tPjM"UddlmZmZddlmZmZmZddlmZddl m Z m Z m Z ddl mZdZeed<Gdd Zd Zeed <d Zeed <dededefdZedZeed<dddddedegeefdedeeedfdzdedzdedzdefdZy)) AwaitableCallable)AnyFinalTypeVar)verbose_proxy_logger)DB_CONNECTION_ERROR_TYPESProxyErrorTypesProxyException) str_to_bool_MAX_EXCEPTION_CHAIN_DEPTHc eZdZdZedefdZededefdZededefdZ ededefdZ ededefdZ ededefd Z ededefd Z ededefd Zededefd Zedefd Zy)PrismaDBExceptionHandlerz< Class to handle DB Exceptions or Connection Errors returnctddlm}|jdd}t|tr|St |duryy)zj Returns True if the request should be allowed to proceed despite the DB connection error r)general_settings allow_requests_on_db_unavailableFT)litellm.proxy.proxy_serverrget isinstanceboolr )r!_allow_requests_on_db_unavailables g/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/db/exception_handler.py&should_allow_request_on_db_unavailablez?PrismaDBExceptionHandler.should_allow_request_on_db_unavailablesB @8H8L8LMoqv8w) 7 >4 4 8 9T Aecddl}t|tryt||jjj ryt|t xr|jtjk(S)a(True only for a database that is temporarily unreachable and is expected to come back on its own. This is the gate for ``allow_requests_on_db_unavailable``, which lets the proxy keep serving, and issue fallback identities, without a verified database. Only a transient outage justifies that. A fault that will never resolve by itself, such as a query engine that is missing or version-skewed, a malformed query the client library built, or a transaction used incorrectly, must surface rather than be absorbed into an indefinite degraded mode. Membership is an allowlist, so an unrecognized failure is treated as permanent. A genuine outage reaches the caller as one of ``DB_CONNECTION_ERROR_TYPES``: the engine is a local HTTP server, and an unreachable database surfaces as a transport error against it rather than as a prisma type. Reporting decisions want the opposite breadth; use ``is_database_infrastructure_error`` for those. rNT) prisma.engine.errorsrr engineerrorsEngineConnectionErrorr typer no_db_connectionrprismas ris_database_connection_errorz5PrismaDBExceptionHandler.is_database_connection_error$sS, $ a2 3 a--CC D!^,[?;[;[1[[rcddl}|jj|jj|jj|jj |jj |jj|jjf}t||ryt|tryt||jjryt|tr|jtjk(ryy)uTrue when the failure came from the database or its query engine rather than from the caller's request. This answers a reporting question, not a serving one: should the caller be told the service is at fault, or that their request was. It stays deliberately broad, because a permanently faulted engine is still a service problem, and reporting one as a credential failure sends an operator looking in the wrong place. Widening it can only change which error a caller sees; it never grants access. Known data-layer PrismaError subclasses (``UniqueViolationError``, ``RecordNotFoundError``, etc.) are excluded — the DB IS reachable and the request itself is what failed. rNFT)r&r! DataErrorUniqueViolationErrorForeignKeyViolationErrorMissingRequiredValueError RawQueryErrorTableNotFoundErrorRecordNotFoundErrorrr PrismaErrorr r#r r$)rr&data_layer_errorss r is_database_infrastructure_errorz9PrismaDBExceptionHandler.is_database_infrastructure_errorBs  MM # # MM . . MM 2 2 MM 3 3 MM ' ' MM , , MM - -$  a* + a2 3 a22 3 a (QVV7W7W-WrcLddl}t||jjuS)aTrue iff ``e`` is a base prisma ``DataError``: the database processed the statement and refused the data itself (e.g. ``invalid byte sequence for encoding "UTF8": 0x00``), as opposed to a connectivity failure. Matched by exact type, not ``isinstance``: the specific data-layer subclasses (``UniqueViolationError``, ``TableNotFoundError``, ``MissingRequiredValueError`` ...) all derive from ``DataError`` but carry their own semantics, and a systemic one like a missing table must not be mistaken for a single poison row and bisected away. A raw Postgres execution error with no prisma P-code surfaces as the base ``DataError``. prisma also wraps the P1001 "can't reach database server" outage as a base ``DataError``, so a caller that must not treat an outage as a per-row data rejection has to additionally consult ``is_database_service_unavailable_error`` before acting on a True here. rN)r&r#r!r)r%s ris_prisma_data_errorz-PrismaDBExceptionHandler.is_prisma_data_errorgs & Aw&--1111rcddl}t|tryt||jj|jj fryt||jj r0t|jd}tfd|Dryt|tr|jtjk(ryy)u? Returns True only for transport/connectivity failures where a reconnect attempt makes sense (e.g. DB is unreachable, connection dropped). Use this for reconnect logic — data-layer errors like UniqueViolationError mean the DB IS reachable, so reconnecting would be pointless. rNT) zcan't reach database serverzcannot reach database serverz can't connectzcannot connectzconnection errorzconnection closedz timed outtimeoutzconnection refusedznetwork is unreachablezno route to hostz broken pipec3&K|]}|v yw)N).0keyword error_messages r zGPrismaDBExceptionHandler.is_database_transport_error..sO7m+OsF)r&rr r!ClientNotConnectedErrorHTTPClientClosedErrorr0strloweranyr r#r r$)rr&connection_keywordsr;s @ris_database_transport_errorz4PrismaDBExceptionHandler.is_database_transport_error~s  a2 3   55 33   a22 3#&q6<<>M * O;NOO a (QVV7W7W-Wrcddl}t||jjsyt |dddk(ryt |j }d|vxs d|vxsd |vS) zNTrue iff ``e`` is a Postgres deadlock (P2034 / 40P01) surfaced through prisma.rNFcodeP2034Tzdeadlock detected40p01zwrite conflict or a deadlock)r&rr!r0getattrr?r@)rr&r;s ris_deadlock_errorz*PrismaDBExceptionHandler.is_deadlock_errorsh !V]]667 1fd #w .A  = 0 ?-' ?-> rcddl}t||jjryt |dd}|E|j j jddjdry|j}|Ey) afTrue iff ``e`` is a non-``PrismaError`` exception raised from inside prisma-client-py's query-engine layer. During the instant a DB connection is torn down, the query engine can return a malformed error payload (``user_facing_error.meta`` is ``null``). prisma-client-py's ``handle_response_errors`` then crashes with ``AttributeError: 'NoneType' object has no attribute 'get'`` before it can raise the proper P1001 "can't reach database server" error. That AttributeError carries no connection keyword, so it can't be matched by message; identify it by its ``prisma.engine`` origin instead. Recognized ``PrismaError`` subclasses are excluded: connectivity ones are already classified by type/keyword above, and data-layer ones (the DB IS reachable) must stay 401. rNF __traceback____name__z prisma.engineT) r&rr!r0rHtb_frame f_globalsr startswithtb_next)rr&tbs ris_prisma_engine_internal_errorz8PrismaDBExceptionHandler.is_prisma_engine_internal_errorsn$  a22 3 Q .n{{$$((R8CCOTBnrcddl}tj|rytj|rytj |rydt |j vryt|t|jfry ddl }t||jj|jjfS#t$rYywxYw)aTrue iff the exception means the database could not answer at the infrastructure level (connection refused, socket/interface failure, timeout) rather than a genuine auth failure (key not found) or a data-layer error (the DB IS reachable and rejected the data). Auth must answer 401 only for a key the DB confirms is invalid. When the DB itself is unreachable, the request has to surface as 503 so callers retry instead of treating valid keys as invalid during an outage. Note: prisma-client-py mislabels the P1001 "can't reach database server" connectivity failure as a ``DataError`` (a data-layer type), so a type-only check misses real outages. ``is_database_transport_error`` keyword-matches the connection message and catches that masquerade, while genuine data errors (no connection keyword) correctly stay 401. The Postgres "cached plan must not change result type" error is matched here, not in ``is_database_transport_error``: it is a transient stale-DB- state condition (not an invalid key), but the connection is healthy so it must not trigger a reconnect. A non-``PrismaError`` raised from inside the prisma query engine (e.g. the ``AttributeError`` from ``handle_response_errors`` when the engine returns a malformed error payload mid-tear-down) is also treated as unavailable; see ``is_prisma_engine_internal_error``. rNTz'cached plan must not change result typeF)asynciorr2rCrSr?r@rOSError TimeoutErrorasyncpg ImportError exceptionsPostgresConnectionErrorInterfaceError)rrUrXs r%is_database_service_unavailable_errorz>PrismaDBExceptionHandler.is_database_service_unavailable_errors8  # D DQ G # ? ? B # C CA F 4A  F a'7#7#78 9   ""::""11     sB;; CCc|}ttD]E}t|tsytj |ry|j xs |j}Gy)azLike ``is_database_service_unavailable_error`` but also walks the ``__cause__`` / ``__context__`` chain. ``is_database_service_unavailable_error`` classifies a single exception by type, which a caller that catches a raw DB failure and re-raises a domain exception of a different type defeats. ``get_user_object`` in ``litellm/proxy/auth/auth_checks.py`` is the concrete case: it wraps every DB error, a genuine outage included, in a bare ``ValueError`` whose original error survives only as ``__context__``. A type check on the ``ValueError`` misses the outage, so the caller would mistake an infrastructure fault for an auth failure. Walking the chain recovers the real signal, which is the PEP 3134 way to inspect a wrapped cause. The walk is depth-bounded, which also makes it cycle-safe. FT)rangerr Exceptionrr] __cause__ __context__)rcurrent_s r.is_database_service_unavailable_error_in_chainzGPrismaDBExceptionHandler.is_database_service_unavailable_error_in_chainsW")*12 ?Agy1'MMgV''>7+>+>G  ? rcZtj|rtjry|)aK Primary handler for `allow_requests_on_db_unavailable` flag. Decides whether to raise a DB Exception or not based on the flag. - If exception is a DB Connection Error, and `allow_requests_on_db_unavailable` is True, - Do not raise an exception, return None - Else, raise the exception N)rr'r)rs rhandle_db_exceptionz,PrismaDBExceptionHandler.handle_db_exception)s& % A A! D(OOQ rN)rL __module__ __qualname____doc__ staticmethodrrr`r'r2r4rCrIrSr] BaseExceptionrergr8rrrrsT D  \ \d\\:"I"$""H2 2d22,(y(T((T  Y  4    986 6 t6 6 p-D2 y  rrg@"_DEFAULT_RECONNECT_TIMEOUT_SECONDSg?'_DEFAULT_RECONNECT_LOCK_TIMEOUT_SECONDSvaluefallbackrcht|ttfrt|ts t|S|S)zReturn `value` if it is a real int/float, else `fallback`. Guards against tests that mock `prisma_client` and leave the timeout slots as MagicMock instances.)rintfloatr)rorps r_coerce_timeoutrtAs*%#u&z%/FU| Or _ReadResultTN)retry_safe_error_typestimeout_secondslock_timeout_seconds prisma_client coro_factoryreasonrv.rwrxc"K |d{S7#t$r}tj|s| t||st |dst ||n t |ddt}t ||n t |ddt}tjd|| |j|||d{7} n+#t$r} tjd|| || d} ~ wwxYw| s|d{7cYd}~Sd}~wwxYww)u9 Run a Prisma read coroutine with one transport-reconnect-and-retry. The canonical "self-heal a transient DB transport blip" wrapper used by `PrismaClient.get_generic_data` and other read paths. Mirrors the inline pattern in `auth_checks._fetch_key_object_from_db_with_reconnect` so we have a single implementation rather than three drifting copies. Behavior: 1. Await `coro_factory()`. On success, return its value. 2. On exception, if it is NOT a transport error (per `is_database_transport_error`), re-raise — data-layer errors like `UniqueViolationError` mean the DB is reachable, reconnect would be pointless. Transport errors outside `retry_safe_error_types` are re-raised too. 3. If `prisma_client` does not expose `attempt_db_reconnect`, re-raise. This guards against partial stand-ins / older clients in tests. 4. Call `prisma_client.attempt_db_reconnect(reason=...)`. If it returns False (cooldown / lock contention / reconnect failure), re-raise. 5. Otherwise await `coro_factory()` a second time and return / propagate its result. At-most-one retry by construction — no infinite loop. `coro_factory` MUST be a zero-arg callable that returns a fresh awaitable on each call. Passing an already-awaited coroutine would fail on retry with `RuntimeError: cannot reuse already awaited coroutine`. `reason` should follow `___failure` so telemetry distinguishes between fan-out callers (e.g. `_update_config_from_db` issues four concurrent reads). Args: prisma_client: The `PrismaClient` (or stand-in) that owns `attempt_db_reconnect` and the `_db_auth_reconnect_*` defaults. coro_factory: Zero-arg callable returning the read awaitable. reason: Telemetry tag forwarded to `attempt_db_reconnect`. retry_safe_error_types: Which transport errors may be replayed, or None for every transport error. A non-idempotent write must narrow this to `DB_RETRY_SAFE_ERROR_TYPES`, where the statements provably never reached the database. timeout_seconds: Optional override for the reconnect cycle timeout. Defaults to `prisma_client._db_auth_reconnect_timeout_seconds`, then to 2.0s. lock_timeout_seconds: Optional override for how long the helper will wait to acquire the reconnect lock. Defaults to `prisma_client._db_auth_reconnect_lock_timeout_seconds`, then to 0.1s. Returns: Whatever `coro_factory()` returns (on first or second attempt). Raises: Whatever `coro_factory()` raises if the failure is not a transport error, or if the reconnect attempt does not succeed, or if the retry also fails. Nattempt_db_reconnect"_db_auth_reconnect_timeout_seconds'_db_auth_reconnect_lock_timeout_secondszNDB transport error on read; attempting reconnect-and-retry. reason=%s error=%s)r{rwrxz^DB reconnect attempt raised; preserving original transport error. reason=%s reconnect_error=%s) r`rrCrhasattrrtrHrmrnrwarningr}) ryrzr{rvrwrx first_excresolved_timeoutresolved_lock_timeout did_reconnect reconnect_excs rcall_with_db_reconnect_retryrMsB~:$!^### 8$'CCIN  ! -jLb6c }&<= "1#. ],PRVW . # (7(3%],UW[\ 3 (  $$ \    /)6)K)K 0%:*L*$$M  / ( (p   .  /  "^###q8$syD D D BD&C=C>CD C, C''C,,D<C?=DD DD  D)collections.abcrrtypingrrrlitellm._loggingrlitellm.proxy._typesr r r litellm.secret_managers.mainr r__annotations__rrmrnrsrtrur?tupler#r`rr8rrrs//&&1 5%'E&ffX -0"E/14'43%En- e-BF$()-y$y$2y667y$  y$ "$y/3"67$> y$ T\ y$ $,y$y$r