alita-sdk 0.3.442__tar.gz → 0.3.444__tar.gz

{alita_sdk-0.3.442 → alita_sdk-0.3.444}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alita_sdk
-Version: 0.3.442
+Version: 0.3.444
 Summary: SDK for building langchain agents using resources from Alita
 Author-email: Artem Rozumenko <artyom.rozumenko@gmail.com>, Mikalai Biazruchka <mikalai_biazruchka@epam.com>, Roman Mitusov <roman_mitusov@epam.com>, Ivan Krakhmaliuk <lifedj27@gmail.com>, Artem Dubrovskiy <ad13box@gmail.com>
 License-Expression: Apache-2.0

{alita_sdk-0.3.442 → alita_sdk-0.3.444}/alita_sdk/runtime/toolkits/mcp.py

@@ -22,6 +22,7 @@ from ..utils.mcp_oauth import (
     canonical_resource,
     extract_resource_metadata_url,
     fetch_resource_metadata,
+    infer_authorization_servers_from_realm,
 )
 
 logger = logging.getLogger(__name__)
@@ -547,6 +548,25 @@ class McpToolkit(BaseToolkit):
             if response.status_code == 401:
                 resource_metadata_url = extract_resource_metadata_url(auth_header, connection_config.url)
                 metadata = fetch_resource_metadata(resource_metadata_url, timeout=timeout) if resource_metadata_url else None
+                
+                # If we couldn't get metadata from the resource_metadata endpoint,
+                # infer authorization servers from the WWW-Authenticate header and server URL
+                if not metadata or not metadata.get('authorization_servers'):
+                    inferred_servers = infer_authorization_servers_from_realm(auth_header, connection_config.url)
+                    if inferred_servers:
+                        if not metadata:
+                            metadata = {}
+                        metadata['authorization_servers'] = inferred_servers
+                        logger.info(f"Inferred authorization servers for {connection_config.url}: {inferred_servers}")
+                        
+                        # Fetch OAuth authorization server metadata from the inferred server
+                        # This avoids CORS issues in the frontend
+                        from alita_sdk.runtime.utils.mcp_oauth import fetch_oauth_authorization_server_metadata
+                        auth_server_metadata = fetch_oauth_authorization_server_metadata(inferred_servers[0], timeout=timeout)
+                        if auth_server_metadata:
+                            metadata['oauth_authorization_server'] = auth_server_metadata
+                            logger.info(f"Fetched OAuth metadata for {inferred_servers[0]}")
+                
                 raise McpAuthorizationRequired(
                     message=f"MCP server {connection_config.url} requires OAuth authorization",
                     server_url=canonical_resource(connection_config.url),

{alita_sdk-0.3.442 → alita_sdk-0.3.444}/alita_sdk/runtime/tools/mcp_remote_tool.py

@@ -18,6 +18,7 @@ from ..utils.mcp_oauth import (
     canonical_resource,
     extract_resource_metadata_url,
     fetch_resource_metadata_async,
+    infer_authorization_servers_from_realm,
 )
 
 logger = logging.getLogger(__name__)
@@ -129,6 +130,25 @@ class McpRemoteTool(McpServerTool):
                                 session=session,
                                 timeout=self.tool_timeout_sec,
                             )
+                        
+                        # If we couldn't get metadata from the resource_metadata endpoint,
+                        # infer authorization servers from the WWW-Authenticate header and server URL
+                        if not metadata or not metadata.get('authorization_servers'):
+                            inferred_servers = infer_authorization_servers_from_realm(auth_header, self.server_url)
+                            if inferred_servers:
+                                if not metadata:
+                                    metadata = {}
+                                metadata['authorization_servers'] = inferred_servers
+                                logger.info(f"Inferred authorization servers for {self.server_url}: {inferred_servers}")
+                                
+                                # Fetch OAuth authorization server metadata from the inferred server
+                                # This avoids CORS issues in the frontend
+                                from alita_sdk.runtime.utils.mcp_oauth import fetch_oauth_authorization_server_metadata
+                                auth_server_metadata = fetch_oauth_authorization_server_metadata(inferred_servers[0], timeout=self.tool_timeout_sec)
+                                if auth_server_metadata:
+                                    metadata['oauth_authorization_server'] = auth_server_metadata
+                                    logger.info(f"Fetched OAuth metadata for {inferred_servers[0]}")
+                        
                         raise McpAuthorizationRequired(
                             message=f"MCP server {self.server_url} requires OAuth authorization",
                             server_url=canonical_resource(self.server_url),

{alita_sdk-0.3.442 → alita_sdk-0.3.444}/alita_sdk/runtime/utils/mcp_oauth.py

@@ -46,7 +46,7 @@ class McpAuthorizationRequired(ToolException):
 def extract_resource_metadata_url(www_authenticate: Optional[str], server_url: Optional[str] = None) -> Optional[str]:
     """
     Pull the resource_metadata URL from a WWW-Authenticate header if present.
-    If not found and server_url is provided, construct the standard .well-known URL.
+    If not found and server_url is provided, try to construct resource metadata URLs.
     """
     if not www_authenticate and not server_url:
         return None
@@ -57,16 +57,62 @@ def extract_resource_metadata_url(www_authenticate: Optional[str], server_url: O
         if match:
             return match.group(1)
     
-    # Fallback: construct standard .well-known URL if server_url provided
-    if server_url:
-        parsed = urlparse(server_url)
-        # Build the standard resource metadata URL
-        base_url = f"{parsed.scheme}://{parsed.netloc}"
-        return f"{base_url}/.well-known/resource-metadata"
+    # For servers that don't provide resource_metadata in WWW-Authenticate,
+    # we'll return None and rely on inferring authorization servers from the realm
+    # or using well-known OAuth discovery endpoints directly
+    return None
+
+
+def fetch_oauth_authorization_server_metadata(base_url: str, timeout: int = 10) -> Optional[Dict[str, Any]]:
+    """
+    Fetch OAuth authorization server metadata from well-known endpoints.
+    Tries both oauth-authorization-server and openid-configuration discovery endpoints.
+    """
+    discovery_endpoints = [
+        f"{base_url}/.well-known/oauth-authorization-server",
+        f"{base_url}/.well-known/openid-configuration",
+    ]
+    
+    for endpoint in discovery_endpoints:
+        try:
+            resp = requests.get(endpoint, timeout=timeout)
+            if resp.status_code == 200:
+                return resp.json()
+        except Exception as exc:
+            logger.debug(f"Failed to fetch OAuth metadata from {endpoint}: {exc}")
+            continue
     
     return None
 
 
+def infer_authorization_servers_from_realm(www_authenticate: Optional[str], server_url: str) -> Optional[list]:
+    """
+    Infer authorization server URLs from WWW-Authenticate realm or server URL.
+    This is used when the server doesn't provide resource_metadata endpoint.
+    """
+    if not www_authenticate and not server_url:
+        return None
+    
+    authorization_servers = []
+    
+    # Try to extract realm from WWW-Authenticate header
+    realm = None
+    if www_authenticate:
+        realm_match = re.search(r'realm\s*=\s*\"([^\"]+)\"', www_authenticate)
+        if realm_match:
+            realm = realm_match.group(1)
+    
+    # Parse the server URL to get base domain
+    parsed = urlparse(server_url)
+    base_url = f"{parsed.scheme}://{parsed.netloc}"
+    
+    # Return the base authorization server URL (not the discovery endpoint)
+    # The client will append .well-known paths when fetching metadata
+    authorization_servers.append(base_url)
+    
+    return authorization_servers if authorization_servers else None
+
+
 def fetch_resource_metadata(resource_metadata_url: str, timeout: int = 10) -> Optional[Dict[str, Any]]:
     """Fetch and parse the protected resource metadata document."""
     try:

{alita_sdk-0.3.442 → alita_sdk-0.3.444}/alita_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alita_sdk
-Version: 0.3.442
+Version: 0.3.444
 Summary: SDK for building langchain agents using resources from Alita
 Author-email: Artem Rozumenko <artyom.rozumenko@gmail.com>, Mikalai Biazruchka <mikalai_biazruchka@epam.com>, Roman Mitusov <roman_mitusov@epam.com>, Ivan Krakhmaliuk <lifedj27@gmail.com>, Artem Dubrovskiy <ad13box@gmail.com>
 License-Expression: Apache-2.0

{alita_sdk-0.3.442 → alita_sdk-0.3.444}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "alita_sdk"
-version = "0.3.442"
+version = "0.3.444"
 description = "SDK for building langchain agents using resources from Alita"
 readme = "README.md"
 requires-python = ">=3.10"