tPjAUdZddlZddlmZmZmZmZmZddlm Z ddl m Z ddl m Z ddlmZddlmZmZmZmZmZdd lmZmZmZmZmZmZmZmZdd lm Z m!Z!m"Z"dd l#m$Z$m%Z%m&Z&ddl'Z'dd l(m)Z)dd l*m+Z+ddl,m-Z-ddl.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:ddl;mZ>ddl?m@Z@ddlAmBZBddlCmDZDddlEmFZFmGZGmHZHddlImJZJmKZKmLZLddlMmNZNmOZOmPZPddlQmRZRddlSmTZTddlUmVZVddlWerddlXmYZZGddeZ[Gdd eZ\Gd!d"eZ]Gd#d$eZ^ed%eTd&e[fd'Z_ed%eRd&e\fd(Z_ed%eVd&e]fd)Z_ed%eNeOzePzd&e^fd*Z_d%eTeRzeVzeNzeOzePzd&e`fd+Z_Gd,d-ZaGd.d/e%ZbGd0d1e Zced2d3geeKg4Zdeeed5<d6Zfd7egd&e0fd8Zhd9egd&e/fd:Zid;ejd&ebfd<Zk dd=egdzd>egdzd?eldzd@emdzdAeneodzdBeneodzd&epege`ffdCZqd&elfdDZrese1je1je1je1jfZxd&exfdEZyd&egdzfdFZzdGene{dHegdzdIexd&e1dzfdJZ|dKeJdLenegd&ene{fdMZ}dKeJdNeegd&dfdOZ~GdPdQeZGdRdSeZGdTdUeZGdVdWeZeeeeefZGdXdYeZdZed&egfd[ZdZed&egdzfd\Ze!epege`fZeeed]<d^e`d&eege`fdzfd_Zd`e`d&elfdaZGdbdce%ZdddedfegdKeJdgedzd&eegdhffdiZdZedKeJd&efdjZdked&efdlZdmeed&efdnZdkedoeegd&egdzfdpZdmeedoeegd&eegdhffdqZGdrdse%ZGdtdue%Zd7egdvegdKeJd&e5dzfdwZdfegdxeegdyeegdhfd&eegdhffdzZd{eedxeegdKeJd&eegfd|Zd{eedvegdKeJd&ecfd}Zd~ed&ecfdZdenegd&enefdZd7egdenegdenegd&dfdZdZeeed<de`d&elfdZd7egdeld&efdZdKeJd7egd&dfdZdeege`fdzd&eldzfdZd;e0d&eldzfdZdd7egdvegd&e5dzfdZde/d&enegfdZdefdZddegd&eefdZd&eefdZedj[ddee>eegedj[dddee>eegdefdZedj[ddee>eegdefdZedj[ddee>eegedhdfdedegfdZedj[ddee>eegdefdZedj[ddee>eegedhdfdedegfdZedj[dedee>eegdefdZdegd&eegegfdzfdZedj[dedee>eegeddedddedfdededegdzfdZedj[dejdee>eegedhdfd7egfdZedjsdejdee>eegedhfd;ejfdZedjwdejdee>eegedhdedhfd7egd;ejfdZedj{ddee>gedhdfd7egfdZdke`d&edzfd„Zdfe`d&eedhffdÄZdfe`d&enegfdĄZdegdzdegd&enegfdDŽZdegdfe`depege`fd&dfdʄZdegdfe`depege`fd&dfd˄Zdegdfe`depege`fd&dfd̄Zdegdegdfe`depege`fd&df d΄Zdegdfe`deegdegdzd&eegdzf dЄZdegd&egfdфZdegdegdfe`depege`fd&df d҄Zdegdegdfe`depege`fd&df dӄZde0ded&eepege`feegffdքZded&elfd؄Ze dd٬ګGdۄdܫZded&efd݄ZGdބdeЫZdegdegee`fd&eedhffdZdeeegegee`ffd&eedhffdZd7egd9egd&dfdZd7egd9egd&dfdZ dd7egdenegdenegdeld&elf dZedjdejdee>eegedhdedhfd7egdefdZGdde%dZedj[dedee>eegeddedddedfdededegdzfdZedj[dedee>eegedhd򬢫fdegfdZd9egdegdzdee2d&e3fdZedjsdedee>eegedhfd~efdZedjwdedee>eegedhd򬢫edhfdegd~efdZedj{ddee>gedhd򬢫fdegfdZdede/dKeJd&eepege`feegeegdzffdZdegdepege`fdKeJfdZdegdeegdeegd&dfdZedjdedee>eegedhd򬢫edhfdegdefdZy(u ✨ SCIM v2 Endpoints for LiteLLM Proxy using Internal User/Team Management This is an enterprise feature and requires a premium license. N) AwaitableCallableIterableMappingSequence)deepcopy) dataclass)partial)chain) TYPE_CHECKINGFinal NamedTupleProtocoloverload) APIRouterBodyDepends HTTPExceptionPathQueryRequestResponse) BaseModel TypeAdapterValidationError)ReadOnly TypedDict assert_never)verbose_proxy_logger)uuid safe_dumps) LiteLLM_TeamTableLiteLLM_UserTableLitellmUserRolesMemberNewTeamRequestNewUserRequestNewUserResponseProxyErrorTypesProxyExceptionTeamMemberAddRequestTeamMemberDeleteRequestUserAPIKeyAuth)_delete_cache_key_object)user_api_key_auth)_safe_get_request_headersnew_user)ScimTransformations)new_teamteam_member_addteam_member_delete) PrismaClient_premium_user_checkhandle_exception_on_proxy)InvitationLinkRepository OrganizationMembershipRepositoryTeamMembershipRepository)TeamRepository)UserRepository)VerificationTokenRepository)*)LiteLLM_VerificationTokenc eZdZdeeefdedzfdZdeeefdedzfdZ ddeeefdzde dzde dzdeeefdzde ef d Z deeefd eeefdefd Z deeefdedzfd Z ddeeefdzde fd Zy)_UserTableClientwherereturnNc KywNselfrEs t/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/management_endpoints/scim/scim_v2.py find_firstz_UserTableClient.find_firstPc KywrHrIrJs rL find_uniquez_UserTableClient.find_uniqueRrNrOskiptakeorderc KywrHrIrKrErRrSrTs rL find_manyz_UserTableClient.find_manyT '*rOdatac KywrHrIrKrErYs rLupdatez_UserTableClient.update\rNrOc KywrHrIrJs rLdeletez_UserTableClient.delete^rNrOc KywrHrIrJs rLcountz_UserTableClient.count`rNrONNNNrH)__name__ __module__ __qualname__rstrobjectr$rMrQintrrWr\r^r`rIrLrDrDOs\gc6k&:\?PSW?W\]wsF{';]@QTX@X].2*. *sF{#d**Dj*Dj * sCx 4' * # $ *n'#v+"6mgc6k>RmWhmX'#v+"6X;Lt;SXPf!5!<PPrhrDc eZdZdeeefdedzfdZ d deeefdzdedzdedzdeeefdzde ef dZ deeefd eeefdefd Z deeefdedzfd Z ddeeefdzdefd Z y)_TeamTableClientrErFNc KywrHrIrJs rLrQz_TeamTableClient.find_uniquedrNrOrRrSrTc KywrHrIrVs rLrWz_TeamTableClient.find_manyfrXrOrYc KywrHrIr[s rLr\z_TeamTableClient.updatenrNrOc KywrHrIrJs rLr^z_TeamTableClient.deleteprNrOc KywrHrIrJs rLr`z_TeamTableClient.countrrNrOrarH)rbrcrdrrerfr#rQrgrrWr\r^r`rIrhrLrjrjcs]wsF{';]@QTX@X].2*. *sF{#d**Dj*Dj * sCx 4' * # $ *n'#v+"6mgc6k>RmWhmX'#v+"6X;Lt;SXPf!5!<PPrhrjcVeZdZd deeefdzddfdZdeeefdeeefddfdZy) _VerificationTokenTableClientNrErFz!Sequence[PrismaVerificationToken]c KywrHrIrJs rLrWz'_VerificationTokenTableClient.find_manyvrNrOrYzPrismaVerificationToken | Nonec KywrHrIr[s rLr\z$_VerificationTokenTableClient.updatexs +.rOrH)rbrcrdrrerfrWr\rIrhrLrqrqusMtWS&[%9D%@tLot/S&[)/18f1E/ )/rhrqc&eZdZdeeefdefdZy)_UserReferencingTableClientrErFc KywrHrIrJs rL delete_manyz'_UserReferencingTableClient.delete_many~rNrON)rbrcrdrrerfrgrwrIrhrLruru}sHwsF{';HHrhru repositoryrFcyrHrIrxs rL_tabler{ **%+N=,I%J%U%U!1!-+H$I$P$Pm334.99.99"&'7'@'@A  AL@WK!1!;!;<]_ %Q %  )LL\ZZZG $  [sJAF.F%CF. F( A6F.F*F. F,!F.(F.*F.,F.rH) rbrcrd__doc__ staticmethodr8r(reSCIMUserrrIrhrLrrsT:#'D[#D[(D[4ZD[ D D[D[rhrceZdZUdZedzed<edzed<edzed<eeed<edzed<edzed<edzed <edzed <ee dzed <ee dzed <y) ScimUserDataz-Typed structure for extracted SCIM user data.Nrr sso_user_idr given_name family_nameactive enterprise entitlementsroles) rbrcrdrre__annotations__rboolSCIMEnterpriseUserSCIMMultiValuedAttributerIrhrLrrsx7d d t 9d t 4K"T))/0477 ( )D 00rhrcBeZdZUdZeeed<eeed<eeed<y)GroupMemberExtractionResultzResult of extracting and processing group members. ``all_member_ids`` is deduped order-preserving; ``existing_member_ids`` is not, so a repeated resolved id appears once in the former and twice in the latter. existing_member_ids created_usersall_member_idsN)rbrcrdrrrerr)rIrhrLrrs( c"((Irhr/scim/v2u✨ SCIM v2 (Enterprise Only))prefixtags dependencies scim_routerc<Kddlm}|tdddi|Sw)z>Check if database is connected and raise HTTPException if not.rrerrorzNo database connected status_codedetail)litellm.proxy.proxy_serverrrrs rL%_get_prisma_client_or_raise_exceptionr s(8W>U4VWW srcKtd{}tt|jd|id{}|st ddd|i|S7H7w)z=Check if user exists and return user, raise 404 if not found.NrrrzUser not found with ID: r)rr{r?rQr)rrusers rL_check_user_existsrsf!F!HHM~m<=IIQZ\cPdIeeD W@XY`Xa>b4cdd KIeAA-AAAAteam_idcKtd{}tt|jd|id{}|st ddd|i|S7H7w)z=Check if team exists and return team, raise 404 if not found.NrrrrGroup not found with ID: r)rr{r>rQr)rrteams rL_check_team_existsr!sf!F!HHM~m<=IIQZ\cPdIeeD W@YZaYb>c4dee KIerrc fd}|jr1t|jdkDr|jdj}d}|jr,|jjr|jj}g}|j r#|j Dcgc]}|j}}|||j ||jr|jjnd|jr|jjnd|j|j|j|jd Scc}w)z)Extract common data from SCIMUser object.Nr) rrrrrrrrrr) emailslenvaluename givenNamegroups externalId familyNamerenterprise_userrr)rrrrgroups rL_extract_scim_user_datar-sJ {{s4;;'!+[[^)) J yyTYY((YY(( E {{*.++666! -1YYdii))D/3yytyy++d++**))  7sD.rrrrrrc>dt||ji}|||d<||jdd|t<|'|Dcgc]}|jdc}|t<|'|Dcgc]}|jdc}|t<|Scc}wcc}w)z)Build metadata dictionary with SCIM data. scim_metadata)rr scim_activeT)by_alias exclude_noner)LiteLLM_UserScimMetadata model_dumpSCIM_ENTERPRISE_METADATA_KEYSCIM_ENTITLEMENTS_METADATA_KEYSCIM_ROLES_METADATA_KEY) rrrrrrrers rL_build_scim_metadatarIs 1 "  *, *H"(1;1F1FPTcg1F1h-.]i3jXYALLdL4S3j/0 V[,\QRQ\\t\-L,\() O 4k-]s B0Bc K ddlm}|jd{}|jdixsi}|jdd}t |S77#t $r }t jd|Yd}~yd}~wwxYww)z Get the scim_upsert_user setting from litellm_settings. Returns: True if scim_upsert_user is not set or is True (default behavior), False if scim_upsert_user is explicitly set to False (SCIM 2.0 strict mode) r proxy_configNlitellm_settingsscim_upsert_userTz>Error reading scim_upsert_user setting, defaulting to True: %s)rr get_configgetr Exceptionrwarning)rconfigrrrs rL_get_scim_upsert_user_settingrhs ;*5577"(**-?"D"J"2"6"67I4"P$%% 8 $$%eghis>BAA6ABA B A;6B;BBctjr#tjjd}||StjS)z2Non-admin default role for SCIM-provisioned users.r)litellmdefault_internal_user_paramsrr%INTERNAL_USER_VIEW_ONLY)configured_roles rL_default_scim_user_rolers9++!(!E!E!I!I+!V  &" "  3 33rhcK ddlm}|jd{}|jdixsi}|jdxsdS7/#t$r }t j d|Yd}~yd}~wwxYww)z Get the scim_admin_group setting from litellm_settings. Returns the configured admin group identifier, or None when unset so callers leave a user's global role untouched (default-safe). rrNrscim_admin_groupz>Error reading scim_admin_group setting, defaulting to None: %s)rrrrrrr)rrrrs rL_get_scim_admin_grouprsx;*5577"(**-?"D"J##$67?4?8 $$%eghis>A;AA .A A; A A8A3.A;3A88A;rr default_rolecz|y|D]2}|j|k(s|j|k(s"tjcS|S)a3 Resolve a user's global proxy role from their SCIM groups. Returns None when no admin group is configured, signalling callers to leave the role unchanged. Otherwise grants PROXY_ADMIN when any group matches the admin group by value or display, and falls back to the non-admin default. N)rdisplayr% PROXY_ADMIN)rrrrs rL_resolve_scim_user_rolersG0 ;;+ %+)E#// /0 rhrteam_idsc K|Dcgc]0}tt|jd|id{2}}t||Dcgc] \}}t || |j nd"c}}S7@cc}wcc}}ww)z Build SCIMUserGroup objects from team ids, populating display from each team's alias so admin-group matching by display name works the same way it does on PUT (where SCIM groups carry display names natively). rrN)rr)r{r>rQzip SCIMUserGroup team_alias)rrrrrs rL_scim_groups_from_team_idsrslt`gf^M23??yRYFZ?[[[E!51   GT '+'7DOOT   \ s1B.A8A6 A8B %A=2B6A88 Buser_idscKtd{}|yt}|D]}tt|j d|id{}|4t t ||jxsgd{||}tt|jd|id|id{y77j7B7 w)aA Recompute and persist each user's global proxy role from their resulting team membership. No-op unless scim_admin_group is configured, so a SCIM group write that drops a member from the admin group demotes them just like the user endpoints do, and the role is left untouched when the feature is off. Nrrrr) rrr{r?rQrrrr\)rrrrrr resolved_roles rL_recompute_scim_member_rolesrs 566K13L  N=9:FFiY`MaFbb < /,]DJJz/_users_named_by_member_value..Is;ss{{;)r r{r?rWrrr)rrrSsubjectemailrowss rL_users_named_by_member_valuerF+s}.[[]G5.xs# [`di[iE# s aSCIM: group member '%s' is one account's user id and is also account '%s' by SSO identity or email, so the membership cannot be attributed. A placeholder an earlier release provisioned under this id looks exactly like this and should be deleted so the real account can be matchedrrr>rr rrzESCIM: group member '%s' matched user_id '%s' by SSO identity or emailzqSCIM: group member '%s' names more than one account by SSO identity or email and cannot be resolved unambiguously)r!r'r r{r?rQrrFrrrrr>r2rrrr)rr member_typer shared_withrnamedrs @rL_classify_group_memberrOLsH!(E08Kg"~FF~m<=IIQZ\aPbIccD "# %A%%WW#    ( (cA  $%0 0"511;"GG">-#@AMMU^`eTfMgg   B4== Q&U?K K5e]KKE 5zQ!! S  !H #5844 5zA~$$    e,,  &&Qd X"hLsJAF/F%F/4F( 5BF/5F+67F/-F-.A8F/(F/+F/-F/entryc|xtdx\}t|fdddSxtdx\td|fddSxtdx\}tdd|fdStdx\}tddd|fS t |y)z=The single-member partition one classified entry contributes.r>NrIrrrrrJ)rrr rrr)rPrrs rL_bucketed_memberrSs  1 1&WJXZmop p2 " "&BVXkmn n# (^ (&BQVPXkmn n)  *&BPRfkemn n+   rh classifiedc \td|D}tttjd|Dttjd|Dttjd|Dttjd|DS)zVSplit classified members into the buckets the resolver acts on, keeping request order.c32K|]}t|ywrH)rSr?rPs rLrAz0_partition_classified_members..sL,U3Lc34K|]}|jywrH)rr?buckets rLrAz0_partition_classified_members..s.Zvv/B/B.ZrBc34K|]}|jywrH)rrZs rLrAz0_partition_classified_members..s)PV&..)PrBc34K|]}|jywrH)rrZs rLrAz0_partition_classified_members..s-XVf.@.@-XrBc34K|]}|jywrH)rrZs rLrAz0_partition_classified_members..s2bv63J3J2brBrR)rrr from_iterable)rTbucketeds rL_partition_classified_membersrasLLLH 5...ZQY.ZZ[e)))Px)PPQ%---Xx-XXYu222bYa2bbc  rh created_idsc|xtdx\}|Sxtdx \}||vr|SdSxtdx\yxtdx\y t |y)Nr>rJrI)rrr rr)rPrbrrs rL_admitted_member_idrdsm  1 1N2 (^ (![05 :d :) " " 7#%7%5%7 7&8 7   rhcVttjfd|DS)a>Member ids that survive resolution, in the order the request listed them. An id the request repeats is one member: the roster these ids are written to holds one row per member, and a second creation attempt for the same id fails against the real unique constraint even though the first one succeeded. c3@K|]}t|xywrH)rd)r?rPrb member_ids rLrAz'_admitted_member_ids..s* ?RSXZe?f2f)1sI s)rrr)rTrbrgs `@rL_admitted_member_idsrhs+   #-   rhceZdZUeeed<y) _UserIdWhererNr7rIrhrLrjrjs c]rhrjceZdZUeeed<y)_ScimErrorDetailrNr7rIrhrLrlrls C=rhrl created_viacKt||d{}||Sd|i}tt|j|d{}|ydd|di}t d| 7P7w) aThe created user, or None when the id already resolves to a user row (a concurrent provisioning request won the creation race after our lookup missed). Raises: HTTPException: 500 when the user can neither be created nor found. The request has to fail so the identity provider retries, instead of recording success for a member the roster silently dropped. )rrmNrrrzFailed to create user 'z&' while provisioning group membership.rr)_create_user_if_not_existsr{r?rQr)rrmrcreatedrEexistingrs rL_ensure_group_member_userrrs6gS^__G"+W!5E">-#@AMMTYMZZH*7)3YZ'F C 77`[s!A(A$3A(A&A(&A(rosterresolvedc tttjt|vr|fndfd|DS)aThe members of this group a removal value names. Both ways of naming one count together. The id as written counts when the roster holds it verbatim, which is how an earlier release recorded a member it could not match, and the accounts it resolves to count when they are on the roster. Counting only the resolved ones would let a value that is one member's canonical id and another member's email revoke both, since each looks singular on its own. rIc3,K|] }|vs| ywrHrI)r?rrss rLrAz+_roster_entries_named_by..sFWGv4EFs )rrrr )rrsrts ` rL_roster_entries_named_byrws;  !VOFF   rhmembersc`Ktd|D}tt|Dcgc]%}|t||t ||dd{f'c}}td|D}|rt ddd|dd i tt jd |DS7acc}ww) aAThe members a ``remove`` clears, one per id the request names. The roster holds canonical user ids, so a directory that added someone by their email or SSO identity has to be able to remove them by that same value, and a member an earlier release recorded under the raw id has to stay removable by it. Ambiguity is a property of the table as it stands, not of the value, so a value that named one person when they were admitted can name two later. Resolving a removal against the whole table would then drop nobody while answering 200, and the person the directory just took out of the group would keep the team. So a removal keeps only the accounts already on the roster: one is unambiguous however many strangers share the address, none means there is nothing to revoke, and only a value naming two of this group's own members is genuinely undecidable. That last case fails rather than reporting a removal it did not perform, or revoking both. Raises: HTTPException: 400 when a member id names more than one current member. c32K|]}t|ywrH)r!r?rs rLrAz&_member_ids_to_drop..sK}V4KrXNr9c3DK|]\}}t|dkDs|yw)rKN)r)r?rentriess rLrAz&_member_ids_to_drop..+s Wc'lUVFVuWs  rr Member ID 'rz' names more than one member of this group, so the removal cannot be attributed. Send the LiteLLM user ID as the member value, or resolve the duplicate.rc3&K|] \}}| ywrHrI)r?_r}s rLrAz&_member_ids_to_drop..4s(KZQ(Ks) frozensetrsortedrwrFrr r_)rxrsrwrittenrmatched undecidables rL_member_ids_to_dropr s*K7KKG   (6)Ee]ae)f#f   GW7WWK;{1~&67pp   U(((K7(KK LL$g  s)%B.B)B' B)AB.'B))B.c FKt|Dcgc]}t||d{c}}t|}|jD]-}t j d|j |j/|jr tddd|jddi|jr2td{s tddd |jdd ittj|j}|D]}t jd |t|Dcgc]}|t||| d{fc}} td | D} t!|j"| t%|t'|S7pcc}w77Ucc}ww)aH Resolve SCIM group members to LiteLLM user ids, dropping members that are not users. Member ids are matched by ``user_id`` first, then by SSO identity or email. An id that resolves to nothing is created when litellm_settings.scim_upsert_user is True (default) and rejected per SCIM 2.0 otherwise. Removals do not come through here: they resolve through ``_member_ids_to_drop`` instead, which neither creates a user nor fails on an id it cannot place. Raises: HTTPException: 400 when a member id is empty, when a member id names more than one user, or when scim_upsert_user is False and a member id is neither an existing user, an existing team, nor a member declared to be something other than a user. 500 when a member's user row can neither be created nor found. NzPSCIM: ignoring non-user group member '%s' (%s); LiteLLM teams contain users onlyrrr~rz' names more than one LiteLLM user, so the group membership cannot be attributed. Resolve the duplicate, which for an id that also matches a SCIM-provisioned placeholder means deleting that placeholder.rzUser with ID 'zV' does not exist. Please create the user first via POST /Users before adding to group.zSCIM: creating placeholder user for group member '%s'; matched no user by user_id, sso_user_id or user_email. An SSO-provisioned user's real account stays teamless if this is a mismatch)rrmrc3,K|] \}}| |ywrHrI)r?rrps rLrAz,_resolve_group_member_ids..zs \ZQH[ \s )rrr)rrOrarrrrrrrrrrrrrrrrrhr) rxrmrrrT partitionrunique_unknown_idsr creationsrs rL_resolve_group_member_idsr7s*ahiW]%;FM%RRRijJ4Z@I$$ !! ^ MM NN  !!;y'A'A!'D&EFPP  +H+J%J%J>)*?*?*B)CDWW  !&dmmI4I4I&J K% $$ f    .  /[huvv  I! \9 \\M &%22#+J BT8UV a Si(&K*w sX F!FFFBF!:F;A2F!-FFF AF!FF!FF!rc~Ktd{}t|jxsgd|d{S7(7w)a Extract member IDs from SCIMGroup, validating that all users exist. Behavior depends on litellm_settings.scim_upsert_user: - If True (default): Creates users that don't exist (backward compatible) - If False: Rejects non-existent users per SCIM 2.0 protocol Returns: GroupMemberExtractionResult with existing members, created users, and all member IDs Raises: HTTPException: If scim_upsert_user is False and any member user does not exist (400 Bad Request) Nscim_group_membershiprxrmr)rrrx)rrs rL_extract_group_member_idsrsD"G!HHM* #+# I s=9#=;== member_idsc0Ktd{}g}|D]t}tt|jd|id{}|s4|jxs |j }|j t|j |dv|S77Nw)zCGet SCIMMember objects with display names for a list of member IDs.NrrUserrrr$)rr{r?rQrrappend SCIMMember)rrrxrgr display_names rL_get_team_members_displayrs!F!HHM')G^ N=9:FFiYbMcFdd ??:dllL NN:DLL,U[\ ] ^ NIes(BB4BBB ABBrrcKt|}t|}||z }||z }|s|r*t|t|t|dd{yy7w)zHandle adding/removing user from teams based on changes. Roster write failures propagate so the SCIM endpoint returns an error the IdP retries, instead of persisting a ``teams`` array the roster never received. Trteams_ids_to_add_user_toteams_ids_to_remove_user_fromraise_on_errorN)setpatch_team_membershipr)rrrexisting_teams_set new_teams_set teams_to_addteams_to_removes rLrrsh!$N 3y>M'*<6GG1GGG G%G)AGG G AG G!&GG7GGG GGc>Ktt|jdd|id|id|igid{tt|jd|id{tt |jd|id{y7a757 w)aDrop rows whose foreign keys reference ``LiteLLM_UserTable.user_id``. Required before deleting the user row itself, otherwise Postgres rejects the user delete with an FK constraint violation (e.g. ``LiteLLM_InvitationLink_user_id_fkey``). r<r created_by updated_byrN)r{r;rwr<r=)rrs rL_delete_rows_referencing_userrs )-8 9 E E G$w'w'  F  1-@ A M MU^`gTh M iii )-8 9 E EYX_L` E aaajas33BB-B#B$-BBBBBcF|sy|jd}|yt|S)zBRead the SCIM active flag from a user's metadata dict, if present.Nr)rr)rrs rL_scim_active_valuers( << .E } ;rhc0|j}t|S)z@Read the SCIM active flag off a user row's metadata, if present.)rr)rrs rL_user_scim_activer$s04 H h ''rhc pKddlm} tj}tj rtj j d}t||dgd|id|}||d{}tjd |||S7#t$r!}tjd ||Yd}~yd}~wwxYww) a Helper function to create a user if they don't exist. Args: user_id: The user ID to create created_via: Context for where the user was created from Returns: LiteLLM_UserTable if user was created, None if creation failed rr2rNrmFrrrrrauto_create_keyrrYzCreated user %s via %szFailed to create user %s: %s) :litellm.proxy.management_endpoints.internal_user_endpointsr3r%rrrrr(rrr exception)rrmr3rr created_userrs rLroro*sT  4 4   / /"??CCKPL"0#[1!"# %-2B$CC !!":G[QD &&'EwPQRsAB6AB )B*B B6B B3B.)B6.B33B6rcKg}|jxsgD]q}t|dr(|j|j|j7t |t sHd|vsM|j d}|a|j|s|Sw)z{ Get the IDs of the members from a team. Use one source of truth for the member IDs: team.members_with_roles r)members_with_roleshasattrrrrrr)rmember_user_idsrrs rL#_get_team_member_user_ids_from_teamrXs)+O))/R0 69 %&..*D  " "6>> 2  %)v*=jj+G"&&w/ 0 sAB B "B 6B responsec*Kd|jd<yw)z5Sets the Content-Type header to application/scim+jsonzapplication/scim+jsonz Content-TypeN)headers)rs rLset_scim_content_typerks(?H^$sbase_urlc ^tddddd|dddtd d d d d |d ddgS) zHReturn the list of SCIM ResourceType definitions per RFC 7643 Section 6.r User Account/Users*urn:ietf:params:scim:schemas:core:2.0:Userz/ResourceTypes/User ResourceTypelocation resourceType)idr descriptionendpointschema_metaGroup/Groups+urn:ietf:params:scim:schemas:core:2.0:Groupz/ResourceTypes/Group)SCIMResourceType)rs rL_get_resource_typesrrsd &@'j(;< .  A'j(<= .  rhcttdddtdddddd d d td ddddtdddtdddtdddgtddddtddddtdddtddd td!d"d#g$td%d"dd&td'ddd(d)tddd*td+dd,g-td.ddd/tddd0td+dd1tddd2td!d"d3g$td4ddd5tddd6td+dd7tddd8td!d"d9g$gd:d;d<=td>d?d?tdddd@dd d dA tdBdddCtdddDtd+ddEtdddFg$gdGd;d<=gS)HzBReturn the list of SCIM Schema definitions per RFC 7643 Section 7.rrruserNamestringFzUnique identifier for the User.T readWritedefaultserver)rr$ multiValuedrrequired mutabilityreturned uniquenessrcomplexz'The components of the user's real name.rzThe given name of the User.)rr$rrzThe family name of the User. formattedzThe full name.)rr$rrr subAttributes displayNamez+The name of the User, suitable for display.)rr$rrrzEmail addresses for the user.rzEmail address value.r$z!Type of email (work, home, etc.).primarybooleanz"Whether this is the primary email.)rr$rrrrz#Whether the user account is active.rz!Groups to which the user belongs.readOnlyzGroup identifier.rzGroup display name.)rr$rrrrrz$A list of entitlements for the user.zThe value of an entitlement.z*A human-readable name for the entitlement.z.A label indicating the entitlement's function.z(Whether this is the primary entitlement.rzA list of roles for the user.zThe value of a role.z#A human-readable name for the role.z'A label indicating the role's function.z!Whether this is the primary role.z;/scim/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:UserSchemar)rrr attributesrrrz$A human-readable name for the Group.nonerxzA list of members of the Group.zMember identifier.zMember display name.zThe type of member; canonical values are "User" and "Group". Only members of type User are honored, LiteLLM teams contain users only.z ,!'!)(K ,!*!*(L# .$!" % E  $!" $ C)+!(!)(; ,!*!)(= # &$'" $ F+!(!)(F ,!*!)(T ,!'!)(X ,!*!*(R!# 8$ " $ ?+!(!)(> ,!*!)(M ,!'!)(Q ,!*!*(K!# kQfZ (mZ v <#&! % F!*&% $"" $ A+!(!)(< ,!*!)(> ,!'!)!k # %N[ (U. yK Krhr#)rr/F)rinclude_in_schemarrequestc&Ktjd|j|jt |j j ddz}t|}dgt||Dcgc]}|jc}dScc}ww)z Base SCIM v2 endpoint for resource discovery per RFC 7644 Section 4. Returns a ListResponse of ResourceTypes supported by this SCIM service provider. Identity providers (Okta, Azure AD, etc.) use this endpoint for resource discovery. z6SCIM base resource discovery request: method=%s url=%srr2urn:ietf:params:scim:api:messages:2.0:ListResponseschemas totalResults Resources rdebugmethodurlrerrstriprrrrrresource_typesrts rL get_scim_baser^s$@  '**+2237*DH/9NHIN+0>?"bmmo? @A.B0B  Bz/ResourceTypesc&Ktjd|j|jt |j j ddz}t|}dgt||Dcgc]}|jc}dScc}ww)z SCIM ResourceTypes endpoint per RFC 7644 Section 4. Returns a ListResponse of all resource types supported by this service provider. z,SCIM ResourceTypes request: method=%s url=%srrrrrr s rLget_resource_typesr~s6  '**+2237*DH/9NHIN+0>?"bmmo? @rz!/ResourceTypes/{resource_type_id}zResourceType ID)titleresource_type_idcKtjd|t|jj ddz}t |}|D]#}|j |k(s|jcStddd|iw)z7 Get a single ResourceType by ID per RFC 7644. z#SCIM ResourceType request for id=%srrrrzResourceType not found: r) rrrerr rrrr)rrrr rs rLget_resource_typersDFVW'**+2237*DH/9N# 55$ $==? "# 34D3EFG s AB %Bz/SchemascKtjd|j|jt }dgt ||Dcgc]}|j c}dScc}ww)z SCIM Schemas endpoint per RFC 7643 Section 7. Returns a ListResponse of all schemas supported by this service provider. z&SCIM Schemas request: method=%s url=%srr)rrr r rrr)rrss rL get_schemasrs`0  "^GHIG .56alln6 7sAA)A$ A)z/Schemas/{schema_id:path}z Schema URI schema_idcKtjd|t}|D]#}|j|k(s|j cSt ddd|iw)z@ Get a single Schema by its URI per RFC 7643 Section 7. zSCIM Schema request for id=%srrzSchema not found: r)rrrrrr)rrrrs rL get_schemarsi> J!^G " 449 <<> !" -i[9: s 5A%Az/ServiceProviderConfig)response_modelrrcKtjd|j|jt |dt |jd}t |Sw)z+Return SCIM Service Provider Configuration.z?SCIM ServiceProviderConfig request: method=%s url=%s headers=%sServiceProviderConfig)rr)r)rrr r r1reSCIMServiceProviderConfig)rrs rLget_service_provider_configr!sTI !'* 0 $D %$ //sAA scim_filterctjd|tj}|sy|jdj |jdfS)zHParse the SCIM equality filters Okta uses before user lifecycle changes.z%\s*([\w.]+)\s+eq\s+(['"]?)(.*?)\2\s*$flagsNrK)rematch IGNORECASErr%)r"r(s rL_parse_scim_eq_filterr*sI884mmE  ;;q>   !5;;q> 11rhrrK)ge d)r+le startIndexr`filterc ~Ktjd||| td{}i}|r-t|}|r |\}}|dk(r d|id|ig|d<n |dk(r||d<t t |j ||dz |d d i d{}t t |j| d{} g} |D]1} tj| d{} | j| 3t| |t|t| | S777b7?#t$r} t| d} ~ wwxYww)z; Get a list of users according to SCIM v2 protocol z8SCIM GET USERS request: startIndex=%s count=%s filter=%sNusernamerrr<z emails.valuerK created_atdescrErRrSrTrrrr/ itemsPerPager)rrrr*r{r?rWr`r4rrSCIMListResponseminrrr:)r/r`r0rwhere_conditions parsed_filterfilter_attribute filter_valueusers total_count scim_usersr scim_userrs rL get_usersrCsB   ,+%J%LL 57 $9#@M1>. ,#z1%|4"L1.$T*&75A$\2;AP]A^:_:i:i"q.( ;j; 5 $*.*G#H#N#NUe#N#ff -/  )D1UU[_``I   i ( ) $!UC O4   G M&5 g a +'**+soD= D!DA$D!D+D!:D;$D!D 8D!D=D!D!D!D!! D:* D55D::D=z/Users/{user_id}zUser IDcKtjd| t|d{}tj|d{}|S7#7#t $r}t |d}~wwxYww)z? Get a single user by ID according to SCIM v2 protocol z$SCIM GET USER request for user_id=%sN)rrrr4rrr:)rrrBrs rLget_userrECsoEwO+.w77"5!X!XY]!^^  8_ +'**+sJA,AA AAA A, AA A) A$$A))A,c K tjd|jtd{}t |}|j rVt t|jd|j id{}|rtddd|j i|j xsttj}t|d |d |d |d |d }t}td{}t!|j"xsg||}t%||d|d|d|d||n|} t&j)|| |d{} | r| St+| d{} t-j.| d{} | S7j777D7.7#t$r} | d} ~ wt0$r} t3| d} ~ wwxYww)z5 Create a user according to SCIM v2 protocol zSCIM CREATE USER request: %sNrrrz#User already exists with username: rrrrrrrrrrrrFr)rrrrr6)rrrrrrr{r?rQrrer uuid4rrrrrr(rrr3r4rrr:)rr user_datarrrrrrrexisting_user_scimrrBrs rL create_userrM[s;+""#A4??CTU%J%LL 348  =="( )F"G"S"S[dfjfsfsZt"S"uuM# ##'J4==/%Z[ ;#djjl*;. l # m $ .">2G$  67 #8#:: 6t{{7Hb+Wcd "0 . .G$!'2'>mL# +A*^*^'-#+_+ %  % %$,!%  "5!X!X^j!kk k Mv$;%  l  +'**+sG1F-FAF-F"BF-F% AF-"F'#F-*G+F-:F);F-F+F-GF-"F-%F-'F-)F-+F-- G6F88 G GGGc Ktjd||j td{}t |d{}t |}t |}d|jv}|r|dn|}t|d|d||d|d|d }t||jxsg|d  d{|d |d |d|d t|d} td{} | &t|jxsg| t| d<t!t#|j%d|i| d{} |r,t'|} | | |dn|k7rt)|| d{t+j,| d{} | S7_7O777[7/7#t.$r}t1|d}~wwxYww)zH Update a user according to SCIM v2 protocol (full replacement) z(SCIM PUT USER request for user_id=%s: %sNrrrrrrrIrrrrr)rrrrrrrrTr)rrrrrrrmodel_fields_setrrrr"rrrrr{r?r\rrr4rrr:)rrrr prev_activerKclient_set_activescim_active_for_metadatar update_datarr new_activerBrs rL update_userrUs2  =+%J%LL %7%@@ .}= 248 $,t/D/D#DAR)H*=Xc . l # m $ $ .">2G$  .(..4"(   $L1#L1$]3w'"8,  $9#::  "'> !r;0G0I(K $%+>-+H$I$P$Pg&%Q%   28 .F%,F-AF%F-F%1F!2F%F#F%GF%F%F%F%F%!F%#F%% F>. F99F>>Gc pKtjd td{}td{}t |j xsgDcgc]0}t t|jd|id{2c}}t d|D}|D]}|jxsg}|vrP|Dcgc] }|k7s | } }t t|jd|jid| id{tj|j} tfd| j xsgDst#t%| j t't(j*  d{t-d d{t/|d{t t1|j3did{t5dS777}cc}wcc}w777k7X7,#t6$r} t9| d} ~ wwxYww)z5 Delete a user according to SCIM v2 protocol z'SCIM DELETE USER request for user_id=%sNrrc3&K|] }|s| ywrHrI)r?rs rLrAzdelete_user..sBdTTBrxrc3<K|]}|jk(ywrHr>)r?rrs rLrAzdelete_user..s]6>>W,]srrrrYuser_api_key_dictTrr>rrVr)rrrrrrr{r>rQrxr\rr#model_validateranyrr7r-r.r%rrrr?r^rrr:) rrrr found_teamsrrcurrent_membersm new_membersteam_rowrs ` rL delete_userrgs'H'R&+%J%LL %7%@@ # -228b ^M:;GGyZaNbGccc  BkBB D-1\\-?RO/)*9JQQ'\qJ J^M:;BB$dll39k:RC)778IJH]8;V;V;\Z\]](09I9ISZ[&4?O?[?[&\ %WdCCC+M7KKK^M23::)WAU:VVVC((G M@ d K  DK W +'**+sH6 HG<HG?H.HHH 6H H  H 8H H A H=HHH(H)H=H>-H+H,H;H6<H?HH HHHHH H3# H..H33H6c8t|tr t|St|}|y|j d}|sy|j d}|j d}tt|| t|ndt|tr|SdS)zEParse one entry of a SCIM patch value, or None when it carries no id.rJNrrr$r)rrerr,r)rPr1 entry_value entry_display entry_types rL_parse_member_entryrl-s%&&'.F ~G,K !::i0M 6*J +&3&?M"T%j#6Z =A rhcpt|tr t|n|f}tdd|DDS)aParse a SCIM patch value into members, keeping each entry's ``type``. PATCH bodies bypass SCIMGroup parsing (SCIMPatchOperation.value is untyped), so member objects arrive as raw dicts and the ``type`` that marks a nested group would otherwise be lost. c3&K|] }|| ywrHrIr{s rLrAz(_parse_member_entries..KsnF[a[mnrYc32K|]}t|ywrH)rlrWs rLrAz(_parse_member_entries..Ks&We':5'A&WrX)rrr)rr}s rL_parse_member_entriesrpCs4:DE49PuW\V^G n&Ww&Wn nnrhcRt|Dcgc]}|jc}Scc}w)z)Return group ids from a SCIM patch value.)rpr)rrs rL_extract_group_valuesrrNs'I#I;++rhop_typerSc6|dk(rd|d<yt||d<y)zHandle displayname updates.removeNrrerzrrSs rL_handle_displayname_updaterls"($( L!$'J L!rhc6|dk(rd|d<yt||d<y)zHandle externalid updates.r|Nrr}r~s rL_handle_externalid_updaterts"(%) M"%(Z M"rhc|dk(r|jddy|}t|tr|jdk(}n t |}||d<y)zHandle active status updates.r|rNtrue)poprrer%r)rzrrbool_vals rL_handle_active_updater|sJ( ]D) eS !{{}.HE{H"*rhrc|dk(r'|dk(r|jddyt||d<y|dk(r'|dk(r|jddyt||d<yy)z2Handle name field updates (givenName, familyName).name.givennamer|rNname.familynamer)rre)rsrzrrs rL_handle_name_updaterse  h    k4 0),UM+ & " " h    lD 1*-e*M, ' #rh teams_setct|}|s| t|d}|dk(r t|S|dk(r|j|y|dk(r|D]}|j |y)z(Handle group/team membership operations.Nrreplaceaddr|)rrryrr\discard)rzrrrs group_valuesgids rL_handle_group_operationsrsw(/L EM4T8D )<  E &  H  #C   c " # rhcR|jdddjdddS)zVThe attribute name a SCIM path targets, stripped of any value filter or sub-attribute.[rKr.)split)rss rL_multi_valued_attribute_basers* ::c1 a & &sA .q 11rhc t|}t|}||k7rtddd|di|dk(r|j|dy|tddd|d |d it |t r|n|g} t j|}|Dcgc]}|jd } }|j|} |dk(rt | t r | | z||<y| ||<y#t$rtddd |d iwxYwcc}w)zQHandle add/replace/remove for the entitlements and roles multi-valued attributes.rrz6Filtered or sub-attribute paths are not supported for z; PATCH the full attributerr|NzThe z operation on z3 requires a 'value' member (RFC 7644 Section 3.5.2)zInvalid value for z9: expected a list of objects with a 'value' sub-attributeTrr) r)SCIM_MULTI_VALUED_ATTRIBUTE_METADATA_KEYSrrrrSCIM_MULTI_VALUED_LIST_ADAPTERr+rrr) rsrzrrbase metadata_keyr&attrsattrdumpedrqs rL%_handle_multi_valued_attribute_updatersI.t4DCDIL t|UVZU[[uvw  ( \4( }tG9N4&@stu  ",E4!8ugJ 5EEjQEJJDT__$_7JFJll<0H%Jx6!)F!2#H\  1$7pqr   Ks3C C<C9c>|dk(r|j|dy|||<y)z5Handle generic metadata operations for unknown paths.r|N)r)rsrzrrs rL_handle_generic_metadatars!( T4 rhr patch_opsc \i}|jxsi}|jdi}t|jxsg}d}|jD]}|j xsdj }|j} |j} |st| tr| jD]\} } | j } | dk(rt| | |)| dk(rt| | |<| dk(rt| | |O| tvrt!| | | |f| dk(slt| ts}| jD]+\}}|j }|dvst#d || ||-|dk(rt| | |/|dk(rt| | |C|dk(rt| | |W|d vrt#|| | |kt%|tvrt!|| | ||j'd r t)| | ||j }||}t+|| | |||n|}||d<||d <||fS) zAApply patch operations and return update data and final team set.rNr#r displayname externalidr) givenname familynamezname.)rrrr)rrrr Operationsrsr%roprrrrrrrrrr startswithrr)rrrSrrrreplace_team_setrrsrrzkeyval key_lowername_keyname_valname_key_lowernew_replace_setfinal_team_sets rL_apply_patch_opsrsH -/K#,,2H#<<B!?I(,"",E 2$$&%% 5$/!KKM SIIK ()'3A-/.w[I,.-gsKH"KK9)WcS[\&(ZT-B.1iik*()1)9)-HH/"''7 8 ' ( -  (  = &w{ C \ ! %guk B X  !'5( ; : : gum D )$ /3\ \ 1$ Q __X &6wyRTRYRYZO*#2 $T7E8 DY,E\1A0L,R[N -H_&K   &&rhexccf|j}t|txr|jddk(S)zTrue when team_member_delete reports the user was already absent from the team, which is the idempotent no-op case for a removal.rzUser not found in team)rrrr)rrs rL_is_user_not_in_team_errorrs.JJF fd # W 7(;?W(WWrhT)frozenslotsc"eZdZUeed<eed<y)RosterWriteFailurerrN)rbrcrdrerrgrIrhrLrrsrhrct|tr |jSt|tr1|jj rt |jSdSy)Nr)rrrr+codeisdigitrg)rs rL_roster_write_statusr%sE#}%#~& # 0 0 2s388};; rhc:eZdZdZdeedfdeddffd ZxZS)SCIMRosterSyncErroraEvery roster write in the batch was attempted; these are the ones that did not land. Rolling the successful ones back is not safe, since the compensating write can fail too and can strip a membership that pre-dated the push. Naming the exact failures instead lets the IdP's next push, which is idempotent, close the gap. handle_exception_on_proxy reads ``status_code`` off this, so a unanimous failure keeps its own status and a mixed batch reports 500. failures. attemptedrFNc td|D}||_t|dk(rtt |nd|_t |dt|d|ddjd|Dy) Nc34K|]}|jywrHr_r?failures rLrAz/SCIMRosterSyncError.__init__..8s#PGG$7$7#PrBrKrzSCIM roster sync failed on z of zn team membership writes, leaving the roster partially updated. Retry the push to reconcile it. Failed writes: z; c34K|]}|jywrH)rrs rLrAz/SCIMRosterSyncError.__init__..>s'T(;(;'TrB) rrrnextiterrsuper__init__join)rKrrstatuses __class__s rLrzSCIMRosterSyncError.__init__7sy##Px#PP?G ?B8}PQ?QtDN';WZ )#h-YKH"ii'T8'TTU W rh) rbrcrdrrrrgr __classcell__)rs@rLrr-s3 '93'>!? C TX  rhrlabelwritecK |d{y7#t$r}|jcYd}~Sd}~wt$r=}tjd||t |d|t |fcYd}~Sd}~wwxYww)zJRun one roster write and return what failed, so the caller can keep going.Nz!SCIM roster write failed (%s): %sz: )rrrI)rrrrrrr)rrrs rL_attempt_roster_writerBsxgg   zz g&&'JESTU"%1#L`abLcdffgsOA< A< A9 0A9A< A92A4.A9/A<4A99A<writesc Kt|Dcgc]\}}t||d{c}}}ttj|S7,cc}}wwrH)rrr r_)rrr per_writes rL_collect_roster_write_failuresrNsP\bcLESX$9%$GGGcdI $$Y/ 00Hcs% AA AA &AA Ac .K tt|t|dttj d{y7#t $r?}|jtjk7rtjd||Yd}~yd}~wwxYww)Nrrrole)rrr\r]z+User %s is already in team %s, skipping add) r6r,r&r.r%rr+r$r*team_member_already_in_teamrrrrrs rL_add_user_to_teamrUs d%gF;-7G7S7ST     d 66_@@ @ ""#PRY[bccds@B>A AA BA B5B B BBcK tt||ttjd{y7#t $r-}t |stjd||Yd}~yd}~wwxYww)Nr[r\r]z*User %s is not in team %s, skipping remove) r7r-r.r%rrrrrrs rL_remove_user_from_teamrdsmc ('J,7G7S7ST    c)!, ""#OQXZabbcs7A83?=?A8? A5#A0+A80A55A8rrrcKttfd|Dfd|D}t|d{}|r|rt|t |y7w)a  Add or remove user from teams Handles duplicate membership gracefully (idempotent operation). A user already being in a team (on add) or already absent from it (on remove) is treated as a no-op, not an error. Every team is attempted before anything is reported, so one failing team cannot strand the others unattempted. When ``raise_on_error`` is True the writes that did not land are reported together, instead of a teams array the roster never received being persisted as a success. c3PK|]}dd|tt|fyw)add  to N)r rr?rrs rLrAz(patch_team_membership..s6 yWI.8I7T[0\] #&c3PK|]}dd|tt|fyw)remove  from N)r rrs rLrAz(patch_team_membership..s7 7)6'3W=SU\^e5fg rNrT)rr rrr)rrrrrrs` rLrrpsc$  7  <   F;6BBHN!(c&kBB  Cs6AA AcKtjd||j td{}t |d{}t |}t ||\}}|jd}tt|tr|nd}t||jxsgt|d{t||d<td{} | 3tt!|t|d{| t#|d<d|vr't|dt$rdd lm} | |d|d<t+t-|j/d |i| d{} |||d n|k7rt1|| d{t3j4| d{} | S7}7m7777P717#t6$r} t9| d} ~ wwxYww)z4 Patch a user according to SCIM v2 protocol z*SCIM PATCH USER request for user_id=%s: %sN)rrrrrrrr!rrTr)rrrrrrrrrrrrrrrrrrr*litellm.litellm_core_utils.safe_json_dumpsr"r{r?r\rr4rrr:)rrrrrPrSrpatched_metadatarTrr"rrBrs rL patch_userrs4 2+%J%LL %7%@@ .}= &6'' # ^ #.//*"=.:N^`gCh/?nrs .(..4">*   $N3 G#8#::  "'>0^@TUU')(K $  $K 4KT)R M&0Z1H&IK #$*>-+H$I$P$Pg&%Q%   !j[=PTVa&b(j.Q Q Q!4!X!XYe!ff ] M@ ;V Rf +'**+s&G! GF3G F6 A5G?F9GF; #GF=A*G.F?/ GGG,G-G2G!3G6G9G;G=G?GGG G GGG!ceZdZUdZeed<y)_TeamWhereConditionszLThe team columns SCIM GET /Groups can filter on, as Prisma where-conditions.rN)rbrcrdrrerrIrhrLrrs VOrhr)totalrc Ktjd||| td{}i}|r,d|vr(|jddj d}||d<t t |j||dz |dd i d{}t t |j| d{}g}|D]} tt| d{d{} tjd | t| d| j}| jr| jjnd} | jr| jjnd} t!d g| j|| d| | d} |j#| tjd|t%||t'|t)||S77F777#t*$r}t-|d}~wwxYww)z< Get a list of groups according to SCIM v2 protocol z9SCIM GET GROUPS request: startIndex=%s count=%s filter=%sNzdisplayName eqzdisplayName eq rKz"'rr3r4r5rzSCIM GET GROUPS members: %srr)rrp lastModified)rrrrxrzSCIM GET GROUPS response: %sr7)rrrrr r{r>rWr`rrgetattrrr3 isoformat updated_at SCIMGrouprr9r:rrr:)r/r`r0rr;rrr@ scim_groupsrrxteam_created_atteam_updated_at scim_grouprs rL get_groupsrsC   8+%J%LL 8: 6)#\\*;rQrrrr&r5rrrr.r%rrr4rrr:) rrrr member_resultrgr created_teamrrs rL create_grouprj s' #+%J%LL JU%5%5JTZZ\9J&,N=,I%J%V%V^gip]q%V%rr #A'!KL  &?u%EE VcVrVrsfYVDss%-0 ,,#5 !@Q'RS,7G7S7ST%  +=-:V:VWWW"5"Z"Z[g"hh A M s Fs  Xh +'**+s%F( F E:A&F E=&F E?F F*AF 8F9F FF 3F 4F 9F(:F =F ?F F F F F% F  F%%F(cJKtjd||j td{}t |d{}t |d{}tjd|j tjdt|j|jr |jni}i|t|jtdi}|jt|d}tt|j!d|i|d{}t#t%|d{} tjd | t#|j } tjd | t'|| | d{|j(|jk7} t+|| r| | zn| | z d{t-j.|d{} | S777777g727#t0$r} t3| d} ~ wwxYww) z6 Update a group according to SCIM v2 protocol z*SCIM PUT GROUP request for group_id=%s: %sNz!SCIM PUT GROUP all_member_ids: %sz SCIM PUT GROUP created_users: %sT)rrrrz"SCIM PUT GROUP current_members: %sz SCIM PUT GROUP final_members: %s)rrc final_members)rrrrrrrrrrr0r/rr"r{r>r\rr _handle_group_membership_changesrrr4rrr:)rrrrr existing_metadataupdated_metadatarS updated_teamrcr alias_changedrrs rL update_groupr s!4  6+%J%LL %7%AA &?u%EE ""#F HdHde""#Es=KfKfGgh>K=S=S=#9#9Y[# # ')9)9); *D#  ++"#34 %+>-+H$I$P$Ph'%Q%  "%+N}+]%]!^""#GY"=#?#?@ ""#E}U.+'    -775;L;LL * 0=_} ,?UbCb   #6"Z"Z[g"hh e MA F$ &^   i +'**+s&H# HG4H G7 HG:C H&G='H>G??AHH6HHH-H.H3H#4H7H:H=H?HHHH H  HH  H#cKtjd| td{}t|d{}t |d{}|D]}t t |jd|id{}|s4|jxsg}||vsI|Dcgc] }||k7s | }}t t |jd|id|id{t||d{t t|jd|id{td S7 777cc}w7b7N7"#t$r} t| d} ~ wwxYww) z6 Delete a group according to SCIM v2 protocol z)SCIM DELETE GROUP request for group_id=%sNrrrrrrVr_)rrrrrr{r?rQrr\rr>r^rrr:) rrrrrgr current_teamstrrs rL delete_groupr ssJHU+%J%LL %7%AA "Em"TT $ I} =>JJR[]fQgJhhD $ 0b },,9 KqQ(] KI K  !>?FF()4GY;OG  +=*EEE^M23::)XAV:WWWC((+ MATi!L F X +'**+sE# ED3ED6E D82ED:EEE! D<,D<0.EEE4E5-E"E#E2E#3E6E8E:E<EEE E  EE  E#rcKi}i|jxsitdi}tt|d{}|j }|j D]`}|j xsdj}|j} |j} |dk(r| dk(rd|d<Jt| |d<Y|dk(r'| dk(r|jddvt| |d<|jd r| t| n%td t|j d D} | dk(r"|t!| t#||d{z }t%| d | d{} | d k(rt| j&}"| dk(s)|t| j&z}C| dk(r|j|d\| ||<c||d<t)d|j D} | r t|nd}|||fS777w)aDProcess patch operations for a group and return update data, final members and, when the request contained a member ``replace`` op, the absolute target roster it declared (``None`` otherwise). ``add``/``remove`` are deltas relative to the current roster, but ``replace`` is absolute: it declares the roster is exactly this set, so the caller must reconcile against it as a set-to-target rather than rebasing it onto a concurrently-mutated roster. A ``remove`` drops the ids it names without resolving them first. Removal is idempotent and cannot put anything on a roster, while resolving would make it conditional on what the id turns out to be and leave members we should never have admitted - the phantom users this endpoint used to create for nested groups - impossible to clean up. TNr#rr|rrrrxc34K|]}t|yw)rJN)r)r?rgs rLrAz2_process_group_patch_operations..G s4=JY//rBscim_group_patchrrrrc3K|]B}|jdk(xr-|jxsdjjdDyw)rr#rxN)rrsr%r)r?rs rLrAz2_process_group_patch_operations..c sB(QSL 2446AA)LL(sAA )rr/rrcopyrrsr%rrrerrrprryrrrrra)rrrrSrrcrrrsrrzpatched_membersr member_replace_presentreplace_targets rL_process_group_patch_operationsr# s($-/K_-006B^9WY]^H!'J='Y!YZO#((*M"",' 2$$&%% = (",0 L),/J L) \ !(" \40),U& __Y '$&e,A^_a_f_fhqAr (" -6I#Y}%=}71! '@+ 2"/'! i'$' (D(D$EM%$1C 8T8T4U$UM(" T4(!&Y,'\'K $'(W`WkWk(%3IC .dN  ~ 55s"Z<1!s;0G7G0D G7?G3G7G5%G7A1G73G75G7c$Kd|vr$t|dtrt|d|d<|r0t|jj d|i|d{St|jj d|id{S737w)aApply the group's metadata/displayName patch updates to the database. Membership itself is not written here; it is reconciled onto the source of truth (members_with_roles and each member's user.teams) by _handle_group_membership_changes via team_member_add/team_member_delete. Writing the legacy `members` column here too would create a second, unread copy of membership that could drift from the source of truth. rrrNr)rrr"r>rr\rQ)rrSrs rL_apply_group_patch_updatesr%k s[ Z J0G%N",[-D"E J#M288??h'@    .44@@ S[G\@] ]]   ^s$ABB .BBBBrcrcFKt||z }t||z }tjd|tjd|tt fd|Dfd|D}t |d{}|rt |t|y7w)a)Reconcile the group roster, attempting every member before reporting failures. Aborting on the first failure would leave the remaining members unattempted on top of unrolled-back, so every member is written and the ones that failed are named for the IdP's next push to reconcile. zmembers_to_add: %szmembers_to_remove: %sc 3XK|]!}d|dtt|ggdf#yw)rrTrNr rr?rgrs rLrAz3_handle_group_membership_changes.. sF 9+T(4- )2:68'+   '*c 3XK|]!}d|dtt|ggdf#yw)rrTrNr(r)s rLrAz3_handle_group_membership_changes.. sF i[xj9- )137?j'+   r*Nr)rrrrr rrr)rrcrmembers_to_addmembers_to_removerrs` rLrr s#=?#BCN%o &EF3^D68IJ  "0  "3  F<;6BBH!(c&kBBCsA>B!BB!cxKtjd||j td{}t |d{}t |||d{\}}}t t|d{}||z }||z } t|||d{} tt|jd|id{} | r=t ttj| jd{n|} ||n| |z| z } t|| | d{|jd|j }||j k7}t#||r| | zn| | z d{tt|jd|id{}|r|} | t%ddd|i t'j(tj| jd{}|S77777p7E7 777u7!#t*$r}t-|d}~wwxYww) z5 Patch a group according to SCIM v2 protocol z,SCIM PATCH GROUP request for group_id=%s: %sNrrrrrrr)rrrrrr#rrr%r{r>rQr#r`rrrrrr4rrr:)rrrrrSrr"snapshot_members intended_addintended_removerrefreshed_teamrefreshed_currenteffective_final new_aliasr final_teamrrs rL patch_groupr7 sv6 ;+%J%LL %7%AA <[ }m< 6 2 ]N#&,OP],^&^"_+.>> !1M!A8+}]] &,^M-J&K&W&W_hjr^s&W&t t  9:K:Z:Z[i[t[t[v:wxx " -8N?PS_?_cr>r /x9JO\\\ '??<9Q9QR (M,D,DD * 4A  0GX[jGj   #) )F"G"S"S[dfnZo"S"pp %L  #$litellm.repositories.user_repositoryr?2litellm.repositories.verification_token_repositoryr@0litellm.types.proxy.management_endpoints.scim_v2 prisma.modelsrBPrismaVerificationTokenrDrjrqrur{rfrrrrrrrerrrrrrrrrrrrrPROXY_ADMIN_VIEW_ONLY INTERNAL_USERr ScimUserRolerrrrrrrr rrUnion_ClassifiedGroupMemberrrr!r'r(r,r2r4rgrrFrOrSrarrdrhrjrlrrrwrrrrrrrrrrrrrorrrrrrrrrrrrr r!r*r9rCrEpostrMputrUr^rgrlrprrryrrrrrrrrr SCIMPatchOprrrrrrrrrrrpatchrrrrrrrrr#r%rr7rIrhrLrYs  LL!GG   =<??1A    DBSO   @??RQxQ(QxQ$/H/I(I ?~?*:? ? ?~?*:? ? Y2Y7TY Y &(+KKNff& & & !"' '   H[H[V 19 1 )   ) *-./ U c .?  c .? (|>,0:>37 d t 4K#T)  /047  ( )D 0  #v+>T.  **"",,. 44S4Z$  t (LDQTIZ^_lZm$ l hWZm `d 6*F*F Zz24GYiij&*&*J3: *$sF{*;<e<VV (*MJV*Ms^*MZI j !II I! IX99T, S d:>N   I Cy   2$251ZFZtZ ;#;;;|b|bQTbY]b(f!5!<(-($+( +c++WfimWm+\4E$s)&?(?#x@P7Q8Mhz*M` +,g6K.LM  +,g6K.LM    * +,g6K.LM g  ( '+,g6K.LM!,=>   & +,g6K.LM w  & +,g6K.LM#\2   $ ,+,g6K.LM  0w 0  0 2s 2uS#X/E 2  #+,g6K.LM A!nraC(t:+:+ :+ $J:+  :+z +,g6K.LM 9-+ +  +$  +,g6K.LM #YA+ A+  A+H +,g6K.LM 9-#YJ+ J+ J+  J+Z +,- 9--+ -+  -+`v*t*;,ooE*c/,BoEEDIE ,d ,s,tCy,2//F/cSYkIZ/_c/0s060SRX[HY0^b0 +3 +v +c6kAR +W[ + 5c 5C 5 5tTWY_T_O` 5ei 5 c & SX UX[_U_ dghkdlosds 2s2s2 "$"$c"$&"$\`adflal\m"$rv"$J3VtTWY_T_O`ei='$='=' 4V c#h &'='@XMXdX $d#$ iC ) * s 8B &@Q)> ??@ A1 s "#1 dS d3 d4 d c# c c c ! " ""3i"$(9" "  "J +,g6K.LM 9-!#Y?+ ?+?+  ?+D9E  #+,g6K.LM A!nraC(tF+F+ F+ $JF+  F+R +,g6K.LM J/++  +$ d !( >  +,g6K.LM Cy-+ -+  -+` +,g6K.LM J/CyB+B+ B+  B+J +,- J/ + +  +FU6U6+<U6MYU6 4V c#hC4 78U6p^s^c6kAR^co^(-CS-C3s8-Cdghkdl-Cqu-C` +,g6K.LM J/!#YH+H+H+  H+rh