
    "<ih#                        d Z ddlmZ ddlZddlmZmZmZ ddlm	Z	m
Z
 ddlmZ ddlmZ ddlmZmZ dd	lmZ dd
lmZ ddlmZ ddlmZ ddlmZmZ  ee          Z G d de	          Z G d de          Z dS )a  Scalekit authentication provider for FastMCP.

This module provides ScalekitProvider - a complete authentication solution that integrates
with Scalekit's OAuth 2.1 and OpenID Connect services, supporting Resource Server
authentication for seamless MCP client authentication.
    )annotationsN)
AnyHttpUrlfield_validatormodel_validator)BaseSettingsSettingsConfigDict)JSONResponse)Route)RemoteAuthProviderTokenVerifier)JWTVerifier)ENV_FILEparse_scopes)
get_logger)NotSetNotSetTc                      e Zd ZU  eded          Zded<   ded<   dZd	ed
<   dZd	ed<   dZ	ded<    e
dd          edd                        Z ed          d             ZdS )ScalekitProviderSettings%FASTMCP_SERVER_AUTH_SCALEKITPROVIDER_ignore)
env_prefixenv_fileextrar   environment_urlstrresource_idNzAnyHttpUrl | Nonebase_urlmcp_urlzlist[str] | Nonerequired_scopesbefore)modevalueobjectc                     t          |          S Nr   )clsr#   s     /Users/kimhansen/Desktop/03 Workspace/ceo-agents/chl-effectiveness/mcp-servers/whoop/.venv/lib/python3.11/site-packages/fastmcp/server/auth/providers/scalekit.py_parse_scopesz&ScalekitProviderSettings._parse_scopes'   s     E"""    afterc                    | j         p| j        }|d}t          |          t                              | d|           | S )Nz@Either base_url or mcp_url must be provided for ScalekitProviderr   )r   r   
ValueErrorr$   __setattr__)selfresolvedmsgs      r(   _resolve_base_urlz*ScalekitProviderSettings._resolve_base_url,   sD    =0DLTCS//!4X666r*   )r#   r$   )__name__
__module____qualname__r   r   model_config__annotations__r   r   r    r   classmethodr)   r   r2    r*   r(   r   r      s         %%:  L  "&H&&&&!%G%%%%(,O,,,,_&X666# # # [ 76# _'"""  #"  r*   r   c                  F     e Zd ZdZeeeeeeddd fdZ	 dd fdZ xZS )ScalekitProvidera  Scalekit resource server provider for OAuth 2.1 authentication.

    This provider implements Scalekit integration using resource server pattern.
    FastMCP acts as a protected resource server that validates access tokens issued
    by Scalekit's authorization server.

    IMPORTANT SETUP REQUIREMENTS:

    1. Create an MCP Server in Scalekit Dashboard:
       - Go to your [Scalekit Dashboard](https://app.scalekit.com/)
       - Navigate to MCP Servers section
       - Register a new MCP Server with appropriate scopes
       - Ensure the Resource Identifier matches exactly what you configure as MCP URL
       - Note the Resource ID

    2. Environment Configuration:
       - Set SCALEKIT_ENVIRONMENT_URL (e.g., https://your-env.scalekit.com)
       - Set SCALEKIT_RESOURCE_ID from your created resource
       - Set BASE_URL to your FastMCP server's public URL

    For detailed setup instructions, see:
    https://docs.scalekit.com/mcp/overview/

    Example:
        ```python
        from fastmcp.server.auth.providers.scalekit import ScalekitProvider

        # Create Scalekit resource server provider
        scalekit_auth = ScalekitProvider(
            environment_url="https://your-env.scalekit.com",
            resource_id="sk_resource_...",
            base_url="https://your-fastmcp-server.com",
        )

        # Use with FastMCP
        mcp = FastMCP("My App", auth=scalekit_auth)
        ```
    N)r   	client_idr   r   r   r    token_verifierr   AnyHttpUrl | str | NotSetTr<   str | NotSetTr   r   r   r    list[str] | NotSetTr=   TokenVerifier | Nonec          	        |t           u}t                              d |||||d                                D                       }	|	j        t
                              d           |rt
                              d           t          |	j                  	                    d          | _        |	j
        | _
        |	j        pg | _        t          |	j                  }
t
                              d| j        | j
        |
| j                   |Wt
                              d| j         d	| j        | j                   t          | j         d	| j        d
| j        pd          }nt
                              d           t                                          |t#          | j         d| j
                   g|
           dS )a  Initialize Scalekit resource server provider.

        Args:
            environment_url: Your Scalekit environment URL (e.g., "https://your-env.scalekit.com")
            resource_id: Your Scalekit resource ID
            base_url: Public URL of this FastMCP server
            required_scopes: Optional list of scopes that must be present in tokens
            token_verifier: Optional token verifier. If None, creates JWT verifier for Scalekit
        c                ,    i | ]\  }}|t           u||S r9   )r   ).0kvs      r(   
<dictcomp>z-ScalekitProvider.__init__.<locals>.<dictcomp>v   s3     
 
 
Aq F?? 1 #??r*   )r   r   r   r   r    NztScalekitProvider parameter 'mcp_url' is deprecated and will be removed in a future release. Rename it to 'base_url'.zScalekitProvider no longer requires 'client_id'. The parameter is accepted only for backward compatibility and will be removed in a future release./z_Initializing ScalekitProvider: environment_url=%s resource_id=%s base_url=%s required_scopes=%szSCreating default JWTVerifier for Scalekit: jwks_uri=%s issuer=%s required_scopes=%sz/keysRS256)jwks_uriissuer	algorithmr    z0Using custom token verifier for ScalekitProviderz/resources/)r=   authorization_serversr   )r   r   model_validateitemsr   loggerwarningr   r   rstripr   r    r   debugr   super__init__r   )r/   r   r<   r   r   r   r    r=   legacy_client_idsettingsbase_url_value	__class__s              r(   rU   zScalekitProvider.__init___   s   ( %F2+::
 
 (7#. (&'6  %''
 
 

 
 'NN+  
  	NNI  
  #8#;<<CCCHH#/'7=2X.//m  	
 	
 	
 !LLe'...$$	   ) 0777+! $ 4 <	  NN LLKLLL 	)d2QQt?OQQRR# $ 	 	
 	
 	
 	
 	
r*   mcp_path
str | Nonereturnlist[Route]c                     t                                          |          }t                              d| j                    fd}|                    t          d|dg                     |S )a  Get OAuth routes including Scalekit authorization server metadata forwarding.

        This returns the standard protected resource routes plus an authorization server
        metadata endpoint that forwards Scalekit's OAuth metadata to clients.

        Args:
            mcp_path: The path where the MCP endpoint is mounted (e.g., "/mcp")
                This is used to advertise the resource URL in metadata.
        z>Preparing Scalekit metadata routes: mcp_path=%s resource_id=%sc                  K   	 j          dj         }t                              d|           t	          j                    4 d{V }|                    |           d{V }|                                 |                                }t                              dt          |
                                                     t          |          cddd          d{V  S # 1 d{V swxY w Y   dS # t          $ r>}t                              d|            t          dd| dd	          cY d}~S d}~ww xY w)
zQForward Scalekit OAuth authorization server metadata with FastMCP customizations.z2/.well-known/oauth-authorization-server/resources/z1Fetching Scalekit OAuth metadata: metadata_url=%sNz8Scalekit metadata fetched successfully: metadata_keys=%sz#Failed to fetch Scalekit metadata: server_error)errorerror_descriptioni  )status_code)r   r   rP   rS   httpxAsyncClientgetraise_for_statusjsonlistkeysr	   	Exceptionra   )requestmetadata_urlclientresponsemetadataer/   s         r(   #oauth_authorization_server_metadatazHScalekitProvider.get_routes.<locals>.oauth_authorization_server_metadata   s     "&"6||jnjz||G   !,.. 2 2 2 2 2 2 2&%+ZZ%=%=======H--///'}}HLLRX]]__--   (112 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2    F1FFGGG#!/-VST-V-V  !$        sC   AC< 
BC)C< )
C33C< 6C37C< <
E3D?9E?Ez'/.well-known/oauth-authorization-serverGET)endpointmethods)rT   
get_routesrP   rS   r   appendr
   )r/   rZ   routesrr   rY   s   `   r(   rv   zScalekitProvider.get_routes   s     ##H--L	
 	
 	
	 	 	 	 	6 	9<  	
 	
 	
 r*   )r   r>   r<   r?   r   r?   r   r>   r   r>   r    r@   r=   rA   r&   )rZ   r[   r\   r]   )r3   r4   r5   __doc__r   rU   rv   __classcell__)rY   s   @r(   r;   r;   7   s        % %T 7=#)%+/5.4/5/3U
 U
 U
 U
 U
 U
 U
 U
r  $8 8 8 8 8 8 8 8 8 8 8r*   r;   )!ry   
__future__r   rd   pydanticr   r   r   pydantic_settingsr   r   starlette.responsesr	   starlette.routingr
   fastmcp.server.authr   r   !fastmcp.server.auth.providers.jwtr   fastmcp.settingsr   fastmcp.utilities.authr   fastmcp.utilities.loggingr   fastmcp.utilities.typesr   r   r3   rP   r   r;   r9   r*   r(   <module>r      sv    # " " " " "  A A A A A A A A A A > > > > > > > > , , , , , , # # # # # # A A A A A A A A 9 9 9 9 9 9 % % % % % % / / / / / / 0 0 0 0 0 0 3 3 3 3 3 3 3 3	H		    |   :w w w w w) w w w w wr*   