@steerable/runtime-darwin-arm64 0.0.0-stage → 0.9.1

package/python-runtime/python/lib/python3.12/site-packages/mcp/server/auth/provider.py

@@ -0,0 +1,314 @@
+from dataclasses import dataclass
+from typing import Any, Generic, Literal, Protocol, TypeVar
+from urllib.parse import parse_qs, urlencode, urlparse, urlunparse
+
+from pydantic import AnyUrl, BaseModel
+
+from mcp.shared.auth import OAuthClientInformationFull, OAuthToken
+
+
+class AuthorizationParams(BaseModel):
+    state: str | None
+    scopes: list[str] | None
+    code_challenge: str
+    redirect_uri: AnyUrl
+    redirect_uri_provided_explicitly: bool
+    resource: str | None = None  # RFC 8707 resource indicator
+
+
+class AuthorizationCode(BaseModel):
+    code: str
+    scopes: list[str]
+    expires_at: float
+    client_id: str
+    code_challenge: str
+    redirect_uri: AnyUrl
+    redirect_uri_provided_explicitly: bool
+    resource: str | None = None  # RFC 8707 resource indicator
+    subject: str | None = None  # resource owner; propagate to the issued AccessToken
+
+
+class RefreshToken(BaseModel):
+    token: str
+    client_id: str
+    scopes: list[str]
+    expires_at: int | None = None
+    resource: str | None = None  # RFC 8707 resource indicator; propagate to refreshed AccessTokens
+    subject: str | None = None  # resource owner; propagate to refreshed AccessTokens
+
+
+class AccessToken(BaseModel):
+    token: str
+    client_id: str
+    scopes: list[str]
+    expires_at: int | None = None
+    resource: str | None = None  # RFC 8707 resource indicator
+    subject: str | None = None  # RFC 7662/9068 `sub`: resource owner; unique only per issuer
+    claims: dict[str, Any] | None = None  # additional claims (e.g. `iss`, `act`)
+
+
+RegistrationErrorCode = Literal[
+    "invalid_redirect_uri",
+    "invalid_client_metadata",
+    "invalid_software_statement",
+    "unapproved_software_statement",
+]
+
+
+@dataclass(frozen=True)
+class RegistrationError(Exception):
+    error: RegistrationErrorCode
+    error_description: str | None = None
+
+
+AuthorizationErrorCode = Literal[
+    "invalid_request",
+    "unauthorized_client",
+    "access_denied",
+    "unsupported_response_type",
+    "invalid_scope",
+    "server_error",
+    "temporarily_unavailable",
+]
+
+
+@dataclass(frozen=True)
+class AuthorizeError(Exception):
+    error: AuthorizationErrorCode
+    error_description: str | None = None
+
+
+TokenErrorCode = Literal[
+    "invalid_request",
+    "invalid_client",
+    "invalid_grant",
+    "unauthorized_client",
+    "unsupported_grant_type",
+    "invalid_scope",
+]
+
+
+@dataclass(frozen=True)
+class TokenError(Exception):
+    error: TokenErrorCode
+    error_description: str | None = None
+
+
+class TokenVerifier(Protocol):
+    """Protocol for verifying bearer tokens."""
+
+    async def verify_token(self, token: str) -> AccessToken | None:
+        """Verify a bearer token and return access info if valid.
+
+        Set `AccessToken.resource` to the resource the token was issued for (its RFC 8707
+        resource indicator / `aud`; for a list, the entry equal to the server's
+        `AuthSettings.resource_server_url`). With `AuthSettings.validate_token_resource` the
+        bearer middleware then refuses any token whose resource is not `resource_server_url`;
+        without it, confirming the token was issued for this server (for example by passing the
+        expected audience to your JWT library) is up to the verifier.
+        """
+
+
+# NOTE: FastMCP doesn't render any of these types in the user response, so it's
+# OK to add fields to subclasses which should not be exposed externally.
+AuthorizationCodeT = TypeVar("AuthorizationCodeT", bound=AuthorizationCode)
+RefreshTokenT = TypeVar("RefreshTokenT", bound=RefreshToken)
+AccessTokenT = TypeVar("AccessTokenT", bound=AccessToken)
+
+
+class OAuthAuthorizationServerProvider(Protocol, Generic[AuthorizationCodeT, RefreshTokenT, AccessTokenT]):
+    async def get_client(self, client_id: str) -> OAuthClientInformationFull | None:
+        """
+        Retrieves client information by client ID.
+
+        Implementors MAY raise NotImplementedError if dynamic client registration is
+        disabled in ClientRegistrationOptions.
+
+        Args:
+            client_id: The ID of the client to retrieve.
+
+        Returns:
+            The client information, or None if the client does not exist.
+        """
+
+    async def register_client(self, client_info: OAuthClientInformationFull) -> None:
+        """
+        Saves client information as part of registering it.
+
+        Implementors MAY raise NotImplementedError if dynamic client registration is
+        disabled in ClientRegistrationOptions.
+
+        Args:
+            client_info: The client metadata to register.
+
+        Raises:
+            RegistrationError: If the client metadata is invalid.
+        """
+
+    async def authorize(self, client: OAuthClientInformationFull, params: AuthorizationParams) -> str:
+        """
+        Called as part of the /authorize endpoint, and returns a URL that the client
+        will be redirected to.
+        Many MCP implementations will redirect to a third-party provider to perform
+        a second OAuth exchange with that provider. In this sort of setup, the client
+        has an OAuth connection with the MCP server, and the MCP server has an OAuth
+        connection with the 3rd-party provider. At the end of this flow, the client
+        should be redirected to the redirect_uri from params.redirect_uri.
+
+        +--------+     +------------+     +-------------------+
+        |        |     |            |     |                   |
+        | Client | --> | MCP Server | --> | 3rd Party OAuth   |
+        |        |     |            |     | Server            |
+        +--------+     +------------+     +-------------------+
+                            |   ^                  |
+        +------------+      |   |                  |
+        |            |      |   |    Redirect      |
+        |redirect_uri|<-----+   +------------------+
+        |            |
+        +------------+
+
+        Implementations will need to define another handler on the MCP server return
+        flow to perform the second redirect, and generate and store an authorization
+        code as part of completing the OAuth authorization step.
+
+        Implementations SHOULD generate an authorization code with at least 160 bits of
+        entropy,
+        and MUST generate an authorization code with at least 128 bits of entropy.
+        See https://datatracker.ietf.org/doc/html/rfc6749#section-10.10.
+
+        Args:
+            client: The client requesting authorization.
+            params: The parameters of the authorization request.
+
+        Returns:
+            A URL to redirect the client to for authorization.
+
+        Raises:
+            AuthorizeError: If the authorization request is invalid.
+        """
+        ...
+
+    async def load_authorization_code(
+        self, client: OAuthClientInformationFull, authorization_code: str
+    ) -> AuthorizationCodeT | None:
+        """
+        Loads an AuthorizationCode by its code.
+
+        Args:
+            client: The client that requested the authorization code.
+            authorization_code: The authorization code to get the challenge for.
+
+        Returns:
+            The AuthorizationCode, or None if not found
+        """
+        ...
+
+    async def exchange_authorization_code(
+        self, client: OAuthClientInformationFull, authorization_code: AuthorizationCodeT
+    ) -> OAuthToken:
+        """
+        Exchanges an authorization code for an access token and refresh token.
+
+        Args:
+            client: The client exchanging the authorization code.
+            authorization_code: The authorization code to exchange.
+
+        Returns:
+            The OAuth token, containing access and refresh tokens.
+
+        Raises:
+            TokenError: If the request is invalid
+        """
+        ...
+
+    async def load_refresh_token(self, client: OAuthClientInformationFull, refresh_token: str) -> RefreshTokenT | None:
+        """
+        Loads a RefreshToken by its token string.
+
+        Args:
+            client: The client that is requesting to load the refresh token.
+            refresh_token: The refresh token string to load.
+
+        Returns:
+            The RefreshToken object if found, or None if not found.
+        """
+        ...
+
+    async def exchange_refresh_token(
+        self,
+        client: OAuthClientInformationFull,
+        refresh_token: RefreshTokenT,
+        scopes: list[str],
+    ) -> OAuthToken:
+        """
+        Exchanges a refresh token for an access token and refresh token.
+
+        Implementations SHOULD rotate both the access token and refresh token.
+
+        Args:
+            client: The client exchanging the refresh token.
+            refresh_token: The refresh token to exchange.
+            scopes: Optional scopes to request with the new access token.
+
+        Returns:
+            The OAuth token, containing access and refresh tokens.
+
+        Raises:
+            TokenError: If the request is invalid
+        """
+        ...
+
+    async def load_access_token(self, token: str) -> AccessTokenT | None:
+        """
+        Loads an access token by its token.
+
+        Args:
+            token: The access token to verify.
+
+        Returns:
+            The AuthInfo, or None if the token is invalid.
+        """
+
+    async def revoke_token(
+        self,
+        token: AccessTokenT | RefreshTokenT,
+    ) -> None:
+        """
+        Revokes an access or refresh token.
+
+        If the given token is invalid or already revoked, this method should do nothing.
+
+        Implementations SHOULD revoke both the access token and its corresponding
+        refresh token, regardless of which of the access token or refresh token is
+        provided.
+
+        Args:
+            token: the token to revoke
+        """
+
+
+def construct_redirect_uri(redirect_uri_base: str, **params: str | None) -> str:
+    parsed_uri = urlparse(redirect_uri_base)
+    query_params = [(k, v) for k, vs in parse_qs(parsed_uri.query).items() for v in vs]
+    for k, v in params.items():
+        if v is not None:
+            query_params.append((k, v))
+
+    redirect_uri = urlunparse(parsed_uri._replace(query=urlencode(query_params)))
+    return redirect_uri
+
+
+class ProviderTokenVerifier(TokenVerifier):
+    """Token verifier that uses an OAuthAuthorizationServerProvider.
+
+    This is provided for backwards compatibility with existing auth_server_provider
+    configurations. For new implementations using AS/RS separation, consider using
+    the TokenVerifier protocol with a dedicated implementation like IntrospectionTokenVerifier.
+    """
+
+    def __init__(self, provider: "OAuthAuthorizationServerProvider[AuthorizationCode, RefreshToken, AccessToken]"):
+        self.provider = provider
+
+    async def verify_token(self, token: str) -> AccessToken | None:
+        """Verify token using the provider's load_access_token method."""
+        return await self.provider.load_access_token(token)

package/python-runtime/python/lib/python3.12/site-packages/mcp/server/auth/routes.py

@@ -0,0 +1,254 @@
+from collections.abc import Awaitable, Callable
+from typing import Any
+from urllib.parse import urlparse
+
+from pydantic import AnyHttpUrl
+from starlette.middleware.cors import CORSMiddleware
+from starlette.requests import Request
+from starlette.responses import Response
+from starlette.routing import Route, request_response  # type: ignore
+from starlette.types import ASGIApp
+
+from mcp.server.auth.handlers.authorize import AuthorizationHandler
+from mcp.server.auth.handlers.metadata import MetadataHandler
+from mcp.server.auth.handlers.register import RegistrationHandler
+from mcp.server.auth.handlers.revoke import RevocationHandler
+from mcp.server.auth.handlers.token import TokenHandler
+from mcp.server.auth.middleware.client_auth import ClientAuthenticator
+from mcp.server.auth.provider import OAuthAuthorizationServerProvider
+from mcp.server.auth.settings import ClientRegistrationOptions, RevocationOptions
+from mcp.server.streamable_http import MCP_PROTOCOL_VERSION_HEADER
+from mcp.server.transport_security import DEFAULT_MAX_REQUEST_BODY_SIZE, RequestBodyLimitMiddleware
+from mcp.shared.auth import OAuthMetadata
+
+
+def validate_issuer_url(url: AnyHttpUrl):
+    """
+    Validate that the issuer URL meets OAuth 2.0 requirements.
+
+    Args:
+        url: The issuer URL to validate
+
+    Raises:
+        ValueError: If the issuer URL is invalid
+    """
+
+    # RFC 8414 requires HTTPS, but we allow localhost HTTP for testing
+    if (
+        url.scheme != "https"
+        and url.host != "localhost"
+        and (url.host is not None and not url.host.startswith("127.0.0.1"))
+    ):
+        raise ValueError("Issuer URL must be HTTPS")  # pragma: no cover
+
+    # No fragments or query parameters allowed
+    if url.fragment:
+        raise ValueError("Issuer URL must not have a fragment")  # pragma: no cover
+    if url.query:
+        raise ValueError("Issuer URL must not have a query string")  # pragma: no cover
+
+
+AUTHORIZATION_PATH = "/authorize"
+TOKEN_PATH = "/token"
+REGISTRATION_PATH = "/register"
+REVOCATION_PATH = "/revoke"
+
+
+def _cors(app: ASGIApp, allow_methods: list[str]) -> ASGIApp:
+    return CORSMiddleware(
+        app=app,
+        allow_origins="*",
+        allow_methods=allow_methods,
+        allow_headers=[MCP_PROTOCOL_VERSION_HEADER],
+    )
+
+
+def _body_limited(app: ASGIApp) -> ASGIApp:
+    return RequestBodyLimitMiddleware(app, DEFAULT_MAX_REQUEST_BODY_SIZE)
+
+
+def cors_middleware(
+    handler: Callable[[Request], Response | Awaitable[Response]],
+    allow_methods: list[str],
+) -> ASGIApp:
+    return _cors(request_response(handler), allow_methods)
+
+
+def create_auth_routes(
+    provider: OAuthAuthorizationServerProvider[Any, Any, Any],
+    issuer_url: AnyHttpUrl,
+    service_documentation_url: AnyHttpUrl | None = None,
+    client_registration_options: ClientRegistrationOptions | None = None,
+    revocation_options: RevocationOptions | None = None,
+) -> list[Route]:
+    validate_issuer_url(issuer_url)
+
+    client_registration_options = client_registration_options or ClientRegistrationOptions()
+    revocation_options = revocation_options or RevocationOptions()
+    metadata = build_metadata(
+        issuer_url,
+        service_documentation_url,
+        client_registration_options,
+        revocation_options,
+    )
+    client_authenticator = ClientAuthenticator(provider)
+    token_handler = TokenHandler(provider, client_authenticator)
+
+    # Create routes
+    # Allow CORS requests for endpoints meant to be hit by the OAuth client
+    # (with the client secret). This is intended to support things like MCP Inspector,
+    # where the client runs in a web browser. CORS is the outermost wrapper so that
+    # responses produced by inner layers (such as a 413) still carry CORS headers.
+    routes = [
+        Route(
+            "/.well-known/oauth-authorization-server",
+            endpoint=cors_middleware(
+                MetadataHandler(metadata).handle,
+                ["GET", "OPTIONS"],
+            ),
+            methods=["GET", "OPTIONS"],
+        ),
+        Route(
+            AUTHORIZATION_PATH,
+            # do not allow CORS for authorization endpoint;
+            # clients should just redirect to this
+            endpoint=_body_limited(request_response(AuthorizationHandler(provider).handle)),
+            methods=["GET", "POST"],
+        ),
+        Route(
+            TOKEN_PATH,
+            endpoint=_cors(_body_limited(request_response(token_handler.handle)), ["POST", "OPTIONS"]),
+            methods=["POST", "OPTIONS"],
+        ),
+    ]
+
+    if client_registration_options.enabled:  # pragma: no branch
+        registration_handler = RegistrationHandler(
+            provider,
+            options=client_registration_options,
+        )
+        routes.append(
+            Route(
+                REGISTRATION_PATH,
+                endpoint=_cors(_body_limited(request_response(registration_handler.handle)), ["POST", "OPTIONS"]),
+                methods=["POST", "OPTIONS"],
+            )
+        )
+
+    if revocation_options.enabled:  # pragma: no branch
+        revocation_handler = RevocationHandler(provider, client_authenticator)
+        routes.append(
+            Route(
+                REVOCATION_PATH,
+                endpoint=_cors(_body_limited(request_response(revocation_handler.handle)), ["POST", "OPTIONS"]),
+                methods=["POST", "OPTIONS"],
+            )
+        )
+
+    return routes
+
+
+def build_metadata(
+    issuer_url: AnyHttpUrl,
+    service_documentation_url: AnyHttpUrl | None,
+    client_registration_options: ClientRegistrationOptions,
+    revocation_options: RevocationOptions,
+) -> OAuthMetadata:
+    authorization_url = AnyHttpUrl(str(issuer_url).rstrip("/") + AUTHORIZATION_PATH)
+    token_url = AnyHttpUrl(str(issuer_url).rstrip("/") + TOKEN_PATH)
+
+    # Create metadata
+    metadata = OAuthMetadata(
+        issuer=issuer_url,
+        authorization_endpoint=authorization_url,
+        token_endpoint=token_url,
+        scopes_supported=client_registration_options.valid_scopes,
+        response_types_supported=["code"],
+        response_modes_supported=None,
+        grant_types_supported=["authorization_code", "refresh_token"],
+        token_endpoint_auth_methods_supported=["client_secret_post", "client_secret_basic"],
+        token_endpoint_auth_signing_alg_values_supported=None,
+        service_documentation=service_documentation_url,
+        ui_locales_supported=None,
+        op_policy_uri=None,
+        op_tos_uri=None,
+        introspection_endpoint=None,
+        code_challenge_methods_supported=["S256"],
+    )
+
+    # Add registration endpoint if supported
+    if client_registration_options.enabled:  # pragma: no branch
+        metadata.registration_endpoint = AnyHttpUrl(str(issuer_url).rstrip("/") + REGISTRATION_PATH)
+
+    # Add revocation endpoint if supported
+    if revocation_options.enabled:  # pragma: no branch
+        metadata.revocation_endpoint = AnyHttpUrl(str(issuer_url).rstrip("/") + REVOCATION_PATH)
+        metadata.revocation_endpoint_auth_methods_supported = ["client_secret_post", "client_secret_basic"]
+
+    return metadata
+
+
+def build_resource_metadata_url(resource_server_url: AnyHttpUrl) -> AnyHttpUrl:
+    """
+    Build RFC 9728 compliant protected resource metadata URL.
+
+    Inserts /.well-known/oauth-protected-resource between host and resource path
+    as specified in RFC 9728 §3.1.
+
+    Args:
+        resource_server_url: The resource server URL (e.g., https://example.com/mcp)
+
+    Returns:
+        The metadata URL (e.g., https://example.com/.well-known/oauth-protected-resource/mcp)
+    """
+    parsed = urlparse(str(resource_server_url))
+    # Handle trailing slash: if path is just "/", treat as empty
+    resource_path = parsed.path if parsed.path != "/" else ""
+    return AnyHttpUrl(f"{parsed.scheme}://{parsed.netloc}/.well-known/oauth-protected-resource{resource_path}")
+
+
+def create_protected_resource_routes(
+    resource_url: AnyHttpUrl,
+    authorization_servers: list[AnyHttpUrl],
+    scopes_supported: list[str] | None = None,
+    resource_name: str | None = None,
+    resource_documentation: AnyHttpUrl | None = None,
+) -> list[Route]:
+    """
+    Create routes for OAuth 2.0 Protected Resource Metadata (RFC 9728).
+
+    Args:
+        resource_url: The URL of this resource server
+        authorization_servers: List of authorization servers that can issue tokens
+        scopes_supported: Optional list of scopes supported by this resource
+
+    Returns:
+        List of Starlette routes for protected resource metadata
+    """
+    from mcp.server.auth.handlers.metadata import ProtectedResourceMetadataHandler
+    from mcp.shared.auth import ProtectedResourceMetadata
+
+    metadata = ProtectedResourceMetadata(
+        resource=resource_url,
+        authorization_servers=authorization_servers,
+        scopes_supported=scopes_supported,
+        resource_name=resource_name,
+        resource_documentation=resource_documentation,
+        # bearer_methods_supported defaults to ["header"] in the model
+    )
+
+    handler = ProtectedResourceMetadataHandler(metadata)
+
+    # RFC 9728 §3.1: Register route at /.well-known/oauth-protected-resource + resource path
+    metadata_url = build_resource_metadata_url(resource_url)
+    # Extract just the path part for route registration
+    parsed = urlparse(str(metadata_url))
+    well_known_path = parsed.path
+
+    return [
+        Route(
+            well_known_path,
+            endpoint=cors_middleware(handler.handle, ["GET", "OPTIONS"]),
+            methods=["GET", "OPTIONS"],
+        )
+    ]

package/python-runtime/python/lib/python3.12/site-packages/mcp/server/auth/settings.py

@@ -0,0 +1,56 @@
+import warnings
+
+from pydantic import AnyHttpUrl, BaseModel, Field, model_validator
+from typing_extensions import Self
+
+
+class ClientRegistrationOptions(BaseModel):
+    enabled: bool = False
+    client_secret_expiry_seconds: int | None = None
+    valid_scopes: list[str] | None = None
+    default_scopes: list[str] | None = None
+
+
+class RevocationOptions(BaseModel):
+    enabled: bool = False
+
+
+class AuthSettings(BaseModel):
+    issuer_url: AnyHttpUrl = Field(
+        ...,
+        description="OAuth authorization server URL that issues tokens for this resource server.",
+    )
+    service_documentation_url: AnyHttpUrl | None = None
+    client_registration_options: ClientRegistrationOptions | None = None
+    revocation_options: RevocationOptions | None = None
+    required_scopes: list[str] | None = None
+
+    # Resource Server settings (when operating as RS only)
+    resource_server_url: AnyHttpUrl | None = Field(
+        ...,
+        description="The URL of the MCP server to be used as the resource identifier "
+        "and base route to look up OAuth Protected Resource Metadata.",
+    )
+    validate_token_resource: bool | None = Field(
+        default=None,
+        description="Only accept tokens the token verifier reports as issued for `resource_server_url` "
+        "(`AccessToken.resource`, the RFC 8707 resource indicator). Enable it when your authorization "
+        "server binds tokens to the `resource` the client requested; set it to False when your token "
+        "verifier checks the token's audience itself. With `resource_server_url` set, leaving it unset warns "
+        "and behaves as False; 3.0 makes True the default there.",
+    )
+
+    @model_validator(mode="after")
+    def _check_validate_token_resource(self) -> Self:
+        if self.validate_token_resource and self.resource_server_url is None:
+            raise ValueError("validate_token_resource requires resource_server_url")
+        if self.validate_token_resource is None and self.resource_server_url is not None:
+            warnings.warn(
+                "`AuthSettings.validate_token_resource` is not set, so bearer tokens are not checked "
+                "against `resource_server_url`; it will default to True in 3.0 when `resource_server_url` is "
+                "set. Set it to True to have the server refuse tokens issued for another resource, or to "
+                "False if your TokenVerifier validates the token's audience itself.",
+                DeprecationWarning,
+                stacklevel=3,
+            )
+        return self