uPjA UddlmZddlZddlZddlZddlmZmZddlm Z ddl m Z m Z m Z ddl mZddlmZddlmZmZddlZddlZdd lmZdd lmZmZd Zd ed <dZd ed<dZd ed<dZd ed<dZ d ed<dZ!d ed<dZ"d ed<ejFjIejFjKddZ&d ed<dOdZ'dPdZ(dQdZ)dRd Z*dSd!Z+dTd"Z,e Gd#d$Z-e d%&Gd'd(Z.e.d)d*e.d+d,e.d-d.d/0e.d1d2d30e.d4d5d60e.d7e.d8e.d9d:d;0e.d0g Z/d?ed@<dUdVdAZ0dWdBZ1dXdCZ2dYdDZ3dZdEZ4 d[dFZ5d\dGZ6 d] d^dHZ7 d_ d`dIZ8 d] dadJZ9 d]dKdLdM dbdNZ:y)c) annotationsN)CallableSequence) dataclass)datetime timedeltatimezone)Path)Lock)AnyFinal)verbose_logger) HTTPHandler_get_httpx_clientz /oauth/tokenr AUTH_ENDPOINT_SUFFIX AICORE_CONFIGCONFIG_FILE_ENV_VAR AICORE_HOMEHOME_PATH_ENV_VARAICORE_PROFILEPROFILE_ENV_VAR VCAP_SERVICESVCAP_SERVICES_ENV_VARaicoreVCAP_AICORE_SERVICE_NAMEAICORE_SERVICE_KEYSERVICE_KEY_ENV_VAR~z.aicoreDEFAULT_HOME_PATHc>tjttSN)osgetenvrra/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/llms/sap/credentials.py _get_homer' s 99&(9 ::r%cN|}t|tr tj|}|D]I}t|ts,t j dt|j|y||vry||}K|S#tj$rt j dYywxYw)Nz?SAP service key or VCAP service is a string but not valid JSON.zMSAP service key or VCAP service traversal hit non-dict type '%s' at key '%s'.) isinstancestrjsonloadsJSONDecodeErrorrwarningdicttype__name__)dpathcurks r& _get_nestedr6$sC#s **S/C#t$  " "_aefiajasasuv  C<!f J##   " "#d e sA99(B$#B$ctjj|}|sy tj|S#tj $rYywxYwr!)r"environgetr+r,r-)var_nameraws r&_load_json_envr<9sE)C zz#   s9AAc@ | t|SdS#t$rYywxYwr!)r* Exception)values r& _str_or_noner@Cs-".s5z8D8 s  c(ttxsiSr!)r<rr$r%r& _load_vcaprBJs / 0 6B6r%ctjD]#}|D]}|jd|k(s|ccS%y)Nlabel)rBvaluesr9)rDservicessvcs r&_get_vcap_servicerHNsFL'') Cwww5(   r%c"eZdZUded<ded<y)Sourcer*namez(Callable[[CredentialsValue], str | None]r9N)r1 __module__ __qualname____annotations__r$r%r&rJrJVs I 11r%rJT)frozencBeZdZUded<dZded<dZded<dZded <y) CredentialsValuer*rKNztuple[str, ...] | Nonevcap_key str | NonedefaultzCallable[[str], str] | None transform_fn)r1rLrMrNrRrTrUr$r%r&rQrQ\s' I'+H$+GZ04L-4r%rQ client_id)clientid client_secret) clientsecretauth_urlurlcd|jd|jtrdzStzSN/rstripendswithrr[s r&rdj'C#,,G[:\B!wbv!wr%)rUbase_url) serviceurls AI_API_URLcT|jd|jdrdzSdzS)Nr_z/v2r`)rbrcr[s r&rdrdos&C#,,u:MB!YSX!Yr%cert_url)certurlcd|jd|jtrdzStzSr^rar[s r&rdrdtrer%cert_file_path key_file_pathcert_str) certificatec&|jddSN\n replacess r&rdrdzs!))TY[_J`r%key_str)keyc&|jddSrrrurws r&rdrd{s5RVAWr%zFinal[list[CredentialsValue]]CREDENTIAL_VALUESctt}|xs#tjj t }tj t}|r t|n||dvrdnd|dz }|rB|jr2 |jd5}tj|cdddS|s|dvrtd |d |d iS#1swYnxYw'#tj$rt|dwxYw) z Loads config JSON from: 1) $AICORE_CONFIG if set, otherwise 2) $AICORE_HOME/config.json (or config_.json when profile is given/not default) Returns {} when nothing is found. )Nr`rTz config.jsonconfig_z.jsonzutf-8)encodingNz, is not valid JSON. Please fix or remove it!z)Unable to locate profile config file at 'z' in AICORE_HOME '')r r'r"r8r9rr#rexistsopenr+loadr-KeyErrorFileNotFoundError)profilehomecfg_envcfg_pathfs r& init_confrsy{#D88GYY23G  W w2G'GmwW^V__dMef HOO% V0 $Ayy| $ $ 7"77"KH:Ughlgmmn opp I $ $ $## VhZ'STU U Vs$CC* CCC"C=c(d|jSNAICORE_)upper)rKs r& _env_namers TZZ\N ##r%ci}tD]B}|j|}||jr|j|n|||j<D|S)z&Extract all credentials from a source.)r|r9rUrK)source credentialscvr?s r&extract_credentialsrsSKX 2  =?__2??5#9RWK X r%c|D]3}t|}|stjd|j|cSt d)z?Extract credentials from the first source that has any defined.z'Resolved SAP credentials from source %sz"No credentials found in any source)rrdebugrK ValueError)sourcesrrs r&resolve_credentialsrsG)&1   !JFKK X   9 ::r%ctdd}|D]9}|j|}|tjd|j|cS|j S)z:Find resource_group from the first source that defines it.resource_grouprT)rTz1Resolved GEN AI Hub resource_group from source %s)rQr9rrrKrT)rrg_credrr?s r&resolve_resource_grouprs[%&6 JG 7#    !TV\VaVa bL  ??r%c(|yt|tr|St|tr tj|St jdt|jy#tj $rt jdYywxYw)z Pre-parse service_key if it's a string to avoid repeated JSON parsing. Returns None if parsing fails (other credential sources may still work). NzESAP service key is a string but not valid JSON. Skipping this source.zISAP service key has unexpected type '%s'. Expected str or dict. Ignoring.) r)r/r*r+r,r-rr.r0r1) service_keys r&_parse_service_key_oncers+t$+s# ::k* *SUYZeUfUoUo  ##   " "#j k sA&&(BBc|ytt||jrd|jzn |jf}|@tt||jr|jS|jfS|SN)rr@r6rRrK)rrvals r&$_resolve_credential_from_service_keyrsvk+[][f[f8H2;;8VmomtmtlvwxC {K BKKR[[`aaVXV]V]U_`aa Jr%c t|txs5tjxs#tj j ttttdfdtdfdtddtdfdtd fd g}t|}t|}|||d <d |vr|jd |d <|S)aw Resolution order (first-source-wins): Sources are checked in this order: kwargs > service key > env (AICORE_) > config (AICORE_ or plain ) > vcap service key > default Important: - Credentials are extracted from the FIRST source that provides any credential value. - Values are NOT merged per key across sources. Except resource_group, which is merged. Warning: - This function does NOT validate the returned credentials just parsed it from the sources. - Callers MUST explicitly call validate_credentials() on the returned dict kwargscLtj|jSr!)r@r9rK)rrs r&rdz#fetch_credentials..sLBGG1D$Er%z service keyct|Sr!)r)rrs r&rdz#fetch_credentials..s;KLr%zenvironment variablescttjjd|jj Sr)r@r"r8r9rKr)rs r&rdz#fetch_credentials..s*|BJJNNWRWW]]_. sf|:: '89:F WRWW]]_$567ZZ(r%z VCAP servicecrCtt|jrd|jzS|jfSdSrr)r vcap_services r&rdz#fetch_credentials..s[ $<>KK)BKK7OQggZr%rrjrZ)rrlitellmsap_service_keyr"r8r9rrHrrJrrpop)rrrrrrrrs` ` @@r&fetch_credentialsrs0g&F)+*w9P9P*wTVT^T^TbTbcvTwxK+,DEL xEF  L   # P         %GB-W5K27;N!(6 $%[ "-//*"= J r%c|r|r|s tdt|t|xr t|t|xr t|g}td|Ddk7r tdy)a Validate SAP AI Core credentials for completeness and consistency. Args: auth_url: OAuth2 token endpoint URL (required) base_url: SAP AI Core API base URL (required) client_id: OAuth2 client ID (required) client_secret: OAuth2 client secret (for secret-based auth) cert_str: PEM-encoded certificate string (for cert-based auth) key_str: PEM-encoded private key string (for cert-based auth) cert_file_path: Path to certificate file (for file-based cert auth) key_file_path: Path to private key file (for file-based cert auth) Raises: ValueError: If required fields are missing or authentication mode is ambiguous. Note: - This function does NOT validate resource_group (resolved separately). - Exactly one authentication method must be provided: * client_secret, OR * (cert_str AND key_str), OR * (cert_file_path AND key_file_path) zSAP AI Core credentials not found. Please provide credentials by setting appropriate environment variables (e.g. AICORE_CLIENT_ID, AICORE_CLIENT_SECRET, etc.)c32K|]}t|ywr!)bool).0ms r& z'validate_credentials..Ws "q47 "szSAP AI Core credentials are incomplete. Invalid credentials: provide exactly one of client_secret, (cert_str & key_str), or (cert_file_path & key_file_path).N)rrsum) rZrfrVrXroryrmrnmodess r&validate_credentialsr*sB 9H B   ] X(4= ^4m!4E  "E ""a' I  (r%cnd|d}|r||d<d} |rPtj|5}t|}|j|||}|j } dddn.t }|j|||}|j }  d} t | jdd } tjtjt| z} d | | fS#1swY`xYw#t$r8} | |jnt| d t!| }t#d || d} ~ wwxYw)Nclient_credentials) grant_typerVrX)cert)client)datatimeout access_token expires_ini)secondszBearer textzToken request failed: )httpxClientrpostr+rintr9rnowr utcrr>rgetattrr* RuntimeError)rVrZr cert_pairrXrresp raw_clienthandlerpayloadrr expiry_dateemsgs r&_request_tokenr_s5"6IND -_"&DB 9- &%Z8||H4|I))+ & & ()G<<tW<EDiikG%n5  L$ ?@ %\\(,,7)J:WW '44 & & B"&"2TYY63q68R3C59:ABs/C31C'B C3'C0,C33 D4<3D//D4g>@<)rexpiry_buffer_minutesc  td||d|}|jd |jd}|jd |jd |jd |jd|jd |jd t |  td d d fd dfd }||d|d fS)a Creates a callable that fetches and caches an OAuth2 bearer token using credentials from `fetch_credentials()`. The callable: - Automatically loads credentials via fetch_credentials(profile, **overrides) - Fetches a new token only if expired or near expiry - Caches token thread-safely with a configurable refresh buffer Args: profile: Optional AICore profile name timeout: Timeout for HTTP requests expiry_buffer_minutes: Refresh the token this many minutes before expiry overrides: Any explicit credential overrides (client_id, client_secret, etc.) Returns: Callable[[], str]: function returning a valid "Bearer " string. )rrrZrfrVrXroryrmrnNct rt Sr r߉jdd} jdd}tj5}tj j |d}tj j |d}t|d5}|j|dddt|d5}|j|dddt ||fcdddS t  fStd#1swYixYw#1swYOxYw#1swYAxYw) N)rZrVrrXrsrtzcert.pemzkey.pemw)rZrVrrzBInvalid authentication configuration: no valid credentials found. ) rrvtempfileTemporaryDirectoryr"r3joinrwriter)cert_str_fixed key_str_fixedtmp cert_pathkey_pathrrZrmrorVrXrnryrs r& _fetch_tokenz'get_token_creator.._fetch_tokensD !!#+   $,$4$4UD$AN#*??5$#?M,,. ##%77<<Z#@ "$'',,sI">)S),QGGN+,(C(+AGGM*+%%'#((3     %-*C!!#)=9  ]^^',,++  s=A D.D.D.D"D.D D."D+ 'D..D7c5tjtj}|z t kr \cdddS#1swYyxYw)N)minutes)rrr rr)rrrlocktoken token_expirys r& get_tokenz$get_token_creator..get_tokensX  !hll3C} 4 s8JY_tMu8u&2n#|    s AAArr$)returntuple[str, datetime]rr*)rr9rr )rrrr overridesrrfrrrZrmrorVrXrnryrrrs `` @@@@@@@@@@@r&get_token_creatorrzs8*;)q{\c)qgp)qK!ooj1H!ooj1H"{3I&???;M!ooj1H __Y/G'OO,<=N&???;M &DE$(L#_#_J k*-{;K/L LLr%r)r2zdict[str, Any] | strr3z Sequence[str]rr )r:r*rdict[str, Any] | None)rrS)rdict[str, Any])rDr*rrr!)rrSrr)rKr*rr*)rrJrdict[str, str])r list[Source]rr)rrrrS)rstr | dict | Nonerr)rrrrQrrS)NN)rrrrSrr)NNNNNNNN)rZrSrfrSrVrSrXrSrorSryrSrmrSrnrSrNone)rVr*rZr*rfloatrr) rrrrSrrrrrz"tuple[Callable[[], str], str, str]); __future__rr+r"rcollections.abcrr dataclassesrrrr pathlibr threadingr typingr r rrlitellm._loggingr&litellm.llms.custom_httpx.http_handlerrrrrNrrrrrrr3r expanduserrr'r6r<r@rBrHrJrQr|rrrrrrrrrrrr$r%r&rs" .!22 +Q,e,,U,(5()).u."*%*1U177<<(:(:3(?K5K;*7 22 2  $555[-0_&78w %Y w %&_%Z!1@`aY7WX/406<$;"0&*F"F F FT  $!% $2 2 2 2  2  2  2 2 2  2 lRVBB!B,1BB8&*dM!# dM"dM dM dM  dM(dMr%