Ë
    tPêj(  ã                   óF  — U d Z ddlmZmZ ddlmZ ddlmZ ddlm	Z	m
Z
 ddlmZ ddlmZmZ ddlmZ dd	lmZ  G d
„ de	«      Z G d„ de	«      Zdedededefd„Zdededz  fd„Zdeeef   dedz  fd„Zdefd„Z edd¬«       G d„ d«      «       Z ee¬«      Zeed<   y)a   
Authorize router fallback targets against the caller's key, team and project model access.

`_enforce_key_and_fallback_model_access` only sees fallbacks the client sends in the request body.
Fallbacks configured on the router (`router_settings.fallbacks` and friends) are chosen after auth,
inside the router, so this predicate is injected into the router to re-run the same model access
checks for each fallback target before it is attempted. Opt-in via
`general_settings.enforce_fallback_model_access: true`.
é    )ÚCallableÚMapping)Ú	dataclass)ÚFinal)Ú	BaseModelÚValidationError)Úverbose_proxy_logger)ÚProxyExceptionÚUserAPIKeyAuth)Úcan_key_call_resolved_model)ÚRouterc                   ó"   — e Zd ZU dZedz  ed<   y)Ú_RequestMetadataNÚuser_api_key_auth)Ú__name__Ú
__module__Ú__qualname__r   r   Ú__annotations__© ó    úm/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/auth/fallback_model_access.pyr   r      s   … Ø/3Ð�~¨Ñ,Ô3r   r   c                   ó   — e Zd ZU dZeed<   y)Ú_FallbackAccessSettingsFÚenforce_fallback_model_accessN)r   r   r   r   Úboolr   r   r   r   r   r      s   … Ø*/Ð! 4Ô/r   r   ÚmodelÚvalid_tokenÚ
llm_routerÚreturnc              ƒ   ó®   K  — 	 t        | d ||¬«      ƒ d {  –—†  y7 Œ# t        $ r Y yt        $ r!}t        j                  d| |«       Y d }~yd }~ww xY w­w)N)r   Úllm_model_listr   r   Fz>Skipping fallback to model=%s: authorization lookup failed: %sT)r   r
   Ú	Exceptionr	   Úwarning)r   r   r   Úes       r   Úis_model_authorized_for_tokenr%      sg   è ø€ ðÜ)ØØØ#Ø!ô	
÷ 	
ð 	
ð ð	
ùô ò ÙÜò Ü×$Ñ$Ð%eÐglÐnoÔpÜûðüs@   ‚A„ –— ›Aœ ž	A§A©A±AÁAÁAÁAÚmetadataNc                 ó`   — 	 t         j                  | «      j                  S # t        $ r Y y w xY w©N)r   Úmodel_validater   r   )r&   s    r   Ú_token_in_metadatar*   /   s0   € ðÜ×.Ñ.¨xÓ8×JÑJÐJøÜò Ùðús   ‚! ¡	-¬-Úrequest_kwargsc                 ó2   ‡ ‡— t        ˆ ˆfd„dD «       d «      S )Nc              3   óZ   •K  — | ]"  }t        ‰j                  |«      «      xŠ�‰–— Œ$ y ­wr(   )r*   Úget)Ú.0Úfieldr+   Útokens     €€r   ú	<genexpr>z2_user_api_key_auth_from_request.<locals>.<genexpr>8   s4   øè ø€ ò 	
àÜ+¨N×,>Ñ,>¸uÓ,EÓFÐF�ÐSô ñ	
ùs   ƒ(+)r&   Úlitellm_metadata)Únext)r+   r1   s   `@r   Ú_user_api_key_auth_from_requestr5   6   s"   ù€ Üô	
à9ô	
ð
 	óð r   c                  óL   — ddl m}  t        j                  | «      j                  S )Nr   ©Úgeneral_settings)Úlitellm.proxy.proxy_serverr8   r   r)   r   r7   s    r   Ú_enforced_by_general_settingsr:   A   s   € Ý;ä"×1Ñ1Ð2BÓC×aÑaÐar   T)ÚfrozenÚslotsc                   óH   — e Zd ZU dZeg ef   ed<   dedeee	f   de
defd„Zy)	ÚRouterFallbackAccessChecka  
    `FallbackAccessCheck` for the proxy's router: while `is_enforced()` is true, a fallback target
    is attempted only when the key behind the request could have requested it directly. Requests
    that carry no key (for example internal health checks) are not restricted.
    Úis_enforcedr   r+   r   r   c             ƒ   óx   K  — | j                  «       syt        |«      }|€yt        |||¬«      ƒ d {  –—† S 7 Œ­w)NT)r   r   r   )r?   r5   r%   )Úselfr   r+   r   r   s        r   Ú__call__z"RouterFallbackAccessCheck.__call__Q   s>   è ø€ Ø×ÑÔ!ØÜ<¸^ÓLˆØÐØÜ2¸ÈKÐdnÔo×oÐoÐoús   ‚1:³8´:N)r   r   r   Ú__doc__r   r   r   Ústrr   Úobjectr   rB   r   r   r   r>   r>   G   sI   … ñð ˜"˜d˜(Ñ#Ó#ðp sð p¸GÀCÈÀKÑ<Pð pÐ^dð pÐimô pr   r>   )r?   Úrouter_fallback_access_check) rC   Úcollections.abcr   r   Údataclassesr   Útypingr   Úpydanticr   r   Úlitellm._loggingr	   Úlitellm.proxy._typesr
   r   Úlitellm.proxy.auth.auth_checksr   Úlitellm.routerr   r   r   rD   r   r%   rE   r*   r5   r:   r>   rF   r   r   r   r   ú<module>rO      sÞ   ðò÷ .Ý !Ý ç /å 1ß ?Ý FÝ !ô4�yô 4ô0˜iô 0ð°#ð ÀNð Ð`fð Ðkoó ð  ð ¨N¸TÑ,Aó ð°G¸CÀ¸KÑ4Hð È^Ð^bÑMbó ðb tó bñ �$˜dÔ#÷pð pó $ðpñ$ '@ÐLiÔ&jÐ ˜eÔ jr   