From caaf368652f87f73277faa6353cd2e0b4261de6e Mon Sep 17 00:00:00 2001
From: yassin <yassin@berri.ai>
Date: Mon, 14 Sep 2026 19:48:45 +0000
Subject: [PATCH] fix(proxy): move credentials hint helper into discovery
 module to break CodeQL import cycle

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/proxy/auth/auth_utils.py                      |  8 --------
 .../discovery_endpoints/ui_discovery_endpoints.py     | 11 ++++++++++-
 litellm/proxy/management_endpoints/ui_sso.py          |  2 +-
 litellm/proxy/proxy_server.py                         |  2 +-
 4 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/litellm/proxy/auth/auth_utils.py b/litellm/proxy/auth/auth_utils.py
index 128b789ee75..be65c3b39ec 100644
--- a/litellm/proxy/auth/auth_utils.py
+++ b/litellm/proxy/auth/auth_utils.py
@@ -552,14 +552,6 @@ def _coerce_metadata_to_dict(value: Any) -> dict[str, Any] | None:
     return None
 
 
-def should_hide_default_credentials_hint(general_settings: Mapping[str, object]) -> bool:
-    return (
-        os.getenv("LITELLM_HIDE_DEFAULT_CREDENTIALS_HINT", "false").lower() == "true"
-        or general_settings.get("hide_default_credentials_hint", False) is True
-        or bool(os.getenv("UI_PASSWORD"))
-    )
-
-
 async def pre_db_read_auth_checks(
     request: Request,
     request_data: dict,
diff --git a/litellm/proxy/discovery_endpoints/ui_discovery_endpoints.py b/litellm/proxy/discovery_endpoints/ui_discovery_endpoints.py
index 07fd04a74fb..e0efe9dea2c 100644
--- a/litellm/proxy/discovery_endpoints/ui_discovery_endpoints.py
+++ b/litellm/proxy/discovery_endpoints/ui_discovery_endpoints.py
@@ -1,5 +1,6 @@
 #### Analytics Endpoints #####
 import os
+from collections.abc import Mapping
 from typing import Final
 
 from fastapi import APIRouter
@@ -11,10 +12,18 @@ from litellm.types.proxy.discovery_endpoints.ui_discovery_endpoints import (
 router: Final = APIRouter()
 
 
+def should_hide_default_credentials_hint(general_settings: Mapping[str, object]) -> bool:
+    return (
+        os.getenv("LITELLM_HIDE_DEFAULT_CREDENTIALS_HINT", "false").lower() == "true"
+        or general_settings.get("hide_default_credentials_hint", False) is True
+        or bool(os.getenv("UI_PASSWORD"))
+    )
+
+
 @router.get("/.well-known/litellm-ui-config", response_model=UiDiscoveryEndpoints)
 @router.get("/litellm/.well-known/litellm-ui-config", response_model=UiDiscoveryEndpoints)  # if mounted at root path
 async def get_ui_config():
-    from litellm.proxy.auth.auth_utils import has_user_setup_sso, should_hide_default_credentials_hint
+    from litellm.proxy.auth.auth_utils import has_user_setup_sso
     from litellm.proxy.proxy_server import general_settings
     from litellm.proxy.utils import get_proxy_base_url, get_server_root_path
 
diff --git a/litellm/proxy/management_endpoints/ui_sso.py b/litellm/proxy/management_endpoints/ui_sso.py
index ab916e8df1b..6a775998f4f 100644
--- a/litellm/proxy/management_endpoints/ui_sso.py
+++ b/litellm/proxy/management_endpoints/ui_sso.py
@@ -92,7 +92,6 @@ from litellm.proxy.auth.auth_checks import ExperimentalUIJWTToken, get_user_obje
 from litellm.proxy.auth.auth_utils import (
     _get_request_ip_address,
     has_user_setup_sso,
-    should_hide_default_credentials_hint,
 )
 from litellm.proxy.auth.handle_jwt import JWTHandler
 from litellm.proxy.auth.ip_address_utils import IPAddressUtils
@@ -107,6 +106,7 @@ from litellm.proxy.common_utils.html_forms.jwt_display_template import (
 )
 from litellm.proxy.common_utils.html_forms.ui_login import build_ui_login_form
 from litellm.proxy.common_utils.user_api_key_cache import UserApiKeyCache
+from litellm.proxy.discovery_endpoints.ui_discovery_endpoints import should_hide_default_credentials_hint
 from litellm.proxy.management_endpoints.internal_user_endpoints import new_user
 from litellm.proxy.management_endpoints.sso import CustomMicrosoftSSO
 from litellm.proxy.management_endpoints.sso.id_jag_assertion_capture import (
diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index 5b3d6365df4..230513d7eb4 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -318,7 +318,6 @@ from litellm.proxy.auth.auth_utils import (
     check_response_size_is_safe,
     is_request_body_safe,
     log_once_if_budget_reservation_disabled,
-    should_hide_default_credentials_hint,
     warn_once_if_custom_auth_skips_common_checks,
 )
 from litellm.proxy.auth.fallback_model_access import router_fallback_access_check
@@ -451,6 +450,7 @@ from litellm.proxy.discovery_endpoints import (
     agent_skills_discovery_router,
     ui_discovery_endpoints_router,
 )
+from litellm.proxy.discovery_endpoints.ui_discovery_endpoints import should_hide_default_credentials_hint
 from litellm.proxy.fine_tuning_endpoints.endpoints import router as fine_tuning_router
 from litellm.proxy.fine_tuning_endpoints.endpoints import set_fine_tuning_config
 from litellm.proxy.google_endpoints.endpoints import router as google_router