
    !<i                     v    d dl Z d dlmZ d dlmZ ddlmZ dZ e j        e	          Z
 G d d          Zd	 ZdS )
    N)jwt)	JoseError   )InvalidClientErrorz6urn:ietf:params:oauth:client-assertion-type:jwt-bearerc                   L    e Zd ZdZeZdZddZd Zd Z	d Z
d	 Zd
 Zd Zd ZdS )JWTBearerClientAssertionz]Implementation of Using JWTs for Client Authentication, which is
    defined by RFC7523.
    client_assertion_jwtT<   c                 0    || _         || _        || _        d S )N)	token_url_validate_jtileeway)selfr   validate_jtir   s       /Users/kimhansen/Desktop/03 Workspace/ceo-agents/chl-effectiveness/mcp-servers/whoop/.venv/lib/python3.11/site-packages/authlib/oauth2/rfc7523/client.py__init__z!JWTBearerClientAssertion.__init__   s    ")     c                 N   |j         }|                    d          }|                    d          }|t          k    rH|rF|                     ||          }|                     ||           |                     |j                  S t                              d| j	                   d S )Nclient_assertion_typeclient_assertionzAuthenticate via %r failed)
formgetASSERTION_TYPEcreate_resolve_key_funcprocess_assertion_claimsauthenticate_clientclientlogdebugCLIENT_AUTH_METHOD)r   query_clientrequestdataassertion_type	assertionresolve_keys          r   __call__z!JWTBearerClientAssertion.__call__   s    |"9::HH/00	^++	+66|WMMK)))[AAA++GN;;;		.0GHHHHHr   c                 d    dt           dddid| j        dddid}| j        rd| j        d|d<   |S )zCreate a claims_options for verify JWT payload claims. Developers
        MAY overwrite this method to create a more strict options.
        T)	essentialvalidater)   )r)   value)isssubaudexpjti)_validate_issr   r   r   )r   optionss     r   create_claims_optionsz.JWTBearerClientAssertion.create_claims_options'   s_     "&=AA&!%??&	
 
  	P+/T=NOOGENr   c                    	 t          j        |||                                           }|                    | j                   nC# t
          $ r6}t                              d|           t          |j	                  |d}~ww xY w|S )aa  Extract JWT payload claims from request "assertion", per
        `Section 3.1`_.

        :param assertion: assertion string value in the request
        :param resolve_key: function to resolve the sign key
        :return: JWTClaims
        :raise: InvalidClientError

        .. _`Section 3.1`: https://tools.ietf.org/html/rfc7523#section-3.1
        )claims_options)r   zAssertion Error: %rdescriptionN)
r   decoder3   r*   r   r   r   r   r   r7   )r   r%   r&   claimses        r   r   z1JWTBearerClientAssertion.process_assertion_claims7   s    	GZ;t7Q7Q7S7S  F OO4;O//// 	G 	G 	GII+Q///$???QF	G s   AA 
B1BBc                 l    |                     | j        d          r|S t          d| j                   )Ntokenz,The client cannot authenticate with method: r6   )check_endpoint_auth_methodr    r   )r   r   s     r   r   z,JWTBearerClientAssertion.authenticate_clientL   sG    ,,T-DgNN 	M `tG^``
 
 
 	
r   c                       fd}|S )Nc                     |d         } |          }|st          d          |_                            ||           S )Nr-   z)The client does not exist on this server.r6   )r   r   resolve_client_public_key)headerspayload	client_idr   r!   r"   r   s       r   r&   zEJWTBearerClientAssertion.create_resolve_key_func.<locals>.resolve_keyT   s^      I!\),,F ( K    $GN11&'BBBr    )r   r!   r"   r&   s   ``` r   r   z0JWTBearerClientAssertion.create_resolve_key_funcS   s7    	C 	C 	C 	C 	C 	C 	C r   c                     t                      )af  Validate if the given ``jti`` value is used before. Developers
        MUST implement this method::

            def validate_jti(self, claims, jti):
                key = "jti:{}-{}".format(claims["sub"], jti)
                if redis.get(key):
                    return False
                redis.set(key, 1, ex=3600)
                return True
        NotImplementedError)r   r9   r0   s      r   r   z%JWTBearerClientAssertion.validate_jtic   s     "###r   c                     t                      )aN  Resolve the client public key for verifying the JWT signature.
        A client may have many public keys, in this case, we can retrieve it
        via ``kid`` value in headers. Developers MUST implement this method::

            def resolve_client_public_key(self, client, headers):
                return client.public_key
        rF   )r   r   rA   s      r   r@   z2JWTBearerClientAssertion.resolve_client_public_keyp   s     "###r   N)Tr
   )__name__
__module____qualname____doc__r   CLIENT_ASSERTION_TYPEr    r   r'   r3   r   r   r   r   r@   rD   r   r   r   r      s         
 +/   I I I     *
 
 
   $ $ $$ $ $ $ $r   r   c                     | d         |k    S )Nr-   rD   )r9   r,   s     r   r1   r1   {   s    %=Cr   )loggingauthlib.joser   authlib.jose.errorsr   rfc6749r   r   	getLoggerrI   r   r   r1   rD   r   r   <module>rT      s           ) ) ) ) ) ) ( ( ( ( ( (Ig!!l$ l$ l$ l$ l$ l$ l$ l$^         r   