tPjbUddlZddlmZddlmZddlmZmZmZddl m Z ddl m Z m Z mZmZmZmZddlmZed d d d d ddddddddddde j*j,e j.j,e j0j,e j2j,e j4j,e j6j,e j8j,e j:j,e j<j,gZee d<dZ!ee d<edZ"ee d<GddZ#y) N)Sequence)Final) HTTPExceptionRequeststatus)verbose_proxy_logger)CommonProxyErrorsKeyManagementRoutesLiteLLM_UserTable LiteLLMRoutesLitellmUserRolesUserAPIKeyAuth)_user_is_org_admin /user/new /user/delete/user/bulk_update /team/new /team/update /team/deletez /team/blockz /team/unblockz/team/permissions_updatez/team/permissions_bulk_update /model/new /model/update /model/deletez/jwt/key/mapping/newz/jwt/key/mapping/updatez/jwt/key/mapping/delete%_PROXY_ADMIN_VIEW_ONLY_BLOCKED_ROUTES) /regeneratez /reset_spend+_PROXY_ADMIN_VIEW_ONLY_BLOCKED_KEY_SUFFIXES) openai_routesllm_api_routes(_AUTH_ENFORCED_PASS_THROUGH_ROUTE_GROUPSc <eZdZe d)dedededzfdZe d)dedededzdefdZ ededefd Z ed e dzdeddfd Z ed e dzd e dzdededed ef dZedefdZededefdZedededzdefdZededefdZededefdZededefdZedededefdZededefdZedededefdZedededefdZededeedefdZededzdedzfdZed)dededzdefdZededefd Zedededdfd!Z eded"edefd#Z!ededefd$Z"ededefd%Z#e$hd&Z%e$gd'Z&e d)ded ed ededzddf d(Z'y)* RouteChecksNroute valid_tokenrequestc ddlm}|j|t j |||y#t$r}|d}~wt$rY2wxYw)zK Check if management route is disabled and raise exception r)EnterpriseRouteChecksr"N)r"r#r$T)*litellm_enterprise.proxy.auth.route_checksr&should_call_router Exceptionr!$is_virtual_key_allowed_to_call_route)r"r#r$r&es d/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/auth/route_checks.pyr)zRouteChecks.should_call_routeCsY  X ! 3 3% 3 @ 88uR]gn8o G   s3 A > A  A returnc|jyt|jtsyt|jdk(ryd}|jD]}tj ||syt d|jDrZ|jD]J}|tjvstj|tj|jrQ|tvrGtj|tj|rtj|| ryd}ny|d k(sdd lm}|j%| rItj|tj|rtj|| ryd}nytj'|| rytj|tj(jsKy|jD]}tj+||sy|rtj-| t/t0j2d|jd|)zR Raises Exception if Virtual Key is not allowed to call the route TrFr" allowed_routec3@K|]}|tjvywN)r _member_names_).0r1s r- zCRouteChecks.is_virtual_key_allowed_to_call_route..ssm} < <<msr"allowed_routesr$r"methodr"user_api_key_dictrInitPassThroughEndpointHelpersr')r"r$r"patternzLVirtual key is not allowed to call this route. Only allowed to call routes: z. Tried to call route:  status_codedetail)r8 isinstancelistlenr!_route_matches_allowed_routeanyr r4check_route_access _member_map_valuer#is_auth_enforced_pass_through_route_get_request_methodcheck_passthrough_route_access;litellm.proxy.pass_through_endpoints.pass_through_endpointsr? is_registered_pass_through_route"_is_get_mcp_server_discovery_routeagent_management_routesroute_matches_wildcard_pattern#_auth_pass_through_denied_exceptionrrHTTP_403_FORBIDDEN)r"r#r$'denied_auth_enforced_pass_through_router1r?s r-r+z0RouteChecks.is_virtual_key_allowed_to_call_routeYso  % % -+44d; {)) *a /27/)77 M77eS`7a  mR]RlRlm m!,!;!;@ (  M$@$@@"55#'4'A'A-'P'V'V6 *-UU + O O&+'2'F'Fw'F'W!P! +IIPUitIu'+FJC#' %(88:ZZafZg*NN&+'2'F'Fw'F'W O $/#M#M*/;$N$",0JN G'+'IIPU_fIg#''99"'+8+P+P+V+V:$(A@ (F)77 M99}9]  3AAAN N11abmb|b|a}~UV[U\]  user_idchddlm}|rt|dkry|ddd}|j|S) z Mask user_id to prevent leaking sensitive information in error messages Args: user_id (str): The user_id to mask Returns: str: Masked user_id showing only first 2 and last 2 characters r)SensitiveDataMaskerz****)visible_prefixvisible_suffix mask_char)0litellm.litellm_core_utils.sensitive_data_maskerr[rG _mask_value)rYr[maskers r- _mask_user_idzRouteChecks._mask_user_ids; Y#g,!+,1QZ]^!!'**rXuser_objcd}d}| |jxsd}|jxsd}tj|}t d|d|d|)a' Raise exception for routes that require proxy admin access Args: user_obj (Optional[LiteLLM_UserTable]): The user object route (str): The route being accessed Raises: Exception: With user role and masked user_id information unknownz^Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route=z . Your role=z. Your user_id=) user_rolerYr!rfr*)rgr"rjrYmasked_user_ids r-!_raise_admin_only_route_exceptionz-RouteChecks._raise_admin_only_route_exceptions    **7iI&&3)G + 9 9' BlmrlssAJ@KKZ[iZj k  rX _user_role request_datactj|tj|tj|rtj ||ytj |rytj |r|dk(ry|dk(r|j}|jd}tjd||j|rl||jk7r\|tjjk7r>tt j"d |d |j |d k(ry|d k(ry|dk(ryyyyy|t$j&jvrt)|dddt)|dgvry|tjjk(rtj+||||y|tj,jk(r/tj/|t$j0jst3||r/tj/|t$j4js{|tj6jk(r/tj/|t$j8js/tj/|t$j:jry|j=ds|j=drytj?||ry|j@dd}|j@D]8} tjC|| rd}ntjE|| s6d}n|stjG||yytjG||y)zO Checks if Non Proxy Admin User is allowed to access the route r'r9r:r"r#z /key/infoz /user/inforYz%user_id: %s & valid_token.user_id: %sz4key not allowed to access this user's info. user_id=z, key's user_id=rBz /v2/user/infoz /model/infoz /team/info permissionsNget_spend_routes)r"rmrnr$r7)rn user_objectz/v1/mcp/z /mcp-rest/r<Fr0Tr@)rgr")$r!custom_admin_only_route_checkrMrN!_require_auth_pass_through_accessis_llm_api_route is_info_route query_paramsgetrdebugrYr PROXY_ADMIN_VIEW_ONLYrLrrrVr global_spend_tracking_routesgetattr _check_proxy_admin_viewer_access INTERNAL_USERrJinternal_user_routesrorg_admin_allowed_routesINTERNAL_USER_VIEW_ONLYinternal_user_view_only_routesself_managed_routes startswithrOr8rHrTrl) rgrmr"r$r#rnrxrY route_allowedr1s r-$non_proxy_admin_allowed_routes_checkz0RouteChecks.non_proxy_admin_allowed_routes_checksV 11 2   : :2272C ;   9 9S^ 9 _  ) ) ) 6   & &U & 3 #,&&-&:&: !-!1!1)!<$**+RT[]h]p]pq;#6#66"&6&L&L&R&RR'$*$=$=!UV]U^^nozpCpCoD E/)-',&'S7" ]??EE E ]D9E"gk="&MM  +AAGG G  8 8%) 9  *88>> >..U=KmKmKsKs.t!|R..U=KqKqKwKw.x-EEKKK..,KKQQ/--E-JkJkJqJq-r    j )U-=-=l-K   7 7eWb 7 c   ' ' 3!M!,!;!;  ;;%Wd;e$(M==ES`=a$(M !==xW\=]!  9 98SX 9 YrXcddlm}m}d|vrZ|dur/tjdt j jy||dvrttjd|dyy) Nr)general_settings premium_useradmin_only_routesTzHTrying to use 'admin_only_routes' this is an Enterprise only feature. %sz-user not allowed to access this route. Route=z is an admin only routerB) litellm.proxy.proxy_serverrrrerrorr not_premium_userrLrrrV)r"rrs r-rtz)RouteChecks.custom_admin_only_route_checkUswM "2 24'$**^%66<<()<==# & 9 9J5'Qhi> 3rXc<t|tsy|tjjvry|tj jvry|tj jvrytj|tjjrytj|tjjry|tjjvrytjjD]O}d|vrtj||rytj|s7tj||sOytj jD] }d|vstj||s ytj jD] }d|vstj||s ytj|rytj jD]}||k(s|j#|dzsyy) z Helper to checks if provided route is an OpenAI route Returns: - True: if route is an OpenAI route - False: if route is not an OpenAI route FTr7{r@rAr'/)rEstrr rrLanthropic_routes google_routesr!rJmcp_inference_routesagent_inference_routeslitellm_native_routes_route_matches_pattern_is_wildcard_patternrT_is_azure_openai_routemapped_pass_through_routesr)r" openai_route google_routeanthropic_route_llm_passthrough_routes r-rvzRouteChecks.is_llm_api_routefs%% M//55 5 M2288 8 M//55 5  ) )mFhFhFnFn ) o  ) )mFjFjFpFp ) q M77== =*77== Ll"55E<5X// /E==ES_=` *77== Ll"55E<5X -==CC Oo%55E?5[  - -E - :&3&N&N&T&T  "..%2B2BCY\_C_2` rXc||jjdk7ry|dk(ryd}|j|sy|t|d}t |xrd|vS)a Returns True if `request` is a GET against one of the two read-only MCP-server discovery paths: - GET `/v1/mcp/server` (list) - GET `/v1/mcp/server/{server_id}` (single server, single segment) Multi-segment paths (`/v1/mcp/server/{id}/approve`, etc.) and any non-GET method return False, so admin-only management writes on the same path prefix are not reachable through this carve-out. NGETFz/v1/mcp/serverTz/v1/mcp/server/r)r;upperrrGbool)r"r$prefix remainders r-rRz.RouteChecks._is_get_mcp_server_discovery_routesf ?gnn224= $ $)' V/ I73i#77rXc`tj|tjjS)z6 Check if route is a management route r7)r!rJr management_routesrLr's r-is_management_routezRouteChecks.is_management_routes& --E-JiJiJoJo-pprXc:|tjjvS)z1 Check if route is an info route )r info_routesrLr's r-rwzRouteChecks.is_info_routes  117777rXct|tsyd}d}tj||stj||ryy)z Check if route is a route from AzureOpenAI SDK client eg. route='/openai/deployments/vertex_ai/gemini-1.5-flash/chat/completions' Fz2^/openai/deployments/[^/]+/[^/]+/chat/completions$z!^/engines/[^/]+/chat/completions$T)rErrematch)r"deployment_patternengine_patterns r-rz"RouteChecks._is_azure_openai_routes>%%$Y D 88& ."((>52QrXrAct|tsydtjdtfd}tjd||}d|d}tj ||ryy) a Check if route matches the pattern placed in proxy/_types.py Example: - pattern: "/threads/{thread_id}" - route: "/threads/thread_49EIN5QF32s4mH20M7GFKdlZ" - returns: True - pattern: "/key/{token_id}/regenerate" - route: "/key/regenerate/82akk800000000jjsk" - returns: False, pattern is "/key/{token_id}/regenerate" Frr.ch|jdjd}|jdryy)Nrz{}z:pathz[^:]+z[^/]+)groupstripendswith)r placeholders r-_placeholder_to_regexzARouteChecks._route_matches_pattern.._placeholder_to_regexs.!&Q!5!5d!;K##G,rXz \{[^}]+\}^$T)rErrMatchsubr)r"rArs r-rz"RouteChecks._route_matches_patterns^ %%  c &&' True (exact match) - allowed_route="/fake-openai-proxy-6", route="/fake-openai-proxy-6/v1/chat/completions" -> True (prefix match) - allowed_route="/fake-openai-proxy-6", route="/fake-openai-proxy-600" -> False (not a valid prefix) Args: route: The actual route being accessed allowed_route: The allowed route pattern Returns: bool: True if route matches (exact or prefix), False otherwise TrF)rr0s r-rHz(RouteChecks._route_matches_allowed_route$s(& M !   MC/ 0rXr8cd|vrytfd|Drytfd|Dryy)a! Check if a route has access by checking both exact matches and patterns Args: route (str): The route to check allowed_routes (Sequence): Allowed routes/patterns Returns: bool: True if route is allowed, False otherwise Tc3xK|]1}tj|rtj|3yw)rr@N)r!rrTr5r1r"s r-r6z1RouteChecks.check_route_access..Ts: // /F  6 6UM 6 Z s7:c3LK|]}tj|yw)r@N)r!rrs r-r6z1RouteChecks.check_route_access..as& WdK . .UM . R s!$F)rIr7s` r-rJzRouteChecks.check_route_access>sK N "  !/    hv  rXc|y |j}t|tsy|j S#ttf$rYywxYwr3)r;AttributeErrorKeyErrorrErr)r$r;s r-rNzRouteChecks._get_request_methodhsL ? #NNF&#&||~ )  s 2AAr;c`ddlm}|j||}|y|jdduS)a2 True for config/DB pass-through endpoints registered with auth=true. These routes are injected into ``openai_routes`` for spend/budget hooks but must not inherit blanket ``openai_routes`` RBAC; access is gated by ``allowed_passthrough_routes`` on the key or team. rr>r:FauthT)rPr?!get_registered_pass_through_routery)r"r;r? route_infos r-rMz/RouteChecks.is_auth_enforced_pass_through_routevs= ;\\chqw\x  ~~f%--rXc@ttjd|dS)Nz1Key/team not allowed to access passthrough route z<. Configure `allowed_passthrough_routes` on the team or key.rB)rrrVr's r-rUz/RouteChecks._auth_pass_through_denied_exceptions,11CE7KMM  rXc^tj||rytj|)zf Require an explicit ``allowed_passthrough_routes`` match for auth=true pass-through. r<Nr')r!rOrUrps r-ruz-RouteChecks._require_auth_pass_through_accesss/  5 5EU` 5 a ==E=JJrXr=c.|j}|jxsi}||yd|vrd|vry|jd|jdy|jdxs|jdxsg}|D]}tj ||syy)zl Check if route is a passthrough route. Supports both exact match and prefix match. Fallowed_passthrough_routesr0T)metadata team_metadataryr!rH)r"r=rrrr1s r-rOz*RouteChecks.check_passthrough_route_accesss ,440>>D"   5 'x 7!!">?G LL5 6 o-:K:KLh:i omo # 8 M77eS`7a rXc2ddlm}||}d|vsd|vryy)z Returns True if `thread` or `assistant` is in the request path Args: request (Request): The request object Returns: bool: True if `thread` or `assistant` is in the request path, False otherwise r)get_request_routethread assistantTF) auth_utilsr)r$rr"s r-_is_assistants_api_requestz&RouteChecks._is_assistants_api_requests& 2(1 u  u 4rXcd|vryd|vryy)z Returns True if this is a google generateContent or streamGenerateContent route These routes from google allow passing key=api_key in the query params generateContentTstreamGenerateContentFr's r-is_generate_content_routez%RouteChecks.is_generate_content_routes  % "e +rX>rHEADOPTIONS)rrrrrrrrrz /key/generatez /key/deletez /key/updatez/key/regeneratez/key/service-account/generatez /key/blockz /key/unblockz/team/key/bulk_updatec tj|rttjd|tj |t jjr|dk(rS|t|tr|j}|D]+}|dvsttjd|d |d |d nO|tvs&|jd r6|jtr!ttjd|d |||j j#nd }|tj$v}|ry|dk(rC|@t|tr0|D]+}|dvsttjd|d |d |d y|tj&vs"|jd r2|jdr!ttjd|d |tj |t j(jrytj |t j*jryttjd|d |)uk Check access for PROXY_ADMIN_VIEW_ONLY role. Admin Viewer follows a read-parity-with-Proxy-Admin rule: anything Proxy Admin can read/list/get, Admin Viewer can read/list/get. The only exclusions are cost-incurring inference routes (Playground, /chat/ completions, etc.) and any state-mutating request. Implementation: 1. LLM/inference routes → 403 (cost-incurring). 2. Safe HTTP method (GET/HEAD/OPTIONS) → allow by default. This is the read-parity guarantee — every new GET endpoint added anywhere in the codebase is automatically readable by Admin Viewer without needing to remember to add it to an allowlist. 3. Unsafe HTTP method (POST/PUT/PATCH/DELETE): - Allow `/user/update` only when restricted to user_email/password. - Block all explicit writes in `_ADMIN_VIEWER_BLOCKED_WRITE_ROUTES`. - Otherwise allow only if the route is in admin_viewer_routes / global_spend_tracking_routes (legacy explicit-allow set). - Else 403. r'z5user not allowed to access this OpenAI routes, role= rBr7z /user/updateN) user_emailpasswordz-user not allowed to access this route, role= z. Trying to access: z and updating invalid param: z-. only user_email and password can be updatedz/key/rr)r!rvrrrVrJr rrLrEdictkeysrrrrr;r_SAFE_HTTP_METHODS"_ADMIN_VIEWER_BLOCKED_WRITE_ROUTESadmin_viewer_routesr|)r"rmrnr$_params_updatedparamr;is_safe_methods r-r~z,RouteChecks._check_proxy_admin_viewer_accesss8  ' 'e ' 4"55Nzl[   ) )mFeFeFkFk ) l&+ <0N-9->->-@O!0 (BB"/,2,E,E)VWaVbbvw|v}~[\a[bbO(P# ??  )enn=h.i$ & 9 9J:,Vjkpjqr 3:2E,,.5 &+*H*H H   N "'J|T,J) E$>>+(.(A(A"OPZ|\55:G;XY^X_`N!N   KBB B   W %%..*G"55FzlRfglfmn   ) )mFgFgFmFm ) n   ) )mFpFpFvFv ) w 11B:,Nbchbij  rXr3)(__name__ __module__ __qualname__ staticmethodrrrr)rr+rfr rlr rrrtrvrRrrwrrrrTrHrrJrNrMrrUrurOrr frozensetrrr~rrXr-r!r!Bsj#'#4*#'g g #g 4g   g g R+s+s++( #d*     2`Z#d*`Z$t+`Z`Z `Z $ `Z  `Z`ZDS >>>>@8#8$8SW88,q3q4qq 8S8T88 cd$cCD@%c%d%% $c$C$D$$8C2'#'x}'''R Wt^ d  .3.d .VZ.." 3 =   K K# K  K KcnY]8G$     ##=>*3 *&, #' k k k k 4 k  k k rXr!)$rcollections.abcrtypingrfastapirrrlitellm._loggingrlitellm.proxy._typesr r r r r rauth_checks_organizationrr KEY_GENERATErL KEY_UPDATE KEY_DELETEKEY_REGENERATEKEY_GENERATE_SERVICE_ACCOUNT KEY_BLOCK KEY_UNBLOCKKEY_BULK_UPDATETEAM_KEY_BULK_UPDATEr__annotations__rrr!rrXr-rs$ $2219 09 "'!!((..&&,,&&,,**0088>>%%++''--++110066=!0%u!L6U+UT2;<_2`(%`g  g  rX