kKjg9dZddlmZddlZddlmZddlZddlmZddl m Z ddl m Z ddl mZdd lmZdd lmZdd lmZdd lmZeeZGd de ZGddeZy)aTGitHub OAuth provider for FastMCP. This module provides a complete GitHub OAuth integration that's ready to use with just a client ID and client secret. It handles all the complexity of GitHub's OAuth flow, token validation, and user management. Example: ```python from fastmcp import FastMCP from fastmcp.server.auth.providers.github import GitHubProvider # Simple GitHub OAuth protection auth = GitHubProvider( client_id="your-github-client-id", client_secret="your-github-client-secret" ) mcp = FastMCP("My Protected Server", auth=auth) ``` ) annotationsN)Literal) AsyncKeyValue) AnyHttpUrl) TokenVerifier) AccessToken) OAuthProxy) parse_scopes) get_logger) TokenCachecLeZdZdZdddddd dfdZddZxZS) GitHubTokenVerifieravToken verifier for GitHub OAuth tokens. GitHub OAuth tokens are opaque (not JWTs), so we verify them by calling GitHub's API to check if they're valid and get user info. Caching is disabled by default. Set ``cache_ttl_seconds`` to a positive integer to cache successful verification results and avoid repeated GitHub API calls for the same token. N required_scopestimeout_secondscache_ttl_secondsmax_cache_size http_clientcft||||_||_t |||_y)aInitialize the GitHub token verifier. Args: required_scopes: Required OAuth scopes (e.g., ['user:email']) timeout_seconds: HTTP request timeout cache_ttl_seconds: How long to cache verification results in seconds. Caching is disabled by default (None). Set to a positive integer to enable (e.g., 300 for 5 minutes). max_cache_size: Maximum number of tokens to cache. Default: 10 000. http_client: Optional httpx.AsyncClient for connection pooling. When provided, the client is reused across calls and the caller is responsible for its lifecycle. When None (default), a fresh client is created per call. )r) ttl_secondsmax_sizeN)super__init__r _http_clientr _cache)selfrrrrr __class__s u/Users/ahmed/devFolder/Ultron/claude-voice/.venv/lib/python3.12/site-packages/fastmcp/server/auth/providers/github.pyrzGitHubTokenVerifier.__init__4s7, 9.' )#  cK|jj|\}}|rtjd|S |jt j |jntj|j4d{}|jdd|ddd d{}|jd k7r@tjd |j|jdd  dddd{y|j}|jd d|ddd d{}|jd k(}|jjd d} | jdD cgc]"} | jr| j$} } | sdg} |j rlt#| } t#|j } | j%| s;tjdt'| t'|  dddd{yt)|t+|jdd| dt+|d|jd|jd|jd|jd|d}|r|jj#|||cdddd{S75777cc} w77#1d{7swYyxYw#tj,$r }tjd|Yd}~yd}~wt.$r }tjd|Yd}~yd}~wwxYww)z0Verify GitHub OAuth token by calling GitHub API.zGitHub token cache hitN)timeoutzhttps://api.github.com/userzBearer zapplication/vnd.github.v3+jsonzFastMCP-GitHub-OAuth) AuthorizationAcceptz User-Agent)headersz)GitHub token verification failed: %d - %sz!https://api.github.com/user/reposzx-oauth-scopes,userz6GitHub token missing required scopes. Has %d, needs %didunknownloginnameemail avatar_url)subr,r-r.r/github_user_data)token client_idscopes expires_atclaimsz!Failed to verify GitHub token: %sz#GitHub token verification error: %s)rgetloggerdebugr contextlib nullcontexthttpx AsyncClientr status_codetextjsonr%splitstriprsetissubsetlenrstr RequestError Exception)rr2 is_cached cached_resultclientresponse user_datascopes_responsescopes_verifiedoauth_scopes_headerscope token_scopestoken_scopes_setrequired_scopes_setresultes r verify_tokenz GitHubTokenVerifier.verify_tokenRs:#';;??5#9 =  LL1 2 V $$0&&t'8'89&&t/C/CDEE!'1+25'):"B&<","''3.LLC ,, ds+  )EEE,%MMO )/ 7+25'):"B&<)3)##2"="="D&5&=&=&A&ABRTV&W#"5!:!:3!? !?{{}KKM!? $$*8L'''*<'8$*-d.B.B*C'.778HI T 01 34 $uEEEz%!)--i"@A'#"9T?3!*w!7 ) f 5!*w!7&/mmL&A,5  #KKOOE62[EEE  E4# MEEEEE^!!  LL B s8MAK) J? K)K,K-AK/ K):K;K)?M-K-K.AK0'K A.K K)KK)MBK- K)9K:K)>M?K)KK)K KK)K)K&K K&"K)%M&K))M<LM M#L>9M>MM) rlist[str] | Nonerintr int | NonerrZrhttpx.AsyncClient | None)r2rFreturnzAccessToken | None)__name__ __module__ __qualname____doc__rrW __classcell__rs@rrr)sV-1!(,%)04 *   &  #  . <]r rceZdZdZddddddddddddddddddd dfdZxZS) GitHubProvideraComplete GitHub OAuth provider for FastMCP. This provider makes it trivial to add GitHub OAuth protection to any FastMCP server. Just provide your GitHub OAuth app credentials and a base URL, and you're ready to go. Features: - Transparent OAuth proxy to GitHub - Automatic token validation via GitHub API - User information extraction - Minimal configuration required Example: ```python from fastmcp import FastMCP from fastmcp.server.auth.providers.github import GitHubProvider auth = GitHubProvider( client_id="Ov23li...", client_secret="abc123...", base_url="https://my-server.com" ) mcp = FastMCP("My App", auth=auth) ``` NrTr)resource_base_url issuer_url redirect_pathrrrrallowed_client_redirect_urisclient_storagejwt_signing_keyrequire_authorization_consentconsent_csp_policyforward_resource%fallback_refresh_token_expiry_seconds#fastmcp_access_token_expiry_secondstoken_expiry_threshold_secondsr enable_cimdc| t|ndg}t||| | |}t| dd|||||||xs|| | | |||||||tj d||y)aOInitialize GitHub OAuth provider. Args: client_id: GitHub OAuth app client ID (e.g., "Ov23li...") client_secret: GitHub OAuth app client secret base_url: Public URL where OAuth endpoints will be accessible (includes any mount path) resource_base_url: Optional public base URL for the protected resource metadata and token audience. Defaults to ``base_url``. issuer_url: Issuer URL for OAuth metadata (defaults to base_url). Use root-level URL to avoid 404s during discovery when mounting under a path. redirect_path: Redirect path configured in GitHub OAuth app (defaults to "/auth/callback") required_scopes: Required GitHub scopes (defaults to ["user"]) timeout_seconds: HTTP request timeout for GitHub API calls (defaults to 10) cache_ttl_seconds: How long to cache token verification results in seconds. Caching is disabled by default (None). Set to a positive integer to enable (e.g., 300 for 5 minutes). max_cache_size: Maximum number of tokens to cache. Default: 10 000. allowed_client_redirect_uris: List of allowed redirect URI patterns for MCP clients. If None (default), all URIs are allowed. If empty list, no URIs are allowed. client_storage: Storage backend for OAuth state (client registrations, encrypted tokens). If None, an encrypted file store will be created in the data directory (derived from `platformdirs`). jwt_signing_key: Secret for signing FastMCP JWT tokens (any string or bytes). If bytes are provided, they will be used as is. If a string is provided, it will be derived into a 32-byte key. If not provided, the upstream client secret will be used to derive a 32-byte key using PBKDF2. require_authorization_consent: Whether to require user consent before authorizing clients (default True). When True, users see a consent screen before being redirected to GitHub. When False, authorization proceeds directly without user confirmation. When "external", the built-in consent screen is skipped but no warning is logged, indicating that consent is handled externally (e.g. by the upstream IdP). SECURITY WARNING: Only set to False for local development or testing environments. http_client: Optional httpx.AsyncClient for connection pooling in token verification. When provided, the client is reused across verify_token calls and the caller is responsible for its lifecycle. When None (default), a fresh client is created per call. enable_cimd: Enable CIMD (Client ID Metadata Document) support for URL-based client IDs (default True). Set to False to disable. fallback_refresh_token_expiry_seconds: Lifetime for the FastMCP-issued refresh token when the upstream provider omits `refresh_expires_in` (e.g. Cognito, GitHub, many OIDC IdPs). Defaults to 1 year. The upstream refresh remains the source of truth. See `OAuthProxy` for details. fastmcp_access_token_expiry_seconds: Lifetime for the FastMCP-issued access token, decoupling it from the upstream provider's `expires_in`. Defaults to None (mirror the upstream lifetime). Set this for bridges whose upstream issues short-lived access tokens that some MCP clients can't refresh gracefully (e.g. `mcp-remote`). See `OAuthProxy` for details. token_expiry_threshold_seconds: Number of seconds before actual expiry to treat a token as expired, refreshing early to avoid races. Defaults to 0. Nr)rz(https://github.com/login/oauth/authorizez+https://github.com/login/oauth/access_token)upstream_authorization_endpointupstream_token_endpointupstream_client_idupstream_client_secrettoken_verifierbase_urlrergrfrhrirjrkrlrmrnrorprqz?Initialized GitHub OAuth provider for client %s with scopes: %s)r rrrr8r9)rr3 client_secretrxrerfrgrrrrrhrirjrkrlrmrnrorprrqrequired_scopes_finalrwrs rrzGitHubProvider.__init__sV.=-HL )vh  -1+/)#   ,V$Q(#0)/'!-X)E)+*G1-2W0S+I#'  ,  M  ! r )*r3rFryrFrxzAnyHttpUrl | strreAnyHttpUrl | str | Nonerfr{rg str | NonerrXrrYrrZrrZrhrXrizAsyncKeyValue | Nonerjzstr | bytes | Nonerkz&bool | Literal['remember', 'external']rlr|rmboolrnrZrorZrprYrr[rqr})r]r^r_r`rrarbs@rrdrds5B6:.2$(,0!(,%)9=/3.2PT)-!%<@:>./04 /r r  r # r 3 r ,r "r *r r &r #r '7r -r ,r (N!r "'#r $%r &0:'r (.8)r *),+r ,.-r ./r r r rd)r` __future__rr:typingrr<key_value.aio.protocolsrpydanticrfastmcp.server.authrfastmcp.server.auth.authrfastmcp.server.auth.oauth_proxyr fastmcp.utilities.authr fastmcp.utilities.loggingr fastmcp.utilities.token_cacher r]r8rrdr rrsW*# 1-06/04 H F-FRN ZN r