tPjUdZddlZddlZddlZddlZddlmZmZddlmZm Z m Z ddl m Z m Z mZmZmZmZddlmZddlmZddlmZmZmZmZmZmZmZmZmZm Z dd l!m"Z"dd l#m$Z$dd l%m&Z&m'Z'm(Z(m)Z)dd l*m+Z+m,Z,dd l-m.Z.m/Z/ddl0m1Z1ddl2m3Z3e Z4e e5d<dZ6e e5d<de7defdZ8d5dZ9de de fdZ:deddfdZ;dede7d e d!e d"e d#e7dzddf d$Z?d%e@de7defd&ZAe4jd'd(ge e"g)e1e e"edd*+fded,ede7d"e d#e7dzf d-ZCe4jd.d(ge e"ge/e1 d7d,ede7d0e7d"ee e e"fd#ee7dzed*+ff d1ZEe4jd2d(ge e"g)e1e e"edd*+fd,ede7d"e d#e7dzfd3ZFe4jd'd(ge e"g)e1e e"fd,ede7d"e fd4ZHy)8zc Endpoints to control callbacks per team Use this when each team should control its own callbacks N)datetimetimezone) AnnotatedAnyFinal) APIRouterDependsHeader HTTPExceptionRequeststatus)verbose_proxy_logger)uuid) AddTeamCallbackLiteLLM_AuditLogsLiteLLM_TeamTableLitellmTableNamesProxyErrorTypesProxyExceptionTeamCallbackDeleteResponseTeamCallbackDeleteResponseDataTeamCallbackMetadataUserAPIKeyAuth)user_api_key_auth)callback_config_error)_CALLBACK_VAR_ENCRYPTED_PREFIXdecrypt_callback_varsencrypt_callback_varsis_sensitive_callback_key) _get_validated_callback_metadata(convert_key_logging_metadata_to_callback)_refresh_cached_team_verify_team_access)management_endpoint_wrapper)TeamRepositoryrouterz***REDACTED***_CALLBACK_VARS_REDACTEDmessagereturnc tdd|iS)Nerror status_codedetailr )r(s /home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/management_endpoints/team_callback_endpoints.py_callback_config_errorr27s S'71C DDdatac^t|j|j}| t|yN)r callback_name callback_varsr2)r4r,s r1_validate_team_callbackr9;s0(););T=O=OPE $U++r3metadatact|ts|Stj|}|j d}t|t rS|D]N}t|tst|j dts4|dDcic] }|t  c}|d<P|j d}t|tr:t|j dtr|dDcic] }|t  c}|d<|Scc}wcc}w)ayStrip secret values out of a team-metadata snapshot before audit logging. Both ``team_metadata["logging"]`` (list of ``AddTeamCallback`` dicts) and ``team_metadata["callback_settings"]["callback_vars"]`` carry provider credentials such as ``langfuse_secret_key``, ``langsmith_api_key``, and ``gcs_path_service_account``. Persisting them verbatim into ``LiteLLM_AuditLogs`` would let anyone with read access to the audit table harvest team callback credentials, so we replace each value with a fixed marker. The keys themselves are kept so the audit reader can still see *which* fields changed. loggingr8callback_settings) isinstancedictcopydeepcopygetlistr')r:redactedlogging_entriesentrykr=s r1_redact_callback_secretsrHAs h %mmH-H%\\)4O/4($ fE%&:eii6PRV+WNSTcNd)e!-D*D)eo& f (||,?@#T*z:K:O:OP_:`bf/gRcdsRt-uQa1H.H-u/* O *f.vs C9#C> callbacksc|jsyt|jD]N}|j|}t|st|j t sr?rrrBrCr r!rP)rQ decryptedrEresolvedrFcallbackr=s r1_resolve_team_callbacksrZvs$ mT *#%%,];I&]]95O"')(2?D(I_r tEeT*7UK\]H?XjrsH  t$-==1D#E9CDUW[9\ 5#4 5bvbx "(+ Or3cx|jry|j}|tjd|yy)u0Surface a fire-and-forget audit-log task failure. ``asyncio.create_task`` swallows exceptions silently — if the audit write fails (transient DB error etc.) we'd otherwise lose the row without any signal. Log at warning level so the operator sees there's a gap in the audit trail. Nz+Failed to write team-callback audit log: %s) cancelled exceptionrwarning)taskexcs r1_log_audit_task_exceptionras9 ~~!C $$%RTWXr3team_idbefore_metadataafter_metadatauser_api_key_dictlitellm_changed_byc"Kddlm}m}ddlm}|syt |}t |} t j|tttjtjtj|xs|j xs||j"t$j&|dt)j*d| itt)j*d|it } | j-t.yw) aEmit an audit-log row for a team-callback mutation. Mirrors the ``store_audit_logs``-gated pattern used in ``team_endpoints.py``: the call is async-fire-and-forget and is a no-op when audit logging is not enabled on the proxy. Captured under ``LitellmTableNames.TEAM_TABLE_NAME`` so the row co-locates with other team mutations in the audit table. Callback secrets are redacted before serialization so the audit table cannot itself become a credential-harvest sink. r)create_audit_log_for_updateis_audit_logging_enabled)litellm_proxy_admin_nameNupdatedr:)default) id updated_at changed_bychanged_by_api_key table_name object_idactionupdated_values before_value) request_data)+litellm.proxy.management_helpers.audit_logsrhrilitellm.proxy.proxy_serverrjrHasyncio create_taskrrLruuid4rnowrutcuser_idapi_keyrTEAM_TABLE_NAMEjsondumpsadd_done_callbackra) rbrcrdrerfrhrirjredacted_beforeredacted_afterr_s r1_emit_team_callback_audit_logrs&D # %5oFO4^DN%%#*tzz|$#<< 5-f1B1J1JfNf#4#<#<,<<! #zz:~*FPST!ZZ_(EsS  D 45sD Dr.c t|d|iS)zMBuild the ``{"error": ...}`` failure body the team callback endpoints return.r,r-r0)r.r(s r1_callback_errorrs ! r3z/team/{team_id:path}/callbackzteam management)tags dependencieszThe litellm-changed-by header enables tracking of actions performed by authorized users on behalf of other users, providing an audit trail for accountability) description http_requestc K ddlm}ddlm}m}m}|#t dd|jji|j|dd d{} | t d dd |d ittd$i| j|d{t|| j} | jd} | t!| t"sg} | D]} | jd|j$k(s"| jd|j&k(sAt)d|j$d|d|j&t*j,t.j0dt3j4| } | j7|j| | d<t9| } t;j<| }t?|j@jCd|id|iddid{}|tEd d |d tG|||d{tI|| | ||d{d|dS777O7)7#t $r}|d}~wt($r}|d}~wtJ$rg}tMjNd|t)d tQ|zt.jRjtU|d!d"t*jV#d}~wwxYww)%a Add a success/failure callback to a team Use this if if you want different teams to have different success/failure callbacks Parameters: - callback_name (Literal["langfuse", "langsmith", "gcs"], required): The name of the callback to add - callback_type (Literal["success", "failure", "success_and_failure"], required): The type of callback to add. One of: - "success": Callback for successful LLM calls - "failure": Callback for failed LLM calls - "success_and_failure": Callback for both successful and failed LLM calls - callback_vars (StandardCallbackDynamicParams, required): A dictionary of variables to pass to the callback - langfuse_public_key: The public key for the Langfuse callback - langfuse_secret_key: The secret key for the Langfuse callback - langfuse_secret: The secret for the Langfuse callback - langfuse_host: The host for the Langfuse callback - langfuse_environment: The tracing environment for the Langfuse callback (lowercase; falls back to LANGFUSE_TRACING_ENVIRONMENT) - gcs_bucket_name: The name of the GCS bucket - gcs_path_service_account: The path to the GCS service account - langsmith_api_key: The API key for the Langsmith callback - langsmith_project: The project for the Langsmith callback - langsmith_base_url: The base URL for the Langsmith callback Example curl: ``` curl -X POST 'http:/localhost:4000/team/dbe2f686-a686-4896-864a-4c3924458709/callback' -H 'Content-Type: application/json' -H 'Authorization: Bearer sk-1234' -d '{ "callback_name": "langfuse", "callback_type": "success", "callback_vars": {"langfuse_public_key": "pk-lf-xxxx1", "langfuse_secret_key": "sk-xxxxx"} }' ``` This means for the team where team_id = dbe2f686-a686-4896-864a-4c3924458709, all LLM calls will be logged to langfuse using the public key pk-lf-xxxx1 and the secret key sk-xxxxx rCommonProxyErrors prisma_clientproxy_logging_objuser_api_key_cacheNr,r-team find_uniquerbrq query_typer+ Team id = z0 does not exist. Please use a different team id.team_objrer<r7 callback_typecallback_name = z9 already exists in team_callback_settings, for team_id = z and event = )r(codetypeparamrbr:object_permissionTwherer4includeteam_rowrrrbrcrdrerfsuccessr r4zGlitellm.proxy.proxy_server.add_team_callbacks(): Exception occured - %sInternal Server Error, rNoner(rrrrS),litellm.proxy._typesrrxrrrr db_not_connected_errorrOget_datar#r model_dumpr9r:rBr>rCr7rrr HTTP_400_BAD_REQUESTrbad_request_errorr@rAappendrrrr%tableupdaterr"r Exceptionrr]rLinternal_server_errorgetattrHTTP_500_INTERNAL_SERVER_ERROR)r4rrbrerfrrrr_existing_teamrQteam_callback_settingsrYrcteam_metadata_json new_team_rowes r1add_team_callbacksrs6nf :   !2!I!I!O!OP  -55gRXer5ss  !:gY6f!gh "&E)B)B)DE/   %'// -:->->y-I ! )xsdt=|j@xsd}|S77cc} w777n#tB$rtD$rtF$r}tIjJd |tIjLtOjPtEd!tS|ztTjVjtY|d"d#tZj\$d}~wwxYww)%a Remove a single callback from a team The team's other callbacks stay registered and keep firing. Use this instead of POST /team/{team_id}/disable_logging, which clears every callback on the team at once. Every entry registered under this callback_name is removed, across callback types, so a callback registered for both "success" and "failure" is deregistered by one call. Parameters: - team_id (str, required): The unique identifier for the team - callback_name (str, required): The name of the callback to remove, matched exactly as it was registered with POST /team/{team_id}/callback (e.g. "langfuse", "langsmith", "gcs") Example curl: ``` curl -X DELETE 'http://localhost:4000/team/dbe2f686-a686-4896-864a-4c3924458709/callback/langsmith' -H 'Authorization: Bearer sk-1234' ``` Covers callbacks registered through POST /team/{team_id}/callback and the Admin UI. Teams still on the deprecated callback_settings metadata shape hold no such entries, so this returns 404 for them; POST /team/{team_id}/disable_logging remains the way to clear those. Returns 404 if the team does not exist, or if callback_name is not registered for the team. rrrNrrrrr does not exist.rr<rSr7rz! is not registered for team_id = .rbr:rTrz- does not exist. Error removing team callbackrrrz Callback z removed for team rbsuccess_callbacksfailure_callbacksr r(r4zJlitellm.proxy.proxy_server.delete_team_callback(): Exception occurred - %srrrr)/rrrxrrrrrrOrr#rrr:rBr>rCr?lenrrrr%rrr"rrZrrrKsuccess_callbackfailure_callbackr rrrr,debug traceback format_excrLrrrr r)rrbr7rerfrrrrrrQregistered_callbacksentriesrFremaining_callbacksupdated_metadataencrypted_metadatar updated_team survivingresponsers r1delete_team_callbackrs)Za:   !#'8'O'O'U'UV V&3&<&<='=' !   !!#G9t3dtA|ztBjDjFtI|dd tJjL!d}~wwxYww)#a Disable all logging callbacks for a team Callbacks registered through POST /team/{team_id}/callback and the Admin UI are cleared, so re-enabling logging means registering them again with their callback_vars Parameters: - team_id (str, required): The unique identifier for the team Example curl: ``` curl -X POST 'http://localhost:4000/team/dbe2f686-a686-4896-864a-4c3924458709/disable_logging' -H 'Authorization: Bearer sk-1234' ``` rrNrr,No db connectedr-rrrrrrrr=r<rbr:rTrz, does not exist. Error updating team loggingrrrzLogging disabled for team rrzJlitellm.proxy.proxy_server.disable_team_logging(): Exception occurred - %srrrrrS)'rxrrrr rr#rrr:r@rArBrrrrrrr%rrr"rrbrrrr,rrrrLrrrOrr r)rrbrerfrrrrrQrcrrVrrrs r1disable_team_loggingrs@h    CBS8TU U -55gRXer5ss  !:gY6F!GH "&E)B)B)DE/   '// !%}!=(5(9(9:Mr(R,@,ZCY,Z"79"368"3.H-R-R-T )*$& i -m< $(JJ}$=%3=$A$G$G$N$Ng&01)$/ %O%    :gY6b!cd #!1/   ,+(/1     3G9='//%'%'  It 0 "  $     ""#oqrs""9#7#7#9:-A6 66<<!Wf-66    sI2FFAF7F8B8F0F1*FFF3F4FIFFFFFI6B H??IIc K ddlm}|tdddi|j|dd d{}|td dd |d it t di|j |d{t|j}d||j|j|jddS77C#t$rt$rt$r }tjd|tj t#j$t'|trZtt)|dd|dt*j,j.t)|ddt)|dt0j2t'|tr|tdt5|zt*j,j.t)|ddt0j2d}~wwxYww)a Get the success/failure callbacks and variables for a team Parameters: - team_id (str, required): The unique identifier for the team Example curl: ``` curl -X GET 'http://localhost:4000/team/dbe2f686-a686-4896-864a-4c3924458709/callback' -H 'Authorization: Bearer sk-1234' ``` This will return the callback settings for the team with id dbe2f686-a686-4896-864a-4c3924458709 Covers callbacks registered through POST /team/{team_id}/callback and the Admin UI as well as teams still on the deprecated callback_settings shape, resolved from the team's stored metadata with the same precedence used at request time. A key-level logging config overrides the team's at request time and is not reflected here. Credential-bearing callback_vars are returned masked as `***REDACTED***` Returns { "status": "success", "data": { "team_id": team_id, "success_callbacks": team_callback_settings_obj.success_callback, "failure_callbacks": team_callback_settings_obj.failure_callback, "callback_vars": team_callback_settings_obj.callback_vars, }, } r)rNrr,rr-rrrrrrrr)rbrrr8rzHlitellm.proxy.proxy_server.get_team_callbacks(): Exception occurred - %sr/zInternal Server Error()rrr.rrrS)rxrr rr#rrrZr:rrr8rrrr,rrrr>rrrrOr rrL)rrbrerrrVrs r1get_team_callbacksrsR: <  CBS8TU U -55gRXer5ss  !:gY6F!GH "&E)B)B)DE/   -DND[D[,\" "%?%P%P%?%P%P!;!I!I   #t "     ""#mopq""9#7#7#9: a ' 8/EaS-JK$::@@a&1Q v/T/TU   > *G-A6 66<<!Wf-66    sMG".B9B5AB93B74AB94G"5B97B99GDGGG")r4rr)N)r_zasyncio.Task[None]r)Nr6)I__doc__ryr@rrrrtypingrrrfastapirr r r r r litellm._loggingr litellm._uuidrrrrrrrrrrrr$litellm.proxy.auth.user_api_key_authr5litellm.proxy.common_utils.callback_config_validationr)litellm.proxy.common_utils.callback_utilsrrrr$litellm.proxy.litellm_pre_call_utilsr r!1litellm.proxy.management_endpoints.team_endpointsr"r#&litellm.proxy.management_helpers.utilsr$$litellm.repositories.team_repositoryr%r&__annotations__r'rLr2r9rHrPobjectrZrarintrpostrdeleterrrBrrSr3r1rsu  '((NN1   CW O? "21ECEME, ss4C-ACdC6(6(6J(V Y.6 .6.6 .6 & .6 d .6 .6bs}#  +,-   )00A(B%+ t& W W W W & W d W   W t3  +,--   GG GG!9J1K!KL G " d x   G GT%  +,-  )00A(B%+ t& B B B &B d B   B J#  +,-  )00A(B] ] ] &]   ] r3