tPj% UddlZddlZddlmZmZmZddlmZdZee d<dZ ee d<dZ ee d <d Z ee d <d Z d efdZded efdZdedededzd efdZdedededzd efdZdeded efdZdeded efdZdeded efdZdeded edzfdZd%dededzfdZ d&dededed d!efd"Zdedefd#Zdeded efd$Zy)'N)FinalLiteralcast)verbose_proxy_loggerzv2:gcm:_V2_GCM_PREFIXencryption_algorithm_ENCRYPTION_ALGORITHM_SETTINGz aes-256-gcm _ALGO_AES_GCMzxsalsa20-poly1305_ALGO_XSALSA20cFddlm}tjdd}||}|S)Nr) master_keyLITELLM_SALT_KEY)litellm.proxy.proxy_serverr osgetenv)r salt_keys u/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/common_utils/encrypt_decrypt_utils.py _get_salt_keyrs&5yy+T2H Oreturnc ddlm}|jtt}t |tr|jtk(rtStS#t $r tcYSwxYw)a+ Resolve the configured at-rest encryption algorithm for *new writes*. Read from ``general_settings.encryption_algorithm`` at write time. Defaults to the legacy XSalsa20-Poly1305 algorithm so deployments that have not opted in keep producing byte-for-byte identical ciphertext. r)general_settings) rrgetr r Exception isinstancestrlowerr )ralgos r_get_encryption_algorithmr"s[?&**+H.Y $!>  s AA'&A' signing_keycdddl}|j|jjS)axDerive a 32-byte key from the salt/master key (shared by both algorithms). Known limitation: this is a single-pass, unsalted ``SHA-256`` of the key, not a dedicated KDF (HKDF/PBKDF2). It is the *same* derivation the legacy nacl path already uses, so the AES path introduces no new weakness and stays interoperable with existing key sourcing; AES-256-GCM's per-value 12-byte random nonce gives the unique (key, nonce) pairs GCM requires. Moving both algorithms to HKDF-SHA256 would be more defensible in an audit but is a separate, coordinated change (it must re-derive or re-encrypt existing data). rN)hashlibsha256encodedigest)r r"s r _derive_keyr&8s( >>+,,. / 6 6 88rvalueaadcddlm}tjd}||t |j ||j d|zSNr)AESGCM utf-8)+cryptography.hazmat.primitives.ciphers.aeadr+rurandomr&encryptr$)r'r r(r+nonces r _seal_aes_gcmr2HsAB::b>E 6+k23;;E5<B +k* + 3 3F3BKc R Y YZa bbrctt||d}ttj|j dzS)zFEncrypt under AES-256-GCM and return the versioned ``v2:gcm:`` string.Nr'r r(r-)r2rbase64urlsafe_b64encoder6r'r r3s r_encrypt_aes_gcmr=Ys1!;DQF F44V<CCGL LLrchtj|ttd}t ||dS)zLDecrypt a versioned ``v2:gcm:`` string produced by :func:`_encrypt_aes_gcm`.Nr3r r()r:urlsafe_b64decodelenrr7r<s r_decrypt_aes_gcmrB_s.,,U3~3F3H-IJF KT JJrprefixct}t|ts tdt |||j d}|t j|jdjdzS)zhAES-256-GCM as unpadded base64url behind ``prefix``, which is also the AAD so a token can't change kind.z:Set LITELLM_SALT_KEY or a master key to mint bearer tokensr-r9ascii=) rrr ValueErrorr2r$r:r;r6rstrip)r'rCrr3s rencrypt_bearer_tokenrIesc#oH h $UVV!8W^I_`F F,,V4;;GDKKCP PPrtokenc,t}t|tr|j|sy|j |} t j |dt| dzzzdd}t|||jdS#t$rYywxYw) zVNone unless ``token`` came from :func:`encrypt_bearer_token` with the same ``prefix``.NrFs-_T)altcharsvalidater-r?) rrr startswith removeprefixr: b64decoderAr7r$r)rJrCrencodedr3s rdecrypt_bearer_tokenrSns#oH h $E,<,}K eS !(*m;(ec;AWXX+%[QO$66GNNwWO" """ ceijoeprw  s#;B! 2B!?!B!! B1*B,,B1keyexception_type)rXerrorreturn_original_valuect} t|trU|jtrt |t t|S tj|}t||}|S|S#t$rtj|}Y1wxYw#t$rl}d|d|d}|dk(r tj||r|ndcYd}~Stjd||r|cYd}~Stj|Yd}~yd}~wwxYw)NrVz Error decrypting value for key: z8, Did your master_key/salt key change recently? Error: zX Set permanent salt key - https://docs.litellm.ai/docs/proxy/prod#5-set-litellm-salt-keyrXz3Unable to decrypt value for key: %s, returning None)rrrrOrrBrr:r@rrQ decrypt_valuerrX exception)r'r]r^r`r decoded_b64r[ error_messages rdecrypt_value_helperrfs  'K  eS !/'ec;AWXX 6$66u= " MEL  6$..u5  6  :3%?xyzx{|UV W $ & &} 515t ;""#XZ]^ L * *= 9 sY?B A3"B1B3BBBB D  (DD D'D -DD cddl}ddl}ddl}|j|j }|j }|j j|}|j d}|j|}|S)Nrr-) r" nacl.secret nacl.utilsr#r$r%secret SecretBoxr0) r'r r"nacl hash_object hash_bytesbox value_bytes encrypteds rrWrWsl! (:(:(<=K#**,J&&z2Cg.K{{;/I rc<ddl}ddl}ddl}|j|j }|j }|j j|} t|dk(ry|j|}|jd}|S#t$r}|d}~wwxYw)Nrr-) r"rhrir#r$r%rjrkrAr5r6r) r'r r"rlrmrnro plaintextr[s rrbrbs! (:(:(<=K#**,J&&z2C u:?KK& $$W-  sB '#B BBB)N)r_F)r:rtypingrrrlitellm._loggingrr__annotations__r r r rrrbytesr&r2r7r=rBrIrSr\boolrfrWrbrrr{s ''1"! (>u=$ u$++3, 9S 9U 9 __3_UT\_e_c%ccc ccMCMcMcM KCKcKcK QQSQSQ  S S4Z t818"' ( ( (,-( (V3*SSr