iA dZddlZddlmZmZmZddlmZmZde ezezde fdZ de d e de fd Z d e e zdzdedzfd Zy) zKUtilities for OAuth 2.0 Resource Indicators (RFC 8707) and PKCE (RFC 7636).N)urlparseurlsplit urlunsplit)AnyUrlHttpUrlurlreturnct|}t|}t|j|jj |j j d}|S)aDConvert server URL to canonical resource URL per RFC 8707. RFC 8707 section 2 states that resource URIs "MUST NOT include a fragment component". Returns absolute URI with lowercase scheme/host for canonical form. Args: url: Server URL to convert Returns: Canonical resource URL string )schemenetlocfragment)strrr_replacer lowerr )rurl_strparsed canonicals U/root/aria/mcps/aria-brain/venv/lib/python3.12/site-packages/mcp/shared/auth_utils.pyresource_url_from_server_urlr sV#hGg F6??&--2E2E2GPVP]P]PcPcPepr?stI requested_resourceconfigured_resourcect|}t|}|jj|jjk7s5|jj|jjk7ry|j}|j}|j ds|dz }|j ds|dz }|j |S)a$Check if a requested resource URL matches a configured resource URL. A requested resource matches if it has the same scheme, domain, port, and its path starts with the configured resource's path. This allows hierarchical matching where a token for a parent resource can be used for child resources. Args: requested_resource: The resource URL being requested configured_resource: The resource URL that has been configured Returns: True if the requested resource matches the configured resource F/)rr rr pathendswith startswith)rr requested configuredrequested_pathconfigured_paths rcheck_resource_allowedr#s +,I-.J:#4#4#:#:#<< @P@P@V@V@X\f\m\m\s\s\u@u^^N ooO  " "3 '#  # #C (3  $ $_ 55r expires_incH|ytjt|zS)zCalculate token expiry timestamp from expires_in seconds. Args: expires_in: Seconds until token expiration (may be string from some servers) Returns: Unix timestamp when token expires, or None if no expiry specified N)timeint)r$s rcalculate_token_expiryr(Ds" 99;Z ((r)__doc__r& urllib.parserrrpydanticrrrrboolr#r'floatr(rrr/slQ 77$cGmf&<,"6s"6"6QU"6J )sSy4'7 )EDL )r