tPjq lUdZddlZddlZddlmZddlmZmZddlmZm Z m Z m Z ddl m Z mZmZmZddlmZmZmZddlmZdd lmZdd lmZdd lmZdd lmZmZm Z m!Z!dd l"m#Z#ddl$m%Z%ddl&m'Z'ddl(m)Z)m*Z*m+Z+erddl,m-Z-e Z.e e/d<ee0e1e2fZ3e e/d<Gdde Z4Gdde Z5ddde5fdZ6hdZ7e e8e1e/d<e9de)DZ:e e9e1e/d<eZ;e e/d <d!Zd'e2de0e1e2ffd(Z?d)ee1e2fde0e1e2ffd*Z@d%ee1e2fde0e1e2ffd+ZAd,e1deBfd-ZCd.e2deBfd/ZDd0ZEe eFe1d1fe/d2<d.e2de1fd3ZGd4ee1e2fd5ee1e2fdeBfd6ZHd4ee1e2fd5ee1e2fdee1e2ffd7ZId%ee1e2fdzde0e1e2ffd8ZJdUd9ZKd:ed;ee1e2fdzde1dzddf d?ZLGd@dAZMGdBdCeZNGdDdEeZOGdFdGeZPGdHdIeZQe.jdJdKgee#geNLee#fd=e!fdMZSe.jdNdKgee#gePLee#fdOeOd=e!fdPZUe.jdJdKgee#gQee#eddRSfdOeQd=e!d>e1dzfdTZVy)Va CACHE SETTINGS MANAGEMENT Endpoints for managing cache configuration GET /cache/settings - Get cache configuration including available settings POST /cache/settings/test - Test cache connection with provided credentials POST /cache/settings - Save cache settings to database N)Mapping)datetimetimezone) TYPE_CHECKINGAnyFinalProtocol) APIRouterDependsHeader HTTPException) BaseModelField TypeAdapter)verbose_proxy_logger)_redis_kwargs_from_environment)uuid)SensitiveDataMasker) AUDIT_ACTIONSLiteLLM_AuditLogsLitellmTableNamesUserAPIKeyAuth)user_api_key_auth)call_with_db_reconnect_retry)CacheConfigRepository)CACHE_SETTINGS_FIELDSREDIS_TYPE_DESCRIPTIONSCacheSettingsField) PrismaClientrouter_STORED_CACHE_SETTINGS_ADAPTERc8eZdZedeeeefzdzfdZy)_CacheConfigRowreturnNcyN)selfs /home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/management_endpoints/cache_settings_endpoints.pycache_settingsz_CacheConfigRow.cache_settings0sCF)__name__ __module__ __qualname__propertystrrobjectr*r'r+r)r#r#/s( Fgc6k&: :T AFFr+r#c^eZdZdeeefdedzfdZdeeefdeeeeeffdefdZy)_CacheConfigTablewherer$Nc Kywr&r')r(r4s r) find_uniquez_CacheConfigTable.find_unique5datac Kywr&r')r(r4r9s r)upsertz_CacheConfigTable.upsert7r7r8)r,r-r.rr0r#r6r;r'r+r)r3r34sOXwsCx'8X_t=SXs'#s("3s73PSUXPXHYCY;Zs_nsr+r3 prisma_clientrr$c,t|jSr&)rtabler<s r)_cache_config_tabler@:s  / 5 55r+>urlpasswordsentinel_password_CACHE_SENSITIVE_FIELDSc#4K|]}|jywr&) field_name).0fields r) rIHs>sTYu?O?O>ss_CACHE_SETTINGS_FIELD_NAMES_CREDENTIAL_CLASSIFIERz***REDACTED***_REDACTED_VALUE>dbhostportrBusername!_URL_OVERRIDDEN_CONNECTION_FIELDSsettingsc|jd}t|txr|jdk7}|r|jdr t |S|j Dcic]\}}|t vs||c}}Scc}}w)aReturn cache settings with the url-vs-discrete-fields ambiguity resolved. When a full ``url`` is supplied it wins: the discrete host/port/db/password/username fields are dropped so the persisted config is unambiguous and matches runtime resolution in ``litellm._redis`` (``redis.Redis.from_url`` ignores them). Cluster mode (``redis_startup_nodes``) is exempt because it authenticates via the discrete fields rather than a url. rAredis_startup_nodes)get isinstancer0stripdictitemsrQ)rRrAhas_urlkvs r)_resolve_cache_url_precedencer^Vsre$CS)?ciikR.?G hll#89H~%^^- \TQ:[1[AqD \\ \s (B9Bcache_settings_valuecxt|trtj|n|}t|tr|SiS)aNormalize a stored cache_settings blob to a dict. The prisma column comes back as either a JSON string or an already-parsed dict depending on the client, so callers that json.loads unconditionally silently drop the whole (still-encrypted) row on the dict path. )rWr0jsonloadsrY)r_parseds r)_parse_stored_settingsrdgs69CCWY\8]DJJ34cwF-6525r+storedctjDcic]\}}|tvs||}}}|s t|Si||}|j dd|Scc}}w)a#Fill connection fields from the REDIS_* environment the cache actually reads. A response cache pointed at Redis resolves host/port/password/etc. from the REDIS_* env vars when the stored config leaves them unset, so a cache configured purely through the environment works while its settings page, which reads only the database row, shows blank. Overlaying the same env kwargs the runtime uses makes the page reflect the effective connection. Stored values win; the environment only fills what the stored config omits. typeredis)rrZrJrY setdefault)rekeyvalue env_kwargs effectives r)_overlay_environmentrnrsw&D%E%K%K%M!sEQTXsQsU J F|/*//I) s AAc||jDcic]\}}||t|rtn|c}}Scc}}w)a[Replace credential-bearing values with a fixed marker, keeping the rest. The marker is unambiguous on the way back in: an admin who edits an unrelated field and re-submits sends the marker for the untouched secret, which the update path maps back to the stored value rather than persisting the marker over a working password. )rZ_is_credential_fieldrL)rRrjrks r)_redact_credentialsrqsD#..*  C !27KC7PoV[[  s 8rjc@|tvxstj|S)zJWhether a cache setting carries a credential and must be redacted on read.)rDrKis_sensitive_key)rjs r)rprps ) ) Y-C-T-TUX-YYr+rkclt|tr|jdk7xr |tk7S|dgifvS)z@Whether a payload value names a live discrete connection target.rTN)rWr0rXrLrks r)_has_connection_targetrvs8%{{}"?u'?? r2 &&r+)rNrOrArUsentinel_nodes service_name._CONNECTION_TARGET_FIELDSc|t|ttfrtj|dt St |S)aDCanonical string form of a connection-target value for equality checks. The client may serialize the same target differently from storage (a port as "6379" vs 6379, node lists round-tripped through JSON), so compare normalized forms rather than raw values to avoid treating an unchanged target as a change. T) sort_keysdefault)rWlistrYradumpsr0rus r) _target_reprrs/%$&zz%4== u:r+incomingsavedctD]q}|j|}|ddgifvr|j|}|dk(r&|ddtfvr?t|t|k7ryYt|t|k7sqyy)aWhether a stored credential may be restored for this request. A stored secret belongs to the stored connection target, so it is reused only when the request describes that same target on every dimension the stored config pins (host/port, url, cluster nodes, sentinel nodes/service). This prevents credential replay: a caller cannot omit the credential, point at a different (or incomplete) target, and have the proxy send the stored secret to a Redis of their choosing. Non-secret target fields (host/port/nodes/service) must be supplied and match in normalized form, so equivalent representations (port "6379" vs 6379) are not seen as a change while an omitted or different value is. ``url`` is the exception: it is itself the secret and the form never re-prefills it, so a redacted or omitted url means "keep the stored url" (same target) and only a different supplied url blocks reuse. NrTrAFT)ryrVrLr)rrrH saved_valueincoming_values r)_saved_secret_is_reusablers"+ ii& 4R, , !e, E>$O!<<N+|K/HH   '< +D D  r+ct|jdxs6t|jdxst|jd}t||}t|}tD]N}||vr ||t k7r|dk(r|r|j |d.||vr |r ||||<=|j |dP|S)aKeep the stored secret behind any credential the caller echoed back redacted or omitted. GET returns credentials as the marker and the form never re-prefills a secret, so a save that does not touch a credential arrives with the marker or with the field absent. Either way the real secret must survive: it is restored from the stored row, or dropped when there is no stored row (the value is env-sourced and the marker must never be persisted). Non-secret fields are taken from the incoming payload as-is, so clearing one still works. ``url`` is the exception: it is credential-bearing (redacted) yet also a connection-mode selector that url-precedence resolves against host/port. If the caller supplies a discrete target (host, cluster, or sentinel nodes), a stored url is a stale mode the caller is leaving, so it is dropped rather than restored, otherwise url-precedence would resurrect it and discard the submitted host/port. rNrUrwrAN)rvrVrrYrDrLpop)rrswitching_to_discrete_targetreuse_saved_secretmergedrHs r)_merge_over_savedrs$ x||F34 B !(,,/D"E F B !(,,/?"@ A! !:(E JNF($ H %O!C  E>: JJud #  E>0!%LF5M JJud #$ Mr+c>|siS|Dcic] }|t c}Scc}w)aJReplace every value in a settings map with a fixed marker. Cache config carries Redis credentials (passwords, connection strings). The audit-log row preserves the field names so a reader can see *which* fields changed, but values are stripped so the audit table can't itself become a credential-harvest sink. )rL)rRr\s r)_redact_settingsrs%  (0 11A  11 1scx|jry|j}|tjd|yy)uSurface a fire-and-forget audit-log task failure as a warning. ``asyncio.create_task`` swallows exceptions silently — if the audit write fails we'd otherwise lose the row without any signal. Nz,Failed to write cache-settings audit log: %s) cancelled exceptionrwarning)taskexcs r)_log_audit_task_exceptionrs9  ~~!C $$%SUXYr+actionbefore_settingsafter_settingsuser_api_key_dictlitellm_changed_bycKddlm}m}ddlm}|syt j |tttjtjtj|xs|jxs||j t"j$d|t'j(dt+|itt'j(dt+|it }|j-t.yw) amEmit an audit-log row for a /cache/settings mutation. Mirrors the ``store_audit_logs``-gated pattern used in ``team_callback_endpoints.py``: fire-and-forget, no-op when audit logging is disabled, with a done-callback that surfaces any task exception. Captured under ``LiteLLM_CacheConfig`` so the row co-locates with the table it mutates. r)create_audit_log_for_updateis_audit_logging_enabled)litellm_proxy_admin_nameN cache_configrR)r|) id updated_at changed_bychanged_by_api_key table_name object_idrupdated_values before_value) request_data)+litellm.proxy.management_helpers.audit_logsrrlitellm.proxy.proxy_serverrasyncio create_taskrr0ruuid4rnowrutcuser_idapi_keyrCACHE_CONFIG_TABLE_NAMErar~radd_done_callbackr) rrrrrrrrrs r)_emit_cache_settings_audit_logr s D # %%%#*tzz|$#<< 5-f1B1J1JfNf#4#<#<,DD(#zz:7G7W*Xbef!ZZ5Eo5V(Wade  D 45sD D ceZdZUdZdZeeefdzed<e deeefdeeefde fdZ e d dZ e d eeeffd Z y) CacheSettingsManagerz Manages cache settings initialization and updates. Tracks last cache params to avoid unnecessary reinitialization. N_last_cache_paramsparams1params2r$cdtttfdtttffd}||}||}||k(S)z Compare two cache parameter dictionaries for equality. Normalizes values and filters out UI-only fields. paramsr$ci}|jD]4\}}|dk(r |t|ttfs t |n|||<6|S)N redis_type)rZrWr}rYr0)r normalizedr\r]s r) normalizez;CacheSettingsManager._cache_params_equal..normalize[sW "J  U1 $=2tjddiS)Nrrr4)r@r6r?sr)z@CacheSettingsManager.init_cache_settings_in_db..ss!+M:FFdTbMcFdr+(init_cache_settings_in_db_lookup_failure)reasonNvariables_dictrz3Cache settings unchanged, skipping reinitialization cache_paramsz(Cache settings initialized from databaseztlitellm.proxy.management_endpoints.cache_settings_endpoints.py::CacheSettingsManager::init_cache_settings_in_db - %s)rr*rWr0r! validate_jsonrY_decrypt_db_variablesrZrrrrdebug _init_cachecopyswitch_on_llm_response_cachinginfo Exceptionr) r< proxy_configrcache_settings_jsoncache_settings_dictdecrypted_settingsr\r]res ` r)init_cache_settings_in_dbz.CacheSettingsManager.init_cache_settings_in_dbjsv + (DdA)#L 'L,G,G-9-H-H#""5s;3@@ATU12$-9,N,N^q,N,r"9K8P8P8R&h1VW[gVgq!t&h &h(::FK_KsKs(;;\L)../de((l(C;G:K:K:M$7;;=$))*TUA-H' #&'i&  * *G   seE7E EA5E  EE"A E .E7/AE ?E7E E E4E/*E7/E44E7rc6|jt_y)z Update the last cache params after initialization. Called after cache settings are updated via the API. N)rrrrs r)update_cache_paramsz(CacheSettingsManager.update_cache_paramss 3?2C2C2E/r+)r<r)r,r-r.__doc__rrYr0r1__annotations__ staticmethodboolrrrr'r+r)rrKs 48S&[)D07*T#v+%6*c6kAR*W[**,00dF$sF{*;FFr+rc|eZdZUedZeeed<edZe e e fed<edZ e e e fed<y) CacheSettingsResponsez5List of all configurable cache settings with metadata descriptionfieldsz Current values of cache settingscurrent_valuesz'Descriptions for each Redis type optionredis_type_descriptionsN) r,r-r.rrr}rrrrYr0r1rr'r+r)rrsJ',9p'qFD# $q(-:\(]NDf%].3@i.jT#s(^jr+rc4eZdZUedZeeefed<y)CacheTestRequestz&Cache settings to test connection withrr*N r,r-r.rr*rYr0r1rr'r+r)rrs(-:b(cNDf%cr+rcjeZdZUedZeed<edZeed<eddZedzed <y) CacheTestResponsez(Connection status: 'success' or 'failed'rstatuszConnection result messagemessageNz"Error message if connection failed)r|rerror) r,r-r.rrr0rrrr'r+r)rrs8$NOFCO%@AGSAd8\]E3:]r+rc4eZdZUedZeeefed<y)CacheSettingsUpdateRequestzCache settings to saverr*Nrr'r+r)rrs(-:R(SNDf%Sr+rz/cache/settingszCache Settings)tags dependenciesresponse_modelcKddlm}m} tDcgc]}|j d}}i}|Xt |j ddid{}|1|jr%|jt|j }tt|}|jd d k(r3|jd rd |d<n|jdrd|d<nd|d<t|}|D]%}|j|vs||j|_'t!||t"Scc}w7#t$$r+} t'j(d| t+dd| d} ~ wwxYww)z Get cache configuration and available settings. Returns: - fields: List of all configurable cache settings with their metadata (type, description, default, options) - current_values: Current values of cache settings from database rr<rT)deepNrrrrrgrhrUclusterrrwsentinelnode)rrrz!Error fetching cache settings: %szError fetching cache settings:  status_codedetail)rr<rr model_copyr@r6r*rrdr^rnrVrqrF field_valuerrrrrr ) rr<rrH cache_fieldsrerrmrrs r)get_cache_settingsrs G-[H]^uu//T/:^ ^%'  $!4]!C!O!OW[]kVl!O!mmL'L,G,G%;;#9,:U:U#V<99Mf9UV  == G +}}23*3 ,'/0*4 ,'*0 ,'!4I >" EE>1$253C3C$D! E%)$;  I_ nH [""#FJ6UVWUX4YZZ[sK E+D4D-&D4D2B0D4'D4,E+-D44 E(=&E##E((E+z/cache/settings/testrequestcKddlm}ddlm}m} i}|Y t |j ddid{}|1|jr%|jt|j}tt|j|}tjd t||j!d d k7r t#d d S|di|}|j$j'd{} t#di| S7#t$ri}YwxYw7"#t$r:} tj(d| t#d d| t+| cYd} ~ Sd} ~ wwxYww)z Test cache connection with provided credentials. Creates a temporary cache instance and uses its test_connection method to verify the credentials work without affecting global state. r)CacherNrrrrz*Testing cache connection with settings: %srgrhfailedz8Only Redis cache type is currently supported for testing)rrz"Error testing cache connection: %szCache connection test failed: )rrrr')litellmrrr<rr@r6r*rrdrr^rrrrqrVrcachetest_connectionrr0) rrrr<rsaved_settings existing_rowr* temp_cacheresultrs r)test_cache_connectionr sp F' -/  $ $,? ,N,Z,Zbfhvaw,Z,x&x + 0K0K%1%G%G'=l>Y>Y'Z&H&N !>>OPWPfPfhv>w x""#OQdesQtu   f % 0$R  "3N3 )..>>@@ *6**1'y  $!# $"A  ""#GK 4QC8a&   sED DD7D/AD E%D3D4DED DDDD E!/EEEEE)rrzThe litellm-changed-by header enables tracking of actions performed by authorized users on behalf of other users, providing an audit trail for accountabilityrcKddlm}m}m}|t dddi|durt ddd i t |j d d i d{}d}i}|3|jr't|j}|j| }|dnd} tt|j|} |j| } t |jd d id tj| ddtj| idd{|j| } | j!D cic]\} }| dk7s | |}} }|j#|t$j'||j)t+| || ||d{ddt-| dS7b7cc}} w7#t.$r+}t1j2d|t dd|d}~wwxYww)z Save cache settings to database and initialize cache. This endpoint: 1. Encrypts sensitive fields (passwords, etc.) 2. Saves to LiteLLM_CacheConfig table 3. Reinitializes cache with new settings r)r<rstore_model_in_dbNrrz2Database not connected. Please connect a database.rTzCSet `'STORE_MODEL_IN_DB='True'` in your env to enable this feature.rrrrupdatedcreated)environment_variables)rr*r*)createupdate)r4r9rr)rrrrrz#Cache settings updated successfullysuccess)rrrRz!Error updating cache settings: %szError updating cache settings: )rr<rrr r@r6r*rdrr^r_encrypt_env_variablesr;rar~rZrrrrrrqrrr)rrrr<rrr rr rr*encrypted_settingsrr\r]rrs r)update_cache_settingsr9s_* QR  $bc  C[%8 $F$R$RZ^`nYo$R$pp 48,.  # (C(C4\5P5PQO)???_N4@4LyR[!>>OPWPfPfhv>w x%1$G$G^l$G$m"-077()&*jj1C&D %djj1C&D 8  %1$F$FVh$F$i1C0H0H0J`1aS_N_q!t` `   l ; 00> 335 -+)/1    =+N;  sq $a  [""#FJ6UVWUX4YZZ[sr/G8 GF4CGF7)G F9F9A G F?!G3G84G7G9G G5 &G00G55G8)rzasyncio.Task[None]r$N)Wrrracollections.abcrrrtypingrrrr fastapir r r r pydanticrrrlitellm._loggingrlitellm._redisr litellm._uuidr0litellm.litellm_core_utils.sensitive_data_maskerrlitellm.proxy._typesrrrr$litellm.proxy.auth.user_api_key_authr"litellm.proxy.db.exception_handlerr'litellm.repositories.table_repositoriesr"litellm.types.management_endpointsrrrlitellm.proxy.utilsrr rrYr0r1r!r#r3r@rDset frozensetrJrKrLrQr^rdrnrqrrprvrytuplerrrrrrrrrrrrVrpostr rr'r+r)r+sk #'66==2219P CKI 0 (3Df4E(FFGhG tt 6~6:K6,Ts3xS 6?>s]r>s5sU9S>2s !4 55*)