tPj3 UdZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z ddl m Z mZddlmZmZmZmZmZddlmZddlmZmZmZdd lmZdd lmZeZe e d <e!hd Z"e e d <de!e#fdZ$de!e#fdZ%hdZ&e e d<ddde'e#e#ffdZ(iZ)e e'e#efe d<de#de fdZ*dZ+e e d<de#de#dzde#dzde#fdZ,de#de#de'fdZ-d e'e#e.fddfd!Z/ejad"d#g$eefd%ede1e'e#e#ffd&Z2ejad'd#g$eed(fd%ede#de'fd)Z3ejid*gd+d#gd,-eefde#d.e#d/ed%edef d0Z5y)1u- Plugin proxy routes for litellm. Enables external services to register as plugins and be proxied through the litellm proxy server. Config (in litellm config.yaml general_settings): plugins: - name: my-plugin url: "http://localhost:3210" display_name: "My Plugin" plugin_key: "sk-..." # optional: plugin's own auth key Plugin iframe auth: The UI calls GET /api/plugins/auth-token to receive a short-lived identity claim ({user_id, user_role, plugin, exp}) encrypted with a per-plugin key derived as HMAC-SHA256(LITELLM_SALT_KEY, plugin_name). The claim carries no litellm bearer token, so a compromised plugin learns only the caller's identity, never their credential. LITELLM_SALT_KEY itself is never shared with plugins — each plugin holds only its own derived key. N)Mapping)Final)Fernet InvalidToken) APIRouterDepends HTTPExceptionRequestResponse)get_async_httpx_client) PluginConfigSpecialHeadersUserAPIKeyAuth)user_api_key_auth)httpxSpecialProviderrouter>tehostcookieupgradetrailers connectiontransfer-encoding_HOP_BY_HOP_STRIPreturnc ddlm}t |dd}t |t s tS|jd}t |tr|rt|jhStS#t$r tcYSwxYw)zThe lowercased general_settings.litellm_key_header_name, if configured. Read live from the proxy module (not import-time) so a custom key header set via config is honoured without a restart. Returns empty when unset. r) proxy_servergeneral_settingsNlitellm_key_header_name) litellm.proxyr Exception frozensetgetattr isinstancedictgetstrlower)rrnames `/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/plugin_routes.py_configured_key_header_namesr+;s~ .&l4FM & -{*../HID(24(=$9djjl^ $WIKW {sA66B  B cNttjztzS)uHeaders to drop before forwarding a request to a plugin backend. Every header user_api_key_auth accepts as a litellm credential is stripped — Authorization, x-api-key, API-Key, x-goog-api-key, Ocp-Apim-Subscription-Key, x-litellm-api-key, and any configured custom key header — so a plugin can never be handed the caller's live litellm key (confused-deputy escalation). )rrlitellm_credential_header_namesr+r*_request_strip_headersr0Ls! ~MMO ORnRp ppr/> set-cookiecontent-lengthcontent-encodingr_RESPONSE_STRIPrawzMapping[str, str]ci|jDcic]\}}|jtvs||!c}}dddScc}}w)a Strip wire-encoding/cookie headers and force proxied responses inert. Plugin-controlled bytes are served from the litellm dashboard origin, so a compromised plugin could return an HTML/JS document that executes with the admin's session against same-origin management APIs. A sandbox CSP forces the response into an opaque origin with scripts disabled, and nosniff stops content-type confusion from re-enabling execution. Both are set last so a plugin cannot override them with its own headers. sandboxnosniff)zcontent-security-policyzx-content-type-options)itemsr(r4)r5kvs r*_safe_response_headersr<dsH IIK LDAq1779O+K1a4 L #,"+  Ls AA_plugin_registry plugin_namectjddj}tj||jt j j}ttj|S)zReturn a Fernet cipher whose key is scoped to a specific plugin. Key material: HMAC-SHA256(LITELLM_SALT_KEY, plugin_name). A plugin possessing its own key cannot derive the master salt or forge claims intended for a different plugin. LITELLM_SALT_KEY) osgetenvencode_hmacnewhashlibsha256digestrbase64urlsafe_b64encode)r>saltderiveds r*_plugin_fernetrNs\)).3::>JQQSG &**73 44r/_CLAIM_TTL_SECONDSuser_id user_rolec||xsd|xsdttjtzd}t|j t j |jjS)uIssue a short-lived, audience-scoped identity claim for the plugin. The claim contains {user_id, user_role, plugin, exp}. Crucially it contains NO litellm bearer token — the plugin can only derive the caller's identity, not act as them against the proxy. rA)pluginrQrRexp) inttimerPrNencryptjsondumpsrDdecode)r>rQrRclaims r*issue_plugin_session_claimr]sc=b_"499;"44 E + & . .tzz%/@/G/G/I J Q Q SSr/ ciphertextc t|j|jt}t j |}|jd|k7r tdt|jddttjkr td|S#t tf$r}td|d}~wwxYw) zVerify and decode a plugin session claim. Raises ValueError if the HMAC is invalid, the audience is wrong, or the claim is expired. Returns the decoded claim dict on success. )ttlz2Invalid, tampered, or expired plugin session claimNrTzPlugin claim audience mismatchrUrzPlugin session claim expired) rNdecryptrDrPrYloadsrr! ValueErrorr&rVrW)r>r^r5r\excs r*verify_plugin_session_claimres X#K0889J9J9LRd8ezz# yyk)9:: 599UA #diik"22788 L ) $XMNTWWXsAB**C 9 CC rc|jd}t|tr|ng}d|DDcic]}|j|}}tj tj |ycc}w)zReplace the plugin registry from general_settings. Replaces (not merges) so plugins removed from config are immediately unreachable without requiring a process restart. pluginsc3FK|]}tj|yw)N)r model_validate).0entrys r* z/register_plugins_from_config..s.gV[|/J/J5/Q.gs!N)r&r$listr)r=clearupdate)rr5entriesp new_registrys r*register_plugins_from_configrsse "%%i0C*4S$*?3RG.g_f.gh16619hLhL)isA1z /api/pluginsrg)tagsuser_api_key_dictcKtjDcgc]4}|j|jxs |j|jd6c}Scc}ww)u^Return registered plugins for authenticated UI callers. plugin_key is never returned — the browser never needs it (the proxy injects it server-side from the registry), and exposing it here would leak the credential into React state and DevTools. Admin key management goes through the redacted /config/field/info path instead. )r) display_nameurl)r=valuesr)rwrx)rurTs r* list_pluginsrzsU"'--/    KK"//>6;;::   sA9AAz/api/plugins/auth-tokenzlitellm-platform-plugincKtjds tdd|tvrtdd|dt |dd }t |d d }d t |||iSw) uIssue a short-lived, audience-scoped plugin session claim. The claim contains {user_id, user_role, plugin, exp}. It does NOT contain the caller's litellm bearer token — a compromised plugin can only learn the caller's identity, not impersonate them against the proxy. Encrypted with a key derived from HMAC(LITELLM_SALT_KEY, plugin_name), so each plugin holds only its own key and cannot forge claims for others. Requires LITELLM_SALT_KEY to be set; returns 503 otherwise. r@izCLITELLM_SALT_KEY is not configured; plugin iframe auth unavailable.) status_codedetailPlugin 'z' is not registered.rQNrR session_claim)rBrCr r=r#r])rur>rQrRs r*plugin_auth_tokenrs} 99' (X  **h{mK_4`aa. 4@G0+tDI 7 WiX YYsA%A'z'/plugin-proxy/{plugin_name}/{path:path})GETPOSTPUTDELETEPATCHOPTIONSHEADF)methodsrtinclude_in_schemapathrequestc Kt|dddk7r tddStj|}|std|dd S|jj d d |}|jj }|r|d |}|jd{}t}|jjD cic]\} } | j|vs| | } } } |j} | rd | | d <t|dd} t|dd}| rt| | d<|rt|| d<ttj } |j"j%|j&|| |}|j"j)|dd{}t|j,|j.t1|jS7=cc} } w7B#t*$r td|d|jdcYSwxYww)uAuthenticated reverse-proxy to a registered plugin backend. Restricted to proxy_admin callers — the shared plugin_key must not be usable as a confused-deputy credential by regular users. Plugin UIs talk to the plugin service directly via the iframe; this route is for administrative and server-to-server access only. The caller's litellm credential is stripped and replaced with the plugin's own plugin_key so plugins never receive a live litellm API key. rRN proxy_adminz.Plugin proxy access requires proxy_admin role.i)contentr|rz' not registeredr~/?zBearer authorizationrQzx-litellm-user-idzx-litellm-user-role) llm_provider)methodrxheadersrF)follow_redirectszCannot connect to plugin 'z' at i)rr|r)r#r r=r&rxrstripquerybodyr0rr9r( plugin_keyr'r rPassThroughEndpointclient build_requestrsendr!rr|r<)r>rrrurT target_urlrrstripr:r;forward_headersrrQrRhandlerreqresps r* plugin_proxyrs", +t4 ED  %((5F {m+;<  JJ%%c*+1TF3J;;$$E "|1UG,  &D*+E/6/D/D/Fatq!!'')[`J`adaOa))J-4ZL+A( . 4@G0+tDI/27|+,14Y-.+9M9a9abG ^^11>># 2 $NN//e/LL  $$&t||4 M'b6M  0 U6::,O   sbBHG+HG!G&A-HA G"G G""6HH G""&H H H  H)6__doc__rJrGhmacrErYrBrWcollections.abcrtypingrcryptography.fernetrrfastapirrr r r &litellm.llms.custom_httpx.http_handlerr litellm.proxy._typesr rr$litellm.proxy.auth.user_api_key_authrlitellm.types.llms.custom_httprr__annotations__r"rr'r+r0r4r%r<r=rNrPr]reobjectrsr&rmrzr api_routerr.r/r*rs], #4HHIMMB?  % 5 XinX"q #q  3S#X$46%S,./05 5 5 5E TC T#* TQTW[Q[ T`c T Scd, *4V 3D * * N)-(/0A(B% $sCx..( %YK8(/0A(B0Z%ZZ Z9Z6- H  )00A(B LL LL& L  L  Lr/