uPj XUddlZddlZddlZddlmZmZddlmZddlm Z m Z ddl Z ddl m ZddlmZddlmZmZddlmZmZmZddlmZmZmZdd lmZd d lmZd Z ee!d <dZ"de#de$e%fdZ&d6de#dzde'e%dffdZ(d6dZ)dZ*dZ+ d6de%de%dzdefdZ, d7de%dzde%dzde%dzfdZ- d7de%dzde%dzde%dzde%fdZ. d7de%dzde%dzde%dzdefd Z/d!Z0d"e%de%fd#Z1d$Z2de jffd%Z4d&e5de5fd'Z6de jnfd(Z8d)e5d*e%dzde5fd+Z9dejnfd,Z:d-e;dzdedzfd.Z d6d1ej~dzdejnejfzfd2Z@dej~dzfd3ZAd&ee%e;fdee%e;ffd4ZBd&e5ddfd5ZCy)8N)CallableMapping)Final)urlsplit urlunsplit)CredentialProvider) get_secretget_secret_str)AzureADCredentialProviderGCPIAMCredentialProvider_generate_gcp_iam_access_token)#REDIS_CLUSTER_HEALTH_CHECK_INTERVALREDIS_CONNECTION_POOL_TIMEOUTREDIS_SOCKET_TIMEOUT)SensitiveDataMasker)verbose_loggerz https://redis.azure.com/.defaultAZURE_REDIS_SCOPEctjtj}hd}hd}|jDchc] }||vs| c}|z}|Scc}w)N>selfretryconnection_pool> urlazure_client_idazure_tenant_idgcp_ssl_ca_certsredis_connect_funcazure_client_secretcredential_providergcp_service_accountazure_redis_ad_token)inspectgetfullargspecredisRedisargs)arg_spec exclude_args include_argsxavailable_argss S/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/_redis.py_get_redis_kwargsr-)sS,,U[[9HL L)1 O1,9NQOR^^N Ps AAclsreturncLtdtj|DS)uEvery ``__init__`` parameter accepted anywhere in a class's MRO. Keyword-only parameters are included, and the MRO is walked because redis-py splits a connection's parameters between ``AbstractConnection`` and its concrete subclasses. Each ``__init__`` is unwrapped before introspection: redis-py >= 7.4 decorates ``AbstractConnection.__init__`` with ``@deprecated_args``, whose wrapper is declared ``(self, *args, **kwargs)`` — introspecting the wrapper directly loses every real parameter (``socket_timeout`` included), which silently emptied this allowlist and dropped the socket timeouts from url-configured connections. ``inspect.unwrap`` follows the ``__wrapped__`` chain to the true signature and is a no-op on undecorated ``__init__``s. c3K|]^}|turTtjtj|j}|j |j zD]}|`ywN)objectr"r#unwrap__init__r& kwonlyargs).0klassspecnames r, z"_init_arg_names..Rs_   ++GNN5>>,JKDII/    sA$A&) frozensetr"getmro)r.s r,_init_arg_namesr>Ds' ^^C( client.c|tj}|tjurtjntj}t hdd}t fdt |D|zS)a0Connection kwargs that redis-py forwards from ``from_url`` down to the connection. ``from_url`` is declared as ``(cls, url, **kwargs)``, so introspecting it yields no connection kwargs at all. What it really does is hand its kwargs to the connection class, so that class's signature is the allowlist. Taking the client's signature instead would be wrong in both directions: it omits nothing useful, but it admits client-only parameters such as ``single_connection_client`` and ``auto_close_connection_pool``, plus the ``ssl_*`` family that only ``SSLConnection`` accepts. Those reach ``AbstractConnection`` and raise ``TypeError`` the first time a connection is created. TLS on a url config is selected by the ``rediss://`` scheme, which picks ``SSLConnection`` on its own. >rrr)rmax_connectionsc3,K|] }|vs| ywr2)r7r*r(s r,r;z(_get_redis_url_kwargs..xsUqq ?TUs )r$r% async_redis Connectionr<tupler>)r@connection_clsr)r(s @r,_get_redis_url_kwargsrI[sf~6< @Q@Q6QK22W\WgWgN# L5L UON;U UXd ddr?c|tjj}tjtj }hd}|j Dchc] }||vs| }}|hdz}|Scc}w)N>hostportrr startup_nodesr>sslpasswordusername ssl_ca_certs ssl_cert_reqssocket_timeoutrrrBrsocket_keepaliverssl_check_hostnamerrr r!health_check_intervalsocket_connect_timeout)r$r%from_urlr"r# RedisClusterr&)r@r'r(r*r+s r,_get_redis_cluster_kwargsrZ{so ~%%,,U-?-?@H`L!)HA!<2GaHNHN, /Is  A+A+cd}tdh}tDcic]}||vs||j|c}Scc}w)NREDIS_r)r<r-upper)PREFIXexclude_from_environmentr*s r,_get_redis_env_kwarg_mappingr`sIF&/1F0G&H/@/B h!aOgFgvhqwwyk "A % hh hs ??cxt}i}|jD]\}}t|d}||||<|S)N) default_value)r`itemsr )mapping return_dictkvvalues r,_redis_kwargs_from_environmentrisK13GK #11D1  "KN# r?service_accountrQcfd}|S)aq Creates a custom Redis connection function for GCP IAM authentication. Args: service_account: GCP service account in format 'projects/-/serviceAccounts/name@project.iam.gserviceaccount.com' ssl_ca_certs: Path to SSL CA certificate file for secure connections Returns: A connection function that can be used with Redis clients cddlm}m}ddlm}|j j |tf}|jdg|ddi |j}||d k7r|d y #|$rKt|dr;|jr/|jd|jd|j}nYcwxYw) z8Initialize the connection and authenticate using GCP IAMrAuthenticationError$AuthenticationWrongNumberOfArgsError str_if_bytesAUTH check_healthFrOrsOKzGCP IAM authentication failedN) redis.exceptionsrnro redis.utilsrq_parser on_connectr send_command read_responsehasattrrO)rrnrorq auth_args auth_responserjs r, iam_connectz6create_gcp_iam_redis_connect_func..iam_connects  - %:?KM &A9A5A  ..0M  &$ .%&EF F /4 tZ(T]]!!&$--e!L $ 2 2 4   sA22A CCrD)rjrQrs` r,!create_gcp_iam_redis_connect_funcrsG4 r?rrrc` ddlm}m}m}|xst j jd}|xst j jd}|xst j jd}|r|r |r ||||S|r ||S|S#t$r t dwxYw) z Build a long-lived Azure credential object. Azure SDK credentials cache tokens internally and handle expiry/refresh transparently, so this should be called once and the result reused. r)ClientSecretCredentialDefaultAzureCredentialManagedIdentityCredentialziazure-identity is required for Azure AD Redis authentication. Install it with: pip install azure-identityAZURE_CLIENT_IDAZURE_TENANT_IDAZURE_CLIENT_SECRET) client_id tenant_id client_secret)r)azure.identityrrr ImportErrorosenvironget) rrrrrr _client_id _tenant_id_client_secrets r,_build_azure_credentialrs    (L2::>>:K+LJ'L2::>>:K+LJ/X2::>>BW3XNj^%  (  (:>>%''%   w   s BB-c`t|||}|jt}|jS)u One-shot helper that builds a credential and fetches a single Azure AD access token for Redis. Each call rebuilds the credential and performs a network round-trip, so it should not be used in steady-state Redis flows — the sync (``create_azure_ad_redis_connect_func``) and async paths (``AzureADCredentialProvider``) keep the credential alive across connections so the Azure SDK's internal cache + silent refresh apply. rrr)r get_tokenrtoken)rrr credentialrs r,_generate_azure_ad_redis_tokenrs40''/J ''(9:E ;;r?c<t|||fd}|_|S)uF Creates a custom Redis connection function for Azure AD authentication. Used for sync Redis clients. The credential is created once (captured by the closure) and reused across connections — the Azure SDK handles token caching and silent renewal internally. Only ``get_token`` is called per connection. rcddlm}m}ddlm}|j j |jtj}tjjdd}|r||f}n|f}|jdg|ddi |j}||d k7r|d y #|$r'|jd|d |j}Y?wxYw) z9Initialize the connection and authenticate using Azure ADrrmrpREDIS_USERNAMErrrsFrtruz(Azure AD authentication failed for RedisN)rvrnrorwrqrxryrrrrrrrzr{) rrnrorq access_tokenrPr}r~rs r, ad_connectz6create_azure_ad_redis_connect_func..ad_connect)s  - %(223DEKK **..)92> !<0I%I&A9A5A 1 ..0M  &$ .%&PQ Q / 4 1   fl  G ..0M 1s B//)CC)r_azure_credential)rrrrrs @r,"create_azure_ad_redis_connect_funcrs/0''/J RH$.J r?cndtjvrtjdSdtjvsdtjvr tddtjvr'tjdjdk(rd}nd}d }d tjvr=d tjvr+tjd d tjd d }n(d tjvrtjd d }|d|tjdd tjdS)N REDIS_URL REDIS_HOST REDIS_PORTzUEither 'REDIS_URL' or both 'REDIS_HOST' and 'REDIS_PORT' must be specified for Redis. REDIS_SSLtrueredissr$rrREDIS_PASSWORD:@z://)rr ValueErrorlower)redis_protocol auth_parts r,get_redis_url_from_environmentrQs bjj zz+&&2::%RZZ)Gpqqbjj RZZ %<%B%B%D%N! I2::%*:bjj*Hzz"234AbjjAQ6R5SSTU RZZ 'zz"234A6  S BJJ|,D+EQrzzR^G_F` aar?rct|}|jjddd}t|j||j |j |jfS)Nrr)rnetlocrsplitrschemepathqueryfragment)rpartsrs r,_url_without_userinforgsLC=ELL''Q/3F u||VUZZennU VVr?c jD]J\}}t|ts|jds)|j dd}t |}||<Lt }tfddD}|r#jd|jddi|}|jddxs t d}|)t|trtj||d<n||jdd|jd dxs t d }|(t|trtj||d <|jd dxs td } | | |d <|jd dxs t d} | | |d <|jdm|jdxs td} |jdxs td} | Htjdt| | |d<| |d_| r|jddr| |d<|jdxs t d} | duxrt| j#dk(}|r| tj$d|r| |jdxs td}|jd xs td!}|jd"xs td#}tjd$t'|||%|d<d&|d_|jdd|jdd|jdd|jdd|jd d|jd"d|jdX|jdd|jd'd|jd(d|jdt+|d|d<d|vr`|d[|jdsH|jd)d|jd*d|jd+d|jd(d|Sd|vr|d d |vr|d  |Sd)|vs|d) t-d,|S)-zO Common functionality across sync + async redis client implementations z os.environ/rc3DK|]}j|duywr2)r)r7key env_overridess r,r;z*_get_redis_client_logic..}s&'/2 #d*'s )rKrMsentinel_nodesrNrMREDIS_CLUSTER_NODESrREDIS_SENTINEL_NODESsentinel_passwordREDIS_SENTINEL_PASSWORD service_nameREDIS_SERVICE_NAMErr REDIS_GCP_SERVICE_ACCOUNTrREDIS_GCP_SSL_CA_CERTSzASetting up GCP IAM authentication for Redis with service account.)rjrQrrNFrQr!REDIS_AZURE_AD_TOKENrzBoth GCP IAM (gcp_service_account) and Azure AD (azure_redis_ad_token) are configured for Redis. Using GCP IAM. Remove one to avoid misconfiguration.rrrrrrz-Setting up Azure AD authentication for Redis.rTrPrOrKrLdbz3Either 'host' or 'url' must be specified for redis.)rc isinstancestr startswithreplacer rianyrpopjsonloadsr rdebugr_gcp_service_accountrwarningr_azure_redis_ad_tokenrr)rrfrgrhenvironment_kwargscaller_named_a_target redis_kwargs_startup_nodes_sentinel_nodes_sentinel_password _service_namer_gcp_ssl_ca_certsr_azure_ad_enabled_azure_client_id_azure_tenant_id_azure_client_secrets` r,_get_redis_client_logicrms ##%%1 a !,,}"= -,AqME$M!  % !? @ $''6a'$!2!25!9!Aud+  L 0(B _%  $/0<0@0@AQSW0X1\f]O"z/3'G)-O)D %&,8,<,<=PRV,W-[i!\%,> ()'3'7'7'M'qQ[\pQqM '4 ^$-.6&2&6&67L&M' Q_ 'R $0#3#34F#G#s>ZrKs  +  !d e1R 4CT2L- .G[L- . C!\%5%5eU%C/@ ^,(4'7'78N'O'uS]^tSu#8#D#uMbIcIiIiIkouIu !5!A  " "G  !5!=&2&6&67H&I&n^\mMn &2&6&67H&I&n^\mMn *6*:*:;P*Q+Uc%V   !P Q1S 0 0$82L- .HLL- . D*D1'.+T2&-&-*D1-.:-t4T*T*   E " ."7 U8K"LL  e!4!@0   VT *   VT *   T4 (   Z .  <'  ) 5 | + ) * 6  | #|F';'CNOO r?ctd}| tj||d<t j dddlm}t}i}|D]}||vs||||<g}|dD]}|j|di||jddtjdd|i|S#tj$r t dwxYw)NrrMzbREDIS_CLUSTER_NODES environment variable is not valid JSON. Please ensure it's properly formatted.z8init_redis_cluster: startup nodes are being initialized.r ClusterNoderD)r rrJSONDecodeErrorrrr redis.clusterrrZappendrr$rY)r_redis_cluster_nodes_in_envrr&cluster_kwargsargnew_startup_nodesitems r,init_redis_clusterrs5?@U5V". ,0JJ7R,SL ) ST)+-DN4 $;".s"3N3 435_-6  !4t!456-    P,= P PP)## t  s B..C rcFi}t}|D]}||vs||||<|Sr2)r-)rconnection_kwargsr&rs r,%_get_redis_sentinel_connection_kwargsrs>!#%D7 $;%1#%6 c "7 r?c^|jd}|jd}|jd}t|}|jdtt ||}|r|s t dt jdtj||}|j|fi|SNrrrrSzIBoth 'sentinel_nodes' and 'service_name' are required for Redis Sentinel.z:init_redis_sentinel: sentinel nodes are being initialized.)sentinel_kwargs) rr setdefaultr_sentinel_auth_kwargsrrrr$Sentinel master_forrrrrrrsentinels r,_init_redis_sentinelr%s(,,-=>N+//0CD&**>:LD\R  !13GH23DFWXO deeUVnn'H 8  | A/@ AAr?rrcJd|jD}t||S)a4The Sentinel monitors are separate servers that authenticate with their own password, so the data node's credential provider never belongs on them: leaving it there makes redis-py send the data node's token to a monitor, which fails whether the monitor is unauthenticated or has its own password.c36K|]\}}|dk7s ||fyw)rNrD)r7rfrgs r,r;z(_sentinel_auth_kwargs..Bs ^da1H]C]Aq6^s  )rO)rcdict)rrkepts r,rr=s' _&7&=&=&?^D 0 11r?c^|jd}|jd}|jd}t|}|jdtt ||}|r|s t dt jdtj||}|j|fi|Sr) rrrrrrrrrErrrs r,_init_async_redis_sentinelrFs(,,-=>N+//0CD&**>:LD\R  !13GH23DFWXO deeUV"**'H 8  | A/@ AAr?rct|dd}| t|St|dd}|.t|tjj dxsdSy)aThe Azure AD and GCP IAM connect funcs run their AUTH exchange with the blocking client API, so on an async connection their ``send_command``/``read_response`` calls return coroutines nobody awaits and every connect fails. Async paths authenticate through a ``CredentialProvider`` instead, which redis-py consults per connection so the token stays fresh. Any other ``redis_connect_func`` is left where it is, since redis-py awaits it itself when it is a coroutine function.rNrr)rP)getattrr r rrr)rr azure_credentials r,_async_credential_providerr^sd"));=SUY!Z&'(;<<%&8:MtT#()9BJJNNScDdDlhlmm r?c|jd}||nt|jd}||Sthdfd|jD}t ||S)zSwaps a connect func an async path cannot run for the equivalent credential provider, which supersedes any static username or password redis-py would otherwise reject it with.rr>rOrPrc36K|]\}}|vs ||fywr2rD)r7rfrg supersededs r,r;z%_async_auth_kwargs..}s Rdaaz>QAq6Rs  )r)rrr<rcr)rexplicit_providerrrrs @r,_async_auth_kwargsr psw ,//0EF  (  ' (8(89M(N O "!"PQJRl&8&8&:RD *= >>r?c tdi|}d|vr t|Sd|vrD|d?t}i}|D]}||vs||||<tjj di|Sd|vrd|vr t |Stjdi|S)NrMrrrrD)rrrIr$r%rXr)rrr& url_kwargsrs r,get_redis_clientr s1BMBL,&!,// e!4!@+-  4Cd{".s"3 3 4{{##1j11<'Nl,J#L11 ;; & &&r?rc ttdi|}d|vrddlm}t }i}|D]}||vs||||<g}|dD]}|j |di||j dd|j dd|jdt|jddddl m } | } | dd|i|} | Sd |vr|d }|tj| Sttj }i} |D]%}||vr ||| |<tjd |'tjj di| Sd |vrd|vr t#|St%||||d<tjdi|S)NrMrrrrVrTT)%get_litellm_async_redis_cluster_classr)rr@zLREDIS: ignoring argument: %s. Not an allowed async_redis.Redis.from_url arg.rr)rrrD)r rrrrZrrrr,litellm.caching.redis_cluster_node_isolationrrEr%rIrrrXr_pretty_print_redis_config) rrrrr&rrrrrasync_redis_cluster_classcluster_clientr s r,get_redis_async_clientrs--D-U}-UVL,&-(* " 8Cd{&23&7s# 879 1 :D  $ $[%84%8 9 :?D1/6 !!"9;^_!!"4d; ,Q+R!!:! +! !   e!4!@  &$$_E E$K,=,=>  Cd{".s"3 3$$bdg    ))7J77<'Nl,J),77L9"*9 &'      r?c vttd i|}tjd|d|vryd|vr|dt t j }|jDcic]\}}||vs |dk7s||}}}t|d<|d|d<d|vr t|d|d<t jjd i|S|jddrt j |d <t jd dti|Scc}}w#ttf$rtjd|dYwxYw) Nz'get_redis_connection_pool: redis_kwargsrMrrrBtimeoutz1REDIS: invalid max_connections value %r, ignoringrNconnection_classrD)r rrrrIrEr%rcrint TypeErrorrrBlockingConnectionPoolrXr SSLConnection)rr allowed_argsrfrg pool_kwargss r,get_redis_connection_poolrsS--D-U}-UVLBLQ,& e!4!@3;;L;LM /;/A/A/Cttq!qLGX]^bs]sadt t!> I)%0 E  , 14\BS5T1U -. 11::I[IIt$+6+D+D '(  - - d6S dWc ddu z* &&G !23 s$& D3D9DD (D87D8cz|jDcic]\}}||dk(r|dn |dk(r|dn|c}}Scc}}w)Nrzrz)rc)rrrhs r,_redis_kwargs_for_loggingr!sc',,.   C ' 'E,=% & &5+<(     s7ct|} ddl}ddlm}ddlm}ddlm}ddlm }tj|jsy|}t}|j|} |dd } |d d d d } | jddd | jdd | j!D]o\} } |  t#| t$r:| dk(r| rdt'| d}n.| dk(r| rdt'| d}nt)| }n t)| }| j+| |qd}| j-drd}n'| j-drd}n| j-drd}|dd dd }|jd dd |jdd |j+d!||j/d"|j/|| d#$|j/||j/| |j/d"y#t0$r4t}|j|} tj2d%| Yyt4$r }tj6d&|Yd}~yd}~wwxYw)'zKPretty print the Redis configuration using rich with sensitive data maskingrN)Console)Panel)Table)TextzRedis Configurationz bold blue)styleu 🔧 Redis Connection ParametersTz bold magentaleft)title show_header header_style title_justify Parametercyan)r'no_wrapValueyellowrM[z cluster nodes]rz sentinel nodes]zStandard Redisz Redis ClusterzRedis SentinelrzRedis (URL-based)u📊 Connection Infoz bold greenPropertyzConnection Type blue) border_stylezRedis configuration: %sz-Error pretty printing Redis configuration: %s)r!logging rich.consoler# rich.panelr$ rich.tabler% rich.textr&r isEnabledForDEBUGr mask_dict add_columnrcrlistlenradd_rowrprintrinfo Exceptionerror)rredis_kwargs_for_loggingr7r#r$r%r&consolemaskermasked_redis_kwargsr) config_tablerrh value_strconnection_type info_tablees r,rrsl&? &MSQ($$"**7==9  %&%../GH1E$4'   64Hx8.335 5JC eT*o-%&'E |?$C  00U&'E |3C$D $'J #E I$$S)4 5$+  " "? 3-O $ $%5 6.O $ $U +1O"(%  jEgX6,o>  d eE78 j! l# d L$&$../GH57JK QLaPPQs+;H A7H EH :I.I.I))I.r2)NNN)Dr"rrcollections.abcrrtypingr urllib.parserrr$ redis.asyncioasynciorEredis.credentialsrlitellmr r "litellm._redis_credential_providerr r r litellm.constantsrrr0litellm.litellm_core_utils.sensitive_data_maskerr_loggingrr__annotations__r-typer<rr>rGrIrZr`rirrrrrrrrYrrrr%rrrr3rr r rrrr!rrDr?r,r]s  -- #0.  Q$=5=6)C..e$+esCxe@Di $))*))Z#'"&&*#(4Z#(4Z#(t#(N#'"&&*4Z4Zt .#'"&&*74Z74Z7t7 7tb,WsWsW OdQ(:(:Q8B%++B02T2cDj2UY2B 0A0AB06D=EWZ^E^$?T?d?"'.BFF 77$>F111FRe''$.e:GCK,@WSRX[EYVQTVQdVQr?