+ Q(ipRt^RIHt^RIt^RIt^RIt^RIHt^RIH t ^RI H t ^RI H t ^RIHtHtHt^RIHt^R IHtHtHtHt^R IHtHtHtHt^R IHt]'d^R I H!t!]!]"4t#!R R]4t$!RR]%4t&!RR]%4t'] !RR44t(] !RR44t)!RR4t*!RR4t+!RR4t,R#)aCIMD (Client ID Metadata Document) support for FastMCP. .. warning:: **Beta Feature**: CIMD support is currently in beta. The API may change in future releases. Please report any issues you encounter. CIMD is a simpler alternative to Dynamic Client Registration where clients host a static JSON document at an HTTPS URL, and that URL becomes their client_id. See the IETF draft: draft-parecki-oauth-client-id-metadata-document This module provides: - CIMDDocument: Pydantic model for CIMD document validation - CIMDFetcher: Fetch and validate CIMD documents with SSRF protection - CIMDClientManager: Manages CIMD client operations ) annotationsN)Mapping) dataclass)timezone)parsedate_to_datetime) TYPE_CHECKINGAnyLiteral)urlparse) AnyHttpUrl BaseModelFieldfield_validator) SSRFErrorSSRFFetchErrorssrf_safe_fetch_response validate_url) get_logger JWTVerifiercX]tRt^-t$Rt]!RRR7tR]R&]!RRR 7tR ]R &]!RR R 7t R ]R&]!RRR 7t R ]R&]!RRR7t R]R&]!RRR 7t R]R&]!RRR7t R]R&]!RRR7tR]R&]!RRR 7tR ]R &]!RR!R 7tR"]R#&]!RR$R 7tR ]R%&]!RR&R 7tR ]R'&]!RR(R 7tR ]R)&]!RR*R 7tR+]R,&]!RR-R 7tR ]R.&]!RR/R 7tR ]R0&]!R4]R1R2l44t]!R4]R3R4l44tR5tR#)6 CIMDDocumentaCIMD document per draft-parecki-oauth-client-id-metadata-document. The client metadata document is a JSON document containing OAuth client metadata. The client_id property MUST match the URL where this document is hosted. Key constraint: token_endpoint_auth_method MUST NOT use shared secrets (client_secret_post, client_secret_basic, client_secret_jwt). redirect_uris is required and must contain at least one entry. .z0Must match the URL where this document is hosted) descriptionr client_idNz!Human-readable name of the client)defaultr str | None client_namezURL of the client's home pagezAnyHttpUrl | None client_urizURL of the client's logo imagelogo_urizWArray of allowed redirect URIs (may include wildcards like http://localhost:*/callback) list[str] redirect_urisnonezDAuthentication method for token endpoint (no shared secrets allowed)z"Literal['none', 'private_key_jwt']token_endpoint_auth_methodc R.#)authorization_coder%^/Users/agent/.openclaw/workspace/venv/lib/python3.14/site-packages/fastmcp/server/auth/cimd.pyCIMDDocument.Ss!5 6r&z%OAuth grant types the client will use)default_factoryr grant_typesc R.#)coder%r%r&r'r(r)Wsr&z(OAuth response types the client will useresponse_typesz5Space-separated list of scopes the client may requestscopez,Contact information for the client developerlist[str] | Nonecontactsz$URL of the client's terms of servicetos_uriz"URL of the client's privacy policy policy_uriz:URL of the client's JSON Web Key Set (for private_key_jwt)jwks_uriz/Client's JSON Web Key Set (for private_key_jwt)zdict[str, Any] | Nonejwksz)Unique identifier for the client software software_idzVersion of the client softwaresoftware_versionc V^8dQhRRRR/#)vstrreturnr%)formats"r' __annotate__CIMDDocument.__annotate__}sSSr&c 80RmpW9d\RV R24hV#)z.Ensure no shared-secret auth methods are used.z6CIMD documents cannot use shared-secret auth methods: z*. Use 'none' or 'private_key_jwt' instead.>client_secret_jwtclient_secret_postclient_secret_basic) ValueError)clsr: forbiddens&& r'validate_auth_method!CIMDDocument.validate_auth_method{s5W >HL;; r&c V^8dQhRRRR/#)r9r:rr<r%)r=s"r'r>r?syYr&c \V'g \R4hVFpV'dVP4'g \R4h\V4pVP'g\RV: 24hVP'dKlVP R4'dK\RV: 24h V#)z@Ensure redirect_uris is non-empty and each entry is a valid URI.z5CIMD documents must include at least one redirect_uriz,CIMD redirect_uris must be non-empty stringszACIMD redirect_uri must have a scheme (e.g. http:// or https://): zurn:z$CIMD redirect_uri must have a host: )rDstripr schemenetloc startswith)rEr:uriparseds&& r'validate_redirect_uris#CIMDDocument.validate_redirect_urissTU UCciikk !OPPc]F=== WX[W^_===)?)? #Gw!OPPr&r%)__name__ __module__ __qualname____firstlineno____doc__r r__annotations__rrrr r"r+r.r/r1r2r3r4r5r6r7r classmethodrGrQ__static_attributes__r%r&r'rr-s " FIz$7K%*3%J!#(4#H % m M9FKZF B#6;K!&(>!NIKE:"'B"H"':"G %*8%J!#(P#H#(E#D $?K$)4$j 123_%&r&rc]tRt^tRtRtR#)CIMDValidationErrorz+Raised when CIMD document validation fails.r%NrSrTrUrVrWrZr%r&r'r\r\s5r&r\c]tRt^tRtRtR#)CIMDFetchErrorz)Raised when CIMD document fetching fails.r%Nr]r%r&r'r_r_s3r&r_cX]tRt^t$RtR]R&R]R&R]R&R]R&R]R &R ]R &R tR #)_CIMDCacheEntryz8Cached CIMD document and associated HTTP cache metadata.rdocretag last_modifiedfloat expires_atfreshness_lifetimeboolmust_revalidater%NrSrTrUrVrWrXrZr%r&r'raras)B  r&racX]tRt^t$RtR]R&R]R&R]R&R]R&R]R &R]R &R tR #) _CIMDCachePolicyz>Normalized cache directives parsed from HTTP response headers.rrcrdrerfrgrhno_storerir%Nrjr%r&r'rlrls(H Nr&rlcn]tRt^tRtRtRtRRRlltRRltRR lt R R lt R R lt RRlt Rt R#) CIMDFetchera_Fetch and validate CIMD documents with SSRF protection. Delegates HTTP fetching to ssrf_safe_fetch_response, which provides DNS pinning, IP validation, size limits, and timeout enforcement. Documents are cached using HTTP caching semantics (Cache-Control/ETag/Last-Modified), with a TTL fallback when response headers do not define caching behavior. iicV^8dQhRR/#)r9timeoutrer%)r=s"r'r>CIMDFetcher.__annotate__s 5 5 5r&c Wn/VnR#)z`Initialize the CIMD fetcher. Args: timeout: HTTP request timeout in seconds (default 10.0) N)rq_cache)selfrqs&&r'__init__CIMDFetcher.__init__s 24 r&c$V^8dQhRRRRRR/#)r9headersMapping[str, str]nowrer<rlr%)r=s"r'r>rrs$3 3 (3 /43 3 r&c  >VP4UUu/uFwr4VP4VbK pppVPRR4pVPR4Uu0uF8qwP 4'gKVP 4P4kK: ppRV9p RV9p Rp VFQp V P R4'gKV P R4P 4p \^\V 44p M RpV e W+,pMXR V9dR\VR ,4pVPf!VP\P R 7pVP#4pVfW P&,p\R W, 4p\)VPR 4VPR4VVV V R7#uuppiuupi \d\PRT 4Li;i \$\3d!\PR TR ,4Li;i)z3Parse HTTP cache headers and derive cache behavior. cache-control,zno-storezno-cacheNzmax-age=z0Ignoring invalid Cache-Control max-age value: %sexpires)tzinfoz4Ignoring invalid Expires header on CIMD response: %sgrcz last-modifiedrcrdrfrgrmri)itemslowergetsplitrKrN removeprefixmaxintrDloggerdebugrrreplacerutc timestamp TypeErrorDEFAULT_CACHE_TTL_SECONDSrl)ruryr{kr: normalized cache_controlpart directivesrmrimax_age directivevaluerfdtrgs&&& r'_parse_cache_policyCIMDFetcher._parse_cache_policys07}}?tqaggil ?"; -:-@-@-E -ET DJJL   -E  +$ 2"#I##J//!..z:@@B!!SZ0G $$(  J * $ *:i+@A99$8<<8B\\^   ===J j&67'$..9!1+   Q@ "LLJEz*  Jy) s6F9F?4"F?"GAG+!G('G(+.HHc V^8dQhRRRR/#)r9ryrzr<rhr%)r=s"r'r>rr sHH.?HDHr&c lVUu0uFq"P4kK ppRV9;'gRV9#uupi)z>Return True when response includes cache freshness directives.r}r)r)ruryrrs&& r'_has_freshness_headers"CIMDFetcher._has_freshness_headers s7)01Aggi 1*,GG Z0GG2s1c V^8dQhRRRR/#r9rr;r<rhr%)r=s"r'r>rrs34r&c V'gR#\V4pVPR8H;'d-\VP4;'dVPR9# \ \ 3dR#i;i)zdCheck if a client_id looks like a CIMD URL. CIMD URLs must be HTTPS with a host and non-root path. Fhttps)r~/)r rLrhrMpathrDAttributeError)rurrPs&& r'is_cimd_client_idCIMDFetcher.is_cimd_client_idso  i(F (11'11KKy0  N+  s AA AA/.A/c V^8dQhRRRR/#)r9 client_id_urlr;r<rr%)r=s"r'r>rrsEEEEr&c n "VPPV4p\P!4pRp^0pVeVP'gW2P8d VP #/pVP 'dVP VR&VP'dVPVR&V'd^R0p\VRVPVPRVVR7GRjxL pTP R8XEd`Tf \R4h\P!4pTP#TP$4'dTP'TP$T4pM5\)RRY2P*,TP*R TPR 7pTP,'g\/TP TP ;'g TP TP;'g TPTPTP*TPR 7TPT&TP #TPP1TR4TP #\P!4pTP'TP$T4p\2P4!TP64p \:P=T 4p \T P@4PCR4TPCR48wd\RT P@ RT R24hT PD'd*\T PD4p \GT 4GRjxL \HPKRTT PL4TP,'gS\/T TP TPTPTP*TPR 7TPT&T #TPP1TR4T #EL \dp\\T44ThRp?i\dp\\T44ThRp?ii;i \2P8dp\R T 24ThRp?ii;i \>dp\R T 24ThRp?ii;iELD \dp\RT 24ThRp?ii;i5i)a<Fetch and validate a CIMD document with SSRF protection. Uses ssrf_safe_fetch_response for the HTTP layer, which provides: - HTTPS only, DNS resolution with IP validation - DNS pinning (connects to validated IP directly) - Blocks private/loopback/link-local/multicast IPs - Response size limit and timeout enforcement - Redirects disabled Args: client_id_url: The URL to fetch (also the expected client_id) Returns: Validated CIMDDocument Raises: CIMDValidationError: If document is invalid or URL blocked CIMDFetchError: If document cannot be fetched Nz If-None-MatchzIf-Modified-Sincei0Tg>@) require_pathmax_sizerqoverall_timeoutrequest_headersallowed_status_codesz=CIMD server returned 304 Not Modified without cached documentFr)rbrcrdrfrgriz!CIMD document is not valid JSON: zInvalid CIMD document: rz(CIMD client_id mismatch: document says 'z' but was fetched from ''z&CIMD jwks_uri failed SSRF validation: z8CIMD document fetched and validated: %s (client_name=%s))'rtrtimerirfrbrcrdrMAX_RESPONSE_SIZErqrr\r;rr_ status_coderryrrlrgrmrapopjsonloadscontentJSONDecodeErrorrmodel_validate Exceptionrrstripr4rrinfor) rurcachedr{rrresponseepolicydatarb jwks_uri_strs && r'fetchCIMDFetcher.fetchs(/iik15 #u  )))c4E4E.Ezz! O{{{39;;0###7=7K7K 34(+Sz$ 05!// $ /%9H   3 &~$S))+C**8+;+;<<11(2B2BCH*"&"%>%>>'-'@'@"$*$:$: ???-< 33 "("6"6"N"N&:N:N%00'-'@'@$*$:$: . M*::   t4:: iik))(*:*:C@ V::h../D L--d3C s}}  $ $S )]-A-A#-F F%:3==/J))6q:  <<<s||,L "<000  F  OO )8[[$22!,,#)#<#< & 6 6 *DKK &  KKOOM4 0  5%c!f-1 4 0 Q(a / 0T## V%(I!&MNTU U V  L%(?s&CD! K L1 ) R5R56R5;)O7$O4%O7)AR5A#R5$"R5R5&B%R5 Q-Q.A%R5(R5>R R R2R5A0R54O77 P?P P?$P?%P::P??R5Q+Q&&Q++R5. R 9RR  R5R R2R--R22R5c$V^8dQhRRRRRR/#)r9rbr redirect_urir;r<rhr%)r=s"r'r>rrs!STr&c VP'gR#VPR4pVPFEpVPR4pW$8XdR#RV9gK&\P!W$4'gKDR# R#)zValidate that a redirect_uri is allowed by the CIMD document. Args: doc: The CIMD document redirect_uri: The redirect URI to validate Returns: True if valid, False otherwise FrT*)r rfnmatch)rurbrallowed allowed_strs&&& r'validate_redirect_uri!CIMDFetcher.validate_redirect_urism   $**3/ ((G!..-K*k!??<==)r&)rtrqN)g$@)rSrTrUrVrWrrrvrrrrrrZr%r&r'roros< $ 53 jH "ENr&rocT]tRtRtRtRtRtRRltRRltR R lt R R lt R t R#)CIMDAssertionValidatoriaValidates JWT assertions for private_key_jwt CIMD clients. Implements RFC 7523 (JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants) for CIMD client authentication. JTI replay protection uses TTL-based caching to ensure proper security: - JTIs are cached with expiration matching the JWT's exp claim - Expired JTIs are automatically cleaned up - Maximum assertion lifetime is enforced (5 minutes) i,c /VnRVn\P!4Vn^#CIMDAssertionValidator.__annotate__sUUtUr&c 0\P!4pVPP4UUu.uFwr#W18gK VNK pppVFpVPVK V'd(VPP R\ V44R#R#uuppi)zRemove expired JTIs from cache.z%Cleaned up %d expired JTIs from cacheN)rrrrrlen)rur{jtiexpexpireds& r'_cleanup_expired_jtis,CIMDAssertionValidator._cleanup_expired_jtissuiik'+'<'<'>L'>83#)33'>LC$  KK  Es7| T Ms BBcV^8dQhRR/#rr%)r=s"r'r>rs%%%r&c \P!4pWP, VP8dVP 4WnR#R#)z>Periodically cleanup expired JTIs to prevent unbounded growth.N)rrrrr)rur{s& r'_maybe_cleanup%CIMDAssertionValidator._maybe_cleanups<nn ## #d&<&< <  & & (!$  =r&c ,V^8dQhRRRRRRRRRR/#) r9 assertionr;rtoken_endpointcimd_docrr<rhr%)r=s"r'r>rsC|||| |  |  |r&c "^RIHpVP4VP'd\ VP4pV RV RV 2pVP P V4pVfjV!VVVRR7p\VP 4VP8d,\\VP 44p VP V WP V&MDVP'd(VPWP4p V!V VVR7pM \R4hVPV4GRjxL p V 'g \R4hV Pp \ P !4p V P R 4pV P R 4pV'g \R 4hW^, 8d \R 4hV'dSW^,8d \R 4hW, VP"8d#\RW, RVP" R24hM0WVP",8d\RVP" R24hV P R4V8wd\RV 24hV P R4pV'g \R4hVVP$9d7VP$V,pVV 8d\RV R24hVP$VWP$V&\VP$4VP&8dfVP)4\VP$4VP&8d2VP*P-RVP&4\R4hVP*P/RV4R#ELT5i)a]Validate JWT assertion from client. Args: assertion: The JWT assertion string client_id: Expected client_id (must match iss and sub claims) token_endpoint: Token endpoint URL (must match aud claim) cimd_doc: CIMD document containing JWKS for key verification Returns: True if valid Raises: ValueError: If validation fails r|NT)r4issueraudience ssrf_safe) public_keyrrz45 5 2X~ !ABBy4666 3CI;gdFaFaEbbde7 46666 ;D&>> ##E,,!!BCC  @) ICs4C"N%AN+M?, N8AN*N9B>N8DNc$V^8dQhRRRRRR/#)r9tokenr;r5dictr<r%)r=s"r'r>rms&5J5J35Jd5Js5Jr&c ,^RIp^RIp^RIHpVP R4^,pVR^\ V4^,, ,, pVP !VPV44pVPR4pTPR.4p T 'g \R4hRp T F'p T'gK T PR4T8XgK%T p M T 'gE\ T 4^8Xd&T ^,p TPPR 4M\R T R 24hTPT 4p T P4PR 4# \dp \RT 24T hRp ? ii;i \dp \R T 24T hRp ? ii;i)zExtract public key from inline JWKS. Args: token: JWT token to extract kid from jwks: JWKS document containing keys Returns: PEM-encoded public key Raises: ValueError: If key cannot be found or extracted N) JsonWebKey.=kidz%Failed to extract key ID from token: keyszJWKS document contains no keysz3No matching kid in JWKS, using single available keyzNo matching key found for kid=z in JWKSzutf-8zFailed to convert JWK to PEM: )base64r authlib.joser rrrurlsafe_b64decoderrrDrr import_keyas_pemdecode)rurr5rrr  header_b64headerr rr  matching_keykeyjwks&&& r'r4CIMDAssertionValidator._extract_public_key_from_jwksmsy + QS)!,J #S_q%8!89 9JZZ 8 8 DEF**U#C xx#=> > Csswwu~,"  4yA~#Aw  ##I!#A#h!OPP J'' 5C::<&&w/ /7 QDQCHIq P Q8 J=aSAB I Js0A1E"/E4 E1E,,E14 F?FF)rrrrrrrN) rSrTrUrVrWrrvrrrrrZr%r&r'rrs2 ! +U%||5J5Jr&rcN]tRtRtRtR RRlltRRltRR ltR R ltR t R#)CIMDClientManageria7Manages all CIMD client operations for OAuth proxy. This class encapsulates: - CIMD client detection - Document fetching and validation - Synthetic OAuth client creation - Private key JWT assertion validation This allows the OAuth proxy to delegate all CIMD-specific logic to a single, focused manager class. Nc$V^8dQhRRRRRR/#)r9 enable_cimdrh default_scoper;allowed_redirect_uri_patternsr0r%)r=s"r'r>CIMDClientManager.__annotate__s(++++(8 +r&c WnW nW0n\4Vn\ 4Vn\\4Vn R#)zInitialize CIMD client manager. Args: enable_cimd: Whether CIMD support is enabled default_scope: Default scope for CIMD clients if not specified in document allowed_redirect_uri_patterns: Allowed redirect URI patterns (proxy's config) N) enabledrrro_fetcherr_assertion_validatorrrSr)rurrrs&&&&r'rvCIMDClientManager.__init__s5# *-J*#  $:$<! * r&c V^8dQhRRRR/#rr%)r=s"r'r>r s K K3 K4 Kr&c `VP;'dVPPV4#)zCheck if client_id is a CIMD URL. Args: client_id: Client ID to check Returns: True if client_id is an HTTPS URL (CIMD format) )r"r#r)rurs&&r'r#CIMDClientManager.is_cimd_client_ids%||JJ ? ? JJr&cV^8dQhRR/#)r9rr;r%)r=s"r'r>r s//c/r&c ,"VP'gR#VPPV4GRjxL p^RIHpRpT!TRTTPTP;'g TPTPTPTPT\P!4R7 pTP P!RTTP4T#L \\3d(pTP P RY4Rp?R#Rp?ii;i5i)aIFetch CIMD document and create synthetic OAuth client. Args: client_id_url: HTTPS URL pointing to CIMD document Returns: OAuthProxyClient with CIMD document attached, or None if fetch fails Note: Return type is left untyped to avoid circular import with oauth_proxy. Returns OAuthProxyClient instance or None. NzCIMD fetch failed for %s: %s)ProxyDCRClient) r client_secretr r+r/r"rr cimd_documentcimd_fetched_atz"CIMD client resolved: %s (name=%s))r"r#rr_r\rr&fastmcp.server.auth.oauth_proxy.modelsr+r+r/rr"rrrr)rurrrr+r clients&& r' get_clientCIMDClientManager.get_clients||| !]]00??H J  #' ,,..66D$6$6'/'J'J*.*L*L ,," IIK    0     =@ 34  KK   > Q sDDCCC*D&A1DCD*D D DDc$V^8dQhRRRRRR/#)r9rr;rr<rhr%)r=s"r'r>r s(       r&c "\VR4'dVP'g \R4hVPpVPR8wd \R4hVPP WP W44GRjxL #L5i)aVValidate JWT assertion for private_key_jwt auth. Args: assertion: JWT assertion string from client client: OAuth proxy client (must have cimd_document) token_endpoint: Token endpoint URL for aud validation Returns: True if assertion is valid Raises: ValueError: If client doesn't have CIMD document or validation fails r-z2Client must have CIMD document for private_key_jwtprivate_key_jwtz6CIMD document must specify private_key_jwt auth methodN)hasattrr-rDr"r$rr)rurr0rrs&&&& r'validate_private_key_jwt*CIMDClientManager.validate_private_key_jwts&v//v7K7K7KQR R''  . .2C CUV V..AA ''    s$B AB BB )r$r#rrr"r)Tr~N) rSrTrUrVrWrvrr1r7rZr%r&r'rrs" +* K/b  r&r)-rW __future__rrrrcollections.abcr dataclassesrdatetimer email.utilsrtypingrrr urllib.parser pydanticr r r rfastmcp.server.auth.ssrfrrrrfastmcp.utilities.loggingrrrrSrrrr\r_rarlrorrr%r&r'rCs # #!-..!BB 1= H j9jZ6)64Y4    GGT^J^JBz z r&