From c79be9f080b29ea4239c3518bddf347023c95736 Mon Sep 17 00:00:00 2001 From: AlSh007 <85677626+AlSh007@users.noreply.github.com> Date: Sun, 18 Oct 2026 05:29:50 +0530 Subject: [PATCH] fix(secrets): return default_value when a secret is missing get_secret only used default_value when reading raised, so a missing secret returned None. Apply it where the environment and secret-manager paths find nothing. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: AlSh007 <85677626+AlSh007@users.noreply.github.com> --- litellm/secret_managers/main.py | 4 ++- tests/unit/secret_managers/test_main.py | 37 +++++++++++++++++++++++++ 2 files changed, 40 insertions(+), 1 deletion(-) diff --git a/litellm/secret_managers/main.py b/litellm/secret_managers/main.py index 716407d6def..6f20401edca 100644 --- a/litellm/secret_managers/main.py +++ b/litellm/secret_managers/main.py @@ -358,13 +358,15 @@ def get_secret( return secret except Exception: return secret + # The secret is not set: `default_value` is what the caller asked for in that case. + return default_value else: secret = os.environ.get(secret_name) secret_value_as_bool = str_to_bool(secret) if secret is not None else None if secret_value_as_bool is not None and isinstance(secret_value_as_bool, bool): return secret_value_as_bool else: - return secret + return secret if secret is not None else default_value except Exception as e: if default_value is not None: return default_value diff --git a/tests/unit/secret_managers/test_main.py b/tests/unit/secret_managers/test_main.py index c3226d2bef6..733a9499ffd 100644 --- a/tests/unit/secret_managers/test_main.py +++ b/tests/unit/secret_managers/test_main.py @@ -106,6 +106,43 @@ def test_oidc_env_path(): del os.environ[env_var_name] +def test_get_secret_returns_default_value_when_the_secret_is_missing(monkeypatch): + from litellm.secret_managers.main import get_secret_bool, get_secret_str + + monkeypatch.delenv("LITELLM_TEST_MISSING_SECRET", raising=False) + monkeypatch.setattr(litellm, "_key_management_system", None) + + assert get_secret("LITELLM_TEST_MISSING_SECRET", default_value="dflt") == "dflt" + assert get_secret_str("LITELLM_TEST_MISSING_SECRET", default_value="dflt") == "dflt" + assert get_secret_bool("LITELLM_TEST_MISSING_SECRET", default_value=True) is True + assert get_secret_bool("LITELLM_TEST_MISSING_SECRET", default_value=False) is False + # Without a default the missing secret is still None. + assert get_secret("LITELLM_TEST_MISSING_SECRET") is None + + +def test_get_secret_prefers_a_set_value_over_default_value(monkeypatch): + from litellm.secret_managers.main import get_secret_bool + + monkeypatch.setattr(litellm, "_key_management_system", None) + monkeypatch.setenv("LITELLM_TEST_SET_SECRET", "real") + monkeypatch.setenv("LITELLM_TEST_EMPTY_SECRET", "") + monkeypatch.setenv("LITELLM_TEST_FALSE_SECRET", "false") + + assert get_secret("LITELLM_TEST_SET_SECRET", default_value="dflt") == "real" + # An empty string is a value that was set, so it is not replaced by the default. + assert get_secret("LITELLM_TEST_EMPTY_SECRET", default_value="dflt") == "" + assert get_secret_bool("LITELLM_TEST_FALSE_SECRET", default_value=True) is False + + +def test_get_secret_returns_default_value_when_the_secret_manager_has_no_secret(monkeypatch): + monkeypatch.delenv("LITELLM_TEST_MISSING_SECRET", raising=False) + monkeypatch.setattr(litellm, "_key_management_system", KeyManagementSystem.GOOGLE_KMS) + + with patch("litellm.secret_managers.main.get_secret_from_manager", return_value=None): + assert get_secret("LITELLM_TEST_MISSING_SECRET", default_value="dflt") == "dflt" + assert get_secret("LITELLM_TEST_MISSING_SECRET") is None + + def test_should_read_secret_from_secret_manager(): """ Test that _should_read_secret_from_secret_manager returns correct values based on access mode