tPj ddlmZddlmZmZdedzdefdZdedzdeefdZ dedzdedzfdZ d edzdedzdefd Z y) )Final)LitellmUserRolesUserAPIKeyAuthuser_api_key_dictNreturnc|y|jtjk(xs'|jtjjk(S)NF) user_roler PROXY_ADMINvaluers r/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/common_utils/resource_ownership.pyis_proxy_adminrsH  ##'7'C'CC M  & &*:*F*F*L*L Lc|gSgdtdzddffd }|jr'||j|d|j|jr|d|j|jr|d|j|jr|d|j|j r|d|j S) u Return ownership scopes that may access a user-created proxy resource. Raw user_id is included for rows created before scope prefixes existed. Prefixes avoid collisions when falling back to team/org/key ownership for keys that do not have a user_id. Identity-less callers (no user_id, team_id, org_id, api_key, or token) return ``[]`` — they share no scope with any other caller, so access checks against an existing owner always fail and creates that depend on a primary scope must reject up front. Returning a shared sentinel here would let any two identity-less callers see each other's data. Nscoperc8|r|vrj|yyy)N)append)rscopess r _addz'get_resource_owner_scopes.._add%s U&( MM% )5rzuser:team:org:key:)struser_idteam_idorg_idapi_keytoken)rrrs @r get_resource_owner_scopesrs   !F!C$J!4!    & &' u&../ 01   u&../ 01 t%,,- ./   t%--. /0 t%++, -. Mrc|y|jr |jS|jrd|jS|jrd|jS|jrd|jS|jrd|jSy)uTReturn the canonical owner scope to stamp on newly-created rows. ``None`` for identity-less callers — callers that depend on a primary scope to record ownership must surface that as a hard error rather than fall back to a shared sentinel (which would collapse every identity-less caller into the same logical owner). Nrrr)rrrrrr s r get_primary_resource_owner_scoper!8s    (((  (00122'../00  '//011'--.// rownerc@|yt|ry|y|t|vS)NTF)rr)r"rs r user_can_access_resource_ownerr$Rs3 '( } -.?@ @@r) typingrlitellm.proxy._typesrrboolrlistrrr!r$rr r*sAnt&;%%,% #Y%P%,4Z4 A : A%, A  Ar