Ë
    tPêj¨V  ã                  óà  — U d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl	m
Z
 ddlmZmZmZ ddlmZ ddlmZmZ ddlmZ dd	lmZmZmZmZ dd
lmZmZmZ ddlZddl m!Z!m"Z"m#Z#m$Z$m%Z% ddl&m'Z'm(Z( ddl)m*Z* erddl+m,Z, dZ-de.d<   dZ/de.d<   dZ0de.d<   dZ1de.d<   dZ2de.d<    G d„ de!«      Z3 G d„ de!«      Z4 G d„ d e!«      Z5 ed!d!¬"«       G d#„ d$«      «       Z6 ed!d!¬"«       G d%„ d&«      «       Z7 ed!d!¬"«       G d'„ d(«      «       Z8 ed!d!¬"«       G d)„ d*«      «       Z9 ed!d!¬"«       G d+„ d,«      «       Z:e9e:z  Z; G d-„ d.e«      Z< G d/„ d0e«      Z= G d1„ d2e«      Z>dOd3„Z?dPd4„Z@dQd5„ZAdRd6„ZBdRd7„ZC G d8„ d9e(«      ZDdSd:„ZEdTd;„ZFdUd<„ZGdVd=„ZHdWd>„ZIej                  f	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 dXd?„ZJej                  f	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 dYd@„ZK	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 dZdA„ZL	 	 	 	 	 	 	 	 	 	 d[dB„ZM e$eeNeOf   «      ZPde.dC<   d\dD„ZQej¤                  eSe0f	 	 	 	 	 	 	 	 	 	 	 d]dE„ZTd^dF„ZUd_dG„ZVej                  eVdHœ	 	 	 	 	 	 	 	 	 	 	 	 	 d`dI„ZWdJZXde.dK<   	 	 	 	 	 	 	 	 dadL„ZYdbdM„ZZ	 	 	 	 	 	 dcdN„Z[y)daL  Browser sign-in for ``lite login --pkce``: OAuth 2.1 authorization code + PKCE S256
against the proxy's own authorization server, as a public client on a loopback redirect.
The proxy publishes everything this needs at ``/.well-known/litellm-cli-auth``, so a CLI
in any other language can run the same steps from that document alone.é    )ÚannotationsN)Úurlsafe_b64encode)ÚCallableÚMappingÚSequence)Ú	dataclass)ÚBaseHTTPRequestHandlerÚ
HTTPServer©ÚMappingProxyType)ÚTYPE_CHECKINGÚFinalÚLiteralÚProtocol)Úparse_qsÚ	urlencodeÚurlparse)Ú	BaseModelÚ
ConfigDictÚFieldÚTypeAdapterÚValidationError)ÚReadOnlyÚ	TypedDict)Ú"CLI_TOKEN_FRESHNESS_BUFFER_SECONDSé   )ÚCliTokenDataz/.well-known/litellm-cli-authr   ÚCLI_AUTH_DISCOVERY_PATHz	/callbackÚCALLBACK_PATHé,  ÚLOGIN_TIMEOUT_SECONDSé   Ú_HTTP_TIMEOUT_SECONDSzlitellm-cliÚ_CLIENT_NAMEc                  óp   — e Zd ZU  ed¬«      Zded<   ded<   ded<   ded<   ded	<   ded
<   ded<   ded<   y)ÚCliAuthContractT©Úfrozenz
Literal[1]Úcontract_versionÚstrÚissuerÚauthorization_endpointÚtoken_endpointÚregistration_endpointÚrevocation_endpointÚresourceútuple[str, ...]Ú code_challenge_methods_supportedN)Ú__name__Ú
__module__Ú__qualname__r   Úmodel_configÚ__annotations__© ó    úq/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/client/cli/commands/pkce_login.pyr&   r&   &   s:   … Ù TÔ*€Là Ó ØƒKØÓØÓØÓØÓØƒMØ&5Ô5r9   r&   c                  ó<   — e Zd ZU  ed¬«      Z ed¬«      Zded<   y)Ú_RegisteredClientTr'   r   ©Ú
min_lengthr*   Ú	client_idN)r3   r4   r5   r   r6   r   r?   r7   r8   r9   r:   r<   r<   3   s   … Ù TÔ*€Lá aÔ(€IˆsÔ(r9   r<   c                  ó�   — e Zd ZU  ed¬«      Z ed¬«      Zded<    ed¬«      Zd	ed
<    ed¬«      Z	ded<   dZ
ded<   dZded<   y)Ú_TokenResponseTr'   r   r=   r*   Úaccess_tokenr   )ÚgtÚintÚ
expires_inÚrefresh_tokenNú
str | NoneÚuser_idÚteam_id)r3   r4   r5   r   r6   r   rB   r7   rE   rF   rH   rI   r8   r9   r:   rA   rA   9   sL   … Ù TÔ*€Lá¨Ô+€L�#Ó+Ù˜q”k€J�Ó!Ù¨!Ô,€M�3Ó,Ø€GˆZÓØ€GˆZÔr9   rA   T)r(   Úslotsc                  ó   — e Zd ZU ded<   y)ÚPkceFailurer*   ÚreasonN©r3   r4   r5   r7   r8   r9   r:   rL   rL   C   ó   … à„Kr9   rL   c                  ó   — e Zd ZU ded<   y)ÚRevocationUnavailabler*   rM   NrN   r8   r9   r:   rQ   rQ   H   rO   r9   rQ   c                  óh   — e Zd ZU ded<   ded<   ded<   ded<   ded<   ded<   ded	<   d
ed<   d
ed<   y)ÚPkceCredentialr*   rB   rF   ÚfloatÚ
expires_atr?   r-   r/   r0   rG   rH   rI   NrN   r8   r9   r:   rS   rS   M   s6   … àÓØÓØÓØƒNØÓØÓØƒMØÓØÔr9   rS   c                  ó   — e Zd ZU ded<   y)ÚCallbackCoder*   ÚcodeNrN   r8   r9   r:   rW   rW   Z   s   … à
„Ir9   rW   c                  ó"   — e Zd ZU ded<   ded<   y)ÚCallbackDeniedr*   ÚerrorrG   ÚdescriptionNrN   r8   r9   r:   rZ   rZ   _   s   … àƒJØÔr9   rZ   c                  ó:   — e Zd Zdd„Zdddœ	 	 	 	 	 	 	 	 	 	 	 dd„Zy)ÚHttpc                ó   — y ©Nr8   )ÚselfÚurlÚtimeouts      r:   ÚgetzHttp.geti   s   � r9   N)ÚdataÚjsonc                ó   — y r`   r8   )ra   rb   re   rf   rc   Úallow_redirectss         r:   Úpostz	Http.postk   s   € ð  r9   )rb   r*   rc   rT   Úreturnúrequests.Response)rb   r*   re   zMapping[str, str] | Nonerf   úMapping[str, object] | Nonerc   rT   rh   Úboolrj   rk   )r3   r4   r5   rd   ri   r8   r9   r:   r^   r^   h   sL   „ ÛHð *.Ø,0ñ àð ð 'ð	 ð
 *ð ð ð ð ð ð 
ô r9   r^   c                  ón   ‡ — e Zd ZdZddˆ fd„Zedd„«       Zd	ˆ fd„Zej                  f	 	 	 	 	 d
d„Z
ˆ xZS )ÚLoopbackServeraŸ  The OS-assigned loopback listener the browser is sent back to. Only the response
    carrying the pending sign-in's ``state`` settles it; anything else (a stray request, a
    stale tab, an attacker poking the port) gets a 400 and the wait continues. A connection
    that opens and then sends nothing is dropped after ``connection_timeout_seconds`` so it
    cannot hold the single-threaded wait past its deadline.c                óf   •— t         ‰| �  dt        «       || _        || _        d | _        d| _        y )N)z	127.0.0.1r   r   )ÚsuperÚ__init__Ú_CallbackHandlerÚexpected_stateÚconnection_timeout_secondsÚoutcomerc   )ra   rt   ru   Ú	__class__s      €r:   rr   zLoopbackServer.__init__}   s2   ø€ Ü‰ÑÐ)Ô+;Ô<Ø%3ˆÔØ1KˆÔ'Ø/3ˆŒØˆ�r9   c                ó2   — d| j                   d   › t        › �S )Nzhttp://127.0.0.1:r   )Úserver_addressr   )ra   s    r:   Úredirect_urizLoopbackServer.redirect_uri„   s   € à" 4×#6Ñ#6°qÑ#9Ð":¼=¸/ÐJÐJr9   c                ó`   •— t         ‰| �  «       }|d   j                  | j                  «       |S ©Nr   )rq   Úget_requestÚ
settimeoutru   )ra   Úacceptedrw   s     €r:   r}   zLoopbackServer.get_requestˆ   s-   ø€ Ü8=¹Ñ8KÓ8MˆØ�‰×Ñ˜t×>Ñ>Ô?Øˆr9   c                óª   —  |«       |z   }| j                   €2 |«       |k\  rt        d«      S | j                  «        | j                   €Œ2| j                   S )Nz3timed out waiting for the browser sign-in to finish)rv   rL   Úhandle_request)ra   Útimeout_secondsÚclockÚdeadlines       r:   ÚwaitzLoopbackServer.wait�   sT   € ñ  ›' OÑ3ˆØ�l‰lÐ"Ù‹w˜(Ò"Ü"Ð#XÓYÐYØ×ÑÔ!ð �l‰lÑ"ð �|‰|Ðr9   )é   )rt   r*   ru   rT   rj   ÚNone)rj   r*   )rj   ztuple[socket.socket, object])r‚   rT   rƒ   úCallable[[], float]rj   zCallbackOutcome | PkceFailure)r3   r4   r5   Ú__doc__rr   Úpropertyrz   r}   ÚtimeÚ	monotonicr…   Ú__classcell__)rw   s   @r:   ro   ro   v   sP   ø„ ñ?öð òKó ðKõð DHÇ>Á>ðØ$ðØ-@ðà	&÷r9   ro   c                  ó0   — e Zd ZU ded<   dd„Zdd„Zd	d„Zy)
rs   ro   Úserverc                ó:  — t        | j                  «      }|j                  t        k7  r| j                  dd«       y t	        |j
                  «      }t        |d«      | j                  j                  k7  r| j                  dd«       y t        |d«      }|�9t        |t        |d«      ¬«      | j                  _
        | j                  d	d
«       y t        |d«      }|€| j                  dd«       y t        |¬«      | j                  _
        | j                  d	d«       y )Ni”  z
Not found.Ústateé�  zDThis response does not belong to the pending sign-in; still waiting.r[   Úerror_description)r[   r\   éÈ   z4Sign-in was not approved. You can close this window.rX   zBThe sign-in response carried no authorization code; still waiting.©rX   zKSigned in to LiteLLM. You can close this window and return to the terminal.)r   Úpathr   Ú_respondr   ÚqueryÚ_firstr�   rt   rZ   rv   rW   )ra   ÚparsedÚparamsr[   rX   s        r:   Údo_GETz_CallbackHandler.do_GET›   sé   € Ü  §¡Ó+ˆØ�;‰;œ-Ò'Ø�M‰M˜#˜|Ô,ØÜ  §¡Ó.ˆÜ�&˜'Ó" d§k¡k×&@Ñ&@Ò@Ø�M‰M˜#ÐeÔfØÜ˜f gÓ.ˆØÐÜ"0°uÌ&ÐQWÐYlÓJmÔ"nˆD�K‰KÔØ�M‰M˜#ÐUÔVØÜ˜V VÓ,ˆØˆ<Ø�M‰M˜#ÐcÔdØÜ*°Ô5ˆ�‰ÔØ�‰�cÐhÕir9   c                 ó   — y r`   r8   )ra   ÚformatÚargss      r:   Úlog_messagez_CallbackHandler.log_message°   s   € Ør9   c                ó.  — |j                  d«      }| j                  |«       | j                  dd«       | j                  dt        t	        |«      «      «       | j                  dd«       | j                  «        | j                  j                  |«       y )Nzutf-8zContent-Typeztext/plain; charset=utf-8zContent-LengthzCache-Controlzno-store)ÚencodeÚsend_responseÚsend_headerr*   ÚlenÚend_headersÚwfileÚwrite)ra   ÚstatusÚtextÚbodys       r:   r—   z_CallbackHandler._respond³   sv   € Ø—k‘k 'Ó*ˆØ×Ñ˜6Ô"Ø×Ñ˜Ð)DÔEØ×ÑÐ)¬3¬s°4«y«>Ô:Ø×Ñ˜¨*Ô5Ø×ÑÔØ�
‰
×Ñ˜Õr9   N)rj   r‡   )rž   r*   rŸ   Úobjectrj   r‡   )r©   rD   rª   r*   rj   r‡   )r3   r4   r5   r7   rœ   r    r—   r8   r9   r:   rs   rs   ˜   s   … ØÓójó*ôr9   rs   c                ó6   — | j                  |«      }|r|d   S d S r|   ©rd   )r›   ÚkeyÚvaluess      r:   r™   r™   ½   s    € Ø—J‘J˜s“O€FÙˆ6�!‰9Ð( DÐ(r9   c           	     óâ  — | j                  d«      › t        › �}	 |j                  |t        ¬«      }|j                  dk7  rt        |› d|j                  › d�«      S 	 t        j                  |j                  «       «      }d	|j                  vrt        d
«      S t        |j                  «      t        | «      k7  rt        |› d|j                  › d| › d�«      S t!        |t#        | «      «      }|r#t        |› d| › ddj%                  |«      › d�«      S |S # t        j
                  $ r}t        d|› d|› �«      cY d }~S d }~ww xY w# t        t        f$ r}t        |› d|› �«      cY d }~S d }~ww xY w)Nú/)rc   zcould not reach ú: r”   z
 answered z9; this proxy version does not support `lite login --pkce`z- returned an unsupported discovery document: ÚS256z$the proxy does not support PKCE S256z is issued for z, not z!; pass that address as --base-urlz names endpoints outside z (z, z%); refusing to send credentials there)Úrstripr   rd   r#   ÚrequestsÚRequestExceptionrL   Ústatus_coder&   Úmodel_validaterf   Ú
ValueErrorr   r2   Ú_canonical_urlr+   Ú_endpoints_outsideÚ_originÚjoin)Úbase_urlÚhttprb   ÚresponseÚexcÚcontractÚforeigns          r:   Údiscover_cli_authrÅ   Â   s†  € Ø—O‘O CÓ(Ð)Ô*AÐ)BÐC€Cð<ØŸ(™( 3Ô0E˜(ÓFˆð ×Ñ˜sÒ"ÜØˆe�:˜h×2Ñ2Ð3Ð3lÐmó
ð 	
ðWÜ)×8Ñ8¸¿¹»ÓIˆð �X×>Ñ>Ñ>ÜÐAÓBÐBÜ�h—o‘oÓ&¬.¸Ó*BÒBÜ˜c˜U /°(·/±/Ð1BÀ&ÈÈ
ÐRsÐtÓuÐuÜ'¨´'¸(Ó2CÓD€GÙÜØˆeÐ,¨X¨J°b¸¿¹À7Ó9KÐ8LÐLqÐró
ð 	
ð €Oøô' ×$Ñ$ò <ÜÐ-¨c¨U°"°S°EÐ:Ó;Õ;ûð<ûô œÐ(ò WÜ˜c˜UÐ"OÐPSÈuÐUÓVÕVûðWús;   ›D Á#E ÄEÄ'D=Ä7EÄ=EÅE.ÅE)Å#E.Å)E.c                óž   ‡— | j                   | j                  | j                  | j                  | j                  f}t        ˆfd„|D «       «      S )Nc              3  óD   •K  — | ]  }‰�t        |«      ‰k7  sŒ|–— Œ y ­wr`   )r½   )Ú.0ÚendpointÚorigins     €r:   ú	<genexpr>z%_endpoints_outside.<locals>.<genexpr>ä   s#   øè ø€ Òe˜h°v°~ÌÐQYÓIZÐ^dÓId”Ñeùs   ƒ ™ )r,   r-   r.   r/   r0   Útuple)rÃ   rÊ   Ú	endpointss    ` r:   r¼   r¼   Ü   sJ   ø€ à×'Ñ'Ø×ÑØ×&Ñ&Ø×$Ñ$Ø×Ñð€Iô Óe¨)ÔeÓeÐer9   c                ó0  — t        | «      }	 |j                  }|j                  dvs|j                  syd|j                  v rd|j                  › d�n|j                  }|j                  › d|› d|xs |j                  dk(  rd› �S d	› �S # t        $ r Y yw xY w)
zÝ``scheme://host:port`` with the default port made explicit, so the same server spelled
    two ways (``https://llm.example.com`` and ``https://LLM.example.com:443/``) compares equal
    and two different servers never do.N)rÀ   Úhttpsú:ú[ú]z://rÏ   i»  éP   )r   Úportrº   ÚschemeÚhostname)rb   rš   rÔ   Úhosts       r:   r½   r½   ç   s£   € ô ˜S“M€FðØ—k‘kˆð ‡}�}Ð-Ñ-°V·_²_ØØ,/°6·?±?Ñ,B�A�f—o‘oÐ& aÑ(ÈÏÉ€DØ�m‰mˆ_˜C ˜v Q tÒ'X°v·}±}ÈÒ7O°Ð&YÐZÐZÐUWÐ&YÐZÐZøô ò Ùðús   �B	 Â		BÂBc                óp   — t        | «      }|€dS |› t        | «      j                  j                  d«      › �S )z±The origin plus the path with its trailing slash dropped: the RFC 8414 section 3.3
    identity check, so a document can only ever be accepted for the proxy it was fetched from.Nr²   )r½   r   r–   rµ   )rb   rÊ   s     r:   r»   r»   ö   s;   € ô ˜C“L€FØ�>ˆ4ÐR¨&¨´(¸3³-×2DÑ2D×2KÑ2KÈCÓ2PÐ1QÐ'RÐRr9   c                  ó@   — e Zd ZU ded<   ded<   ded<   ded<   ded<   y	)
Ú_ClientRegistrationzReadOnly[str]Úclient_namezReadOnly[tuple[str, ...]]Úredirect_urisÚgrant_typesÚresponse_typeszReadOnly[Literal['none']]Útoken_endpoint_auth_methodNrN   r8   r9   r:   rÚ   rÚ   ý   s    … ØÓØ,Ó,Ø*Ó*Ø-Ó-Ø 9Ô9r9   rÚ   c                 ó   — t        | «      S r`   r   )Úfieldss    r:   Ú_formrâ     s   € Ü˜FÓ#Ð#r9   c                óˆ   — d|j                   cxk  rdk  sy yt        | › d|j                  j                  dd«      › d�«      S )zðEvery POST to the proxy is sent with ``allow_redirects=False``: a 307 or 308 would make
    ``requests`` replay the form, code and verifier or refresh token included, wherever ``Location``
    points, past the origin check discovery passed.r    r’   Nz redirected to ÚLocationzanother addressz; refusing to follow it)r¸   rL   Úheadersrd   )Úrequest_namerÁ   s     r:   Ú_refused_redirectrç   	  sU   € ð �(×&Ñ&Ô,¨Ò,Øð -ØÜØˆ.˜¨×(8Ñ(8×(<Ñ(<¸ZÐIZÓ([Ð'\Ð\sÐtóð r9   c                óô  — t         |fddddœ}	 |j                  | j                  |t        d¬«      }t        d|«      }|�|S |j                  d	vr$t        d
|j                  › dt        |«      › �«      S 	 t        j                  |j                  «       «      j                  S # t        j
                  $ r}t        d|› �«      cY d }~S d }~ww xY w# t        t        f$ r}t        d|› �«      cY d }~S d }~ww xY w)N)Úauthorization_coderF   r•   Únone)rÛ   rÜ   rÝ   rÞ   rß   F)rf   rc   rh   zclient registration failed: zclient registration)r”   éÉ   z client registration failed with r³   z1client registration returned an unexpected body: )r$   ri   r.   r#   r¶   r·   rL   rç   r¸   Ú_error_detailr<   r¹   rf   r?   rº   r   )rÃ   rz   rÀ   ÚregistrationrÁ   rÂ   Ú
redirecteds          r:   Úregister_clientrï     s  € ä#Ø&˜Ø>Ø#Ø&,ñ0€LðAØŸ)™)Ø×*Ñ*°ÔG\Ðnsð $ó 
ˆô
 *Ð*?ÀÓJ€JØÐØÐØ×Ñ :Ñ-ÜÐ=¸h×>RÑ>RÐ=SÐSUÔVcÐdlÓVmÐUnÐoÓpÐpðVÜ ×/Ñ/°·±³Ó@×JÑJÐJøô ×$Ñ$ò AÜÐ9¸#¸Ð?Ó@Õ@ûðAûô œÐ(ò VÜÐNÈsÈeÐTÓUÕUûðVús;   �#B" Á5,C Â"CÂ5CÃCÃCÃC7ÃC2Ã,C7Ã2C7c                 óæ   — t        j                  d«      } t        j                  | j	                  d«      «      j                  «       }| t        |«      j                  d«      j                  d«      fS )Né@   Úasciió   =)	ÚsecretsÚtoken_urlsafeÚhashlibÚsha256r¢   Údigestr   rµ   Údecode)Úverifierrø   s     r:   Ú	pkce_pairrû   -  sY   € Ü×+Ñ+¨BÓ/€HÜ—N‘N 8§?¡?°7Ó#;Ó<×CÑCÓE€FØÔ& vÓ.×5Ñ5°dÓ;×BÑBÀ7ÓKÐKÐKr9   c                ón   — t        t        d||||d| j                  ¬«      «      }| j                  › d|› �S )NrX   r´   )Úresponse_typer?   rz   r‘   Úcode_challengeÚcode_challenge_methodr0   ú?)r   râ   r0   r,   )rÃ   r?   rz   r‘   rþ   r˜   s         r:   Úauthorize_urlr  3  sI   € ÜÜØ ØØ%ØØ)Ø"(Ø×&Ñ&ô	
ó
€Eð ×-Ñ-Ð.¨a°¨wÐ7Ð7r9   c                ó”   — t        | j                  | j                  | j                  |t	        d||||| j                  ¬«      ||¬«      S )Nré   )Ú
grant_typerX   rz   r?   Úcode_verifierr0   ©r-   r/   r0   r?   ÚformrÀ   Únow)Ú_token_requestr-   r/   r0   râ   )rÃ   r?   rz   rX   r  rÀ   r  s          r:   Úredeem_coder	  B  sW   € ô Ø×.Ñ.Ø$×8Ñ8Ø×"Ñ"ØÜØ+ØØ%ØØ'Ø×&Ñ&ô
ð Øôð r9   c                ó@   — t        | |||t        d|||¬«      ||¬«      S )NrF   )r  rF   r?   r0   r  )r  râ   )r-   r/   r0   r?   rF   rÀ   r  s          r:   Úrefresh_credentialr  ]  s3   € ô Ø%Ø/ØØÜ˜o¸]ÐV_ÐjrÔsØØôð r9   c                óP  — 	 |j                  | |t        d¬«      }t        d|«      }	|	�|	S |j                  dk7  r$t	        d|j                  › dt        |«      › �«      S 	 t        j                  |j                  «       «      }
t        |
j                  |
j                   |«       |
j                   z   || |||
j"                  |
j$                  ¬	«	      S # t        j                  $ r}t	        d|› �«      cY d }~S d }~ww xY w# t        t        f$ r}t	        d|› �«      cY d }~S d }~ww xY w)
NF©re   rc   rh   ztoken request failed: ztoken requestr”   ztoken request failed with r³   z,token endpoint returned an unexpected body: )	rB   rF   rU   r?   r-   r/   r0   rH   rI   )ri   r#   r¶   r·   rL   rç   r¸   rì   rA   r¹   rf   rº   r   rS   rB   rF   rE   rH   rI   )r-   r/   r0   r?   r  rÀ   r  rÁ   rÂ   rî   Útokens              r:   r  r  q  s,  € ð;ØŸ)™) N¸ÔG\Ðns˜)Ótˆô *¨/¸8ÓD€JØÐØÐØ×Ñ˜sÒ"ÜÐ7¸×8LÑ8LÐ7MÈRÔP]Ð^fÓPgÐOhÐiÓjÐjðQÜ%×4Ñ4°X·]±]³_ÓEˆô Ø×'Ñ'Ø×)Ñ)Ù“5˜5×+Ñ+Ñ+ØØ%Ø/ØØ—‘Ø—‘ô
ð 
øô ×$Ñ$ò ;ÜÐ3°C°5Ð9Ó:Õ:ûð;ûô œÐ(ò QÜÐIÈ#ÈÐOÓPÕPûðQús;   ‚C Á#C> ÃC;Ã#C6Ã0C;Ã6C;Ã>D%ÄD ÄD%Ä D%c                ó~  — 	 |j                  | t        |d|¬«      t        d¬«      }t        d|«      }|�|S |j                  dk(  rt        dt        |«      › �«      S |j                  d	k7  r$t        d
|j                  › dt        |«      › �«      S y # t        j                  $ r}t        d|› �«      cY d }~S d }~ww xY w)NrF   )r  Útoken_type_hintr?   Fr  zrevocation request failed: zrevocation requesti÷  zrevocation failed with 503: r”   zrevocation failed with r³   )
ri   râ   r#   r¶   r·   rL   rç   r¸   rQ   rì   )r/   r?   rF   rÀ   rÁ   rÂ   rî   s          r:   Úrevoke_credentialr  ”  sÙ   € ð@ØŸ)™)ØÜ˜]¸OÐW`ÔaÜ)Ø!ð	 $ó 
ˆô *Ð*>ÀÓI€JØÐØÐØ×Ñ˜sÒ"Ü$Ð'CÄMÐRZÓD[ÐC\Ð%]Ó^Ð^Ø×Ñ˜sÒ"ÜÐ4°X×5IÑ5IÐ4JÈ"Ì]Ð[cÓMdÐLeÐfÓgÐgØøô ×$Ñ$ò @ÜÐ8¸¸Ð>Ó?Õ?ûð@ús   ‚%B ÂB<Â$B7Â1B<Â7B<Ú_ERROR_BODYc                ó  — 	 t         j                  | j                  «      }t        |j                  d«      xs( |j                  d«      xs |j                  d«      xs |«      d d S # t        $ r | j                  d d cY S w xY w)Nr”   r“   r[   Údetail)r  Úvalidate_jsonÚcontentr   rª   r*   rd   )rÁ   r«   s     r:   rì   rì   ­  s�   € ð#Ü!×/Ñ/°×0@Ñ0@ÓAˆô ˆt�x‰xÐ+Ó,Ò_°·±¸Ó0AÒ_ÀTÇXÁXÈhÓEWÒ_Ð[_Ó`ÐaeÐbeÐfÐføô ò #Ø�}‰}˜T˜cÐ"Ò"ð#ús   ‚A( Á(BÂBc                óâ  — t        | |«      }t        |t        «      r|S t        j                  d«      }t        «       \  }}t        |«      5 }	t        ||	j                  |«      }
t        |
t        «      r|
cd d d «       S t        ||
|	j                  ||«      } |d|› �«        |d«       t        j                  ||fdd¬«      j                  «        |	j                  |«      }d d d «       xt        d˜ x�\    |S  xt        d˜ x�,\    t        d|j                  › d	|j                   xs d
› �«      S  t"        d˜ x�&\   t%        |
	j                  |j&                  ||«      S  y # 1 sw Y   Œ‚xY w)Né    zOpening browser to: z/Approve the sign-in in your browser. Waiting...zlite-login-browserT)ÚtargetrŸ   ÚnameÚdaemonr8   zsign-in was not approved (z): z
no details)rÅ   Ú
isinstancerL   rô   rõ   rû   ro   rï   rz   r  Ú	threadingÚThreadÚstartr…   rZ   r[   r\   rW   r	  rX   )r¿   rÀ   Úopen_browserÚechor‚   rÃ   r‘   rú   Ú	challenger�   r?   rb   rv   s                r:   Úrun_pkce_loginr#  µ  s`  € ô (¨°$Ó7€HÜ�(œKÔ(ØˆÜ×(Ñ(¨Ó,€EÜ#›+Ñ€HˆiÜ	˜Ó	ð 6 &Ü*¨8°V×5HÑ5HÈ$ÓOˆ	Ü�i¤Ô-Ø÷6ñ 6ô # 8¨Y¸×8KÑ8KÈUÐT]Ó^ˆÙÐ# C 5Ð)Ô*ÙÐ>Ô?Ü×Ñ °C°6Ð@TÐ]aÔb×hÑhÔjØŸ™ _Ó5ˆ÷6ð ØŒ[Ž]ØˆNð àŒ^ÖÜÐ!;¸G¿M¹M¸?È#Èg×NaÑNaÒNqÐeqÐMrÐsÓtÐtð ä�^Ü˜x¨°F×4GÑ4GÈÏÉÐW_ÐaeÓfÐfñ ÷6ð 6ús   Á)E%Á?A%E%Å%E.c                ó(  — | j                  d«      |j                  |j                  xs dddddt        j                  «       |j                  |j
                  |j                  |j                  |j                  |j                  |j                  dœ}|S )Nr²   zcli-userÚunknownÚcliÚAuthorizationÚ )r¿   r¯   rH   Ú
user_emailÚ	user_roleÚauth_header_nameÚ	jwt_tokenÚ	timestamprU   rF   r?   r-   r/   r0   rI   )rµ   rB   rH   r‹   rU   rF   r?   r-   r/   r0   rI   )r¿   Ú
credentialÚrecords      r:   Úpkce_token_recordr0  Ó  s‡   € à—O‘O CÓ(Ø×&Ñ&Ø×%Ñ%Ò3¨ØØØ+ØÜ—Y‘Y“[Ø ×+Ñ+Ø#×1Ñ1Ø×)Ñ)Ø$×3Ñ3Ø)×=Ñ=Ø×'Ñ'Ø×%Ñ%ñ#€Fð" €Mr9   c                 ó   — y r`   r8   )Ú_messages    r:   Ú_ignore_warningr3  è  s   € Ør9   )r  Úwarnc               ó  — | j                  d«      }t        |t        «      r|sy| j                  d«      }t        |t        t        f«      s|S  |«       |t
        z
  k  r|S  |«       |k  r|nd}t        | «      }	|	€|S t        |	||dœŽ}
t        |
t        «      r4t         |«       |  |«       «      }|€ |d|
j                  › �«       |xs |S | j                  d«      } |t        t        |t        «      r|nd|
«      «       |
j                  S )aO  The stored key, refreshed first when it is about to expire and a refresh token is
    on file. The refresh fires at the same moment ``is_cli_token_fresh`` stops calling the
    key fresh, so a command that checks freshness and then asks for the key never disagrees
    with itself. The rotated pair is saved before the new key is returned, so a crash after
    this point never strands the CLI with a burned refresh token. A refresh that fails
    reads the record again, because a sibling ``lite`` process may have rotated the pair
    first, in which case the key it saved for this same proxy is the live one; when no sibling
    did, the reason the proxy gave goes to ``warn`` so a revoked or refused refresh token is
    never a silent failure. A record without ``expires_at`` (the classic ``lite login``
    credential) is returned as stored.r¯   NrU   )rÀ   r  zCould not renew the key: r¿   r(  )rd   r  r*   rD   rT   r   Ú_refresh_inputsr  rL   Ú_key_rotated_by_a_siblingrM   r0  rB   )Ú
token_dataÚsaverÀ   Úreloadr  r4  r¯   rU   Ústill_validÚrefresh_inputsÚ	refreshedÚsibling_keyr¿   s                r:   Úfresh_api_keyr?  ì  s  € ð& —‘ Ó&€CÜ�cœ3Ô¡sØØ"Ÿ™ |Ó4€JÜ�j¤3¬ ,Ô/Øˆ
Ù
ƒuˆzÔ>Ñ>Ò>Øˆ
Ù #£¨
Ò 2™¸€KÜ+¨JÓ7€NØÐØÐÜ)¨>ÀÈ#ÒN€IÜ�)œ[Ô)Ü6±v³xÀÉSËUÓSˆØÐÙÐ,¨Y×-=Ñ-=Ð,>Ð?Ô@ØÒ)˜kÐ)Ø —n‘n ZÓ0€HÙÔ	¤z°(¼CÔ'@™8ÀbÈ)Ó	TÔUØ×!Ñ!Ð!r9   )r¿   r-   r0   rH   rI   Ú_CREDENTIAL_IDENTITY_FIELDSc                ó.  ‡ ‡— ‰ �#‰ j                  d«      ‰j                  d«      k(  ryt        ˆ ˆfd„t        D «       «      ry‰ j                  d«      }t        |t        t
        f«      r||k\  ry‰ j                  d«      }t        |t        «      r|r|S dS )aX  The key a sibling process saved, but only when it continues this very credential:
    same proxy, same token endpoint, same resource, same user and team, and not yet expired.
    A concurrent ``lite login`` against a different proxy, or as someone else on this one,
    replaces the same file, and its key must never be sent as this credential.NrF   c              3  ód   •K  — | ]'  }‰j                  |«      ‰j                  |«      k7  –— Œ) y ­wr`   r®   )rÈ   Úfieldr/  r8  s     €€r:   rË   z,_key_rotated_by_a_sibling.<locals>.<genexpr>"  s(   øè ø€ Ò
_¸%ˆ6�:‰:�eÓ 
§¡¨uÓ 5Õ5Ñ
_ùs   ƒ-0rU   r¯   )rd   Úanyr@  r  rD   rT   r*   )r/  r8  r  rU   r¯   s   ``   r:   r7  r7    s‚   ù€ ð €~˜Ÿ™ OÓ4¸
¿¹ÀÓ8WÒWØÜ
Ô
_ÔC^Ô
_Ô_ØØŸ
™
 <Ó0€JÜ�j¤3¬ ,Ô/°3¸*Ò3DØØ—‘˜EÓ"€CÜ˜S¤#Ô&©3ˆ3Ð8°DÐ8r9   c                óÊ   ‡ — t        ˆ fd„dD «       «      }t        d„ |D «       «      sy |\  }}}}}t        |«      t        |«      t        |«      t        |«      t        |«      fS )Nc              3  ó@   •K  — | ]  }‰j                  |«      –— Œ y ­wr`   r®   )rÈ   rC  r8  s     €r:   rË   z"_refresh_inputs.<locals>.<genexpr>,  s"   øè ø€ ò àð 	�‰�u×ñùs   ƒ)r-   r/   r0   r?   rF   c              3  óD   K  — | ]  }t        |t        «      xr |–— Œ y ­wr`   )r  r*   )rÈ   Úvalues     r:   rË   z"_refresh_inputs.<locals>.<genexpr>0  s   è ø€ ÒD°EŒz˜%¤Ó%Ò/¨%Ó/ÑDùs   ‚ )rÌ   Úallr*   )r8  r°   r-   r/   r0   r?   rF   s   `      r:   r6  r6  +  si   ø€ Üó àhôó €Fô ÑD¸VÔDÔDØØNTÑK€NÐ'¨°9¸mÜˆ~Ó¤Ð$7Ó 8¼#¸h»-ÌÈYËÔY\Ð]jÓYkÐkÐkr9   c                óJ   — t        | «      }|€y |\  }}}}}t        ||||«      S r`   )r6  r  )r8  rÀ   r<  Ú_r/   r?   rF   s          r:   Úrevoke_stored_credentialrL  6  s:   € ô ,¨JÓ7€NØÐØØ:HÑ7€AÐ˜A˜y¨-ÜÐ0°)¸]ÈDÓQÐQr9   )r›   zMapping[str, Sequence[str]]r¯   r*   rj   rG   )r¿   r*   rÀ   r^   rj   zCliAuthContract | PkceFailure)rÃ   r&   rÊ   rG   rj   r1   )rb   r*   rj   rG   )rá   r*   rj   úMapping[str, str])ræ   r*   rÁ   rk   rj   zPkceFailure | None)rÃ   r&   rz   r*   rÀ   r^   rj   zstr | PkceFailure)rj   ztuple[str, str])rÃ   r&   r?   r*   rz   r*   r‘   r*   rþ   r*   rj   r*   )rÃ   r&   r?   r*   rz   r*   rX   r*   r  r*   rÀ   r^   r  rˆ   rj   úPkceCredential | PkceFailure)r-   r*   r/   r*   r0   r*   r?   r*   rF   r*   rÀ   r^   r  rˆ   rj   rN  )r-   r*   r/   r*   r0   r*   r?   r*   r  rM  rÀ   r^   r  rˆ   rj   rN  )
r/   r*   r?   r*   rF   r*   rÀ   r^   rj   ú*PkceFailure | RevocationUnavailable | None)rÁ   rk   rj   r*   )r¿   r*   rÀ   r^   r   zCallable[[str], object]r!  úCallable[[str], None]r‚   rT   rj   rN  )r¿   r*   r.  rS   rj   r   )r2  r*   rj   r‡   )r8  úMapping[str, object]r9  zCallable[[CliTokenData], None]rÀ   r^   r:  z)Callable[[], Mapping[str, object] | None]r  rˆ   r4  rP  rj   rG   )r/  rl   r8  rQ  r  rT   rj   rG   )r8  rQ  rj   z%tuple[str, str, str, str, str] | None)r8  rQ  rÀ   r^   rj   rO  )\r‰   Ú
__future__r   rö   rô   Úsocketr  r‹   Ú
webbrowserÚbase64r   Úcollections.abcr   r   r   Údataclassesr   Úhttp.serverr	   r
   Útypesr   Útypingr   r   r   r   Úurllib.parser   r   r   r¶   Úpydanticr   r   r   r   r   Útyping_extensionsr   r   Ú*litellm.litellm_core_utils.cli_token_utilsr   Úauthr   r   r7   r   r!   r#   r$   r&   r<   rA   rL   rQ   rS   rW   rZ   ÚCallbackOutcomer^   ro   rs   r™   rÅ   r¼   r½   r»   rÚ   râ   rç   rï   rû   r  r	  r  r  r  r*   r¬   r  rì   ÚopenÚprintr#  r0  r3  r?  r@  r7  r6  rL  r8   r9   r:   ú<module>rc     s#  ðòJõ
 #ã Û Û Û Û Û Ý $ß 7Ñ 7Ý !ß :Ý "ß :Ó :ß 6Ñ 6ã ß OÕ Oß 1å YáÝ"à!@Ð ˜Ó @Ø"€ˆuÓ "Ø"Ð �uÓ "Ø!Ð �uÓ !Ø#€ˆeÓ #ô
6�iô 
6ô)˜	ô )ô�Yô ñ �$˜dÔ#÷ð ó $ðñ �$˜dÔ#÷ð ó $ðñ �$˜dÔ#÷	ð 	ó $ð	ñ �$˜dÔ#÷ð ó $ðñ �$˜dÔ#÷ð ó $ðð
  Ñ/€ô ˆ8ô  ô�Zô ôD"Ð-ô "óJ)ó
ó4fó[óSô:˜)ô :ó$óóVó2Ló8ð,  $Ÿy™yðØðàðð ðð ð	ð
 ðð ðð 
ðð "óðD  $Ÿy™yðØðàðð ðð ð	ð
 ðð ðð 
ðð "óð( Øð àð ð ð ð ð	 ð
 ð ð ð ð 
ð ð "ó ðFØðØ),ðØ=@ðØHLðà/óñ, ! ¨¨f¨Ñ!5Ó6€ˆUÓ 6ógð -7¯O©OØ"'Ø2ðgØðgà
ðgð *ðgð  ð	gð
 ðgð "ógó<ó*ð  $Ÿy™yØ"1ñ'"Ø$ð'"à
(ð'"ð ð'"ð
 6ð'"ð 
ð'"ð  ð'"ð ó'"ðT &fÐ ˜UÓ eð9Ø'ð9Ø5Ið9ØPUð9àó9ó$lðRØ$ðRØ,0ðRà/ôRr9   