alita-sdk 0.3.441__tar.gz → 0.3.443__tar.gz

{alita_sdk-0.3.441 → alita_sdk-0.3.443}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alita_sdk
-Version: 0.3.441
+Version: 0.3.443
 Summary: SDK for building langchain agents using resources from Alita
 Author-email: Artem Rozumenko <artyom.rozumenko@gmail.com>, Mikalai Biazruchka <mikalai_biazruchka@epam.com>, Roman Mitusov <roman_mitusov@epam.com>, Ivan Krakhmaliuk <lifedj27@gmail.com>, Artem Dubrovskiy <ad13box@gmail.com>
 License-Expression: Apache-2.0

{alita_sdk-0.3.441 → alita_sdk-0.3.443}/alita_sdk/runtime/clients/client.py

@@ -342,6 +342,9 @@ class AlitaClient:
             app_type = "react"
         elif app_type == 'autogen':
             app_type = "react"
+        
+        # LangChainAssistant constructor calls get_tools() which may raise McpAuthorizationRequired
+        # The exception will propagate naturally to the indexer worker's outer handler
         if runtime == 'nonrunnable':
             return LangChainAssistant(self, data, llm, chat_history, app_type,
                                       tools=tools, memory=memory, store=store, mcp_tokens=mcp_tokens)
@@ -605,6 +608,9 @@ class AlitaClient:
             'tools': tools,  # Tool configs that will be processed by get_tools()
             'variables': variables
         }
+        
+        # LangChainAssistant constructor calls get_tools() which may raise McpAuthorizationRequired
+        # The exception will propagate naturally to the indexer worker's outer handler
         return LangChainAssistant(
             self,
             agent_data,

{alita_sdk-0.3.441 → alita_sdk-0.3.443}/alita_sdk/runtime/toolkits/mcp.py

@@ -22,6 +22,7 @@ from ..utils.mcp_oauth import (
     canonical_resource,
     extract_resource_metadata_url,
     fetch_resource_metadata,
+    infer_authorization_servers_from_realm,
 )
 
 logger = logging.getLogger(__name__)
@@ -545,8 +546,19 @@ class McpToolkit(BaseToolkit):
 
             auth_header = response.headers.get('WWW-Authenticate', '')
             if response.status_code == 401:
-                resource_metadata_url = extract_resource_metadata_url(auth_header)
+                resource_metadata_url = extract_resource_metadata_url(auth_header, connection_config.url)
                 metadata = fetch_resource_metadata(resource_metadata_url, timeout=timeout) if resource_metadata_url else None
+                
+                # If we couldn't get metadata from the resource_metadata endpoint,
+                # infer authorization servers from the WWW-Authenticate header and server URL
+                if not metadata or not metadata.get('authorization_servers'):
+                    inferred_servers = infer_authorization_servers_from_realm(auth_header, connection_config.url)
+                    if inferred_servers:
+                        if not metadata:
+                            metadata = {}
+                        metadata['authorization_servers'] = inferred_servers
+                        logger.info(f"Inferred authorization servers for {connection_config.url}: {inferred_servers}")
+                
                 raise McpAuthorizationRequired(
                     message=f"MCP server {connection_config.url} requires OAuth authorization",
                     server_url=canonical_resource(connection_config.url),
@@ -554,6 +566,7 @@ class McpToolkit(BaseToolkit):
                     www_authenticate=auth_header,
                     resource_metadata=metadata,
                     status=response.status_code,
+                    tool_name=toolkit_name,
                 )
 
             if response.status_code != 200:

{alita_sdk-0.3.441 → alita_sdk-0.3.443}/alita_sdk/runtime/tools/mcp_remote_tool.py

@@ -18,6 +18,7 @@ from ..utils.mcp_oauth import (
     canonical_resource,
     extract_resource_metadata_url,
     fetch_resource_metadata_async,
+    infer_authorization_servers_from_realm,
 )
 
 logger = logging.getLogger(__name__)
@@ -121,7 +122,7 @@ class McpRemoteTool(McpServerTool):
                 async with session.post(self.server_url, json=mcp_request, headers=headers) as response:
                     auth_header = response.headers.get('WWW-Authenticate') or response.headers.get('Www-Authenticate')
                     if response.status == 401:
-                        resource_metadata_url = extract_resource_metadata_url(auth_header)
+                        resource_metadata_url = extract_resource_metadata_url(auth_header, self.server_url)
                         metadata = None
                         if resource_metadata_url:
                             metadata = await fetch_resource_metadata_async(
@@ -129,6 +130,17 @@ class McpRemoteTool(McpServerTool):
                                 session=session,
                                 timeout=self.tool_timeout_sec,
                             )
+                        
+                        # If we couldn't get metadata from the resource_metadata endpoint,
+                        # infer authorization servers from the WWW-Authenticate header and server URL
+                        if not metadata or not metadata.get('authorization_servers'):
+                            inferred_servers = infer_authorization_servers_from_realm(auth_header, self.server_url)
+                            if inferred_servers:
+                                if not metadata:
+                                    metadata = {}
+                                metadata['authorization_servers'] = inferred_servers
+                                logger.info(f"Inferred authorization servers for {self.server_url}: {inferred_servers}")
+                        
                         raise McpAuthorizationRequired(
                             message=f"MCP server {self.server_url} requires OAuth authorization",
                             server_url=canonical_resource(self.server_url),
@@ -136,6 +148,7 @@ class McpRemoteTool(McpServerTool):
                             www_authenticate=auth_header,
                             resource_metadata=metadata,
                             status=response.status,
+                            tool_name=self.name,
                         )
 
                     if response.status != 200:

{alita_sdk-0.3.441 → alita_sdk-0.3.443}/alita_sdk/runtime/utils/mcp_oauth.py

@@ -21,6 +21,7 @@ class McpAuthorizationRequired(ToolException):
         www_authenticate: Optional[str] = None,
         resource_metadata: Optional[Dict[str, Any]] = None,
         status: Optional[int] = None,
+        tool_name: Optional[str] = None,
     ):
         super().__init__(message)
         self.server_url = server_url
@@ -28,6 +29,7 @@ class McpAuthorizationRequired(ToolException):
         self.www_authenticate = www_authenticate
         self.resource_metadata = resource_metadata
         self.status = status
+        self.tool_name = tool_name
 
     def to_dict(self) -> Dict[str, Any]:
         return {
@@ -37,21 +39,65 @@ class McpAuthorizationRequired(ToolException):
             "www_authenticate": self.www_authenticate,
             "resource_metadata": self.resource_metadata,
             "status": self.status,
+            "tool_name": self.tool_name,
         }
 
 
-def extract_resource_metadata_url(www_authenticate: Optional[str]) -> Optional[str]:
-    """Pull the resource_metadata URL from a WWW-Authenticate header if present."""
-    if not www_authenticate:
+def extract_resource_metadata_url(www_authenticate: Optional[str], server_url: Optional[str] = None) -> Optional[str]:
+    """
+    Pull the resource_metadata URL from a WWW-Authenticate header if present.
+    If not found and server_url is provided, try to construct resource metadata URLs.
+    """
+    if not www_authenticate and not server_url:
         return None
 
     # RFC9728 returns `resource_metadata="<url>"` inside the header value
-    match = re.search(r'resource_metadata\s*=\s*\"?([^\", ]+)\"?', www_authenticate)
-    if match:
-        return match.group(1)
+    if www_authenticate:
+        match = re.search(r'resource_metadata\s*=\s*\"?([^\", ]+)\"?', www_authenticate)
+        if match:
+            return match.group(1)
+    
+    # For servers that don't provide resource_metadata in WWW-Authenticate,
+    # we'll return None and rely on inferring authorization servers from the realm
+    # or using well-known OAuth discovery endpoints directly
     return None
 
 
+def infer_authorization_servers_from_realm(www_authenticate: Optional[str], server_url: str) -> Optional[list]:
+    """
+    Infer authorization server URLs from WWW-Authenticate realm or server URL.
+    This is used when the server doesn't provide resource_metadata endpoint.
+    """
+    if not www_authenticate and not server_url:
+        return None
+    
+    authorization_servers = []
+    
+    # Try to extract realm from WWW-Authenticate header
+    realm = None
+    if www_authenticate:
+        realm_match = re.search(r'realm\s*=\s*\"([^\"]+)\"', www_authenticate)
+        if realm_match:
+            realm = realm_match.group(1)
+    
+    # Parse the server URL to get base domain
+    parsed = urlparse(server_url)
+    base_url = f"{parsed.scheme}://{parsed.netloc}"
+    
+    # For OAuth 2.1 / OpenID Connect, try standard well-known endpoints
+    # These are the most common discovery endpoints
+    if realm and realm.lower() == "oauth":
+        # Standard OAuth 2.0 / 2.1 discovery endpoints
+        authorization_servers.append(f"{base_url}/.well-known/oauth-authorization-server")
+        authorization_servers.append(f"{base_url}/.well-known/openid-configuration")
+    else:
+        # If no realm or different realm, still try standard endpoints
+        authorization_servers.append(f"{base_url}/.well-known/oauth-authorization-server")
+        authorization_servers.append(f"{base_url}/.well-known/openid-configuration")
+    
+    return authorization_servers if authorization_servers else None
+
+
 def fetch_resource_metadata(resource_metadata_url: str, timeout: int = 10) -> Optional[Dict[str, Any]]:
     """Fetch and parse the protected resource metadata document."""
     try:

{alita_sdk-0.3.441 → alita_sdk-0.3.443}/alita_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alita_sdk
-Version: 0.3.441
+Version: 0.3.443
 Summary: SDK for building langchain agents using resources from Alita
 Author-email: Artem Rozumenko <artyom.rozumenko@gmail.com>, Mikalai Biazruchka <mikalai_biazruchka@epam.com>, Roman Mitusov <roman_mitusov@epam.com>, Ivan Krakhmaliuk <lifedj27@gmail.com>, Artem Dubrovskiy <ad13box@gmail.com>
 License-Expression: Apache-2.0

{alita_sdk-0.3.441 → alita_sdk-0.3.443}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "alita_sdk"
-version = "0.3.441"
+version = "0.3.443"
 description = "SDK for building langchain agents using resources from Alita"
 readme = "README.md"
 requires-python = ">=3.10"