From 7df138e7e1cb0663958d49614937038ae9f0c11b Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sun, 22 Feb 2026 03:35:37 +0000 Subject: [PATCH] fix(policy-endpoints): validate version status + avoid double auth Co-authored-by: Krish Dholakia --- .../proxy/policy_engine/policy_endpoints.py | 35 ++++++++++--------- .../policy_engine/policy_resolve_endpoints.py | 2 -- .../proxy/policy_engine/resolver_types.py | 4 +-- 3 files changed, 21 insertions(+), 20 deletions(-) diff --git a/litellm/proxy/policy_engine/policy_endpoints.py b/litellm/proxy/policy_engine/policy_endpoints.py index d8de028d6a0..91a195dc3d7 100644 --- a/litellm/proxy/policy_engine/policy_endpoints.py +++ b/litellm/proxy/policy_engine/policy_endpoints.py @@ -4,24 +4,31 @@ CRUD ENDPOINTS FOR POLICIES Provides REST API endpoints for managing policies and policy attachments. """ -from typing import Optional +from typing import Literal, Optional from fastapi import APIRouter, Depends, HTTPException from litellm._logging import verbose_proxy_logger from litellm.proxy._types import UserAPIKeyAuth from litellm.proxy.auth.user_api_key_auth import user_api_key_auth -from litellm.proxy.policy_engine.attachment_registry import \ - get_attachment_registry +from litellm.proxy.policy_engine.attachment_registry import get_attachment_registry from litellm.proxy.policy_engine.pipeline_executor import PipelineExecutor from litellm.proxy.policy_engine.policy_registry import get_policy_registry from litellm.types.proxy.policy_engine import ( - GuardrailPipeline, PipelineTestRequest, PolicyAttachmentCreateRequest, - PolicyAttachmentDBResponse, PolicyAttachmentListResponse, - PolicyCreateRequest, PolicyDBResponse, PolicyListDBResponse, - PolicyUpdateRequest, PolicyVersionCompareResponse, - PolicyVersionCreateRequest, PolicyVersionListResponse, - PolicyVersionStatusUpdateRequest) + GuardrailPipeline, + PipelineTestRequest, + PolicyAttachmentCreateRequest, + PolicyAttachmentDBResponse, + PolicyAttachmentListResponse, + PolicyCreateRequest, + PolicyDBResponse, + PolicyListDBResponse, + PolicyUpdateRequest, + PolicyVersionCompareResponse, + PolicyVersionCreateRequest, + PolicyVersionListResponse, + PolicyVersionStatusUpdateRequest, +) router = APIRouter() @@ -37,7 +44,9 @@ router = APIRouter() dependencies=[Depends(user_api_key_auth)], response_model=PolicyListDBResponse, ) -async def list_policies(version_status: Optional[str] = None): +async def list_policies( + version_status: Optional[Literal["draft", "published", "production"]] = None, +): """ List all policies from the database. Optionally filter by version_status. @@ -93,7 +102,6 @@ async def list_policies(version_status: Optional[str] = None): @router.post( "/policies", tags=["Policies"], - dependencies=[Depends(user_api_key_auth)], response_model=PolicyDBResponse, ) async def create_policy( @@ -187,7 +195,6 @@ async def list_policy_versions(policy_name: str): @router.post( "/policies/name/{policy_name}/versions", tags=["Policies"], - dependencies=[Depends(user_api_key_auth)], response_model=PolicyDBResponse, ) async def create_policy_version( @@ -222,7 +229,6 @@ async def create_policy_version( @router.put( "/policies/{policy_id}/status", tags=["Policies"], - dependencies=[Depends(user_api_key_auth)], response_model=PolicyDBResponse, ) async def update_policy_version_status( @@ -361,7 +367,6 @@ async def get_policy(policy_id: str): @router.put( "/policies/{policy_id}", tags=["Policies"], - dependencies=[Depends(user_api_key_auth)], response_model=PolicyDBResponse, ) async def update_policy( @@ -541,7 +546,6 @@ async def get_resolved_guardrails(policy_id: str): @router.post( "/policies/test-pipeline", tags=["Policies"], - dependencies=[Depends(user_api_key_auth)], ) async def test_pipeline( request: PipelineTestRequest, @@ -656,7 +660,6 @@ async def list_policy_attachments(): @router.post( "/policies/attachments", tags=["Policies"], - dependencies=[Depends(user_api_key_auth)], response_model=PolicyAttachmentDBResponse, ) async def create_policy_attachment( diff --git a/litellm/proxy/policy_engine/policy_resolve_endpoints.py b/litellm/proxy/policy_engine/policy_resolve_endpoints.py index 318e990ff12..5d80b3045a3 100644 --- a/litellm/proxy/policy_engine/policy_resolve_endpoints.py +++ b/litellm/proxy/policy_engine/policy_resolve_endpoints.py @@ -202,7 +202,6 @@ async def _find_affected_keys_by_alias( @router.post( "/policies/resolve", tags=["Policies"], - dependencies=[Depends(user_api_key_auth)], response_model=PolicyResolveResponse, ) async def resolve_policies_for_context( @@ -310,7 +309,6 @@ async def resolve_policies_for_context( @router.post( "/policies/attachments/estimate-impact", tags=["Policies"], - dependencies=[Depends(user_api_key_auth)], response_model=AttachmentImpactResponse, ) async def estimate_attachment_impact( diff --git a/litellm/types/proxy/policy_engine/resolver_types.py b/litellm/types/proxy/policy_engine/resolver_types.py index 2df450dc2ba..759c08ab813 100644 --- a/litellm/types/proxy/policy_engine/resolver_types.py +++ b/litellm/types/proxy/policy_engine/resolver_types.py @@ -6,7 +6,7 @@ the final guardrails list. """ from datetime import datetime -from typing import Any, Dict, List, Optional +from typing import Any, Dict, List, Literal, Optional from pydantic import BaseModel, ConfigDict, Field @@ -267,7 +267,7 @@ class PolicyVersionCreateRequest(BaseModel): class PolicyVersionStatusUpdateRequest(BaseModel): """Request body for updating a policy version's status.""" - version_status: str = Field( + version_status: Literal["published", "production"] = Field( description="New status: 'published' or 'production'.", )