tPj(!UdZddlZddlZddlZddlmZddlmZmZddl Z ddl m Z ddl m Z ddlmZddlmZdd lmZd Zeed <d Zeed <dZeed<dZeed<dededzfdZdedefdZedGddZdeeefdzdedzfdZGdde ZeZ eed<deeefdzdeeefdzfd Z!y)!a OAuth M2M (client_credentials) support for A2A agents that target Databricks App endpoints. Databricks Apps reject static bearer tokens; they require a short-lived OAuth access token minted from the workspace OIDC token endpoint. When an agent is registered with a ``databricks_oauth`` block in its ``litellm_params``, LiteLLM fetches that token via the client_credentials grant, caches it until shortly before expiry, and attaches it as the outbound ``Authorization`` header on every call the proxy makes to the agent. Config example:: agents: - agent_name: my-databricks-app agent_card_params: url: https://my-app-1234.aws.databricksapps.com litellm_params: databricks_oauth: client_id: os.environ/DATABRICKS_CLIENT_ID client_secret: os.environ/DATABRICKS_CLIENT_SECRET workspace_url: https://dbc-abc123.cloud.databricks.com N) dataclass)AnyFinal)verbose_logger) InMemoryCache)get_async_httpx_client)get_secret_str)httpxSpecialProviderdatabricks_oauthDATABRICKS_OAUTH_PARAMzall-apis_DEFAULT_SCOPE<_TOKEN_EXPIRY_BUFFER_SECONDSi_DEFAULT_TTL_SECONDSvaluereturnc`t|tsy|jdr t|S|S)z=Resolve a config value, expanding ``os.environ/`` references.Nz os.environ/) isinstancestr startswithr )rs s/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/agent_endpoints/databricks_oauth.py_resolve_secretr.s- eS !  &e$$ L workspace_urlcl|jjd}|jd}|dS)z=Build the workspace OIDC token endpoint from a workspace URL./z/serving-endpointsz/oidc/v1/token)striprstrip removesuffix)rbases r_token_url_from_workspacer!7s9    ' ' ,D   1 2DV> ""rT)frozencLeZdZUeed<eed<eed<eed<edefdZy)DatabricksAppOAuthConfig client_id client_secret token_urlscoperctj|jjj dd}|j d|j d|jd|S)N|)hashlibsha256r&encode hexdigestr'r%r()self secret_digests r cache_keyz"DatabricksAppOAuthConfig.cache_keyEs^ '~~d.@.@.G.G.IJTTVWZXZ[ ..!4>>"2!DJJs3NN J Q3QQrr$litellm_paramsc@|sy|jt}|yt|ts(t dtdt |j t|jd}t|jd}t|jd}d|fd|fd|ffDcgc] \}}|s| }}}|rt ddj|t|jd xst}t||t|| Scc}}w) a8Build a Databricks App OAuth config from an agent's ``litellm_params``. Returns ``None`` when the agent has no ``databricks_oauth`` block. Raises ``ValueError`` when the block is present but incomplete, so misconfiguration surfaces loudly instead of silently sending an unauthenticated request. N'z+' must be a mapping of OAuth settings, got r%r&rz:Databricks App OAuth config is missing required field(s): z, r()r%r&r'r() getr rdict ValueErrortyper3rjoinr r$r!) r9rawr%r&rnamermissingr(s rparse_databricks_oauth_configrDMs2 ##$:;C { c4 1344_`deh`i`r`r_stuu&sww{';>),  ^^I.F!    $0088JE3 Qwy%S9  40     9     st7C&C C&C C&C C&$C8C 9>C7 C&CC& C& CC&C#C C#C&cKttj}tjd|j t j|jd|jjj} |j|j d|jdd|dd d{}|j)}t+|t,s"t!d t/|j0d |j3d}|s t!d|j3d} | t5|nt6} t;| t<z d} || fS7#tj$r(}t!d |j"j$|d}~wtj&$r}t!d ||d}~wwxYw#t8t f$r t6} YwxYww)N) llm_providerz+Fetching Databricks App OAuth token from %s:client_credentials) grant_typer(zBasic z!application/x-www-form-urlencoded) Authorizationz Content-Type)dataheadersz6Databricks App OAuth token request failed with status z+Databricks App OAuth token request failed: zBDatabricks App OAuth token response returned non-object JSON (got ) access_tokenz:Databricks App OAuth token response missing 'access_token' expires_inr)rr A2Ardebugr'base64 b64encoder%r&r.decodepostr(httpxHTTPStatusErrorr>response status_code HTTPErrorjsonrr=r?r3r<intr TypeErrormaxr) r0r[client basic_authrwexcbodyrmraw_expires_inrnr]s rr_z)DatabricksAppOAuthTokenCache._fetch_tokens.0J^,PdJ&BBAFS  G $$ HIaIaHbc  [J3%PQWZ Z [ :& .-J .smBG4E<E=EA1G3GGEF?2#FF?+F::F??GGGGG)rN)r3r4r5__doc__rJrrQrRrSrVrYr$rctupler{r_ __classcell__)rMs@rrFrFysp2A3A7<<A#s#t# ,D.*!)A*!eCQTHo*!rrF databricks_app_oauth_token_cachecrKt|}|ytj|d{}dd|iS7 w)zReturn ``{"Authorization": "Bearer "}`` for a Databricks App agent. Returns ``None`` when the agent is not configured for Databricks App OAuth. NrizBearer )rDrrc)r9r[rbs r"resolve_databricks_app_auth_headerrsE2.AF ~9II&QQE wug. //Rs '75 7)"rrQrqr, dataclassesrtypingrrrulitellm._loggingrlitellm.caching.in_memory_cacher&litellm.llms.custom_httpx.http_handlerrlitellm.secret_managers.mainr litellm.types.llms.custom_httpr r r6r rrrrr!r$r=rDrFrrr8rrrs0 ! +9I7? 22""&(e("e"33:#S#S# $ Q Q Q)cNT))$)XZ!=Z!z+G*H %H 0cNT) 0 #s(^d 0r