scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-29 06:33:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 267

fix(auth): strip bedrock/invoke/ prefix in resolver; enforce URL model on Bedrock routes regardless of body

Browse source
This commit is contained in:
wangjifeng 2026-04-25 09:52:13 +08:00
parent bf531fc164
commit aa30a99885
1 changed files with 14 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
litellm/proxy/auth/auth_utils.py
View file

@ -910,7 +910,7 @@ def _resolve_bedrock_model_id_to_model_group(
configured = params.get("model") or ""
if not configured:
continue
for prefix in ("bedrock/converse/", "bedrock/"):
for prefix in ("bedrock/converse/", "bedrock/invoke/", "bedrock/"):
if configured.startswith(prefix):
configured = configured[len(prefix) :]
break
@ -971,14 +971,19 @@ def get_model_from_request(
# Pattern: /bedrock[/v{N}]/model/{modelId}/{invoke|converse|...}
# The modelId may contain slashes (e.g. `aws/anthropic/…`) and may be
# prefixed with `application-inference-profile/` for inference profiles.
if model is None:
bedrock_match = _BEDROCK_PASSTHROUGH_ROUTE_PATTERN.match(route)
if bedrock_match:
bedrock_model_id = bedrock_match.group("model")
resolved = _resolve_bedrock_model_id_to_model_group(
bedrock_model_id=bedrock_model_id, llm_router=llm_router
)
model = resolved or bedrock_model_id
# For Bedrock routes the URL model is authoritative — override any body
# `model` field so that ACL checks cannot be bypassed via the request body.
bedrock_match = _BEDROCK_PASSTHROUGH_ROUTE_PATTERN.match(route)
if bedrock_match:
bedrock_model_id = bedrock_match.group("model")
resolved = _resolve_bedrock_model_id_to_model_group(
bedrock_model_id=bedrock_model_id, llm_router=llm_router
)
# Use resolved model_group when available; fall back to the raw Bedrock
# model ID so callers can still do literal-name comparisons. When no
# router deployment maps to this model the raw ID is the best proxy we
# have — returning None would silently skip all ACL enforcement.
model = resolved or bedrock_model_id
return model