tPjo" UdZddlmZmZddlmZddlmZddlde de dzd e fd Z de d e ee e e edzfffd Z dd e de dzd efdZedhZeed<dZeed< dd e de dee gee dzfde dzd e f dZy)z Auth Checks for Organizations ) AwaitableCallable)Final)status)* request_body user_objectNroutec |y|jdd}|dk(ri|jtjjk7rBt d|jt jjdtj|jtjjk(ry|tjjvr5t|\}}|j9t d|dt jjdtj|5t d t jjdtj|j|}|9t d |d t jjdtj|tjjk7rAt d |d |d|d |t jjdtjy|dk(rt|\}}|jt|jdkDr|8t d|t jjdtj|j|}|tjjk7r>t d|d|d |t jjdtjyyyy)a^ Role based access control checks only run if a user is part of an Organization Organization Checks: ONLY RUN IF user_object.organization_memberships is not None 1. Only Proxy Admins can access /organization/new 2. IF route is a LiteLLMRoutes.org_admin_only_routes, then check if user is an Org Admin for that organization Norganization_idz/organization/newz8Only proxy admins can create new organizations. You are user_role)messagetypeparamcodezTried to access route=z` but you are not a member of any organization. Please contact the proxy admin to request access.zNPassed organization_id is None, please pass an organization_id in your requestzQYou do not have a role within the selected organization. Passed organization_id: z:. Please contact the organization admin to request access.z-You do not have the required role to perform z in Organization z. Your role is z /team/newrz|Passed organization_id is None, please specify the organization_id in your request. You are part of multiple organizations: z*You do not have the required role to call )getr LitellmUserRoles PROXY_ADMINvalueProxyExceptionProxyErrorTypes auth_errorrHTTP_401_UNAUTHORIZED LiteLLMRoutesorg_admin_only_routesget_user_organization_infoorganization_memberships ORG_ADMINlen)rr r passed_organization_id_user_organizations_user_organization_role_mappingr _user_role_in_passed_orgs p/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/auth/auth_checks_organization.py$organization_role_based_access_checkr% sB 0<0@0@ARTX0Y ##  $4$@$@$F$F F RS^ShShRij$//55!11   0 < < B BB 33999 '{ 3  +  / / 7 08XY$//55'11   " ) h$//55'11  5T4W4WXn4o   kmClDD~$//55'11   (2288 8 GwN_`v_wxGHQGRRcdzc{|$//55!11   9 +  '{ 3  +  / / ;KDhDh@ilm@m%-$[\o[pq(3399+55 /N.Q.QRh.i $'+;+E+E+K+KK$H_w^xyJKaJbc(3399%55 LAn ; returncg}i}|jR|jD]C}|j|j|j|j||j<E||fS)a Helper function to extract user organization information. Args: user_object (LiteLLM_UserTable): The user object containing organization memberships. Returns: Tuple[List[str], Dict[str, Optional[LitellmUserRoles]]]: A tuple containing: - List of organization IDs the user is a member of - Dictionary mapping organization IDs to user roles )rr appendr )r r!r" _memberships r$rrnsx-/QS#++7&?? eK**6#**;+F+FGOZOdOd/ 0K0KL e  ? ??r& request_datac|y|jyg}|jdd}||j||jdd}t|tr|j ||sy|jDchc]A}|j tjjk(r|j |jCc}tfd|DScc}w)u Helper function to check if user is an org admin for all of the passed organizations. Checks both: - `organization_id` (singular string) — legacy callers - `organizations` (list of strings) — used by /user/new NFr organizationsc3&K|]}|v ywN).0org_id admin_org_idss r$ z%_user_is_org_admin..sG6v&Gs) rrr) isinstancelistextendr rrrr all)r+r candidate_org_idssingular orgs_listr*r3s @r$_user_is_org_adminr<s++3+-"&&'8$?H  *#''>I)T"  +  '??   $4$>$>$D$D DIdIdIp ##M G5FG GGs=ACz /team/updateTEAM_ORG_CONTEXT_ROUTESz/team/{team_id}PATCH_TEAM_ROUTE_TEMPLATEfetch_team_org_idroute_templatec K|jdr|S|tvr|jd}n!|tk(r|jddd}n|St |t r|s|S||d{}|s|Si|d|iS7w)a Return a copy of request_body with organization_id resolved from the target team when the route identifies the team by team_id and the caller did not pass organization_id. This lets an org admin of the team's own org reach the org-scoped branch of the route gate (which keys off organization_id) without the client having to send it. Returns request_body unchanged when it does not apply, so callers that already pass organization_id and non-team routes are untouched. The team_id is taken from the body for TEAM_ORG_CONTEXT_ROUTES, or from the last path segment when ``route_template`` is the ``/team/{team_id}`` route. r team_id/N)rr=r>rsplitr5str)r rr?r@rBr2s r$$add_team_org_context_to_request_bodyrHs$)* ''*..y9 4 4,,sA&r* gs #7+G44F  6l 6-v 665sA.B0B1Br/)__doc__collections.abcrrtypingrfastapirlitellm.proxy._typesdictLiteLLM_UserTablerGr%tupler6rrboolr< frozensetr=__annotations__r>rHr0r&r$rTs0"^^"T)^ ^B@"@ 49d3 04 778 89@8-1%H%H"T)%H %HP"+N+;!<<$554"& !7 !7!7 yt'< <=!7$J !7  !7r&