tPjlUddlZddlZddlZddlmZmZddlmZmZddlm Z m Z m Z ddl m Z mZmZmZddlmZmZddlmZmZddlmZdd lmZdd lmZ dd lmZddl!Z!dd l"m#Z#dd l$m%Z%ddl&m'Z'ddl(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/ddl0m1Z1ddl2m3Z3ddl4m5Z5ddl6m7Z7m8Z8m9Z9e r ddl:m;Z;ddle e?d<Gdde Z@Gdde ZAdddeAfdZBdZCe e?d <d!eeDeEfdzdeFeDeDffd"ZGdrd#ZHd$eDd%e)d&eeDeEfdzd'eeDeEfdzd(e/d)eDdzddfd*ZId+d,d-d.d/d0d1d2d3d4d5d6 ZJe eFeDeDfe?d7<hd8ZKe eLeDe?d9<d:d;dd?d@dAdBZMe eFeDeDfe?dC<dDdEhZNe eLeDe?dF<e%ZOe e?dG<dHeeDeEfdIeLeDdeFeDeEffdJZPdKeFeDeDfdeFeDeDdzffdLZQGdMdNedOPZRdQeRdeDfdRZSdSeTedeFeDeEffdTZUdUeDeeDeEfzdeFeDeEffdVZVeJfdWeeDeEfdKeeDeDfddfdXZWdsd[ZXdsd\ZYdYdZd]eeDeDdzfddfd^ZZdsd_Z[dddYdZdWeeDeEfdeFeDeEffd`Z\e>jdadbgee1gcee1edddefd!e9d(e/d)eDdzfdfZ^e>jdadbgee1ge7gee1fd(e/fdhZ`e>jdadbgee1gcee1edddefd(e/d)eDdzfdiZbe>jdjdbgee1gcee1fd(e/fdkZce>jdldbgee1gcee1edddefd!e8d(e/d)eDdzdeFeDeDffdmZde>jdldbgee1ge7gee1fd(e/de7fdnZee>jdldbgee1gcee1edddefd(e/d)eDdzdeFeDeDffdoZfe>jdpdbgee1gcee1fd(e/deFeDeDffdqZgy#e$re ZYwxYw)tN)MappingSequence)datetimetimezone) TYPE_CHECKINGFinalProtocol) APIRouterDependsHeader HTTPException) BaseModel TypeAdapter)ReadOnly TypedDict)uuid) safe_dumps)safe_json_loads)RecordNotFoundError)verbose_proxy_logger)SensitiveDataMasker)get_async_httpx_client) AUDIT_ACTIONSCommonProxyErrorsKeyManagementSystemLiteLLM_AuditLogsLitellmTableNamesLitellmUserRolesUserAPIKeyAuth)user_api_key_auth)ConfigOverridesRepository)httpxSpecialProvider)ConfigOverrideSettingsResponseCyberArkConfigHashicorpVaultConfig) ProxyConfig) PrismaClientrouterc8eZdZedeeeefzdzfdZy)_ConfigOverrideRowreturnNcyN)selfs /home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/management_endpoints/config_override_endpoints.py config_valuez_ConfigOverrideRow.config_value3sAD)__name__ __module__ __qualname__propertystrrobjectr1r.r2r0r*r*2s( DcGCK$884?DDr2r*cxeZdZdeeefdedzfdZdeeefdeeeeeffdefdZdeeefdefdZ y)_ConfigOverridesTableClientwherer+Nc Kywr-r.r/r;s r0 find_uniquez'_ConfigOverridesTableClient.find_unique8datac Kywr-r.)r/r;rAs r0upsertz"_ConfigOverridesTableClient.upsert:r?r@c Kywr-r.r=s r0deletez"_ConfigOverridesTableClient.delete<r?r@) r3r4r5rr7r*r>r8rCrEr.r2r0r:r:7sg[wsCx'8[=ORV=V[j'#s("3j73PSUXPXHYCY;Zj_ejC'#s("3CCr2r: prisma_clientr'r+c,t|jSr-)r!table)rFs r0_config_overrides_tablerI?s $] 3 9 99r2z***REDACTED***_AUDIT_REDACTEDconfigc>|siS|Dcic] }|t c}Scc}w)aYStrip values from a config snapshot before audit-log emission. Hashicorp Vault config carries ``vault_token``, ``approle_secret_id``, ``client_key`` etc. Persisting them verbatim into ``LiteLLM_AuditLogs`` would let anyone with read access to the audit table harvest the proxy's KMS credentials. Keep keys, redact values. )rJ)rKks r0_redact_configrNFs%  (. /1A  // /scx|jry|j}|tjd|yy)Nz-Failed to write config override audit log: %s) cancelled exceptionrwarning)taskexcs r0_log_audit_task_exceptionrUSs7 ~~!C $$%TVYZr2 object_idaction before_config after_configuser_api_key_dictlitellm_changed_bycKddlm}m}ddlm}|syt j |tttjtjtj|xs|jxs||j t"j$||t'j(dt+|itt'j(dt+|it } | j-t.yw) a Emit an audit-log row for a /config_overrides/{object_id} mutation. Mirrors the ``store_audit_logs``-gated pattern from ``team_callback_endpoints.py``. Captured under ``LiteLLM_ConfigOverrides`` so the row co-locates with the table it mutates. r)create_audit_log_for_updateis_audit_logging_enabled)litellm_proxy_admin_nameNrKdefault) id updated_at changed_bychanged_by_api_key table_namerVrWupdated_values before_value) request_data)+litellm.proxy.management_helpers.audit_logsr]r^litellm.proxy.proxy_serverr_asyncio create_taskrr7ruuid4rnowrutcuser_idapi_keyrCONFIG_OVERRIDES_TABLE_NAMEjsondumpsrNadd_done_callbackrU) rVrWrXrYrZr[r]r^r_rSs r0_emit_config_override_audit_logrw[s D # %%%#*tzz|$#<< 5-f1B1J1JfNf#4#<#<,HH##zz8^L5Q*R\_`!ZZ>-3P(Q[^_  D 45sD D HCP_VAULT_ADDRHCP_VAULT_TOKENHCP_VAULT_APPROLE_ROLE_IDHCP_VAULT_APPROLE_SECRET_IDHCP_VAULT_APPROLE_MOUNT_PATHHCP_VAULT_CLIENT_CERTHCP_VAULT_CLIENT_KEYHCP_VAULT_CERT_ROLEHCP_VAULT_NAMESPACEHCP_VAULT_MOUNT_NAMEHCP_VAULT_PATH_PREFIX) vault_addr vault_tokenapprole_role_idapprole_secret_idapprole_mount_path client_cert client_keyvault_cert_rolevault_namespacevault_mount_namevault_path_prefixHASHICORP_ENV_VAR_MAPPING>rrrHASHICORP_SENSITIVE_FIELDSCYBERARK_API_BASECYBERARK_ACCOUNTCYBERARK_USERNAMECYBERARK_API_KEYCYBERARK_CLIENT_CERTCYBERARK_CLIENT_KEYCYBERARK_SSL_VERIFYCYBERARK_REFRESH_INTERVAL)cyberark_api_basecyberark_accountcyberark_usernamecyberark_api_keyrr ssl_verifyrefresh_intervalCYBERARK_ENV_VAR_MAPPINGrrCYBERARK_SENSITIVE_FIELDS_sensitive_maskerrAsensitive_fieldsci}|jD]9\}}|-||vr)t|trtj |||<5|||<;|S)zMMask sensitive fields for API responses. Non-sensitive fields are left as-is.)items isinstancer7r _mask_value)rArmaskedkeyvalues r0_mask_sensitive_fieldsrs[')Fjjl U  (8!8Zs=S+77>F3KF3K  Mr2env_var_mappingci}|jD])\}}tjj|}|||<+|S)zARead current env var values as fallback when no DB record exists.)rosenvironget)rvalues field_name env_var_name env_values r0_get_current_env_valuesrsGF$3$9$9$;' LJJNN<0 &z' Mr2cDeZdZUeeed<eeded<eeed<y)_JsonSchemaFieldtypeanyOf descriptionN)r3r4r5rr7__annotations__rr.r2r0rrs' 3- H/0 11#r2rF)total field_infocd|vr|dS|jdgD]*}|jddk7s|jddcSy)z?Extract the non-null type from a Pydantic v2 JSON schema field.rrnullstring)r)roptions r0_extract_field_typersV &!!.."-0 ::f  '::fh/ /0 r2 model_classct|jd}|jdi}i}|jD]&\}}|jddt |d||<(|jdd|dS)z?Build field_schema dict from a Pydantic model for UI rendering.T)by_alias propertiesr)rr)rr)r json_schemarrr)rschemaraw_propertiesrrrs r0_build_field_schemars ,88$8GF>-<' 3" : zz-4  r2rawcRt|tr t|iSt|S)z:Parse a config_value from DB (may be JSON string or dict).r`)rr7rdict)rs r0_parse_config_valuers##ssB// 9r2 config_datac|jD]Z\}}|j|}|"|dk7rt|tj|<;tjj |d\y)zPSet mapped env vars from config data. Unsets vars for missing/None/empty fields.Nr)rrr7rrpop)rrrrrs r0 _set_env_varsrs_ %4$9$9$;/ L +  "'*5zBJJ| $ JJNN< . /r2 proxy_configr&ctitjtjk(rdt_dt_d|_y)zVClear all Hashicorp Vault state: env vars, secret manager, and change-detection cache.N)rlitellm_key_management_systemrHASHICORP_VAULTsecret_manager_client_last_hashicorp_vault_configrs r0_clear_hashicorp_vault_staters7"%%)<)L)LL(,%)-&04L-r2cF|jtt|_yy)z[Capture deployment-provided CYBERARK_* env vars once, before the first DB-driven overwrite.N)_cyberark_boot_envrrrs r0_snapshot_cyberark_boot_envrs!&&.*ABZ*[ '/r2 env_valuesct|t|jdr |jdytjtjk7rydt_ dt_d|_ tjjdr |jdyy#t$rt j dYwxYw#t$rt j dYywxYw) zXRestore CYBERARK_* env vars and reinitialize (or drop) the secret manager to match them.rcyberarkkey_management_systemNz1Failed to restore previous CyberArk configurationrxhashicorp_vaultz>Failed to reinitialize Hashicorp Vault after CyberArk rollback)rrrinitialize_secret_manager ExceptionrrQrrrCYBERARKrrrr)rrs r0_restore_cyberark_runtimer s*67~~)*   2 2 2 T %%)<)E)EE$(G!%)G"04L- zz~~&' m  2 2IZ 2 [( ` * *+^ _ ` m * *+k l ms#B)C )C  C  C.-C.cJ|jxsi}t||d|_y)zMDrop DB-driven CyberArk state, restoring deployment-provided env vars if any.N)rr_last_cyberark_config)rboot_envs r0_clear_cyberark_stater"s+ ''-2 lH5)-L&r2cK|jt|}t|}t|j ddid|dd|idd{t |S7w)zSEncrypt and upsert the CyberArk config row; returns the stored (encrypted) payload. config_typerrr1r1createupdater;rAN)_encrypt_env_variablesrrrIrCr)rFrrencrypted_datar1s r0_persist_cyberark_configr+s )??[@QRN$^4L !- 0 7 7j) * ,     8    < (( sAA#A!A#z!/config_overrides/hashicorp_vaultzConfig Overrides)tags dependencieszThe litellm-changed-by header enables tracking of actions performed by authorized users on behalf of other users, providing an audit trail for accountability)rc&Kddlm}m}|jtj k7r t dd|%t dtjj|jd }t|jd d i d{}d}i}|]|jQt|j} |j| }t D]!} | |vs|j#| s|| || <#n9t%t }t D]!} | |vs|j#| s|| || <#|j'D cic]\} } | d k7s | | }} } t)|j#d} t)|j#d}t)|j#dxr|j#d}t)|j#dxr|j#d}| s t dd|s|s|s t ddt%t }t+| |j-d |j7|}t9|}t|j;d d id |dd|idd{t=||_||n|}|dnd}tAd ||||| d{d!d"d#S7+cc} } w#t.$r?}t+|t1j2dt5|t dd|d}~wwxYw77_w)$z Update Hashicorp Vault secret manager configuration. Sets environment variables, encrypts sensitive fields, and stores in DB. Reinitializes the secret manager on this pod. rrFr,Only admin users can update config overrides status_codedetailNT exclude_nonerrr;rrrrrrrzVault Address is requiredzAt least one authentication method is required: provide a Token, both AppRole Role ID and Secret ID, or both Client Certificate and Client Keyrz7Error reinitializing Hashicorp Vault secret manager: %s%Failed to initialize secret manager: rr1rrupdatedcreatedrVrWrXrYrZr[z2Hashicorp Vault configuration updated successfullysuccessmessagestatus)!rkrFr user_roler PROXY_ADMINr rdb_not_connected_errorr model_dumprIr>r1r_decrypt_db_variablesrrrrboolrrrrrQr7rrrCrrrw)rKrZr[rFrrexisting_recordexisting_decryptedr existing_datafieldrMvhas_vault_addrhas_token_authhas_approle_authhas_tls_cert_auth previous_enverr1rXrWs r0update_hashicorp_vault_configrEsx$G""&6&B&BBA  $;;AA  &,%6%6D%6%IK$;=#I#U#U/0$V$O48(*J"'C'C'O2?3O3OP )?? N. ?EK',>,B,B5,I%7%> E" ? --FG . 7EK'JNN5,A%/%6 E" 7 %0$5$5$7CDAq171a4CKC!!>?N !?@N";??3D#E#n+//ZmJno#KOOM$B$d{WcGde .  "2;L8  22KLL+ ..EV.W)?? LN$^4L !- 0 7 7/0 1 ,     8   1@ 0ML-2D1O-U_M0?0K9QZF )## +-  H }(D<  l#&&'`befgbhi:1#>    0sB LJ9A LL+'LL%L J<J<C L#K5AL:L ;4L/L0 L<L L  :LL  LL)rrresponse_modelcKddlm}ddlm}m}||s t dd|%t dt jjtt}t|jd d i d{}|P|jDt|j}|j|}t!|t"}t%d || St't(} t!| t"} t%d | | S7w) z} Get current Hashicorp Vault configuration. Returns decrypted values from DB, or falls back to current env vars. r_user_has_admin_viewrr*Only admin users can view config overridesrNrrrrrr field_schema)/litellm.proxy.management_endpoints.common_utilsr!rkrFrr rrrrr%rIr>r1rrrrr#rr rZr!rFrr$ db_recordrdecrypted_data masked_datarmasked_env_valuess r0get_hashicorp_vault_configr+sUF 1 2?  $;;AA  ..BCL5]COO/0PI!7!7!C01G1GH 7C6X6XYd6e3ND^_ -)%  00IJJ5jB\] )% ! +A:D<D=BDcKddlm}m}|jtj k7r t dd|%t dtjjt|jdd i d{}d}|1|j% |jt|j}d } t|j!dd i d{d }t)||rt+d d|d||d{dddS7#t$rd}YdwxYw7D#t"$rt%j&d Y`wxYw7Bw)z1Delete Hashicorp Vault configuration. Idempotent.rrr,Only admin users can delete config overridesrNrrrrFTz3No existing Hashicorp Vault config record to deletedeletedrz2Hashicorp Vault configuration deleted successfullyrr )rkrFrr rr r rrrrIr>r1rrrrErrdebugrrwrZr[rFrrrXr/s r0delete_hashicorp_vault_configr2 sG""&6&B&BBA  $;;AA  $;=#I#U#U/0$V$O/3M"'C'C'O !(>>?RSbSoSo?pqM GZ%m4;;=RcBd;eee!.-''/1    H A ! M ! f Z""#XYZ xA:E<D =E$D 6E9 D DD !EE E DEDED E>EEEz1/config_overrides/hashicorp_vault/test_connectioncKddlm}|jtjk7r t ddt j}t||s t dd tj|jd{} ttj }|j d }|j"r|j"|d <|j%||d{}|j'dd|j dS7#t$r}t d d |d}~wwxYw7I#t$r}t d d|d}~wwxYww)z Test the connection to the currently configured Hashicorp Vault. Uses the already-initialized secret manager client. Does not modify any state. r)HashicorpSecretManagerrz*Only admin users can test Vault connectionrrz>Hashicorp Vault is not configured. Save a configuration first.NzVault authentication failed: ) llm_providerz/v1/auth/token/lookup-selfzX-Vault-NamespaceheaderszVault token validation failed: rz#Successfully connected to Vault at r r )0litellm.secret_managers.hashicorp_secret_managerr5r rr r rrrrl to_thread_get_request_headersrrr" SecretManagerrrrraise_for_status)rZr5clientr9r async_client lookup_urlresponses r0test_hashicorp_vault_connectionrDLse""&6&B&BB?  11F f4 5S   292C2CFD_D_2`,`  4BVBdBde %0011KL  ! !+1+A+AG' ( , 0 0W 0 MM!!#89J9J8KL +-a  21#6   N  4QC8   smAE "D?DDAD+D) D+4E D D&D!!D&&E )D++ E 4EE  E z/config_overrides/cyberarkc Kddlm}m}|jtj k7r t dd|%t dtjj|jd }t|jd d i d{}d}i}|]|jQt|j} |j| }t D]!} | |vs|j#| s|| || <#n9t%t }t D]!} | |vs|j#| s|| || <#|j'D cic]\} } | d k7s | | }} } t)|j#d} t)|j#d}t)|j#dxr|j#d}| s t dd|s|s t ddt+|t%t }t-|t  |j/d  t9|||d{|_||n|}|dnd}t?d |||||d{dddS7cc} } w#t0$rD}t-|t t3j4dt7|t dd|d}~wwxYw7#t0$r@}t=||t3j4dt7|t dd|d}~wwxYw7w) z Update CyberArk Conjur secret manager configuration. Sets environment variables, encrypts sensitive fields, and stores in DB. Reinitializes the secret manager on this pod. rrrrrNrTrrrrrrrrrrzCyberArk API Base is requiredzmAt least one authentication method is required: provide an API Key, or both Client Certificate and Client Keyrz0Error reinitializing CyberArk secret manager: %srz+Error persisting CyberArk configuration: %sz*Failed to persist CyberArk configuration: rrrz+CyberArk configuration updated successfullyrr ) rkrFrr rr r rrrrrIr>r1rrrrrrrrrrrrrQr7rrrrw)rKrZr[rFrrrrrrrrMr has_api_basehas_api_key_authrrrrXrWs r0update_cyberark_configrHsS$G""&6&B&BBA  $;;AA  &,%6%6D%6%IK$;=#I#U#Uj)$V$O48(*J"'C'C'O2?3O3OP )?? N- ?EK',>,B,B5,I%7%> E" ?--EF - 7EK'JNN5,A%/%6 E" 7%0$5$5$7CDAq171a4CKC{/BCDL";??3E#FG#KOOM$B$d{WcGde 2  $5L   -12JKL+78 ..Z.P  3K <4 . *2D1O-U_M0?0K9QZF )# +-  A S"D2  l$<=&&'Y[^_`[ab:1#>   .   !, =&&'TVYZ[V\]?sC   sB LIA LL+'LL%L IIB.LI$J6'J4( J61 LL LL$ J1-?J,,J11L4J66 K??;K::K??LcKddlm}ddlm}m}||s t dd|%t dt jjtt}t|jd d i d{}|P|jDt|j}|j|}t!|t"}t%d || St't(} t!| t"} t%d | | S7w) z Get current CyberArk Conjur configuration. Returns decrypted values from DB, or falls back to current env vars. Sensitive fields are masked before leaving the server. rr rrr"rNrrrrr#)r%r!rkrFrr rrrrr$rIr>r1rrrrr#rrr&s r0get_cyberark_configrJsG  1 2?  $;;AA  .n=L4]COOj)PI!7!7!C01G1GH 6B6X6XYd6e3ND]^ -"%  00HIJ5jB[\ ) ! %r,cKddlm}m}|jtj k7r t dd|%t dtjjt|jdd i d{}d}|1|j% |jt|j}d } t|j!dd i d{d }t)||rt+d d|d||d{dddS7#t$rd}YdwxYw7D#t"$rt%j&d Y`wxYw7Bw)z1Delete CyberArk Conjur configuration. Idempotent.rrrr.rNrrrrFTz,No existing CyberArk config record to deleter/rz+CyberArk configuration deleted successfullyrr )rkrFrr rr r rrrrIr>r1rrrrErrr0rrwr1s r0delete_cyberark_configrL6sG""&6&B&BBA  $;;AA  $;=#I#U#Uj)$V$O/3M"'C'C'O !(>>?RSbSoSo?pqMGS%m4;; *-<   ,'- '/1    A ? ! M !   S""#QRS  r3z*/config_overrides/cyberark/test_connectioncKddlm}|jtjk7r t ddt j}t||s t dd tj|jd{} ttjd |j i }|j"d }|j%||d{}|j'dd|j"dS7x#t$r}t d d |d}~wwxYw7I#t$r}t d d|d}~wwxYww)z Test the connection to the currently configured CyberArk Conjur server. Uses the already-initialized secret manager client. Does not modify any state. r)CyberArkSecretManagerrz-Only admin users can test CyberArk connectionrrz7CyberArk is not configured. Save a configuration first.Nr6z CyberArk authentication failed: r)r7paramsz/whoamir8z"CyberArk token validation failed: rz-Successfully connected to CyberArk Conjur at r:)/litellm.secret_managers.cyberark_secret_managerrNr rr r rrrrlr<r=rrr"r>r conjur_addrrr?)rZrNr@r9rrA whoami_urlrCs r0test_cyberark_connectionrSvs[V""&6&B&BBB  11F f3 4L   292C2CFD_D_2`,`  4-;; &"3"34  &112': , 0 0W 0 MM!!#B6CUCUBVW +-a  5aS9   N  7s;   smAD>"C:?C8C:A DDD&D>8C:: DDDD>D D;&D66D;;D>)rSzasyncio.Task[None]r+N)rr&r+N)hrlrtrcollections.abcrrrrtypingrrr fastapir r r r pydanticrrtyping_extensionsrr litellm._uuidr*litellm.litellm_core_utils.safe_json_dumpsr*litellm.litellm_core_utils.safe_json_loadsr prisma.errorsr ImportErrorrrlitellm._loggingr0litellm.litellm_core_utils.sensitive_data_maskerr&litellm.llms.custom_httpx.http_handlerrlitellm.proxy._typesrrrrrrr$litellm.proxy.auth.user_api_key_authr 'litellm.repositories.table_repositoriesr!litellm.types.llms.custom_httpr"9litellm.types.proxy.management_endpoints.config_overridesr#r$r%rkr&litellm.proxy.utilsr'r(rr*r:rIrJr7r8rrNrUrwrrsetrrrrrrrrrrrrrrrrpostrrr+rEr2rDrHrJrLrSr.r2r0ris -'11==+1AF$11PICM? 60 EE D(D:>:>Y:*) 073;/$6 04S> 0[(6(6 (63;'$. (6 #v+&- (6 & (6d (6 (6\#$268*(,,.0 45c3h0 /E#c(O-*,*)''3 3%S#X/ .5S? /050 f!5SVZ[^`f[fVgT#s(^S#PT*_@Uy $4 T)_ c6k9J  S73;#77Df