From 792523122041191f420bc98155e42637387da387 Mon Sep 17 00:00:00 2001 From: yucheng Date: Thu, 8 Oct 2026 02:46:35 +0000 Subject: [PATCH] fix(proxy): keep the config save rewrite on the proxy server decrypt helper Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- litellm/proxy/common_utils/encrypt_decrypt_utils.py | 6 ------ litellm/proxy/proxy_server.py | 7 +++++-- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/litellm/proxy/common_utils/encrypt_decrypt_utils.py b/litellm/proxy/common_utils/encrypt_decrypt_utils.py index 211479110a8..b960730d0c5 100644 --- a/litellm/proxy/common_utils/encrypt_decrypt_utils.py +++ b/litellm/proxy/common_utils/encrypt_decrypt_utils.py @@ -278,12 +278,6 @@ def legacy_unreadable(value: object) -> bool: return needs_legacy_reader(value) and not legacy_encryption_available() -def decrypt_for_rewrite(value: str, key: str) -> str | None: - if legacy_unreadable(value): - return value - return decrypt_value_helper(value=value, key=key, return_original_value=True) - - def require_legacy_reader_for(values: Iterable[object], purpose: str) -> None: """Refuse a decrypt-then-rewrite pass when PyNaCl is missing and one of the values is unprefixed: it would read as unreadable and be dropped, double wrapped or miscounted as plaintext. Versioned gcm and non string diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py index 29592c34a97..5b592fc2eb5 100644 --- a/litellm/proxy/proxy_server.py +++ b/litellm/proxy/proxy_server.py @@ -425,9 +425,9 @@ from litellm.proxy.common_utils.debug_utils import init_verbose_loggers from litellm.proxy.common_utils.debug_utils import router as debugging_endpoints_router from litellm.proxy.common_utils.discoverable_model_filter import discoverable_rows, undiscoverable_model_names from litellm.proxy.common_utils.encrypt_decrypt_utils import ( - decrypt_for_rewrite, decrypt_value_helper, encrypt_value_helper, + legacy_unreadable, ) from litellm.proxy.common_utils.error_body_call_id import JSON_OBJECT, error_body_call_id, with_call_id from litellm.proxy.common_utils.fips import ( @@ -7857,7 +7857,10 @@ class ProxyConfig: _decrypt_and_set_db_env_variables): this is a write path, and loading values into os.environ is the read path's responsibility. """ - decrypted_env_vars: Final = {k: decrypt_for_rewrite(value=v, key=k) for k, v in environment_variables.items()} + decrypted_env_vars: Final = { + k: v if legacy_unreadable(v) else decrypt_value_helper(value=v, key=k, return_original_value=True) + for k, v in environment_variables.items() + } return self.encrypt_env_variables( environment_variables=decrypted_env_vars, new_encryption_key=new_encryption_key,