~tjdZddlmZddlmZddlmZmZmZGddeZ e e efZ e e efZ d0d Zd1dZd2dZd3dZd4dZd5dZddddd6d"Zd#d$d%d7d*Zdd+d$d,d8d/ZdS)9z2Helpers for building sandbox proxy configurations.) annotations)Sequence)AnyLiteral TypedDictc(eZdZUdZded<ded<dS)SandboxProxySecretz7A secret value that can be used by sandbox proxy rules.z%Literal['workspace_secret', 'opaque']typestrvalueN)__name__ __module__ __qualname____doc____annotations__]/var/www/html/CA-Chatbot/venv/lib/python3.11/site-packages/langsmith/sandbox/_proxy_config.pyr r s+AA////JJJJJrr r r fieldreturnct|tr|st|d|S)Nz must be a non-empty string) isinstancer strip ValueError)r rs r_require_non_empty_stringrsJ eS ! !@@E>>>??? ;;==rvalues Sequence[str] list[str]cvt|ts|stdfd|D}|S)Nz$ must be a non-empty list of stringsc0g|]}t|Srr).0r rs r z2_require_non_empty_string_list..s$NNNe+E599NNNr)rr r)rr normalizeds ` r_require_non_empty_string_listr%sT&#IfIEGGGHHHNNNNvNNNJ rnamect|d}|d}|d}||krtd|r+|ddstd|r|nd|d}d|d S) a"Create a LangSmith workspace secret reference for a proxy configuration. Args: name: Workspace secret name, with or without surrounding braces. Returns: A proxy secret reference such as ``{"type": "workspace_secret", "value": "{AWS_ACCESS_KEY_ID}"}``. r&{}z5workspace secret must be a name or a {NAME} referencez.workspace secret reference must contain a nameworkspace_secretr r )r startswithendswithrr)r&r$startsendsr s rr,r,!s+488J  " "3 ' 'F   s # #D ~~PQQQ Kj2&,,..KIJJJ 9JJ&9:&9&9&9E& 7 77rc(dt|ddS)zProvide a write-only secret value for a proxy configuration. The value is sent when creating or updating the sandbox proxy config, but LangSmith stores it as an opaque secret and does not return it from the API. opaquer r-r!)r s r opaque_secretr46s '@'P'P Q QQrrules!Sequence[SandboxProxyRule] | Nonelist[SandboxProxyRule]c"|gSt|tst|trtdg}|D]L}t|tr|stdt |||M|S)Nz/rules must be a list of proxy rule dictionaries)rdictr r_validate_proxy_provider_ruleappend)r5r$rules r_normalize_proxy_rulesr=?s } %L*UC"8"8LJKKK)+J  $%% PT PNOO O%d+++$ rr<SandboxProxyRuleNonec|ddkrdS|d}t|trd|vrtdt |dddS)Nr gcpscopesz#gcp proxy auth rules require scopes)getrr9rr%)r<rAs rr:r:Oss xx5   ((5//C c4 @HC$7$7>???"3x=(;;;;;rN)r5no_proxyaccess_controlrDSequence[str] | NonerEdict[str, Any] | NoneSandboxProxyConfigcdt|i}|t|d|d<|6t|tst dt||d<|S)zBuild a sandbox proxy config from one or more proxy rules. Use provider-specific rule helpers such as ``aws_auth`` and ``gcp_auth`` when a sandbox needs multiple auth flows. r5NrDz#access_control must be a dictionaryrE)r=r%rr9r)r5rDrEconfigs r proxy_configrKXsq#*+A%+H+H!IF;HjQQz!.$// DBCC C#'#7#7 MrawsT)r&enabled access_key_idsecret_access_keyrMboolc6t|d}|d|||ddS)acBuild a sandbox proxy rule that signs AWS HTTPS requests. The sandbox proxy keeps the real AWS credentials outside the sandbox and signs supported AWS requests with SigV4 on the sandbox's behalf. AWS credentials must be supplied as ``workspace_secret`` or ``opaque`` values; plaintext AWS credentials are intentionally not supported. r&rL)rNrO)r&r rMrLr!)rNrOr&rM rule_names raws_authrSms;*$77I*!2    rrA)rBr&rMservice_account_jsonrBcbt|d}d|i}|t|d|d<|d||dS)a|Build a sandbox proxy rule that injects GCP OAuth bearer auth. The sandbox proxy keeps the service account JSON outside the sandbox and injects OAuth bearer tokens for built-in Google API host matching. ``service_account_json`` must be supplied as a ``workspace_secret`` or ``opaque`` value; plaintext service account JSON is intentionally not supported. r&rTNrBrA)r&r rMrA)rr%)rTrBr&rMrR gcp_configs rgcp_authrWsW*$77I 4"J=fhOO 8   r)r r rr rr )rrrr rr)r&r rr )r r rr )r5r6rr7)r<r>rr?)r5r6rDrFrErGrrH) rNr rOr r&r rMrPrr>) rTr rBrFr&r rMrPrr>)r __future__rcollections.abcrtypingrrrr r9r r>rHrr%r,r4r=r:rKrSrWrrrr[s88""""""$$$$$$**********S>#s(^ 8888*RRRR     <<<<04%),0 2 :$( r