tPj bdZddlmZmZddlmZddlmZmZedZ dede dd fd Z dedd fd Z y ) z RBAC utility helpers for feature-level access control. These helpers are used by agent and vector store endpoints to enforce proxy-admin-configurable toggles that restrict access for internal users. )FinalLiteral) HTTPException)LitellmUserRolesUserAPIKeyAuth)agents vector_storesuser_api_key_dict feature_namereturnNcK|jtjtjtjjtjjfvryddlm}m}m}d|d}d|d}|j|dsy|j|drdd l m }|||| d{}|rytd d d |di7w)a Raise HTTP 403 if the user's role is blocked from accessing the given feature by the UI settings stored in general_settings. Args: user_api_key_dict: The authenticated user. feature_name: Either "agents" or "vector_stores". Nr)general_settings prisma_clientuser_api_key_cachedisable__for_internal_usersallow__for_team_adminsF)_user_has_admin_privileges)r rrerrorz Access to z5 is disabled for your role. Contact your proxy admin. status_codedetail) user_roler PROXY_ADMINPROXY_ADMIN_VIEW_ONLYvaluelitellm.proxy.proxy_serverrrrget/litellm.proxy.management_endpoints.common_utilsrr) r r rrr disable_flagallow_team_admins_flagris_admins j/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/common_utils/rbac_utils.pycheck_feature_access_for_userr&s""$$..$$**..44 '  %\N2EFL&,\N:J$K    e 42E: !;/'1!     :l^3hij  sB/C1C 2CcK|jtjtjjfvryddlm}|j ddsytdddi w) u Raise HTTP 403 if the caller is an org admin and key generation is disabled for org admins via UI settings. Only blocks the ORG_ADMIN role — proxy admins and all other roles are unaffected, so those paths continue to be gated by their existing auth checks. Nr)r"disable_key_generate_for_org_adminFrrzDkey generation is disabled for org admins. Contact your proxy admin.r)rr ORG_ADMINrrrr r)r rs r%!check_org_admin_can_generate_keysr*Gsh""""""((+ ;    De L _` sA A") __doc__typingrrfastapirlitellm.proxy._typesrr FeatureNamer&r*r%r2sU"!A/0 3%33 3l% r1