tPj}|dZddlZddlmZmZddlmZddlmZm Z m Z m Z ddl m Z mZddlmZddlmZdd lmZdd lmZmZmZdd lmZdd lmZdd lmZerddlm Z!ddlm"Z"m#Z#de$e%e&fdede$fdZ'eddGddZ(dee%e&fde%dzdede(fdZ)de$de%dzdedzde%dzfdZ*de$dedzfdZ+de,e%de,e%fdZ-d e d!e%de.fd"Z/d#e0e%dedzdd$fd%Z1d#e0e%dedzde$e%e0e%ffd&Z2d'ed(e$e%e0e%fddfd)Z3d'ed(e$e%e0e%fddfd*Z4d'edzd(e$e%e0e%fddfd+Z5d(e$e%e0e%fde0e%fd,Z6 dGd-d.dedzde0e%fd/Z7de0e%fd0Z8de0e%fd1Z9d2e%dzdedzde,e%fd3Z:d4e,e%dzde%dzd5e.dedzddf d6Z;d7e d.dedzded'edzde0e%fd<Z?d'edzde0e%fd=Z@d'edzde0e%fd>ZA dHd'edzd9e d:dedzd5e.d?e d.dedzf d@ZBdAe0e%d9e d:d5e.ddfdBZCd'edzde0e%fdCZD dId'edzd9e d:d5e.ddfdDZEd'edzde,e%fdEZF dId'edzd9e d:d5e.ddfdFZGy)Jzh Common utility functions for handling object permission updates across organizations, teams, and keys. N)MappingSequence) dataclass) TYPE_CHECKINGAnyFinalOptional) HTTPExceptionstatus)verbose_proxy_logger)uuid) safe_dumps)ObjectPermissionDictSpecialMCPServerNameSpecialMCPServerNames) PrismaClient)ObjectPermissionRepository)MCPServerRepository)models)LiteLLM_ObjectPermissionTableLiteLLM_TeamTableCachedObj data_dict prisma_clientreturncK| td|jd}|rGt|jj d|id{}|r |j }||d<|S7#t $r|j}Y$wxYww)a Helper method to attach object_permission to a dictionary if object_permission_id is set. This function: 1. Checks if the dictionary has an object_permission_id 2. If found, queries the database for the corresponding object permission 3. Converts the object permission to a dictionary format 4. Attaches it to the input dictionary under the 'object_permission' key Args: data_dict: The dictionary to attach object_permission to prisma_client: The database client Returns: Dict: The input dictionary with object_permission attached if found Raises: ValueError: If prisma_client is None NPrisma client not foundobject_permission_idwhereobject_permission) ValueErrorgetrtable find_unique model_dump Exceptiondict)rrrr s }/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/management_helpers/object_permission_utils.py attach_object_permission_to_dictr)s.233"+--0F"G"<]"K"Q"Q"]"])+?@#^#    =$5$@$@$B!.?I) *   =$5$:$:$<! =s6A B  A,B A.%B .B B  B  B T)frozenslotsc,eZdZUeed<eeefed<y)ObjectPermissionUpsertrrecordN)__name__ __module__ __qualname__str__annotations__r'objectr(r-r-Gs f r6r-new_object_permissionexisting_object_permission_idc>K|xsttj}t|jj d|id{}||j ddni}i||d|i}i|d|vrdt|dini}t||S7Lw)a= Read-and-merge half of an object permission upsert; performs no writes. Merges the sent grants over the existing row (looked up by ``existing_object_permission_id``, or a fresh uuid when the entity has none) and returns the id plus the full record to upsert. The id is pinned inside the record because the column has ``@default(uuid())``, so a create without it would mint a different id than the one the caller links. ``mcp_tool_permissions`` is serialized to a JSON string to avoid GraphQL parsing issues (e.g. server IDs starting with "3e64" being interpreted as floats). Keeping this separate from the write lets callers run the upsert inside the same transaction as the row that links ``object_permission_id``, so a rolled-back update cannot leave permission changes live. rrNT) exclude_unset exclude_nonemcp_tool_permissions)rr.) r2r uuid4rr#r$r%rr-)r7r8rrexisting_object_permissionexisting_fieldsmergedr.s r( prepare_object_permission_upsertrAMs(#@"T3tzz|CT.H.W.].].i.i%';</j/) & 1 #--Dt-T  ( ( (  4(F ( (&/$Z7M0N%O P (F "7KTZ [[+)sA BBA B data_jsoncK| td|jdd}|yt|trt j |}t t|tr|ni||d{}t|jjd|ji|j|jdd{}tjd||jS7w7(w) a Common logic for handling object permission updates across organizations, teams, and keys. This function: 1. Extracts `object_permission` from data_json 2. Looks up existing object permission if it exists 3. Merges new permissions with existing ones 4. Upserts to the LiteLLM_ObjectPermissionTable 5. Returns the object_permission_id Args: data_json: The data dictionary containing the object_permission to update existing_object_permission_id: The current object_permission_id from the entity (can be None) prisma_client: The database client Returns: Optional[str]: The object_permission_id after the update/creation, or None if no object_permission to process Raises: ValueError: If prisma_client is None Nrr )r7r8rr)createupdate)rdataz!created_object_permission_row: %s)r!pop isinstancer2jsonloadsrAr'rr#upsertrr.r debug)rBr8rr7rKcreated_object_permission_rows r(&handle_update_object_permission_commonrNzs4233/8}}=PRV/W$'- $ +@ A:7ABWY]7^3df&C#F 2LM1Z1`1`1g1g%v'B'BCmmmm 2h2,!BDab ( = == ,s%A+C)-C%.AC)>C'?'C)'C)cK|d|vr|S|d}t|ts|jd|S|jDcic]\}}| |dk7s||}}}d|vrt |d|d<t |j j|d{}|j|d<|jd|Scc}}w7,w)z Creates the LiteLLM_ObjectPermissionTable record for the key/team. Handles permissions for vector stores and mcp servers. Nr rr<)rF) rHr'rGitemsrrr#rDr)rBrpermission_datakv clean_datacreated_permissions r(_set_object_permissionrVs 39 D&':;O ot , )*)..0,AAMaKaFa1,J, +-7 CY8Z-[ )*&@&O&U&U&\&\bl&\&m m(:(O(OI$% MM%& ,!ns+AC  CCCAC C -C valuesczt}g}|D])}||vr|j||j|+|SN)setaddappend)rWseenresultvalues r(_dedupe_preserving_orderr`sEED!F D=   e  Mr6server identifierc j|t|ddt|ddt|ddt|ddhvS)N server_idalias server_namename)getattr)rarbs r(_mcp_server_identifier_matchesrisD  T*& t,%  r6 identifiersz.Sequence[prisma_models.LiteLLM_MCPServerTable]cK||sgSt|}t|jjddd|iidd|iidd|iigid{S7w)NORrdinrerfr)listrr# find_many)rjridentifier_lists r("_get_db_mcp_servers_by_identifiersrqsK !+.O$]399CC t_56412 78 D  sA A AAcK|siSddlm}|Dcic] }|t}}t||d{D]:}t |dd}|s|D]#}t ||s||j |%<|jjD]F\}}t |ddxs|}|s|D](}||k(s t ||s||j |*H|Scc}w7w)a Resolve MCP permission entries written as server_id, alias, or server_name to canonical server IDs. DB rows are authoritative when available; the in-memory registry is still consulted for config-file servers, which are not persisted in the MCP table. rglobal_mcp_server_managerrjrNrd) 9litellm.proxy._experimental.mcp_server.mcp_server_managerrtrZrqrhrir[ get_registryrP)rjrrtrbresolvedrard registry_keys r(&_resolve_mcp_server_identifiers_to_idsrzs  Q\+\*J,=+\H+\:# 4FK6  % 4J-fjA$((3 4 4!: F F H N N P4 fFK6F,  % 4J\)-KFT^-_$((3 4 4 O+,]s&C'C C'C%(C'A&C' C'r identifier_to_server_idsc X|jd}t|tsyg}|D]s}|tjj k(r*|j tjj J|jt|j|gut||d<y)N mcp_servers) r"rHrnrno_mcp_serversr_r\extendsortedr`)r r{r}normalized_serversrbs r(&_rewrite_object_permission_mcp_serversr!s+..}=K k4 (+-!X .==CC C  % %&;&J&J&P&P Q !!&)A)E)EjRT)U"VW X (@@R'Sm$r6c|jd}t|tsyi}|jD]]\}}t|tsg}t |j|gD](}|j |g||j|*_|jDcic]\}}|t|c}}|d<ycc}}w)Nr<) r"rHr'rPrnr setdefaultrr`)r r{r<normalized_tool_permissionsrbtoolsrds r(/_rewrite_object_permission_mcp_tool_permissionsr2s#4"7"78N"O *D 1?A1779A E%&E 8 < 'I'I'ORN--33~E&((3D3h3h006B4.,@@FBN.#&N3*.~/B/B/D*E^.BBEVVWK$J#%=H oyO_OcOcdmOn o o +,< =@R RR.!ps=AD!D "A3DD DD 5D 9D D Dc@ddlm}t|jS)zAReturn the set of MCP server IDs marked with allow_all_keys=True.rrs)rvrtrZget_allow_all_keys_server_idsrss r(_get_allow_all_keys_server_idsrs (FFH IIr6c\ddlm}t|jj S)zGReturn every MCP server id registered on the proxy (config + DB union).rrs)rvrtrZrwrrss r(rrs' (557<<> ??r6rcK|r|gSt|jjd|id{}|gS|jxsgS7w)Nrr)rr#r$r})rrexistings r('_existing_object_permission_mcp_serversrsg =#8 6}EKKWW%';<XH    %2% s1AA Arequested_mcp_serversis_proxy_admincKtjj}|s||xsgvryt||d{}||vryt t j ddi7&w)a Only a proxy admin may newly grant the all-proxy MCP sentinel. Scoping a team to every MCP server on the proxy is a proxy-wide authorization decision, so a caller who is not a proxy admin (e.g. a team admin managing their own team) cannot add ``all-proxy-mcpservers``. A sentinel a proxy admin already granted is left untouched, so unrelated edits to such a team still succeed. Raises HTTPException(403) when a non-admin tries to add the sentinel. N)rrerrorz]Only a proxy admin can grant a team access to all proxy MCP servers ('all-proxy-mcpservers'). status_codedetail)rrr_rr r HTTP_403_FORBIDDEN)rr8rrsentinelexisting_mcp_serverss r(1enforce_all_proxy_mcp_servers_grant_is_admin_onlyrsv +<<BBH*?*E2F(O:#)#'' -- t   #s6A!A'A!r>c K|| tS|jxsi}tt|tr#t j |j n|j }t|jxsg|ztjjtjjhz }tttt||d{S7 w)a  Resolve the canonical MCP server IDs a key's stored object_permission already grants. Updates that keep or shrink those grants stay valid even when the team allowlist has since changed; sentinels are excluded so they cannot grandfather anything. Nru) frozensetr<rHr2rIrJrr}rr~r_rrrrzrZ)r>rrtool_perm_keysrjs r(%_get_grandfathered_key_mcp_server_idsrs")]-B{6KKQrN,5-7-L >"'')R`ReReRg-N$$>$J$J$PbQTbb,,22..44gK (8 ,+    sCC0!C. " C0team_objrcK| tS|j}| tSt||d{S7w)z Get the full set of MCP server IDs a team allows. If team has no object_permission or no MCP config, returns empty set (meaning only allow_all_keys servers are permitted). N)rr)rZr r)rrrs r(_get_team_allowed_mcp_serversrsKu $,$>$>%u 25#  s 5><>c|rt|ts tSt}|jd}t|tr:|j ||j tjj|jd}t|tr|j |j|S)z Extract all MCP server IDs referenced in a key's object_permission dict. Includes: - mcp_servers list - Keys from mcp_tool_permissions r}r<) rHr'rZr"rnrEdiscardrr~r_r)r rr}r<s r(!_extract_requested_mcp_server_idsrs J/@$$Gu "%%J*..}=K+t$+&0??EEF"3"7"78N"O&-.3356 r6c|rt|ts tS|jd}t|tr t|StS)z>Extract MCP access groups from a key's object_permission dict.rrHr'rZr"rn)r groupss r($_extract_requested_mcp_access_groupsrsD J/@$$Gu %))*=>F&$6{ 5Lr6c|rt|ts tS|jd}t|tr t|StS)zrz.Key requests MCP servers not allowed by team '': . Team allows: z#. Global (allow_all_keys) servers: .z\Key is not in a team. Only globally available (allow_all_keys) MCP servers can be assigned: z. Disallowed servers: rrz4Key requests MCP access groups not allowed by team 'ziKey is not in a team. MCP access groups cannot be assigned to keys outside of a team. Disallowed groups: )requested_toolsetsrr)rrrrrrzr"r warningrrrrteam_idr r rrZr r_validate_requested_toolsets)r rrrrteamless_admin_assignmentrequested_serversrequested_access_groupsrallow_all_keys_serversteam_allowed_serversall_allowed_serversr{rbstale_identifiersactive_requested_serversallowed_serversgrandfathered_serversdisallowed_serversrrteam_access_groupsallowed_access_groupsdisallowed_groupss r(%validate_key_mcp_servers_against_teamr+s 8(04'7'JN@ARS%IJ[%\ ?@Q R %?U8V7WWXZ((./E(F'GH++12D+E*FaI  "55(  '*u  **6**<#?qBBBHIZB[A\\]_ "55(  !-% E#+ $ $( sJA H9H+H9+H.,H94H1 H1AH9#H6$EH9.H91H9rc L|sy|-|ryttjddt|di|j}| |j nd}|sy|t |z }|syttjdd|jdt|dt|di) z Validate mcp_toolsets requested on a key. Non-admin callers cannot assign toolsets to a personal (no team) key. Team keys must request a subset of the team's own toolset allowlist. NrzrKey is not in a team. MCP toolsets cannot be assigned to personal keys by non-admin callers. Disallowed toolsets: rrz/Key requests MCP toolsets not allowed by team 'rr)r r rrr rrZr)rrrteam_opteam_mcp_toolsetsdisallowed_toolsetss r(rrs   11P012!5  //G7>7Jw33PT !3c:K6L!L  -- A(BRBRASSV-./0 &'8 9:!=   r6c|rt|ts tS|jd}t|tr|Dchc]}|st |c}StScc}w)zAc|rt|tsgS|jd}t|tsgS|Dcgc]}|st |c}Scc}w)zCReturn search_tool_name values from a key's object_permission dict. search_tools)rHr'r"rnr2rs r(_extract_requested_search_toolsr sO J/@$$G "&&~6C c4   %q1CF %% %s A Ac Kt|}|sy|,|s*ttjddt |dig}|/|j #|j j }|r t|}|syt|t|z }|rI| |jnd}ttjdd|dt |d t |diyw) z Validate key object_permission.search_tools is a subset of the team's allowlist. Empty team allowlist means no restriction at team layer (skip). Non-admin callers cannot assign search_tools to a personal (no team) key. NrzvKey is not in a team. search_tools cannot be assigned to personal keys by non-admin callers. Disallowed search tools: rrunknownz/Key requests search tools not allowed by team 'rr) rr r rrr rrnrZr)r rrr team_toolsst disallowedrs r(&validate_key_search_tools_against_teamrs77HII 11Ti(),  J : : F..;; bJ IZ8J-5-A))y11EgYcj)*/&:L9MQP  sCCrY)NFN)F)H__doc__rIcollections.abcrr dataclassesrtypingrrrr fastapir r litellm._loggingr litellm._uuidr *litellm.litellm_core_utils.safe_json_dumpsrlitellm.proxy._typesrrrlitellm.proxy.utilsr1litellm.repositories.object_permission_repositoryr'litellm.repositories.table_repositoriesrprismar prisma_modelsrrr'r2r4r)r-rArNrVrnr`boolrirZrqrzrrrrrrrrrrrrrrrrrrrrrr5r6r(rs2  -!66)1Abb,XG. &CK && &R $d#$ *\"3;/*\#&:*\ *\ *\Z3>3>#&:3> $&3> 4Z 3>l$&@T#Y493CDS$&6&'S'$&' #s3x-'TT+T"3C=1T T"+"3C=1 *+d2"3C=1 "g"3C=1gXg*. S; S$& S X SFJCJ@S@ &* &$& & #Y &9t+#&: $&   B ()H I$&s^@*.34$& X.+d2X4 +d2 X  +d2 X  *. PT I+d2I34I $&I I %--L$M I D IX*C*34** *Z +d2 X !+d234 8 &+d2 & #Y &!/ +d2/ 34/ /  / r6