scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-14 23:21:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 102

fix(responses): align credential boundary resolution

Browse source
This commit is contained in:
AaronHowell 2026-09-08 18:02:31 +08:00
parent d5cf5640b0
commit 2cd28b97f1
2 changed files with 45 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
litellm/router_utils/pre_call_checks/encrypted_content_affinity_check.py
View file

@ -165,11 +165,9 @@ class EncryptedContentAffinityCheck(CustomLogger):
litellm_params: object,
) -> tuple[object, object] | None:
"""
``(api_base, api_key)`` pair identifying an Azure resource. Two
deployments sharing both are interchangeable for ``encrypted_content``
follow-ups; Azure rejects content produced by any other resource.
Missing values are resolved from ``litellm_credential_name`` without
modifying the deployment, and explicit deployment values take precedence.
``(api_base, api_key)`` identifies an upstream encryption boundary.
The values are resolved from the deployment and its named credential
without modifying the deployment.
Accepts any object exposing dict-style ``.get(key, default)``: plain
dicts (the common case in ``healthy_deployments``) as well as
@ -187,22 +185,18 @@ class EncryptedContentAffinityCheck(CustomLogger):
credential_name: Final = getter("litellm_credential_name")
credential_values: Final[Mapping[str, object] | None] = (
CredentialAccessor.get_credential_values(credential_name)
if isinstance(credential_name, str) and credential_name and (api_base is None or api_key is None)
if isinstance(credential_name, str) and credential_name
else None
)
effective_api_base: Final = (
api_base
if api_base is not None
else credential_values.get("api_base")
if credential_values is not None
else None
credential_values.get("api_base")
if credential_values is not None and "api_base" in credential_values
else api_base
)
effective_api_key: Final = (
api_key
if api_key is not None
else credential_values.get("api_key")
if credential_values is not None
else None
credential_values.get("api_key")
if credential_values is not None and "api_key" in credential_values
else api_key
)
if not effective_api_base or not effective_api_key:
return None

37
tests/test_litellm/router_utils/pre_call_checks/test_encrypted_content_affinity_check.py
View file

@ -1174,7 +1174,7 @@ def test_boundary_key_resolves_missing_values_from_named_credential():
assert boundary == ("https://account-a.example.com", "credential-key-a")
def test_boundary_key_prefers_explicit_values_over_named_credential():
def test_boundary_key_matches_named_credential_precedence():
from litellm.router_utils.pre_call_checks.encrypted_content_affinity_check import (
EncryptedContentAffinityCheck,
)
@ -1198,11 +1198,44 @@ def test_boundary_key_prefers_explicit_values_over_named_credential():
boundary = EncryptedContentAffinityCheck._encryption_boundary_key(
{
"api_base": "https://deployment.example.com",
"api_key": "deployment-key",
"litellm_credential_name": "account-a",
}
)
assert boundary == ("https://deployment.example.com", "credential-key-a")
assert boundary == ("https://credential.example.com", "credential-key-a")
def test_boundary_key_resolves_credential_when_explicit_values_are_empty():
from litellm.router_utils.pre_call_checks.encrypted_content_affinity_check import (
EncryptedContentAffinityCheck,
)
with (
patch.object( # test-quality-ok: credential registry is the direct dependency under test
litellm,
"credential_list",
[
CredentialItem(
credential_name="account-a",
credential_values={
"api_base": "https://credential.example.com",
"api_key": "credential-key-a",
},
credential_info={},
)
],
)
):
boundary = EncryptedContentAffinityCheck._encryption_boundary_key(
{
"api_base": "",
"api_key": "",
"litellm_credential_name": "account-a",
}
)
assert boundary == ("https://credential.example.com", "credential-key-a")
def test_boundary_fallback_matches_deployments_with_same_named_credential_values():