uPjA4ddlZddlZddlmZmZddlmZddlZddlZddl Z ddl m Z ddl m Z ddlmZmZmZddlmZdd lmZmZdd lmZGd d eZy) N)AnyFinal)quote)verbose_logger) InMemoryCache)_get_httpx_clientget_async_httpx_clienthttpxSpecialProvider)KeyManagementSystem)BaseSecretManagerraise_if_unsafe_secret_name) str_to_boolceZdZdZdefdZdefdZdeddfdZdedefdZ dded edzd e e jzdzdedzfd Z dded edzd e e jzdzdedzfd Z dded ededzd edzd e e jzdzdeezdzdeeeffdZ ddededzd edzd e e jzdzdef dZy)CyberArkSecretManagercTddlm}m}tjdd|_tjdd|_tjdd|_tjd d |_tjd d |_ tjd d |_ ttjd }||nd|_ |js#|jr |js td|t_t j"t_t'tj(j+dd}t-||_|dur"td|j0j2|jst5j6dyy)Nr)CommonProxyErrors premium_userCYBERARK_API_BASEzhttp://127.0.0.1:8080CYBERARK_ACCOUNTdefaultCYBERARK_USERNAMEadminCYBERARK_API_KEYCYBERARK_CLIENT_CERTCYBERARK_CLIENT_KEYCYBERARK_SSL_VERIFYTzMissing CyberArk credentials. Please set CYBERARK_API_KEY or both CYBERARK_CLIENT_CERT and CYBERARK_CLIENT_KEY in your environment.CYBERARK_REFRESH_INTERVAL300) default_ttlz=CyberArk secret manager is only available for premium users. zzCyberArk SSL verification is disabled. This is insecure and should only be used for testing with self-signed certificates.)litellm.proxy.proxy_serverrrosgetenv conjur_addrconjur_accountconjur_usernameconjur_api_key tls_cert_path tls_key_pathr ssl_verify ValueErrorlitellmsecret_manager_clientr CYBERARK_key_management_systemintenvirongetrcachenot_premium_uservaluerwarning)selfrrssl_verify_env_refresh_intervals t/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/secret_managers/cyberark_secret_manager.py__init__zCyberArkSecretManager.__init__sgN99%8:QR ii(:IF!yy),>4CTCTV )-%)<)E)E&$'rzz~~6QSX'Y#Z"/@A t #OPaPrPrPxPxOyz   " "M returncV|jjd}||Stjd|jd|j d|j d} |jra|jrUtj|j|jf|j}|j||j}n?td |ji }|jj||j}|j!|j"}t%j&|j)j+}tjd |jj-d| |S#t.$r}t1d |d}~wwxYw)z Authenticate with CyberArk Conjur and get a session token. The token is a JSON object that must be base64-encoded for use in subsequent requests. Returns: str: Base64-encoded session token cyberark_auth_tokenNz&Authenticating with CyberArk Conjur...z/authn//z /authenticate)certverify)contentr+paramsz0Successfully authenticated with CyberArk Conjur.)keyr6z+Could not authenticate to CyberArk Conjur: )r4 get_cacherdebugr%r&r'r)r*httpxClientr+postr(rclientraise_for_statustextbase64 b64encodeencodedecode set_cache Exception RuntimeError) r8 cached_tokenauth_url http_clientresp http_handler token_json token_b64es r; _authenticatez#CyberArkSecretManager._authenticateAs#jj223HI  # EF!--.gd6I6I5J!DL`L`Kaano R!!d&7&7%*\\,,d.?.?@??& #''$:M:M'N'8 doo?^&_ #**//$BUBU/V  ! ! #!% J%// 0A0A0CDKKMI  !S T JJ %:) L  R!LQCPQ Q RsD,F F(F##F(c2|j}dd|diS)z Get headers for CyberArk API requests including authentication. Returns: dict: Headers with authentication token Authorizationz Token token="")r_)r8tokens r;_get_request_headersz*CyberArkSecretManager._get_request_headersns&))+=q!9::r= secret_nameNct||jd|jd}tj|dj }d|d} t d|ji}|jj|i|jd d i| }|jtjd |y#tj$r}}|j j"d vrtjd|nDtj$d|j j"|j j&Yd}~yYd}~yd}~wt($r }tj$d|Yd}~yd}~wwxYw)z Ensure a variable exists in CyberArk Conjur by creating a policy entry if needed. Args: secret_name: Name of the variable to ensure exists z /policies/z /policy/rootrb) default_stylez - !variable  r+rEz Content-Typezapplication/x-yaml)headersrDz%Created policy entry for variable: %s)iiz8Variable %s already exists or policy conflict (expected)z)Could not ensure variable exists: %s - %sNz"Error ensuring variable exists: %s)rr%r&yaml safe_dumpstriprr+rMrLrdrNrrIrJHTTPStatusErrorresponse status_coder7rOrU)r8re policy_url quoted_name policy_yamlrMrZr^s r;_ensure_variable_existsz-CyberArkSecretManager._ensure_variable_existsxs_ $K0#//0 4;N;N:O|\ !^^KsKQQS +K=;  L-lDOO5TUF --,,//1"$8$ -D  ! ! #  !H+ V$$ zz%%3$$%_alm&&?AWAWYZYcYcYhYhn  L  " "#G K K Ls&A0CE<A.E E<E77E<cXt|d}|jd|jd|S)z Build the URL for accessing a secret in CyberArk Conjur. Args: secret_name: Name of the secret (will be URL-encoded) Returns: str: Full URL for the secret r)safez /secrets/z /variable/)rr%r&)r8re encoded_names r;get_urlzCyberArkSecretManager.get_urls5$Kb9 ""#9T-@-@,AL>ZZr=optional_paramstimeoutcK|jj||jj|Sttjd|j i} |j |}|j||jd{}|j|j}|jj|||S7>#tj$rP}|jjdk(rt!j"d|nt!j$d|Yd}~yd}~wt&$r }t!j$d|Yd}~yd}~wwxYww)a_ Reads a secret from CyberArk Conjur using an async HTTPX client. Args: secret_name: Name/path of the secret to read optional_params: Additional parameters (not used for Conjur) timeout: Request timeout Returns: Optional[str]: The secret value if found, None otherwise Nr+ llm_providerrFri&Secret %s not found in CyberArk Conjur-Error reading secret from CyberArk Conjur: %s)r4rHr r SecretManagerr+rwr3rdrNrOrTrJrmrnrorrI exceptionrU) r8rerxry async_clienturlrn secret_valuer^s r;async_read_secretz'CyberArkSecretManager.async_read_secrets)$ ::   , 8::'' 4 44-;; $//2  k2C$0$4$4S$B[B[B]$4$^^H  % % '#+--L JJ l ;  _$$ zz%%,$$%M{[(()XZ[\   $ $%TVW X sUAE$!5CC=CE$CE!*AD50E$5 E!EE$E!!E$c|jj||jj|Std|ji} |j |}|j j ||j}|j|j}|jj|||S#tj$rP}|jjdk(rtj d|ntj"d|Yd}~yd}~wt$$r }tj"d|Yd}~yd}~wwxYw)a] Reads a secret from CyberArk Conjur using a sync HTTPX client. Args: secret_name: Name/path of the secret to read optional_params: Additional parameters (not used for Conjur) timeout: Request timeout Returns: Optional[str]: The secret value if found, None otherwise Nr+rEr}r~rr)r4rHrr+rwrMr3rdrNrOrTrJrmrnrorrIrrU) r8rerxry sync_clientrrnrr^s r;sync_read_secretz&CyberArkSecretManager.sync_read_secrets$ ::   , 8::'' 4 4.|T__6UV  k2C)0044S$B[B[B]4^H  % % '#+--L JJ l ; $$ zz%%,$$%M{[(()XZ[\   $ $%TVW X s&A5CEAD$$ E0E  Er descriptiontagscKttjd|ji} |j ||j |}|j ||j|d{} | j|jj||dd|ddS79#t$r.} tjd | d t| dcYd} ~ Sd} ~ wwxYww) a Writes a secret to CyberArk Conjur using an async HTTPX client. Args: secret_name: Name/path of the secret to write secret_value: Value to store description: Optional description (not used by Conjur) optional_params: Additional parameters timeout: Request timeout tags: Optional tags (not used by Conjur) Returns: dict: Response containing status and details of the operation r+r{)rrirDNsuccesszSecret z written successfullystatusmessagez+Error writing secret to CyberArk Conjur: %serror)r r rr+rsrwrLrdrNr4rTrUrrstr) r8rerrrxryrrrrnr^s r;async_write_secretz(CyberArkSecretManager.async_write_secrets.5-;; $//2  :  ( ( 5k2C)..3@Y@Y@[eq.rrH  % % ' JJ l ;$$[M1FG  s :  $ $%RTU V%#a&9 9 :sG(C(AB.2B,38B.+C(,B.. C%7#C C%C( C%%C(recovery_window_in_daysctKtjd|jj|dddSw)a CyberArk Conjur does not support direct secret deletion via API. Secrets can only be removed through policy updates. Args: secret_name: Name of the secret recovery_window_in_days: Not used optional_params: Additional parameters timeout: Request timeout Returns: dict: Response indicating operation not supported zhCyberArk Conjur does not support direct secret deletion. Secrets must be removed through policy updates. not_supportedz`CyberArk Conjur does not support direct secret deletion. Use policy updates to remove variables.r)rr7r4 delete_cache)r8rerrxrys r;async_delete_secretz)CyberArkSecretManager.async_delete_secret5s?(  v  ,&y  s68)NN)NNNN)NN)__name__ __module__ __qualname__r<rr_dictrdrsrwfloatrJTimeoutrrlistrrr1rr=r;rrs'R+Rs+RZ;d;$L3$L4$LL [3 [3 ["(,04 ,,,&- , t ,b(,04 )))&- ) t )^#''+04#'.:.:.:4Z .:  .: &- .:TkD .: c3h.:f/0'+04   "%t   &-    r=r)rPr#typingrr urllib.parserrJrjr-litellm._loggingrlitellm.cachingr&litellm.llms.custom_httpx.http_handlerrr r litellm.proxy._typesr base_secret_managerr rmainrrrr=r;rsD  +) 5O| -| r=