
    ~h!                     n    d dl mZ d dlmZ d dlmZ d dlmZ d dlmZ d dl	m
Z
 ddlmZ  G d	 d
e      Zy)    )ContinueIteration)default_json_headers)ExpiredTokenError)InvalidClaimError)InvalidTokenError)JWTBearerTokenValidator   )IntrospectionEndpointc                   P     e Zd ZdZdZd fd	Zd Zd Zd Zd Z	de
d	e
fd
Z xZS )JWTIntrospectionEndpointa  JWTIntrospectionEndpoint inherits from :ref:`specs/rfc7662`
    :class:`~authlib.oauth2.rfc7662.IntrospectionEndpoint` and implements the machinery
    to automatically process the JWT access tokens.

    :param issuer: The issuer identifier for which tokens will be introspected.

    :param \\*\\*kwargs: Other parameters are inherited from
        :class:`~authlib.oauth2.rfc7662.introspection.IntrospectionEndpoint`.

    ::

        class MyJWTAccessTokenIntrospectionEndpoint(JWTIntrospectionEndpoint):
            def get_jwks(self): ...

            def get_username(self, user_id): ...


        # endpoint dedicated to JWT access token introspection
        authorization_server.register_endpoint(
            MyJWTAccessTokenIntrospectionEndpoint(
                issuer="https://authorization-server.example.org",
            )
        )

        # another endpoint dedicated to refresh token introspection
        authorization_server.register_endpoint(MyRefreshTokenIntrospectionEndpoint)

    introspectionc                 6    t        |   |d|i| || _        y )Nserver)super__init__issuer)selfr   r   argskwargs	__class__s        `/opt/mcp/mcp-sentiment/venv/lib/python3.12/site-packages/authlib/oauth2/rfc9068/introspection.pyr   z!JWTIntrospectionEndpoint.__init__,   s!    $8v88    c                 |    | j                  |      }| j                  ||      }| j                  |      }d|t        fS )    )authenticate_endpoint_clientauthenticate_tokencreate_introspection_payloadr   )r   requestclienttokenbodys        r   create_endpoint_responsez1JWTIntrospectionEndpoint.create_endpoint_response0   sH     227; ''8 007D...r   c                 l   | j                  ||       |j                  j                  d      dvr
t               t	        | j
                  d      }| j                  |_        	 |j                  |j                  d         }|r| j                  |||      r|S yy# t        $ r}t               |d}~ww xY w)r   token_type_hint)access_tokenNN)r   resource_serverr!   )
check_paramsformgetr   r   r   get_jwksr   r   check_permission)r   r   r    	validatorr!   excs         r   r   z+JWTIntrospectionEndpoint.authenticate_token=   s    '6* <<-.6LL#%%+4;;PTU	!]]		/00g1FGE T**5&'BL C5 ! 	/#%3.	/s   #B 	B3#B..B3c           
      4   |sddiS 	 |j                          dd|d   |d   |d   |d	   |d   |d
   |d   d	}| j                  |d         x}r||d<   |S # t        $ r ddicY S t        $ r*}|j                  dk(  rt	               |t               |d }~ww xY w)NactiveFissTBearer	client_idscopesubaudexpiat)	r0   
token_typer3   r4   r5   r6   r1   r7   r8   username)validater   r   
claim_namer   r   get_username)r   r!   r.   payloadr:   s        r   r   z5JWTIntrospectionEndpoint.create_introspection_payloadQ   s    e$$	/NN "{+7^<<<<<

 ((u6686"*GJ- ! 	%e$$  	/~~&')s2#%3.	/s   A B%B-%BBc                     t               )zReturn the JWKs that will be used to check the JWT access token signature.
        Developers MUST re-implement this method::

            def get_jwks(self):
                return load_jwks("jwks.json")
        )NotImplementedError)r   s    r   r+   z!JWTIntrospectionEndpoint.get_jwkso   s     "##r   user_idreturnc                      y)zReturns an username from a user ID.
        Developers MAY re-implement this method::

            def get_username(self, user_id):
                return User.get(id=user_id).username
        N )r   rA   s     r   r=   z%JWTIntrospectionEndpoint.get_usernamex   s     r   )N)__name__
__module____qualname____doc__ENDPOINT_NAMEr   r#   r   r   r+   strr=   __classcell__)r   s   @r   r   r      s;    < $M/(<$C C r   r   N)authlib.common.errorsr   authlib.constsr   authlib.jose.errorsr   r   authlib.oauth2.rfc6750.errorsr   &authlib.oauth2.rfc9068.token_validatorr   rfc7662r
   r   rD   r   r   <module>rR      s)    3 / 1 1 ; J +t4 tr   