tPji UdZddlZddlmZmZddlmZmZmZm Z ddl m Z er ddl m Z ddlmZddlmZmZmZmZmZmZed ZeGd d ZeGd d ZdedefdZd9dededefdZd:dededefdZde eefde!ede eeffdZ"d;dZ#dedede!ededef dZ$dededefdZ%dededdedefd Z&d!e eeffd"Z'dedefd#Z(gd$Z)ee*d%<d&efd'Z+d(ededdfd)Z,ded*ed+ed,e-d-e-def d.Z.dedefd/Z/dede!efd0Z0d1d2gZ1ee*d3<d1gZ2ee*d4<ded5ede!efd6Z3 dz2MigrationReport.residual_legacy..[s8#3::8sumr0rs r!residual_legacyzMigrationReport.residual_legacyXs8888r#c:td|jDS)Nc34K|]}|jywr3)rr8s r!r;z6MigrationReport.total_undecryptable.._s?3$$?r<r=rs r!total_undecryptablez#MigrationReport.total_undecryptable]s????r#c|j|j|jDcic]}|j|j c}dScc}w)N)r?rBr0)r?rBr0rr")r r:s r!r"zMigrationReport.as_dictasE#33#'#;#;AEP##,, 5P  Qs"A )r$r%r&r'rlistr0rr)r5propertyr*r?rBr+r(objectr"r,r#r!r.r.Osz0&+D&AItN#A&.&T&999@S@@ c6k* r#r.valuercPt|txr|jtS)zETrue if ``value`` is already an AES-256-GCM (``v2:gcm:``) ciphertext.) isinstancer( startswithr)rGs r! is_migratedrKns eS ! Fe&6&6~&FFr#keyct|tsy|dk(ry|jtryt ||dd}|yy) uClassify a stored value for the residual scanner. * ``not-a-string`` — not a string (numbers/bools/None left as-is on disk). * ``migrated`` — carries the ``v2:gcm:`` prefix. * ``legacy`` — decrypts under the legacy nacl reader (still needs migrating). * ``plaintext`` — a non-empty string that does not decrypt and is not v2; treated as legacy plaintext (nothing to migrate). * ``undecryptable`` — reserved for callers that already know a value is ciphertext but cannot decrypt it; ``classify_value`` itself cannot tell a corrupt ciphertext from plaintext, so it returns ``plaintext`` for both. rrrdebugFrGrLexception_typereturn_original_valuer)rIr(rJrrrGrL decrypteds r!classify_valuerUssJ eS ! { '+%SQXpuvI r#ct|tr|dk(r|S|jtr|St ||dd}||St |S)a^Re-encrypt a single stored string into the configured (AES) format. Returns the value unchanged if it is not a string, is already ``v2:``, or cannot be decrypted (skip-on-undecryptable). Otherwise decrypts under the format-detecting reader and re-encrypts through ``encrypt_value_helper`` (which writes AES when the gate is on). rNrOFrP)rIr(rJrrrrSs r!reencrypt_valuerWsV eS !Ub[  ' +%SQXpuvI  **r#datasensitive_keyscrt|}|D]&}|j|}|t||||<(|S)zReturn a copy of ``data`` with only ``sensitive_keys`` re-encrypted. Non-sensitive fields (e.g. ``base_url``, ``connection_id``) are left as-is. Null/missing fields are skipped. rL)r+getrW)rXrYoutkvs r!reencrypt_selective_dictr`sH dC + GGAJ 9  *A + Jr#cddlm}|jt}t |t r|j tk(stdtd|dy)uFail fast if the AES algorithm gate is not enabled. Running the migration with the gate off would decrypt then re-encrypt right back into the legacy format — a no-op that silently fails the migration. r)general_settingszFEncryption migration requires general_settings.encryption_algorithm: 'z'. Current value: zW. Set it before migrating so re-encrypted values are written in the AES-256-GCM format.N) litellm.proxy.proxy_serverrbr\r rIr(lowerr RuntimeError)rbalgos r!_assert_aes_gate_enabledrgs_ <"&&'DED tS !djjlm&C 09L L  'Dr# prisma_client param_namesensitive_fieldsdry_runclKt|}|jjjd|id{}| |j|S|j}t |t rtj|}t |ts|Sd}|D]}|j|} | |xjdz c_ t| |} | dk(r|xjdz c_ T| d k(r]|r|xjdz c_qt| |} | | k7r| ||<|xj dz c_d }|xjdz c_|xj"dz c_|rH|sF|jjj%d|id tj&|i d{|S7u7 w) zMigrate a single ``LiteLLM_Config`` row whose ``param_value`` is a JSON dict with selected sensitive fields (vantage_settings / cloudzero_settings). rriwhereNFr[rrT param_valuerorX)rdblitellm_config find_uniquerqrIr(jsonloadsr+r\rrUrrrWrrupdatedumps) rhrirjrkr1recordsettingschangedfldr_clsnew_vs r!_migrate_config_settings_rowrs#J7F'**99EE\[eLfEggF ~++3 !!H(C ::h' h % G" LL  9 !QC( *     "   (? " #A3/Ez % 1$ "    ! 3"6w--44,H!565    MWhN s"8F4F/E-F4(F2)F42F4cKtd}|jjjddid{}| |j|S|j}t |t rtj|}t |ts|St|}d}|jD]\}}t |t r|dk(r|xjdz c_ t|| } | d k(r|xjdz c_ Y| d k(r]|r|xjdz c_vt|| } | |k7r| ||<|xj dz c_d }|xjdz c_|xj"dz c_|rH|sF|jjj%ddid tj&|id{|S77 w)zMigrate the ``LiteLLM_SSOConfig`` row. All non-null fields are encrypted (via the same ``_encrypt_env_variables`` path used on save), so we re-encrypt every present string field. sso_configrmidrnNFrNrpr[rrT sso_settingsrr)rrslitellm_ssoconfigrurrIr(rvrwr+itemsrrUrrrWrrrxry) rhrkr1rzr{ new_settingsr|r}r_r~rs r!_migrate_sso_configrs #L9F'**<<HHPTVbOcHddF ~,,4 ""H(C ::h' h % x.LG..""Q!S!Q"W !QC( *     "   (? " #A3/Ez$) S!1$ "    ! 1"4w0077& $**\":;8    MWeN s"8GG F GGGG table_name)teamverification_tokenc Kddlm}m}t|d}|dk(r|jj }d}n|jj }d}|jd{}|xsgD])} t| d d} t| trd | vrd | vr*d} t| D]r} | jD]]} |xjd z c_ t| }|d k(r|xjd z c_>|dk(r| d z } I|xj d z c__t| dk(r|r|xj"| z c_ ||| }|xj.| z c_|j1|t| |id t3j4|id{,|S7:#t$$rL}t'j(d|t| |dt+||xj,| z c_Yd}~d}~wwxYw7dw)aMigrate callback-var credentials on the team or verification-token table. Covers both shapes the ``decrypt_callback_vars`` / ``encrypt_callback_vars`` transforms understand: ``metadata.logging[*].callback_vars.`` and the top-level ``metadata.callback_settings.callback_vars.``. Reuses those proven transforms (selective, prefix-marked; legacy plaintext is left alone until re-encrypted). r)decrypt_callback_varsencrypt_callback_varsz.callback_varsrmrteam_idtokenNmetadataloggingcallback_settingsrprrz7Skipping %s row %s callback_vars (transform failed): %s?rr))litellm.proxy.common_utils.callback_utilsrrrrslitellm_teamtablelitellm_verificationtoken find_manygetattrrIr+_iter_callback_var_dictsvaluesr_classify_callback_valuerrr Exceptionr warningr(rrrxrvry)rhrrkrrr1tablepkrowsrowr row_legacycvsr_r~ re_encryptedes r!_migrate_callback_vars_tabler3s #zl.,IJFV  22   :: ))Dzr0 3 D1(D)ix.GL_goLo  +H5 *CZZ\ *!#.q1*$%%*%H_!OJ$$)$ * * ?   MMZ 'M  01Fx1PQL :%llwsB'(djj67   [0 d Mg*H  ( (IR%A    J .   sKA!G:#F$CG:9F A G:G8 G: G5)AG0*G:0G55G:rc#@K|jdgxsgD]9}t|ts|jd}t|ts6|;|jd}t|tr'|jd}t|tr|yyyw)asYield each ``callback_vars`` dict in a metadata structure. Mirrors ``_transform_callback_vars``: credentials live both under ``logging[*].callback_vars`` and under the top-level ``callback_settings.callback_vars``. Counting only the former would let the walker report success while leaving ``callback_settings`` secrets in legacy format at rest. r callback_varsrN)r\rIr+)rentryrrs r!rrsi,2 eT "))O,C#t$  (||,?@#T*##O4 c4 I !+s*B!BABcpddlm}t|tsy|}|j |}t |dS)aClassify one stored callback-var value, independent of the AES gate. Encrypted callback vars carry the ``litellm_enc::`` marker in front of the ciphertext; strip it, then classify the inner value the same way the covered-table scanner does (``v2:gcm:`` prefix -> migrated, nacl-decryptable -> legacy, otherwise plaintext). Detecting legacy by decrypt rather than by a re-encrypt delta is what makes the ``check_encryption`` attestation correct even when run with the AES write gate off. r)_CALLBACK_VAR_ENCRYPTED_PREFIXrcallbackr[)rrrIr( removeprefixrU)rGrinners r!rrs9 eS ! E   = >E %Z 00r#)) model_tablelitellm_proxymodeltable)litellm_paramsr,) credentialslitellm_credentialstable)credential_valuesr,) mcp_serverlitellm_mcpservertable)renv_varsr,)mcp_user_credentialslitellm_mcpusercredentialsr,)credential_b64)mcp_user_env_varslitellm_mcpuserenvvarsr,) values_b64_COVERED_TABLE_SPECSobjc# K|g}|rz|j}t|tr|nQt|tr |j |j n!t|t r|j ||ryyyw)a,Yield every string leaf in a nested dict/list/scalar structure. Iterative (explicit stack) on purpose: recursion here is banned by the code-quality recursive-function detector (unbounded nesting has caused CPU spikes in the past), and an explicit stack walks arbitrary depth safely. N)poprIr(r+extendrrD)rstackcurs r!_iter_encrypted_stringsrsc#&E iik c3 I T " LL & T " LL  s A>BBr1c|xjdz c_t|d}|dk(r|xjdz c_y|dk(r|xjdz c_y|xjdz c_y)u'Classify one stored string and bump the matching read-only counter. Only genuine nacl ciphertext lands in ``legacy``; non-secret strings (model names, base URLs, …) do not decrypt and fall through to ``plaintext``, so over-scanning a column is harmless to the residual count. rpscanr[rrN)rrUrrr)r1rGr~s r!_classify_into_reportrs] NNaN62C jQ   Ar#rdb_attr json_columnsscalar_columnscVKt|}t|j|d}||S |jd{}|xsgD]} |D]T} t| | d} | t| tr tj| } t| D]} t|| V|D],} t| | d} t| ts!t|| .|S7#t$r,}t j d|t||cYd}~Sd}~wwxYw#ttf$rYwxYww)Nrmzscan: %s unavailable: %s)rrrsrrr rOr(rIrvrw ValueError TypeErrorrr)rhrrrrr1rrrrcolrawsr_s r!_scan_one_tablers<#H5F=++Wd;E } !OO--zr1 1C#sD)C{#s#**S/C-S1 1%fa0 1 1" 1CS$'A!S!%fa0 11 M). ""#=xQP #I.so(D)CCC.D)2DAD)D)C D%!D DD) DD)D&#D)%D&&D)cKtd} |jjjddid{}| |j|S|j}t|tr tj|}t|D]}t|||S7d#t$r+}t j dt||cYd}~Sd}~wwxYw#ttf$ri}YjwxYww)zEScan the ``environment_variables`` config row (``param_value`` dict).config_environment_variablesrmrienvironment_variablesrnNz%scan: config env vars unavailable: %s)rrsrtrurr rOr(rqrIrvrwrrrr)rhr1rzrrGrs r!_scan_config_env_varsrs",JKF+..==IIQ]_vPwIxx~++3   E% JJu%E%U +)fa() My ""#JCPQFS I& E sh C0+B"B B",C0-CC0 B"" C+ C C C0CC0C-*C0,C--C0c Kg}tD]-\}}}}|jt|||||d{/|jt|d{|S7.7 w)zDRead-only classification of every rotation-covered table. No writes.N)rr4rr)rhreportsrr json_cols scalar_colss r!_scan_covered_tablesrsf+-G5Ih1'9k_]HgyZeffgh NN.}==> Ng=s!.A#A #A#A! A#!A#api_keyintegration_token_VANTAGE_SENSITIVE_CLOUDZERO_SENSITIVEuser_api_key_dictcKddlm}t|d{Dcic]}|j|}}t }| t d|t d|t d|||d{t|d{}|D]K}|j|j}|r |jnd} td| |jz |_ M|S7cc}w7p7_w)aORe-encrypt the tables already covered by ``_rotate_master_key`` (model table, credentials, MCP credential/env tables, config environment_variables) by running that orchestrator in *same-key* mode. With the AES gate on, the re-encrypt writes land in ``v2:`` format. ``_rotate_master_key`` returns no counts, so we bracket it with read-only scans: the pre-scan's legacy total minus the post-scan's gives the number actually migrated per location, and the post-scan supplies the residual / already-v2 / scanned figures. Returns one report per covered location. r)_rotate_master_keyNzfCannot migrate covered tables: no salt key / master key is set. Set LITELLM_SALT_KEY before migrating.r r )rhrcurrent_master_keynew_master_key) ;litellm.proxy.management_endpoints.key_management_endpointsrrrrrerr\rmaxr) rhrrrpre current_keypost post_report pre_report pre_legacys r!_migrate_covered_tablesr/s0DM/R)RSA!**a-SCS&K t   >=9/1BC&"  -];;DG WW[112 *4Z&&!  #1j;3E3E&EF  G K+*SSC#CC#CD7?"D;!D9" D;/D;1D;3D;5D;7D;9D;cKt}t|d{D]}|j||jt|ddd{|jt|ddd{|jt |dt dd{|jt |dt dd{|jt|dd{|S7777^767w)aRead-only residual scan across **every** at-rest location. No writes. Covers both the rotation-managed tables (model / credentials / MCP credential and env-var tables / config ``environment_variables``) and the net-new walker locations (team and verification-token ``callback_vars``, vantage / cloudzero config rows, SSO config). Reports how many values are still ``legacy``; ``residual_legacy == 0`` across this full scan is the compliance attestation. NrT)rkrrr)r.rr5rrrrr)rhr1rs r!check_encryptionr}s$%F.m<< 7 JJ1-QUVVW JJ1-AU_cdde JJ1-ASUgquvvw JJ*=:NPdnrss JJ(EEF M=WdvsEsiDC:6DC<$D7C>8)D!D")D D #D/D0 D<D>DDDD)r)migrate)rN)F)6r'rv dataclassesrrtypingrrrrlitellm._loggingr litellm.proxy._typesr litellm.proxy.utilsr 0litellm.proxy.common_utils.encrypt_decrypt_utilsr r rrrr ValueClassrr.rFboolrKr(rUrWr+rDr`rgrrrrrrr)rrtuplerrrrrrrrr,r#r!rs@ (66130W X      0     <GvG$G &s 2+6++F+( 4V #4 d3i TXY\^dYdTe  05553i5 5  5p1V1d1~1hNN45NN NbtCK'8*1F1z1@e$."         Fv.*fn9M'(;<E<(ke)$$F$W[\jWk$T$$$$ $N&_r#