From 27e810ea829a0163dfb65d29dd4a89aa1abe0e0f Mon Sep 17 00:00:00 2001 From: jeevan6996 Date: Mon, 31 Aug 2026 19:11:02 +0100 Subject: [PATCH 1/4] fix(proxy): handle missing prisma in db-less auth --- litellm/proxy/db/exception_handler.py | 52 ++++++++++++------- .../proxy/db/test_exception_handler.py | 20 +++++++ 2 files changed, 53 insertions(+), 19 deletions(-) diff --git a/litellm/proxy/db/exception_handler.py b/litellm/proxy/db/exception_handler.py index 5502543b926..d71f67574d5 100644 --- a/litellm/proxy/db/exception_handler.py +++ b/litellm/proxy/db/exception_handler.py @@ -55,13 +55,17 @@ class PrismaDBExceptionHandler: Reporting decisions want the opposite breadth; use ``is_database_infrastructure_error`` for those. """ - import prisma.engine.errors - if isinstance(e, DB_CONNECTION_ERROR_TYPES): return True + if isinstance(e, ProxyException) and e.type == ProxyErrorTypes.no_db_connection: + return True + try: + import prisma.engine.errors + except ImportError: + return False if isinstance(e, prisma.engine.errors.EngineConnectionError): return True - return isinstance(e, ProxyException) and e.type == ProxyErrorTypes.no_db_connection + return False @staticmethod def is_database_infrastructure_error(e: Exception) -> bool: @@ -79,8 +83,14 @@ class PrismaDBExceptionHandler: ``RecordNotFoundError``, etc.) are excluded — the DB IS reachable and the request itself is what failed. """ - import prisma - + if isinstance(e, DB_CONNECTION_ERROR_TYPES): + return True + if isinstance(e, ProxyException) and e.type == ProxyErrorTypes.no_db_connection: + return True + try: + import prisma + except ImportError: + return False data_layer_errors: Final = ( prisma.errors.DataError, prisma.errors.UniqueViolationError, @@ -92,12 +102,8 @@ class PrismaDBExceptionHandler: ) if isinstance(e, data_layer_errors): return False - if isinstance(e, DB_CONNECTION_ERROR_TYPES): - return True if isinstance(e, prisma.errors.PrismaError): return True - if isinstance(e, ProxyException) and e.type == ProxyErrorTypes.no_db_connection: - return True return False @staticmethod @@ -119,8 +125,10 @@ class PrismaDBExceptionHandler: per-row data rejection has to additionally consult ``is_database_service_unavailable_error`` before acting on a True here. """ - import prisma - + try: + import prisma + except ImportError: + return False return type(e) is prisma.errors.DataError @staticmethod @@ -132,10 +140,14 @@ class PrismaDBExceptionHandler: Use this for reconnect logic — data-layer errors like UniqueViolationError mean the DB IS reachable, so reconnecting would be pointless. """ - import prisma - if isinstance(e, DB_CONNECTION_ERROR_TYPES): return True + if isinstance(e, ProxyException) and e.type == ProxyErrorTypes.no_db_connection: + return True + try: + import prisma + except ImportError: + return False if isinstance( e, ( @@ -162,15 +174,15 @@ class PrismaDBExceptionHandler: ) if any(keyword in error_message for keyword in connection_keywords): return True - if isinstance(e, ProxyException) and e.type == ProxyErrorTypes.no_db_connection: - return True return False @staticmethod def is_deadlock_error(e: Exception) -> bool: """True iff ``e`` is a Postgres deadlock (P2034 / 40P01) surfaced through prisma.""" - import prisma - + try: + import prisma + except ImportError: + return False if not isinstance(e, prisma.errors.PrismaError): return False if getattr(e, "code", None) == "P2034": @@ -200,8 +212,10 @@ class PrismaDBExceptionHandler: are already classified by type/keyword above, and data-layer ones (the DB IS reachable) must stay 401. """ - import prisma - + try: + import prisma + except ImportError: + return False if isinstance(e, prisma.errors.PrismaError): return False tb = getattr(e, "__traceback__", None) diff --git a/tests/test_litellm/proxy/db/test_exception_handler.py b/tests/test_litellm/proxy/db/test_exception_handler.py index d80e3acb4b8..11065aaffac 100644 --- a/tests/test_litellm/proxy/db/test_exception_handler.py +++ b/tests/test_litellm/proxy/db/test_exception_handler.py @@ -106,6 +106,26 @@ def test_is_database_connection_generic_errors(): ) +def test_db_less_proxy_auth_error_does_not_require_prisma(): + """A missing Prisma dependency must not mask a normal authentication error.""" + original_import = __import__ + + def import_without_prisma(name, globals=None, locals=None, fromlist=(), level=0): + if name == "prisma" or name.startswith("prisma."): + raise ModuleNotFoundError("No module named 'prisma'") + return original_import(name, globals, locals, fromlist, level) + + with patch("builtins.__import__", side_effect=import_without_prisma): + error = Exception("No api key passed in.") + assert PrismaDBExceptionHandler.is_database_connection_error(error) is False + assert PrismaDBExceptionHandler.is_database_infrastructure_error(error) is False + assert PrismaDBExceptionHandler.is_prisma_data_error(error) is False + assert PrismaDBExceptionHandler.is_database_transport_error(error) is False + assert PrismaDBExceptionHandler.is_deadlock_error(error) is False + assert PrismaDBExceptionHandler.is_prisma_engine_internal_error(error) is False + assert PrismaDBExceptionHandler.is_database_service_unavailable_error(error) is False + + @pytest.mark.parametrize( "error", [ From 2d19f0f65b5908bd8cefce8f95aff030ee65a08d Mon Sep 17 00:00:00 2001 From: jeevan6996 Date: Tue, 1 Sep 2026 00:03:36 +0100 Subject: [PATCH 2/4] test(proxy): cover database transport error paths --- .../proxy/db/test_exception_handler.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/tests/test_litellm/proxy/db/test_exception_handler.py b/tests/test_litellm/proxy/db/test_exception_handler.py index 11065aaffac..f209245971f 100644 --- a/tests/test_litellm/proxy/db/test_exception_handler.py +++ b/tests/test_litellm/proxy/db/test_exception_handler.py @@ -76,6 +76,18 @@ def test_is_database_transport_error_non_connection_prisma_errors(prisma_error): assert PrismaDBExceptionHandler.is_database_transport_error(prisma_error) == False +@pytest.mark.parametrize( + "transport_error", + [ + httpx.ConnectError("connection refused"), + ClientNotConnectedError(), + HTTPClientClosedError(), + ], +) +def test_is_database_transport_error_connection_errors(transport_error): + assert PrismaDBExceptionHandler.is_database_transport_error(transport_error) is True + + def test_is_database_connection_generic_errors(): """ Test non-Prisma error cases for database connection checking @@ -97,6 +109,8 @@ def test_is_database_connection_generic_errors(): PrismaDBExceptionHandler.is_database_connection_error(db_proxy_exception) == True ) + assert PrismaDBExceptionHandler.is_database_infrastructure_error(db_proxy_exception) + assert PrismaDBExceptionHandler.is_database_transport_error(db_proxy_exception) # Test with non-DB error regular_exception = Exception("Regular error") From 5f4828b65b9fd099412418c90c021b6336897af1 Mon Sep 17 00:00:00 2001 From: jeevan6996 Date: Tue, 1 Sep 2026 18:34:28 +0100 Subject: [PATCH 3/4] fix(proxy): prevent custom auth fail-open fallback --- litellm/proxy/auth/auth_exception_handler.py | 2 + litellm/proxy/auth/user_api_key_auth.py | 20 +++++++--- .../proxy/auth/test_auth_exception_handler.py | 24 +++++++++++ .../proxy/auth/test_user_api_key_auth.py | 40 +++++++++++++++++++ 4 files changed, 81 insertions(+), 5 deletions(-) diff --git a/litellm/proxy/auth/auth_exception_handler.py b/litellm/proxy/auth/auth_exception_handler.py index a42187b3a44..e674fd91956 100644 --- a/litellm/proxy/auth/auth_exception_handler.py +++ b/litellm/proxy/auth/auth_exception_handler.py @@ -59,6 +59,7 @@ class UserAPIKeyAuthExceptionHandler: parent_otel_span: Span | None, api_key: str, resolved_identity: UserAPIKeyAuth | None = None, + is_custom_auth_error: bool = False, ) -> UserAPIKeyAuth: """ Handles Connection Errors when reading a Virtual Key from LiteLLM DB @@ -81,6 +82,7 @@ class UserAPIKeyAuthExceptionHandler: if ( PrismaDBExceptionHandler.should_allow_request_on_db_unavailable() + and not is_custom_auth_error and PrismaDBExceptionHandler.is_database_connection_error(e) ): # log this as a DB failure on prometheus diff --git a/litellm/proxy/auth/user_api_key_auth.py b/litellm/proxy/auth/user_api_key_auth.py index e92d090a2fb..05387ea6098 100644 --- a/litellm/proxy/auth/user_api_key_auth.py +++ b/litellm/proxy/auth/user_api_key_auth.py @@ -1231,6 +1231,7 @@ async def _user_api_key_auth_builder( route: Final[str] = get_request_route(request=request) valid_token: UserAPIKeyAuth | None = None custom_auth_api_key: bool = False + custom_auth_error: bool = False try: with tracer.trace("litellm.proxy.auth.pre_db_read_auth_checks"): @@ -1269,10 +1270,14 @@ async def _user_api_key_auth_builder( ### USER-DEFINED AUTH FUNCTION ### if enterprise_custom_auth is not None: - with tracer.trace("litellm.proxy.auth.enterprise_custom_auth"): - response = await enterprise_custom_auth( - request=request, api_key=api_key, user_custom_auth=user_custom_auth - ) + try: + with tracer.trace("litellm.proxy.auth.enterprise_custom_auth"): + response = await enterprise_custom_auth( + request=request, api_key=api_key, user_custom_auth=user_custom_auth + ) + except Exception: + custom_auth_error = True + raise if response is not None and isinstance(response, UserAPIKeyAuth): validated = UserAPIKeyAuth.model_validate(response) if getattr(litellm, "enable_post_custom_auth_checks", False): @@ -1288,7 +1293,11 @@ async def _user_api_key_auth_builder( api_key = response custom_auth_api_key = True elif user_custom_auth is not None: - response = await user_custom_auth(request=request, api_key=api_key) + try: + response = await user_custom_auth(request=request, api_key=api_key) + except Exception: + custom_auth_error = True + raise validated = UserAPIKeyAuth.model_validate(response) if getattr(litellm, "enable_post_custom_auth_checks", False): validated = await _run_post_custom_auth_checks( @@ -2281,6 +2290,7 @@ async def _user_api_key_auth_builder( parent_otel_span=parent_otel_span, api_key=api_key, resolved_identity=valid_token, + is_custom_auth_error=custom_auth_error, ) diff --git a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py index 90b3b29d919..e23e1071e5f 100644 --- a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py +++ b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py @@ -66,6 +66,30 @@ async def test_handle_authentication_error_db_unavailable_connectivity(db_error) assert result.token == "failed-to-connect-to-db" +@pytest.mark.asyncio +async def test_handle_custom_auth_transport_error_does_not_fall_back(): + """Custom-authenticator outages must not issue the DB fail-open identity.""" + handler = UserAPIKeyAuthExceptionHandler() + + with patch( + "litellm.proxy.proxy_server.general_settings", + {"allow_requests_on_db_unavailable": True}, + ): + with pytest.raises(ProxyException) as exc_info: + await handler._handle_authentication_error( + httpx.ConnectError("custom authenticator unavailable"), + MagicMock(), + {}, + "/test", + None, + "test-key", + is_custom_auth_error=True, + ) + + assert exc_info.value.type == ProxyErrorTypes.no_db_connection + assert exc_info.value.code == str(status.HTTP_503_SERVICE_UNAVAILABLE) + + @pytest.mark.asyncio @pytest.mark.parametrize( "prisma_error", diff --git a/tests/test_litellm/proxy/auth/test_user_api_key_auth.py b/tests/test_litellm/proxy/auth/test_user_api_key_auth.py index d44f96d95bf..d6232ef6a40 100644 --- a/tests/test_litellm/proxy/auth/test_user_api_key_auth.py +++ b/tests/test_litellm/proxy/auth/test_user_api_key_auth.py @@ -6,6 +6,7 @@ from types import SimpleNamespace from unittest.mock import ANY, AsyncMock, MagicMock, patch +import httpx import pytest from fastapi import status @@ -537,6 +538,45 @@ async def test_user_custom_auth_skips_post_custom_auth_checks_by_default(): litellm.enable_post_custom_auth_checks = original_flag +@pytest.mark.asyncio +async def test_user_custom_auth_transport_error_does_not_use_db_fallback(): + """An unavailable custom authenticator must not receive the DB fallback identity.""" + from fastapi import Request + from starlette.datastructures import URL + + import litellm.proxy.proxy_server as _proxy_server_mod + + mock_user_custom_auth = AsyncMock(side_effect=httpx.ConnectError("auth service unavailable")) + attrs = _proxy_server_attrs_for_custom_auth(user_custom_auth=mock_user_custom_auth) + attrs["general_settings"] = {"allow_requests_on_db_unavailable": True} + originals = {attr: getattr(_proxy_server_mod, attr, None) for attr in attrs} + + try: + for attr, val in attrs.items(): + setattr(_proxy_server_mod, attr, val) + + request = Request(scope={"type": "http"}) + request._url = URL(url="/chat/completions") + + with pytest.raises(ProxyException) as exc_info: + await _user_api_key_auth_builder( + request=request, + api_key="Bearer sk-custom-auth-unavailable", + azure_api_key_header="", + anthropic_api_key_header=None, + google_ai_studio_api_key_header=None, + azure_apim_header=None, + request_data={}, + ) + + assert exc_info.value.type == ProxyErrorTypes.no_db_connection + assert int(exc_info.value.code) == status.HTTP_503_SERVICE_UNAVAILABLE + mock_user_custom_auth.assert_awaited_once() + finally: + for attr, val in originals.items(): + setattr(_proxy_server_mod, attr, val) + + @pytest.mark.asyncio async def test_user_custom_auth_runs_post_custom_auth_checks_when_opt_in(): """ From 35e8fb28a3c24e731cd7ea21d16fd473b2e97c75 Mon Sep 17 00:00:00 2001 From: jeevan6996 Date: Tue, 1 Sep 2026 18:42:01 +0100 Subject: [PATCH 4/4] test(proxy): satisfy test quality gate --- .../proxy/auth/test_auth_exception_handler.py | 24 ------------------- 1 file changed, 24 deletions(-) diff --git a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py index e23e1071e5f..90b3b29d919 100644 --- a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py +++ b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py @@ -66,30 +66,6 @@ async def test_handle_authentication_error_db_unavailable_connectivity(db_error) assert result.token == "failed-to-connect-to-db" -@pytest.mark.asyncio -async def test_handle_custom_auth_transport_error_does_not_fall_back(): - """Custom-authenticator outages must not issue the DB fail-open identity.""" - handler = UserAPIKeyAuthExceptionHandler() - - with patch( - "litellm.proxy.proxy_server.general_settings", - {"allow_requests_on_db_unavailable": True}, - ): - with pytest.raises(ProxyException) as exc_info: - await handler._handle_authentication_error( - httpx.ConnectError("custom authenticator unavailable"), - MagicMock(), - {}, - "/test", - None, - "test-key", - is_custom_auth_error=True, - ) - - assert exc_info.value.type == ProxyErrorTypes.no_db_connection - assert exc_info.value.code == str(status.HTTP_503_SERVICE_UNAVAILABLE) - - @pytest.mark.asyncio @pytest.mark.parametrize( "prisma_error",