uPj+ dZddlmZmZddlmZddlmZdededzfdZ dd e ed e de eeffd Z dede eefdzfd Zded edzdedzde fdZy)aG Tenant-isolation helpers for managed file/batch/vector-store resources. Returns a Prisma filter and an ownership check that scope managed resources to the caller's identity: proxy admins see everything, user-keyed callers see records they created, service-account keys (no user_id) fall back to the resource's owning team, and keys with neither a user_id nor a team_id fall back to their own hashed token so they can still reach the resources they created. Callers with no admin role and no identifying ids at all are denied so an empty user_id can never select an unscoped query. )AnyFinal)UserAPIKeyAuth)user_api_key_has_admin_viewuser_api_key_dictreturnNc|j |jS|jy|jxs |j}|rd|Sy)aReturn the identity to stamp on (and match against) a managed resource's ``created_by``. A key with neither a user_id nor a team_id would otherwise stamp ``created_by=None`` and be locked out of its own resources, so it owns them under its hashed token instead, using the ``key:`` scope prefix already used by ``proxy/common_utils/resource_ownership.py``. ``None`` means the caller has no usable identity of its own and must fall back to team scoping, or be denied. Nzkey:)user_idteam_idtokenapi_key)rr s v/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/llms/base_llm/managed_resources/isolation.pyresolve_resource_owner_idrsT  , (((  ,$**G.?.G.GE eW~ itemshas_morec\d||r|djnd|r|dj|dSd|dS)zBuild the OpenAI-style paginated list response shape used by managed file/batch/vector-store listings. ``first_id`` and ``last_id`` are sourced from each item's ``.id`` attribute.listrN)objectdatafirst_idlast_idr)id)rrs rbuild_list_pager1sE #(E!HKKd#(59<<  /3  rct|riS|j}|j}| | dd|id|igiS|d|iSt|}|d|iSy)uReturn a Prisma `where` fragment that scopes a managed-resource listing to records the caller is allowed to see. - ``{}`` means no scoping (proxy admins). - ``{"created_by": }`` for user-keyed callers, and for keys with no user_id and no team_id (owner id is their hashed token). - ``{"team_id": }`` for service-account callers that have a team but no user_id. - ``{"OR": [...]}`` when the caller has both — listing must include both their own resources and team-shared ones so it stays consistent with ``can_access_resource``. - ``None`` means deny: callers MUST skip the query rather than fall back to an unscoped fetch. NOR created_byr )_user_has_admin_viewr r r)rr r owner_ids rbuild_owner_filterr!>s"-. &..G&..Gw2 w'G$  7##/0ABHh'' rrresource_team_idcrt|ryt|}||||k(ry|j}||||k(ryy)u0Return True iff the caller may read/modify a managed resource. The resource's ``created_by`` and ``team_id`` fields must be non-None to match the caller's identity — guarding against the ``None == None`` bypass that previously let service-account keys read every keyless resource. TF)rrr )rrr"r r s rcan_access_resourcer$gsV-./0ABH 6:;Q&..G/;@PT[@[ r)F)__doc__typingrrlitellm.proxy._typesrrrstrrrbooldictrr!r$rrr,s  %4Z4 49  c3h &%& #s(^d&R%d Dj r