+ P(iL^RIHt^RIHt^RIHt^RIHt!RR]4tR#))default_json_headers)InvalidRequestError) TokenEndpoint)UnsupportedTokenTypeErrorcRa]tRt^toRtRtRtRtRtRt Rt Rt R t R t VtR #) IntrospectionEndpointz}Implementation of introspection endpoint which is described in `RFC7662`_. .. _RFC7662: https://tools.ietf.org/html/rfc7662 introspectionc VPW4VPVPR,VPPR44pV'dVP W2V4'dV#R#R#)aThe protected resource calls the introspection endpoint using an HTTP ``POST`` request with parameters sent as "application/x-www-form-urlencoded" data. The protected resource sends a parameter representing the token along with optional parameters representing additional context that is known by the protected resource to aid the authorization server in its response. token **REQUIRED** The string value of the token. For access tokens, this is the ``access_token`` value returned from the token endpoint defined in OAuth 2.0. For refresh tokens, this is the ``refresh_token`` value returned from the token endpoint as defined in OAuth 2.0. token_type_hint **OPTIONAL** A hint about the type of the token submitted for introspection. tokentoken_type_hintN) check_params query_tokenformgetcheck_permission)selfrequestclientr s&&& j/Users/agent/.openclaw/workspace/venv/lib/python3.14/site-packages/authlib/oauth2/rfc7662/introspection.pyauthenticate_token(IntrospectionEndpoint.authenticate_tokensd& '*  LL !7<<#3#34E#F  T**5'BBLC5cVPpRV9d \4hVPR4pV'dW@P9d \ 4hR#R#)r r N)rrrSUPPORTED_TOKEN_TYPESr)rrrparamshints&&& rr "IntrospectionEndpoint.check_params,sI & %' 'zz+, D : ::+- -;4rc zVPV4pVPW4pVPV4p^V\3#)z`Validate introspection request and create the response. :returns: (status_code, body, headers) )authenticate_endpoint_clientrcreate_introspection_payloadr)rrrr bodys&& rcreate_endpoint_response.IntrospectionEndpoint.create_endpoint_response5sF 227;''8007D...rcV'gRR/#VP4'gVP4'dRR/#VPV4pRV9dRVR&V#)activeFT) is_expired is_revokedintrospect_token)rr payloads&& rr 2IntrospectionEndpoint.create_introspection_payloadEsa e$ $     !1!1!3!3e$ $''. 7 " $GH rc \4h)a%Check if the request has permission to introspect the token. Developers MUST implement this method:: def check_permission(self, token, client, request): # only allow a special client to introspect the token return client.client_id == "introspection_client" :return: bool NotImplementedError)rr rrs&&&&rr&IntrospectionEndpoint.check_permissionSs "##rc \4h)a2Get the token from database/storage by the given token string. Developers should implement this method:: def query_token(self, token_string, token_type_hint): if token_type_hint == "access_token": tok = Token.query_by_access_token(token_string) elif token_type_hint == "refresh_token": tok = Token.query_by_refresh_token(token_string) else: tok = Token.query_by_access_token(token_string) if not tok: tok = Token.query_by_refresh_token(token_string) return tok r,)r token_stringr s&&&rr!IntrospectionEndpoint.query_token_s "##rc \4h)aRead given token and return its introspection metadata as a dictionary following `Section 2.2`_:: def introspect_token(self, token): return { "active": True, "client_id": token.client_id, "token_type": token.token_type, "username": get_token_username(token), "scope": token.get_scope(), "sub": get_token_user_sub(token), "aud": token.client_id, "iss": "https://server.example.com/", "exp": token.expires_at, "iat": token.issued_at, } .. _`Section 2.2`: https://tools.ietf.org/html/rfc7662#section-2.2 r,)rr s&&rr(&IntrospectionEndpoint.introspect_tokenps ("##rN)__name__ __module__ __qualname____firstlineno____doc__ ENDPOINT_NAMErr r"r rrr(__static_attributes____classdictcell__) __classdict__s@rrrs9$M4./  $$"$$rrN)authlib.constsrrfc6749rrrrr4rrr@s/)#/|$M|$r