fix(credentials): preserve short masked values

litellm/proxy/credential_endpoints/endpoints.py

@@ -71,6 +71,9 @@ def _looks_like_masked_credential_value(
     if not isinstance(submitted_value, str) or "*" not in submitted_value:
         return False
 
+    if set(submitted_value) == {"*"}:
+        return True
+
     return _is_masked_credential_value(
         key=key,
         submitted_value=submitted_value,

tests/test_litellm/proxy/management_endpoints/credential_endpoints/test_credential_update.py

@@ -112,3 +112,37 @@ def test_preserve_masked_credential_value_on_decryption_failure():
         merged_credential.credential_values["api_key"]
         == "encrypted-with-old-master-key"
     )
+
+
+def test_preserve_short_masked_credential_value_on_decryption_failure():
+    db_credential = CredentialItem(
+        credential_name="short-secret",
+        credential_values={"api_key": "encrypted-short-secret"},
+        credential_info={},
+    )
+    updated_patch = CredentialItem(
+        credential_name="short-secret",
+        credential_values={"api_key": "*****", "api_base": "https://new.example"},
+        credential_info={},
+    )
+
+    with (
+        patch(
+            "litellm.proxy.credential_endpoints.endpoints.decrypt_value_helper",
+            return_value=None,
+        ),
+        patch(
+            "litellm.proxy.credential_endpoints.endpoints.encrypt_value_helper",
+            side_effect=lambda value, new_encryption_key=None: f"encrypted:{value}",
+        ),
+    ):
+        sanitized_patch = _preserve_masked_credential_values(
+            db_credential, updated_patch
+        )
+        merged_credential = update_db_credential(db_credential, sanitized_patch)
+
+    assert sanitized_patch.credential_values == {"api_base": "https://new.example"}
+    assert merged_credential.credential_values["api_key"] == "encrypted-short-secret"
+    assert merged_credential.credential_values["api_base"] == (
+        "encrypted:https://new.example"
+    )