL779Y9Y  #LL+MdllNnNnMo)pq1U $ @ @.2ll.J.J.X.X2. 8JDLL4"&,,"6"6"F"FGY"ZZZ 4V $ ; ; $ < < $ G GH_H_ `40
 ;O4N17STi7j1j.7IDLL4"&,,"6"6"F"FGY"ZZZ 261L1L1N+N%NN55nEEE %%g.%%,3HgF 00=W7A4<<CkCk>44:
 6:5P5P5R/R)R"99.III %%g.M %$$( #> M2 [ E, #_8 [ 2kZ ,OE  $$%78( 0SI$ (();<A %$$$s  #ZW:Z&Y.W=AY."Y.Y.X Y.3X4	Y.>&Y.%(Y.AXX
X(X<X	
=CXX
X&X.F X.X/A:X)X*=X'X(X?X XXX ;Y.AY1Y2YYYY.(Z3Y,4Z=Y. Y.Y.X	XXXXXXX"Y  Y.YY"Y))Y.,Z.Z	4Y75
Z	 Z		Z)r   r   )NNr   N)rW   rX   rY   rZ   r[   requires_response_bodyr   r   r   r  r  r%  r  r9  r>  rC  rG  rK  rO  rf  r^   r_   r`   s   @r4   r   r      s     
 "+" +"Zr r @ 34 34j RY[R R>> >T T< *! !d d
/ /
H Hr7   r   )Cr[   rM   rI   loggingr;   r=   r   collections.abcr   r   r   dataclassesr   r   typingr   r   urllib.parser	   r
   r   r   r   r   pydanticr   r   r   mcp.client.auth.exceptionsr   r   mcp.client.auth.utilsr   r   r   r   r   r   r   r   r   r   r   r   r   r   r    mcp.client.streamable_httpr!   mcp.shared.authr"   r#   r$   r%   r&   mcp.shared.auth_utilsr'   r(   r)   	getLoggerrW   r   r+   rb   r~   Authr   r1   r7   r4   <module>rv     s          ? ? (   < <   6 6 F    " <   
		8	$OY O8 ( y y yxZ%** Zr7   