Merge commit '1bb9b175e2736c997e68eaa357b6f6bf7880b34f' into litellm_python_version_ci

enterprise/litellm_enterprise/proxy/management_endpoints/internal_user_endpoints.py

@@ -39,9 +39,9 @@ async def available_enterprise_users(
 
     if not premium_user:
         # check if SSO is enabled - show 5 user limit
-        from litellm.proxy.auth.auth_utils import _has_user_setup_sso
+        from litellm.proxy.auth.auth_utils import has_user_setup_sso
 
-        if _has_user_setup_sso():
+        if has_user_setup_sso():
             premium_user_data = EnterpriseLicenseData(
                 max_users=5,
             )

litellm/integrations/otel/langfuse_logger.py

@@ -0,0 +1,60 @@
+from collections.abc import AsyncGenerator, AsyncIterator, Callable, Mapping
+from typing import TYPE_CHECKING, Final
+
+from litellm._logging import verbose_logger
+from litellm.integrations.otel.logger import OpenTelemetryV2
+from litellm.integrations.otel.mappers.langfuse import LANGFUSE_OBSERVATION_INPUT, LANGFUSE_OBSERVATION_OUTPUT
+from litellm.integrations.otel.model.request_io import request_input, response_output, stream_output
+from litellm.integrations.otel.plumbing.context import request_root_span
+
+if TYPE_CHECKING:
+    from litellm.proxy._types import UserAPIKeyAuth
+    from litellm.types.utils import ModelResponseStream
+
+
+class LangfuseOpenTelemetryV2(OpenTelemetryV2):
+    """Stamps the request's input and output on the root observation while it is still recording.
+
+    Langfuse shows a trace's input and output from its root observation. The proxy's root span ends
+    when the response is sent, before the success callback runs, so both stamps come from the
+    post-call hooks in the request task: the request as it stands after the pre-call chain and the
+    response as it is returned, for the call types whose response renders as a message.
+    """
+
+    async def async_post_call_success_hook(
+        self,
+        data: Mapping[str, object],
+        user_api_key_dict: "UserAPIKeyAuth",
+        response: object,
+    ) -> None:
+        self._stamp_root_io(data, lambda: response_output(response))
+
+    async def async_post_call_streaming_iterator_hook(
+        self,
+        user_api_key_dict: "UserAPIKeyAuth",
+        response: "AsyncIterator[ModelResponseStream]",
+        request_data: Mapping[str, object],
+    ) -> "AsyncGenerator[ModelResponseStream, None]":
+        relayed: Final[list[ModelResponseStream]] = []  # mutable-ok: relayed as they arrive, assembled at end of stream
+        async for chunk in response:
+            relayed.append(chunk)
+            yield chunk
+        self._stamp_root_io(request_data, lambda: stream_output(tuple(relayed), request_data))
+
+    def _stamp_root_io(self, data: Mapping[str, object], render_output: Callable[[], str | None]) -> None:
+        root: Final = request_root_span()
+        if root is None or not root.is_recording():
+            return
+        try:
+            output: Final = render_output()
+            if output is None:
+                return
+            root.set_attribute(LANGFUSE_OBSERVATION_OUTPUT, output)
+            rendered_input: Final = request_input(data)
+        except Exception:  # noqa: BLE001  # telemetry must never fail the request it describes
+            verbose_logger.debug(
+                "otel v2 langfuse: could not render the root observation input or output", exc_info=True
+            )
+            return
+        if rendered_input is not None:
+            root.set_attribute(LANGFUSE_OBSERVATION_INPUT, rendered_input)

litellm/integrations/otel/logger.py

@@ -4,6 +4,7 @@ from collections import OrderedDict
 from collections.abc import Callable, Iterator, Mapping, Sequence
 from contextlib import contextmanager
 from datetime import datetime
+from types import MappingProxyType
 from typing import TYPE_CHECKING, Any, Final, cast
 
 from opentelemetry.context import Context, attach, get_current
@@ -909,3 +910,29 @@ def phase_span(name: str) -> "Iterator[Span | None]":
         return
     with logger.start_phase_span(name) as span:
         yield span
+
+
+def build_otel_v2_logger(
+    config: OpenTelemetryV2Config,
+    callback_name: str | None = None,
+    tracer_provider: TracerProvider | None = None,
+    logger_provider: LoggerProvider | None = None,
+    meter_provider: "MeterProvider | None" = None,
+    settings: Mapping[str, object] = MappingProxyType({}),
+) -> OpenTelemetryV2:
+    return _logger_class(config)(
+        config=config,
+        callback_name=callback_name,
+        tracer_provider=tracer_provider,
+        logger_provider=logger_provider,
+        meter_provider=meter_provider,
+        **settings,
+    )
+
+
+def _logger_class(config: OpenTelemetryV2Config) -> type[OpenTelemetryV2]:
+    if "langfuse" not in config.mapper_names or not config.capture_span_content:
+        return OpenTelemetryV2
+    from litellm.integrations.otel.langfuse_logger import LangfuseOpenTelemetryV2
+
+    return LangfuseOpenTelemetryV2

litellm/integrations/otel/mappers/langfuse.py

@@ -11,6 +11,7 @@ the JSON-serialized payloads. ``_llm_call`` just applies both tables.
 
 import json
 from collections.abc import Callable
+from typing import Final
 
 from litellm.integrations.otel.mappers.base import AttributeMap, AttrValue, SpanData
 from litellm.integrations.otel.mappers.utils import (
@@ -25,6 +26,9 @@ from litellm.integrations.otel.model.payloads import (
     LLMUsage,
 )
 
+LANGFUSE_OBSERVATION_INPUT: Final = "langfuse.observation.input"
+LANGFUSE_OBSERVATION_OUTPUT: Final = "langfuse.observation.output"
+
 
 class LangfuseMapper:
     _LLM_CALL_ATTRS: dict[str, Callable[[LLMCallSpanData], AttrValue | None]] = {
@@ -56,8 +60,8 @@ class LangfuseMapper:
         "langfuse.observation.model.parameters": lambda d: json_if(
             collect(LangfuseMapper._MODEL_PARAMS, d.request_params)
         ),
-        "langfuse.observation.input": lambda d: serialize_messages(d.messages_in),
-        "langfuse.observation.output": lambda d: serialize_messages(output_messages(d)),
+        LANGFUSE_OBSERVATION_INPUT: lambda d: serialize_messages(d.messages_in),
+        LANGFUSE_OBSERVATION_OUTPUT: lambda d: serialize_messages(output_messages(d)),
         "langfuse.observation.usage_details": lambda d: json_if(collect(LangfuseMapper._USAGE_FIELDS, d.usage)),
         "langfuse.observation.cost_details": lambda d: (
             json.dumps({"total": d.response_cost}) if d.response_cost is not None else None

litellm/integrations/otel/model/request_io.py

@@ -0,0 +1,90 @@
+from collections.abc import Mapping, Sequence
+from typing import Final, Literal
+
+from pydantic import BaseModel, ConfigDict, Field, TypeAdapter, ValidationError
+from typing_extensions import ReadOnly, TypedDict
+
+import litellm
+from litellm.integrations.otel.mappers.utils import json_or_none
+from litellm.proxy.guardrails.anthropic_sse import assemble_anthropic_sse_stream, is_raw_sse_stream
+from litellm.types.llms.openai import ResponseCompletedEvent, ResponsesAPIResponse
+from litellm.types.utils import ModelResponse, ModelResponseStream
+
+_SYSTEM_KEYS: Final = ("system", "instructions")
+_TURNS: Final = TypeAdapter(tuple[object, ...])
+_MESSAGES: Final = TypeAdapter(list[object] | None)
+
+
+class _Turn(TypedDict):
+    role: ReadOnly[str]
+    content: ReadOnly[object]
+
+
+class _AnthropicMessage(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    type: Literal["message"] = Field(exclude=True)
+    role: str = "assistant"
+    content: object = None
+
+
+def request_input(data: Mapping[str, object]) -> str | None:
+    turns: Final = data.get("messages", data.get("input"))
+    if turns is None:
+        return None
+    return json_or_none((*_system_turns(data), *_user_turns(turns)))
+
+
+def _system_turns(data: Mapping[str, object]) -> tuple[_Turn, ...]:
+    return tuple(_Turn(role="system", content=data[key]) for key in _SYSTEM_KEYS if data.get(key) is not None)
+
+
+def _user_turns(turns: object) -> tuple[object, ...]:
+    if isinstance(turns, str):
+        return (_Turn(role="user", content=turns),)
+    try:
+        return _TURNS.validate_python(turns)
+    except ValidationError:
+        return (_Turn(role="user", content=turns),)
+
+
+def response_output(response: object) -> str | None:
+    match response:
+        case ModelResponse():
+            return json_or_none(tuple(choice.message.model_dump(exclude_none=True) for choice in response.choices))
+        case ResponsesAPIResponse():
+            return json_or_none(response.model_dump(exclude_none=True).get("output"))
+        case _:
+            return _anthropic_message_output(response)
+
+
+def _anthropic_message_output(message: object) -> str | None:
+    try:
+        parsed: Final = _AnthropicMessage.model_validate(message)
+    except ValidationError:
+        return None
+    return json_or_none((parsed.model_dump(),))
+
+
+def stream_output(chunks: Sequence[object], data: Mapping[str, object]) -> str | None:
+    if not chunks:
+        return None
+    if is_raw_sse_stream(chunks):
+        return response_output(assemble_anthropic_sse_stream(chunks))
+    if all(isinstance(chunk, ModelResponseStream) for chunk in chunks):
+        return response_output(_assembled_chat_stream(chunks, data))
+    return response_output(_completed_response(chunks))
+
+
+def _assembled_chat_stream(chunks: Sequence[object], data: Mapping[str, object]) -> object:
+    try:
+        return litellm.stream_chunk_builder(  # pyright: ignore[reportUnknownMemberType]  # upstream types chunks as a bare list
+            chunks=list(chunks),  # mutable-ok: stream_chunk_builder takes a list
+            messages=_MESSAGES.validate_python(data.get("messages")),
+        )
+    except (litellm.APIError, ValidationError):
+        return None
+
+
+def _completed_response(chunks: Sequence[object]) -> ResponsesAPIResponse | None:
+    return next((chunk.response for chunk in reversed(chunks) if isinstance(chunk, ResponseCompletedEvent)), None)

litellm/litellm_core_utils/litellm_logging.py

@@ -4390,13 +4390,15 @@ def _init_custom_logger_compatible_class(
             from litellm.integrations.otel.model.config import is_otel_v2_enabled
 
             if is_otel_v2_enabled():
-                from litellm.integrations.otel.logger import OpenTelemetryV2
+                from litellm.integrations.otel.logger import OpenTelemetryV2, build_otel_v2_logger
+                from litellm.integrations.otel.model.config import OpenTelemetryV2Config
 
                 for callback in _in_memory_loggers:
-                    if type(callback) is OpenTelemetryV2:
+                    if isinstance(callback, OpenTelemetryV2):
                         return callback
-                otel_logger_v2: Final = OpenTelemetryV2(
-                    **_get_custom_logger_settings_from_proxy_server(callback_name=logging_integration)
+                otel_settings: Final = _get_custom_logger_settings_from_proxy_server(callback_name=logging_integration)
+                otel_logger_v2: Final = build_otel_v2_logger(
+                    config=OpenTelemetryV2Config(**otel_settings), settings=otel_settings
                 )
                 _in_memory_loggers.append(otel_logger_v2)
                 _maybe_auto_initialize_arize_phoenix(_in_memory_loggers)
@@ -4759,7 +4761,7 @@ def _maybe_construct_otel_v2(callback_name: str, _in_memory_loggers: list[Custom
 
     if not is_otel_v2_enabled():
         return None
-    from litellm.integrations.otel.logger import OpenTelemetryV2
+    from litellm.integrations.otel.logger import OpenTelemetryV2, build_otel_v2_logger
     from litellm.integrations.otel.presets import PRESET_BY_CALLBACK
 
     preset_fn: Final = PRESET_BY_CALLBACK.get(callback_name)
@@ -4774,7 +4776,7 @@ def _maybe_construct_otel_v2(callback_name: str, _in_memory_loggers: list[Custom
         # If env vars are missing or the preset raises, defer to the legacy path
         # so customers get the same error story they had before V2 landed.
         return None
-    v2_logger: Final = OpenTelemetryV2(config=config, callback_name=callback_name)
+    v2_logger: Final = build_otel_v2_logger(config=config, callback_name=callback_name)
     _in_memory_loggers.append(v2_logger)
     return v2_logger
 

litellm/llms/base_llm/files/azure_blob_storage_backend.py

@@ -7,16 +7,36 @@ to reuse all authentication and Azure Storage operations.
 """
 
 import time
+from pathlib import Path
 from typing import Final
 from urllib.parse import quote, urlparse
 
 from litellm._logging import verbose_logger
 from litellm._uuid import uuid
 from litellm.integrations.azure_storage.azure_storage import AzureBlobStorageLogger
+from litellm.proxy.common_utils.path_utils import safe_filename
 
 from .storage_backend import BaseFileStorageBackend
 
 
+def _safe_basename(original_filename: str) -> str:
+    try:
+        return safe_filename(original_filename)
+    except ValueError:
+        return "file"
+
+
+def _safe_extension(original_filename: str) -> str:
+    """The extension off a basename, with no path separators or traversal sequences.
+
+    original_filename.split(".")[-1] does not parse path structure, so a filename
+    like "a.jsonl/../../etc/cron.d/x" would put "../../etc/cron.d/x" straight into
+    the blob path built below. Path.suffix only ever looks at the last path
+    component, so routing through safe_filename() first closes that off.
+    """
+    return Path(_safe_basename(original_filename)).suffix.lstrip(".")
+
+
 class AzureBlobStorageBackend(BaseFileStorageBackend, AzureBlobStorageLogger):
     """
     Azure Blob Storage backend implementation.
@@ -81,16 +101,15 @@ class AzureBlobStorageBackend(BaseFileStorageBackend, AzureBlobStorageLogger):
     def _generate_file_name(self, original_filename: str, file_naming_strategy: str) -> str:
         """Generate file name based on naming strategy."""
         if file_naming_strategy == "original_filename":
-            # Use original filename, but sanitize it
-            return quote(original_filename, safe="")
+            return quote(_safe_basename(original_filename), safe="")
         elif file_naming_strategy == "timestamp":
             # Use timestamp
-            extension = original_filename.split(".")[-1] if "." in original_filename else ""
+            extension = _safe_extension(original_filename)
             timestamp: Final = int(time.time() * 1000)  # milliseconds
             return f"{timestamp}.{extension}" if extension else str(timestamp)
         else:  # default to "uuid"
             # Use UUID
-            extension = original_filename.split(".")[-1] if "." in original_filename else ""
+            extension = _safe_extension(original_filename)
             file_uuid: Final = str(uuid.uuid4())
             return f"{file_uuid}.{extension}" if extension else file_uuid
 

litellm/proxy/_types.py

@@ -2508,6 +2508,14 @@ class ConfigGeneralSettings(LiteLLMPydanticObjectBase):
         None,
         description="max batch input file size in MB for /v1/files uploads with purpose=batch, if a file is larger than this size it will be rejected before being forwarded to the provider",
     )
+    max_file_size_mb: int | None = Field(
+        None,
+        description="max file size in MB for /v1/files uploads, for any purpose, if a file is larger than this size it will be rejected before being forwarded to the provider",
+    )
+    blocked_file_extensions: tuple[str, ...] | None = Field(
+        None,
+        description="file extensions (e.g. ['.exe', '.sh']) rejected on /v1/files uploads, for any purpose, matched case-insensitively against the uploaded filename",
+    )
     max_response_size_mb: int | None = Field(
         None,
         description="max response size in MB, if a response is larger than this size it will be rejected",
@@ -2696,6 +2704,40 @@ class ConfigGeneralSettings(LiteLLMPydanticObjectBase):
         None,
         description="List of MCP server fields that must be filled in for a submission to pass standards checks (e.g. ['description', 'source_url', 'alias']).",
     )
+    password_policy_min_length: int | None = Field(
+        None,
+        description=(
+            "Minimum length required for a locally-managed user's password. Default is 12; "
+            "a value below 8 is floored to 8 rather than weakening the requirement further."
+        ),
+    )
+    password_policy_require_uppercase: bool | None = Field(
+        None,
+        description="If True (default), a locally-managed user's password must contain an uppercase letter.",
+    )
+    password_policy_require_lowercase: bool | None = Field(
+        None,
+        description="If True (default), a locally-managed user's password must contain a lowercase letter.",
+    )
+    password_policy_require_numbers: bool | None = Field(
+        None,
+        description="If True (default), a locally-managed user's password must contain a number.",
+    )
+    password_policy_require_special_characters: bool | None = Field(
+        None,
+        description="If True (default), a locally-managed user's password must contain a special (non-alphanumeric) character.",
+    )
+    disable_password_login_when_sso_enabled: bool | None = Field(
+        None,
+        description=(
+            "If True and SSO is configured (MICROSOFT_CLIENT_ID, GOOGLE_CLIENT_ID, "
+            "GENERIC_CLIENT_ID, or SAML_IDP_METADATA_URL/XML), disables username/password "
+            "login on /login, /v2/login, and /v3/login so SSO is the only way to reach the "
+            "Admin UI. An admin locked out of the UI can still administer the proxy over the "
+            "API with the master key; unset this setting and restart the proxy to restore "
+            "UI username/password login. Default is False."
+        ),
+    )
     disable_budget_reservation: bool | None = Field(
         None,
         description=(

litellm/proxy/agent_endpoints/agent_registry.py

@@ -6,8 +6,12 @@ from datetime import datetime, timezone
 from types import MappingProxyType
 from typing import TYPE_CHECKING, Final, NamedTuple, Protocol, TypedDict
 
+from pydantic import TypeAdapter, ValidationError
+
 import litellm
+from litellm.constants import REDACTED_BY_LITELM_STRING
 from litellm.litellm_core_utils.safe_json_dumps import safe_dumps
+from litellm.litellm_core_utils.sensitive_data_masker import SensitiveDataMasker
 from litellm.proxy.management_helpers.object_permission_utils import (
     handle_update_object_permission_common,
 )
@@ -52,6 +56,9 @@ class AgentRecord(Protocol):
     @property
     def agent_name(self) -> str: ...
 
+    @property
+    def litellm_params(self) -> Mapping[str, object] | None: ...
+
     @property
     def object_permission_id(self) -> str | None: ...
 
@@ -121,6 +128,188 @@ def _dump_agent_params(raw: Mapping[str, object]) -> dict[str, object]:
     return dict(raw) if raw else {}
 
 
+_AGENT_PARAMS_MASKER: Final = SensitiveDataMasker()
+_REDACT_AGENT_PARAMS_MAX_DEPTH: Final = 10
+_AGENT_PARAMS_ADAPTER: Final[TypeAdapter[dict[str, object]]] = TypeAdapter(
+    dict[str, object]
+)  # mutable-ok: safe_dumps() and AgentResponse.litellm_params both require a real dict, not a Mapping
+_AGENT_PARAMS_SEQUENCE_ADAPTER: Final[TypeAdapter[tuple[object, ...]]] = TypeAdapter(tuple[object, ...])
+_EMPTY_LITELLM_PARAMS: Final[Mapping[str, object]] = MappingProxyType({})
+
+
+def redact_sensitive_agent_litellm_params(litellm_params: object, _depth: int = 0) -> object:
+    """
+    Replace credential-bearing values in an agent's litellm_params with
+    ``REDACTED_BY_LITELM_STRING`` while preserving non-secret keys (``model``,
+    ``is_public``, rate-limit config). Used so list/get/create/update
+    responses never echo a stored provider credential back to the caller.
+
+    Handles a plain dict, a JSON-serialized string (some callers hold the
+    in-memory registry's params that way), and ``None`` at the top level;
+    anything else is passed through. Recursion depth is bounded to match the
+    convention documented in ``tests/code_coverage_tests/recursive_detector.py``.
+    """
+    if litellm_params is None:
+        return None
+    if isinstance(litellm_params, str):
+        if _depth >= _REDACT_AGENT_PARAMS_MAX_DEPTH:
+            return REDACTED_BY_LITELM_STRING
+        try:
+            parsed_params: Final = _AGENT_PARAMS_ADAPTER.validate_json(litellm_params)
+        except ValidationError:
+            return REDACTED_BY_LITELM_STRING
+        return json.dumps(_redact_agent_params_tree(parsed_params, _depth + 1))
+    return _redact_agent_params_tree(litellm_params, _depth)
+
+
+def _redact_agent_params_tree(value: object, _depth: int) -> object:
+    """Structural recursion over an already-parsed litellm_params value: a
+    dict redacts sensitive keys and recurses into the rest, a list redacts
+    each element (so a secret nested inside a list of provider configs is
+    still caught), and anything else -- including a plain string leaf, which
+    must never be re-interpreted as a JSON blob -- passes through unchanged.
+    """
+    if _depth >= _REDACT_AGENT_PARAMS_MAX_DEPTH:
+        return REDACTED_BY_LITELM_STRING
+    if isinstance(value, list):
+        typed_items: Final = _AGENT_PARAMS_SEQUENCE_ADAPTER.validate_python(value)
+        return tuple(_redact_agent_params_tree(item, _depth + 1) for item in typed_items)
+    if not isinstance(value, dict):
+        return value
+    typed_params: Final = _AGENT_PARAMS_ADAPTER.validate_python(value)
+    return {
+        key: (
+            REDACTED_BY_LITELM_STRING
+            if _AGENT_PARAMS_MASKER.is_sensitive_key(key)
+            else _redact_agent_params_tree(nested_value, _depth + 1)
+        )
+        for key, nested_value in typed_params.items()
+    }  # mutable-ok: consumed by json.dumps()/AgentResponse.litellm_params, both of which require a real dict
+
+
+def parse_agent_litellm_params(value: object) -> Mapping[str, object]:
+    """Normalize a stored litellm_params column to a read-only mapping.
+
+    The prisma Json column comes back as either an already-parsed dict or a
+    JSON string depending on the read path, so handle both rather than
+    assuming one. Only ever read from (merge-source lookups), never mutated
+    or re-serialized directly, so a read-only view is enough here.
+    """
+    if isinstance(value, str):
+        try:
+            return _AGENT_PARAMS_ADAPTER.validate_json(value)
+        except ValidationError:
+            return _EMPTY_LITELLM_PARAMS
+    if isinstance(value, Mapping):
+        try:
+            return _AGENT_PARAMS_ADAPTER.validate_python(value)
+        except ValidationError:
+            return _EMPTY_LITELLM_PARAMS
+    return _EMPTY_LITELLM_PARAMS
+
+
+_MISSING_AGENT_PARAM: Final = object()
+_RESTORE_AGENT_PARAMS_MAX_DEPTH: Final = 10
+
+
+def _restore_redacted_nested_value(incoming_value: object, existing_value: object, _depth: int) -> object:
+    """Recurse into a non-sensitively-named dict/list value so a secret
+    nested underneath it (e.g. inside a list of per-provider configs) is
+    still restored, not just top-level keys. Mirrors the shapes
+    ``redact_sensitive_agent_litellm_params`` recurses into on read, so
+    restore and redact stay symmetric.
+
+    List elements are paired with the existing list by position: with no
+    stable per-element identity in an arbitrary ``dict[str, object]`` schema,
+    index is the same correspondence every other part of this restore (and
+    the endpoints' existing full-replace-on-PUT semantics) already assumes.
+    This correctly preserves a masked secret across an ordinary edit of that
+    same entry's other fields; it does not protect against a caller who both
+    reorders/resizes the list AND echoes back a masked marker in the same
+    request, which is a known, narrow limitation (see LIT-6736 PR discussion)
+    rather than a cross-entry credential leak in the common case.
+
+    A value collapsed to the flat marker by the read side's depth cap is
+    recovered wholesale from ``existing_value`` (rather than the marker
+    string itself getting persisted) whenever ``existing_value`` isn't
+    already that same flat marker. Depth-bounded like its read-side
+    counterpart; a value at the cap is returned unchanged rather than
+    corrupted.
+    """
+    if incoming_value == REDACTED_BY_LITELM_STRING and existing_value != REDACTED_BY_LITELM_STRING:
+        return existing_value
+    if _depth >= _RESTORE_AGENT_PARAMS_MAX_DEPTH:
+        return incoming_value
+    if isinstance(incoming_value, Mapping):
+        typed_incoming_map: Final = _AGENT_PARAMS_ADAPTER.validate_python(incoming_value)
+        existing_map: Final = (
+            _AGENT_PARAMS_ADAPTER.validate_python(existing_value)
+            if isinstance(existing_value, Mapping)
+            else _EMPTY_LITELLM_PARAMS
+        )
+        return _restore_redacted_litellm_params(typed_incoming_map, existing_map, _depth + 1)
+    if isinstance(incoming_value, (list, tuple)):
+        typed_incoming_seq: Final = _AGENT_PARAMS_SEQUENCE_ADAPTER.validate_python(incoming_value)
+        existing_seq: Final = (
+            _AGENT_PARAMS_SEQUENCE_ADAPTER.validate_python(existing_value)
+            if isinstance(existing_value, (list, tuple))
+            else ()
+        )
+        return tuple(
+            _restore_redacted_nested_value(
+                item,
+                existing_seq[index] if index < len(existing_seq) else None,
+                _depth + 1,
+            )
+            for index, item in enumerate(typed_incoming_seq)
+        )
+    return incoming_value
+
+
+def _resolved_agent_param_value(
+    key: str,
+    incoming: Mapping[str, object],
+    existing: Mapping[str, object],
+    _depth: int,
+) -> object:
+    """The value ``key`` should end up with in a restored litellm_params, or
+    ``_MISSING_AGENT_PARAM`` when it should be dropped entirely."""
+    if key in incoming:
+        value: Final = incoming[key]
+        if _AGENT_PARAMS_MASKER.is_sensitive_key(key):
+            return existing.get(key, _MISSING_AGENT_PARAM) if value == REDACTED_BY_LITELM_STRING else value
+        return _restore_redacted_nested_value(value, existing.get(key), _depth)
+    if _AGENT_PARAMS_MASKER.is_sensitive_key(key):
+        return existing.get(key, _MISSING_AGENT_PARAM)
+    return _MISSING_AGENT_PARAM
+
+
+def _restore_redacted_litellm_params(
+    incoming: Mapping[str, object],
+    existing: Mapping[str, object],
+    _depth: int = 0,
+) -> dict[str, object]:
+    """Restore the real credential behind any litellm_params value the caller
+    echoed back as ``REDACTED_BY_LITELM_STRING``, and behind any sensitive key
+    omitted entirely, so an edit to an unrelated field never overwrites (or
+    silently drops) a stored provider credential -- the UI never has to
+    read-and-resend a secret to keep it. Recurses into nested dicts and lists
+    so a secret nested under a non-sensitively-named key is restored too.
+
+    A sensitive key given a real (non-marker) value, including an explicit
+    empty string, is treated as a deliberate update -- that's how a caller
+    clears a credential. Non-sensitive keys always take the incoming value
+    (recursed into), matching the endpoints' existing full-replace-on-PUT /
+    merge-on-PATCH semantics for everything that isn't a secret.
+    """
+    all_keys: Final = frozenset(incoming) | frozenset(existing)
+    return {
+        key: value
+        for key in all_keys
+        if (value := _resolved_agent_param_value(key, incoming, existing, _depth)) is not _MISSING_AGENT_PARAM
+    }  # mutable-ok: fed to safe_dumps() for JSON-column storage, which requires a real dict
+
+
 class GrantMigrationResult(NamedTuple):
     rewritten: int
     missed: int
@@ -301,9 +490,14 @@ class AgentRegistry:
         try:
             agent_name: Final = agent.get("agent_name")
 
-            # Serialize litellm_params
+            # Serialize litellm_params. A create has no stored row to restore a
+            # secret behind, so a sensitive key submitted as the redaction
+            # marker (e.g. a stray client re-post) is dropped rather than
+            # persisted as the literal placeholder string.
             litellm_params_obj: Final = agent.get("litellm_params", {})
-            litellm_params_dict: Final[dict[str, object]] = _dump_agent_params(litellm_params_obj)
+            litellm_params_dict: Final = _restore_redacted_litellm_params(
+                _dump_agent_params(litellm_params_obj), _EMPTY_LITELLM_PARAMS
+            )
             litellm_params: Final[str] = safe_dumps(litellm_params_dict)
 
             # Serialize agent_card_params
@@ -410,8 +604,14 @@ class AgentRegistry:
             update_data: Final[dict[str, object]] = {}
             if augment_agent.get("agent_name"):
                 update_data["agent_name"] = augment_agent.get("agent_name")
-            if augment_agent.get("litellm_params"):
-                update_data["litellm_params"] = safe_dumps(augment_agent.get("litellm_params"))
+            if "litellm_params" in agent:
+                existing_litellm_params: Final = parse_agent_litellm_params(existing_agent.get("litellm_params"))
+                update_data["litellm_params"] = safe_dumps(
+                    _restore_redacted_litellm_params(
+                        _dump_agent_params(agent.get("litellm_params") or _EMPTY_LITELLM_PARAMS),
+                        existing_litellm_params,
+                    )
+                )
             if augment_agent.get("agent_card_params"):
                 update_data["agent_card_params"] = safe_dumps(augment_agent.get("agent_card_params"))
 
@@ -474,9 +674,22 @@ class AgentRegistry:
         try:
             agent_name: Final = agent.get("agent_name")
 
+            # A PUT fully replaces litellm_params from the request body, so the
+            # existing row is read up front to restore any sensitive key the
+            # caller echoed back redacted (or omitted) rather than persisting
+            # the marker -- or nothing -- over the real stored credential.
+            existing_row: Final = await agents_table(prisma_client).find_unique(
+                where={"agent_id": agent_id}  # mutable-ok: prisma's query builder rejects a Mapping/MappingProxyType
+            )
+            existing_litellm_params: Final = parse_agent_litellm_params(
+                existing_row.litellm_params if existing_row is not None else None
+            )
+
             # Serialize litellm_params
             litellm_params_obj: Final = agent.get("litellm_params", {})
-            litellm_params_dict: Final[dict[str, object]] = _dump_agent_params(litellm_params_obj)
+            litellm_params_dict: Final = _restore_redacted_litellm_params(
+                _dump_agent_params(litellm_params_obj), existing_litellm_params
+            )
             litellm_params: Final[str] = safe_dumps(litellm_params_dict)
 
             # Serialize agent_card_params
@@ -512,9 +725,8 @@ class AgentRegistry:
                     update_data[rate_field] = _val
 
             if agent.get("object_permission") is not None:
-                existing_agent: Final = await agents_table(prisma_client).find_unique(where={"agent_id": agent_id})
                 existing_object_permission_id: Final = (
-                    existing_agent.object_permission_id if existing_agent is not None else None
+                    existing_row.object_permission_id if existing_row is not None else None
                 )
                 agent_copy: Final = dict(agent)
                 object_permission_id: Final = await handle_update_object_permission_common(

litellm/proxy/agent_endpoints/endpoints.py

@@ -20,7 +20,6 @@ from typing_extensions import ReadOnly, Required, assert_never
 
 import litellm
 from litellm._logging import verbose_proxy_logger
-from litellm.litellm_core_utils.litellm_logging import _get_masked_values
 from litellm.llms.custom_httpx.http_handler import get_async_httpx_client
 from litellm.proxy._types import (
     CommonProxyErrors,
@@ -33,6 +32,10 @@ from litellm.proxy.a2a.agent_card import (
     merge_agent_card,
     normalize_protocol_version,
 )
+from litellm.proxy.agent_endpoints.agent_registry import (
+    parse_agent_litellm_params,
+    redact_sensitive_agent_litellm_params,
+)
 from litellm.proxy.agent_endpoints.agent_search import (
     DEFAULT_AGENT_SEARCH_TOP_K,
     AgentSearchEmbeddingFailed,
@@ -139,25 +142,37 @@ async def _attach_keys_to_agents(agents: Sequence[AgentResponse], prisma_client)
         agent.keys = matched_keys or None
 
 
+def _redact_agent_litellm_params_dict(
+    litellm_params: Mapping[str, object],
+) -> dict[str, object]:  # mutable-ok: AgentResponse.litellm_params is declared as a plain dict, not Mapping
+    """Type-narrowing wrapper: a dict in always yields a dict back from
+    ``redact_sensitive_agent_litellm_params``, which the function's general
+    (possible-JSON-string, possibly-None) signature can't express."""
+    return dict(  # mutable-ok: AgentResponse.litellm_params is declared as a plain dict, not Mapping
+        parse_agent_litellm_params(redact_sensitive_agent_litellm_params(litellm_params))
+    )
+
+
 def _redact_sensitive_agent_fields(
     agents: Sequence[AgentResponse],
+    *,
+    is_admin: bool,
 ) -> list[AgentResponse]:
     """
-    Return copies of the given agents with sensitive configuration fields
-    redacted.  The original objects are not modified.
+    Return copies of the given agents with credential-bearing litellm_params
+    values replaced by a fixed marker (never returned to ANY caller,
+    admin included) and, for non-admin callers, virtual-key and header
+    fields stripped entirely. The original objects are not modified.
     """
     redacted: Final[list[AgentResponse]] = []
     for agent in agents:
         copy = agent.model_copy(deep=True)
-        copy.static_headers = None
-        copy.extra_headers = None
-        copy.keys = None
+        if not is_admin:
+            copy.static_headers = None
+            copy.extra_headers = None
+            copy.keys = None
         if copy.litellm_params:
-            copy.litellm_params = _get_masked_values(
-                copy.litellm_params,
-                unmasked_length=4,
-                number_of_asterisks=4,
-            )
+            copy.litellm_params = _redact_agent_litellm_params_dict(copy.litellm_params)
         redacted.append(copy)
     return redacted
 
@@ -345,13 +360,13 @@ async def get_agents(
                 global_agent_registry.ids_for_agent(agent.agent_id).isdisjoint(litellm.public_agent_groups)
             )
 
-        # Redact sensitive fields for non-admin users
+        # litellm_params secrets are always redacted; keys/headers stay
+        # admin-only.
         is_admin: Final = (
             user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN
             or user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value
         )
-        if not is_admin:
-            returned_agents = _redact_sensitive_agent_fields(returned_agents)
+        returned_agents = _redact_sensitive_agent_fields(returned_agents, is_admin=is_admin)
 
         if health_check:
             agents_with_url: Final = [agent for agent in returned_agents if (agent.agent_card_params or {}).get("url")]
@@ -505,7 +520,9 @@ async def create_agent(
                 "Failed to register agent '%s' (ID: %s) in memory: %s", agent_name, agent_id, reg_error
             )
 
-        return result
+        # The caller is a proxy admin (enforced above); litellm_params
+        # secrets are still never echoed back in the response.
+        return _redact_sensitive_agent_fields((result,), is_admin=True)[0]
 
     except HTTPException:
         raise
@@ -578,13 +595,13 @@ async def get_agent_by_id(
 
         await _attach_keys_to_agents([agent], prisma_client)
 
-        # Redact sensitive fields for non-admin users
+        # litellm_params secrets are always redacted; keys/headers stay
+        # admin-only.
         is_admin = (
             user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN
             or user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value
         )
-        if not is_admin:
-            agent = _redact_sensitive_agent_fields([agent])[0]
+        agent = _redact_sensitive_agent_fields((agent,), is_admin=is_admin)[0]
 
         return agent
     except HTTPException:
@@ -688,7 +705,7 @@ async def update_agent(
             "Successfully updated agent '%s' (ID: %s) in memory", existing_agent.get("agent_name"), agent_id
         )
 
-        return result
+        return _redact_sensitive_agent_fields((result,), is_admin=True)[0]
     except HTTPException:
         raise
     except Exception as e:
@@ -791,7 +808,7 @@ async def patch_agent(
             "Successfully updated agent '%s' (ID: %s) in memory", existing_agent.get("agent_name"), agent_id
         )
 
-        return result
+        return _redact_sensitive_agent_fields((result,), is_admin=True)[0]
     except HTTPException:
         raise
     except Exception as e:

litellm/proxy/auth/auth_utils.py

@@ -1,3 +1,4 @@
+import importlib.util
 import os
 import re
 import sys
@@ -1402,7 +1403,7 @@ def is_pass_through_provider_route(route: str) -> bool:
     return False
 
 
-def _has_user_setup_sso() -> bool:
+def has_user_setup_sso() -> bool:
     """
     Check if the user has set up single sign-on (SSO).
 
@@ -1425,6 +1426,63 @@ def _has_user_setup_sso() -> bool:
     )
 
 
+def _is_google_ready() -> bool:
+    return bool(os.getenv("GOOGLE_CLIENT_ID")) and bool(os.getenv("GOOGLE_CLIENT_SECRET"))
+
+
+def _is_microsoft_ready() -> bool:
+    return (
+        bool(os.getenv("MICROSOFT_CLIENT_ID"))
+        and bool(os.getenv("MICROSOFT_CLIENT_SECRET"))
+        and bool(os.getenv("MICROSOFT_TENANT"))
+    )
+
+
+def _is_generic_oauth_ready() -> bool:
+    return (
+        bool(os.getenv("GENERIC_CLIENT_ID"))
+        and bool(os.getenv("GENERIC_CLIENT_SECRET"))
+        and bool(os.getenv("GENERIC_AUTHORIZATION_ENDPOINT"))
+        and bool(os.getenv("GENERIC_TOKEN_ENDPOINT"))
+        and bool(os.getenv("GENERIC_USERINFO_ENDPOINT"))
+    )
+
+
+def _is_saml_ready() -> bool:
+    if not (os.getenv("SAML_IDP_METADATA_URL") or os.getenv("SAML_IDP_METADATA_XML")):
+        return False
+    # SAML's runtime (python3-saml) is an optional dependency; the SAML
+    # handler itself fails closed on every request when it is missing
+    # (SAMLAuthHandler raises before touching the IdP), so metadata alone
+    # is not "ready" either. find_spec raises ModuleNotFoundError (rather
+    # than returning None) when the top-level package is absent entirely,
+    # so this must not be a bare boolean expression or every password
+    # login would 500 on a deployment that configured SAML metadata
+    # without installing the optional extra.
+    try:
+        return importlib.util.find_spec("onelogin.saml2.auth") is not None
+    except ModuleNotFoundError:
+        return False
+
+
+def is_sso_provider_fully_configured() -> bool:
+    """Whether ANY configured SSO provider has every companion setting it
+    needs to actually authenticate a user, not merely a client id.
+
+    A lone ``MICROSOFT_CLIENT_ID`` with no secret or tenant makes
+    ``has_user_setup_sso()`` return True while every real sign-in attempt
+    fails, so a gate that BLOCKS the password fallback (unlike the UI
+    discovery use of ``has_user_setup_sso()``, where a dead login button is
+    merely confusing) must check readiness here, or it can lock every admin
+    out with no way to sign in at all. Checks every provider independently
+    (mirroring ``/sso/readiness``'s per-provider requirements) rather than
+    stopping at the first one with a client id set, so a stray leftover
+    client id for an unused provider can never mask a different, fully
+    configured provider that would otherwise satisfy this gate.
+    """
+    return _is_google_ready() or _is_microsoft_ready() or _is_generic_oauth_ready() or _is_saml_ready()
+
+
 def get_customer_user_header_from_mapping(user_id_mapping) -> list | None:
     """Return the header_name mapped to CUSTOMER role, if any (dict-based)."""
     if not user_id_mapping:

litellm/proxy/auth/login_utils.py

@@ -7,7 +7,9 @@ login endpoints (e.g., /login and /v2/login).
 
 import os
 import secrets
+from collections.abc import Mapping
 from datetime import datetime, timedelta, timezone
+from types import MappingProxyType
 from typing import Final, Literal, cast
 
 import jwt
@@ -24,6 +26,7 @@ from litellm.proxy._types import (
     UpdateUserRequest,
     UserAPIKeyAuth,
 )
+from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
 from litellm.proxy.management_endpoints.internal_user_endpoints import user_update
 from litellm.proxy.management_endpoints.key_management_endpoints import (
     generate_key_helper_fn,
@@ -111,6 +114,7 @@ async def authenticate_user(
     password: str,
     master_key: str | None,
     prisma_client: PrismaClient | None,
+    general_settings: Mapping[str, object] = MappingProxyType({}),
 ) -> LoginResult:
     """
     Authenticate a user and generate an API key for UI access.
@@ -124,13 +128,40 @@ async def authenticate_user(
         password: Password from the login form
         master_key: Master key for the proxy (required)
         prisma_client: Prisma database client (optional)
+        general_settings: Proxy general_settings, checked for
+            `disable_password_login_when_sso_enabled`
 
     Returns:
         LoginResult: Object containing authentication data
 
     Raises:
-        ProxyException: If authentication fails or required configuration is missing
+        ProxyException: If authentication fails or required configuration is missing,
+            or if username/password login is disabled while SSO is configured
+
+    Recovery: an admin locked out of the UI by
+    `disable_password_login_when_sso_enabled` can still administer the proxy over
+    the API with the master key (Authorization: Bearer <master_key>), which never
+    goes through this function. To restore UI username/password login, unset the
+    setting in config.yaml (or the DB-persisted general_settings) and restart the
+    proxy; this is a deliberate, auditable config change rather than a hidden
+    bypass.
+
+    The gate below requires the SSO provider to be FULLY configured (every
+    companion secret/endpoint an actual sign-in needs), not merely that a
+    client id is present, so an incomplete SSO setup can never disable the
+    only working login path.
     """
+    if general_settings.get("disable_password_login_when_sso_enabled") is True and is_sso_provider_fully_configured():
+        raise ProxyException(
+            message=(
+                "Username/password login is disabled because SSO is configured "
+                "and 'disable_password_login_when_sso_enabled' is set. Sign in via SSO."
+            ),
+            type=ProxyErrorTypes.auth_error,
+            param="disable_password_login_when_sso_enabled",
+            code=403,
+        )
+
     if master_key is None:
         raise ProxyException(
             message="Master Key not set for Proxy. Please set Master Key to use Admin UI. Set `LITELLM_MASTER_KEY` in .env or set general_settings:master_key in config.yaml.  https://docs.litellm.ai/docs/proxy/virtual_keys. If set, use `--detailed_debug` to debug issue.",

litellm/proxy/auth/password_policy.py

@@ -0,0 +1,92 @@
+"""Password-strength policy enforcement for locally-managed proxy users.
+
+Applied at every path that persists a new or changed password for a DB-backed
+user (``/user/update``, ``/user/bulk_update``, and the invitation onboarding
+claim flow), so the strength bar is configured in one place instead of
+per-endpoint.
+"""
+
+from collections.abc import Mapping
+from dataclasses import dataclass
+from typing import Final
+
+from litellm.proxy._types import ProxyErrorTypes, ProxyException
+
+DEFAULT_MIN_LENGTH: Final = 12
+MIN_ALLOWED_LENGTH: Final = 8
+
+
+def _has_uppercase(password: str) -> bool:
+    return any(ch.isupper() for ch in password)
+
+
+def _has_lowercase(password: str) -> bool:
+    return any(ch.islower() for ch in password)
+
+
+def _has_digit(password: str) -> bool:
+    return any(ch.isdigit() for ch in password)
+
+
+def _has_special_character(password: str) -> bool:
+    """Unicode-aware: a letter or digit from ANY script counts as
+    alphanumeric, not just ASCII, so an accented letter (e.g. the second
+    character of "Passwörd1234") cannot be miscounted as the required
+    special character the way an ASCII-only `[^A-Za-z0-9]` regex would."""
+    return any(not ch.isalnum() for ch in password)
+
+
+@dataclass(frozen=True, slots=True)
+class PasswordPolicy:
+    min_length: int
+    require_uppercase: bool
+    require_lowercase: bool
+    require_numbers: bool
+    require_special_characters: bool
+
+
+def _configured_min_length(general_settings: Mapping[str, object]) -> int:
+    """The configured minimum, floored at MIN_ALLOWED_LENGTH so a nonpositive
+    or too-low override (a typo, or `0`/`false` coercing through) cannot
+    silently disable the length requirement rather than merely relaxing it."""
+    min_length_setting: Final = general_settings.get("password_policy_min_length")
+    if isinstance(min_length_setting, bool) or not isinstance(min_length_setting, (int, float)):
+        return DEFAULT_MIN_LENGTH
+    return max(MIN_ALLOWED_LENGTH, int(min_length_setting))
+
+
+def get_password_policy(general_settings: Mapping[str, object]) -> PasswordPolicy:
+    return PasswordPolicy(
+        min_length=_configured_min_length(general_settings),
+        require_uppercase=general_settings.get("password_policy_require_uppercase", True) is not False,
+        require_lowercase=general_settings.get("password_policy_require_lowercase", True) is not False,
+        require_numbers=general_settings.get("password_policy_require_numbers", True) is not False,
+        require_special_characters=(
+            general_settings.get("password_policy_require_special_characters", True) is not False
+        ),
+    )
+
+
+def _policy_violations(password: str, policy: PasswordPolicy) -> tuple[str, ...]:
+    checks: Final = (
+        (len(password) < policy.min_length, f"be at least {policy.min_length} characters long"),
+        (policy.require_uppercase and not _has_uppercase(password), "include an uppercase letter"),
+        (policy.require_lowercase and not _has_lowercase(password), "include a lowercase letter"),
+        (policy.require_numbers and not _has_digit(password), "include a number"),
+        (policy.require_special_characters and not _has_special_character(password), "include a special character"),
+    )
+    return tuple(message for failed, message in checks if failed)
+
+
+def validate_password_policy(password: str, general_settings: Mapping[str, object]) -> None:
+    """Raise ``ProxyException`` (400) if ``password`` fails the configured policy."""
+    policy: Final = get_password_policy(general_settings)
+    violations: Final = _policy_violations(password, policy)
+    if not violations:
+        return
+    raise ProxyException(
+        message="Password does not meet the required policy: must " + ", ".join(violations) + ".",
+        type=ProxyErrorTypes.validation_error,
+        param="password",
+        code=400,
+    )

litellm/proxy/discovery_endpoints/ui_discovery_endpoints.py

@@ -14,7 +14,7 @@ router: Final = APIRouter()
 @router.get("/.well-known/litellm-ui-config", response_model=UiDiscoveryEndpoints)
 @router.get("/litellm/.well-known/litellm-ui-config", response_model=UiDiscoveryEndpoints)  # if mounted at root path
 async def get_ui_config():
-    from litellm.proxy.auth.auth_utils import _has_user_setup_sso
+    from litellm.proxy.auth.auth_utils import has_user_setup_sso
     from litellm.proxy.proxy_server import general_settings
     from litellm.proxy.utils import get_proxy_base_url, get_server_root_path
 
@@ -28,7 +28,7 @@ async def get_ui_config():
         or general_settings.get("hide_default_credentials_hint", False) is True
     )
 
-    sso_configured: Final = _has_user_setup_sso()
+    sso_configured: Final = has_user_setup_sso()
 
     from litellm.proxy.proxy_server import proxy_config
 

litellm/proxy/management_endpoints/internal_user_endpoints.py

@@ -27,6 +27,7 @@ from litellm._logging import verbose_proxy_logger
 from litellm._uuid import uuid
 from litellm.proxy._types import *
 from litellm.proxy.auth.auth_checks import get_team_object, get_user_object
+from litellm.proxy.auth.password_policy import validate_password_policy
 from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
 from litellm.proxy.common_utils.user_api_key_cache import (
     object_permission_cache_key,
@@ -154,9 +155,10 @@ def _team_membership_table(
     return team_membership_table
 
 
-def _hash_password_in_dict(data: dict) -> None:
-    """Hash password field in-place if present."""
+def _hash_password_in_dict(data: dict, general_settings: Mapping[str, object]) -> None:
+    """Validate and hash password field in-place if present."""
     if "password" in data and data["password"] is not None:
+        validate_password_policy(data["password"], general_settings)
         data["password"] = hash_password(data["password"])
 
 
@@ -500,7 +502,7 @@ async def new_user(
     ```
     """
     try:
-        from litellm.proxy.proxy_server import _license_check, prisma_client
+        from litellm.proxy.proxy_server import _license_check, general_settings, prisma_client
 
         if prisma_client is None:
             raise HTTPException(status_code=400, detail=CommonProxyErrors.db_not_connected_error.value)
@@ -548,7 +550,7 @@ async def new_user(
         # generate_key_helper_fn only forwards object_permission_id, so without this the entitlement
         # the caller sent would be dropped on the floor.
         data_json = await _set_object_permission(data_json=data_json, prisma_client=prisma_client)
-        _hash_password_in_dict(data_json)
+        _hash_password_in_dict(data_json, general_settings)
         teams = data.teams
         if teams is None:
             teams = check_if_default_team_set()
@@ -1405,7 +1407,7 @@ async def _update_single_user_helper(
 
     Returns the updated user data or raises an exception on failure.
     """
-    from litellm.proxy.proxy_server import litellm_proxy_admin_name, prisma_client
+    from litellm.proxy.proxy_server import general_settings, litellm_proxy_admin_name, prisma_client
 
     if prisma_client is None:
         raise Exception("Not connected to DB!")
@@ -1420,7 +1422,7 @@ async def _update_single_user_helper(
 
     data_json: Final[dict] = user_request.model_dump(exclude_unset=True)
     non_default_values = _update_internal_user_params(data_json=data_json, data=user_request)
-    _hash_password_in_dict(non_default_values)
+    _hash_password_in_dict(non_default_values, general_settings)
 
     existing_user_row: BaseModel | None = None
     if user_request.user_id:

litellm/proxy/management_endpoints/ui_sso.py

@@ -89,7 +89,7 @@ from litellm.proxy._types import (
 from litellm.proxy.auth.auth_checks import ExperimentalUIJWTToken, get_user_object
 from litellm.proxy.auth.auth_utils import (
     _get_request_ip_address,
-    _has_user_setup_sso,
+    has_user_setup_sso,
 )
 from litellm.proxy.auth.handle_jwt import JWTHandler
 from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
@@ -2617,7 +2617,7 @@ async def get_ui_settings(request: Request):
     _proxy_base_url: Final = os.getenv("PROXY_BASE_URL", None)
     _logout_url: Final = os.getenv("PROXY_LOGOUT_URL", None)
     _api_doc_base_url: Final = os.getenv("LITELLM_UI_API_DOC_BASE_URL", None)
-    _is_sso_enabled: Final = _has_user_setup_sso()
+    _is_sso_enabled: Final = has_user_setup_sso()
     disable_expensive_db_queries: Final = (
         proxy_state.get_proxy_state_variable("spend_logs_row_count") > MAX_SPENDLOG_ROWS_TO_QUERY
     )

litellm/proxy/openai_files_endpoints/files_endpoints.py

@@ -70,6 +70,15 @@ from litellm.proxy.openai_files_endpoints.common_utils import (
     validate_managed_files_requirement,
     validate_managed_id_requirement,
 )
+from litellm.proxy.openai_files_endpoints.general_upload_validation import (
+    MB,
+    check_blocked_extension,
+    check_unsafe_filename,
+    check_upload_file_size,
+    coerce_optional_int_setting,
+    coerce_optional_str_list_setting,
+    raise_upload_validation_failure,
+)
 from litellm.proxy.utils import ProxyLogging, is_known_model
 from litellm.repositories.table_repositories import ManagedFileRepository
 from litellm.router import Router
@@ -397,13 +406,23 @@ async def create_file(
     # descriptor and its disk blocks until the collector runs.
     spools: Final[list[BinaryIO]] = []  # mutable-ok: filled as the scan opens handles
     try:
+        unsafe_filename_failure: Final = check_unsafe_filename(file.filename)
+        if unsafe_filename_failure is not None:
+            raise_upload_validation_failure(unsafe_filename_failure)
+
+        max_file_size_mb: Final = coerce_optional_int_setting(general_settings.get("max_file_size_mb"))
+
         # Batch uploads can be gigabytes. Starlette has already spooled the upload
         # to disk, so stream from that handle instead of reading it into memory.
-        # Other uploads are small and stay in-memory bytes.
+        # Other uploads stay in-memory bytes, bounded to max_file_size_mb (plus one
+        # byte, to still tell "exactly at the limit" from "over it") when it is set,
+        # so an oversized upload cannot be read to completion before it is rejected.
         file_source: bytes | BinaryIO
         if purpose == "batch":
             await file.seek(0)
             file_source = file.file
+        elif max_file_size_mb is not None and max_file_size_mb > 0:
+            file_source = await file.read(max_file_size_mb * MB + 1)
         else:
             file_source = await file.read()
         custom_llm_provider = (
@@ -442,6 +461,15 @@ async def create_file(
         # Cast purpose to OpenAIFilesPurpose type
         purpose = cast(OpenAIFilesPurpose, purpose)
 
+        general_size_failure: Final = check_upload_file_size(file_source, max_file_size_mb)
+        if general_size_failure is not None:
+            raise_upload_validation_failure(general_size_failure)
+
+        blocked_extensions: Final = coerce_optional_str_list_setting(general_settings.get("blocked_file_extensions"))
+        blocked_extension_failure: Final = check_blocked_extension(file.filename, blocked_extensions)
+        if blocked_extension_failure is not None:
+            raise_upload_validation_failure(blocked_extension_failure)
+
         if purpose == "batch":
             batch_file_failure: Final = await asyncio.to_thread(
                 check_batch_file_upload,

litellm/proxy/openai_files_endpoints/general_upload_validation.py

@@ -0,0 +1,150 @@
+"""
+Upload validation applied to every purpose at POST /v1/files.
+
+batch_file_validation.py checks the JSONL shape of purpose="batch" uploads; this
+module applies the same fast-fail-before-forwarding shape (size cap, blocked
+extensions, path-traversal filenames) regardless of purpose.
+"""
+
+from dataclasses import dataclass
+from pathlib import Path
+from typing import BinaryIO, Final, NoReturn, assert_never
+
+from litellm.proxy._types import ProxyException
+from litellm.proxy.common_utils.path_utils import safe_filename
+
+MB: Final = 1024 * 1024
+
+
+def coerce_optional_int_setting(raw: object) -> int | None:
+    """A general_settings value declared as an optional integer, e.g. max_file_size_mb.
+
+    bool is an int subclass, so an explicit isinstance(raw, bool) exclusion is needed
+    or a YAML `true`/`false` would silently pass as 1/0.
+    """
+    if raw is None:
+        return None
+    if isinstance(raw, int) and not isinstance(raw, bool):
+        return raw
+    raise TypeError(f"expected an integer, got {raw!r}")
+
+
+def coerce_optional_str_list_setting(raw: object) -> tuple[str, ...]:
+    """A general_settings value declared as an optional list of strings, e.g. blocked_file_extensions."""
+    if raw is None:
+        return ()
+    if not isinstance(raw, list) or not all(isinstance(item, str) for item in raw):
+        raise TypeError(f"expected a list of strings, got {raw!r}")
+    return tuple(raw)
+
+
+@dataclass(frozen=True, slots=True)
+class UploadedFileTooLarge:
+    size_bytes: int
+    limit_mb: int
+
+
+@dataclass(frozen=True, slots=True)
+class UploadedFileBlockedExtension:
+    extension: str
+
+
+@dataclass(frozen=True, slots=True)
+class UploadedFileUnsafeFilename:
+    filename: str
+
+
+UploadValidationFailure = UploadedFileTooLarge | UploadedFileBlockedExtension | UploadedFileUnsafeFilename
+
+
+def _file_size_bytes(file_source: bytes | BinaryIO) -> int:
+    if isinstance(file_source, bytes):
+        return len(file_source)
+    original_position: Final = file_source.tell()
+    file_source.seek(0, 2)
+    size: Final = file_source.tell()
+    file_source.seek(original_position)
+    return size
+
+
+def check_upload_file_size(
+    file_source: bytes | BinaryIO,
+    max_file_size_mb: int | None,
+) -> UploadedFileTooLarge | None:
+    if max_file_size_mb is None or max_file_size_mb <= 0:
+        return None
+    size_bytes: Final = _file_size_bytes(file_source)
+    if size_bytes > max_file_size_mb * MB:
+        return UploadedFileTooLarge(size_bytes=size_bytes, limit_mb=max_file_size_mb)
+    return None
+
+
+def check_blocked_extension(
+    filename: str | None,
+    blocked_extensions: tuple[str, ...],
+) -> UploadedFileBlockedExtension | None:
+    if not blocked_extensions or not filename:
+        return None
+    try:
+        extension: Final = Path(safe_filename(filename)).suffix.lower()
+    except ValueError:
+        return None
+    # The uploaded name's extension is normalized above; blocked_extensions comes
+    # straight from config.yaml or the DB and is normalized here too, so a
+    # differently-cased entry (".EXE") still catches a lowercase upload.
+    normalized_blocked: Final = frozenset(item.lower() for item in blocked_extensions)
+    if extension and extension in normalized_blocked:
+        return UploadedFileBlockedExtension(extension=extension)
+    return None
+
+
+def check_unsafe_filename(filename: str | None) -> UploadedFileUnsafeFilename | None:
+    """Reject a filename before it can influence any storage path or backend call.
+
+    Only flags a genuine traversal component ("..") or a null byte, so an ordinary
+    name like "report.v2.pdf" or ".env" is never rejected.
+    """
+    if not filename:
+        return None
+    if "\x00" in filename:
+        return UploadedFileUnsafeFilename(filename=filename)
+    normalized: Final = filename.replace("\\", "/")
+    if any(part == ".." for part in normalized.split("/")):
+        return UploadedFileUnsafeFilename(filename=filename)
+    return None
+
+
+def raise_upload_validation_failure(failure: UploadValidationFailure) -> NoReturn:
+    match failure:
+        case UploadedFileTooLarge(size_bytes=size_bytes, limit_mb=limit_mb):
+            raise ProxyException(
+                message=(
+                    f"Uploaded file exceeds the configured max_file_size_mb of {limit_mb} MB "
+                    f"(read stopped at {size_bytes / MB:.1f} MB). The file was not forwarded to the provider."
+                ),
+                type="invalid_request_error",
+                param="file",
+                code=413,
+            )
+        case UploadedFileBlockedExtension(extension=extension):
+            raise ProxyException(
+                message=(
+                    f"File extension '{extension}' is blocked by this proxy's blocked_file_extensions "
+                    "setting. The file was not forwarded to the provider."
+                ),
+                type="invalid_request_error",
+                param="file",
+                code=400,
+            )
+        case UploadedFileUnsafeFilename(filename=filename):
+            raise ProxyException(
+                message=(
+                    f"Filename '{filename}' is not allowed: directory traversal sequences are not "
+                    "permitted in uploaded file names. The file was not forwarded to the provider."
+                ),
+                type="invalid_request_error",
+                param="file",
+                code=400,
+            )
+        case _:
+            assert_never(failure)

litellm/proxy/proxy_server.py

@@ -310,6 +310,7 @@ from litellm.proxy.auth.model_checks import (
     get_mcp_server_ids,
     get_team_models,
 )
+from litellm.proxy.auth.password_policy import validate_password_policy
 from litellm.proxy.auth.user_api_key_auth import (
     _fetch_global_spend_with_event_coordination,
     user_api_key_auth,
@@ -6644,6 +6645,12 @@ class ProxyConfig:
         if "max_batch_file_size_mb" not in self._yaml_general_settings_keys:
             general_settings["max_batch_file_size_mb"] = _general_settings.get("max_batch_file_size_mb")
 
+        if "max_file_size_mb" not in self._yaml_general_settings_keys:
+            general_settings["max_file_size_mb"] = _general_settings.get("max_file_size_mb")
+
+        if "blocked_file_extensions" not in self._yaml_general_settings_keys:
+            general_settings["blocked_file_extensions"] = _general_settings.get("blocked_file_extensions")
+
         ## ALERTING ARGS ##
         if "alerting_args" in _general_settings:
             general_settings["alerting_args"] = _general_settings["alerting_args"]
@@ -15236,6 +15243,7 @@ async def login(request: Request):
         password=password,
         master_key=master_key,
         prisma_client=prisma_client,
+        general_settings=general_settings,
     )
 
     # Create UI token object
@@ -15310,6 +15318,7 @@ async def login_v2(request: Request):
             password=password,
             master_key=master_key,
             prisma_client=prisma_client,
+            general_settings=general_settings,
         )
 
         returned_ui_token_object: Final = create_ui_token_object(
@@ -15380,6 +15389,7 @@ async def login_v3(request: Request):
             password=password,
             master_key=master_key,
             prisma_client=prisma_client,
+            general_settings=general_settings,
         )
 
         returned_ui_token_object: Final = create_ui_token_object(
@@ -15749,6 +15759,7 @@ async def claim_onboarding_link(data: InvitationClaim, request: Request):
             detail={"error": "Invalid onboarding session for invitation link."},
         )
 
+    validate_password_policy(data.password, general_settings)
     hashed_pw: Final = hash_password(data.password)
     current_time = litellm.utils.get_utc_datetime()
     async with prisma_client.db.tx() as tx:
@@ -16412,6 +16423,8 @@ _GENERAL_SETTINGS_CONFIG_LIST_FIELD_TYPES: Final[Mapping[str, str]] = MappingPro
         "global_max_parallel_requests": "Integer",
         "max_request_size_mb": "Integer",
         "max_batch_file_size_mb": "Integer",
+        "max_file_size_mb": "Integer",
+        "blocked_file_extensions": "List",
         "max_response_size_mb": "Integer",
         "proxy_config_reload_interval_seconds": "Integer",
         "pass_through_endpoints": "PydanticModel",

litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py

@@ -1594,7 +1594,10 @@ async def update_ui_settings(
     tags=["UI Theme Settings"],
     dependencies=[Depends(user_api_key_auth)],
 )
-async def upload_logo(file: UploadFile = File(...)):
+async def upload_logo(
+    file: UploadFile = File(...),
+    user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),
+):
     """
     Upload a custom logo for the admin UI.
     Accepts image files (PNG, JPG, JPEG, SVG) and stores them for use in the UI.
@@ -1602,6 +1605,12 @@ async def upload_logo(file: UploadFile = File(...)):
     import os
     from pathlib import Path
 
+    if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN:
+        raise HTTPException(
+            status_code=403,
+            detail="Only proxy admins can upload a UI logo.",
+        )
+
     # Validate file type
     allowed_extensions: Final = {".png", ".jpg", ".jpeg", ".svg"}
     file_extension: Final = Path(file.filename or "").suffix.lower()
@@ -1612,9 +1621,11 @@ async def upload_logo(file: UploadFile = File(...)):
             detail=f"Invalid file type. Allowed types: {', '.join(allowed_extensions)}",
         )
 
-    # Validate file size (max 5MB)
-    file_content: Final = await file.read()
-    if len(file_content) > 5 * 1024 * 1024:  # 5MB
+    # Read bounded to one byte past the limit, so an oversized upload is never
+    # fully buffered in memory before being rejected.
+    max_logo_size_bytes: Final = 5 * 1024 * 1024
+    file_content: Final = await file.read(max_logo_size_bytes + 1)
+    if len(file_content) > max_logo_size_bytes:
         raise HTTPException(status_code=400, detail="File size too large. Maximum size is 5MB.")
 
     # Create uploads directory if it doesn't exist

litellm/router.py

@@ -30,7 +30,7 @@ import anyio
 import httpx
 import openai
 from openai import AsyncOpenAI
-from pydantic import BaseModel
+from pydantic import BaseModel, TypeAdapter, ValidationError
 from typing_extensions import overload
 
 import litellm
@@ -383,6 +383,28 @@ def _stream_chunks_have_generated_content(chunks: Sequence[ModelResponseStream])
     return False
 
 
+_NO_SESSION_KWARGS: Final[Mapping[str, Mapping[str, object]]] = MappingProxyType({})
+_SESSION_ADAPTER: Final = TypeAdapter(Mapping[str, object])
+
+
+def _with_router_resolved_session_model(session: object, model_name: str) -> Mapping[str, Mapping[str, object]]:
+    """
+    Realtime client-secret requests carry the model inside ``session`` as well, and the caller's copy of it still
+    holds the pre-routing model group name, so it has to follow the deployment the router just picked.
+
+    Returns kwargs to merge into the downstream call, empty when there is no session model to resolve.
+    """
+    try:
+        typed_session: Final = _SESSION_ADAPTER.validate_python(session)
+    except ValidationError:
+        return _NO_SESSION_KWARGS
+    if "model" not in typed_session:
+        return _NO_SESSION_KWARGS
+    return MappingProxyType(
+        {"session": {**typed_session, "model": model_name}}  # mutable-ok: callees deepcopy and JSON-dump session
+    )
+
+
 # Router._aanthropic_messages_streaming_iterator buffers lifecycle chunks
 # until real content commits the primary stream; a hostile or slow-starting
 # upstream that never emits content or an error could otherwise grow that
@@ -4930,6 +4952,7 @@ class Router:
                 "caching": self.cache_responses,
                 **kwargs,
                 "model": model_name,
+                **_with_router_resolved_session_model(kwargs.get("session"), model_name),
             }
             # Only set custom_llm_provider if it's not None
             if custom_llm_provider is not None:

tests/code_coverage_tests/recursive_detector.py

@@ -64,6 +64,8 @@ IGNORE_FUNCTIONS = [
     "_flatten_form_field",  # bounded by the nesting depth of the already-parsed request body (a finite JSON tree, no cycles possible).
     "_flatten_form_data_field",  # bounded by the nesting depth of the already-parsed request body (a finite JSON tree, no cycles possible).
     "_json_safe",  # max depth set (_MAX_DEPTH) plus a seen-ids cycle guard for self-referential input.
+    "_redact_agent_params_tree",  # max depth set (default 10), same shape as _redact_sensitive_litellm_params.
+    "_restore_redacted_nested_value",  # max depth set (default 10), mirrors _redact_agent_params_tree on the write side.
 ]
 
 

tests/test_litellm/integrations/otel/test_langfuse_logger.py

@@ -0,0 +1,359 @@
+"""Tests for ``LangfuseOpenTelemetryV2``: the root observation's input and output are stamped from the
+request-task hooks, while the root span is still recording, so Langfuse can show them on the trace."""
+
+import asyncio
+import json
+from collections.abc import AsyncIterator, Sequence
+from typing import Final
+
+import pytest
+
+pytest.importorskip("opentelemetry")
+
+from opentelemetry.sdk.trace.export.in_memory_span_exporter import InMemorySpanExporter  # noqa: E402
+
+import litellm  # noqa: E402
+from litellm.caching.dual_cache import DualCache  # noqa: E402
+from litellm.integrations.otel.logger import build_otel_v2_logger  # noqa: E402
+from litellm.integrations.otel.model.config import OpenTelemetryV2Config, is_otel_v2_enabled  # noqa: E402
+from litellm.integrations.otel.model.spans import LITELLM_PROXY_REQUEST_SPAN_NAME, SpanRole  # noqa: E402
+from litellm.integrations.otel.plumbing import context as otel_context  # noqa: E402
+from litellm.integrations.otel.plumbing import providers  # noqa: E402
+from litellm.integrations.otel.plumbing.context import set_request_root_span  # noqa: E402
+from litellm.litellm_core_utils.litellm_logging import _maybe_construct_otel_v2  # noqa: E402
+from litellm.proxy._types import UserAPIKeyAuth  # noqa: E402
+from litellm.proxy.utils import ProxyLogging  # noqa: E402
+from litellm.types.llms.openai import (  # noqa: E402
+    ResponseCompletedEvent,
+    ResponsesAPIResponse,
+    ResponsesAPIStreamEvents,
+)
+from litellm.types.utils import (  # noqa: E402
+    Choices,
+    Delta,
+    Embedding,
+    EmbeddingResponse,
+    Message,
+    ModelResponse,
+    ModelResponseStream,
+    StreamingChoices,
+)
+
+INPUT_ATTR: Final = "langfuse.observation.input"
+OUTPUT_ATTR: Final = "langfuse.observation.output"
+CHAT_DATA: Final = {"model": "gpt-5.4-mini", "messages": [{"role": "user", "content": "ping"}]}
+
+
+@pytest.fixture(autouse=True)
+def _reset_request_root_span():
+    otel_context._request_root_span.set(None)
+    yield
+    otel_context._request_root_span.set(None)
+
+
+def _logger(*, capture: str = "span_only", mappers: Sequence[str] = ("genai", "langfuse")):
+    cfg = OpenTelemetryV2Config(exporter="in_memory", mapper_names=list(mappers), capture_message_content=capture)
+    exporter = InMemorySpanExporter()
+    tracer_provider = providers.build_tracer_provider(cfg, exporter=exporter)
+    return build_otel_v2_logger(config=cfg, tracer_provider=tracer_provider), exporter
+
+
+def _start_root(logger):
+    root = logger._emitter.start_span(SpanRole.PROXY_REQUEST, LITELLM_PROXY_REQUEST_SPAN_NAME)
+    set_request_root_span(root)
+    return root
+
+
+def _root_attrs(exporter):
+    by_name = {span.name: span for span in exporter.get_finished_spans()}
+    return dict(by_name[LITELLM_PROXY_REQUEST_SPAN_NAME].attributes or {})
+
+
+def _run_request(logger, data: dict, call_type: str, response: object):
+    root = _start_root(logger)
+    asyncio.run(logger.async_pre_call_hook(UserAPIKeyAuth(), DualCache(), data, call_type))
+    asyncio.run(logger.async_post_call_success_hook(data=data, user_api_key_dict=UserAPIKeyAuth(), response=response))
+    root.end()
+
+
+async def _relay(logger, chunks: Sequence[object], data: dict) -> list[object]:
+    async def source() -> AsyncIterator[object]:
+        for chunk in chunks:
+            yield chunk
+
+    return [chunk async for chunk in logger.async_post_call_streaming_iterator_hook(UserAPIKeyAuth(), source(), data)]
+
+
+def _run_stream(logger, data: dict, chunks: Sequence[object]) -> list[object]:
+    root = _start_root(logger)
+    asyncio.run(logger.async_pre_call_hook(UserAPIKeyAuth(), DualCache(), data, "acompletion"))
+    relayed = asyncio.run(_relay(logger, chunks, data))
+    root.end()
+    return relayed
+
+
+def _chat_chunk(content: str | None, finish_reason: str | None = None) -> ModelResponseStream:
+    return ModelResponseStream(
+        id="chatcmpl-1",
+        created=1,
+        model="gpt-5.4-mini",
+        choices=[StreamingChoices(index=0, delta=Delta(content=content), finish_reason=finish_reason)],
+    )
+
+
+def _responses_api_response() -> ResponsesAPIResponse:
+    return ResponsesAPIResponse(
+        id="resp_1",
+        created_at=1,
+        output=[
+            {
+                "type": "message",
+                "id": "msg_1",
+                "status": "completed",
+                "role": "assistant",
+                "content": [{"type": "output_text", "text": "pong", "annotations": []}],
+            }
+        ],
+    )
+
+
+def _anthropic_sse_frames() -> tuple[bytes, ...]:
+    events = (
+        {
+            "type": "message_start",
+            "message": {
+                "id": "msg_1",
+                "type": "message",
+                "role": "assistant",
+                "model": "claude-sonnet-4-5",
+                "content": [],
+                "stop_reason": None,
+                "usage": {"input_tokens": 1, "output_tokens": 0},
+            },
+        },
+        {"type": "content_block_start", "index": 0, "content_block": {"type": "text", "text": ""}},
+        {"type": "content_block_delta", "index": 0, "delta": {"type": "text_delta", "text": "po"}},
+        {"type": "content_block_delta", "index": 0, "delta": {"type": "text_delta", "text": "ng"}},
+        {"type": "content_block_stop", "index": 0},
+        {"type": "message_delta", "delta": {"stop_reason": "end_turn"}, "usage": {"output_tokens": 2}},
+        {"type": "message_stop"},
+    )
+    return tuple(f"event: {event['type']}\ndata: {json.dumps(event)}\n\n".encode() for event in events)
+
+
+def test_chat_request_stamps_root_observation_input_and_output():
+    logger, exporter = _logger()
+    response = ModelResponse(choices=[Choices(message=Message(role="assistant", content="pong"))])
+
+    _run_request(logger, CHAT_DATA, "acompletion", response)
+
+    attrs = _root_attrs(exporter)
+    assert json.loads(attrs[INPUT_ATTR]) == [{"role": "user", "content": "ping"}]
+    output = json.loads(attrs[OUTPUT_ATTR])
+    assert [(turn["role"], turn["content"]) for turn in output] == [("assistant", "pong")]
+
+
+def test_responses_request_folds_instructions_into_input_and_stamps_output_items():
+    logger, exporter = _logger()
+    data = {"model": "gpt-5.4-mini", "instructions": "be terse", "input": "ping"}
+
+    _run_request(logger, data, "aresponses", _responses_api_response())
+
+    attrs = _root_attrs(exporter)
+    assert json.loads(attrs[INPUT_ATTR]) == [
+        {"role": "system", "content": "be terse"},
+        {"role": "user", "content": "ping"},
+    ]
+    output = json.loads(attrs[OUTPUT_ATTR])
+    assert output[0]["role"] == "assistant"
+    assert output[0]["content"][0]["text"] == "pong"
+
+
+def test_anthropic_messages_request_folds_system_into_input_and_stamps_content_blocks():
+    logger, exporter = _logger()
+    data = {"model": "claude-sonnet-4-5", "system": "be terse", "messages": [{"role": "user", "content": "ping"}]}
+    response = {"type": "message", "role": "assistant", "content": [{"type": "text", "text": "pong"}]}
+
+    _run_request(logger, data, "aanthropic_messages", response)
+
+    attrs = _root_attrs(exporter)
+    assert json.loads(attrs[INPUT_ATTR]) == [
+        {"role": "system", "content": "be terse"},
+        {"role": "user", "content": "ping"},
+    ]
+    assert json.loads(attrs[OUTPUT_ATTR]) == [{"role": "assistant", "content": [{"type": "text", "text": "pong"}]}]
+
+
+def test_chat_stream_relays_chunks_untouched_and_stamps_assembled_output():
+    logger, exporter = _logger()
+    chunks = (_chat_chunk("po"), _chat_chunk("ng"), _chat_chunk(None, finish_reason="stop"))
+
+    relayed = _run_stream(logger, CHAT_DATA, chunks)
+
+    assert [id(chunk) for chunk in relayed] == [id(chunk) for chunk in chunks]
+    output = json.loads(_root_attrs(exporter)[OUTPUT_ATTR])
+    assert [(turn["role"], turn["content"]) for turn in output] == [("assistant", "pong")]
+
+
+def test_responses_stream_stamps_output_from_the_completed_event():
+    logger, exporter = _logger()
+    completed = ResponseCompletedEvent(
+        type=ResponsesAPIStreamEvents.RESPONSE_COMPLETED, response=_responses_api_response()
+    )
+    chunks = ({"type": "response.created"}, {"type": "response.output_text.delta", "delta": "pong"}, completed)
+
+    relayed = _run_stream(logger, {"model": "gpt-5.4-mini", "input": "ping"}, chunks)
+
+    assert relayed == list(chunks)
+    output = json.loads(_root_attrs(exporter)[OUTPUT_ATTR])
+    assert output[0]["content"][0]["text"] == "pong"
+
+
+def test_anthropic_sse_stream_stamps_output_from_the_assembled_frames():
+    logger, exporter = _logger()
+    frames = _anthropic_sse_frames()
+
+    relayed = _run_stream(
+        logger, {"model": "claude-sonnet-4-5", "messages": [{"role": "user", "content": "ping"}]}, frames
+    )
+
+    assert relayed == list(frames)
+    output = json.loads(_root_attrs(exporter)[OUTPUT_ATTR])
+    assert [(turn["role"], turn["content"]) for turn in output] == [("assistant", "pong")]
+
+
+def test_root_observation_io_survives_the_root_ending_before_the_success_callback():
+    logger, exporter = _logger()
+    response = ModelResponse(choices=[Choices(message=Message(role="assistant", content="pong"))])
+    root = _start_root(logger)
+    asyncio.run(logger.async_pre_call_hook(UserAPIKeyAuth(), DualCache(), CHAT_DATA, "acompletion"))
+    logger.log_pre_api_call(
+        model="gpt-5.4-mini",
+        messages=[],
+        kwargs={"litellm_call_id": "call_1", "litellm_params": {"metadata": {}}},
+    )
+    asyncio.run(
+        logger.async_post_call_success_hook(data=CHAT_DATA, user_api_key_dict=UserAPIKeyAuth(), response=response)
+    )
+    root.end()
+
+    payload = {
+        "call_type": "acompletion",
+        "custom_llm_provider": "openai",
+        "model": "gpt-5.4-mini",
+        "messages": CHAT_DATA["messages"],
+        "response": response.model_dump(),
+        "status": "success",
+        "litellm_call_id": "call_1",
+        "metadata": {},
+        "hidden_params": {},
+    }
+    asyncio.run(
+        logger.async_log_success_event(
+            {"standard_logging_object": payload, "litellm_params": {"metadata": {}}}, response, None, None
+        )
+    )
+
+    attrs = _root_attrs(exporter)
+    assert INPUT_ATTR in attrs and OUTPUT_ATTR in attrs
+    generation = next(span for span in exporter.get_finished_spans() if span.name != LITELLM_PROXY_REQUEST_SPAN_NAME)
+    assert OUTPUT_ATTR in dict(generation.attributes or {})
+
+
+def test_root_input_is_the_request_as_the_pre_call_chain_left_it():
+    logger, exporter = _logger()
+    raw = {"model": "gpt-5.4-mini", "messages": [{"role": "user", "content": "my ssn is 123-45-6789"}]}
+    masked = {"model": "gpt-5.4-mini", "messages": [{"role": "user", "content": "my ssn is [REDACTED]"}]}
+    response = ModelResponse(choices=[Choices(message=Message(role="assistant", content="noted"))])
+    root = _start_root(logger)
+    asyncio.run(logger.async_pre_call_hook(UserAPIKeyAuth(), DualCache(), raw, "acompletion"))
+    asyncio.run(logger.async_post_call_success_hook(data=masked, user_api_key_dict=UserAPIKeyAuth(), response=response))
+    root.end()
+
+    assert json.loads(_root_attrs(exporter)[INPUT_ATTR]) == masked["messages"]
+
+
+def test_root_already_ended_is_left_alone():
+    logger, exporter = _logger()
+    response = ModelResponse(choices=[Choices(message=Message(role="assistant", content="pong"))])
+    root = _start_root(logger)
+    root.end()
+
+    asyncio.run(
+        logger.async_post_call_success_hook(data=CHAT_DATA, user_api_key_dict=UserAPIKeyAuth(), response=response)
+    )
+
+    attrs = _root_attrs(exporter)
+    assert INPUT_ATTR not in attrs and OUTPUT_ATTR not in attrs
+
+
+def test_responses_without_a_message_body_stamp_neither_input_nor_output():
+    logger, exporter = _logger()
+    embedding = EmbeddingResponse(model="e", data=[Embedding(embedding=[0.1], index=0, object="embedding")])
+
+    _run_request(logger, {"model": "e", "input": "ping"}, "aembedding", embedding)
+
+    attrs = _root_attrs(exporter)
+    assert INPUT_ATTR not in attrs and OUTPUT_ATTR not in attrs
+
+
+def test_unrenderable_output_never_raises_into_the_request():
+    logger, exporter = _logger()
+
+    _run_request(logger, CHAT_DATA, "acompletion", object())
+
+    attrs = _root_attrs(exporter)
+    assert INPUT_ATTR not in attrs and OUTPUT_ATTR not in attrs
+
+
+@pytest.mark.parametrize(
+    ("capture", "mappers"),
+    [("no_content", ("genai", "langfuse")), ("span_only", ("genai",))],
+)
+def test_factory_keeps_the_base_logger_unless_langfuse_content_capture_is_on(capture, mappers):
+    logger, exporter = _logger(capture=capture, mappers=mappers)
+
+    _run_request(logger, CHAT_DATA, "acompletion", ModelResponse())
+    attrs = _root_attrs(exporter)
+    assert INPUT_ATTR not in attrs and OUTPUT_ATTR not in attrs
+
+
+@pytest.mark.parametrize(
+    ("capture", "mappers", "relays_streams"),
+    [
+        ("span_only", ("genai", "langfuse"), True),
+        ("no_content", ("genai", "langfuse"), False),
+        ("span_only", ("genai",), False),
+    ],
+)
+def test_only_langfuse_content_capture_takes_proxy_streams_off_the_fast_path(
+    monkeypatch, capture, mappers, relays_streams
+):
+    logger, _ = _logger(capture=capture, mappers=mappers)
+    monkeypatch.setattr(litellm, "callbacks", [logger])
+
+    assert ProxyLogging._callback_capabilities().has_iterator_override is relays_streams
+
+
+def test_langfuse_otel_preset_builds_a_logger_that_stamps_the_root(monkeypatch):
+    monkeypatch.setenv("LITELLM_OTEL_V2", "true")
+    monkeypatch.setenv("LANGFUSE_PUBLIC_KEY", "pk")
+    monkeypatch.setenv("LANGFUSE_SECRET_KEY", "sk")
+    monkeypatch.setenv("LANGFUSE_HOST", "https://cloud.langfuse.com")
+    monkeypatch.setenv("OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT", "span_only")
+    is_otel_v2_enabled.cache_clear()
+
+    loggers: list = []
+    try:
+        built = _maybe_construct_otel_v2("langfuse_otel", loggers)
+        assert built is not None
+        assert _maybe_construct_otel_v2("langfuse_otel", loggers) is built
+        root = _start_root(built)
+        response = ModelResponse(choices=[Choices(message=Message(role="assistant", content="pong"))])
+        asyncio.run(
+            built.async_post_call_success_hook(data=CHAT_DATA, user_api_key_dict=UserAPIKeyAuth(), response=response)
+        )
+        attrs = dict(root.attributes or {})
+        assert INPUT_ATTR in attrs and OUTPUT_ATTR in attrs
+    finally:
+        is_otel_v2_enabled.cache_clear()

tests/test_litellm/llms/base_llm/files/test_azure_blob_storage_backend.py

@@ -184,6 +184,50 @@ async def test_download_file_drops_query_string_from_the_stored_url(mock_env_var
     )
 
 
+@pytest.mark.parametrize(
+    "malicious_filename",
+    [
+        "report.jsonl/../../etc/cron.d/evil",
+        "a.b/../../../root/.ssh/authorized_keys",
+    ],
+)
+@pytest.mark.parametrize("strategy", ["uuid", "timestamp"])
+@pytest.mark.asyncio
+async def test_generate_file_name_strips_path_traversal_from_extension(mock_env_vars, malicious_filename, strategy):
+    """
+    original_filename.split(".")[-1] does not parse path structure, so a filename whose
+    last "." is followed by a directory traversal sequence used to put that sequence
+    straight into the blob path built from this name. The mutant this pins is reverting
+    _safe_extension() back to that bare split.
+    """
+    backend = _make_backend()
+    generated = backend._generate_file_name(malicious_filename, strategy)
+    assert "/" not in generated
+    assert ".." not in generated
+
+
+@pytest.mark.asyncio
+async def test_generate_file_name_uuid_strategy_preserves_ordinary_extension(mock_env_vars):
+    backend = _make_backend()
+    generated = backend._generate_file_name("data.jsonl", "uuid")
+    assert generated.endswith(".jsonl")
+
+
+@pytest.mark.asyncio
+async def test_generate_file_name_original_filename_strategy_strips_directory_components(mock_env_vars):
+    """The blob name must never carry a directory the caller supplied, traversal or not."""
+    backend = _make_backend()
+    generated = backend._generate_file_name("../../etc/passwd", "original_filename")
+    assert generated == "passwd"
+
+
+@pytest.mark.asyncio
+async def test_generate_file_name_null_byte_filename_falls_back_to_safe_default(mock_env_vars):
+    backend = _make_backend()
+    generated = backend._generate_file_name("report.pdf\x00.exe", "uuid")
+    assert "\x00" not in generated
+
+
 @pytest.mark.parametrize(
     "env_fixture, expected_suffix",
     [("mock_env_vars", "core.windows.net"), ("mock_gov_env_vars", GOV_SUFFIX)],

tests/test_litellm/proxy/agent_endpoints/test_agent_registry.py

@@ -8,7 +8,18 @@ from unittest.mock import AsyncMock, MagicMock
 
 import pytest
 
-from litellm.proxy.agent_endpoints.agent_registry import AgentRegistry, GrantMigrationResult
+from litellm.constants import REDACTED_BY_LITELM_STRING
+from litellm.proxy.agent_endpoints.agent_registry import (
+    AgentRegistry,
+    GrantMigrationResult,
+    _restore_redacted_litellm_params,
+    redact_sensitive_agent_litellm_params,
+)
+
+# Obviously-fake stand-ins for a real AWS credential pair (LIT-6736 regression
+# fixtures) -- never a real key shape, and must never appear in any response.
+SENTINEL_AWS_ACCESS_KEY_ID: Final = "AKIATESTSENTINEL0000"
+SENTINEL_AWS_SECRET_ACCESS_KEY: Final = "test-sentinel-do-not-use-secret-value"
 
 
 def _sample_agent_card_params() -> dict:
@@ -49,6 +60,7 @@ async def test_update_agent_in_db_clears_static_headers_and_extra_headers_when_o
 
     mock_update = AsyncMock(return_value=updated_agent)
     mock_prisma.db.litellm_agentstable.update = mock_update
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(return_value=None)
 
     # Agent config WITHOUT static_headers or extra_headers (omitted)
     agent_config = {
@@ -95,6 +107,7 @@ async def test_update_agent_in_db_preserves_explicit_static_headers_and_extra_he
 
     mock_update = AsyncMock(return_value=updated_agent)
     mock_prisma.db.litellm_agentstable.update = mock_update
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(return_value=None)
 
     agent_config = {
         "agent_name": "Updated Agent",
@@ -436,6 +449,9 @@ async def test_update_agent_in_db_raises_when_row_deleted_mid_update():
     guard the code dereferences None and reports an opaque AttributeError instead of the id."""
     registry: Final = AgentRegistry()
     mock_prisma: Final = MagicMock()
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value=SimpleNamespace(litellm_params={}, object_permission_id=None)
+    )
     mock_prisma.db.litellm_agentstable.update = AsyncMock(return_value=None)
 
     with pytest.raises(Exception, match="Error updating agent in DB") as exc_info:
@@ -485,3 +501,492 @@ async def test_delete_agent_from_db_raises_when_row_already_gone():
         await registry.delete_agent_from_db(agent_id="agent-123", prisma_client=mock_prisma)
 
     assert str(exc_info.value) == "Error deleting agent from DB: Agent not found, passed agent_id=agent-123"
+
+
+# ---------- LIT-6736: agent litellm_params secret redaction ----------
+
+
+def test_redact_sensitive_agent_litellm_params_masks_secrets_keeps_the_rest():
+    """The sentinel secret must never appear in the redacted output; non-secret
+    keys (model reference, is_public) must survive untouched."""
+    redacted = redact_sensitive_agent_litellm_params(
+        {
+            "aws_access_key_id": SENTINEL_AWS_ACCESS_KEY_ID,
+            "aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY,
+            "model": "bedrock/agentcore/my-agent",
+            "is_public": True,
+        }
+    )
+
+    assert SENTINEL_AWS_ACCESS_KEY_ID not in json.dumps(redacted)
+    assert SENTINEL_AWS_SECRET_ACCESS_KEY not in json.dumps(redacted)
+    assert redacted["aws_access_key_id"] == REDACTED_BY_LITELM_STRING
+    assert redacted["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+    assert redacted["model"] == "bedrock/agentcore/my-agent"
+    assert redacted["is_public"] is True
+
+
+def test_redact_sensitive_agent_litellm_params_recurses_into_nested_dicts():
+    """A secret nested one level down (e.g. a per-provider sub-config) must
+    also be redacted, not just top-level keys."""
+    redacted = redact_sensitive_agent_litellm_params(
+        {"provider_config": {"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY, "region": "us-east-1"}}
+    )
+
+    assert SENTINEL_AWS_SECRET_ACCESS_KEY not in json.dumps(redacted)
+    assert redacted["provider_config"]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+    assert redacted["provider_config"]["region"] == "us-east-1"
+
+
+def test_redact_sensitive_agent_litellm_params_handles_none_and_json_string():
+    assert redact_sensitive_agent_litellm_params(None) is None
+
+    serialized = json.dumps({"api_key": SENTINEL_AWS_SECRET_ACCESS_KEY, "model": "gpt-4"})
+    redacted = redact_sensitive_agent_litellm_params(serialized)
+
+    assert SENTINEL_AWS_SECRET_ACCESS_KEY not in redacted
+    assert json.loads(redacted)["api_key"] == REDACTED_BY_LITELM_STRING
+    assert json.loads(redacted)["model"] == "gpt-4"
+
+
+def test_redact_sensitive_agent_litellm_params_recurses_into_lists_of_dicts():
+    """A secret nested inside a list of provider sub-configs (a shape a
+    non-sensitively-named key can legitimately hold) must also be redacted,
+    not silently returned as-is."""
+    redacted = redact_sensitive_agent_litellm_params(
+        {
+            "provider_configs": [
+                {"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY, "region": "us-east-1"},
+                {"aws_secret_access_key": "other-" + SENTINEL_AWS_SECRET_ACCESS_KEY, "region": "us-west-2"},
+            ]
+        }
+    )
+
+    assert SENTINEL_AWS_SECRET_ACCESS_KEY not in json.dumps(redacted)
+    assert redacted["provider_configs"][0]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+    assert redacted["provider_configs"][0]["region"] == "us-east-1"
+    assert redacted["provider_configs"][1]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+    assert redacted["provider_configs"][1]["region"] == "us-west-2"
+
+
+def test_redact_sensitive_agent_litellm_params_redacts_secrets_inside_model_list():
+    """The exact shape flagged in review: litellm_params.model_list, where each
+    entry carries its own nested litellm_params with a provider credential."""
+    redacted = redact_sensitive_agent_litellm_params(
+        {
+            "model_list": [
+                {
+                    "model_name": "gpt-4",
+                    "litellm_params": {"api_key": SENTINEL_AWS_SECRET_ACCESS_KEY, "model": "gpt-4"},
+                },
+                {
+                    "model_name": "claude",
+                    "litellm_params": {
+                        "aws_secret_access_key": "other-" + SENTINEL_AWS_SECRET_ACCESS_KEY,
+                        "model": "bedrock/claude",
+                    },
+                },
+            ]
+        }
+    )
+
+    assert SENTINEL_AWS_SECRET_ACCESS_KEY not in json.dumps(redacted)
+    assert redacted["model_list"][0]["litellm_params"]["api_key"] == REDACTED_BY_LITELM_STRING
+    assert redacted["model_list"][0]["litellm_params"]["model"] == "gpt-4"
+    assert redacted["model_list"][1]["litellm_params"]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+    assert redacted["model_list"][1]["litellm_params"]["model"] == "bedrock/claude"
+
+
+def test_restore_redacted_litellm_params_preserves_secret_inside_model_list():
+    """The write-side counterpart: a caller editing a model_list entry's own
+    non-secret field (renaming it) while leaving that same entry's nested
+    secret masked must not corrupt the stored per-deployment credential.
+    List entries correspond by position (see the module docstring on
+    ``_restore_redacted_nested_value``), so this -- the common "edit this
+    entry, keep its secret" pattern -- must keep working."""
+    existing = {
+        "agent_name": "my-agent",
+        "model_list": [
+            {
+                "model_name": "gpt-4",
+                "litellm_params": {"api_key": SENTINEL_AWS_SECRET_ACCESS_KEY, "model": "gpt-4"},
+            },
+        ],
+    }
+    incoming = {
+        "agent_name": "my-agent-renamed",
+        "model_list": [
+            {
+                "model_name": "gpt-4-renamed",
+                "litellm_params": {"api_key": REDACTED_BY_LITELM_STRING, "model": "gpt-4"},
+            },
+        ],
+    }
+
+    restored = _restore_redacted_litellm_params(incoming, existing)
+
+    assert SENTINEL_AWS_SECRET_ACCESS_KEY == restored["model_list"][0]["litellm_params"]["api_key"]
+    assert restored["model_list"][0]["model_name"] == "gpt-4-renamed"
+    assert restored["agent_name"] == "my-agent-renamed"
+
+
+def test_restore_redacted_litellm_params_matches_list_entries_by_position():
+    """Documents the accepted trade-off: a list has no stable per-element
+    identity in a plain ``dict[str, object]`` schema, so restoration matches
+    entries by index, the same correspondence every other part of this merge
+    (and the endpoints' full-replace-on-PUT semantics) already assumes. If a
+    caller both reorders the list AND echoes back a masked marker in the same
+    request, a credential can end up attached to a different logical entry.
+    That is a known, narrow limitation -- not a leak between different
+    agents or tenants, since it only reshuffles one agent's own stored
+    values -- and this test pins the current, deliberate behavior rather
+    than asserting it away."""
+    existing = {
+        "model_list": [
+            {"model_name": "gpt-4", "litellm_params": {"api_key": SENTINEL_AWS_SECRET_ACCESS_KEY}},
+            {"model_name": "claude", "litellm_params": {"api_key": "other-" + SENTINEL_AWS_SECRET_ACCESS_KEY}},
+        ],
+    }
+    incoming = {
+        "model_list": [
+            # Same index (0) now holds what used to be at index 1's entry.
+            {"model_name": "claude", "litellm_params": {"api_key": REDACTED_BY_LITELM_STRING}},
+        ],
+    }
+
+    restored = _restore_redacted_litellm_params(incoming, existing)
+
+    assert restored["model_list"][0]["litellm_params"]["api_key"] == SENTINEL_AWS_SECRET_ACCESS_KEY
+
+
+def test_restore_redacted_litellm_params_recovers_a_whole_subtree_collapsed_by_the_depth_cap():
+    """Past the read-side recursion depth cap, a whole nested subtree is
+    collapsed to the flat REDACTED_BY_LITELM marker rather than a dict/list.
+    If the caller echoes that flat marker back unchanged, the whole
+    subtree -- not just the literal marker string -- must be restored."""
+    existing_subtree = {"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY, "region": "us-east-1"}
+    incoming = {"provider_config": REDACTED_BY_LITELM_STRING}
+    existing = {"provider_config": existing_subtree}
+
+    restored = _restore_redacted_litellm_params(incoming, existing)
+
+    assert restored["provider_config"] == existing_subtree
+
+
+def test_redact_sensitive_agent_litellm_params_does_not_reinterpret_plain_string_values_as_json():
+    """A plain non-JSON string value (most string leaves) must pass through
+    unchanged rather than failing to parse and getting redacted."""
+    redacted = redact_sensitive_agent_litellm_params({"model": "bedrock/agentcore/my-agent", "is_public": True})
+
+    assert redacted["model"] == "bedrock/agentcore/my-agent"
+    assert redacted["is_public"] is True
+
+
+@pytest.mark.asyncio
+async def test_add_agent_to_db_drops_a_sentinel_value_instead_of_storing_the_placeholder():
+    """A create has nothing stored to restore behind a redaction marker, so a
+    sensitive key submitted as the literal marker is dropped rather than
+    persisted as the placeholder string itself."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+    created_agent = MagicMock()
+    created_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "Test Agent",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {},
+        "object_permission": None,
+    }
+    created_agent.object_permission = None
+    mock_create = AsyncMock(return_value=created_agent)
+    mock_prisma.db.litellm_agentstable.create = mock_create
+
+    await registry.add_agent_to_db(
+        agent={
+            "agent_name": "Test Agent",
+            "agent_card_params": _sample_agent_card_params(),
+            "litellm_params": {
+                "aws_secret_access_key": REDACTED_BY_LITELM_STRING,
+                "model": "bedrock/agentcore/my-agent",
+            },
+        },
+        prisma_client=mock_prisma,
+        created_by="test-user",
+    )
+
+    stored_params: Final = json.loads(mock_create.call_args.kwargs["data"]["litellm_params"])
+    assert "aws_secret_access_key" not in stored_params
+    assert stored_params["model"] == "bedrock/agentcore/my-agent"
+
+
+@pytest.mark.asyncio
+async def test_update_agent_in_db_preserves_secret_when_echoed_back_redacted():
+    """PUT round-trips the GET response, which shows the secret redacted. Saving
+    an unrelated field change must not overwrite the real stored credential
+    with the redaction marker."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value=SimpleNamespace(
+            litellm_params={
+                "aws_access_key_id": SENTINEL_AWS_ACCESS_KEY_ID,
+                "aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY,
+                "model": "bedrock/agentcore/my-agent",
+            },
+            object_permission_id=None,
+        )
+    )
+    updated_agent = MagicMock()
+    updated_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "Renamed Agent",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {},
+        "object_permission": None,
+    }
+    updated_agent.object_permission = None
+    mock_update = AsyncMock(return_value=updated_agent)
+    mock_prisma.db.litellm_agentstable.update = mock_update
+
+    await registry.update_agent_in_db(
+        agent_id="agent-123",
+        agent={
+            "agent_name": "Renamed Agent",
+            "agent_card_params": _sample_agent_card_params(),
+            # The UI round-tripped the redacted secret and the untouched
+            # access key id verbatim; only agent_name actually changed.
+            "litellm_params": {
+                "aws_access_key_id": SENTINEL_AWS_ACCESS_KEY_ID,
+                "aws_secret_access_key": REDACTED_BY_LITELM_STRING,
+                "model": "bedrock/agentcore/my-agent",
+            },
+        },
+        prisma_client=mock_prisma,
+        updated_by="test-user",
+    )
+
+    stored_params: Final = json.loads(mock_update.call_args.kwargs["data"]["litellm_params"])
+    assert stored_params["aws_secret_access_key"] == SENTINEL_AWS_SECRET_ACCESS_KEY
+    assert stored_params["aws_access_key_id"] == SENTINEL_AWS_ACCESS_KEY_ID
+    assert stored_params["model"] == "bedrock/agentcore/my-agent"
+
+
+@pytest.mark.asyncio
+async def test_update_agent_in_db_preserves_secret_when_key_omitted_entirely():
+    """Omitting the sensitive key altogether must fall back to the stored
+    value too, not just an explicit redaction-marker round-trip."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value=SimpleNamespace(
+            litellm_params={"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY},
+            object_permission_id=None,
+        )
+    )
+    updated_agent = MagicMock()
+    updated_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "Test Agent",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {},
+        "object_permission": None,
+    }
+    updated_agent.object_permission = None
+    mock_update = AsyncMock(return_value=updated_agent)
+    mock_prisma.db.litellm_agentstable.update = mock_update
+
+    await registry.update_agent_in_db(
+        agent_id="agent-123",
+        agent={
+            "agent_name": "Test Agent",
+            "agent_card_params": _sample_agent_card_params(),
+            "litellm_params": {"model": "bedrock/agentcore/my-agent"},
+        },
+        prisma_client=mock_prisma,
+        updated_by="test-user",
+    )
+
+    stored_params: Final = json.loads(mock_update.call_args.kwargs["data"]["litellm_params"])
+    assert stored_params["aws_secret_access_key"] == SENTINEL_AWS_SECRET_ACCESS_KEY
+
+
+@pytest.mark.asyncio
+async def test_update_agent_in_db_preserves_secret_nested_under_a_non_sensitive_key():
+    """A secret nested inside a dict held by a non-sensitively-named key
+    (e.g. a per-provider sub-config) must also survive an echoed-back
+    redaction marker, not just top-level secret keys."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value=SimpleNamespace(
+            litellm_params={
+                "provider_config": {
+                    "aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY,
+                    "region": "us-east-1",
+                }
+            },
+            object_permission_id=None,
+        )
+    )
+    updated_agent = MagicMock()
+    updated_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "Test Agent",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {},
+        "object_permission": None,
+    }
+    updated_agent.object_permission = None
+    mock_update = AsyncMock(return_value=updated_agent)
+    mock_prisma.db.litellm_agentstable.update = mock_update
+
+    await registry.update_agent_in_db(
+        agent_id="agent-123",
+        agent={
+            "agent_name": "Test Agent",
+            "agent_card_params": _sample_agent_card_params(),
+            "litellm_params": {
+                # The GET response redacted the nested secret; the caller
+                # round-trips it verbatim while changing nothing.
+                "provider_config": {
+                    "aws_secret_access_key": REDACTED_BY_LITELM_STRING,
+                    "region": "us-west-2",
+                }
+            },
+        },
+        prisma_client=mock_prisma,
+        updated_by="test-user",
+    )
+
+    stored_params: Final = json.loads(mock_update.call_args.kwargs["data"]["litellm_params"])
+    assert stored_params["provider_config"]["aws_secret_access_key"] == SENTINEL_AWS_SECRET_ACCESS_KEY
+    assert stored_params["provider_config"]["region"] == "us-west-2"
+
+
+@pytest.mark.asyncio
+async def test_update_agent_in_db_clears_secret_on_explicit_empty_value():
+    """An explicit empty string is a deliberate clear, distinct from an omitted
+    key or the redaction marker, and must actually clear the stored secret."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value=SimpleNamespace(
+            litellm_params={"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY},
+            object_permission_id=None,
+        )
+    )
+    updated_agent = MagicMock()
+    updated_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "Test Agent",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {},
+        "object_permission": None,
+    }
+    updated_agent.object_permission = None
+    mock_update = AsyncMock(return_value=updated_agent)
+    mock_prisma.db.litellm_agentstable.update = mock_update
+
+    await registry.update_agent_in_db(
+        agent_id="agent-123",
+        agent={
+            "agent_name": "Test Agent",
+            "agent_card_params": _sample_agent_card_params(),
+            "litellm_params": {"aws_secret_access_key": ""},
+        },
+        prisma_client=mock_prisma,
+        updated_by="test-user",
+    )
+
+    stored_params: Final = json.loads(mock_update.call_args.kwargs["data"]["litellm_params"])
+    assert stored_params["aws_secret_access_key"] == ""
+
+
+@pytest.mark.asyncio
+async def test_patch_agent_in_db_preserves_secret_when_litellm_params_omitted():
+    """A PATCH that only renames the agent must not touch (let alone drop) the
+    stored litellm_params secret."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value={
+            "agent_id": "agent-123",
+            "agent_name": "Old Name",
+            "litellm_params": {"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY},
+            "object_permission_id": None,
+        }
+    )
+    patched_agent = MagicMock()
+    patched_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "New Name",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY},
+        "object_permission": None,
+    }
+    patched_agent.object_permission = None
+    mock_update = AsyncMock(return_value=patched_agent)
+    mock_prisma.db.litellm_agentstable.update = mock_update
+
+    await registry.patch_agent_in_db(
+        agent_id="agent-123",
+        agent={"agent_name": "New Name"},
+        prisma_client=mock_prisma,
+        updated_by="test-user",
+    )
+
+    update_data: Final = mock_update.call_args.kwargs["data"]
+    assert "litellm_params" not in update_data
+
+
+@pytest.mark.asyncio
+async def test_patch_agent_in_db_preserves_secret_when_echoed_back_redacted():
+    """A PATCH that includes litellm_params (e.g. to flip an unrelated flag)
+    with the secret round-tripped as the redaction marker must not clobber
+    the stored credential."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value={
+            "agent_id": "agent-123",
+            "agent_name": "Test Agent",
+            "litellm_params": {
+                "aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY,
+                "is_public": False,
+            },
+            "object_permission_id": None,
+        }
+    )
+    patched_agent = MagicMock()
+    patched_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "Test Agent",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {},
+        "object_permission": None,
+    }
+    patched_agent.object_permission = None
+    mock_update = AsyncMock(return_value=patched_agent)
+    mock_prisma.db.litellm_agentstable.update = mock_update
+
+    await registry.patch_agent_in_db(
+        agent_id="agent-123",
+        agent={
+            "litellm_params": {
+                "aws_secret_access_key": REDACTED_BY_LITELM_STRING,
+                "is_public": True,
+            }
+        },
+        prisma_client=mock_prisma,
+        updated_by="test-user",
+    )
+
+    stored_params: Final = json.loads(mock_update.call_args.kwargs["data"]["litellm_params"])
+    assert stored_params["aws_secret_access_key"] == SENTINEL_AWS_SECRET_ACCESS_KEY
+    assert stored_params["is_public"] is True

tests/test_litellm/proxy/agent_endpoints/test_endpoints.py

@@ -4,6 +4,7 @@ import pytest
 from fastapi import FastAPI
 from fastapi.testclient import TestClient
 
+from litellm.constants import REDACTED_BY_LITELM_STRING
 from litellm.proxy._types import LitellmUserRoles, UserAPIKeyAuth
 from litellm.proxy.agent_endpoints import endpoints as agent_endpoints
 from litellm.proxy.agent_endpoints.auth.agent_permission_handler import (
@@ -484,11 +485,15 @@ class TestAgentRBACInternalUserViewOnly:
         assert resp.status_code == 403
 
 
+SENTINEL_AGENT_API_KEY = "sk-test-sentinel-do-not-use"
+
+
 class TestAgentRBACProxyAdminViewOnly:
     """Read-only proxy admins go through the object-permission scoped branch on
     GET /v1/agents (the admin fast path stays full PROXY_ADMIN only, so viewers
-    cannot fan out health checks beyond their allowlist), and secret unredaction
-    also stays gated on full PROXY_ADMIN."""
+    cannot fan out health checks beyond their allowlist). litellm_params
+    secrets are redacted for every caller, admin included (LIT-6736); only the
+    virtual-key/header visibility stays gated on full PROXY_ADMIN."""
 
     @pytest.fixture(autouse=True)
     def _setup(self, monkeypatch):
@@ -501,7 +506,7 @@ class TestAgentRBACProxyAdminViewOnly:
                 agent_id=f"agent-{index}",
                 agent_name=f"Agent {index}",
                 agent_card_params=_sample_agent_card_params(),
-                litellm_params={"api_key": "sk-super-secret-agent-key"},
+                litellm_params={"api_key": SENTINEL_AGENT_API_KEY},
             )
             for index in (1, 2)
         ]
@@ -544,7 +549,7 @@ class TestAgentRBACProxyAdminViewOnly:
 
     def test_should_still_redact_secrets_for_view_only_admin(self):
         """An unrestricted viewer sees the same agents as an admin but with keys
-        stripped and litellm_params masked."""
+        stripped; litellm_params secrets never appear in either response."""
         self.allowed_agents_spy.return_value = UnrestrictedAgentAccess()
         viewer_resp = self._list_agents(self.viewer_client)
         admin_resp = self._list_agents(self.admin_client)
@@ -553,14 +558,12 @@ class TestAgentRBACProxyAdminViewOnly:
         viewer_by_id = {agent["agent_id"]: agent for agent in viewer_resp.json()}
         assert set(viewer_by_id) == {"agent-1", "agent-2"}
         assert viewer_by_id["agent-1"]["keys"] is None
-        assert "sk-super-secret-agent-key" not in viewer_resp.text
+        assert SENTINEL_AGENT_API_KEY not in viewer_resp.text
 
         admin_by_id = {agent["agent_id"]: agent for agent in admin_resp.json()}
         assert admin_by_id["agent-1"]["keys"][0]["token"] == "hash-aaa"
-        assert (
-            admin_by_id["agent-1"]["litellm_params"]["api_key"]
-            == "sk-super-secret-agent-key"
-        )
+        assert SENTINEL_AGENT_API_KEY not in admin_resp.text
+        assert admin_by_id["agent-1"]["litellm_params"]["api_key"] == REDACTED_BY_LITELM_STRING
 
 
 class TestAgentRBACProxyAdmin:
@@ -616,6 +619,109 @@ class TestAgentRBACProxyAdmin:
             # Security scheme is the LiteLLM scheme.
             assert "LiteLLMKey" in stored_card["securitySchemes"]
 
+    def test_create_agent_response_never_echoes_secret(self):
+        """LIT-6736: POST /v1/agents must not echo the stored secret back, even
+        though it's the caller's own value and even for a proxy admin."""
+        with patch("litellm.proxy.proxy_server.prisma_client"):  # test-quality-ok: proxy_server module global is the endpoint's only injection point
+            self.mock_registry.get_agent_by_name = MagicMock(return_value=None)
+            self.mock_registry.add_agent_to_db = AsyncMock(
+                return_value=AgentResponse(
+                    agent_id="agent-123",
+                    agent_name="Test Agent",
+                    agent_card_params=_sample_agent_card_params(),
+                    litellm_params={
+                        "aws_secret_access_key": SENTINEL_AGENT_API_KEY,
+                        "model": "bedrock/agentcore/my-agent",
+                    },
+                )
+            )
+            self.mock_registry.register_agent = MagicMock()
+
+            resp = self.admin_client.post(
+                "/v1/agents",
+                json={
+                    "agent_name": "Test Agent",
+                    "agent_card_params": _sample_agent_card_params(),
+                    "litellm_params": {
+                        "aws_secret_access_key": SENTINEL_AGENT_API_KEY,
+                        "model": "bedrock/agentcore/my-agent",
+                    },
+                },
+                headers={"Authorization": "Bearer k"},
+            )
+
+            assert resp.status_code == 200
+            assert SENTINEL_AGENT_API_KEY not in resp.text
+            body = resp.json()
+            assert body["litellm_params"]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+            assert body["litellm_params"]["model"] == "bedrock/agentcore/my-agent"
+
+    def test_update_agent_response_never_echoes_secret(self):
+        """LIT-6736: PUT /v1/agents/{id} must not echo the stored secret back."""
+        with patch("litellm.proxy.proxy_server.prisma_client") as mock_prisma:  # test-quality-ok: proxy_server module global is the endpoint's only injection point
+            mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+                return_value={
+                    "agent_id": "agent-123",
+                    "agent_name": "Existing Agent",
+                    "agent_card_params": _sample_agent_card_params(),
+                }
+            )
+            self.mock_registry.update_agent_in_db = AsyncMock(
+                return_value=AgentResponse(
+                    agent_id="agent-123",
+                    agent_name="Test Agent",
+                    agent_card_params=_sample_agent_card_params(),
+                    litellm_params={"aws_secret_access_key": SENTINEL_AGENT_API_KEY},
+                )
+            )
+            self.mock_registry.deregister_agent = MagicMock()
+            self.mock_registry.register_agent = MagicMock()
+
+            resp = self.admin_client.put(
+                "/v1/agents/agent-123",
+                json={
+                    "agent_name": "Test Agent",
+                    "agent_card_params": _sample_agent_card_params(),
+                    "litellm_params": {"aws_secret_access_key": REDACTED_BY_LITELM_STRING},
+                },
+                headers={"Authorization": "Bearer k"},
+            )
+
+            assert resp.status_code == 200
+            assert SENTINEL_AGENT_API_KEY not in resp.text
+            assert resp.json()["litellm_params"]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+
+    def test_patch_agent_response_never_echoes_secret(self):
+        """LIT-6736: PATCH /v1/agents/{id} must not echo the stored secret back."""
+        with patch("litellm.proxy.proxy_server.prisma_client") as mock_prisma:  # test-quality-ok: proxy_server module global is the endpoint's only injection point
+            mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+                return_value={
+                    "agent_id": "agent-123",
+                    "agent_name": "Existing Agent",
+                    "agent_card_params": _sample_agent_card_params(),
+                }
+            )
+            self.mock_registry.patch_agent_in_db = AsyncMock(
+                return_value=AgentResponse(
+                    agent_id="agent-123",
+                    agent_name="Renamed Agent",
+                    agent_card_params=_sample_agent_card_params(),
+                    litellm_params={"aws_secret_access_key": SENTINEL_AGENT_API_KEY},
+                )
+            )
+            self.mock_registry.deregister_agent = MagicMock()
+            self.mock_registry.register_agent = MagicMock()
+
+            resp = self.admin_client.patch(
+                "/v1/agents/agent-123",
+                json={"agent_name": "Renamed Agent"},
+                headers={"Authorization": "Bearer k"},
+            )
+
+            assert resp.status_code == 200
+            assert SENTINEL_AGENT_API_KEY not in resp.text
+            assert resp.json()["litellm_params"]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+
     def test_should_allow_admin_to_delete_agent(self):
         existing = {
             "agent_id": "agent-123",

tests/test_litellm/proxy/auth/test_auth_utils.py

@@ -3169,7 +3169,7 @@ class TestIsRequestBodySafeChecksBracketNotationMetadata:
 
 
 class TestHasUserSetupSso:
-    """_has_user_setup_sso must treat SAML IdP metadata as SSO configured.
+    """has_user_setup_sso must treat SAML IdP metadata as SSO configured.
 
     Regression: UI discovery used this helper for sso_configured, but it only
     checked OAuth client IDs, so SAML-only setups left the login button gray.
@@ -3187,29 +3187,167 @@ class TestHasUserSetupSso:
             monkeypatch.delenv(key, raising=False)
 
     def test_false_when_no_sso_env(self):
-        from litellm.proxy.auth.auth_utils import _has_user_setup_sso
+        from litellm.proxy.auth.auth_utils import has_user_setup_sso
 
-        assert _has_user_setup_sso() is False
+        assert has_user_setup_sso() is False
 
     def test_true_for_oauth_client_ids(self, monkeypatch):
-        from litellm.proxy.auth.auth_utils import _has_user_setup_sso
+        from litellm.proxy.auth.auth_utils import has_user_setup_sso
 
         monkeypatch.setenv("GOOGLE_CLIENT_ID", "google-client")
-        assert _has_user_setup_sso() is True
+        assert has_user_setup_sso() is True
 
     def test_true_for_saml_metadata_url(self, monkeypatch):
-        from litellm.proxy.auth.auth_utils import _has_user_setup_sso
+        from litellm.proxy.auth.auth_utils import has_user_setup_sso
 
         monkeypatch.setenv(
             "SAML_IDP_METADATA_URL", "https://idp.example.com/metadata.xml"
         )
-        assert _has_user_setup_sso() is True
+        assert has_user_setup_sso() is True
 
     def test_true_for_saml_metadata_xml(self, monkeypatch):
-        from litellm.proxy.auth.auth_utils import _has_user_setup_sso
+        from litellm.proxy.auth.auth_utils import has_user_setup_sso
 
         monkeypatch.setenv("SAML_IDP_METADATA_XML", "<EntityDescriptor/>")
-        assert _has_user_setup_sso() is True
+        assert has_user_setup_sso() is True
+
+
+class TestIsSsoProviderFullyConfigured:
+    """A lone client id must not read as ready: `has_user_setup_sso()` only
+    checks the client id (correct for a UI-discovery "show the login button"
+    decision), but a gate that BLOCKS the password fallback needs every
+    companion setting the provider requires, or an incomplete setup locks
+    every admin out with no working login path at all."""
+
+    @pytest.fixture(autouse=True)
+    def _clear_sso_env(self, monkeypatch):
+        for key in (
+            "GOOGLE_CLIENT_ID",
+            "GOOGLE_CLIENT_SECRET",
+            "MICROSOFT_CLIENT_ID",
+            "MICROSOFT_CLIENT_SECRET",
+            "MICROSOFT_TENANT",
+            "GENERIC_CLIENT_ID",
+            "GENERIC_CLIENT_SECRET",
+            "GENERIC_AUTHORIZATION_ENDPOINT",
+            "GENERIC_TOKEN_ENDPOINT",
+            "GENERIC_USERINFO_ENDPOINT",
+            "SAML_IDP_METADATA_URL",
+            "SAML_IDP_METADATA_XML",
+        ):
+            monkeypatch.delenv(key, raising=False)
+
+    def test_false_when_nothing_configured(self):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        assert is_sso_provider_fully_configured() is False
+
+    def test_google_client_id_alone_is_not_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("GOOGLE_CLIENT_ID", "google-client")
+        assert is_sso_provider_fully_configured() is False
+
+    def test_google_with_secret_is_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("GOOGLE_CLIENT_ID", "google-client")
+        monkeypatch.setenv("GOOGLE_CLIENT_SECRET", "google-secret")
+        assert is_sso_provider_fully_configured() is True
+
+    def test_microsoft_client_id_alone_is_not_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("MICROSOFT_CLIENT_ID", "ms-client")
+        assert is_sso_provider_fully_configured() is False
+
+    def test_microsoft_missing_tenant_is_not_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("MICROSOFT_CLIENT_ID", "ms-client")
+        monkeypatch.setenv("MICROSOFT_CLIENT_SECRET", "ms-secret")
+        assert is_sso_provider_fully_configured() is False
+
+    def test_microsoft_with_secret_and_tenant_is_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("MICROSOFT_CLIENT_ID", "ms-client")
+        monkeypatch.setenv("MICROSOFT_CLIENT_SECRET", "ms-secret")
+        monkeypatch.setenv("MICROSOFT_TENANT", "ms-tenant")
+        assert is_sso_provider_fully_configured() is True
+
+    def test_generic_client_id_alone_is_not_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("GENERIC_CLIENT_ID", "generic-client")
+        assert is_sso_provider_fully_configured() is False
+
+    def test_generic_missing_one_endpoint_is_not_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("GENERIC_CLIENT_ID", "generic-client")
+        monkeypatch.setenv("GENERIC_CLIENT_SECRET", "generic-secret")
+        monkeypatch.setenv("GENERIC_AUTHORIZATION_ENDPOINT", "https://idp.example.com/authorize")
+        monkeypatch.setenv("GENERIC_TOKEN_ENDPOINT", "https://idp.example.com/token")
+        # GENERIC_USERINFO_ENDPOINT deliberately left unset.
+        assert is_sso_provider_fully_configured() is False
+
+    def test_generic_with_every_endpoint_is_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("GENERIC_CLIENT_ID", "generic-client")
+        monkeypatch.setenv("GENERIC_CLIENT_SECRET", "generic-secret")
+        monkeypatch.setenv("GENERIC_AUTHORIZATION_ENDPOINT", "https://idp.example.com/authorize")
+        monkeypatch.setenv("GENERIC_TOKEN_ENDPOINT", "https://idp.example.com/token")
+        monkeypatch.setenv("GENERIC_USERINFO_ENDPOINT", "https://idp.example.com/userinfo")
+        assert is_sso_provider_fully_configured() is True
+
+    def test_saml_metadata_url_is_ready_when_runtime_installed(self, monkeypatch):
+        from litellm.proxy.auth import auth_utils
+
+        monkeypatch.setenv("SAML_IDP_METADATA_URL", "https://idp.example.com/metadata.xml")
+        monkeypatch.setattr(auth_utils.importlib.util, "find_spec", lambda name: object())
+        assert auth_utils.is_sso_provider_fully_configured() is True
+
+    def test_saml_metadata_url_is_not_ready_without_runtime(self, monkeypatch):
+        """Regression: python3-saml (``onelogin.saml2``) is an optional
+        dependency; SAMLAuthHandler fails closed on every request when it is
+        not installed, so IdP metadata alone must not read as ready."""
+        from litellm.proxy.auth import auth_utils
+
+        monkeypatch.setenv("SAML_IDP_METADATA_URL", "https://idp.example.com/metadata.xml")
+        monkeypatch.setattr(auth_utils.importlib.util, "find_spec", lambda name: None)
+        assert auth_utils.is_sso_provider_fully_configured() is False
+
+    def test_saml_check_does_not_raise_when_package_entirely_absent(self, monkeypatch):
+        """Regression: `importlib.util.find_spec("onelogin.saml2.auth")`
+        raises ModuleNotFoundError (not merely returns None) when the
+        TOP-LEVEL `onelogin` package is not installed at all, which is
+        exactly the real-world "optional extra not installed" case. If the
+        gate does not catch this, every password login 500s instead of
+        falling back, on a deployment that configured SAML metadata but
+        skipped the extra."""
+        from litellm.proxy.auth import auth_utils
+
+        def _raise(name: str):
+            raise ModuleNotFoundError("No module named 'onelogin'")
+
+        monkeypatch.setenv("SAML_IDP_METADATA_URL", "https://idp.example.com/metadata.xml")
+        monkeypatch.setattr(auth_utils.importlib.util, "find_spec", _raise)
+        assert auth_utils.is_sso_provider_fully_configured() is False
+
+    def test_incomplete_earlier_provider_does_not_mask_a_ready_later_one(self, monkeypatch):
+        """Regression: a stray GOOGLE_CLIENT_ID with no secret (e.g. a
+        leftover from a migration) must not stop the check from reaching a
+        fully configured Microsoft provider set alongside it — every
+        provider is evaluated independently, not in a first-match order."""
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("GOOGLE_CLIENT_ID", "google-client")
+        monkeypatch.setenv("MICROSOFT_CLIENT_ID", "ms-client")
+        monkeypatch.setenv("MICROSOFT_CLIENT_SECRET", "ms-secret")
+        monkeypatch.setenv("MICROSOFT_TENANT", "ms-tenant")
+        assert is_sso_provider_fully_configured() is True
 
 
 class TestIsRequestBodySafeBlocksAwsIdentitySelectors:

tests/test_litellm/proxy/auth/test_login_utils.py

@@ -6,6 +6,7 @@ to login_utils.py for better reusability.
 """
 
 import os
+from contextlib import ExitStack
 from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
@@ -598,3 +599,203 @@ class TestEncodeUiSessionJwt:
         request.cookies = {"token": token}
         with patch("litellm.proxy.proxy_server.master_key", "sk-master-for-tests"):
             assert _user_id_from_session_cookie(request) == "cornell-user"
+
+
+def _patch_sso_configured(stack: ExitStack, *, configured: bool) -> None:
+    stack.enter_context(
+        patch(  # test-quality-ok: no HTTP boundary here; same internal the pre-existing tests above already mock
+            "litellm.proxy.auth.login_utils.is_sso_provider_fully_configured", return_value=configured
+        )
+    )
+
+
+def _patch_successful_admin_login_deps(stack: ExitStack) -> None:
+    """The collaborators a real admin login exercises past the SSO gate:
+    generating the UI session key, syncing the admin role, and reading the
+    experimental-login flag. Shared so the two "still allowed" tests below
+    don't each repeat the same three-mock wiring."""
+    stack.enter_context(
+        patch(  # test-quality-ok: internal orchestration, no HTTP boundary; matches pre-existing tests
+            "litellm.proxy.auth.login_utils.generate_key_helper_fn",
+            new_callable=AsyncMock,
+            return_value={"token": "test-token", "user_id": LITELLM_PROXY_ADMIN_NAME},
+        )
+    )
+    stack.enter_context(
+        patch(  # test-quality-ok: internal orchestration, no HTTP boundary; matches pre-existing tests
+            "litellm.proxy.auth.login_utils.user_update",
+            new_callable=AsyncMock,
+            return_value=None,
+        )
+    )
+    stack.enter_context(
+        patch(  # test-quality-ok: internal orchestration, no HTTP boundary; matches pre-existing tests
+            "litellm.proxy.auth.login_utils.get_secret_bool",
+            return_value=False,
+        )
+    )
+
+
+class TestDisablePasswordLoginWhenSSOEnabled:
+    """`disable_password_login_when_sso_enabled` must reject every
+    username/password login attempt (including the UI_USERNAME/UI_PASSWORD
+    admin fallback) once SSO is configured, so SSO becomes the only way to
+    reach the Admin UI. It must not affect logins when SSO is unconfigured,
+    so admins can never lock themselves out with no SSO to fall back to."""
+
+    @pytest.mark.asyncio
+    async def test_rejects_correct_admin_credentials_when_sso_configured(self):
+        master_key = "sk-1234"
+        ui_username = "admin"
+
+        mock_prisma_client = MagicMock()
+        mock_prisma_client.db.litellm_usertable.find_first = AsyncMock(return_value=None)
+
+        with patch.dict(os.environ, {"UI_USERNAME": ui_username, "UI_PASSWORD": master_key}):
+            with ExitStack() as stack:
+                _patch_sso_configured(stack, configured=True)
+                with pytest.raises(ProxyException) as exc_info:
+                    await authenticate_user(
+                        username=ui_username,
+                        password=master_key,
+                        master_key=master_key,
+                        prisma_client=mock_prisma_client,
+                        general_settings={"disable_password_login_when_sso_enabled": True},
+                    )
+
+        assert exc_info.value.type == ProxyErrorTypes.auth_error
+        assert exc_info.value.code == "403"
+        # The credential comparison must never even run.
+        mock_prisma_client.db.litellm_usertable.find_first.assert_not_called()
+
+    @pytest.mark.asyncio
+    async def test_rejects_correct_db_user_credentials_when_sso_configured(self):
+        master_key = "sk-1234"
+        user_email = "test@example.com"
+        password = "correct-password"
+
+        mock_user = LiteLLM_UserTable(
+            user_id="test-user-123",
+            user_email=user_email,
+            password=hash_token(token=password),
+            user_role=LitellmUserRoles.INTERNAL_USER,
+        )
+        mock_prisma_client = MagicMock()
+        mock_prisma_client.db.litellm_usertable.find_first = AsyncMock(return_value=mock_user)
+
+        with patch.dict(os.environ, {"UI_USERNAME": "admin", "UI_PASSWORD": "unrelated"}):
+            with ExitStack() as stack:
+                _patch_sso_configured(stack, configured=True)
+                with pytest.raises(ProxyException) as exc_info:
+                    await authenticate_user(
+                        username=user_email,
+                        password=password,
+                        master_key=master_key,
+                        prisma_client=mock_prisma_client,
+                        general_settings={"disable_password_login_when_sso_enabled": True},
+                    )
+
+        assert exc_info.value.code == "403"
+        mock_prisma_client.db.litellm_usertable.find_first.assert_not_called()
+
+    @pytest.mark.asyncio
+    async def test_allows_password_login_when_setting_enabled_but_sso_not_configured(self):
+        """The setting alone must not lock out an admin who has not actually
+        configured SSO — there would be no fallback left."""
+        master_key = "sk-1234"
+        ui_username = "admin"
+
+        mock_prisma_client = MagicMock()
+        mock_prisma_client.db.litellm_usertable.find_first = AsyncMock(return_value=None)
+
+        with patch.dict(
+            os.environ,
+            {
+                "UI_USERNAME": ui_username,
+                "UI_PASSWORD": master_key,
+                "DATABASE_URL": "postgresql://test:test@localhost/test",
+            },
+            clear=True,
+        ):
+            with ExitStack() as stack:
+                _patch_sso_configured(stack, configured=False)
+                _patch_successful_admin_login_deps(stack)
+                result = await authenticate_user(
+                    username=ui_username,
+                    password=master_key,
+                    master_key=master_key,
+                    prisma_client=mock_prisma_client,
+                    general_settings={"disable_password_login_when_sso_enabled": True},
+                )
+
+        assert isinstance(result, LoginResult)
+        assert result.user_id == LITELLM_PROXY_ADMIN_NAME
+
+    @pytest.mark.asyncio
+    async def test_allows_password_login_when_sso_env_is_incomplete(self):
+        """Regression: a lone MICROSOFT_CLIENT_ID with no client secret or
+        tenant makes has_user_setup_sso() True, but a real SSO sign-in would
+        fail. The gate must read the real env (no is_sso_provider_fully_configured
+        mock here) and still let password login through, or an admin who set
+        one env var by mistake is locked out with no way in."""
+        master_key = "sk-1234"
+        ui_username = "admin"
+
+        mock_prisma_client = MagicMock()
+        mock_prisma_client.db.litellm_usertable.find_first = AsyncMock(return_value=None)
+
+        with patch.dict(
+            os.environ,
+            {
+                "UI_USERNAME": ui_username,
+                "UI_PASSWORD": master_key,
+                "DATABASE_URL": "postgresql://test:test@localhost/test",
+                "MICROSOFT_CLIENT_ID": "ms-client-id-only",
+            },
+            clear=True,
+        ):
+            with ExitStack() as stack:
+                _patch_successful_admin_login_deps(stack)
+                result = await authenticate_user(
+                    username=ui_username,
+                    password=master_key,
+                    master_key=master_key,
+                    prisma_client=mock_prisma_client,
+                    general_settings={"disable_password_login_when_sso_enabled": True},
+                )
+
+        assert isinstance(result, LoginResult)
+        assert result.user_id == LITELLM_PROXY_ADMIN_NAME
+
+    @pytest.mark.asyncio
+    async def test_allows_password_login_when_sso_configured_but_setting_not_enabled(self):
+        """SSO being configured must not, by itself, disable the password
+        fallback: the setting is opt-in."""
+        master_key = "sk-1234"
+        ui_username = "admin"
+
+        mock_prisma_client = MagicMock()
+        mock_prisma_client.db.litellm_usertable.find_first = AsyncMock(return_value=None)
+
+        with patch.dict(
+            os.environ,
+            {
+                "UI_USERNAME": ui_username,
+                "UI_PASSWORD": master_key,
+                "DATABASE_URL": "postgresql://test:test@localhost/test",
+            },
+            clear=True,
+        ):
+            with ExitStack() as stack:
+                _patch_sso_configured(stack, configured=True)
+                _patch_successful_admin_login_deps(stack)
+                result = await authenticate_user(
+                    username=ui_username,
+                    password=master_key,
+                    master_key=master_key,
+                    prisma_client=mock_prisma_client,
+                    general_settings={},
+                )
+
+        assert isinstance(result, LoginResult)
+        assert result.user_id == LITELLM_PROXY_ADMIN_NAME

tests/test_litellm/proxy/auth/test_onboarding.py

@@ -231,7 +231,7 @@ async def test_claim_token_rejects_already_used_link():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     with patch("litellm.proxy.proxy_server.prisma_client", prisma):
@@ -254,7 +254,7 @@ async def test_claim_token_rejects_expired_link():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     with patch("litellm.proxy.proxy_server.prisma_client", prisma):
@@ -275,7 +275,7 @@ async def test_claim_token_rejects_mismatched_user_id():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="wrong-user",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     with patch("litellm.proxy.proxy_server.prisma_client", prisma):
@@ -296,7 +296,7 @@ async def test_claim_token_rejects_missing_onboarding_token():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     with (
@@ -322,7 +322,7 @@ async def test_claim_token_rejects_wrong_onboarding_session():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
     request = _make_claim_request(
         _make_onboarding_token(invitation_link="other-invite")
@@ -351,7 +351,7 @@ async def test_claim_token_rejects_invalid_bearer_token():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
     request = _make_claim_request("sk-regular-key")
 
@@ -380,7 +380,7 @@ async def test_claim_token_rejects_concurrent_reuse_before_password_write():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     with (
@@ -418,7 +418,7 @@ async def test_claim_token_sets_accepted_at_after_password_written():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     mock_token_response = {"token": "sk-generated-key", "user_id": "user-123"}
@@ -477,7 +477,7 @@ async def test_claim_token_rolls_back_invite_when_session_key_mint_fails():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     with (

tests/test_litellm/proxy/auth/test_password_policy.py

@@ -0,0 +1,136 @@
+"""
+Tests for the configurable password-strength policy in
+`litellm.proxy.auth.password_policy`, enforced on every path that persists a
+new or changed password for a locally-managed user.
+"""
+
+import pytest
+
+from litellm.proxy._types import ProxyErrorTypes, ProxyException
+from litellm.proxy.auth.password_policy import (
+    DEFAULT_MIN_LENGTH,
+    MIN_ALLOWED_LENGTH,
+    PasswordPolicy,
+    get_password_policy,
+    validate_password_policy,
+)
+
+STRONG_PASSWORD = "Str0ng!Passw0rd"
+
+
+def test_get_password_policy_defaults_to_pif_baseline():
+    policy = get_password_policy({})
+    assert policy == PasswordPolicy(
+        min_length=DEFAULT_MIN_LENGTH,
+        require_uppercase=True,
+        require_lowercase=True,
+        require_numbers=True,
+        require_special_characters=True,
+    )
+
+
+def test_get_password_policy_reads_overrides_from_general_settings():
+    policy = get_password_policy(
+        {
+            "password_policy_min_length": 20,
+            "password_policy_require_uppercase": False,
+            "password_policy_require_lowercase": False,
+            "password_policy_require_numbers": False,
+            "password_policy_require_special_characters": False,
+        }
+    )
+    assert policy == PasswordPolicy(
+        min_length=20,
+        require_uppercase=False,
+        require_lowercase=False,
+        require_numbers=False,
+        require_special_characters=False,
+    )
+
+
+def test_validate_password_policy_accepts_strong_password():
+    assert validate_password_policy(STRONG_PASSWORD, {}) is None
+
+
+@pytest.mark.parametrize(
+    "password,expected_fragment",
+    [
+        ("Sh0rt!Pw", "12 characters"),
+        ("weakpassword123!", "uppercase"),
+        ("WEAKPASSWORD123!", "lowercase"),
+        ("WeakPassword!!!!", "number"),
+        ("WeakPassword12345", "special character"),
+    ],
+)
+def test_validate_password_policy_rejects_each_missing_class(password, expected_fragment):
+    with pytest.raises(ProxyException) as exc_info:
+        validate_password_policy(password, {})
+    assert exc_info.value.code == "400"
+    assert exc_info.value.type == ProxyErrorTypes.validation_error
+    assert exc_info.value.param == "password"
+    assert expected_fragment in exc_info.value.message
+
+
+def test_validate_password_policy_reports_every_violation_at_once():
+    with pytest.raises(ProxyException) as exc_info:
+        validate_password_policy("weak", {})
+    assert "12 characters" in exc_info.value.message
+    assert "uppercase" in exc_info.value.message
+    assert "number" in exc_info.value.message
+    assert "special character" in exc_info.value.message
+
+
+def test_validate_password_policy_honors_relaxed_config():
+    general_settings = {
+        "password_policy_min_length": MIN_ALLOWED_LENGTH,
+        "password_policy_require_special_characters": False,
+    }
+    # 8 chars, has upper/lower/number, no special char: fails default policy,
+    # passes the relaxed one above.
+    validate_password_policy("Abcd1234", general_settings)
+    with pytest.raises(ProxyException):
+        validate_password_policy("Abcd1234", {})
+
+
+def test_validate_password_policy_honors_stricter_min_length():
+    general_settings = {"password_policy_min_length": 20}
+    with pytest.raises(ProxyException) as exc_info:
+        validate_password_policy(STRONG_PASSWORD, general_settings)
+    assert "20 characters" in exc_info.value.message
+
+
+@pytest.mark.parametrize("configured_min_length", [0, -1, -100, 1, 7])
+def test_get_password_policy_floors_nonpositive_or_too_low_min_length(configured_min_length):
+    """A misconfigured min_length must never disable the length check
+    entirely: it floors at MIN_ALLOWED_LENGTH instead of passing through."""
+    policy = get_password_policy({"password_policy_min_length": configured_min_length})
+    assert policy.min_length == MIN_ALLOWED_LENGTH
+
+
+def test_validate_password_policy_rejects_short_password_even_with_zero_min_length_configured():
+    general_settings = {"password_policy_min_length": 0}
+    with pytest.raises(ProxyException) as exc_info:
+        validate_password_policy("a", general_settings)
+    assert f"{MIN_ALLOWED_LENGTH} characters" in exc_info.value.message
+
+
+def test_get_password_policy_ignores_boolean_min_length():
+    """`bool` is a subclass of `int` in Python; a stray `true`/`false` value
+    must not silently coerce into a min_length of 1 or 0."""
+    policy = get_password_policy({"password_policy_min_length": False})
+    assert policy.min_length == DEFAULT_MIN_LENGTH
+
+
+def test_validate_password_policy_rejects_unicode_letter_as_special_character():
+    """Regression: an ASCII-only `[^A-Za-z0-9]` check would miscount an
+    accented letter as the required special character, so a letters-and-
+    digits-only password like this one (no real symbol) must still be
+    rejected."""
+    with pytest.raises(ProxyException) as exc_info:
+        validate_password_policy("Passwörd1234", {})
+    assert "special character" in exc_info.value.message
+
+
+def test_validate_password_policy_accepts_real_special_character_with_unicode_letters():
+    """Same base password as the rejection test above, plus an actual symbol."""
+    assert validate_password_policy("Passwörd1234!", {}) is None

tests/test_litellm/proxy/discovery_endpoints/test_ui_discovery_endpoints.py

@@ -18,7 +18,7 @@ def test_ui_discovery_endpoints_with_defaults():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):
 
@@ -41,7 +41,7 @@ def test_ui_discovery_endpoints_with_custom_server_root_path():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/litellm"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):
 
@@ -66,7 +66,7 @@ def test_ui_discovery_endpoints_with_proxy_base_url_when_set():
             "litellm.proxy.utils.get_proxy_base_url",
             return_value="https://proxy.example.com",
         ),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):
 
@@ -91,7 +91,7 @@ def test_ui_discovery_endpoints_with_sso_configured_and_auto_redirect_enabled():
             "litellm.proxy.utils.get_proxy_base_url",
             return_value="https://proxy.example.com",
         ),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=True),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=True),
         patch.dict(
             os.environ,
             {"AUTO_REDIRECT_UI_LOGIN_TO_SSO": "true", "DISABLE_ADMIN_UI": "false"},
@@ -121,7 +121,7 @@ def test_ui_discovery_endpoints_with_sso_configured_and_auto_redirect_not_set_de
             "litellm.proxy.utils.get_proxy_base_url",
             return_value="https://proxy.example.com",
         ),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=True),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=True),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):
         # Ensure AUTO_REDIRECT_UI_LOGIN_TO_SSO is not set (simulate default)
@@ -148,7 +148,7 @@ def test_ui_discovery_endpoints_with_sso_configured_but_auto_redirect_disabled()
             "litellm.proxy.utils.get_proxy_base_url",
             return_value="https://proxy.example.com",
         ),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=True),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=True),
         patch.dict(
             os.environ,
             {"AUTO_REDIRECT_UI_LOGIN_TO_SSO": "false", "DISABLE_ADMIN_UI": "false"},
@@ -174,7 +174,7 @@ def test_ui_discovery_endpoints_with_sso_not_configured_but_auto_redirect_enable
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(
             os.environ,
             {"AUTO_REDIRECT_UI_LOGIN_TO_SSO": "true", "DISABLE_ADMIN_UI": "false"},
@@ -203,7 +203,7 @@ def test_ui_discovery_endpoints_both_routes_return_same_data():
             "litellm.proxy.utils.get_proxy_base_url",
             return_value="https://proxy.example.com",
         ),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=True),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=True),
         patch.dict(
             os.environ,
             {"AUTO_REDIRECT_UI_LOGIN_TO_SSO": "true", "DISABLE_ADMIN_UI": "false"},
@@ -228,7 +228,7 @@ def test_ui_discovery_endpoints_with_auto_redirect_via_general_settings():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=True),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=True),
         patch(
             "litellm.proxy.proxy_server.general_settings",
             {"auto_redirect_ui_login_to_sso": True},
@@ -254,7 +254,7 @@ def test_ui_discovery_endpoints_with_auto_redirect_env_var_overrides_general_set
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=True),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=True),
         patch(
             "litellm.proxy.proxy_server.general_settings",
             {"auto_redirect_ui_login_to_sso": False},
@@ -281,7 +281,7 @@ def test_ui_discovery_endpoints_with_admin_ui_disabled():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "true"}, clear=False),
     ):
 
@@ -311,7 +311,7 @@ def test_ui_discovery_endpoints_is_control_plane_true_when_workers_configured():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch("litellm.proxy.proxy_server.proxy_config", mock_config),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):
@@ -336,7 +336,7 @@ def test_ui_discovery_endpoints_hide_default_credentials_hint_default_false():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):
         os.environ.pop("LITELLM_HIDE_DEFAULT_CREDENTIALS_HINT", None)
@@ -357,7 +357,7 @@ def test_ui_discovery_endpoints_hide_default_credentials_hint_via_env_var():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(
             os.environ,
             {
@@ -384,7 +384,7 @@ def test_ui_discovery_endpoints_hide_default_credentials_hint_via_general_settin
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch(
             "litellm.proxy.proxy_server.general_settings",
             {"hide_default_credentials_hint": True},
@@ -411,7 +411,7 @@ def test_ui_discovery_endpoints_is_control_plane_false_when_no_workers():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch("litellm.proxy.proxy_server.proxy_config", mock_config),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):

tests/test_litellm/proxy/management_endpoints/test_internal_user_endpoints.py

@@ -4220,3 +4220,88 @@ async def test_user_new_persists_model_max_budget(
     )
 
     assert captured["user_data"].get("model_max_budget") == expected_written
+
+
+@pytest.fixture
+def _admin_prisma(mocker):
+    """A mocked prisma_client wired in as proxy_server's module globals, for
+    the password-policy tests below (mirrors the pattern every other test in
+    this file repeats per-test; consolidated here since these three share it
+    verbatim)."""
+    mock_prisma_client = mocker.MagicMock()
+    mocker.patch(  # test-quality-ok: same module-global mocking every test in this file already uses
+        "litellm.proxy.proxy_server.prisma_client", mock_prisma_client
+    )
+    mocker.patch(  # test-quality-ok: same module-global mocking every test in this file already uses
+        "litellm.proxy.proxy_server.litellm_proxy_admin_name", "admin"
+    )
+    return mock_prisma_client
+
+
+@pytest.mark.asyncio
+async def test_user_update_rejects_weak_password(_admin_prisma):
+    """/user/update must reject a password that fails the configured
+    policy before it ever reaches the DB write."""
+    from litellm.proxy._types import ProxyException
+    from litellm.proxy.management_endpoints.internal_user_endpoints import (
+        _update_single_user_helper,
+    )
+
+    user_request = UpdateUserRequest(user_id="target-user", password="short1!")
+    admin_caller = UserAPIKeyAuth(user_id="admin-1", user_role=LitellmUserRoles.PROXY_ADMIN)
+
+    with pytest.raises(ProxyException) as exc_info:
+        await _update_single_user_helper(user_request=user_request, user_api_key_dict=admin_caller)
+
+    assert exc_info.value.code == "400"
+    _admin_prisma.db.litellm_usertable.find_first.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_user_update_rejects_weak_password_against_configured_policy(_admin_prisma, mocker):
+    """A password that meets the default policy but not a stricter
+    admin-configured one must still be rejected."""
+    from litellm.proxy._types import ProxyException
+    from litellm.proxy.management_endpoints.internal_user_endpoints import (
+        _update_single_user_helper,
+    )
+
+    mocker.patch(  # test-quality-ok: same module-global mocking every test in this file already uses
+        "litellm.proxy.proxy_server.general_settings",
+        {"password_policy_min_length": 24},
+    )
+
+    user_request = UpdateUserRequest(user_id="target-user", password="Str0ng!Passw0rd")
+    admin_caller = UserAPIKeyAuth(user_id="admin-1", user_role=LitellmUserRoles.PROXY_ADMIN)
+
+    with pytest.raises(ProxyException) as exc_info:
+        await _update_single_user_helper(user_request=user_request, user_api_key_dict=admin_caller)
+
+    assert "24 characters" in exc_info.value.message
+
+
+@pytest.mark.asyncio
+async def test_user_update_hashes_and_persists_strong_password(_admin_prisma, mocker):
+    """A password meeting the policy is hashed (never stored in plaintext)
+    and reaches the DB write."""
+    from litellm.proxy.management_endpoints.internal_user_endpoints import (
+        _update_single_user_helper,
+    )
+
+    mock_prisma_client = _admin_prisma
+    existing_user = mocker.MagicMock()
+    existing_user.model_dump.return_value = {"user_id": "target-user"}
+    existing_user.user_id = "target-user"
+    mock_prisma_client.db.litellm_usertable.find_first = mocker.AsyncMock(return_value=existing_user)
+    mock_prisma_client.update_data = mocker.AsyncMock(return_value={"user_id": "target-user"})
+    mock_prisma_client.jsonify_object = mocker.MagicMock(side_effect=lambda x: x)
+
+    strong_password = "Str0ng!Passw0rd"
+    user_request = UpdateUserRequest(user_id="target-user", password=strong_password)
+    admin_caller = UserAPIKeyAuth(user_id="admin-1", user_role=LitellmUserRoles.PROXY_ADMIN)
+
+    await _update_single_user_helper(user_request=user_request, user_api_key_dict=admin_caller)
+
+    written_data = mock_prisma_client.update_data.call_args.kwargs["data"]
+    assert written_data.get("password") is not None
+    assert written_data["password"] != strong_password

tests/test_litellm/proxy/openai_files_endpoint/test_files_endpoint.py

@@ -4555,3 +4555,114 @@ def test_create_file_async_pre_call_hook_rejection_blocks_upload(monkeypatch, ll
     assert response.status_code == 400, response.text
     assert "file upload not allowed" in response.text
     assert provider_route.call_count == 0
+
+
+def test_create_file_non_batch_over_max_file_size_mb_rejected_before_forwarding(monkeypatch, llm_router: Router):
+    """max_file_size_mb applies to every purpose, unlike the batch-only max_batch_file_size_mb."""
+    import litellm.proxy.proxy_server as ps
+
+    forwarded_calls = _setup_batch_upload_endpoint(monkeypatch, llm_router)
+    monkeypatch.setitem(ps.general_settings, "max_file_size_mb", 1)
+
+    oversized = b"x" * (2 * 1024 * 1024)
+    try:
+        response = client.post(
+            "/v1/files",
+            files={"file": ("labels.jsonl", oversized, "application/octet-stream")},
+            data={"purpose": "user_data"},
+            headers={"Authorization": "Bearer test-key"},
+        )
+    finally:
+        _teardown_batch_upload_endpoint()
+
+    assert response.status_code == 413, response.text
+    error = response.json()["error"]
+    assert error["type"] == "invalid_request_error"
+    assert error["param"] == "file"
+    assert "max_file_size_mb" in error["message"]
+    assert "1 MB" in error["message"]
+    assert forwarded_calls == []
+
+
+def test_create_file_non_batch_under_max_file_size_mb_forwards(monkeypatch, llm_router: Router):
+    import litellm.proxy.proxy_server as ps
+
+    forwarded_calls = _setup_batch_upload_endpoint(monkeypatch, llm_router)
+    monkeypatch.setitem(ps.general_settings, "max_file_size_mb", 1)
+
+    try:
+        response = client.post(
+            "/v1/files",
+            files={"file": ("labels.jsonl", b"small content", "application/octet-stream")},
+            data={"purpose": "user_data"},
+            headers={"Authorization": "Bearer test-key"},
+        )
+    finally:
+        _teardown_batch_upload_endpoint()
+
+    assert response.status_code == 200, response.text
+    assert len(forwarded_calls) == 1
+
+
+def test_create_file_blocked_extension_rejected_before_forwarding(monkeypatch, llm_router: Router):
+    import litellm.proxy.proxy_server as ps
+
+    forwarded_calls = _setup_batch_upload_endpoint(monkeypatch, llm_router)
+    monkeypatch.setitem(ps.general_settings, "blocked_file_extensions", [".exe", ".sh"])
+
+    try:
+        response = client.post(
+            "/v1/files",
+            files={"file": ("payload.exe", b"MZ\x90\x00", "application/octet-stream")},
+            data={"purpose": "user_data"},
+            headers={"Authorization": "Bearer test-key"},
+        )
+    finally:
+        _teardown_batch_upload_endpoint()
+
+    assert response.status_code == 400, response.text
+    error = response.json()["error"]
+    assert error["type"] == "invalid_request_error"
+    assert error["param"] == "file"
+    assert ".exe" in error["message"]
+    assert "blocked_file_extensions" in error["message"]
+    assert forwarded_calls == []
+
+
+def test_create_file_blocked_extension_unset_allows_everything(monkeypatch, llm_router: Router):
+    forwarded_calls = _setup_batch_upload_endpoint(monkeypatch, llm_router)
+
+    try:
+        response = client.post(
+            "/v1/files",
+            files={"file": ("payload.exe", b"MZ\x90\x00", "application/octet-stream")},
+            data={"purpose": "user_data"},
+            headers={"Authorization": "Bearer test-key"},
+        )
+    finally:
+        _teardown_batch_upload_endpoint()
+
+    assert response.status_code == 200, response.text
+    assert len(forwarded_calls) == 1
+
+
+def test_create_file_path_traversal_filename_rejected_before_forwarding(monkeypatch, llm_router: Router):
+    """A filename carrying a directory-traversal component must never reach storage or the provider."""
+    forwarded_calls = _setup_batch_upload_endpoint(monkeypatch, llm_router)
+
+    try:
+        response = client.post(
+            "/v1/files",
+            files={"file": ("../../etc/passwd", b"malicious content", "text/plain")},
+            data={"purpose": "user_data"},
+            headers={"Authorization": "Bearer test-key"},
+        )
+    finally:
+        _teardown_batch_upload_endpoint()
+
+    assert response.status_code == 400, response.text
+    error = response.json()["error"]
+    assert error["type"] == "invalid_request_error"
+    assert error["param"] == "file"
+    assert "traversal" in error["message"].lower()
+    assert forwarded_calls == []

tests/test_litellm/proxy/openai_files_endpoint/test_general_upload_validation.py

@@ -0,0 +1,134 @@
+import io
+
+import pytest
+
+from litellm.proxy._types import ProxyException
+from litellm.proxy.openai_files_endpoints.general_upload_validation import (
+    MB,
+    UploadedFileBlockedExtension,
+    UploadedFileTooLarge,
+    UploadedFileUnsafeFilename,
+    check_blocked_extension,
+    check_unsafe_filename,
+    check_upload_file_size,
+    raise_upload_validation_failure,
+)
+
+
+def test_size_under_cap_allowed():
+    assert check_upload_file_size(b"x" * 100, 1) is None
+
+
+def test_size_over_cap_rejected_for_bytes():
+    content = b"x" * (2 * MB)
+    assert check_upload_file_size(content, 1) == UploadedFileTooLarge(size_bytes=len(content), limit_mb=1)
+
+
+def test_size_over_cap_rejected_for_binaryio_and_restores_caller_position():
+    """The handle is caller-owned; inspecting its size must not discard where the caller had it."""
+    content = b"x" * (2 * MB)
+    handle = io.BytesIO(content)
+    handle.seek(17)
+    assert check_upload_file_size(handle, 1) == UploadedFileTooLarge(size_bytes=len(content), limit_mb=1)
+    assert handle.tell() == 17
+
+
+def test_size_under_cap_allowed_for_binaryio_restores_caller_position():
+    handle = io.BytesIO(b"x" * 100)
+    handle.seek(42)
+    assert check_upload_file_size(handle, 1) is None
+    assert handle.tell() == 42
+
+
+def test_size_exactly_at_cap_allowed():
+    content = b"x" * MB
+    assert check_upload_file_size(content, 1) is None
+
+
+def test_no_cap_skips_size_check():
+    assert check_upload_file_size(b"x" * (10 * MB), None) is None
+
+
+@pytest.mark.parametrize("cap", [0, -3])
+def test_nonpositive_cap_disables_size_check(cap):
+    assert check_upload_file_size(b"x" * (10 * MB), cap) is None
+
+
+def test_blocked_extension_rejected():
+    assert check_blocked_extension("payload.exe", (".exe", ".sh")) == UploadedFileBlockedExtension(extension=".exe")
+
+
+def test_blocked_extension_match_is_case_insensitive():
+    assert check_blocked_extension("payload.EXE", (".exe",)) == UploadedFileBlockedExtension(extension=".exe")
+
+
+def test_blocked_extension_match_is_case_insensitive_for_configured_value():
+    """A config entry like blocked_file_extensions: ['.EXE'] must still catch a lowercase upload."""
+    assert check_blocked_extension("payload.exe", (".EXE",)) == UploadedFileBlockedExtension(extension=".exe")
+
+
+def test_extension_not_in_blocklist_allowed():
+    assert check_blocked_extension("report.pdf", (".exe", ".sh")) is None
+
+
+def test_empty_blocklist_allows_everything():
+    assert check_blocked_extension("payload.exe", ()) is None
+
+
+def test_no_filename_skips_extension_check():
+    assert check_blocked_extension(None, (".exe",)) is None
+
+
+def test_path_traversal_filename_rejected():
+    assert check_unsafe_filename("../../etc/passwd") == UploadedFileUnsafeFilename(filename="../../etc/passwd")
+
+
+def test_windows_style_path_traversal_filename_rejected():
+    assert check_unsafe_filename("..\\..\\windows\\system32\\config") == UploadedFileUnsafeFilename(
+        filename="..\\..\\windows\\system32\\config"
+    )
+
+
+def test_traversal_embedded_after_extension_rejected():
+    assert check_unsafe_filename("report.jsonl/../../etc/cron.d/evil") == UploadedFileUnsafeFilename(
+        filename="report.jsonl/../../etc/cron.d/evil"
+    )
+
+
+def test_null_byte_filename_rejected():
+    assert check_unsafe_filename("report.pdf\x00.exe") == UploadedFileUnsafeFilename(filename="report.pdf\x00.exe")
+
+
+@pytest.mark.parametrize("filename", ["report.pdf", ".env", "a.b.c.jsonl", "my file (1).csv", None])
+def test_ordinary_filenames_allowed(filename):
+    assert check_unsafe_filename(filename) is None
+
+
+@pytest.mark.parametrize(
+    "failure, expected_code, expected_fragments",
+    [
+        (
+            UploadedFileTooLarge(size_bytes=15728640, limit_mb=10),
+            "413",
+            ("15.0 MB", "max_file_size_mb", "10 MB", "not forwarded"),
+        ),
+        (
+            UploadedFileBlockedExtension(extension=".exe"),
+            "400",
+            (".exe", "blocked_file_extensions", "not forwarded"),
+        ),
+        (
+            UploadedFileUnsafeFilename(filename="../../etc/passwd"),
+            "400",
+            ("../../etc/passwd", "traversal", "not forwarded"),
+        ),
+    ],
+)
+def test_failures_map_to_openai_shaped_proxy_exceptions(failure, expected_code, expected_fragments):
+    with pytest.raises(ProxyException) as exc_info:
+        raise_upload_validation_failure(failure)
+    assert exc_info.value.code == expected_code
+    assert exc_info.value.type == "invalid_request_error"
+    assert exc_info.value.param == "file"
+    for fragment in expected_fragments:
+        assert fragment in exc_info.value.message

tests/test_litellm/proxy/proxy_server/test_routes_login_sso.py

@@ -29,7 +29,7 @@ def _install_login_mocks(monkeypatch, raise_on_auth: bool = False) -> None:
     """
     from litellm.proxy import proxy_server as ps
 
-    async def _fake_auth(username, password, master_key, prisma_client):
+    async def _fake_auth(username, password, master_key, prisma_client, general_settings=None):
         if raise_on_auth:
             raise Exception("boom-auth-failure")
         fake = MagicMock()

tests/test_litellm/proxy/proxy_server/test_routes_onboarding.py

@@ -234,7 +234,7 @@ def test_claim_onboarding_link_happy(client, monkeypatch, mock_prisma):
         json={
             "invitation_link": "inv-123",
             "user_id": "user-abc",
-            "password": "hunter2",
+            "password": "Hunter2Strong!",
         },
         headers={"Authorization": f"Bearer {onboarding_jwt}"},
     )
@@ -260,7 +260,7 @@ def test_claim_onboarding_link_invalid_invite_401(client, monkeypatch, mock_pris
         json={
             "invitation_link": "missing",
             "user_id": "user-abc",
-            "password": "hunter2",
+            "password": "Hunter2Strong!",
         },
         headers={"Authorization": "Bearer irrelevant"},
     )
@@ -287,7 +287,7 @@ def test_claim_onboarding_link_user_id_mismatch_401(
         json={
             "invitation_link": "inv-123",
             "user_id": "user-attacker",
-            "password": "hunter2",
+            "password": "Hunter2Strong!",
         },
         headers={"Authorization": "Bearer irrelevant"},
     )
@@ -339,7 +339,7 @@ def test_claim_onboarding_link_bad_onboarding_jwt_401(
         json={
             "invitation_link": "inv-123",
             "user_id": "user-abc",
-            "password": "hunter2",
+            "password": "Hunter2Strong!",
         },
         headers={"Authorization": f"Bearer {bogus_jwt}"},
     )

tests/test_litellm/proxy/test_proxy_server.py

@@ -131,6 +131,7 @@ def test_login_v2_returns_redirect_url_and_sets_cookie(monkeypatch):
         password="secret",
         master_key="test-master-key",
         prisma_client=mock_prisma_client,
+        general_settings={},
     )
     mock_create_ui_token_object.assert_called_once_with(
         login_result=mock_login_result,

tests/test_litellm/proxy/ui_crud_endpoints/test_proxy_setting_endpoints.py

@@ -3006,6 +3006,56 @@ def test_update_mcp_semantic_filter_settings_requires_proxy_admin(monkeypatch):
         app.dependency_overrides.pop(user_api_key_auth, None)
 
 
+def test_upload_logo_requires_proxy_admin(monkeypatch):
+    """Any authenticated key could previously write a file to the server's disk here."""
+    from litellm.proxy._types import UserAPIKeyAuth
+    from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
+
+    async def _internal_user_auth():
+        return UserAPIKeyAuth(
+            user_id="internal-user-1",
+            api_key="hashed-internal-key",
+            user_role=LitellmUserRoles.INTERNAL_USER,
+        )
+
+    app.dependency_overrides[user_api_key_auth] = _internal_user_auth
+    try:
+        resp = client.post(
+            "/upload/logo",
+            files={"file": ("logo.png", b"\x89PNG\r\n\x1a\n" + b"x" * 32, "image/png")},
+        )
+        assert resp.status_code == 403
+        assert "proxy admin" in resp.json()["detail"].lower()
+    finally:
+        app.dependency_overrides.pop(user_api_key_auth, None)
+
+
+def test_upload_logo_allows_proxy_admin(monkeypatch, tmp_path):
+    from litellm.proxy._types import UserAPIKeyAuth
+    from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
+
+    async def _admin_auth():
+        return UserAPIKeyAuth(
+            user_id="admin-1",
+            api_key="hashed-admin-key",
+            user_role=LitellmUserRoles.PROXY_ADMIN,
+        )
+
+    app.dependency_overrides[user_api_key_auth] = _admin_auth
+    try:
+        resp = client.post(
+            "/upload/logo",
+            files={"file": ("logo.png", b"\x89PNG\r\n\x1a\n" + b"x" * 32, "image/png")},
+        )
+        assert resp.status_code == 200, resp.text
+        assert resp.json()["status"] == "success"
+    finally:
+        app.dependency_overrides.pop(user_api_key_auth, None)
+        uploaded_path = resp.json().get("file_path")
+        if uploaded_path and os.path.exists(uploaded_path):
+            os.remove(uploaded_path)
+
+
 class TestPtuCostAttributionUISetting:
     """``enable_ptu_cost_attribution`` is derived from the environment on every GET.
 

tests/test_litellm/test_router.py

@@ -6,6 +6,7 @@ import logging
 import os
 import threading
 from types import SimpleNamespace
+from typing import Final
 from unittest.mock import AsyncMock, MagicMock, patch
 
 import httpx
@@ -1537,6 +1538,91 @@ async def test_ageneric_api_call_deployment_model_overrides_alias():
     ), f"Expected deployment model 'vertex_ai/gemini-2.5-flash', got '{captured['model']}'"
 
 
+@pytest.mark.asyncio
+async def test_ageneric_api_call_resolves_realtime_session_model():
+    """
+    Regression for #36742: realtime client secret requests carry the model inside `session` too, and the proxy
+    fills it with the pre-routing model group name. The underlying litellm function reads session.model first,
+    so it must see the resolved deployment, while a caller's nested transcription model stays untouched.
+    """
+    routed: Final = AsyncMock(return_value={"result": "ok"})
+
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "my-realtime-group",
+                "litellm_params": {
+                    "model": "openai/gpt-realtime-2.1-mini",
+                    "api_key": "fake-key",
+                },
+                "model_info": {"mode": "realtime"},
+            }
+        ]
+    )
+
+    await router._ageneric_api_call_with_fallbacks(
+        model="my-realtime-group",
+        original_function=routed,
+        session={
+            "type": "realtime",
+            "model": "my-realtime-group",
+            "audio": {"input": {"transcription": {"model": "gpt-4o-transcribe"}}},
+        },
+    )
+
+    sent: Final = routed.call_args.kwargs
+    assert sent["model"] == "openai/gpt-realtime-2.1-mini"
+    assert sent["session"]["model"] == "openai/gpt-realtime-2.1-mini"
+    assert sent["session"]["audio"]["input"]["transcription"]["model"] == "gpt-4o-transcribe"
+
+
+@pytest.mark.asyncio
+async def test_ageneric_api_call_does_not_add_session_model():
+    """
+    A session that never carried a model must not gain one from routing: the underlying function then falls back
+    to the resolved `model` kwarg itself, and the outgoing session body keeps the caller's shape.
+    """
+    routed: Final = AsyncMock(return_value={"result": "ok"})
+
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "my-realtime-group",
+                "litellm_params": {
+                    "model": "openai/gpt-realtime-2.1-mini",
+                    "api_key": "fake-key",
+                },
+                "model_info": {"mode": "realtime"},
+            }
+        ]
+    )
+
+    await router._ageneric_api_call_with_fallbacks(
+        model="my-realtime-group",
+        original_function=routed,
+        session={"type": "realtime"},
+    )
+
+    sent: Final = routed.call_args.kwargs
+    assert sent["model"] == "openai/gpt-realtime-2.1-mini"
+    assert sent["session"] == {"type": "realtime"}
+
+
+@pytest.mark.parametrize(
+    "session, expected",
+    [
+        ({"type": "realtime", "model": "my-realtime-group"}, {"session": {"type": "realtime", "model": "resolved"}}),
+        ({"type": "realtime"}, {}),
+        (None, {}),
+        ("not-a-session", {}),
+    ],
+)
+def test_with_router_resolved_session_model(session, expected):
+    from litellm.router import _with_router_resolved_session_model
+
+    assert dict(_with_router_resolved_session_model(session, "resolved")) == expected
+
+
 def test_router_get_model_access_groups_team_only_models():
     """
     Test that Router.get_model_access_groups returns the correct response for team-only models

ui/litellm-dashboard/src/autorouter_presets.json

@@ -68,13 +68,16 @@
   },
   "openai_family": {
     "label": "OpenAI Family",
-    "description": "Routes across the GPT model family: gpt-5.4-nano for simple queries, gpt-5.4-mini for medium, gpt-5.4 for complex, o3 for reasoning-heavy requests.",
+    "description": "Routes across the GPT model family: Luna for simple queries, Terra for medium, Sol for complex, Sol at xhigh thinking for reasoning.",
     "complexity_router_config": {
       "tiers": {
-        "SIMPLE": ["gpt-5.4-nano"],
-        "MEDIUM": ["gpt-5.4-mini"],
-        "COMPLEX": ["gpt-5.4"],
-        "REASONING": ["o3"]
+        "SIMPLE": ["gpt-5.6-luna"],
+        "MEDIUM": ["gpt-5.6-terra"],
+        "COMPLEX": ["gpt-5.6-sol"],
+        "REASONING": ["gpt-5.6-sol"]
+      },
+      "tier_model_configs": {
+        "REASONING": [{ "model_name": "gpt-5.6-sol", "litellm_params": { "reasoning_effort": "xhigh" } }]
       },
       "classifier_type": "heuristic",
       "escalation_keywords": ["LITELLM ESCALATE"],

ui/litellm-dashboard/src/lib/autorouter_presets.test.ts

@@ -158,6 +158,24 @@ describe("autorouter_presets", () => {
     });
   });
 
+  it("pins the OpenAI preset to the Luna, Terra, and Sol progression", () => {
+    const preset = getPresetByKey("openai_family")!;
+    const expectedTiers = {
+      SIMPLE: ["gpt-5.6-luna"],
+      MEDIUM: ["gpt-5.6-terra"],
+      COMPLEX: ["gpt-5.6-sol"],
+      REASONING: ["gpt-5.6-sol"],
+    };
+    expect(preset.complexity_router_config.tiers).toEqual(expectedTiers);
+    expect(preset.complexity_router_config.tier_model_configs).toEqual({
+      REASONING: [{ model_name: "gpt-5.6-sol", litellm_params: { reasoning_effort: "xhigh" } }],
+    });
+    const prefill = buildPresetPrefill(preset.complexity_router_config, groupsOnly(getRequiredModelsInPreset(preset)));
+    expect(prefill.complexityRouterConfig.tier_model_params).toEqual({
+      REASONING: { "gpt-5.6-sol": { reasoning_effort: "xhigh" } },
+    });
+  });
+
   it("pins the gemini preset to concrete model ids, never Google's hot-swapping -latest aliases", () => {
     const gemini = getPresetByKey("gemini_family")!;
     const config = gemini.complexity_router_config;

ui/litellm-dashboard/src/lib/http/schema.d.ts

@@ -25438,6 +25438,11 @@ export interface components {
              * @description run health checks in background
              */
             background_health_checks?: boolean | null;
+            /**
+             * Blocked File Extensions
+             * @description file extensions (e.g. ['.exe', '.sh']) rejected on /v1/files uploads, for any purpose, matched case-insensitively against the uploaded filename
+             */
+            blocked_file_extensions?: string[] | null;
             /**
              * Cancel On Disconnect
              * @description cancel the in-flight upstream LLM request (non-streaming) when the client disconnects, freeing backend capacity (e.g. a vLLM GPU slot); the request is logged as a 499 failure
@@ -25522,6 +25527,11 @@ export interface components {
              * @description If True, disables the optimistic per-request budget reservation introduced in v1.84.0. WARNING: This weakens hard budget enforcement. Without the reservation, a burst of concurrent requests from a single key can each pass the read-time spend check before any of them is charged, allowing a configured budget to be exceeded under high concurrency. Budgets are still evaluated on every request at read time, so an already-exhausted budget is still rejected. Enable only if your deployment is experiencing phantom BudgetExceededError responses caused by leaked reservations (see GitHub issue #27639). A proxy-level WARNING is logged on every request while this flag is active as a reminder that hard enforcement is relaxed.
              */
             disable_budget_reservation?: boolean | null;
+            /**
+             * Disable Password Login When Sso Enabled
+             * @description If True and SSO is configured (MICROSOFT_CLIENT_ID, GOOGLE_CLIENT_ID, GENERIC_CLIENT_ID, or SAML_IDP_METADATA_URL/XML), disables username/password login on /login, /v2/login, and /v3/login so SSO is the only way to reach the Admin UI. An admin locked out of the UI can still administer the proxy over the API with the master key; unset this setting and restart the proxy to restore UI username/password login. Default is False.
+             */
+            disable_password_login_when_sso_enabled?: boolean | null;
             /**
              * Enable Public Model Hub
              * @description Public model hub for users to see what models they have access to, supported openai params, etc.
@@ -25577,6 +25587,11 @@ export interface components {
              * @description max batch input file size in MB for /v1/files uploads with purpose=batch, if a file is larger than this size it will be rejected before being forwarded to the provider
              */
             max_batch_file_size_mb?: number | null;
+            /**
+             * Max File Size Mb
+             * @description max file size in MB for /v1/files uploads, for any purpose, if a file is larger than this size it will be rejected before being forwarded to the provider
+             */
+            max_file_size_mb?: number | null;
             /**
              * Max Parallel Requests
              * @description maximum parallel requests for each api key
@@ -25667,6 +25682,31 @@ export interface components {
              * @description Default upstream request timeout in seconds for native and custom pass-through endpoints that use pass_through_request. Defaults to 600 when unset.
              */
             pass_through_request_timeout?: number | null;
+            /**
+             * Password Policy Min Length
+             * @description Minimum length required for a locally-managed user's password. Default is 12; a value below 8 is floored to 8 rather than weakening the requirement further.
+             */
+            password_policy_min_length?: number | null;
+            /**
+             * Password Policy Require Lowercase
+             * @description If True (default), a locally-managed user's password must contain a lowercase letter.
+             */
+            password_policy_require_lowercase?: boolean | null;
+            /**
+             * Password Policy Require Numbers
+             * @description If True (default), a locally-managed user's password must contain a number.
+             */
+            password_policy_require_numbers?: boolean | null;
+            /**
+             * Password Policy Require Special Characters
+             * @description If True (default), a locally-managed user's password must contain a special (non-alphanumeric) character.
+             */
+            password_policy_require_special_characters?: boolean | null;
+            /**
+             * Password Policy Require Uppercase
+             * @description If True (default), a locally-managed user's password must contain an uppercase letter.
+             */
+            password_policy_require_uppercase?: boolean | null;
             /**
              * Plugins
              * @description external services registered as embeddable UI plugins