
    ^hfl                        S r SSKrSSKrSSKrSSKJrJrJr  SSKJ	r	J
r
JrJrJr  SSKJr  SSKrSSKJr  SSKJr  SSKJrJrJrJrJrJr  SS	KJr  SS
KJr  SSK J!r!J"r"J#r#  SSK$J%r%  SSK&J'r'J(r(  SSK)J*r*  \(       a  SSK+J,r,  OSSKJ-r,  \	" 5       r.\.R_                  SS/SS9S\4S j5       r0\.R_                  SS/SS9S\4S j5       r1 S S\\,   S\\   S\24S jjr3\.R_                  SS/S\
" \5      /S9S\4S j5       r4g)!z
Has all /sso/* routes

/sso/key/generate - handles user signing in with SSO and redirects to /sso/callback
/sso/callback - returns JWT Redirect Response that redirects to LiteLLM UI
    N)TYPE_CHECKINGListOptional)	APIRouterDependsHTTPExceptionRequeststatus)RedirectResponse)verbose_proxy_logger)MAX_SPENDLOG_ROWS_TO_QUERY)LitellmUserRolesNewUserRequestProxyErrorTypesProxyExceptionSSOUserDefinedValuesUserAPIKeyAuth)_has_user_setup_sso)user_api_key_auth)admin_ui_disabled	html_formshow_missing_vars_in_env)new_user)check_is_admin_only_accesshas_admin_ui_access)str_to_bool)OpenID)Anyz/sso/key/generateexperimentalF)tagsinclude_in_schemarequestc                 f	  #    SSK Jn  [        R                  " SS5      n[        R                  " SS5      n[        R                  " SS5      n[        R                  " S5      nUb  [	        US9nU(       a
  [        5       $ Uc  Uc  Ub-  US	La(  [        S
[        R                  S[        R                  S9e[        5       nUb  U$ [        R                  " S[        U R                  5      5      n[        R                  " S5      n	UR                  S5      (       a  US-  nOUS-  nUb  SSKJn
  [        R                  " SS5      nUc(  [        S[        R                  S[        R"                  S9eU
" UUUS9n[$        R&                  " SU SU 35        U   UR)                  5       I Sh  vN sSSS5        $ Ub  SSKJn  [        R                  " SS5      n[        R                  " SS5      nUc(  [        S[        R                  S[        R"                  S9eU" UUUUS	S9nU   UR)                  5       I Sh  vN sSSS5        $ UGb  SSKJn  SSKJn  [        R                  " SS5      n[        R                  " S S!5      R7                  S"5      n[        R                  " S#S5      n[        R                  " S$S5      n[        R                  " S%S5      nUc(  [        S&[        R                  S[        R"                  S9eUc(  [        S'[        R                  S#[        R"                  S9eUc(  [        S([        R                  S$[        R"                  S9eUc(  [        S)[        R                  S%[        R"                  S9e[$        R8                  " S*U S+U S,U 35        [$        R8                  " S-U S.U S/35        U" UUUS09nU" S1US29nU" UUUS	US39nU   0 n[        R                  " S4S5      nU(       a  UUS5'   O(S6U;   a"  [:        R<                  " 5       R>                  US5'   UR(                  " S:0 UD6I Sh  vN sSSS5        $ U	b  SS7K J!n  U" [D        S8S99$ SS7K J!n  U" [D        S8S99$  GN! , (       d  f       g= f GNN! , (       d  f       g= f NZ! , (       d  f       g= f7f);z
Create Proxy API Keys using Google Workspace SSO. Requires setting PROXY_BASE_URL in .env
PROXY_BASE_URL should be the your deployed proxy endpoint, e.g. PROXY_BASE_URL="https://litellm-production-7002.up.railway.app/"
Example:
r   )premium_userMICROSOFT_CLIENT_IDNGOOGLE_CLIENT_IDGENERIC_CLIENT_IDDISABLE_ADMIN_UI)valueTa}  You must be a LiteLLM Enterprise user to use SSO. If you have a license please set `LITELLM_LICENSE` in your env. If you want to obtain a license meet with us here: https://calendly.com/d/4mp-gd3-k5k/litellm-1-1-onboarding-chat You are seeing this error message because You set one of `MICROSOFT_CLIENT_ID`, `GOOGLE_CLIENT_ID`, or `GENERIC_CLIENT_ID` in your env. Please unset thisr$   messagetypeparamcodePROXY_BASE_URLUI_USERNAME/sso/callback/sso/callback	GoogleSSOGOOGLE_CLIENT_SECRET1GOOGLE_CLIENT_SECRET not set. Set it in .env file)	client_idclient_secretredirect_uriz5In /google-login/key/generate, 
GOOGLE_REDIRECT_URI: z
GOOGLE_CLIENT_ID: MicrosoftSSOMICROSOFT_CLIENT_SECRETMICROSOFT_TENANT4MICROSOFT_CLIENT_SECRET not set. Set it in .env filer8   r9   tenantr:   allow_insecure_http)DiscoveryDocumentcreate_providerGENERIC_CLIENT_SECRETGENERIC_SCOPEopenid email profile GENERIC_AUTHORIZATION_ENDPOINTGENERIC_TOKEN_ENDPOINTGENERIC_USERINFO_ENDPOINT2GENERIC_CLIENT_SECRET not set. Set it in .env file;GENERIC_AUTHORIZATION_ENDPOINT not set. Set it in .env file3GENERIC_TOKEN_ENDPOINT not set. Set it in .env file6GENERIC_USERINFO_ENDPOINT not set. Set it in .env fileauthorization_endpoint: 
token_endpoint: 
userinfo_endpoint: GENERIC_REDIRECT_URI: 
GENERIC_CLIENT_ID: 
authorization_endpointtoken_endpointuserinfo_endpointoidc)namediscovery_documentr8   r9   r:   rB   scopeGENERIC_CLIENT_STATEstateokta)HTMLResponse   )contentstatus_code )#litellm.proxy.proxy_serverr$   osgetenvr   r   r   r   
auth_errorr
   HTTP_403_FORBIDDENr   strbase_urlendswithfastapi_sso.sso.googler5   HTTP_500_INTERNAL_SERVER_ERRORr   infoget_login_redirectfastapi_sso.sso.microsoftr<   fastapi_sso.sso.baserC   fastapi_sso.sso.genericrE   splitdebuguuiduuid4hexfastapi.responsesrc   r   )r"   r$   microsoft_client_idgoogle_client_idgeneric_client_id_disable_ui_flagis_disabledmissing_env_varsredirect_urlui_usernamer5   google_client_secret
google_ssor<   microsoft_client_secretmicrosoft_tenantmicrosoft_ssorC   rE   generic_client_secretgeneric_scopegeneric_authorization_endpointgeneric_token_endpointgeneric_userinfo_endpoint	discoverySSOProvidergeneric_ssoredirect_paramsra   rc   s                                 c/home/james-whalen/.local/lib/python3.13/site-packages/litellm/proxy/management_endpoints/ui_sso.pygoogle_loginr   1   s     8))$94@yy!3T:		"5t< yy!34#!(89$&& 	''(t#  X$//$..	  01# 99-s73C3C/DEL))M*KS!!&'#4!yy)?F' K$//,::	  &.%


 	!!D\NRfgwfxy	
 #6688 Z 
	(:"$)),Et"L99%7>"* N$///::	  %)1#% $
 &99;; ]		&:; "		*A4 H		/3IJPPQTU)+,d*
& "$+CT!J$&II.I4$P! ( L$//-::	  *1 U$//6::	  ") M$//.::	  %, P$//1::	  	""&'E&FFXYoXp  qF  G`  Fa  b	
 	""$\N2GHYGZZ\]	
 &#A17
	
 &6iP!'/% $
 
 !OII4d;E+0(99JJL$$  ( %77J/JJ [ 
	  	3I3??2I3??S 9 Z. < ]T K [s   FR1Q9,Q6-Q90A8R1(R<R
=R FR1A$R RR /R16Q99
RR1
R
RR1R  
R.*R1r3   c                 P  ^7^8^9^:^;^<^=#    SSK Jn  SSKJnJnJnJnJnJn  [        R                  " SS5      n[        R                  " SS5      n	[        R                  " SS5      n
Uc(  [        S[        R                  S	[        R                  S
9e[        R                  " S[!        U R"                  5      5      nUR%                  S5      (       a  US-  nOUS-  nSnU	bk  SSKJn  [        R                  " SS5      nUc(  [        S[        R                  S[        R                  S
9eU" U	UUS9nUR+                  U 5      I Sh  vN nGOUb  SSKJn  [        R                  " SS5      n[        R                  " SS5      nUc(  [        S[        R                  S[        R                  S
9eUc(  [        S[        R                  S[        R                  S
9eU" UUUUSS9nUR+                  U 5      I Sh  vN nGOU
Gb  SSKJnJm7  SSKJn  [        R                  " SS5      n[        R                  " SS5      R;                  S5      n[        R                  " S S5      n[        R                  " S!S5      n[        R                  " S"S5      n[        R                  " S#S$5      R=                  5       S%:H  nUc(  [        S&[        R                  S[        R                  S
9eUc(  [        S'[        R                  S [        R                  S
9eUc(  [        S([        R                  S![        R                  S
9eUc(  [        S)[        R                  S"[        R                  S
9e[>        R@                  " S*U S+U S,U 35        [>        R@                  " S-U S.U
 S/35        [        R                  " S0S15      m<[        R                  " S2S35      m9[        R                  " S4S55      m:[        R                  " S6S75      n[        R                  " S8S95      m;[        R                  " S:S;5      m=[        R                  " S<S=5      m8[>        R@                  " S>T< S?T: S@U 35        U" UUUSA9nU7U8U9U:U;U<U=4SB jnU" SCUUSD9nU" U
UUSUSE9n [>        R@                  " SF5        U R+                  U SGU0SH9I Sh  vN n[>        R@                  " SIU5        [C        US5S5      n!Ub  [C        USJS5      OSn"U!br  [        R                  " SK5      b[  U!R;                  SL5      SM   n#[        R                  " SK5      R;                  SN5      n$U#U$;  a  [E        SOSPSQRG                  U#U$5      0SR9eU
b*  Ub'  [C        USJS5      n"[C        US5S5      n![C        UWS5      n%U"c4  Ub1  [C        US9SS5      =(       d    SSn&[C        US;SS5      =(       d    SSn'U&U'-   n"U!b  U"b  [I        U"5      S:X  a  U!n"Sn(/ n)[J        RL                  n*[J        RN                  n+STSU0 0 SSVSW.n,Sn-Ub7  [P        RR                  " U5      (       a  U" U5      I Sh  vN n-O[U        SX5      eU"b  [W        U)U"U!U*SU+SY9n-U"n.Sn% UGb  URY                  U"SZS[9I Sh  vN n([>        R@                  " S\U( S][J        RZ                   35        U(c-  UR\                  R^                  Ra                  S^U!0S_9I Sh  vN n(U(b  U"b  [W        [C        U(S`U)5      U"[C        U(S^U!5      [C        U(SaS5      [C        U(SbU*5      [C        U(ScU+5      Sd9n-[C        U(SaS5      n%UR\                  R^                  Rc                  S^U!0SeU"0Sf9I Sh  vN   O[e        UU-Sg9I Sh  vN n%U-c  [g        Sh5      e[>        Rh                  " SiU- 35        U,Rk                  U-5        SjU,Sk'   U" S0 U,DSlSj0D6I Sh  vN n/U/Sm   n0U/Se   n"U"U.:X  d   eSnn1U%=(       d    [l        Rn                  Rp                  n%[        R                  " SoS5      b1  [        Rr                  So   U":X  a  [l        Rt                  Rp                  n%[>        R@                  " SpU% SqU 35        [w        U5      n2U2(       a$  [y        U%5      n3U3(       d  [E        SOSrSsU% StU 30SR9eSSK=n4U4R}                  U"U0U!U%SuUUR                  SvSw5      Sx.USySz9n5U"b  [        U"[         5      (       a  U1S{U"-   -  n1[        U1S|S}9n6U6R                  SmU5SS~9  U6$  GN GN GNN GN GN GN< GN GN! [f         a     GNf = f GNj7f)zVerify loginr   )generate_key_helper_fn)general_settings
master_keyr$   prisma_clientui_access_modeuser_custom_ssor%   Nr&   r'   zMaster Key not set for Proxy. Please set Master Key to use Admin UI. Set `LITELLM_MASTER_KEY` in .env or set general_settings:master_key in config.yaml.  https://docs.litellm.ai/docs/proxy/virtual_keys. If set, use `--detailed_debug` to debug issue.r   r*   r/   r1   r2   r3   r4   r6   r7   )r8   r:   r9   r;   r=   r>   r?   z-MICROSOFT_TENANT not set. Set it in .env fileTr@   )rC   r   rD   rF   rG   rH   rI   rJ   rK   rL   GENERIC_INCLUDE_CLIENT_IDfalsetruerM   rN   rO   rP   rQ   rR   rS   rT   rU   rV   GENERIC_USER_ID_ATTRIBUTEpreferred_username#GENERIC_USER_DISPLAY_NAME_ATTRIBUTEsubGENERIC_USER_EMAIL_ATTRIBUTEemailGENERIC_USER_ROLE_ATTRIBUTErole!GENERIC_USER_FIRST_NAME_ATTRIBUTE
first_name GENERIC_USER_LAST_NAME_ATTRIBUTE	last_nameGENERIC_USER_PROVIDER_ATTRIBUTEproviderz! generic_user_id_attribute_name: z%
 generic_user_email_attribute_name: z$
 generic_user_role_attribute_name: rW   c           
         > T" U R                  T5      U R                  T5      U R                  T5      U R                  T5      U R                  T5      U R                  T5      S9$ )N)iddisplay_namer   r   r   r   )get)	responseclientr   generic_provider_attribute_name(generic_user_display_name_attribute_name!generic_user_email_attribute_name&generic_user_first_name_attribute_namegeneric_user_id_attribute_name%generic_user_last_name_attribute_names	     r   response_convertor)auth_callback.<locals>.response_convertor  s^    << >?%\\*RSll#DE#<<(NO",,'LM!&EF     r[   )r\   r]   r   r^   z&calling generic_sso.verify_and_processinclude_client_id)paramszgeneric result: %sr   ALLOWED_EMAIL_DOMAINS@   ,i  r+   zZThe email domain={}, is not an allowed email domain={}. Contact your admin to change this.)rf   detail 24hrg{Gz?zlitellm-dashboard)durationkey_max_budgetaliasesconfigspendteam_idz,user_custom_sso must be a coroutine function)modelsuser_id
user_email
max_budget	user_rolebudget_durationuser)r   
table_namezuser_info: z(; litellm.default_internal_user_params: r   )wherer   r   r   r   )r   r   r   r   r   r   r   )r   data)result_openiduser_defined_valueszUnable to map user identity to known values. 'user_defined_values' is None. File an issue - https://github.com/BerriAI/litellm/issuesz)user_defined_values for creating ui key: keyrequest_typer   tokenz/ui/PROXY_ADMIN_IDzuser_role: z; ui_access_mode: errorz,User not allowed to access proxy. User role=z, proxy mode=ssolitellm_key_header_nameAuthorization)r   r   r   r   login_methodr$   auth_header_nameHS256)	algorithmz?userID=i/  )urlrf   )r   r)   securerg   )C;litellm.proxy.management_endpoints.key_management_endpointsr   rh   r   r   r$   r   r   r   ri   rj   r   r   rk   r
   rq   rm   rn   ro   rp   r5   verify_and_processrt   r<   ru   rC   r   rv   rE   rw   lowerr   rx   getattrr   formatlenlitellmmax_internal_user_budgetinternal_user_budget_durationasyncioiscoroutinefunction
ValueErrorr   get_datadefault_internal_user_paramsdblitellm_usertable
find_firstupdate_manyinsert_sso_user	Exceptionrr   updater   INTERNAL_USER_VIEW_ONLYr)   environPROXY_ADMINr   r   jwtencoder   
isinstancer   
set_cookie)>r"   r   r   r   r$   r   r   r   r}   r~   r   r   resultr5   r   r   r<   r   r   r   rC   rE   r   r   r   r   r   generic_include_client_id generic_user_role_attribute_namer   r   r   r   r   r   email_domainallowed_domainsr   _first_name
_last_name	user_infouser_id_modelsr   r   default_ui_key_valuesr   _user_id_from_ssor   r   litellm_dashboard_uiis_admin_only_access
has_accessr   	jwt_tokenredirect_responser   r   r   r   r   r   r   s>                                                          @@@@@@@r   auth_callbackr     s^
      ))$94@yy!3T:		"5t< P ++66	
 	
 99-s73C3C/DELS!!&'F#4!yy)?F' K$//,::	  &%.


 "44W==		(:"$)),Et"L99%7>"* N$///::	  # G$//(::	  %)1#% $
 %77@@		&B; "		*A4 H		/3IJPPQTU)+,d*
& "$+CT!J$&II.I4$P!II17;AACvM 	" !( L$//-::	  *1 U$//6::	  ") M$//.::	  %, P$//1::	  	""&'E&FFXYoXp  qF  G`  Fa  b	
 	""$\N2GHYGZZ\]	
 *,')=*
& 4699154
0 -/II*G-
) ,.99)6,
( 24/2
. 13		.1
- +-))-z+
' 	""/0N/OOu  wX  vY  Y~  _  ~`  a	
 &#A17
		 	 &(1

 "'/% $
 	""#KL"5502KL 6 
 
 	""#7@ !( >J<B<NWVT48TXG")),C"D"P!'',Q/))$;<BB3G.{   C   C$o   $);&$-VWd3
F$DdK	6-flB7=2V["5;

*7?c'la6GIN&??$+$I$I!
 & ;?"&&77(7(?"?KLL		2!!/9
  I'$+44WQW4XXI &&i[(PQXQuQuPvw  "/"2"2"D"D"O"O'4 #P # 	 $)<&:"9hG#&y,
K%idC&!<1I  %,!#46S%'# $I{DA	 $&&88DD'4Iw;O E   
 #2"((;# 	 " T
 	
 
34G3HI   !45,1.)+ 
 H
 7
Cy!G ''''!K-EEKKI
		"D)5JJ'(G3 %0066	
i[ 2>2BC 6nE(3
KI;Vcdrcst  

$"!( 0 4 4)?!
	
 	  I z'377
W 44(-AsS  WId Kq	 >6 AV
n #@" Y*
  s   D;d&c:B1d&6c=7J;d&2d 3Fd&5d6%d&d 3d4Ad d	Bd dd d&d (d)d -Ad&9d#:Ed&=d& d&d&d 	d d d 
d d&d  d&r   r   returnc                   #    [         R                  " SU 35        Uc  [        S5      e[        R                  (       a  UR                  [        R                  5        UR                  S5      [        R                  R                  :X  aJ  UR                  S5      c  [        R                  US'   UR                  S5      c  [        R                  US'   US   c  [        R                  US'   [        US   US   US   US   US   S	9nU (       a  S
U R                  0Ul        [!        U[#        5       S9I Sh  vN   US   =(       d    [        R                  $  N 7f)a!  
Helper function to create a New User in LiteLLM DB after a successful SSO login

Args:
    result_openid (OpenID): User information in OpenID format if the login was successful.
    user_defined_values (Optional[SSOUserDefinedValues], optional): LiteLLM SSOValues / fields that were read
z)Inserting SSO user into DB. User values: Nzuser_defined_values is Noner   r   r   r   r   )r   r   r   r   r   auth_provider)r   user_api_key_dict)r   rx   r   r   r   r   r   r   INTERNAL_USERr)   r   r   r   r   r   metadatar   r   )r   r   new_user_requests      r   r   r   L  sX     
34G3HI "677++""7#G#GH {+/?/M/M/S/SS""<08070P0P-""#45=55   12 ;'/+;+S+SK(%#I.&|4%k2&|4+,=> %4m6L6L$M!
(N<L
MMM{+W/?/W/WW Ns   D7E9E:!Ez/sso/get/ui_settings)r    r!   dependenciesc                   #    SSK JnJn  [        R                  " SS 5      n[        R                  " SS 5      n[        5       nUR                  S5      [        :  nUR                  SS5      nS[        R                  ;   a'  [        R                  S   R                  5       S	:X  a  S
nUUUUUR                  S5      US.$ 7f)Nr   )r   proxy_stater/   PROXY_LOGOUT_URLspend_logs_row_countdefault_team_disabledFPROXY_DEFAULT_TEAM_DISABLEDr   T)r/   r  DEFAULT_TEAM_DISABLEDSSO_ENABLEDNUM_SPEND_LOGS_ROWSDISABLE_EXPENSIVE_DB_QUERIES)rh   r   r  ri   rj   r   get_proxy_state_variabler   r   r   r   )r"   r   r  _proxy_base_url_logout_url_is_sso_enableddisable_expensive_db_queriesr  s           r   get_ui_settingsr)  }  s      Iii 0$7O)).5K)+O,,-CD
$	% ! -001H%P$

2::34::<F$(! *'!6&*CC" 
 )E	 	s   B>C )N)5__doc__r   ri   ry   typingr   r   r   fastapir   r   r   r	   r
   r|   r   r   litellm._loggingr   litellm.constantsr   litellm.proxy._typesr   r   r   r   r   r   litellm.proxy.auth.auth_utilsr   $litellm.proxy.auth.user_api_key_authr   )litellm.proxy.common_utils.admin_ui_utilsr   r   r   :litellm.proxy.management_endpoints.internal_user_endpointsr   3litellm.proxy.management_endpoints.sso_helper_utilsr   r   litellm.secret_managers.mainr   ru   r   r   routerr   r   r  rm   r   r)  rg   r   r   <module>r7     sF    	  0 0 F F .  1 8  > B 
 P 5+$	 ~&6%Pk@ k@ Qk@\ O>"2eLh h MhZ ;?.XF#.X!"67.X 	.Xb 
	+,-	  7 r   