From 9161253d6a0f8f250e58eb3e580202bd1949c243 Mon Sep 17 00:00:00 2001
From: Ishaan Jaffer <ishaanjaffer0324@gmail.com>
Date: Thu, 5 Mar 2026 13:55:01 -0800
Subject: [PATCH] address greptile review feedback (greploop iteration 3)

---
 litellm/proxy/management_endpoints/ui_sso.py | 14 +++++++++++---
 litellm/proxy/proxy_server.py                |  2 --
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/litellm/proxy/management_endpoints/ui_sso.py b/litellm/proxy/management_endpoints/ui_sso.py
index 7024fad1c59..8ecb6b4a629 100644
--- a/litellm/proxy/management_endpoints/ui_sso.py
+++ b/litellm/proxy/management_endpoints/ui_sso.py
@@ -875,7 +875,7 @@ async def get_generic_sso_response(
                 message=detailed_message,
                 type=ProxyErrorTypes.auth_error,
                 param="GENERIC_CLIENT_USE_PKCE",
-                code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                code=status.HTTP_401_UNAUTHORIZED,
             )
 
         verbose_proxy_logger.exception(
@@ -2676,7 +2676,9 @@ class SSOAuthenticationHandler:
                 http_client=http_client,
             )
 
-        return {**token_response, **userinfo}
+        # Merge with token_response taking precedence so token fields (e.g. access_token)
+        # cannot be overridden by non-standard userinfo fields.
+        return {**userinfo, **token_response}
 
     @staticmethod
     async def _get_pkce_userinfo(
@@ -2708,7 +2710,13 @@ class SSOAuthenticationHandler:
                     timeout=30.0,
                 )
                 if resp.status_code == 200:
-                    userinfo = resp.json()
+                    try:
+                        userinfo = resp.json()
+                    except Exception as json_err:
+                        verbose_proxy_logger.warning(
+                            "Userinfo endpoint returned non-JSON response (status 200): %s",
+                            json_err,
+                        )
                 else:
                     verbose_proxy_logger.warning(
                         "Userinfo endpoint returned %s, falling back to id_token",
diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index 397a64915d4..da040f5caa2 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -2472,8 +2472,6 @@ class ProxyConfig:
         ):
             ## INIT PROXY REDIS USAGE CLIENT ##
             redis_usage_cache = litellm.cache.cache
-
-            ## INIT PROXY REDIS USAGE CLIENT ##
             # Note: PKCE verifier storage uses redis_usage_cache directly (not
             # user_api_key_cache) to avoid routing all API-key lookups through Redis.