tPjۏUdZddlmZddlZddlZddlZddlZddlZddlZddl m Z m Z ddl m Z mZmZmZmZmZddlZddlZddlmZddlmZddlmZdd lmZmZdd lmZdd l m!Z!dd l"m#Z#dd l$m%Z%ddl&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:ddl;mZ>ddl?m@Z@mAZAddlBmCZCmDZDddlEmFZFddlGmHZHmIZImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZRmSZSGddeTZUGddeTZVdZWdeXd<dZYdeXd<dZZdeXd <d!Z[deXd"<d#Z\deXd$<d%Z]deXd&<ed'e)e^z(Z_d.d)Z`Gd*d+ZaGd,d-Zby)/z Supports using JWT's for authenticating into the proxy. Currently only supports admin. JWT token must have 'litellm_proxy_admin' in scope. ) annotationsN) AwaitableCallable)AnyFinalLiteralNoReturnTypeVarcast)x509)default_backend) serialization) HTTPExceptionstatus)PyJWK)verbose_proxy_logger)get_nested_value) HTTPHandler)DEFAULT_JWKS_STALE_TTL RBAC_ROLES JWKKeyValueJWTAuthBuilderResultJWTIssuerConfig JWTKeyItemLiteLLM_EndUserTableLiteLLM_JWTAuthLiteLLM_OrganizationTableLiteLLM_TeamMembershipLiteLLM_TeamTableLiteLLM_UserTableLitellmUserRolesMemberProxyErrorTypesProxyException ScopeMappingSpanTeamMemberAddRequestUserAPIKeyAuth)can_team_access_model) RouteChecks)UserApiKeyCacheget_management_object_ttl) PrismaClient ProxyLogging)UserRepository) _allowed_routes_checkallowed_routes_checkget_actual_routesget_end_user_objectget_org_objectget_org_object_by_aliasget_role_based_modelsget_role_based_routesget_team_membershipget_team_objectget_team_object_by_aliasget_user_objectceZdZdZy)NoMatchingJWTPublicKeyErrorzJRaised when a JWKS endpoint returns no key matching the requested ``kid``.N__name__ __module__ __qualname____doc__b/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/auth/handle_jwt.pyr>r>NsTrEr>ceZdZdZy)JWKSUnreachableErrorznRaised when an IdP's JWKS / OIDC discovery endpoint is unreachable and no cached copy is left to fall back on.Nr?rDrErFrHrHRsxrErHrJWKS_FETCH_ATTEMPTSg? JWKS_FETCH_RETRY_BACKOFF_SECONDS JWKS_UNREACHABLE_BACKOFF_SECONDSlitellm_stale_STALE_CACHE_KEY_PREFIXlitellm_stale_written_at_!STALE_WRITTEN_AT_CACHE_KEY_PREFIXlitellm_jwks_unreachable_UNREACHABLE_CACHE_KEY_PREFIX _CachedValueT)boundc^td|tjdtjS)NzService Unavailable, the identity provider's JWKS endpoint is temporarily unreachable, so the JWT signature could not be verified. Please retry shortly. Error: Nonemessagetypeparamcode)r$r#auth_provider_unavailablerHTTP_503_SERVICE_UNAVAILABLE)errors rFjwks_unavailable_exceptionr``s8  eejdk m 6 6  0 0 rEceZdZUdZded<ded<gdZdZdZd Zd Z d Z d Z d Z eeee e e e fZ dHdZ dI dJdZedKdZedLdZdMdZdMdZdNdZdOdZdPdZdQdZdQdZdRdZdSdZdSdZdRdZdRdZdTdUdZdRd Z dVd!Z!dWd"Z"dVd#Z#dXd$Z$dRd%Z%dRd&Z&dRd'Z'dRd(Z(dQd)Z)dYd*Z*dZd+Z+d[d,Z,d\d-Z-d]d.Z. d^d/Z/ d^d0Z0d\d1Z1 d_d2Z2dYd3Z3d`d4Z4d`d5Z5dad6Z6dbd7Z7dcd8Z8ddd9Z9ded:Z:dfd;Z;ddhd>Z?did?Z@djd@ZAdkdAZBdldBZC dm dndCZD do dpdDZEdqdEZFdfdFZGdGZHy)r JWTHandlerz - treat the sub id passed in as the user id - return an error if id making request doesn't exist in proxy user table - track spend against the user id - if role="litellm_proxy_user" -> allow making calls + info. Can not edit budgets PrismaClient | None prisma_clientr+user_api_key_cache) RS256RS384RS512PS256PS384PS512ES256ES384ES512EdDSA_litellm_jwt_issuer_litellm_user_id_litellm_user_email_litellm_team_id_litellm_team_ids_litellm_org_id_litellm_end_user_idc>t|_d|_i|_y)Nr)r http_handlerleeway_refresh_locksselfs rF__init__zJWTHandler.__init__s(M 79rEc<||_||_||_||_yN)rdrelitellm_jwtauthry)r|rdrerrys rFupdate_environmentzJWTHandler.update_environments#+"4. rEcF|y|jd}t|dk(S)NF.rI)splitlen)tokenpartss rFis_jwtzJWTHandler.is_jwts& ={{3'5zQrEctj|sy tj|dddtj}t |t r|Sy#t$r }tjd|Yd}~yd}~wwxYw)z Decode JWT claims without signature verification. Used for routing decisions before selecting validation path. NF)verify_signature verify_aud)options algorithmsz6Failed to decode unverified JWT claims for routing: %s) rbrjwtdecodeSUPPORTED_JWT_ALGORITHMS isinstancedict Exceptionrdebug)rclaimses rFget_unverified_claimsz JWTHandler.get_unverified_claimssu   ' JJ-2%H%>>F &$'   & &'_ab c s:A A=A88A=c|jjy|j|d}|syt|}|jjD]}|j|vs|j cSy)a Returns the RBAC role the token 'belongs' to based on role mappings. Args: token (dict): The JWT token containing role information Returns: Optional[RBAC_ROLES]: The mapped internal RBAC role if a mapping exists, None otherwise Note: The function handles both single string roles and lists of roles from the JWT. If multiple mappings match the JWT roles, the first matching mapping is returned. Nr default_value)r role_mappings get_jwt_rolesetrole internal_role)r|rjwt_role jwt_role_set role_mappings rF_rbac_role_from_role_mappingz'JWTHandler._rbac_role_from_role_mappingsw    - - 5++%t+L!(m  00>> 2L  L0#111 2 rEcv|j|}|j|}|j|d}|rtjS|j |dtj S|j|d|"|j|rtjS|j|x}r|Sy)a^ Returns the RBAC role the token 'belongs' to. RBAC roles allowed to make requests: - PROXY_ADMIN: can make requests to all routes - TEAM: can make requests to routes associated with a team - INTERNAL_USER: can make requests to routes associated with a user Resolves: https://github.com/BerriAI/litellm/issues/6793 Returns: - PROXY_ADMIN: if token is admin - TEAM: if token is associated with a team - INTERNAL_USER: if token is associated with a user - None: if token is not associated with a team or user rscopesNr) user_roles) get_scopesis_adminget_user_rolesr! PROXY_ADMIN get_team_idTEAM get_user_idis_allowed_user_role INTERNAL_USERr)r|rrrr rbac_roles rF get_rbac_rolezJWTHandler.get_rbac_roles"e4--v-6 //e4/P #// /   E  > J#(( (   5  = I%))Z)@#11 1;;%;H HY H rEc6|jj|vryy)NTF)radmin_jwt_scope)r|rs rFrzJWTHandler.is_admin s    / /6 9rEc|j|jttrsyt |dd}t |ddxsg}t fd|DS)NFrissuersc3<K|]}|jk(ywr)issuer).0 issuer_configrs rF zAJWTHandler._is_trusted_issuer_normalized_token..sVm=''61Vs)getLITELLM_JWT_ISSUER_CLAIMrstrgetattrany)r|rrissuer_configsrs @rF#_is_trusted_issuer_normalized_tokenz.JWTHandler._is_trusted_issuer_normalized_tokensY $"?"?@&#&f!(/@$!G 'D I ORV~VVVrEc2|j|xr||vS)Nr)r)r|rclaims rF$_has_trusted_issuer_normalized_claimz/JWTHandler._has_trusted_issuer_normalized_claims 77e7DWRWWrEc@|j||jrB|j|j}t|tr|St|t r|gSgS|j j(t||j jg}|xsgSgSNrrdatakey_pathdefault) rLITELLM_TEAM_IDS_CLAIMrrlistrrteam_ids_jwt_fieldr)r|rissuer_team_idsteam_idss rFget_team_ids_from_jwtz JWTHandler.get_team_ids_from_jwts  4 45HcHc 4 d%*YYt/J/J%KO/40&&/3/'(( I    2 2 >0@--@@1H >r ! rEct|j|}d}|j||jr|j |j}n8|j j "t||j j d}|it|tr0|D])}|t|}|s||vs|j|+|S|r't||vr|jt||S)uf Return team IDs from both the plural ``team_ids_jwt_field`` and the singular ``team_id_jwt_field`` claim (string or list of strings), as a deduplicated list preserving plural-first order. Membership-reconciliation paths (SSO callback, JWT-bearer sync) need to consider both claim shapes. Reading only the plural field — as callers historically did — silently dropped users whose IdP populates the singular field, which is what Okta and Auth0 default to when a user has a single primary team. This intentionally does NOT consult ``team_id_default``: that fallback is a property of how the JWT-bearer auth flow resolves a single request-bound team, not of the token's claims. Callers that want the default-team behavior should still go through ``get_team_id``. Nrr) rrrLITELLM_TEAM_ID_CLAIMrrteam_id_jwt_fieldrrrappend)r|rrsingularitemsids rFget_all_jwt_team_idszJWTHandler.get_all_jwt_team_ids2s"&*$*D*DU*K%L  4 45HbHb 4 cyy!;!;R>R>g>g>orEcz|jj%t|jjtryy)z Returns: - True: if 'user_allowed_email_domain' is set - False: if 'user_allowed_email_domain' is None TF)ruser_allowed_email_domainrrr{s rFis_enforced_email_domainz#JWTHandler.is_enforced_email_domainus7    9 9 E*  : :CK rEc|j||jr6|j|j}t|tr |r|dS|S|S |j j t}t||j j |}||ur.|j j|j jS|St|tr8|s|Stjd|j j ||d|d}|S|j j|j j}|Sd} |S#t$r|}Y|SwxYw)Nrrrz\JWT Auth: team_id_jwt_field '%s' returned a list %s; using first element '%s' automatically.) rrrrrrrobjectrteam_id_defaultrrr)r|rrteam_idsentinels rFrzJWTHandler.get_team_idsb  4 45HbHb 4 cii : :;G'4(%,wqz?-?N" $##55A"((*!11CC$ h&++;;G#33CCC,,gt,",,(..v,,>>  &ajG%%55A..>>  $#G $s1A1EE E5E,EE EEc |jj$t||jj|}|Sd} |S#t$r|}Y|SwxYw)aG Extract team name/alias from JWT token using the configured team_alias_jwt_field. Args: token: The decoded JWT token dictionary default_value: Default value to return if field not found Returns: The team alias from the token, or default_value if not found Nr)rrrr)r|rr team_aliass rFget_team_aliaszJWTHandler.get_team_aliassi '##88D-!11FF) "!!  '&J '9AA AANc8|dury|jjS)z Returns: - True: if 'user_id_upsert' is set AND valid_user_email is not False - False: if not F)ruser_id_upsert)r|valid_user_emails rFis_upsert_user_idzJWTHandler.is_upsert_user_ids! u $##222rEc|j||jr|j|jS |jj$t ||jj|}|S|} |S#t $r|}Y|SwxYwr)rLITELLM_USER_ID_CLAIMrruser_id_jwt_fieldrrrs rFrzJWTHandler.get_user_ids  4 45HbHb 4 c99T778 8 $##55A*!11CC)( $#G $rc |jj$t||jj|}|S|} |S#t$r|}Y|SwxYw)zn Returns the user role from the token. Set via 'user_roles_jwt_field' in the config. r)ruser_roles_jwt_fieldrrr|rrrs rFrzJWTHandler.get_user_rolessk '##88D-!11FF) +  '&J '8AA AAc|jjsy|j|g}|sy|jjD]9}|D]2}tj||js$|j ccS;y)z(Map roles from JWT to LiteLLM user rolesNr)rjwt_litellm_role_maprfnmatchr litellm_role)r|r jwt_rolesmappingrs rFmap_jwt_role_to_litellm_rolez'JWTHandler.map_jwt_role_to_litellm_roles~##88,,5,K ++@@ 0G! 0??4)9)9:"/// 0 0rEc |jj$t||jj|}|S|} |S#t$r|}Y|SwxYw)z Generic implementation of `get_user_roles` that can be used for both user and team roles. Returns the jwt role from the token. Set via 'roles_jwt_field' in the config. r)rroles_jwt_fieldrrrs rFrzJWTHandler.get_jwt_rolesk '##33?-!11AA) +  '&J 'rc`|+jjtfd|Dryy)zl Returns the user role from the token. Set via 'user_allowed_roles' in the config. c3NK|]}|jjvywr)ruser_allowed_roles)rrr|s rFrz2JWTHandler.is_allowed_user_role.."s"[DD00CCC[s"%TF)rr r)r|rs` rFrzJWTHandler.is_allowed_user_roles2  "$$77C[PZ[[rEc|j||jr|j|jS |jj$t ||jj|}|Sd} |S#t $r|}Y|SwxYwr)rLITELLM_USER_EMAIL_CLAIMrruser_email_jwt_fieldrr)r|rr user_emails rFget_user_emailzJWTHandler.get_user_email's  4 45HeHe 4 f99T::; ; '##88D-!11FF) "  '&J 'rc |jj$t||jj|}|S|} |S#t$r|}Y|SwxYw)Nr)robject_id_jwt_fieldrr)r|rr object_ids rF get_object_idzJWTHandler.get_object_id8sk &##77C,!11EE) *  &%I &rc|j||jr|j|jS |jj$t ||jj|}|Sd} |S#t $r|}Y|SwxYwr)rLITELLM_ORG_ID_CLAIMrrorg_id_jwt_fieldrr)r|rrorg_ids rF get_org_idzJWTHandler.get_org_idFs  4 45HaHa 4 b99T667 7 ###44@)!11BB)   #"F  #rc |jj$t||jj|}|Sd} |S#t$r|}Y|SwxYw)aV Extract organization name/alias from JWT token using the configured org_alias_jwt_field. Args: token: The decoded JWT token dictionary default_value: Default value to return if field not found Returns: The organization alias from the token, or default_value if not found Nr)rorg_alias_jwt_fieldrr)r|rr org_aliass rF get_org_aliaszJWTHandler.get_org_aliasWsi &##77C,!11EE) !   &%I &rc t|dtr|dj}|St|dtr|d}|St dt |dd#t $rg}Y|SwxYw)NscopezUnmapped scope type - z. Supported types - list, str.)rrrrrrZr)r|rrs rFrzJWTHandler.get_scopesps %.#.w--/ E'ND1w   "8eGn9M8NNl mnn F  s&AAA A.-A.cKdvrSjdjfddd{S7w)aS If url points to an OIDC discovery document (*.well-known/openid-configuration), fetch it and return the jwks_uri contained within. Otherwise return url unchanged. This lets JWT_PUBLIC_KEY_URL be set to a well-known discovery endpoint instead of requiring operators to manually find the JWKS URL. z .well-known/openid-configurationlitellm_oidc_discovery_c&jSr)_fetch_jwks_uri_from_discoveryr|urlsrFz.JWTHandler._resolve_jwks_url..sD??DrEzan OIDC discovery lookup cache_keyttlrefresh log_contextN)_cached_with_stale_fallback_get_public_key_cache_ttlr"s``rF_resolve_jwks_urlzJWTHandler._resolve_jwks_url}sT .S 8J55/u5..0D2 6    s 4?=?c HKtdtD]'} |jj|d{cS |jj|d{S7+#tj $r`}t jdt|j||t|tjt|zd{7Yd}~d}~wwxYw7|#tj $r1}tt|jd|dtd|d}~wwxYww)zSGET ``url``, retrying transport failures so one IdP blip does not fail the request.r0Nz6JWT Auth: %s fetching %s (attempt %s/%s), retrying: %sz fetching z after z attempts)rangerJrxrhttpxTransportErrorrwarningrZr@asynciosleeprKrH)r|r#attemptrs rF_get_with_transient_retriesz&JWTHandler._get_with_transient_retriess Q 34 PG P!..223777 P y**..s33 38'' P$,,LG$$' mm$Dw$NOOO P4## y&$q'*:*:);:cU'ReQffo'pqwx x ysD"A#A!A#D"CCC D"!A##C6ACC C D"CD"CD.,DDD"clK|jj|d{}td|S7w)N_CachedValueT | None)reasync_get_cacher r|r&cacheds rF_get_cached_valuezJWTHandler._get_cached_values3"55EEiPP*F33Qs 424cK|jj|d{}t|ttfr t |SdS7'wr)rer8rintfloatr9s rF_get_cached_timestampz JWTHandler._get_cached_timestampsA"55EEiPP *6C< @uV}JdJQsA A (A c\K|jj|||d{y7w)Nkeyvaluer')reasync_set_cache)r|r&rCr's rF_put_cached_valuezJWTHandler._put_cached_values(%%55)5VY5ZZZs ",*,cK|j|d{}||S|jj|tj}|4d{|j|d{}||cdddd{S|j ||||d{cdddd{S77b7K7977#1d{7swYyxYww)zIRead ``cache_key``, refreshing it through a single-flight lock on a miss.Nr%)r;rz setdefaultr2Lock_refresh_or_serve_stale)r|r&r'r(r)r:lockcached_after_locks rFr*z&JWTHandler._cached_with_stale_fallbacks594J4J94U.U  M))44Y O  CGCYCYZcCd=d  ,(   55#g;6     /V  =d      sCB5  '#78N >M373I3IMcLdendoJp3q-q// :: / =CK3>M$$ [    3 "   - .r:s3)CB<9C%B>&C>C?>C>CCcK|jt|d{}|dStj|z S7wr)r?rQtime)r|r& written_ats rFrPzJWTHandler._stale_copy_agesG"&"<"<@a?bclbm=n"oo !)tGtyy{Z/GGpsA? Ac(Kt|}|j|d{}| t|S |d{}|j|||d{|dkDr`|jt ||||zd{|jt|tj||zd{|S77#t$r6}|j|t |t d{7|cYd}~Sd}~wwxYw777Pw)a Refresh ``cache_key``, returning the outage as a value rather than raising it. A failed refresh is remembered for ``JWKS_UNREACHABLE_BACKOFF_SECONDS`` so a sustained outage costs one fetch per window instead of one per request serialised behind the refresh lock. N)r&rCr'r) rSr;rHrErrMrOrQrW) r|r&r'rMr(unreachable_cache_keyrecent_failure refreshedrs rFrOz$JWTHandler._refresh_or_record_outagesL+G)G {'S262H2HI^2_,_  %'7 7 %,YI$$y s$SSS q=((34YK@ WZ]fWf)  ((>? {KSWS\S\S^dgjsds)  )-` /# ((/s1vCc)  H   T  sDCD C CC DD +DD8D?DDC D $D7C:8D>D ?DD  DDDcKtjd||j|d{}|jdk7r(t d|d|jd|j  |j }|jd}|st d|d tjd |||S7#t$r}t d|d|d}~wwxYww) Nz2JWT Auth: Fetching OIDC discovery document from %sz"JWT Auth: OIDC discovery endpoint  returned status : z5JWT Auth: Failed to parse OIDC discovery document at jwks_uriz%JWT Auth: OIDC discovery document at z% does not contain a 'jwks_uri' field.z3JWT Auth: Resolved OIDC discovery %s -> jwks_uri=%s)rrr5 status_codertextjsonr)r|r#response discoveryrras rFr!z)JWTHandler._fetch_jwks_uri_from_discoverys""#WY\] $ @ @ EE   3 &4SE9J8K_K_J``bckcpcpbqr  `'}}I$-- 3CC5Hmno o""#XZ]_ghF `STWSXXZ[\Z]^_ _ `s3+CB5;C*B7:.IsD112CDrEzkid=r%)rmkid#No matching public key found. keys=, kid=)r,r*r+ parse_keysr rr>)r|jwks_urlrtrm public_keyrns` @rF_get_public_key_from_jwks_urlz(JWTHandler._get_public_key_from_jwks_urlDs)-)?)?)I#I <<./@.AB..0Dse =  !OO3O?  !j) )),OPaObbhilhm*noo$J s!B B 4B B ;B  B cKtjd}| td|jdDcgc]#}|j s|j %}}|D]} |j ||d{cSt d|d|cc}w7#t $r!}tjd||Yd}~_d}~wt$r(}tjd||t||d}~wwxYww) NJWT_PUBLIC_KEY_URLz,Missing JWT Public Key URL from environment.,rxrtz0JWT Auth: No matching public key found at %s: %sz*JWT Auth: JWKS endpoint %s unreachable: %srurv) osgetenvrrstriprzr>rrrHr_r`)r|rtkeys_urlr# keys_url_listkey_urlrs rFget_public_keyzJWTHandler.get_public_keySs))$89  JK K7?~~c7JZciik Z Z$ ;G ;!??VY?ZZZ ;*,OP]^dehdi*jkk [[. k$**+]_fhijj' ;$**+WY`bcd03: ;s^6C:BB C:(B>B?BC:B C7'C>C: C7#C22C77C:cd}t|dk(r\t|tr|jdd|k(s||}|St|tr|djdd|k(s||d}|St|dkDrK|D]F}t|tr|jdd}nd}|+t|ts<|?||k(sE|}H|S)Nr0rtr)rrrrr)r|rmrtryrBkey_kids rFrwzJWTHandler.parse_keysfs(, t9>$%488E4+@C+G3;! D$'T!W[[-E-LPSP[!!W Y] %c4(!ggeT2G"G?z#t'<ATY`dgYg!$J  %rEc|jjy|jdd}||jjk(ryy)NT@F)rrr)r|r  email_domains rFis_allowed_domainzJWTHandler.is_allowed_domainxsF    9 9 A(..s3B7 4//II IrEcK|jjs tddtj|j j }|jj|d{}|tjd|Stjd|jj |jj|jjd|dd d{}|jd k7r%td |jd |j|j}tjd ||jj!|||jj"d{|S777 #t$r)}tj$d|td|d}~wwxYww)a Fetch user information from OIDC UserInfo endpoint. This follows the OpenID Connect protocol where an access token is sent to the identity provider's UserInfo endpoint to retrieve user identity information. Args: token: The access token to use for authentication Returns: dict: User information from the UserInfo endpoint Raises: Exception: If UserInfo endpoint is not configured or request fails zWOIDC UserInfo endpoint not configured. Set 'oidc_userinfo_endpoint' in JWT auth config.oidc_userinfo_NzReturning cached OIDC UserInfoz"Calling OIDC UserInfo endpoint: %szBearer zapplication/json) AuthorizationAccept)r#headersr^z'OIDC UserInfo endpoint returned status r`zReceived OIDC UserInfo: %srAz Error fetching OIDC UserInfo: %szFailed to fetch OIDC UserInfo: )roidc_userinfo_endpointrhashlibsha256encode hexdigestrer8rrrxrrbrcrdrDoidc_userinfo_cache_ttlr_)r|rr&cached_userinforeuserinfors rFget_oidc_userinfozJWTHandler.get_oidc_userinfos"##::uv v,GNN5<<>,J,T,T,V+WX '+'>'>'N'Ny'Y!Y  & & &'G H" """#GI]I]ItItu C$($5$5$9$9((??'.ug%60%:%H##s*"I(J^J^I__abjboboap qrr&mmoH & &'CX N))99((@@:   O?"Z  C & &'I1 M=aSAB B Cs\A4G6F7AG?:F9F:BF FFGFF G $$GG  GFctjd}tjd}|*|(|jstjdd|_i}|d|d<|d|d<|||xsdd S) aBuild the audience/issuer/options kwargs for ``jwt.decode``. Setting ``JWT_AUDIENCE`` (and optionally ``JWT_ISSUER``) turns on the corresponding PyJWT verifications, blocking cross-tenant tokens minted by other applications that share the same IdP signing keys. When both are unset PyJWT only checks the signature and expiry, which is preserved for backward compatibility but logged once as a warning. The warning fires even in mixed deployments that also configure ``LiteLLM_JWTAuth.issuers``: tokens whose ``iss`` does not match any configured issuer fall through to this global path, and if env-var scoping is absent that fallback is itself unscoped. JWT_AUDIENCE JWT_ISSUERNzJWT auth is enabled but neither JWT_AUDIENCE nor JWT_ISSUER is configured. Tokens minted by any application that shares the same IdP signing keys will be accepted. Set JWT_AUDIENCE (and ideally JWT_ISSUER) to scope this proxy.TFr verify_iss)audiencerr)rr_unscoped_jwt_warning_emittedrr1)clsrrrs rF_build_decode_kwargszJWTHandler._build_decode_kwargss))N3 ,/  s7X7X ( (@  15C -!  $)GL ! >$)GL !!$  rEct|dd}|y|j}|sy|j|}|y|jd}t |t r|sy|D]}|j |k(s|cSy)Nrriss)rrrrrrr)r|rrrrrrs rF_get_configured_issuerz!JWTHandler._get_configured_issuers!(/@$!G  " / 7 7222? > 5)&#&f+ %M##v-$$ %rEcn|jr |jS|jjddS)N/z!/.well-known/openid-configuration)rxrrstrip)r|rs rF_get_jwks_url_for_issuerz#JWTHandler._get_jwks_url_for_issuers9  ! ! )) ) &&--c233TUUrEcNt}t|||}||us||dk(ry|S)uResolve a mapped claim from ``token``. Returns ``None`` when the field is absent or empty so that mapped claims behave like the global ``litellm_jwtauth`` path — present claims override the normalised value, missing ones simply leave it ``None``. rN)rr)r|r claim_fieldr claim_values rF#_get_claim_value_for_issuer_mappingz.JWTHandler._get_claim_value_for_issuer_mappings=!(-  ( "k&9[B=NrEc|jDcic]\}}||jvs||}}}|j||j<|j|j f|j |jf|j|jf|j|jf|j|jf|j|jfg}|D]#\}}| |j!||} | | ||<%|Scc}}w)N)rr)itemsLITELLM_INTERNAL_CLAIMSrrrrr r rrrrrrrrr) r|rrkv normalizedclaim_mappings source_claimnormalized_claimrs rF_apply_issuer_claim_mappingsz'JWTHandler._apply_issuer_claim_mappingss"49KKM"kDAqQdNjNjEj1a4"k "k4A4H4H 4001  , ,d.H.H I  / /1N1N O  , ,d.H.H I  - -t/J/J K  + +T-F-F G  0 0$2P2P Q ! /= ; *L*#BB(CK&/: +, ;+#ls DDc2i}dD]}||vs||||<|S)N)ktyrtnrxycrvrD)r|ryjwkrBs rF_get_jwk_from_public_keyz#JWTHandler._get_jwk_from_public_key-s2< +Cj %c?C + rEcL| |s tdi}|d|d<|d|d<|xsdS)NzAaudience must be provided unless disable_audience_validation=TrueFrr) ValueError)r|rrdisable_audience_validationrs rF_get_decode_optionszJWTHandler._get_decode_options4sG  $?`a a!  $)GL ! >$)GL !$rEc h||n|j|||}t|tr_tj|j |j }tj|||j||||jStj|jt} | jj!t"j$j&t"j(j*} tj|| |j||||jS)N)rrr)ry)rrrrry)rrrrry)rrrr from_dictrrBrrrryr load_pem_x509_certificaterr ry public_bytesrEncodingPEM PublicFormatSubjectPublicKeyInfo) r|rryrrrrdecode_optionspublic_key_objcertrBs rF_decode_jwt_with_public_keyz&JWTHandler._decode_jwt_with_public_keyIs" ))!,G*  j$ '$)OOD4Q4Q]g4Q4h$i$m$mN::88&!{{ 44Z5F5F5H/J[\__&33  " " & &  & & ; ; zz  44";;  rEcK |j|j||d{} |j |||j |j |j}|j!||S7L#t$r}t||d}~wwxYw#tj$r,tdtjdtjt$r}td|d}~wwxYww)N)rr~)rryrrr Token ExpiredrXValidation fails: )rr)rzrrHr`rrrrrExpiredSignatureErrorr$r# expired_keyrHTTP_401_UNAUTHORIZEDrr)r|rrrtryrpayloads rF_auth_jwt_with_issuerz JWTHandler._auth_jwt_with_issuerws 7&*&H&H66]6S'I'!J 6!==%&//$++,9,U,U >G"00'1  3!$ 7,Q/Q 6 7((  '$0011    6045 5 6sVC2&A9A7A94B$C27A99 B BBC2AC/C**C//C2cKtj|}tjd||j dd}|j |}||j |||d{S|j}|j|d{}|S |j|||d|d|d }|jD cic]\}} ||jvs|| c} }St%d 77fcc} }w#tj$r,td tjdt j" t$$r} t%d | d} ~ wwxYww)Nz header: %srtr)rrrt)rtrrr)rryrrrrrXrzInvalid JWT Submitted)rget_unverified_headerrrrrrrrrrrrr$r#rrrr) r|rheaderrtr decode_kwargsryrrrrs rFauth_jwtzJWTHandler.auth_jwts~11%8""<8ZZt,#:::G  $33+4  $88: "&"5"5#"5">>  ! :!%!A!A)*:6(2))4 "B"*1bAATEaEa&C>+D. E <E >DAE EEE cTK|jjd{y7wr)rxcloser{s rFrzJWTHandler.closes%%'''s (&()returnrW)r) rdrcrer+rrryr=rrW)r str | Nonerbool)rrr dict | None)rrrRBAC_ROLES | None)rrrr)rrrr)rrrrrr)rrr list[str])rrrrrr)rrr)r bool | Nonerr)rrrlist[str] | Nonerr)rrrzLitellmUserRoles | None)rrrr)r#rrr)r#rrzhttpx.Response)r&rrr7)r&rrz float | None)r&rrCzJWKKeyValue | str | floatr'r>rrW) r&rr'r>r(&Callable[[], Awaitable[_CachedValueT]]r)rrrT) r&rr'r>rMr>r(rrz$_CachedValueT | JWKSUnreachableError)rr>)rnrrr)rxrrtrrr)rtrrr)rmrrtrrzJWTKeyItem | None)r rrr)rrrr)rr)rrrzJWTIssuerConfig | None)rrrr)rrrrrr)rrrrrr)ryrrr)NF)rstr | list[str] | Nonerrrrrr)NNF)rrryz dict | strrrrrrrrrrr)rrrrrtrrr)Ir@rArBrC__annotations__rrrr rrrrrr}r staticmethodrrrrrrrrrrrrrrrrrrrrrrrrrr,r5r;r?rEr*rIrPrOr!r+rNrprzrrwrrr classmethodrrrrrrrrrrrrDrErFrbrbls'&''  5.4.0, 6  !: : * , )      *>"H WX.%N$ *X23"& * " "2  "y*4K [8     *(((8 (  (  (TH!!! ! 8 ! . !F&. 4 ' pl&$9Cv%*!$ $ L.V"0",1 (&*   4"#,1, , , ) ,  ,  , &*,  , \ @(1T(rErbceZdZdZe ddZe ddZe ddZe ddZe d d dZ e d!dZ ed"d Z e d# d$d Z ed%d Z e d# d&d Ze d'd Ze d(dZe d# d)dZe d*dZe d+ d,dZe d-dZe d# d.dZe d/dZe d0dZe d# d1dZe d2dZed3dZe d4dZe d d5dZy)6JWTAuthManagerz7Manages JWT authentication and authorization operationsc rt||}||yt||}|stdd|d|d|y) zU Checks if user is allowed to access the route, based on their role. rgeneral_settingsT) user_routeallowed_routesRole=z not allowed to call route=z. Allowed routes=rbdetail)r8r1r)rrrouterole_based_routes is_alloweds rFcan_rbac_role_call_routez'JWTAuthManager.can_rbac_role_call_routesc$99_o#p  $ 1, yk)DUGK\]n\op  rEc \t||}||y||vrtdd|d|d|y)zU Checks if user is allowed to access the model, based on their role. rTrrz not allowed to call model=z. Allowed models=r)r7r)rrmodelrole_based_modelss rFcan_rbac_role_call_modelz'JWTAuthManager.can_rbac_role_call_modelsW$99_o#p  $  ) )yk)DUGK\]n\op  rEc|syg}|D]9}|j|vs|js|j|j;|jd}|sy||vrt ddd|d|iy)zE Check if scope allows access to the requested model Nrrr_zmodel=z not allowed. Allowed_models=r)rmodelsextendrr)scope_mappingsr request_datarallowed_modelssmrequested_models rFcheck_scope_based_accessz'JWTAuthManager.check_scope_based_accesss  "  1Bxx6!bii%%bii0 1".!1!1'!:  . 06/)::WXfWg!hi  rEcK|jjdurO| tddtj |||j dtj |||yyw) z/Validate RBAC role and model access permissionsTNrzjUnmatched token passed in. enforce_rbac is set to True. Token must belong to a proxy admin, team, or user.rr)rrr)rrr)r enforce_rbacrrrrr) jwt_handlerjwt_valid_tokenrrrrs rFcheck_rbac_rolezJWTAuthManager.check_rbac_roles  & & 3 3t ; # #H  3 3#!1"&&w/ 4   3 3#!1 4  #>#M#M % *;66  % %&OQ[ \ 8%+#5!1"3 !K%0%8%8"$))H*Vh*;66  * * , 4#.#>#>#P#PM&1&A&A&V&V D-'#0#7#7Q#?ERy((*%*1X HX//9l;UV M)m.D.DS.I!xx(;]KA%&WWQZ ;M?K::DFcd A-Phiyhzz|~B}CD ";..E! "==C'{/J/J/^/^$**J&HH " "sPAH (F,.F)/F,6,H "H #DH )F,, H5AH<H HH c@|j|}t|}|S)z8Get combined team IDs from groups and individual team_idr)rr)r r team_ids_from_groups all_team_idss rFget_all_team_idszJWTAuthManager.get_all_team_idss)'2&G&Go&G&^!"67 rEct|tr|jnd}tj||sytj |t |r|jxsiniS)NrmethodT) team_metadata)ruser_api_key_dict)rrupperr*#is_auth_enforced_pass_through_routecheck_passthrough_route_accessr(metadata)rrrequest_methodnormalized_request_methods rF"_team_has_passthrough_route_accessz1JWTAuthManager._team_has_passthrough_route_accesssn FPP^`cEd>+?+?+Ajn!>>, 99,[fK DB user_id %r (email/sso match)rrrdrer r!)r5rr(r6organization_idr$rrr# auth_errorr<rr4rr\rr9)rr rrrrr rdrer r!rrrrreffective_user_idteam_membership_objects rF get_objectszJWTAuthManager.get_objectsTs::8< %!"/'9%5&7   % %&NPY Z6#+#5!1"3  J$))F S]SmSm u $ @ L^_j_z_z`U`U_VW$//"  15 &#"/'9#.#@#@Rb#@#c%5&7) '    8< * +"/'9%5&7  $2#L#LU\ju#L#v  ' & &S!  $@D ww*##"/'9%5&7  #    "    u0 "2sYE3E'2E3E*BE3E- E3?E/AE3E1E3*E3-E3/E31E3c.|r|s|s|s tddy)zUIf enforce_rbac is true, validate that a valid rbac id is returned for spend trackingrzrNo user or team id found in token. enforce_rbac is set to True. Token must belong to a proxy admin, team, or user.rTrGrrr rs rFvalidate_object_idz!JWTAuthManager.validate_object_ids( wwL rEc  |sy|jDcic]\}}|j|}}}|jd}|sy|xr| }|s ||vrtdd|dt |t j d||Scc}}w)a Extract team_id from x-litellm-team-id header if present. Validates that the team is in the user's allowed teams from JWT. Args: request_headers: Dictionary of request headers allowed_team_ids: Set of team IDs the user is allowed to access (from JWT) fallback_to_db_teams: When True and the JWT carries no team claims (allowed_team_ids is empty), the header value is returned provisionally and validated against DB memberships later in auth_builder instead of being rejected here. Returns: The team_id from header if valid, None otherwise Raises: HTTPException: If team_id is provided but not in allowed_team_ids Nx-litellm-team-idrTeam 'zS' from x-litellm-team-id header is not in your JWT's allowed teams. Allowed teams: rz/Using team_id from x-litellm-team-id header: %s)rlowerrrrrr)request_headersallowed_team_idsrRrrnormalized_headersheader_team_iddefer_to_db_memberships rFget_team_id_from_headerz&JWTAuthManager.get_team_id_from_headers0?N>S>S>U$VdaQWWY\$V$V 2 6 67J K(<(UEUAU%.@P*P/0CDHIYDZC[\  ""#TVde%WsB c^Kddlm}|sy|sy|jD]*}|js|j|jk(s*yt t |jd|j } ||ttjd{tjd |j|j y70#t$rT}|jtjk(r0tjd |j|j Yd}~y|d}~wwxYww) z Map user to teams. - If user is not in team, add them to the team - If user is in team, do nothing r)team_member_addNuser)rr)memberr)r)rr>z%Successfully added user %s to team %sz&User %s is already a member of team %s)1litellm.proxy.management_endpoints.team_endpointsrsmembers_with_rolesrr'r"rr(r!rrrr$rZr#team_member_already_in_team)rrrsrurrs rFmap_user_to_teamsz JWTAuthManager.map_user_to_teamss V  "44 F~~&..K4G4G"G +#++ ''   !"0.::#   ! & &79L9LkNaNa  #  vvDDD$**Q>QS^SfSf sS(D-D-/D-5%C C /C D- C D*AD%D-#D%%D**D-cK|jjsy||y|j|}|r|j|jk7rt |j jd|jid|jid{|j|_|4|j|j|tt|d{t|jjr|j|n|j|}t|j xsg}||z }|jjxr| } | r tn||z } |s| r{ddlm} | |jt'|t'| d{t'||_|4|j|j|tt|d{y7W77Q7 w) ak Sync user role and team memberships with JWT claims The goal of this method is to ensure: 1. The user role on LiteLLM DB is in sync with the IDP provider role 2. The user is a member of the teams specified in the JWT token This method is only called if sync_user_role_and_teams is set to True in the JWT config. Nrr)wherer)rBrC model_typer'r)patch_team_membership)rteams_ids_to_add_user_toteams_ids_to_remove_user_from)rsync_user_role_and_teamsrrrCr/tableupdaterrDr r,rrRrrteams/litellm.proxy.management_endpoints.scim.scim_v2r}r) r r rrdrenew_role jwt_team_idsexisting_teams teams_to_add preserve_db_teams_without_claimsteams_to_remover}s rFrz'JWTAuthManager.sync_user_role_and_teamsDs"**CC   -"7 &BB?S  --? /55<< +"5"56!8>>2=  %-NNK !!-(88#++%012DE 9"**??  , ,_ =22?C !$K$5$5$; <*^; 2=2M2M2b2b2wkwgw(*JP^amPm ? (#++)-l);.2?.C   !%\ 2K !-(88#++%012DE 9 [  4 sKB G- G# AG-G&CG-G)AG-G+G-&G-)G-+G-c8K|r|jdnd}|rtj|sy t||||||jj d{} ||d<| |d<y7#t $r"} tjd||| Yd} ~ yd} ~ wwxYww)a,Attach team context from x-litellm-team-id to an admin result. Only applies on LLM API routes so team TPM/RPM limits and attribution are enforced when admins act on behalf of a team. Admin management routes ignore the header to preserve pre-existing bypass behavior. riNrHrz{admin x-litellm-team-id=%r on route=%s could not be resolved (%s); proceeding with admin access, team context NOT attached.rr) rr*is_llm_api_router:rr"rrr1) admin_resultrrlr rdrer r!rorrs rF"_attach_team_from_header_for_adminz1JWTAuthManager._attach_team_from_header_for_admins"M\ 3 34G Hae[%A%A%N  '6&+#5!1"3*::II ("K(#1 Y&1 ]#+"  ! ( (K    s@/B(A,A*A, B*A,, B5B BBBcPK|$|jrt|jdk7ry|jd} t||||||d{}|y|s||dfSt||||||d{} ||| fS7,7 #t$rt j d|d YywxYww) u If JWT did not resolve team_id, but the user belongs to exactly one team in LiteLLM, load that team (and membership when user_id is set) so that spend / metadata can be attributed correctly. Returns (team_id, team_object, team_membership_object). Any DB error is debug-logged and the tuple is (None, None, None) — no exception ever propagates from this helper. Nr0NNNrrr_z4JWT single-team fallback error, skipping. team_id=%sT)exc_info)rrr:r9rrr) rrrdrer r!r"_tidteam_rowrs rF_resolve_single_team_fallbackz,JWTAuthManager._resolve_single_team_fallbacks&  k&7&73{?P?P;QUV;V#!''* $$3+#5!1"3- %H'Xt+++>+#5!1"3 ,&O?2 2-& $ & &F  $  $sd7B&A?A;A?B&A?B&A?1A=2A?:B&;A?=A??!B# B&"B##B&c Kddlm} |r |jng} tj || |}d}| D]w} t |||| | |d{}d}|r t||| dd{|sHX[=\>#7#7#9bf>> 1  !&++ + ; ;  rEc$tdd|d)z The single denial shape for a provisional x-litellm-team-id header, raised identically for nonexistent teams and for teams the user is not a member of, so the response does not reveal whether a team id exists. rrjzB' (from x-litellm-team-id header) is not in your team memberships.rrG)rs rF$_raise_header_team_membership_denialz3JWTAuthManager._raise_header_team_membership_denialjs!WI%gh  rEcX|r |jng}||vrytj|y)z A provisional team_id from the x-litellm-team-id header (accepted without JWT-team validation when the JWT carries no team claims) must exist in the user's DB team memberships before it becomes request context. N)rrr)rrrs rF&_validate_header_team_in_db_membershipz5JWTAuthManager._validate_header_team_in_db_membershipvs-5@{00R m # ;;GDrEc H K|jjrB|j|s0tjd|j |d{} n|j |d{} |jjr(|jj| s tdd|j| } tj|| |||| d{|j| } |jjrC|jjr-tj|jj| |||j!| d}tj#|| d{\}}}|j%| d}|j'| d}d}d}|j!| d}| r-|r+| t(j*k(r|}n| t(j,k(r|}tj/|| ||||| | d{}|r'tj1||| ||||| d{|Stj3|| }|j5| d}|jj6xr/|j9|  xr|j;| d xr|du}|r|s|j=|tj?| || }|r6|} tA||||||jjBxr| d{}n)|s'|s%tjG|| ||||d{\}}|s:|s8tjI||jKd || ||||| d{\}}|rf|dtMjN|tQ| tRr| jUndr-tA||||||jjB d{}|r.tjW||| stjY||j[| d}tj]||||||||||||| d{\}}}}}|r |j^n|} tja|| |||d{||rtjc|||jKd |||jjd|jjB|||||  d{\}}}|rtjW||| stjY|n|=tjg|||||||jjBd{\}}}nJ|rH||k(rCtji||tjk|| |stdd|d|dtjm||d{tjo|||jKdddtq|xr|jrt(jtk(}!tw|!|||||jxr |jxn||| ||||||  S777r77G7#7P#t$r|stjE|YHwxYw7T777I777G7ۭw) z-Main authentication and authorization builderrzDOIDC UserInfo is enabled. Fetching user info from UserInfo endpoint.NrzInvalid JWT tokenr)rrrrrrX)rrrlr rdrer r!)rlrmrRrr) rrrrCr rdrer r!r;rOrH) rr rrrrr rdrer r!rr)r r rrdre) rrrrr rQr"rdrer r!rC)rrrdrer r!r")rrrrjzB' (from x-litellm-team-id header) is not allowed to access route 'r&)rrr Frf) rrrrr rrrrrrrr)=roidc_userinfo_enabledrrrrrcustom_validaterrrr renforce_scope_based_accessrrrrYrrr!rrrrr9rrRrraddrqr:r"rr5rVrr*r@rrr?rErIrrdr`rrrQrrrryrgrrrrr )"rr rrrrdrer r!rlrCr rrrrr rrrrrrr8specific_team_iddb_team_fallbackrorrrrrcresolved_org_idrs" rF auth_builderzJWTAuthManager.auth_builders"  & & < <[EWEW^eEWEf & &'m n*5*G*Gg*G*V$VO%0$8$8w$8$GGO  & & 6 6..>>O# #. '44?4K ,,          $.._.E  & & A AkFaFaFpFp  3 3*::II)!1 4  --OSW-X 7E6R6RS^`o6p0p--$.._TX.Y(88^b8c "04 --OSW-X ,111#.<<<#%3$E$E /^h%F%    CC) /'+#5!1"3D    -==k?[ "-"9"9_c"9"d  ' ' < < 44?4KK .._TX.YY 4  $4   - . . F F+)!1!G!  $G M$3#"/'9%5&7$/$?$?$N$N$gWgSg % !1 %GG" !  7)7)S)S% , 0 0 9-'+#5!1"3*T * $ G[ #??2<^S2Q,,.W[ !0+#5!1"3*::II !K >LL#)M  ? ?e ? L'44?Z^4_ !,,!#-#'1-/-      " $@J!;!;v55#+#'1 6    ?/ %>>' , 0 0 9'0;0K0K0k0k*::II+#5!1"3-?    &$~PP'- Q  CC%CP _ %BB'+#5!1"3*::IIC  &'^";  A A' B "88-'9 $ #  )klqkrrtu..##/   )))--neD * !%[%j[5J5JN^NjNj5j k#)#2=2IkNdNd ..jt#"!#+2&  y%WH ,1q   \! M'CCGL M $.4 &  86 s6AZ"YZ"0Y1A1Z""Y#BZ">Y?BZ"Y&Z":Y;B'Z"#-Y#Y Y#"Z"7Z 8;Z"3Z4A*Z"ZA,Z" Z 7Z"ZA#Z"'Z(A.Z"ZA-Z"Z B Z"Z"Z"Z"Z"Z" Y##!ZZ"ZZ"Z"Z"Z"Z"Z"Z" Z")rrrrrrr Literal[True])rrrrrrrr) rzlist[ScopeMapping]rrrrrrrrW)r rbr rrrrrrrrrrrWr#)r rbrrrrrrrrrrr rr rrzJWTAuthBuilderResult | None)r rbr rrdrcrer+r  Span | Noner!r.r+tuple[str | None, LiteLLM_TeamTable | None])r rbr rrset[str]r)rLiteLLM_TeamTable | NonerrrCrrr)rrrrW)rrrrrrr rbrdrcrer+r rr!r.rCrrr)r rbr rrz*tuple[str | None, str | None, bool | None])rrrLiteLLM_UserTable | Nonerr)rrr rrrrrrrrrr rbrdrcrer+r rr!r.rrrrrztuple[LiteLLM_UserTable | None, LiteLLM_OrganizationTable | None, LiteLLM_EndUserTable | None, LiteLLM_TeamMembership | None, str | None]) rrrrr rrrrr)F)rlrrmrrRrrr)rrrr) r rbr rrrrdrcrezUserApiKeyCache | NonerrW)rrrrrlrr rbrdrcrer+r rr!r.rrW)rrrrrdrcrer+r rr!r.r"rrtuple)rrrrrrrrr rbrQrr"rrdrcrer+r rr!r.rCrrzJtuple[str | None, LiteLLM_TeamTable | None, LiteLLM_TeamMembership | None])rrrCrr rbrr)rrrr )rrrrrrW)rrr rbrrrrrrrdrcrer+r rr!r.rlrrCrrr)r@rArBrCrrrrr rr5r9rErIrVrYr\rdrgrqryrrrrrrrrrDrErFrrsgA  4  (*   :    %  4(,!%& & & &  &  &  & %& &  %& & P^/^/^/+^/, ^/ & ^/ ( ^/ 5^/^/@&* -  #     &  &*SS#SS S + S , S&S(S#S 5SSj 5 5 5 4 5 5  -    !%        &    + , & (      B        &+)$)")#)  ))V0-0-00d 6: FFF.F+ F 3 F  FFP)2*)2)2%)2 )2 + )2 , )2&)2()2 )2)2V4$-4$4$+4$, 4$ & 4$ ( 4$$4$ 4$4$l&*c -c c $c  c  c *. c c +c ,c &c (c #c  Tc c J  "       &     E E- E  E E(,%)} } } }  }  } + } ,} &} (} %} #}  } } rEr)r_rHrr$)crC __future__rr2rrrr,rWcollections.abcrrtypingrrrr r r r/r cryptographyr cryptography.hazmat.backendsr cryptography.hazmat.primitivesrfastapirr jwt.api_jwkrlitellm._loggingr0litellm.litellm_core_utils.dot_notation_indexingr'litellm.llms.custom_httpx.httpx_handlerrlitellm.proxy._typesrrrrrrrrrrrr r!r"r#r$r%r&r'r(litellm.proxy.auth.auth_checksr)litellm.proxy.auth.route_checksr*-litellm.proxy.common_utils.user_api_key_cacher+r,litellm.proxy.utilsr-r.$litellm.repositories.user_repositoryr/ auth_checksr1r2r3r4r5r6r7r8r9r:r;r<rr>rHrJrrKrMrOrQrSrrTr`rbrrDrErFrs# /?? 88)1M?,A7;?     U)Uy9yU*. %.*, %, 00+F!5F&AeA{S/@A  V(V(r"~ ~ rE