
    hv                        d dl Z d dlZd dlZd dlmZ d dlmZmZmZmZm	Z	m
Z
mZmZmZmZ d dlZd dlmZ d dlmZ d dlmZ d dlmZmZ d dlmZ d d	lmZmZ erd d
lmZ d dl m!Z! neZ!eZ G d de      Z" G d de#      Z$ G d d      Z%y)    N)datetime)
TYPE_CHECKINGAnyDictListLiteralOptionalTupleUnioncastget_args)	BaseModel)verbose_logger)	DualCache) BEDROCK_INVOKE_PROVIDERS_LITERALBEDROCK_MAX_POLICY_SIZE)tracer)
get_secretget_secret_str)AWSPreparedRequestCredentialsc                   2    e Zd ZU eed<   eed<   ee   ed<   y)Boto3CredentialsInfocredentialsaws_region_nameaws_bedrock_runtime_endpointN)__name__
__module____qualname__r   __annotations__strr	        ]/var/www/Befach/backend/env/lib/python3.12/site-packages/litellm/llms/bedrock/base_aws_llm.pyr   r   #   s    "*3-/r$   r   c                        e Zd Z fdZ xZS )AwsAuthErrorc                     || _         || _        t        j                  dd      | _        t        j
                  || j                        | _        t        | !  | j                         y )NPOSTz0https://us-west-2.console.aws.amazon.com/bedrock)methodurl)status_coderequest)	r,   messagehttpxRequestr-   Responseresponsesuper__init__)selfr,   r.   	__class__s      r%   r4   zAwsAuthError.__init__*   sT    &}}Q
 ;ULL	
r$   )r   r   r    r4   __classcell__r6   s   @r%   r'   r'   )   s    	
 	
r$   r'   c                       e Zd Zd3 fdZdeeee   f   defdZ ej                         	 	 	 	 	 	 	 	 	 d4dee   dee   dee   dee   d	ee   d
ee   dee   dee   dee   fd       Z
dee   dee   fdZededee   fd       Zededee   fd       Z	 	 d5dedee   dee   defdZ	 d6dee   fdZ ej                         deded	edee   dee   deeee   f   fd       Z ej                         dee   dee   ded	edeeee   f   f
d       Z ej                         d
edeeee   f   fd       Z ej                         dedededeeee   f   fd       Z ej                         dededee   deeee   f   fd       Z ej                         deeee   f   fd       Z ej                         defd       Z	 d7dee   d ee   ded!eed"      deeef   f
d#Zd!eed"      dedefd$Z	 d6dedee   de fd%Z! ej                         	 d6d&eded'ee   d(ed)e"ee#f   d*ed+ee   de$fd,       Z%	 	 	 	 d8d-ed.   d*eded/ededee   d0ee&   d1ee&   d+ee   deeee#   f   fd2Z' xZ(S )9
BaseAWSLLMreturnc                 R    t               | _        t        |           g d| _        y )N)
aws_access_key_idaws_secret_access_keyaws_session_tokenr   aws_session_nameaws_profile_nameaws_role_nameaws_web_identity_tokenaws_sts_endpointr   )r   	iam_cacher3   r4   aws_authentication_params)r5   r6   s    r%   r4   zBaseAWSLLM.__init__7   s!    "*
&r$   credential_argsc                     t        j                  |d      }t        j                  |j	                               j                         S )zP
        Generate a unique cache key based on the credential arguments.
        T)	sort_keys)jsondumpshashlibsha256encode	hexdigest)r5   rG   credential_strs      r%   get_cache_keyzBaseAWSLLM.get_cache_keyG   s5    
 OtD~~n3356@@BBr$   r=   r>   r?   r   r@   rA   rB   rC   rD   c
                 |   |||||||||	g	}
t        |
      D ]  \  }}|r6|j                  d      r%t        |      }|'t        |t              s8||
|<   >|A| j
                  |   }|j                         t        j                  v sqt        j                  |j                               |
|<    |
\	  }}}}}}}}}	t        j                  d|||||||||	
       t               j                         D ci c]  \  }}|j                  d      s|| }}}| j                  |      }| j                  j!                  |      }|r|S |||| j#                  |||||	      \  }}n|I|.dt%        t'        j(                         j+                                }| j-                  ||||      \  }}nf|| j/                  |      \  }}nO|||| j1                  |||      \  }}n1|||| j3                  |||      \  }}n| j5                         \  }}| j                  j7                  |||	       |S c c}}w )
z3
        Return a boto3.Credentials object
        zos.environ/zin get credentials
aws_access_key_id=%s
aws_secret_access_key=%s
aws_session_token=%s
aws_region_name=%s
aws_session_name=%s
aws_profile_name=%s
aws_role_name=%s
aws_web_identity_token=%s
aws_sts_endpoint=%saws_)rC   rB   r@   r   rD   zlitellm-session-)r=   r>   rB   r@   )r=   r>   r?   )r=   r>   r   )ttl)	enumerate
startswithr   
isinstancer"   rF   upperosenvirongetenvr   debuglocalsitemsrQ   rE   	get_cache_auth_with_web_identity_tokenintr   now	timestamp_auth_with_aws_role_auth_with_aws_profile_auth_with_aws_session_token$_auth_with_access_key_and_secret_key_auth_with_env_vars	set_cache)r5   r=   r>   r?   r   r@   rA   rB   rC   rD   params_to_checkiparam_vkeykvargs	cache_key_cached_credentialsr   
_cache_ttls                         r%   get_credentialszBaseAWSLLM.get_credentialsO   s   $ !"
0
 "/2HAu))-8&>jS&9)+OA&44Q799;"**,)+399;)?OA& 3* 
	
!" 		" !"'	
. "(!1JAQ\\&5I1JJ&&t,	"nn66yA&& #.) ,&*&H&H'=+!1 /!1 'I '#K &'%5c(,,.:R:R:T6U5V#W &*&>&>"3&;+!1	 '? '#K )&*&A&ABR&S#K)%1!-&*&G&G"3&;"3 'H '#K )%1+&*&O&O"3&; / 'P '#K '+&>&>&@#K  KZ H Ks   5H8H8modelc                     	 t        |t              rd|vry |j                  d      }t        |      dk  ry |d   }|sy |S # t        $ r Y y w xY w)Nzarn:aws:bedrock:      )rW   r"   splitlen	Exception)r5   rv   partsregions       r%   _get_aws_region_from_model_arnz)BaseAWSLLM._get_aws_region_from_model_arn   sb    	eS)->e-K KK$E5zA~ 1XFM 		s    A A A A 	AA
model_pathc                     | j                  d      }t        |      dk\  r&|d   }|t        t              v rt	        t        |      S y)at  
        Helper function to get the provider from a model path with format: provider/model-name

        Args:
            model_path (str): The model path (e.g., 'llama/arn:aws:bedrock:us-east-1:086734376398:imported-model/r4c4kewx2s0n' or 'anthropic/model-name')

        Returns:
            Optional[str]: The provider name, or None if no valid provider found
        /   r   N)r{   r|   r   r   r   )r   r~   providers      r%   _get_provider_from_model_pathz(BaseAWSLLM._get_provider_from_model_path   sG       %u:?QxH8$DEE<hGGr$   c                 *   | j                  d      r| j                  ddd      } | j                  d      d   }|t        t              v rt        t        |      S t        j                  |       }||S d| v ryt        t              D ]
  }|| v s|c S  y)a  
        Helper function to get the bedrock provider from the model

        handles 3 scenarions:
        1. model=invoke/anthropic.claude-3-5-sonnet-20240620-v1:0 -> Returns `anthropic`
        2. model=anthropic.claude-3-5-sonnet-20240620-v1:0 -> Returns `anthropic`
        3. model=llama/arn:aws:bedrock:us-east-1:086734376398:imported-model/r4c4kewx2s0n -> Returns `llama`
        4. model=us.amazon.nova-pro-v1:0 -> Returns `nova`
        zinvoke/ r   .r   Nnova)rV   replacer{   r   r   r   r:   r   )rv   _split_modelr   s      r%   get_bedrock_invoke_providerz&BaseAWSLLM.get_bedrock_invoke_provider  s     I&MM)R3E{{3'*8$DEE8,GG ;;EBO U?$%EFu$#O G r$   optional_paramsmodel_idc                    |j                  dd      }|i|| j                  |      }n| j                  |      }t        dd      }||t        |t              r|}t        dd      }||t        |t              r|}|J	 ddl}t        j                  d      5  |j                         }ddd       j                  }	|	r|	}|S d}	 |S |S # 1 sw Y   "xY w# t        $ r d}Y |S w xY w)ar  
        Get the AWS region name from the environment variables.

        Parameters:
            optional_params (dict): Optional parameters for the model call
            model (str): The model name
            model_id (str): The model ID. This is the ARN of the model, if passed in as a separate param.

        Returns:
            str: The AWS region name
        r   NAWS_REGION_NAME
AWS_REGIONr   boto3.Session()	us-west-2)getr   r   rW   r"   boto3r   traceSessionregion_namer}   )
r5   r   rv   r   r   litellm_aws_region_namestandard_aws_region_namer   sessionconfigured_regions
             r%   _get_aws_region_namezBaseAWSLLM._get_aws_region_name'  s   " *--.?F"#"&"E"Eh"O"&"E"Ee"L&01BD&I#  '+76<"9'1,'E$',87=":".\\"34 .#mmoG.$+$7$7!$&7O 	 '2O . .  ."-.s0   C C+C C CC C'&C'c                     |Dt        dd      }|t        |t              r|}t        dd      }|t        |t              r|}|d}|S )a  
        Get the AWS region name for non-llm api calls.

        LLM API calls check the model arn and end up using that as the region name.

        For non-llm api calls eg. Guardrails, Vector Stores we just need to check the dynamic param or env vars.
        Nr   r   r   )r   rW   r"   )r5   r   r   r   s       r%   )get_aws_region_name_for_non_llm_api_callsz4BaseAWSLLM.get_aws_region_name_for_non_llm_api_callsa  sh     "&01BD&I#&2z'8 #:'1,'E$'3
(#9 #;&"-r$   c                 t   ddl }t        j                  d| d| d|        |d| d}n|}t        |      }|t	        dd	
      t        j                  d      5  |j                  d||      }	ddd       	j                  |||dd      }
|
d   d   |
d   d   |
d   d   |d}|
d   t        kD  rt        j                  d|
d           t        j                  d      5   |j                  di |}ddd       j                         }|| j                         fS # 1 sw Y   xY w# 1 sw Y   7xY w)z:
        Authenticate with AWS Web Identity Token
        r   NzIN Web Identity Token: z | Role Name: z | Session Name: zhttps://sts..amazonaws.comz6OIDC token could not be retrieved from secret manager.i  )r.   r,   boto3.client(sts)sts)r   endpoint_urli  a  {"Version":"2012-10-17","Statement":[{"Sid":"BedrockLiteLLM","Effect":"Allow","Action":["bedrock:InvokeModel","bedrock:InvokeModelWithResponseStream"],"Resource":"*","Condition":{"Bool":{"aws:SecureTransport":"true"},"StringLike":{"aws:UserAgent":"litellm/*"}}}]})RoleArnRoleSessionNameWebIdentityTokenDurationSecondsPolicyr   AccessKeyIdSecretAccessKeySessionToken)r=   r>   r?   r   PackedPolicySizezKThe policy size is greater than 75% of the allowed size, PackedPolicySize: zboto3.Session(**iam_creds_dict)r#   )r   r   r\   r   r'   r   r   clientassume_role_with_web_identityr   warningr   ru   &_get_default_ttl_for_boto3_credentials)r5   rC   rB   r@   r   rD   r   sts_endpoint
oidc_token
sts_clientsts_responseiam_creds_dictr   	iam_credss                 r%   r`   z(BaseAWSLLM._auth_with_web_identity_token  s    	%&<%=^M?Zkl|k}~	
 #)/):.IL+L 67
P 
 \\-. 	+) & J	 "??!,'  ] @ 
 ".m!<]!K%1-%@AR%S!-m!<^!L*	
 *+.EE""]^jk}^~]  A \\;< 	6#emm5n5G	6 ++-	$EEGGGC	 	:	6 	6s   D"%D."D+.D7c                 f   ddl }ddlm} t        j                  d      5  |j                  d||      }ddd       j                  ||      }|d   }	 ||	d	   |	d
   |	d         }
|	d   }t        j                  |j                        }||z
  j                         dz
  }|
|fS # 1 sw Y   sxY w)z,
        Authenticate with AWS Role
        r   Nr   r   r   )r=   r>   )r   r   r   r   r   r   
access_key
secret_keytoken
Expiration<   )r   botocore.credentialsr   r   r   r   assume_roler   rb   tzinfototal_seconds)r5   r=   r>   rB   r@   r   r   r   r   sts_credentialsr   
sts_expirycurrent_timests_ttls                 r%   rd   zBaseAWSLLM._auth_with_aws_role  s     	4\\-. 	"3&; & J	 "--!3C . 

 '}5!&}5&'89!.1
 %\2
||J$5$56,;;=BG##/	 	s   B''B0c                     ddl }t        j                  d      5  |j                  |      }|j	                         dfcddd       S # 1 sw Y   yxY w)z/
        Authenticate with AWS profile
        r   Nz,boto3.Session(profile_name=aws_profile_name))profile_namer   r   r   r   ru   )r5   rA   r   r   s       r%   re   z!BaseAWSLLM._auth_with_aws_profile  sM     	 \\HI 	2]]0@]AF))+T1	2 	2 	2   $AAc                 ,    ddl m}  ||||      }|dfS )z5
        Authenticate with AWS Session Token
        r   r   r   N)r   r   )r5   r=   r>   r?   r   r   s         r%   rf   z'BaseAWSLLM._auth_with_aws_session_token  s'     	5!(,#
 D  r$   c                     ddl }t        j                  d      5  |j                  |||      }ddd       j	                         }|| j                         fS # 1 sw Y   +xY w)zA
        Authenticate with AWS Access Key and Secret Key
        r   Nz|boto3.Session(aws_access_key_id=aws_access_key_id, aws_secret_access_key=aws_secret_access_key, region_name=aws_region_name))r=   r>   r   )r   r   r   r   ru   r   )r5   r=   r>   r   r   r   r   s          r%   rg   z/BaseAWSLLM._auth_with_access_key_and_secret_key  sr     	 \\ K
 	 mm"3&;+ $ G	 --/DGGIII	 	s   AA"c                     ddl }t        j                  d      5  |j                         }|j	                         }|dfcddd       S # 1 sw Y   yxY w)z=
        Authenticate with AWS Environment Variables
        r   Nr   r   )r5   r   r   r   s       r%   rh   zBaseAWSLLM._auth_with_env_vars$  sJ    
 	\\+, 	%mmoG!113K$	% 	% 	%r   c                      y)zj
        Get the default TTL for boto3 credentials

        Returns `3600-60` which is 59 minutes
        i  r#   )r5   s    r%   r   z1BaseAWSLLM._get_default_ttl_for_boto3_credentials0  s     r$   api_baser   endpoint_type)runtimeagentc                    t        d      }||}n=|t        |t              r|}n(|rt        |t              r|}n| j                  ||      }|rt        |t              r|}||fS |t        |t              r|}||fS |}||fS )NAWS_BEDROCK_RUNTIME_ENDPOINT)r   r   )r   rW   r"   _select_default_endpoint_url)r5   r   r   r   r    env_aws_bedrock_runtime_endpointr   proxy_endpoint_urls           r%   get_runtime_endpointzBaseAWSLLM.get_runtime_endpoint9  s     ,66T+U(#L)5*(#;
 8L-*,c3
 <L<<+ / = L ,
,c1
 "B /// *5*(#;
 "> /// ".///r$   c                 $    |dk(  rd| dS d| dS )z
        Select the default endpoint url based on the endpoint type

        Default endpoint url is https://bedrock-runtime.{aws_region_name}.amazonaws.com
        r   zhttps://bedrock-agent-runtime.r   zhttps://bedrock-runtime.r#   )r5   r   r   s      r%   r   z'BaseAWSLLM._select_default_endpoint_url_  s,     G#3O3DNSS-o->nMMr$   c                    	 ddl m} |j                  dd      }|j                  dd      }|j                  dd      }| j	                  ||      }|j                  dd       |j                  d	d      }|j                  d
d      }	|j                  dd      }
|j                  dd      }|j                  dd      }|j                  dd      }| j                  |||||	|
|||	      }t        |||      S # t        $ r t        d      w xY w)z
        Get boto3 credentials from optional params

        Args:
            optional_params (dict): Optional parameters for the model call

        Returns:
            Credentials: Boto3 credentials object
        r   r   7Missing boto3 to call bedrock. Run 'pip install boto3'.r>   Nr=   r?   r   rB   r@   rA   rC   rD   r   	r=   r>   r?   r   r@   rA   rB   rC   rD   )r   r   r   )r   r   ImportErrorpopr   ru   r   )r5   r   rv   r   r>   r=   r?   r   rB   r@   rA   rC   rD   r   r   s                  r%   *_get_boto_credentials_from_optional_paramsz5BaseAWSLLM._get_boto_credentials_from_optional_paramsl  sM   	Y8
 !0 3 34KT R+//0CTJ+//0CTJ33OUK-t4'++OTB*../A4H*../A4H!0!4!45Mt!T*../A4H'6':':*D(
$ $(#7#7/"7/+--'#9- $8 
$
 $#+)E
 	
=  	YWXX	Ys   C6 6Dr   extra_headersr   dataheadersapi_keyc                 z   ||}nt        d      }|r	 ddlm}	 d| |d<    |	d|||      }
nL	 dd	lm} ddlm}	  ||d
|      } |	d|||      }
|j                  |
       |d|v r|d   |
j                  d<   |
j                         }|S # t        $ r t        d      w xY w# t        $ r t        d      w xY w)NAWS_BEARER_TOKEN_BEDROCKr   
AWSRequestr   Bearer Authorizationr)   r*   r+   r   r   	SigV4Authbedrock)	r   botocore.awsrequestr   r   botocore.authr   add_authr   prepare)r5   r   r   r   r   r   r   r   aws_bearer_tokenr   r-   r   sigv4preppeds                 r%   get_request_headerszBaseAWSLLM.get_request_headers  s     .5-.HI:
 *11A0B'CGO$ <dGG3:
 k9oFE <dGG NN7#)o.N3@3Q0//#7  !M   !M s   B B% B"%B:service_name)r   	sagemakerrequest_datastreamfake_streamc
                 V   |	|	}
nt        d      }
|
r8|xs i }d|d<   d|
 |d<   |t        j                  |      j                         fS 	 ddlm} dd	lm} dd
lm	} |j                  dd      }|j                  dd      }|j                  dd      }|j                  dd      }|j                  dd      }|j                  dd      }|j                  dd      }|j                  dd      }| j                  ||      }| j                  |||||||||	      } ||||      }|ddi|}nddi} |d|t        j                  |      |      }|j                  |       t        |j                         }|d|v r|d   |d<   ||j"                  fS # t        $ r t        d      w xY w)z
        Sign a request for Bedrock or Sagemaker

        Returns:
            Tuple[dict, Optional[str]]: A tuple containing the headers and the json str body of the request
        Nr   zapplication/jsonzContent-Typer   r   r   r   r   r   r   r>   r=   r?   rB   r@   rA   rC   rD   )r   rv   r   r)   r   )r   rJ   rK   rN   r   r   r   r   r   r   r   r   r   ru   r   dictr   body)r5   r   r   r   r   r   rv   r   r   r   r   r   r   r   r>   r=   r?   rB   r@   rA   rC   rD   r   r   r   r-   request_headers_dicts                              r%   _sign_requestzBaseAWSLLM._sign_request  s   $ .5-.HI mG&8GN#)01A0B'CGO$DJJ|4;;===	Y/68 !0 3 34KT R+//0CTJ+//0CTJ'++OTB*../A4H*../A4H!0!4!45Mt!T*../A4H33+5 4 
 $(#7#7/"7/+--'#9- $8 
$
 +|_E%'9EWEG%'9:GL)	
 	w#GOO4Ow$>4;O4L 1#W\\11c  	YWXX	Ys   F F()r;   N)	NNNNNNNNN)NN)N)r   )NNNN))r   r   r    r4   r   r"   r	   rQ   r   wrapru   r   staticmethodr   r   r   r   r   r   r
   r   ra   r`   rd   re   rf   rg   rh   r   r   r   r   r   r   r   bytesr   r   boolr   r7   r8   s   @r%   r:   r:   6   s   
 CT#x}2D-E C# C V[[] ,0/3+/)-*.*.'+04*.J#C=J  (}J $C=	J
 "#J #3-J #3-J  }J !)J #3-J JXHSM hsm * 	2	3 & 	2	3 H  $"&	88 }8 3-	8
 
8x *.!#< V[[]?H #?H ?H 	?H
 "#?H #3-?H 
{HSM)	*?H ?HB V[[]$$#C=$$  (}$$ 	$$
 $$ 
{HSM)	*$$ $$L V[[]2 #2	{HSM)	*2 2 V[[]!!  #! 	!
 
{HSM)	*! !( V[[]JJ  #J "#	J
 
{HSM)	*J J0 V[[]	%U;+E%F 	% 	% V[[]   @I$03-$0 '/sm$0 	$0
  (: ;<$0 
sCx$0LN%g.@&ABNUXN	N =A0
#0
,4SM0
	0
d V[[] "&- - -  ~	-
 - CJ- - #- 
- -l  $!%&*!%T245T2 T2 	T2
 T2 T2 }T2 T2 d^T2 #T2 
tXe_$	%T2r$   r:   )&rL   rJ   rY   r   typingr   r   r   r   r   r	   r
   r   r   r   r/   pydanticr   litellm._loggingr   litellm.caching.cachingr   litellm.constantsr   r   %litellm.litellm_core_utils.dd_tracingr   litellm.secret_managers.mainr   r   r   r   r   r   r   r}   r'   r:   r#   r$   r%   <module>r     so      	      + - W 8 C60K09 0

9 

l2 l2r$   