From 16b1e6e7f67fb29063ca80bd037f612b57c00a53 Mon Sep 17 00:00:00 2001 From: Yucheng Zhu Date: Tue, 18 Aug 2026 13:35:52 -0700 Subject: [PATCH] docs(team_callback_endpoints): correct prose that still described masking on read --- litellm/proxy/management_endpoints/team_callback_endpoints.py | 2 +- .../management_endpoints/test_team_callback_endpoints.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/litellm/proxy/management_endpoints/team_callback_endpoints.py b/litellm/proxy/management_endpoints/team_callback_endpoints.py index f04422925a5..e10ab25afbb 100644 --- a/litellm/proxy/management_endpoints/team_callback_endpoints.py +++ b/litellm/proxy/management_endpoints/team_callback_endpoints.py @@ -125,7 +125,7 @@ def _resolve_team_callbacks(team_metadata: object) -> TeamCallbackMetadata: entry as active for a team whose requests never fire it. Credential ``callback_vars`` are stored encrypted, so they are decrypted - before being masked by key; a value encrypted under a key that is no longer + before being dropped by key; a value encrypted under a key that is no longer classified as sensitive would otherwise come back as raw ciphertext. """ if not isinstance(team_metadata, dict): diff --git a/tests/test_litellm/proxy/management_endpoints/test_team_callback_endpoints.py b/tests/test_litellm/proxy/management_endpoints/test_team_callback_endpoints.py index cc669c080d4..2192006571b 100644 --- a/tests/test_litellm/proxy/management_endpoints/test_team_callback_endpoints.py +++ b/tests/test_litellm/proxy/management_endpoints/test_team_callback_endpoints.py @@ -687,14 +687,14 @@ async def test_get_team_callbacks_decrypts_vars_stored_under_non_sensitive_keys( """Stored ciphertext must be decrypted, not handed back raw. Which keys count as sensitive is a moving classification, so a value can be - encrypted at rest under a key that later stops being masked on read. Without + encrypted at rest under a key that later stops being dropped on read. Without the decrypt step that value comes back as an unusable litellm_enc:: blob. """ from litellm.proxy.common_utils.callback_utils import _CALLBACK_VAR_ENCRYPTED_PREFIX, is_sensitive_callback_key from litellm.proxy.common_utils.encrypt_decrypt_utils import encrypt_value_helper monkeypatch.setenv("LITELLM_SALT_KEY", "test-salt-32-bytes-aaaaaaaaaaaaaa") - assert not is_sensitive_callback_key("langsmith_project"), "test needs a key that is not masked on read" + assert not is_sensitive_callback_key("langsmith_project"), "test needs a key that is not dropped on read" metadata = { "logging": [