Ë
    tPêjñK ã                   ó–  — U d Z ddlZddlZddlZddlZddlmZ ddlmZmZ ddl	m
Z
mZmZmZmZmZ ddlZddlZddlmZmZmZmZ ddlmZ ddlZddlmZmZ dd	lmZ dd
lmZm Z m!Z! ddl"m#Z# ddl$m%Z%m&Z& ddl'm(Z( ddl)m*Z* ddl+­ ddl,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZB ddlCmDZD ddlEmFZF ddlGmHZHmIZImJZJmKZKmLZLmMZMmNZNmOZOmPZP ddlQmRZRmSZS ddlTmUZUmVZV ddlWmXZX ddlYmZZZ ddl[m\Z\m]Z] ddl^m_Z_ ddl`maZa ddlbmcZc ddldmeZe ddlfmgZgmhZhmiZimjZjmkZk ddllmmZm ddlnmoZompZp dd lqmrZr dd!lsmtZt dd"lumvZvmwZwmxZx dd#lymzZz dd$l{m|Z| dd%l}m~Z~ 	 dd&lm€Z� e�Z€e‚dz  eƒd'<    e«       Z‡eeƒd)<   d*eˆd+eˆfd,„Z‰d*eˆd-eŠdz  d+e‹fd.„ZŒ ee��j                  �j                  d/d0¬1«      Z�eeƒd2<    ee��j"                  �j                  d/d0¬1«      Z’eeƒd3<    ee��j&                  �j                  d/d4¬1«      Z”eeƒd5<    ee��j*                  �j                  d/d6¬1«      Z–eeƒd7<    ee��j.                  �j                  d/d8¬1«      Z˜eeƒd9<    ee��j2                  �j                  d/d:¬1«      Zšeeƒd;<   	 d«d<eŠd*eˆd=edz  d>e
dz  d+eˆe›eˆ   z  dz  f
d?„Zœd@eˆe›eˆ   z  dz  d+e›eˆ   fdA„Z� G dB„ dCe«      Zž G dD„ dEe«      ZŸ G dF„ dGe«      Z dHe d+e›eˆ   fdI„Z¡dJeˆdz  dKevdz  dLeodMe¢dz  dNewd+eeˆe£f   dz  fdO„Z¤dHe¥dPeŸdQe›eˆ   d+dfdR„Z¦	 	 d¬dHe¥dPeždSeˆd<eŠd=edTe›dz  d>e�jN                  dz  d+dfdU„Z¨dVeˆd+eˆfdW„Z©d/dXœdYe
dz  dZe
dz  d[e‹d+e‹fd\„Zªd]eŠd^d_d+e‹fd`„Z«daeˆdbeSd+e‹fdc„Z¬dVeˆfdd„Z­deeŠdfe®dgeˆdz  d+dfdh„Z¯diefdj„Z°dHe¥deeŠd+e¥fdk„Z± eedl¬m«      Z²eeƒdn<   doeˆdLeodKevd+e³dz  fdp„Z´dqeˆdLeodKevdz  daeˆdNewd+e³dz  fdr„ZµdbeSdse›eˆ   d+eˆfdt„Z¶d2eˆdz  dVeˆd5eˆdz  d7eˆdz  d9eˆdz  d;eˆdz  due›eŠ   dz  d*eˆd=ed+e·eˆeˆdz  f   fdv„Z¸d=ed*eˆdue›eŠ   dz  dVeˆd+e¥eˆz  f
dw„Z¹dxZºeeƒdy<   dzZ» G d{„ d|e«      Z¼	 	 	 	 d­d}eˆdZeˆdbeSdKevdLeodMe¢dz  dNewdoeˆd~eˆdz  dJeˆdz  deˆdz  dgeˆdz  d+e¥dz  fd€„Z½d�eŠdbeSdKevdz  dLeodMe¢dz  dNewd+ee¥dz  d|f   fd‚„Z¾d=ed+efdƒ„Z¿d=ed+dfd„„ZÀd=ed+e·eŠeÁdz  f   fd…„ZÂd†e¥d‡eÁd*eˆd+dfdˆ„ZÃd‰eˆdz  dKevdz  dLeodMe¢dz  dNewd+eÄdz  fdŠ„ZÅ	 d«d=edVeˆd5eˆd7eˆdz  d9eˆdz  d;eˆdz  d<eŠd2eˆdz  d+e¥fd‹„ZÆdŒeˆfd�„ZÇdHe¥d+eÈfdŽ„ZÉdHe¥d�eÊd+e‹fd�„ZË e(�j˜                  «       d‘e¥d=ed<eŠd*eˆd+df
d’„«       ZÍd®d“„ZÎ	 	 d¬d‘e¥d<eŠd*eˆd>e
dz  d”eÈdz  d•eÏdz  dKevdz  dLeodNewd–e‹d-eŠdgeˆdz  d—eÐdz  d+dfd˜„ZÑd<eŠd*eˆd=edz  d>e
dz  d+e‹f
d™„ZÒd=edHe¥d+e]fdš„ZÓd‘e¥d=ed<eŠd*eˆdVeˆd+e¥dz  fd›„ZÔ e(�j˜                  «        e�jª                  e’«       e�jª                  e”«       e�jª                  e–«       e�jª                  e˜«       e�jª                  eš«       e�jª                  e�«      fd=edVeˆd5eˆd7eˆdz  d9eˆdz  d;eˆdz  d2eˆdz  d+e¥fdœ„«       ZÖ	 d«d�eÏdz  dVeˆdMe¢dz  džeŠd*eˆdŸed e×dz  d+e¥fd¡„ZØd=ed¢eˆd+eˆfd£„ZÙdHe¥fd¤„ZÚdHe¥d+e¥fd¥„ZÛdHe¥d*eˆdMe¢dz  fd¦„ZÜdHe¥d<eŠd*eˆd=edz  dTe›dz  d>e
dz  d+dfd§„ZÝd¨e£d+eˆdz  fd©„ZÞdHe¥d=ed<eŠd*eˆdMe¢dz  d+e¥fdª„Zßy# e„$ r!Z… e�j                  d(e…«       dZ€Y dZ…[…�ŒYdZ…[…ww xY w)¯z¶
This file handles authentication for the LiteLLM Proxy.

it checks if the user passed a valid API Key to the LiteLLM Proxy

Returns a UserAPIKeyAuth object if the API key is valid

é    N)ÚMapping)ÚdatetimeÚtimezone)ÚAnyÚFinalÚ
NamedTupleÚProtocolÚUnionÚcast)ÚHTTPExceptionÚRequestÚ	WebSocketÚstatus)ÚAPIKeyHeader)Úverbose_loggerÚverbose_proxy_logger)ÚServiceLogging)ÚGLOBAL_PROXY_SPEND_CACHE_KEYÚLITELLM_PROXY_BUDGET_NAMEÚLITELLM_PROXY_MASTER_KEY_ALIAS)Úis_otel_v2_enabled)Ú
phase_spanÚseed_request_identity)Útracer)Úget_nested_value)Ú*)ÚExperimentalUIJWTTokenÚTeamNotFoundErrorÚ_cache_key_objectÚ_can_object_call_modelÚ_check_end_user_budgetÚ_delete_cache_key_objectÚ_get_user_roleÚ_is_model_cost_zeroÚ_is_user_proxy_adminÚ#_virtual_key_max_budget_alert_checkÚ_virtual_key_max_budget_checkÚ_virtual_key_soft_budget_checkÚcan_key_call_modelÚcommon_checksÚget_end_user_objectÚget_jwt_key_mapping_objectÚget_object_permissionÚget_project_objectÚget_team_objectÚget_user_objectÚis_valid_fallback_modelÚ resolve_and_validate_end_user_id)ÚUserAPIKeyAuthExceptionHandler)Ú
AuthMethod)	Úabbreviate_api_keyÚ!get_end_user_id_from_request_bodyÚget_model_from_requestÚget_request_routeÚget_request_route_templateÚiter_request_fallback_targetsÚnormalize_request_routeÚpre_db_read_auth_checksÚ route_in_additonal_public_routes)ÚJWTAuthManagerÚ
JWTHandler)ÚTrustedProxyConfigÚresolve_network_context)ÚOauth2Handler)Úhandle_oauth2_proxy_request)ÚCredentialRefÚ	Principal)ÚIdentityStore©ÚRouteChecks)Úget_trusted_proxy_cidrs)ÚEventDrivenCacheCoordinator)Ú_read_request_bodyÚ_safe_get_request_headersÚ_safe_get_request_query_paramsÚ_safe_set_request_parsed_bodyÚ!populate_request_with_path_params©Ú_realtime_request_body)ÚUserApiKeyCacheÚteam_membership_auth_cache_key)ÚPrismaDBExceptionHandler)ÚLiteLLMProxyRequestSetup)ÚPrismaClientÚProxyLoggingÚnormalize_route_for_root_path)ÚTeamMembershipRepository)Úget_secret_bool)ÚServiceTypes)Úenterprise_custom_authr\   z#Error in enterprise custom auth: %sÚuser_api_key_service_logger_objÚrouteÚreturnc                 óT   — | dk7  r"| j                  d«      r| j                  d«      S | S )Nú/)ÚendswithÚrstrip©r^   s    úi/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/auth/user_api_key_auth.pyÚ_normalize_public_auth_routerf   v   s(   € Ø�‚|˜Ÿ™ sÔ+Ø�|‰|˜CÓ Ð Ø€Ló    Úgeneral_settingsc                 óH   — t        | «      }|dk(  rt        j                  duS y)Nz/metricsF)rf   ÚlitellmÚ!require_auth_for_metrics_endpoint)r^   rh   Únormalized_routes      re   Ú#_route_requires_auth_despite_publicrm   |   s)   € Ü:¸5ÓAÐØ˜:Ò%Ü×8Ñ8ÀÐEÐEàrg   FzBearer token)ÚnameÚ
auto_errorÚdescriptionÚcustom_litellm_key_headerÚapi_key_headerzcSome older versions of the openai Python package will send an API-Key header with just the API key Úazure_api_key_headerzIf anthropic client used.Úanthropic_api_key_headerz If google ai studio client used.Úgoogle_ai_studio_api_key_headerz8The default name of the subscription key header of AzureÚazure_apim_headerÚrequest_dataÚrequestÚ
llm_routerc                 óL   — t        | |t        |¬«      t        |¬«      ||¬«      S )N©rx   )rw   r^   Úrequest_headersÚrequest_query_paramsry   rx   )r7   rL   rM   ©rw   r^   rx   ry   s       re   Ú_get_model_from_request_contextr   ¤   s-   € ô "Ø!ØÜ1¸'ÔBÜ;ÀGÔLØØôð rg   Úmodelc                 ó4   — | €g S t        | t        «      r| gS | S ©N)Ú
isinstanceÚstr©r€   s    re   Ú"_get_model_names_for_budget_checksr†   ´   s$   € ð €}Øˆ	Ü�%œÔØˆwˆØ€Lrg   c                   ó:   — e Zd Zdededefd„Zdedededz  fd„Zy)Ú_KeyModelBudgetLimiterÚuser_api_key_dictr€   r_   c              ƒ   ó   K  — y ­wr‚   © ©Úselfr‰   r€   s      re   Úis_key_within_model_budgetz1_KeyModelBudgetLimiter.is_key_within_model_budget¿   ó   è ø� ùó   ‚Nc              ƒ   ó   K  — y ­wr‚   r‹   rŒ   s      re   Ú get_fallback_model_within_budgetz7_KeyModelBudgetLimiter.get_fallback_model_within_budgetÁ   r�   r�   )Ú__name__Ú
__module__Ú__qualname__ÚUserAPIKeyAuthr„   ÚboolrŽ   r’   r‹   rg   re   rˆ   rˆ   ¾   s0   „ ØjÀ.ÐjÐY\ÐjÐaeÓjàvÈÐvÐ_bÐvÐgjÐmqÑgqÔvrg   rˆ   c                   ó.   — e Zd Zdedeeef   dedefd„Zy)Ú_UserModelBudgetLimiterÚuser_idÚuser_model_max_budgetr€   r_   c              ƒ   ó   K  — y ­wr‚   r‹   )r�   rš   r›   r€   s       re   Úis_user_within_model_budgetz3_UserModelBudgetLimiter.is_user_within_model_budgetÅ   s	   è ø€ àùr�   N)r“   r”   r•   r„   r   Úobjectr—   r�   r‹   rg   re   r™   r™   Ä   s0   „ ðØðØ3:¸3À¸;Ñ3GðØPSðà	ôrg   r™   c                   ó(   — e Zd Zedee   fd„«       Zy)Ú_TokenTeamModelsr_   c                  ó   — y r‚   r‹   )r�   s    re   Úteam_modelsz_TokenTeamModels.team_modelsË   s   € Ø(+rg   N)r“   r”   r•   ÚpropertyÚlistr„   r¢   r‹   rg   re   r    r    Ê   s   „ ØØ+˜T #™YÒ+ó Ù+rg   r    Úvalid_tokenc                 ó   — | j                   S r‚   )r¢   )r¥   s    re   Ú_token_team_modelsr§   Ï   s   € Ø×"Ñ"Ð"rg   rš   Úprisma_clientÚuser_api_key_cacheÚparent_otel_spanÚproxy_logging_objc              ƒ   óÄ   K  — | �|€y	 t        | ||d||¬«      ƒ d{  –—† }|�|j                  S dS 7 Œ# t        $ r }t        j                  d|«       Y d}~yd}~ww xY w­w)zåThe user row's `model_max_budget`, or None when the row cannot be read.

    A user whose row is missing must not be refused: this is a budget lookup,
    and the main auth path likewise treats an unreadable user as no user.
    NF©rš   r¨   r©   Úuser_id_upsertrª   r«   z6Unable to read user for the per-model budget check: %s)r0   Ú	Exceptionr   ÚdebugÚmodel_max_budget)rš   r¨   r©   rª   r«   Úuser_objÚes          re   Ú_read_user_model_max_budgetr´   Ó   s~   è ø€ ð €˜-Ð/ØðÜ /ØØ'Ø1Ø Ø-Ø/ô!
÷ 
ˆð )1Ð(<ˆ8×$Ñ$ÐFÀ$ÐFð
ùô ò Ü×ÑÐUÐWXÔYÜûðüs6   ‚A ‰4 �2ž4 ¢A ²4 ´	A½AÁA ÁAÁA Úmodel_max_budget_limiterÚmodelsc              ƒ   óÀ   K  — | j                   }| j                  �t        |t        «      r|sy|D ](  }|j	                  | j                  ||¬«      ƒ d{  –—†  Œ* y7 Œ­w)zâEnforce the internal user's own `model_max_budget` across the request's models.

    Separate from the key check: a user's per-model budget caps every key they
    own, so a caller cannot escape it by minting another key.
    N)rš   r›   r€   )r›   rš   rƒ   r   r�   )r¥   rµ   r¶   r›   Ú
model_names        re   Ú_check_user_model_budgetr¹   ð   sq   è ø€ ð $/×#DÑ#DÐØ×ÑÐ"¬*Ð5JÌGÔ*TÑ\qØØò 
ˆ
Ø&×BÑBØ×'Ñ'Ø"7Øð Có 
÷ 	
ñ 	
ñ
ð	
ús   ‚AAÁAÁAr¸   Úllm_model_listc           	   ƒ   ó   K  — 	 |j                  | |¬«      ƒ d{  –—†  y7 Œ# t        j                  $ �r}|j                  d«      |k7  r|‚|j	                  | |¬«      ƒ d{  –—†7  }|€|‚	 t        ||| |¬«      ƒ d{  –—†7   | j                  r/t        ||| j                  | j                  | j                  d¬«       n# t        $ r |‚w xY w||d<   t        ||¬«       ||_        t        j                  |«      |_        |j                   j                  d«      }	t#        |	t$        «      rd|	v r
||	d<   Y d}~yY d}~yY d}~yd}~ww xY w­w)	a„  
    Enforce the key's per-model budget for `model_name`. If exceeded and the
    key has a `budget_fallbacks` chain configured for `model_name`, reroute
    the request to the first fallback model still within its own budget
    instead of rejecting the request.

    The selected fallback is validated against the key's model-access
    allowlist and the team's model restrictions so that budget_fallbacks
    cannot bypass model authorization. The rewrite is persisted to the
    parsed-body cache, Starlette's JSON cache (``request._json``), and
    path parameters so that downstream handlers see the final model
    regardless of whether they consume ``_read_request_body()``,
    ``request.json()``, or the path ``model`` parameter.

    Fallback is only attempted when ``model_name`` matches the top-level
    ``request_data["model"]``; models extracted from nested fields
    (``session.model``, ``completion.model``, etc.) are not rewritable
    and raise immediately.

    Raises:
        BudgetExceededError: if `model_name` is over budget and no configured
            fallback is within budget either (or the fallback is not authorized).
    )r‰   r€   Nr€   ©r€   rº   r¥   ry   Úteam)r€   ry   r¶   Úteam_model_aliasesÚteam_idÚobject_type)rx   Úparsed_bodyÚpath_params)rŽ   rj   ÚBudgetExceededErrorÚgetr’   r)   r¢   r    r¾   r¿   ÚProxyExceptionrN   Ú_jsonÚorjsonÚdumpsÚ_bodyÚscoperƒ   Údict)
r¥   rµ   r¸   rw   rx   rº   ry   r³   Úfallback_modelrÂ   s
             re   Ú%_check_key_model_budget_with_fallbackrÍ     sf  è ø€ ð@&2Ø&×AÑAØ)Øð Bó 
÷ 	
ò 	
ùô ×&Ñ&ó !2Ø×Ñ˜GÓ$¨
Ò2ØˆGØ&>×&_Ñ&_Ø)Øð '`ó '
÷ !
ð !
ˆð Ð!ØˆGð	Ü$Ø$Ø-Ø'Ø%ô	÷ ñ ð ×&Ò&Ü&Ø(Ø)Ø&×2Ñ2Ø'2×'EÑ'EØ'×/Ñ/Ø &õùô ò 	ØˆGð	úà .ˆ�WÑÜ%¨gÀ<ÕPØ$ˆŒÜŸ™ \Ó2ˆŒØ$Ÿ]™]×.Ñ.¨}Ó=ˆÜ�k¤4Ô(¨W¸Ñ-CØ#1ˆK˜Ö ô .DÔ(ûðA!2üsh   ‚E„" š ›" ŸE " ¢E¶,EÁ"A%Á#	EÁ-CÁ?BÂ A CÃ EÃCÃA*EÄ7EÅEÅEÚapi_keyc                 ó®  — | j                  d«      r| j                  dd«      } | S | j                  d«      r| j                  dd«      } | S | j                  d«      r| j                  dd«      } | S | j                  d«      rTt        j                  d| «      }|r|j	                  d«      } | S t        j                  d| «      }|r|j	                  d«      } | S ©	NúBearer Ú úBasic zbearer zAWS4-HMAC-SHA256zCredential=Bearer\s+([^/\s,]+)é   zCredential=([^/\s,]+)©Ú
startswithÚreplaceÚreÚsearchÚgroup©rÎ   Úmatchs     re   Ú%_get_bearer_token_or_received_api_keyrÝ   N  sØ   € Ø×Ñ˜)Ô$Ø—/‘/ )¨RÓ0ˆð$ €Nð# 
×	Ñ	˜HÔ	%Ø—/‘/ (¨BÓ/ˆð  €Nð 
×	Ñ	˜IÔ	&Ø—/‘/ )¨RÓ0ˆð €Nð 
×	Ñ	Ð.Ô	/ô —	‘	Ð;¸WÓEˆÙØ—k‘k !“nˆGð €Nô	 —I‘IÐ6¸Ó@ˆEÙØŸ+™+ a›.�à€Nrg   ©Úsplit_space_delimitedÚselector_valueÚclaim_valuerß   c                ó  ‡‡‡— | €yt        | t        «      r| D �cg c]  }t        |«      ‘Œ c}nt        | «      g}|€yt        |t        «      r|D �cg c]  }t        |«      ‘Œ c}Šna‰rSt        |t        «      rCd|j                  «       v r1|j                  «       j	                  d«      D �cg c]  }|sŒ|‘Œ	 c}Šnt        |«      gŠdt        dt        dt
        fˆfd„Št        ˆˆfd„|D «       «      S c c}w c c}w c c}w )	NTFú ÚselectorÚclaimr_   c                 ót   •— d| v sd| v r+‰st        d„ |D «       «      ryt        j                  || «      S | |k(  S )Nr   ú?c              3   ó<   K  — | ]  }|j                  «       –— Œ y ­wr‚   )Úisspace)Ú.0Úchs     re   ú	<genexpr>zS_routing_selector_matches_claim.<locals>._selector_matches_claim.<locals>.<genexpr>†  s   è ø€ Ò0NÀ"°·±·Ñ0Nùs   ‚F)ÚanyÚfnmatchÚfnmatchcase)rä   rå   rß   s     €re   Ú_selector_matches_claimz@_routing_selector_matches_claim.<locals>._selector_matches_claim€  sC   ø€ à�(‰?˜c X™oñ )¬SÑ0NÈÔ0NÔ-NØÜ×&Ñ& u¨hÓ7Ð7Ø˜5Ñ Ð rg   c              3   ó@   •K  — | ]  }‰D ]  } ‰||¬ «      –— Œ Œ y­w))rä   rå   Nr‹   )rê   ÚsÚcrð   Ú
claim_lists      €€re   rì   z2_routing_selector_matches_claim.<locals>.<genexpr>‹  s+   øè ø€ ÒgÀÐ\fÒgÐWXÑ&°¸×;Ð;ÐgÐ;Ñgùs   ƒ)rƒ   r¤   r„   ÚstripÚsplitr—   rí   )rà   rá   rß   ÚvÚselector_listrð   rô   s     `  @@re   Ú_routing_selector_matches_claimrù   e  só   ú€ ð ÐØô -7°~ÄtÔ,L˜Ö(�AŒˆQ�Ó(ÔSVÐWeÓSfÐRgð ð ÐØä�+œtÔ$Ø&1Ö2 ”c˜!•fÒ2‰
Ù	¤:¨k¼3Ô#?ÀCÈ;×K\ÑK\ÓK^ÑD^ð
 "-×!2Ñ!2Ó!4×!:Ñ!:¸3Ó!?ÖE˜AÂ1’aÒE‰
ä˜+Ó&Ð'ˆ
ð	!¬#ð 	!´cð 	!¼dõ 	!ô ÔgÀ]ÔgÓgÐgùò9 	)ùò 3ùò Fs   ›C7ÁC<Â.DÂ6DÚtoken_claimsÚoverrideÚJWTRoutingOverridec                 ó:  — t        |j                  | j                  d«      «      xru t        |j                  | j                  d«      «      xrN t        |j                  | j                  d«      d¬«      xr% t        |j
                  | j                  d«      «      S )NÚissÚ	client_idrÊ   TrÞ   Úaud)rù   rþ   rÄ   rÿ   rÊ   r   ©rú   rû   s     re   Ú_matches_routing_overrider  Ž  s‰   € ä'¨¯©°l×6FÑ6FÀuÓ6MÓNò 	SÜ+¨H×,>Ñ,>À×@PÑ@PÐQ\Ó@]Ó^ò	Sä+Ø�N‰NØ×Ñ˜WÓ%Ø"&ô
ò	Sô ,¨H¯L©L¸,×:JÑ:JÈ5Ó:QÓRð	rg   ÚtokenÚjwt_handlerc                 óÖ   — |j                   j                  }|sy|j                  | ¬«      }|€y|D ]6  }|j                  dk(  sŒt	        ||¬«      sŒ!t        j                  d«        y y)NF©r  Úoauth2r  zDJWT routing override matched. Routing token to OAuth2 introspection.T)Úlitellm_jwtauthÚrouting_overridesÚget_unverified_claimsÚpathr  r   r°   )r  r  r	  rú   rû   s        re   Ú$_should_route_jwt_to_oauth2_overrider  ›  st   € Ø*×:Ñ:×LÑLÐÙØà%×;Ñ;À%Ð;ÓH€LØÐØà%ò ˆØ�=‰=˜HÓ$Ô)BÐP\ÐgoÖ)pÜ ×&Ñ&Ð'mÔnÙðð
 rg   c                 ó¾  — | j                  d«      r| j                  dd«      } | S | j                  d«      r| j                  dd«      } | S | j                  d«      r| j                  dd«      } | S | j                  d«      rZt        j                  d| «      }|r|j	                  d«      } | S t        j                  d| «      }|r|j	                  d«      } | S d} | S d} | S rÐ   rÕ   rÛ   s     re   Ú_get_bearer_tokenr  ¬  sö   € ð ×Ñ˜)Ô$Ø—/‘/ )¨RÓ0ˆð* €Nð) 
×	Ñ	˜HÔ	%Ø—/‘/ (¨BÓ/ˆð& €Nð% 
×	Ñ	˜IÔ	&Ø—/‘/ )¨RÓ0ˆð" €Nð! 
×	Ñ	Ð.Ô	/ô —	‘	Ð;¸WÓEˆÙØ—k‘k !“nˆGð €Nô —I‘IÐ6¸Ó@ˆEÙØŸ+™+ a›.�ð
 €Nð �ð €Nð ˆØ€Nrg   Úend_user_paramsÚbudget_infoÚend_user_idc                 ó  — |j                   �|j                   | d<   |j                  �|j                  | d<   |j                  �|j                  | d<   |j                  �|j                  | d<   t	        j
                  d|«       y)a  
    Helper function to apply budget limits to end user parameters.

    Args:
        end_user_params: Dictionary to update with budget parameters
        budget_info: Budget table object containing limits
        end_user_id: ID of the end user for logging
    NÚend_user_tpm_limitÚend_user_rpm_limitÚend_user_max_budgetÚend_user_model_max_budgetz$Applied budget limits to end user %s)Ú	tpm_limitÚ	rpm_limitÚ
max_budgetr±   r   r°   ©r  r  r  s      re   Ú'_apply_budget_limits_to_end_user_paramsr  È  s‰   € ð ×ÑÐ(Ø0;×0EÑ0EˆÐ,Ñ-à×ÑÐ(Ø0;×0EÑ0EˆÐ,Ñ-à×ÑÐ)Ø1<×1GÑ1GˆÐ-Ñ.à×#Ñ#Ð/Ø7B×7SÑ7SˆÐ3Ñ4ä×ÑÐEÀ{ÕSrg   Ú	websocketc              ƒ   ó¸  ‡K  — | j                   xs i }t        |j                  d«      xs g «      }d||j                  dd«      dœ}dD ]  }||v sŒ||   ||<   Œ t        |¬«      }| j                  |_        | j                  }|j                  d«      Šˆfd	„}||_        | j                  j                  d
«      }|sµ| j                  j                  d«      }	|	sa| j                  j                  dd«      j                  d«      D ]3  }
|
j                  «       }
|
j                  d«      sŒ%|
t        d«      d  }	 n |	s—| j                  t        j                  ¬«      ƒ d {  –—†  t!        dd¬«      ‚|j                  d«      s5| j                  t        j                  ¬«      ƒ d {  –—†  t!        dd¬«      ‚|t        d«      d  j                  «       }		 t#        |d|	› �¬«      ƒ d {  –—† S 7 ŒŒ7 ŒH7 Œ# t$        $ rY}t'        j(                  |«       | j                  t        j                  ¬«      ƒ d {  –—†7   t!        dt+        |«      ¬«      ‚d }~ww xY w­w)NÚheadersÚhttpr  rÒ   )Útyper  r  )Ú	root_pathÚapp_root_path)rÊ   r€   c               “   ó"   •K  — t        ‰ «      S ­wr‚   rP   r…   s   €re   Úreturn_bodyz0user_api_key_auth_websocket.<locals>.return_bodyþ  s   øè ø€ Ü% eÓ,Ð,ùs   ƒÚauthorizationzapi-keyzsec-websocket-protocolú,zopenai-insecure-api-key.)Úcodeé“  zNo API key provided©Ústatus_codeÚdetailrÑ   z#Invalid Authorization header format©rx   rÎ   )rÊ   r¤   rÄ   r   ÚurlÚ_urlÚquery_paramsÚbodyr  rö   rõ   rÖ   ÚlenÚcloser   ÚWS_1008_POLICY_VIOLATIONr   Úuser_api_key_authr¯   r   Ú	exceptionr„   )r  Úws_scopeÚscope_headersÚsynthetic_scopeÚkeyrx   r/  r$  r%  rÎ   Úprotocolr³   r€   s               @re   Úuser_api_key_auth_websocketr;  ä  s;  øè ø€ ð  —o‘oÒ+¨€HÜ §¡¨YÓ 7Ò =¸2Ó>€Mð Ø Ø—‘˜V RÓ(ñ.€Oð
 .ò 1ˆØ�(Š?Ø#+¨C¡=ˆO˜CÒ ð1ô  ?Ô3€Gà—=‘=€G„Là#×0Ñ0€Là×#Ñ# GÓ,€Eô-ð €G„Là$×,Ñ,×0Ñ0°ÓA€MáØ×#Ñ#×'Ñ'¨	Ó2ˆÙà%×-Ñ-×1Ñ1Ð2JÈBÓO×UÑUÐVYÓZò �Ø#Ÿ>™>Ó+�Ø×&Ñ&Ð'AÕBØ&¤sÐ+EÓ'FÐ'HÐI�GÙð	ñ
 Ø—/‘/¤v×'FÑ'F�/ÓG×GÐGÜ¨CÐ8MÔNÐNð ×'Ñ'¨	Ô2Ø—/‘/¤v×'FÑ'F�/ÓG×GÐGÜ¨CÐ8]Ô^Ð^à¤ I£Ð 0Ð1×7Ñ7Ó9ˆð<Ü&¨wÀ'È'ÈÐ@SÔT×TÐTð Høð
 Høð UùÜò <Ü×&Ñ& qÔ)Ø�o‰o¤6×#BÑ#BˆoÓC×CÑCÜ¨´C¸³FÔ;Ð;ûð<üst   ƒAIÁCIÄ,6IÅ"G/Å#AIÆ(G1Æ)-IÇG5 Ç*G3Ç+G5 Ç.IÇ1IÇ3G5 Ç5	IÇ>8IÈ6H9È7IÉIÉIc                 ó
  — |j                  d«      | _        |j                  d«      �
|d   | _        |j                  d«      �
|d   | _        |j                  d«      �
|d   | _        |j                  d«      �
|d   | _        | S )Nr  r  r  Úallowed_model_regionr  )rÄ   r  r  r  r=  r  ©r¥   r  s     re   Ú'update_valid_token_with_end_user_paramsr?  #  s�   € Ø-×1Ñ1°-Ó@€KÔð
 ×ÑÐ/Ó0Ð<Ø)8Ð9MÑ)NˆÔ&Ø×ÑÐ/Ó0Ð<Ø)8Ð9MÑ)NˆÔ&Ø×ÑÐ1Ó2Ð>Ø+:Ð;QÑ+RˆÔ(Ø×ÑÐ6Ó7ÐCØ0?Ð@[Ñ0\ˆÔ-ØÐrg   z[GLOBAL SPEND])Ú
log_prefixÚ_global_spend_coordinatorÚ	cache_keyc              ƒ   ón   ‡K  — dt         dz  fˆfd„}t        j                  | ||¬«      ƒ d{  –—† S 7 Œ­w)aU  
    Fetch global spend with event-driven coordination to prevent cache stampede.
    Uses EventDrivenCacheCoordinator: first request queries DB and signals others when done.

    Reads the proxy budget aggregate user row, which accrues proxy-wide spend
    per request and is zeroed by ResetBudgetJob every ``litellm.budget_duration``.
    r_   Nc               “   óª   •K  — ‰j                   j                  j                  dt        i¬«      ƒ d {  –—† } | �t	        | j
                  «      S d S 7 Œ­w)Nrš   ©Úwhere)ÚdbÚlitellm_usertableÚfind_uniquer   ÚfloatÚspend)Úproxy_budget_rowr¨   s    €re   Ú_load_global_spendzG_fetch_global_spend_with_event_coordination.<locals>._load_global_spendE  s]   øè ø€ Ø(5×(8Ñ(8×(JÑ(J×(VÑ(VØÔ7Ð8ð )Wó )
÷ #
Ðð 1AÐ0LŒuÐ%×+Ñ+Ó,ÐVÐRVÐVð#
ús   ƒ0A³A´A)rB  ÚcacheÚload_fn)rJ  rA  Úget_or_load)rB  r©   r¨   rM  s     ` re   Ú+_fetch_global_spend_with_event_coordinationrQ  8  sF   øè ø€ ðW¤e¨d¡lõ Wô +×6Ñ6ØØ Ø"ð 7ó ÷ ð ð ús   ƒ+5®3¯5Úlitellm_proxy_admin_namec              ƒ   ó   K  — d }t         j                  dkD  rr|�pt        }t        |||¬«      ƒ d {  –—† }|�Rt	        | t         j                  ||t
        j                  ¬«      }t        j                  |j                  d|¬«      «       |S 7 ŒZ­w)Nr   ©rB  r©   r¨   )rš   r  rK  r  Úevent_groupÚproxy_budget©r   Ú	user_info)
rj   r  r   rQ  ÚCallInfoÚLitellm_EntityTypeÚPROXYÚasyncioÚcreate_taskÚbudget_alerts)rR  r©   r¨   r  r«   Úglobal_proxy_spendrB  rX  s           re   Úget_global_proxy_spendr`  R  s¢   è ø€ ð ÐÜ×Ñ˜AÒ -Ð";ä7ˆ	Ü#NØØ1Ø'ô$
÷ 
Ðð
 Ð)Ü'Ø0Ü"×-Ñ-Ø(ØÜ.×4Ñ4ô ˆIô ×ÑØ!×/Ñ/Ø'Ø'ð 0ó ôð Ðð'
ús   ‚/B±B²ABÚscopesc                 ój   — | j                  |¬«      }|rt        j                  S t        j                  S )N)ra  )Úis_adminÚLitellmUserRolesÚPROXY_ADMINÚTEAM)r  ra  rc  s      re   Úget_rbac_rolerg  s  s0   € Ø!×*Ñ*°&Ð*Ó9€HÙÜ×+Ñ+Ð+ä×$Ñ$Ð$rg   Úpass_through_endpointsc	                 ó0  — ddl m}	 ddlm}
 |}d}t	        | t
        «      r| }t        | «      }||fS t	        |t
        «      r t        |«      dkD  r|}t        |¬«      }||fS t	        |t
        «      r|}|}||fS t	        |t
        «      r|}|}||fS t	        |t
        «      r|}|}||fS t	        |t
        «      r|}|}||fS  |	j                  |¬«      r<|�: |
|«      j                  d«      r# |
|«      j                  d«      xs d}|}|}||fS |��|D ]|  }|j                  d	d«      |k(  sŒ|j                  d
d«      }|€Œ.|j                  dd«      }|j                  j                  |«      €Œ\|j                  j                  |«      xs d}|}Œ~ ||fS )zj
    Returns:
        Tuple[Optional[str], Optional[str]]: Tuple of the api_key and the passed_in_key
    r   rG   )rM   N©rÎ   rd   r9  rÒ   r  r  Úlitellm_user_api_key)Úlitellm.proxy.auth.route_checksrH   Ú-litellm.proxy.common_utils.http_parsing_utilsrM   rƒ   r„   rÝ   r1  r  Úis_generate_content_routerÄ   r  )rq   rÎ   rs   rt   ru   rv   rh  r^   rx   rH   rM   Úpassed_in_keyÚgoogle_auth_keyÚendpointr  Ú
header_keys                   re   Úget_api_keyrs  {  sô  € õ <õð €GØ $€MÜÐ+¬SÔ1Ø1ˆÜ7Ð8QÓRˆðB �MÐ!Ð!ôA 
�GœSÔ	!¤c¨'£l°QÒ&6ØˆÜ#¨GÔ4ˆð< �MÐ!Ð!ô; 
Ð(¬#Ô	.Ø,ˆØ&ˆð6 �MÐ!Ð!ô5 
Ð,¬cÔ	2Ø0ˆØ*ˆð0 �MÐ!Ð!ô/ 
Ð3´SÔ	9Ø7ˆØ1ˆð* �MÐ!Ð!ô) 
Ð%¤sÔ	+Ø)ˆØ#ˆð$ �MÐ!Ð!ð! 	.ˆ×-Ñ-°EÕ:ØÐÙ*¨7Ó3×7Ñ7¸Ô>á&DÀWÓ&M×&QÑ&QÐRWÓ&XÒ&^Ð\^ˆØ'ˆØ!ˆð �MÐ!Ð!ð 
 Ð	+Ø.ò 	0ˆHØ�|‰|˜F BÓ'¨5Ó0Ø'/§|¡|°I¸tÓ'D�ØÑ&Ø&-§k¡kÐ2HÈ"Ó&M�JØ—‘×*Ñ*¨:Ó6ÑBØ")§/¡/×"5Ñ"5°jÓ"AÒ"GÀR˜Ø(/™ð	0ð �MÐ!Ð!rg   c              ƒ   ó¬  K  — d}t        |«      }|�4t        j                  j                  D ]  }|j	                  |«      sŒd} n |r:| j
                  j                  d«      �| j
                  j                  d«      xs d}|��M|D �]G  }t        |t        «      sŒ|j                  dd«      |k(  sŒ+|j                  dd«      durt        «       c S |j                  d«      �o|j                  d«      dk(  r[d	d l
}|j                  d
d«      j                  «       }|j                  |«      }	|	j                  d«      }
|
j                  d«      d	   }ŒË|j                  dd «      }|€Œà|j                  dd«      }t        | j
                  t        «      s�Œ| j
                  j                  |¬«      €�Œ,| j
                  j                  |¬«      }�ŒJ |S ­w)NFTrk  rÒ   r  ÚauthÚcustom_auth_parserÚlangfuser   rÓ   zutf-8ú:r  )r9  )rX   ÚLiteLLMRoutesÚmapped_pass_through_routesÚvaluerÖ   r  rÄ   rƒ   rË   r–   Úbase64r×   rõ   Ú	b64decodeÚdecoderö   )rx   r^   rh  rÎ   Úis_mapped_pass_through_routerl   Úmapped_routerq  r|  Údecoded_bytesÚdecoded_strr  rr  s                re   Ú:check_api_key_for_custom_headers_or_pass_through_endpointsrƒ  ·  s¹  è ø€ ð */Ð Ü;¸EÓBÐØÐ#Ü)×DÑD×JÑJò 	ˆLØ×*Ñ*¨<Õ8Ø/3Ð,Ùð	ñ $Ø�?‰?×ÑÐ5Ó6ÐBØ—o‘o×)Ñ)Ð*@ÓAÒGÀRˆGØÑ)Ø.ó 	JˆHÜ˜(¤DÕ)¨h¯l©l¸6À2Ó.FÈ%Ó.Oð —<‘< ¨Ó-°TÑ9Ü)Ó+Ò+ð —<‘<Ð 4Ó5ÐAÀhÇlÁlÐSgÓFhÐlvÒFvó "à%Ÿo™o¨h¸Ó;×AÑAÓC�GØ$*×$4Ñ$4°WÓ$=�MØ"/×"6Ñ"6°wÓ"?�KØ)×/Ñ/°Ó4°QÑ7‘Gà&Ÿl™l¨9°dÓ;�GØÑ*Ø%,§[¡[Ð1GÈÓ%L˜
Ü% g§o¡o´tÖ<ÀÇÁ×ATÑATÐYcÐATÓAdÒApØ&-§o¡o×&9Ñ&9¸jÐ&9Ó&IšGð5	Jð6 €Nùs+   ‚>GÁAGÂGÂ2B4GÅ',GÆGÆ3!GÚ__JWT_PROXY_ADMIN__Ú_JWT_PROXY_ADMIN_SENTINELzÙ This key has the structure of a JWT, but JWT auth is not enabled on this proxy, so it was treated as a virtual key. Set `enable_jwt_auth: true` under `general_settings` in your proxy config to authenticate with JWTs.c                   ó0   — e Zd ZU dZeed<   eed<   eed<   y)Ú_PendingAutoRegisteraE  
    Signal returned by ``_resolve_jwt_to_virtual_key`` when the JWT's claim is
    unmapped and ``unregistered_jwt_client_behavior`` is AUTO_REGISTER.

    The caller MUST run standard ``JWTAuthManager.auth_builder`` to apply RBAC,
    scope mappings, ``custom_validate``, and ``user_allowed_email_domain``
    policy BEFORE calling ``_auto_register_jwt_mapping`` with the validated
    ``team_id`` / ``user_id`` from the auth_builder result. Auto-registering
    purely on a signature-valid JWT (the old behavior) bypassed every JWT
    policy beyond signature verification.
    Úclaim_fieldrá   rB  N)r“   r”   r•   Ú__doc__r„   Ú__annotations__r‹   rg   re   r‡  r‡  õ  s   … ñ
ð ÓØÓØ„Nrg   r‡  Úvirtual_key_claim_fieldr¿   Úorg_idc              ƒ   óÖ  K  — ddl m}  |dd||	|
d| |dœ¬«      ƒ d{  –—† }t        |d   «      }	 |j                  j                  j                  | ||d	d	d
œ¬«      ƒ d{  –—†  |j!                  |||j"                  j$                  ¬«      ƒ d{  –—†  t        j&                  d| |«       t)        j*                  t)        ||||¬«      j-                  |¬«      ƒ d{  –—† «      }|�|
|_        ||_        |j2                  |_        |S 7 Œë7 Œª# t        $ rÉ}t        |«      j                  «       }d|v sd|v rœt        j                  d| |«       	 |j                  j                  j                  d|i¬«      ƒ d{  –—†7   n,# t        $ r }t        j                  d|«       Y d}~nd}~ww xY wt        | ||¬«      ƒ d{  –—†7  }|€t        dd¬«      ‚‚ Y d}~�Œud}~ww xY w7 �ŒR7 �Œ­w)u  
    Auto-register: create a new virtual key + mapping for an unrecognised JWT
    claim value. ``team_id`` and ``user_id`` must come from a successful
    ``JWTAuthManager.auth_builder`` run â€” they encode the JWT identity AFTER
    RBAC/scope/custom_validate/email-domain policy has been enforced. The key
    is stamped with those values so the cached future-request path inherits
    the same team/user/org limits the auth_builder path would have applied.

    Race safety: if two concurrent requests both reach here simultaneously (both
    saw no mapping in the DB), one will win the unique-constraint race on
    litellm_jwtkeymapping. The loser catches the conflict, deletes its orphaned
    key, fetches the winner's mapping, and proceeds â€” no error surfaced.
    r   )Úgenerate_key_helper_fnr9  T)Úauto_registeredÚjwt_claim_fieldÚjwt_claim_value)Úrequest_typeÚ
table_namer¿   rš   Úorganization_idÚmetadataNr  Úauto_register)Újwt_claim_namer‘  r  Ú
created_byÚ
updated_by)ÚdataÚuniqueÚp2002u‡   JWT Key Mapping (auto_register): unique conflict on create â€” deleting orphaned virtual key and fetching winner's mapping for %s='%s'.rE  zMJWT Key Mapping (auto_register): failed to delete orphaned key after race: %s©r—  r‘  r¨   i÷  uw   JWT Key Mapping: AUTO_REGISTER race resolution failed â€” winner's mapping was concurrently removed. Retry the request.r)  ©r9  r{  ÚttlzEJWT Key Mapping (auto_register): created new virtual key for %s='%s'.©rª   r«   ©Úhashed_token)Ú;litellm.proxy.management_endpoints.key_management_endpointsrŽ  Ú
hash_tokenrG  Úlitellm_jwtkeymappingÚcreater¯   r„   Úlowerr   r°   Úlitellm_verificationtokenÚdeleteÚwarningr,   r   Úasync_set_cacher  Úvirtual_key_mapping_cache_ttlÚinforF   Úkey_from_principalÚresolverŒ  r  r  rÎ   )r‹  rá   r  r¨   r©   rª   r«   rB  r¿   rš   rŒ  r  rŽ  Úkey_dataÚ
token_hashr³   Ú	error_strÚ
delete_errÚauto_registered_keys                      re   Ú_auto_register_jwt_mappingrµ    sI  è ø€ õ:ñ 3ØØØØØà#Ø6Ø*ñ
ô÷ €Hô ˜H WÑ-Ó.€Jð4Ø×Ñ×4Ñ4×;Ñ;à"9Ø#.Ø#Ø-Ø-ñð <ó 
÷ 	
ð 	
ðj ×
,Ñ
,ØØØ×'Ñ'×EÑEð -ó ÷ ð ô ×ÑØOØØôô "/×!AÑ!AÜØØØ-Ø/ô	
÷
 ‰'˜zˆ'Ó
*÷	+ó"Ðð Ð&Ø%+ÐÔ"Ø*5ÐÔ'Ø&9×&?Ñ&?ÐÔ#ØÐðøð$	
ùô ò *Ü˜q›6Ÿ<™<›>ˆ	Ø�yÑ  G¨yÑ$8ô !×&Ñ&ð[à'Øô	ðØ#×&Ñ&×@Ñ@×GÑGÈwÐXbÐNcÐGÓd×dÒdøÜò ô %×,Ñ,ØcØ÷ñ ûðúô  :Ø6Ø +Ø+ô ÷ ð ˆJð
 Ð!ô $Ø #ðXôð ð õ "ûð9*úðXùð	+ûs«   ‚G)žD
ŸG)²/D Á!DÁ"D Á&+G)ÂG#ÂAG)ÃG&Ã,G)ÄD Ä	G Ä8GÅ+FÅ;E>Å<FÆGÆ	F+ÆF&Æ!GÆ&F+Æ+GÆ?GÇ GÇG)ÇG Ç G)Ç&G)Ú
jwt_claimsc              ƒ   ó
  K  — |j                   j                  }|€yt        | |d¬«      }|€`t        j                  d|«       |j                   j
                  }|t        j                  t        j                  fv rt        dd|› d�¬«      ‚yd|› d	|› �}	|j                  |	«      ƒ d{  –—† }
|
t        k(  ry|
d
k(  r�|j                   j
                  }|t        j                  k(  rt        dd|› d|› d�¬«      ‚|t        j                  k(  r?|€t        dd¬«      ‚|j                  |	«      ƒ d{  –—†  t        |t        |«      |	¬«      S y|
�:t        j                   t        ||||¬«      j#                  |
¬«      ƒ d{  –—† «      S d}|�t%        |t        |«      |¬«      ƒ d{  –—† }|�j|j'                  |	||j                   j(                  ¬«      ƒ d{  –—†  t        j                   t        ||||¬«      j#                  |¬«      ƒ d{  –—† «      S |j                   j
                  }|t        j                  k(  rD|j'                  |	d
|j                   j(                  ¬«      ƒ d{  –—†  t        dd|› d|› d�¬«      ‚|t        j                  k(  r&|€t        dd¬«      ‚t        |t        |«      |	¬«      S |j'                  |	d
|j                   j(                  ¬«      ƒ d{  –—†  y7 �ŒF7 �ŒÂ7 �Œu7 �ŒQ7 �Œ"7 Œî7 Œ“7 Œ­w)at  
    Returns:
      - ``UserAPIKeyAuth``: a resolved virtual key (cache hit or DB hit). The
        caller may use this directly; JWT policy has been enforced previously
        (at key-creation time or, for cached results, before caching).
      - ``_PendingAutoRegister``: claim is unmapped and behavior is AUTO_REGISTER.
        The caller MUST run ``JWTAuthManager.auth_builder`` to enforce JWT
        policy (RBAC, scope, custom_validate, email-domain), then invoke
        ``_auto_register_jwt_mapping`` with the validated team_id/user_id.
      - ``None``: claim is unmapped and behavior is FALLBACK_TEAM_MAPPING.
        The caller falls through to standard team-based JWT auth (which itself
        enforces full JWT policy via auth_builder).
      - Raises HTTPException: REJECT policy hit, missing claim under
        REJECT/AUTO_REGISTER, or other policy violations.
    N)rš  Úkey_pathÚdefaultz:JWT Key Mapping: Claim field '%s' not found in JWT claims.r(  z!JWT Key Mapping: Required claim 'z)' is missing from the JWT. Access denied.r)  zjwt_key_mapping:rx  Ú__NO_MAPPING__z+JWT Key Mapping: No registered mapping for z='z'. Access denied.éô  zJWT Key Mapping: AUTO_REGISTER requires a database connection. Configure a database or change unregistered_jwt_client_behavior.)rˆ  rá   rB  r   r¡  r�  rž  )r  r‹  r   r   r°   Ú unregistered_jwt_client_behaviorÚUnregisteredJWTClientBehaviorÚREJECTÚAUTO_REGISTERr   Úasync_get_cacher…  Úasync_delete_cacher‡  r„   rF   r®  r¯  r,   r«  r¬  )r¶  r  r¨   r©   rª   r«   r‹  rá   ÚbehaviorrB  Úcached_mappingr±  s               re   Ú_resolve_jwt_to_virtual_keyrÄ  �  s¯  è ø€ ð. &1×%@Ñ%@×%XÑ%XÐØÐ&Øä)ØØ(Øô€Kð ÐÜ×"Ñ"ØHÐJaô	
ð ×.Ñ.×OÑOˆØÜ)×0Ñ0Ü)×7Ñ7ð
ñ 
ô  Øà7Ð8OÐ7Pð Q>ð >ôð ð à)Ð*AÐ)BÀ!ÀKÀ=ÐQ€IØ"4×"DÑ"DÀYÓ"O×O€NàÔ2Ò2ð àÐ)Ò)Ø×.Ñ.×OÑOˆØÔ4×;Ñ;Ò;ÜØØDÐE\ÐD]Ð]_Ð`kÐ_lÐl}Ð~ôð ð Ô4×BÑBÒBð Ð$Ü#Ø #ð[ôð ð %×7Ñ7¸	ÓB×BÐBÜ'Ø3Ü Ó,Ø#ôð ð
 Ø	Ð	#Ü×/Ñ/ÜØØ"Ø!1Ø"3ô	÷
 ‰g >ˆgÓ2÷3ó
ð 	
ð "€JØÐ Ü5Ø2Ü Ó,Ø'ô
÷ 
ˆ
ð ÐØ ×0Ñ0ØØØ×+Ñ+×IÑIð 1ó 
÷ 	
ð 	
ô
 ×/Ñ/ÜØØ"Ø!1Ø"3ô	÷
 ‰g :ˆgÓ.÷/ó
ð 	
ð ×*Ñ*×KÑK€HàÔ0×7Ñ7Ò7ð !×0Ñ0ØØ"Ø×+Ñ+×IÑIð 1ó 
÷ 	
ð 	
ô
 ØØ@ÐAXÐ@YÐY[Ð\gÐ[hÐhyÐzô
ð 	
ð
 Ô0×>Ñ>Ò>ØÐ ÜØðWôð ô $Ø/Ü˜KÓ(Øô
ð 	
ð ×
,Ñ
,ØØØ×'Ñ'×EÑEð -ó ÷ ð ð
 ðc Pùð: Cùð3ùð
ùð	
ùð/øð	
øð>ús”   ‚B&LÂ(K.Â)BLÄ/K1Ä0ALÅ?K4Æ &LÆ&K7Æ'1LÇK:Ç5LÈK=ÈALÉ+K?É,A<LË(LË)LË1LË4LË7LË:LË=LË?LÌLc                 óÆ   — t        | j                  dd«      }|�|S t        j                  t        j
                  «      }	 || j                  _        |S # t        $ r Y |S w xY w)aÊ  Idempotently stamp ``request.state.litellm_received_at`` with the moment
    litellm's own code started handling this request -- the first line of
    ``user_api_key_auth``, before any auth/pre-call work runs. This is the
    basis for the request-latency Prometheus metrics (see
    ``litellm/integrations/prometheus.py``), and unlike the OTEL SERVER span
    below, it is set unconditionally so those metrics don't depend on OTEL
    being configured.
    Úlitellm_received_atN)ÚgetattrÚstater   Únowr   ÚutcrÆ  r¯   )rx   Úexisting_received_atÚreceived_ats      re   Ú,_ensure_litellm_received_at_on_request_staterÍ  <  sj   € ô 4;¸7¿=¹=ÐJ_ÐaeÓ3fÐØÐ'Ø#Ð#Ü!Ÿ™¤h§l¡lÓ3€KðØ,7ˆ�‰Ô)ð Ðøô ò ØØÐðús   Á A Á	A ÁA c                 ó$  — ddl m} t        | «      }|€yt        | j                  dd«      �y|j                  |t        | «      ¬«      }t        |dd«      }t        «       s |� ||t        | ¬«      t        | «      ¬«       || j                  _
        y)	aR  Idempotently create the OTEL SERVER span and stash it on
    ``request.state.parent_otel_span``. Safe to call multiple times.

    Called both at the top of ``user_api_key_auth`` (so body-parse failures
    have a span to close) and inside ``_user_api_key_auth_builder`` (for
    callers that bypass ``user_api_key_auth``, e.g. MCP).
    r   )Úopen_telemetry_loggerNrª   )Ú
start_timer  Ú"set_proxy_request_route_attributesr{   )Úurl_pathÚ
http_route)Úlitellm.proxy.proxy_serverrÏ  rÍ  rÇ  rÈ  Ú)create_litellm_proxy_request_started_spanrL   r   r8   r9   rª   )rx   rÏ  rÐ  rª   Úset_route_attrss        re   Ú)_ensure_parent_otel_span_on_request_stater×  P  s›   € õ AäDÀWÓM€JàÐ$ØÜˆw�}‰}Ð0°$Ó7ÐCØØ3×]Ñ]ØÜ)¨'Ó2ð ^ó Ðô %Ð%:Ð<`ÐbfÓg€OÜÔ OÐ$?ÙØÜ&¨wÔ7Ü1°'Ó:õ	
ð
 &6€G‡M�MÕ"rg   c              ƒ   óŠ   K  — 	 t        | ¬«      ƒ d{  –—† }t        || ¬«      dfS 7 Œ# t        $ r}i |fcY d}~S d}~ww xY w­w)a2  Parse the body, returning a parse failure instead of raising it.

    A body that fails to parse is still a request from a known caller, so auth
    must run (resolving identity onto the request's trace) before the 400 goes
    out; the caller re-raises the returned exception once identity is seeded.
    r{   N)rw   rx   )rK   rÅ   rO   )rx   rÁ   Úparse_exceptions      re   Ú*_read_request_body_deferring_parse_failurerÚ  p  sM   è ø€ ð#Ü#5¸gÔ#F×Fˆô -¸+ÈwÔWÐY]Ð]Ð]ð GùÜò #Ø�?Ð"Õ"ûð#üs8   ‚A„) “'”) ˜A§) ©	A ²;µA ¶A»A Á Ar‰   Úbody_parse_exceptionc              ƒ   óÎ   K  — ddl m} 	 |j                  i || t        j                  |¬«      ƒ d{  –—†  y7 Œ# t
        $ r }t        j                  d|«       Y d}~yd}~ww xY w­w)a/  Record the 400 an unparsable body earns as a failed request log.

    The endpoint never runs for these, so no downstream failure hook writes the
    spend log row the Admin UI reads. Logging must not change what the caller
    sees, so a failure here is swallowed and the 400 is raised either way.
    r   )r«   )rw   Úoriginal_exceptionr‰   Ú
error_typer^   Nz=Failed to log the request rejected for an unparsable body: %s)rÔ  r«   Úpost_call_failure_hookÚProxyErrorTypesÚbad_request_errorr¯   r   r5  )r‰   rÛ  r^   r«   r³   s        re   Ú_record_unparsable_body_failurerâ  €  sk   è ø€ õ =ð	kØ×6Ñ6ØØ3Ø/Ü&×8Ñ8Øð 7ó 
÷ 	
ò 	
ùô ò kÜ×&Ñ&Ð'fÐhi×jÑjûðküs7   ‚A%Š'9 ±7²9 ¶A%·9 ¹	A"ÁAÁA%ÁA"Á"A%Úobject_permission_idc              ƒ   óH   K  — | �|€yt        | ||||¬«      ƒ d{  –—† S 7 Œ­w)z�Re-resolve a team's object permission by id when the team row itself is unreadable, so the
    token-derived fallback doesn't silently drop it.N©rã  r¨   r©   rª   r«   )r-   rå  s        re   Ú0_resolve_object_permission_for_unresolvable_teamræ  ™  s<   è ø€ ð Ð# }Ð'<ØÜ&Ø1Ø#Ø-Ø)Ø+ô÷ ð ð ús   ‚"› œ"c              ƒ   óÈ8  K  — ddl m}m}	m}
m}m}m}m}m}m	}m
}m}m} d }t        | j                  dd «      xs# t        j                   t"        j$                  «      }	 || j                  _        t+        | ¬«      }d }d}	 t-        j.                  d«      5  t1        || |¬«      ƒ d {  –—†  d d d «       |j3                  dd «      }t5        ||||||||| ¬	«	      \  }}|j3                  d
«      }|�t7        | |¬«      }|�"t9        | «       t        | j                  dd «      }t:        ��t-        j.                  d«      5  t;        | ||¬«      ƒ d {  –—† }d d d «       �Pt=        |t>        «      r@t>        jA                  |«      }t        tB        dd«      rtE        || |||¬«      ƒ d {  –—† }|S |�it=        |tF        «      rY|}d}nT|�R || |¬«      ƒ d {  –—† }t>        jA                  |«      }t        tB        dd«      rtE        || |||¬«      ƒ d {  –—† }|S 	 tI        ||¬«      sB|tJ        jL                  jN                  v stQ        |¬«      rt?        tR        jT                  ¬«      S |j3                  dd«      du }|j3                  dd«      du }|r|	jW                  |¬«      nd} | xr tY        ||	¬«      }!|!xr. t[        j\                  |¬«      xs t[        j^                  |¬«      }"|xr. t[        j\                  |¬«      xs t[        j^                  |¬«      }#|#r| r|"rnddl m0}$ |$durFtc        dtd        jf                  jN                  z   th        jj                  dtl        jn                  ¬«      ‚tq        jr                  |¬«      ƒ d {  –—† S |j3                  dd«      du rtu        | ¬«      ƒ d {  –—† S |j3                  dd«      du �r™|	jW                  |¬«      } tw        jx                  d | «       | �rnddl m0}$ |$durFtc        d!td        jf                  jN                  › �th        jj                  dtl        jn                  ¬«      ‚d}%d }&|	jz                  j|                  ��1|	jz                  j~                  r| s|	j�                  |¬«      ƒ d {  –—† }'n|	jƒ                  |¬«      ƒ d {  –—† }'t…        |'|	||||¬"«      ƒ d {  –—† }(t=        |(t>        «      r©|(}|j†                  xs d#}|'|_D        d}%|jŠ                  �”|jŒ                  €ˆ|'xs i })|	j�                  |)d ¬$«      }*|	j‘                  |)d ¬$«      }+|*�Z|+|jŠ                  k(  rK	 t“        |jŠ                  ||d|||*¬%«      ƒ d {  –—† },|,�$|,jŒ                  |_F        nt=        |(t”        «      r|(}&|%�rÏt-        j.                  d'«      5  t—        j˜                  ||||	|||||t›        | «      t[        jœ                  | ¬«      ¬(«      ƒ d {  –—† }.d d d «       .d)   }/|.d*   }0|.d+   }1|.d,   }2|.d-   }3|.d.   }4|.d/   }5|.d0   }6|.j3                  d1d «      }7|.j3                  d2d «      }'|/r­|&�>|jŸ                  |&j                   t¢        |	jz                  j¤                  ¬3«      ƒ d {  –—†  t?        d tR        j¦                  |2|3|0|1�|1j¨                  nd |1�|1jª                  nd |1�|1j¬                  nd |1�|1j®                  ng |1�|1j°                  nd |6|5||'¬4«      S t?        d²i d5d “d*|0“d6|1�|1j¨                  nd “d7|1�|1jª                  nd “d8|1�|1j¬                  nd “d9|1�|1j®                  ng “d:|4�!|4j²                  �tS        |4j²                  «      ntR        j´                  “d,|2“d-|3“d0|6“d|“d/|5“d;|4�|4jª                  nd “d<|4�|4j¬                  nd “d=|4�|4j¶                  nd “d>|7�|7j¹                  «       nd “d?|7�|7j»                  «       nd “d@|1�|1j°                  nd “d2|'“Ž}|1�|1j¼                  nd |__        |&�v|�ttÁ        |&jÂ                  |&jÄ                  |	|||||&j                   |0|2|6|5¬A«      ƒ d {  –—† }8|8�5|'|8_D        |3|8_F        |4�|4j¶                  nd |8_c        |8}|j†                  xs d#}tÉ        ||| |¬B«      }9d}:|9�*|�(ddClemf};  |;|9|¬D«      }:|:rtw        jÎ                  dE|9«       d }<|jÐ                  �EtÓ        |jÐ                  |||¬F«      ƒ d {  –—† }<|<�"|<j°                  |_j        |<jÖ                  |_k        |:s;tÙ        tÛ        t>        |«      |tÝ        tÉ        ||| |¬B«      ¬G«      ¬H«      ƒ d {  –—†  tÛ        t>        |«      S |s<tß        | |||¬I«      ƒ d {  –—† }t=        |tF        «      r|}nt=        |t>        «      r|S |€Gt=        |tF        «      rt?        |tR        j´                  |¬J«      S t?        tR        j´                  |¬K«      S |€t)        dL«      ‚|d#k(  rt)        dM«      ‚|dNk(  r9|j3                  dOd«      du r
t?        «       S tá        tl        jn                  dP¬Q«      ‚d }=i }>tã        |t›        | «      «      }?tå        |?|||||¬R«      ƒ d {  –—† }5|5r¬	 |5|>d/<   t-        j.                  dS«      5  tç        |5|||||¬T«      ƒ d {  –—† }=d d d «       |=�4|=jè                  |>dU<   |=jê                  �Rtí        |>|=jê                  |5¬V«       n9tB        jî                  �)ddWlemx}@  |@|||¬X«      ƒ d {  –—† }A|A�tí        |>A|5¬V«       |€³	 t-        j.                  dZ«      5  tõ        jö                  tõ        ||||d¬[«      jù                  tû        |«      ¬\«      ƒ d {  –—† «      }d d d «       t=        |t>        «      rd|_~        |€7|�j                  d^«      s%�t        d_«      dur�t        �j                  |«      }|��‚t=        |t>        «      �rq|j²                  tR        j¦                  k(  �rS|�j                  ��t        j                   t"        j$                  «      }Bt=        |�j                  t        «      r|�j                  }Cn!t        �j
                  |�j                  «      }CC�j                  �C�j                  �j                  |C«      €!C�j                  t"        j$                  ¬`«      }CCBk  r^�t        tû        |«      ||¬a«      ƒ d {  –—†  tc        dbC› dcB› �th        �j                  tl        �j                  �t        |¬d«      ¬e«      ‚�t        ||>¬f«      }||_Ž        |=�|=j¼                  |_�        |S |�Öt=        |t>        «      rÆ|�j                   �¹|�j                   �t"        k7  r¤	 �t%        |�j                   ||||d¬g«      ƒ d {  –—† }D|D�j&                  �q|�j&                  �dD�j&                  |�j&                  kD  rID�j(                  }E|E�j+                  «       D ](  \  }F}Gdh|F› �}H|H|�j,                  v sŒ�t/        |HG«       Œ* 	 �t1        �j2                  ||«      }It=        |tF        «      stá        didj�t5        |«      › �h¬Q«      ‚Iry�t7        d tR        j¦                  �t8        |i |>¥d,|
i¥||¬k«      ƒ d {  –—† }J�t;        �j<                  �t?        tû        |«      |J||¬l«      «       �t        |J|>¬f«      }Jd|J_~        |JS |tJ        �j@                  jN                  v rt)        dm|› dn�«      ‚|€tc        doth        �jB                  dpd ¬e«      ‚|�€”t=        |tF        «      rt�tE        |«      dqkD  r|d dr › ds|dtd  › �nds}K|�j                  d^«      sx|s�tG        jV                  |¬«      r�tH        nd#}Ltá        tl        �j                  duK› dv|L› �¬Q«      ‚tÿ        �jJ                  dw�jM                  |��t5        |«      ndx«      «       �t        |¬d«      }M|�j                  d^«      rtû        |¬«      }	 t-        j.                  dy«      5  tõ        jö                  tõ        ||||¬z«      jù                  |¬\«      ƒ d {  –—† «      }d d d «       |>j3                  d/«      |_©        |>j3                  d€«      |_ª        |>j3                  d�«      |_«        |>j3                  dU«      |_t        |��tY        |«      }d }Ni }O|��ñ|�jZ                  du rt)        d‚«      ‚�t]        |||| ||¬ƒ«      ƒ d {  –—†  |jŠ                  �¨	 t-        j.                  d„«      5  t“        |jŠ                  ||d||¬…«      ƒ d {  –—† }Nd d d «       N�Nj¶                  |_c        N�Qt=        Nj°                  �t^        «      r6Nj°                  j3                  d‡«      du rt)        dˆ|jŠ                  › d‰�«      ‚tÉ        ||| |¬B«      }9d}:|9�*|�(ddClemf};  |;|9|¬D«      }:|:rtw        jÎ                  dE|9«       |:�sº|�j`                  ��¬|jŠ                  }P|�j                   }Q|���P���Q��Š�tc        QP¬Š«      }R|�je                  |R�tf        ¬‹«      ƒ d {  –—† }S|S€u�ti        |«      �jj                  �jm                  PQdŒœd�di¬Ž«      ƒ d {  –—† }T|T�=�tg        d²i T�jo                  «       ¤Ž}S|jŸ                  R|S�tf        d�¬�«      ƒ d {  –—†  S�âSjê                  �ÖSjê                  �jp                  }U|U�½UdkD  r¸dd‘l m¹}V |�j`                  }W|jŠ                  �;|�j                   �. Vd’|jŠ                  › d“|�j                   › �WU¬”«      ƒ d {  –—† }WWUkD  rY|jŠ                  › d“|�j                   › �}XtC        jò                  WUd•|X› d–|W› d—|U› ��tt        �jv                  jN                  |X¬˜«      ‚|�j                  ��t        j                   t"        j$                  «      }Bt=        |�j                  t        «      r|�j                  }Cn!t        �j
                  |�j                  «      }CC�j                  �C�j                  �j                  |C«      €!C�j                  t"        j$                  ¬`«      }Ctw        jx                  d™CB«       |C|Bk  r>tc        dbC› dcB› �th        �j                  tl        �j                  �t        |¬d«      ¬e«      ‚|:�s”t-        j.                  dš«      5  �ty        ||N¬›«      ƒ d {  –—†  t[        j\                  |¬«      r�t{        ||N¬›«      ƒ d {  –—†  �t}        ||N¬›«      ƒ d {  –—†  |j¶                  }YtÉ        ||| |¬B«      }ZtÝ        |Z¬G«      }[|Y�mt=        Y�t^        «      r\�tE        Y«      dkD  rM|�K[rI|j†                  �=[D ]  }\�t        |||\|| ||¬œ«      ƒ d {  –—†  Œ tÉ        ||| |¬B«      }ZtÝ        |Z¬G«      }[[rtÙ        ||[¬H«      ƒ d {  –—†  |�j€                  }]|]�^t=        ]�t^        «      rM�tE        ]«      dkD  r>[r<|�jR                  �/[D ]*  }\|�jƒ                  |�jR                  ]|\¬�«      ƒ d {  –—†  Œ, d d d «       |�j                   �k	 |�j                   �t"        k(  r�t…        �t"        ¬ž«      ‚t-        j.                  dŸ«      5  �t%        |�j                   ||||¬ «      ƒ d {  –—† }^d d d «       nd }^^�#^j¼                  |__        |^j°                  |_Ë        nd |__        d }`|jÐ                  �EtÓ        |jÐ                  |||¬F«      ƒ d {  –—† }`|`�"`j°                  |_j        |`jÖ                  |_k        d }atB        �jp                  dkD  r¯|�­�tœ        }bt-        j.                  d£«      5  �tŸ        b||¬¤«      ƒ d {  –—† }ad d d «       a�o�t¡        |j†                  atB        �jp                  |
|�j                   �tt        �j¢                  ¬¥«      }c�t;        �j<                  |�j¥                  d¦|c¬§«      «       |€tá        d{d¨¬©«      ‚|j†                  €tá        d{dª¬©«      ‚|j†                  }|�jo                  d¬««      }O|O�j§                  d¬d «       |�j¨                  �|�j¨                  Od­<   |=�!O�j«                  |>«       |=j¼                  |Od®<   |€t)        d¯«      ‚O�#�t7        N||O||¬°«      ƒ d {  –—† }dd|d_~        |dS y # t(        $ r Y �Œ±w xY w7 �Œ}# 1 sw Y   �Œ}xY w7 �Œæ# 1 sw Y   �ŒæxY w7 �Œž7 �Œt7 �Œ97 �ŒÃ7 �Œž7 �ŒÄ7 �Œ¬7 �Œ–7 �Œô# t(        $ r!}-tw        jx                  d&|-«       Y d }-~-�Œñd }-~-ww xY w7 �Œ # 1 sw Y   �Œ xY w7 �Œ7 �ŒS7 �Œ³7 �ŒU7 �Œ/7 �Œ77 �Œ# 1 sw Y   �ŒxY w7 �Œ¬# t(        $ r=}-t=        |-tB        jò                  «      r|-‚tw        jx                  dY|-«       Y d }-~-�ŒÛd }-~-ww xY w7 �Œ�# 1 sw Y   �Œ‹xY w# t(        $ r tÿ        jx                  d]«       d }Y �Œšw xY w7 �ŒM7 �ŒŽ# t(        $ r }-tÿ        jx                  |-«       Y d }-~-�Œ2d }-~-ww xY w# t(        $ r d}IY �Œ/w xY w7 �Œ×7 �
Œ# 1 sw Y   �
ŒxY w# tb        $ r5}-|-�jN                  d{k(  s|-�jN                  d|k(  rd}M› d~|› d�|-_¨        |-‚d }-~-ww xY w7 �	Œº7 �	Œw# 1 sw Y   �	ŒwxY w# t(        $ r#}-tÿ        jx                  d†|-«       d }NY d }-~-�	Œ¡d }-~-ww xY w7 �Œ©7 �Œt7 �Œ87 �Œµ7 �Œ
7 �Œà7 �ŒÌ7 �ŒV7 �Œ$7 �Œ¼# 1 sw Y   �ŒºxY w7 �ŒS# 1 sw Y   �ŒSxY w# tà        $ r­ �t‡        |«      }_�t‰        |�j                   |�jŠ                  |�jŒ                  |�jŽ                  |�j�                  |�j’                  |�j”                  |_|�j–                  |�j˜                  �t›        |�j˜                  ||||¬¡«      ƒ d {  –—†7  ¬¢«      }^Y �Œw xY w7 �Œ¶7 �ŒI# 1 sw Y   �ŒIxY w7 �Œ# t(        $ r1}-�t­        �j®                  |-| |||||¬±«      ƒ d {  –—†7  cY d }-~-S d }-~-ww xY w­w)³Nr   )rh   r  rR  rº   ry   Ú
master_keyrµ   rÏ  r¨   r«   r©   Úuser_custom_authrÆ  r{   Fz*litellm.proxy.auth.pre_db_read_auth_checks)rw   rx   r^   rh  )	rq   rÎ   rs   rt   ru   rv   rh  r^   rx   Úlitellm_key_header_name)rx   Úcustom_litellm_key_header_namerª   z)litellm.proxy.auth.enterprise_custom_auth)rx   rÎ   ré  Úenable_post_custom_auth_checks)r¥   rx   rw   r^   rª   Tr,  )r^   rh   ©Úcurrent_route©Ú	user_roleÚenable_oauth2_authÚenable_jwt_authr  )r  r  rd   )Úpremium_userz=Oauth2 token validation is only available for premium users. ró  )Úmessager   Úparamr'  Úenable_oauth2_proxy_authz
is_jwt: %sz(JWT Auth is an enterprise only feature. )r¶  r  r¨   r©   rª   r«   rÒ   )r  Údefault_value)rš   r¨   r©   r®   rª   r«   Ú
user_emailz.JWT mapped-key user_email backfill skipped: %sz#litellm.proxy.auth.jwt_auth_builder)rw   rh   rÎ   r  r^   r¨   r©   r«   rª   r|   Úrequest_methodÚis_proxy_adminr¿   Úteam_objectrš   rø  Úuser_objectr  rŒ  Úteam_membershipr¶  rž  )rÎ   rð  rš   rø  r¿   Ú
team_aliasÚteam_tpm_limitÚteam_rpm_limitr¢   Úteam_metadatarŒ  r  rª   r¶  rÎ   rþ  rÿ  r   r¢   rð  Úuser_tpm_limitÚuser_rpm_limitr›   Úteam_member_rpm_limitÚteam_member_tpm_limitr  )r‹  rá   r  r¨   r©   rª   r«   rB  r¿   rš   rŒ  r  r~   )r$   ©r€   ry   z2Skipping all budget checks for zero-cost model: %s©Ú
project_idr¨   r©   r«   r…   ©r¥   rµ   r¶   )rx   r^   rh  rÎ   )rÎ   rð  rª   )rð  rª   zNo api key passed in.z=Malformed API Key passed in. Ensure Key has `Bearer ` prefix.z
/user/authÚallow_user_authz)'allow_user_auth' not set or set to Falser)  ©Úraw_end_user_idr¨   r©   rª   r«   r^   z&litellm.proxy.auth.get_end_user_object)r  r¨   r©   rª   r«   r^   r=  r  ©Úget_default_end_user_budget©r¨   r©   rª   ú%Unable to find user in db. Error - %sz-litellm.proxy.auth.get_key_object_check_cache)rª   r«   Úcheck_cache_onlyr¡  zapi key not found in cache.zsk-ÚEXPERIMENTAL_UI_LOGIN©Útzinfo)r¢  r©   r«   ú4Authentication Error - Expired Key. Key Expiry time ú and current time rj  ©rô  r   r'  rõ  r>  )r¿   r¨   r©   rª   r«   r  Úteam_r»  z0Master key must be a valid string. Current type=)r²   rð  rÎ   rª   Úvalid_token_dictr^   rÐ  )r¢  Úuser_api_key_objr©   r«   zTried to access route=z, which is only for MASTER KEYzNo connected db.i�  é   é   z****éüÿÿÿz'LiteLLM Virtual Key expected. Received=z, expected to start with 'sk-'.zZlitellm.proxy.proxy_server.user_api_key_auth(): Warning - Key is not a string. Got type={}ÚNonez)litellm.proxy.auth.get_key_object_from_dbr   i‘  Ú401zLAuthentication Error, Invalid proxy server token passed. Received API Key = z, Key Hash (Token) =zC. Unable to find token in cache or `LiteLLM_VerificationTokenTable`r  r  z=Key is blocked. Update via `/key/unblock` if you're an admin.©r¥   rw   r^   rx   rº   ry   z"litellm.proxy.auth.get_user_objectr­   z’litellm.proxy.auth.user_api_key_auth.py::user_api_key_auth() - Unable to get user from db/cache. Setting user_obj to None. Exception received - %sÚscim_activezUser=zG has been deactivated via SCIM. Keys owned by this user cannot be used.)r¿   rš   )r9  Ú
model_type)rš   r¿   Úlitellm_budget_table)rF  Úincludeé   )r9  r{  r"  rŸ  )Úget_current_spendzspend:team_member:rx  )Úcounter_keyÚfallback_spendr  z%Budget has been exceeded! TeamMember=z Current cost: z, Max budget: )Úcurrent_costr  rô  Úentity_typeÚ	entity_idz=Checking if token expired, expiry time %s and current time %sz litellm.proxy.auth.budget_checks)r¥   r«   r²   ©r¥   rµ   r¸   rw   rx   rº   ry   ©r  r  r€   )r¿   z"litellm.proxy.auth.get_team_object©r¿   r¨   r©   rª   r«   rå  )r¿   r  Úsoft_budgetrK  r  r  Úblockedr¶   r•  rã  Úobject_permissionz)litellm.proxy.auth.get_global_proxy_spendrT  )r  rK  r  rš   r¿   rU  rV  rW  zInvalid API key)r+  z$Invalid API key, no token associated)Úexclude_noner  Úbudget_throttle_pctÚend_user_object_permissionz!Invalid proxy server token passed)r²   rÎ   rª   r  r^   rÐ  ©r³   rx   rw   r^   rª   rÎ   Úresolved_identityr‹   )ØrÔ  rh   r  rR  rº   ry   rè  rµ   rÏ  r¨   r«   r©   ré  rÇ  rÈ  r   rÉ  r   rÊ  rÆ  r¯   r8   r   Útracer<   rÄ   rs  Úget_api_key_from_custom_headerr×  r\   rƒ   r–   Úmodel_validaterj   Ú_run_post_custom_auth_checksr„   rm   ry  Úpublic_routesr{  r=   rd  ÚINTERNAL_USER_VIEW_ONLYÚis_jwtr  rH   Úis_llm_api_routeÚis_info_routeró  rÅ   ÚCommonProxyErrorsÚnot_premium_userrà  Ú
auth_errorr   ÚHTTP_403_FORBIDDENrB   Úcheck_oauth2_tokenrC   r   r°   r  r‹  Úoidc_userinfo_enabledÚget_oidc_userinfoÚauth_jwtrÄ  r  r¶  rš   rø  Úget_user_emailÚget_user_idr0   r‡  r>   Úauth_builderrL   Ú_get_request_methodr«  rB  r…  r¬  re  rþ  r  r  r¶   r•  rð  ÚINTERNAL_USERr±   Úsafe_get_team_member_rpm_limitÚsafe_get_team_member_tpm_limitr1  Úteam_object_permissionrµ  rˆ  rá   r›   r   Úlitellm.proxy.auth.auth_checksr$   r­  r  r.   Úproject_metadataÚproject_aliasr¹   r   r†   rƒ  r   r6   r2   r+   r=  r#  r  Úmax_end_user_budget_idr  rÃ   rF   r®  r¯  r¤  Úvia_virtual_keyr   rÖ   rZ   r   Úget_key_object_from_ui_hash_keyÚexpiresÚfromisoformatr  Ú	utcoffsetr×   r"   Úexpired_keyÚHTTP_401_UNAUTHORIZEDr5   r?  rª   r4  r¿   Ú
UI_TEAM_IDr/   Úlast_refreshed_atÚ__dict__ÚitemsÚ
__fields__ÚsetattrÚsecretsÚcompare_digestr   Ú_return_user_api_key_auth_objr   r\  r]  r   Úmaster_key_only_routesÚno_db_connectionr1  r?   Ú_JWT_AUTH_DISABLED_HINTrª  Úformatr'  rô  r  r  r  Ú,_update_key_budget_with_temp_budget_increaser0  Ú&_enforce_key_and_fallback_model_accessrË   Úteam_member_spendrS   rÀ  ÚLiteLLM_TeamMembershiprY   ÚtableÚ
find_firstÚ
model_dumpr  r&  rZ  ÚTEAM_MEMBERr&   r'   r(   rÍ   r  Úis_end_user_within_model_budgetr   r§   ÚLiteLLM_TeamTableCachedObjÚteam_max_budgetÚteam_soft_budgetÚ
team_spendrÿ  r   Úteam_blockedr  Úteam_object_permission_idræ  r   rQ  rY  r[  r^  Úpopr3  Úupdater3   Ú_handle_authentication_error)erx   rÎ   rs   rt   ru   rv   rw   rq   rh   r  rR  rº   ry   rè  rµ   rÏ  r¨   r«   r©   ré  rª   rÐ  r^   r¥   Úcustom_auth_api_keyrh  ro  rë  ÚresponseÚ	validatedrñ  rò  r=  Úroute_jwt_to_oauth2Úshould_apply_override_oauth2Úshould_apply_global_oauth2ró  Údo_standard_jwt_authÚpending_auto_registerr¶  Úresolve_resultÚmapped_claimsÚmapped_user_emailÚmapped_jwt_user_idÚmapped_user_objr³   Úresultrú  r¿   rû  rš   rø  rü  r  rŒ  rý  r�  r€   Úskip_budget_checksr$   Ú_jwt_project_objÚ_end_user_objectr  r  r  Údefault_budgetÚcurrent_timeÚexpiry_timeÚteam_objÚteam_obj_dictÚkr÷   Ú
field_nameÚis_master_key_validÚ_user_api_key_objÚ_masked_keyÚ_hintÚabbreviated_api_keyr²   r  Ú_user_idÚ_team_idÚ
_cache_keyÚteam_member_infoÚ
_db_memberÚteam_member_budgetr&  rj  Ú
_entity_idÚmax_budget_per_modelÚcurrent_modelÚcurrent_modelsr¸   Úend_user_mmbÚ	_team_objÚtoken_team_modelsÚ_project_objr_  rB  Ú	call_infoÚvirtual_key_auth_objse                                                                                                        re   Ú_user_api_key_auth_builderr§  ­  sÐ  è ø€ ÷÷ ÷ ó ð %)Ðô   §¡Ð/DÀdÓKÒiÌxÏ|É|Ô\d×\hÑ\hÓOi€JðØ,6ˆ�‰Ô)ô *°'Ô:€EØ)-€KØ %ÐðY
Ü�\‰\ÐFÓGñ 	Ü)Ø)ØØô÷ ð ÷	ð <L×;OÑ;OÐPhÐjnÓ;oÐä!,Ø&?ØØ!5Ø%=Ø,KØ/Ø#9ØØô
"
Ñˆ�ð 1A×0DÑ0DÐE^Ó0_Ð&Ø)Ð5Ü4ØØ/MôˆGð
 !Ð,ô 6°gÔ>Ü& w§}¡}Ð6HÈ$ÓOÐô "Ð-Ü—‘ÐIÓJñ Ü!7Ø#¨WÐGWô"÷ �÷ð Ð#¬
°8¼^Ô(LÜ*×9Ñ9¸(ÓC�	Üœ7Ð$DÀeÔLÜ&BØ$-Ø 'Ø%1Ø#Ø)9ô'÷ !�Ið !Ð ØÐ%¬*°X¼sÔ*CØ"�Ø&*Ñ#ØÐ)Ù-°gÀwÔO×OˆHÜ&×5Ñ5°hÓ?ˆIÜ”wÐ @À%ÔHÜ">Ø )Ø#Ø!-ØØ%5ô#÷ �	ð Ðð	ô 3¸ÐQaÕbØ”]×0Ñ0×6Ñ6Ñ6Ô:ZÐinÕ:oô "Ô,<×,TÑ,TÔUÐUð %5×$8Ñ$8Ð9MÈuÓ$UÐY]Ð$]ÐØ!1×!5Ñ!5Ð6GÈÓ!OÐSWÐ!WˆÙ6E�×#Ñ#¨'Ð#Ô2È5ˆð %ÒuÔ)MÐT[ÐitÔ)uÐð
 /Bò /
Ü×(Ñ(¨uÔ5Ò_¼×9RÑ9RÐY^Ô9_ð 	%ð -?ò -
Ü×(Ñ(¨uÔ5Ò_¼×9RÑ9RÐY^Ô9_ð 	#ñ '©vÑ:VÝ?à 4Ñ'Ü$Ø[Ü'×8Ñ8×>Ñ>ñ?ä(×3Ñ3Ø(Ü×2Ñ2ôð ô '×9Ñ9ÀÔH×HÐHà×ÑÐ :¸EÓBÀdÑJÜ4¸WÔE×EÐEà×ÑÐ 1°5Ó9¸TÒAØ ×'Ñ'¨gÐ'Ó6ˆFÜ ×&Ñ& |°VÔ<ÚÝCà tÑ+Ü(Ø"JÔK\×KmÑKm×KsÑKsÐJtÐ uÜ,×7Ñ7Ø,Ü#×6Ñ6ô	ð ð (,Ð$ØEIÐ%Ø×.Ñ.×FÑFÑRð #×2Ñ2×HÒHÑQWØ+6×+HÑ+HÈwÐ+HÓ+W×%W™
à+6×+?Ñ+?ÀgÐ+?Ó+N×%N˜
ä2MØ#-Ø$/Ø&3Ø+=Ø)9Ø*;ô3÷ -�Nô " .´.ÔAØ&4˜Ø"-×"3Ñ"3Ò"9°r˜Ø1;˜Ô.Ø/4Ð,à&×.Ñ.Ð:¸{×?UÑ?UÐ?]Ø,6Ò,<¸"˜MØ0;×0JÑ0JÐQ^ÐnrÐ0JÓ0sÐ-Ø8C×8OÑ8OÐVcÐswÐ8OÓ8xÐ.Ø0Ð<ÐASÐWb×WjÑWjÒAjð!\ÜCRØ0;×0CÑ0CØ6CØ;MØ7<Ø9IØ:KØ3DôD&÷ >& Oð (7Ð'BØAP×A[ÑA[¨Õ(>Ü# NÔ4HÔIð 1?Ð-ò (ÜŸ™Ð&KÓLñ Ü.<×.IÑ.IØ)5Ø-=Ø$+Ø(3Ø"'Ø*7Ø/AØ.?Ø-=Ü,EÀgÓ,NÜ+6×+JÑ+JÐSZÔ+[ô/÷ )˜÷ð -3Ð3CÑ,D�NØ%+¨IÑ%6�GØ)/°Ñ)>�KØ%+¨IÑ%6�GØ(.¨|Ñ(<�JØ)/°Ñ)>�KØ"(¨Ñ"7�KØ$*¨8Ñ$4�FØLRÏJÉJÐWhÐjnÓLo�OØ!'§¡¨L¸$Ó!?�Já%ð 1Ð<Ø"4×"DÑ"DØ$9×$CÑ$CÜ&?Ø$/×$?Ñ$?×$]Ñ$]ð #Eó #÷ ð ô
  .Ø$(Ü&6×&BÑ&BØ$+Ø'1Ø$+ØBMÐBY¨×(>Ò(>Ð_cØEPÐE\¨K×,AÒ,AÐbfØEPÐE\¨K×,AÒ,AÐbfØ?JÐ?V¨×);Ò);Ð\^ØCNÐCZ¨;×+?Ò+?Ð`dØ#)Ø(3Ø-=Ø'1ô ð ô" #1ò #Ù $ð#á 'ð#ð ?JÐ>U K×$:Ò$:Ð[_øð#ð BMÐAX¨×(=Ò(=Ð^bøð	#ð
 BMÐAX¨×(=Ò(=Ð^bøð#ð <GÐ;R [×%7Ò%7ÐXZøð#ð  +Ð6¸;×;PÑ;PÐ;\ô -¨[×-BÑ-BÔCä!1×!?Ñ!?øð#ñ !(ð#ñ $.ð#ñ  &ð#ñ *:ð#ñ  %0ð!#ð" BMÐAX¨×(=Ò(=Ð^bøð##ð$ BMÐAX¨×(=Ò(=Ð^bøð%#ð& P[ÐOf¨{×/KÒ/KÐlpøð'#ð* Q`ÐPk˜O×JÑJÔLÐquøð+#ð0 Q`ÐPk˜O×JÑJÔLÐquøð1#ð4 @KÐ?V {×';Ò';Ð\`øð5#ñ6 $.ð7#�Kð< :EÐ9P˜×5Ò5ÐVZð  Ô6ð -Ð8¸]Ð=VÜ7QØ4I×4UÑ4UØ(=×(IÑ(IØ(3Ø*7Ø/AØ-=Ø.?Ø&;×&EÑ&EØ$+Ø$+Ø#)Ø(3ô8÷ 2˜ð +Ð6Ø9C˜OÔ6Ø9C˜OÔ6ð ALÐ@W × <Ò <Ð]að ,ÔAð +:˜KØ&1×&7Ñ&7Ò&=¸2˜Gô <Ø%1Ø#Ø 'Ø#-ô	�Eð */Ð&ØÐ(¨ZÐ-CÝVá-@ÀuÐYcÔ-dÐ*Ù-Ü0×5Ñ5Ð6jÐlqÔrð (,Ð$Ø"×-Ñ-Ð9Ü1CØ'2×'=Ñ'=Ø*7Ø/AØ.?ô	2÷ ,Ð(ð ,Ð7Ø;K×;TÑ;T˜KÔ8Ø8H×8VÑ8V˜KÔ5ñ .Ü6Ü(,¬^¸[Ó(IØ5MÜ#EÜ&EØ1=Ø*/Ø,3Ø/9ô	'"ô$ô÷ ð ô  ¤°Ó<Ð<ñ #ÜWØØØ'=Øô	÷ ˆHô ˜(¤CÔ(Ø"‘Ü˜H¤nÔ5Ø�ØÐÜ˜'¤3Ô'Ü%Ø#Ü.×<Ñ<Ø%5ôð ô &Ü.×<Ñ<Ø%5ôð ð ˆ_ÜÐ3Ó4Ð4Ø˜Š]äÐ[Ó\Ð\à�LÒ Ø×#Ñ#Ð$5°uÓ=ÀÑEÜ%Ó'Ð'ä#Ü &× 9Ñ 9ØFôð ð  ÐØ!#ˆä!BÀ<ÔQjÐkrÓQsÓ!tˆÜ<Ø+Ø'Ø1Ø-Ø/Øô
÷ 
ˆñ ð(WØ1<� Ñ.ä—\‘\Ð"JÓKñ Ü-@Ø$/Ø&3Ø+=Ø)9Ø*;Ø#ô.÷ (Ð$÷ð $Ð/Ø>N×>cÑ>c�OÐ$:Ñ;Ø'×<Ñ<ÐHÜ?Ø,;Ø(8×(MÑ(MØ(3öô
 ×3Ñ3Ð?õñ 3NØ&3Ø+=Ø)9ô3÷ -�Nð
 &Ð1Ü?Ø,;Ø(6Ø(3õð Ðð#Ü—\‘\Ð"QÓRñ 	Ü"/×"BÑ"BÜ+Ø)Ø.Ø-=Ø.?Ø-1ô÷ "™'¬z¸'Ó/B˜'ÓC÷Dó#�K÷	ô ˜k¬>Ô:Ø26�KÔ/ð Ð#Ø×*Ò*¨5Ô1Ý#Ð$;Ó<ÀEÑIå4×TÒTÐU\Ó]�ð Ñ#Ü˜;¬Õ7Ø×%Ñ%Ô)9×)EÑ)EÓEà×"Ò"Ñ.Ü'Ÿ|™|¬H¯L©LÓ9�Ü˜k×1Ò1´8Ô<Ø"-×"5Ò"5‘Kä"*×"8Ò"8¸×9LÒ9LÓ"M�KØ×%Ò%Ð-°×1CÒ1C×1MÒ1MÈkÓ1ZÐ1bØ"-×"5Ò"5¼X¿\¹\Ð"5Ó"J�KØ Ò-Ý2Ü%/°Ó%8Ø+=Ø*;ô÷ ð ô
 )Ø"VÐWbÐVcÐcuð  wCð  vDð  !EÜ,×8Ò8Ü#×9Ò9Ý0¸ÔAô	ð õ BØ'¸ôˆKð ,<ˆKÔ(ØÐ+Ø9I×9[Ñ9[�Ô6àÐð Ð#Ü˜;¬Ô7Ø×#Ò#Ð/Ø×#Ò#¥zÒ1ð(ÝDSØ'×/Ò/Ø"/Ø'9Ø%5Ø&7Ø%)ôE÷ ?�ð ×.Ò.Ð:Ø#×5Ò5ÐAØ ×2Ò2°[×5RÒ5RÒRà+3×+<Ò+<�Mà -× 3Ò 3Ó 5ò @™˜˜1Ø',¨Q¨C [˜
Ø%¨×)?Ò)?Ò?Ý# K°¸QÕ?ð@ð	(Ý")×"8Ò"8¸À*Ó"MÐô
 ˜*¤cÔ*ÜØØJÍ4ÐPZÓK[ÐJ\Ð]Ð^ôð ñ
 õ
 'DØÜ*×6Ñ6Ý6Ø!1ð"Ø%ð"àÐ7ñ"ð Ø%ô'÷ !Ðõ ×ÒÝ!Ü!+¨JÓ!7Ø%6Ø'9Ø&7ô	ôõ !HØ-¸ô!Ðð 15ÐÔ-à$Ð$ð ”M×8Ò8×>Ñ>Ñ>ÜÐ4°U°GÐ;YÐZÓ[Ð[ð
 Ð!ä Ø*Ü$×5Ò5ØØô	ð ð ÑÜ˜'¤3Ô'ÝKNÈwË<ÐZ[ÒK[¨°°¨ }°D¸ÀÀ¸¸Ñ%GÐag�Ø×)Ò)¨%Ô0Ù;JÍz×O`ÑO`ÐgnÕOoÖ3Ðuw�EÜ'Ü$*×$@Ò$@àEÀkÀ]ð S<Ø<A¸7ðDôð ô ×&Ò&Øp×wÒwØ)0Ð)<�˜WœÀ&óôõ
 *<ÀGÔ)LÐØ×!Ò! %Ô(Ü$¨7Ô3�ðÜ—\‘\Ð"MÓNñ Ü"/×"BÑ"BÜ+Ø)Ø.Ø-=Ø.?ô	÷
 "™'¨w˜'Ó7÷8ó#�K÷ð '6×&9Ñ&9¸-Ó&HˆKÔ#Ø-<×-@Ñ-@ÐAUÓ-VˆKÔ*Ø-<×-@Ñ-@ÐAUÓ-VˆKÔ*Ø/>×/BÑ/BÐCYÓ/ZˆKÔ,àÐ"ÝFÀ{ÓSˆKà-1ˆØ!#ÐØÑ"ð ×"Ò" dÑ*ÜÐ _Ó`Ð`Ý8Ø'Ø)ØØØ-Ø%ô÷ ð ð ×"Ñ"Ð.ð$ÜŸ™Ð&JÓKñ Ü)8Ø$/×$7Ñ$7Ø*7Ø/AØ+0Ø-=Ø.?ô*÷ $˜÷ð  Ð'ð 9A×8QÑ8Q�KÔ5ð Ð(Ü" 8×#4Ñ#4µdÔ;Ø ×)Ñ)×-Ñ-¨mÓ<ÀÑEä#Ø × 3Ñ 3Ð4Ð4{Ð|óð ô
 4Ø)ØØØ%ô	ˆEð "'ÐØÐ  ZÐ%;ÝNá%8¸uÐQ[Ô%\Ð"Ù%Ü(×-Ñ-Ð.bÐdiÔjò &¨+×*GÒ*GÑ*SØ"-×"5Ñ"5�Ø"-×"5Ò"5�Ø Ñ,°Ñ1EÈ(ÑJ^Ý(FÈxÐaiÔ(j�Jà-?×-OÒ-OØ&Ý#9ð .Pó .÷ (Ð$ð (Ð/å2JÈ=Ó2Y×2_Ò2_×2jÒ2jà+3Ø+3ñ#ð &<¸TÐ$Bð 3kó 3÷ -˜
ð &Ð1Ý/EÑ/`È
×H]ÒH]ÓH_Ñ/`Ð,Ø"4×"DÑ"DØ$.Ø&6Ý+AØ$%ð	 #Eó #÷ ð ð (Ð3Ð8H×8]Ñ8]Ð8iØ4D×4YÑ4Y×4dÒ4dÐ*Ø-Ð9Ð>PÐSTÒ>TåTà0;×0MÒ0MÐ-Ø*×2Ñ2Ð>À;×CVÒCVÐCbÙ:KØ2DÀ[×EXÑEXÐDYÐYZÐ[f×[nÒ[nÐZoÐ0pØ3DØ/Aô;"÷ 5"Ð 1ð
  1Ð3EÒEØ7B×7JÑ7JÐ6KÈ1È[×M`ÒM`ÐLaÐ4b 
Ü&-×&AÑ&AØ1BØ/Aà*OÐPZÈ|ð \9Ø9JÐ8KÈ>ÐZlÐYmð)oõ 1C×0NÒ0N×0TÑ0TØ.8ô	'"ð 	!"ð ×"Ò"Ñ.Ü'Ÿ|™|¬H¯L©LÓ9�Ü˜k×1Ò1´8Ô<Ø"-×"5Ò"5‘Kä"*×"8Ò"8¸×9LÒ9LÓ"M�KØ×%Ò%Ð-°×1CÒ1C×1MÒ1MÈkÓ1ZÐ1bØ"-×"5Ò"5¼X¿\¹\Ð"5Ó"J�KÜ$×*Ñ*ØSÐU`Ðbnôð  Ò-ä(Ø"VÐWbÐVcÐcuð  wCð  vDð  !EÜ,×8Ò8Ü#×9Ò9Ý0¸ÔAô	ð ò &Ü—\‘\Ð"DÓEñ Wõ >Ø$/Ø*;Ø!)ô÷ ð ô #×3Ñ3¸%Õ@Ý;Ø(3Ø.?Ø%-ô÷ ð õ 9Ø$/Ø*;Ø!)ô÷ ð ð 3>×2NÑ2NÐ(Ü$CØ%1Ø#Ø 'Ø#-ô	%�Mô &HÈmÔ%\�Nð -Ð8Ü&Ð';½TÔBÝÐ 4Ó5¸Ò9Ø)Ð5Ù*Ø'×-Ñ-Ð9ð +9ò 	˜JÝ"GØ,7Ø9QØ+5Ø-9Ø(/Ø/=Ø+5ô#÷ ñ ð	ô )HØ)5Ø"'Ø$+Ø'1ô	)˜ô *LÐR_Ô)`˜ñ &Ü6Ø(3Ø5MØ#1ô÷ ð ð +6×*OÒ*O�Là$Ð0Ü& |µTÔ:Ý Ó-°Ò1Ù*Ø'×3Ò3Ð?à*8ò ˜JØ":×"ZÒ"ZØ,7×,CÒ,CØ:FØ&0ð #[ó #÷ ñ ð÷eWðt ×"Ò"Ð.ðØ"×*Ò*­jÒ8Ý/½
ÔCÐCÜŸ™Ð&JÓKñ Ý*9Ø$/×$7Ò$7Ø*7Ø/AØ-=Ø.?ô+÷ %˜	÷øð< !�	àÐ$Ø5>×5PÑ5P�Ô2ð -6×,>Ñ,>�Õ)à59�Ô2ð  ˆLØ×%Ñ%Ð1Ü%7Ø*×5Ñ5Ø"/Ø'9Ø&7ô	&÷  �ð  Ð+Ø3?×3HÑ3H�KÔ0Ø0<×0JÑ0J�KÔ-à!%ÐÜ×!Ò! AÒ%¨-Ð*CÝ#?�	Ü—\‘\Ð"MÓNñ Ý/ZØ"+Ø+=Ø&3ô0÷ *Ð&÷ð &Ð1Ý'/Ø)×/Ñ/Ø0Ü#*×#5Ò#5Ø 8Ø +× 3Ò 3Ý$6×$<Ò$<ô(�Iõ ×'Ò'Ø)×7Ò7Ø!/Ø&/ð 8ó ôð Ð"Ü# CÐ0AÔBÐBØ× Ñ Ð(Ü# CÐ0VÔWÐWØ!×'Ñ'ˆGà*×5Ò5À4Ð5ÓHÐØ× Ò  ¨$Ô/ð ×.Ò.Ð:Ø:E×:YÒ:YÐ Ð!6Ñ7àÐ+Ø ×'Ò'¨Ô8ØAQ×AcÑAcÐ Ð!=Ñ>ð ÐäÐ?Ó@Ð@ØÐ'Ý0MØ!ØØ!1Ø!1ØØ%ô1÷ +Ð ð 48Ð Ô0Ø'Ð'ð (øôW  ò Úðúðù÷	ñ 	úðJù÷ñ úð!ùð Pùðùðv Iùð Fùð. &Xùà%Nùð-ùð(>&úô (1ò !tÜ$8×$>Ñ$>Ð?oÐqr×$sÒ$sûð!túð)ù÷ñ úðFùð|2ùðZ,ùð&ùð$ùðT
ùð(ù÷ñ úð.-úô ò WÜ˜a¤×!<Ñ!<Ô=Ø�GÜ$×*Ñ*Ð+RÐTU×VÒVûðWúðDù÷	ñ 	ûô" ò #Ü×$Ñ$Ð%BÔCØ"“ð#úð<ùð8?úô( ò (Ü×$Ñ$ Q×'Ò'ûð(ûô
 ò 	(Ø"'Óð	(úð!ùðL8ù÷ñ ûô "ò Ø—6’6˜S’= A§F¢F¨e¢OØ"nð  pCð  oDð  DXð  Y`ð  Xað  adð  !e�A”IØ�ûðúðBùð$ù÷ñ ûô !ò $Ü"×(Ñ(ð mØôð  $–Hûð$úðX(ùð-ùðùð5"ùðXùðùðùð4ùð,ùð ù÷gWñ Wúð~%ù÷ñ ûô %ò Ý/AÀ+Ó/NÐ%Ý :Ø +× 3Ò 3Ø#.×#>Ò#>Ø$/×$@Ò$@Ø)×4Ò4Ø"-×"<Ò"<Ø"-×"<Ò"<Ø +× 8Ò 8Ø0Ø!,×!:Ò!:Ø-8×-RÒ-RÝ0`Ø1<×1VÒ1VØ*7Ø/AØ-=Ø.?ô1÷ +ð +ô!“IðúðH ùð*ù÷ñ úðb+úô ò 	
Ý3×PÒPØØØ%ØØ-ØØ)ô
÷ 
ð 
õ 	
ûð	
üs”  ‚AAq"ÁAd Á/Aq"Â Ap% ÂAd'Â'Ad$Â(Ad'Â,BAp% Ä<Ad7ÅAd4ÅAd7ÅAAp% Æ&AeÆ'Ap% Æ,Aq"Æ-&Ap% ÇAeÇ=Ap% ÈAe
ÈAp% ÈAq"ÈAAp% É'Aq"É(D"Ap% Î
AeÎAp% ÎAq"Î#Ap% Î2AeÎ3Ap% Î6Aq"Î7CAp% ÒAeÒAp% Ò*AeÒ+Ap% ÓAeÓBAp% Õ	Ae Õ(AeÕ)Ae Õ->Ap% Ö+AAf×,Af×-Af×1BAp% ÚAfÚA0Ap% Û3Aq"Û4EAp% áAfáB"Ap% ã/Af"ã0A Ap% åAf%åAp% å$Aq"å%Ap% å9Af(å:(Ap% æ"Aq"æ#-Ap% çAq"çAp% ç+Aq"ç,?Ap% è+Aq"è,AAp% é4Af+é5Ap% é<Ag êAf1ê+Af.ê,Af1ê0A"Ag ìAf>ìAg ì'Ap% ì*Ah ì?<Ahí;Ah

í<AhîAh î#EAp% ó4Aió5A+Ap% õ Aq"õ!4Ap% ö Ai ö6Aiö7A1Ai ø)Ai ø:Ai3 ùAAp% ú.Ajú/AAp% û7Aq"û8D2Ap% Á@+Aj ÁA 2AjÁA2Aj
ÁA3AjÁA;Aj ÁBBAp% ÁDAkÁD Ap% ÁD1Ak, ÁEAkÁE%AkÁE&AkÁE*Ak, ÁE2D Ap% ÁI2AlÁI37Ap% ÁJ*AlÁJ+>Ap% ÁK)Al!ÁK*BAp% ÁM/Al$ÁM0FAp% ÁT
Al9ÁTAl'ÁT,Al9ÁU
Al*ÁUAl9ÁU!Al-ÁU"A8Al9ÁWAl0ÁW4Al9ÁXAl3ÁXA*Al9ÁY:Al6ÁY;Al9ÁZAp% ÁZ<Am Á[ Am	Á[3AmÁ[4Am	Á[8Am Á\ AAp% Á]ApÁ]AAp% Á^6ApÁ_	ApÁ_
ApÁ_D7Ap% ÁdAp"ÁdAp% ÁdAq"Ád	Ad!ÁdAq"Ád Ad!Ád!Aq"Ád$Ad'Ád'Ad1Ád,Ap% Ád4Ad7Ád7AeÁd<	Ap% ÁeAp% Áe
Ap% ÁeAp% ÁeAp% ÁeAp% ÁeAp% ÁeAp% ÁeAe Áe	Af	Áe(AfÁe>Ap% ÁfAf	Áf	Ap% ÁfAfÁfAfÁf	Ap% ÁfAp% Áf"Ap% Áf%Ap% Áf(Ap% Áf+Ap% Áf.Af1Áf1Af;Áf6	Ag Ág	AhÁg
2AhÁg<Ap% ÁhAhÁhAp% Áh
AhÁhAhÁhAh Áh Ah>Áh:Ap% Áh=Ah>Áh>Ap% ÁiAi Ái	Ai0ÁiAi+Ái%Ap% Ái+Ai0Ái0Ap% Ái3AjÁi>Ap% ÁjAjÁjAp% ÁjAjÁjAjÁjAj Áj	AkÁj!0AkÁkAkÁkAp% ÁkAkÁkAk)Ák$Ak, Ák,	AlÁk5AlÁlAp% ÁlAlÁlAp% ÁlAp% Ál!Ap% Ál$Ap% Ál'Al9Ál*Al9Ál-Al9Ál0Al9Ál3Al9Ál6Al9Ál9AmÁl>Ap% ÁmAm	Ám	AmÁmAm ÁmB'ApÁo=Ap Áo>
ApÁpAp% ÁpApÁpAp% ÁpApÁpApÁp	Ap% Áp%	AqÁp.!AqÁqAqÁqAqÁqAqÁqAq"ÁqAqÁqAq"Úlabelc              ƒ   ó@  K  — 	 |ƒ d{  –—† S 7 Œ# t         t        t        j                  f$ r1}t	        j
                  d| t        |«      j                  |«       ‚ d}~wt        $ r5}t	        j
                  d| t        |«      j                  |«       Y d}~yd}~ww xY w­w)a   Run an awaitable and return its result. Re-raises authentication /
    authorization failures (HTTPException, ProxyException,
    BudgetExceededError) so they propagate to the caller.
    Other exceptions (e.g. transient DB errors fetching context) are
    swallowed with a debug log and ``None`` is returned so
    ``common_checks`` can still run against whatever limits are recorded
    directly on the token.
    Nz*centralized auth: %s fetch failed (%s: %s)z-centralized auth: %s fetch swallowed (%s: %s))	r   rÅ   rj   rÃ   r   r°   r   r“   r¯   )r¨  Ú	awaitabler³   s      re   Ú_safe_fetchr«  ï  sŒ   è ø€ ðØ�ÐˆùÜœ>¬7×+FÑ+FÐGò Ü×"Ñ"Ø8ØÜ�‹G×ÑØô		
ð 	ûÜò Ü×"Ñ"Ø;ØÜ�‹G×ÑØô		
ô ûðüsB   ‚B„ ‰Š �BŽ �B®,AÁBÁ&+BÂBÂBÂBc                 ó  — | j                   €J ‚t        | «      }t        | j                   | j                  | j                  | j
                  | j                  | j                  | j                  || j                  | j                  ¬«
      S )z®Reconstruct a cached team object from the fields already on the
    UserAPIKeyAuth. Only called when valid_token.team_id is known to be
    non-None (the caller gates on it).)
r¿   r  r/  rK  r  r  r0  r¶   r•  rã  )r¿   r§   rq  rr  rs  rt  rÿ  r   ru  r  rv  )r¥   r£  s     re   Ú_team_obj_from_tokenr­  	  s‚   € ð ×ÑÐ*Ð*Ð*Ü1°+Ó>ÐÜ%Ø×#Ñ#Ø×.Ñ.Ø×0Ñ0Ø×$Ñ$Ø×,Ñ,Ø×,Ñ,Ø×(Ñ(Ø Ø×*Ñ*Ø(×BÑBôð rg   Úlookup_errorc                 óŽ   — | j                   t        k(  ryt        |t        «      ry| j                  ryt        j                  «       S )ag  Whether the token's own team fields may stand in for a team that failed to
    resolve, without widening access.

    The UI dashboard mints every session key against the ``UI_TEAM_ID`` sentinel,
    which by design never has a team row, so a failed lookup for it is not a
    degraded read to be treated with suspicion; it always vouches, exactly as it
    always safely has (these keys are restricted elsewhere to UI-only routes).

    For every other team, a team that is provably gone is a definitive answer,
    not a degraded read, so nothing may stand in for it and no setting may
    override that.

    Otherwise the team's grant is merely unknown. A token carrying one may vouch,
    since replaying a recorded grant cannot widen it and denying every team key
    while the row is briefly unreadable would trade the widening for an outage. A
    token carrying none may not: ``team_models=[]`` reads as every model and
    ``team_blocked=False`` as unblocked. ``allow_requests_on_db_unavailable`` opts
    back out, and is only consulted here because the failure is known by this
    point to be a degraded read.
    TF)r¿   r[  rƒ   r   r¢   rT   Ú&should_allow_request_on_db_unavailable)r¥   r®  s     re   Ú_token_can_vouch_for_teamr±   	  s>   € ð* ×ÑœjÒ(ØÜ�,Ô 1Ô2ØØ×ÒØÜ#×JÑJÓLÐLrg   Úuser_api_key_auth_objc              ƒ   óL
  K  — ddl m}m}m}m}m}m}	m}
m} |t        j                  j                  v st        |¬«      ry|j                  dd«      }|�C|D ]>  }t        |t        «      sŒ|j                  dd«      |k(  sŒ*|j                  d«      d	usŒ> y |€7|j                  d
d«      s%|j                  dd«      s|j                  dd«      sy|�|j                  dd«      sy| j                   }| j"                  }|€.t%        |t'        |«      «      }t)        |||
||	|¬«      ƒ d{  –—† }g }| j*                  �G| j*                  t,        k7  r4|j/                  t1        dt3        | j*                  ||
||	¬«      «      «       n#|j/                  t1        dt5        «       «      «       | j6                  �5|j/                  t1        dt9        | j6                  ||
d||	¬«      «      «       n#|j/                  t1        dt5        «       «      «       | j:                  �3|j/                  t1        dt=        | j:                  ||
|	¬«      «      «       n#|j/                  t1        dt5        «       «      «       |r6|j/                  t1        dt?        |||
||	|| j@                  ¬«      «      «       n#|j/                  t1        dt5        «       «      «       |j/                  t1        dtC        ||
|| jD                  xs d|	¬«      «      «       tG        jH                  |dd	iŽƒ d{  –—† \  }}}}}|||||fD ]$  }t        |tJ        tL        jN                  f«      sŒ$|‚ t        |tP        «      r)| j*                  €d}n:tS        | |«      rtU        | «      }n"|‚| j*                  t,        k(  rtU        | «      n|}t        |tP        «      rdn|}t        |tP        «      rdn|}t        |tP        «      rdn|}t        |tP        «      rdn|}| jV                  €|�|jX                  �|jX                  | _+        | jZ                  t\        j^                  k(  r8ta        | j6                  xs |t\        j^                  |�|jb                  nd¬«      }|�"|jd                  | _3        |jh                  | _4        tk        ||||¬«      }tm        jn                  ||¬«       tm        jp                  ||| ¬«       ts        ||||||||||	| ||¬ «      ƒ d{  –—† }tu        | |||||||||
|	||¬!«      ƒ d{  –—†  y7 �Œò7 �Œ7 Œ+7 Œ­w)"u‹  Run ``common_checks`` once at the ``user_api_key_auth`` wrapper
    boundary, regardless of which ``_user_api_key_auth_builder`` path
    returned. This is the single invariant enforcement point for key
    model-access, budgets, guardrails, org, and vector-store checks.

    Invariants:
    - ``user_custom_auth`` with ``custom_auth_run_common_checks`` unset
      skips the gate â€” matches the existing custom-auth RPS guarantee.
      Custom-auth deployments don't use OAuth2 / DB-fallback paths, so
      the skip does not re-open any bypass.
    - ``PROXY_ADMIN`` tokens still run through ``common_checks`` so
      team-blocked / team-budget / end-user-budget / tag-budget /
      vector-store / tool-allowlist enforcement applies to admin keys
      too. Admin status is honored where the underlying check exempts it
      (``_is_api_route_allowed``, ``organization_role_based_access_check``).
    r   )rh   rR  ry   rè  r¨   r«   r©   ré  rí  Nrh  r  rÒ   ru  Trò  Frñ  rö  Úcustom_auth_run_common_checksr  r½   r.  Úuserr­   Úprojectr  Úend_user©r  r¨   r©   rª   r«   r^   Útoken_end_user_max_budgetÚglobal_spend)rR  r©   r¨   r  r«   Úreturn_exceptionsg        )rš   rð  rK  r~   )rw   r^   )rx   rw   r‰   )rx   Úrequest_bodyrû  rü  Úend_user_objectrh   r_  r^   ry   r«   r¥   rˆ  Úproject_object)r²  rw   r^   ry   rû  rü  r  r½  r¨   r©   r«   rˆ  rh   );rÔ  rh   rR  ry   rè  r¨   r«   r©   ré  ry  r;  r{  r=   rÄ   rƒ   rË   rª   r  r6   rL   r2   r¿   r[  Úappendr«  r/   Ú
_noop_nonerš   r0   r  r.   r+   r  r`  r  r\  ÚgatherrÅ   rj   rÃ   ÚBaseExceptionr±  r­  rŒ  r”  rð  rd  re  ÚLiteLLM_UserTablerK  r•  rQ  rR  Ú_should_skip_budget_checksrU   Ú#pre_seed_litellm_metadata_for_routeÚ apply_client_tag_policy_pre_authr*   Ú#_reserve_budget_after_common_checks)r²  rx   rw   r^   rh   rR  ry   rè  r¨   r«   r©   ré  rh  rq  rª   r  r  Úfetch_corosÚteam_resultÚuser_resultÚproject_resultÚend_user_resultÚglobal_spend_resultÚrrû  rü  r¾  r½  r_  rˆ  Ú_s                                  re   Ú_run_centralized_common_checksrÐ  >	  s�  è ø€ ÷.	÷ 	ó 	ð ”×+Ñ+×1Ñ1Ñ1Ô5UÐdiÕ5jØð %5×$8Ñ$8Ð9QÐSWÓ$XÐØÐ)Ø.ò 	ˆHÜ˜(¤DÕ)¨h¯l©l¸6À2Ó.FÈ%Ó.OÐT\×T`ÑT`ÐagÓThÐptÒTtÙð	ð ÐØ×ÑÐ.°Ô6Ø×ÑÐ 4°eÔ<Ø×ÑÐ :¸EÔBààÐ#Ð,<×,@Ñ,@ÐA`ÐbgÔ,hØà3×DÑDÐð
 (×3Ñ3€KØÐÜ!BÀ<ÔQjÐkrÓQsÓ!tˆÜ<Ø+Ø'Ø1Ø-Ø/Øô
÷ 
ˆð €KØ×$Ñ$Ð0Ð5J×5RÑ5RÔV`Ò5`Ø×ÑÜØÜØ1×9Ñ9Ø"/Ø'9Ø%5Ø&7ôó	õ	
ð 	×Ñœ; v¬z«|Ó<Ô=à×$Ñ$Ð0Ø×ÑÜØÜØ1×9Ñ9Ø"/Ø'9Ø#(Ø%5Ø&7ôó
õ	
ð 	×Ñœ; v¬z«|Ó<Ô=à×'Ñ'Ð3Ø×ÑÜØÜ"Ø4×?Ñ?Ø"/Ø'9Ø&7ô	óõ
	
ð 	×Ñœ; y´*³,Ó?Ô@áØ×ÑÜØÜ#Ø +Ø"/Ø'9Ø%5Ø&7ØØ.C×.WÑ.Wôóõ	
ð 	×Ñœ; z´:³<Ó@ÔAà×ÑÜØÜ"Ø)AØ#5Ø+Ø+×1Ñ1Ò7°RØ"3ôó		
ôô6 �n‰n˜kÐB¸TÑB×BñØØØØØð 	ØØØØðò ˆô �aœ.¬'×*EÑ*EÐFÕGØˆGðô  �+œ}Ô-ð !×(Ñ(Ð0Ø‰KÜ&Ð'<¸kÔJÜ.Ð/DÓE‰KàÐð <Q×;XÑ;XÔ\fÒ;fÔ Ð!6Ô7Ðlwð 	ô 5?¸{ÌMÔ4Z©DÐ`k€Kä˜>¬=Ô9‰¸~ð ô ˜?¬MÔ:‰Àð ô 0:Ð:MÌ}Ô/]¡tÐcvÐà×#Ñ#Ð+°Ð0GÈK×LgÑLgÐLsØ'2×'BÑ'BÐÔ$ð ×&Ñ&Ô*:×*FÑ*FÒFÜ'Ø)×1Ñ1ÒMÐ5MÜ&×2Ñ2Ø'2Ð'>�+×#Ò#ÀCô
ˆð Ð!Ø1?×1HÑ1HÐÔ.Ø.<×.JÑ.JÐÔ+ä :Ø!ØØØô	!Ðô ×@Ñ@Ø!Øõô ×=Ñ=ØØ!Ø/õô ØØ!ØØØ'Ø)Ø-ØØØ+Ø)Ø-Ø%ô÷ 	€Aô  .Ø3Ø!ØØØØØØ'Ø#Ø-Ø+Ø-Ø)ô÷ ñ ðk
ùðN 	Cùð|	øð úsc   ‚A'T$Á*T$Â T$ÂBT$Ä(TÄ)G,T$ÌTÌ4T$ÍF)T$Ó4T Ó5T$ÔT"ÔT$ÔT$Ô T$Ô"T$c               ƒ   ó   K  — y­w)z…Sentinel coroutine for asyncio.gather when a fetch is unnecessary
    (e.g. token has no team_id). Keeps the result tuple positional.Nr‹   r‹   rg   re   rÀ  rÀ  q
  s   è ø€ ð ùr�   rû  rü  rˆ  r½  c              ƒ   ó
  K  — d | _         |	ry |
j                  d«      du rt        j                  d«       y ddlm}  ||||| ||||||||
j                  d«      du |
j                  d«      du ¬«      ƒ d {  –—† | _         y 7 Œ
­w)	NÚdisable_budget_reservationTut  disable_budget_reservation is enabled: skipping optimistic budget reservation. Budget enforcement is read-time only â€” concurrent requests can each pass the spend check before their cost is recorded, so a configured budget may be briefly exceeded under high concurrency. Set disable_budget_reservation to False or remove it to restore hard per-request budget enforcement.r   )Úreserve_budget_for_requestÚapply_user_budget_to_team_keysÚfail_closed_budget_enforcement)r¼  r^   ry   r¥   rû  rü  r¨   r©   r«   r  r½  rÕ  rÖ  )Úbudget_reservationrÄ   r   rª  Ú/litellm.proxy.spend_tracking.budget_reservationrÔ  )r²  rw   r^   ry   rû  rü  r¨   r©   r«   rˆ  rh   r  r½  rÔ  s                 re   rÇ  rÇ  w
  s®   è ø€ ð 04ÐÔ,ÙØØ×ÑÐ8Ó9¸TÑAÜ×$Ñ$ð3ô	
ð 	õñ 6PØ!ØØØ)ØØØ#Ø-Ø+ØØ'Ø'7×';Ñ';Ð<\Ó']ÐaeÐ'eØ'7×';Ñ';Ð<\Ó']ÐaeÐ'eô6÷ 0ÐÕ,ð 0ús   ‚A4BÁ6BÁ7Bc                 óD   — t        | |||¬«      }|�|�t        ||¬«      S y)Nr~   r  F)r   r$   )rw   r^   rx   ry   r€   s        re   rÄ  rÄ  ©
  s7   € ô 3Ø!ØØØô	€Eð Ð˜ZÐ3Ü"¨¸:ÔFÐFØrg   c           	      ó  — t        «       }t        | t        t        |«      |¬«      «      }|j                  rt
        j                  nt
        j                  }t        j                  ||||j                  t        |j                  ¬«      ¬«      S )aî  Project the resolved identity into one per-request Principal, off the key
    object the builder already fetched, and stamp the request network context
    onto it once. X-Forwarded-For is only trusted when the operator configured
    ``trusted_proxy_ranges``; otherwise the direct peer is authoritative.

    credential_ref and a stable subject fallback are always set off the token so
    the Principal can never be anonymous, even for a keyless service-account key
    with no user or alias.)Úuse_forwarded_forÚtrusted_proxy_cidrs)Útoken_id)Úauth_methodÚnetworkÚsubject_fallbackÚcredential_ref)rI   rA   r@   r—   r¶  r4   Ú
BEARER_JWTÚAPI_KEYrF   Ú_principal_from_keyr  rD   )rx   r¥   Úcidrsrß  rÞ  s        re   Ú_resolve_request_principalræ  º
  sw   € ô +Ó,€EÜ,ØÜ¬T°%«[ÈeÔTó€Gð 3>×2HÒ2Hœ×.Ò.Ìj×N`ÑN`€KÜ×,Ñ,ØØØØ$×*Ñ*Ü$¨k×.?Ñ.?Ô@ôð rg   c           
   ƒ   ó°  K  — t        j                  || |¬«       	 t        | |||¬«      ƒ d{  –—†  | j                  €Mddlm	}m
}m} t        |t        |«      «      }	|	�,t        |	||| j                  ||¬«      ƒ d{  –—† }
|
�|
| _        y7 Œ^# t        $ r9}t	        j
                  ||||| j                  || ¬«      ƒ d{  –—†7  cY d}~S d}~ww xY w7 ŒU­w)a3  Authorize an already-authenticated request: disabled-route check, the single
    ``common_checks`` gate (which also reserves budget), and end-user fallback
    resolution. Returns the auth object the exception handler recovered when a check
    failed but the request may proceed anyway, else ``None``.
    )r^   r¥   rx   )r²  rx   rw   r^   Nr5  r   )r¨   r«   r©   r  )rH   Úshould_call_routerÐ  r¯   r3   ry  rª   r  rÔ  r¨   r«   r©   r6   rL   r2   )r²  rx   rw   r^   rÎ   r³   r¨   r«   r©   r  Úresolved_end_user_ids              re   Ú _authorize_authenticated_requestrê  Ò
  s  è ø€ ô ×!Ñ!¨Ð;PÐZaÕbð
Ü,Ø"7ØØ%Øô	
÷ 	
ð 	
ð. ×(Ñ(Ð0÷	
ñ 	
ô "CÀ<ÔQjÐkrÓQsÓ!tˆØÐ&Ü0PØ /Ø+Ø#5Ø!6×!GÑ!GØ"3Øô1÷ +Ð ð $Ð/Ø4HÐ%Ô1ØðU	
ùô ò 	
Ü3×PÑPØØØ%ØØ2×CÑCØØ3ô
÷ 
ð 
õ 	
ûð	
úð4+ús\   ‚CœB ®B¯B ³ACÁ>CÁ?CÂB Â	CÂ)CÃCÃCÃCÃCÃCÃCc              ƒ   óº  K  — t        | «       t        | ¬«      ƒ d{  –—† \  }}t        | ¬«      }	t        d|	› �«      5  	 t	        | |||||||¬«      ƒ d{  –—† }
d|
_        |€%t        |
| ||	|¬«      ƒ d{  –—† }|�|cddd«       S ddd«       t        
t        |t        «      r|j                  d«      nd¬«       t        |	«      |
_        |�t        |
||	¬«      ƒ d{  –—†  |‚	 t        | |
«      | j                   _        |
S 7 Œê7 Œ²# t
        $ r |�|‚‚ w xY w7 Œ¥# 1 sw Y   Œ—xY w7 ŒH# t
        $ r!}t%        j&                  d	|«       Y d}~|
S d}~ww xY w­w)
zC
    Parent function to authenticate user api key / jwt token.
    r{   Nzauth )rx   rÎ   rs   rt   ru   rv   rw   rq   )r²  rx   rw   r^   rÎ   r€   r…   )r‰   rÛ  r^   z8Principal projection at auth seam failed (non-fatal): %s)r×  rÚ  r8   r   r§  r¯   r×  rê  r   rƒ   rË   rÄ   r;   Úrequest_routerâ  ræ  rÈ  Ú	principalr   rª  )rx   rÎ   rs   rt   ru   rv   rq   rw   rÛ  r^   r²  Úrecovered_auth_objr³   s                re   r4  r4    s´  è ø€ ô$ .¨gÔ6ä/YÐbiÔ/j×)jÑ&€LÐ&Ü)°'Ô:€Eô 
�e˜E˜7�OÓ	$ñ #*ð	Ü1KØØØ%9Ø)AØ0OØ"3Ø)Ø*Cô	2÷ 	,Ð!ð" 48ÐÔ0ð  Ð'Ü.NØ&;ØØ)ØØô/÷ )Ðð "Ð-Ø)÷G#*÷ #*ñ #*ôR ØÜ+5°lÄDÔ+Iˆl×Ñ˜wÔ'Ètõô +BÀ%Ó*HÐÔ'àÐ'Ü-Ø3Ø!5Øô
÷ 	
ð 	
ð
 #Ð"ðdÜ"<¸WÐF[Ó"\ˆ�‰Ôð !Ð ðS *køð	,ùô ò 	ð $Ð/Ø*Ð*Øð	úð)ø÷7#*ð #*úð`	
ùô ò dÜ×$Ñ$Ð%_Ðab×cÐcà Ð ûðdüs“   ‚E�Dž!E¿D ÁDÁD
ÁDÁD Á8DÁ9D Â A#EÃ#D,Ã$EÃ+D. ÄEÄ
DÄDÄD Ä D)Ä%EÄ.	EÄ7EÅEÅEÅEr²   r  rÐ  rð  c              ƒ   óº  K  — t        j                  t        j                  «      }t	        j
                  t        j                  t        j                  ||||j                  «       |j                  «       z
  |¬«      «       |xs t        | ¬«      xs t        j                  }|||dœ|¥}	| �V|	j                  | j                  | j                   | j"                  t%        | dd «      t%        | dd «      t%        | dd «      ¬«       | �At'        | ¬«      r5|	j                  t        j(                  ¬«       t*        j-                  |	«      S t*        j-                  |	«      S ­w)	N)ÚserviceÚ	call_typerÐ  Úend_timeÚdurationrª   )r²   )rÎ   rª   rð  rK  r  r±   )r  r  rø  Ú
user_spendÚuser_max_budgetr›   rï  )r   rÉ  r   rÊ  r\  r]  r]   Úasync_service_success_hookr[   ÚAUTHÚ	timestampr#   rd  rL  rx  r  r  rø  rÇ  r%   re  r–   r9  )
r²   rÎ   rª   r  r^   rÐ  rð  rò  Úretrieved_user_roleÚuser_api_key_kwargss
             re   rc  rc  t  sS  è ø€ ô —l‘l¤8§<¡<Ó0€Hä×ÑÜ'×BÑBÜ ×%Ñ%ØØ!ØØ×'Ñ'Ó)¨J×,@Ñ,@Ó,BÑBØ-ð 	Có 	
ô	ð "+Ò!q¬nÀhÔ.OÒ!qÔSc×SqÑSqÐð Ø,Ø(ñ"ð ð	"Ðð ÐØ×"Ñ"Ø#×-Ñ-Ø#×-Ñ-Ø×*Ñ*Ü˜x¨°$Ó7Ü# H¨l¸DÓAÜ")¨(Ð4FÈÓ"Mð 	#ô 	
ð ÐÔ 4¸hÕ GØ×"Ñ"Ü&×2Ñ2ð 	#ô 	
ô ×,Ñ,Ð-@ÓAÐAä×,Ñ,Ð-@ÓAÐAùs   ‚EErë  c                 óˆ  — d}|j                  «       }| j                  j                  «       D ��ci c]  \  }}|j                  «       |“Œ }}}t        j                  d||«       |j                  |«      }|r.t        |¬«      }t        j                  d|t        |«      «       |S t        j                  d|«       |S c c}}w )zË
    Get API key from custom header

    Args:
        request (Request): Request object
        custom_litellm_key_header_name (str): Custom header name

    Returns:
        Optional[str]: API key
    rÒ   z?searching for custom_litellm_key_header_name= %s, in headers=%srj  z9Found custom API key using header: %s, setting api_key=%szCNo LiteLLM Virtual Key pass. Please set header=%s: Bearer <api_key>)	r§  r  r^  r   r°   rÄ   r  r5   r5  )rx   rë  rÎ   r�  r÷   Ú_headersÚcustom_api_keys          re   r8  r8  ¤  sÁ   € ð €Gà%C×%IÑ%IÓ%KÐ"Ø07·±×0EÑ0EÓ0G×H©¨¨1�q—w‘w“y !‘|ÐH€HÑHÜ×ÑØIØ&Øôð
 %ŸL™LÐ)GÓH€NÙÜ#¨NÔ;ˆÜ×"Ñ"ØGØ*Ü˜wÓ'ô	
ð €Nô 	×&Ñ&ØQÐSqô	
ð €Nùó% Is   °B>c                 ó
  — | j                   }d|v rsd|v rot        j                  |d   «      }|j                  € |j	                  t
        j                  ¬«      }|t        j                  t
        j                  «      kD  r|d   S y )NÚtemp_budget_increaseÚtemp_budget_expiryr  )r•  r   rW  r  r×   r   rÊ  rÉ  )r¥   Úvalid_token_metadataÚexpirys      re   Ú_get_temp_budget_increaser  Ç  sy   € Ø"-×"6Ñ"6ÐØÐ!5Ñ5Ð:NÐRfÑ:fÜ×'Ñ'Ð(<Ð=QÑ(RÓSˆØ�=‰=Ð Ø—^‘^¬8¯<©<�^Ó8ˆFØ”H—L‘L¤§¡Ó.Ò.Ø'Ð(>Ñ?Ð?Ørg   c                 ó~   — | j                   €| S t        | «      }|s| S | j                  d| j                   |z   i¬«      S )Nr  )rx  )r  r  Ú
model_copy)r¥   rÿ  s     re   rh  rh  Ò  sO   € ð ×ÑÐ%ØÐÜ";¸KÓ"HÐÙØÐØ×!Ñ!¨,¸×8NÑ8NÐQeÑ8eÐ)fÐ!ÓgÐgrg   c           	   ƒ   óŒ  K  — d}	 t        | j                  |||||| j                  ¬«      ƒ d{  –—† }|�Y| j                  |j                  dœ}|j                  �&t        ||j                  | j                  xs d¬«       t        | |¬«      } nbt        j                  �Rddl	m
}  ||||¬	«      ƒ d{  –—† }	|	�7d
| j                  i}t        ||	| j                  xs d¬«       t        | |¬«      } | |fS 7 ŒÅ7 ŒC# t        $ r?}
t        |
t        j                  «      r|
‚t        j                  d|
«       Y d}
~
| |fS d}
~
ww xY w­w)z@Look up end_user from DB and apply budget limits to valid_token.Nr¸  )r  r=  rÒ   r  r>  r   r  r  r  r  )r+   r  r  r=  r#  r  r?  rj   rS  rP  r  r¯   rƒ   rÃ   r   r°   )r¥   r^   rª   r¨   r©   r«   r½  r  r  r‹  r³   s              re   Ú!_lookup_end_user_and_apply_budgetr  Ý  su  è ø€ ð €Oð-OÜ 3Ø#×/Ñ/Ø'Ø1Ø-Ø/ØØ&1×&EÑ&Eô!
÷ 
ˆð Ð&à*×6Ñ6Ø(7×(LÑ(LñˆOð ×3Ñ3Ð?Ü7Ø$3Ø /× DÑ DØ +× 7Ñ 7Ò =¸2õô
 BØ'¸ô‰Kô ×+Ñ+Ð7ÝRá*EØ+Ø#5Ø!1ô+÷ %ˆNð
 Ð)Ø#0°+×2IÑ2IÐ"J�Ü7Ø$3Ø .Ø +× 7Ñ 7Ò =¸2õô
 FØ +¸_ô�ð ˜Ð'Ð'ð[
øð4%ùô ò OÜ�aœ×4Ñ4Ô5ØˆGÜ×"Ñ"Ð#JÈA×NÐNØ˜Ð'Ð'ûð	OüsQ   ‚E†)C9 ¯C5°BC9 Â3C7Â4=C9 Ã1EÃ5C9 Ã7C9 Ã9	EÄ2D<Ä4EÄ<EÅEc              ƒ   óü  ‡K  — | j                   }|i k7  r+|j                  dg «      }|}t        j                  d|«       yt	        | j
                  t        «      rd| j
                  v ryt        ||||¬«      }	|	�t        |	|| |¬«      ƒ d{  –—†  t        ˆfd„t        |«      D «       «      }
t        j                  |
«      D ]/  }t        ||| |¬«      ƒ d{  –—†  t        ||d¬«      ƒ d{  –—†  Œ1 y7 Œi7 Œ7 Œ­w)	u³   
    Key-level model allowlist and client fallbacks (same as standard auth).
    Not included in common_checks â€” common_checks enforces team/user/project model access only.
    Ú
model_listz
 new llm router model list %szall-team-modelsr~   Nr¼   c              3   ó<   •K  — | ]  }t        |«      xŠ�‰–— Œ y ­wr‚   )Ú_fallback_target_model_name)rê   Útargetrn   s     €re   rì   z9_enforce_key_and_fallback_model_access.<locals>.<genexpr>=  s)   øè ø€ ò &
àÜ3°FÓ;Ð;�ÐHô ñ&
ùs   ƒ)r€   ry   Ú
user_model)ÚconfigrÄ   r   r°   rƒ   r¶   r¤   r   r)   Útupler:   rË   Úfromkeysr1   )r¥   rw   r^   rx   rº   ry   r  r	  Únew_model_listr€   Úfallback_namesÚ_namern   s               @re   ri  ri    s"  øè ø€ ð  ×&Ñ&€Fà�‚|Ø"ŸJ™J |°RÓ8ˆ
Ø *ˆÜ×"Ñ"Ð#DÀnÕUÜ	�K×&Ñ&¬Ô	-Ð2CÀ{×GYÑGYÑ2YØä6Ø%ØØØ!ô	
ˆð ÐÜ$ØØ-Ø'Ø%ô	÷ ð ô !&ó &
ä7¸ÓEô&
ó !
ˆô —]‘] >Ó2ò 	ˆEÜ$ØØ-Ø'Ø%ô	÷ ð ô *ØØ%Øô÷ ñ ñ	ðøðøðús7   ƒB	C<ÂC6ÂAC<ÃC8ÃC<Ã.C:Ã/C<Ã8C<Ã:C<r  c                 óŽ   — t        | t        «      r| S t        | t        «      r#| j                  d«      }t        |t        «      r|S y )Nr€   )rƒ   r„   rË   rÄ   )r  r€   s     re   r  r  Q  s;   € Ü�&œ#ÔØˆÜ�&œ$ÔØ—z‘z 'Ó*ˆÜ�eœSÔ!ØˆLØrg   c           
   ƒ   óÐ  K  — ddl m}m}m}m}m}	m}
m} d }| j                  �Et        | |||	||
¬«      ƒ d {  –—† \  } }|�'|j                  dd«      st        ||¬«      ƒ d {  –—†  | j                  ��t        j                  t        j                   «      }t#        | j                  t        «      r| j                  }nt        j$                  | j                  «      }|j&                  �|j&                  j)                  |«      € |j+                  t        j                   ¬«      }||k  rXt-        d|› d	|› �t.        j0                  t2        j4                  | j6                  rt9        | j6                  ¬
«      ¬«      ‚d¬«      ‚|j                  dd«      rt;        | |||||¬«      ƒ d {  –—†  t=        ||||¬«      }t?        |¬«      }|�|�tA        ||¬«      nd}| jB                  }|sj|�ht#        |tD        «      rXtG        |«      dkD  rJ|rH| j6                  �<|D ]  }tI        | ||||||¬«      ƒ d {  –—†  Œ t=        ||||¬«      }t?        |¬«      }tK        | jL                  |	|||
¬«      ƒ d {  –—† }|| _'        |s|rtQ        | ||¬«      ƒ d {  –—†  | jR                  }|s[|�Yt#        |tD        «      rItG        |«      dkD  r;|r9| j                  �-|D ](  }|jU                  | j                  ||¬«      ƒ d {  –—†  Œ* | jV                  �EtY        | jV                  |	||
¬«      ƒ d {  –—† }|�"|jZ                  | _.        |j^                  | _/        | S 7 �Œ7 �Œò7 �Œ°7 �Œ*7 Œí7 ŒÎ7 Œi7 Œ<­w)Nr   )rh   rº   ry   rµ   r¨   r«   r©   )r¥   r^   rª   r¨   r©   r«   r´  F)Úend_user_objr^   r  r  r  rj  rÒ   r  r   r~   r…   r  r,  )rš   r¨   r©   rª   r«   r	  r-  r  )0rÔ  rh   rº   ry   rµ   r¨   r«   r©   r  r  rÄ   r!   rV  r   rÉ  r   rÊ  rƒ   rW  r  rX  r×   rÅ   rà  rY  r   rZ  r  r5   ri  r   r†   r$   r±   rË   r1  rÍ   r´   rš   r›   r¹   r  rp  r  r.   r•  rQ  rR  )r¥   rx   rw   r^   rª   rh   rº   ry   rµ   r¨   r«   r©   r½  rŒ  r�  rŸ  r   rˆ  rž  r¸   Úuser_budgetr¡  r¤  s                          re   r:  r:  [  sÌ  è ø€ ÷÷ ñ ð €OØ×ÑÐ*Ü-NØ#ØØ-Ø'Ø1Ø/ô.
÷ (
Ñ$ˆ�_ð Ð&Ð/?×/CÑ/CÐDcÐejÔ/kÜ(°oÈUÔS×SÐSð ×ÑÑ&Ü&Ÿl™l¬8¯<©<Ó8ˆÜ�k×)Ñ)¬8Ô4Ø%×-Ñ-‰Kä"×0Ñ0°×1DÑ1DÓEˆKØ×ÑÐ%¨×);Ñ);×)EÑ)EÀkÓ)RÐ)ZØ%×-Ñ-´X·\±\Ð-ÓBˆKØ˜Ò%Ü ØNÈ{ÈmÐ[mÐnzÐm{Ð|Ü$×0Ñ0Ü×1Ñ1ØHS×HYÒHYÔ)°+×2CÑ2CÔDô	ð ð `bô	ð ð ×ÑÐ;¸UÔCÜ4Ø#Ø%ØØØ)Ø!ô
÷ 	
ð 	
ô 4Ø!ØØØô	€Mô 8¸mÔL€Nð Ð$¨Ð)?ô 	 -¸JÕGàð ð #.×">Ñ">ÐáØ Ð,ÜÐ+¬TÔ2ÜÐ$Ó%¨Ò)ÙØ×ÑÐ)à(ò 		ˆJÜ7Ø'Ø)AØ%Ø)ØØ-Ø%ô÷ ñ ð		ô 8Ø%ØØØ!ô	
ˆô <À-ÔPˆô  ;Ø×#Ñ#Ø#Ø-Ø)Ø+ô ÷ €Kð )4€KÔ%Ù¡.Ü&Ø#Ø%=Ø!ô
÷ 	
ð 	
ð &×?Ñ?€LáØÐ$Ü�|¤TÔ*Ü�Ó Ò!ÙØ×#Ñ#Ð/à(ò 	ˆJØ*×JÑJØ'×3Ñ3Ø*6Ø ð Kó ÷ ñ ð	ð ×ÑÐ)Ü$6Ø"×-Ñ-Ø'Ø1Ø/ô	%
÷ 
ˆð Ð#Ø+7×+@Ñ+@ˆKÔ(Ø(4×(BÑ(BˆKÔ%àÐða(
ùð Tùð(	
ùðLùð4øð	
øð"øð
ús�   ‚5M&·M¸+M&Á#MÁ$EM&Æ(MÆ)BM&È1MÈ2>M&É0MÉ1 M&ÊM ÊA&M&Ë8M"Ë9.M&Ì'M$Ì(+M&ÍM&ÍM&ÍM&ÍM&Í M&Í"M&Í$M&r‚   )NN)NNNN)r_   N)àr‰  r\  rî   rØ   ra  Úcollections.abcr   r   r   Útypingr   r   r   r	   r
   r   ÚfastapirÇ   r   r   r   r   Úfastapi.security.api_keyr   rj   Úlitellm._loggingr   r   Úlitellm._service_loggerr   Úlitellm.constantsr   r   r   Ú&litellm.integrations.otel.model.configr   Ú!litellm.integrations.otel.runtimer   r   Ú%litellm.litellm_core_utils.dd_tracingr   Ú0litellm.litellm_core_utils.dot_notation_indexingr   Úlitellm.proxy._typesrP  r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   r2   Ú)litellm.proxy.auth.auth_exception_handlerr3   Úlitellm.proxy.auth.auth_methodr4   Úlitellm.proxy.auth.auth_utilsr5   r6   r7   r8   r9   r:   r;   r<   r=   Úlitellm.proxy.auth.handle_jwtr>   r?   Úlitellm.proxy.auth.networkr@   rA   Úlitellm.proxy.auth.oauth2_checkrB   Ú$litellm.proxy.auth.oauth2_proxy_hookrC   Úlitellm.proxy.auth.resolversrD   rE   Ú"litellm.proxy.auth.resolvers.storerF   rl  rH   Ú&litellm.proxy.auth.trusted_proxy_utilsrI   Ú,litellm.proxy.common_utils.cache_coordinatorrJ   rm  rK   rL   rM   rN   rO   Ú)litellm.proxy.common_utils.realtime_utilsrQ   Ú-litellm.proxy.common_utils.user_api_key_cacherR   rS   Ú"litellm.proxy.db.exception_handlerrT   Ú$litellm.proxy.litellm_pre_call_utilsrU   Úlitellm.proxy.utilsrV   rW   rX   Ú'litellm.repositories.table_repositoriesrY   Úlitellm.secret_managers.mainrZ   Úlitellm.types.servicesr[   Ú/litellm_enterprise.proxy.auth.user_api_key_authr\   Ú_enterprise_custom_authÚCallablerŠ  ÚImportErrorr³   r°   r]   r„   rf   rË   r—   rm   ÚSpecialHeadersÚcustom_litellm_api_keyr{  rq   Úopenai_authorizationrr   Úazure_authorizationrs   Úanthropic_authorizationrt   Úgoogle_ai_studio_authorizationru   Úazure_apim_authorizationrv   r¤   r   r†   rˆ   r™   r    r§   ÚSpanrž   r´   r–   r¹   ÚRouterrÍ   rÝ   rù   r  r  r  ÚLiteLLM_BudgetTabler  r;  r?  rA  rJ  rQ  r`  rg  r  rs  rƒ  r…  rf  r‡  rµ  rÄ  rÍ  r×  rÅ   rÚ  râ  ÚLiteLLM_ObjectPermissionTableræ  r§  r«  rq  r­  rÂ  r±  ÚwraprÐ  rÀ  rÃ  ÚLiteLLM_EndUserTablerÇ  rÄ  ræ  rê  ÚSecurityr4  rd  rc  r8  r  rh  r  ri  r  r:  r‹   rg   re   ú<module>rI     sQ  ðòó Û Û 	Û Ý #ß 'ß @× @ã Û ß =Ó =Ý 1ã ß AÝ 2÷ñ õ
 Fß OÝ 8Ý MÜ "÷÷ ÷ ÷ ÷ ÷ õ0 UÝ 5÷
÷ 
õ 
÷ Eß RÝ 9Ý Lß AÝ <Ý 7Ý JÝ T÷õ õ M÷õ HÝ I÷ñ õ
 MÝ 8Ý /ð"õð /FÐ˜H t™OÓEñ
 *8Ó)9Ð  Ó 9ð¨ð °ó ð¨sð ÀdÈTÁkð ÐVZó ñ $0Ø	×	.Ò	.×	4Ò	4ØØô$Ð ˜5ó ñ
 %Ø	×	,Ò	,×	2Ò	2ØØô€�ó ñ
 +Ø	×	+Ò	+×	1Ò	1ØØuôÐ �eó ñ
 #/Ø	×	/Ò	/×	5Ò	5ØØ+ô#Ð ˜%ó ñ
 *6Ø	×	6Ò	6×	<Ò	<ØØ2ô*Ð  ó ñ
 (Ø	×	0Ò	0×	6Ò	6ØØJôÐ �5ó ð "ñ	Øðàðð �t‰^ðð �d‘
ð	ð
 	ˆ4�‰9�_�tÑóð Ø��c‘‰?˜TÑ!ðà	ˆ#�Yóôw˜Xô wô˜hô ô,�xô ,ð
#Ð$4ð #¸¸c¹ó #ðGØ�4‰ZðGà $Ñ&ðGð (ðGð ˜T‘kð	Gð
 $ðGð ˆS�&ˆ[Ñ˜DÑ óGð:
Øð
à5ð
ð �‰Ið
ð 
ó	
ð6 #'Ø(,ñF2ØðF2à4ðF2ð ðF2ð ð	F2ð
 ðF2ð ˜4‘KðF2ð —’ Ñ%ðF2ð 
óF2ðR°3ð ¸3ó ð6 #(ò	&hØ˜$‘Jð&hà�t‘ð&hð  ð	&hð
 
ó&hðR
¨Dð 
Ð<Pð 
ÐUYó 
ð°ð À*ð ÐQUó ð"Øóð8TØðTà$ðTð �t‘ðTð 
ó	Tð8<<°ó <<ð~¸ð ÐZ^ð Ðcqó ñ$ $?ÐJZÔ#[Ð ˜5Ó [ðØðà'ðð  ðð ˆT�\ó	ð4Ø!ðà'ðð   $Ñ&ðð ð	ð
 $ðð ˆT�\óðB%˜zð %°4¸±9ð %Àó %ð9"Ø" T™zð9"àð9"ð  ™*ð9"ð " D™jð	9"ð
 &)¨4¡Zð9"ð ˜T‘zð9"ð ! ™J¨Ñ-ð9"ð ð9"ð ð9"ð ˆ3��d‘
ˆ?Ñó9"ðx,Øð,àð,ð ! ™J¨Ñ-ð,ð ð	,ð
 �cÑó,ðj $9Ð ˜5Ó 8ðð ô˜:ô ð6 ØØØ"ñEØ ðEàðEð ðEð  ð	Eð
 (ðEð ˜T‘kðEð $ðEð ðEð �4‰ZðEð �4‰ZðEð �$‰JðEð �t‘ðEð �dÑóEðPjØðjàðjð   $Ñ&ðjð (ð	jð
 ˜T‘kðjð $ðjð ˆ>˜DÑ Ð"8Ð8Ñ9ójðZ¸'ð Àhó ð(6°wð 6À4ó 6ð@^Øð^à
ˆ4� $Ñ&Ð&Ñ'ó^ð kØ%ðkà(ðkð ðkð 
ó	kð2Ø ™*ðà $Ñ&ðð (ðð ˜T‘kð	ð
 $ðð # TÑ)óð8 -1ñ
Øð
àð
ð ð
ð " D™jð	
ð
 &)¨4¡Zð
ð ˜T‘zð
ð ð
ð  # T™zð
ð ó
ðD"˜Só ð: nð Ð9Só ð(M¨>ð MÈð MÐ[_ó Mð< €‡‚ƒðoØ)ðoàðoð ðoð ð	oð
 
òoó ðoód	ð$ #Ø37ñ/Ø)ð/àð/ð ð/ð �d‘
ð	/ð
 ,¨dÑ2ð/ð # TÑ)ð/ð   $Ñ&ð/ð (ð/ð $ð/ð ð/ð ð/ð �t‘ð/ð *¨DÑ0ð/ð 
ó/ðdØðàðð �t‰^ðð �d‘
ð	ð
 
óð"¨ð ¸nð ÐQZó ð0?Ø)ð?àð?ð ð?ð ð	?ð
 ð?ð �dÑó?ðD €‡‚ƒð $�7×#Ò# NÓ3Ø 0 × 0Ò 0Ð1EÓ FØ+;¨7×+;Ò+;Ð<TÓ+UØ2B°'×2BÒ2BÐCbÓ2cØ$4 G×$4Ò$4Ð5FÓ$GØ,<¨G×,<Ò,<Ð=VÓ,Wñ\!Øð\!àð\!ð ð\!ð " D™jð	\!ð
 &)¨4¡Zð\!ð ˜T‘zð\!ð  # T™zð\!ð ò\!ó ð\!ðL *.ñ-BØ $Ñ&ð-Bàð-Bð ˜T‘kð-Bð ð	-Bð
 ð-Bð ð-Bð   $Ñ&ð-Bð ó-Bð` ¨Gð  ÐUXð  Ð]`ó  ðF¨>ó ðhØðhàóhð8(Øð8(àð8(ð ˜T‘kó8(ðv6àð6ð ð6ð ð	6ð
 �t‰^ð6ð ˜4‘Kð6ð �d‘
ð6ð 
ó6ðr¨ð °3¸±:ó ðdØðdàðdð ðdð ð	dð
 ˜T‘kðdð ôdøðY_ ò "ØÐ×ÒÐDÀaÔHØ!Öûð"ús   ÅZ" Ú"[Ú'[Û[