diff --git a/Makefile b/Makefile index b265ae5a009..5ae2638fbaa 100644 --- a/Makefile +++ b/Makefile @@ -144,11 +144,13 @@ lint-install: $(UV) sync --inexact --frozen --group proxy-dev --group e2e-dev $(UV_RUN) python scripts/prisma_generate_if_needed.py -# Diff-scoped format check, identical to test-linting.yml's "Check ruff format" step: +# Diff-scoped format check, mirroring test-linting.yml's "Check ruff format" step: # only the litellm Python files changed vs the base are checked, so a pre-existing -# format issue elsewhere doesn't block an unrelated commit. +# format issue elsewhere doesn't block an unrelated commit. Git pathspecs match +# recursively, so 'litellm/*.py' covers nested modules and the top-level files that +# CI's 'litellm/**/*.py' skips, which makes this target a superset of the CI step. lint-format-check-changed: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE) - @files=$$(git diff --name-only origin/litellm_internal_staging...HEAD -- 'litellm/**/*.py' | grep -v '^litellm/enterprise/' || true); \ + @files=$$(git diff --name-only --diff-filter=ACMR origin/litellm_internal_staging...HEAD -- 'litellm/*.py' | grep -v '^litellm/enterprise/' || true); \ if [ -z "$$files" ]; then \ echo "No changed litellm Python files to format-check."; \ else \ diff --git a/cookbook/litellm_proxy_server/cli_token_usage.py b/cookbook/litellm_proxy_server/cli_token_usage.py index 6306970cdde..e6b3744019c 100644 --- a/cookbook/litellm_proxy_server/cli_token_usage.py +++ b/cookbook/litellm_proxy_server/cli_token_usage.py @@ -60,4 +60,4 @@ if __name__ == "__main__": print("\n💡 Tips:") print("1. Run 'litellm-proxy login' to authenticate first") print("2. Replace 'https://your-proxy.com' with your actual proxy URL") - print("3. The token is stored locally at ~/.litellm/token.json") + print("3. The token is stored in your OS keychain, or in ~/.litellm/token.json when there is none") diff --git a/litellm/litellm_core_utils/cli_keyring.py b/litellm/litellm_core_utils/cli_keyring.py new file mode 100644 index 00000000000..70b1773739d --- /dev/null +++ b/litellm/litellm_core_utils/cli_keyring.py @@ -0,0 +1,231 @@ +""" +CLI Keyring Access + +SDK-level access to the OS keychain (macOS Keychain, Windows Credential Manager, +Linux Secret Service) that holds the credential minted by `lite login`. + +The `keyring` package is optional and imported lazily, so importing this module +never pulls it in. Every failure is returned as a value, naming which of the +ways the keychain can be out of reach applies, so callers can degrade to the +token file and tell the user what to do about it. + +A write is only reported as stored once it has been read back, because keyring's +null backend, which `keyring --disable` and headless CI images both select, +accepts every write and keeps nothing. Writes are also pre-flighted with a +throwaway value, because a keychain can answer neither way and block forever. +""" + +import os +import threading +from contextlib import suppress +from dataclasses import dataclass, field +from typing import Final, Protocol, TypeAlias + +KEYRING_SERVICE: Final = "litellm-cli" +KEYRING_ACCOUNT: Final = "credential" +KEYRING_PREFLIGHT_ACCOUNT: Final = "credential-preflight" +DISABLE_KEYRING_ENV_VAR: Final = "LITELLM_CLI_DISABLE_KEYRING" + +_DISABLED_VALUES: Final = frozenset(("1", "true", "yes", "on")) +_PREFLIGHT_VALUE: Final = "preflight" +_PREFLIGHT_TIMEOUT_SECONDS: Final = 5.0 + + +@dataclass(frozen=True, slots=True) +class SecretFound: + blob: str + + +@dataclass(frozen=True, slots=True) +class SecretMissing: + pass + + +@dataclass(frozen=True, slots=True) +class SecretStored: + pass + + +@dataclass(frozen=True, slots=True) +class SecretErased: + pass + + +@dataclass(frozen=True, slots=True) +class SecretStranded: + pass + + +@dataclass(frozen=True, slots=True) +class KeyringNotInstalled: + pass + + +@dataclass(frozen=True, slots=True) +class KeyringDisabled: + pass + + +@dataclass(frozen=True, slots=True) +class KeyringUnreachable: + pass + + +@dataclass(frozen=True, slots=True) +class KeyringDiscardsWrites: + pass + + +KeyringUnusable: TypeAlias = KeyringNotInstalled | KeyringDisabled | KeyringUnreachable +SecretRead: TypeAlias = SecretFound | SecretMissing | KeyringUnusable +SecretWrite: TypeAlias = SecretStored | KeyringUnusable | KeyringDiscardsWrites +SecretErase: TypeAlias = SecretErased | SecretStranded | KeyringUnusable + + +class SecretVault(Protocol): + """The single slot holding the CLI credential's secret material.""" + + def read(self) -> SecretRead: ... + + def write(self, blob: str) -> SecretWrite: ... + + def erase(self) -> SecretErase: ... + + +class KeyringApi(Protocol): + def get_password(self, service_name: str, username: str) -> str | None: ... + + def set_password(self, service_name: str, username: str, password: str) -> None: ... + + def delete_password(self, service_name: str, username: str) -> None: ... + + +def _keyring_disabled() -> bool: + return os.getenv(DISABLE_KEYRING_ENV_VAR, "").strip().lower() in _DISABLED_VALUES + + +def _import_keyring() -> KeyringApi | None: + try: + import keyring + except ImportError: + return None + return keyring + + +def _keyring_api() -> KeyringApi | KeyringNotInstalled | KeyringDisabled: + if _keyring_disabled(): + return KeyringDisabled() + api: Final = _import_keyring() + return KeyringNotInstalled() if api is None else api + + +def _answers_a_write(api: KeyringApi, timeout_seconds: float) -> bool: + """Whether the keychain answers a write at all, asked with a value worth nothing. + + macOS derives the login keychain from `$HOME`, and `set_password` against a HOME with no usable + one blocks forever with no timeout of its own. Containers, CI images, `sudo -H`, and service + accounts all run there, and reads answer normally, so nothing cheaper tells them apart. Asking + with a throwaway value keeps a keychain that never answers from taking `lite login` down with + it, and keeps the real credential out of a store that might accept it long after we gave up. + A keychain that refuses the probe outright still answered it, so only silence counts against it. + """ + answered: Final = threading.Event() + + def ask() -> None: + with suppress(Exception): + api.set_password(KEYRING_SERVICE, KEYRING_PREFLIGHT_ACCOUNT, _PREFLIGHT_VALUE) + answered.set() + + threading.Thread(target=ask, daemon=True, name="litellm-cli-keyring-preflight").start() + return answered.wait(timeout_seconds) + + +def _forget_the_preflight(api: KeyringApi) -> None: + """Take the throwaway probe back out. + + A backend that kept nothing has nothing to remove, and the probe is worth nothing either way, + so a keychain that refuses to give it up costs the caller nothing. + """ + with suppress(Exception): + api.delete_password(KEYRING_SERVICE, KEYRING_PREFLIGHT_ACCOUNT) + + +@dataclass(frozen=True, slots=True) +class KeyringVault: + """The OS keychain, reached through the optional `keyring` package. + + A keychain that let the pre-flight time out is not asked anything else for the rest of the + process. The probe that timed out is still sitting in the keychain on a thread of its own, and + it holds the keychain against every later call, so the read after it would block on the main + thread with no timeout to save it. One silence is answer enough. + """ + + preflight_timeout_seconds: float = _PREFLIGHT_TIMEOUT_SECONDS + stopped_answering: threading.Event = field(default_factory=threading.Event, compare=False, repr=False) + + def read(self) -> SecretRead: + if self.stopped_answering.is_set(): + return KeyringUnreachable() + api: Final = _keyring_api() + if isinstance(api, (KeyringNotInstalled, KeyringDisabled)): + return api + try: + blob: Final = api.get_password(KEYRING_SERVICE, KEYRING_ACCOUNT) + except Exception: # noqa: BLE001 # backends raise outside keyring.errors; never break the SDK + return KeyringUnreachable() + return SecretMissing() if blob is None else SecretFound(blob) + + def write(self, blob: str) -> SecretWrite: + """Store the secret, reporting stored only once the keychain hands the same bytes back. + + A backend that accepts writes and keeps nothing, which is exactly what `keyring --disable` + and `PYTHON_KEYRING_BACKEND=keyring.backends.null.Keyring` select, raises nothing to + distinguish itself. Reading the value back is the only way to tell it apart from a keychain + that really stored the credential, and the caller is about to drop its own copy on our word. + + The keychain is pre-flighted first, because one that blocks rather than answering would + otherwise hang `lite login` outright. + """ + if self.stopped_answering.is_set(): + return KeyringUnreachable() + api: Final = _keyring_api() + if isinstance(api, (KeyringNotInstalled, KeyringDisabled)): + return api + if not _answers_a_write(api, self.preflight_timeout_seconds): + self.stopped_answering.set() + return KeyringUnreachable() + _forget_the_preflight(api) + try: + api.set_password(KEYRING_SERVICE, KEYRING_ACCOUNT, blob) + except Exception: # noqa: BLE001 # a keychain that refuses the write falls back to the token file + return KeyringUnreachable() + return SecretStored() if self.read() == SecretFound(blob) else KeyringDiscardsWrites() + + def erase(self) -> SecretErase: + """Remove our entry, reporting whether the keychain is guaranteed to be free of it. + + A keychain out of reach is never an erasure: the entry belongs to the OS, not to this + install, so it outlives an uninstalled `keyring` package and a kill switch set after login. + Those cases are reported apart from a confirmed entry that would not delete, because only + the caller knows whether this machine ever put a secret in a keychain. + """ + match self.read(): + case KeyringNotInstalled() | KeyringDisabled() | KeyringUnreachable() as unusable: + return unusable + case SecretMissing(): + return SecretErased() + case SecretFound(): + return self._delete() + + def _delete(self) -> SecretErase: + api: Final = _keyring_api() + if isinstance(api, (KeyringNotInstalled, KeyringDisabled)): + return api + try: + api.delete_password(KEYRING_SERVICE, KEYRING_ACCOUNT) + except Exception: # noqa: BLE001 # report the failure as a value so `lite logout` can warn + return SecretStranded() + return SecretErased() + + +SYSTEM_KEYRING: Final[SecretVault] = KeyringVault() diff --git a/litellm/litellm_core_utils/cli_token_utils.py b/litellm/litellm_core_utils/cli_token_utils.py index 50694ae615f..b45513c5ea3 100644 --- a/litellm/litellm_core_utils/cli_token_utils.py +++ b/litellm/litellm_core_utils/cli_token_utils.py @@ -1,16 +1,125 @@ """ CLI Token Utilities -SDK-level utilities for reading CLI authentication tokens. +SDK-level utilities for reading the credential minted by `lite login`. + +Non-secret metadata lives in ~/.litellm/token.json. The secret material (the +bearer key, plus a JWT when one is issued) lives in the OS keychain when the +machine has one, and in that same 0600 file otherwise. This module hides the +split from callers, and migrates a legacy plaintext file into the keychain the +first time it reads one. + This module has no dependencies on proxy code and can be safely imported at the SDK level. """ -import json -import os +import math import time from collections.abc import Mapping +from dataclasses import dataclass from pathlib import Path -from typing import Final +from types import MappingProxyType +from typing import Final, TypeAlias + +from pydantic import BaseModel, ConfigDict, ValidationError + +from litellm.litellm_core_utils.cli_keyring import ( + SYSTEM_KEYRING, + KeyringDisabled, + KeyringNotInstalled, + KeyringUnreachable, + SecretErase, + SecretErased, + SecretFound, + SecretMissing, + SecretStored, + SecretStranded, + SecretVault, + SecretWrite, +) +from litellm.litellm_core_utils.private_json import ( + commit_staged_json, + discard_staged_json, + ensure_private_dir, + overwrite_private_json, + stage_private_json, + write_private_json, +) + + +@dataclass(frozen=True, slots=True) +class CredentialNotSaved: + """The credential was minted but no store would keep it, so this machine has none. + + Nothing was touched on the way to this, so a login that already worked still does. + """ + + detail: str + + +@dataclass(frozen=True, slots=True) +class CredentialNotRecorded: + """The keychain took the credential, but the file that names it could not be replaced. + + The keychain holds one entry, so the secret that was there is already gone and no rollback + brings it back. Removing the new one as well would only turn a login this machine may still + be able to use into no login at all, so it stays, and the user is told what is where. + """ + + +@dataclass(frozen=True, slots=True) +class CredentialNotCleared: + """The token file still holds the secret, because it could not be removed or rewritten. + + Logging out of the keychain is only half of it. A `~/.litellm` that refuses both the scrubbed + rewrite and the removal leaves the credential readable on disk, which is the one thing a logout + is for, so it is reported instead of being counted as a clean sweep. + """ + + detail: str + + +SecretSave: TypeAlias = SecretWrite | CredentialNotSaved | CredentialNotRecorded + +SecretClear: TypeAlias = SecretErase | CredentialNotCleared + + +class CliTokenRecord(BaseModel): + """A stored CLI credential. + + `key is None` means the metadata was found but the secret could not be + produced: the keychain holds nothing for us, or we could not reach it. + """ + + model_config = ConfigDict(frozen=True, extra="allow") + + base_url: str = "" + key: str | None = None + user_id: str = "" + user_email: str = "" + user_role: str = "" + auth_header_name: str = "Authorization" + jwt_token: str = "" + timestamp: float = 0.0 + expires_at: float | None = None + refresh_token: str | None = None + + +class CliTokenSecret(BaseModel): + """The secret material as stored in the OS keychain. + + `base_url` is duplicated from the metadata file purely as a pairing tag: a + secret minted for one server is never handed to another, even if the + metadata file is edited underneath us. `timestamp` is the sign-in this + secret came from, which is what decides it against a secret still on disk. + """ + + model_config = ConfigDict(frozen=True) + + base_url: str + key: str + jwt_token: str = "" + timestamp: float = 0.0 + CLI_TOKEN_FRESHNESS_BUFFER_SECONDS: Final = 360 @@ -22,26 +131,183 @@ def get_cli_token_file_path() -> str: return str(config_dir / "token.json") -def load_cli_token() -> dict | None: - """Load CLI token data from file""" - token_file: Final = get_cli_token_file_path() - if not os.path.exists(token_file): +def load_cli_token(*, vault: SecretVault = SYSTEM_KEYRING) -> CliTokenRecord | None: + """Load the stored CLI credential, or None when this machine has none""" + record: Final = _read_token_file() + if record is None: return None + return _resolve_secret(record, vault) + +def save_cli_token(record: CliTokenRecord, *, vault: SecretVault = SYSTEM_KEYRING) -> SecretSave: + """Store a freshly minted credential. Reports where its secret material ended up, and why. + + The token file is what makes a keychain-backed credential findable again, and it is also the + half that a read-only or full directory refuses, so it is staged before the keychain is handed + anything. A save that cannot land then leaves both stores exactly as it found them, which + matters most when the login it failed to replace is still perfectly good. + + Staging can still succeed and the replacement fail afterwards. That is the one case where the + keychain has already taken the new secret, and it reports itself as such rather than claiming + the previous login survived. + """ + stamped: Final = _stamped_past_every_stored_login(record, vault) + staged: Final = _stage_token_file(_without_secret(stamped)) + if isinstance(staged, CredentialNotSaved): + return staged + outcome: Final = SecretStored() if stamped.key is None else vault.write(_encode_secret(stamped, stamped.key)) + if isinstance(outcome, SecretStored): + return outcome if _commit_token_file(staged) else CredentialNotRecorded() + discard_staged_json(staged) + return _keep_the_secret_in_the_file(stamped, outcome) + + +def _stamped_past_every_stored_login(record: CliTokenRecord, vault: SecretVault) -> CliTokenRecord: + """Keep a sign-in's stamp ahead of every login already stored, whatever the clock did in between. + + The stamp is what decides a keychain secret against one still on disk, so a clock that stepped + backwards between two logins would hand the older of them the win and put a superseded + credential back in use. Pinning the new stamp just past the highest one either store holds costs + one read each and changes nothing on a clock that only moves forwards. + """ + highest: Final = _highest_stamp_already_stored(record.base_url, vault) + if highest < record.timestamp: + return record + return record.model_copy(update=MappingProxyType({"timestamp": math.nextafter(highest, math.inf)})) + + +def _highest_stamp_already_stored(base_url: str, vault: SecretVault) -> float: + """When the latest login either store still holds was made, or minus infinity when neither has one. + + Both are asked because the file names the login being replaced only while the two agree. A login + the keychain took but the file could not record afterwards leaves the keychain holding the later + of the two, and reading only the file would stamp the next sign-in below it. + """ + previous: Final = _read_token_file() + secret: Final = _stored_secret(base_url, vault) + return max( + -math.inf if previous is None else previous.timestamp, + -math.inf if secret is None else secret.timestamp, + ) + + +def _stored_secret(base_url: str, vault: SecretVault) -> CliTokenSecret | None: + """The keychain's secret for this server, when it holds one this login may be compared against""" + match vault.read(): + case SecretFound(blob=blob): + return _decode_secret(blob, base_url) + case SecretMissing() | KeyringNotInstalled() | KeyringDisabled() | KeyringUnreachable(): + return None + + +def _keep_the_secret_in_the_file(record: CliTokenRecord, outcome: SecretWrite) -> SecretSave: + """Fall back to the owner-only file, which is all that is left when no keychain took the secret""" try: - with open(token_file, "r") as f: - return json.load(f) - except (OSError, json.JSONDecodeError): - return None + _write_token_file(record) + except OSError as error: + return CredentialNotSaved(str(error)) + return outcome + + +def clear_cli_token(*, vault: SecretVault = SYSTEM_KEYRING) -> SecretClear: + """Remove the credential from both stores. Reports whether the keychain is now free of it. + + A logout the keychain never answered keeps the token file, with its secret taken out, because + that file is the only remaining record that something may still be in there to remove. It is + what lets a later run tell a machine with a credential it cannot reach apart from one that never + had a login at all, and taking it away would leave the next logout answering the warning this + one just issued with a false all-clear. The secret goes either way, and a file that will give up + neither its copy nor itself is removed rather than kept, with the note written again afterwards + so the warning still outlives this run. + """ + outcome: Final = vault.erase() + record: Final = _read_token_file() + settled: Final = _nothing_left_behind(outcome, record) + if not settled and _keep_the_unchecked_keychain_on_record(outcome, record): + return outcome + removal: Final = _remove_token_file() + if removal is not None and record is not None and not _scrub_file_secret(record): + return removal + if removal is None and record is not None and _the_keychain_went_unchecked(outcome): + _write_the_note_the_removal_took_with_it(record) + return SecretErased() if settled else outcome + + +def _remove_token_file() -> CredentialNotCleared | None: + try: + Path(get_cli_token_file_path()).unlink(missing_ok=True) + except OSError as error: + return CredentialNotCleared(str(error)) + return None + + +def _write_the_note_the_removal_took_with_it(record: CliTokenRecord) -> None: + """Put the secret-free note back after the file carrying it had to go to get the secret off disk. + + Reaching here means neither rewrite would take, so the file went instead, and its absence is + what the next logout would read as a keychain already known to be clean. Removing it is also + what frees the room the rewrite was refused for, so the note usually lands on this second try. + When it does not, the warning this logout printed is the only one the user gets. + """ + staged: Final = _stage_scrubbed_file(record) + if staged is not None: + _commit_token_file(staged) + + +def _keep_the_unchecked_keychain_on_record(outcome: SecretErase, record: CliTokenRecord | None) -> bool: + """Whether the token file, stripped of its secret, is worth keeping as the note that says so. + + Only a keychain that could not be reached leaves the question open. One that answered for itself + is remembered without any help from the file, and a file it can still pair a live entry with + would leave the machine signed in to the login that was just ended. A copy that will give up + its secret neither to a staged replacement nor to an overwrite is not kept either, because the + secret goes first. + """ + if record is None or not _the_keychain_went_unchecked(outcome): + return False + return _scrub_file_secret(record) + + +def _the_keychain_went_unchecked(outcome: SecretErase) -> bool: + """Whether the keychain neither confirmed the erase nor answered that it still holds the secret""" + match outcome: + case SecretErased() | SecretStranded(): + return False + case KeyringDisabled() | KeyringNotInstalled() | KeyringUnreachable(): + return True + + +def _nothing_left_behind(outcome: SecretErase, record: CliTokenRecord | None) -> bool: + """Whether the keychain can be trusted to hold no credential of ours once the file is gone. + + A machine with no token file has no stored login to end, and `clear_cli_token` keeps one behind + whenever the keychain is left unconfirmed, taking the secret out in place when it cannot stage a + replacement and writing the note again when the file holding it had to go, so a missing file is + real evidence rather than the absence of it. Past that, a + keychain that could not be reached is never trusted, whatever the file looks like. Even a file + holding its own secret says only that the login which wrote it had no keychain to write to, and + the login before it may well have had one: the entry that login left outlives both the + uninstalled package and the file that replaced it. `SecretStranded` is + the keychain answering for itself and outranks the file. + """ + match outcome: + case SecretErased(): + return True + case SecretStranded(): + return False + case KeyringDisabled() | KeyringNotInstalled() | KeyringUnreachable(): + return record is None def get_litellm_gateway_api_key( expected_base_url: str | None = None, + *, + vault: SecretVault = SYSTEM_KEYRING, ) -> str | None: """ Get the stored CLI API key for use with LiteLLM SDK. - This function reads the token file created by `lite login` + This function reads the credential created by `lite login` and returns the API key for use in Python scripts. Args: @@ -49,6 +315,7 @@ def get_litellm_gateway_api_key( originally issued for this URL. Pass the target server URL to prevent credential leakage when the client is pointed at a different (possibly malicious) server. + vault: Where the secret material is stored. Defaults to the OS keychain. Returns: str: The API key if found (and origin matches), None otherwise @@ -64,30 +331,182 @@ def get_litellm_gateway_api_key( >>> base_url="https://your-proxy.com/v1" >>> ) """ - token_data: Final = load_cli_token() - if not token_data or "key" not in token_data: + record: Final = _read_token_file() + if record is None: return None - if expected_base_url is not None: - stored_url: Final = token_data.get("base_url") - if stored_url != expected_base_url.rstrip("/"): - return None - return token_data["key"] + if expected_base_url is not None and record.base_url != expected_base_url.rstrip("/"): + return None + resolved: Final = _resolve_secret(record, vault) + return None if resolved is None else resolved.key def is_cli_token_fresh( - token_data: Mapping[str, object], buffer_hours: float = CLI_TOKEN_FRESHNESS_BUFFER_SECONDS / 3600 + token_data: CliTokenRecord | Mapping[str, object], + buffer_hours: float = CLI_TOKEN_FRESHNESS_BUFFER_SECONDS / 3600, ) -> bool: - """Check whether a cached CLI token (as stored in token.json) is still - within its expiration window. Used by `lite auth print-token` to fail - fast, without a network round trip, once the cached token is past - `LITELLM_CLI_JWT_EXPIRATION_HOURS`.""" + """Check whether a cached CLI token is still within its expiration window. + Used by `lite auth print-token` to fail fast, without a network round trip, + once the cached token is past `LITELLM_CLI_JWT_EXPIRATION_HOURS`. A `--pkce` + credential carries its own `expires_at`, which is authoritative when present.""" from litellm.constants import CLI_JWT_EXPIRATION_HOURS - expires_at: Final = token_data.get("expires_at") + expires_at: Final = ( + token_data.expires_at if isinstance(token_data, CliTokenRecord) else token_data.get("expires_at") + ) if isinstance(expires_at, (int, float)): return time.time() < expires_at - buffer_hours * 3600 - timestamp: Final = token_data.get("timestamp") + timestamp: Final = token_data.timestamp if isinstance(token_data, CliTokenRecord) else token_data.get("timestamp") if not isinstance(timestamp, (int, float)): return False age_hours: Final = (time.time() - timestamp) / 3600 return age_hours < (CLI_JWT_EXPIRATION_HOURS - buffer_hours) + + +def _read_token_file() -> CliTokenRecord | None: + try: + raw: Final = Path(get_cli_token_file_path()).read_text() + except (OSError, ValueError): + return None + try: + return CliTokenRecord.model_validate_json(raw) + except ValidationError: + return None + + +def _resolve_secret(record: CliTokenRecord, vault: SecretVault) -> CliTokenRecord | None: + match vault.read(): + case SecretFound(blob=blob): + return _apply_vault_secret(record, blob, vault) + case SecretMissing(): + return _migrate_file_secret(record, vault) + case KeyringNotInstalled() | KeyringDisabled() | KeyringUnreachable(): + return record + + +def _apply_vault_secret(record: CliTokenRecord, blob: str, vault: SecretVault) -> CliTokenRecord | None: + """Resolve the credential when both stores hold one. + + The sign-in each secret came from decides it, because either store can be the stale one. A + secret is usually left on disk by a keychain that would not take it, which makes the file the + fresher of the two. It is the older one when a login the keychain did take could not replace + the file afterwards, and serving that one would put a superseded credential back in use. Equal + stamps are one login sitting in both stores, left by a migration whose scrub was refused, so + that branch retries the migration rather than trading one credential for another. + + A scrub the file refuses leaves that superseded secret where it lies, which is the state the + login already named when it could not replace the file, and which `lite logout` reports rather + than counting as a clean sweep. Rolling the vault back the way a migration does is not the + answer here, because the two stores hold different credentials and the rollback would hand the + superseded one back out. + """ + secret: Final = _decode_secret(blob, record.base_url) + if secret is None or (record.key is not None and secret.timestamp <= record.timestamp): + return _migrate_file_secret(record, vault) + _scrub_file_secret(record) + return record.model_copy( + update=MappingProxyType( + { + "key": secret.key, + "jwt_token": secret.jwt_token, + "timestamp": max(secret.timestamp, record.timestamp), + } + ) + ) + + +def _migrate_file_secret(record: CliTokenRecord, vault: SecretVault) -> CliTokenRecord | None: + """Move a file-held secret into the vault, but only once the file's copy can be taken away. + + The scrubbed file is staged first so a directory that will not accept it stops the migration + before the keychain is handed anything. Copying the credential into a second store and only + then discovering the first one cannot be cleaned would widen exposure instead of narrowing it, + which is the opposite of what moving it into the keychain is for. + + A staged file that will not go into place is overwritten where it lies before the keychain is + asked to take the new entry back, so the migration finishes on a directory that would only ever + have refused it. Rolling back is the last resort, and a rollback the keychain also refuses + leaves the secret in both stores until the next read, which retries this same migration. + """ + if record.key is None: + return None + staged: Final = _stage_scrubbed_file(record) + if staged is None: + return record + if not isinstance(vault.write(_encode_secret(record, record.key)), SecretStored): + discard_staged_json(staged) + return record + if not _commit_token_file(staged) and not _overwrite_file_secret(record): + vault.erase() + return record + + +def _scrub_file_secret(record: CliTokenRecord) -> bool: + """Leave no secret material in the token file once the vault holds it""" + if record.key is None and not record.jwt_token: + return True + staged: Final = _stage_scrubbed_file(record) + if staged is not None and _commit_token_file(staged): + return True + return _overwrite_file_secret(record) + + +def _overwrite_file_secret(record: CliTokenRecord) -> bool: + """Take the secret out of the token file where it lies, when no replacement can be put in place. + + The atomic rewrite wants room for a second file and a directory that will accept it. A full disk + refuses the first and a read-only `~/.litellm` the second, and neither stands in the way of + shortening the file that is already there. It is worth the loss of atomicity because a partial + write reads as no login at all, which is where the refused rewrite left the next run anyway. + """ + try: + overwrite_private_json(get_cli_token_file_path(), _without_secret(record).model_dump(exclude_none=True)) + except OSError: + return False + return True + + +def _stage_scrubbed_file(record: CliTokenRecord) -> str | None: + staged: Final = _stage_token_file(_without_secret(record)) + return None if isinstance(staged, CredentialNotSaved) else staged + + +def _stage_token_file(record: CliTokenRecord) -> str | CredentialNotSaved: + path: Final = Path(get_cli_token_file_path()) + try: + ensure_private_dir(path.parent) + return stage_private_json(str(path), record.model_dump(exclude_none=True)) + except OSError as error: + return CredentialNotSaved(str(error)) + + +def _commit_token_file(staged: str) -> bool: + try: + commit_staged_json(staged, get_cli_token_file_path()) + except OSError: + return False + return True + + +def _without_secret(record: CliTokenRecord) -> CliTokenRecord: + return record.model_copy(update=MappingProxyType({"key": None, "jwt_token": ""})) + + +def _encode_secret(record: CliTokenRecord, key: str) -> str: + return CliTokenSecret( + base_url=record.base_url, key=key, jwt_token=record.jwt_token, timestamp=record.timestamp + ).model_dump_json() + + +def _decode_secret(blob: str, base_url: str) -> CliTokenSecret | None: + """The keychain entry, when it is one this metadata file may be paired with""" + try: + secret: Final = CliTokenSecret.model_validate_json(blob) + except ValidationError: + return None + return secret if secret.base_url == base_url else None + + +def _write_token_file(record: CliTokenRecord) -> None: + path: Final = Path(get_cli_token_file_path()) + ensure_private_dir(path.parent) + write_private_json(str(path), record.model_dump(exclude_none=True)) diff --git a/litellm/litellm_core_utils/private_json.py b/litellm/litellm_core_utils/private_json.py new file mode 100644 index 00000000000..30f64c8fc27 --- /dev/null +++ b/litellm/litellm_core_utils/private_json.py @@ -0,0 +1,70 @@ +import json +import os +import stat +import tempfile +from collections.abc import Mapping +from pathlib import Path +from typing import Final + +PRIVATE_DIR_MODE: Final = 0o700 + + +def ensure_private_dir(directory: Path) -> None: + """Create directory (and parents) owner-only, tightening it if it already exists group/world readable""" + directory.mkdir(mode=PRIVATE_DIR_MODE, parents=True, exist_ok=True) + if stat.S_IMODE(directory.stat().st_mode) & 0o077: + directory.chmod(PRIVATE_DIR_MODE) + + +def stage_private_json(path: str, data: Mapping[str, object]) -> str: + """Write JSON to a private temp file beside `path`, ready for `commit_staged_json`. + + Staging is the half that can fail on a read-only or full directory, so callers with something + to lose can find that out before they act on the assumption that the rewrite will land. + """ + parent: Final = Path(path).parent + parent.mkdir(parents=True, exist_ok=True) + fd, tmp_path = tempfile.mkstemp(dir=str(parent), prefix=".tmp-", suffix=".json") + try: + with os.fdopen(fd, "w") as f: + json.dump(data, f, indent=2) + f.flush() + os.fsync(f.fileno()) + except BaseException: + Path(tmp_path).unlink(missing_ok=True) + raise + return tmp_path + + +def commit_staged_json(staged: str, path: str) -> None: + """Move a staged file into place, replacing whatever is there in one step""" + try: + os.replace(staged, path) + except OSError: + Path(staged).unlink(missing_ok=True) + raise + + +def overwrite_private_json(path: str, data: Mapping[str, object]) -> None: + """Rewrite a file that is already there, in place, keeping the mode it was created with. + + `write_private_json` needs room for a second file and a directory that will accept it, which is + what a full disk and a read-only `~/.litellm` respectively refuse. Shortening the file already + in place needs neither. It is not atomic, so an interrupted write leaves a partial file, and it + never creates one, so it cannot put a world-readable file where a private one was. + """ + fd: Final = os.open(path, os.O_WRONLY | os.O_TRUNC) + with os.fdopen(fd, "w") as f: + json.dump(data, f, indent=2) + f.flush() + os.fsync(f.fileno()) + + +def discard_staged_json(staged: str) -> None: + """Throw a staged file away when the change it was part of is abandoned""" + Path(staged).unlink(missing_ok=True) + + +def write_private_json(path: str, data: Mapping[str, object]) -> None: + """Atomically write JSON to path with owner-only permissions (0600)""" + commit_staged_json(stage_private_json(path, data), path) diff --git a/litellm/proxy/client/README.md b/litellm/proxy/client/README.md index bfe95dfcbd7..3a39bec5ee6 100644 --- a/litellm/proxy/client/README.md +++ b/litellm/proxy/client/README.md @@ -331,7 +331,7 @@ sequenceDiagram CLI->>Proxy: Poll /sso/cli/poll/login_id with poll_secret header Proxy->>CLI: Return {"status": "ready", "key": "jwt"} - CLI->>CLI: Save key to ~/.litellm/token.json + CLI->>CLI: Save key to the OS keychain (metadata to ~/.litellm/token.json) ``` ### Authentication Commands @@ -353,7 +353,7 @@ The CLI provides these authentication commands: 5. **Callback Processing**: SSO provider redirects back to proxy with state parameter 6. **User Code Verification**: Browser confirms the verification code shown in the CLI 7. **Polling**: CLI polls `/sso/cli/poll/{login_id}` with the polling secret header until the JWT is ready. When `CLI_SSO_CLAIM_MAP` is configured on the proxy, the poll response may include `attribution_metadata` (allowlisted scalar OIDC claims for client attribution). -8. **Token Storage**: CLI saves the authentication token to `~/.litellm/token.json` +8. **Token Storage**: CLI saves the key to the OS keychain and the non-secret session metadata to `~/.litellm/token.json` ### Benefits of This Approach @@ -365,11 +365,11 @@ The CLI provides these authentication commands: ### Token Storage -Authentication tokens are stored in `~/.litellm/token.json` with restricted file permissions (600). The stored token includes: +The key itself goes into the OS keychain (macOS Keychain, Windows Credential Manager, or the Linux Secret Service) under service `litellm-cli`, account `credential`. Only the non-secret session metadata is written to `~/.litellm/token.json`, in a `0700` directory with `0600` file permissions: ```json { - "key": "sk-...", + "base_url": "https://your-proxy.com", "user_id": "cli-user", "user_email": "user@example.com", "user_role": "cli", @@ -378,6 +378,10 @@ Authentication tokens are stored in `~/.litellm/token.json` with restricted file } ``` +Keychain storage needs the `keyring` package, which ships with `pip install 'litellm[cli]'`. Headless boxes and CI runners usually have no keychain either. In all of those cases the key stays in the same `0600` file alongside the metadata, exactly as it did before, and `lite login` names which one applies: the package is missing, the machine has no keychain, or you set `LITELLM_CLI_DISABLE_KEYRING=1` to force the file even where a keychain exists. A `token.json` written by an older `lite` keeps working and is moved into the keychain, and scrubbed from the file, the first time a keychain-capable `lite` reads it. + +`lite logout` clears both stores. If the keychain is locked at that moment it says so, and re-running it once the keychain is unlocked finishes the job. + The stored credential is a short-lived, per-session agent token, not a managed virtual key. It is scoped to the user and team you logged in as and inherits their models and budgets; spend is tracked against the shared team and user budgets rather than a separate per-session cap, so multiple logins or several concurrent agents all draw down the same allowance. It is short-lived by design (default 24h, configurable via `LITELLM_CLI_JWT_EXPIRATION_HOURS`); re-run `lite login` to refresh it and pick up your latest team and user settings. `lite auth print-token` (usable as Claude Code's `apiKeyHelper`) prints it while fresh and fails once it expires -- there is no silent renewal. It is accepted on a default deployment without `EXPERIMENTAL_UI_LOGIN`, does not appear in the Keys UI, and cannot be rotated or revoked mid-session. A credential from `lite login --pkce` is the exception: it carries a refresh token, so the CLI renews the key shortly before it expires and `lite logout` revokes the refresh token on the proxy (see [Browser sign-in with PKCE](https://docs.litellm.ai/docs/proxy/cli_sso#browser-sign-in-with-pkce)). Only the holder can end a `--pkce` session early, with `lite logout`; an admin has no button for it, but every renewal re-reads the user on the proxy, so deactivating the user or removing them from the team makes the next renewal fail and the key runs out within `LITELLM_CLI_JWT_EXPIRATION_HOURS`. On a proxy with more than one worker or replica, configure Redis (`litellm_settings.cache` with Redis `cache_params`, or `general_settings.coordination_redis`) so a refresh token stays single-use and `lite logout` holds on every worker; without Redis each worker keeps its own record. For a long-lived, rotatable, Keys-UI-visible credential, create a dedicated virtual key in the dashboard and pass it via `--api-key` or `LITELLM_PROXY_API_KEY`. ### Usage diff --git a/litellm/proxy/client/cli/commands/agents.py b/litellm/proxy/client/cli/commands/agents.py index ed2bf2be03d..e05e85ae483 100644 --- a/litellm/proxy/client/cli/commands/agents.py +++ b/litellm/proxy/client/cli/commands/agents.py @@ -8,7 +8,7 @@ from typing import Final import click import requests -from .auth import get_stored_api_key, login +from .auth import context_secret_vault, get_stored_api_key, login ANTHROPIC_BASE_URL_ENV: Final = "ANTHROPIC_BASE_URL" ANTHROPIC_AUTH_TOKEN_ENV: Final = "ANTHROPIC_AUTH_TOKEN" @@ -316,7 +316,7 @@ def resolve_api_key(ctx: click.Context) -> str: click.echo("No LiteLLM credentials found; starting login...") ctx.invoke(login) - api_key = get_stored_api_key(expected_base_url=base_url) + api_key = get_stored_api_key(expected_base_url=base_url, vault=context_secret_vault(ctx)) if not api_key: raise click.ClickException("Login did not produce an API key; cannot start the agent.") return api_key diff --git a/litellm/proxy/client/cli/commands/auth.py b/litellm/proxy/client/cli/commands/auth.py index 31583dec978..550b11311f5 100644 --- a/litellm/proxy/client/cli/commands/auth.py +++ b/litellm/proxy/client/cli/commands/auth.py @@ -1,9 +1,7 @@ -import json -import os import sys import time import webbrowser -from pathlib import Path +from collections.abc import Callable, Mapping from typing import Any, Final from urllib.parse import urlencode @@ -14,7 +12,32 @@ from rich.table import Table from typing_extensions import NotRequired, ReadOnly, TypedDict, assert_never from litellm.constants import CLI_JWT_EXPIRATION_HOURS -from litellm.litellm_core_utils.cli_token_utils import is_cli_token_fresh +from litellm.litellm_core_utils.cli_keyring import ( + DISABLE_KEYRING_ENV_VAR, + SYSTEM_KEYRING, + KeyringDisabled, + KeyringDiscardsWrites, + KeyringNotInstalled, + KeyringUnreachable, + SecretErased, + SecretFound, + SecretMissing, + SecretStored, + SecretStranded, + SecretVault, +) +from litellm.litellm_core_utils.cli_token_utils import ( + CliTokenRecord, + CredentialNotCleared, + CredentialNotRecorded, + CredentialNotSaved, + SecretSave, + clear_cli_token, + get_cli_token_file_path, + is_cli_token_fresh, + load_cli_token, + save_cli_token, +) from .claude_settings import ( CLAUDE_SETTINGS_PATH, @@ -31,7 +54,6 @@ from .pkce_login import ( revoke_stored_credential, run_pkce_login, ) -from .private_json import write_private_json class CliTokenData(TypedDict): @@ -62,6 +84,7 @@ class CliTeam(TypedDict, total=False): class CliContextObj(TypedDict): base_url: str base_url_explicit: NotRequired[bool] + secret_vault: NotRequired[ReadOnly[SecretVault]] api_key: ReadOnly[NotRequired[str | None]] api_key_from_token_file: ReadOnly[NotRequired[bool]] @@ -94,51 +117,148 @@ class CliAuthResult(TypedDict): team_id: str | None -# Token storage utilities -def get_token_file_path() -> str: - """Get the path to store the authentication token""" - return str(Path.home() / ".litellm" / "token.json") +KEYRING_INSTALL_HINT: Final = "pip install 'litellm[cli]'" + +KEYRING_ENABLE_HINT: Final = "keyring --enable (or unset PYTHON_KEYRING_BACKEND)" + +STRANDED_CREDENTIAL_MESSAGE: Final = ( + "Logged out locally, but your credential is still in the OS keychain and could not be removed." +) + +UNCHECKED_KEYCHAIN_MESSAGE: Final = ( + "Logged out locally, but your OS keychain could not be checked, so a credential stored there by " + "an earlier login may still be usable." +) -def save_token(token_data: CliTokenData) -> None: - """Save token data to file""" - write_private_json(get_token_file_path(), token_data) +def storage_notice(outcome: SecretSave) -> str: + """Tell the user where the credential ended up, and how to get keychain storage if it did not.""" + path: Final = get_cli_token_file_path() + match outcome: + case SecretStored(): + return "Credential stored in your OS keychain." + case KeyringNotInstalled(): + return ( + f"Credential stored in {path} (owner-only). " + f"For OS keychain storage, install the keyring package with: {KEYRING_INSTALL_HINT}" + ) + case KeyringDisabled(): + return f"Keychain storage is off ({DISABLE_KEYRING_ENV_VAR}). Credential stored in {path} (owner-only)." + case KeyringUnreachable(): + return f"No OS keychain available. Credential stored in {path} (owner-only)." + case KeyringDiscardsWrites(): + return ( + f"Your keyring backend keeps nothing it is given, so the credential was stored in {path} " + f"(owner-only) instead. For OS keychain storage, run: {KEYRING_ENABLE_HINT}" + ) + case CredentialNotSaved(detail=detail): + return ( + f"Signed in, but the credential could not be saved to {path}: {detail}. " + "Any login you already had is untouched. Run 'lite login' again once that path is " + "writable, or 'lite logout' to clear whatever is stored now." + ) + case CredentialNotRecorded(): + return ( + f"Signed in, and the credential is in your OS keychain, but {path} could not be " + "replaced, so it still describes your previous login and may still hold its " + "credential. Run 'lite login' again once that path is writable, or 'lite logout' " + "to clear both." + ) -def load_token() -> CliTokenData | None: - """Load token data from file""" - token_file: Final = get_token_file_path() - if not os.path.exists(token_file): - return None - - try: - with open(token_file, "r") as f: - return json.load(f) - except (OSError, json.JSONDecodeError): - return None +def keychain_unreadable_notice(vault: SecretVault) -> str: + """Explain why the secret half of a stored login cannot be produced, and what fixes it""" + match vault.read(): + case KeyringNotInstalled(): + return ( + "Your credential is in your OS keychain, which this install cannot read without the " + f"keyring package. Install it with: {KEYRING_INSTALL_HINT}, or run 'lite login' to start over." + ) + case KeyringDisabled(): + return ( + f"Your credential is in your OS keychain, which {DISABLE_KEYRING_ENV_VAR} is blocking. " + "Unset it, or run 'lite login' to start over." + ) + case KeyringUnreachable(): + return ( + "Your credential is in your OS keychain, which could not be read. Unlock it, or run " + "'lite login' to start over." + ) + case SecretFound() | SecretMissing(): + return "Your credential could not be read from your OS keychain. Run 'lite login' to start over." -def clear_token() -> None: - """Clear stored token""" - token_file: Final = get_token_file_path() - if os.path.exists(token_file): - os.remove(token_file) +def context_secret_vault(ctx: click.Context) -> SecretVault: + """Where this invocation reads and writes secret material; injectable through ctx.obj for tests""" + ctx_obj: Final[CliContextObj | None] = ctx.obj + if ctx_obj is None: + return SYSTEM_KEYRING + return ctx_obj.get("secret_vault") or SYSTEM_KEYRING -def get_stored_api_key(expected_base_url: str | None = None) -> str | None: - """Get the stored API key from token file. +def load_token(*, vault: SecretVault = SYSTEM_KEYRING) -> Mapping[str, object] | None: + """The stored credential as a plain mapping, with the secret resolved out of the vault. + + The PKCE renewal and revocation helpers read records by field name, so this is the + shape they get; the keychain split lives underneath, in `load_cli_token`. + """ + record: Final = load_cli_token(vault=vault) + return None if record is None else record.model_dump(exclude_none=True) + + +def save_token(record: CliTokenData, *, vault: SecretVault = SYSTEM_KEYRING) -> SecretSave: + """Store a credential the PKCE layer produced, secret in the vault and the rest on disk""" + return save_cli_token(CliTokenRecord(**record), vault=vault) + + +def _renewal_saver(vault: SecretVault) -> Callable[[CliTokenData], None]: + """Persist a silently renewed credential, and say on stderr when no store would keep it. + + A renewal rotates the refresh token, so a rotation that is never stored logs this + machine out on the next command; the user hears about it rather than guessing. + """ + + def save(record: CliTokenData) -> None: + outcome: Final = save_token(record, vault=vault) + if isinstance(outcome, (CredentialNotSaved, CredentialNotRecorded)): + _warn(storage_notice(outcome)) + + return save + + +def _renewal_reader(vault: SecretVault) -> Callable[[], Mapping[str, object] | None]: + """Re-read the record mid-renewal, so a rotation a sibling `lite` process saved is seen""" + + def reload() -> Mapping[str, object] | None: + return load_token(vault=vault) + + return reload + + +def get_stored_api_key( + expected_base_url: str | None = None, + *, + vault: SecretVault = SYSTEM_KEYRING, +) -> str | None: + """Get the stored API key. If expected_base_url is provided, the key is only returned when it was originally issued for that URL. This prevents credential leakage when the CLI is pointed at a different (possibly malicious) server. A key obtained by ``lite login --pkce`` is refreshed here once it nears expiry. """ - token_data: Final = load_token() + token_data: Final = load_token(vault=vault) if token_data is None: return None if expected_base_url is not None and token_data.get("base_url") != expected_base_url.rstrip("/"): return None - return fresh_api_key(token_data, save_token, requests.Session(), reload=load_token, warn=_warn) + return fresh_api_key( + token_data, + _renewal_saver(vault), + requests.Session(), + reload=_renewal_reader(vault), + warn=_warn, + ) def _warn(message: str) -> None: @@ -672,11 +792,14 @@ def _configure_claude_code(base_url: str) -> None: click.echo("Your other Claude Code settings were left untouched. Restart Claude Code to pick this up.") -def _finish_login(base_url: str, api_key: str, config_claude: bool) -> None: +def _finish_login(base_url: str, api_key: str, config_claude: bool, stored: SecretSave) -> None: from litellm.proxy.client.cli.interface import show_commands click.echo("\nLogin successful!") click.echo(f"JWT Token: {api_key[:20]}...") + click.echo(storage_notice(stored)) + if isinstance(stored, (CredentialNotSaved, CredentialNotRecorded)): + return click.echo("You can now use the CLI without specifying --api-key") if config_claude: _configure_claude_code(base_url) @@ -684,27 +807,28 @@ def _finish_login(base_url: str, api_key: str, config_claude: bool) -> None: show_commands() -def _replace_stored_token(record: CliTokenData, http: Http) -> None: - previous: Final = load_token() - save_token(record) - if previous is None: - return +def _replace_stored_token(record: CliTokenData, http: Http, vault: SecretVault) -> SecretSave: + previous: Final = load_token(vault=vault) + stored: Final = save_token(record, vault=vault) + if previous is None or isinstance(stored, CredentialNotSaved): + return stored revocation: Final = revoke_stored_credential(previous, http) if revocation is not None: click.echo( f"Could not revoke the previous login's refresh token on the proxy ({revocation.reason}); " "it expires on its own." ) + return stored -def _pkce_login(base_url: str, config_claude: bool) -> None: +def _pkce_login(base_url: str, config_claude: bool, vault: SecretVault) -> None: http: Final = requests.Session() credential: Final = run_pkce_login(base_url, http, echo=click.echo) if isinstance(credential, PkceFailure): click.echo(f"Authentication failed: {credential.reason}") return - _replace_stored_token(pkce_token_record(base_url, credential), http) - _finish_login(base_url, credential.access_token, config_claude) + stored: Final = _replace_stored_token(pkce_token_record(base_url, credential), http, vault) + _finish_login(base_url, credential.access_token, config_claude, stored) @click.command(name="login") @@ -737,7 +861,7 @@ def login(ctx: click.Context, config_claude: bool, pkce: bool) -> None: try: if pkce: - _pkce_login(base_url, config_claude) + _pkce_login(base_url, config_claude, context_secret_vault(ctx)) return cli_sso_flow: Final = _start_cli_sso_flow(base_url=base_url) key_id: Final = cli_sso_flow["login_id"] @@ -765,7 +889,7 @@ def login(ctx: click.Context, config_claude: bool, pkce: bool) -> None: # Save token data. base_url is stored so we can verify origin # before reusing the key on a subsequent CLI invocation. - _replace_stored_token( + stored: Final = _replace_stored_token( { "base_url": base_url.rstrip("/"), "key": api_key, @@ -777,9 +901,10 @@ def login(ctx: click.Context, config_claude: bool, pkce: bool) -> None: "timestamp": time.time(), }, requests.Session(), + context_secret_vault(ctx), ) - _finish_login(base_url, api_key, config_claude) + _finish_login(base_url, api_key, config_claude, stored) return else: click.echo("Authentication timed out. Please try again.") @@ -802,23 +927,44 @@ def login(ctx: click.Context, config_claude: bool, pkce: bool) -> None: @click.command(name="logout") -def logout(): +@click.pass_context +def logout(ctx: click.Context): """Logout and clear stored authentication""" - token_data: Final = load_token() + vault: Final = context_secret_vault(ctx) + token_data: Final = load_token(vault=vault) revocation: Final = revoke_stored_credential(token_data, requests.Session()) if token_data is not None else None match revocation: case RevocationUnavailable(reason=reason): raise click.ClickException( - f"The proxy could not record the revocation ({reason}). Nothing was cleared; run `lite logout` again shortly." + f"The proxy could not record the revocation ({reason}). Nothing was cleared; " + "run `lite logout` again shortly." ) case PkceFailure(reason=reason): - clear_token() click.echo(f"Could not revoke the refresh token on the proxy ({reason}); it expires on its own.") case None: - clear_token() + pass case _: assert_never(revocation) - click.echo("Logged out successfully. Authentication token cleared.") + + path: Final = get_cli_token_file_path() + match clear_cli_token(vault=vault): + case SecretErased(): + click.echo("Logged out successfully. Authentication token cleared.") + case CredentialNotCleared(detail=detail): + click.echo(f"Your credential is still in {path}, which could not be removed: {detail}.") + click.echo("Delete that file, or make the directory writable and run 'lite logout' again.") + case SecretStranded(): + click.echo(STRANDED_CREDENTIAL_MESSAGE) + click.echo("Unlock your keychain and run 'lite logout' again to clear it.") + case KeyringNotInstalled(): + click.echo(UNCHECKED_KEYCHAIN_MESSAGE) + click.echo(f"Install the keyring package with: {KEYRING_INSTALL_HINT}, then run 'lite logout' again.") + case KeyringDisabled(): + click.echo(UNCHECKED_KEYCHAIN_MESSAGE) + click.echo(f"Unset {DISABLE_KEYRING_ENV_VAR} and run 'lite logout' again to clear it.") + case KeyringUnreachable(): + click.echo(UNCHECKED_KEYCHAIN_MESSAGE) + click.echo("Unlock your keychain and run 'lite logout' again to clear it.") @click.command(name="print-token") @@ -833,7 +979,8 @@ def print_token(ctx: click.Context): `lite login --pkce` token renews itself here first, and once a token has expired for good, run the same `lite login` command again. """ - token_data: Final = load_token() + vault: Final = context_secret_vault(ctx) + token_data: Final = load_token(vault=vault) if not token_data: click.echo("Not authenticated. Run 'lite login'.", err=True) sys.exit(1) @@ -853,10 +1000,20 @@ def print_token(ctx: click.Context): click.echo("Token expired. Run 'lite login' again.", err=True) sys.exit(1) + if token_data.get("key") is None: + click.echo(keychain_unreadable_notice(vault), err=True) + sys.exit(1) + api_key: Final = ( ctx_obj.get("api_key") if issued_for_this_server and ctx_obj.get("api_key_from_token_file") - else fresh_api_key(token_data, save_token, requests.Session(), reload=load_token, warn=_warn) + else fresh_api_key( + token_data, + _renewal_saver(vault), + requests.Session(), + reload=_renewal_reader(vault), + warn=_warn, + ) ) if not api_key: click.echo(f"Key expired. Run '{_login_command(renews)}' again.", err=True) @@ -866,26 +1023,32 @@ def print_token(ctx: click.Context): @click.command(name="whoami") -def whoami(): +@click.pass_context +def whoami(ctx: click.Context): """Show current authentication status""" - token_data: Final = load_token() + vault: Final = context_secret_vault(ctx) + token_data: Final = load_token(vault=vault) if not token_data: click.echo("Not authenticated. Run 'lite login' to authenticate.") return - click.echo("Authenticated") - click.echo(f"User Email: {token_data.get('user_email', 'Unknown')}") - click.echo(f"User ID: {token_data.get('user_id', 'Unknown')}") - click.echo(f"User Role: {token_data.get('user_role', 'Unknown')}") + key_readable: Final = token_data.get("key") is not None + click.echo("Authenticated" if key_readable else "Signed in, but the credential cannot be read") + click.echo(f"User Email: {token_data.get('user_email') or 'Unknown'}") + click.echo(f"User ID: {token_data.get('user_id') or 'Unknown'}") + click.echo(f"User Role: {token_data.get('user_role') or 'Unknown'}") team_id: Final = token_data.get("team_id") if team_id: click.echo(f"Team ID: {team_id}") - timestamp: Final = token_data.get("timestamp", 0) - age_hours: Final = (time.time() - timestamp) / 3600 + stamped: Final = token_data.get("timestamp") + age_hours: Final = (time.time() - (stamped if isinstance(stamped, (int, float)) else 0.0)) / 3600 click.echo(f"Token age: {age_hours:.1f} hours") + if not key_readable: + click.echo(keychain_unreadable_notice(vault)) + expires_at: Final = token_data.get("expires_at") if isinstance(expires_at, (int, float)): click.echo(_key_expiry_line(expires_at, renews="refresh_token" in token_data)) diff --git a/litellm/proxy/client/cli/commands/claude_settings.py b/litellm/proxy/client/cli/commands/claude_settings.py index e9a6a25a064..e18e5b1b7ee 100644 --- a/litellm/proxy/client/cli/commands/claude_settings.py +++ b/litellm/proxy/client/cli/commands/claude_settings.py @@ -15,7 +15,7 @@ from typing import Final from pydantic import JsonValue, TypeAdapter, ValidationError -from .private_json import write_private_json +from litellm.litellm_core_utils.private_json import write_private_json ENV_KEY: Final = "env" API_KEY_HELPER_KEY: Final = "apiKeyHelper" diff --git a/litellm/proxy/client/cli/commands/config.py b/litellm/proxy/client/cli/commands/config.py index 19dd407ba19..2715a0a9a38 100644 --- a/litellm/proxy/client/cli/commands/config.py +++ b/litellm/proxy/client/cli/commands/config.py @@ -10,7 +10,7 @@ from urllib.parse import urlparse import click from pydantic import TypeAdapter -from .private_json import write_private_json +from litellm.litellm_core_utils.private_json import ensure_private_dir, write_private_json HIDDEN_COMMANDS_KEY: Final = "hidden_commands" @@ -42,7 +42,9 @@ def load_config() -> Mapping[str, str]: def save_config(config: Mapping[str, str]) -> None: """Save CLI config to file""" - write_private_json(get_config_file_path(), config) + config_file: Final = Path(get_config_file_path()) + ensure_private_dir(config_file.parent) + write_private_json(str(config_file), config) def get_config_value(key: str) -> str | None: diff --git a/litellm/proxy/client/cli/commands/private_json.py b/litellm/proxy/client/cli/commands/private_json.py deleted file mode 100644 index 31062e4a799..00000000000 --- a/litellm/proxy/client/cli/commands/private_json.py +++ /dev/null @@ -1,21 +0,0 @@ -import json -import os -import tempfile -from collections.abc import Mapping -from pathlib import Path -from typing import Final - - -def write_private_json(path: str, data: Mapping[str, object]) -> None: - """Atomically write JSON to path with owner-only permissions (0600)""" - parent: Final = Path(path).parent - parent.mkdir(parents=True, exist_ok=True) - fd, tmp_path = tempfile.mkstemp(dir=str(parent), prefix=".tmp-", suffix=".json") - try: - with os.fdopen(fd, "w") as f: - json.dump(data, f, indent=2) - f.flush() - os.fsync(f.fileno()) - os.replace(tmp_path, path) - finally: - Path(tmp_path).unlink(missing_ok=True) diff --git a/litellm/proxy/client/cli/commands/up.py b/litellm/proxy/client/cli/commands/up.py index 80b7a04b75a..b7c02866d6f 100644 --- a/litellm/proxy/client/cli/commands/up.py +++ b/litellm/proxy/client/cli/commands/up.py @@ -14,10 +14,12 @@ from typing import IO, Final import click from pydantic import JsonValue, TypeAdapter, ValidationError +from litellm.litellm_core_utils.cli_keyring import SecretVault from litellm.litellm_core_utils.cli_token_utils import is_cli_token_fresh +from litellm.litellm_core_utils.private_json import ensure_private_dir from .agents import AgentRunError, resolve_api_key, verify_proxy_key -from .auth import CliContextObj, get_stored_api_key, load_token, login +from .auth import CliContextObj, context_secret_vault, get_stored_api_key, load_token, login from .claude_settings import ( BACKUP_PATH, CLAUDE_SETTINGS_PATH, @@ -66,7 +68,7 @@ def secure_create(path: Path) -> Iterator[IO[str]]: def write_backup(record: BackupRecord, backup_path: Path | None = None) -> None: path: Final = backup_path if backup_path is not None else BACKUP_PATH - path.parent.mkdir(exist_ok=True) + ensure_private_dir(path.parent) with secure_create(path) as f: json.dump({"existed": record.existed, "content": record.content}, f, indent=2) @@ -103,31 +105,32 @@ def restore_claude_settings(settings_path: Path | None = None, backup_path: Path return record -def _usable_login(api_key: str | None) -> bool: +def _usable_login(api_key: str | None, vault: SecretVault) -> bool: if api_key is None: return False - token_data: Final = load_token() + token_data: Final = load_token(vault=vault) return token_data is not None and is_cli_token_fresh(token_data) -def _key_resolved_on_the_way_in(ctx_obj: CliContextObj, base_url: str) -> str | None: +def _key_resolved_on_the_way_in(ctx_obj: CliContextObj, base_url: str, vault: SecretVault) -> str | None: if ctx_obj.get("api_key_from_token_file"): return ctx_obj.get("api_key") - return get_stored_api_key(expected_base_url=base_url) + return get_stored_api_key(expected_base_url=base_url, vault=vault) -def _stored_login_is_pkce() -> bool: - token_data: Final = load_token() - return token_data is not None and "refresh_token" in token_data +def _stored_login_is_pkce(vault: SecretVault) -> bool: + token_data: Final = load_token(vault=vault) + return token_data is not None and token_data.get("refresh_token") is not None def _ensure_fresh_login(ctx: click.Context) -> None: ctx_obj: Final[CliContextObj] = ctx.obj base_url: Final = ctx_obj["base_url"].rstrip("/") - if _usable_login(_key_resolved_on_the_way_in(ctx_obj, base_url)): + vault: Final = context_secret_vault(ctx) + if _usable_login(_key_resolved_on_the_way_in(ctx_obj, base_url, vault), vault): return - pkce: Final = _stored_login_is_pkce() + pkce: Final = _stored_login_is_pkce(vault) login_command: Final = "lite login --pkce" if pkce else "lite login" if not sys.stdin.isatty(): raise UpError( @@ -137,7 +140,7 @@ def _ensure_fresh_login(ctx: click.Context) -> None: click.echo("No fresh LiteLLM login found for this proxy; starting login...") ctx.invoke(login, pkce=pkce) - if not _usable_login(get_stored_api_key(expected_base_url=base_url)): + if not _usable_login(get_stored_api_key(expected_base_url=base_url, vault=vault), vault): raise UpError("Login did not produce a usable token; cannot start `lite up`.") diff --git a/litellm/proxy/client/cli/main.py b/litellm/proxy/client/cli/main.py index 6dba1399acb..2674bf49ff0 100644 --- a/litellm/proxy/client/cli/main.py +++ b/litellm/proxy/client/cli/main.py @@ -9,7 +9,7 @@ from litellm._version import version as litellm_version from litellm.proxy.client.health import HealthManagementClient from .commands.agents import agent_commands -from .commands.auth import auth_group, get_stored_api_key, login, logout, whoami +from .commands.auth import auth_group, context_secret_vault, get_stored_api_key, login, logout, whoami from .commands.autoroute.commands import autoroute_group from .commands.chat import chat from .commands.config import config_commands, get_config_value, hidden_command_names @@ -94,7 +94,11 @@ def cli(ctx: click.Context, show_version: bool, base_url: str | None, api_key: s # If no API key provided via flag or environment variable, try to load from saved token. # Pass base_url so we only use the stored key when it was issued for this server. api_key_from_token_file: Final = api_key is None - resolved_api_key: Final = get_stored_api_key(expected_base_url=base_url) if api_key_from_token_file else api_key + resolved_api_key: Final = ( + get_stored_api_key(expected_base_url=base_url, vault=context_secret_vault(ctx)) + if api_key_from_token_file + else api_key + ) ctx.obj["base_url"] = base_url ctx.obj["api_key"] = resolved_api_key diff --git a/pyproject.toml b/pyproject.toml index ffbc96eefb9..09a69f3771e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -78,13 +78,16 @@ proxy = [ "expression>=5.6.0,<6.0", ] # Thin client install for the `lite` CLI on developer laptops. The CLI's heavy -# imports (fastapi, cryptography, ...) are all guarded, so it runs on the base -# SDK plus just these four; none of the server runtime in `proxy` is pulled in. +# imports are all guarded, so it runs on the base SDK plus just these five, and +# none of the server runtime in `proxy` is pulled in. On Linux, +# keyring reaches the Secret Service through secretstorage, which brings +# cryptography with it. cli = [ "rich>=13.9.4,<14.0", "pyyaml>=6.0.3,<7.0", "requests>=2.32.0,<3.0", "InquirerPy>=0.3.4,<1.0", + "keyring>=25.6.0,<26.0", ] extra_proxy = [ "prisma>=0.11.0,<1.0", @@ -166,6 +169,7 @@ litellm-proxy = "litellm.proxy.client.cli:cli" dev = [ "diff-cover==9.7.2", "basedpyright==1.39.7", + "keyring==25.7.0", "pytest==9.0.3", "pytest-mock==3.15.1", "pytest-asyncio==1.3.0", diff --git a/tests/base_sdk_tests/check_base_sdk_install.py b/tests/base_sdk_tests/check_base_sdk_install.py index 723f30cad76..6b38de75e2e 100644 --- a/tests/base_sdk_tests/check_base_sdk_install.py +++ b/tests/base_sdk_tests/check_base_sdk_install.py @@ -11,7 +11,7 @@ import sys import traceback from collections.abc import Callable -EXTRAS_ONLY_MODULES = ("fastapi", "uvicorn") +EXTRAS_ONLY_MODULES = ("fastapi", "uvicorn", "keyring") def _require(condition: bool, message: str) -> None: diff --git a/tests/test_litellm/conftest.py b/tests/test_litellm/conftest.py index c0644c88291..1229642dea0 100644 --- a/tests/test_litellm/conftest.py +++ b/tests/test_litellm/conftest.py @@ -22,6 +22,19 @@ import litellm from litellm import router as litellm_router_module from litellm import utils as litellm_utils_module from litellm._logging import ALL_LOGGERS +from litellm.litellm_core_utils.cli_keyring import ( + KeyringDiscardsWrites, + KeyringUnreachable, + KeyringUnusable, + SecretErase, + SecretErased, + SecretFound, + SecretMissing, + SecretRead, + SecretStored, + SecretStranded, + SecretWrite, +) from litellm.litellm_core_utils.prompt_templates import ( image_handling as image_handling_module, ) @@ -106,6 +119,75 @@ def isolate_host_proxy_base_url(monkeypatch): monkeypatch.delenv("PROXY_BASE_URL", raising=False) +@pytest.fixture(scope="function", autouse=True) +def isolate_host_os_keychain(monkeypatch): + """Keep any code path that resolves a CLI credential out of the developer's real OS keychain. + + Tests that exercise keychain behaviour inject their own vault instead. + """ + monkeypatch.setenv("LITELLM_CLI_DISABLE_KEYRING", "1") + + +class FakeSecretVault: + """In-memory stand-in for the OS keychain, injected wherever CLI credential storage is exercised. + + `available=False` models a keychain that is locked or has no backend, `writable=False` one that + refuses to store, `erasable=False` one that will not release what it already holds, and `failure` + picks which unusable state those report. `discards=True` is keyring's null backend, which answers + reads and erases like any other yet keeps nothing it is given, so only writes report it. + """ + + def __init__( + self, + blob: str | None = None, + *, + available: bool = True, + writable: bool = True, + erasable: bool = True, + discards: bool = False, + failure: KeyringUnusable = KeyringUnreachable(), + ) -> None: + self.blob: str | None = blob + self.available: bool = available + self.writable: bool = writable + self.erasable: bool = erasable + self.discards: bool = discards + self.failure: KeyringUnusable = failure + self.reads: int = 0 + self.writes: list[str] = [] + self.erases: int = 0 + + def read(self) -> SecretRead: + self.reads += 1 + if not self.available: + return self.failure + return SecretMissing() if self.blob is None else SecretFound(self.blob) + + def write(self, blob: str) -> SecretWrite: + self.writes.append(blob) + if not (self.available and self.writable): + return self.failure + if self.discards: + return KeyringDiscardsWrites() + self.blob = blob + return SecretStored() + + def erase(self) -> SecretErase: + self.erases += 1 + if not self.available: + return self.failure + if not self.erasable: + return SecretStranded() if self.blob is not None else SecretErased() + self.blob = None + return SecretErased() + + +@pytest.fixture +def secret_vault_factory(): + """Build FakeSecretVault instances; see its docstring for the failure modes it can model.""" + return FakeSecretVault + + def _run_coroutine_if_needed(result): if not asyncio.iscoroutine(result): return diff --git a/tests/test_litellm/litellm_core_utils/test_cli_token_utils.py b/tests/test_litellm/litellm_core_utils/test_cli_token_utils.py index 5593211ba6f..b8ac1987453 100644 --- a/tests/test_litellm/litellm_core_utils/test_cli_token_utils.py +++ b/tests/test_litellm/litellm_core_utils/test_cli_token_utils.py @@ -1,93 +1,1114 @@ -""" -Unit tests for CLI token utilities -""" - +import errno import json import os +import stat +import sys import tempfile +import threading import time -from pathlib import Path -from unittest.mock import mock_open, patch import pytest -from litellm.litellm_core_utils.cli_token_utils import get_litellm_gateway_api_key +from litellm.constants import CLI_JWT_EXPIRATION_HOURS +from litellm.litellm_core_utils.cli_keyring import ( + DISABLE_KEYRING_ENV_VAR, + KEYRING_ACCOUNT, + KEYRING_PREFLIGHT_ACCOUNT, + KEYRING_SERVICE, + KeyringDisabled, + KeyringDiscardsWrites, + KeyringNotInstalled, + KeyringUnreachable, + KeyringVault, + SecretErased, + SecretFound, + SecretMissing, + SecretStored, + SecretStranded, +) +from litellm.litellm_core_utils.cli_token_utils import ( + CliTokenRecord, + CredentialNotCleared, + CredentialNotRecorded, + CredentialNotSaved, + clear_cli_token, + get_cli_token_file_path, + get_litellm_gateway_api_key, + is_cli_token_fresh, + load_cli_token, + save_cli_token, +) + +SERVER = "https://proxy.example.com" +OTHER_SERVER = "https://other-proxy.example.com" -class TestCLITokenUtils: - """Test CLI token utility functions""" +@pytest.fixture +def isolated_home(monkeypatch, tmp_path): + monkeypatch.setenv("HOME", str(tmp_path)) + monkeypatch.setenv("USERPROFILE", str(tmp_path)) + return tmp_path - def test_get_litellm_gateway_api_key_success(self): - """Test getting CLI API key when token file exists and is valid""" - token_data = { - "key": "sk-test-cli-key-123", - "user_id": "test-user", - "user_email": "test@example.com", - "timestamp": 1234567890, - } - with ( - patch("os.path.exists", return_value=True), - patch("builtins.open", mock_open(read_data=json.dumps(token_data))), - patch( - "litellm.litellm_core_utils.cli_token_utils.get_cli_token_file_path", - return_value="/test/.litellm/token.json", - ), - ): +def _token_file(home): + return home / ".litellm" / "token.json" - result = get_litellm_gateway_api_key() - assert result == "sk-test-cli-key-123" +def _write_legacy_file(home, **overrides): + payload = { + "base_url": SERVER, + "key": "sk-legacy", + "user_id": "u-1", + "user_email": "user@example.com", + "user_role": "cli", + "timestamp": time.time(), + **overrides, + } + path = _token_file(home) + path.parent.mkdir(exist_ok=True) + path.write_text(json.dumps(payload)) + path.chmod(0o600) + return path - def test_get_litellm_gateway_api_key_no_file(self): - """Test getting CLI API key when token file doesn't exist""" - with ( - patch("os.path.exists", return_value=False), - patch( - "litellm.litellm_core_utils.cli_token_utils.get_cli_token_file_path", - return_value="/test/.litellm/token.json", - ), - ): - result = get_litellm_gateway_api_key() +def _write_metadata_only_file(home): + """What a post-migration token.json looks like: everything except the secret material.""" + path = _token_file(home) + path.parent.mkdir(exist_ok=True) + path.write_text(json.dumps({"base_url": SERVER, "user_id": "u-1", "timestamp": time.time()})) + path.chmod(0o600) + return path - assert result is None - def test_get_litellm_gateway_api_key_invalid_json(self): - """Test getting CLI API key when token file has invalid JSON""" - with ( - patch("os.path.exists", return_value=True), - patch("builtins.open", mock_open(read_data="invalid json")), - patch( - "litellm.litellm_core_utils.cli_token_utils.get_cli_token_file_path", - return_value="/test/.litellm/token.json", - ), - ): +def _blob(base_url=SERVER, key="sk-vault", jwt_token="", timestamp=0.0): + return json.dumps({"base_url": base_url, "key": key, "jwt_token": jwt_token, "timestamp": timestamp}) - result = get_litellm_gateway_api_key() - assert result is None +_REAL_MKSTEMP = tempfile.mkstemp - def test_get_litellm_gateway_api_key_no_key_field(self): - """Test getting CLI API key when token file exists but has no key field""" - token_data = { - "user_id": "test-user", - "user_email": "test@example.com", - # Missing 'key' field - } - with ( - patch("os.path.exists", return_value=True), - patch("builtins.open", mock_open(read_data=json.dumps(token_data))), - patch( - "litellm.litellm_core_utils.cli_token_utils.get_cli_token_file_path", - return_value="/test/.litellm/token.json", - ), - ): +class _MkstempThatNeedsTheOldFileGone: + """A disk with exactly one token file's worth of room left on it. - result = get_litellm_gateway_api_key() + Staging a replacement needs room for a second file, which is what a full disk refuses. Removing + the file already there is what gives that room back. + """ - assert result is None + def __init__(self, path): + self.path = path + + def __call__(self, *args, **kwargs): + if self.path.exists(): + raise OSError(errno.ENOSPC, "No space left on device") + return _REAL_MKSTEMP(*args, **kwargs) + + +_REAL_REPLACE = os.replace + + +def _refuse_replace(*args, **kwargs): + raise OSError("device or resource busy") + + +class _ReplaceThatStartsRefusing: + """`os.replace` standing in for a path that cannot be replaced yet: a file another process holds + open on Windows, a directory that went read-only between staging and the rewrite.""" + + def __init__(self): + self.allowed = False + + def __call__(self, src, dst): + if not self.allowed: + raise OSError("device or resource busy") + _REAL_REPLACE(src, dst) + + +class TestGetCliTokenFilePath: + def test_points_at_the_home_config_file(self, isolated_home): + assert get_cli_token_file_path() == str(isolated_home / ".litellm" / "token.json") + + def test_does_not_create_the_directory(self, isolated_home): + """Merely asking for the path must not leave a directory behind, so an SDK import that + never logs in cannot create a ~/.litellm on someone's machine.""" + get_cli_token_file_path() + + assert not (isolated_home / ".litellm").exists() + + +class TestLoadCliToken: + def test_no_token_file_never_touches_the_keychain(self, isolated_home, secret_vault_factory): + """The SDK calls this on machines that never ran `lite login`; it must not prompt for + keychain access there.""" + vault = secret_vault_factory(blob=_blob()) + + assert load_cli_token(vault=vault) is None + assert vault.reads == 0 + + def test_secret_comes_from_the_vault_when_the_file_holds_only_metadata(self, isolated_home, secret_vault_factory): + _write_metadata_only_file(isolated_home) + vault = secret_vault_factory(blob=_blob(key="sk-from-keychain")) + + record = load_cli_token(vault=vault) + + assert record.key == "sk-from-keychain" + assert "sk-from-keychain" not in _token_file(isolated_home).read_text() + + def test_jwt_token_round_trips_through_the_vault(self, isolated_home, secret_vault_factory): + _write_metadata_only_file(isolated_home) + vault = secret_vault_factory(blob=_blob(key="sk-a", jwt_token="jwt-a")) + + record = load_cli_token(vault=vault) + + assert (record.key, record.jwt_token) == ("sk-a", "jwt-a") + + def test_legacy_plaintext_file_still_authenticates_and_is_migrated(self, isolated_home, secret_vault_factory): + """A token.json written by an older `lite` keeps working, and reading it moves the secret + into the keychain and scrubs it from disk.""" + path = _write_legacy_file(isolated_home) + vault = secret_vault_factory() + + record = load_cli_token(vault=vault) + + assert record.key == "sk-legacy" + assert json.loads(vault.blob)["key"] == "sk-legacy" + on_disk = json.loads(path.read_text()) + assert "key" not in on_disk + assert on_disk["user_email"] == "user@example.com" + assert stat.S_IMODE(path.stat().st_mode) == 0o600 + + def test_migration_tightens_a_world_readable_legacy_file(self, isolated_home, secret_vault_factory): + """An older `lite`, a loose umask, or a restored backup can leave token.json readable by + every account on the box. Migrating it must not preserve those permissions.""" + path = _write_legacy_file(isolated_home) + path.chmod(0o644) + + load_cli_token(vault=secret_vault_factory()) + + assert stat.S_IMODE(path.stat().st_mode) == 0o600 + + def test_legacy_file_survives_a_vault_that_refuses_to_store(self, isolated_home, secret_vault_factory): + """Scrubbing the only copy of the secret after a failed keychain write would log the user + out for good.""" + path = _write_legacy_file(isolated_home) + before = path.read_text() + + record = load_cli_token(vault=secret_vault_factory(writable=False)) + + assert record.key == "sk-legacy" + assert path.read_text() == before + + def test_a_secret_left_on_disk_outranks_a_stale_keychain_entry(self, isolated_home, secret_vault_factory): + """A failed keychain write leaves the fresh secret on disk while the vault still holds the + previous one; the next read must serve the file's secret and move it into the vault, never + resurrect the stale key or scrub the only copy of the fresh one.""" + path = _write_legacy_file(isolated_home, key="sk-fresh") + vault = secret_vault_factory(blob=_blob(key="sk-stale")) + + record = load_cli_token(vault=vault) + + assert record.key == "sk-fresh" + assert json.loads(vault.blob)["key"] == "sk-fresh" + assert "key" not in json.loads(path.read_text()) + + def test_a_login_the_file_could_not_record_is_the_one_that_gets_used( + self, isolated_home, secret_vault_factory + ): + """A login the keychain took and the file could not be pointed at afterwards leaves the + superseded secret sitting on disk in front of the fresh one. Serving the file's copy would + put a credential the user just replaced, and may well have just revoked, back into every + request, and would overwrite the keychain with it on the way past.""" + path = _write_legacy_file(isolated_home, key="sk-superseded", timestamp=1000.0) + vault = secret_vault_factory(blob=_blob(key="sk-fresh", timestamp=2000.0)) + + record = load_cli_token(vault=vault) + + assert record.key == "sk-fresh" + assert record.timestamp == 2000.0 + assert json.loads(vault.blob)["key"] == "sk-fresh" + assert "key" not in json.loads(path.read_text()) + + def test_a_secret_written_to_disk_after_the_keychain_entry_still_wins( + self, isolated_home, secret_vault_factory + ): + """The other direction of the same rule, which is the common one: a login that fell back to + the file because the keychain refused it is newer than whatever the keychain kept.""" + path = _write_legacy_file(isolated_home, key="sk-fresh", timestamp=2000.0) + vault = secret_vault_factory(blob=_blob(key="sk-stale", timestamp=1000.0)) + + record = load_cli_token(vault=vault) + + assert record.key == "sk-fresh" + assert json.loads(vault.blob)["key"] == "sk-fresh" + assert "key" not in json.loads(path.read_text()) + + def test_a_disk_secret_survives_when_the_stale_vault_refuses_the_rewrite( + self, isolated_home, secret_vault_factory + ): + path = _write_legacy_file(isolated_home, key="sk-fresh") + before = path.read_text() + + record = load_cli_token(vault=secret_vault_factory(blob=_blob(key="sk-stale"), writable=False)) + + assert record.key == "sk-fresh" + assert path.read_text() == before + + def test_legacy_file_survives_an_unreachable_vault_without_write_attempts( + self, isolated_home, secret_vault_factory + ): + path = _write_legacy_file(isolated_home) + before = path.read_text() + vault = secret_vault_factory(available=False) + + record = load_cli_token(vault=vault) + + assert record.key == "sk-legacy" + assert vault.writes == [] + assert path.read_text() == before + + def test_metadata_only_file_with_an_empty_vault_is_not_a_login(self, isolated_home, secret_vault_factory): + _write_metadata_only_file(isolated_home) + + assert load_cli_token(vault=secret_vault_factory()) is None + + def test_metadata_only_file_with_an_unreachable_vault_reports_a_missing_secret( + self, isolated_home, secret_vault_factory + ): + """The caller needs to tell "never logged in" apart from "locked keychain", so the record + comes back with no key rather than as None.""" + _write_metadata_only_file(isolated_home) + + record = load_cli_token(vault=secret_vault_factory(available=False)) + + assert record.key is None + assert record.user_id == "u-1" + + def test_a_secret_minted_for_another_server_is_never_handed_out(self, isolated_home, secret_vault_factory): + _write_metadata_only_file(isolated_home) + + assert load_cli_token(vault=secret_vault_factory(blob=_blob(base_url=OTHER_SERVER))) is None + + def test_a_secret_minted_for_another_server_loses_to_the_file(self, isolated_home, secret_vault_factory): + _write_legacy_file(isolated_home) + vault = secret_vault_factory(blob=_blob(base_url=OTHER_SERVER, key="sk-elsewhere")) + + record = load_cli_token(vault=vault) + + assert record.key == "sk-legacy" + assert json.loads(vault.blob)["key"] == "sk-legacy" + + def test_unreadable_vault_blob_falls_back_to_the_file_secret(self, isolated_home, secret_vault_factory): + _write_legacy_file(isolated_home) + + record = load_cli_token(vault=secret_vault_factory(blob="not json at all {{{")) + + assert record.key == "sk-legacy" + + def test_a_token_file_that_is_not_text_is_not_a_login(self, isolated_home, secret_vault_factory): + """A truncated write or a half-synced backup can leave bytes that are not UTF-8 at all. + Reading them must fail the way an absent file does, not crash every `lite` command.""" + path = _token_file(isolated_home) + path.parent.mkdir(parents=True, exist_ok=True) + path.write_bytes(b"\xff\xfe not utf-8 at all") + + assert load_cli_token(vault=secret_vault_factory()) is None + + def test_corrupt_token_file_is_not_a_login(self, isolated_home, secret_vault_factory): + _token_file(isolated_home).parent.mkdir() + _token_file(isolated_home).write_text("not json at all {{{") + + assert load_cli_token(vault=secret_vault_factory(blob=_blob())) is None + + +class TestGetLitellmGatewayApiKey: + def test_returns_the_vault_secret_when_the_origin_matches(self, isolated_home, secret_vault_factory): + _write_metadata_only_file(isolated_home) + + key = get_litellm_gateway_api_key(expected_base_url=SERVER, vault=secret_vault_factory(blob=_blob())) + + assert key == "sk-vault" + + def test_trailing_slash_on_the_expected_url_is_normalised(self, isolated_home, secret_vault_factory): + _write_metadata_only_file(isolated_home) + + key = get_litellm_gateway_api_key(expected_base_url=SERVER + "/", vault=secret_vault_factory(blob=_blob())) + + assert key == "sk-vault" + + def test_origin_mismatch_returns_nothing_without_reading_the_keychain(self, isolated_home, secret_vault_factory): + """Pointing the SDK at a different server must fail before the keychain is even consulted, + so a hostile base_url cannot provoke an unlock prompt.""" + _write_legacy_file(isolated_home) + vault = secret_vault_factory(blob=_blob()) + + assert get_litellm_gateway_api_key(expected_base_url=OTHER_SERVER, vault=vault) is None + assert vault.reads == 0 + + def test_no_token_file_returns_nothing(self, isolated_home, secret_vault_factory): + assert get_litellm_gateway_api_key(vault=secret_vault_factory(blob=_blob())) is None + + +class TestSaveCliToken: + def test_secret_goes_to_the_keychain_and_never_to_the_file(self, isolated_home, secret_vault_factory): + vault = secret_vault_factory() + + stored = save_cli_token( + CliTokenRecord(base_url=SERVER, key="sk-new", user_id="u-1", timestamp=time.time()), + vault=vault, + ) + + assert stored == SecretStored() + assert "sk-new" not in _token_file(isolated_home).read_text() + assert json.loads(vault.blob)["key"] == "sk-new" + assert load_cli_token(vault=vault).key == "sk-new" + + def test_falls_back_to_the_owner_only_file_when_there_is_no_keychain(self, isolated_home, secret_vault_factory): + stored = save_cli_token( + CliTokenRecord(base_url=SERVER, key="sk-new", timestamp=time.time()), + vault=secret_vault_factory(available=False), + ) + + path = _token_file(isolated_home) + assert stored == KeyringUnreachable() + assert json.loads(path.read_text())["key"] == "sk-new" + assert stat.S_IMODE(path.stat().st_mode) == 0o600 + assert list(path.parent.glob(".tmp-*")) == [] + + def test_creates_the_config_directory_owner_only(self, isolated_home, secret_vault_factory): + """A 0755 ~/.litellm lets any local process list, and in the fallback case read, the + credential's directory.""" + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-new"), vault=secret_vault_factory()) + + assert stat.S_IMODE((isolated_home / ".litellm").stat().st_mode) == 0o700 + + def test_tightens_a_directory_left_group_readable_by_an_older_cli(self, isolated_home, secret_vault_factory): + config_dir = isolated_home / ".litellm" + config_dir.mkdir(mode=0o755) + + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-new"), vault=secret_vault_factory()) + + assert stat.S_IMODE(config_dir.stat().st_mode) == 0o700 + + def test_a_credential_no_store_would_keep_is_reported_rather_than_raised( + self, isolated_home, secret_vault_factory, monkeypatch + ): + """`lite login` catches whatever escapes here and calls it an authentication failure, which + is the one thing that did not happen: the proxy minted a real credential. Saying so lets the + user act on the actual problem instead of retrying a sign-in that already worked.""" + + def _explode(*args, **kwargs): + raise OSError("read-only file system") + + monkeypatch.setattr("litellm.litellm_core_utils.private_json.json.dump", _explode) + + outcome = save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-new"), vault=secret_vault_factory()) + + assert isinstance(outcome, CredentialNotSaved) + assert "read-only file system" in outcome.detail + + def test_a_file_that_will_not_be_written_stops_the_save_before_the_keychain_is_touched( + self, isolated_home, secret_vault_factory, monkeypatch + ): + """The token file is what makes a keychain entry findable again, so it is staged first. + Handing the keychain a secret and only then finding out that nothing will point at it + would strand a live credential under a machine with no idea it is there.""" + vault = secret_vault_factory() + + def _explode(*args, **kwargs): + raise OSError("read-only file system") + + monkeypatch.setattr("litellm.litellm_core_utils.private_json.json.dump", _explode) + + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-new"), vault=vault) + + assert vault.blob is None + + @pytest.mark.skipif(os.geteuid() == 0, reason="root ignores directory permissions") + def test_a_login_that_cannot_be_saved_leaves_the_working_one_alone( + self, isolated_home, secret_vault_factory + ): + """Signing in again on a machine whose ~/.litellm has gone read-only must not cost the user + the credential they already had. Overwriting the keychain and then failing to record it, or + undoing that write afterwards, would take a login that still works out from under them.""" + _write_legacy_file(isolated_home, key=None) + vault = secret_vault_factory(blob=_blob(key="sk-in-use")) + path = _token_file(isolated_home) + path.parent.chmod(0o500) + try: + outcome = save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-new"), vault=vault) + finally: + path.parent.chmod(0o700) + + assert isinstance(outcome, CredentialNotSaved) + assert json.loads(vault.blob)["key"] == "sk-in-use" + assert load_cli_token(vault=vault).key == "sk-in-use" + + def test_a_keychain_write_the_file_cannot_be_pointed_at_is_reported_as_that( + self, isolated_home, secret_vault_factory + ): + """Staging the file can succeed and the replacement still fail, and that is the one path + where the keychain already took the new secret. Reporting it as a save that kept nothing + would send the user looking for a credential that is sitting in their keychain.""" + vault = secret_vault_factory() + path = _token_file(isolated_home) + path.parent.mkdir(parents=True, exist_ok=True) + path.mkdir() + + outcome = save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-new"), vault=vault) + + assert isinstance(outcome, CredentialNotRecorded) + assert json.loads(vault.blob)["key"] == "sk-new" + + def test_the_credential_the_file_cannot_name_is_left_in_the_keychain( + self, isolated_home, secret_vault_factory + ): + """The keychain holds one entry, so the secret that was there went the moment this one + landed. Taking the new one back out would turn a login this machine may still be able to + use into no login at all, and it cannot restore the old one either way.""" + vault = secret_vault_factory(blob=_blob(key="sk-in-use")) + path = _token_file(isolated_home) + path.parent.mkdir(parents=True, exist_ok=True) + path.mkdir() + + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-new"), vault=vault) + + assert vault.blob is not None + + def test_a_failed_write_leaves_the_previous_credential_intact(self, isolated_home, secret_vault_factory, monkeypatch): + path = _write_legacy_file(isolated_home) + before = path.read_text() + + def _explode(*args, **kwargs): + raise TypeError("not serialisable") + + monkeypatch.setattr("litellm.litellm_core_utils.private_json.json.dump", _explode) + + with pytest.raises(TypeError): + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-new"), vault=secret_vault_factory(available=False)) + + assert path.read_text() == before + assert list(path.parent.glob(".tmp-*")) == [] + + def test_a_login_is_stamped_past_the_one_it_replaces_even_on_a_clock_that_went_back( + self, isolated_home, secret_vault_factory + ): + """The stamp is what decides the keychain secret against the one on disk, so a login that + carries an earlier wall clock than the login before it must not be filed as the older of + the two.""" + _write_legacy_file(isolated_home, key="sk-old", timestamp=2000.0) + vault = secret_vault_factory() + + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-new", timestamp=1000.0), vault=vault) + + assert json.loads(vault.blob)["timestamp"] > 2000.0 + + def test_a_clock_that_went_back_does_not_hand_the_win_to_the_superseded_login( + self, isolated_home, secret_vault_factory + ): + """The disk state a login reports as CredentialNotRecorded: the keychain took the new + secret and the file still holds the previous one. Reading it back has to produce the login + that was just made, and an earlier wall clock is no reason to serve the one it replaced.""" + _write_legacy_file(isolated_home, key="sk-superseded", timestamp=2000.0) + vault = secret_vault_factory() + + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-fresh", timestamp=1000.0), vault=vault) + _write_legacy_file(isolated_home, key="sk-superseded", timestamp=2000.0) + + assert load_cli_token(vault=vault).key == "sk-fresh" + + def test_a_login_on_a_clock_that_moved_forwards_keeps_its_own_time( + self, isolated_home, secret_vault_factory + ): + """Pinning the stamp above the previous login is only ever a floor. The ordinary case has + to record when the user actually signed in, because that is what decides expiry.""" + _write_legacy_file(isolated_home, key="sk-old", timestamp=1000.0) + vault = secret_vault_factory() + + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-new", timestamp=2000.0), vault=vault) + + assert json.loads(vault.blob)["timestamp"] == 2000.0 + assert json.loads(_token_file(isolated_home).read_text())["timestamp"] == 2000.0 + + def test_a_login_is_stamped_past_the_keychain_the_file_could_not_keep_up_with( + self, isolated_home, secret_vault_factory + ): + """A login reported as CredentialNotRecorded leaves the keychain holding a later sign-in + than the file names, so the file alone is no longer the floor. A later login on a clock + that went back past that keychain entry still has to be the one served.""" + _write_legacy_file(isolated_home, key="sk-superseded", timestamp=1000.0) + vault = secret_vault_factory(blob=_blob(key="sk-recorded", timestamp=2000.0), writable=False) + + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-fresh", timestamp=1500.0), vault=vault) + + assert load_cli_token(vault=vault).key == "sk-fresh" + + +class TestScrubFailure: + """A keychain that took the secret while the file kept it is the worst of both stores: the + credential is live, it is in cleartext on disk, and every command reports success.""" + + @pytest.mark.skipif(os.geteuid() == 0, reason="root ignores directory permissions") + def test_a_file_that_will_not_give_its_copy_up_rolls_the_vault_write_back( + self, isolated_home, secret_vault_factory + ): + """Handing the keychain a copy without taking the file's away leaves the credential live in + two stores instead of one. A directory that permits neither the rewrite nor the delete, a + root-owned ~/.litellm left behind by a `sudo lite login`, must widen nothing.""" + path = _write_legacy_file(isolated_home) + vault = secret_vault_factory() + path.parent.chmod(0o500) + try: + record = load_cli_token(vault=vault) + finally: + path.parent.chmod(0o700) + + assert record.key == "sk-legacy" + assert json.loads(path.read_text())["key"] == "sk-legacy" + assert vault.blob is None + + def test_a_full_disk_stops_the_migration_before_the_keychain_is_handed_anything( + self, isolated_home, secret_vault_factory, monkeypatch + ): + """The scrubbed file is staged first precisely so this is knowable in advance. A disk that + cannot take the rewrite leaves the credential where it already was, in one store.""" + path = _write_legacy_file(isolated_home) + vault = secret_vault_factory() + + def _explode(*args, **kwargs): + raise OSError("no space left on device") + + monkeypatch.setattr("litellm.litellm_core_utils.private_json.json.dump", _explode) + + record = load_cli_token(vault=vault) + + assert record.key == "sk-legacy" + assert vault.blob is None + assert json.loads(path.read_text())["key"] == "sk-legacy" + assert list(path.parent.glob(".tmp-*")) == [] + + def test_a_rewrite_the_directory_refuses_is_finished_in_place( + self, isolated_home, secret_vault_factory, monkeypatch + ): + """Staging can succeed and the rewrite still fail afterwards, which is the one window where + both stores hold the credential. Shortening the file already there needs neither a second + file nor a cooperative directory, so the move finishes rather than handing the keychain copy + back and leaving the cleartext where it was.""" + path = _write_legacy_file(isolated_home) + vault = secret_vault_factory() + monkeypatch.setattr("litellm.litellm_core_utils.private_json.os.replace", _refuse_replace) + + record = load_cli_token(vault=vault) + + assert record.key == "sk-legacy" + assert vault.blob is not None + assert json.loads(path.read_text()).get("key") is None + assert list(path.parent.glob(".tmp-*")) == [] + + @pytest.mark.skipif(os.geteuid() == 0, reason="root ignores file permissions") + def test_a_rollback_the_keychain_refuses_is_finished_by_the_next_read( + self, isolated_home, secret_vault_factory, monkeypatch + ): + """A file that will take neither a replacement nor an overwrite, and a keychain that will not + give back what it just took, leave the credential in both stores. Nothing is lost by that, + and nothing is abandoned either: the next read carries the move the rest of the way, so the + duplicate outlives only the conditions that caused it.""" + path = _write_legacy_file(isolated_home) + vault = secret_vault_factory(erasable=False) + replace = _ReplaceThatStartsRefusing() + monkeypatch.setattr("litellm.litellm_core_utils.private_json.os.replace", replace) + path.chmod(0o400) + + assert load_cli_token(vault=vault).key == "sk-legacy" + assert vault.blob is not None + assert json.loads(path.read_text())["key"] == "sk-legacy" + + replace.allowed = True + path.chmod(0o600) + + assert load_cli_token(vault=vault).key == "sk-legacy" + assert json.loads(path.read_text()).get("key") is None + + +class TestClearCliToken: + def test_removes_the_credential_from_both_stores(self, isolated_home, secret_vault_factory): + vault = secret_vault_factory() + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-new"), vault=vault) + + assert clear_cli_token(vault=vault) == SecretErased() + assert vault.blob is None + assert not _token_file(isolated_home).exists() + assert load_cli_token(vault=vault) is None + + def test_reports_a_keychain_that_will_not_release_the_secret(self, isolated_home, secret_vault_factory): + _write_legacy_file(isolated_home) + vault = secret_vault_factory(blob=_blob(), erasable=False) + + assert clear_cli_token(vault=vault) == SecretStranded() + assert not _token_file(isolated_home).exists() + + def test_a_keychain_that_will_not_release_the_secret_still_ends_the_local_login( + self, isolated_home, secret_vault_factory + ): + """The warning this returns says the machine is logged out locally and the keychain entry is + what is left over. Keeping the file that names that entry makes the first half untrue: every + later command reads the credential straight back out of the keychain and keeps working.""" + _write_metadata_only_file(isolated_home) + vault = secret_vault_factory(blob=_blob(), erasable=False) + + assert clear_cli_token(vault=vault) == SecretStranded() + assert load_cli_token(vault=vault) is None + + @pytest.mark.parametrize( + "failure", [KeyringDisabled(), KeyringUnreachable(), KeyringNotInstalled()] + ) + def test_a_secret_in_the_file_is_no_evidence_about_a_keychain_that_exists( + self, isolated_home, secret_vault_factory, failure + ): + """Store a secret in the keychain, sign in again while the keychain is unusable so the new + secret lands in the file, then log out while it is still unusable. The file now carries its + own secret and the first login's entry is still there, so reading the file as proof of a + clean keychain reports a logout that did not happen. + + The three unusable states are the whole of what an erase can answer besides erased and + stranded; a backend that keeps nothing it is given is something only a write finds out.""" + _write_legacy_file(isolated_home) + vault = secret_vault_factory(available=False, failure=failure) + + assert clear_cli_token(vault=vault) == failure + assert json.loads(_token_file(isolated_home).read_text()).get("key") is None + + def test_a_second_logout_still_reports_the_keychain_it_could_not_clear( + self, isolated_home, secret_vault_factory + ): + """The first logout deletes the file and tells the user to run it again once the keychain is + reachable. If the second run reads that missing file as proof of a clean keychain, the advice + turns into the very false all-clear it was issued to prevent.""" + _write_metadata_only_file(isolated_home) + vault = secret_vault_factory(available=False, failure=KeyringUnreachable()) + + assert clear_cli_token(vault=vault) == KeyringUnreachable() + assert clear_cli_token(vault=vault) == KeyringUnreachable() + + def test_logout_from_an_install_without_keyring_does_not_claim_the_keychain_is_clear( + self, isolated_home, secret_vault_factory + ): + """A file holding only metadata put its secret in a keychain by definition. Losing the + package that reaches it does not take the entry with it, so this cannot report success.""" + _write_metadata_only_file(isolated_home) + vault = secret_vault_factory(available=False, failure=KeyringNotInstalled()) + + assert clear_cli_token(vault=vault) == KeyringNotInstalled() + assert json.loads(_token_file(isolated_home).read_text()).get("key") is None + + def test_a_logout_that_cannot_clear_the_keychain_keeps_the_record_that_it_has_to( + self, isolated_home, secret_vault_factory + ): + """The file left behind holds no secret. It is what a later run reads to tell a machine with + a credential it cannot reach apart from one that never had a login, which is the difference + between warning the user and inventing a credential for them to worry about.""" + _write_metadata_only_file(isolated_home) + vault = secret_vault_factory(available=False, failure=KeyringUnreachable()) + + clear_cli_token(vault=vault) + + assert json.loads(_token_file(isolated_home).read_text()).get("key") is None + + def test_a_logout_that_cannot_clear_the_keychain_still_takes_the_file_secret_away( + self, isolated_home, secret_vault_factory + ): + """Keeping a record of the unreachable keychain must never mean keeping the cleartext copy + the user just asked to be rid of.""" + _write_legacy_file(isolated_home) + vault = secret_vault_factory(available=False, failure=KeyringUnreachable()) + + clear_cli_token(vault=vault) + + assert "sk-legacy" not in _token_file(isolated_home).read_text() + + def test_a_repeat_logout_never_answers_its_own_warning_with_an_all_clear( + self, isolated_home, secret_vault_factory + ): + """Sign in while the keychain works, sign in again once it has gone out of reach so the + second secret lands in the file, then log out twice. The first logout cannot say the first + login's entry is gone, and says so. If the second one reads the file the first one took + away as proof of a clean keychain, it retracts that warning while the credential behind it + is still live.""" + vault = secret_vault_factory() + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-first"), vault=vault) + vault.available = False + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-second"), vault=vault) + + assert clear_cli_token(vault=vault) == KeyringUnreachable() + assert clear_cli_token(vault=vault) == KeyringUnreachable() + assert vault.blob is not None + assert "sk-second" not in _token_file(isolated_home).read_text() + + @pytest.mark.parametrize("failure", [KeyringNotInstalled(), KeyringDisabled(), KeyringUnreachable()]) + def test_logging_out_of_a_machine_that_never_logged_in_invents_nothing_to_warn_about( + self, isolated_home, secret_vault_factory, failure + ): + """`lite logout` with no token file has nothing to end. Warning that a credential may be + stranded in a keychain it cannot check sends the user after something that was never there, + and `pip install keyring` will not make it appear.""" + vault = secret_vault_factory(available=False, failure=failure) + + assert clear_cli_token(vault=vault) == SecretErased() + + def test_a_file_backed_login_cannot_vouch_for_a_keychain_no_package_can_reach( + self, isolated_home, secret_vault_factory + ): + """Sign in with the keyring package installed, lose the package, then sign in again so the + second secret lands in the file. The first login's entry outlives both, and the file that + replaced it holds a secret of its own, which is the shape a logout must not read as proof + that no keychain was ever involved.""" + vault = secret_vault_factory() + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-keychain"), vault=vault) + vault.available = False + vault.failure = KeyringNotInstalled() + save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-in-file"), vault=vault) + + assert clear_cli_token(vault=vault) == KeyringNotInstalled() + assert vault.blob is not None + assert "sk-in-file" not in _token_file(isolated_home).read_text() + + @pytest.mark.skipif(os.geteuid() == 0, reason="root ignores file permissions") + def test_a_file_that_gives_up_neither_its_secret_nor_itself_is_reported_not_raised( + self, isolated_home, secret_vault_factory + ): + """A `~/.litellm` gone read-only refuses the staged rewrite and the removal, and a token file + left read-only with it, as a `sudo lite login` leaves both, refuses the overwrite too. The + credential is still readable on disk, which is the one thing logging out is for, so it has to + come back as an answer rather than as a traceback the user has to read the code to + understand.""" + path = _write_legacy_file(isolated_home) + path.chmod(0o400) + path.parent.chmod(0o500) + try: + outcome = clear_cli_token(vault=secret_vault_factory()) + finally: + path.parent.chmod(0o700) + path.chmod(0o600) + + assert isinstance(outcome, CredentialNotCleared) + assert json.loads(path.read_text())["key"] == "sk-legacy" + + @pytest.mark.skipif(os.geteuid() == 0, reason="root ignores directory permissions") + def test_a_directory_that_takes_no_new_file_still_gives_up_the_secret_in_the_old_one( + self, isolated_home, secret_vault_factory + ): + """A read-only `~/.litellm` accepts no replacement token file and no removal of the one it + has, and still lets that one be shortened. The secret goes, the file stays as the note that + the keychain went unchecked, and the logout after it warns again instead of reading the gap + the removal would have left as a clean keychain. + + The key is a realistic length so the file genuinely shrinks: a rewrite in place that leaves + the tail of the old contents behind hands the next run a file it cannot parse.""" + path = _write_legacy_file(isolated_home, key="sk-" + "a" * 700) + vault = secret_vault_factory(available=False, failure=KeyringUnreachable()) + path.parent.chmod(0o500) + try: + assert clear_cli_token(vault=vault) == KeyringUnreachable() + assert clear_cli_token(vault=vault) == KeyringUnreachable() + finally: + path.parent.chmod(0o700) + + assert json.loads(path.read_text()).get("key") is None + + @pytest.mark.skipif(os.geteuid() == 0, reason="root ignores file permissions") + def test_a_note_the_logout_had_to_remove_is_written_again_for_the_next_one( + self, isolated_home, secret_vault_factory, monkeypatch + ): + """A full disk refuses the replacement file and a read-only token file refuses the rewrite + in place, so the only way left to get the secret off disk is to remove the file carrying it. + That file was also the note saying the keychain went unchecked, and its absence is what the + next logout would read as a keychain already known to be clean. + + Removing it is what frees the room the replacement was refused for, so the note is written + again on the way out and the logout after this one still warns.""" + path = _write_legacy_file(isolated_home) + path.chmod(0o400) + monkeypatch.setattr( + "litellm.litellm_core_utils.private_json.tempfile.mkstemp", + _MkstempThatNeedsTheOldFileGone(path), + ) + vault = secret_vault_factory(available=False, failure=KeyringUnreachable()) + + assert clear_cli_token(vault=vault) == KeyringUnreachable() + assert clear_cli_token(vault=vault) == KeyringUnreachable() + + assert json.loads(path.read_text()).get("key") is None + + @pytest.mark.skipif(os.geteuid() == 0, reason="root ignores directory permissions") + def test_a_metadata_file_that_will_not_go_is_not_worth_alarming_the_user_over( + self, isolated_home, secret_vault_factory + ): + """The secret was in the keychain and the keychain gave it up. What is stuck on disk names a + credential that no longer exists, so the logout it describes really did happen.""" + path = _write_metadata_only_file(isolated_home) + path.parent.chmod(0o500) + try: + outcome = clear_cli_token(vault=secret_vault_factory(blob=_blob())) + finally: + path.parent.chmod(0o700) + + assert outcome == SecretErased() + + def test_is_safe_when_nothing_was_ever_stored(self, isolated_home, secret_vault_factory): + assert clear_cli_token(vault=secret_vault_factory()) == SecretErased() + + +class TestIsCliTokenFresh: + def test_a_just_issued_token_is_fresh(self): + assert is_cli_token_fresh(CliTokenRecord(timestamp=time.time())) is True + + def test_a_token_past_its_expiry_is_stale(self): + stale = CliTokenRecord(timestamp=time.time() - (CLI_JWT_EXPIRATION_HOURS + 1) * 3600) + + assert is_cli_token_fresh(stale) is False + + def test_the_buffer_retires_a_token_just_before_it_expires(self): + almost = CliTokenRecord(timestamp=time.time() - (CLI_JWT_EXPIRATION_HOURS * 3600 - 60)) + + assert is_cli_token_fresh(almost, buffer_hours=0.1) is False + + def test_a_stamp_left_in_the_future_keeps_reporting_fresh_until_the_clock_catches_up(self): + """The stamp both orders the two stores and drives this shortcut, so a store left stamped + ahead of the clock hands that stamp to the next sign-in and keeps it looking fresh past the + expiry the gateway will actually enforce. Pinning that here so the shared stamp cannot stop + being a deliberate trade without this failing first.""" + ahead = CliTokenRecord(timestamp=time.time() + CLI_JWT_EXPIRATION_HOURS * 3600) + + assert is_cli_token_fresh(ahead) is True + + +class _FakeKeyringModule: + def __init__(self, stored=None, *, get_error=None, set_error=None, delete_error=None, discard=False): + self.stored = stored + self.get_error = get_error + self.set_error = set_error + self.delete_error = delete_error + self.discard = discard + self.calls = [] + + def get_password(self, service_name, username): + self.calls.append(("get", service_name, username)) + if self.get_error is not None: + raise self.get_error + return self.stored + + def set_password(self, service_name, username, password): + self.calls.append(("set", service_name, username)) + if self.set_error is not None: + raise self.set_error + if self.discard or username != KEYRING_ACCOUNT: + return + self.stored = password + + def delete_password(self, service_name, username): + self.calls.append(("delete", service_name, username)) + if self.delete_error is not None: + raise self.delete_error + if username == KEYRING_ACCOUNT: + self.stored = None + + +class _NeverAnsweringKeyringModule(_FakeKeyringModule): + """A keychain whose writes block instead of returning, the way macOS does under a HOME that + has no usable login keychain.""" + + def __init__(self): + super().__init__() + self.blocked = threading.Event() + + def set_password(self, service_name, username, password): + self.calls.append(("set", service_name, username)) + self.blocked.set() + threading.Event().wait() + + +class _KeychainHeldByABlockedWrite(_NeverAnsweringKeyringModule): + """The same keychain, plus what the blocked write does to everything after it: the stuck call + holds the keychain, so every later read blocks behind it too.""" + + def get_password(self, service_name, username): + self.calls.append(("get", service_name, username)) + if self.blocked.is_set(): + threading.Event().wait() + return self.stored + + +def _answered_within(seconds, call): + answers = [] + worker = threading.Thread(target=lambda: answers.append(call()), daemon=True) + worker.start() + worker.join(seconds) + assert not worker.is_alive(), f"{call.__qualname__} never returned" + return answers[0] + + +@pytest.fixture +def install_fake_keyring(monkeypatch): + def _install(fake): + monkeypatch.delenv(DISABLE_KEYRING_ENV_VAR, raising=False) + monkeypatch.setitem(sys.modules, "keyring", fake) + return fake + + return _install + + +class TestKeyringVault: + def test_round_trips_through_the_installed_keyring(self, install_fake_keyring): + fake = install_fake_keyring(_FakeKeyringModule()) + vault = KeyringVault() + + assert vault.write("blob-1") == SecretStored() + assert vault.read() == SecretFound("blob-1") + assert vault.erase() == SecretErased() + assert vault.read() == SecretMissing() + assert {call[1] for call in fake.calls} == {KEYRING_SERVICE} + assert {call[2] for call in fake.calls} == {KEYRING_ACCOUNT, KEYRING_PREFLIGHT_ACCOUNT} + + def test_the_kill_switch_reports_no_keychain(self, monkeypatch): + """`LITELLM_CLI_DISABLE_KEYRING` has to work without importing keyring, because keyring + caches its backend on first use and cannot be reconfigured later. Erase still fails: a + credential stored before the switch was set may be in the keychain, and with reads + disabled `lite logout` cannot verify it is gone, so it must say so instead.""" + monkeypatch.setenv(DISABLE_KEYRING_ENV_VAR, "1") + vault = KeyringVault() + + assert vault.read() == KeyringDisabled() + assert vault.write("blob-1") == KeyringDisabled() + assert vault.erase() == KeyringDisabled() + + def test_an_uninstalled_keyring_library_degrades_to_the_file(self, monkeypatch): + """keyring is an optional extra, so the SDK must survive its absence rather than raise on + the hot path. Erase cannot succeed: the entry belongs to the OS and outlives the package, + so an install without it is not evidence that the keychain is empty.""" + monkeypatch.delenv(DISABLE_KEYRING_ENV_VAR, raising=False) + monkeypatch.setitem(sys.modules, "keyring", None) + vault = KeyringVault() + + assert vault.read() == KeyringNotInstalled() + assert vault.write("blob-1") == KeyringNotInstalled() + assert vault.erase() == KeyringNotInstalled() + + def test_a_locked_keychain_is_reported_not_raised(self, install_fake_keyring): + install_fake_keyring(_FakeKeyringModule(get_error=RuntimeError("keyring is locked"))) + + assert KeyringVault().read() == KeyringUnreachable() + + def test_a_refused_write_is_reported_not_raised(self, install_fake_keyring): + install_fake_keyring(_FakeKeyringModule(set_error=RuntimeError("no backend"))) + + assert KeyringVault().write("blob-1") == KeyringUnreachable() + + def test_a_refused_delete_is_reported_so_logout_can_warn(self, install_fake_keyring): + install_fake_keyring(_FakeKeyringModule(stored="blob-1", delete_error=RuntimeError("locked"))) + + assert KeyringVault().erase() == SecretStranded() + + def test_a_backend_that_keeps_nothing_is_not_a_successful_write(self, install_fake_keyring): + """keyring's null backend accepts every write, stores nothing, and raises nothing to say so. + Taking its silence for success is how a credential gets deleted: the caller drops its own + copy on our word. Only reading the value back tells the two apart.""" + fake = install_fake_keyring(_FakeKeyringModule(discard=True)) + + assert KeyringVault().write("blob-1") == KeyringDiscardsWrites() + assert fake.stored is None + + def test_a_keychain_that_never_answers_does_not_hang_the_login(self, install_fake_keyring): + """macOS derives the login keychain from `$HOME`, and `set_password` under a HOME with no + usable one blocks forever with no timeout of its own. Containers, CI images, `sudo -H`, and + service accounts all run there, and `lite login` never touched a keychain before this, so a + sign-in that simply never returns would be a new way for it to fail.""" + fake = install_fake_keyring(_NeverAnsweringKeyringModule()) + vault = KeyringVault(preflight_timeout_seconds=0.2) + + started = time.monotonic() + outcome = vault.write("blob-1") + + assert outcome == KeyringUnreachable() + assert time.monotonic() - started < 5 + assert fake.blocked.is_set() + + def test_a_keychain_that_never_answers_is_never_handed_the_credential(self, install_fake_keyring): + """Giving up on the write is only safe if the secret was never the thing being written. A + blocked call can still land later, and a keychain copy nobody waited for would sit beside + the file copy the user was told about.""" + fake = install_fake_keyring(_NeverAnsweringKeyringModule()) + + KeyringVault(preflight_timeout_seconds=0.2).write("blob-1") + + assert [call[2] for call in fake.calls] == [KEYRING_PREFLIGHT_ACCOUNT] + + def test_a_keychain_that_stopped_answering_is_not_asked_again(self, install_fake_keyring): + """The write that timed out is still holding the keychain when we give up on it, so the + call after it is the one that hangs, and read has nothing to time out against. Anything + resolving the credential more than once in a process hits that: an SDK client built twice + pays the pre-flight timeout on the first build and never returns from the second.""" + install_fake_keyring(_KeychainHeldByABlockedWrite()) + vault = KeyringVault(preflight_timeout_seconds=0.05) + + assert vault.write("blob-1") == KeyringUnreachable() + + assert _answered_within(5, vault.read) == KeyringUnreachable() + assert _answered_within(5, vault.erase) == KeyringUnreachable() + assert _answered_within(5, lambda: vault.write("blob-2")) == KeyringUnreachable() + + def test_a_keychain_that_stopped_answering_leaves_the_credential_in_the_file( + self, isolated_home, install_fake_keyring + ): + """The end of the same story: giving up on the keychain has to leave a login that still + works, and loading it back must not go asking the keychain that already stopped answering.""" + install_fake_keyring(_KeychainHeldByABlockedWrite()) + vault = KeyringVault(preflight_timeout_seconds=0.05) + + outcome = save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-only-copy"), vault=vault) + + assert outcome == KeyringUnreachable() + assert _answered_within(5, lambda: load_cli_token(vault=vault)).key == "sk-only-copy" + + def test_a_login_survives_a_keychain_that_never_answers(self, isolated_home, install_fake_keyring): + """The end of the same story: the credential still has to be usable afterwards.""" + install_fake_keyring(_NeverAnsweringKeyringModule()) + + outcome = save_cli_token( + CliTokenRecord(base_url=SERVER, key="sk-only-copy"), + vault=KeyringVault(preflight_timeout_seconds=0.2), + ) + + assert outcome == KeyringUnreachable() + assert json.loads(_token_file(isolated_home).read_text())["key"] == "sk-only-copy" + + def test_the_real_null_backend_is_rejected(self, monkeypatch): + """Pinned against the actual library rather than the double above, because the whole risk is + that upstream's no-op write looks exactly like a successful one.""" + keyring = pytest.importorskip("keyring") + null_backend = pytest.importorskip("keyring.backends.null") + monkeypatch.delenv(DISABLE_KEYRING_ENV_VAR, raising=False) + previous = keyring.get_keyring() + keyring.set_keyring(null_backend.Keyring()) + try: + assert KeyringVault().write("blob-1") == KeyringDiscardsWrites() + finally: + keyring.set_keyring(previous) + + def test_a_credential_survives_a_backend_that_keeps_nothing( + self, isolated_home, install_fake_keyring + ): + """The end of the same story: the credential must still be usable afterwards. Reporting the + discard is only worth anything if the token file then keeps the copy the keychain refused.""" + install_fake_keyring(_FakeKeyringModule(discard=True)) + + outcome = save_cli_token(CliTokenRecord(base_url=SERVER, key="sk-only-copy")) + + assert outcome == KeyringDiscardsWrites() + assert json.loads(_token_file(isolated_home).read_text())["key"] == "sk-only-copy" + assert load_cli_token().key == "sk-only-copy" + + def test_erasing_a_locked_keychain_is_a_failure(self, install_fake_keyring): + install_fake_keyring(_FakeKeyringModule(get_error=RuntimeError("locked"))) + + assert KeyringVault().erase() == KeyringUnreachable() class TestIsCliTokenFreshWithExpiresAt: diff --git a/tests/test_litellm/litellm_core_utils/test_private_json.py b/tests/test_litellm/litellm_core_utils/test_private_json.py new file mode 100644 index 00000000000..cedff61959f --- /dev/null +++ b/tests/test_litellm/litellm_core_utils/test_private_json.py @@ -0,0 +1,37 @@ +import json +import os +import stat + +import pytest + +from litellm.litellm_core_utils.private_json import overwrite_private_json, write_private_json + + +class TestOverwritePrivateJson: + def test_replaces_the_contents_of_the_file_already_there(self, tmp_path): + path = tmp_path / "token.json" + write_private_json(str(path), {"key": "sk-" + "a" * 700}) + + overwrite_private_json(str(path), {"user_id": "u-1"}) + + assert json.loads(path.read_text()) == {"user_id": "u-1"} + + def test_refuses_to_create_the_file_it_was_asked_to_rewrite(self, tmp_path): + """This is the one writer that does not go through a private temp file, so a path it creates + would land with whatever the umask allows. Refusing keeps it unable to put a world-readable + file where the caller believed a private one already was.""" + path = tmp_path / "token.json" + + with pytest.raises(FileNotFoundError): + overwrite_private_json(str(path), {"user_id": "u-1"}) + + assert not path.exists() + + @pytest.mark.skipif(os.geteuid() == 0, reason="root ignores file permissions") + def test_keeps_the_owner_only_mode_the_file_was_created_with(self, tmp_path): + path = tmp_path / "token.json" + write_private_json(str(path), {"key": "sk-live"}) + + overwrite_private_json(str(path), {"user_id": "u-1"}) + + assert stat.S_IMODE(path.stat().st_mode) == 0o600 diff --git a/tests/test_litellm/proxy/client/cli/test_agents.py b/tests/test_litellm/proxy/client/cli/test_agents.py index a23c573047f..c2858c84c6d 100644 --- a/tests/test_litellm/proxy/client/cli/test_agents.py +++ b/tests/test_litellm/proxy/client/cli/test_agents.py @@ -672,8 +672,9 @@ class TestAgentCommands: assert "LITELLM_PROXY_API_KEY" in result.output mock_run.assert_not_called() - def test_interactive_without_key_logs_in_then_launches(self): + def test_interactive_without_key_logs_in_then_launches(self, secret_vault_factory): captured = {} + vault = secret_vault_factory() @click.command() def fake_login(): @@ -695,12 +696,12 @@ class TestAgentCommands: result = self.runner.invoke( _agent_command("claude"), [], - obj={"base_url": "http://localhost:4000", "api_key": None}, + obj={"base_url": "http://localhost:4000", "api_key": None, "secret_vault": vault}, ) assert result.exit_code == 0, result.output assert captured["api_key"] == "sk-after-login" - mock_get.assert_called_once_with(expected_base_url="http://localhost:4000") + mock_get.assert_called_once_with(expected_base_url="http://localhost:4000", vault=vault) def test_child_exit_code_reaches_the_shell(self): with patch(f"{AGENTS_MODULE}.run_agent", side_effect=SystemExit(42)): diff --git a/tests/test_litellm/proxy/client/cli/test_auth_commands.py b/tests/test_litellm/proxy/client/cli/test_auth_commands.py index c494cf8b45b..eb40f54a1f3 100644 --- a/tests/test_litellm/proxy/client/cli/test_auth_commands.py +++ b/tests/test_litellm/proxy/client/cli/test_auth_commands.py @@ -4,7 +4,7 @@ import stat import sys import time from pathlib import Path -from unittest.mock import Mock, mock_open, patch +from unittest.mock import Mock, patch sys.path.insert(0, os.path.abspath("../../..")) # Adds the parent directory to the system path @@ -13,21 +13,50 @@ import pytest from click.testing import CliRunner from litellm.constants import CLI_JWT_EXPIRATION_HOURS +from litellm.litellm_core_utils.cli_keyring import ( + DISABLE_KEYRING_ENV_VAR, + KeyringDisabled, + KeyringNotInstalled, + SecretErased, + SecretStored, +) +from litellm.litellm_core_utils.cli_token_utils import CliTokenRecord, save_cli_token from litellm.proxy.client.cli import cli from litellm.proxy.client.cli.commands.auth import ( - clear_token, get_stored_api_key, - get_token_file_path, - load_token, login, logout, print_token, - save_token, whoami, ) from litellm.proxy.client.cli.commands.claude_settings import SettingsFileOwner +@pytest.fixture +def isolated_home(monkeypatch, tmp_path): + monkeypatch.setenv("HOME", str(tmp_path)) + monkeypatch.setenv("USERPROFILE", str(tmp_path)) + monkeypatch.delenv("LITELLM_PROXY_URL", raising=False) + monkeypatch.delenv("LITELLM_PROXY_API_KEY", raising=False) + return tmp_path + + +def _write_home_json(home: Path, filename: str, payload: dict[str, object]) -> None: + litellm_dir = home / ".litellm" + litellm_dir.mkdir(exist_ok=True) + (litellm_dir / filename).write_text(json.dumps(payload)) + + +def _write_token_file(home: Path, *, key: str | None) -> None: + """A stored login: `key=None` is the metadata half of a keychain-backed pair, a key is a file-backed one.""" + payload: dict[str, object] = {"base_url": "https://test.example.com", "user_id": "u-1", "timestamp": time.time()} + _write_home_json(home, "token.json", payload if key is None else {**payload, "key": key}) + + +def _secret_blob(base_url: str, key: str) -> str: + return json.dumps({"base_url": base_url, "key": key, "jwt_token": ""}) + + def _mock_cli_sso_start_response( login_id: str = "cli-session-uuid-456", poll_secret: str = "poll-secret", @@ -176,196 +205,50 @@ class TestStartCliSsoFlowErrors: assert "https://unreachable.example.com/sso/cli/start" in message -class TestTokenUtilities: - """Test token file utility functions""" +class TestStoredApiKeyLookup: + """`get_stored_api_key` is what every other `lite` subcommand authenticates with, so the + keychain split and the origin check both have to be invisible to it.""" - def test_get_token_file_path(self): - """Test getting token file path""" - with ( - patch("pathlib.Path.home") as mock_home, - patch("pathlib.Path.mkdir") as mock_mkdir, - ): - mock_home.return_value = Path("/home/user") + def test_returns_the_secret_the_keychain_holds(self, isolated_home, secret_vault_factory): + _write_home_json(isolated_home, "token.json", {"base_url": "https://real-proxy.com", "user_id": "u-1"}) + vault = secret_vault_factory(blob=_secret_blob("https://real-proxy.com", "sk-from-keychain")) - result = get_token_file_path() + assert get_stored_api_key(vault=vault) == "sk-from-keychain" - assert result == "/home/user/.litellm/token.json" - mock_mkdir.assert_not_called() + def test_returns_a_legacy_plaintext_key(self, isolated_home, secret_vault_factory): + _write_home_json(isolated_home, "token.json", {"base_url": "https://real-proxy.com", "key": "sk-legacy"}) - def test_reading_the_token_never_creates_the_config_directory(self, tmp_path): - """Every `lite` invocation reads the token; only saving one may touch ~/.litellm""" - with patch("pathlib.Path.home", return_value=tmp_path): - assert load_token() is None - assert not (tmp_path / ".litellm").exists() - save_token({"key": "sk-test"}) - assert load_token() == {"key": "sk-test"} + assert get_stored_api_key(vault=secret_vault_factory()) == "sk-legacy" - def test_save_token(self, tmp_path): - """Test saving token data to file""" - token_data = { - "key": "test-key", - "user_id": "test-user", - "timestamp": 1234567890, - } - token_file = tmp_path / "token.json" + def test_no_token_at_all_returns_nothing(self, isolated_home, secret_vault_factory): + assert get_stored_api_key(vault=secret_vault_factory()) is None - with patch("litellm.proxy.client.cli.commands.auth.get_token_file_path") as mock_path: - mock_path.return_value = str(token_file) + def test_metadata_without_a_secret_returns_nothing(self, isolated_home, secret_vault_factory): + _write_home_json(isolated_home, "token.json", {"base_url": "https://real-proxy.com", "user_id": "u-1"}) - save_token(token_data) + assert get_stored_api_key(vault=secret_vault_factory()) is None - assert json.loads(token_file.read_text()) == token_data - assert stat.S_IMODE(token_file.stat().st_mode) == 0o600 + def test_matching_base_url_returns_the_key(self, isolated_home, secret_vault_factory): + _write_home_json(isolated_home, "token.json", {"base_url": "https://real-proxy.com", "key": "sk-prod"}) - def test_load_token_success(self): - """Test loading token data from file successfully""" - token_data = { - "key": "test-key", - "user_id": "test-user", - "timestamp": 1234567890, - } + assert get_stored_api_key("https://real-proxy.com", vault=secret_vault_factory()) == "sk-prod" - with ( - patch("builtins.open", mock_open(read_data=json.dumps(token_data))), - patch("litellm.proxy.client.cli.commands.auth.get_token_file_path") as mock_path, - patch("os.path.exists", return_value=True), - ): - mock_path.return_value = "/test/path/token.json" + def test_trailing_slash_on_the_expected_url_is_normalised(self, isolated_home, secret_vault_factory): + _write_home_json(isolated_home, "token.json", {"base_url": "https://real-proxy.com", "key": "sk-prod"}) - result = load_token() + assert get_stored_api_key("https://real-proxy.com/", vault=secret_vault_factory()) == "sk-prod" - assert result == token_data + def test_mismatched_base_url_withholds_the_key(self, isolated_home, secret_vault_factory): + _write_home_json(isolated_home, "token.json", {"base_url": "https://real-proxy.com", "key": "sk-prod"}) - def test_load_token_file_not_exists(self): - """Test loading token when file doesn't exist""" - with ( - patch("litellm.proxy.client.cli.commands.auth.get_token_file_path") as mock_path, - patch("os.path.exists", return_value=False), - ): - mock_path.return_value = "/test/path/token.json" + assert get_stored_api_key("https://evil.com", vault=secret_vault_factory()) is None - result = load_token() + def test_old_tokens_without_a_base_url_are_rejected_when_an_origin_is_expected( + self, isolated_home, secret_vault_factory + ): + _write_home_json(isolated_home, "token.json", {"key": "sk-old-token"}) - assert result is None - - def test_load_token_json_decode_error(self): - """Test loading token with invalid JSON""" - with ( - patch("builtins.open", mock_open(read_data="invalid json")), - patch("litellm.proxy.client.cli.commands.auth.get_token_file_path") as mock_path, - patch("os.path.exists", return_value=True), - ): - mock_path.return_value = "/test/path/token.json" - - result = load_token() - - assert result is None - - def test_load_token_io_error(self): - """Test loading token with IO error""" - with ( - patch("builtins.open", side_effect=OSError("Permission denied")), - patch("litellm.proxy.client.cli.commands.auth.get_token_file_path") as mock_path, - patch("os.path.exists", return_value=True), - ): - mock_path.return_value = "/test/path/token.json" - - result = load_token() - - assert result is None - - def test_clear_token_file_exists(self): - """Test clearing token when file exists""" - with ( - patch("litellm.proxy.client.cli.commands.auth.get_token_file_path") as mock_path, - patch("os.path.exists", return_value=True), - patch("os.remove") as mock_remove, - ): - mock_path.return_value = "/test/path/token.json" - - clear_token() - - mock_remove.assert_called_once_with("/test/path/token.json") - - def test_clear_token_file_not_exists(self): - """Test clearing token when file doesn't exist""" - with ( - patch("litellm.proxy.client.cli.commands.auth.get_token_file_path") as mock_path, - patch("os.path.exists", return_value=False), - patch("os.remove") as mock_remove, - ): - mock_path.return_value = "/test/path/token.json" - - clear_token() - - mock_remove.assert_not_called() - - def test_get_stored_api_key_success(self): - """Test getting stored API key successfully""" - token_data = {"key": "test-api-key-123", "user_id": "test-user"} - - with patch( - "litellm.proxy.client.cli.commands.auth.load_token", - return_value=token_data, - ): - result = get_stored_api_key() - assert result == "test-api-key-123" - - def test_get_stored_api_key_no_token(self): - """Test getting stored API key when no token exists""" - with patch( - "litellm.proxy.client.cli.commands.auth.load_token", - return_value=None, - ): - result = get_stored_api_key() - assert result is None - - def test_get_stored_api_key_no_key_field(self): - """Test getting stored API key when token has no key field""" - token_data = {"user_id": "test-user"} - - with patch( - "litellm.proxy.client.cli.commands.auth.load_token", - return_value=token_data, - ): - result = get_stored_api_key() - assert result is None - - def test_get_stored_api_key_base_url_match(self): - """Stored key is returned when expected_base_url matches stored origin""" - token_data = {"key": "sk-prod", "base_url": "https://real-proxy.com"} - with patch( - "litellm.proxy.client.cli.commands.auth.load_token", - return_value=token_data, - ): - assert get_stored_api_key(expected_base_url="https://real-proxy.com") == "sk-prod" - - def test_get_stored_api_key_base_url_match_trailing_slash(self): - """Trailing slash on expected_base_url is normalised before comparison""" - token_data = {"key": "sk-prod", "base_url": "https://real-proxy.com"} - with patch( - "litellm.proxy.client.cli.commands.auth.load_token", - return_value=token_data, - ): - assert get_stored_api_key(expected_base_url="https://real-proxy.com/") == "sk-prod" - - def test_get_stored_api_key_base_url_mismatch(self): - """Stored key is NOT returned when expected_base_url differs from stored origin""" - token_data = {"key": "sk-prod", "base_url": "https://real-proxy.com"} - with patch( - "litellm.proxy.client.cli.commands.auth.load_token", - return_value=token_data, - ): - assert get_stored_api_key(expected_base_url="https://evil.com") is None - - def test_get_stored_api_key_old_token_no_base_url(self): - """Old tokens without a base_url field are rejected when origin check is requested""" - token_data = {"key": "sk-old-token"} - with patch( - "litellm.proxy.client.cli.commands.auth.load_token", - return_value=token_data, - ): - assert get_stored_api_key(expected_base_url="https://real-proxy.com") is None + assert get_stored_api_key("https://real-proxy.com", vault=secret_vault_factory()) is None class TestLoginCommand: @@ -399,7 +282,7 @@ class TestLoginCommand: patch("requests.get", return_value=mock_response), patch("litellm.proxy.client.cli.commands.auth.requests.Session", _FakeSession), patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=_pkce_record()), - patch("litellm.proxy.client.cli.commands.auth.save_token") as mock_save, + patch("litellm.proxy.client.cli.commands.auth.save_token", return_value=SecretStored()) as mock_save, patch("litellm.proxy.client.cli.interface.show_commands"), ): result = self.runner.invoke(login, obj={"base_url": "https://test.example.com"}) @@ -438,7 +321,7 @@ class TestLoginCommand: return_value=_mock_cli_sso_start_response(login_id="cli-test-uuid-123"), ) as mock_post, patch("requests.get", return_value=mock_response) as mock_get, - patch("litellm.proxy.client.cli.commands.auth.save_token") as mock_save, + patch("litellm.proxy.client.cli.commands.auth.save_cli_token") as mock_save, patch("litellm.proxy.client.cli.interface.show_commands") as mock_show_commands, ): result = self.runner.invoke(login, obj=mock_context.obj) @@ -460,8 +343,8 @@ class TestLoginCommand: # Verify JWT was saved mock_save.assert_called_once() saved_data = mock_save.call_args[0][0] - assert saved_data["key"] == "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.test.jwt" - assert saved_data["user_id"] == "test-user-123" + assert saved_data.key == "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.test.jwt" + assert saved_data.user_id == "test-user-123" # Verify commands were shown mock_show_commands.assert_called_once() @@ -591,14 +474,121 @@ class TestLogoutCommand: """Setup for each test""" self.runner = CliRunner() - def test_logout_success(self): + def test_logout_success(self, isolated_home, secret_vault_factory): """Test successful logout""" - with patch("litellm.proxy.client.cli.commands.auth.clear_token") as mock_clear: - result = self.runner.invoke(logout) + vault = secret_vault_factory(blob=_secret_blob("https://test.example.com", "sk-stored")) + _write_token_file(isolated_home, key=None) - assert result.exit_code == 0 - assert "Logged out successfully" in result.output - mock_clear.assert_called_once() + result = self.runner.invoke(logout, obj={"secret_vault": vault}) + + assert result.exit_code == 0 + assert "Logged out successfully" in result.output + assert vault.blob is None + assert not (isolated_home / ".litellm" / "token.json").exists() + + def test_logout_without_the_keyring_package_does_not_claim_the_keychain_is_clear( + self, isolated_home, secret_vault_factory + ): + """Logging out from an install without the cli extra cannot touch an entry a keychain-backed + login left behind, so it must point at the package rather than report a clean logout.""" + _write_token_file(isolated_home, key=None) + + result = self.runner.invoke( + logout, obj={"secret_vault": secret_vault_factory(available=False, failure=KeyringNotInstalled())} + ) + + assert result.exit_code == 0 + assert "Logged out successfully" not in result.output + assert "could not be checked" in result.output + assert "pip install 'litellm[cli]'" in result.output + + def test_logout_does_not_call_an_unusable_keychain_clean(self, isolated_home, secret_vault_factory): + """A keychain-backed login, then a login that fell back to the file because the keychain had + become unusable, leaves the first entry live. The file's own secret says nothing about it, + so a clean bill of health here is the one answer that cannot be justified.""" + _write_token_file(isolated_home, key="sk-in-file") + vault = secret_vault_factory(available=False, failure=KeyringDisabled()) + + result = self.runner.invoke(logout, obj={"secret_vault": vault}) + + assert result.exit_code == 0 + assert "Logged out successfully" not in result.output + assert "could not be checked" in result.output + assert DISABLE_KEYRING_ENV_VAR in result.output + + def test_logout_warns_when_the_keychain_refuses_to_release_the_entry( + self, isolated_home, secret_vault_factory + ): + """A locked keychain leaves a live credential behind that the user believes is gone.""" + vault = secret_vault_factory( + blob=_secret_blob("https://test.example.com", "sk-stored"), erasable=False + ) + _write_token_file(isolated_home, key=None) + + result = self.runner.invoke(logout, obj={"secret_vault": vault}) + + assert result.exit_code == 0 + assert "Logged out successfully" not in result.output + assert "still in the OS keychain" in result.output + assert "Unlock your keychain" in result.output + + @pytest.mark.skipif(os.geteuid() == 0, reason="root ignores file permissions") + def test_logout_reports_a_token_file_it_cannot_clear(self, isolated_home, secret_vault_factory): + """`lite logout` on a read-only ~/.litellm holding a read-only token file used to end in a + PermissionError traceback with the credential still sitting in the file. The user has to be + told what is left and where.""" + _write_token_file(isolated_home, key="sk-in-file") + config_dir = isolated_home / ".litellm" + path = config_dir / "token.json" + path.chmod(0o400) + config_dir.chmod(0o500) + try: + result = self.runner.invoke(logout, obj={"secret_vault": secret_vault_factory()}) + finally: + config_dir.chmod(0o700) + path.chmod(0o600) + + assert result.exit_code == 0 + assert "Logged out successfully" not in result.output + assert "still in" in result.output + assert str(config_dir / "token.json") in result.output + + @pytest.mark.skipif(os.geteuid() == 0, reason="root ignores directory permissions") + def test_logout_on_a_read_only_directory_still_takes_the_secret_out_of_the_file( + self, isolated_home, secret_vault_factory + ): + """A ~/.litellm that will accept no replacement file and no removal still lets the file it + has be shortened, so the logout the user asked for happens rather than being handed back to + them with instructions.""" + _write_token_file(isolated_home, key="sk-in-file") + config_dir = isolated_home / ".litellm" + path = config_dir / "token.json" + config_dir.chmod(0o500) + try: + result = self.runner.invoke(logout, obj={"secret_vault": secret_vault_factory()}) + finally: + config_dir.chmod(0o700) + + assert result.exit_code == 0 + assert "Logged out successfully" in result.output + assert "sk-in-file" not in path.read_text() + + def test_logout_without_the_keyring_package_still_warns_about_a_file_held_secret( + self, isolated_home, secret_vault_factory + ): + """A file holding its own secret only says the login that wrote it had no keychain to write + to. An earlier login on this machine may have had one, and no install without the package + can look, so the honest answer is that the keychain went unchecked.""" + _write_token_file(isolated_home, key="sk-in-file") + + result = self.runner.invoke( + logout, obj={"secret_vault": secret_vault_factory(available=False, failure=KeyringNotInstalled())} + ) + + assert result.exit_code == 0 + assert "Logged out successfully" not in result.output + assert "could not be checked" in result.output + assert "pip install 'litellm[cli]'" in result.output class TestWhoamiCommand: @@ -610,14 +600,15 @@ class TestWhoamiCommand: def test_whoami_authenticated(self): """Test whoami when user is authenticated""" - token_data = { - "user_email": "test@example.com", - "user_id": "test-user-123", - "user_role": "admin", - "timestamp": time.time() - 3600, # 1 hour ago - } + token_data = CliTokenRecord( + user_email="test@example.com", + user_id="test-user-123", + user_role="admin", + key="sk-live", + timestamp=time.time() - 3600, + ) - with patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=token_data): + with patch("litellm.proxy.client.cli.commands.auth.load_cli_token", return_value=token_data): result = self.runner.invoke(whoami) assert result.exit_code == 0 @@ -629,7 +620,7 @@ class TestWhoamiCommand: def test_whoami_not_authenticated(self): """Test whoami when user is not authenticated""" - with patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=None): + with patch("litellm.proxy.client.cli.commands.auth.load_cli_token", return_value=None): result = self.runner.invoke(whoami) assert result.exit_code == 0 @@ -638,14 +629,15 @@ class TestWhoamiCommand: def test_whoami_old_token(self): """Test whoami with old token showing warning""" - token_data = { - "user_email": "test@example.com", - "user_id": "test-user-123", - "user_role": "admin", - "timestamp": time.time() - (25 * 3600), # 25 hours ago - } + token_data = CliTokenRecord( + user_email="test@example.com", + user_id="test-user-123", + user_role="admin", + key="sk-live", + timestamp=time.time() - (25 * 3600), + ) - with patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=token_data): + with patch("litellm.proxy.client.cli.commands.auth.load_cli_token", return_value=token_data): result = self.runner.invoke(whoami) assert result.exit_code == 0 @@ -654,12 +646,9 @@ class TestWhoamiCommand: def test_whoami_missing_fields(self): """Test whoami with token missing some fields""" - token_data = { - "timestamp": time.time() - 3600 - # Missing user_email, user_id, user_role - } + token_data = CliTokenRecord(key="sk-live", timestamp=time.time() - 3600) - with patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=token_data): + with patch("litellm.proxy.client.cli.commands.auth.load_cli_token", return_value=token_data): result = self.runner.invoke(whoami) assert result.exit_code == 0 @@ -668,6 +657,7 @@ class TestWhoamiCommand: def test_whoami_pkce_record_shows_the_team_and_when_the_key_renews(self): token_data = { + "key": "sk-cli", "user_email": "unknown", "user_id": "user-1", "user_role": "cli", @@ -687,6 +677,7 @@ class TestWhoamiCommand: def test_whoami_expired_key_without_a_refresh_token_asks_for_a_new_login(self): token_data = { + "key": "sk-cli", "user_id": "user-1", "timestamp": time.time() - 3600, "expires_at": time.time() - 60, @@ -701,6 +692,7 @@ class TestWhoamiCommand: def test_whoami_expired_pkce_record_that_could_not_be_renewed_asks_for_a_new_pkce_login(self): token_data = { + "key": "sk-cli", "user_id": "user-1", "team_id": "team-alpha", "timestamp": time.time() - 3600, @@ -717,16 +709,16 @@ class TestWhoamiCommand: def test_whoami_no_timestamp(self): """Test whoami with token missing timestamp""" - token_data = { - "user_email": "test@example.com", - "user_id": "test-user-123", - "user_role": "admin", - # Missing timestamp - } + token_data = CliTokenRecord( + user_email="test@example.com", + user_id="test-user-123", + user_role="admin", + key="sk-live", + ) with ( patch( - "litellm.proxy.client.cli.commands.auth.load_token", + "litellm.proxy.client.cli.commands.auth.load_cli_token", return_value=token_data, ), patch("time.time", return_value=1000), @@ -786,7 +778,7 @@ class TestCLIKeyRegenerationFlow: return_value=_mock_cli_sso_start_response(login_id="cli-session-uuid-456"), ), patch("requests.get", side_effect=[mock_first_response, mock_second_response]) as mock_get, - patch("litellm.proxy.client.cli.commands.auth.save_token") as mock_save, + patch("litellm.proxy.client.cli.commands.auth.save_cli_token") as mock_save, patch("litellm.proxy.client.cli.interface.show_commands") as mock_show_commands, patch("click.prompt", return_value="2"), ): # User selects index 2 @@ -819,8 +811,8 @@ class TestCLIKeyRegenerationFlow: # Verify JWT was saved mock_save.assert_called_once() saved_data = mock_save.call_args[0][0] - assert saved_data["key"] == "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.team-beta.jwt" - assert saved_data["user_id"] == "test-user-456" + assert saved_data.key == "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.team-beta.jwt" + assert saved_data.user_id == "test-user-456" mock_show_commands.assert_called_once() @@ -847,7 +839,7 @@ class TestCLIKeyRegenerationFlow: return_value=_mock_cli_sso_start_response(login_id="cli-session-uuid-solo"), ), patch("requests.get", return_value=mock_response), - patch("litellm.proxy.client.cli.commands.auth.save_token") as mock_save, + patch("litellm.proxy.client.cli.commands.auth.save_cli_token") as mock_save, patch("litellm.proxy.client.cli.interface.show_commands"), ): result = self.runner.invoke(login, obj=mock_context.obj) @@ -865,8 +857,8 @@ class TestCLIKeyRegenerationFlow: # Verify JWT was saved mock_save.assert_called_once() saved_data = mock_save.call_args[0][0] - assert saved_data["key"] == "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.no-team.jwt" - assert saved_data["user_id"] == "test-user-solo" + assert saved_data.key == "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.no-team.jwt" + assert saved_data.user_id == "test-user-solo" class TestPrintTokenCommand: @@ -895,7 +887,7 @@ class TestPrintTokenCommand: self.runner = CliRunner() def test_no_stored_token_fails_cleanly(self): - with patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=None): + with patch("litellm.proxy.client.cli.commands.auth.load_cli_token", return_value=None): result = self.runner.invoke(print_token, obj={}) assert result.exit_code != 0 @@ -907,12 +899,12 @@ class TestPrintTokenCommand: one). Must use token.json's own base_url, not a hardcoded default.""" with ( patch( - "litellm.proxy.client.cli.commands.auth.load_token", - return_value={ - "base_url": "https://litellm-proxy.corp.com", - "key": "sk-prod-fresh", - "timestamp": time.time(), - }, + "litellm.proxy.client.cli.commands.auth.load_cli_token", + return_value=CliTokenRecord( + base_url="https://litellm-proxy.corp.com", + key="sk-prod-fresh", + timestamp=time.time(), + ), ), patch("requests.post") as mock_post, ): @@ -929,12 +921,12 @@ class TestPrintTokenCommand: token minted for proxy A must not reach a helper invocation aimed at proxy B, even though the token itself is otherwise fresh.""" with patch( - "litellm.proxy.client.cli.commands.auth.load_token", - return_value={ - "base_url": "https://other-server.com", - "key": "sk-should-not-print", - "timestamp": time.time(), - }, + "litellm.proxy.client.cli.commands.auth.load_cli_token", + return_value=CliTokenRecord( + base_url="https://other-server.com", + key="sk-should-not-print", + timestamp=time.time(), + ), ): result = self.runner.invoke( print_token, @@ -948,12 +940,12 @@ class TestPrintTokenCommand: """`lite up`'s own bound invocation shape: --base-url matching the token's origin must succeed exactly like the bare/legacy invocation does.""" with patch( - "litellm.proxy.client.cli.commands.auth.load_token", - return_value={ - "base_url": "http://localhost:4000", - "key": "sk-matches", - "timestamp": time.time(), - }, + "litellm.proxy.client.cli.commands.auth.load_cli_token", + return_value=CliTokenRecord( + base_url="http://localhost:4000", + key="sk-matches", + timestamp=time.time(), + ), ): result = self.runner.invoke( print_token, @@ -969,12 +961,12 @@ class TestPrintTokenCommand: frequently).""" with ( patch( - "litellm.proxy.client.cli.commands.auth.load_token", - return_value={ - "base_url": "http://localhost:4000", - "key": "sk-cached-fresh", - "timestamp": time.time(), - }, + "litellm.proxy.client.cli.commands.auth.load_cli_token", + return_value=CliTokenRecord( + base_url="http://localhost:4000", + key="sk-cached-fresh", + timestamp=time.time(), + ), ), patch("requests.post") as mock_post, ): @@ -993,12 +985,12 @@ class TestPrintTokenCommand: with ( patch( - "litellm.proxy.client.cli.commands.auth.load_token", - return_value={ - "base_url": "http://localhost:4000", - "key": "sk-stale-key", - "timestamp": old_timestamp, - }, + "litellm.proxy.client.cli.commands.auth.load_cli_token", + return_value=CliTokenRecord( + base_url="http://localhost:4000", + key="sk-stale-key", + timestamp=old_timestamp, + ), ), patch("requests.post") as mock_post, ): @@ -1010,25 +1002,11 @@ class TestPrintTokenCommand: mock_post.assert_not_called() -def _write_home_json(home: Path, filename: str, payload: dict[str, object]) -> None: - litellm_dir = home / ".litellm" - litellm_dir.mkdir(exist_ok=True) - (litellm_dir / filename).write_text(json.dumps(payload)) - - class TestPrintTokenWithConfigFile: """A config-file base_url is a drop-in replacement for exporting LITELLM_PROXY_URL, so print-token must treat it as an explicit server choice: a token minted for a different proxy is never handed out.""" - @pytest.fixture - def isolated_home(self, monkeypatch, tmp_path): - monkeypatch.setenv("HOME", str(tmp_path)) - monkeypatch.setenv("USERPROFILE", str(tmp_path)) - monkeypatch.delenv("LITELLM_PROXY_URL", raising=False) - monkeypatch.delenv("LITELLM_PROXY_API_KEY", raising=False) - return tmp_path - def test_config_base_url_mismatch_fails_closed(self, isolated_home): _write_home_json( isolated_home, @@ -1086,37 +1064,266 @@ class TestPrintTokenWithConfigFile: assert result.stdout.strip() == "sk-issued-for-a" -class TestSaveTokenPrivateWrite: - """token.json holds the real API key: it must never be world-readable at any - instant, and a failed write must not destroy the previously stored token.""" +class TestFileFallbackStorage: + """On a headless box with no keychain the token file is still the only store, so it has to + stay owner-only and survive a failed write.""" - @pytest.fixture - def isolated_home(self, monkeypatch, tmp_path): - monkeypatch.setenv("HOME", str(tmp_path)) - monkeypatch.setenv("USERPROFILE", str(tmp_path)) - monkeypatch.delenv("LITELLM_PROXY_URL", raising=False) - monkeypatch.delenv("LITELLM_PROXY_API_KEY", raising=False) - return tmp_path - - def test_save_token_owner_only_permissions_and_no_temp_leftovers(self, isolated_home): - save_token({"key": "sk-secret", "user_id": "u-1", "timestamp": 1234567890}) + def test_owner_only_file_and_directory_with_no_temp_leftovers(self, isolated_home, secret_vault_factory): + save_cli_token( + CliTokenRecord(base_url="https://proxy.example.com", key="sk-secret", user_id="u-1", timestamp=1234567890), + vault=secret_vault_factory(available=False), + ) token_file = isolated_home / ".litellm" / "token.json" - assert json.loads(token_file.read_text()) == {"key": "sk-secret", "user_id": "u-1", "timestamp": 1234567890} + assert json.loads(token_file.read_text())["key"] == "sk-secret" assert stat.S_IMODE(token_file.stat().st_mode) == 0o600 + assert stat.S_IMODE(token_file.parent.stat().st_mode) == 0o700 assert list(token_file.parent.glob(".tmp-*")) == [] - def test_save_token_failure_mid_write_preserves_existing_token(self, isolated_home): + def test_a_failed_write_preserves_the_existing_token(self, isolated_home, secret_vault_factory, monkeypatch): _write_home_json(isolated_home, "token.json", {"key": "sk-original", "timestamp": 1234567890}) token_file = isolated_home / ".litellm" / "token.json" + def _explode(*args, **kwargs): + raise TypeError("not serialisable") + + monkeypatch.setattr("litellm.litellm_core_utils.private_json.json.dump", _explode) + with pytest.raises(TypeError): - save_token({"key": object()}) + save_cli_token(CliTokenRecord(key="sk-new"), vault=secret_vault_factory(available=False)) assert json.loads(token_file.read_text()) == {"key": "sk-original", "timestamp": 1234567890} assert list(token_file.parent.glob(".tmp-*")) == [] +class TestKeychainBackedCommands: + """End-to-end through the `lite` commands: the secret lives in the keychain, the file keeps + only metadata, and every command still reads and writes through that split.""" + + def setup_method(self): + self.runner = CliRunner() + + def _login(self, vault, base_url="https://test.example.com"): + poll_response = Mock() + poll_response.status_code = 200 + poll_response.json.return_value = { + "status": "ready", + "key": "sk-minted", + "user_id": "test-user-123", + "team_id": "team-1", + "teams": ["team-1"], + } + with ( + patch("webbrowser.open"), + patch("requests.post", return_value=_mock_cli_sso_start_response()), + patch("requests.get", return_value=poll_response), + patch("litellm.proxy.client.cli.interface.show_commands"), + ): + return self.runner.invoke(login, obj={"base_url": base_url, "secret_vault": vault}) + + def test_login_puts_the_secret_in_the_keychain_and_not_in_the_file(self, isolated_home, secret_vault_factory): + vault = secret_vault_factory() + + result = self._login(vault) + + token_file = isolated_home / ".litellm" / "token.json" + assert result.exit_code == 0 + assert "Credential stored in your OS keychain." in result.output + assert json.loads(vault.blob)["key"] == "sk-minted" + assert "sk-minted" not in token_file.read_text() + assert json.loads(token_file.read_text())["user_id"] == "test-user-123" + + def test_login_without_a_keychain_says_where_the_credential_went(self, isolated_home, secret_vault_factory): + result = self._login(secret_vault_factory(available=False)) + + token_file = isolated_home / ".litellm" / "token.json" + assert result.exit_code == 0 + assert "No OS keychain available" in result.output + assert str(token_file) in result.output + assert json.loads(token_file.read_text())["key"] == "sk-minted" + + def test_login_points_a_user_missing_the_keyring_package_at_the_install( + self, isolated_home, secret_vault_factory + ): + """`lite` ships with every install, the keyring package only with the cli extra. Telling + that user their machine has no keychain sends them looking for a problem they do not have.""" + result = self._login(secret_vault_factory(available=False, failure=KeyringNotInstalled())) + + token_file = isolated_home / ".litellm" / "token.json" + assert result.exit_code == 0 + assert "pip install 'litellm[cli]'" in result.output + assert "No OS keychain available" not in result.output + assert json.loads(token_file.read_text())["key"] == "sk-minted" + + def test_login_keeps_the_credential_when_the_backend_keeps_nothing( + self, isolated_home, secret_vault_factory + ): + """A backend that accepts writes and stores nothing must not be reported as keychain + storage, because the file is then told to drop the only remaining copy.""" + result = self._login(secret_vault_factory(discards=True)) + + token_file = isolated_home / ".litellm" / "token.json" + assert result.exit_code == 0 + assert "Credential stored in your OS keychain." not in result.output + assert "keyring --enable" in result.output + assert json.loads(token_file.read_text())["key"] == "sk-minted" + + def test_login_names_the_kill_switch_instead_of_blaming_the_machine( + self, isolated_home, secret_vault_factory + ): + result = self._login(secret_vault_factory(available=False, failure=KeyringDisabled())) + + assert result.exit_code == 0 + assert DISABLE_KEYRING_ENV_VAR in result.output + assert "No OS keychain available" not in result.output + assert json.loads((isolated_home / ".litellm" / "token.json").read_text())["key"] == "sk-minted" + + def test_whoami_and_print_token_read_through_the_keychain(self, isolated_home, secret_vault_factory): + vault = secret_vault_factory() + self._login(vault) + obj = {"base_url": "https://test.example.com", "secret_vault": vault} + + whoami_result = self.runner.invoke(whoami, obj=obj) + print_result = self.runner.invoke(print_token, obj=obj) + + assert "Authenticated" in whoami_result.output + assert "test-user-123" in whoami_result.output + assert print_result.exit_code == 0 + assert print_result.stdout.strip() == "sk-minted" + + def test_logout_clears_the_keychain_as_well_as_the_file(self, isolated_home, secret_vault_factory): + vault = secret_vault_factory() + self._login(vault) + + result = self.runner.invoke(logout, obj={"base_url": "https://test.example.com", "secret_vault": vault}) + + assert result.exit_code == 0 + assert "Logged out successfully" in result.output + assert vault.blob is None + assert not (isolated_home / ".litellm" / "token.json").exists() + + def test_logout_warns_when_the_keychain_will_not_release_the_secret(self, isolated_home, secret_vault_factory): + """Silently reporting success would leave a live credential in the keychain.""" + vault = secret_vault_factory(erasable=False) + self._login(vault) + + result = self.runner.invoke(logout, obj={"base_url": "https://test.example.com", "secret_vault": vault}) + + assert result.exit_code == 0 + assert "could not be removed" in result.output + assert not (isolated_home / ".litellm" / "token.json").exists() + + def test_print_token_explains_a_locked_keychain_instead_of_printing_nothing( + self, isolated_home, secret_vault_factory + ): + _write_home_json( + isolated_home, + "token.json", + {"base_url": "https://test.example.com", "user_id": "u-1", "timestamp": time.time()}, + ) + obj = {"base_url": "https://test.example.com", "secret_vault": secret_vault_factory(available=False)} + + result = self.runner.invoke(print_token, obj=obj) + + assert result.exit_code == 1 + assert "could not be read" in result.output + assert "lite login" in result.output + + def test_whoami_does_not_call_a_credential_it_cannot_read_authenticated( + self, isolated_home, secret_vault_factory + ): + """A login whose secret is stuck in an unreachable keychain authenticates nothing. Leading + with "Authenticated" and a token age reads as a working session, and sends the user looking + for the problem somewhere other than the keychain the notice underneath names.""" + _write_home_json( + isolated_home, + "token.json", + {"base_url": "https://test.example.com", "user_id": "u-1", "timestamp": time.time()}, + ) + obj = {"base_url": "https://test.example.com", "secret_vault": secret_vault_factory(available=False)} + + result = self.runner.invoke(whoami, obj=obj) + + assert "Authenticated" not in result.output + assert "the credential cannot be read" in result.output + assert "could not be read" in result.output + + def test_whoami_names_the_kill_switch_rather_than_a_missing_package( + self, isolated_home, secret_vault_factory + ): + """Every unreachable keychain used to be described as a locked one needing the keyring + package installed. Someone who set the kill switch has the package and an unlocked keychain, + so that advice sends them to fix two things that were never wrong.""" + _write_token_file(isolated_home, key=None) + vault = secret_vault_factory(available=False, failure=KeyringDisabled()) + + result = self.runner.invoke(whoami, obj={"base_url": "https://test.example.com", "secret_vault": vault}) + + assert DISABLE_KEYRING_ENV_VAR in result.output + assert "pip install" not in result.output + + def test_print_token_points_an_install_without_keyring_at_the_package( + self, isolated_home, secret_vault_factory + ): + _write_token_file(isolated_home, key=None) + vault = secret_vault_factory(available=False, failure=KeyringNotInstalled()) + obj = {"base_url": "https://test.example.com", "secret_vault": vault} + + result = self.runner.invoke(print_token, obj=obj) + + assert result.exit_code == 1 + assert "pip install 'litellm[cli]'" in result.output + assert DISABLE_KEYRING_ENV_VAR not in result.output + + +class TestApiKeyPrecedence: + """`LITELLM_PROXY_API_KEY` and `--api-key` outrank the stored credential; moving the secret + into the keychain must not disturb that order.""" + + def _resolved_key(self, args, obj=None): + with patch("litellm.proxy.client.cli.main.print_version") as mock_print_version: + result = CliRunner().invoke(cli, [*args, "version"], obj=obj) + assert result.exit_code == 0, result.output + return mock_print_version.call_args[0][1] + + def test_the_stored_credential_is_the_fallback(self, isolated_home): + _write_home_json( + isolated_home, + "token.json", + {"base_url": "http://localhost:4000", "key": "sk-stored", "timestamp": time.time()}, + ) + + assert self._resolved_key([]) == "sk-stored" + + def test_the_stored_credential_is_read_through_the_injected_keychain(self, isolated_home, secret_vault_factory): + """The vault handed to the CLI through ctx.obj must be the one the group callback reads, + so a keychain-held secret resolves without ever touching the host OS keychain.""" + _write_home_json(isolated_home, "token.json", {"base_url": "http://localhost:4000", "timestamp": time.time()}) + vault = secret_vault_factory(_secret_blob("http://localhost:4000", "sk-keychain")) + + assert self._resolved_key([], obj={"secret_vault": vault}) == "sk-keychain" + + def test_env_var_beats_the_stored_credential(self, isolated_home, monkeypatch): + _write_home_json( + isolated_home, + "token.json", + {"base_url": "http://localhost:4000", "key": "sk-stored", "timestamp": time.time()}, + ) + monkeypatch.setenv("LITELLM_PROXY_API_KEY", "sk-from-env") + + assert self._resolved_key([]) == "sk-from-env" + + def test_explicit_api_key_beats_both(self, isolated_home, monkeypatch): + _write_home_json( + isolated_home, + "token.json", + {"base_url": "http://localhost:4000", "key": "sk-stored", "timestamp": time.time()}, + ) + monkeypatch.setenv("LITELLM_PROXY_API_KEY", "sk-from-env") + + assert self._resolved_key(["--api-key", "sk-explicit"]) == "sk-explicit" + + class TestLoginConfigClaude: """`lite login --config-claude` wiring into ~/.claude/settings.json""" @@ -1139,7 +1346,7 @@ class TestLoginConfigClaude: patch("webbrowser.open"), patch("requests.post", return_value=_mock_cli_sso_start_response()), patch("requests.get", return_value=poll_response), - patch("litellm.proxy.client.cli.commands.auth.save_token"), + patch("litellm.proxy.client.cli.commands.auth.save_cli_token"), patch("litellm.proxy.client.cli.interface.show_commands"), patch("litellm.proxy.client.cli.commands.auth.CLAUDE_SETTINGS_PATH", settings_path), patch( @@ -1290,13 +1497,14 @@ class TestPkceLoginCommand: def test_pkce_login_saves_the_new_record_then_revokes_the_refresh_token_it_replaced(self): posts_when_saved = [] + def record_posts(record, **_): + posts_when_saved.append(list(_FakeSession.instances[0].posts)) + return SecretStored() + with ( patch("litellm.proxy.client.cli.commands.auth.run_pkce_login", return_value=_pkce_credential()), patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=_pkce_record(team_id="team-a")), - patch( - "litellm.proxy.client.cli.commands.auth.save_token", - side_effect=lambda record: posts_when_saved.append(list(_FakeSession.instances[0].posts)), - ) as save, + patch("litellm.proxy.client.cli.commands.auth.save_token", side_effect=record_posts) as save, patch("litellm.proxy.client.cli.commands.auth.requests.Session", _FakeSession), patch("litellm.proxy.client.cli.interface.show_commands"), ): @@ -1324,7 +1532,7 @@ class TestPkceLoginCommand: with ( patch("litellm.proxy.client.cli.commands.auth.run_pkce_login", return_value=_pkce_credential()), patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=_pkce_record()), - patch("litellm.proxy.client.cli.commands.auth.save_token") as save, + patch("litellm.proxy.client.cli.commands.auth.save_token", return_value=SecretStored()) as save, patch("litellm.proxy.client.cli.commands.auth.requests.Session", _FailingSession), patch("litellm.proxy.client.cli.interface.show_commands"), ): @@ -1343,7 +1551,7 @@ class TestPkceLoginCommand: with ( patch("litellm.proxy.client.cli.commands.auth.run_pkce_login", return_value=_pkce_credential()), patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=previous), - patch("litellm.proxy.client.cli.commands.auth.save_token") as save, + patch("litellm.proxy.client.cli.commands.auth.save_token", return_value=SecretStored()) as save, patch("litellm.proxy.client.cli.commands.auth.requests.Session", _FakeSession), patch("litellm.proxy.client.cli.interface.show_commands"), ): @@ -1358,7 +1566,7 @@ class TestPkceLoginCommand: with ( patch("litellm.proxy.client.cli.commands.auth.run_pkce_login", return_value=_pkce_credential()) as run, patch("litellm.proxy.client.cli.commands.auth._start_cli_sso_flow") as sso_start, - patch("litellm.proxy.client.cli.commands.auth.save_token") as save, + patch("litellm.proxy.client.cli.commands.auth.save_token", return_value=SecretStored()) as save, patch("litellm.proxy.client.cli.interface.show_commands"), ): result = self.runner.invoke(login, ["--pkce"], obj={"base_url": f"{PKCE_BASE_URL}/"}) @@ -1387,7 +1595,7 @@ class TestPkceLoginCommand: "litellm.proxy.client.cli.commands.auth.run_pkce_login", return_value=PkceFailure("sign-in was not approved (access_denied): no details"), ), - patch("litellm.proxy.client.cli.commands.auth.save_token") as save, + patch("litellm.proxy.client.cli.commands.auth.save_token", return_value=SecretStored()) as save, ): result = self.runner.invoke(login, ["--pkce"], obj={"base_url": PKCE_BASE_URL}) @@ -1414,7 +1622,7 @@ class TestPkceLogoutCommand: def test_logout_revokes_the_refresh_token_before_clearing(self): with ( patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=_pkce_record()), - patch("litellm.proxy.client.cli.commands.auth.clear_token") as clear, + patch("litellm.proxy.client.cli.commands.auth.clear_cli_token", return_value=SecretErased()) as clear, patch("litellm.proxy.client.cli.commands.auth.requests.Session", _FakeSession), ): result = self.runner.invoke(logout) @@ -1437,7 +1645,7 @@ class TestPkceLogoutCommand: with ( patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=_pkce_record()), - patch("litellm.proxy.client.cli.commands.auth.clear_token") as clear, + patch("litellm.proxy.client.cli.commands.auth.clear_cli_token", return_value=SecretErased()) as clear, patch("litellm.proxy.client.cli.commands.auth.requests.Session", _RefusingSession), ): result = self.runner.invoke(logout) @@ -1460,7 +1668,7 @@ class TestPkceLogoutCommand: with ( patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=_pkce_record()), - patch("litellm.proxy.client.cli.commands.auth.clear_token") as clear, + patch("litellm.proxy.client.cli.commands.auth.clear_cli_token", return_value=SecretErased()) as clear, patch("litellm.proxy.client.cli.commands.auth.requests.Session", _UnavailableSession), ): result = self.runner.invoke(logout) @@ -1476,7 +1684,7 @@ class TestPkceLogoutCommand: def test_logout_of_a_classic_token_makes_no_request(self): with ( patch("litellm.proxy.client.cli.commands.auth.load_token", return_value={"key": "sk-classic"}), - patch("litellm.proxy.client.cli.commands.auth.clear_token") as clear, + patch("litellm.proxy.client.cli.commands.auth.clear_cli_token", return_value=SecretErased()) as clear, patch("litellm.proxy.client.cli.commands.auth.requests.Session", _FakeSession), ): result = self.runner.invoke(logout) diff --git a/tests/test_litellm/proxy/client/cli/test_claude_settings.py b/tests/test_litellm/proxy/client/cli/test_claude_settings.py index bc9744eb410..9010fb4c022 100644 --- a/tests/test_litellm/proxy/client/cli/test_claude_settings.py +++ b/tests/test_litellm/proxy/client/cli/test_claude_settings.py @@ -7,6 +7,7 @@ from unittest.mock import patch import pytest from click.testing import CliRunner +from litellm.litellm_core_utils.cli_token_utils import CliTokenRecord from litellm.proxy.client.cli import cli from litellm.proxy.client.cli.commands.claude_settings import ( AUTOROUTE_BACKUP_PATH, @@ -181,18 +182,18 @@ class TestApiKeyHelperIsActuallyInvocable: assert result.exit_code != 2 def test_the_generated_command_reaches_print_token(self): - with patch(f"{AUTH_MODULE}.load_token", return_value=None): + with patch(f"{AUTH_MODULE}.load_cli_token", return_value=None): result = CliRunner().invoke(cli, self._helper_args("http://localhost:4000")) assert "Not authenticated" in result.output def test_the_generated_command_carries_the_base_url_through(self): - stale = { - "base_url": "http://other-proxy.example.com", - "key": "sk-stale", - "timestamp": time.time(), - } - with patch(f"{AUTH_MODULE}.load_token", return_value=stale): + stale = CliTokenRecord( + base_url="http://other-proxy.example.com", + key="sk-stale", + timestamp=time.time(), + ) + with patch(f"{AUTH_MODULE}.load_cli_token", return_value=stale): result = CliRunner().invoke(cli, self._helper_args("http://localhost:4000")) assert "Not authenticated for this server" in result.output diff --git a/tests/test_litellm/proxy/client/cli/test_config_commands.py b/tests/test_litellm/proxy/client/cli/test_config_commands.py index d81ee6bd2b1..6f3f4e4b268 100644 --- a/tests/test_litellm/proxy/client/cli/test_config_commands.py +++ b/tests/test_litellm/proxy/client/cli/test_config_commands.py @@ -18,7 +18,7 @@ from litellm.proxy.client.cli.commands.config import ( load_config, save_config, ) -from litellm.proxy.client.cli.commands.private_json import write_private_json +from litellm.litellm_core_utils.private_json import write_private_json from litellm.proxy.client.cli.interface import show_commands @@ -355,7 +355,7 @@ class TestWritePrivateJson: def _interrupt(*args: object, **kwargs: object) -> None: raise KeyboardInterrupt() - monkeypatch.setattr("litellm.proxy.client.cli.commands.private_json.json.dump", _interrupt) + monkeypatch.setattr("litellm.litellm_core_utils.private_json.json.dump", _interrupt) target = tmp_path / "config.json" with pytest.raises(KeyboardInterrupt): diff --git a/tests/test_litellm/proxy/client/cli/test_up_commands.py b/tests/test_litellm/proxy/client/cli/test_up_commands.py index 264de328c37..9958286884b 100644 --- a/tests/test_litellm/proxy/client/cli/test_up_commands.py +++ b/tests/test_litellm/proxy/client/cli/test_up_commands.py @@ -246,10 +246,10 @@ class _FakeTokenStore: self.keys_by_base_url = keys_by_base_url self.rotated_to = rotated_to self.key_requests = [] - monkeypatch.setattr(up_module, "load_token", lambda: self.record) + monkeypatch.setattr(up_module, "load_token", lambda **_: self.record) monkeypatch.setattr(up_module, "get_stored_api_key", self.get_stored_api_key) - def get_stored_api_key(self, expected_base_url=None): + def get_stored_api_key(self, expected_base_url=None, **_): self.key_requests.append(expected_base_url) key = self.keys_by_base_url.get(expected_base_url) if key is not None and self.rotated_to is not None: @@ -302,6 +302,19 @@ class TestEnsureFreshLogin: assert login_calls == [("http://proxy-b:4000", False)] assert store.key_requests == ["http://proxy-b:4000", "http://proxy-b:4000"] + def test_forces_a_fresh_login_when_the_cached_token_has_no_readable_key(self, monkeypatch): + monkeypatch.setattr(up_module.sys.stdin, "isatty", lambda: True) + store = _FakeTokenStore(monkeypatch, {"base_url": "http://proxy-a:4000"}, {}) + monkeypatch.setattr(up_module, "is_cli_token_fresh", lambda token_data: True) + login_calls = _capture_login( + monkeypatch, + on_login=lambda: store.log_in({"key": "sk-a", "base_url": "http://proxy-a:4000"}, "sk-a"), + ) + + _ensure_fresh_login(_make_ctx("http://proxy-a:4000")) + + assert login_calls == [("http://proxy-a:4000", False)] + def test_fails_cleanly_non_interactively_when_only_a_different_proxys_token_is_cached(self, monkeypatch): monkeypatch.setattr(up_module.sys.stdin, "isatty", lambda: False) _FakeTokenStore(monkeypatch, {"key": "sk-a", "base_url": "http://proxy-a:4000"}, {}) diff --git a/type-discipline-budget.json b/type-discipline-budget.json index 20cd1165577..a5c5a9f135b 100644 --- a/type-discipline-budget.json +++ b/type-discipline-budget.json @@ -3,7 +3,7 @@ "limit": 22805 }, "LIT002": { - "limit": 26878 + "limit": 26877 }, "LIT003": { "limit": 269 @@ -27,12 +27,12 @@ "limit": 0 }, "LIT010": { - "limit": 16695 + "limit": 16693 }, "LIT011": { "limit": 5588 }, "LIT012": { - "limit": 4519 + "limit": 4511 } } diff --git a/uv.lock b/uv.lock index d9e2fb94667..53bb0cb8f82 100644 --- a/uv.lock +++ b/uv.lock @@ -10,7 +10,7 @@ resolution-markers = [ ] [options] -exclude-newer = "2026-08-16T00:41:08.185444Z" +exclude-newer = "2026-08-17T01:06:38.502388Z" exclude-newer-span = "P3D" [manifest] @@ -710,6 +710,15 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/a0/59/76ab57e3fe74484f48a53f8e337171b4a2349e506eabe136d7e01d059086/backports_asyncio_runner-1.2.0-py3-none-any.whl", hash = "sha256:0da0a936a8aeb554eccb426dc55af3ba63bcdc69fa1a600b5bb305413a4477b5", size = 12313, upload-time = "2025-07-02T02:27:14.263Z" }, ] +[[package]] +name = "backports-tarfile" +version = "1.2.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/86/72/cd9b395f25e290e633655a100af28cb253e4393396264a98bd5f5951d50f/backports_tarfile-1.2.0.tar.gz", hash = "sha256:d75e02c268746e1b8144c278978b6e98e85de6ad16f8e4b0844a154557eca991", size = 86406, upload-time = "2024-05-28T17:01:54.731Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/b9/fa/123043af240e49752f1c4bd24da5053b6bd00cad78c2be53c0d1e8b975bc/backports.tarfile-1.2.0-py3-none-any.whl", hash = "sha256:77e284d754527b01fb1e6fa8a1afe577858ebe4e9dad8919e34c862cb399bc34", size = 30181, upload-time = "2024-05-28T17:01:53.112Z" }, +] + [[package]] name = "basedpyright" version = "1.39.7" @@ -3538,6 +3547,51 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl", hash = "sha256:c6242fc49e35958c8b15141343aa660db5fc54d4f13a1db01a3f5891b98700ef", size = 16234, upload-time = "2024-04-16T21:28:14.499Z" }, ] +[[package]] +name = "jaraco-classes" +version = "3.4.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "more-itertools" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/06/c0/ed4a27bc5571b99e3cff68f8a9fa5b56ff7df1c2251cc715a652ddd26402/jaraco.classes-3.4.0.tar.gz", hash = "sha256:47a024b51d0239c0dd8c8540c6c7f484be3b8fcf0b2d85c13825780d3b3f3acd", size = 11780, upload-time = "2024-03-31T07:27:36.643Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/7f/66/b15ce62552d84bbfcec9a4873ab79d993a1dd4edb922cbfccae192bd5b5f/jaraco.classes-3.4.0-py3-none-any.whl", hash = "sha256:f662826b6bed8cace05e7ff873ce0f9283b5c924470fe664fff1c2f00f581790", size = 6777, upload-time = "2024-03-31T07:27:34.792Z" }, +] + +[[package]] +name = "jaraco-context" +version = "6.1.2" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "backports-tarfile", marker = "python_full_version < '3.12'" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/af/50/4763cd07e722bb6285316d390a164bc7e479db9d90daa769f22578f698b4/jaraco_context-6.1.2.tar.gz", hash = "sha256:f1a6c9d391e661cc5b8d39861ff077a7dc24dc23833ccee564b234b81c82dfe3", size = 16801, upload-time = "2026-03-20T22:13:33.922Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/f2/58/bc8954bda5fcda97bd7c19be11b85f91973d67a706ed4a3aec33e7de22db/jaraco_context-6.1.2-py3-none-any.whl", hash = "sha256:bf8150b79a2d5d91ae48629d8b427a8f7ba0e1097dd6202a9059f29a36379535", size = 7871, upload-time = "2026-03-20T22:13:32.808Z" }, +] + +[[package]] +name = "jaraco-functools" +version = "4.6.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "more-itertools" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/6c/1f/c23395957d41ccf27c4e535c3d334c4051e5395b3752057ba4cbaec35c56/jaraco_functools-4.6.0.tar.gz", hash = "sha256:880c577ec9720b3a052d5bc611fb9f2269b3d87902ef42440df443b88e443280", size = 20837, upload-time = "2026-07-14T01:28:02.544Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/02/36/ecc85bc96c273dc8a11273ed4782272975e6338d4a3e9228621175edf0e3/jaraco_functools-4.6.0-py3-none-any.whl", hash = "sha256:99e3dc0060c5cbe8fcd1cdb36258e2a65ca40f1566b2033b12abb1bb44dd3c30", size = 11677, upload-time = "2026-07-14T01:28:01.59Z" }, +] + +[[package]] +name = "jeepney" +version = "0.9.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/7b/6f/357efd7602486741aa73ffc0617fb310a29b588ed0fd69c2399acbb85b0c/jeepney-0.9.0.tar.gz", hash = "sha256:cf0e9e845622b81e4a28df94c40345400256ec608d0e55bb8a3feaa9163f5732", size = 106758, upload-time = "2025-02-27T18:51:01.684Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/b2/a3/e137168c9c44d18eff0376253da9f1e9234d0239e0ee230d2fee6cea8e55/jeepney-0.9.0-py3-none-any.whl", hash = "sha256:97e5714520c16fc0a45695e5365a2e11b81ea79bba796e26f9f1d178cb182683", size = 49010, upload-time = "2025-02-27T18:51:00.104Z" }, +] + [[package]] name = "jinja2" version = "3.1.6" @@ -3764,6 +3818,24 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/41/45/1a4ed80516f02155c51f51e8cedb3c1902296743db0bbc66608a0db2814f/jsonschema_specifications-2025.9.1-py3-none-any.whl", hash = "sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe", size = 18437, upload-time = "2025-09-08T01:34:57.871Z" }, ] +[[package]] +name = "keyring" +version = "25.7.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "importlib-metadata", marker = "python_full_version < '3.12'" }, + { name = "jaraco-classes" }, + { name = "jaraco-context" }, + { name = "jaraco-functools" }, + { name = "jeepney", marker = "sys_platform == 'linux'" }, + { name = "pywin32-ctypes", marker = "sys_platform == 'win32'" }, + { name = "secretstorage", marker = "sys_platform == 'linux'" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/43/4b/674af6ef2f97d56f0ab5153bf0bfa28ccb6c3ed4d1babf4305449668807b/keyring-25.7.0.tar.gz", hash = "sha256:fe01bd85eb3f8fb3dd0405defdeac9a5b4f6f0439edbb3149577f244a2e8245b", size = 63516, upload-time = "2025-11-16T16:26:09.482Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/81/db/e655086b7f3a705df045bf0933bdd9c2f79bb3c97bfef1384598bb79a217/keyring-25.7.0-py3-none-any.whl", hash = "sha256:be4a0b195f149690c166e850609a477c532ddbfbaed96a404d4e43f8d5e2689f", size = 39160, upload-time = "2025-11-16T16:26:08.402Z" }, +] + [[package]] name = "kiwisolver" version = "1.5.0" @@ -4222,6 +4294,7 @@ caching = [ ] cli = [ { name = "inquirerpy" }, + { name = "keyring" }, { name = "pyyaml" }, { name = "requests" }, { name = "rich" }, @@ -4352,6 +4425,7 @@ dev = [ { name = "diff-cover" }, { name = "fakeredis" }, { name = "fastapi-offline" }, + { name = "keyring" }, { name = "langfuse" }, { name = "openapi-core" }, { name = "opentelemetry-api" }, @@ -4446,6 +4520,7 @@ requires-dist = [ { name = "inquirerpy", marker = "extra == 'proxy'", specifier = ">=0.3.4,<1.0" }, { name = "jinja2", specifier = ">=3.1.6,<4.0" }, { name = "jsonschema", specifier = ">=4.0.0,<5.0" }, + { name = "keyring", marker = "extra == 'cli'", specifier = ">=25.6.0,<26.0" }, { name = "langfuse", marker = "extra == 'proxy-runtime'", specifier = ">=2.59.7,<3.0" }, { name = "litellm-enterprise", marker = "extra == 'proxy'", editable = "enterprise" }, { name = "litellm-proxy-extras", marker = "extra == 'proxy'", editable = "litellm-proxy-extras" }, @@ -4532,6 +4607,7 @@ dev = [ { name = "diff-cover", specifier = "==9.7.2" }, { name = "fakeredis", specifier = "==2.34.1" }, { name = "fastapi-offline", specifier = "==1.7.6" }, + { name = "keyring", specifier = "==25.7.0" }, { name = "langfuse", specifier = "==2.59.7" }, { name = "openapi-core", specifier = "==0.22.0" }, { name = "opentelemetry-api", specifier = "==1.28.0" }, @@ -7790,6 +7866,15 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/c0/d2/21af5c535501a7233e734b8af901574572da66fcc254cb35d0609c9080dd/pywin32-311-cp314-cp314-win_arm64.whl", hash = "sha256:a508e2d9025764a8270f93111a970e1d0fbfc33f4153b388bb649b7eec4f9b42", size = 8932540, upload-time = "2025-07-14T20:13:36.379Z" }, ] +[[package]] +name = "pywin32-ctypes" +version = "0.2.3" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/85/9f/01a1a99704853cb63f253eea009390c88e7131c67e66a0a02099a8c917cb/pywin32-ctypes-0.2.3.tar.gz", hash = "sha256:d162dc04946d704503b2edc4d55f3dba5c1d539ead017afa00142c38b9885755", size = 29471, upload-time = "2024-08-14T10:15:34.626Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/de/3d/8161f7711c017e01ac9f008dfddd9410dff3674334c233bde66e7ba65bbf/pywin32_ctypes-0.2.3-py3-none-any.whl", hash = "sha256:8a1513379d709975552d202d942d9837758905c8d01eb82b8bcc30918929e7b8", size = 30756, upload-time = "2024-08-14T10:15:33.187Z" }, +] + [[package]] name = "pyyaml" version = "6.0.3" @@ -8632,6 +8717,19 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/07/39/338d9219c4e87f3e708f18857ecd24d22a0c3094752393319553096b98af/scipy-1.17.1-cp314-cp314t-win_arm64.whl", hash = "sha256:200e1050faffacc162be6a486a984a0497866ec54149a01270adc8a59b7c7d21", size = 25489165, upload-time = "2026-02-23T00:22:29.563Z" }, ] +[[package]] +name = "secretstorage" +version = "3.5.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "cryptography" }, + { name = "jeepney" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/1c/03/e834bcd866f2f8a49a85eaff47340affa3bfa391ee9912a952a1faa68c7b/secretstorage-3.5.0.tar.gz", hash = "sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be", size = 19884, upload-time = "2025-11-23T19:02:53.191Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/b7/46/f5af3402b579fd5e11573ce652019a67074317e18c1935cc0b4ba9b35552/secretstorage-3.5.0-py3-none-any.whl", hash = "sha256:0ce65888c0725fcb2c5bc0fdb8e5438eece02c523557ea40ce0703c266248137", size = 15554, upload-time = "2025-11-23T19:02:51.545Z" }, +] + [[package]] name = "semantic-router" version = "0.1.15"