uPjIUdZddlmZmZddlmZmZmZmZddlm Z ddl m Z ddl m Z mZmZmZerddlmZddlmZdd lmZGd d eZGd d Zdaedzed<defdZy)z Attachment Registry - Manages policy attachments from YAML config. Attachments define WHERE policies apply, separate from the policy definitions. This allows the same policy to be attached to multiple scopes. )datetimetimezone) TYPE_CHECKINGAnyFinal TypedDict)verbose_proxy_logger)PolicyAttachmentRepository)PolicyAttachmentPolicyAttachmentCreateRequestPolicyAttachmentDBResponsePolicyMatchContext)Sequence)LiteLLM_PolicyAttachmentTable) PrismaClientc"eZdZUeed<eed<y)PolicyAttachmentMatch policy_name matched_viaN)__name__ __module__ __qualname__str__annotations__t/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/policy_engine/attachment_registry.pyrrsrrc eZdZdZd#dZdeeeefddfdZ deeefde fdZ d e deefd Z d e deefd Zed e d e defd Zded e defdZdee fdZdee dffdZdedee fdZdefdZd#dZd e ddfdZdedefdZdedefdZ d$dedddedzdefdZ dedddeeeffdZ!dedddedzfd Z"dddeefd!Z# d%d"Z$y)&AttachmentRegistrya In-memory registry for storing and managing policy attachments. Attachments define the relationship between policies and their scopes. A single policy can have multiple attachments (applied to different scopes). Example YAML: ```yaml attachments: - policy: global-baseline scope: "*" - policy: healthcare-compliance teams: [healthcare-team] - policy: dev-safety keys: ["dev-key-*"] ``` returnNc.g|_d|_d|_y)NrF _attachments_config_attachments _initializedselfs r__init__zAttachmentRegistry.__init__4s46AC "'rattachments_configcg|_|D]O} |j|}|jj|tjd|j Qt|j|_ d|_ tjdt|jy#t $r*}tjd|td||d}~wwxYw)z Load attachments from a configuration list. Args: attachments_config: List of attachment dictionaries from YAML. z Loaded attachment for policy: %szError loading attachment: %szInvalid attachment: NTzLoaded %s policy attachments)r#_parse_attachmentappendr debugpolicy Exceptionerror ValueErrortupler$r%infolen)r'r)attachment_data attachmentes rload_attachmentsz#AttachmentRegistry.load_attachments9s1 DO D!33OD !!((4$**+MzO`O`a  D$)):):#;  !!"@#dFWFWBXY  D$**+I1M #7s!;r?)r get)r'r5s rr+z$AttachmentRegistry._parse_attachmentOsg "&&x4!%%g.!%%g. $$V,"&&x0 $$V,   rcontextcP|j|Dcgc]}|d c}Scc}w)z Get list of policy names attached to the given context. Args: context: The request context to match against Returns: List of policy names that are attached to matching scopes r)"get_attached_policies_with_reasons)r'rBrs rget_attached_policiesz(AttachmentRegistry.get_attached_policiesbs)+/*Q*QRY*Z[Q- [[[s #c ddlm}g}t}|jD]}|j }|j ||s'|j |vs6|j|j |j||}|j|j |dtjd|j ||j|j|j|S)z Get list of policy names and match reasons for the given context. Returns a list of dicts with 'policy_name' and 'matched_via' keys. The 'matched_via' describes which dimension caused the match. r PolicyMatcher)r;rB)rrzRAttachment matched: policy=%s, matched_via=%s, context=(team=%s, key=%s, model=%s))*litellm.proxy.policy_engine.policy_matcherrIsetr#to_policy_scope scope_matchesr.add_describe_match_reasonr,r r- team_alias key_aliasmodel)r'rBrIresults seen_policiesr6r;rs rrDz5AttachmentRegistry.get_attached_policies_with_reasonsns M68), ++ J..0E***H$$M9!%%j&7&78"&"="=j'"RKNN+5+<+<+6 )..l"))#**))  *rr6czddlm}|jryg}|jr[|jrO|jDcgc]!}|j ||js |#}}|r|j d|d|j r*|jr|j d|j|jr*|jr|j d|j|jr*|jr|j d|j|rdj|Sd Scc}w) z/Describe why an attachment matched the context.rrHzscope:*ztag:zteam:zkey:zmodel:+z scope:default) rJrI is_globalr?matches_patternr,r<rPr=rQr>rRjoin)r6rBrIreasonst matching_tagss rrOz)AttachmentRegistry._describe_match_reasons  M    ! ??w||/6||#q!}?\?\]^`j`o`o?pA#qM#qmA&6%789    2 2 NNU7#5#5"67 8 ??w00 NNT'"3"3!45 6    NNVGMM?3 4$+sxx @@$rs !D8"D8rc,|j|}||vS)a Check if a specific policy is attached to the given context. Args: policy_name: Name of the policy to check context: The request context to match against Returns: True if the policy is attached to a matching scope )rF)r'rrBattacheds ris_policy_attachedz%AttachmentRegistry.is_policy_attacheds44W=h&&rc6|jjS)zp Get all loaded attachments. Returns: List of all PolicyAttachment objects )r#copyr&s rget_all_attachmentsz&AttachmentRegistry.get_all_attachmentss  %%''r.c|jS)z Get the attachments loaded from config.yaml. Returns: Tuple of config-defined PolicyAttachment objects )r$r&s rget_config_attachmentsz)AttachmentRegistry.get_config_attachmentss'''rc`|jDcgc]}|j|k(s|c}Scc}w)z Get all attachments for a specific policy. Args: policy_name: Name of the policy Returns: List of attachments for the policy )r#r.)r'ras rget_attachments_for_policyz-AttachmentRegistry.get_attachments_for_policys) ,,HaK0GHHHs++c|jS)z Check if the registry has been initialized with attachments. Returns: True if attachments have been loaded, False otherwise )r%r&s ris_initializedz!AttachmentRegistry.is_initializeds   rc.g|_d|_d|_y)z: Clear all attachments from the registry. rFNr"r&s rclearzAttachmentRegistry.clears#% !rc|jj|d|_tjd|j y)zp Add a single attachment. Args: attachment: PolicyAttachment object to add TzAdded attachment for policy: %sN)r#r,r%r r-r.)r'r6s radd_attachmentz!AttachmentRegistry.add_attachments7   , ""#DjFWFWXrct|j}|jDcgc]}|j|k7s|c}|_|t|jz }|dkDrtjd|||Scc}w)z Remove all attachments for a specific policy. Args: policy_name: Name of the policy Returns: Number of attachments removed rz'Removed %s attachment(s) for policy: %s)r4r#r.r r-)r'roriginal_countrf removed_counts rremove_attachments_for_policyz0AttachmentRegistry.remove_attachments_for_policysv!$D$5$5 6(,(9(9U1QXX=TQU-D4E4E0FF 1  & &'PR_al m Vs A;A; attachment_idcy)z Remove an attachment by its ID (for DB-synced attachments). Args: attachment_id: The ID of the attachment to remove Returns: True if removed, False if not found Fr)r'rrs rremove_attachment_by_idz*AttachmentRegistry.remove_attachment_by_idsrattachment_request prisma_clientr created_byc K t|jj|j|j|j xsg|j xsg|jxsg|jxsgtjtjtjtj||d d{}t|j|j|j |j |j|j}|j|t|j |j|j|j xsg|j xsg|jxsg|jxsg|j"|j$|j&|j( S7#t*$r)}t-j.d|t+d|d}~wwxYww)aL Add a policy attachment to the database. Args: attachment_request: The attachment creation request prisma_client: The Prisma client instance created_by: User who created the attachment Returns: PolicyAttachmentDBResponse with the created attachment ) rr;r<r=r>r? created_at updated_atrw updated_by)dataNr@ rrrr;r<r=r>r?ryrzrwr{z!Error adding attachment to DB: %szError adding attachment to DB: )r tablecreaterr;r<r=r>r?rnowrutcr rmr rrryrzrwr{r/r exception)r'rurvrwcreated_attachmentr6r7s radd_attachment_to_dbz'AttachmentRegistry.add_attachment_to_dbs", CMgNeFF#5#A#A/55/55;.339r077=2.339r"*,,x||"<"*,,x||"<",",  H $!1)55(..(..',,)00',, !J    +-0>>.::(..(..4"',,2)006B',,2-88-88-88-88  9HR C * *+NPQ R=aSAB B Cs<G3CF>F<C5F>;G3<F>> G0$G++G00G3cK t|jjd|id{}|td|dt|jj d|id{|j |d{dd|diS7e7'7#t$r)}t jd |td |d}~wwxYww) z Delete a policy attachment from the database. Args: attachment_id: The ID of the attachment to delete prisma_client: The Prisma client instance Returns: Dict with success message rrwhereNzAttachment with ID z not foundmessagez Attachment z deleted successfullyz%Error deleting attachment from DB: %sz#Error deleting attachment from DB: )r r~ find_uniquer/deletesync_attachments_from_dbr rr'rrrvr6r7s rdelete_attachment_from_dbz,AttachmentRegistry.delete_attachment_from_dbQs GLfMeKK &FKGGHJ!"5m_J OPP-];AAHHP_anOoHp p p// > > >]O;PQR RGH q ? G * *+RTU VA!EF F Gs\C*BB?B.B/BB BCBBB C #$CC  Cc K t|jjd|id{}|yt|j|j |j |jxsg|jxsg|jxsg|jxsg|j|j|j|j S7#t$r)}t!j"d|td|d}~wwxYww)a Get a policy attachment by ID from the database. Args: attachment_id: The ID of the attachment to retrieve prisma_client: The Prisma client instance Returns: PolicyAttachmentDBResponse if found, None otherwise rrrNr}z$Error getting attachment from DB: %sz"Error getting attachment from DB: )r r~rr rrrr;r<r=r>r?ryrzrwr{r/r rrs rget_attachment_by_id_from_dbz/AttachmentRegistry.get_attachment_by_id_from_dbus FLfMeKK &FKGGHJ!-(66&22 && &&,"__*!((.B__*%00%00%00%00  GH( F * *+QST U@DE E FsCD*C C C DBC D C C>$C99C>>Dc&K t|jjddid{}|Dcgc]}t|j|j |j |jxsg|jxsg|jxsg|jxsg|j|j|j|j c}S7cc}w#t$r)}t!j"d|td|d}~wwxYww)z Get all policy attachments from the database. Args: prisma_client: The Prisma client instance Returns: List of PolicyAttachmentDBResponse objects rydesc)orderNr}z%Error getting attachments from DB: %sz#Error getting attachments from DB: )r r~ find_manyr rrrr;r<r=r>r?ryrzrwr{r/r r)r'rv attachmentsrfr7s rget_all_attachments_from_dbz.AttachmentRegistry.get_all_attachments_from_dbs GPjQeII#V,KK(%+"#// ! ''''-R288>r2 || || || ||   K   G * *+RTU VA!EF F GsJD*CCCBCCDCC D%$D  DDc zK |j|d{}|Dcgc]}t|j|j|jr |jnd|j r |j nd|j r |j nd|jr |jnd}}g|j||_ d|_ tjdt|t|jy7cc}w#t$r)}tjd|td|d}~wwxYww)z Sync policy attachments from the database to in-memory registry. Config-loaded attachments are preserved. Args: prisma_client: The Prisma client instance Nr@Tz]Synced %s attachments from DB to in-memory registry (%s config-defined attachments preserved)z%Error syncing attachments from DB: %sz#Error syncing attachments from DB: )rr rr;r<r=r>r?r$r#r%r r3r4r/r)r'rvrattachment_responsedb_attachmentsr7s rrz+AttachmentRegistry.sync_attachments_from_dbs8 G'+'G'G 'V!VK,7 %(!.::-338K8Q8Q.44W[5H5M5M,11SW:M:T:T/66Z^5H5M5M,11SW  %N %!M$":": L^ LD  $D  % %oK D,,- !"W %& G * *+RTU VA!EF F GsKD;DC?DB D-AD>D;?DD D8$D33D88D;)r N)N)rvrr N)%rrr__doc__r(listdictrrr8r r+rrFrrD staticmethodrOboolr_rbr2rdrgrirkrmintrqrtr r rrrrrrrrrr!s0$( Z4S#X3GZDZ, c3h DT & \-? \DI \!:L!QUVkQl!FA+;AFXA]`AA* 'c '.C(D( Ic IdCS>T I!!" Y)9 Yd Y" S T ,"& =C9=C&=C$J =C $ =C~"G"G&"G c3h "GH&F&F&&F $d * &FP&G%&G ( )&GP#G%#G #GrrN_attachment_registryr c.t tatS)zs Get the global AttachmentRegistry singleton. Returns: The global AttachmentRegistry instance )rrrrrget_attachment_registryrs#13 r)rrrtypingrrrrlitellm._loggingr 'litellm.repositories.table_repositoriesr !litellm.types.proxy.policy_enginer r r rcollections.abcr prisma.modelsrlitellm.proxy.utilsrrrrrrrrrrsn(771N(;0I GGGGV37(4/6  !3  r