Ë
    uPêjð  ã                   ó  — U d Z ddlmZ ddlmZ ddlmZ ddlmZ ddl	m
Z
mZmZ ddlmZmZmZ  e
ddd	«       e
d
d
dd¬«       e
ddd«       e
dddd¬«       e
ddd«       e
ddd«       e
dddd¬«       e
ddd«       e
ddd«       e
ddd«       e
dddd ¬!«       e
d"d"d#«       e
d$d$d%«       e
d&d&d'«       e
d(d(d)«       e
d*d*d+«      fZeee
d,f      ed-<    ed.„ eD «       «      Zeee      ed/<   eD � ci c]  } | j.                  | j0                  “Œ c} Zeeeef      ed0<   d1Zeed2<    edd¬3«       G d4„ d5«      «       Zd6eeef   d7eeef   fd8„Zd9ed7ed:z  fd;„Zd9ed7ed:z  fd<„Z d=eeef   d:z  d>eeef   d7efd?„Z!y:c c} w )@ay  Resolved SSO config object.

Reconciles the dedicated ``sso_config`` DB row (lowercase, per-value encrypted
keys) with the process environment (uppercase env vars) into a typed
``SSOConfig`` plus per-field provenance. This is the single source of truth for
the SSO field -> env-var mapping, used by both the read-back endpoint and the
save endpoint so the two can never drift.
é    )ÚMapping)Ú	dataclass)ÚFinal)Údecrypt_value_helper)ÚFieldDescriptorÚFieldSourceÚresolve_fields)ÚRoleMappingsÚ	SSOConfigÚTeamMappingsÚgoogle_client_idÚGOOGLE_CLIENT_IDÚgoogle_client_secretÚGOOGLE_CLIENT_SECRETT)Ú	is_secretÚmicrosoft_client_idÚMICROSOFT_CLIENT_IDÚmicrosoft_client_secretÚMICROSOFT_CLIENT_SECRETÚmicrosoft_tenantÚMICROSOFT_TENANTÚgeneric_client_idÚGENERIC_CLIENT_IDÚgeneric_client_secretÚGENERIC_CLIENT_SECRETÚgeneric_authorization_endpointÚGENERIC_AUTHORIZATION_ENDPOINTÚgeneric_token_endpointÚGENERIC_TOKEN_ENDPOINTÚgeneric_userinfo_endpointÚGENERIC_USERINFO_ENDPOINTÚgeneric_scopeÚGENERIC_SCOPEzopenid email profile)ÚdefaultÚsaml_idp_metadata_urlÚSAML_IDP_METADATA_URLÚsaml_idp_metadata_xmlÚSAML_IDP_METADATA_XMLÚsaml_sp_entity_idÚSAML_SP_ENTITY_IDÚsaml_allow_unsolicitedÚSAML_ALLOW_UNSOLICITEDÚproxy_base_urlÚPROXY_BASE_URL.ÚSSO_DESCRIPTORSc              #   óN   K  — | ]  }|j                   sŒ|j                  –— Œ y ­w)N)r   Ú
field_name)Ú.0Úds     úg/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/config_resolvers/sso.pyú	<genexpr>r5   1   s   è ø€ Ò4jÀaÐ^_×^iÓ^i°Q·\µ\Ñ4jùs   ‚%”%ÚSSO_SECRET_FIELDSÚSSO_FIELD_ENV_VARS)Úrole_mappingsÚteam_mappingsÚ_STRUCTURED_KEYS)ÚfrozenÚslotsc                   ó,   — e Zd ZU eed<   eeef   ed<   y)ÚResolvedSSOConfigÚconfigÚ
provenanceN)Ú__name__Ú
__module__Ú__qualname__r   Ú__annotations__ÚdictÚstrr   © ó    r4   r>   r>   9   s   … àÓØ�S˜+Ð%Ñ&Ô&rH   r>   ÚrawÚreturnc           
      ó’   — | j                  «       D ��ci c]&  \  }}|t        |t        «      rt        ||d¬«      n|“Œ( c}}S c c}}w )NT)ÚvalueÚkeyÚreturn_original_value)ÚitemsÚ
isinstancerF   r   )rI   rM   rL   s      r4   Ú_decryptrQ   ?   sQ   € ð
 Ÿ)™)›+÷	ñ ˆC�ð 	ÜV`ÐafÔhkÔVlÔ  u°#ÈTÕRÐrwñ	xóð ùó s   ”+AÚdataNc                 ó<   — t        | t        «      rt        di | ¤ŽS d S ©NrG   )rP   rE   r
   ©rR   s    r4   Ú_parse_role_mappingsrV   H   s   € ä#-¨d´DÔ#9Œ<Ñ˜$ÑÐC¸tÐCrH   c                 ó<   — t        | t        «      rt        di | ¤ŽS d S rT   )rP   rE   r   rU   s    r4   Ú_parse_team_mappingsrX   M   s   € Ü#-¨d´DÔ#9Œ<Ñ˜$ÑÐC¸tÐCrH   Ússo_db_settingsÚenvc                 ó¢  — | rt        | «      ni }t        |j                  «       D ��ci c]  \  }}|t        vsŒ||“Œ c}}«      }t	        t
        ||«      \  }}|j                  d«      |j                  d«      t        |j                  d«      «      t        |j                  d«      «      dœ}t        di i |¥|¥¤Ž}	t        |	|¬«      S c c}}w )a„  Resolve the effective SSO config: stored row first, then process env.

    Decryption happens here, once, via the pure ``decrypt_value_helper``; this
    function never writes ``os.environ`` (unlike the legacy read path). Values
    are returned unmasked so the login path could consume them; the read-back
    endpoint is responsible for masking secrets before responding to the UI.
    Ú
user_emailÚui_access_moder8   r9   )r\   r]   r8   r9   )r?   r@   rG   )rE   rQ   rO   r:   r	   r/   ÚgetrV   rX   r   r>   )
rY   rZ   rI   rM   rL   Ú	decryptedÚvaluesr@   Ú
structuredr?   s
             r4   Úresolve_sso_configrb   Q   s¿   € ñ +:”�oÔ&¸r€CÜ¸c¿i¹i»k× i±
°°UÈSÔXhÒMh  e¡Ó iÓj€IÜ'¬¸ÀCÓHÑ€FˆJà—m‘m LÓ1Ø#Ÿ-™-Ð(8Ó9Ü-¨c¯g©g°oÓ.FÓGÜ-¨c¯g©g°oÓ.FÓGñ	€Jô Ñ9Ð 8 6Ð 8¨ZÐ 8Ñ9€FÜ F°zÔBÐBùó !js
   ¨C
¹C
)"Ú__doc__Úcollections.abcr   Údataclassesr   Útypingr   Ú0litellm.proxy.common_utils.encrypt_decrypt_utilsr   Ú+litellm.proxy.config_resolvers._descriptorsr   r   r	   Ú/litellm.types.proxy.management_endpoints.ui_ssor
   r   r   r/   ÚtuplerD   Ú	frozensetr6   rF   r1   Úenv_varr7   rE   r:   r>   ÚobjectrQ   rV   rX   rb   )r3   s   0r4   ú<module>rn      s`  ðòõ $Ý !Ý å Q÷ñ ÷
ñ ñ Ð&Ð(:Ð<NÓOÙÐ*Ð,BÐDZÐfjÔkÙÐ)Ð+@ÐBWÓXÙÐ-Ð/HÐJcÐosÔtÙÐ&Ð(:Ð<NÓOÙÐ'Ð)<Ð>QÓRÙÐ+Ð-DÐF]ÐimÔnÙØ(Ð*JÐLlóñ Ð,Ð.FÐH`ÓaÙÐ/Ð1LÐNiÓjÙ�O _°oÐOeÔfÙÐ+Ð-DÐF]Ó^ÙÐ+Ð-DÐF]Ó^ÙÐ'Ð)<Ð>QÓRÙÐ,Ð.FÐH`ÓaÙÐ$Ð&6Ð8HÓIð%7€��u˜_¨cÐ1Ñ2Ñ3ó ñ. ,5Ñ4jÈ?Ô4jÓ+jÐ �5˜ 3™Ñ(Ó jØN]Ö,^È¨Q¯\©\¸1¿9¹9Ñ-DÒ,^Ð �E˜$˜s C˜x™.Ñ)Ó ^ð =Ð �%Ó <ñ �$˜dÔ#÷'ð 'ó $ð'ð
�'˜#˜v˜+Ñ&ð ¨4°°V°Ñ+<ó ðD˜vð D¨,¸Ñ*=ó Dð
D˜vð D¨,¸Ñ*=ó DðC¨°°V°Ñ(<¸tÑ(Cð CÈ'ÐRUÐWZÐRZÑJ[ð CÐ`qô Cùò? -_s   Ã5F