+ Q(i?^^RIHt^RIt^RIt^RIHt^RIHt^RIH t ^RI t ^RI t ^RI H t ^RIHt^RIHt^R IHtHt^R IHt^R IHtHtHt^R IHt^R IHt^RIH t ^RI!H"t"H#t#^RI$H%t%^RI&H't'R.t(]'!])4t*!RR]+4t,RRRllt-!RR]4t.!RR]4t/R#)) annotationsN)AsyncGenerator)aclosing)Any)PydanticAdapter) AsyncKeyValue) MemoryStore)OAuthClientProvider TokenStorage)McpHttpClientFactory)OAuthClientInformationFullOAuthClientMetadata OAuthToken) AnyHttpUrl)override)Server)OAuthCallbackResultcreate_oauth_callback_server)find_available_port) get_loggerOAuthc]tRt^%tRtRtR#)ClientNotFoundErrorzARaised when OAuth client credentials are not found on the server.N)__name__ __module__ __qualname____firstlineno____doc____static_attributes__r_/Users/agent/.openclaw/workspace/venv/lib/python3.14/site-packages/fastmcp/client/auth/oauth.pyrr%sKr!rc$V^8dQhRRRRRR/#)mcp_urlstr httpx_kwargsdict[str, Any] | Nonereturnboolr)formats"r" __annotate__r,)s$  5 r!c"\P!R/T;'g/B;_uu_4GRjxL pVPVRR7GRjxL pVPR9dRRR4GRjxL R#RVP9dRRR4GRjxL R#RRR4GRjxL R#L{LaLALL \P dRRR4GRjxL R#i;i +GRjxL 'giR#;i5i) z Check if the MCP endpoint requires authentication by making a test request. Returns: True if auth appears to be required, False otherwise Ng@)timeoutTzWWW-AuthenticateFr)ii)httpx AsyncClientget status_codeheaders RequestError)r%r'clientresponses&& r"check_if_auth_requiredr7)s  8L$6$6B888F #ZZZ==H##z1988"X%5%55988988>9 !! %988  !9888s-C?B+C?C"B5 B- B5" C?-B/.C?4B5 C?B1C? C?$B3%C?-B5/C?1C?3C?5C C" C?CC?CC""C< (C+) C< 4C< 6 C?c]tRt^Gt$R]R&R]R&R]R&R]R&R R ltR R ltR RltRRlt] RRl4t ] RRl4t ] RRl4t ] RRl4t RtR#)TokenStorageAdapterr& _server_urlr_key_value_storezPydanticAdapter[OAuthToken]_storage_oauth_tokenz+PydanticAdapter[OAuthClientInformationFull]_storage_client_infoc V^8dQhRRRR/#)r$async_key_valuer server_urlr&r)r+s"r"r, TokenStorageAdapter.__annotate__Ms   3 r!c W nWn\\,!RV\RR7Vn\\ ,!RV\ RR7VnR#)zmcp-oauth-tokenT)default_collection key_valuepydantic_modelraise_on_validation_errorzmcp-oauth-client-infoN)r:r;rrr<r r=)selfr?r@s&&&r"__init__TokenStorageAdapter.__init__MsM% /$3J$?0%%&* % ! %44N$O6%5&* % !r!cV^8dQhRR/#r$r)r&r)r+s"r"r,rA]s,,c,r!c VP R2#)z/tokensr:rGs&r"_get_token_cache_key(TokenStorageAdapter._get_token_cache_key]s""#7++r!cV^8dQhRR/#rKr)r+s"r"r,rA`s11C1r!c VP R2#)z /client_inforMrNs&r"_get_client_info_cache_key.TokenStorageAdapter._get_client_info_cache_key`s""#<00r!cV^8dQhRR/#r$r)Noner)r+s"r"r,rAcsVVTVr!c "VPPVP4R7GRjxL VPPVP 4R7GRjxL R#L8L5i)keyN)r<deleterOr=rSrNs&r"clearTokenStorageAdapter.clearcsZ''..43L3L3N.OOO''..43R3R3T.UUU PUs!.A-A)1A-"A+#A-+A-cV^8dQhRR/#)r$r)zOAuthToken | Noner)r+s"r"r,rAhsTT"3Tr!c r"VPPVP4R7GRjxL #L5irY)r<r1rOrNs&r" get_tokensTokenStorageAdapter.get_tokensgs...22t7P7P7R2SSSS .757c V^8dQhRRRR/#)r$tokensrr)rWr)r+s"r"r,rAls  z d r!c z"VPPVP4VRR7GRjxL R#L5i)<rZvaluettlNi3)r<putrO)rGrds&&r" set_tokensTokenStorageAdapter.set_tokensks< ''++))+",   s 0;9;cV^8dQhRR/#)r$r)z!OAuthClientInformationFull | Noner)r+s"r"r,rAws  'H r!c r"VPPVP4R7GRjxL #L5irY)r=r1rSrNs&r"get_client_info#TokenStorageAdapter.get_client_infovs9..22//13    rbc V^8dQhRRRR/#)r$ client_infor r)rWr)r+s"r"r,rA}s   1K  PT  r!c "RpVP'd0VP\\P!44, pVPP VP 4VVR7GRjxL R#L5i)Nrg)client_secret_expires_atinttimer=rjrS)rGrrris&& r"set_client_info#TokenStorageAdapter.set_client_info|sf  / / /66TYY[9IIC''++//1,   sA3A>5A<6A>)r;r:r=r<N)rrrr__annotations__rHrOrSr\rr`rkrorwr rr!r"r9r9Gs##55EE ,1VTT        r!r9ca]tRt^t$RtR]R&RRRlltRV3RlltRV3R lltR R lt R R lt RV3Rllt Rt V;t #)rz OAuth client provider for MCP servers with browser-based authentication. This class provides OAuth authentication for FastMCP clients by opening a browser for user authorization and running a local callback server. r*_boundc@V^8dQhRRRRRRRRR R R R R RRRRRRR/ #)r$r%z str | Nonescopeszstr | list[str] | None client_namer& token_storagezAsyncKeyValue | Noneadditional_client_metadatar( callback_portz int | Nonehttpx_client_factoryzMcpHttpClientFactory | Noneclient_metadata_url client_id client_secretr)r+s"r"r,OAuth.__annotate__sn3 3 3 '3  3 , 3 %: 3 "3 :3 (3 3 "3 r!c  W nW0nW@nWPnW`nWnWnWnRVnT;'g\PVn RVn VeVPV4R#R#)a Initialize OAuth client provider for an MCP server. Args: mcp_url: Full URL to the MCP endpoint (e.g. "http://host/mcp/sse/"). Optional when OAuth is passed to Client(auth=...), which provides the URL automatically from the transport. scopes: OAuth scopes to request. Can be a space-separated string or a list of strings. client_name: Name for this client during registration token_storage: An AsyncKeyValue-compatible token store, tokens are stored in memory if not provided additional_client_metadata: Extra fields for OAuthClientMetadata callback_port: Fixed port for OAuth callback (default: random available port) client_metadata_url: A CIMD (Client ID Metadata Document) URL. When provided, this URL is used as the client_id instead of performing Dynamic Client Registration. Must be an HTTPS URL with a non-root path (e.g. "https://myapp.example.com/oauth/client.json"). client_id: Pre-registered OAuth client ID. When provided, skips dynamic client registration and uses these static credentials instead. client_secret: OAuth client secret (optional, used with client_id) NF)_scopes _client_name_token_storage_additional_client_metadata_callback_port_client_metadata_url _client_id_client_secret_static_client_infor/r0rr{_bind) rGr%r}r~rrrrrrrs &&&&&&&&&&&r"rHOAuth.__init__soL '++E(+$7!#+#' $8$M$MEiH  dllD ) )$,,/J \\ %T\\*JJ- )) %l34 .? #8    //552   ???'11t1DH,8;,0,?,?,?(V56(B(//("11((D $ ++<<{} m[ 1 1 % \  ;N); "  +..!22!22 $ 9 9   r!cV^8dQhRR/#rVr)r+s"r"r,rs J J4 Jr!c <"\SV`4GRjxL VPeIVPVPnVP P VP4GRjxL VPP'dZVPPP'd2VPPVPP4R#R#R#LL}5i)zBLoad stored tokens and client info, properly setting token expiry.N) r _initializercontextrrrrwcurrent_tokens expires_inupdate_token_expiry)rGrs&r"rOAuth._initializesg!###  # # /'+'?'?DLL $,,<%Jr!c "\4p\P!4p\VPVP VVR7p\P !4;_uu_4GRjxL pVPVP4\PRVP 24Rp\P!V4;_uu_4VP4GRjxL VP'd VPhVPVP3uuRRR4RVn\P"!R4GRjxL VP$P'4uuRRR4GRjxL #EL LL6L +'giM&;i \(dp\)RT R24ThRp?ii;iRTn\P"!R4GRjxL TP$P'4ME RTn\P"!R4GRjxL TP$P'4i;iRRR4GRjxL M +GRjxL 'giM;i\+R 4h5i) z4Handle OAuth callback and return (auth_code, state).)portr@result_container result_readyNu7🎧 OAuth callback server started on http://localhost:gr@Tg?zOAuth callback timed out after z secondsz+OAuth callback handler could not be started)ranyioEventrrr%create_task_group start_soonserverr fail_afterwaiterrorrstate should_exitsleep cancel_scopecancel TimeoutErrorr)rGresultrservertgTIMEOUTes& r"rOAuth.callback_handler7s%&{{} 6##||#%  **,,, MM&,, ' KKI$J\J\I]^ G )%%g..&++---|||$ll*!;; 4 /.&*"kk#&&&&&()-,,.''-/.   "5gYhG  /&*"kk#&&&&&(&*"kk#&&&&&()-,,,,,,HIIsA$I2&E3'I2*AI +F E< E6 E< 4#E<  F! I E8 I  I2-E:.I26E< 8I :I2< F F G4 F F/F**F//G43 I G I 4!H6H  H66I 9 I2II2 I$ I I$ I$ I2c V^8dQhRRRR/#)r$requestz httpx.Requestr)z-AsyncGenerator[httpx.Request, httpx.Response]r)r+s"r"r,r^s22$2 62r!c  `<"VP'g \R4h\\SV`V44;_uu_4GRjxL pRpVP V4GRjxL pV5xpK"L(L \ dMi;iRRR4GRjxL R# +GRjxL 'giR#;i \dTPe \R4Rh\PR4RTn TPP4GRjxL \\ST`T44;_uu_4GRjxL pRpTP T4GRjxL pT5xpK# \ dMi;iRRR4GRjxL R# +GRjxL 'giR#;ii;i5i)zHTTPX auth flow with automatic retry on stale cached credentials. If the OAuth flow fails due to invalid/stale client credentials, clears the cache and retries once with fresh registration. zOAuth provider has no server URL. Either pass mcp_url to OAuth() or use it with Client(auth=...) which provides the URL automatically.NzOAuth server rejected the static client credentials. Verify that the client_id (and client_secret, if provided) are correct and that the client is registered with the server.z@OAuth client not found on server, clearing cache and retrying...F)r{rrrasync_auth_flowasendStopAsyncIterationrrrdebug _initializedrr\)rGrgenr6yielded_requestrs&& r"rOAuth.async_auth_flow^sr{{{X %  7 @AAAS03 (0C*C)8#8 B +D-BAAAAA# ''3)U  LLR !&D ,,224 4 4  7 @AAAS03 (0C*C*C)8#8- BAAAAA% s7F.$B4A/B4 BA3#A1$ A3-B/B41A33 B>BBB B4BB4F.B1 B  B1 )B1 +B4/F.1B44AF+D)F+<D? =F+F E'E  E'%F ' E5 2F 4E5 5F 8 F+FF+ F. F' F F' F' F+$F.'F++F.)rr{rrrrrrrrrrr%rr) NNzFastMCP ClientNNNNNNN)rrrrrryrHrrrrrr __classcell__)rs@r"rrsD L3 jLL\ J J+*%JN22r!)N)0 __future__rrvrcollections.abcr contextlibrtypingrrr/key_value.aio.adapters.pydanticrkey_value.aio.protocolsrkey_value.aio.stores.memoryr mcp.client.authr r mcp.shared._httpx_utilsr mcp.shared.authr rrpydanticrtyping_extensionsruvicorn.serverrfastmcp.client.oauth_callbackrrfastmcp.utilities.httprfastmcp.utilities.loggingr__all__rr Exceptionrr7r9rrr!r"rs" * ;13=8  &!70 ) H L)L<@ ,@ FF Fr!