§
    !¾<iJ  ã                   ó   — d Z ddlZddlmZmZ ddlmZ ddlmZ  ej	        e
¦  «        Z G d„ de¦  «        Z G d„ d	¦  «        ZdS )
z3DNS rebinding protection for MCP server transports.é    N)Ú	BaseModelÚField)ÚRequest)ÚResponsec                   ó˜   — e Zd ZU dZ edd¬¦  «        Zeed<    eg d¬¦  «        Ze	e
         ed<    eg d¬¦  «        Ze	e
         ed	<   d
S )ÚTransportSecuritySettingszSettings for MCP transport security features.

    These settings help protect against DNS rebinding attacks by validating
    incoming request headers.
    Tz<Enable DNS rebinding protection (recommended for production))ÚdefaultÚdescriptionÚenable_dns_rebinding_protectionz^List of allowed Host header values. Only applies when enable_dns_rebinding_protection is True.Úallowed_hostsz`List of allowed Origin header values. Only applies when enable_dns_rebinding_protection is True.Úallowed_originsN)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   r   ÚboolÚ__annotations__r   ÚlistÚstrr   © ó    ú˜/Users/kimhansen/Desktop/03 Workspace/ceo-agents/chl-effectiveness/mcp-servers/whoop/.venv/lib/python3.11/site-packages/mcp/server/transport_security.pyr   r      sº   € € € € € € ðð ð -2¨EØØRð-ñ -ô -Ð# Tð ð ñ ð
  %˜uØð5ð ñ  ô  €M4˜”9ð ð ñ ð "' Øð5ð"ñ "ô "€OT˜#”Yð ð ñ ð ð r   r   c                   ó„   — e Zd ZdZddedz  fd„Zdedz  defd„Zdedz  defd	„Z	d
edz  defd„Z
ddedededz  fd„ZdS )ÚTransportSecurityMiddlewarezKMiddleware to enforce DNS rebinding protection for MCP transport endpoints.NÚsettingsc                 ó4   — |pt          d¬¦  «        | _        d S )NF)r   )r   r   )Úselfr   s     r   Ú__init__z$TransportSecurityMiddleware.__init__(   s!   € ð !ÐdÕ$=Ð^cÐ$dÑ$dÔ$dˆŒˆˆr   ÚhostÚreturnc                 ó.  — |st                                d¦  «         dS || j        j        v rdS | j        j        D ]<}|                     d¦  «        r%|dd…         }|                     |dz   ¦  «        r dS Œ=t                                d|› ¦  «         dS )	z0Validate the Host header against allowed values.zMissing Host header in requestFTú:*Néþÿÿÿú:zInvalid Host header: )ÚloggerÚwarningr   r   ÚendswithÚ
startswith)r   r   ÚallowedÚ	base_hosts       r   Ú_validate_hostz*TransportSecurityMiddleware._validate_host-   s²   € àð 	ÝNŠNÐ;Ñ<Ô<Ð<Ø5ð 4”=Ô.Ð.Ð.Ø4ð ”}Ô2ð 	 ð 	 ˆGØ×Ò Ñ%Ô%ð  à# C R CœL	à—?’? 9¨s¡?Ñ3Ô3ð  Ø˜4˜4øåŠÐ5¨tÐ5Ð5Ñ6Ô6Ð6Øˆur   Úoriginc                 óú   — |sdS || j         j        v rdS | j         j        D ]<}|                     d¦  «        r%|dd…         }|                     |dz   ¦  «        r dS Œ=t                               d|› ¦  «         dS )z2Validate the Origin header against allowed values.Tr"   Nr#   r$   zInvalid Origin header: F)r   r   r'   r(   r%   r&   )r   r,   r)   Úbase_origins       r   Ú_validate_originz,TransportSecurityMiddleware._validate_originC   s¤   € ð ð 	Ø4ð T”]Ô2Ð2Ð2Ø4ð ”}Ô4ð 	 ð 	 ˆGØ×Ò Ñ%Ô%ð  à% c r cœlà×$Ò$ [°3Ñ%6Ñ7Ô7ð  Ø˜4˜4øåŠÐ9°Ð9Ð9Ñ:Ô:Ð:Øˆur   Úcontent_typec                 óÎ   — |st                                d¦  «         dS |                     ¦   «                              d¦  «        st                                d|› ¦  «         dS dS )z3Validate the Content-Type header for POST requests.z+Missing Content-Type header in POST requestFzapplication/jsonzInvalid Content-Type header: T)r%   r&   Úlowerr(   )r   r0   s     r   Ú_validate_content_typez2TransportSecurityMiddleware._validate_content_typeY   sl   € àð 	ÝNŠNÐHÑIÔIÐIØ5ð ×!Ò!Ñ#Ô#×.Ò.Ð/AÑBÔBð 	ÝNŠNÐI¸<ÐIÐIÑJÔJÐJØ5àˆtr   FÚrequestÚis_postc              ƒ   óª  K  — |r@|j                              d¦  «        }|                      |¦  «        st          dd¬¦  «        S | j        j        sdS |j                              d¦  «        }|                      |¦  «        st          dd¬¦  «        S |j                              d	¦  «        }|                      |¦  «        st          d
d¬¦  «        S dS )z•Validate request headers for DNS rebinding protection.

        Returns None if validation passes, or an error Response if validation fails.
        zcontent-typezInvalid Content-Type headeri  )Ústatus_codeNr   zInvalid Host headeri¥  r,   zInvalid Origin headeri“  )ÚheadersÚgetr3   r   r   r   r+   r/   )r   r4   r5   r0   r   r,   s         r   Úvalidate_requestz,TransportSecurityMiddleware.validate_requestf   sî   è è € ð ð 	PØ"œ?×.Ò.¨~Ñ>Ô>ˆLØ×.Ò.¨|Ñ<Ô<ð PÝÐ =È3ÐOÑOÔOÐOð Œ}Ô<ð 	Ø4ð Œ×"Ò" 6Ñ*Ô*ˆØ×"Ò" 4Ñ(Ô(ð 	DÝÐ1¸sÐCÑCÔCÐCð ”×$Ò$ XÑ.Ô.ˆØ×$Ò$ VÑ,Ô,ð 	FÝÐ3ÀÐEÑEÔEÐEàˆtr   )N)F)r   r   r   r   r   r   r   r   r+   r/   r3   r   r   r:   r   r   r   r   r   %   sí   € € € € € ØUÐUðeð eÐ!:¸TÑ!Að eð eð eð eð
 3¨¡:ð °$ð ð ð ð ð, s¨T¡zð °dð ð ð ð ð,°3¸±:ð À$ð ð ð ð ðð ¨gð Àð ÐQYÐ\`ÑQ`ð ð ð ð ð ð r   r   )r   ÚloggingÚpydanticr   r   Ústarlette.requestsr   Ústarlette.responsesr   Ú	getLoggerr   r%   r   r   r   r   r   ú<module>r@      sÈ   ðØ 9Ð 9à €€€à %Ð %Ð %Ð %Ð %Ð %Ð %Ð %Ø &Ð &Ð &Ð &Ð &Ð &Ø (Ð (Ð (Ð (Ð (Ð (à	ˆÔ	˜8Ñ	$Ô	$€ðð ð ð ð  	ñ ô ð ð2Zð Zð Zð Zð Zñ Zô Zð Zð Zð Zr   