
    !<i:                         d dl Z d dlmZ d dlmZ ddlmZ ddlmZ ddlmZ ddlmZ dd	lm	Z	 dd
lm
Z
 ddlmZ  e j        e          ZdZ G d dee	          ZdS )    N)	JoseError)jwt   )	BaseGrant)InvalidClientError)InvalidGrantError)InvalidRequestError)TokenEndpointMixin)UnauthorizedClientError   sign_jwt_bearer_assertionz+urn:ietf:params:oauth:grant-type:jwt-bearerc                   ~    e Zd ZeZddiddiddidZdZe	 	 	 	 dd            Zd Z	d Z
d	 Zd
 Zd Zd Zd Zd ZdS )JWTBearerGrant	essentialT)issaudexp<   Nc           	      (    t          | ||||||fi |S )Nr   )keyissueraudiencesubject	issued_at
expires_atclaimskwargss           /Users/kimhansen/Desktop/03 Workspace/ceo-agents/chl-effectiveness/mcp-servers/whoop/.venv/lib/python3.11/site-packages/authlib/oauth2/rfc7523/jwt_bearer.pysignzJWTBearerGrant.sign!   s2     )7Iz6
 
MS
 
 	
    c                    	 t          j        || j        | j                  }|                    | j                   nC# t          $ r6}t                              d|           t          |j
                  |d}~ww xY w|S )a#  Extract JWT payload claims from request "assertion", per
        `Section 3.1`_.

        :param assertion: assertion string value in the request
        :return: JWTClaims
        :raise: InvalidGrantError

        .. _`Section 3.1`: https://tools.ietf.org/html/rfc7523#section-3.1
        )claims_options)leewayzAssertion Error: %rdescriptionN)r   decoderesolve_public_keyCLAIMS_OPTIONSvalidateLEEWAYr   logdebugr   r&   )self	assertionr   es       r   process_assertion_claimsz'JWTBearerGrant.process_assertion_claims0   s    	FZ424CV  F OO4;O//// 	F 	F 	FII+Q///#>>>AE	F s   <? 
A?	1A::A?c                 f    |                      |d                   }|                     |||          S )Nr   )resolve_issuer_clientresolve_client_key)r.   headerspayloadclients       r   r(   z!JWTBearerGrant.resolve_public_keyD   s1    ++GEN;;&&vw@@@r!   c                    | j         j                            d          }|st          d          |                     |          }|                     |d                   }t                              d|           |                    | j	                  st          d| j	         d          || j         _        |                                  |                    d          }|rw|                     |          }|st          d	          t                              d
||           |                     ||          st!          d	          || j         _        dS dS )a  The client makes a request to the token endpoint by sending the
        following parameters using the "application/x-www-form-urlencoded"
        format per `Section 2.1`_:

        grant_type
             REQUIRED.  Value MUST be set to
             "urn:ietf:params:oauth:grant-type:jwt-bearer".

        assertion
             REQUIRED.  Value MUST contain a single JWT.

        scope
            OPTIONAL.

        The following example demonstrates an access token request with a JWT
        as an authorization grant:

        .. code-block:: http

            POST /token.oauth2 HTTP/1.1
            Host: as.example.com
            Content-Type: application/x-www-form-urlencoded

            grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer
            &assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6IjE2In0.
            eyJpc3Mi[...omitted for brevity...].
            J9l-ZhwP[...omitted for brevity...]

        .. _`Section 2.1`: https://tools.ietf.org/html/rfc7523#section-2.1
        r/   zMissing 'assertion' in requestr   zValidate token request of %sz0The client is not authorized to use 'grant_type='subz Invalid 'sub' value in assertionr%   z'Check client(%s) permission to User(%s)z,Client has no permission to access user dataN)requestformgetr	   r1   r3   r,   r-   check_grant_type
GRANT_TYPEr   r7   validate_requested_scopeauthenticate_userr   has_granted_permissionr   user)r.   r/   r   r7   r   rC   s         r   validate_token_requestz%JWTBearerGrant.validate_token_requestH   sw   > L%))+66	 	H%&FGGG..y99++F5M::		0&999&&t77 	)U4?UUU   %%%'''**U## 
	%))'22D X'4VWWWWII?NNN..vt<< ( N    !%DL
	% 
	%r!   c                     |                      | j        j        j        | j        j        d          }t
                              d|| j        j                   |                     |           d|| j	        fS )zZIf valid and authorized, the authorization server issues an access
        token.
        F)scoperC   include_refresh_tokenzIssue token %r to %r   )
generate_tokenr;   r6   rF   rC   r,   r-   r7   
save_tokenTOKEN_RESPONSE_HEADER)r.   tokens     r   create_token_responsez$JWTBearerGrant.create_token_response   st     ##,&,""' $ 
 

 			(%1DEEEE4555r!   c                     t                      )a1  Fetch client via "iss" in assertion claims. Developers MUST
        implement this method in subclass, e.g.::

            def resolve_issuer_client(self, issuer):
                return Client.query_by_iss(issuer)

        :param issuer: "iss" value in assertion
        :return: Client instance
        NotImplementedError)r.   r   s     r   r3   z$JWTBearerGrant.resolve_issuer_client        "###r!   c                     t                      )au  Resolve client key to decode assertion data. Developers MUST
        implement this method in subclass. For instance, there is a
        "jwks" column on client table, e.g.::

            def resolve_client_key(self, client, headers, payload):
                # from authlib.jose import JsonWebKey

                key_set = JsonWebKey.import_key_set(client.jwks)
                return key_set.find_by_kid(headers["kid"])

        :param client: instance of OAuth client model
        :param headers: headers part of the JWT
        :param payload: payload part of the JWT
        :return: ``authlib.jose.Key`` instance
        rO   )r.   r7   r5   r6   s       r   r4   z!JWTBearerGrant.resolve_client_key   s      "###r!   c                     t                      )a%  Authenticate user with the given assertion claims. Developers MUST
        implement it in subclass, e.g.::

            def authenticate_user(self, subject):
                return User.get_by_sub(subject)

        :param subject: "sub" value in claims
        :return: User instance
        rO   )r.   r   s     r   rA   z JWTBearerGrant.authenticate_user   rQ   r!   c                     t                      )a  Check if the client has permission to access the given user's resource.
        Developers MUST implement it in subclass, e.g.::

            def has_granted_permission(self, client, user):
                permission = ClientUserGrant.query(client=client, user=user)
                return permission.granted

        :param client: instance of OAuth client model
        :param user: instance of User model
        :return: bool
        rO   )r.   r7   rC   s      r   rB   z%JWTBearerGrant.has_granted_permission   s     "###r!   )NNNN)__name__
__module____qualname__JWT_BEARER_GRANT_TYPEr?   r)   r+   staticmethodr    r1   r(   rD   rM   r3   r4   rA   rB    r!   r   r   r      s        &J
 T"T"T" N F
 
 
 
 \
  (A A A:% :% :%x6 6 6
$ 
$ 
$$ $ $$
$ 
$ 
$$ $ $ $ $r!   r   )loggingauthlib.joser   r   rfc6749r   r   r   r	   r
   r   r/   r   	getLoggerrU   r,   rX   r   rZ   r!   r   <module>r_      s	    " " " " " "             ( ( ( ( ( ( ' ' ' ' ' ' ) ) ) ) ) ) ( ( ( ( ( ( - - - - - - 0 0 0 0 0 0g!!E u$ u$ u$ u$ u$Y 2 u$ u$ u$ u$ u$r!   