
    "<i                        d Z ddlmZ ddlZddlZddlmZmZ ddlm	Z	 ddl
mZ ddlmZ ddlmZ dd	lmZ dd
lmZ  ee          ZdZedd            Zedd            ZdddddZ G d d          ZdS )a"  JWT token issuance and verification for FastMCP OAuth Proxy.

This module implements the token factory pattern for OAuth proxies, where the proxy
issues its own JWT tokens to clients instead of forwarding upstream provider tokens.
This maintains proper OAuth 2.0 token audience boundaries.
    )annotationsN)Anyoverload)JsonWebToken)	JoseError)hashes)HKDF)
PBKDF2HMAC)
get_loggeri@B high_entropy_materialstrsaltreturnbytesc                    dS )zHDerive JWT signing key from a high-entropy key material and server salt.N )r   r   s     /Users/kimhansen/Desktop/03 Workspace/ceo-agents/chl-effectiveness/mcp-servers/whoop/.venv/lib/python3.11/site-packages/fastmcp/server/auth/jwt_issuer.pyderive_jwt_keyr                low_entropy_materialc                    dS )zGDerive JWT signing key from a low-entropy key material and server salt.Nr   )r   r   s     r   r   r       r   r   )r   r   
str | Nonec                   | |t          d          | pt          t          j                    d|                                d                              |                                           }t          j        |          S |ut          t          j                    d|                                t                                        |                                          }t          j        |          S t          d          )	zWDerive JWT signing key from a high-entropy or low-entropy key material and server salt.NzSEither high_entropy_material or low_entropy_material must be provided, but not both    s   Fernet)	algorithmlengthr   info)key_material)r   r   r   
iterationszEEither high_entropy_material or low_entropy_material must be provided)

ValueErrorr	   r   SHA256encodederivebase64urlsafe_b64encoder
   KDF_ITERATIONS)r   r   r   derived_keypbkdf2s        r   r   r   %   s    (-A-Ma
 
 	
 (moo	
 
 

 &3::<<&
=
= 	 '444'moo%	
 
 

 &299;;&
<
< 	 '///
O  r   c                  6    e Zd ZdZddZ	 dddZddZddZdS )	JWTIssuera  Issues and validates FastMCP-signed JWT tokens using HS256.

    This issuer creates JWT tokens for MCP clients with proper audience claims,
    maintaining OAuth 2.0 token boundaries. Tokens are signed with HS256 using
    a key derived from the upstream client secret.
    issuerr   audiencesigning_keyr   c                Z    || _         || _        || _        t          dg          | _        dS )zInitialize JWT issuer.

        Args:
            issuer: Token issuer (FastMCP server base URL)
            audience: Token audience (typically {base_url}/mcp)
            signing_key: HS256 signing key (32 bytes)
        HS256N)r,   r-   _signing_keyr   _jwt)selfr,   r-   r.   s       r   __init__zJWTIssuer.__init__R   s/      ' '++			r     	client_idscopes	list[str]jti
expires_inintr   c                f   t          t          j                              }ddd}| j        | j        |d                    |          ||z   ||d}| j                            ||| j                  }|                    d          }	t          
                    d||dd	         |d
                    |	S )a  Issue a minimal FastMCP access token.

        FastMCP tokens are reference tokens containing only the minimal claims
        needed for validation and lookup. The JTI maps to the upstream token
        which contains actual user identity and authorization data.

        Args:
            client_id: MCP client ID
            scopes: Token scopes
            jti: Unique token identifier (maps to upstream token)
            expires_in: Token lifetime in seconds

        Returns:
            Signed JWT token
        r0   JWTalgtyp )issaudr6   scopeexpiatr9   utf-8z/Issued access token for client=%s jti=%s exp=%dN   rE   r;   timer,   r-   joinr2   r#   r1   decodeloggerdebug
r3   r6   r7   r9   r:   nowheaderpayloadtoken_bytestokens
             r   issue_access_tokenzJWTIssuer.issue_access_tokend   s    , $)++ //;="XXf%%#
 
 i&&vw8IJJ""7++=GEN		
 	
 	
 r   c           	     h   t          t          j                              }ddd}| j        | j        |d                    |          ||z   ||dd}| j                            ||| j                  }|                    d          }	t          
                    d||d	d
         |d                    |	S )a7  Issue a minimal FastMCP refresh token.

        FastMCP refresh tokens are reference tokens containing only the minimal
        claims needed for validation and lookup. The JTI maps to the upstream
        token which contains actual user identity and authorization data.

        Args:
            client_id: MCP client ID
            scopes: Token scopes
            jti: Unique token identifier (maps to upstream token)
            expires_in: Token lifetime in seconds (should match upstream refresh expiry)

        Returns:
            Signed JWT token
        r0   r=   r>   rA   refresh)rB   rC   r6   rD   rE   rF   r9   	token_userG   z0Issued refresh token for client=%s jti=%s exp=%dNrH   rE   rI   rO   s
             r   issue_refresh_tokenzJWTIssuer.issue_refresh_token   s    , $)++ //;="XXf%%#"	
 	
 i&&vw8IJJ""7++>GEN		
 	
 	
 r   rT   dict[str, Any]c                   	 | j                             || j                  }|                    d          }|r@|t	          j                    k     r)t
                              d           t          d          |                    d          | j        k    r)t
                              d           t          d          |                    d          | j	        k    r)t
                              d           t          d	          t
                              d
|                    d                     |S # t          $ r!}t
                              d|            d}~ww xY w)a3  Verify and decode a FastMCP token.

        Validates JWT signature, expiration, issuer, and audience.

        Args:
            token: JWT token to verify

        Returns:
            Decoded token payload

        Raises:
            JoseError: If token is invalid, expired, or has wrong claims
        rE   zToken expiredzToken has expiredrB   zToken has invalid issuerzInvalid token issuerrC   zToken has invalid audiencezInvalid token audiencez*Token verified successfully for subject=%ssubzToken validation failed: %sN)
r2   rL   r1   getrJ   rM   rN   r   r,   r-   )r3   rT   rR   rE   es        r   verify_tokenzJWTIssuer.verify_token   sL   	i&&ud.?@@G ++e$$C 5sTY[[((_--- 3444 {{5!!T[007888 6777 {{5!!T]229::: 8999LL<gkk%>P>P   N 	 	 	LL6:::	s   D4D7 7
E"EE"N)r,   r   r-   r   r.   r   )r5   )
r6   r   r7   r8   r9   r   r:   r;   r   r   )rT   r   r   rZ   )__name__
__module____qualname____doc__r4   rU   rY   r_   r   r   r   r+   r+   J   sz         , , , ,. - - - - -^. . . .`) ) ) ) ) )r   r+   )r   r   r   r   r   r   )r   r   r   r   r   r   )r   r   r   r   r   r   r   r   )rc   
__future__r   r%   rJ   typingr   r   authlib.joser   authlib.jose.errorsr   cryptography.hazmat.primitivesr   'cryptography.hazmat.primitives.kdf.hkdfr	   )cryptography.hazmat.primitives.kdf.pbkdf2r
   fastmcp.utilities.loggingr   r`   rM   r'   r   r+   r   r   r   <module>rl      sx    # " " " " "                   % % % % % % ) ) ) ) ) ) 1 1 1 1 1 1 8 8 8 8 8 8 @ @ @ @ @ @ 0 0 0 0 0 0	H		 
S S S 
S 
R R R 
R )-'+" " " " " "Jb b b b b b b b b br   