From 2cd28b97f1793ef6032526a0119cb892dc3e9b66 Mon Sep 17 00:00:00 2001
From: AaronHowell <111272993+AaronHowell@users.noreply.github.com>
Date: Tue, 8 Sep 2026 18:02:31 +0800
Subject: [PATCH] fix(responses): align credential boundary resolution

---
 .../encrypted_content_affinity_check.py       | 26 +++++--------
 .../test_encrypted_content_affinity_check.py  | 37 ++++++++++++++++++-
 2 files changed, 45 insertions(+), 18 deletions(-)

diff --git a/litellm/router_utils/pre_call_checks/encrypted_content_affinity_check.py b/litellm/router_utils/pre_call_checks/encrypted_content_affinity_check.py
index eba2f36b675..db3c865e183 100644
--- a/litellm/router_utils/pre_call_checks/encrypted_content_affinity_check.py
+++ b/litellm/router_utils/pre_call_checks/encrypted_content_affinity_check.py
@@ -165,11 +165,9 @@ class EncryptedContentAffinityCheck(CustomLogger):
         litellm_params: object,
     ) -> tuple[object, object] | None:
         """
-        ``(api_base, api_key)`` pair identifying an Azure resource. Two
-        deployments sharing both are interchangeable for ``encrypted_content``
-        follow-ups; Azure rejects content produced by any other resource.
-        Missing values are resolved from ``litellm_credential_name`` without
-        modifying the deployment, and explicit deployment values take precedence.
+        ``(api_base, api_key)`` identifies an upstream encryption boundary.
+        The values are resolved from the deployment and its named credential
+        without modifying the deployment.
 
         Accepts any object exposing dict-style ``.get(key, default)``: plain
         dicts (the common case in ``healthy_deployments``) as well as
@@ -187,22 +185,18 @@ class EncryptedContentAffinityCheck(CustomLogger):
         credential_name: Final = getter("litellm_credential_name")
         credential_values: Final[Mapping[str, object] | None] = (
             CredentialAccessor.get_credential_values(credential_name)
-            if isinstance(credential_name, str) and credential_name and (api_base is None or api_key is None)
+            if isinstance(credential_name, str) and credential_name
             else None
         )
         effective_api_base: Final = (
-            api_base
-            if api_base is not None
-            else credential_values.get("api_base")
-            if credential_values is not None
-            else None
+            credential_values.get("api_base")
+            if credential_values is not None and "api_base" in credential_values
+            else api_base
         )
         effective_api_key: Final = (
-            api_key
-            if api_key is not None
-            else credential_values.get("api_key")
-            if credential_values is not None
-            else None
+            credential_values.get("api_key")
+            if credential_values is not None and "api_key" in credential_values
+            else api_key
         )
         if not effective_api_base or not effective_api_key:
             return None
diff --git a/tests/test_litellm/router_utils/pre_call_checks/test_encrypted_content_affinity_check.py b/tests/test_litellm/router_utils/pre_call_checks/test_encrypted_content_affinity_check.py
index 46e67983c33..7b7a4969d41 100644
--- a/tests/test_litellm/router_utils/pre_call_checks/test_encrypted_content_affinity_check.py
+++ b/tests/test_litellm/router_utils/pre_call_checks/test_encrypted_content_affinity_check.py
@@ -1174,7 +1174,7 @@ def test_boundary_key_resolves_missing_values_from_named_credential():
     assert boundary == ("https://account-a.example.com", "credential-key-a")
 
 
-def test_boundary_key_prefers_explicit_values_over_named_credential():
+def test_boundary_key_matches_named_credential_precedence():
     from litellm.router_utils.pre_call_checks.encrypted_content_affinity_check import (
         EncryptedContentAffinityCheck,
     )
@@ -1198,11 +1198,44 @@ def test_boundary_key_prefers_explicit_values_over_named_credential():
         boundary = EncryptedContentAffinityCheck._encryption_boundary_key(
             {
                 "api_base": "https://deployment.example.com",
+                "api_key": "deployment-key",
                 "litellm_credential_name": "account-a",
             }
         )
 
-    assert boundary == ("https://deployment.example.com", "credential-key-a")
+    assert boundary == ("https://credential.example.com", "credential-key-a")
+
+
+def test_boundary_key_resolves_credential_when_explicit_values_are_empty():
+    from litellm.router_utils.pre_call_checks.encrypted_content_affinity_check import (
+        EncryptedContentAffinityCheck,
+    )
+
+    with (
+        patch.object(  # test-quality-ok: credential registry is the direct dependency under test
+            litellm,
+            "credential_list",
+            [
+                CredentialItem(
+                    credential_name="account-a",
+                    credential_values={
+                        "api_base": "https://credential.example.com",
+                        "api_key": "credential-key-a",
+                    },
+                    credential_info={},
+                )
+            ],
+        )
+    ):
+        boundary = EncryptedContentAffinityCheck._encryption_boundary_key(
+            {
+                "api_base": "",
+                "api_key": "",
+                "litellm_credential_name": "account-a",
+            }
+        )
+
+    assert boundary == ("https://credential.example.com", "credential-key-a")
 
 
 def test_boundary_fallback_matches_deployments_with_same_named_credential_values():