uPj<UdZddlZddlmZddlmZmZddlmZm Z m Z m Z ddl m Z ddlmZddlmZdd lmZdd lmZdd lmZdd lmZdd lmZddlmZddlmZm Z m!Z!m"Z"m#Z#m$Z$erddl%m&Z'eZ(ee)d<de*dee*de+e*e,ffdZ-de,de+fdZ.d7de,de,de/fdZ0de,ddfdZ1ddd ee*de2e/e*e3ffd!Z4d"dd ee*de2e/e*e3ffd#Z5de,d$dd%ee*d&ee*d'ee*de2e/e*e/e*e3ff d(Z6de,d)ee*d'ee*de/e*fd*Z7e(jqd+d,ge ege$-e d.d/0e efd1e#d2e9d3efd4Z:e(jqd5d,ge ege-e efd1e d3efd6Z;y)8u Policy resolve and attachment impact estimation endpoints. - /policies/resolve — debug which guardrails apply for a given context - /policies/attachments/estimate-impact — preview blast radius before creating an attachment N)Sequence) TYPE_CHECKINGFinal) APIRouterDepends HTTPExceptionQuery)verbose_proxy_logger)MAX_POLICY_ESTIMATE_IMPACT_ROWS)UserAPIKeyAuth) RouteChecks)user_api_key_auth)get_attachment_registry)get_policy_registry)TeamRepository)VerificationTokenRepository)AttachmentImpactResponsePolicyAttachmentCreateRequestPolicyMatchContextPolicyMatchDetailPolicyResolveRequestPolicyResolveResponse)modelsrouterfieldpatternsreturnc g}g}|D]=}|jdr|j|d|ddii-|j|?g}|r|j|d|ii|j||s|ddiiSt|dk(r|dSd |iS) zBuild a Prisma ``where`` clause for alias patterns. Supports exact matches and suffix wildcards (``prefix*``). Returns something like: {"OR": [{"field": {"in": ["a","b"]}}, {"field": {"startsWith": "dev-"}}]} * startsWithNinnotrOR)endswithappendextendlen)rrexactprefix_conditionspat conditionss y/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/policy_engine/policy_resolve_endpoints.py_build_alias_wherer/(s!E8: <<   $ $elCH-E%F G LL   24J 54-01'( t}%% :!!} *  raw_metadatac|iSt|tr tj|St|t r|SiS#tjt f$ricYSwxYw)z8Parse metadata that may be a dict, JSON string, or None.) isinstancestrjsonloadsJSONDecodeError TypeErrordict)r1s r._parse_metadatar:Csb ,$ ::l+ +&lD9<ArA$$i0 I s?AAmetadata json_metadatacP||n|}t|}|jdgxsgS)zDExtract tags list from a metadata field (or metadata_json fallback).tags)r:get)r;r<rawparseds r._get_tags_from_metadatarBOs."/";C#C(F ::fb ! 'R'r0 prisma_clientz)Sequence[prisma_models.LiteLLM_TeamTable]cxKt|jjidditd{S7w)zHFetch teams from DB once. Reuse the result across tag and alias lookups. created_atdescwhereordertakeN)rtable find_manyr rCs r._fetch_all_teamsrNVsA .44>>V$ ,?  s 1:8:keysz1Sequence[prisma_models.LiteLLM_VerificationToken] tag_patternsc g}d}|D]d}|jxsd}t|jt|dd}|s7t fd|DsL|r|j |`|dz }f||fS)zvFilter key rows whose metadata.tags match any of the given patterns. Returns (named_aliases, unnamed_count). r metadata_jsonNc3ZK|]"}D]}tj||$yw)routepatternNr route_matches_wildcard_pattern.0tagr,rPs r. z'_filter_keys_by_tags..ls> #   6 6S# N N N (+r$) key_aliasrBr;getattranyr')rOrPaffected unnamed_countkeyr_key_tagss ` r._filter_keys_by_tagsrf_s"$HM #MM'R *3<<oW[9\]     *"  # ] ""r0teamscg}d}|D]X}|jxsd}t|j}|s+tfd|Ds@|r|j |T|dz }Z||fS)zvFilter pre-fetched team rows whose metadata.tags match any patterns. Returns (named_aliases, unnamed_count). rrRc3ZK|]"}D]}tj||$ywrUrXrZs r.r]z(_filter_teams_by_tags..s> #   6 6S# N N N r^r$) team_aliasrBr;rar')rgrPrbrcteamrj team_tagss ` r._filter_teams_by_tagsrmxsy"$HM #__* +DMM:      +"  # ] ""r0 all_teams team_patternsexisting_teams existing_keysc Kg}g}|D]d}|jxsd st fd|Ds+ |vs0|j |jt|jfg}d} |rnt |j jdd|iidditd {} | D]0} | jxsd} | r| |vs|j| ,| d z } 2||| fS7>w) zFilter pre-fetched teams by alias patterns, then fetch their keys. Returns (new_teams, new_keys, unnamed_keys_count). rRc3LK|]}tj|ywrUrX)r[r,rjs r.r]z2_find_affected_by_team_patterns..s' Z]K 6 6ZQT U U !$rteam_idr"rErFrGNr$) rjrar'r4rurrKrLr r_)rCrnrorprq new_teamsmatched_team_idsrknew_keysunnamed_keys_countrOrdr_rjs @r._find_affected_by_team_patternsrzs#%I)+;__* # an  /  , ''DLL(9:;"$H7 FLLVVt%567(0W    (C +IM1OOI."a'"  ( h 2 22 s'C,C,C,A1C,+C*,C, C, key_patternsc Kg}t|jjtd|dditd{}|D]@}|j xsdst fd|Ds+|vs0|jB|S7Kw)z1Find keys whose alias matches the given patterns.r_rErFrGNrRc3LK|]}tj|ywrUrX)r[r,r_s r.r]z/_find_affected_keys_by_alias..s' Y\K 6 6YPS T T rt)rrKrLr/r r_rar')rCr{rqrbrOrdr_s @r._find_affected_keys_by_aliasr~s "$H3MBHHRR l;V$ ,SD +MM'R  `l   - * + Os#=BB BB2B7Bz/policies/resolvePolicies)r> dependenciesresponse_modelFz?Force a DB sync before resolving. Default uses in-memory cache.)default descriptionrequest force_syncuser_api_key_dictcKddlm}ddlm}ddlm}| t dd |rBtj|d{tj|d{t|j|j|j|j }tj!| }|s t#gg S|Dcgc]}|d  } }|j%| | } g} t'} |D]w} | d }|| vr |j)|tj+|}|r |j,ng}| j/|| j1t3|| d|yt#t5| | S7I7+cc}w#t $rt6$r1}t9j:d|t dt=|d}~wwxYww)a Resolve which policies and guardrails apply for a given context. Use this endpoint to debug "what guardrails would apply to a request with this team/key/model/tags combination?" Example Request: ```bash curl -X POST "http://localhost:4000/policies/resolve" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "tags": ["healthcare"], "model": "gpt-4" }' ``` r) PolicyMatcher)PolicyResolverrMNDatabase not connected status_codedetail)rjr_modelr>)context)effective_guardrailsmatched_policies policy_name) policy_namesr)rpoliciesr matched_via)rrguardrails_addedzError resolving policies: %s)*litellm.proxy.policy_engine.policy_matcherr+litellm.proxy.policy_engine.policy_resolverrlitellm.proxy.proxy_serverrCrrsync_policies_from_dbrsync_attachments_from_dbrrjr_rr>"get_attached_policies_with_reasonsr%get_policies_with_matching_conditionssetresolve_policy_guardrailsget_all_policies guardrailsupdater'rsorted Exceptionr exceptionr4)rrrrrrCr match_resultsrrapplied_policy_namesrall_guardrailsresultpnameresolvedres r.resolve_policies_for_contextrs>IJ84LMM<< %'==mL L L)+DD]S S S,))''--   78[[dk[l (%'!#  :GGAq/G G&3&Y&Y%'Z'  #%%(U# F=)E00%??!,.??A@H 19,,bJ  ! !* -  # #! % &} 5%/  &%!'!7-  c M S(H@  <&&'EqICF;;" \ -H "Content-Type: application/json" \ -d '{ "policy_name": "hipaa-compliance", "tags": ["healthcare", "health-*"] }' ``` rrMNrrrrr!u#(global scope — affects all keys)u$(global scope — affects all teams))affected_keys_countaffected_teams_count sample_keys sample_teamsrErFrG )rrryunnamed_teams_countrrz&Error estimating attachment impact: %s)rrCrscoperr>rgrNrrKrLr rfrmrzr(rOr~r)rr rr4)rrrC affected_keysaffected_teams unnamed_keys unnamed_teamsrPrornrOrvrx new_unnamedr{rs r.estimate_attachment_impactrAs#494LMMG< ==C +$&%'BCDE  $& $&  %ll0b &}}2 @B =.}==I  ;M J P P Z Z#V,4![!D +?t\*R 'M<,A- )NM 5T 60 ,Ix  ! !) ,   * K 'L&ll0b 9H   *' #M 2\ A!$^!4}!D+ -%cr*',   M>0  <&&'OQRSCF;;rsz $'<<1=/7BSK?. cXc]tCK?P6 B& BT B(f(V(t(&5`# =#MUVY]# 49c>#2# 6#FNsm# 49c>#2(3(3:(3C=(3SM (3 C= (3  49d3i $% (3V)1#GOPS} #Y6 +,-(  U)00A(B \< !\<\< & \<  \