`gjUdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z m Z ddl mZddlmZmZe Gdd Zej&d d Zd ed <e ddZddZy)aDashboard-mediated callback bridge for MCP OAuth. The MCP SDK remains responsible for discovery, DCR, PKCE, state validation and token exchange. This module only moves the two human/browser callbacks from a loopback listener into the already-authenticated dashboard session. ) annotationsN)contextmanager) dataclassfield)Iterator)parse_qsurlparsecXeZdZUded<ded<ded<ded<ded<dZd ed <eej Zd ed <dZded<dZ ded<dZ ded<ee Z ded<eddZ ded<edddZded<edddZded<eej"ddZded<eej"ddZded<eej"ddZded<eej*ddZd ed!<d+d"Zd,d-d#Z d.d$Zd/d0d%Zd1d&Zd2d'Zd3d(Zd1d)Zed4d*Z y)5DashboardOAuthFlowstrflow_id server_name str | Noneprofile hermes_home redirect_uriFboolreconnect_live)default_factoryfloat created_atstartingstatusNauthorization_urlerrorz list[dict]tools)defaultinitexpected_state)rrreprztuple[str, str | None] | None _callback_callback_error)rrr zthreading.Event_authorization_ready_callback_ready _worker_donezthreading.Lock_lockc\Ktt|jjddgd}|s t d|j 5|j dvr td||_||_ d|_|jjdddy#1swYyxYww)Nstaterz-OAuth authorization URL did not include state>rapprovedOAuth flow already endedauthorization_required) rr queryget ValueErrorr&r RuntimeErrorrrr#set)selfurlr(s L/root/.hermes/venv/lib/python3.12/site-packages/tools/mcp_dashboard_oauth.pypublish_authorization_urlz,DashboardOAuthFlow.publish_authorization_url*s#,,-11'D6B1ELM M ZZ ,{{33"#=>>"'D %(D "2DK  % % ) ) +  , , ,sA B,A B  B, B)%B,cKtj|jj|d{}|s t d|j st |jxsd|j S7Bw)Nz+Timed out waiting for MCP authorization URLz)MCP OAuth flow ended before authorization)asyncio to_threadr#wait TimeoutErrorrr/rr1timeoutreadys r3wait_for_authorization_urlz-DashboardOAuthFlow.wait_for_authorization_url6sf''(A(A(F(FPPLM M%%tzzX-XY Y%%% Qs.A5A3AA5cp|j5|jjr td|j"| t j |j|s td|r||_n|r ||f|_nd|_|jjdddy#1swYyxYw)NzOAuth callback already receivedzOAuth callback state mismatchz,OAuth callback did not include code or error) r&r$is_setr.rsecretscompare_digestr"r!r0)r1coder(rs r3deliver_callbackz#DashboardOAuthFlow.deliver_callback>sZZ '##**, !BCC##+=--d.A.A5I !@AA',$"&'U$  $ $ & ' ' 's BB,,B5cKtj|jj|d{}|s t d|j rt d|j |j t d|jS7Xw)Nz(Timed out waiting for MCP OAuth callbackzOAuth authorization failed: z4OAuth callback did not include an authorization code)r6r7r$r8r9r"r/r!r:s r3wait_for_callbackz$DashboardOAuthFlow.wait_for_callbackVs''(<(<(A(A7KKIJ J   !=d>R>R=STU U >> !UV V~~Ls.B B AB c|j5|jdk(r tdd|_d|_dddy#1swYyxYw)Nrr*r))r&rr/rr1s r3 mark_approvedz DashboardOAuthFlow.mark_approved`sD ZZ {{g%"#=>>$DKDJ    s )?Ac|j5|jdk(r dddyd|_||_|jj |j j dddy#1swYyxYw)Nr)r)r&rrr#r0r$)r1rs r3 mark_errorzDashboardOAuthFlow.mark_errorgsk ZZ '{{j( ' '"DKDJ  % % ) ) +  $ $ &  ' ' 'sA2AA22A;c|j5|j|j|j|j|j dcdddS#1swYyxYw)N)r rrrr)r&r rrrrrGs r3snapshotzDashboardOAuthFlow.snapshotpsJ ZZ <<#//++%)%;%;    s :AAc8|jjyN)r%r0rGs r3mark_worker_donez#DashboardOAuthFlow.mark_worker_donezs c6|jjSrN)r%r?rGs r3 worker_donezDashboardOAuthFlow.worker_done}s  ''))rP)r2r returnNone)g>@)r;rrSr )rBrr(rrrrSrT)gr@)r;rrSztuple[str, str | None])rSrT)rr rSrT)rSdict)rSr)!__name__ __module__ __qualname____annotations__rrtimerrrrlistrrr!r" threadingEventr#r$r%Lockr&r4r=rCrErHrJrLrOpropertyrRrPr3r r sk L  ND dii8J8FC$(z(E:d3E:3!&t%!@NJ@/4TTY/ZI,Z"'5u"MOZM,1)//X]di,j/j',Y__SX_d'eO_e$))//PU\a$bL/b!)..uSXYE>Y ,&'' '  '  '0' **rPr mcp_dashboard_oauth_flow)rz1contextvars.ContextVar[DashboardOAuthFlow | None]_current_dashboard_flowc#Ktj|} dtj|y#tj|wxYwwrN)rbr0reset)flowtokens r3dashboard_oauth_flowrgs; # ' ' -E- %%e,%%e,sA 3A A  A c*tjSrN)rbr-r`rPr3get_dashboard_oauth_flowris " & & ((rP)rer rSzIterator[None])rSzDashboardOAuthFlow | None)__doc__ __future__rr6 contextvarsr@r\rZ contextlibr dataclassesrrtypingr urllib.parserr r ContextVarrbrYrgrir`rPr3rrs# %(+ i*i* i*ZK5tDJ --)rP