Ë
    tPêj  ã                  ó  — d dl mZ d dlmZ d dlmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZmZmZ d dlmZ d d	lmZ d d
lmZmZmZmZ d dlmZmZmZmZm Z m!Z!m"Z"m#Z# d dl$m%Z%m&Z&m'Z' erd dl(m)Z) d dl*m+Z+ d dl,m-Z-m.Z.  G d„ d«      Z/y)é    )Úannotations)ÚSequence)ÚTYPE_CHECKINGÚFinal)Ú	BaseModel)Úverbose_proxy_logger)ÚUserAPIKeyAuth)Ú_cache_key_objectÚ!_copy_user_api_key_auth_for_cacheÚ(_fetch_key_object_from_db_with_reconnectÚget_object_permission)Ú
AuthMethod)ÚNetworkContext)ÚKeyNotFoundErrorÚKeyNotInCacheErrorÚNoDatabaseConnectionErrorÚPrincipalMissingSourceKeyError)ÚCredentialRefÚEndUserIdentityÚOrganizationIdentityÚ	PrincipalÚPrincipalTypeÚProjectIdentityÚTeamIdentityÚUserIdentity)ÚTeamRoleÚmap_roleÚ	team_role)Ú	DualCache)ÚSpan)ÚPrismaClientÚProxyLoggingc                  óÂ   — e Zd ZdZddddœ	 	 	 	 	 	 	 	 	 	 	 dd„Zej                  ddœ	 	 	 	 	 	 	 dd„Zedd„«       Z	dd	„Z
eddd
dddœ	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 dd„«       Zy)ÚIdentityStoreaý  The auth flow's resolver: one combined_view lookup, projected into a Principal.

    ``resolve`` does the lookup (cache, then DB via the shared lower-level helpers,
    then write-back) and returns the per-caller Principal. The Principal carries the
    source key object so ``key_from_principal`` can hand it back to the parts of the
    request flow that still consume ``UserAPIKeyAuth`` (budget, rate limits, policy);
    that carrier is a stopgap until those consumers read identity off the Principal.
    The Prisma client, key cache, the request's tracing span / logging sink, and
    whether this store may only read the cache are injected so the composition root
    can build the store once the proxy DB is connected; the span and logging sink
    are infra the DB call is instrumented with and ``check_cache_only`` is a store
    mode, none of them inputs to resolving identity. ``auth_checks.get_key_object``
    stays as the legacy entrypoint for its other callers until they migrate onto
    this store.
    NF)Úparent_otel_spanÚproxy_logging_objÚcheck_cache_onlyc               óJ   — || _         || _        || _        || _        || _        y )N)Ú_prismaÚ_cacheÚ_parent_otel_spanÚ_proxy_logging_objÚ_check_cache_only)ÚselfÚprisma_clientÚcacher%   r&   r'   s         úg/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/auth/resolvers/store.pyÚ__init__zIdentityStore.__init__;   s*   € ð %ˆŒØˆŒØ!1ˆÔØ"3ˆÔØ!1ˆÕó    )Úauth_methodÚnetworkc          	   ƒ  ó¨   K  — | j                  |«      ƒ d {  –—† }| j                  ||||j                  t        |j                  ¬«      ¬«      S 7 Œ8­w)N)Útoken_id)r4   r5   Úsubject_fallbackÚcredential_ref)Ú_resolve_keyÚ_principal_from_keyÚtokenr   )r.   Úhashed_tokenr4   r5   Úkeys        r1   ÚresolvezIdentityStore.resolveJ   sT   è ø€ ð  ×,Ñ,¨\Ó:×:ˆØ×'Ñ'ØØ#ØØ ŸY™YÜ(°#·)±)Ô<ð (ó 
ð 	
ð ;ús   ‚A—A˜9Ac                óF   — | j                   €
t        «       ‚| j                   S )a  Hand back the resolved key object carried on the Principal.

        Stopgap for the request flow that still consumes ``UserAPIKeyAuth`` for
        budget, rate-limit, and policy state. Only Principals produced by
        ``resolve`` carry a source key.
        )Ú
source_keyr   )Ú	principals    r1   Úkey_from_principalz IdentityStore.key_from_principalZ   s%   € ð ×ÑÐ'Ü0Ó2Ð2Ø×#Ñ#Ð#r3   c              ƒ  óJ  K  — | j                   €
t        «       ‚| j                  j                  |t        ¬«      ƒ d {  –—† }|�t        |¬«      S | j                  rt        |«      ‚t        || j                   | j                  | j                  ¬«      ƒ d {  –—† }|€t        |«      ‚t	        j                  |j                  d¬«      «      }|j                  r\|j                  sP	 t!        |j                  | j                   | j                  | j                  | j                  ¬«      ƒ d {  –—† |_        t)        ||| j                  | j                  ¬«      ƒ d {  –—†  |S 7 �Œ&7 ŒÎ7 Œ;# t"        $ r+}t%        j&                  d|j                  |«       Y d }~Œcd }~ww xY w7 ŒD­w)	N)r>   Ú
model_type)Úuser_api_key_obj)r=   r/   r%   r&   T)Úexclude_none)Úobject_permission_idr/   Úuser_api_key_cacher%   r&   zIFailed to load object_permission for key with object_permission_id=%s: %s)r=   rF   rI   r&   )r)   r   r*   Úasync_get_cacher	   r   r-   r   r   r+   r,   r   Úmodel_validateÚ
model_dumprH   Úobject_permissionr   Ú	Exceptionr   Údebugr
   )r.   r=   ÚcachedÚfrom_dbr>   Úes         r1   r:   zIdentityStore._resolve_keyf   s…  è ø€ Ø�<‰<ÐÜ+Ó-Ð-à"Ÿk™k×9Ñ9¸lÔWeÐ9Óf×fˆØÐÜ4ÀfÔMÐMà×!Ò!Ü$ \Ó2Ð2ä1YØ%ØŸ,™,Ø!×3Ñ3Ø"×5Ñ5ô	2
÷ ,
ˆð ˆ?Ü" <Ó0Ð0ä#×2Ñ2°7×3EÑ3EÐSWÐ3EÓ3XÓYˆà×#Ò#¨C×,AÒ,AðÜ.CØ),×)AÑ)AØ"&§,¡,Ø'+§{¡{Ø%)×%;Ñ%;Ø&*×&=Ñ&=ô/÷ )�Ô%ô  Ø%Ø Ø#Ÿ{™{Ø"×5Ñ5ô	
÷ 	
ð 	
ð ˆ
ðQ gùð,
øð)ùô ò Ü$×*Ñ*Ø_Ø×,Ñ,Ø÷ñ ûðúð	
úsl   ‚;F#½E#¾AF#ÂE&ÂAF#Ã'AE* Ä,E(Ä-	E* Ä6&F#ÅF!ÅF#Å&F#Å(E* Å*	FÅ3!FÆF#ÆFÆF#© )Úissuerr8   Úscopesr9   r5   c               ó”  — g }| j                   �l| j                  rt        | j                  j                  «      nt        j
                  }|j                  t        | j                   | j                  |¬«      «       | j                  �!t        | j                  | j                  ¬«      nd}	| j                  �!t        | j                  | j                  ¬«      nd}
| j                  �!t!        | j                  | j"                  ¬«      nd}| j$                  �t'        | j$                  ¬«      nd}t)        | j*                  «      }t-        | j                  rt.        j0                  nt.        j2                  | j                  xs | j4                  xs |xs d||
|	||||r|gng t7        |«      ||xs
 t9        «       |xs
 t;        «       | ¬«      S )a;  Project the identity slice off an already-resolved key object and carry
        the key on the Principal so ``key_from_principal`` can recover it.

        Pure: issues no lookup. Both ``resolve`` and the auth seam call this so
        identity is projected once off whichever key object they already hold.
        N)ÚidÚnameÚrole)rW   rX   )rW   Úemail)rW   Ú )Úprincipal_typeÚsubjectrT   ÚuserÚorganizationÚteamsÚprojectÚend_userÚrolesrU   r4   r9   r5   rA   )Úteam_idÚteam_memberr   rY   r   ÚMEMBERÚappendr   Ú
team_aliasÚorg_idr   Úorganization_aliasÚuser_idr   Ú
user_emailÚ
project_idr   Úproject_aliasÚend_user_idr   r   Ú	user_roler   r   ÚHUMANÚSERVICE_ACCOUNTÚ	key_aliasÚlistr   r   )r>   r4   rT   r8   rU   r9   r5   r`   rY   r_   r^   ra   rb   Úmappeds                 r1   r;   z!IdentityStore._principal_from_key”   sh  € ð" ,.ˆØ�;‰;Ð"Ø=@¿_º_œ) C§O¡O×$8Ñ$8Ô9ÔRZ×RaÑRaˆDØ�L‰Lœ¨¯©¸3¿>¹>ÐPTÔUÔVàPS×PZÑPZÐPfÔ  C§J¡J°S×5KÑ5KÕLÐlpð 	ð MPÏKÉKÐLc”l c§k¡k¸¿¹ÕHÐimˆØPS×P^ÑP^ÐPj”/ S§^¡^¸#×:KÑ:KÕLÐptˆØADÇÁÐA\œ/¨S¯_©_Õ=ÐbfˆÜ  §¡Ó/ˆÜØ36·;²;œM×/Ò/ÄM×DaÑDaØ—K‘KÒJ 3§=¡=ÒJÐ4DÒJÈØØØ%ØØØÙ$�6‘(¨"Ü˜“<Ø#Ø)Ò<¬]«_ØÒ/œ~Ó/Øô
ð 	
r3   )r/   zPrismaClient | Noner0   r   r%   zSpan | Noner&   zProxyLogging | Noner'   ÚboolÚreturnÚNone)r=   Ústrr4   r   r5   úNetworkContext | Nonerw   r   )rB   r   rw   r	   )r=   ry   rw   r	   )r>   r	   r4   r   rT   ú
str | Noner8   r{   rU   zSequence[str]r9   zCredentialRef | Noner5   rz   rw   r   )Ú__name__Ú
__module__Ú__qualname__Ú__doc__r2   r   ÚAPI_KEYr?   ÚstaticmethodrC   r:   r;   rS   r3   r1   r$   r$   *   s  „ ñð* )-Ø15Ø!&ñ2à*ð2ð ð2ð
 &ð2ð /ð2ð ð2ð 
ó2ð& #-×"4Ñ"4Ø)-ñ
àð
ð  ð	
ð
 'ð
ð 
ó
ð  ò	$ó ð	$ó,ð\ ð
 "Ø'+Ø "Ø/3Ø)-ñ*
Øð*
ð  ð*
ð ð	*
ð
 %ð*
ð ð*
ð -ð*
ð 'ð*
ð 
ò*
ó ñ*
r3   r$   N)0Ú
__future__r   Úcollections.abcr   Útypingr   r   Úpydanticr   Úlitellm._loggingr   Úlitellm.proxy._typesr	   Úlitellm.proxy.auth.auth_checksr
   r   r   r   Úlitellm.proxy.auth.auth_methodr   Úlitellm.proxy.auth.networkr   Ú'litellm.proxy.auth.resolvers.exceptionsr   r   r   r   Ú#litellm.proxy.auth.resolvers.modelsr   r   r   r   r   r   r   r   Úlitellm.proxy.auth.rolesr   r   r   Úlitellm.caching.cachingr   Ú"litellm.integrations.opentelemetryr    Úlitellm.proxy.utilsr!   r"   r$   rS   r3   r1   ú<module>r‘      sc   ðÝ "å $ß 'å å 1Ý /÷ó õ 6Ý 5÷ó ÷	÷ 	ó 	÷ CÑ BáÝ1Ý7ß>÷U
ò U
r3   