aiohttp-tiny-mcp 0.4.0__tar.gz → 0.5.0__tar.gz

{aiohttp_tiny_mcp-0.4.0 → aiohttp_tiny_mcp-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aiohttp-tiny-mcp
-Version: 0.4.0
+Version: 0.5.0
 Summary: Remote MCP server and client library for aiohttp
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -26,6 +26,7 @@ Classifier: Topic :: System :: Distributed Computing
 Classifier: Typing :: Typed
 Requires-Dist: aiohttp>=3.14
 Requires-Dist: pydantic>=2.13
+Requires-Dist: pyjwt[crypto]>=2.13 ; extra == 'jwt'
 Requires-Dist: psycopg[binary,pool]>=3 ; extra == 'postgres'
 Requires-Dist: redis>=5 ; extra == 'redis'
 Requires-Dist: pyyaml>=6 ; extra == 'skills'
@@ -34,6 +35,7 @@ Requires-Python: >=3.10
 Project-URL: Documentation, https://mosquito.github.io/aiohttp-tiny-mcp/
 Project-URL: Repository, https://github.com/mosquito/aiohttp-tiny-mcp
 Project-URL: Issues, https://github.com/mosquito/aiohttp-tiny-mcp/issues
+Provides-Extra: jwt
 Provides-Extra: postgres
 Provides-Extra: redis
 Provides-Extra: skills
@@ -80,7 +82,7 @@ For a local multi-process setup:
 from aiohttp import web
 
 from aiohttp_tiny_mcp import Registry
-from aiohttp_tiny_mcp.sqlite import SqliteHub, SqliteSessionStore, SqliteStorage
+from aiohttp_tiny_mcp.storage.sqlite import SqliteHub, SqliteSessionStore, SqliteStorage
 
 storage = SqliteStorage("mcp.sqlite")
 registry = Registry(
@@ -173,8 +175,8 @@ Console("/mcp", title="Demo").setup(app, "/console")
 
 Open `http://127.0.0.1:8080/console`. It speaks the protocol itself on any of
 the five revisions, builds a form from each tool's schema, answers the
-questions a handler asks, and shows every message either way. Three files from
-this package, no build step and no second process.
+questions a handler asks, and shows every message either way. Static files from
+this package need no build step or second process.
 
 An MCP host that supports Streamable HTTP can connect to
 `http://127.0.0.1:8080/mcp`. In an existing aiohttp service, use
@@ -235,7 +237,7 @@ Start with [the documentation overview](https://mosquito.github.io/aiohttp-tiny-
 2. [Quickstart](https://mosquito.github.io/aiohttp-tiny-mcp/quickstart.html): a complete server, launch command, and client call.
 3. [How the server fits together](https://mosquito.github.io/aiohttp-tiny-mcp/pieces.html): a conversation across two workers and each object's lifetime.
 4. [Using Exchange](https://mosquito.github.io/aiohttp-tiny-mcp/guide/exchange.html): request context, progress, questions, and state.
-5. [Authentication](https://mosquito.github.io/aiohttp-tiny-mcp/guide/auth.html): Basic, Bearer, custom subclasses, multiple policies, and permissions.
+5. [Authentication](https://mosquito.github.io/aiohttp-tiny-mcp/guide/auth.html): Basic, Bearer, GitHub sign-in, custom policies, and permissions.
 6. [Stores and hubs](https://mosquito.github.io/aiohttp-tiny-mcp/deployment/stores.html): shared backend contracts and deployment requirements.
 7. [Extensions and skills](https://mosquito.github.io/aiohttp-tiny-mcp/guide/extensions.html): custom methods, skill directories, and resources for older clients.
 

{aiohttp_tiny_mcp-0.4.0 → aiohttp_tiny_mcp-0.5.0}/README.md

@@ -38,7 +38,7 @@ For a local multi-process setup:
 from aiohttp import web
 
 from aiohttp_tiny_mcp import Registry
-from aiohttp_tiny_mcp.sqlite import SqliteHub, SqliteSessionStore, SqliteStorage
+from aiohttp_tiny_mcp.storage.sqlite import SqliteHub, SqliteSessionStore, SqliteStorage
 
 storage = SqliteStorage("mcp.sqlite")
 registry = Registry(
@@ -131,8 +131,8 @@ Console("/mcp", title="Demo").setup(app, "/console")
 
 Open `http://127.0.0.1:8080/console`. It speaks the protocol itself on any of
 the five revisions, builds a form from each tool's schema, answers the
-questions a handler asks, and shows every message either way. Three files from
-this package, no build step and no second process.
+questions a handler asks, and shows every message either way. Static files from
+this package need no build step or second process.
 
 An MCP host that supports Streamable HTTP can connect to
 `http://127.0.0.1:8080/mcp`. In an existing aiohttp service, use
@@ -193,7 +193,7 @@ Start with [the documentation overview](https://mosquito.github.io/aiohttp-tiny-
 2. [Quickstart](https://mosquito.github.io/aiohttp-tiny-mcp/quickstart.html): a complete server, launch command, and client call.
 3. [How the server fits together](https://mosquito.github.io/aiohttp-tiny-mcp/pieces.html): a conversation across two workers and each object's lifetime.
 4. [Using Exchange](https://mosquito.github.io/aiohttp-tiny-mcp/guide/exchange.html): request context, progress, questions, and state.
-5. [Authentication](https://mosquito.github.io/aiohttp-tiny-mcp/guide/auth.html): Basic, Bearer, custom subclasses, multiple policies, and permissions.
+5. [Authentication](https://mosquito.github.io/aiohttp-tiny-mcp/guide/auth.html): Basic, Bearer, GitHub sign-in, custom policies, and permissions.
 6. [Stores and hubs](https://mosquito.github.io/aiohttp-tiny-mcp/deployment/stores.html): shared backend contracts and deployment requirements.
 7. [Extensions and skills](https://mosquito.github.io/aiohttp-tiny-mcp/guide/extensions.html): custom methods, skill directories, and resources for older clients.
 

{aiohttp_tiny_mcp-0.4.0 → aiohttp_tiny_mcp-0.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "aiohttp-tiny-mcp"
-version = "0.4.0"
+version = "0.5.0"
 description = "Remote MCP server and client library for aiohttp"
 readme = "README.md"
 license = "Apache-2.0"
@@ -39,6 +39,7 @@ Repository = "https://github.com/mosquito/aiohttp-tiny-mcp"
 Issues = "https://github.com/mosquito/aiohttp-tiny-mcp/issues"
 
 [project.optional-dependencies]
+jwt = ["PyJWT[crypto]>=2.13"]
 skills = ["PyYAML>=6"]
 sqlite = ["aiosqlite>=0.20"]
 redis = ["redis>=5"]
@@ -47,7 +48,7 @@ postgres = ["psycopg[binary,pool]>=3"]
 [dependency-groups]
 dev = [
     "PyYAML>=6",
-    "PyJWT>=2.13",
+    "PyJWT[crypto]>=2.13",
     "aiosqlite>=0.20",
     "furo>=2025.12.19",
     "markdown-pytest>=0.6.6",
@@ -101,8 +102,12 @@ select = [
     "I",
     "UP",
     "B",
+    "TID",
 ]
 
+[tool.ruff.lint.flake8-tidy-imports]
+ban-relative-imports = "parents"
+
 [tool.ty.environment]
 root = [
     "src",

{aiohttp_tiny_mcp-0.4.0 → aiohttp_tiny_mcp-0.5.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "aiohttp-tiny-mcp"
-version = "0.4.0"
+version = "0.5.0"
 description = "Remote MCP server and client library for aiohttp"
 readme = "README.md"
 license = "Apache-2.0"
@@ -39,8 +39,9 @@ Repository = "https://github.com/mosquito/aiohttp-tiny-mcp"
 Issues = "https://github.com/mosquito/aiohttp-tiny-mcp/issues"
 
 [project.optional-dependencies]
+jwt = ["PyJWT[crypto]>=2.13"]
 skills = ["PyYAML>=6"]
-# A hub and a session store on one SQLite file: aiohttp_tiny_mcp.sqlite.
+# A hub and a session store on one SQLite file: aiohttp_tiny_mcp.storage.sqlite.
 sqlite = ["aiosqlite>=0.20"]
 redis = [
     "redis>=5",
@@ -52,7 +53,7 @@ postgres = [
 [dependency-groups]
 dev = [
     "PyYAML>=6",
-    "PyJWT>=2.13",
+    "PyJWT[crypto]>=2.13",
     "aiosqlite>=0.20",
     "furo>=2025.12.19",
     "markdown-pytest>=0.6.6",
@@ -104,7 +105,10 @@ line-length = 100
 target-version = "py310"
 
 [tool.ruff.lint]
-select = ["E", "F", "I", "UP", "B"]
+select = ["E", "F", "I", "UP", "B", "TID"]
+
+[tool.ruff.lint.flake8-tidy-imports]
+ban-relative-imports = "parents"
 
 [tool.ty.environment]
 root = ["src", "examples"]

{aiohttp_tiny_mcp-0.4.0 → aiohttp_tiny_mcp-0.5.0}/src/aiohttp_tiny_mcp/__init__.py

@@ -2,10 +2,22 @@
 
 from __future__ import annotations
 
-from .auth import Authentication, Authorization, BasicAuth, Principal, StaticBasicAuth, Unauthorized
-from .client import Client
-from .client_base import ClientError, Elicitor
-from .core import (
+from .auth import (
+    Authentication,
+    Authorization,
+    BasicAuth,
+    Principal,
+    StaticBasicAuth,
+    StaticVerifier,
+    TokenVerifier,
+    Unauthorized,
+    principal_from_claims,
+)
+from .client.base import ClientError, Elicitor
+from .client.http import Client
+from .client.stdio import StdioClient
+from .extensions import Extension
+from .protocol.core import (
     Answer,
     AnswerAction,
     NeedInput,
@@ -14,12 +26,7 @@ from .core import (
     elicit_cancel,
     elicit_decline,
 )
-from .endpoint import Endpoint
-from .exchange import Exchange
-from .extensions import Extension
-from .http_sse import SseEndpoint
-from .hub import Hub, MemoryHub
-from .models import (
+from .protocol.models import (
     AudioContent,
     BlobResourceContents,
     CallToolResult,
@@ -34,14 +41,17 @@ from .models import (
     TextContent,
     TextResourceContents,
 )
-from .namespaces import namespace
 from .protocol.selection import AdapterSet
-from .registry import Registry
-from .request_state import RequestStates
-from .sessions import MemorySessionStore, SessionRecord, SessionStore
-from .sse import SSEResponse
-from .stdio import run_stdio, serve_stdio
-from .stdio_client import StdioClient
+from .server.exchange import Exchange
+from .server.http import Endpoint
+from .server.registry import Registry
+from .server.request_state import RequestStates
+from .server.sse import SseEndpoint
+from .server.stdio import run_stdio, serve_stdio
+from .storage.hub import Hub, MemoryHub
+from .storage.namespaces import namespace
+from .storage.sessions import MemorySessionStore, SessionRecord, SessionStore
+from .transport.sse import SSEResponse
 
 __all__ = [
     "AdapterSet",
@@ -81,6 +91,8 @@ __all__ = [
     "SessionStore",
     "StdioClient",
     "StaticBasicAuth",
+    "StaticVerifier",
+    "TokenVerifier",
     "TextContent",
     "TextResourceContents",
     "Unauthorized",
@@ -88,6 +100,7 @@ __all__ = [
     "elicit_accept",
     "elicit_cancel",
     "elicit_decline",
+    "principal_from_claims",
     "run_stdio",
     "serve_stdio",
 ]

aiohttp_tiny_mcp-0.4.0/src/aiohttp_tiny_mcp/auth.py → aiohttp_tiny_mcp-0.5.0/src/aiohttp_tiny_mcp/auth/__init__.py

@@ -2,12 +2,14 @@
 
 from __future__ import annotations
 
+import math
 import time
 from abc import ABC, abstractmethod
 from base64 import b64decode
 from binascii import Error as Base64Error
 from collections.abc import Iterable, Mapping, Sequence
 from dataclasses import dataclass, field
+from hashlib import sha256
 from secrets import compare_digest
 from typing import Any, Protocol, runtime_checkable
 from urllib.parse import urlsplit
@@ -52,6 +54,73 @@ class TokenVerifier(Protocol):
     async def verify(self, token: str) -> Principal | None: ...
 
 
+def principal_from_claims(claims: Mapping[str, Any]) -> Principal:
+    """Map verified claims to a principal. This function does not verify tokens.
+
+    Empty claims are valid. Malformed identity, scope, or expiry values raise
+    ValueError. Application-specific namespaces require a custom mapper.
+    """
+    subject = claims.get("sub")
+    issuer = claims.get("iss")
+    client_id = claims.get("client_id", claims.get("azp", ""))
+    if subject is not None and not isinstance(subject, str):
+        raise ValueError("sub must be a string")
+    if issuer is not None and not isinstance(issuer, str):
+        raise ValueError("iss must be a string")
+    if not isinstance(client_id, str):
+        raise ValueError("client_id or azp must be a string")
+    scope = claims.get("scope", claims.get("scp", []))
+    if isinstance(scope, str):
+        scopes = frozenset(scope.split())
+    elif isinstance(scope, list) and all(isinstance(item, str) for item in scope):
+        scopes = frozenset(scope)
+    else:
+        raise ValueError("scope or scp must be a string or a list of strings")
+    expires_at = None
+    if "exp" in claims:
+        try:
+            expires_at = float(claims["exp"])
+        except (ValueError, TypeError, OverflowError) as error:
+            raise ValueError("exp must be a finite timestamp") from error
+        if isinstance(claims["exp"], bool) or not math.isfinite(expires_at):
+            raise ValueError("exp must be a finite timestamp")
+    return Principal(
+        subject=subject,
+        issuer=issuer,
+        client_id=client_id,
+        scopes=scopes,
+        expires_at=expires_at,
+        claims=dict(claims),
+    )
+
+
+class StaticVerifier:
+    """Verify configured opaque tokens for development and tests.
+
+    Compare fixed-size digests for every configured token, including after a
+    match. Authorization enforces the returned principal's expiry and scopes.
+    """
+
+    def __init__(self, mapping: Mapping[str, Principal]) -> None:
+        if any(not token for token in mapping):
+            raise ValueError("static tokens must be non-empty")
+        self._entries = tuple(
+            (sha256(token.encode("utf-8")).digest(), principal)
+            for token, principal in mapping.items()
+        )
+
+    async def verify(self, token: str) -> Principal | None:
+        try:
+            digest = sha256(token.encode("utf-8")).digest()
+        except UnicodeEncodeError:
+            return None
+        found = None
+        for expected, principal in self._entries:
+            if compare_digest(digest, expected):
+                found = principal
+        return found
+
+
 class Unauthorized(Exception):
     """Authentication or authorization failed."""
 
@@ -121,7 +190,7 @@ class BasicAuth(Authentication):
     """Subclass `verify` to authenticate Basic credentials against your user store.
 
     Credentials use standard Base64 and UTF-8. Query credentials are not read.
-    Use `StaticBasicAuth` for one configured username and password.
+    Use `StaticBasicAuth` for configured accounts with individual scopes.
     """
 
     def __init__(
@@ -165,15 +234,17 @@ class BasicAuth(Authentication):
 
 
 class StaticBasicAuth(BasicAuth):
-    """Basic authentication for one configured account. Use HTTPS in production."""
+    """Basic authentication for configured accounts with individual scopes.
+
+    Pass each account as (username, password, scopes), or (username, password)
+    for an account without scopes. Usernames must be unique. Use HTTPS in
+    production.
+    """
 
     def __init__(
         self,
-        username: str,
-        password: str,
-        *,
+        *accounts: tuple[str, str] | tuple[str, str, Iterable[str]],
         realm: str = "mcp",
-        scopes: Iterable[str] = (),
         bind_sessions: bool = True,
         namespace_from_token: bool = True,
         required_scopes: Sequence[str] = (),
@@ -184,20 +255,52 @@ class StaticBasicAuth(BasicAuth):
             namespace_from_token=namespace_from_token,
             required_scopes=required_scopes,
         )
-        if ":" in username or any(
-            ord(char) < 32 or ord(char) == 127 for char in username + password
-        ):
-            raise ValueError("Basic credentials cannot contain controls or a colon in the username")
-        if not username or not password:
-            raise ValueError("username and password must be non-empty")
-        self._username = username.encode("utf-8")
-        self._password = password.encode("utf-8")
-        self._principal = Principal(subject=username, scopes=frozenset(scopes))
+        if not accounts:
+            raise ValueError("at least one Basic account is required")
+        entries: list[tuple[bytes, bytes, Principal]] = []
+        usernames: set[str] = set()
+        for account in accounts:
+            if not isinstance(account, tuple) or len(account) not in (2, 3):
+                raise TypeError("accounts must be (username, password[, scopes]) tuples")
+            username, password = account[:2]
+            if not isinstance(username, str) or not isinstance(password, str):
+                raise TypeError("username and password must be strings")
+            if not username or not password:
+                raise ValueError("username and password must be non-empty")
+            if ":" in username or any(
+                ord(char) < 32 or ord(char) == 127 for char in username + password
+            ):
+                raise ValueError(
+                    "Basic credentials cannot contain controls or a colon in the username"
+                )
+            if username in usernames:
+                raise ValueError("Basic account usernames must be unique")
+            usernames.add(username)
+            scopes = account[2] if len(account) == 3 else ()
+            if isinstance(scopes, str):
+                raise TypeError("account scopes must be an iterable of strings, not a string")
+            granted = frozenset(scopes)
+            if any(not isinstance(scope, str) for scope in granted):
+                raise TypeError("account scopes must contain only strings")
+            entries.append(
+                (
+                    sha256(username.encode("utf-8")).digest(),
+                    sha256(password.encode("utf-8")).digest(),
+                    Principal(subject=username, scopes=granted),
+                )
+            )
+        self._entries = tuple(entries)
 
     async def verify(self, username: str, password: str) -> Principal | None:
-        matched = compare_digest(username.encode("utf-8"), self._username)
-        matched &= compare_digest(password.encode("utf-8"), self._password)
-        return self._principal if matched else None
+        given_username = sha256(username.encode("utf-8")).digest()
+        given_password = sha256(password.encode("utf-8")).digest()
+        found = None
+        for expected_username, expected_password, principal in self._entries:
+            matched = compare_digest(given_username, expected_username)
+            matched &= compare_digest(given_password, expected_password)
+            if matched:
+                found = principal
+        return found
 
 
 @dataclass(frozen=True)
@@ -269,6 +372,8 @@ __all__ = [
     "BasicAuth",
     "Principal",
     "StaticBasicAuth",
+    "StaticVerifier",
     "TokenVerifier",
     "Unauthorized",
+    "principal_from_claims",
 ]

aiohttp_tiny_mcp-0.5.0/src/aiohttp_tiny_mcp/auth/jwt.py

@@ -0,0 +1,117 @@
+"""Optional JWT verification. Install aiohttp-tiny-mcp[jwt] to use this module."""
+
+from __future__ import annotations
+
+from collections.abc import Callable, Mapping
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+try:
+    import jwt
+    from cryptography.exceptions import UnsupportedAlgorithm
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric import ec, ed448, ed25519, rsa
+    from jwt.algorithms import HMACAlgorithm
+except ImportError as error:
+    raise ImportError("JWT verification requires aiohttp-tiny-mcp[jwt]") from error
+
+from aiohttp_tiny_mcp.auth import Principal, principal_from_claims
+
+VerificationKey = (
+    bytes
+    | rsa.RSAPublicKey
+    | ec.EllipticCurvePublicKey
+    | ed25519.Ed25519PublicKey
+    | ed448.Ed448PublicKey
+)
+
+
+@dataclass(frozen=True)
+class JWTVerifier:
+    """Verify JWTs, then map verified claims with the synchronous principal hook.
+
+    Use HMACJWTVerifier or PublicKeyJWTVerifier to select algorithms from trusted
+    key material. The mapper may raise ValueError to reject verified claims.
+    """
+
+    key: VerificationKey = field(repr=False)
+    algorithms: tuple[str, ...]
+    issuer: str = ""
+    audience: str = ""
+    principal: Callable[[Mapping[str, Any]], Principal] = principal_from_claims
+
+    async def verify(self, credentials: str) -> Principal | None:
+        """Check the signature, required expiry, and configured issuer and audience."""
+        try:
+            claims = jwt.decode(
+                credentials,
+                self.key,
+                algorithms=self.algorithms,
+                issuer=self.issuer or None,
+                audience=self.audience or None,
+                options={"require": ["exp"], "verify_aud": bool(self.audience)},
+            )
+            return self.principal(claims)
+        except (jwt.InvalidTokenError, ValueError, TypeError, OverflowError):
+            return None
+
+
+class HMACJWTVerifier(JWTVerifier):
+    """Verify HS256 JWTs with a configured pre-shared key."""
+
+    def __init__(
+        self,
+        pre_shared_key: str,
+        *,
+        issuer: str = "",
+        audience: str = "",
+        principal: Callable[[Mapping[str, Any]], Principal] = principal_from_claims,
+    ) -> None:
+        hmac = HMACAlgorithm(HMACAlgorithm.SHA256)
+        try:
+            key = hmac.prepare_key(pre_shared_key)
+        except jwt.InvalidKeyError as error:
+            raise ValueError("the JWT pre-shared key must not be an asymmetric key") from error
+        if len(key) < 32:
+            raise ValueError("the JWT pre-shared key must contain at least 32 bytes")
+        super().__init__(key, ("HS256",), issuer, audience, principal)
+
+
+class PublicKeyJWTVerifier(JWTVerifier):
+    """Verify RSA, EC, or EdDSA JWTs with a configured public key."""
+
+    def __init__(
+        self,
+        public_key: str,
+        *,
+        issuer: str = "",
+        audience: str = "",
+        principal: Callable[[Mapping[str, Any]], Principal] = principal_from_claims,
+    ) -> None:
+        material = public_key.strip()
+        if not material.startswith("-----BEGIN "):
+            material = Path(material).expanduser().read_text(encoding="utf-8")
+        try:
+            loaded = serialization.load_pem_public_key(material.encode("utf-8"))
+        except (ValueError, TypeError, UnsupportedAlgorithm) as error:
+            raise ValueError("the JWT public key must be a supported PEM public key") from error
+        algorithms: tuple[str, ...]
+        if isinstance(loaded, rsa.RSAPublicKey):
+            if loaded.key_size < 2048:
+                raise ValueError("the JWT RSA public key must contain at least 2048 bits")
+            algorithms = ("RS256", "RS384", "RS512", "PS256", "PS384", "PS512")
+        elif isinstance(loaded, ec.EllipticCurvePublicKey):
+            curves = {"secp256r1": "ES256", "secp384r1": "ES384", "secp521r1": "ES512"}
+            algorithm = curves.get(loaded.curve.name)
+            if algorithm is None:
+                raise ValueError("unsupported JWT elliptic curve")
+            algorithms = (algorithm,)
+        elif isinstance(loaded, (ed25519.Ed25519PublicKey, ed448.Ed448PublicKey)):
+            algorithms = ("EdDSA",)
+        else:
+            raise ValueError("unsupported JWT public key type")
+        super().__init__(loaded, algorithms, issuer, audience, principal)
+
+
+__all__ = ["HMACJWTVerifier", "JWTVerifier", "PublicKeyJWTVerifier"]

aiohttp_tiny_mcp-0.5.0/src/aiohttp_tiny_mcp/client/__init__.py

@@ -0,0 +1 @@
+"""HTTP and stdio clients with shared request handling."""

aiohttp_tiny_mcp-0.4.0/src/aiohttp_tiny_mcp/client_base.py → aiohttp_tiny_mcp-0.5.0/src/aiohttp_tiny_mcp/client/base.py

@@ -7,9 +7,9 @@ from abc import ABC, abstractmethod
 from collections.abc import AsyncIterator, Awaitable, Callable, Mapping, Sequence
 from typing import Any
 
-from .adapter import Adapter
-from .core import ClientProfile, InputRequest, Operation
-from .models import (
+from aiohttp_tiny_mcp.protocol.adapter import Adapter
+from aiohttp_tiny_mcp.protocol.core import ClientProfile, InputRequest, Operation
+from aiohttp_tiny_mcp.protocol.models import (
     CallToolParams,
     CallToolResult,
     CompleteArgument,

aiohttp_tiny_mcp-0.4.0/src/aiohttp_tiny_mcp/client.py → aiohttp_tiny_mcp-0.5.0/src/aiohttp_tiny_mcp/client/http.py

@@ -1,4 +1,4 @@
-"""HTTP transport for BaseClient. See stdio_client.py for the stdio transport."""
+"""HTTP transport for BaseClient. The stdio transport lives in client.stdio."""
 
 from __future__ import annotations
 
@@ -9,10 +9,11 @@ from typing import Any
 
 import aiohttp
 
-from .adapter import Adapter
-from .client_base import BaseClient, Elicitor
-from .models import Implementation
-from .sse import read_sse
+from aiohttp_tiny_mcp.protocol.adapter import Adapter
+from aiohttp_tiny_mcp.protocol.models import Implementation
+from aiohttp_tiny_mcp.transport.sse import read_sse
+
+from .base import BaseClient, Elicitor
 
 ANSWER_METHOD = "elicitation/create"
 

aiohttp_tiny_mcp-0.4.0/src/aiohttp_tiny_mcp/stdio_client.py → aiohttp_tiny_mcp-0.5.0/src/aiohttp_tiny_mcp/client/stdio.py

@@ -8,9 +8,10 @@ from collections.abc import AsyncIterator, Callable, Mapping
 from contextlib import asynccontextmanager
 from typing import Any, Protocol, runtime_checkable
 
-from .adapter import Adapter
-from .client_base import BaseClient, ClientError, Elicitor
-from .models import Implementation
+from aiohttp_tiny_mcp.protocol.adapter import Adapter
+from aiohttp_tiny_mcp.protocol.models import Implementation
+
+from .base import BaseClient, ClientError, Elicitor
 
 
 @runtime_checkable

{aiohttp_tiny_mcp-0.4.0 → aiohttp_tiny_mcp-0.5.0}/src/aiohttp_tiny_mcp/console/__init__.py

@@ -17,6 +17,7 @@ FILES = {
     "": ("index.html", "text/html"),
     "console.js": ("console.js", "application/javascript"),
     "console.css": ("console.css", "text/css"),
+    "oauth-callback": ("oauth-callback.html", "text/html"),
 }
 
 
@@ -31,12 +32,14 @@ class Console:
         description: str = "",
         template: str | Path | None = None,
         variables: Mapping[str, str] | None = None,
+        oauth_client_id: str | None = None,
     ) -> None:
         self.endpoint_path = endpoint_path
         self.title = title
         self.description = description
         self.template = Path(template) if template else HERE / "index.html"
         self.variables = dict(variables or {})
+        self.oauth_client_id = oauth_client_id
 
     def substitutions(self, base: str) -> dict[str, str]:
         return {
@@ -44,6 +47,7 @@ class Console:
             "BASE": base,
             "TITLE": self.title,
             "DESCRIPTION": self.description,
+            "OAUTH_CLIENT_ID": self.oauth_client_id or "",
             **self.variables,
         }
 
@@ -80,7 +84,7 @@ class Console:
         )
 
     def routes(self, path: str = "/console") -> list[web.RouteDef]:
-        """The page, either way it is addressed, and its two files."""
+        """The page, its assets, and the OAuth callback page."""
         base = path.rstrip("/")
         log.debug("console at %s, for the endpoint at %s", base, self.endpoint_path)
         return [
@@ -89,6 +93,22 @@ class Console:
             web.get(f"{base}/{{file}}", self.handle),
         ]
 
+    @staticmethod
+    def is_public(request: web.Request) -> bool:
+        """Identify a mounted console asset for application authentication middleware.
+
+        Check the resolved handler, method, and file allowlist. No path prefix
+        is trusted, and an unmounted console grants no exemptions.
+        """
+        handler = request.match_info.handler
+        console = getattr(handler, "__self__", None)
+        return (
+            request.method in {"GET", "HEAD"}
+            and isinstance(console, Console)
+            and handler == console.handle
+            and request.match_info.get("file", "") in FILES
+        )
+
     def setup(self, app: web.Application, path: str = "/console") -> web.Application:
         log.debug("adding the console routes to %r", app)
         app.add_routes(self.routes(path))