uPj?UddlZddlZddlZddlmZmZddlmZdZee d<dZ ee d<iZ ee e ee effe d<ej Zee d <d e d e fd Zd e d e fd ZGddeZGddeZy)N)AnyFinal)CredentialProviderz https://redis.azure.com/.defaultAZURE_REDIS_SCOPEi _GCP_IAM_TOKEN_TTL_SECONDS _token_cache_token_cache_lockservice_accountreturnc ddlm}|j}|j |dg}|j |}t |jS#t$r tdwxYw)a  Generate GCP IAM access token for Redis authentication. Args: service_account: GCP service account in format 'projects/-/serviceAccounts/name@project.iam.gserviceaccount.com' Returns: Access token string for GCP IAM authentication r)iam_credentials_v1zlgoogle-cloud-iam is required for GCP IAM Redis authentication. Install it with: pip install google-cloud-iamz.https://www.googleapis.com/auth/cloud-platform)namescope)request) google.cloudr ImportErrorIAMCredentialsClientGenerateAccessTokenRequestgenerate_access_tokenstr access_token)r r clientrresponses g/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/_redis_credential_provider.py_generate_gcp_iam_access_tokenrs 3';;=F'BB ?@CG2272CH x$$ %%   <   s AA(ctj|}||\}}tj|kr|St5tj|}|'|\}}tj|kr |cdddSt |}|tjt zft|<|cdddS#1swYyxYw)ay Return a cached GCP IAM token, refreshing only when expired. Uses a module-level cache shared across all GCPIAMCredentialProvider instances for the same service account. The threading.Lock ensures only one thread performs the network round-trip on expiry; all others wait briefly and read the fresh token (double-checked locking pattern). This avoids N concurrent blocking IAM refreshes when N Redis connections are established simultaneously (e.g. during health checks or pool warm-up), which would otherwise serialise inside Python's async event loop and cause cascading request latency. N)rgettime monotonicr rr)r cachedtokenexpirys r_get_cached_gcp_iam_tokenr#0s  o .F  v >> f $L  !!/2  "ME6~~&(  /?  NN 9 9) _%   s5B5;0B55B>cDeZdZdZdeddfdZdeefdZdeefdZy)GCPIAMCredentialProvideru redis.credentials.CredentialProvider implementation that supplies GCP IAM tokens for Redis authentication, with module-level caching per service account. Tokens are cached for _GCP_IAM_TOKEN_TTL_SECONDS (55 min) so that repeated connection establishments — e.g. during connection pool warm-up or health checks — do not each trigger a synchronous network round-trip that would block Python's async event loop and cause cascading request latency. gcp_service_accountr Nc||_yN)_gcp_service_account)selfr&s r__init__z!GCPIAMCredentialProvider.__init___s $7!c2t|j}|fSr()r#r)r*r!s rget_credentialsz(GCPIAMCredentialProvider.get_credentialsbs01J1JKxr,clKtjt|jd{}|fS7wr()asyncio to_threadr#r)r.s rget_credentials_asyncz.GCPIAMCredentialProvider.get_credentials_asyncfs/$../H$JcJcddxes (424) __name__ __module__ __qualname____doc__rr+tupler/r3r,rr%r%Ts:8C8D8sU3Zr,r%cpeZdZdZd dededzddfdZdeeeeefzfdZdeeeeefzfdZ y) AzureADCredentialProvidera redis.credentials.CredentialProvider implementation that supplies Azure AD tokens for Redis authentication. Wraps an azure-identity credential object so the Azure SDK's internal token cache and silent refresh are honoured on every Redis connection. This avoids the static-token-baked-in-pool issue where pool-managed connections would fail authentication after the initial token expired (~1 hour TTL). N credentialusernamer c ||_||_yr() _credential _username)r*r<r=s rr+z"AzureADCredentialProvider.__init__vs%!r,c|jjtj}|jr|j|fS|fSr()r? get_tokenrr!r@r.s rr/z)AzureADCredentialProvider.get_credentialszs<''112CDJJ >>NNE* *xr,cKtj|jjtd{}|j r|j |j fS|j fS75wr()r1r2r?rBrr@r!)r* token_objs rr3z/AzureADCredentialProvider.get_credentials_asyncsU!(!2!243C3C3M3MO`!aa >>NNIOO4 4!!bs2A,A*6A,r() r4r5r6r7rrr+r8r/r3r9r,rr;r;ks_"3"#*""seCHo!= "U3Z%S/-I"r,r;)r1 threadingrtypingrrredis.credentialsrr__annotations__rrdictrr8floatLockr rr#r%r;r9r,rrLs 0>5=%)E( 57 eDeCJ//016)9>>+5+&C&C&6!s!s!H1." 2"r,