kKj1rdZddlmZddlZddlZddlZddlmZddlm Z ddl m Z ddl m Z ddlmZmZmZdd lmZdd lmZdd lmZdd lmZmZmZmZdd lmZddlm Z m!Z!m"Z"m#Z#ddl$m%Z%erddl&m'Z'e%e(Z)d"dZ*GddeZ+Gdde,Z-Gdde,Z.e GddZ/e GddZ0GddZ1GddZ2Gd d!Z3y)#aCIMD (Client ID Metadata Document) support for FastMCP. .. warning:: **Beta Feature**: CIMD support is currently in beta. The API may change in future releases. Please report any issues you encounter. CIMD is a simpler alternative to Dynamic Client Registration where clients host a static JSON document at an HTTPS URL, and that URL becomes their client_id. See the IETF draft: draft-parecki-oauth-client-id-metadata-document This module provides: - CIMDDocument: Pydantic model for CIMD document validation - CIMDFetcher: Fetch and validate CIMD documents with SSRF protection - CIMDClientManager: Manages CIMD client operations ) annotationsN)Mapping) dataclass)timezone)parsedate_to_datetime) TYPE_CHECKINGAnyLiteral)urlparse)jwk) JoseError) AnyHttpUrl BaseModelFieldfield_validator)matches_allowed_pattern) SSRFErrorSSRFFetchErrorssrf_safe_fetch_response validate_url) get_logger JWTVerifierc |jd}|dk(r3tj|djj dS|dk(r3tj|djj dSt d|)NktyRSAzutf-8ECzUnsupported JWK key type: )getr import_keyas_pemdecode ValueError)key_datakey_types i/Users/ahmed/devFolder/Ultron/claude-voice/.venv/lib/python3.12/site-packages/fastmcp/server/auth/cimd.py _jwk_to_pemr&0s}||E"H5~~h.557>>wGG4~~h-446==gFF 1(> ??cFeZdZUdZeddZded<edd Zd ed <edd Zd ed<edd Z d ed<eddZ ded<edd Z ded<eddZ ded<eddZ ded<edd Zd ed <edd! Zd"ed#<edd$ Zd ed%<edd& Zd ed'<edd( Zd ed)<edd* Zd+ed,<edd- Zd ed.<edd/ Zd ed0<eded3d1Zeded4d2Zy)5 CIMDDocumentaCIMD document per draft-parecki-oauth-client-id-metadata-document. The client metadata document is a JSON document containing OAuth client metadata. The client_id property MUST match the URL where this document is hosted. Key constraint: token_endpoint_auth_method MUST NOT use shared secrets (client_secret_post, client_secret_basic, client_secret_jwt). redirect_uris is required and must contain at least one entry. .z0Must match the URL where this document is hosted) descriptionr client_idNz!Human-readable name of the client)defaultr* str | None client_namezURL of the client's home pagezAnyHttpUrl | None client_urizURL of the client's logo imagelogo_urizWArray of allowed redirect URIs (may include wildcards like http://localhost:*/callback) list[str] redirect_urisnonezDAuthentication method for token endpoint (no shared secrets allowed)z"Literal['none', 'private_key_jwt']token_endpoint_auth_methodcdgS)Nauthorization_coder7r'r%zCIMDDocument._s!5 6r'z%OAuth grant types the client will use)default_factoryr* grant_typescdgS)Ncoder7r7r'r%r8zCIMDDocument.csr'z(OAuth response types the client will useresponse_typesz5Space-separated list of scopes the client may requestscopez,Contact information for the client developerlist[str] | Nonecontactsz$URL of the client's terms of servicetos_uriz"URL of the client's privacy policy policy_uriz:URL of the client's JSON Web Key Set (for private_key_jwt)jwks_uriz/Client's JSON Web Key Set (for private_key_jwt)zdict[str, Any] | Nonejwksz)Unique identifier for the client software software_idzVersion of the client softwaresoftware_versionc4hd}||vrtd|d|S)z.Ensure no shared-secret auth methods are used.>client_secret_jwtclient_secret_postclient_secret_basicz6CIMD documents cannot use shared-secret auth methods: z*. Use 'none' or 'private_key_jwt' instead.)r")clsv forbiddens r%validate_auth_methodz!CIMDDocument.validate_auth_methods7W >HL;; r'c |s td|D]p}|r|js tdt|}|jstd||jrR|j drdtd||S)z@Ensure redirect_uris is non-empty and each entry is a valid URI.z5CIMD documents must include at least one redirect_uriz,CIMD redirect_uris must be non-empty stringszACIMD redirect_uri must have a scheme (e.g. http:// or https://): zurn:z$CIMD redirect_uri must have a host: )r"stripr schemenetloc startswith)rKrLuriparseds r%validate_redirect_urisz#CIMDDocument.validate_redirect_urissTU UCciik !OPPc]F== WX[W^_==)? #Gw!OPPr')rLstrreturnrW)rLr1rXr1)__name__ __module__ __qualname____doc__rr+__annotations__r.r/r0r2r4r:r=r>r@rArBrCrDrErFr classmethodrNrVr7r'r%r)r)9s " FIz$7K%*3%J!#(4#H % m M9FKZF B#6;K!&(>!NIKE:"'B"H"':"G %*8%J!#(P#H#(E#D $?K$)4$j 123_%&r'r)ceZdZdZy)CIMDValidationErrorz+Raised when CIMD document validation fails.NrYrZr[r\r7r'r%r`r`s5r'r`ceZdZdZy)CIMDFetchErrorz)Raised when CIMD document fetching fails.Nrar7r'r%rcrcs3r'rccNeZdZUdZded<ded<ded<ded<ded <d ed <y ) _CIMDCacheEntryz8Cached CIMD document and associated HTTP cache metadata.r)docr-etag last_modifiedfloat expires_atfreshness_lifetimeboolmust_revalidateNrYrZr[r\r]r7r'r%reres)B  r'recNeZdZUdZded<ded<ded<ded<ded <ded <y ) _CIMDCachePolicyz>Normalized cache directives parsed from HTTP response headers.r-rgrhrirjrkrlno_storermNrnr7r'r%rprps(H Nr'rpcZeZdZdZdZdZ d d dZ d dZddZddZ ddZ dd Z y ) CIMDFetcherasFetch and validate CIMD documents with SSRF protection. Delegates HTTP fetching to ssrf_safe_fetch_response, which provides DNS pinning, IP validation, size limits, and timeout enforcement. Documents are cached using HTTP caching semantics (Cache-Control/ETag/Last-Modified), with a TTL fallback when response headers do not define caching behavior. iic ||_i|_y)zxInitialize the CIMD fetcher. Args: timeout: HTTP request timeout in seconds (default 10.0) N)timeout_cache)selfrus r%__init__zCIMDFetcher.__init__s 24 r'c|jDcic]\}}|j|}}}|jdd}|jdDchc]1}|j s|j j3}}d|v} d|v} d} |D]J} | j ds| j dj } tdt| } nd}| || z}nOd |vrK t|d }|j |jtj }|j#}|||j&z}td ||z }t)|jd|jd||| | Scc}}wcc}w#t$rtjd | YwxYw#t$tf$rtjd |d YwxYw)z3Parse HTTP cache headers and derive cache behavior. cache-control,zno-storezno-cacheNzmax-age=rz0Ignoring invalid Cache-Control max-age value: %sexpires)tzinfoz4Ignoring invalid Expires header on CIMD response: %sgrgz last-modifiedrgrhrjrkrqrm)itemslowerrsplitrPrS removeprefixmaxintr"loggerdebugrr~replacerutc timestamp TypeErrorDEFAULT_CACHE_TTL_SECONDSrp)rwheadersnowkrL normalized cache_controlpart directivesrqrmmax_age directivevaluerjdtrks r%_parse_cache_policyzCIMDFetcher._parse_cache_policys07}}?tq!aggil ?"; -:-@-@-E -ETDJJL   -E  +$ 2"#I##J/!..z:@@B!!SZ0G $$(  wJ * $ *:i+@A99$8<<8B\\^   t===J j3&67'$..9!1+   Q@ "LLJEz*  Jy) s6FF- FF7A GF=<F=(G+*G+cZ|Dchc]}|j}}d|vxsd|vScc}w)z>Return True when response includes cache freshness directives.rzr})r)rwrrrs r%_has_freshness_headersz"CIMDFetcher._has_freshness_headerss6)01Aaggi 1*,G Z0GG2s(c|sy t|}|jdk(xr%t|jxr|jdvS#t t f$rYywxYw)ztCheck if a client_id looks like a CIMD URL. CIMD URLs must be HTTPS with a host and non-root path. Fhttps)r{/)r rQrlrRpathr"AttributeError)rwr+rUs r%is_cimd_client_idzCIMDFetcher.is_cimd_client_idse  i(F (1'1KKy0  N+  sAAAAc K|jj|}tj}d}dh}|e|js||jkr |j Si}|j r|j |d<|jr|j|d<|rddh} t|d|j|jd||d{}|j dk(rA| td tj}|j#|j$r|j'|j$|}n2t)dd||j*z|j*d |j }|j,st/|j |j xs |j |jxs |j|j|j*|j |j|<|j S|jj1|d|j Stj}|j'|j$|} t3j4|j6} t:j=| } t| j@jCd|jCdk7rtd| j@d|d| jDr)t| jD} tG| d{tHjKd|| jL|j,sRt/| |j |j|j|j*|j |j|<| S|jj1|d| S7#t$r}tt||d}~wt$r}tt||d}~wwxYw#t2j8$r}td ||d}~wwxYw#t>$r}td||d}~wwxYw76#t$r}td||d}~wwxYww)aFetch and validate a CIMD document with SSRF protection. Uses ssrf_safe_fetch_response for the HTTP layer, which provides: - HTTPS only, DNS resolution with IP validation - DNS pinning (connects to validated IP directly) - Blocks private/loopback/link-local/multicast IPs - Response size limit and timeout enforcement - Redirects disabled Args: client_id_url: The URL to fetch (also the expected client_id) Returns: Validated CIMDDocument Raises: CIMDValidationError: If document is invalid or URL blocked CIMDFetchError: If document cannot be fetched Nz If-None-MatchzIf-Modified-Sincei0Tg>@) require_pathmax_sizeruoverall_timeoutrequest_headersallowed_status_codesz=CIMD server returned 304 Not Modified without cached documentFr)rfrgrhrjrkrmz!CIMD document is not valid JSON: zInvalid CIMD document: rz(CIMD client_id mismatch: document says 'z' but was fetched from ''z&CIMD jwks_uri failed SSRF validation: z8CIMD document fetched and validated: %s (client_name=%s))'rvrtimermrjrfrgrhrMAX_RESPONSE_SIZErurr`rWrrc status_coderrrrprkrqrepopjsonloadscontentJSONDecodeErrorr)model_validate Exceptionr+rstriprCrrinfor.) rw client_id_urlcachedrrrresponseepolicydatarf jwks_uri_strs r%fetchzCIMDFetcher.fetch+s (/iik15 #u  ))cF4E4E.Ezz! O{{39;;0##7=7K7K 34(+Sz$ 05!// $ /%9H   3 &~$S))+C**8+;+;<11(2B2BCH*"&"V%>%>>'-'@'@"$*$:$: ??-< 3 "("6"6"N&:N:N%00'-'@'@$*$:$: . M*::   t4:: iik))(*:*:C@ V::h../D L--d3C s}}  $ $S )]-A-A#-F F%:3==/J))6q:  <<s||,L "<000  F  OO )8[[$22!,,#)#<#< & 6 6 *DKK &  KKOOM4 0  5%c!f-1 4 0 Q(a / 0T## V%(I!&MNTU U V  L%(?s&CD! K L1 )L'>83#)3'>LC$  KK  Es7| T Ms BBctj}||jz |jkDr|j ||_yy)z>Periodically cleanup expired JTIs to prevent unbounded growth.N)rrrrr)rwrs r%_maybe_cleanupz%CIMDAssertionValidator._maybe_cleanups@nn ## #d&<&< <  & & (!$D  =r'clKddlm}|j|jrt |j}|d|d|}|j j |}|||||d}t|j |jk\r+tt|j } |j | =||j |<n?|jr(|j||j} || ||}n td|j|d{} | s td | j} t!j } | j d }| j d }|s td || d z kr td|rD|| d zkDr td||z |j"kDrJtd||z d|j"d|| |j"zkDrtd|j"d| j d|k7rtd|| j d}|s td||j$vr0|j$|}|| kDrtd|d|j$|=||j$|<t|j$|j&kDrc|j)t|j$|j&kDr1|j*j-d|j&td|j*j/d|y7w)aValidate JWT assertion from client. Args: assertion: The JWT assertion string client_id: Expected client_id (must match iss and sub claims) token_endpoint: Token endpoint URL (must match aud claim) cimd_doc: CIMD document containing JWKS for key verification Returns: True if valid Raises: ValueError: If validation fails rr|NT)rCissueraudience ssrf_safe) public_keyrrz45 5 S2X~ !ABBSy4666 3C#I;gdFaFaEbbde S46666 ;D&>> ##E,,!!BCC  @) ICsDL4L1HL4c |jdd}|ddt|dzz zz }tjt j |}|j d}|j dg}|s td d}|D]} |s| j d|k(s| }n|s>t|d k(r!|d}|jjd ntd |d  t|S#tttjf$r}td||d}~wwxYw#tttf$r}td||d}~wwxYw)aExtract public key from inline JWKS. Args: token: JWT token to extract kid from jwks: JWKS document containing keys Returns: PEM-encoded public key Raises: ValueError: If key cannot be found or extracted .r=kidz%Failed to extract key ID from token: NkeyszJWKS document contains no keysz3No matching kid in JWKS, using single available keyzNo matching key found for kid=z in JWKSzFailed to convert JWK to PEM: )rrrrbase64urlsafe_b64decoder IndexErrorr"rrrr&r r) rwtokenrD header_b64headerrrr matching_keykeys r%rz4CIMDAssertionValidator._extract_public_key_from_jwkswsd QS)!,J #S_q%8!89 9JZZ 8 8 DEF**U#C xx#=> > Cswwu~,"  4yA~#Aw  ##I!#A#h!OPP J|, ,5J(<(<= QDQCHIq P Q69j1 J=aSAB I Js0A$C5* D*5D'D""D'*E>E  EN)rXNone) rrWr+rWrrWrr)rXrl)rrWrDdictrXrW) rYrZr[r\rrxrrrrr7r'r%rrsa ! +U%||| |  |  ||/Jr'rcNeZdZdZ d ddZd dZd dZ d dZy) CIMDClientManageraWManages all CIMD client operations for OAuth proxy. This class encapsulates: - CIMD client detection - Document fetching and validation - Synthetic OAuth client creation - Private key JWT assertion validation This allows the OAuth proxy to delegate all CIMD-specific logic to a single, focused manager class. Nc||_||_||_t|_t |_tt|_ y)a!Initialize CIMD client manager. Args: enable_cimd: Whether CIMD support is enabled default_scope: Default scope for CIMD clients if not specified in document allowed_redirect_uri_patterns: Allowed redirect URI patterns (proxy's config) N) enabled default_scopeallowed_redirect_uri_patternsrs_fetcherr_assertion_validatorrrYr)rw enable_cimdrr s r%rxzCIMDClientManager.__init__s;# *-J*#  $:$<! * r'cT|jxr|jj|S)zCheck if client_id is a CIMD URL. Args: client_id: Client ID to check Returns: True if client_id is an HTTPS URL (CIMD format) )rr r)rwr+s r%rz#CIMDClientManager.is_cimd_client_ids"||J ? ? JJr'c  K|jsy |jj|d{}ddlm}d}||d||j|jxs |j|j|j|j|tj }|j j!d||j|S7#ttf$r'}|j j d||Yd}~yd}~wwxYww)aFetch CIMD document and create synthetic OAuth client. Args: client_id_url: HTTPS URL pointing to CIMD document Returns: OAuthProxyClient with CIMD document attached, or None if fetch fails Note: Return type is left untyped to avoid circular import with oauth_proxy. Returns OAuthProxyClient instance or None. NzCIMD fetch failed for %s: %sr)ProxyDCRClient) r+ client_secretr2r:r>r4r r. cimd_documentcimd_fetched_atz"CIMD client resolved: %s (name=%s))rr rrcr`rr&fastmcp.server.auth.oauth_proxy.modelsrr:r>rr4r r.rr)rwrrrrr2clients r% get_clientzCIMDClientManager.get_clients|| !]]00??H J  #' ,,..6D$6$6'/'J'J*.*L*L ,," IIK    0     =@ 34  KK   > q Q s>DC C C BD C DC<7D<DDcKt|dr |js td|j}|jdk7r td|jj ||j ||d{S7w)aValidate JWT assertion for private_key_jwt auth. Args: assertion: JWT assertion string from client client: OAuth proxy client (must have cimd_document) token_endpoint: Token endpoint URL for aud validation Returns: True if assertion is valid Raises: ValueError: If client doesn't have CIMD document or validation fails rz2Client must have CIMD document for private_key_jwtprivate_key_jwtz6CIMD document must specify private_key_jwt auth methodN)hasattrrr"r4r rr+)rwrrrrs r%validate_private_key_jwtz*CIMDClientManager.validate_private_key_jwts~&v/v7K7KQR R''  . .2C CUV V..AA v''    sA5A>7A<8A>)Tr{N)r rlrrWr r?r)rrW)rrWrrWrXrl)rYrZr[r\rxrrrr7r'r%rrs` !:> +++(8 +* K/b      r'r)r#zdict[str, Any]rXrW)4r\ __future__rrrrcollections.abcr dataclassesrdatetimer email.utilsrtypingrr r urllib.parser joserfcr joserfc.errorsr pydanticrrrr'fastmcp.server.auth.redirect_validationrfastmcp.server.auth.ssrfrrrrfastmcp.utilities.loggingrrrrYrr&r)rr`rcrerprsrrr7r'r%r's # #!-..!$BBK 1= H @j9jZ6)64Y4    EEPXJXJvz z r'