kKj!dZddlmZddlZddlZddlmZmZddlm Z ddl m Z ddl m Z ddlmZmZdd lmZddlZdd lmZeeZd Zd Zedd ZeddZddd ddZGddZy)a"JWT token issuance and verification for FastMCP OAuth Proxy. This module implements the token factory pattern for OAuth proxies, where the proxy issues its own JWT tokens to clients instead of forwarding upstream provider tokens. This maintains proper OAuth 2.0 token audience boundaries. ) annotationsN)Anyoverload)hashes)HKDF) PBKDF2HMAC)jwkjwt) JoseError) get_loggeri@B cy)zHDerive JWT signing key from a high-entropy key material and server salt.N)high_entropy_materialsalts o/Users/ahmed/devFolder/Ultron/claude-voice/.venv/lib/python3.12/site-packages/fastmcp/server/auth/jwt_issuer.pyderive_jwt_keyrcy)zGDerive JWT signing key from a low-entropy key material and server salt.Nr)low_entropy_materialrs rrr"rr)rrc| | td|bttjd|j dj |j }t j|S|tjjrtnt}ttjd|j |j |j }t j|Std)zWDerive JWT signing key from a high-entropy or low-entropy key material and server salt.zSEither high_entropy_material or low_entropy_material must be provided, but not both sFernet) algorithmlengthrinfo) key_material)rrr iterationszEEither high_entropy_material or low_entropy_material must be provided) ValueErrorrrSHA256encodederivebase64urlsafe_b64encodefastmcpsettings test_modeKDF_ITERATIONS_TESTKDF_ITERATIONSr)rrr derived_keyrpbkdf2s rrr's(-A-M a  (mmo  &3::<& = '' 44'#*#3#3#=#= > mmo!  &299;& < ''// O rceZdZdZ ddZ d d dZ d d dZ d d dZy) JWTIssueraIssues and validates FastMCP-signed JWT tokens using HS256. This issuer creates JWT tokens for MCP clients with proper audience claims, maintaining OAuth 2.0 token boundaries. Tokens are signed with HS256 using a key derived from the upstream client secret. cd||_||_||_tj|d|_y)zInitialize JWT issuer. Args: issuer: Token issuer (FastMCP server base URL) audience: Token audience (typically {base_url}/mcp) signing_key: HS256 signing key (32 bytes) octN)issueraudience _signing_keyr import_key_jwt_key)selfr0r1 signing_keys r__init__zJWTIssuer.__init__Ws,   '{E: rNc<ttj}ddd}|j|j|dj |||z||d}|r||d<t j |||jdg} tjd||d d |d | S) aWIssue a minimal FastMCP access token. FastMCP tokens are reference tokens containing only the minimal claims needed for validation and lookup. The JTI maps to the upstream token which contains actual user identity and authorization data. Args: client_id: MCP client ID scopes: Token scopes jti: Unique token identifier (maps to upstream token) expires_in: Token lifetime in seconds upstream_claims: Optional claims from upstream IdP token to include Returns: Signed JWT token HS256JWTalgtyp )issaud client_idscopeexpiatjtiupstream_claims algorithmsz/Issued access token for client=%s jti=%s exp=%dNrC inttimer0r1joinr r!r4loggerdebug r5rAscopesrE expires_inrFnowheaderpayloadtokens rissue_access_tokenzJWTIssuer.issue_access_tokenis0$))+ /;;=="XXf%##  )8G% &   MMy    =  G EN   rc >ttj}ddd}|j|j|dj |||z||dd}|r||d<t j |||jdg} tjd ||d d |d | S) aIssue a minimal FastMCP refresh token. FastMCP refresh tokens are reference tokens containing only the minimal claims needed for validation and lookup. The JTI maps to the upstream token which contains actual user identity and authorization data. Args: client_id: MCP client ID scopes: Token scopes jti: Unique token identifier (maps to upstream token) expires_in: Token lifetime in seconds (should match upstream refresh expiry) upstream_claims: Optional claims from upstream IdP token to include Returns: Signed JWT token r9r:r;r>refresh)r?r@rArBrCrDrE token_userFrGz0Issued refresh token for client=%s jti=%s exp=%dNrIrCrJrPs rissue_refresh_tokenzJWTIssuer.issue_refresh_tokens0$))+ /;;=="XXf%#" #  )8G% &   MMy    >  G EN   rc tj||jdgj}|j dd}||k7r(t j d||td|d||j d}|7|tjkr t j d td |j d |jk7r t j d td|j d|jk7r t j dtdt j d|j d|S#t$r}t j d|d }~wwxYw)aVerify and decode a FastMCP token. Validates JWT signature, expiration, issuer, audience, and token type. Args: token: JWT token to verify expected_token_use: Expected token type ("access" or "refresh"). Defaults to "access", which rejects refresh tokens. Returns: Decoded token payload Raises: JoseError: If token is invalid, expired, or has wrong claims r9rGrZaccessz(Token type mismatch: expected %s, got %szToken type mismatch: expected z, got rCNz Token expiredzToken has expiredr?zToken has invalid issuerzInvalid token issuerr@zToken has invalid audiencezInvalid token audiencez*Token verified successfully for subject=%ssubzToken validation failed: %s) r decoder4claimsgetrNrOr rLr0r1)r5rVexpected_token_userUrZrCes r verify_tokenzJWTIssuer.verify_tokensc(, jj #9f  K:I.. >&  45G4HI$+' ++e$C3#4 _- 344{{5!T[[0 78 677{{5!T]]2 9: 899 LLP N  LL6 :  sEE F$E;;F)r0strr1rer6bytes)iN) rArerQz list[str]rErerRrKrFzdict[str, Any] | Nonereturnre)N)r])rVrerbrergzdict[str, Any])__name__ __module__ __qualname____doc__r7rWr[rdrrrr-r-Os;;; ;.15 666 6  6 / 6 6|26 777 7  7 / 7 7x#+@@ @  @rr-)rrerrergrf)rrerrergrf)r str | Nonerrlrrergrf)rk __future__rr#rLtypingrrcryptography.hazmat.primitivesr'cryptography.hazmat.primitives.kdf.hkdfr)cryptography.hazmat.primitives.kdf.pbkdf2rjoserfcr r joserfc.errorsr r%fastmcp.utilities.loggingr rhrNr)r(rr-rrrrus# 18@$0 H  S S R R )-'+%%%%%  %  %PKKr