alita-sdk 0.3.441__py3-none-any.whl → 0.3.443__py3-none-any.whl

alita_sdk/runtime/clients/client.py

@@ -342,6 +342,9 @@ class AlitaClient:
             app_type = "react"
         elif app_type == 'autogen':
             app_type = "react"
+        
+        # LangChainAssistant constructor calls get_tools() which may raise McpAuthorizationRequired
+        # The exception will propagate naturally to the indexer worker's outer handler
         if runtime == 'nonrunnable':
             return LangChainAssistant(self, data, llm, chat_history, app_type,
                                       tools=tools, memory=memory, store=store, mcp_tokens=mcp_tokens)
@@ -605,6 +608,9 @@ class AlitaClient:
             'tools': tools,  # Tool configs that will be processed by get_tools()
             'variables': variables
         }
+        
+        # LangChainAssistant constructor calls get_tools() which may raise McpAuthorizationRequired
+        # The exception will propagate naturally to the indexer worker's outer handler
         return LangChainAssistant(
             self,
             agent_data,

alita_sdk/runtime/toolkits/mcp.py

@@ -22,6 +22,7 @@ from ..utils.mcp_oauth import (
     canonical_resource,
     extract_resource_metadata_url,
     fetch_resource_metadata,
+    infer_authorization_servers_from_realm,
 )
 
 logger = logging.getLogger(__name__)
@@ -545,8 +546,19 @@ class McpToolkit(BaseToolkit):
 
             auth_header = response.headers.get('WWW-Authenticate', '')
             if response.status_code == 401:
-                resource_metadata_url = extract_resource_metadata_url(auth_header)
+                resource_metadata_url = extract_resource_metadata_url(auth_header, connection_config.url)
                 metadata = fetch_resource_metadata(resource_metadata_url, timeout=timeout) if resource_metadata_url else None
+                
+                # If we couldn't get metadata from the resource_metadata endpoint,
+                # infer authorization servers from the WWW-Authenticate header and server URL
+                if not metadata or not metadata.get('authorization_servers'):
+                    inferred_servers = infer_authorization_servers_from_realm(auth_header, connection_config.url)
+                    if inferred_servers:
+                        if not metadata:
+                            metadata = {}
+                        metadata['authorization_servers'] = inferred_servers
+                        logger.info(f"Inferred authorization servers for {connection_config.url}: {inferred_servers}")
+                
                 raise McpAuthorizationRequired(
                     message=f"MCP server {connection_config.url} requires OAuth authorization",
                     server_url=canonical_resource(connection_config.url),
@@ -554,6 +566,7 @@ class McpToolkit(BaseToolkit):
                     www_authenticate=auth_header,
                     resource_metadata=metadata,
                     status=response.status_code,
+                    tool_name=toolkit_name,
                 )
 
             if response.status_code != 200:

alita_sdk/runtime/tools/mcp_remote_tool.py

@@ -18,6 +18,7 @@ from ..utils.mcp_oauth import (
     canonical_resource,
     extract_resource_metadata_url,
     fetch_resource_metadata_async,
+    infer_authorization_servers_from_realm,
 )
 
 logger = logging.getLogger(__name__)
@@ -121,7 +122,7 @@ class McpRemoteTool(McpServerTool):
                 async with session.post(self.server_url, json=mcp_request, headers=headers) as response:
                     auth_header = response.headers.get('WWW-Authenticate') or response.headers.get('Www-Authenticate')
                     if response.status == 401:
-                        resource_metadata_url = extract_resource_metadata_url(auth_header)
+                        resource_metadata_url = extract_resource_metadata_url(auth_header, self.server_url)
                         metadata = None
                         if resource_metadata_url:
                             metadata = await fetch_resource_metadata_async(
@@ -129,6 +130,17 @@ class McpRemoteTool(McpServerTool):
                                 session=session,
                                 timeout=self.tool_timeout_sec,
                             )
+                        
+                        # If we couldn't get metadata from the resource_metadata endpoint,
+                        # infer authorization servers from the WWW-Authenticate header and server URL
+                        if not metadata or not metadata.get('authorization_servers'):
+                            inferred_servers = infer_authorization_servers_from_realm(auth_header, self.server_url)
+                            if inferred_servers:
+                                if not metadata:
+                                    metadata = {}
+                                metadata['authorization_servers'] = inferred_servers
+                                logger.info(f"Inferred authorization servers for {self.server_url}: {inferred_servers}")
+                        
                         raise McpAuthorizationRequired(
                             message=f"MCP server {self.server_url} requires OAuth authorization",
                             server_url=canonical_resource(self.server_url),
@@ -136,6 +148,7 @@ class McpRemoteTool(McpServerTool):
                             www_authenticate=auth_header,
                             resource_metadata=metadata,
                             status=response.status,
+                            tool_name=self.name,
                         )
 
                     if response.status != 200:

alita_sdk/runtime/utils/mcp_oauth.py

@@ -21,6 +21,7 @@ class McpAuthorizationRequired(ToolException):
         www_authenticate: Optional[str] = None,
         resource_metadata: Optional[Dict[str, Any]] = None,
         status: Optional[int] = None,
+        tool_name: Optional[str] = None,
     ):
         super().__init__(message)
         self.server_url = server_url
@@ -28,6 +29,7 @@ class McpAuthorizationRequired(ToolException):
         self.www_authenticate = www_authenticate
         self.resource_metadata = resource_metadata
         self.status = status
+        self.tool_name = tool_name
 
     def to_dict(self) -> Dict[str, Any]:
         return {
@@ -37,21 +39,65 @@ class McpAuthorizationRequired(ToolException):
             "www_authenticate": self.www_authenticate,
             "resource_metadata": self.resource_metadata,
             "status": self.status,
+            "tool_name": self.tool_name,
         }
 
 
-def extract_resource_metadata_url(www_authenticate: Optional[str]) -> Optional[str]:
-    """Pull the resource_metadata URL from a WWW-Authenticate header if present."""
-    if not www_authenticate:
+def extract_resource_metadata_url(www_authenticate: Optional[str], server_url: Optional[str] = None) -> Optional[str]:
+    """
+    Pull the resource_metadata URL from a WWW-Authenticate header if present.
+    If not found and server_url is provided, try to construct resource metadata URLs.
+    """
+    if not www_authenticate and not server_url:
         return None
 
     # RFC9728 returns `resource_metadata="<url>"` inside the header value
-    match = re.search(r'resource_metadata\s*=\s*\"?([^\", ]+)\"?', www_authenticate)
-    if match:
-        return match.group(1)
+    if www_authenticate:
+        match = re.search(r'resource_metadata\s*=\s*\"?([^\", ]+)\"?', www_authenticate)
+        if match:
+            return match.group(1)
+    
+    # For servers that don't provide resource_metadata in WWW-Authenticate,
+    # we'll return None and rely on inferring authorization servers from the realm
+    # or using well-known OAuth discovery endpoints directly
     return None
 
 
+def infer_authorization_servers_from_realm(www_authenticate: Optional[str], server_url: str) -> Optional[list]:
+    """
+    Infer authorization server URLs from WWW-Authenticate realm or server URL.
+    This is used when the server doesn't provide resource_metadata endpoint.
+    """
+    if not www_authenticate and not server_url:
+        return None
+    
+    authorization_servers = []
+    
+    # Try to extract realm from WWW-Authenticate header
+    realm = None
+    if www_authenticate:
+        realm_match = re.search(r'realm\s*=\s*\"([^\"]+)\"', www_authenticate)
+        if realm_match:
+            realm = realm_match.group(1)
+    
+    # Parse the server URL to get base domain
+    parsed = urlparse(server_url)
+    base_url = f"{parsed.scheme}://{parsed.netloc}"
+    
+    # For OAuth 2.1 / OpenID Connect, try standard well-known endpoints
+    # These are the most common discovery endpoints
+    if realm and realm.lower() == "oauth":
+        # Standard OAuth 2.0 / 2.1 discovery endpoints
+        authorization_servers.append(f"{base_url}/.well-known/oauth-authorization-server")
+        authorization_servers.append(f"{base_url}/.well-known/openid-configuration")
+    else:
+        # If no realm or different realm, still try standard endpoints
+        authorization_servers.append(f"{base_url}/.well-known/oauth-authorization-server")
+        authorization_servers.append(f"{base_url}/.well-known/openid-configuration")
+    
+    return authorization_servers if authorization_servers else None
+
+
 def fetch_resource_metadata(resource_metadata_url: str, timeout: int = 10) -> Optional[Dict[str, Any]]:
     """Fetch and parse the protected resource metadata document."""
     try:

{alita_sdk-0.3.441.dist-info → alita_sdk-0.3.443.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alita_sdk
-Version: 0.3.441
+Version: 0.3.443
 Summary: SDK for building langchain agents using resources from Alita
 Author-email: Artem Rozumenko <artyom.rozumenko@gmail.com>, Mikalai Biazruchka <mikalai_biazruchka@epam.com>, Roman Mitusov <roman_mitusov@epam.com>, Ivan Krakhmaliuk <lifedj27@gmail.com>, Artem Dubrovskiy <ad13box@gmail.com>
 License-Expression: Apache-2.0

{alita_sdk-0.3.441.dist-info → alita_sdk-0.3.443.dist-info}/RECORD

@@ -36,7 +36,7 @@ alita_sdk/configurations/zephyr_essential.py,sha256=TiZedsBlfIDroflipvoqxjJeEWPo
 alita_sdk/runtime/__init__.py,sha256=4W0UF-nl3QF2bvET5lnah4o24CoTwSoKXhuN0YnwvEE,828
 alita_sdk/runtime/clients/__init__.py,sha256=BdehU5GBztN1Qi1Wul0cqlU46FxUfMnI6Vq2Zd_oq1M,296
 alita_sdk/runtime/clients/artifact.py,sha256=b7hVuGRROt6qUcT11uAZqzJqslzmlgW-Y6oGsiwNmjI,4029
-alita_sdk/runtime/clients/client.py,sha256=3GAbPSBq4P2Tgkn4kQK4zHfjzkHxKvzcsLWM-i3-JoM,47362
+alita_sdk/runtime/clients/client.py,sha256=trgvD6vzOqepn29ks0i1ALKigdVxiBinaJiOi-ejNb0,47754
 alita_sdk/runtime/clients/datasource.py,sha256=HAZovoQN9jBg0_-lIlGBQzb4FJdczPhkHehAiVG3Wx0,1020
 alita_sdk/runtime/clients/mcp_discovery.py,sha256=aFJ0wYQ8EAmXa9qLUusHZfQXkNec1wbgkqHdVeSFX-g,11697
 alita_sdk/runtime/clients/mcp_manager.py,sha256=DRbqiO761l7UgOdv_keHbD2g0oZodtPHejpArXYZIoE,9050
@@ -103,7 +103,7 @@ alita_sdk/runtime/toolkits/application.py,sha256=HHAKgwKOckxc7EQG-AV7rz4POOzQJKF
 alita_sdk/runtime/toolkits/artifact.py,sha256=YChNCX4QhVpaQG7Jk4TS-Wl0Aruc4slQ2K21zh9nNO0,3176
 alita_sdk/runtime/toolkits/configurations.py,sha256=kIDAlnryPQfbZyFxV-9SzN2-Vefzx06TX1BBdIIpN90,141
 alita_sdk/runtime/toolkits/datasource.py,sha256=qk78OdPoReYPCWwahfkKLbKc4pfsu-061oXRryFLP6I,2498
-alita_sdk/runtime/toolkits/mcp.py,sha256=9avAcSn94BZxjM0W8l-qw0jqydV9N8p_3Hyqfr8uFmM,38963
+alita_sdk/runtime/toolkits/mcp.py,sha256=rzwEwW4LR-8aqVPsW-QvUSC0qMVM2MyOn0uH_m7VQjo,39797
 alita_sdk/runtime/toolkits/prompt.py,sha256=WIpTkkVYWqIqOWR_LlSWz3ug8uO9tm5jJ7aZYdiGRn0,1192
 alita_sdk/runtime/toolkits/subgraph.py,sha256=wwUK8JjPXkGzyVZ3tAukmvST6eGbqx_U11rpnmbrvtg,2105
 alita_sdk/runtime/toolkits/tools.py,sha256=F93TOPQWmULpslyJh-lCEdkQ3OD4RbEvfe84g8wBzb0,11639
@@ -122,7 +122,7 @@ alita_sdk/runtime/tools/llm.py,sha256=iRG_wU4T01LRsjEMPZe5Uah7LiMqDc-vspwkMuQtlt
 alita_sdk/runtime/tools/loop.py,sha256=uds0WhZvwMxDVFI6MZHrcmMle637cQfBNg682iLxoJA,8335
 alita_sdk/runtime/tools/loop_output.py,sha256=U4hO9PCQgWlXwOq6jdmCGbegtAxGAPXObSxZQ3z38uk,8069
 alita_sdk/runtime/tools/mcp_inspect_tool.py,sha256=38X8euaxDbEGjcfp6ElvExZalpZun6QEr6ZEW4nU5pQ,11496
-alita_sdk/runtime/tools/mcp_remote_tool.py,sha256=7iZS2r5xgiRRYk5PySdGC2FQ55ZvVfIqH7dCvPiL_hY,9487
+alita_sdk/runtime/tools/mcp_remote_tool.py,sha256=odt6j54SjeP0vaVo0cZkV2GHoZtPSTRh6owtVcqFytk,10396
 alita_sdk/runtime/tools/mcp_server_tool.py,sha256=-xO3H6BM63KaIV1CdcQKPVE0WPigiqOgFZDX7m2_yGs,4419
 alita_sdk/runtime/tools/pgvector_search.py,sha256=NN2BGAnq4SsDHIhUcFZ8d_dbEOM8QwB0UwpsWCYruXU,11692
 alita_sdk/runtime/tools/prompt.py,sha256=nJafb_e5aOM1Rr3qGFCR-SKziU9uCsiP2okIMs9PppM,741
@@ -136,7 +136,7 @@ alita_sdk/runtime/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG
 alita_sdk/runtime/utils/constants.py,sha256=Xntx1b_uxUzT4clwqHA_U6K8y5bBqf_4lSQwXdcWrp4,13586
 alita_sdk/runtime/utils/evaluate.py,sha256=iM1P8gzBLHTuSCe85_Ng_h30m52hFuGuhNXJ7kB1tgI,1872
 alita_sdk/runtime/utils/logging.py,sha256=svPyiW8ztDfhqHFITv5FBCj8UhLxz6hWcqGIY6wpJJE,3331
-alita_sdk/runtime/utils/mcp_oauth.py,sha256=fh4jM0UjV65-MGNno7o-7_kpRd6pY57fgZ63Cl-v46E,3791
+alita_sdk/runtime/utils/mcp_oauth.py,sha256=icGG2j3mzKS2ARVmq0r_MPhHBiHrXMJ0DtIcU7y7TLQ,5826
 alita_sdk/runtime/utils/save_dataframe.py,sha256=i-E1wp-t4wb17Zq3nA3xYwgSILjoXNizaQAA9opWvxY,1576
 alita_sdk/runtime/utils/streamlit.py,sha256=yIb4YIGH8HRAXZtZlywjxI07Xdcb5eUt7rMA-elFTdc,107261
 alita_sdk/runtime/utils/toolkit_runtime.py,sha256=MU63Fpxj0b5_r1IUUc0Q3-PN9VwL7rUxp2MRR4tmYR8,5136
@@ -360,8 +360,8 @@ alita_sdk/tools/zephyr_scale/api_wrapper.py,sha256=kT0TbmMvuKhDUZc0i7KO18O38JM9S
 alita_sdk/tools/zephyr_squad/__init__.py,sha256=0ne8XLJEQSLOWfzd2HdnqOYmQlUliKHbBED5kW_Vias,2895
 alita_sdk/tools/zephyr_squad/api_wrapper.py,sha256=kmw_xol8YIYFplBLWTqP_VKPRhL_1ItDD0_vXTe_UuI,14906
 alita_sdk/tools/zephyr_squad/zephyr_squad_cloud_client.py,sha256=R371waHsms4sllHCbijKYs90C-9Yu0sSR3N4SUfQOgU,5066
-alita_sdk-0.3.441.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-alita_sdk-0.3.441.dist-info/METADATA,sha256=C0gyyRq4qwLPvIy-IjF6z7JR6JnXcmRtRlUKYKH0FfY,19071
-alita_sdk-0.3.441.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-alita_sdk-0.3.441.dist-info/top_level.txt,sha256=0vJYy5p_jK6AwVb1aqXr7Kgqgk3WDtQ6t5C-XI9zkmg,10
-alita_sdk-0.3.441.dist-info/RECORD,,
+alita_sdk-0.3.443.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+alita_sdk-0.3.443.dist-info/METADATA,sha256=cepzPrDlxn1tJo2xZwFUGT-y8nw5lZCT_9gzHVLwWkI,19071
+alita_sdk-0.3.443.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+alita_sdk-0.3.443.dist-info/top_level.txt,sha256=0vJYy5p_jK6AwVb1aqXr7Kgqgk3WDtQ6t5C-XI9zkmg,10
+alita_sdk-0.3.443.dist-info/RECORD,,