diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 1a29c0b6691..51d489459d9 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,2 +1,3 @@ /ui/ @yuneng-jiang @ryan-crabbe-berri /litellm/proxy/_experimental/out/ @yuneng-jiang @ryan-crabbe-berri +/ui/litellm-dashboard/src/lib/http/schema.d.ts diff --git a/enterprise/litellm_enterprise/enterprise_callbacks/llm_guard.py b/enterprise/litellm_enterprise/enterprise_callbacks/llm_guard.py index ad8aabf77b6..d10b5a2ab09 100644 --- a/enterprise/litellm_enterprise/enterprise_callbacks/llm_guard.py +++ b/enterprise/litellm_enterprise/enterprise_callbacks/llm_guard.py @@ -7,7 +7,8 @@ # Thank you users! We ❤️ you! - Krrish & Ishaan ## This provides an LLM Guard Integration for content moderation on the proxy -from typing import Literal, Optional +import asyncio +from typing import Optional import aiohttp from fastapi import HTTPException @@ -18,7 +19,6 @@ from litellm.integrations.custom_logger import CustomLogger from litellm.proxy._types import UserAPIKeyAuth from litellm.secret_managers.main import get_secret_str from litellm.types.utils import CallTypesLiteral -from litellm.utils import get_formatted_prompt class _ENTERPRISE_LLMGuard(CustomLogger): @@ -46,45 +46,44 @@ class _ENTERPRISE_LLMGuard(CustomLogger): except Exception: pass - async def moderation_check(self, text: str): + async def moderation_check(self, text: str) -> str: """ + Runs the LLM Guard moderation check on ``text``. + + Raises an HTTPException when the content violates the safety policy; + otherwise returns the sanitized prompt from LLM Guard, falling back to + the original text when the API does not provide one. + [TODO] make this more performant for high-throughput scenario """ try: - async with aiohttp.ClientSession() as session: - if self.mock_redacted_text is not None: - redacted_text = self.mock_redacted_text - else: - # Make the first request to /analyze - analyze_url = f"{self.llm_guard_api_base}analyze/prompt" - verbose_proxy_logger.debug("Making request to: %s", analyze_url) - analyze_payload = {"prompt": text} - redacted_text = None + if self.mock_redacted_text is not None: + redacted_text = self.mock_redacted_text + else: + analyze_url = f"{self.llm_guard_api_base}analyze/prompt" + verbose_proxy_logger.debug("Making request to: %s", analyze_url) + async with aiohttp.ClientSession() as session: async with session.post( - analyze_url, json=analyze_payload + analyze_url, json={"prompt": text} ) as response: redacted_text = await response.json() - verbose_proxy_logger.debug( - f"LLM Guard: Received response - {redacted_text}" + verbose_proxy_logger.debug( + f"LLM Guard: Received response - {redacted_text}" + ) + if redacted_text is None: + raise HTTPException( + status_code=500, + detail={ + "error": f"Invalid content moderation response: {redacted_text}" + }, ) - if redacted_text is not None: - if ( - redacted_text.get("is_valid", None) is not None - and redacted_text["is_valid"] is False - ): - raise HTTPException( - status_code=400, - detail={"error": "Violated content safety policy"}, - ) - else: - pass - else: - raise HTTPException( - status_code=500, - detail={ - "error": f"Invalid content moderation response: {redacted_text}" - }, - ) + if redacted_text.get("is_valid", None) is False: + raise HTTPException( + status_code=400, + detail={"error": "Violated content safety policy"}, + ) + sanitized_prompt = redacted_text.get("sanitized_prompt") + return sanitized_prompt if isinstance(sanitized_prompt, str) else text except Exception as e: verbose_proxy_logger.exception( "litellm.enterprise.enterprise_hooks.llm_guard::moderation_check - Exception occurred - {}".format( @@ -138,23 +137,75 @@ class _ENTERPRISE_LLMGuard(CustomLogger): return self.print_verbose("Makes LLM Guard Check") - try: - assert call_type in [ - "completion", - "embeddings", - "image_generation", - "moderation", - "audio_transcription", - ] - except Exception: + if call_type not in [ + "completion", + "embeddings", + "image_generation", + "moderation", + "audio_transcription", + ]: self.print_verbose( f"Call Type - {call_type}, not in accepted list - ['completion','embeddings','image_generation','moderation','audio_transcription']" ) return data - formatted_prompt = get_formatted_prompt(data=data, call_type=call_type) # type: ignore - self.print_verbose(f"LLM Guard, formatted_prompt: {formatted_prompt}") - return await self.moderation_check(text=formatted_prompt) + return await self._moderate_request(data=data) + + async def _moderate_request(self, data: dict) -> dict: + """ + Sanitizes the request in place using the prompt returned by LLM Guard so + the provider-bound request carries the redacted content, then returns it. + """ + messages = data.get("messages") + if messages is not None: + data["messages"] = list( + await asyncio.gather( + *(self._moderate_message(message) for message in messages) + ) + ) + return data + + input_ = data.get("input") + if input_ is not None: + data["input"] = await self._moderate_input(input_) + return data + + prompt = data.get("prompt") + if isinstance(prompt, str): + data["prompt"] = await self.moderation_check(text=prompt) + return data + + async def _moderate_message(self, message: dict) -> dict: + content = message.get("content") + if isinstance(content, str): + return {**message, "content": await self.moderation_check(text=content)} + if isinstance(content, list): + return { + **message, + "content": list( + await asyncio.gather( + *(self._moderate_content_part(part) for part in content) + ) + ), + } + return message + + async def _moderate_content_part(self, part: dict) -> dict: + if part.get("type") == "text" and isinstance(part.get("text"), str): + return {**part, "text": await self.moderation_check(text=part["text"])} + return part + + async def _moderate_input(self, input_: object) -> object: + if isinstance(input_, str): + return await self.moderation_check(text=input_) + if isinstance(input_, list): + return [ + await self.moderation_check(text=item) + if isinstance(item, str) + else item + for item in input_ + ] + return input_ async def async_post_call_streaming_hook( self, user_api_key_dict: UserAPIKeyAuth, response: str diff --git a/helm/litellm-helm/README.md b/helm/litellm-helm/README.md index 74e70f4aeb4..0edc4d2504b 100644 --- a/helm/litellm-helm/README.md +++ b/helm/litellm-helm/README.md @@ -54,6 +54,12 @@ If `db.useStackgresOperator` is used (not yet implemented): | `pdb.annotations` | Extra metadata annotations to add to the PDB | `{}` | | `pdb.labels` | Extra metadata labels to add to the PDB | `{}` | +| `billingMetrics.enabled` | Enable enterprise billable-request metering. Requires an enterprise license. | `false` | +| `billingMetrics.endpoint` | Collector that the billable-request counter is pushed to. | `https://telemetry.litellm.ai` | +| `billingMetrics.secretName` | Name of an existing Secret holding the mTLS client certificate, under the keys `tls.crt` and `tls.key`. | `litellm-billing-metrics-mtls` | +| `billingMetrics.caSecretName` | Name of an existing Secret holding a CA bundle under the key `ca.crt`. Only needed for a private or test collector whose server certificate is not on the public web PKI. | `""` | +| `billingMetrics.exportIntervalMs` | How often the counter is pushed, in milliseconds. The proxy defaults to `60000` when unset. | `""` | + #### Example `proxy_config` ConfigMap from values (default): ``` @@ -94,6 +100,21 @@ data: type: Opaque ``` +#### Enterprise billable-request metering + +Enterprise licenses meter billable requests by pushing a counter to LiteLLM's collector over mutual TLS. The chart does not create the client certificate; it mounts one you already hold, read-only, so the private key is never exposed through the environment. Create the Secret under the name the chart expects, then turn the block on: + +``` +kubectl create secret tls litellm-billing-metrics-mtls --cert=client.crt --key=client.key +``` + +``` +billingMetrics: + enabled: true +``` + +Set `billingMetrics.caSecretName` only when the collector is a private or test one whose server certificate is not on the public web PKI; the production collector needs no CA override. The chart fails the render rather than deploying a proxy that silently never exports, so a missing `secretName` or an emptied `endpoint` surfaces at `helm install` time. + ### Database Settings | Name | Description | Value | diff --git a/helm/litellm-helm/templates/_helpers.tpl b/helm/litellm-helm/templates/_helpers.tpl index 469d52c03a7..387bc3d5dc4 100644 --- a/helm/litellm-helm/templates/_helpers.tpl +++ b/helm/litellm-helm/templates/_helpers.tpl @@ -50,6 +50,53 @@ app.kubernetes.io/name: {{ include "litellm.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} +{{/* +Enterprise billable-request metering. The client certificate identifies the +deployment to LiteLLM's collector, so it is mounted read-only from an existing +Secret rather than passed through the environment. +*/}} +{{- define "litellm.billingMetrics.certDir" -}}/etc/litellm/billing-mtls{{- end -}} +{{- define "litellm.billingMetrics.caDir" -}}/etc/litellm/billing-mtls-ca{{- end -}} + +{{- define "litellm.billingMetricsEnv" -}} +- name: LITELLM_BILLING_METRICS_ENDPOINT + value: {{ required "billingMetrics.endpoint is required when billingMetrics.enabled is true" .Values.billingMetrics.endpoint | quote }} +- name: LITELLM_BILLING_METRICS_CLIENT_CERT + value: {{ printf "%s/tls.crt" (include "litellm.billingMetrics.certDir" .) | quote }} +- name: LITELLM_BILLING_METRICS_CLIENT_KEY + value: {{ printf "%s/tls.key" (include "litellm.billingMetrics.certDir" .) | quote }} +{{- if .Values.billingMetrics.caSecretName }} +- name: LITELLM_BILLING_METRICS_CA_CERT + value: {{ printf "%s/ca.crt" (include "litellm.billingMetrics.caDir" .) | quote }} +{{- end }} +{{- with .Values.billingMetrics.exportIntervalMs }} +- name: LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MS + value: {{ . | quote }} +{{- end }} +{{- end -}} + +{{- define "litellm.billingMetricsVolumes" -}} +- name: billing-metrics-mtls + secret: + secretName: {{ required "billingMetrics.secretName is required when billingMetrics.enabled is true (an existing Secret with tls.crt and tls.key)" .Values.billingMetrics.secretName }} +{{- if .Values.billingMetrics.caSecretName }} +- name: billing-metrics-mtls-ca + secret: + secretName: {{ .Values.billingMetrics.caSecretName }} +{{- end }} +{{- end -}} + +{{- define "litellm.billingMetricsVolumeMounts" -}} +- name: billing-metrics-mtls + mountPath: {{ include "litellm.billingMetrics.certDir" . }} + readOnly: true +{{- if .Values.billingMetrics.caSecretName }} +- name: billing-metrics-mtls-ca + mountPath: {{ include "litellm.billingMetrics.caDir" . }} + readOnly: true +{{- end }} +{{- end -}} + {{/* Create the name of the service account to use */}} diff --git a/helm/litellm-helm/templates/deployment.yaml b/helm/litellm-helm/templates/deployment.yaml index b9cd1be06ec..32bfa4b2647 100644 --- a/helm/litellm-helm/templates/deployment.yaml +++ b/helm/litellm-helm/templates/deployment.yaml @@ -142,6 +142,9 @@ spec: {{- with .Values.extraEnvVars }} {{- toYaml . | nindent 12 }} {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsEnv" . | nindent 12 }} + {{- end }} {{- if .Values.migrationJob.enabled }} # Schema updates are owned by the dedicated migrations Job; skip # the proxy's startup `prisma db push` so N replicas don't race @@ -220,6 +223,9 @@ spec: - name: npm mountPath: /.npm {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsVolumeMounts" . | nindent 12 }} + {{- end }} {{- with .Values.volumeMounts }} {{- toYaml . | nindent 12 }} {{- end }} @@ -252,6 +258,9 @@ spec: items: - key: {{ .Values.proxyConfigMap.key | default "config.yaml" }} path: "config.yaml" + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsVolumes" . | nindent 8 }} + {{- end }} {{- with .Values.volumes }} {{- toYaml . | nindent 8 }} {{- end }} diff --git a/helm/litellm-helm/tests/billing_metrics_tests.yaml b/helm/litellm-helm/tests/billing_metrics_tests.yaml new file mode 100644 index 00000000000..71803df378c --- /dev/null +++ b/helm/litellm-helm/tests/billing_metrics_tests.yaml @@ -0,0 +1,297 @@ +suite: test billingMetrics wiring on the proxy deployment +templates: + - deployment.yaml + - configmap-litellm.yaml + - migrations-job.yaml +tests: + - it: is off by default, adding no env, volume, or mount + template: deployment.yaml + asserts: + - notContains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: litellm-billing-metrics-mtls + - notContains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls + mountPath: /etc/litellm/billing-mtls + readOnly: true + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + + - it: renders the endpoint and the mounted cert paths when enabled + template: deployment.yaml + set: + billingMetrics: + enabled: true + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CLIENT_CERT + value: /etc/litellm/billing-mtls/tls.crt + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CLIENT_KEY + value: /etc/litellm/billing-mtls/tls.key + + # The conventional Secret name is the default, so enabling the block is enough. + - it: mounts the default cert secret read-only alongside the config volume + template: deployment.yaml + set: + billingMetrics: + enabled: true + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: litellm-billing-metrics-mtls + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls + mountPath: /etc/litellm/billing-mtls + readOnly: true + + - it: honours a secretName override + template: deployment.yaml + set: + billingMetrics: + enabled: true + secretName: my-billing-mtls + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: my-billing-mtls + - notContains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: litellm-billing-metrics-mtls + + - it: honours an endpoint override + template: deployment.yaml + set: + billingMetrics: + enabled: true + endpoint: https://collector.internal:4318 + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://collector.internal:4318 + + # The production collector presents a public web-PKI certificate, so the CA + # override must stay absent unless a private collector is configured. + - it: omits the CA env, volume, and mount when no caSecretName is set + template: deployment.yaml + set: + billingMetrics: + enabled: true + asserts: + - notContains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls-ca + secret: + secretName: billing-ca + - notContains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls-ca + mountPath: /etc/litellm/billing-mtls-ca + readOnly: true + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CA_CERT + value: /etc/litellm/billing-mtls-ca/ca.crt + + - it: mounts the CA secret when caSecretName is set + template: deployment.yaml + set: + billingMetrics: + enabled: true + caSecretName: billing-ca + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CA_CERT + value: /etc/litellm/billing-mtls-ca/ca.crt + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls-ca + secret: + secretName: billing-ca + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls-ca + mountPath: /etc/litellm/billing-mtls-ca + readOnly: true + + - it: passes the export interval through only when set + template: deployment.yaml + set: + billingMetrics: + enabled: true + exportIntervalMs: 5000 + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MS + value: "5000" + + - it: omits the export interval when unset + template: deployment.yaml + set: + billingMetrics: + enabled: true + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MS + value: "60000" + + # Kubernetes resolves duplicate env names last-wins, so the chart-owned billing + # entries must render after .Values.envVars or a user could silently redirect + # the metering export. The three billing entries are the last ones emitted here + # (migrationJob, which appends DISABLE_SCHEMA_UPDATE, is off for this case). + - it: renders the billing endpoint after envVars so it cannot be shadowed + template: deployment.yaml + set: + migrationJob: + enabled: false + billingMetrics: + enabled: true + envVars: + LITELLM_BILLING_METRICS_ENDPOINT: https://shadowed.example + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://shadowed.example + - equal: + path: spec.template.spec.containers[0].env[-3] + value: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + - equal: + path: spec.template.spec.containers[0].env[-2].name + value: LITELLM_BILLING_METRICS_CLIENT_CERT + - equal: + path: spec.template.spec.containers[0].env[-1].name + value: LITELLM_BILLING_METRICS_CLIENT_KEY + + - it: keeps user-supplied volumes and mounts alongside the billing secret + template: deployment.yaml + set: + billingMetrics: + enabled: true + volumes: + - name: custom-callbacks + configMap: + name: my-callbacks + volumeMounts: + - name: custom-callbacks + mountPath: /app/callbacks + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: custom-callbacks + configMap: + name: my-callbacks + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: litellm-billing-metrics-mtls + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: custom-callbacks + mountPath: /app/callbacks + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls + mountPath: /etc/litellm/billing-mtls + readOnly: true + + - it: still mounts the proxy config when enabled + template: deployment.yaml + set: + billingMetrics: + enabled: true + asserts: + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: litellm-config + mountPath: /etc/litellm/config.yaml + subPath: config.yaml + + # Only the proxy serves billable traffic. The migrations Job must never mount + # the client certificate, and it renders its own env and volumes, so nothing + # stops a future edit from wiring the billing include into it by mistake. + - it: does not touch the migrations job when enabled + template: migrations-job.yaml + set: + billingMetrics: + enabled: true + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + - notExists: + path: spec.template.spec.containers[0].volumeMounts + - notExists: + path: spec.template.spec.volumes + + - it: fails loudly when enabled with an emptied secretName + template: deployment.yaml + set: + billingMetrics: + enabled: true + secretName: "" + asserts: + - failedTemplate: + errorMessage: billingMetrics.secretName is required when billingMetrics.enabled is true (an existing Secret with tls.crt and tls.key) + + - it: fails loudly when enabled without an endpoint + template: deployment.yaml + set: + billingMetrics: + enabled: true + endpoint: "" + asserts: + - failedTemplate: + errorMessage: billingMetrics.endpoint is required when billingMetrics.enabled is true diff --git a/helm/litellm-helm/values.yaml b/helm/litellm-helm/values.yaml index d3821a547e5..0529e74d6e4 100644 --- a/helm/litellm-helm/values.yaml +++ b/helm/litellm-helm/values.yaml @@ -139,6 +139,20 @@ masterkeySecretName: "" # if set, use this secret key for the master key; otherwise, use the default key masterkeySecretKey: "" +# Optional: enterprise billable-request metering. When enabled, the proxy counts +# successful requests to inference, MCP, and A2A endpoints and pushes them to +# LiteLLM's collector over mutual TLS. Requires an enterprise license. +# The client certificate identifies the deployment, so it is mounted read-only +# from an existing Secret and never passed through the environment. +billingMetrics: + enabled: false + endpoint: https://telemetry.litellm.ai # collector to push the counter to + secretName: litellm-billing-metrics-mtls # existing Secret holding tls.crt and tls.key + # Only for private or test collectors whose server certificate is not on the + # public web PKI. The production collector needs no CA override. + caSecretName: "" # existing Secret holding ca.crt + exportIntervalMs: "" # push cadence; the proxy defaults to 60000 + proxyConfigMap: # when true, creates a new configmap create: true diff --git a/helm/litellm/templates/_helpers.tpl b/helm/litellm/templates/_helpers.tpl index 7c281aa158b..043a0afc173 100644 --- a/helm/litellm/templates/_helpers.tpl +++ b/helm/litellm/templates/_helpers.tpl @@ -34,6 +34,57 @@ app.kubernetes.io/managed-by: {{ .Release.Service }} helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }} {{- end -}} +{{/* +Enterprise billable-request metering. Wired into gateway and backend, not the +migrations job. The gateway serves nearly all billable traffic, but the backend +keeps the named-server MCP transport (/{mcp_server_name}/mcp), which writes a +SpendLogs row, so metering only the gateway would silently drop that traffic. +The client certificate identifies the deployment to LiteLLM's collector, so it is +mounted read-only from an existing Secret rather than passed through the +environment. +*/}} +{{- define "litellm.billingMetrics.certDir" -}}/etc/litellm/billing-mtls{{- end -}} +{{- define "litellm.billingMetrics.caDir" -}}/etc/litellm/billing-mtls-ca{{- end -}} + +{{- define "litellm.billingMetricsEnv" -}} +- name: LITELLM_BILLING_METRICS_ENDPOINT + value: {{ required "billingMetrics.endpoint is required when billingMetrics.enabled is true" .Values.billingMetrics.endpoint | quote }} +- name: LITELLM_BILLING_METRICS_CLIENT_CERT + value: {{ printf "%s/tls.crt" (include "litellm.billingMetrics.certDir" .) | quote }} +- name: LITELLM_BILLING_METRICS_CLIENT_KEY + value: {{ printf "%s/tls.key" (include "litellm.billingMetrics.certDir" .) | quote }} +{{- if .Values.billingMetrics.caSecretName }} +- name: LITELLM_BILLING_METRICS_CA_CERT + value: {{ printf "%s/ca.crt" (include "litellm.billingMetrics.caDir" .) | quote }} +{{- end }} +{{- with .Values.billingMetrics.exportIntervalMs }} +- name: LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MS + value: {{ . | quote }} +{{- end }} +{{- end -}} + +{{- define "litellm.billingMetricsVolumes" -}} +- name: billing-metrics-mtls + secret: + secretName: {{ required "billingMetrics.secretName is required when billingMetrics.enabled is true (an existing Secret with tls.crt and tls.key)" .Values.billingMetrics.secretName }} +{{- if .Values.billingMetrics.caSecretName }} +- name: billing-metrics-mtls-ca + secret: + secretName: {{ .Values.billingMetrics.caSecretName }} +{{- end }} +{{- end -}} + +{{- define "litellm.billingMetricsVolumeMounts" -}} +- name: billing-metrics-mtls + mountPath: {{ include "litellm.billingMetrics.certDir" . }} + readOnly: true +{{- if .Values.billingMetrics.caSecretName }} +- name: billing-metrics-mtls-ca + mountPath: {{ include "litellm.billingMetrics.caDir" . }} + readOnly: true +{{- end }} +{{- end -}} + {{/* Per-component selector labels — used in both Service selectors and Deployment matchLabels. */}} diff --git a/helm/litellm/templates/backend/deployment.yaml b/helm/litellm/templates/backend/deployment.yaml index 8b4552bf302..9d056167fe1 100644 --- a/helm/litellm/templates/backend/deployment.yaml +++ b/helm/litellm/templates/backend/deployment.yaml @@ -44,14 +44,20 @@ spec: - name: CONFIG_FILE_PATH value: /app/config/config.yaml {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsEnv" . | nindent 12 }} + {{- end }} {{- include "litellm.envFrom" .Values.backend | nindent 10 }} - {{- if or .Values.gateway.config.create .Values.backend.volumeMounts }} + {{- if or .Values.gateway.config.create .Values.backend.volumeMounts .Values.billingMetrics.enabled }} volumeMounts: {{- if .Values.gateway.config.create }} - name: gateway-config mountPath: /app/config/config.yaml subPath: config.yaml {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsVolumeMounts" . | nindent 12 }} + {{- end }} {{- with .Values.backend.volumeMounts }} {{- toYaml . | nindent 12 }} {{- end }} @@ -66,13 +72,16 @@ spec: {{- end }} resources: {{- toYaml .Values.backend.resources | nindent 12 }} - {{- if or .Values.gateway.config.create .Values.backend.volumes }} + {{- if or .Values.gateway.config.create .Values.backend.volumes .Values.billingMetrics.enabled }} volumes: {{- if .Values.gateway.config.create }} - name: gateway-config configMap: name: {{ include "litellm.gateway.fullname" . }}-config {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsVolumes" . | nindent 8 }} + {{- end }} {{- with .Values.backend.volumes }} {{- toYaml . | nindent 8 }} {{- end }} diff --git a/helm/litellm/templates/gateway/deployment.yaml b/helm/litellm/templates/gateway/deployment.yaml index bd491b69e0f..4c80d784156 100644 --- a/helm/litellm/templates/gateway/deployment.yaml +++ b/helm/litellm/templates/gateway/deployment.yaml @@ -46,14 +46,20 @@ spec: - name: NUM_WORKERS value: {{ .Values.gateway.numWorkers | quote }} {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsEnv" . | nindent 12 }} + {{- end }} {{- include "litellm.envFrom" .Values.gateway | nindent 10 }} - {{- if or .Values.gateway.config.create .Values.gateway.volumeMounts }} + {{- if or .Values.gateway.config.create .Values.gateway.volumeMounts .Values.billingMetrics.enabled }} volumeMounts: {{- if .Values.gateway.config.create }} - name: gateway-config mountPath: /app/config/config.yaml subPath: config.yaml {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsVolumeMounts" . | nindent 12 }} + {{- end }} {{- with .Values.gateway.volumeMounts }} {{- toYaml . | nindent 12 }} {{- end }} @@ -68,13 +74,16 @@ spec: {{- end }} resources: {{- toYaml .Values.gateway.resources | nindent 12 }} - {{- if or .Values.gateway.config.create .Values.gateway.volumes }} + {{- if or .Values.gateway.config.create .Values.gateway.volumes .Values.billingMetrics.enabled }} volumes: {{- if .Values.gateway.config.create }} - name: gateway-config configMap: name: {{ include "litellm.gateway.fullname" . }}-config {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsVolumes" . | nindent 8 }} + {{- end }} {{- with .Values.gateway.volumes }} {{- toYaml . | nindent 8 }} {{- end }} diff --git a/helm/litellm/tests/billing_metrics_tests.yaml b/helm/litellm/tests/billing_metrics_tests.yaml new file mode 100644 index 00000000000..ceba0bd1430 --- /dev/null +++ b/helm/litellm/tests/billing_metrics_tests.yaml @@ -0,0 +1,249 @@ +suite: test billingMetrics wiring on gateway and backend +templates: + - gateway/deployment.yaml + - gateway/configmap.yaml + - backend/deployment.yaml + - migrations-job.yaml +values: + - ./values/required.yaml +tests: + - it: is off by default, adding no env, volume, or mount + template: gateway/deployment.yaml + asserts: + - notContains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: billing-mtls + - equal: + path: spec.template.spec.containers[0].volumeMounts + value: + - name: gateway-config + mountPath: /app/config/config.yaml + subPath: config.yaml + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + + - it: renders the endpoint and the mounted cert paths when enabled + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CLIENT_CERT + value: /etc/litellm/billing-mtls/tls.crt + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CLIENT_KEY + value: /etc/litellm/billing-mtls/tls.key + + - it: mounts the cert secret read-only alongside the config volume + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: billing-mtls + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls + mountPath: /etc/litellm/billing-mtls + readOnly: true + + # The production collector presents a public web-PKI certificate, so the CA + # override must stay absent unless a private collector is configured. + - it: omits the CA env, volume, and mount when no caSecretName is set + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + asserts: + - notContains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls-ca + secret: + secretName: billing-ca + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CA_CERT + value: /etc/litellm/billing-mtls-ca/ca.crt + + - it: mounts the CA secret when caSecretName is set + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + caSecretName: billing-ca + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CA_CERT + value: /etc/litellm/billing-mtls-ca/ca.crt + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls-ca + secret: + secretName: billing-ca + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls-ca + mountPath: /etc/litellm/billing-mtls-ca + readOnly: true + + - it: passes the export interval through only when set + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + exportIntervalMs: 5000 + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MS + value: "5000" + + - it: keeps user-supplied gateway volumes alongside the billing secret + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + gateway.volumes: + - name: custom-callbacks + configMap: + name: my-callbacks + gateway.volumeMounts: + - name: custom-callbacks + mountPath: /app/callbacks + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: custom-callbacks + configMap: + name: my-callbacks + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: billing-mtls + + # The backend keeps the named-server MCP transport (/{mcp_server_name}/mcp), + # which writes a SpendLogs row, so it must meter too or that traffic is lost. + - it: meters the backend as well, since it serves the MCP transport + template: backend/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls + mountPath: /etc/litellm/billing-mtls + readOnly: true + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: billing-mtls + + - it: leaves the backend alone when metering is off + template: backend/deployment.yaml + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + + # The migrations job runs prisma and serves no traffic; it must never receive + # the client key. + - it: never mounts the billing cert on the migrations job + template: migrations-job.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + - isNull: + path: spec.template.spec.volumes + + # The conventional Secret name is the default, so enabling metering needs no + # secretName at all; the guard below only fires on an explicitly blanked one. + - it: uses the conventional secret name by default + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: litellm-billing-metrics-mtls + + - it: fails loudly when the secretName is explicitly blanked + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: "" + asserts: + - failedTemplate: + errorMessage: billingMetrics.secretName is required when billingMetrics.enabled is true (an existing Secret with tls.crt and tls.key) + + - it: fails loudly when enabled without an endpoint + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + endpoint: "" + secretName: billing-mtls + asserts: + - failedTemplate: + errorMessage: billingMetrics.endpoint is required when billingMetrics.enabled is true diff --git a/helm/litellm/values.yaml b/helm/litellm/values.yaml index a8f2d39663e..74d02a25b7a 100644 --- a/helm/litellm/values.yaml +++ b/helm/litellm/values.yaml @@ -73,6 +73,25 @@ masterKey: secretName: litellm-master-key-secret # name of a Secret containing the master key secretKey: master-key +# Optional: enterprise billable-request metering. When enabled, the gateway and +# backend count successful requests to inference, MCP, and A2A endpoints and push +# them to LiteLLM's collector over mutual TLS. Both components serve billable +# routes: the backend keeps the named-server MCP transport. Requires an +# enterprise license. The client certificate identifies the deployment, so it is +# mounted read-only from an existing Secret and never passed through the env. +billingMetrics: + enabled: false + endpoint: https://telemetry.litellm.ai # collector to push the counter to + # An existing Secret holding the client certificate under tls.crt and its key + # under tls.key, usually created from the onboarding artifact. The default is + # the conventional name, so the common path is to create that Secret and set + # enabled: true. Override only if yours is named differently. + secretName: litellm-billing-metrics-mtls + # Only for private or test collectors whose server certificate is not on the + # public web PKI. The production collector needs no CA override. + caSecretName: "" # existing Secret holding ca.crt + exportIntervalMs: "" # push cadence; the proxy defaults to 60000 + # External Postgres connection. database: writer: diff --git a/litellm/caching/caching_handler.py b/litellm/caching/caching_handler.py index c860f8e540d..b17e055c7ea 100644 --- a/litellm/caching/caching_handler.py +++ b/litellm/caching/caching_handler.py @@ -85,6 +85,22 @@ class CachingHandlerResponse(BaseModel): in_memory_cache_obj = InMemoryCache() +def _drop_logging_obj_from_kwargs(request_kwargs: dict[str, object]) -> dict[str, object]: + """ + The caching handler is stored on the Logging object + (``logging_obj._llm_caching_handler``), so keeping ``litellm_logging_obj`` + inside ``request_kwargs`` closes a reference cycle + (Logging -> LLMCachingHandler -> kwargs -> Logging) that keeps the full + request payload (messages included) alive until a generational GC pass + instead of being freed by refcount when the request ends. Nothing in the + caching layer reads the logging object from these kwargs; cache-key + generation ignores litellm-internal params. + """ + if "litellm_logging_obj" not in request_kwargs: + return request_kwargs + return {k: v for k, v in request_kwargs.items() if k != "litellm_logging_obj"} + + def _is_chat_completion_cached_dict(cached_result: dict) -> bool: cached_id = cached_result.get("id") if isinstance(cached_id, str) and cached_id.startswith("chatcmpl"): @@ -118,7 +134,7 @@ class LLMCachingHandler: self.async_streaming_chunks: List[ModelResponse] = [] self.sync_streaming_chunks: List[ModelResponse] = [] - self.request_kwargs = request_kwargs + self.request_kwargs = _drop_logging_obj_from_kwargs(request_kwargs) self.preset_cache_key: Optional[str] = None self.original_function = original_function self.start_time = start_time @@ -297,7 +313,7 @@ class LLMCachingHandler: new_kwargs.pop("metadata", None) if new_kwargs.get("stream") is True and "cache_key" not in new_kwargs: new_kwargs["cache_key"] = litellm.cache.get_cache_key(**new_kwargs) - self.request_kwargs = new_kwargs + self.request_kwargs = _drop_logging_obj_from_kwargs(new_kwargs) print_verbose("Checking Sync Cache") cached_result = litellm.cache.get_cache(**new_kwargs) if cached_result is not None: @@ -693,7 +709,7 @@ class LLMCachingHandler: new_kwargs.pop("metadata", None) if new_kwargs.get("stream") is True and "cache_key" not in new_kwargs: new_kwargs["cache_key"] = litellm.cache.get_cache_key(**new_kwargs) - self.request_kwargs = new_kwargs + self.request_kwargs = _drop_logging_obj_from_kwargs(new_kwargs) cached_result: Optional[Any] = None if call_type == CallTypes.aembedding.value: if isinstance(new_kwargs["input"], str): diff --git a/litellm/litellm_core_utils/litellm_logging.py b/litellm/litellm_core_utils/litellm_logging.py index 461ab62b815..268dcc3df78 100644 --- a/litellm/litellm_core_utils/litellm_logging.py +++ b/litellm/litellm_core_utils/litellm_logging.py @@ -925,7 +925,6 @@ class Logging(LiteLLMLoggingBaseClass): def pre_call(self, input, api_key, model=None, additional_args={}): # Log the exact input to the LLM API - litellm.error_logs["PRE_CALL"] = locals() try: self._pre_call( input=input, @@ -1135,7 +1134,6 @@ class Logging(LiteLLMLoggingBaseClass): def post_call(self, original_response, input=None, api_key=None, additional_args={}): # Log the exact result from the LLM API, for streaming - log the type of response received - litellm.error_logs["POST_CALL"] = locals() if isinstance(original_response, dict): original_response = json.dumps(original_response, default=str) try: @@ -3074,7 +3072,7 @@ class Logging(LiteLLMLoggingBaseClass): def get_combined_callback_list(self, dynamic_success_callbacks: Optional[List], global_callbacks: List) -> List: if dynamic_success_callbacks is None: return list(global_callbacks) - return list(set(dynamic_success_callbacks + global_callbacks)) + return list(dict.fromkeys(dynamic_success_callbacks + global_callbacks)) def _remove_internal_litellm_callbacks(self, callbacks: List) -> List: """ diff --git a/litellm/litellm_core_utils/redact_messages.py b/litellm/litellm_core_utils/redact_messages.py index 6e8429839ad..43181e7f5ff 100644 --- a/litellm/litellm_core_utils/redact_messages.py +++ b/litellm/litellm_core_utils/redact_messages.py @@ -77,6 +77,22 @@ def _redact_streaming_response(streaming_response): streaming_response.reasoning = None +def _redact_tool_calls(tool_calls) -> None: + """Redact tool call arguments (assistant tool calls carry prompt-derived data).""" + if not tool_calls: + return + for tool_call in tool_calls: + function = getattr(tool_call, "function", None) + if function is not None and hasattr(function, "arguments"): + function.arguments = "redacted-by-litellm" + + +def _redact_function_call(function_call) -> None: + """Redact legacy assistant function_call arguments.""" + if function_call is not None and hasattr(function_call, "arguments"): + function_call.arguments = "redacted-by-litellm" + + def _redact_choice_content(choice): """Helper to redact content in a choice (message or delta).""" if isinstance(choice, litellm.Choices): @@ -85,12 +101,16 @@ def _redact_choice_content(choice): choice.message.reasoning_content = "redacted-by-litellm" if hasattr(choice.message, "thinking_blocks"): choice.message.thinking_blocks = None + _redact_tool_calls(getattr(choice.message, "tool_calls", None)) + _redact_function_call(getattr(choice.message, "function_call", None)) elif isinstance(choice, litellm.utils.StreamingChoices): choice.delta.content = "redacted-by-litellm" if hasattr(choice.delta, "reasoning_content"): choice.delta.reasoning_content = "redacted-by-litellm" if hasattr(choice.delta, "thinking_blocks"): choice.delta.thinking_blocks = None + _redact_tool_calls(getattr(choice.delta, "tool_calls", None)) + _redact_function_call(getattr(choice.delta, "function_call", None)) def _redact_responses_api_output(output_items): @@ -111,6 +131,9 @@ def _redact_responses_api_output(output_items): if hasattr(summary_item, "text"): summary_item.text = "redacted-by-litellm" + if hasattr(output_item, "type") and output_item.type == "function_call" and hasattr(output_item, "arguments"): + output_item.arguments = "redacted-by-litellm" + def _redact_responses_api_output_dict(output_items, redacted_str: str): """Helper to redact ResponsesAPIResponse output items in dict form.""" @@ -131,6 +154,9 @@ def _redact_responses_api_output_dict(output_items, redacted_str: str): if isinstance(summary_item, dict) and "text" in summary_item: summary_item["text"] = redacted_str + if output_item.get("type") == "function_call" and "arguments" in output_item: + output_item["arguments"] = redacted_str + def _redact_standard_logging_object(model_call_details: dict): """Redact messages and response inside standard_logging_object if present.""" @@ -162,6 +188,19 @@ def _redact_standard_logging_object(model_call_details: dict): standard_logging_object["response"] = {"text": redacted_str} +def _redact_tool_calls_dict(message: dict, redacted_str: str) -> None: + """Redact tool call / function_call arguments in a dict-form message or delta.""" + tool_calls = message.get("tool_calls") + if isinstance(tool_calls, list): + for tool_call in tool_calls: + if isinstance(tool_call, dict) and isinstance(tool_call.get("function"), dict): + tool_call["function"]["arguments"] = redacted_str + + function_call = message.get("function_call") + if isinstance(function_call, dict) and "arguments" in function_call: + function_call["arguments"] = redacted_str + + def _redact_model_response_dict_choices(choices, redacted_str: str): for choice in choices: if isinstance(choice, dict): @@ -173,6 +212,7 @@ def _redact_model_response_dict_choices(choices, redacted_str: str): choice["message"]["thinking_blocks"] = None if "audio" in choice["message"]: choice["message"]["audio"] = None + _redact_tool_calls_dict(choice["message"], redacted_str) elif "delta" in choice and isinstance(choice["delta"], dict): choice["delta"]["content"] = redacted_str if "reasoning_content" in choice["delta"]: @@ -181,6 +221,7 @@ def _redact_model_response_dict_choices(choices, redacted_str: str): choice["delta"]["thinking_blocks"] = None if "audio" in choice["delta"]: choice["delta"]["audio"] = None + _redact_tool_calls_dict(choice["delta"], redacted_str) else: _redact_choice_content(choice) diff --git a/litellm/llms/custom_httpx/llm_http_handler.py b/litellm/llms/custom_httpx/llm_http_handler.py index 96d0ad48b79..b47fc50e196 100644 --- a/litellm/llms/custom_httpx/llm_http_handler.py +++ b/litellm/llms/custom_httpx/llm_http_handler.py @@ -1879,6 +1879,7 @@ class BaseLLMHTTPHandler: litellm_params: GenericLiteLLMParams, api_key: Optional[str], model: str, + timeout: Optional[Union[float, httpx.Timeout]] = None, ) -> httpx.Response: max_attempts = max(provider_config.max_retry_on_anthropic_messages_http_error, 1) litellm_params_dict = dict(litellm_params) @@ -1891,6 +1892,7 @@ class BaseLLMHTTPHandler: data=signed_json_body or json.dumps(request_body), stream=stream or False, logging_obj=logging_obj, + timeout=timeout, ) response.raise_for_status() return response @@ -1925,6 +1927,32 @@ class BaseLLMHTTPHandler: raise RuntimeError("unreachable: anthropic messages HTTP retry loop exited without return") + @staticmethod + def _resolve_anthropic_messages_timeout( + litellm_params: GenericLiteLLMParams, + stream: bool, + custom_llm_provider: str, + ) -> Optional[Union[float, httpx.Timeout]]: + from litellm.litellm_core_utils.completion_timeout import CompletionTimeout + from litellm.litellm_core_utils.request_timeout_resolver import ( + get_configured_request_timeout, + ) + from litellm.utils import supports_httpx_timeout + + stream_timeout = litellm_params.get("stream_timeout") if stream else None + model_timeout = stream_timeout if stream_timeout is not None else litellm_params.get("timeout") + request_timeout = litellm_params.get("request_timeout") + global_timeout = get_configured_request_timeout() + if model_timeout is None and request_timeout is None and global_timeout is None: + return None + return CompletionTimeout.resolve( + model_timeout, + {"request_timeout": request_timeout}, + custom_llm_provider, + global_timeout=global_timeout, + supports_httpx_timeout=supports_httpx_timeout, + ) + async def async_anthropic_messages_handler( self, model: str, @@ -2075,6 +2103,11 @@ class BaseLLMHTTPHandler: litellm_params=litellm_params, api_key=api_key, model=model, + timeout=self._resolve_anthropic_messages_timeout( + litellm_params=litellm_params, + stream=stream or False, + custom_llm_provider=custom_llm_provider, + ), ) # used for logging + cost tracking diff --git a/litellm/llms/openai/responses/guardrail_translation/handler.py b/litellm/llms/openai/responses/guardrail_translation/handler.py index 093dffccac0..d90703d1544 100644 --- a/litellm/llms/openai/responses/guardrail_translation/handler.py +++ b/litellm/llms/openai/responses/guardrail_translation/handler.py @@ -247,6 +247,8 @@ class OpenAIResponsesHandler(BaseTranslation): """ Merge remapped guardrailed tools with original tools that were not sent to the guardrail (e.g. web_search, web_search_preview), preserving order. + Tools a guardrail appended (``remapped`` longer than ``original_tools``) + have no original slot and are kept so an injected tool is not dropped. """ if not original_tools: return remapped @@ -262,6 +264,8 @@ class OpenAIResponsesHandler(BaseTranslation): if j < len(remapped): result.append(remapped[j]) j += 1 + # Keep guardrail-appended tools that matched no original slot above. + result.extend(remapped[j:]) return result def _apply_guardrailed_tools_to_data( diff --git a/litellm/model_prices_and_context_window_backup.json b/litellm/model_prices_and_context_window_backup.json index 77ca423b866..dedb9bbf40a 100644 --- a/litellm/model_prices_and_context_window_backup.json +++ b/litellm/model_prices_and_context_window_backup.json @@ -44261,6 +44261,90 @@ "supports_response_schema": true, "supports_tool_choice": true }, + "bedrock_mantle/openai.gpt-5.6-sol": { + "input_cost_per_token": 5.5e-06, + "cache_creation_input_token_cost": 6.875e-06, + "cache_read_input_token_cost": 5.5e-07, + "output_cost_per_token": 3.3e-05, + "litellm_provider": "bedrock_mantle", + "max_input_tokens": 272000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "responses", + "use_openai_responses_path": true, + "supported_endpoints": [ + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_tool_choice": true, + "supports_vision": true + }, + "bedrock_mantle/openai.gpt-5.6-terra": { + "input_cost_per_token": 2.75e-06, + "cache_creation_input_token_cost": 3.4375e-06, + "cache_read_input_token_cost": 2.75e-07, + "output_cost_per_token": 1.65e-05, + "litellm_provider": "bedrock_mantle", + "max_input_tokens": 272000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "responses", + "use_openai_responses_path": true, + "supported_endpoints": [ + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_tool_choice": true, + "supports_vision": true + }, + "bedrock_mantle/openai.gpt-5.6-luna": { + "input_cost_per_token": 1.1e-06, + "cache_creation_input_token_cost": 1.375e-06, + "cache_read_input_token_cost": 1.1e-07, + "output_cost_per_token": 6.6e-06, + "litellm_provider": "bedrock_mantle", + "max_input_tokens": 272000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "responses", + "use_openai_responses_path": true, + "supported_endpoints": [ + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_tool_choice": true, + "supports_vision": true + }, "bedrock_mantle/openai.gpt-5.5": { "input_cost_per_token": 5.5e-06, "cache_read_input_token_cost": 5.5e-07, @@ -44373,6 +44457,7 @@ "supports_vision": true }, "bedrock_mantle/xai.grok-4.3": { + "use_openai_responses_path": true, "input_cost_per_token": 1.25e-06, "output_cost_per_token": 2.5e-06, "cache_read_input_token_cost": 2e-07, diff --git a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py index 33f0641b732..43fe3999291 100644 --- a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py +++ b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py @@ -175,16 +175,18 @@ mcp_oauth2_token_cache = MCPOAuth2TokenCache() def _compute_per_user_token_ttl(server: "MCPServer", expires_in: Optional[int]) -> int: """Compute Redis TTL for a per-user token. - Uses server.token_storage_ttl_seconds when configured; otherwise derives - TTL from expires_in minus the expiry buffer; falls back to the default TTL. + Uses server.token_storage_ttl_seconds when configured, capped at the token's + remaining lifetime (expires_in minus the expiry buffer) so a cached entry never + outlives the token itself; otherwise derives TTL from expires_in minus the + expiry buffer; falls back to the default TTL. """ + lifetime_bound = expires_in - MCP_PER_USER_TOKEN_EXPIRY_BUFFER_SECONDS if expires_in is not None else None if server.token_storage_ttl_seconds is not None: - return max(server.token_storage_ttl_seconds, 1) - if expires_in is not None: - return max( - expires_in - MCP_PER_USER_TOKEN_EXPIRY_BUFFER_SECONDS, - 1, - ) + if lifetime_bound is None: + return max(server.token_storage_ttl_seconds, 1) + return max(min(server.token_storage_ttl_seconds, lifetime_bound), 1) + if lifetime_bound is not None: + return max(lifetime_bound, 1) return MCP_PER_USER_TOKEN_DEFAULT_TTL diff --git a/litellm/proxy/_lazy_openapi_snapshot.json b/litellm/proxy/_lazy_openapi_snapshot.json index 27cdc483d4a..67d935e34e3 100644 --- a/litellm/proxy/_lazy_openapi_snapshot.json +++ b/litellm/proxy/_lazy_openapi_snapshot.json @@ -7613,6 +7613,18 @@ ], "title": "Messages" }, + "metadata": { + "anyOf": [ + { + "additionalProperties": true, + "type": "object" + }, + { + "type": "null" + } + ], + "title": "Metadata" + }, "text": { "title": "Text", "type": "string" diff --git a/litellm/proxy/client/cli/commands/auth.py b/litellm/proxy/client/cli/commands/auth.py index 4eda6817252..785d3b1e37b 100644 --- a/litellm/proxy/client/cli/commands/auth.py +++ b/litellm/proxy/client/cli/commands/auth.py @@ -277,6 +277,28 @@ def prompt_team_selection_fallback( return None +def _response_error_detail(response: requests.Response) -> str | None: + try: + body = response.json() + except ValueError: + return None + detail = body.get("detail") if isinstance(body, dict) else None + if isinstance(detail, str) and detail: + return detail + return None + + +def _polling_error_message(response: requests.Response) -> str: + detail = _response_error_detail(response) + if detail: + return f"Polling error: HTTP {response.status_code}: {detail}" + return f"Polling error: HTTP {response.status_code}" + + +def _is_permanent_polling_error(status_code: int) -> bool: + return 400 <= status_code < 500 and status_code != 429 + + # Polling-based authentication - no local server needed def _poll_for_ready_data( url: str, @@ -308,8 +330,14 @@ def _poll_for_ready_data( click.echo(pending_message) elif other_status_message and other_status_log_every > 0 and attempt % other_status_log_every == 0: click.echo(other_status_message) + elif _is_permanent_polling_error(response.status_code): + detail = _response_error_detail(response) + raise ValueError( + f"The proxy rejected the login session with HTTP {response.status_code}" + + (f": {detail}" if detail else f" and no error detail (from {url})") + ) elif http_error_log_every > 0 and attempt % http_error_log_every == 0: - click.echo(f"Polling error: HTTP {response.status_code}") + click.echo(_polling_error_message(response)) except requests.RequestException as e: if connection_error_log_every > 0 and attempt % connection_error_log_every == 0: click.echo(f"Connection error (will retry): {e}") @@ -342,12 +370,45 @@ def _normalize_teams(teams, team_details): def _start_cli_sso_flow(base_url: str) -> Dict[str, Any]: - response = requests.post(f"{base_url}/sso/cli/start", timeout=10) - response.raise_for_status() - data = response.json() + start_url = f"{base_url}/sso/cli/start" + try: + response = requests.post(start_url, timeout=10) + except requests.RequestException as e: + raise ValueError( + f"Could not reach the proxy at {start_url}: {e}. " + "Check that the proxy is running and that --base-url points at it." + ) from e + + if response.status_code in (404, 405): + raise ValueError( + f"POST {start_url} returned HTTP {response.status_code}. " + "Either --base-url is wrong, or the proxy is older than this CLI and does not support " + "the CLI SSO login flow; upgrade the proxy or use a CLI version that matches it." + ) + if response.status_code != 200: + detail = _response_error_detail(response) + raise ValueError( + f"Starting CLI login failed: HTTP {response.status_code} from {start_url}" + + (f": {detail}" if detail else "") + ) + + try: + data = response.json() + except ValueError: + content_type = response.headers.get("content-type", "unknown") + raise ValueError( + f"The proxy returned a non-JSON response from {start_url} (content-type: {content_type}). " + "A proxy, load balancer, or auth gateway in front of LiteLLM may be intercepting the request. " + f"Response starts with: {response.text[:200]!r}" + ) + required_fields = ("login_id", "poll_secret", "user_code") - if not all(isinstance(data.get(field), str) for field in required_fields): - raise ValueError("Invalid CLI SSO start response") + missing_fields = tuple(field for field in required_fields if not isinstance(data.get(field), str)) + if missing_fields: + raise ValueError( + f"The response from {start_url} is missing required field(s): {', '.join(missing_fields)}. " + "The proxy version may not match this CLI; upgrade whichever is older." + ) return data @@ -577,6 +638,10 @@ def login(ctx: click.Context): return else: click.echo("❌ Authentication timed out. Please try again.") + click.echo( + "The proxy never reported the browser sign-in as finished. If you did complete it, " + "check the proxy logs for /sso/callback errors and confirm SSO is configured on the proxy." + ) return except KeyboardInterrupt: diff --git a/litellm/proxy/enterprise_billing/__init__.py b/litellm/proxy/enterprise_billing/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/litellm/proxy/enterprise_billing/billing_metrics.py b/litellm/proxy/enterprise_billing/billing_metrics.py new file mode 100644 index 00000000000..f9f8ceaf721 --- /dev/null +++ b/litellm/proxy/enterprise_billing/billing_metrics.py @@ -0,0 +1,323 @@ +""" +Push-based OTLP metering for enterprise litellm deployments. + +Owns a dedicated OpenTelemetry meter provider and an OTLP/HTTP exporter +authenticated to our global collector with a TLS client certificate. The +collector front end terminates mutual TLS: the client certificate presented +here is validated against our CA at the edge, and the verified subject is +what identifies the deployment. It is intentionally isolated from the global +meter provider so the customer's own OTEL metrics are untouched and ours +never leak into their backend. + +The deployment's identity rides on the TLS client certificate, not on the +payload; the secret license key is never sent as an attribute or header. +""" + +import os +import tempfile +from dataclasses import dataclass +from typing import TYPE_CHECKING, Optional, Union + +from opentelemetry.exporter.otlp.proto.http.metric_exporter import OTLPMetricExporter +from opentelemetry.metrics import Counter +from opentelemetry.sdk.metrics import MeterProvider +from opentelemetry.sdk.metrics.export import PeriodicExportingMetricReader +from opentelemetry.sdk.resources import Resource + +from litellm._logging import verbose_proxy_logger +from litellm.proxy.middleware.billable_request_metrics_middleware import ( + BillableCategory, +) + +if TYPE_CHECKING: + from litellm.proxy._types import EnterpriseLicenseData + +ENDPOINT_ENV = "LITELLM_BILLING_METRICS_ENDPOINT" +CLIENT_CERT_ENV = "LITELLM_BILLING_METRICS_CLIENT_CERT" +CLIENT_KEY_ENV = "LITELLM_BILLING_METRICS_CLIENT_KEY" +CA_CERT_ENV = "LITELLM_BILLING_METRICS_CA_CERT" +EXPORT_INTERVAL_ENV = "LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MS" +DEFAULT_EXPORT_INTERVAL_MS = 60_000 +SHUTDOWN_FLUSH_TIMEOUT_MS = 5_000 +_METRICS_PATH = "/v1/metrics" + +# The cert env vars take a path or the PEM itself. Secret stores that inject +# values as env content cannot mount them as files, so inline PEM is written out. +_PEM_PREFIX = "-----BEGIN" +_PEM_DIR_PREFIX = "litellm-billing-mtls-" +_PEM_FILE_MODE = 0o600 +_CLIENT_CERT_FILENAME = "client.crt" +_CLIENT_KEY_FILENAME = "client.key" +_CA_CERT_FILENAME = "ca.crt" + +METRIC_NAME = "litellm.enterprise.billable_requests" +METER_NAME = "litellm.enterprise.billing" + +AttributeValue = Union[str, int] + + +@dataclass(frozen=True, slots=True) +class BillingMetricsConfig: + endpoint: str + client_cert_path: str + client_key_path: str + ca_cert_path: Optional[str] + export_interval_ms: int + litellm_version: str + license_id: Optional[str] + + +def _metrics_endpoint(endpoint: str) -> str: + """The OTLP/HTTP metric exporter wants the full URL including the signal path.""" + trimmed = endpoint.rstrip("/") + return trimmed if trimmed.endswith(_METRICS_PATH) else f"{trimmed}{_METRICS_PATH}" + + +def _resource_attributes(config: BillingMetricsConfig) -> dict[str, AttributeValue]: + base: dict[str, AttributeValue] = { + "service.name": "litellm-proxy", + "litellm.version": config.litellm_version, + } + license_attr: dict[str, AttributeValue] = {"litellm.license.id": config.license_id} if config.license_id else {} + return {**base, **license_attr} + + +def _billable_attributes( + category: BillableCategory, route: str, status_code: int, model_id: Optional[str] +) -> dict[str, AttributeValue]: + base: dict[str, AttributeValue] = { + "litellm.endpoint.category": category.value, + "http.route": route, + "http.response.status_code": status_code, + } + model_attr: dict[str, AttributeValue] = {"litellm.model_id": model_id} if model_id else {} + return {**base, **model_attr} + + +def build_mtls_meter_provider(config: BillingMetricsConfig) -> MeterProvider: + """OTLP/HTTP exporter presenting a TLS client certificate. + + The collector's load balancer terminates mutual TLS and validates the client + certificate against our CA. Server verification uses the system trust store + (the collector presents a public web-PKI certificate); ca_cert_path overrides + it only for private/test collectors. + """ + exporter = OTLPMetricExporter( + endpoint=_metrics_endpoint(config.endpoint), + # None -> exporter falls back to the system trust store. + certificate_file=config.ca_cert_path, + client_certificate_file=config.client_cert_path, + client_key_file=config.client_key_path, + ) + reader = PeriodicExportingMetricReader(exporter, export_interval_millis=config.export_interval_ms) + return MeterProvider(metric_readers=[reader], resource=Resource.create(_resource_attributes(config))) + + +class BillingMetricsRecorder: + """Increments one OTLP counter per billable request. The meter provider is injected (see the factory).""" + + def __init__(self, provider: MeterProvider) -> None: + self._provider = provider + self._counter: Counter = provider.get_meter(METER_NAME).create_counter( + name=METRIC_NAME, + unit="{request}", + description="Count of 2xx HTTP requests to billable LLM/MCP/A2A endpoints", + ) + + def record(self, *, category: BillableCategory, route: str, status_code: int, model_id: Optional[str]) -> None: + self._counter.add(1, _billable_attributes(category, route, status_code, model_id)) + + def shutdown(self) -> None: + """Final flush + exporter-thread stop. Without this, up to one export + interval of billable counts is dropped on every proxy restart.""" + self._provider.shutdown(timeout_millis=SHUTDOWN_FLUSH_TIMEOUT_MS) + + +def _export_interval_ms() -> int: + raw = os.getenv(EXPORT_INTERVAL_ENV) + if raw is None: + return DEFAULT_EXPORT_INTERVAL_MS + try: + return int(raw) + except ValueError: + verbose_proxy_logger.warning( + "Invalid %s=%r, falling back to %d ms", EXPORT_INTERVAL_ENV, raw, DEFAULT_EXPORT_INTERVAL_MS + ) + return DEFAULT_EXPORT_INTERVAL_MS + + +@dataclass(frozen=True, slots=True) +class _CredentialPaths: + client_cert_path: str + client_key_path: str + ca_cert_path: Optional[str] + + +def _is_pem_content(value: str) -> bool: + return value.lstrip().startswith(_PEM_PREFIX) + + +def _write_pem(directory: str, filename: str, pem: str) -> str: + path = os.path.join(directory, filename) + with open(path, "w", encoding="utf-8") as handle: + handle.write(pem if pem.endswith("\n") else f"{pem}\n") + os.chmod(path, _PEM_FILE_MODE) + return path + + +def _resolve_credential_paths(*, client_cert: str, client_key: str, ca_cert: Optional[str]) -> _CredentialPaths: + """ + Accept either a filesystem path or inline PEM content for each credential. + + Secret stores that inject values as environment content rather than mounted + files (ECS tasks reading AWS Secrets Manager, Cloud Run reading Secret + Manager) can only deliver the certificate as a string. The OTLP exporter + takes paths, so inline PEM is written to a private directory once, when the + recorder is built. Raises OSError if that write fails; the caller disables + metering rather than propagating. + """ + inline = tuple(value for value in (client_cert, client_key, ca_cert) if value and _is_pem_content(value)) + if not inline: + return _CredentialPaths(client_cert, client_key, ca_cert) + + # mkdtemp is 0o700, so the 0o600 key file it holds is unreachable by other users. + directory = tempfile.mkdtemp(prefix=_PEM_DIR_PREFIX) + return _CredentialPaths( + client_cert_path=( + _write_pem(directory, _CLIENT_CERT_FILENAME, client_cert) if _is_pem_content(client_cert) else client_cert + ), + client_key_path=( + _write_pem(directory, _CLIENT_KEY_FILENAME, client_key) if _is_pem_content(client_key) else client_key + ), + ca_cert_path=( + _write_pem(directory, _CA_CERT_FILENAME, ca_cert) if ca_cert and _is_pem_content(ca_cert) else ca_cert + ), + ) + + +def load_billing_metrics_config( + *, license_data: Optional["EnterpriseLicenseData"], litellm_version: str +) -> Optional[BillingMetricsConfig]: + endpoint = os.getenv(ENDPOINT_ENV) + client_cert = os.getenv(CLIENT_CERT_ENV) + client_key = os.getenv(CLIENT_KEY_ENV) + # Optional: only for private/test collectors whose server cert is not on the + # public web PKI. The production collector needs no CA override. + ca_cert = os.getenv(CA_CERT_ENV) + + missing = [ + name + for name, value in ( + (ENDPOINT_ENV, endpoint), + (CLIENT_CERT_ENV, client_cert), + (CLIENT_KEY_ENV, client_key), + ) + if not value + ] + if not endpoint or not client_cert or not client_key: + verbose_proxy_logger.warning( + "Enterprise billing metrics disabled: licensed deployment missing config (%s)", + ", ".join(missing), + ) + return None + + try: + paths = _resolve_credential_paths(client_cert=client_cert, client_key=client_key, ca_cert=ca_cert) + except OSError as exc: + verbose_proxy_logger.warning( + "Enterprise billing metrics disabled: could not write inline certificate content to disk: %s", exc + ) + return None + + # Report the variable names, never their values. A value that is neither a + # readable path nor recognizable PEM is still secret material, and this + # warning would otherwise copy a client key straight into the proxy logs. + unreadable = [ + env_name + for env_name, path in ( + (CLIENT_CERT_ENV, paths.client_cert_path), + (CLIENT_KEY_ENV, paths.client_key_path), + (CA_CERT_ENV, paths.ca_cert_path), + ) + if path and not os.path.isfile(path) + ] + if unreadable: + verbose_proxy_logger.warning( + "Enterprise billing metrics disabled: %s did not resolve to a readable certificate file. " + "Set each to a file path, or to inline PEM content beginning with '%s'.", + ", ".join(unreadable), + _PEM_PREFIX, + ) + return None + + return BillingMetricsConfig( + endpoint=endpoint, + client_cert_path=paths.client_cert_path, + client_key_path=paths.client_key_path, + ca_cert_path=paths.ca_cert_path, + export_interval_ms=_export_interval_ms(), + litellm_version=litellm_version, + license_id=(license_data or {}).get("user_id"), + ) + + +class _ActiveRecorderRegistry: + """One-slot registry linking the factory-built recorder to the shutdown + hook; the middleware instance holding the recorder is not reachable from + proxy_shutdown_event.""" + + def __init__(self) -> None: + self._recorder: Optional[BillingMetricsRecorder] = None + + def set(self, recorder: BillingMetricsRecorder) -> None: + self._recorder = recorder + + def pop(self) -> Optional[BillingMetricsRecorder]: + recorder = self._recorder + self._recorder = None + return recorder + + +_ACTIVE_RECORDER = _ActiveRecorderRegistry() + + +def build_billing_metrics_recorder( + *, premium: bool, license_data: Optional["EnterpriseLicenseData"], litellm_version: str +) -> Optional[BillingMetricsRecorder]: + """Build the recorder, or None when the deployment is not licensed or metering is unconfigured.""" + if not premium: + # Debug, not warning: unlicensed is the common case and a warning here + # would be noise on every OSS proxy. Every other disable path warns. + verbose_proxy_logger.debug("Enterprise billing metrics disabled: deployment is not licensed") + return None + + config = load_billing_metrics_config(license_data=license_data, litellm_version=litellm_version) + if config is None: + return None + + try: + recorder = BillingMetricsRecorder(build_mtls_meter_provider(config)) + except Exception as exc: # noqa: BLE001 -- metering must never break proxy startup + verbose_proxy_logger.warning("Enterprise billing metrics disabled: failed to initialize exporter: %s", exc) + return None + _ACTIVE_RECORDER.set(recorder) + # The only positive signal that this component meters. Without it, a silent + # return above is indistinguishable from a working exporter in the logs, and + # a component that carries the cert but no license would look healthy. + verbose_proxy_logger.info( + "Enterprise billing metrics enabled: exporting to %s every %d ms", + config.endpoint, + config.export_interval_ms, + ) + return recorder + + +def shutdown_billing_metrics_recorder() -> None: + """Flush and stop the active recorder, if any. Idempotent; never raises.""" + recorder = _ACTIVE_RECORDER.pop() + if recorder is None: + return + try: + recorder.shutdown() + except Exception as exc: # noqa: BLE001 -- shutdown must never block or fail proxy exit + verbose_proxy_logger.warning("Enterprise billing metrics: final flush failed: %s", exc) diff --git a/litellm/proxy/guardrails/guardrail_endpoints.py b/litellm/proxy/guardrails/guardrail_endpoints.py index b6a2d8d9069..1ed67a93d94 100644 --- a/litellm/proxy/guardrails/guardrail_endpoints.py +++ b/litellm/proxy/guardrails/guardrail_endpoints.py @@ -2238,7 +2238,10 @@ async def apply_guardrail( if litellm_logging_obj is not None: _patch_logging_obj_for_guardrail(litellm_logging_obj, request) - request_data: dict = {"messages": request.messages} if request.messages else {} + request_data: dict = { + **({"messages": request.messages} if request.messages is not None else {}), + **({"metadata": request.metadata} if request.metadata is not None else {}), + } _input_type = _resolve_guardrail_input_type(active_guardrail, request.input_type) guardrailed_inputs = await active_guardrail.apply_guardrail( inputs={"texts": [request.text]}, diff --git a/litellm/proxy/guardrails/guardrail_hooks/compresr/__init__.py b/litellm/proxy/guardrails/guardrail_hooks/compresr/__init__.py new file mode 100644 index 00000000000..73d31f7aec0 --- /dev/null +++ b/litellm/proxy/guardrails/guardrail_hooks/compresr/__init__.py @@ -0,0 +1,75 @@ +from __future__ import annotations + +from typing import TYPE_CHECKING + +from litellm.types.guardrails import ( + GuardrailEventHooks, + Mode, + SupportedGuardrailIntegrations, +) + +from .compresr import CompresrGuardrail + +if TYPE_CHECKING: + from litellm.types.guardrails import Guardrail, LitellmParams + + +def _coerce_event_hook( + mode: str | list[str] | Mode, +) -> GuardrailEventHooks | list[GuardrailEventHooks] | Mode: + if isinstance(mode, Mode): + return mode + if isinstance(mode, list): + return [GuardrailEventHooks(item) for item in mode] + return GuardrailEventHooks(mode) + + +def _get_optional_value(litellm_params: LitellmParams, optional_params: object | None, attribute_name: str) -> object: + if optional_params is not None: + value = getattr(optional_params, attribute_name, None) + if value is not None: + return value + return getattr(litellm_params, attribute_name, None) + + +def initialize_guardrail(litellm_params: LitellmParams, guardrail: Guardrail) -> CompresrGuardrail: + import litellm + + optional_params = getattr(litellm_params, "optional_params", None) + + _callback = CompresrGuardrail( + api_base=litellm_params.api_base, + api_key=litellm_params.api_key, + model=litellm_params.model, + target_compression_ratio=_get_optional_value(litellm_params, optional_params, "target_compression_ratio"), + coarse=_get_optional_value(litellm_params, optional_params, "coarse"), + min_chars_to_compress=_get_optional_value(litellm_params, optional_params, "min_chars_to_compress"), + compress_tool_outputs=_get_optional_value(litellm_params, optional_params, "compress_tool_outputs"), + compress_system=_get_optional_value(litellm_params, optional_params, "compress_system"), + compress_history=_get_optional_value(litellm_params, optional_params, "compress_history"), + compress_last_user=_get_optional_value(litellm_params, optional_params, "compress_last_user"), + enable_retrieval=_get_optional_value(litellm_params, optional_params, "enable_retrieval"), + max_bytes_per_call=_get_optional_value(litellm_params, optional_params, "max_bytes_per_call"), + allow_bypass_header=_get_optional_value(litellm_params, optional_params, "allow_bypass_header"), + dynamic=_get_optional_value(litellm_params, optional_params, "dynamic"), + dynamic_min_ratio=_get_optional_value(litellm_params, optional_params, "dynamic_min_ratio"), + dynamic_max_ratio=_get_optional_value(litellm_params, optional_params, "dynamic_max_ratio"), + compression_params=_get_optional_value(litellm_params, optional_params, "compression_params"), + guardrail_name=guardrail["guardrail_name"], + event_hook=_coerce_event_hook(litellm_params.mode), + default_on=litellm_params.default_on or False, + unreachable_fallback=litellm_params.unreachable_fallback, + ) + litellm.logging_callback_manager.add_litellm_callback( # pyright: ignore[reportUnknownMemberType] # callback manager is untyped + _callback + ) + return _callback + + +guardrail_initializer_registry = { + SupportedGuardrailIntegrations.COMPRESR.value: initialize_guardrail, +} + +guardrail_class_registry = { + SupportedGuardrailIntegrations.COMPRESR.value: CompresrGuardrail, +} diff --git a/litellm/proxy/guardrails/guardrail_hooks/compresr/compresr.py b/litellm/proxy/guardrails/guardrail_hooks/compresr/compresr.py new file mode 100644 index 00000000000..a95bdb670c3 --- /dev/null +++ b/litellm/proxy/guardrails/guardrail_hooks/compresr/compresr.py @@ -0,0 +1,1214 @@ +"""Compresr guardrail — query-aware, recoverable context compression. + +Compresses bulky message content (tool outputs by default) through the +Compresr API before the request reaches the LLM. Each compressed message +carries a hash marker; a ``compresr_retrieve`` tool is injected so the model +can fetch the original content back through the agentic loop when the +compressed version is not enough — making compression recoverable instead +of lossy. + +Unlike gateway-side compressors that operate on whole message lists, each +target is compressed *query-aware*: the query sent to Compresr is the intent +of the tool call that produced the message (``name + arguments``, resolved +via ``tool_call_id``), falling back to the last user message. +""" + +from __future__ import annotations + +import asyncio +import hashlib +import ipaddress +import json +import time +from collections import Counter, OrderedDict +from dataclasses import dataclass, field +from typing import TYPE_CHECKING, Any, Literal +from urllib.parse import urlparse + +import httpx +from fastapi import HTTPException +from httpx import Response as HttpxResponse +from typing_extensions import TypeGuard + +import litellm +from litellm._logging import verbose_proxy_logger +from litellm.constants import PRE_CALL_EXECUTED_GUARDRAILS_KEY +from litellm.integrations.custom_guardrail import ( + CustomGuardrail, + log_guardrail_information, +) +from litellm.litellm_core_utils.prompt_templates.factory import ( + get_attribute_or_key, + get_tool_calls_from_response, + has_tool_with_name, +) +from litellm.llms.custom_httpx.http_handler import ( + get_async_httpx_client, # pyright: ignore[reportUnknownVariableType] # helper is untyped in http_handler + httpxSpecialProvider, +) +from litellm.proxy._types import UserAPIKeyAuth +from litellm.secret_managers.main import get_secret_str +from litellm.types.guardrails import GuardrailEventHooks, Mode +from litellm.types.integrations.custom_logger import ( + AgenticLoopPlan, + AgenticLoopRequestPatch, +) +from litellm.types.utils import GenericGuardrailAPIInputs + +if TYPE_CHECKING: + from litellm.litellm_core_utils.litellm_logging import ( + Logging as LiteLLMLoggingObj, + ) + from litellm.types.proxy.guardrails.guardrail_hooks.base import ( + GuardrailConfigModel, + ) + +BYPASS_HEADER = "x-compresr-bypass" +COMPRESR_RETRIEVE_TOOL_NAME = "compresr_retrieve" +DEFAULT_API_BASE = "https://api.compresr.ai" +DEFAULT_COMPRESSION_MODEL = "latte_v2" +DEFAULT_TARGET_COMPRESSION_RATIO = 0.5 +DEFAULT_MIN_CHARS_TO_COMPRESS = 500 +_ORIGINALS_TTL_SECONDS = 15 * 60 +_NO_SCOPE_WARNING_INTERVAL_SECONDS = 15 * 60 +_MAX_TRACKED_CALLS = 256 +_DEFAULT_MAX_BYTES_PER_CALL = 10 * 1024 * 1024 +# Aggregate ceiling across all recovery-store entries. max_bytes_per_call only +# bounds a single call; this caps the whole store so many calls cannot exhaust it. +_MAX_TOTAL_STORE_BYTES = 256 * 1024 * 1024 +# Max compresr_retrieve calls expanded into a single follow-up (repeats deduped). +_MAX_RETRIEVALS_PER_LOOP = 8 +# The shared client's 600s read timeout is far too long for an on-request +# guardrail; bound the compress call so a stall hits the fail policy quickly. +_COMPRESS_TIMEOUT_SECONDS = 60.0 +_SOURCE_TAG = "integration:litellm" +# Request-content fields the compression_params passthrough must never +# override — they carry the actual message content/queries being compressed. +_RESERVED_COMPRESSION_PARAM_KEYS = frozenset({"context", "query", "inputs"}) +_BLOCKED_METADATA_HOSTS = frozenset( + { + "metadata.google.internal", + "metadata.goog", + "metadata.azure.com", + "metadata.azure.internal", + } +) +_BLOCKED_METADATA_IPS = frozenset( + ipaddress.ip_address(ip) for ip in ("169.254.169.254", "fd00:ec2::254", "100.100.100.200", "168.63.129.16") +) + + +def _parse_ip_literal(host: str) -> ipaddress.IPv4Address | ipaddress.IPv6Address | None: + """Parse ``host`` as an IP literal, covering the alternate spellings the + socket layer accepts (decimal/hex single-integer IPv4, IPv4-mapped IPv6) + so a blocked address cannot be smuggled past a string comparison.""" + try: + addr = ipaddress.ip_address(host) + except ValueError: + try: + addr = ipaddress.ip_address(int(host, 0)) + except (TypeError, ValueError): + return None + if isinstance(addr, ipaddress.IPv6Address) and addr.ipv4_mapped is not None: + return addr.ipv4_mapped + return addr + + +def _validate_api_base(url: str) -> str: + """Return ``url`` if it passes basic outbound-target checks, else raise. + + Best-effort defense in depth for a mis/maliciously-configured ``api_base``: + rejects non-http(s) schemes and cloud-metadata IPs/hosts (incl. alternate IP + encodings); private ranges are allowed for on-prem deployments. NOT a complete + SSRF control — no DNS resolution, and the shared client follows redirects and + re-resolves DNS (TOCTOU / rebinding); ``api_base`` is trusted operator config, + so this is an accepted limitation. + """ + parsed = urlparse(url) + if parsed.scheme not in ("http", "https"): + raise ValueError(f"Compresr guardrail api_base must be http or https, got scheme={parsed.scheme!r}") + host = (parsed.hostname or "").lower() + if not host: + raise ValueError("Compresr guardrail api_base has no host") + ip_literal = _parse_ip_literal(host) + if host in _BLOCKED_METADATA_HOSTS or (ip_literal is not None and ip_literal in _BLOCKED_METADATA_IPS): + raise ValueError(f"Compresr guardrail api_base {host!r} is a blocked cloud-metadata host") + return url + + +def _is_str_object_dict(value: object) -> TypeGuard[dict[str, object]]: # guard-ok: isinstance narrows correctly; predicate is trivially correct # fmt: skip + return isinstance(value, dict) + + +def _is_object_list(value: object) -> TypeGuard[list[object]]: # guard-ok: isinstance narrows correctly; predicate is trivially correct # fmt: skip + return isinstance(value, list) + + +def _content_to_text(content: object) -> str: + """Collapse a message ``content`` (str or list-of-parts) to plain text. + + For the multimodal list shape, joins ``{type: "text", text: ...}`` parts + with blank-line separators; non-text parts are ignored. + """ + if isinstance(content, str): + return content + if isinstance(content, list): + parts: list[str] = [] + for part in content: + if isinstance(part, dict) and part.get("type") == "text": + text = part.get("text") + if isinstance(text, str): + parts.append(text) + return "\n\n".join(parts) + return "" + + +def _replace_text_in_content(content: object, new_text: str) -> object: + """Write ``new_text`` back into a ``content`` value, preserving shape. + + ``str`` content is replaced directly. For list-of-parts content the first + text part carries ``new_text``, later text parts are dropped, and + non-text parts (images, audio, files) pass through untouched. + """ + if isinstance(content, str): + return new_text + if isinstance(content, list): + out: list[object] = [] + replaced = False + for part in content: + if isinstance(part, dict) and part.get("type") == "text": + if not replaced: + out.append({**part, "text": new_text}) + replaced = True + continue + out.append(part) + if not replaced: + out.insert(0, {"type": "text", "text": new_text}) + return out + return new_text + + +def _render_tool_intent(fn: dict[str, object]) -> str: + name = str(fn.get("name") or "").strip() + args = fn.get("arguments") + if isinstance(args, dict): + try: + args_str = json.dumps(args, separators=(",", ":")) + except (TypeError, ValueError): + args_str = str(args) + else: + args_str = str(args).strip() if args is not None else "" + if name and args_str: + return f"{name}: {args_str}" + return name or args_str + + +def _query_for_target(messages: list[dict[str, object]], target_idx: int, fallback: str) -> str: + """Query used to compress ``messages[target_idx]``. + + Tool/function outputs are compressed against the intent of the tool call + that produced them (found via ``tool_call_id`` on a prior assistant + message); everything else uses the last user message. + """ + msg = messages[target_idx] + if msg.get("role") not in ("tool", "function"): + return fallback + + tool_call_id = msg.get("tool_call_id") + fn_name = msg.get("name") + for j in range(target_idx - 1, -1, -1): + prev = messages[j] + if prev.get("role") != "assistant": + continue + tool_calls = prev.get("tool_calls") + if isinstance(tool_calls, list): + for tc in tool_calls: + if not isinstance(tc, dict): + continue + if tool_call_id and tc.get("id") == tool_call_id: + fn = tc.get("function") + intent = _render_tool_intent(fn if isinstance(fn, dict) else {}) + if intent: + return intent + # Legacy function_call fallback: require a name match, else an earlier + # function_call turn would attribute the wrong intent. + fc = prev.get("function_call") + if isinstance(fc, dict) and fn_name and fc.get("name") == fn_name: + intent = _render_tool_intent(fc) + if intent: + return intent + return fallback + + +def _safe_int(value: object) -> int: + """Parse a token-stat field defensively. + + A malformed-but-200 response must not raise here: ``_call_compress`` has + already returned successfully, so the fail_open/fail_closed decision is + behind us. A bare ``int()`` on a non-numeric field would surface as an + unhandled 500 even when ``fail_open`` is configured. + """ + try: + return int(value) if value is not None else 0 + except (TypeError, ValueError): + return 0 + + +def _safe_response_text(response: object, limit: int = 500) -> str: + """Read a response body for error logging without letting the read itself + raise. A corrupt ``Content-Encoding`` makes ``httpx``'s ``.text`` raise a + ``DecodingError``; if that happened while building a failure detail it would + turn an already-handled error into an unhandled 500.""" + try: + text = getattr(response, "text", "") + except httpx.DecodingError: + return "" + return (text or "")[:limit] + + +def _content_hash(text: str) -> str: + # surrogatepass so a lone surrogate in untrusted content (valid via a JSON + # \uXXXX escape) hashes instead of raising past the fail policy. + return hashlib.sha256(text.encode("utf-8", "surrogatepass")).hexdigest()[:24] + + +def _entry_bytes(originals: dict[str, str]) -> int: + """UTF-8 byte size of one recovery-store entry (surrogatepass, like _content_hash).""" + return sum(len(value.encode("utf-8", "surrogatepass")) for value in originals.values()) + + +def _display_hash(hash_value: str) -> str: + """Bound a model-supplied hash for logs/fallback text. A real marker hash is + 24 hex chars; a prompt-injected ``compresr_retrieve`` call could pass a huge + or control-character-laden string, so strip non-printables (no forged log + lines / ANSI escapes) and cap length before echoing into logs and the + conversation.""" + printable = "".join(ch for ch in hash_value if ch.isprintable()) + return printable if len(printable) <= 32 else f"{printable[:32]}…" + + +def _recovery_marker(hash_value: str) -> str: + return ( + f"\n\n[compresr hash={hash_value}: parts of this content were compressed " + f"away. If you need the full original, call the " + f"{COMPRESR_RETRIEVE_TOOL_NAME} tool with this hash.]" + ) + + +def _build_compresr_retrieve_tool() -> dict[str, object]: + return { + "type": "function", + "function": { + "name": COMPRESR_RETRIEVE_TOOL_NAME, + "description": ( + "Retrieve the original, uncompressed content behind a Compresr " + "compression marker. Call this when a compression marker's hash " + "points at content you need in full." + ), + "parameters": { + "type": "object", + "properties": { + "hash": { + "type": "string", + "description": "The 24-character hex hash from the compression marker.", + }, + }, + "required": ["hash"], + }, + }, + } + + +def has_compresr_retrieve_tool(tools: object) -> bool: + return has_tool_with_name(tools, COMPRESR_RETRIEVE_TOOL_NAME) + + +def _merge_retrieve_tool(existing_tools: object) -> list[object] | None: + """The request's tools plus the retrieve tool, or None when the incoming + shape is not a list (leave the caller's tools untouched; markers stay + inert text).""" + if existing_tools is not None and not isinstance(existing_tools, list): + return None + retrieve_tool = _build_compresr_retrieve_tool() + if existing_tools is None: + return [retrieve_tool] + if has_compresr_retrieve_tool(existing_tools): + return list(existing_tools) + return list(existing_tools) + [retrieve_tool] + + +def _extract_compresr_tool_calls(response: object) -> list[dict[str, object]]: + return [ + {"id": tc.get("id"), "type": "function", "name": tc.get("name"), "arguments": tc.get("arguments", {})} + for tc in get_tool_calls_from_response(response) + if tc.get("name") == COMPRESR_RETRIEVE_TOOL_NAME + ] + + +def _resolve_call_id(logging_obj: object) -> str | None: + """The call id from the framework logging object. + + This value ultimately derives from the client-settable ``x-litellm-call-id`` + header and is echoed back in responses, so it is NOT a trust boundary on its + own — ``_scoped_store_key`` prefixes it with the caller's virtual-key hash to + partition the recovery store per tenant. Request-body/kwargs call ids are + deliberately not consulted here. + """ + logging_call_id = getattr(logging_obj, "litellm_call_id", None) + if isinstance(logging_call_id, str) and logging_call_id: + return logging_call_id + return None + + +def _caller_scope(logging_obj: object) -> str: + """The caller's virtual-key hash, used to partition the recovery store. + + Trust is anchored on the ``UserAPIKeyAuth`` object the proxy sets + server-side (``metadata.user_api_key_auth``, litellm_pre_call_utils). Its + ``api_key`` is the hash of the authenticated key. Both metadata spellings + are scanned (``/v1/messages`` and ``/v1/responses`` carry it under + ``litellm_metadata``), but the bare ``user_api_key`` *string* is never + trusted on its own: a JSON request body can place one in the client-supplied + ``metadata`` field, which is only sanitized on the route's canonical + container. Returns "" when the proxy runs without per-key auth, in which case + all traffic is a single trust domain and the call id alone suffices. + """ + details = getattr(logging_obj, "model_call_details", None) + if not _is_str_object_dict(details): + return "" + litellm_params = details.get("litellm_params") + for container in (litellm_params, details): + if not _is_str_object_dict(container): + continue + for meta_key in ("metadata", "litellm_metadata"): + metadata = container.get(meta_key) + if not _is_str_object_dict(metadata): + continue + auth = metadata.get("user_api_key_auth") + if isinstance(auth, UserAPIKeyAuth) and isinstance(auth.api_key, str) and auth.api_key: + return auth.api_key + return "" + + +def _scoped_store_key(logging_obj: object) -> str | None: + """Key for the recovery store: caller identity plus framework call id. + + Keying on the call id alone is unsafe: it comes from the client-settable + ``x-litellm-call-id`` header and is echoed back in responses, so one caller + could read or evict another's originals by reusing the id. Prefixing the + unforgeable virtual-key hash binds each entry to the tenant that created it. + Returns None when there is no call id, which disables recovery for the call. + """ + call_id = _resolve_call_id(logging_obj) + if call_id is None: + return None + scope = _caller_scope(logging_obj) + return f"{scope}\x00{call_id}" if scope else call_id + + +def _is_responses_api_response(response: object) -> bool: + return isinstance(get_attribute_or_key(response, "output", None), list) + + +def _is_anthropic_messages_response(response: object) -> bool: + return isinstance(get_attribute_or_key(response, "content", None), list) + + +def _assistant_text_from_response(response: object) -> str | None: + """The assistant's natural-language text from a model response, across chat, + Anthropic, and Responses shapes. Preserved when the turn is rebuilt for the + retrieval follow-up so the model's reasoning is not lost.""" + choices = get_attribute_or_key(response, "choices", None) + if isinstance(choices, list) and choices: + message = get_attribute_or_key(choices[0], "message", None) + if message is not None: + text = _content_to_text(get_attribute_or_key(message, "content", None)) + if text: + return text + content = get_attribute_or_key(response, "content", None) + if isinstance(content, list): + parts = [ + text + for block in content + if get_attribute_or_key(block, "type", None) == "text" + for text in (get_attribute_or_key(block, "text", None),) + if isinstance(text, str) and text + ] + if parts: + return "".join(parts) + output = get_attribute_or_key(response, "output", None) + if isinstance(output, list): + parts = [] + for item in output: + if get_attribute_or_key(item, "type", None) != "message": + continue + item_content = get_attribute_or_key(item, "content", None) + if not isinstance(item_content, list): + continue + for chunk in item_content: + if get_attribute_or_key(chunk, "type", None) == "output_text": + text = get_attribute_or_key(chunk, "text", None) + if isinstance(text, str) and text: + parts.append(text) + if parts: + return "".join(parts) + return None + + +def _build_assistant_message_from_response( + response: object, + retrieved: list[tuple[dict[str, object], str]], +) -> dict[str, object]: + """Rebuild the chat-completions assistant turn for the retrieval follow-up. + + Only the ``compresr_retrieve`` calls are echoed, each answered by a tool + result below. Other tool calls made in the same turn are omitted on purpose: + the follow-up re-runs the model with the recovered content so it re-plans + them. Echoing them would leave tool_calls with no matching tool result and + the provider would reject the request. + """ + return { + "role": "assistant", + "content": _assistant_text_from_response(response), + "tool_calls": [ + { + "id": tool_call.get("id"), + "type": "function", + "function": { + "name": tool_call.get("name"), + "arguments": json.dumps(tool_call.get("arguments", {})), + }, + } + for tool_call, _ in retrieved + ], + } + + +def _build_anthropic_followup_messages( + response: object, + retrieved: list[tuple[dict[str, object], str]], +) -> list[dict[str, object]]: + """Anthropic requires the tool_use block echoed back in an assistant + message paired with a tool_result block keyed by the same tool_use_id. The + assistant text is preserved; non-retrieve tool calls are re-planned by the + follow-up (see _build_assistant_message_from_response).""" + assistant_content: list[dict[str, object]] = [] + text = _assistant_text_from_response(response) + if text: + assistant_content.append({"type": "text", "text": text}) + assistant_content.extend( + { + "type": "tool_use", + "id": tool_call.get("id"), + "name": tool_call.get("name"), + "input": tool_call.get("arguments", {}), + } + for tool_call, _ in retrieved + ) + assistant_message: dict[str, object] = {"role": "assistant", "content": assistant_content} + user_message: dict[str, object] = { + "role": "user", + "content": [ + {"type": "tool_result", "tool_use_id": tool_call.get("id"), "content": content} + for tool_call, content in retrieved + ], + } + return [assistant_message, user_message] + + +def _build_responses_followup_items( + response: object, + retrieved: list[tuple[dict[str, object], str]], +) -> list[dict[str, object]]: + """The Responses API requires the model's function_call echoed back paired + with a function_call_output keyed by the same call_id. The assistant text is + preserved; non-retrieve tool calls are re-planned by the follow-up.""" + items: list[dict[str, object]] = [] + text = _assistant_text_from_response(response) + if text: + items.append({"role": "assistant", "content": text}) + for tool_call, content in retrieved: + call_id = tool_call.get("id") + items.append( + { + "type": "function_call", + "call_id": call_id, + "name": tool_call.get("name"), + "arguments": json.dumps(tool_call.get("arguments", {})), + } + ) + items.append({"type": "function_call_output", "call_id": call_id, "output": content}) + return items + + +@dataclass +class _CompressionResult: + """Outcome of applying compression results to a message list.""" + + compressed_messages: list[dict[str, object]] + originals: dict[str, str] = field(default_factory=dict) + # original text -> compressed text, plus the machinery the Responses `texts` + # mirror needs to replace only where it is unambiguous. + text_replacements: dict[str, str] = field(default_factory=dict) + replaced_text_counts: dict[str, int] = field(default_factory=dict) + ambiguous_texts: set[str] = field(default_factory=set) + messages_compressed: int = 0 + tokens_before: int = 0 + tokens_after: int = 0 + + +class CompresrGuardrail(CustomGuardrail): + def __init__( + self, + api_base: str | None = None, + api_key: str | None = None, + model: str | None = None, + target_compression_ratio: float | None = None, + coarse: bool | None = None, + min_chars_to_compress: int | None = None, + compress_tool_outputs: bool | None = None, + compress_system: bool | None = None, + compress_history: bool | None = None, + compress_last_user: bool | None = None, + enable_retrieval: bool | None = None, + guardrail_name: str | None = None, + event_hook: GuardrailEventHooks | list[GuardrailEventHooks] | Mode | None = None, + default_on: bool = False, + unreachable_fallback: str | None = None, + max_bytes_per_call: int | None = None, + allow_bypass_header: bool | None = None, + dynamic: bool | None = None, + dynamic_min_ratio: float | None = None, + dynamic_max_ratio: float | None = None, + compression_params: dict[str, object] | None = None, + ): + raw_api_base = (api_base or get_secret_str("COMPRESR_API_BASE") or DEFAULT_API_BASE).rstrip("/") + self.compresr_api_base = _validate_api_base(raw_api_base) + self.compresr_api_key = api_key or get_secret_str("COMPRESR_API_KEY") + if not self.compresr_api_key: + raise ValueError( + "Compresr guardrail requires an API key. Set `api_key` in the " + "guardrail config or the COMPRESR_API_KEY env var." + ) + self.compression_model = model or DEFAULT_COMPRESSION_MODEL + self.target_compression_ratio = ( + DEFAULT_TARGET_COMPRESSION_RATIO if target_compression_ratio is None else target_compression_ratio + ) + self.coarse = True if coarse is None else coarse + self.min_chars_to_compress = ( + DEFAULT_MIN_CHARS_TO_COMPRESS if min_chars_to_compress is None else min_chars_to_compress + ) + self.compress_tool_outputs = True if compress_tool_outputs is None else compress_tool_outputs + self.compress_system = False if compress_system is None else compress_system + self.compress_history = False if compress_history is None else compress_history + self.compress_last_user = False if compress_last_user is None else compress_last_user + self.enable_retrieval = True if enable_retrieval is None else enable_retrieval + self.unreachable_fallback: Literal["fail_closed", "fail_open"] = ( + "fail_open" if unreachable_fallback == "fail_open" else "fail_closed" + ) + self.max_bytes_per_call = _DEFAULT_MAX_BYTES_PER_CALL if max_bytes_per_call is None else max_bytes_per_call + if self.max_bytes_per_call < 0: + raise ValueError("max_bytes_per_call must be >= 0 (0 disables the cap; positive values enforce it)") + self.allow_bypass_header = False if allow_bypass_header is None else allow_bypass_header + # Dynamic (adaptive) compression — latte_v2 only, on by default: the server + # picks the ratio per input instead of honoring target_compression_ratio. + self.dynamic = True if dynamic is None else dynamic + self.dynamic_min_ratio = dynamic_min_ratio + self.dynamic_max_ratio = dynamic_max_ratio + # Passthrough of extra compression params forwarded verbatim, so a new + # Compresr feature works without changing this guardrail. Named fields win; + # request-content fields are stripped. + reserved_keys = _RESERVED_COMPRESSION_PARAM_KEYS.intersection(compression_params or {}) + if reserved_keys: + verbose_proxy_logger.warning( + "Compresr: ignoring reserved compression_params keys %s", sorted(reserved_keys) + ) + self.compression_params: dict[str, object] = { + k: v for k, v in (compression_params or {}).items() if k not in _RESERVED_COMPRESSION_PARAM_KEYS + } + self.async_handler = get_async_httpx_client( + llm_provider=httpxSpecialProvider.GuardrailCallback, + ) + self._originals_by_call_id: OrderedDict[str, tuple[dict[str, str], float]] = OrderedDict() + # Running byte size of the store, kept in sync to enforce the global cap cheaply. + self._store_total_bytes = 0 + # Rate-limits the "recovery skipped, no auth scope" warning so an ongoing + # misconfiguration stays visible without flooding hot-path logs. + self._no_scope_warning_expiry = 0.0 + if self.enable_retrieval: + verbose_proxy_logger.warning( + "Compresr: enable_retrieval is on; the recovery store is per-process. " + "For multi-worker deployments, set enable_retrieval=false or run with --workers 1." + ) + super().__init__( # pyright: ignore[reportUnknownMemberType] # CustomGuardrail.__init__ is untyped + guardrail_name=guardrail_name, + event_hook=event_hook, + default_on=default_on, + ) + + def _should_bypass(self, request_data: dict) -> bool: + if not self.allow_bypass_header: + return False + psr = request_data.get("proxy_server_request") + if not _is_str_object_dict(psr): + return False + headers = psr.get("headers") + if not _is_str_object_dict(headers): + return False + return str(headers.get(BYPASS_HEADER)).lower() == "true" + + def _request_headers(self) -> dict[str, str]: + return { + "Content-Type": "application/json", + "X-API-Key": self.compresr_api_key or "", + } + + def _handle_compress_failure(self, error: str, log_detail: dict[str, object]) -> None: + """fail_open logs and returns (caller forwards uncompressed); + fail_closed raises. ``log_detail`` may include upstream response bodies + and is written only to server logs; the raised ``HTTPException`` carries + a generic message so a malicious ``api_base`` cannot exfiltrate response + bytes through the client-visible error.""" + if self.unreachable_fallback == "fail_open": + verbose_proxy_logger.warning( + "Compresr: %s; fail_open configured, forwarding request uncompressed. detail=%s", + error, + log_detail, + ) + return + verbose_proxy_logger.error("Compresr: %s. detail=%s", error, log_detail) + raise HTTPException(status_code=502, detail={"error": error}) + + def _evict_oldest(self) -> None: + """Drop the front (oldest) entry and decrement the running byte total.""" + _key, (evicted, _expiry) = self._originals_by_call_id.popitem(last=False) + self._store_total_bytes -= _entry_bytes(evicted) + + def _prune_originals(self) -> None: + # Insertion order == expiry order (shared TTL); prune from the front. + now = time.monotonic() + store = self._originals_by_call_id + while store and store[next(iter(store))][1] <= now: + self._evict_oldest() + while len(store) > _MAX_TRACKED_CALLS: + self._evict_oldest() + # Global byte budget; keep the most-recent entry so the current call's + # originals survive (a single call is already bounded by max_bytes_per_call). + while len(store) > 1 and self._store_total_bytes > _MAX_TOTAL_STORE_BYTES: + self._evict_oldest() + + def _existing_originals(self, store_key: str | None) -> dict[str, str]: + """Originals already stored under this key, so the per-call byte budget + can account for an earlier turn that reused the store key.""" + if store_key is None: + return {} + return self._originals_by_call_id.get(store_key, ({}, 0.0))[0] + + def _store_originals(self, store_key: str, originals: dict[str, str]) -> None: + existing, _ = self._originals_by_call_id.get(store_key, ({}, 0.0)) + merged = self._bound_call_bytes({**existing, **originals}) + # Keep the running total in sync: drop the overwritten entry, add the new one. + self._store_total_bytes += _entry_bytes(merged) - _entry_bytes(existing) + self._originals_by_call_id[store_key] = ( + merged, + time.monotonic() + _ORIGINALS_TTL_SECONDS, + ) + self._originals_by_call_id.move_to_end(store_key) + self._prune_originals() + + def _bound_call_bytes(self, merged: dict[str, str]) -> dict[str, str]: + """Drop oldest entries (dict insertion order) until the aggregate byte + size fits ``self.max_bytes_per_call``. Prevents one call with many + large tool outputs from growing proxy memory without bound.""" + if self.max_bytes_per_call <= 0: + return merged + total = _entry_bytes(merged) + if total <= self.max_bytes_per_call: + return merged + bounded = dict(merged) + for key in list(bounded.keys()): + if total <= self.max_bytes_per_call: + break + total -= len(bounded[key].encode("utf-8", "surrogatepass")) + del bounded[key] + verbose_proxy_logger.warning("Compresr: originals-store byte cap hit, evicted hash=%s", key) + return bounded + + def _retrieve_original(self, store_key: str | None, hash_value: str) -> str | None: + """Stored original for a marker hash, or None if not issued for this + request (unknown, expired, or from another caller's scope).""" + if store_key: + originals, expiry = self._originals_by_call_id.get(store_key, ({}, 0.0)) + if expiry > time.monotonic() and hash_value in originals: + return originals[hash_value] + verbose_proxy_logger.warning( + "Compresr retrieve: rejecting hash=%s (not issued for this request, or expired)", + _display_hash(hash_value), + ) + return None + + def _resolve_retrievals( + self, store_key: str | None, tool_calls: list[dict[str, object]] + ) -> tuple[list[tuple[dict[str, object], str]], bool]: + """Resolve compresr_retrieve calls to (call, result_text) pairs, deduping + repeated hashes and capping the count so the follow-up cannot be amplified. + The bool is True iff at least one call resolved to real stored content.""" + retrieved: list[tuple[dict[str, object], str]] = [] + seen: set[str] = set() + resolved_any = False + for idx, tc in enumerate(tool_calls): + arguments = tc.get("arguments", {}) + hash_value = str(arguments.get("hash", "")) if isinstance(arguments, dict) else "" + if idx >= _MAX_RETRIEVALS_PER_LOOP: + result = "[compresr: retrieval limit reached for this turn]" + elif hash_value in seen: + result = "[compresr: already retrieved above for this hash]" + else: + content = self._retrieve_original(store_key, hash_value) + if content is None: + result = f"[compresr: hash={_display_hash(hash_value)} not found, expired, or not issued for this request]" + else: + seen.add(hash_value) + resolved_any = True + result = content + verbose_proxy_logger.debug("Compresr retrieve: hash=%s -> %d chars", _display_hash(hash_value), len(result)) + retrieved.append((tc, result)) + return retrieved, resolved_any + + async def _call_compress( + self, + contexts: list[str], + queries: list[str], + ) -> list[dict[str, object]] | None: + """Compress ``contexts`` (query-aware). Returns one result dict per + context, or None when the service failed and fail_open applies.""" + common: dict[str, object] = { + # Passthrough first so the named fields below always win on collision. + **self.compression_params, + "compression_model_name": self.compression_model, + "target_compression_ratio": self.target_compression_ratio, + "coarse": self.coarse, + "dynamic": self.dynamic, + "source": _SOURCE_TAG, + } + # Only send the bounds the operator actually set; otherwise let the + # server apply its own floor/ceiling. + if self.dynamic_min_ratio is not None: + common["dynamic_min_ratio"] = self.dynamic_min_ratio + if self.dynamic_max_ratio is not None: + common["dynamic_max_ratio"] = self.dynamic_max_ratio + if len(contexts) == 1: + url = f"{self.compresr_api_base}/api/compress/question-specific/" + payload: dict[str, object] = { + "context": contexts[0], + "query": queries[0], + **common, + } + else: + url = f"{self.compresr_api_base}/api/compress/question-specific/batch" + payload = { + "inputs": [{"context": ctx, "query": q} for ctx, q in zip(contexts, queries)], + **common, + } + + try: + raw_response: HttpxResponse | None = await self.async_handler.post( # pyright: ignore[reportUnknownMemberType] # AsyncHTTPHandler.post is untyped + url=url, + json=payload, + headers=self._request_headers(), + timeout=_COMPRESS_TIMEOUT_SECONDS, + ) + except asyncio.CancelledError: + raise + except httpx.HTTPStatusError as e: + # The shared handler calls raise_for_status(), so a non-2xx reply arrives + # here as an error carrying the upstream body + our API key header; route + # it through the fail policy so none of that reaches the client. + resp = getattr(e, "response", None) + self._handle_compress_failure( + "Compresr compression service returned an error", + { + "status_code": getattr(resp, "status_code", None), + "body": _safe_response_text(resp), + }, + ) + return None + except (httpx.RequestError, litellm.Timeout) as e: + # Every request-side httpx failure is a RequestError; route the whole + # class through the fail policy so none escapes as a 500 under fail_open. + # (HTTPStatusError is handled above and is not a RequestError.) + self._handle_compress_failure( + "Compresr compression service request failed", + {"detail": str(e)}, + ) + return None + if raw_response is None or not 200 <= raw_response.status_code < 300: + self._handle_compress_failure( + "Compresr compression service returned an error", + { + "status_code": getattr(raw_response, "status_code", None), + "body": _safe_response_text(raw_response), + }, + ) + return None + + try: + body: object = raw_response.json() + except (ValueError, httpx.DecodingError, RecursionError): + # RecursionError: a deeply nested JSON body overflows the parser; + # route it through the fail policy rather than let it escape as a 500. + self._handle_compress_failure( + "Compresr compression service returned an unreadable response", + {"body": _safe_response_text(raw_response)}, + ) + return None + if not _is_str_object_dict(body) or not _is_str_object_dict(body.get("data")): + self._handle_compress_failure( + "Compresr compression service returned unexpected response shape", + {"body": _safe_response_text(raw_response)}, + ) + return None + data: dict[str, object] = body["data"] # pyright: ignore[reportAssignmentType] # dict-guarded above; subscript does not narrow + + if len(contexts) == 1: + return [data] + results = data.get("results") + if ( + not _is_object_list(results) + or len(results) != len(contexts) + or not all(_is_str_object_dict(r) for r in results) + ): + # Anything but a 1:1 dict-per-context mapping would misalign + # results with their target messages. + self._handle_compress_failure( + "Compresr batch response missing or mismatched 'results'", + {"expected": len(contexts), "got": len(results) if _is_object_list(results) else None}, + ) + return None + return results # pyright: ignore[reportReturnType] # every element dict-checked above; list[object] does not narrow + + def _select_targets(self, messages: list[dict[str, object]], query_idx: int | None) -> list[int]: + """Indices of messages whose text content should be compressed.""" + targets: list[int] = [] + for idx, msg in enumerate(messages): + if idx == query_idx and not self.compress_last_user: + continue + role = msg.get("role") + if role in ("tool", "function"): + if not self.compress_tool_outputs: + continue + elif role == "system": + if not self.compress_system: + continue + elif role == "user": + if idx != query_idx and not self.compress_history: + continue + else: + continue + if len(_content_to_text(msg.get("content"))) < self.min_chars_to_compress: + continue + targets.append(idx) + return targets + + @staticmethod + def _extract_fallback_query( + messages: list[dict[str, object]], + ) -> tuple[str, int | None]: + for idx in range(len(messages) - 1, -1, -1): + if messages[idx].get("role") == "user": + return _content_to_text(messages[idx].get("content")), idx + return "", None + + def _apply_compression_results( + self, + messages: list[dict[str, object]], + targets: list[int], + contexts: list[str], + results: list[dict[str, object]], + recovery_enabled: bool, + existing_originals: dict[str, str] | None = None, + ) -> _CompressionResult: + """Write each compression result into a copy of ``messages``. + + A result is a real compression only when it is a non-empty string that + differs from the original; identical text is treated as a no-op so an + untouched request is not needlessly rewritten downstream. + """ + out = _CompressionResult(compressed_messages=list(messages)) + existing = existing_originals or {} + cap = self.max_bytes_per_call + # Seed with what is already stored under this store key: markers are + # attached only while the store (existing + this call's originals) stays + # within the cap, so _store_originals never has to evict a hash this call + # just shipped a marker for -- including on a later turn that reuses the + # store key. A hash already stored (or repeated here) costs no new bytes. + recovery_bytes = _entry_bytes(existing) + for target_idx, original_text, result in zip(targets, contexts, results): + compressed_text = result.get("compressed_context") + if not isinstance(compressed_text, str) or not compressed_text or compressed_text == original_text: + continue + out.messages_compressed += 1 + if recovery_enabled: + hash_value = _content_hash(original_text) + already_stored = hash_value in existing or hash_value in out.originals + new_bytes = 0 if already_stored else len(original_text.encode("utf-8", "surrogatepass")) + if cap <= 0 or recovery_bytes + new_bytes <= cap: + recovery_bytes += new_bytes + out.originals[hash_value] = original_text + compressed_text += _recovery_marker(hash_value) + previous = out.text_replacements.get(original_text) + if previous is not None and previous != compressed_text: + # Two targets with identical text but different query-specific + # compressions; a value-keyed replacement cannot tell them apart. + out.ambiguous_texts.add(original_text) + else: + out.text_replacements[original_text] = compressed_text + out.replaced_text_counts[original_text] = out.replaced_text_counts.get(original_text, 0) + 1 + original_msg = out.compressed_messages[target_idx] + out.compressed_messages[target_idx] = { + **original_msg, + "content": _replace_text_in_content(original_msg.get("content"), compressed_text), + } + out.tokens_before += _safe_int(result.get("original_tokens")) + out.tokens_after += _safe_int(result.get("compressed_tokens")) + return out + + @staticmethod + def _mirror_texts_channel(input_texts: object, applied: _CompressionResult) -> list[object] | None: + """Compressed content mirrored into the Responses `texts` channel. + + The chat/Anthropic handlers round-trip ``structured_messages``; the + Responses translation cannot rebuild its input from chat messages and + instead writes back through ``texts``. This matches by value, so a + replacement is applied only when it is unambiguous: one compression per + text, and every occurrence in ``texts`` accounted for by a compressed + target. Anything else is left uncompressed rather than risk a wrong or + out-of-policy replacement. Returns None when nothing safe applies. + """ + if not applied.text_replacements or not isinstance(input_texts, list): + return None + counts = Counter(text for text in input_texts if isinstance(text, str)) + safe = { + text: replacement + for text, replacement in applied.text_replacements.items() + if text not in applied.ambiguous_texts and counts.get(text) == applied.replaced_text_counts.get(text) + } + if not safe: + return None + return [safe.get(text, text) if isinstance(text, str) else text for text in input_texts] + + @log_guardrail_information + async def apply_guardrail( + self, + inputs: GenericGuardrailAPIInputs, + request_data: dict, + input_type: Literal["request", "response"], + logging_obj: LiteLLMLoggingObj | None = None, + ) -> GenericGuardrailAPIInputs: + if input_type != "request": + return inputs + + if self._should_bypass(request_data): + verbose_proxy_logger.debug("Compresr: %s header set; skipping compression", BYPASS_HEADER) + return inputs + + structured_messages = inputs.get("structured_messages") + if not _is_object_list(structured_messages) or not structured_messages: + return inputs + messages = [m for m in structured_messages if _is_str_object_dict(m)] + if len(messages) != len(structured_messages): + return inputs + + fallback_query, query_idx = self._extract_fallback_query(messages) + targets: list[int] = [] + queries: list[str] = [] + for idx in self._select_targets(messages, query_idx): + query = _query_for_target(messages, idx, fallback_query) + # latte models require a non-empty query; leave targets we cannot + # derive one for uncompressed rather than erroring. + if not query.strip(): + continue + targets.append(idx) + queries.append(query) + if not targets: + verbose_proxy_logger.debug("Compresr: no messages eligible for compression") + return inputs + + contexts = [_content_to_text(messages[idx].get("content")) for idx in targets] + + start_time = time.monotonic() + results = await self._call_compress(contexts=contexts, queries=queries) + end_time = time.monotonic() + if results is None: # service failed, fail_open configured + return inputs + + # Recovery needs a per-tenant scope; without per-key auth the key would fall + # back to the client-settable call id (cross-tenant reads), so skip it. + store_key = _scoped_store_key(logging_obj) + scope = _caller_scope(logging_obj) + recovery_enabled = self.enable_retrieval and store_key is not None and bool(scope) + if self.enable_retrieval and not scope and time.monotonic() >= self._no_scope_warning_expiry: + # Surface the silent no-recovery case (compressed, but no auth scope + # to inject the retrieve tool), re-warning once per interval. + self._no_scope_warning_expiry = time.monotonic() + _NO_SCOPE_WARNING_INTERVAL_SECONDS + verbose_proxy_logger.warning( + "Compresr: enable_retrieval is on but this request has no per-key auth scope; " + "compressing without recovery (compresr_retrieve tool not injected). " + "Configure virtual-key auth to enable recovery." + ) + + existing_originals = self._existing_originals(store_key) + applied = self._apply_compression_results( + messages, targets, contexts, results, recovery_enabled, existing_originals + ) + if applied.messages_compressed == 0: + # Nothing replaced: return the original inputs object (handlers detect + # edits by identity; a fresh list forces write-back that strips Anthropic + # cache_control from thinking blocks). + verbose_proxy_logger.debug("Compresr: service returned no compressed content; request unchanged") + return inputs + + stats: dict[str, object] = { + "messages_compressed": applied.messages_compressed, + "tokens_before": applied.tokens_before, + "tokens_after": applied.tokens_after, + "tokens_saved": applied.tokens_before - applied.tokens_after, + "compression_model": self.compression_model, + } + verbose_proxy_logger.debug( + "Compresr: compressed %s message(s), %s -> %s tokens", + applied.messages_compressed, + applied.tokens_before, + applied.tokens_after, + ) + self.add_standard_logging_guardrail_information_to_request_data( + guardrail_json_response=stats, + request_data=request_data, + guardrail_status="success", + guardrail_provider="compresr", + start_time=start_time, + end_time=end_time, + duration=end_time - start_time, + ) + + compressed_inputs: dict[str, object] = {**inputs, "structured_messages": applied.compressed_messages} + mirrored_texts = self._mirror_texts_channel(inputs.get("texts"), applied) + if mirrored_texts is not None: + compressed_inputs["texts"] = mirrored_texts + + originals = applied.originals + if not recovery_enabled or not originals or store_key is None: + return compressed_inputs # pyright: ignore[reportReturnType] # plain dicts satisfy AllMessageValues at runtime + + self._store_originals(store_key, originals) + + merged_tools = _merge_retrieve_tool(inputs.get("tools")) + if merged_tools is not None: + compressed_inputs["tools"] = merged_tools + return compressed_inputs # pyright: ignore[reportReturnType] # plain dicts satisfy AllMessageValues at runtime + + async def async_should_run_agentic_loop( + self, + response: Any, + model: str, + messages: list[dict], + tools: list[dict] | None, + stream: bool, + custom_llm_provider: str, + kwargs: dict, + ) -> tuple[bool, dict]: + if not has_compresr_retrieve_tool(tools): + return False, {} + tool_calls = _extract_compresr_tool_calls(response) + if not tool_calls: + return False, {} + return True, {"tool_calls": tool_calls} + + async def async_build_agentic_loop_plan( + self, + tools: dict, + model: str, + messages: list[dict], + response: Any, + anthropic_messages_provider_config: Any, + anthropic_messages_optional_request_params: dict, + logging_obj: Any, + stream: bool, + kwargs: dict, + ) -> AgenticLoopPlan: + tool_calls: list[dict[str, object]] = tools.get("tool_calls", []) # pyright: ignore[reportAssignmentType] # gate hook builds this dict with list values only + + self._prune_originals() + store_key = _scoped_store_key(logging_obj) + retrieved, resolved_any = self._resolve_retrievals(store_key, tool_calls) + if not resolved_any: + # Nothing this guardrail stored resolved; skip the extra provider round-trip. + return AgenticLoopPlan(run_agentic_loop=False) + + if _is_responses_api_response(response): + follow_up_messages = list(messages) + _build_responses_followup_items(response, retrieved) + elif _is_anthropic_messages_response(response): + follow_up_messages = list(messages) + _build_anthropic_followup_messages(response, retrieved) + else: + assistant_message = _build_assistant_message_from_response(response, retrieved) + tool_results = [ + {"role": "tool", "tool_call_id": tc.get("id"), "content": content} for tc, content in retrieved + ] + follow_up_messages = list(messages) + [assistant_message] + tool_results + + anthropic_max = anthropic_messages_optional_request_params.get("max_tokens") + max_tokens: int | None = anthropic_max if anthropic_max is not None else kwargs.get("max_tokens") + optional_params_without_max_tokens = { + k: v for k, v in anthropic_messages_optional_request_params.items() if k != "max_tokens" + } + + full_model_name = model + if logging_obj is not None: + agentic_params = getattr(logging_obj, "model_call_details", {}).get("agentic_loop_params", {}) + candidate = agentic_params.get("model", model) + if isinstance(candidate, str) and candidate: + full_model_name = candidate + + return AgenticLoopPlan( + run_agentic_loop=True, + request_patch=AgenticLoopRequestPatch( + model=full_model_name, + messages=follow_up_messages, + max_tokens=max_tokens, + optional_params=optional_params_without_max_tokens, + kwargs=self._sanitized_follow_up_kwargs(kwargs), + ), + metadata={"tool_type": "compresr_retrieve"}, + ) + + def _sanitized_follow_up_kwargs(self, kwargs: dict) -> dict[str, object]: + """Copy of the request kwargs for the retrieval follow-up with other + guardrails' pre-call-executed markers stripped, so input guardrails + re-inspect the restored originals; only this guardrail's own marker is + kept, to avoid recompressing what it just retrieved.""" + out: dict[str, object] = { + k: v for k, v in kwargs.items() if not k.startswith("_compresr") and k != "litellm_logging_obj" + } + own_marker = self._pre_call_marker() + for meta_key in ("metadata", "litellm_metadata"): + meta = out.get(meta_key) + if not isinstance(meta, dict): + continue + executed = meta.get(PRE_CALL_EXECUTED_GUARDRAILS_KEY) + if not isinstance(executed, list): + continue + kept = [m for m in executed if own_marker is not None and m == own_marker] + out[meta_key] = ( + {**meta, PRE_CALL_EXECUTED_GUARDRAILS_KEY: kept} + if kept + else {k: v for k, v in meta.items() if k != PRE_CALL_EXECUTED_GUARDRAILS_KEY} + ) + return out + + @staticmethod + def get_config_model() -> type[GuardrailConfigModel[object]] | None: + from litellm.types.proxy.guardrails.guardrail_hooks.compresr import ( + CompresrGuardrailConfigModel, + ) + + return CompresrGuardrailConfigModel diff --git a/litellm/proxy/management_endpoints/team_endpoints.py b/litellm/proxy/management_endpoints/team_endpoints.py index 797f4600857..d267a3cac69 100644 --- a/litellm/proxy/management_endpoints/team_endpoints.py +++ b/litellm/proxy/management_endpoints/team_endpoints.py @@ -1621,6 +1621,7 @@ async def update_team( - allowed_passthrough_routes: Optional[List[str]] - List of allowed pass through routes for the team. - model_rpm_limit: Optional[Dict[str, int]] - The RPM (Requests Per Minute) limit per model for this team. Example: {"gpt-4": 100, "gpt-3.5-turbo": 200} - model_tpm_limit: Optional[Dict[str, int]] - The TPM (Tokens Per Minute) limit per model for this team. Example: {"gpt-4": 10000, "gpt-3.5-turbo": 20000} + - mcp_rpm_limit: Optional[Dict[str, int]] - Per-MCP-server RPM limit for this team, keyed by MCP server name (alias if set, else the configured name). Example: {"github": 100, "slack": 200}. Applied across all keys for this team. Example - update team TPM Limit - allowed_vector_store_indexes: Optional[List[dict]] - List of allowed vector store indexes for the key. Example - [{"index_name": "my-index", "index_permissions": ["write", "read"]}]. If specified, the key will only be able to use these specific vector store indexes. Create index, using `/v1/indexes` endpoint. - secret_manager_settings: Optional[dict] - Secret manager settings for the team. [Docs](https://docs.litellm.ai/docs/secret_managers/overview) diff --git a/litellm/proxy/management_endpoints/ui_sso.py b/litellm/proxy/management_endpoints/ui_sso.py index d8015bb8031..0475566192e 100644 --- a/litellm/proxy/management_endpoints/ui_sso.py +++ b/litellm/proxy/management_endpoints/ui_sso.py @@ -241,13 +241,34 @@ def _check_cli_sso_start_rate_limit( def _get_cli_sso_flow_or_raise(login_id: Optional[str], cache: DualCache) -> dict: + if isinstance(login_id, str) and login_id.startswith("sk-"): + raise HTTPException( + status_code=400, + detail=( + "Your litellm CLI is out of date and uses a login flow this proxy no longer supports. " + "Upgrade it with `pip install -U 'litellm[proxy]'` and run `litellm-proxy login` again." + ), + ) if not _is_valid_cli_sso_login_id(login_id): - raise HTTPException(status_code=400, detail="Invalid CLI login session") + raise HTTPException(status_code=400, detail="Invalid CLI login session id") cache_key = _get_cli_sso_flow_cache_key(cast(str, login_id)) flow = cache.get_cache(key=cache_key) if not isinstance(flow, dict) or "poll_secret_hash" not in flow: - raise HTTPException(status_code=400, detail="Invalid CLI login session") + verbose_proxy_logger.warning( + "CLI SSO login session not found in cache for login_id=%s. If the proxy runs multiple replicas, " + "a shared Redis cache (enable_redis_auth_cache: true) is required for CLI login to work.", + login_id, + ) + raise HTTPException( + status_code=400, + detail=( + "CLI login session not found or expired. Run `litellm-proxy login` again. " + "If this happens immediately after starting a login, the proxy is likely running multiple " + "replicas without a shared cache; configure Redis with `enable_redis_auth_cache: true` " + "so every replica can see the login session." + ), + ) return flow diff --git a/litellm/proxy/middleware/billable_request_metrics_middleware.py b/litellm/proxy/middleware/billable_request_metrics_middleware.py new file mode 100644 index 00000000000..72bac1bcd6f --- /dev/null +++ b/litellm/proxy/middleware/billable_request_metrics_middleware.py @@ -0,0 +1,234 @@ +""" +Counts billable HTTP requests on enterprise deployments. + +A billable request is an inbound request to an LLM inference, MCP, or A2A +endpoint that returns a 2xx status. The actual export happens in an injected +recorder (see litellm.proxy.enterprise_billing.billing_metrics); when no +recorder is injected (non-enterprise, or metering misconfigured) this +middleware is a transparent pass-through. +""" + +import re +import threading +from enum import Enum +from typing import Callable, Optional, Protocol, Sequence, runtime_checkable + +from starlette.types import ASGIApp, Message, Receive, Scope, Send + +from litellm._logging import verbose_proxy_logger +from litellm.proxy._types import LiteLLMRoutes + + +class BillableCategory(str, Enum): + LLM = "llm" + MCP = "mcp" + A2A = "a2a" + + +@runtime_checkable +class BillingRecorder(Protocol): + def record(self, *, category: BillableCategory, route: str, status_code: int, model_id: Optional[str]) -> None: ... + + +_MODEL_ID_HEADER = b"x-litellm-model-id" + +# Ordered: a longer suffix that shares an ending with a shorter one must come +# first, e.g. "/chat/completions" before "/completions". This is the POST +# inference surface that writes a SpendLogs row on success, so the exported +# count lines up with the admin UI usage page for inference traffic. Billing +# is a deliberate lower bound on SpendLogs rows: management writes that also +# log (batch/file/fine-tuning creation, interaction cancel) and non-POST calls +# that log (passthrough reads) never bill, so drift only ever undercounts. +_LLM_ROUTE_SUFFIXES: tuple[str, ...] = ( + "/chat/completions", + "/completions", + "/embeddings", + "/responses", + "/rerank", + "/moderations", + "/images/generations", + "/images/edits", + "/images/variations", + "/audio/transcriptions", + "/audio/translations", + "/audio/speech", + "/videos", # create; GET list is excluded by the POST gate + "/remix", # /v1/videos/{id}/remix + "/ocr", + "/search", # /v1/search and /v1/vector_stores/{id}/search + "/rag/query", + "/rag/ingest", + ":generateContent", # Gemini-native /v1beta/models/{model}:generateContent + ":streamGenerateContent", +) + +# Exact paths only: a suffix match would also catch non-inference resources that +# share the ending, e.g. the OpenAI Assistants route /v1/threads/{id}/messages +# writes no SpendLogs row and must not bill, unlike Anthropic /v1/messages. +_LLM_ROUTE_EXACT: tuple[str, ...] = ( + "/v1/messages", + "/interactions", # Google Interactions create; /{id} reads and /cancel do not match + "/v1beta/interactions", +) + +# Provider passthrough prefixes (e.g. /bedrock/..., /vertex-ai/...) carry real +# inference calls that write SpendLogs rows, so they bill. Anchored to the +# routes enum so new providers are picked up without touching this module. +# /langfuse forwards observability traffic, not inference: it writes no +# SpendLogs row and must not bill. +_NON_BILLABLE_PASSTHROUGH_PREFIXES = frozenset({"/langfuse"}) +_PASSTHROUGH_PREFIXES: tuple[str, ...] = tuple( + prefix + for prefix in LiteLLMRoutes.mapped_pass_through_routes.value + if prefix not in _NON_BILLABLE_PASSTHROUGH_PREFIXES +) + + +def _classify_llm_route(path: str) -> Optional[str]: + exact_match = next((route for route in _LLM_ROUTE_EXACT if path == route), None) + if exact_match is not None: + return exact_match + suffix_match = next((suffix for suffix in _LLM_ROUTE_SUFFIXES if path == suffix or path.endswith(suffix)), None) + if suffix_match is not None: + return suffix_match + # Deep passthrough paths only: the bare prefix itself is not an inference call. + return next((prefix for prefix in _PASSTHROUGH_PREFIXES if path.startswith(f"{prefix}/")), None) + + +_MCP_MANAGEMENT_PREFIX = "/v1/mcp" +_MCP_DYNAMIC_TRANSPORT = re.compile(r"/(?:toolset/)?[^/]+/mcp") +# The REST wrapper's tool-call endpoint executes a tool and fires the same MCP +# spend logging as the /mcp transport; its list/test siblings do not bill. +_MCP_REST_TOOL_CALL = "/mcp-rest/tools/call" + +_A2A_INVOKE_SUFFIX = "/message/send" +_A2A_TRANSPORT_PREFIXES: tuple[str, ...] = ("/v1/a2a/", "/a2a/") +# Bare POST /a2a/{agent_id} carries the JSON-RPC method in the body, not the +# path. Only message/send and message/stream write a SpendLogs row there; the +# task RPCs (tasks/get, tasks/cancel, tasks/pushNotificationConfig/*, ...) are +# forwarded upstream and write none. A path-only classifier cannot separate +# them, so the bare route does not bill: counting a task RPC would overcount, +# while missing a bare-path message/send only undercounts, and undercounting is +# the sole direction this metric is allowed to drift. The /mcp transport is +# method-agnostic by contrast because its list path logs a SpendLogs row too. + + +def _classify_mcp_route(path: str) -> Optional[str]: + if path == _MCP_MANAGEMENT_PREFIX or path.startswith(f"{_MCP_MANAGEMENT_PREFIX}/"): + return None + if path == "/mcp" or path.startswith("/mcp/"): + return "/mcp" + if path == _MCP_REST_TOOL_CALL: + return "/mcp" + if _MCP_DYNAMIC_TRANSPORT.fullmatch(path) is not None: + return "/mcp" + return None + + +def _classify_a2a_route(path: str) -> Optional[str]: + if path.endswith(_A2A_INVOKE_SUFFIX) and any(path.startswith(prefix) for prefix in _A2A_TRANSPORT_PREFIXES): + return "/a2a" + return None + + +def classify_billable_request(path: str, method: str = "POST") -> Optional[tuple[BillableCategory, str]]: + """Map a request path to its (category, normalized route), or None if not billable.""" + normalized = path.rstrip("/") or "/" + + mcp_route = _classify_mcp_route(normalized) + if mcp_route is not None: + return (BillableCategory.MCP, mcp_route) + + a2a_route = _classify_a2a_route(normalized) + if a2a_route is not None: + return (BillableCategory.A2A, a2a_route) + + # POST-only is a conservative gate: non-POST calls can still write a + # SpendLogs row (passthrough reads, resource GETs) but must not bill, so + # any classifier-vs-dashboard mismatch is an undercount, never an overcount. + if method.upper() != "POST": + return None + + llm_route = _classify_llm_route(normalized) + if llm_route is not None: + return (BillableCategory.LLM, llm_route) + return None + + +def _extract_model_id(headers: Sequence[tuple[bytes, bytes]]) -> Optional[str]: + return next( + (value.decode("latin-1") for name, value in headers if name.lower() == _MODEL_ID_HEADER and value), + None, + ) + + +class BillableRequestMetricsMiddleware: + """ + Pure ASGI middleware that records one billable request per 2xx response to a + billable endpoint. Modeled on InFlightRequestsMiddleware: it wraps `send`, + reads the final status and the x-litellm-model-id header off the + `http.response.start` message, and never blocks or fails the request path. + """ + + def __init__( + self, + app: ASGIApp, + recorder: Optional[BillingRecorder] = None, + recorder_factory: Optional[Callable[[], Optional[BillingRecorder]]] = None, + ) -> None: + self.app = app + self.recorder = recorder + # The factory defers recorder construction to the first request, AFTER the + # startup event has loaded the YAML config's environment_variables (license + # and cert env vars). Building at import time captured recorder=None for + # deployments configured that way. Resolved exactly once; the result + # (including None) is cached. + self._recorder_factory = recorder_factory + self._resolved = recorder_factory is None + self._resolve_lock = threading.Lock() + + def _resolve_recorder(self) -> Optional[BillingRecorder]: + if self._resolved: + return self.recorder + # The lock keeps concurrent first requests from each building their own + # MeterProvider (and leaking its background exporter thread). + with self._resolve_lock: + if not self._resolved: + factory = self._recorder_factory + self.recorder = factory() if factory is not None else self.recorder + self._resolved = True + return self.recorder + + async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None: + if scope["type"] != "http": + await self.app(scope, receive, send) + return + + recorder = self._resolve_recorder() + if recorder is None: + await self.app(scope, receive, send) + return + + classification = classify_billable_request(scope.get("path", ""), scope.get("method", "POST")) + if classification is None: + await self.app(scope, receive, send) + return + + category, route = classification + status_code = 0 + model_id: Optional[str] = None + + async def send_wrapper(message: Message) -> None: + nonlocal status_code, model_id + if message["type"] == "http.response.start": + status_code = message["status"] + model_id = _extract_model_id(message.get("headers", [])) + await send(message) + + await self.app(scope, receive, send_wrapper) + + if 200 <= status_code < 300: + try: + recorder.record(category=category, route=route, status_code=status_code, model_id=model_id) + except Exception: # noqa: BLE001 -- metering must never fail a request that was already served + verbose_proxy_logger.warning("billable request metering failed for %s", route, exc_info=True) diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py index b04f12a0e90..6661474d215 100644 --- a/litellm/proxy/proxy_server.py +++ b/litellm/proxy/proxy_server.py @@ -438,10 +438,30 @@ from litellm.proxy.management_helpers.audit_logs import ( create_object_audit_log, ) from litellm.proxy.memory.memory_endpoints import router as memory_router +from litellm.proxy.middleware.billable_request_metrics_middleware import ( + BillableRequestMetricsMiddleware, + BillingRecorder, +) from litellm.proxy.plugin_routes import ( - router as plugin_router, register_plugins_from_config, ) +from litellm.proxy.plugin_routes import ( + router as plugin_router, +) + +try: + from litellm.proxy.enterprise_billing.billing_metrics import ( + build_billing_metrics_recorder as _build_billing_metrics_recorder, + ) + from litellm.proxy.enterprise_billing.billing_metrics import ( + shutdown_billing_metrics_recorder as _shutdown_billing_metrics_recorder, + ) + + build_billing_metrics_recorder: Optional[Callable[..., Optional[BillingRecorder]]] = _build_billing_metrics_recorder + shutdown_billing_metrics_recorder: Optional[Callable[[], None]] = _shutdown_billing_metrics_recorder +except ImportError: + build_billing_metrics_recorder = None + shutdown_billing_metrics_recorder = None from litellm.proxy.middleware.in_flight_requests_middleware import ( InFlightRequestsMiddleware, ) @@ -461,13 +481,11 @@ from litellm.proxy.openai_files_endpoints.files_endpoints import ( ) from litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints import ( passthrough_endpoint_router, + vertex_ai_live_websocket_passthrough, ) from litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints import ( router as llm_passthrough_router, ) -from litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints import ( - vertex_ai_live_websocket_passthrough, -) from litellm.proxy.pass_through_endpoints.pass_through_endpoints import ( initialize_pass_through_endpoints, ) @@ -552,22 +570,19 @@ from litellm.types.proxy.management_endpoints.ui_sso import ( from litellm.types.realtime import RealtimeQueryParams from litellm.types.router import ( DeploymentTypedDict, -) -from litellm.types.router import ModelInfo as RouterModelInfo -from litellm.types.router import ( RouterGeneralSettings, RoutingPlugin, SearchToolTypedDict, updateDeployment, ) +from litellm.types.router import ModelInfo as RouterModelInfo from litellm.types.scheduler import DefaultPriorities from litellm.types.secret_managers.main import ( KeyManagementSettings, KeyManagementSystem, ) -from litellm.types.utils import CredentialItem, CustomHuggingfaceTokenizer +from litellm.types.utils import CredentialItem, CustomHuggingfaceTokenizer, RawRequestTypedDict, StandardLoggingPayload from litellm.types.utils import ModelInfo as ModelMapInfo -from litellm.types.utils import RawRequestTypedDict, StandardLoggingPayload from litellm.utils import _add_custom_logger_callback_to_specific_event try: @@ -768,6 +783,11 @@ async def proxy_shutdown_event(): if db_writer_client is not None: await db_writer_client.close() # type: ignore[reportGeneralTypeIssues] + # final flush of billable-request counts: without it, up to one export + # interval of enterprise billing data is dropped on every restart + if shutdown_billing_metrics_recorder is not None: + shutdown_billing_metrics_recorder() + # flush remaining langfuse logs if "langfuse" in litellm.success_callback: try: @@ -973,11 +993,11 @@ async def proxy_startup_event(app: FastAPI): if is_otel_v2_enabled(): from opentelemetry import trace as _otel_trace - from litellm.litellm_core_utils.litellm_logging import _in_memory_loggers from litellm.integrations.otel.logger import ( OpenTelemetryV2, publish_global_otel_v2_provider, ) + from litellm.litellm_core_utils.litellm_logging import _in_memory_loggers registered = open_telemetry_logger if isinstance(open_telemetry_logger, OpenTelemetryV2) else None publish_global_otel_v2_provider( @@ -1781,6 +1801,31 @@ app.add_middleware( ) app.add_middleware(PrometheusAuthMiddleware) +# Added before InFlightRequestsMiddleware so it nests *inside* it: Starlette +# makes the last-added middleware outermost. The billable count is recorded +# after the inner app returns, so if this sat outside the in-flight tracker a +# request could be counted as drained while its record() had not yet run, and +# proxy_shutdown_event could flush and stop the exporter underneath it. +app.add_middleware( + BillableRequestMetricsMiddleware, + # Factory, not an instance: the recorder is resolved on the first request so + # it sees premium_user and the billing env vars AFTER proxy_startup_event has + # loaded the YAML config's environment_variables. Building it here at import + # time would permanently capture recorder=None for YAML-configured + # deployments. The lambda reads the module globals at call time. + recorder_factory=lambda: ( + build_billing_metrics_recorder( + premium=premium_user, + # Read from the license check, not the premium_user_data module + # global: that global is bound once at import and goes stale when + # the license arrives via the YAML config's environment_variables. + license_data=_license_check.airgapped_license_data, + litellm_version=version, + ) + if build_billing_metrics_recorder is not None + else None + ), +) app.add_middleware(InFlightRequestsMiddleware) app.add_middleware(SecurityHeadersMiddleware) diff --git a/litellm/proxy/route_llm_request.py b/litellm/proxy/route_llm_request.py index 8c980f33b01..94871ff072d 100644 --- a/litellm/proxy/route_llm_request.py +++ b/litellm/proxy/route_llm_request.py @@ -6,6 +6,7 @@ from fastapi import HTTPException, status import litellm from litellm.proxy._types import UserAPIKeyAuth +from litellm.router_utils.common_utils import _is_proxy_admin_request # Router-internal mock_testing_* flag names — kept in sync with # ``litellm.types.router.MockRouterTestingParams`` by the test @@ -363,6 +364,7 @@ async def route_request( team_id = get_team_id_from_data(data) router_model_names = llm_router.model_names if llm_router is not None else [] + is_proxy_admin_without_team = team_id is None and _is_proxy_admin_request(data) # Preprocess Google GenAI generate content requests if route_type in ["agenerate_content", "agenerate_content_stream"]: @@ -517,6 +519,13 @@ async def route_request( data["model"] = team_model_name return getattr(llm_router, f"{route_type}")(**data) + elif ( + is_proxy_admin_without_team + and data["model"] not in router_model_names + and data["model"] in llm_router.team_public_model_names + ): + return getattr(llm_router, f"{route_type}")(**data) + elif data["model"] in router_model_names or llm_router.has_model_id(data["model"]): return getattr(llm_router, f"{route_type}")(**data) diff --git a/litellm/proxy/utils.py b/litellm/proxy/utils.py index 62fc28256cd..9f36e729330 100644 --- a/litellm/proxy/utils.py +++ b/litellm/proxy/utils.py @@ -833,7 +833,7 @@ class ProxyLogging: def get_combined_callback_list(self, dynamic_success_callbacks: Optional[List], global_callbacks: List) -> List: if dynamic_success_callbacks is None: return list(global_callbacks) - return list(set(dynamic_success_callbacks + global_callbacks)) + return list(dict.fromkeys(dynamic_success_callbacks + global_callbacks)) def _parse_pre_mcp_call_hook_response( self, diff --git a/litellm/router.py b/litellm/router.py index 3d49d7048e4..f408d030b8b 100644 --- a/litellm/router.py +++ b/litellm/router.py @@ -26,6 +26,7 @@ from typing import ( AsyncGenerator, Callable, Dict, + FrozenSet, Generator, List, Literal, @@ -108,6 +109,7 @@ from litellm.router_utils.clientside_credential_handler import ( is_clientside_credential, ) from litellm.router_utils.common_utils import ( + _is_proxy_admin_request, filter_team_based_models, filter_web_search_deployments, ) @@ -494,6 +496,7 @@ class Router: self.model_name_to_deployment_indices: Dict[str, List[int]] = {} # Maps (team_id, team_public_model_name) -> list of indices in model_list self.team_model_to_deployment_indices: Dict[Tuple[str, str], List[int]] = {} + self.team_public_model_names: FrozenSet[str] = frozenset() # Initialize cache attributes that ``_invalidate_model_group_info_cache`` # touches *before* the first ``set_model_list`` below (which calls @@ -2983,7 +2986,7 @@ class Router: # here before it's wiped below, instead of relying on that attempt's # (possibly still-pending) failure event to do it. refund_stale_reservation_before_retry(self.cache, kwargs) - set_io_token_rate_limit_request_kwargs(kwargs) + set_io_token_rate_limit_request_kwargs(kwargs, store_in_context=deployment_has_io_token_limits(deployment)) ## DEPLOYMENT-LEVEL TAGS deployment_tags = deployment.get("litellm_params", {}).get("tags") @@ -7800,6 +7803,7 @@ class Router: self.model_id_to_deployment_index_map = {} # Reset the index self.model_name_to_deployment_indices = {} # Reset the model_name index self.team_model_to_deployment_indices = {} # Reset the team_model index + self.team_public_model_names = frozenset() # Reset per-strategy router registries so hot-reload doesn't leave # stale routers pointing at the old model_list. self.quality_routers = {} @@ -8151,6 +8155,9 @@ class Router: self.team_model_to_deployment_indices[key] = updated_indices else: del self.team_model_to_deployment_indices[key] + self.team_public_model_names = frozenset( + public_model_name for _, public_model_name in self.team_model_to_deployment_indices + ) def _update_team_model_index(self, model: dict, idx: int) -> None: """ @@ -8164,6 +8171,7 @@ class Router: team_public_model_name = (model.get("model_info") or {}).get("team_public_model_name") if team_id and team_public_model_name: key = (team_id, team_public_model_name) + self.team_public_model_names = self.team_public_model_names | frozenset({team_public_model_name}) if key not in self.team_model_to_deployment_indices: self.team_model_to_deployment_indices[key] = [] if idx not in self.team_model_to_deployment_indices[key]: @@ -9118,6 +9126,7 @@ class Router: """ self.model_name_to_deployment_indices.clear() self.team_model_to_deployment_indices.clear() + self.team_public_model_names = frozenset() for idx, model in enumerate(model_list): model_name = model.get("model_name") @@ -10026,7 +10035,10 @@ class Router: return [m for m in self.model_list if m["litellm_params"]["model"] == model] def _try_early_resolve_deployments_for_model_not_in_names( - self, model: str, request_team_id: Optional[str] + self, + model: str, + request_team_id: Optional[str], + include_team_models: bool = False, ) -> Optional[Tuple[str, Union[List, Dict]]]: """ When ``model`` is not in ``self.model_names``, try team routes, pattern routes, @@ -10041,6 +10053,30 @@ class Router: team_deployments = self._get_all_deployments(model_name=model, team_id=request_team_id) if team_deployments: return model, team_deployments + elif include_team_models: + team_deployments = [ + self.model_list[index] + for (_, public_model_name), indices in self.team_model_to_deployment_indices.items() + if public_model_name == model + for index in indices + ] + team_ids = { + team_id + for deployment in team_deployments + for team_id in [(deployment.get("model_info") or {}).get("team_id")] + if team_id is not None + } + if len(team_ids) > 1: + raise litellm.BadRequestError( + message=( + f"Model name '{model}' matches deployments from multiple teams. " + "Specify the deployment ID directly to disambiguate." + ), + model=model, + llm_provider="", + ) + if team_deployments: + return model, team_deployments pattern_deployments = self.pattern_router.get_deployments_by_pattern( model=model, @@ -10105,7 +10141,11 @@ class Router: if _model_from_alias is not None: model = _model_from_alias - early = self._try_early_resolve_deployments_for_model_not_in_names(model=model, request_team_id=request_team_id) + early = self._try_early_resolve_deployments_for_model_not_in_names( + model=model, + request_team_id=request_team_id, + include_team_models=_is_proxy_admin_request(request_kwargs), + ) if early is not None: return early diff --git a/litellm/router_utils/common_utils.py b/litellm/router_utils/common_utils.py index 18bce2348f6..5cfea5e3bf2 100644 --- a/litellm/router_utils/common_utils.py +++ b/litellm/router_utils/common_utils.py @@ -1,14 +1,27 @@ import hashlib import json +from collections.abc import Mapping from typing import TYPE_CHECKING, Dict, List, Optional, Union if TYPE_CHECKING: from litellm.types.llms.openai import OpenAIFileObject +from litellm.exceptions import BadRequestError from litellm.types.router import CredentialLiteLLMParams from litellm._logging import verbose_logger +def _is_proxy_admin_request(request_kwargs: Optional[Mapping[str, object]]) -> bool: + if request_kwargs is None: + return False + metadata_value = request_kwargs.get("metadata") + litellm_metadata_value = request_kwargs.get("litellm_metadata") + metadata = metadata_value if isinstance(metadata_value, Mapping) else {} + litellm_metadata = litellm_metadata_value if isinstance(litellm_metadata_value, Mapping) else {} + user_api_key_auth = metadata.get("user_api_key_auth") or litellm_metadata.get("user_api_key_auth") + return getattr(user_api_key_auth, "user_role", None) == "proxy_admin" + + def get_litellm_params_sensitive_credential_hash(litellm_params: dict) -> str: """ Hash of the credential params, used for mapping the file id to the right model @@ -59,6 +72,40 @@ def filter_team_based_models( metadata = request_kwargs.get("metadata") or {} litellm_metadata = request_kwargs.get("litellm_metadata") or {} request_team_id = metadata.get("user_api_key_team_id") or litellm_metadata.get("user_api_key_team_id") + if request_team_id is None and _is_proxy_admin_request(request_kwargs) and isinstance(healthy_deployments, list): + requested_model = ( + request_kwargs.get("model") or metadata.get("model_group") or litellm_metadata.get("model_group") + ) + candidate_deployments = tuple( + (deployment.get("model_name"), deployment.get("model_info") or {}) for deployment in healthy_deployments + ) + team_ids = frozenset( + team_id + for _, model_info in candidate_deployments + for team_id in [model_info.get("team_id")] + if team_id is not None + ) + matches_requested_model = ( + isinstance(requested_model, str) + and bool(candidate_deployments) + and all( + model_info.get("team_id") is not None + and (model_name == requested_model or model_info.get("team_public_model_name") == requested_model) + for model_name, model_info in candidate_deployments + ) + ) + if matches_requested_model and len(team_ids) > 1: + raise BadRequestError( + message=( + f"Model name '{requested_model}' matches deployments from multiple teams. " + "Specify the deployment ID directly to disambiguate." + ), + model=requested_model, + llm_provider="", + ) + if matches_requested_model: + return healthy_deployments + ids_to_remove = set() if isinstance(healthy_deployments, dict): return healthy_deployments diff --git a/litellm/router_utils/pre_call_checks/io_token_rate_limit_check.py b/litellm/router_utils/pre_call_checks/io_token_rate_limit_check.py index 62c99a1c9f6..803fdc4b353 100644 --- a/litellm/router_utils/pre_call_checks/io_token_rate_limit_check.py +++ b/litellm/router_utils/pre_call_checks/io_token_rate_limit_check.py @@ -43,14 +43,21 @@ ITPM_CACHE_KEY = "_litellm_itpm_cache_key" OTPM_CACHE_KEY = "_litellm_otpm_cache_key" -def set_io_token_rate_limit_request_kwargs(kwargs: Optional[dict[str, Any]]) -> None: +def set_io_token_rate_limit_request_kwargs(kwargs: Optional[dict[str, Any]], store_in_context: bool = True) -> None: # The reservation sentinels are server-only, but `metadata` is caller # controlled on proxy requests. Strip any client-supplied copies here (this # runs before the router stashes its own reservation) so a forged # reservation can't drive the post-call reconcile/refund against an # arbitrary counter and bypass the configured limits. _clear_reservation_from_kwargs(kwargs) - _io_token_rate_limit_request_kwargs.set(kwargs) + # The context slot pins the entire request kwargs (messages included) for + # the lifetime of the surrounding context, which outlives the request when + # the context is captured by pooled resources (e.g. a redis connection + # created mid-request). Only ITPM/OTPM-limited deployments read it, so for + # every other deployment overwrite the slot with None instead of the + # kwargs; overwriting (rather than skipping) also releases a previous + # request's kwargs when a context is reused. + _io_token_rate_limit_request_kwargs.set(kwargs if store_in_context else None) def get_io_token_rate_limit_request_kwargs() -> Optional[dict[str, Any]]: diff --git a/litellm/types/guardrails.py b/litellm/types/guardrails.py index 03b6b36ec2e..f3410935ec7 100644 --- a/litellm/types/guardrails.py +++ b/litellm/types/guardrails.py @@ -56,6 +56,9 @@ from litellm.types.proxy.guardrails.guardrail_hooks.cisco_ai_defense import ( from litellm.types.proxy.guardrails.guardrail_hooks.headroom import ( HeadroomGuardrailConfigModel, ) +from litellm.types.proxy.guardrails.guardrail_hooks.compresr import ( + CompresrGuardrailConfigModel, +) """ Pydantic object defining how to set guardrails on litellm proxy @@ -123,6 +126,7 @@ class SupportedGuardrailIntegrations(Enum): VIGIL_GUARD = "vigil_guard" REPELLOAI = "repelloai" HEADROOM = "headroom" + COMPRESR = "compresr" class Role(Enum): @@ -806,7 +810,7 @@ class BaseLitellmParams(ContentFilterConfigModel): # works for new and patch up default="fail_closed", description=( "Behavior when a guardrail endpoint is unreachable due to network errors. " - "Implemented by guardrail='generic_guardrail_api', 'akto', 'vigil_guard', 'repelloai', and 'headroom'. " + "Implemented by guardrail='generic_guardrail_api', 'akto', 'vigil_guard', 'repelloai', 'headroom', and 'compresr'. " "'fail_closed' raises an error (default). 'fail_open' logs a critical error and allows the request to proceed." ), ) @@ -899,6 +903,7 @@ class LitellmParams( BedrockGuardrailConfigModel, LakeraV2GuardrailConfigModel, HeadroomGuardrailConfigModel, + CompresrGuardrailConfigModel, RepelloAIGuardrailConfigModel, LassoGuardrailConfigModel, PillarGuardrailConfigModel, @@ -1034,6 +1039,7 @@ class ApplyGuardrailRequest(BaseModel): entities: Optional[List[PiiEntityType]] = None input_type: str = "request" messages: Optional[List[Dict[str, Any]]] = None + metadata: Dict[str, Any] | None = None class ApplyGuardrailResponse(BaseModel): diff --git a/litellm/types/mcp_server/mcp_server_manager.py b/litellm/types/mcp_server/mcp_server_manager.py index 82ff15303f3..ced6dfe5e2e 100644 --- a/litellm/types/mcp_server/mcp_server_manager.py +++ b/litellm/types/mcp_server/mcp_server_manager.py @@ -122,9 +122,10 @@ class MCPServer(BaseModel): # response (supports dot-notation for nested fields, e.g. "team.enterprise_id"). # Tokens that fail validation are rejected before storage. token_validation: Optional[Dict[str, Any]] = None - # Optional TTL override (seconds) for the Redis per-user token cache. - # Defaults to the token's expires_in minus the expiry buffer, or - # MCP_PER_USER_TOKEN_DEFAULT_TTL when expires_in is absent. + # Optional TTL override (seconds) for the Redis per-user token cache, capped + # at the token's expires_in minus the expiry buffer so a cached entry never + # outlives the token. Defaults to the token's expires_in minus the expiry + # buffer, or MCP_PER_USER_TOKEN_DEFAULT_TTL when expires_in is absent. token_storage_ttl_seconds: Optional[int] = None timeout: Optional[float] = None # Max concurrent outbound tool calls to this server; excess calls queue. diff --git a/litellm/types/proxy/guardrails/guardrail_hooks/compresr.py b/litellm/types/proxy/guardrails/guardrail_hooks/compresr.py new file mode 100644 index 00000000000..dad61f83b7d --- /dev/null +++ b/litellm/types/proxy/guardrails/guardrail_hooks/compresr.py @@ -0,0 +1,135 @@ +from typing import Any, Dict, Literal + +from pydantic import BaseModel, Field + +from .base import GuardrailConfigModel + + +class CompresrGuardrailOptionalParams(BaseModel): + """Optional tuning knobs for the Compresr guardrail.""" + + target_compression_ratio: float | None = Field( + default=None, + description=( + "Compression strength. 0-1 is the fraction of tokens to remove " + "(0.5 = remove ~50%, the default); a value >1 is an Nx reduction " + "factor (e.g. 4 = ~4x smaller)." + ), + ) + coarse: bool | None = Field( + default=None, + description=("Paragraph-level compression (default, faster) instead of token-level (finer-grained)."), + ) + min_chars_to_compress: int | None = Field( + default=None, + description=("Skip messages whose text is shorter than this many characters. Defaults to 500."), + ) + compress_tool_outputs: bool | None = Field( + default=None, + description=("Compress tool/function result messages (search hits, RAG chunks, API dumps). Defaults to True."), + ) + compress_system: bool | None = Field( + default=None, + description="Also compress system messages. Defaults to False.", + ) + compress_history: bool | None = Field( + default=None, + description="Also compress prior (non-last) user messages. Defaults to False.", + ) + compress_last_user: bool | None = Field( + default=None, + description=( + "Also compress the last user message. The query sent to Compresr " + "is always the original verbatim text. Defaults to False." + ), + ) + enable_retrieval: bool | None = Field( + default=None, + description=( + "Make compression recoverable: inject a `compresr_retrieve` tool " + "so the model can fetch the original content behind a compression " + "marker via the agentic loop. Defaults to True. Set to False (or " + "run the proxy with --workers 1) for multi-worker deployments: " + "the recovery store is per-process, so pre-call and retrieval hooks " + "on different workers cannot see each other's originals." + ), + ) + max_bytes_per_call: int | None = Field( + default=None, + description=( + "Cap on aggregate bytes of stored originals per litellm_call_id. " + "When a call exceeds this, oldest entries are evicted so the " + "in-process store cannot grow without bound. Defaults to 10 MiB." + ), + ) + allow_bypass_header: bool | None = Field( + default=None, + description=( + "Honor the `x-compresr-bypass: true` request header to skip " + "compression for a single call. Off by default because the " + "header is caller-settable; enable only on trusted deployments." + ), + ) + dynamic: bool | None = Field( + default=None, + description=( + "latte_v2 only. Let the server choose the compression amount per input " + "(Kneedle elbow) instead of using target_compression_ratio. Defaults to True." + ), + ) + dynamic_min_ratio: float | None = Field( + default=None, + description=( + "latte_v2 only. Floor on the adaptive ratio when `dynamic` is on. " + "Unset lets the server default apply (~1.5)." + ), + ) + dynamic_max_ratio: float | None = Field( + default=None, + description=( + "latte_v2 only. Ceiling on the adaptive ratio when `dynamic` is on. " + "Unset lets the server default apply (~10.0)." + ), + ) + compression_params: Dict[str, Any] | None = Field( + default=None, + description=( + "Passthrough of extra parameters forwarded verbatim in the Compresr " + "compress payload (e.g. `heuristic_chunking`, or any newer knob), so " + "a new Compresr feature works without a guardrail update. The named " + "fields above take precedence on collision." + ), + ) + + +class CompresrGuardrailConfigModel(GuardrailConfigModel[CompresrGuardrailOptionalParams]): + api_key: str | None = Field( + default=None, + description=("Compresr API key. Falls back to the COMPRESR_API_KEY env var."), + ) + api_base: str | None = Field( + default=None, + description=( + "Base URL of the Compresr API. Falls back to the COMPRESR_API_BASE " + "env var, then https://api.compresr.ai. Point at your internal " + "service URL for on-prem deployments." + ), + ) + model: str | None = Field( + default=None, + description=( + "Compresr compression model (not the LLM). Defaults to 'latte_v2', the query-aware compression model." + ), + ) + unreachable_fallback: Literal["fail_closed", "fail_open"] = Field( + default="fail_closed", + description=( + "Behavior when the Compresr compression service is unreachable or errors. " + "'fail_closed' raises an error (default). 'fail_open' logs a critical error and " + "forwards the request uncompressed instead of blocking it." + ), + ) + + @staticmethod + def ui_friendly_name() -> str: + return "Compresr (context compression)" diff --git a/model_prices_and_context_window.json b/model_prices_and_context_window.json index df6e8c992ef..e10dde793d1 100644 --- a/model_prices_and_context_window.json +++ b/model_prices_and_context_window.json @@ -44382,6 +44382,90 @@ "supports_response_schema": true, "supports_tool_choice": true }, + "bedrock_mantle/openai.gpt-5.6-sol": { + "input_cost_per_token": 5.5e-06, + "cache_creation_input_token_cost": 6.875e-06, + "cache_read_input_token_cost": 5.5e-07, + "output_cost_per_token": 3.3e-05, + "litellm_provider": "bedrock_mantle", + "max_input_tokens": 272000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "responses", + "use_openai_responses_path": true, + "supported_endpoints": [ + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_tool_choice": true, + "supports_vision": true + }, + "bedrock_mantle/openai.gpt-5.6-terra": { + "input_cost_per_token": 2.75e-06, + "cache_creation_input_token_cost": 3.4375e-06, + "cache_read_input_token_cost": 2.75e-07, + "output_cost_per_token": 1.65e-05, + "litellm_provider": "bedrock_mantle", + "max_input_tokens": 272000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "responses", + "use_openai_responses_path": true, + "supported_endpoints": [ + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_tool_choice": true, + "supports_vision": true + }, + "bedrock_mantle/openai.gpt-5.6-luna": { + "input_cost_per_token": 1.1e-06, + "cache_creation_input_token_cost": 1.375e-06, + "cache_read_input_token_cost": 1.1e-07, + "output_cost_per_token": 6.6e-06, + "litellm_provider": "bedrock_mantle", + "max_input_tokens": 272000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "responses", + "use_openai_responses_path": true, + "supported_endpoints": [ + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_tool_choice": true, + "supports_vision": true + }, "bedrock_mantle/openai.gpt-5.5": { "input_cost_per_token": 5.5e-06, "cache_read_input_token_cost": 5.5e-07, @@ -44494,6 +44578,7 @@ "supports_vision": true }, "bedrock_mantle/xai.grok-4.3": { + "use_openai_responses_path": true, "input_cost_per_token": 1.25e-06, "output_cost_per_token": 2.5e-06, "cache_read_input_token_cost": 2e-07, diff --git a/pyproject.toml b/pyproject.toml index 3dc6529f307..fb07f69f7e4 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -3,7 +3,7 @@ name = "litellm" version = "1.94.0" description = "Library to easily interface with LLM API providers" readme = "README.md" -requires-python = ">=3.10, <3.14" +requires-python = ">=3.10, <3.15" license = "MIT" license-files = ["LICENSE"] authors = [ @@ -129,7 +129,8 @@ proxy-runtime = [ "opentelemetry-sdk==1.33.1", "opentelemetry-exporter-otlp==1.33.1", "opentelemetry-instrumentation-fastapi==0.54b1", - "ddtrace>=2.19.0,<3.0", + "ddtrace>=2.19.0,<3.0; python_version < '3.14'", + "ddtrace>=4.0.0,<5.0; python_version >= '3.14'", "sentry-sdk>=2.21.0,<3.0", "mangum>=0.17.0,<1.0", "azure-ai-contentsafety>=1.0.0,<2.0", diff --git a/terraform/litellm/aws/README.md b/terraform/litellm/aws/README.md index 7d4ef0a14fb..40a9da66c70 100644 --- a/terraform/litellm/aws/README.md +++ b/terraform/litellm/aws/README.md @@ -158,6 +158,38 @@ AgentOps) live under `proxy_config.litellm_settings.callbacks` and are orthogonal to the OTLP variables above; their credentials still go in `*_extra_secrets`. +### Enterprise billing metrics + +License-gated request metering is opt-in and gated entirely on +`billing_metrics_endpoint`. Empty (default) and no billing env is added to +the container, so existing deployments are unchanged. Set it and both +gateway and backend export billable-request counts over OTLP/HTTP, +authenticating to the collector with the mTLS client certificate issued for +your deployment. + +The proxy accepts the certificate, key, and CA bundle as either a file path +or literal PEM content. This stack takes the PEM, writes each one to its own +Secrets Manager entry, grants the task-execution role +`secretsmanager:GetSecretValue` on them, and injects them as +`LITELLM_BILLING_METRICS_CLIENT_CERT` / `_CLIENT_KEY` (and `_CA_CERT` when +set), so no volume mount is needed on Fargate. + +```hcl +billing_metrics_endpoint = "https://telemetry.litellm.ai/v1/metrics" +``` + +```bash +export TF_VAR_billing_metrics_client_cert_pem="$(cat client.crt)" +export TF_VAR_billing_metrics_client_key_pem="$(cat client.key)" +``` + +`billing_metrics_ca_cert_pem` is only for private or test collectors whose +CA is not in the system trust store; leave it empty against +`telemetry.litellm.ai`. Metering requires an enterprise license, so pair +this with `litellm_license`. To tune the export cadence, set +`LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MS` through `gateway_extra_env` / +`backend_extra_env` + ## Tenant deployment Every resource the stack creates is named `${tenant}-litellm-${env}` (or diff --git a/terraform/litellm/aws/ecs.tf b/terraform/litellm/aws/ecs.tf index 54ab80de9f4..4df41c278e8 100644 --- a/terraform/litellm/aws/ecs.tf +++ b/terraform/litellm/aws/ecs.tf @@ -76,6 +76,33 @@ locals { { name = "OTEL_HEADERS", valueFrom = var.otel_headers_secret_arn }, ] : [] + # Enterprise request metering, gated on billing_metrics_endpoint. The + # endpoint rides in as a plain env var; the mTLS material is stored in + # Secrets Manager (secrets.tf) and injected as PEM-valued env vars, which + # the proxy accepts in place of file paths. Each PEM is wired only when the + # operator supplied it, so an empty ca_cert_pem falls back to the system + # trust store. + billing_metrics_enabled = var.billing_metrics_endpoint != "" + billing_metrics_client_cert_enabled = local.billing_metrics_enabled && var.billing_metrics_client_cert_pem != "" + billing_metrics_client_key_enabled = local.billing_metrics_enabled && var.billing_metrics_client_key_pem != "" + billing_metrics_ca_cert_enabled = local.billing_metrics_enabled && var.billing_metrics_ca_cert_pem != "" + + billing_metrics_env = local.billing_metrics_enabled ? [ + { name = "LITELLM_BILLING_METRICS_ENDPOINT", value = var.billing_metrics_endpoint }, + ] : [] + + billing_metrics_secrets = concat( + local.billing_metrics_client_cert_enabled ? [ + { name = "LITELLM_BILLING_METRICS_CLIENT_CERT", valueFrom = aws_secretsmanager_secret.billing_metrics_client_cert[0].arn }, + ] : [], + local.billing_metrics_client_key_enabled ? [ + { name = "LITELLM_BILLING_METRICS_CLIENT_KEY", valueFrom = aws_secretsmanager_secret.billing_metrics_client_key[0].arn }, + ] : [], + local.billing_metrics_ca_cert_enabled ? [ + { name = "LITELLM_BILLING_METRICS_CA_CERT", valueFrom = aws_secretsmanager_secret.billing_metrics_ca_cert[0].arn }, + ] : [], + ) + shared_env = [ { name = "IAM_TOKEN_DB_AUTH", value = "true" }, { name = "DATABASE_HOST", value = aws_rds_cluster.this.endpoint }, @@ -108,6 +135,7 @@ locals { { name = "LITELLM_LICENSE", valueFrom = aws_secretsmanager_secret.license[0].arn }, ], local.otel_secrets, + local.billing_metrics_secrets, ) # Backend-only managed secrets. UI_PASSWORD is consumed by the management @@ -179,6 +207,30 @@ locals { # ---------- Gateway ---------- resource "aws_ecs_task_definition" "gateway" { + # Metering needs a client certificate AND its key. Each secret is created only + # when its own PEM is supplied, so an endpoint set with a missing key would + # otherwise apply cleanly and leave the proxy logging "missing config" and + # never exporting. ca_cert_pem stays optional: empty means fall back to the + # system trust store. + # + # The guard lives here, on an unconditional resource, rather than on the cert + # secret: that secret is count-gated on the cert itself, so it has zero + # instances in exactly the case this must catch. Adding count or for_each to + # this resource would silently stop the guard from evaluating. + # + # endpoint cert key -> result + # "" any any -> metering off, no secrets created + # set set set -> metering on + # set any-missing -> plan fails here + lifecycle { + precondition { + condition = var.billing_metrics_endpoint == "" || ( + var.billing_metrics_client_cert_pem != "" && var.billing_metrics_client_key_pem != "" + ) + error_message = "billing_metrics_client_cert_pem and billing_metrics_client_key_pem are both required when billing_metrics_endpoint is set." + } + } + family = "${local.name}-gateway" network_mode = "awsvpc" requires_compatibilities = ["FARGATE"] @@ -198,6 +250,7 @@ resource "aws_ecs_task_definition" "gateway" { environment = concat( local.shared_env, local.gateway_otel_env, + local.billing_metrics_env, local.gateway_extra_env_list, local.proxy_config_env, ) @@ -264,6 +317,18 @@ resource "aws_ecs_service" "gateway" { # ---------- Backend ---------- resource "aws_ecs_task_definition" "backend" { + # Same guard as the gateway: the backend meters too (it serves the named-server + # MCP transport), and a targeted apply of just this resource must not slip a + # billing endpoint through without the credentials to use it. + lifecycle { + precondition { + condition = var.billing_metrics_endpoint == "" || ( + var.billing_metrics_client_cert_pem != "" && var.billing_metrics_client_key_pem != "" + ) + error_message = "billing_metrics_client_cert_pem and billing_metrics_client_key_pem are both required when billing_metrics_endpoint is set." + } + } + family = "${local.name}-backend" network_mode = "awsvpc" requires_compatibilities = ["FARGATE"] @@ -284,6 +349,7 @@ resource "aws_ecs_task_definition" "backend" { local.shared_env, local.backend_default_env, local.backend_otel_env, + local.billing_metrics_env, local.backend_extra_env_list, local.proxy_config_env, ) diff --git a/terraform/litellm/aws/iam.tf b/terraform/litellm/aws/iam.tf index 64e1b1ad5f9..63c6c26f184 100644 --- a/terraform/litellm/aws/iam.tf +++ b/terraform/litellm/aws/iam.tf @@ -53,6 +53,9 @@ data "aws_iam_policy_document" "secrets_access" { [aws_secretsmanager_secret.master_key.arn], aws_secretsmanager_secret.license[*].arn, aws_secretsmanager_secret.ui_password[*].arn, + aws_secretsmanager_secret.billing_metrics_client_cert[*].arn, + aws_secretsmanager_secret.billing_metrics_client_key[*].arn, + aws_secretsmanager_secret.billing_metrics_ca_cert[*].arn, local.extra_secret_arns, var.otel_headers_secret_arn == "" ? [] : [var.otel_headers_secret_arn], ) diff --git a/terraform/litellm/aws/secrets.tf b/terraform/litellm/aws/secrets.tf index 300d38e4053..85d3eb4502c 100644 --- a/terraform/litellm/aws/secrets.tf +++ b/terraform/litellm/aws/secrets.tf @@ -74,6 +74,61 @@ resource "aws_secretsmanager_secret_version" "ui_password" { secret_string = var.ui_password } +# Billing-metrics mTLS material — only created when metering is enabled +# (billing_metrics_endpoint non-empty) and the operator supplied the PEM. +# The task-execution role gets GetSecretValue via iam.tf, and gateway + +# backend pick the env vars up through shared_secrets in ecs.tf. +resource "aws_secretsmanager_secret" "billing_metrics_client_cert" { + count = local.billing_metrics_client_cert_enabled ? 1 : 0 + + name = "${local.name}-billing-metrics-client-cert" + description = "LITELLM_BILLING_METRICS_CLIENT_CERT for gateway + backend." + recovery_window_in_days = 0 + + tags = local.tags +} + +resource "aws_secretsmanager_secret_version" "billing_metrics_client_cert" { + count = local.billing_metrics_client_cert_enabled ? 1 : 0 + + secret_id = aws_secretsmanager_secret.billing_metrics_client_cert[0].id + secret_string = var.billing_metrics_client_cert_pem +} + +resource "aws_secretsmanager_secret" "billing_metrics_client_key" { + count = local.billing_metrics_client_key_enabled ? 1 : 0 + + name = "${local.name}-billing-metrics-client-key" + description = "LITELLM_BILLING_METRICS_CLIENT_KEY for gateway + backend." + recovery_window_in_days = 0 + + tags = local.tags +} + +resource "aws_secretsmanager_secret_version" "billing_metrics_client_key" { + count = local.billing_metrics_client_key_enabled ? 1 : 0 + + secret_id = aws_secretsmanager_secret.billing_metrics_client_key[0].id + secret_string = var.billing_metrics_client_key_pem +} + +resource "aws_secretsmanager_secret" "billing_metrics_ca_cert" { + count = local.billing_metrics_ca_cert_enabled ? 1 : 0 + + name = "${local.name}-billing-metrics-ca-cert" + description = "LITELLM_BILLING_METRICS_CA_CERT for gateway + backend." + recovery_window_in_days = 0 + + tags = local.tags +} + +resource "aws_secretsmanager_secret_version" "billing_metrics_ca_cert" { + count = local.billing_metrics_ca_cert_enabled ? 1 : 0 + + secret_id = aws_secretsmanager_secret.billing_metrics_ca_cert[0].id + secret_string = var.billing_metrics_ca_cert_pem +} + resource "aws_secretsmanager_secret" "db_master_password" { name = "${local.name}-db-master-password" description = "Aurora master-user password - bootstrap only. Runtime auth is IAM-token." diff --git a/terraform/litellm/aws/variables.tf b/terraform/litellm/aws/variables.tf index 8db4935664b..c2ed1db14b1 100644 --- a/terraform/litellm/aws/variables.tf +++ b/terraform/litellm/aws/variables.tf @@ -533,3 +533,65 @@ variable "otel_headers_secret_arn" { type = string default = "" } + +# ---------- Enterprise billing metrics ---------- +# +# License-gated request metering. Opt-in and gated entirely on +# billing_metrics_endpoint: leave it empty (the default) and nothing +# metering-related lands in the container env. Set it and gateway + backend +# export billable-request counts over OTLP/HTTP, authenticating to the +# collector with an mTLS client cert. The proxy accepts the cert, key, and CA +# as either a file path or literal PEM content, so on Fargate they are +# injected straight from Secrets Manager as env vars and no volume is needed. + +variable "billing_metrics_endpoint" { + description = <<-EOT + OTLP/HTTP endpoint for enterprise billing metrics (sets + LITELLM_BILLING_METRICS_ENDPOINT). Non-empty enables request metering; + empty (default) disables it and adds no billing env to the container. + Requires an enterprise license. Example: + "https://telemetry.litellm.ai/v1/metrics" + EOT + type = string + default = "" +} + +variable "billing_metrics_client_cert_pem" { + description = <<-EOT + PEM content of the mTLS client certificate issued for this deployment. + When billing_metrics_endpoint is set, the stack stores this in a + `-litellm--billing-metrics-client-cert` Secrets Manager + entry, grants the task-execution role GetSecretValue on it, and exposes + it to gateway + backend as LITELLM_BILLING_METRICS_CLIENT_CERT. Required + whenever metering is enabled. + EOT + type = string + default = "" + sensitive = true +} + +variable "billing_metrics_client_key_pem" { + description = <<-EOT + PEM content of the private key matching + billing_metrics_client_cert_pem. Stored in a + `-litellm--billing-metrics-client-key` Secrets Manager + entry and exposed as LITELLM_BILLING_METRICS_CLIENT_KEY. Required + whenever metering is enabled. + EOT + type = string + default = "" + sensitive = true +} + +variable "billing_metrics_ca_cert_pem" { + description = <<-EOT + PEM content of the CA bundle used to verify the metering collector. + Only needed for private or test collectors whose CA is not in the + system trust store; telemetry.litellm.ai is publicly trusted, so leave + this empty for production. When set, it is exposed as + LITELLM_BILLING_METRICS_CA_CERT. + EOT + type = string + default = "" + sensitive = true +} diff --git a/terraform/litellm/gcp/README.md b/terraform/litellm/gcp/README.md index 1e0bf4319df..88e9979148f 100644 --- a/terraform/litellm/gcp/README.md +++ b/terraform/litellm/gcp/README.md @@ -204,6 +204,40 @@ Behavior matches the AWS stack 1:1; the only naming differences are `otel_headers_secret` (a Secret Manager resource ID) vs AWS's `otel_headers_secret_arn` (a Secrets Manager ARN). +### Enterprise billing metrics + +License-gated request metering is opt-in and gated entirely on +`billing_metrics_endpoint`. Empty (default) and no billing env is added to +the container, so existing deployments are unchanged. Set it and both +gateway and backend export billable-request counts over OTLP/HTTP, +authenticating to the collector with the mTLS client certificate issued for +your deployment. + +The proxy accepts the certificate, key, and CA bundle as either a file path +or literal PEM content. This stack takes the PEM, writes each one to its own +Secret Manager entry, grants the runtime service account +`roles/secretmanager.secretAccessor` on them, and injects them as Cloud Run +secret env vars `LITELLM_BILLING_METRICS_CLIENT_CERT` / `_CLIENT_KEY` (and +`_CA_CERT` when set), so no volume mount is needed. + +```hcl +billing_metrics_endpoint = "https://telemetry.litellm.ai/v1/metrics" +``` + +```bash +export TF_VAR_billing_metrics_client_cert_pem="$(cat client.crt)" +export TF_VAR_billing_metrics_client_key_pem="$(cat client.key)" +``` + +`billing_metrics_ca_cert_pem` is only for private or test collectors whose +CA is not in the system trust store; leave it empty against +`telemetry.litellm.ai`. Metering requires an enterprise license, so pair +this with `litellm_license`. To tune the export cadence, set +`LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MS` through `gateway_extra_env` / +`backend_extra_env` + +Behavior matches the AWS stack 1:1; the variable names are identical + ## Tenant deployment Every resource the stack creates is named `${tenant}-litellm-${env}` (or diff --git a/terraform/litellm/gcp/cloudrun.tf b/terraform/litellm/gcp/cloudrun.tf index 7b1bb901e20..57533b71731 100644 --- a/terraform/litellm/gcp/cloudrun.tf +++ b/terraform/litellm/gcp/cloudrun.tf @@ -59,6 +59,33 @@ locals { { name = "OTEL_HEADERS", secret = var.otel_headers_secret, version = "latest" }, ] : [] + # Enterprise request metering, gated on billing_metrics_endpoint. The + # endpoint rides in as a plain env var; the mTLS material lives in Secret + # Manager (secrets.tf) and is injected as PEM-valued env vars, which the + # proxy accepts in place of file paths. Each PEM is wired only when the + # operator supplied it, so an empty ca_cert_pem falls back to the system + # trust store. + billing_metrics_enabled = var.billing_metrics_endpoint != "" + billing_metrics_client_cert_enabled = local.billing_metrics_enabled && var.billing_metrics_client_cert_pem != "" + billing_metrics_client_key_enabled = local.billing_metrics_enabled && var.billing_metrics_client_key_pem != "" + billing_metrics_ca_cert_enabled = local.billing_metrics_enabled && var.billing_metrics_ca_cert_pem != "" + + billing_metrics_env_kv = local.billing_metrics_enabled ? [ + { name = "LITELLM_BILLING_METRICS_ENDPOINT", value = var.billing_metrics_endpoint }, + ] : [] + + billing_metrics_env_secrets = concat( + local.billing_metrics_client_cert_enabled ? [ + { name = "LITELLM_BILLING_METRICS_CLIENT_CERT", secret = google_secret_manager_secret.billing_metrics_client_cert[0].id, version = "latest" }, + ] : [], + local.billing_metrics_client_key_enabled ? [ + { name = "LITELLM_BILLING_METRICS_CLIENT_KEY", secret = google_secret_manager_secret.billing_metrics_client_key[0].id, version = "latest" }, + ] : [], + local.billing_metrics_ca_cert_enabled ? [ + { name = "LITELLM_BILLING_METRICS_CA_CERT", secret = google_secret_manager_secret.billing_metrics_ca_cert[0].id, version = "latest" }, + ] : [], + ) + # Cloud Run v2 secret env vars use value_source.secret_key_ref pointing at a # secret resource ID. Shared between gateway and backend (the migrations # job has its own narrower env list — see migrations_env_secrets below). @@ -138,6 +165,30 @@ locals { # ---------- Gateway ---------- resource "google_cloud_run_v2_service" "gateway" { + # Metering needs a client certificate AND its key. Each secret is created only + # when its own PEM is supplied, so an endpoint set with a missing key would + # otherwise apply cleanly and leave the proxy logging "missing config" and + # never exporting. ca_cert_pem stays optional: empty means fall back to the + # system trust store. + # + # The guard lives here, on an unconditional resource, rather than on the cert + # secret: that secret is count-gated on the cert itself, so it has zero + # instances in exactly the case this must catch. Adding count or for_each to + # this resource would silently stop the guard from evaluating. + # + # endpoint cert key -> result + # "" any any -> metering off, no secrets created + # set set set -> metering on + # set any-missing -> plan fails here + lifecycle { + precondition { + condition = var.billing_metrics_endpoint == "" || ( + var.billing_metrics_client_cert_pem != "" && var.billing_metrics_client_key_pem != "" + ) + error_message = "billing_metrics_client_cert_pem and billing_metrics_client_key_pem are both required when billing_metrics_endpoint is set." + } + } + name = "${local.name}-gateway" location = var.region ingress = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER" @@ -175,7 +226,7 @@ resource "google_cloud_run_v2_service" "gateway" { } dynamic "env" { - for_each = concat(local.shared_env_kv, local.gateway_otel_env_kv, local.gateway_extra_env_kv, local.proxy_config_env) + for_each = concat(local.shared_env_kv, local.gateway_otel_env_kv, local.billing_metrics_env_kv, local.gateway_extra_env_kv, local.proxy_config_env) content { name = env.value.name value = env.value.value @@ -183,7 +234,7 @@ resource "google_cloud_run_v2_service" "gateway" { } dynamic "env" { - for_each = concat(local.shared_env_secrets, local.otel_env_secrets, local.gateway_extra_secret_kv) + for_each = concat(local.shared_env_secrets, local.otel_env_secrets, local.billing_metrics_env_secrets, local.gateway_extra_secret_kv) content { name = env.value.name value_source { @@ -242,6 +293,9 @@ resource "google_cloud_run_v2_service" "gateway" { google_secret_manager_secret_iam_member.license, google_secret_manager_secret_iam_member.extras, google_secret_manager_secret_iam_member.otel_headers, + google_secret_manager_secret_iam_member.billing_metrics_client_cert, + google_secret_manager_secret_iam_member.billing_metrics_client_key, + google_secret_manager_secret_iam_member.billing_metrics_ca_cert, google_storage_bucket_iam_member.proxy_config_runtime, google_sql_user.app, # Don't go live until the schema is migrated; otherwise the proxy boots, @@ -252,6 +306,18 @@ resource "google_cloud_run_v2_service" "gateway" { # ---------- Backend ---------- resource "google_cloud_run_v2_service" "backend" { + # Same guard as the gateway: the backend meters too (it serves the named-server + # MCP transport), and a targeted apply of just this resource must not slip a + # billing endpoint through without the credentials to use it. + lifecycle { + precondition { + condition = var.billing_metrics_endpoint == "" || ( + var.billing_metrics_client_cert_pem != "" && var.billing_metrics_client_key_pem != "" + ) + error_message = "billing_metrics_client_cert_pem and billing_metrics_client_key_pem are both required when billing_metrics_endpoint is set." + } + } + name = "${local.name}-backend" location = var.region ingress = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER" @@ -289,7 +355,7 @@ resource "google_cloud_run_v2_service" "backend" { } dynamic "env" { - for_each = concat(local.shared_env_kv, local.backend_default_env_kv, local.backend_otel_env_kv, local.backend_extra_env_kv, local.proxy_config_env) + for_each = concat(local.shared_env_kv, local.backend_default_env_kv, local.backend_otel_env_kv, local.billing_metrics_env_kv, local.backend_extra_env_kv, local.proxy_config_env) content { name = env.value.name value = env.value.value @@ -297,7 +363,7 @@ resource "google_cloud_run_v2_service" "backend" { } dynamic "env" { - for_each = concat(local.shared_env_secrets, local.backend_managed_env_secrets, local.otel_env_secrets, local.backend_extra_secret_kv) + for_each = concat(local.shared_env_secrets, local.backend_managed_env_secrets, local.otel_env_secrets, local.billing_metrics_env_secrets, local.backend_extra_secret_kv) content { name = env.value.name value_source { @@ -357,6 +423,9 @@ resource "google_cloud_run_v2_service" "backend" { google_secret_manager_secret_iam_member.ui_password, google_secret_manager_secret_iam_member.extras, google_secret_manager_secret_iam_member.otel_headers, + google_secret_manager_secret_iam_member.billing_metrics_client_cert, + google_secret_manager_secret_iam_member.billing_metrics_client_key, + google_secret_manager_secret_iam_member.billing_metrics_ca_cert, google_storage_bucket_iam_member.proxy_config_runtime, google_sql_user.app, terraform_data.migration, diff --git a/terraform/litellm/gcp/iam.tf b/terraform/litellm/gcp/iam.tf index dc3ae5e0912..09df5e7dff0 100644 --- a/terraform/litellm/gcp/iam.tf +++ b/terraform/litellm/gcp/iam.tf @@ -79,3 +79,29 @@ resource "google_secret_manager_secret_iam_member" "otel_headers" { role = "roles/secretmanager.secretAccessor" member = "serviceAccount:${google_service_account.runtime.email}" } + +# Billing-metrics mTLS accessors — only created when request metering is +# enabled and the matching PEM was supplied. +resource "google_secret_manager_secret_iam_member" "billing_metrics_client_cert" { + count = local.billing_metrics_client_cert_enabled ? 1 : 0 + + secret_id = google_secret_manager_secret.billing_metrics_client_cert[0].id + role = "roles/secretmanager.secretAccessor" + member = "serviceAccount:${google_service_account.runtime.email}" +} + +resource "google_secret_manager_secret_iam_member" "billing_metrics_client_key" { + count = local.billing_metrics_client_key_enabled ? 1 : 0 + + secret_id = google_secret_manager_secret.billing_metrics_client_key[0].id + role = "roles/secretmanager.secretAccessor" + member = "serviceAccount:${google_service_account.runtime.email}" +} + +resource "google_secret_manager_secret_iam_member" "billing_metrics_ca_cert" { + count = local.billing_metrics_ca_cert_enabled ? 1 : 0 + + secret_id = google_secret_manager_secret.billing_metrics_ca_cert[0].id + role = "roles/secretmanager.secretAccessor" + member = "serviceAccount:${google_service_account.runtime.email}" +} diff --git a/terraform/litellm/gcp/secrets.tf b/terraform/litellm/gcp/secrets.tf index f93514bb70b..6ec77139996 100644 --- a/terraform/litellm/gcp/secrets.tf +++ b/terraform/litellm/gcp/secrets.tf @@ -63,3 +63,58 @@ resource "google_secret_manager_secret_version" "ui_password" { secret = google_secret_manager_secret.ui_password[0].id secret_data = var.ui_password } + +# Billing-metrics mTLS material — only created when metering is enabled +# (billing_metrics_endpoint non-empty) and the operator supplied the PEM. +# The runtime SA gets accessor permission via iam.tf, and gateway + backend +# pick the env vars up through billing_metrics_env_secrets in cloudrun.tf. +resource "google_secret_manager_secret" "billing_metrics_client_cert" { + count = local.billing_metrics_client_cert_enabled ? 1 : 0 + + secret_id = "${local.name}-billing-metrics-client-cert" + labels = local.labels + replication { + auto {} + } +} + +resource "google_secret_manager_secret_version" "billing_metrics_client_cert" { + count = local.billing_metrics_client_cert_enabled ? 1 : 0 + + secret = google_secret_manager_secret.billing_metrics_client_cert[0].id + secret_data = var.billing_metrics_client_cert_pem +} + +resource "google_secret_manager_secret" "billing_metrics_client_key" { + count = local.billing_metrics_client_key_enabled ? 1 : 0 + + secret_id = "${local.name}-billing-metrics-client-key" + labels = local.labels + replication { + auto {} + } +} + +resource "google_secret_manager_secret_version" "billing_metrics_client_key" { + count = local.billing_metrics_client_key_enabled ? 1 : 0 + + secret = google_secret_manager_secret.billing_metrics_client_key[0].id + secret_data = var.billing_metrics_client_key_pem +} + +resource "google_secret_manager_secret" "billing_metrics_ca_cert" { + count = local.billing_metrics_ca_cert_enabled ? 1 : 0 + + secret_id = "${local.name}-billing-metrics-ca-cert" + labels = local.labels + replication { + auto {} + } +} + +resource "google_secret_manager_secret_version" "billing_metrics_ca_cert" { + count = local.billing_metrics_ca_cert_enabled ? 1 : 0 + + secret = google_secret_manager_secret.billing_metrics_ca_cert[0].id + secret_data = var.billing_metrics_ca_cert_pem +} diff --git a/terraform/litellm/gcp/variables.tf b/terraform/litellm/gcp/variables.tf index 4355192e9f1..1162e100bb2 100644 --- a/terraform/litellm/gcp/variables.tf +++ b/terraform/litellm/gcp/variables.tf @@ -490,3 +490,66 @@ variable "otel_capture_message_content" { error_message = "otel_capture_message_content must be one of: no_content, prompt_and_completion." } } + +# ---------- Enterprise billing metrics ---------- +# +# License-gated request metering. Opt-in and gated entirely on +# billing_metrics_endpoint: leave it empty (the default) and nothing +# metering-related is added to the container env. Set it and gateway + +# backend export billable-request counts over OTLP/HTTP, authenticating to +# the collector with an mTLS client cert. The proxy accepts the cert, key, +# and CA as either a file path or literal PEM content, so on Cloud Run they +# are injected straight from Secret Manager as env vars and no volume is +# needed. + +variable "billing_metrics_endpoint" { + description = <<-EOT + OTLP/HTTP endpoint for enterprise billing metrics (sets + LITELLM_BILLING_METRICS_ENDPOINT). Non-empty enables request metering; + empty (default) disables it and adds no billing env to the container. + Requires an enterprise license. Example: + "https://telemetry.litellm.ai/v1/metrics" + EOT + type = string + default = "" +} + +variable "billing_metrics_client_cert_pem" { + description = <<-EOT + PEM content of the mTLS client certificate issued for this deployment. + When billing_metrics_endpoint is set, the stack stores this in a + `-litellm--billing-metrics-client-cert` Secret Manager + entry, grants the runtime SA accessor on it, and exposes it to gateway + + backend as LITELLM_BILLING_METRICS_CLIENT_CERT. Required whenever + metering is enabled. + EOT + type = string + default = "" + sensitive = true +} + +variable "billing_metrics_client_key_pem" { + description = <<-EOT + PEM content of the private key matching + billing_metrics_client_cert_pem. Stored in a + `-litellm--billing-metrics-client-key` Secret Manager entry + and exposed as LITELLM_BILLING_METRICS_CLIENT_KEY. Required whenever + metering is enabled. + EOT + type = string + default = "" + sensitive = true +} + +variable "billing_metrics_ca_cert_pem" { + description = <<-EOT + PEM content of the CA bundle used to verify the metering collector. + Only needed for private or test collectors whose CA is not in the + system trust store; telemetry.litellm.ai is publicly trusted, so leave + this empty for production. When set, it is exposed as + LITELLM_BILLING_METRICS_CA_CERT. + EOT + type = string + default = "" + sensitive = true +} diff --git a/tests/local_testing/test_llm_guard.py b/tests/local_testing/test_llm_guard.py index da881e19d3c..78bbd1c0af8 100644 --- a/tests/local_testing/test_llm_guard.py +++ b/tests/local_testing/test_llm_guard.py @@ -28,8 +28,11 @@ from litellm.caching.caching import DualCache @pytest.mark.asyncio async def test_llm_guard_valid_response(): """ - Tests to see llm guard raises an error for a flagged response + A valid (is_valid=True) LLM Guard response must apply the returned + sanitized_prompt back onto the request data so the provider receives the + redacted content. """ + litellm.llm_guard_mode = "all" input_a_anonymizer_results = { "sanitized_prompt": "hello world", "is_valid": True, @@ -44,21 +47,65 @@ async def test_llm_guard_valid_response(): user_api_key_dict = UserAPIKeyAuth(api_key=_api_key) local_cache = DualCache() - try: - await llm_guard.async_moderation_hook( - data={ - "messages": [ - { - "role": "user", - "content": "hello world, my name is Jane Doe. My number is: 23r323r23r2wwkl", - } - ] - }, - user_api_key_dict=user_api_key_dict, - call_type="completion", - ) - except Exception as e: - pytest.fail(f"An exception occurred - {str(e)}") + data = { + "messages": [ + { + "role": "user", + "content": "hello world, my name is Jane Doe. My number is: 23r323r23r2wwkl", + } + ] + } + + result = await llm_guard.async_moderation_hook( + data=data, + user_api_key_dict=user_api_key_dict, + call_type="completion", + ) + + assert result is data + assert data["messages"][0]["content"] == "hello world" + + +@pytest.mark.asyncio +async def test_llm_guard_sanitizes_multimodal_and_input(): + """ + Sanitization must reach text parts of multimodal message content and the + ``input`` field (embeddings/moderation) while leaving non-text parts intact. + """ + litellm.llm_guard_mode = "all" + llm_guard = _ENTERPRISE_LLMGuard( + mock_testing=True, + mock_redacted_text={ + "sanitized_prompt": "email: [REDACTED]", + "is_valid": True, + "scanners": {"Regex": 0.0}, + }, + ) + user_api_key_dict = UserAPIKeyAuth(api_key=hash_token("sk-12345")) + + image_part = {"type": "image_url", "image_url": {"url": "https://example.com/a.png"}} + data = { + "messages": [ + { + "role": "user", + "content": [ + {"type": "text", "text": "email: person@example.com"}, + image_part, + ], + } + ] + } + result = await llm_guard.async_moderation_hook( + data=data, user_api_key_dict=user_api_key_dict, call_type="completion" + ) + assert result["messages"][0]["content"][0]["text"] == "email: [REDACTED]" + assert result["messages"][0]["content"][1] == image_part + + input_data = {"input": ["email: person@example.com", "another prompt"]} + input_result = await llm_guard.async_moderation_hook( + data=input_data, user_api_key_dict=user_api_key_dict, call_type="embeddings" + ) + assert input_result["input"] == ["email: [REDACTED]", "email: [REDACTED]"] @pytest.mark.asyncio diff --git a/tests/test_litellm/caching/test_caching_handler.py b/tests/test_litellm/caching/test_caching_handler.py index 01327529410..1136a0b7e7b 100644 --- a/tests/test_litellm/caching/test_caching_handler.py +++ b/tests/test_litellm/caching/test_caching_handler.py @@ -556,3 +556,31 @@ async def test_embedding_cache_falls_back_to_token_counter_for_legacy_entries(): assert cache_hit # token_counter over "hello world" yields a nonzero count — fallback path still runs assert response.usage.prompt_tokens > 0 + + +def test_request_kwargs_does_not_retain_logging_obj(): + """ + The caching handler lives on logging_obj._llm_caching_handler, so keeping + litellm_logging_obj inside request_kwargs closes a reference cycle + (Logging -> LLMCachingHandler -> kwargs -> Logging). That cycle keeps the + full request payload alive until a generational GC pass instead of being + freed by refcount when the request finishes; under bursts of large-token + requests this presents as stepwise RSS growth that never returns to + baseline. Other kwargs (messages included) must be preserved. + """ + logging_obj = MagicMock() + kwargs = { + "model": "gpt-4o", + "messages": [{"role": "user", "content": "hello"}], + "litellm_logging_obj": logging_obj, + } + + handler = LLMCachingHandler( + original_function=MagicMock(), + request_kwargs=kwargs, + start_time=datetime.now(), + ) + + assert "litellm_logging_obj" not in handler.request_kwargs + assert handler.request_kwargs["messages"] == kwargs["messages"] + assert handler.request_kwargs["model"] == "gpt-4o" diff --git a/tests/test_litellm/litellm_core_utils/test_litellm_logging.py b/tests/test_litellm/litellm_core_utils/test_litellm_logging.py index ade2c677745..f99cfb953ba 100644 --- a/tests/test_litellm/litellm_core_utils/test_litellm_logging.py +++ b/tests/test_litellm/litellm_core_utils/test_litellm_logging.py @@ -32,6 +32,13 @@ def logging_obj(): ) +def test_get_combined_callback_list_preserves_insertion_order(logging_obj): + assert logging_obj.get_combined_callback_list( + dynamic_success_callbacks=["prometheus", "langfuse", "datadog", "otel", "s3"], + global_callbacks=["langfuse", "gcs_bucket", "arize", "logfire"], + ) == ["prometheus", "langfuse", "datadog", "otel", "s3", "gcs_bucket", "arize", "logfire"] + + def test_get_masked_api_base(logging_obj): api_base = "https://api.openai.com/v1" masked_api_base = logging_obj._get_masked_api_base(api_base) @@ -3773,3 +3780,19 @@ def test_zero_token_video_usage_preserves_duration_seconds(logging_obj): assert payload["metadata"]["usage_object"]["duration_seconds"] == 4.0 assert payload["total_tokens"] == 0 assert payload["completion_tokens"] == 0 + + +def test_pre_call_does_not_pin_request_in_module_state(logging_obj): + """ + pre_call/post_call must not stash their locals (full messages, the Logging + object, complete_input_dict) into module-level state. That pinned the most + recent request's entire payload in memory for the life of the worker, + which with multi-hundred-KB requests is a permanent per-worker leak. + """ + litellm.error_logs.clear() + big_input = [{"role": "user", "content": "x" * 10_000}] + + logging_obj.pre_call(input=big_input, api_key="sk-test") + logging_obj.post_call(original_response='{"ok": true}', input=big_input, api_key="sk-test") + + assert litellm.error_logs == {} diff --git a/tests/test_litellm/litellm_core_utils/test_redact_messages.py b/tests/test_litellm/litellm_core_utils/test_redact_messages.py index 0f7f492ddb6..e1ffabb3515 100644 --- a/tests/test_litellm/litellm_core_utils/test_redact_messages.py +++ b/tests/test_litellm/litellm_core_utils/test_redact_messages.py @@ -320,6 +320,176 @@ class TestPerformRedaction: assert choice.message.content == "redacted-by-litellm" assert choice.message.reasoning_content == "redacted-by-litellm" + def test_redacts_tool_call_arguments_in_model_response_dict(self): + """Assistant tool call arguments must not leak when redaction is on.""" + result = { + "choices": [ + { + "message": { + "content": None, + "tool_calls": [ + { + "id": "call_1", + "type": "function", + "function": { + "name": "get_weather", + "arguments": '{"city": "sensitive-city"}', + }, + } + ], + "function_call": { + "name": "get_weather", + "arguments": '{"city": "sensitive-city"}', + }, + } + } + ] + } + + redacted = perform_redaction({}, result) + + message = redacted["choices"][0]["message"] + assert message["content"] == "redacted-by-litellm" + tool_call = message["tool_calls"][0] + assert tool_call["function"]["arguments"] == "redacted-by-litellm" + assert tool_call["function"]["name"] == "get_weather" + assert message["function_call"]["arguments"] == "redacted-by-litellm" + + def test_redacts_tool_call_arguments_in_streaming_delta_dict(self): + result = { + "choices": [ + { + "delta": { + "content": None, + "tool_calls": [ + { + "index": 0, + "function": { + "name": "get_weather", + "arguments": '{"city": "sensitive-city"}', + }, + } + ], + } + } + ] + } + + redacted = perform_redaction({}, result) + + delta = redacted["choices"][0]["delta"] + assert delta["tool_calls"][0]["function"]["arguments"] == "redacted-by-litellm" + + def test_redacts_tool_call_arguments_on_model_response_object(self): + result = litellm.ModelResponse( + id="resp-1", + choices=[ + litellm.Choices( + message=litellm.Message( + content=None, + role="assistant", + tool_calls=[ + { + "id": "call_1", + "type": "function", + "function": { + "name": "get_weather", + "arguments": '{"city": "sensitive-city"}', + }, + } + ], + ) + ) + ], + model="gpt-4o", + ) + + redacted = perform_redaction({}, result) + + tool_call = redacted.choices[0].message.tool_calls[0] + assert tool_call.function.arguments == "redacted-by-litellm" + assert tool_call.function.name == "get_weather" + assert result.choices[0].message.tool_calls[0].function.arguments == ( + '{"city": "sensitive-city"}' + ) + + def test_redacts_tool_call_arguments_on_streaming_response_object(self): + """Reproduces the Stream=True path where tool calls arrive as deltas.""" + streaming_choice = litellm.utils.StreamingChoices( + delta=litellm.utils.Delta( + content=None, + role="assistant", + tool_calls=[ + { + "index": 0, + "id": "call_1", + "type": "function", + "function": { + "name": "get_weather", + "arguments": '{"city": "sensitive-city"}', + }, + } + ], + ) + ) + streaming_response = SimpleNamespace(choices=[streaming_choice]) + details = { + "stream": True, + "complete_streaming_response": streaming_response, + } + + perform_redaction(details, None) + + tool_call = streaming_response.choices[0].delta.tool_calls[0] + assert tool_call.function.arguments == "redacted-by-litellm" + + def test_redacts_tool_call_arguments_in_standard_logging_object(self): + details = { + "standard_logging_object": { + "response": { + "choices": [ + { + "message": { + "content": None, + "tool_calls": [ + { + "id": "call_1", + "type": "function", + "function": { + "name": "get_weather", + "arguments": '{"city": "sensitive-city"}', + }, + } + ], + } + } + ] + } + } + } + + perform_redaction(details, None) + + message = details["standard_logging_object"]["response"]["choices"][0]["message"] + assert message["tool_calls"][0]["function"]["arguments"] == "redacted-by-litellm" + + def test_redacts_responses_api_function_call_arguments_dict(self): + result = { + "output": [ + { + "type": "function_call", + "name": "get_weather", + "arguments": '{"city": "sensitive-city"}', + "call_id": "call_1", + } + ] + } + + redacted = perform_redaction({}, result) + + assert redacted["output"][0]["arguments"] == "redacted-by-litellm" + assert redacted["output"][0]["name"] == "get_weather" + def test_redacts_response_output_objects_with_top_level_text(self): output_items = [ SimpleNamespace(text="top-level output"), diff --git a/tests/test_litellm/llms/anthropic/chat/guardrail_translation/test_anthropic_guardrail_handler.py b/tests/test_litellm/llms/anthropic/chat/guardrail_translation/test_anthropic_guardrail_handler.py index 807f1fe95f5..c5422e0d70f 100644 --- a/tests/test_litellm/llms/anthropic/chat/guardrail_translation/test_anthropic_guardrail_handler.py +++ b/tests/test_litellm/llms/anthropic/chat/guardrail_translation/test_anthropic_guardrail_handler.py @@ -7,7 +7,7 @@ with guardrail transformations, specifically testing edge cases with empty choic import os import sys -from typing import Any, List, Literal, Optional +from typing import Any, Literal, Optional from unittest.mock import MagicMock, patch import pytest @@ -295,6 +295,81 @@ class TestAnthropicMessagesHandlerInputProcessing: assert "input_schema" in tools[1] +class ToolAppendingGuardrail(CustomGuardrail): + """Guardrail that appends a new OpenAI-format function tool, mimicking a + guardrail that injects a retrieval/recovery tool the model can later call.""" + + async def apply_guardrail( + self, + inputs: GenericGuardrailAPIInputs, + request_data: dict, + input_type: Literal["request", "response"], + logging_obj: Optional[Any] = None, + ) -> GenericGuardrailAPIInputs: + tools = list(inputs.get("tools") or []) + tools.append( + { + "type": "function", + "function": { + "name": "injected_tool", + "description": "injected by guardrail", + "parameters": {"type": "object", "properties": {}}, + }, + } + ) + inputs["tools"] = tools + return inputs + + +class TestAnthropicMessagesHandlerToolInjection: + """A tool a guardrail injects in OpenAI format must survive the write-back + to Anthropic format alongside the request's original tools.""" + + @pytest.mark.asyncio + async def test_injected_tool_survives_when_request_already_has_tools(self): + handler = AnthropicMessagesHandler() + guardrail = ToolAppendingGuardrail(guardrail_name="test") + + data = { + "model": "claude-opus-4-6", + "messages": [{"role": "user", "content": "hi"}], + "tools": [ + { + "name": "get_weather", + "description": "Get the weather at a specific location", + "input_schema": { + "type": "object", + "properties": {"location": {"type": "string"}}, + }, + } + ], + } + + result = await handler.process_input_messages( + data=data, guardrail_to_apply=guardrail, litellm_logging_obj=MagicMock() + ) + + names = [t.get("name") for t in result["tools"]] + assert "get_weather" in names + assert "injected_tool" in names + + @pytest.mark.asyncio + async def test_injected_tool_survives_when_request_has_no_tools(self): + handler = AnthropicMessagesHandler() + guardrail = ToolAppendingGuardrail(guardrail_name="test") + + data = { + "model": "claude-opus-4-6", + "messages": [{"role": "user", "content": "hi"}], + } + + result = await handler.process_input_messages( + data=data, guardrail_to_apply=guardrail, litellm_logging_obj=MagicMock() + ) + + assert [t.get("name") for t in result["tools"]] == ["injected_tool"] + + if __name__ == "__main__": # Run the tests pytest.main([__file__, "-v"]) diff --git a/tests/test_litellm/llms/bedrock_mantle/test_bedrock_mantle_responses_transformation.py b/tests/test_litellm/llms/bedrock_mantle/test_bedrock_mantle_responses_transformation.py index aafaf401700..816a025e11a 100644 --- a/tests/test_litellm/llms/bedrock_mantle/test_bedrock_mantle_responses_transformation.py +++ b/tests/test_litellm/llms/bedrock_mantle/test_bedrock_mantle_responses_transformation.py @@ -397,6 +397,20 @@ class TestBedrockMantleResponsesRegistry: assert isinstance(cfg, BedrockMantleResponsesAPIConfig) assert cfg.use_openai_path is True + @pytest.mark.parametrize( + "model", + ["openai.gpt-5.6-sol", "openai.gpt-5.6-terra", "openai.gpt-5.6-luna"], + ) + def test_registry_returns_config_for_gpt_5_6_family(self, local_cost_map, model): + from litellm.utils import ProviderConfigManager + + cfg = ProviderConfigManager.get_provider_responses_api_config( + provider="bedrock_mantle", + model=model, + ) + assert isinstance(cfg, BedrockMantleResponsesAPIConfig) + assert cfg.use_openai_path is True + def test_registry_returns_native_config_for_gpt_oss(self, local_cost_map): # Core regression: gpt-oss-120b supports the native Responses API (AWS # model card), so it must get a BedrockMantleResponsesAPIConfig on the @@ -460,7 +474,12 @@ class TestBedrockMantleResponsesRegistry: model="xai.grok-4.3", ) assert isinstance(cfg, BedrockMantleResponsesAPIConfig) - assert cfg.use_openai_path is False + # grok-4.3 is a third-party frontier model on Bedrock Mantle, served on the + # /openai/v1 base (like gpt-5.x / gemma-4), not the standard /v1 path used by + # open-weights models such as gpt-oss. The standard /v1 base returns + # "Berm is not enabled for this account", so the price-map entry carries + # use_openai_responses_path=true. + assert cfg.use_openai_path is True def test_unmapped_frontier_model_falls_through_to_none(self, restore_model_cost): # The gate is data-driven, not name-based: an unseen model not yet in the @@ -1237,6 +1256,25 @@ class TestBedrockMantleResponsesPricing: assert info["cache_read_input_token_cost"] == pytest.approx(2.75e-07) assert info["max_input_tokens"] == 272000 + @pytest.mark.parametrize( + "model, input_cost, cache_creation_cost, cache_read_cost, output_cost", + [ + ("openai.gpt-5.6-sol", 5.5e-06, 6.875e-06, 5.5e-07, 3.3e-05), + ("openai.gpt-5.6-terra", 2.75e-06, 3.4375e-06, 2.75e-07, 1.65e-05), + ("openai.gpt-5.6-luna", 1.1e-06, 1.375e-06, 1.1e-07, 6.6e-06), + ], + ) + def test_gpt_5_6_pricing_and_mode( + self, local_cost_map, model, input_cost, cache_creation_cost, cache_read_cost, output_cost + ): + info = litellm.get_model_info(f"bedrock_mantle/{model}") + assert info["mode"] == "responses" + assert info["input_cost_per_token"] == pytest.approx(input_cost) + assert info["cache_creation_input_token_cost"] == pytest.approx(cache_creation_cost) + assert info["cache_read_input_token_cost"] == pytest.approx(cache_read_cost) + assert info["output_cost_per_token"] == pytest.approx(output_cost) + assert info["max_input_tokens"] == 272000 + def test_models_registered(self, local_cost_map): assert "bedrock_mantle/openai.gpt-5.5" in litellm.bedrock_mantle_models assert "bedrock_mantle/openai.gpt-5.4" in litellm.bedrock_mantle_models diff --git a/tests/test_litellm/llms/custom_httpx/test_llm_http_handler.py b/tests/test_litellm/llms/custom_httpx/test_llm_http_handler.py index 926f40a6c67..fddd8d09dfc 100644 --- a/tests/test_litellm/llms/custom_httpx/test_llm_http_handler.py +++ b/tests/test_litellm/llms/custom_httpx/test_llm_http_handler.py @@ -1084,6 +1084,147 @@ def test_sync_delete_responses_sets_json_content_type(): # --------------------------------------------------------------------------- +@pytest.mark.parametrize( + "litellm_params_kwargs, stream, global_timeout, expected", + [ + ({"timeout": 12.0}, False, None, 12.0), + ({"request_timeout": 30.0}, False, None, 30.0), + ({}, False, 1500.0, 1500.0), + ({"timeout": 5.0, "stream_timeout": 50.0}, True, None, 50.0), + ({"timeout": 5.0, "stream_timeout": 50.0}, False, None, 5.0), + ({"timeout": 5.0, "request_timeout": 30.0}, False, None, 5.0), + ({}, False, None, None), + ({}, True, None, None), + ], +) +def test_resolve_anthropic_messages_timeout( + monkeypatch, litellm_params_kwargs, stream, global_timeout, expected +): + from litellm.constants import DEFAULT_REQUEST_TIMEOUT_SECONDS + + if global_timeout is None: + monkeypatch.setattr( + "litellm.request_timeout", + float(DEFAULT_REQUEST_TIMEOUT_SECONDS), + raising=False, + ) + monkeypatch.setattr( + "litellm.request_timeout_explicitly_set", + False, + raising=False, + ) + else: + monkeypatch.setattr("litellm.request_timeout", global_timeout, raising=False) + monkeypatch.setattr( + "litellm.request_timeout_explicitly_set", True, raising=False + ) + + resolved = BaseLLMHTTPHandler._resolve_anthropic_messages_timeout( + litellm_params=GenericLiteLLMParams(**litellm_params_kwargs), + stream=stream, + custom_llm_provider="anthropic", + ) + + assert resolved == expected + + +@pytest.mark.asyncio +async def test_async_anthropic_messages_handler_forwards_request_timeout(monkeypatch): + from litellm.constants import DEFAULT_REQUEST_TIMEOUT_SECONDS + + monkeypatch.setattr(litellm, "callbacks", []) + monkeypatch.setattr(litellm, "request_timeout", float(DEFAULT_REQUEST_TIMEOUT_SECONDS)) + monkeypatch.setattr(litellm, "request_timeout_explicitly_set", False) + handler = BaseLLMHTTPHandler() + + mock_config = Mock() + mock_config.validate_anthropic_messages_environment = Mock( + return_value=({"x-api-key": "k"}, "https://api.anthropic.com") + ) + mock_config.should_filter_anthropic_beta_headers = Mock(return_value=False) + mock_config.transform_anthropic_messages_request = Mock( + return_value={"model": "claude", "messages": []} + ) + mock_config.get_complete_url = Mock(return_value="https://api.anthropic.com/v1/messages") + mock_config.sign_request = Mock(return_value=({"x-api-key": "k"}, None)) + mock_config.max_retry_on_anthropic_messages_http_error = 1 + expected_response = {"id": "msg_1", "content": []} + mock_config.transform_anthropic_messages_response = Mock(return_value=expected_response) + + ok_response = Mock() + ok_response.raise_for_status = Mock(return_value=None) + mock_client = AsyncMock(spec=AsyncHTTPHandler) + mock_client.post = AsyncMock(return_value=ok_response) + + logging_obj = Mock() + logging_obj.model_call_details = {} + logging_obj.dynamic_success_callbacks = [] + + result = await handler.async_anthropic_messages_handler( + model="claude", + messages=[{"role": "user", "content": "hi"}], + anthropic_messages_provider_config=mock_config, + anthropic_messages_optional_request_params={}, + custom_llm_provider="anthropic", + litellm_params=GenericLiteLLMParams(request_timeout=0.3), + logging_obj=logging_obj, + client=mock_client, + kwargs={}, + ) + + assert result is expected_response + assert mock_client.post.await_args.kwargs["timeout"] == 0.3 + + +@pytest.mark.asyncio +async def test_async_anthropic_messages_handler_forwards_stream_timeout(monkeypatch): + from litellm.constants import DEFAULT_REQUEST_TIMEOUT_SECONDS + + monkeypatch.setattr(litellm, "callbacks", []) + monkeypatch.setattr(litellm, "request_timeout", float(DEFAULT_REQUEST_TIMEOUT_SECONDS)) + monkeypatch.setattr(litellm, "request_timeout_explicitly_set", False) + handler = BaseLLMHTTPHandler() + + mock_config = Mock() + mock_config.validate_anthropic_messages_environment = Mock( + return_value=({"x-api-key": "k"}, "https://api.anthropic.com") + ) + mock_config.should_filter_anthropic_beta_headers = Mock(return_value=False) + mock_config.transform_anthropic_messages_request = Mock( + return_value={"model": "claude", "messages": []} + ) + mock_config.get_complete_url = Mock(return_value="https://api.anthropic.com/v1/messages") + mock_config.sign_request = Mock(return_value=({"x-api-key": "k"}, None)) + mock_config.max_retry_on_anthropic_messages_http_error = 1 + mock_config.get_async_streaming_response_iterator = Mock(return_value=Mock()) + + ok_response = Mock() + ok_response.raise_for_status = Mock(return_value=None) + ok_response.headers = httpx.Headers({}) + mock_client = AsyncMock(spec=AsyncHTTPHandler) + mock_client.post = AsyncMock(return_value=ok_response) + + logging_obj = Mock() + logging_obj.model_call_details = {} + logging_obj.dynamic_success_callbacks = [] + + await handler.async_anthropic_messages_handler( + model="claude", + messages=[{"role": "user", "content": "hi"}], + anthropic_messages_provider_config=mock_config, + anthropic_messages_optional_request_params={}, + custom_llm_provider="anthropic", + litellm_params=GenericLiteLLMParams(timeout=9.0, stream_timeout=0.7), + logging_obj=logging_obj, + client=mock_client, + stream=True, + kwargs={}, + ) + + assert mock_client.post.await_args.kwargs["stream"] is True + assert mock_client.post.await_args.kwargs["timeout"] == 0.7 + + @pytest.mark.asyncio async def test_anthropic_post_uses_prebuilt_body_without_redumping(): """When the caller passes a pre-serialized (unsigned) body, attempt 0 must @@ -1894,7 +2035,9 @@ async def test_anthropic_invalid_thinking_signature_retry_resigns_bedrock_reques ok_response = httpx.Response(200, json={"id": "msg_1"}, request=httpx.Request("POST", request_url)) class FakeAsyncClient: - async def post(self, url, headers, data, stream=False, logging_obj=None): + async def post( + self, url, headers, data, stream=False, logging_obj=None, timeout=None + ): posts.append({"headers": dict(headers), "data": data}) return invalid_signature_response if len(posts) == 1 else ok_response diff --git a/tests/test_litellm/llms/openai/responses/test_openai_responses_guardrail_handler.py b/tests/test_litellm/llms/openai/responses/test_openai_responses_guardrail_handler.py index 49cd1b71ef2..4c45eaac7b9 100644 --- a/tests/test_litellm/llms/openai/responses/test_openai_responses_guardrail_handler.py +++ b/tests/test_litellm/llms/openai/responses/test_openai_responses_guardrail_handler.py @@ -1168,3 +1168,69 @@ class TestGetStructuredMessages: data = {"input": None} result = handler.get_structured_messages(data) assert result is None + + +class ToolAppendingGuardrail(CustomGuardrail): + """Guardrail that appends a new function tool, mimicking a guardrail that + injects a retrieval/recovery tool the model can later call.""" + + async def apply_guardrail( + self, + inputs: GenericGuardrailAPIInputs, + request_data: dict, + input_type: Literal["request", "response"], + logging_obj: Optional[Any] = None, + ) -> GenericGuardrailAPIInputs: + tools = list(inputs.get("tools") or []) + tools.append( + { + "type": "function", + "function": { + "name": "injected_tool", + "description": "injected by guardrail", + "parameters": {"type": "object", "properties": {}}, + }, + } + ) + inputs["tools"] = tools + return inputs + + +class TestOpenAIResponsesHandlerToolInjection: + """A tool a guardrail injects must survive the write-back to Responses format.""" + + def test_merge_keeps_guardrail_appended_tool(self): + """_merge_tools_after_guardrail must not drop the extra appended tool.""" + handler = OpenAIResponsesHandler() + original = [{"type": "function", "name": "a"}] + remapped = [ + {"type": "function", "name": "a"}, + {"type": "function", "name": "b"}, + ] + merged = handler._merge_tools_after_guardrail(original, remapped) + assert [t["name"] for t in merged] == ["a", "b"] + + @pytest.mark.asyncio + async def test_injected_tool_survives_when_request_already_has_tools(self): + """Regression: the merge dropped the injected tool whenever the request + already carried tools, so the model never saw it.""" + handler = OpenAIResponsesHandler() + guardrail = ToolAppendingGuardrail(guardrail_name="test") + + data = { + "input": [{"role": "user", "content": "hi", "type": "message"}], + "tools": [ + { + "type": "function", + "name": "get_weather", + "parameters": {"type": "object", "properties": {}}, + } + ], + "model": "gpt-4", + } + + result = await handler.process_input_messages(data, guardrail) + + names = [t.get("name") for t in result["tools"]] + assert "get_weather" in names + assert "injected_tool" in names diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_oauth2_token_cache.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_oauth2_token_cache.py index 7d2cf4442a5..47112fc9900 100644 --- a/tests/test_litellm/proxy/_experimental/mcp_server/test_oauth2_token_cache.py +++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_oauth2_token_cache.py @@ -227,3 +227,66 @@ async def test_client_credentials_uses_client_secret_basic_when_configured(): assert "client_secret" not in kwargs["data"] assert "client_id" not in kwargs["data"] assert kwargs["data"]["grant_type"] == "client_credentials" + + +def test_storage_ttl_capped_at_token_lifetime(): + """A token_storage_ttl_seconds longer than the token's own lifetime must be capped at + expires_in minus the expiry buffer. Before the cap, the configured TTL won outright and the + Redis fast path (which never re-checks expires_at) kept serving the dead token until eviction, + while the stored refresh_token sat unused because refresh only runs on the DB read-through.""" + from litellm.constants import MCP_PER_USER_TOKEN_EXPIRY_BUFFER_SECONDS + from litellm.proxy._experimental.mcp_server.oauth2_token_cache import ( + _compute_per_user_token_ttl, + ) + + server = _server(oauth2_flow=None, token_storage_ttl_seconds=604800) + assert _compute_per_user_token_ttl(server, expires_in=86400) == 86400 - MCP_PER_USER_TOKEN_EXPIRY_BUFFER_SECONDS + + +def test_storage_ttl_shorter_than_token_lifetime_wins(): + """A configured TTL below the token lifetime is the operative value: the knob's purpose is to + force earlier DB re-checks (staleness backstop), so the shorter side must win the min().""" + from litellm.proxy._experimental.mcp_server.oauth2_token_cache import ( + _compute_per_user_token_ttl, + ) + + server = _server(oauth2_flow=None, token_storage_ttl_seconds=3600) + assert _compute_per_user_token_ttl(server, expires_in=86400) == 3600 + + +def test_storage_ttl_verbatim_when_token_lifetime_unknown(): + """With no expires_in from the upstream there is nothing to cap against, so the configured + TTL applies as-is (matching the pre-cap behavior for lifetime-less tokens).""" + from litellm.proxy._experimental.mcp_server.oauth2_token_cache import ( + _compute_per_user_token_ttl, + ) + + server = _server(oauth2_flow=None, token_storage_ttl_seconds=604800) + assert _compute_per_user_token_ttl(server, expires_in=None) == 604800 + + +def test_storage_ttl_floors_at_one_second_for_nearly_dead_token(): + """A token already inside the expiry buffer yields the 1-second floor, not zero or a negative + TTL, mirroring the floor the default (unconfigured) path has always had.""" + from litellm.proxy._experimental.mcp_server.oauth2_token_cache import ( + _compute_per_user_token_ttl, + ) + + server = _server(oauth2_flow=None, token_storage_ttl_seconds=3600) + assert _compute_per_user_token_ttl(server, expires_in=30) == 1 + + +def test_default_ttl_paths_unchanged_without_storage_ttl(): + """With token_storage_ttl_seconds unset the TTL still derives from expires_in minus the + buffer, and falls back to MCP_PER_USER_TOKEN_DEFAULT_TTL when expires_in is absent.""" + from litellm.constants import ( + MCP_PER_USER_TOKEN_DEFAULT_TTL, + MCP_PER_USER_TOKEN_EXPIRY_BUFFER_SECONDS, + ) + from litellm.proxy._experimental.mcp_server.oauth2_token_cache import ( + _compute_per_user_token_ttl, + ) + + server = _server(oauth2_flow=None) + assert _compute_per_user_token_ttl(server, expires_in=86400) == 86400 - MCP_PER_USER_TOKEN_EXPIRY_BUFFER_SECONDS + assert _compute_per_user_token_ttl(server, expires_in=None) == MCP_PER_USER_TOKEN_DEFAULT_TTL diff --git a/tests/test_litellm/proxy/auth/test_cli_auth.py b/tests/test_litellm/proxy/auth/test_cli_auth.py index a4f72ef90ef..c9b31a1d776 100644 --- a/tests/test_litellm/proxy/auth/test_cli_auth.py +++ b/tests/test_litellm/proxy/auth/test_cli_auth.py @@ -60,13 +60,13 @@ async def test_normalize_teams_with_details_with_aliases(): @patch("litellm.proxy.client.cli.commands.auth.requests.post") def test_start_cli_sso_flow_rejects_invalid_response(request_mock): - """Test CLI SSO start rejects malformed server responses""" + """Test CLI SSO start rejects malformed server responses and names the missing fields""" response = Mock() - response.raise_for_status = Mock() + response.status_code = 200 response.json.return_value = {"login_id": "cli-session", "user_code": "ABCD-EFGH"} request_mock.return_value = response - with pytest.raises(ValueError, match="Invalid CLI SSO start response"): + with pytest.raises(ValueError, match="missing required field\\(s\\): poll_secret"): _start_cli_sso_flow("https://litellm.com") @@ -75,15 +75,13 @@ def test_start_cli_sso_flow_rejects_invalid_response(request_mock): "litellm.proxy.client.cli.commands.auth.requests.get", side_effect=[Mock(status_code=404)], ) -@patch("litellm.proxy.client.cli.commands.auth.click.echo") @patch("litellm.proxy.client.cli.commands.auth.time.sleep") -async def test_poll_for_ready_404(sleep_mock, click_mock, request_mock): - """Test poll_for_ready function""" - actual = _poll_for_ready_data( - "https://litellm.com", poll_interval=1, total_timeout=1, request_timeout=42 - ) - assert actual is None - click_mock.assert_called_once_with("Polling error: HTTP 404") +async def test_poll_for_ready_404(sleep_mock, request_mock): + """Test polling treats HTTP 404 as a permanent error and raises instead of retrying""" + with pytest.raises(ValueError, match="rejected the login session with HTTP 404"): + _poll_for_ready_data( + "https://litellm.com", poll_interval=1, total_timeout=1, request_timeout=42 + ) request_mock.assert_called_once_with("https://litellm.com", timeout=42) diff --git a/tests/test_litellm/proxy/client/cli/test_auth_commands.py b/tests/test_litellm/proxy/client/cli/test_auth_commands.py index 6be43c9da44..a451889415f 100644 --- a/tests/test_litellm/proxy/client/cli/test_auth_commands.py +++ b/tests/test_litellm/proxy/client/cli/test_auth_commands.py @@ -8,6 +8,7 @@ from unittest.mock import Mock, mock_open, patch sys.path.insert(0, os.path.abspath("../../..")) # Adds the parent directory to the system path +import pytest from click.testing import CliRunner from litellm.constants import CLI_JWT_EXPIRATION_HOURS @@ -40,6 +41,138 @@ def _mock_cli_sso_start_response( return mock_response +class TestPollingErrorSurfacing: + def test_client_error_raises_with_server_detail_and_stops_polling(self): + from litellm.proxy.client.cli.commands.auth import _poll_for_ready_data + + mock_response = Mock() + mock_response.status_code = 400 + mock_response.json.return_value = { + "detail": "Your litellm CLI is out of date and uses a login flow this proxy no longer supports." + } + + with patch("requests.get", return_value=mock_response) as mock_get, patch("time.sleep"): + with pytest.raises(ValueError) as exc_info: + _poll_for_ready_data("http://test/sso/cli/poll/sk-legacy") + + assert mock_get.call_count == 1 + assert ( + "The proxy rejected the login session with HTTP 400: Your litellm CLI is out of date " + "and uses a login flow this proxy no longer supports." in str(exc_info.value) + ) + + def test_login_command_shows_server_rejection_to_user(self): + mock_context = Mock() + mock_context.obj = {"base_url": "https://test.example.com"} + + mock_poll_response = Mock() + mock_poll_response.status_code = 400 + mock_poll_response.json.return_value = {"detail": "CLI login session not found or expired."} + + with ( + patch("webbrowser.open"), + patch("requests.post", return_value=_mock_cli_sso_start_response()), + patch("requests.get", return_value=mock_poll_response), + patch("time.sleep"), + ): + result = CliRunner().invoke(login, obj=mock_context.obj) + + assert result.exit_code == 0 + assert "❌ Authentication failed:" in result.output + assert "CLI login session not found or expired." in result.output + assert "Authentication timed out" not in result.output + + def test_server_error_without_json_body_retries_until_timeout(self, capsys): + from litellm.proxy.client.cli.commands.auth import _poll_for_ready_data + + mock_response = Mock() + mock_response.status_code = 500 + mock_response.json.side_effect = ValueError("no json") + + with patch("requests.get", return_value=mock_response) as mock_get, patch("time.sleep"): + result = _poll_for_ready_data("http://test/sso/cli/poll/cli-abc", total_timeout=6, poll_interval=2) + + assert result is None + assert mock_get.call_count == 3 + assert "Polling error: HTTP 500" in capsys.readouterr().out + + def test_rate_limit_is_retried_not_aborted(self, capsys): + from litellm.proxy.client.cli.commands.auth import _poll_for_ready_data + + mock_response = Mock() + mock_response.status_code = 429 + mock_response.json.return_value = {"detail": "Too many CLI login attempts. Try again later."} + + with patch("requests.get", return_value=mock_response) as mock_get, patch("time.sleep"): + result = _poll_for_ready_data("http://test/sso/cli/poll/cli-abc", total_timeout=4, poll_interval=2) + + assert result is None + assert mock_get.call_count == 2 + assert "Polling error: HTTP 429: Too many CLI login attempts. Try again later." in capsys.readouterr().out + + +class TestStartCliSsoFlowErrors: + def test_endpoint_not_found_explains_version_or_base_url(self): + from litellm.proxy.client.cli.commands.auth import _start_cli_sso_flow + + mock_response = Mock() + mock_response.status_code = 404 + + with patch("requests.post", return_value=mock_response): + with pytest.raises(ValueError) as exc_info: + _start_cli_sso_flow("https://old-proxy.example.com") + + message = str(exc_info.value) + assert "HTTP 404" in message + assert "--base-url" in message + assert "older than this CLI" in message + + def test_http_error_includes_server_detail(self): + from litellm.proxy.client.cli.commands.auth import _start_cli_sso_flow + + mock_response = Mock() + mock_response.status_code = 429 + mock_response.json.return_value = {"detail": "Too many CLI login attempts. Try again later."} + + with patch("requests.post", return_value=mock_response): + with pytest.raises(ValueError) as exc_info: + _start_cli_sso_flow("https://test.example.com") + + assert "HTTP 429" in str(exc_info.value) + assert "Too many CLI login attempts. Try again later." in str(exc_info.value) + + def test_non_json_response_names_interception(self): + from litellm.proxy.client.cli.commands.auth import _start_cli_sso_flow + + mock_response = Mock() + mock_response.status_code = 200 + mock_response.json.side_effect = ValueError("no json") + mock_response.headers = {"content-type": "text/html"} + mock_response.text = "Sign in to corporate VPN" + + with patch("requests.post", return_value=mock_response): + with pytest.raises(ValueError) as exc_info: + _start_cli_sso_flow("https://test.example.com") + + message = str(exc_info.value) + assert "non-JSON response" in message + assert "text/html" in message + assert "Sign in to corporate VPN" in message + + def test_connection_error_points_at_base_url(self): + import requests + + from litellm.proxy.client.cli.commands.auth import _start_cli_sso_flow + + with patch("requests.post", side_effect=requests.ConnectionError("Connection refused")): + with pytest.raises(ValueError) as exc_info: + _start_cli_sso_flow("https://unreachable.example.com") + + message = str(exc_info.value) + assert "Could not reach the proxy" in message + assert "https://unreachable.example.com/sso/cli/start" in message + + class TestTokenUtilities: """Test token file utility functions""" diff --git a/tests/test_litellm/proxy/enterprise_billing/test_billing_metrics.py b/tests/test_litellm/proxy/enterprise_billing/test_billing_metrics.py new file mode 100644 index 00000000000..0446cfeeab0 --- /dev/null +++ b/tests/test_litellm/proxy/enterprise_billing/test_billing_metrics.py @@ -0,0 +1,432 @@ +""" +Tests for the enterprise billing-metrics recorder and its factory. + +These verify the license gate, the missing-config and missing-cert disable +paths, the OTLP/HTTP exporter wiring (client cert+key authenticate us to the +collector's mTLS-terminating front end; CA override optional for private +collectors), the metric attribute mapping, and that recording produces the +expected OTLP counter via an in-memory reader. +""" + +import os +import socket +import stat +from pathlib import Path +from typing import Dict, List, Optional + +import pytest +from opentelemetry.sdk.metrics import MeterProvider +from opentelemetry.sdk.metrics.export import InMemoryMetricReader + +from litellm.proxy.enterprise_billing import billing_metrics as bm +from litellm.proxy.middleware.billable_request_metrics_middleware import BillableCategory + +_ENV_VARS = ( + bm.ENDPOINT_ENV, + bm.CLIENT_CERT_ENV, + bm.CLIENT_KEY_ENV, + bm.CA_CERT_ENV, + bm.EXPORT_INTERVAL_ENV, +) + + +@pytest.fixture(autouse=True) +def clear_env(monkeypatch): + for name in _ENV_VARS: + monkeypatch.delenv(name, raising=False) + yield + bm.shutdown_billing_metrics_recorder() + + +def _write_certs(tmp_path: Path) -> Dict[str, str]: + files = { + bm.CA_CERT_ENV: ("ca.pem", b"ca-bytes"), + bm.CLIENT_CERT_ENV: ("client.pem", b"client-cert-bytes"), + bm.CLIENT_KEY_ENV: ("client.key", b"client-key-bytes"), + } + paths = {} + for env_name, (filename, content) in files.items(): + path = tmp_path / filename + path.write_bytes(content) + paths[env_name] = str(path) + return paths + + +def _set_full_env(monkeypatch, tmp_path: Path) -> Dict[str, str]: + paths = _write_certs(tmp_path) + monkeypatch.setenv(bm.ENDPOINT_ENV, "https://collector.example:4317") + monkeypatch.setenv(bm.CA_CERT_ENV, paths[bm.CA_CERT_ENV]) + monkeypatch.setenv(bm.CLIENT_CERT_ENV, paths[bm.CLIENT_CERT_ENV]) + monkeypatch.setenv(bm.CLIENT_KEY_ENV, paths[bm.CLIENT_KEY_ENV]) + return paths + + +def _config(tmp_path: Path, license_id: Optional[str] = "org-1") -> bm.BillingMetricsConfig: + paths = _write_certs(tmp_path) + return bm.BillingMetricsConfig( + endpoint="https://collector.example:4317", + client_cert_path=paths[bm.CLIENT_CERT_ENV], + client_key_path=paths[bm.CLIENT_KEY_ENV], + ca_cert_path=paths[bm.CA_CERT_ENV], + export_interval_ms=60_000, + litellm_version="1.2.3", + license_id=license_id, + ) + + +# ── Factory gating ──────────────────────────────────────────────────────────── + + +def test_not_premium_returns_none(tmp_path, monkeypatch): + _set_full_env(monkeypatch, tmp_path) + assert bm.build_billing_metrics_recorder(premium=False, license_data=None, litellm_version="1.0") is None + + +def test_premium_without_config_returns_none(monkeypatch): + assert bm.build_billing_metrics_recorder(premium=True, license_data={"user_id": "x"}, litellm_version="1.0") is None + + +def test_premium_with_missing_cert_files_returns_none(monkeypatch, tmp_path): + monkeypatch.setenv(bm.ENDPOINT_ENV, "https://collector.example:4317") + monkeypatch.setenv(bm.CA_CERT_ENV, str(tmp_path / "missing-ca.pem")) + monkeypatch.setenv(bm.CLIENT_CERT_ENV, str(tmp_path / "missing-cert.pem")) + monkeypatch.setenv(bm.CLIENT_KEY_ENV, str(tmp_path / "missing-key.pem")) + assert bm.build_billing_metrics_recorder(premium=True, license_data=None, litellm_version="1.0") is None + + +def test_premium_with_full_config_builds_recorder(monkeypatch, tmp_path): + """Builds a real MeterProvider, so the exporter is stubbed: the live one + resolves the collector and opens a TLS connection during the shutdown flush. + The getaddrinfo spy keeps that stub from being quietly dropped later.""" + _set_full_env(monkeypatch, tmp_path) + monkeypatch.setattr(bm, "OTLPMetricExporter", _fake_exporter_class({})) + + resolved: List[str] = [] + real_getaddrinfo = socket.getaddrinfo + + def _spy_getaddrinfo(host, port, *args, **kwargs): + resolved.append(str(host)) + return real_getaddrinfo(host, port, *args, **kwargs) + + monkeypatch.setattr(socket, "getaddrinfo", _spy_getaddrinfo) + + recorder = bm.build_billing_metrics_recorder( + premium=True, license_data={"user_id": "org-1"}, litellm_version="1.0" + ) + assert isinstance(recorder, bm.BillingMetricsRecorder) + recorder.record(category=BillableCategory.LLM, route="/chat/completions", status_code=200, model_id=None) + bm.shutdown_billing_metrics_recorder() + + assert [host for host in resolved if "collector.example" in host] == [] + + +def test_building_the_recorder_logs_an_affirmative_line(monkeypatch, tmp_path): + """ + Every disable path logs; a successful build must log too. Otherwise an + operator cannot tell a metering component from one that silently returned + None, which is how an unlicensed component looks healthy while exporting + nothing. + """ + _set_full_env(monkeypatch, tmp_path) + monkeypatch.setenv(bm.EXPORT_INTERVAL_ENV, "5000") + monkeypatch.setattr(bm, "OTLPMetricExporter", _fake_exporter_class({})) + + infos: List[str] = [] + monkeypatch.setattr(bm.verbose_proxy_logger, "info", lambda msg, *args: infos.append(msg % args if args else msg)) + + recorder = bm.build_billing_metrics_recorder(premium=True, license_data={"user_id": "org-1"}, litellm_version="1.0") + + assert recorder is not None + joined = "\n".join(infos) + assert "https://collector.example:4317" in joined + assert "5000" in joined + + +def test_unlicensed_build_does_not_warn(monkeypatch, tmp_path): + """Unlicensed is the common OSS case; warning there would be pure noise.""" + _set_full_env(monkeypatch, tmp_path) + + warnings: List[str] = [] + monkeypatch.setattr(bm.verbose_proxy_logger, "warning", lambda msg, *args: warnings.append(str(msg))) + + assert bm.build_billing_metrics_recorder(premium=False, license_data=None, litellm_version="1.0") is None + assert warnings == [] + + +def test_shutdown_flushes_active_recorder_once(monkeypatch, tmp_path): + """The shutdown hook must flush the recorder the factory built (buffered + counts are lost on restart otherwise) and be idempotent for repeat calls.""" + _set_full_env(monkeypatch, tmp_path) + shutdowns = [] + + class _SpyProvider: + def get_meter(self, name): + return MeterProvider().get_meter(name) + + def shutdown(self, timeout_millis=None): + shutdowns.append(timeout_millis) + + monkeypatch.setattr(bm, "build_mtls_meter_provider", lambda config: _SpyProvider()) + recorder = bm.build_billing_metrics_recorder(premium=True, license_data=None, litellm_version="1.0") + assert recorder is not None + + bm.shutdown_billing_metrics_recorder() + bm.shutdown_billing_metrics_recorder() + assert shutdowns == [bm.SHUTDOWN_FLUSH_TIMEOUT_MS] + + +def test_shutdown_without_active_recorder_is_noop(): + bm.shutdown_billing_metrics_recorder() + + +# ── Config loading ──────────────────────────────────────────────────────────── + + +def test_load_config_carries_license_id(monkeypatch, tmp_path): + _set_full_env(monkeypatch, tmp_path) + config = bm.load_billing_metrics_config(license_data={"user_id": "org-42"}, litellm_version="9.9") + assert config is not None and config.license_id == "org-42" and config.litellm_version == "9.9" + + +def test_load_config_with_empty_string_env_is_disabled(monkeypatch, tmp_path): + """An env var set to the empty string is as unusable as an unset one and + must disable metering rather than produce a config with a blank endpoint.""" + paths = _write_certs(tmp_path) + monkeypatch.setenv(bm.ENDPOINT_ENV, "") + monkeypatch.setenv(bm.CLIENT_CERT_ENV, paths[bm.CLIENT_CERT_ENV]) + monkeypatch.setenv(bm.CLIENT_KEY_ENV, paths[bm.CLIENT_KEY_ENV]) + assert bm.load_billing_metrics_config(license_data=None, litellm_version="1.0") is None + + +_CLIENT_CERT_PEM = "-----BEGIN CERTIFICATE-----\nclient-cert-body\n-----END CERTIFICATE-----" +_CLIENT_KEY_PEM = "-----BEGIN PRIVATE KEY-----\nclient-key-body\n-----END PRIVATE KEY-----" +_CA_CERT_PEM = "-----BEGIN CERTIFICATE-----\nca-body\n-----END CERTIFICATE-----" + + +def test_load_config_materializes_inline_pem_content(monkeypatch): + """ + ECS and Cloud Run inject secrets as env content, not as mounted files, so the + cert env vars must accept PEM directly. The exporter takes paths, so the PEM + is written to disk and the config points at those files. + """ + monkeypatch.setenv(bm.ENDPOINT_ENV, "https://collector.example:4317") + monkeypatch.setenv(bm.CLIENT_CERT_ENV, _CLIENT_CERT_PEM) + monkeypatch.setenv(bm.CLIENT_KEY_ENV, _CLIENT_KEY_PEM) + monkeypatch.setenv(bm.CA_CERT_ENV, _CA_CERT_PEM) + + config = bm.load_billing_metrics_config(license_data=None, litellm_version="1.0") + + assert config is not None + assert config.ca_cert_path is not None + written = { + config.client_cert_path: _CLIENT_CERT_PEM, + config.client_key_path: _CLIENT_KEY_PEM, + config.ca_cert_path: _CA_CERT_PEM, + } + for path, pem in written.items(): + assert path != pem, "config must carry a file path, not the PEM itself" + assert os.path.isfile(path) + assert Path(path).read_text(encoding="utf-8") == f"{pem}\n" + + # The private key must not be world- or group-readable. + assert stat.S_IMODE(os.stat(config.client_key_path).st_mode) == 0o600 + + +def test_load_config_accepts_a_mix_of_pem_content_and_file_paths(monkeypatch, tmp_path): + """A deployment may mount the CA but inject the client credentials inline.""" + paths = _write_certs(tmp_path) + monkeypatch.setenv(bm.ENDPOINT_ENV, "https://collector.example:4317") + monkeypatch.setenv(bm.CLIENT_CERT_ENV, _CLIENT_CERT_PEM) + monkeypatch.setenv(bm.CLIENT_KEY_ENV, _CLIENT_KEY_PEM) + monkeypatch.setenv(bm.CA_CERT_ENV, paths[bm.CA_CERT_ENV]) + + config = bm.load_billing_metrics_config(license_data=None, litellm_version="1.0") + + assert config is not None + assert config.ca_cert_path == paths[bm.CA_CERT_ENV] + assert Path(config.client_cert_path).read_text(encoding="utf-8") == f"{_CLIENT_CERT_PEM}\n" + + +def test_load_config_leaves_file_paths_untouched(monkeypatch, tmp_path): + """Path-valued env vars keep working; nothing is copied or rewritten.""" + paths = _set_full_env(monkeypatch, tmp_path) + + config = bm.load_billing_metrics_config(license_data=None, litellm_version="1.0") + + assert config is not None + assert config.client_cert_path == paths[bm.CLIENT_CERT_ENV] + assert config.client_key_path == paths[bm.CLIENT_KEY_ENV] + assert config.ca_cert_path == paths[bm.CA_CERT_ENV] + + +def test_load_config_with_inline_pem_disabled_when_unwritable(monkeypatch): + """A failure to materialize the PEM disables metering instead of raising.""" + monkeypatch.setenv(bm.ENDPOINT_ENV, "https://collector.example:4317") + monkeypatch.setenv(bm.CLIENT_CERT_ENV, _CLIENT_CERT_PEM) + monkeypatch.setenv(bm.CLIENT_KEY_ENV, _CLIENT_KEY_PEM) + + def _explode(prefix=None): + raise OSError("read-only filesystem") + + monkeypatch.setattr(bm.tempfile, "mkdtemp", _explode) + + assert bm.load_billing_metrics_config(license_data=None, litellm_version="1.0") is None + + +def test_load_config_never_logs_credential_values(monkeypatch): + """ + A value that is neither a readable path nor `-----BEGIN`-prefixed PEM is + still secret material. The disable warning must name the env vars, never + echo their contents, or a malformed key lands in the proxy logs. + """ + secret_material = "MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQ-not-pem-prefixed" + monkeypatch.setenv(bm.ENDPOINT_ENV, "https://collector.example:4317") + monkeypatch.setenv(bm.CLIENT_CERT_ENV, secret_material) + monkeypatch.setenv(bm.CLIENT_KEY_ENV, secret_material) + + logged: List[str] = [] + + def _capture(msg, *args): + logged.append(msg % args if args else msg) + + monkeypatch.setattr(bm.verbose_proxy_logger, "warning", _capture) + + assert bm.load_billing_metrics_config(license_data=None, litellm_version="1.0") is None + + joined = "\n".join(logged) + assert secret_material not in joined + assert bm.CLIENT_CERT_ENV in joined and bm.CLIENT_KEY_ENV in joined + + +def test_load_config_with_empty_pem_env_is_disabled(monkeypatch): + """Empty stays empty: an unset secret must not be mistaken for inline PEM.""" + monkeypatch.setenv(bm.ENDPOINT_ENV, "https://collector.example:4317") + monkeypatch.setenv(bm.CLIENT_CERT_ENV, "") + monkeypatch.setenv(bm.CLIENT_KEY_ENV, "") + + assert bm.load_billing_metrics_config(license_data=None, litellm_version="1.0") is None + + +def test_export_interval_default_and_override(monkeypatch): + assert bm._export_interval_ms() == bm.DEFAULT_EXPORT_INTERVAL_MS + monkeypatch.setenv(bm.EXPORT_INTERVAL_ENV, "5000") + assert bm._export_interval_ms() == 5000 + monkeypatch.setenv(bm.EXPORT_INTERVAL_ENV, "not-a-number") + assert bm._export_interval_ms() == bm.DEFAULT_EXPORT_INTERVAL_MS + + +# ── OTLP/HTTP exporter wiring ───────────────────────────────────────────────── + + +def test_metrics_endpoint_appends_signal_path(): + assert bm._metrics_endpoint("https://telemetry.example.com") == "https://telemetry.example.com/v1/metrics" + assert bm._metrics_endpoint("https://telemetry.example.com/") == "https://telemetry.example.com/v1/metrics" + assert bm._metrics_endpoint("https://telemetry.example.com/v1/metrics") == "https://telemetry.example.com/v1/metrics" + + +def _fake_exporter_class(captured: Dict[str, object]) -> type: + """A no-network stand-in for OTLPMetricExporter. Tests that build a real + MeterProvider must install this: the real exporter resolves the collector + host and opens a TLS connection on the reader's first export and on the + shutdown flush.""" + + class _FakeExporter: + # PeriodicExportingMetricReader probes these on the exporter it wraps. + _preferred_temporality: dict = {} + _preferred_aggregation: dict = {} + + def __init__(self, **kwargs): + captured.update(kwargs) + + def export(self, *args, **kwargs): + return None + + def shutdown(self, *args, **kwargs): + return None + + def force_flush(self, *args, **kwargs): + return True + + return _FakeExporter + + +def test_meter_provider_wires_client_cert_into_http_exporter(tmp_path, monkeypatch): + """Client cert+key authenticate us at the collector's mTLS front end; CA override rides certificate_file.""" + captured: Dict[str, object] = {} + + monkeypatch.setattr(bm, "OTLPMetricExporter", _fake_exporter_class(captured)) + config = _config(tmp_path) + provider = bm.build_mtls_meter_provider(config) + provider.shutdown() + + assert captured["endpoint"] == "https://collector.example:4317/v1/metrics" + assert captured["client_certificate_file"] == config.client_cert_path + assert captured["client_key_file"] == config.client_key_path + assert captured["certificate_file"] == config.ca_cert_path + + +def test_load_config_without_ca_is_valid(monkeypatch, tmp_path): + """The production collector presents a public web-PKI cert: no CA override required.""" + paths = _write_certs(tmp_path) + monkeypatch.setenv(bm.ENDPOINT_ENV, "https://telemetry.example.com") + monkeypatch.setenv(bm.CLIENT_CERT_ENV, paths[bm.CLIENT_CERT_ENV]) + monkeypatch.setenv(bm.CLIENT_KEY_ENV, paths[bm.CLIENT_KEY_ENV]) + config = bm.load_billing_metrics_config(license_data=None, litellm_version="1.0") + assert config is not None and config.ca_cert_path is None + + +# ── Resource and metric attributes ──────────────────────────────────────────── + + +def test_resource_attributes_include_license_id(tmp_path): + attrs = bm._resource_attributes(_config(tmp_path, license_id="org-7")) + assert attrs["service.name"] == "litellm-proxy" + assert attrs["litellm.version"] == "1.2.3" + assert attrs["litellm.license.id"] == "org-7" + + +def test_resource_attributes_omit_license_id_when_absent(tmp_path): + attrs = bm._resource_attributes(_config(tmp_path, license_id=None)) + assert "litellm.license.id" not in attrs + + +def test_billable_attributes_with_model_id(): + attrs = bm._billable_attributes(BillableCategory.LLM, "/chat/completions", 200, "deploy-3") + assert attrs == { + "litellm.endpoint.category": "llm", + "http.route": "/chat/completions", + "http.response.status_code": 200, + "litellm.model_id": "deploy-3", + } + + +def test_billable_attributes_omit_model_id_when_none(): + attrs = bm._billable_attributes(BillableCategory.MCP, "/mcp", 200, None) + assert "litellm.model_id" not in attrs + + +# ── End-to-end recording via in-memory reader ───────────────────────────────── + + +def _counter_points(reader: InMemoryMetricReader): + data = reader.get_metrics_data() + for resource_metric in data.resource_metrics: + for scope_metric in resource_metric.scope_metrics: + for metric in scope_metric.metrics: + if metric.name == bm.METRIC_NAME: + return list(metric.data.data_points) + return [] + + +def test_record_increments_counter_with_attributes(): + reader = InMemoryMetricReader() + recorder = bm.BillingMetricsRecorder(MeterProvider(metric_readers=[reader])) + + recorder.record(category=BillableCategory.LLM, route="/chat/completions", status_code=200, model_id="m1") + recorder.record(category=BillableCategory.LLM, route="/chat/completions", status_code=200, model_id="m1") + recorder.record(category=BillableCategory.MCP, route="/mcp", status_code=200, model_id=None) + + points = _counter_points(reader) + by_category = {point.attributes["litellm.endpoint.category"]: point.value for point in points} + assert by_category["llm"] == 2 + assert by_category["mcp"] == 1 diff --git a/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_compresr.py b/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_compresr.py new file mode 100644 index 00000000000..f6f29eee5bc --- /dev/null +++ b/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_compresr.py @@ -0,0 +1,2091 @@ +""" +Unit tests for the Compresr guardrail. + +Tests cover: +- apply_guardrail compresses eligible messages query-aware (tool-call intent + resolved via tool_call_id, falling back to the last user message) +- target selection: tool outputs by default, system/history opt-in, min-chars + threshold, targets without a derivable query are left uncompressed +- multimodal content: text parts replaced, non-text parts preserved +- recovery: hash marker appended, compresr_retrieve tool injected, originals + stored per litellm_call_id, agentic loop returns the original content and + rejects hashes not issued for the current request +- x-compresr-bypass header, response-type passthrough +- fail_closed raises HTTPException; fail_open forwards uncompressed +""" + +import hashlib +import json +from types import SimpleNamespace +from unittest.mock import AsyncMock, MagicMock, create_autospec, patch + +import httpx +import pytest +from fastapi import HTTPException + +from litellm.constants import PRE_CALL_EXECUTED_GUARDRAILS_KEY +from litellm.proxy.guardrails.guardrail_hooks.compresr.compresr import ( + COMPRESR_RETRIEVE_TOOL_NAME, + CompresrGuardrail, + _content_hash, + _extract_compresr_tool_calls, + _scoped_store_key, + has_compresr_retrieve_tool, +) +from litellm.types.utils import GenericGuardrailAPIInputs + +FAKE_API_BASE = "https://compresr.example.com" +FAKE_API_KEY = "cmp_test-key" + +TOOL_OUTPUT = "Result 1: EV range comparison. " * 40 # > 500 chars +USER_QUESTION = "Which 2026 EV has the longest range?" + +AGENT_MESSAGES = [ + {"role": "system", "content": "You are a research assistant."}, + {"role": "user", "content": USER_QUESTION}, + { + "role": "assistant", + "content": None, + "tool_calls": [ + { + "id": "call_1", + "type": "function", + "function": {"name": "web_search", "arguments": '{"query": "2026 EV range"}'}, + } + ], + }, + {"role": "tool", "tool_call_id": "call_1", "content": TOOL_OUTPUT}, +] + + +def _make_guardrail(**kwargs) -> CompresrGuardrail: + defaults = dict( + api_base=FAKE_API_BASE, + api_key=FAKE_API_KEY, + guardrail_name="compresr", + default_on=True, + ) + defaults.update(kwargs) + return CompresrGuardrail(**defaults) + + +def _make_single_compress_response( + compressed_context: str = "compressed summary", + original_tokens: int = 1000, + compressed_tokens: int = 400, + status: int = 200, +) -> MagicMock: + mock = MagicMock() + mock.status_code = status + mock.json.return_value = { + "success": True, + "data": { + "compressed_context": compressed_context, + "original_tokens": original_tokens, + "compressed_tokens": compressed_tokens, + "actual_compression_ratio": 0.6, + "tokens_saved": original_tokens - compressed_tokens, + "duration_ms": 42, + }, + } + mock.text = "" + return mock + + +def _make_batch_compress_response(compressed_contexts: list, status: int = 200) -> MagicMock: + mock = MagicMock() + mock.status_code = status + mock.json.return_value = { + "success": True, + "data": { + "results": [ + { + "compressed_context": ctx, + "original_tokens": 1000, + "compressed_tokens": 400, + "actual_compression_ratio": 0.6, + "tokens_saved": 600, + "duration_ms": 42, + } + for ctx in compressed_contexts + ], + "count": len(compressed_contexts), + }, + } + mock.text = "" + return mock + + +def _make_openai_response_with_tool_call(tool_name: str, arguments: dict, tool_id: str = "call_abc123") -> MagicMock: + fn = MagicMock() + fn.name = tool_name + fn.arguments = json.dumps(arguments) + + tc = MagicMock() + tc.id = tool_id + tc.type = "function" + tc.function = fn + + message = MagicMock() + message.content = None + message.tool_calls = [tc] + + choice = MagicMock() + choice.message = message + + response = MagicMock() + response.choices = [choice] + # Plain chat-completion shape: no responses-API `output` list, no + # anthropic `content` list. + response.output = None + response.content = None + return response + + +def _make_openai_response_with_tool_calls(tool_calls: list, content: object = None) -> MagicMock: + """Chat-completion response carrying several tool calls in one turn + (parallel tool calling). ``tool_calls`` items are (name, arguments, id).""" + tcs = [] + for name, arguments, tool_id in tool_calls: + fn = MagicMock() + fn.name = name + fn.arguments = json.dumps(arguments) + tc = MagicMock() + tc.id = tool_id + tc.type = "function" + tc.function = fn + tcs.append(tc) + + message = MagicMock() + message.content = content + message.tool_calls = tcs + + choice = MagicMock() + choice.message = message + + response = MagicMock() + response.choices = [choice] + response.output = None + response.content = None + return response + + +def _apply_inputs(messages: list) -> GenericGuardrailAPIInputs: + return GenericGuardrailAPIInputs(structured_messages=[dict(m) for m in messages]) + + +def _logging_obj(call_id: str) -> SimpleNamespace: + # Default fixture models a proxy with per-key auth enabled (the production + # shape). Recovery requires a caller scope; tests that need the no-auth + # path should build the object explicitly. + from litellm.proxy._types import UserAPIKeyAuth + + return SimpleNamespace( + litellm_call_id=call_id, + model_call_details={ + "litellm_params": {"metadata": {"user_api_key_auth": UserAPIKeyAuth(api_key="hash-default")}} + }, + ) + + +def _logging_obj_with_key(call_id: str, user_api_key: str, meta_key: str = "metadata") -> SimpleNamespace: + """Logging object carrying the server-set UserAPIKeyAuth object, the way the + proxy populates it for an authenticated request (the bare user_api_key + string alone is never trusted — a client could forge that).""" + from litellm.proxy._types import UserAPIKeyAuth + + return SimpleNamespace( + litellm_call_id=call_id, + model_call_details={"litellm_params": {meta_key: {"user_api_key_auth": UserAPIKeyAuth(api_key=user_api_key)}}}, + ) + + +def _retrieve_tool_call(hash_value: str, tool_id: str) -> dict: + return { + "id": tool_id, + "type": "function", + "name": COMPRESR_RETRIEVE_TOOL_NAME, + "arguments": {"hash": hash_value}, + } + + +def _retrieve_tool_stub() -> dict: + return { + "type": "function", + "function": {"name": COMPRESR_RETRIEVE_TOOL_NAME, "parameters": {}}, + } + + +@pytest.fixture +def guardrail() -> CompresrGuardrail: + return _make_guardrail() + + +# ── init ────────────────────────────────────────────────────────────── + + +def test_init_raises_without_api_key(monkeypatch): + monkeypatch.delenv("COMPRESR_API_KEY", raising=False) + with pytest.raises(ValueError, match="API key"): + CompresrGuardrail(guardrail_name="compresr") + + +def test_init_defaults(): + g = _make_guardrail() + assert g.compresr_api_base == FAKE_API_BASE + assert g.compression_model == "latte_v2" + assert g.target_compression_ratio == 0.5 + assert g.coarse is True + assert g.min_chars_to_compress == 500 + assert g.compress_tool_outputs is True + assert g.compress_system is False + assert g.compress_history is False + assert g.compress_last_user is False + assert g.enable_retrieval is True + assert g.unreachable_fallback == "fail_closed" + + +def test_init_coerces_unknown_unreachable_fallback_to_fail_closed(): + g = _make_guardrail(unreachable_fallback="banana") + assert g.unreachable_fallback == "fail_closed" + + +# ── compression core ───────────────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_apply_guardrail_compresses_tool_output_with_intent_query( + guardrail: CompresrGuardrail, +): + inputs = _apply_inputs(AGENT_MESSAGES) + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=_logging_obj("call-id-1"), + ) + + _, call_kwargs = mock_post.call_args + assert call_kwargs["url"] == f"{FAKE_API_BASE}/api/compress/question-specific/" + assert call_kwargs["headers"]["X-API-Key"] == FAKE_API_KEY + payload = call_kwargs["json"] + assert payload["context"] == TOOL_OUTPUT + # Query is the tool call's intent, not the user question. + assert payload["query"] == 'web_search: {"query": "2026 EV range"}' + assert payload["compression_model_name"] == "latte_v2" + assert payload["target_compression_ratio"] == 0.5 + + out = result["structured_messages"] + assert out[3]["content"].startswith("compressed summary") + # Untouched messages pass through byte-identical. + assert out[0] == AGENT_MESSAGES[0] + assert out[1] == AGENT_MESSAGES[1] + assert out[2] == AGENT_MESSAGES[2] + + +@pytest.mark.asyncio +async def test_apply_guardrail_mirrors_compression_into_texts_channel( + guardrail: CompresrGuardrail, +): + """The /v1/responses translation writes compressed output back through the + `texts` channel, not structured_messages. Compression must be mirrored there + or that surface silently forwards the original content uncompressed.""" + messages = [ + {"role": "user", "content": USER_QUESTION}, + {"role": "tool", "tool_call_id": "call_unknown", "content": TOOL_OUTPUT}, + ] + inputs = GenericGuardrailAPIInputs( + texts=[USER_QUESTION, TOOL_OUTPUT], + structured_messages=[dict(m) for m in messages], + ) + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=_logging_obj("call-id-1"), + ) + + texts = result["texts"] + # The compressed tool output replaces the original in the texts channel... + assert texts[1].startswith("compressed summary") + assert texts[1] != TOOL_OUTPUT + # ...while untouched text passes through byte-identical. + assert texts[0] == USER_QUESTION + + +@pytest.mark.asyncio +async def test_apply_guardrail_returns_inputs_unchanged_when_nothing_compressed( + guardrail: CompresrGuardrail, +): + """A 200 response whose compressed_context is empty is a functional no-op. + The exact inputs object must come back: handlers detect guardrail edits by + identity, and a fresh structured_messages list would force a full write-back + of an untouched request (on Anthropic, reconversion strips cache_control + from thinking blocks).""" + inputs = _apply_inputs(AGENT_MESSAGES) + mock_post = AsyncMock(return_value=_make_single_compress_response(compressed_context="")) + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=_logging_obj("call-id-1"), + ) + + assert result is inputs + + +@pytest.mark.asyncio +async def test_texts_mirror_skips_duplicate_content_with_diverging_compressions( + guardrail: CompresrGuardrail, +): + """Two targets with identical text but different query-specific compressions: + the value-keyed texts mirror cannot tell the occurrences apart, so it must + leave them uncompressed rather than apply an arbitrary variant to both.""" + messages = [ + {"role": "user", "content": USER_QUESTION}, + { + "role": "assistant", + "content": None, + "tool_calls": [ + {"id": "call_1", "type": "function", "function": {"name": "search_docs", "arguments": '{"q": "a"}'}}, + {"id": "call_2", "type": "function", "function": {"name": "search_web", "arguments": '{"q": "b"}'}}, + ], + }, + {"role": "tool", "tool_call_id": "call_1", "content": TOOL_OUTPUT}, + {"role": "tool", "tool_call_id": "call_2", "content": TOOL_OUTPUT}, + ] + inputs = GenericGuardrailAPIInputs( + texts=[USER_QUESTION, TOOL_OUTPUT, TOOL_OUTPUT], + structured_messages=[dict(m) for m in messages], + ) + mock_post = AsyncMock(return_value=_make_batch_compress_response(["compressed for docs", "compressed for web"])) + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=_logging_obj("call-id-1"), + ) + + # Each message position still gets its own query-specific compression... + out = result["structured_messages"] + assert out[2]["content"].startswith("compressed for docs") + assert out[3]["content"].startswith("compressed for web") + # ...but the texts mirror leaves the ambiguous occurrences untouched. + assert result["texts"] == [USER_QUESTION, TOOL_OUTPUT, TOOL_OUTPUT] + + +@pytest.mark.asyncio +async def test_texts_mirror_skips_text_that_also_appears_outside_targets( + guardrail: CompresrGuardrail, +): + """compress_system is off, so a system message whose text happens to equal + a compressed tool output must not be rewritten through the texts mirror.""" + messages = [ + {"role": "system", "content": TOOL_OUTPUT}, + {"role": "user", "content": USER_QUESTION}, + {"role": "tool", "tool_call_id": "call_x", "content": TOOL_OUTPUT}, + ] + inputs = GenericGuardrailAPIInputs( + texts=[TOOL_OUTPUT, USER_QUESTION, TOOL_OUTPUT], + structured_messages=[dict(m) for m in messages], + ) + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=_logging_obj("call-id-1"), + ) + + out = result["structured_messages"] + assert out[0]["content"] == TOOL_OUTPUT # system message untouched + assert out[2]["content"].startswith("compressed summary") + # One compressed target cannot account for two occurrences in texts. + assert result["texts"] == [TOOL_OUTPUT, USER_QUESTION, TOOL_OUTPUT] + + +@pytest.mark.asyncio +async def test_tool_output_without_matching_call_uses_user_question( + guardrail: CompresrGuardrail, +): + messages = [ + {"role": "user", "content": USER_QUESTION}, + {"role": "tool", "tool_call_id": "call_unknown", "content": TOOL_OUTPUT}, + ] + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + payload = mock_post.call_args.kwargs["json"] + assert payload["query"] == USER_QUESTION + + +@pytest.mark.asyncio +async def test_function_result_without_name_does_not_bind_unrelated_call( + guardrail: CompresrGuardrail, +): + """A legacy function-role result missing its name must not adopt the intent + of an arbitrary earlier assistant function_call; it falls back to the last + user message.""" + messages = [ + {"role": "user", "content": USER_QUESTION}, + { + "role": "assistant", + "content": None, + "function_call": {"name": "get_weather", "arguments": '{"city": "Paris"}'}, + }, + {"role": "function", "content": TOOL_OUTPUT}, + ] + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + payload = mock_post.call_args.kwargs["json"] + assert payload["query"] == USER_QUESTION + + +@pytest.mark.asyncio +async def test_target_without_derivable_query_left_uncompressed( + guardrail: CompresrGuardrail, +): + # No user message and no tool-call intent anywhere -> nothing to compress. + messages = [{"role": "tool", "tool_call_id": "call_x", "content": TOOL_OUTPUT}] + mock_post = AsyncMock() + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + mock_post.assert_not_called() + assert result["structured_messages"][0]["content"] == TOOL_OUTPUT + + +@pytest.mark.asyncio +async def test_system_and_history_not_compressed_by_default( + guardrail: CompresrGuardrail, +): + long_system = "Rules. " * 200 + messages = [ + {"role": "system", "content": long_system}, + {"role": "user", "content": "Old question? " * 100}, + {"role": "user", "content": USER_QUESTION}, + {"role": "tool", "tool_call_id": "c1", "content": TOOL_OUTPUT}, + ] + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + # Only one (single, non-batch) call: the tool output. + assert mock_post.call_count == 1 + assert mock_post.call_args.kwargs["json"]["context"] == TOOL_OUTPUT + out = result["structured_messages"] + assert out[0]["content"] == long_system + assert out[2]["content"] == USER_QUESTION + + +@pytest.mark.asyncio +async def test_opt_in_system_uses_batch_endpoint(): + guardrail = _make_guardrail(compress_system=True) + long_system = "Rules. " * 200 + messages = [ + {"role": "system", "content": long_system}, + {"role": "user", "content": USER_QUESTION}, + {"role": "tool", "tool_call_id": "c1", "content": TOOL_OUTPUT}, + ] + mock_post = AsyncMock(return_value=_make_batch_compress_response(["short system", "short tool"])) + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + call_kwargs = mock_post.call_args.kwargs + assert call_kwargs["url"].endswith("/api/compress/question-specific/batch") + batch_inputs = call_kwargs["json"]["inputs"] + assert [i["context"] for i in batch_inputs] == [long_system, TOOL_OUTPUT] + out = result["structured_messages"] + assert out[0]["content"].startswith("short system") + assert out[2]["content"].startswith("short tool") + + +@pytest.mark.asyncio +async def test_short_messages_skipped(guardrail: CompresrGuardrail): + messages = [ + {"role": "user", "content": USER_QUESTION}, + {"role": "tool", "tool_call_id": "c1", "content": "tiny result"}, + ] + mock_post = AsyncMock() + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + mock_post.assert_not_called() + assert result["structured_messages"][1]["content"] == "tiny result" + + +@pytest.mark.asyncio +async def test_multimodal_text_replaced_non_text_preserved( + guardrail: CompresrGuardrail, +): + image_part = {"type": "image_url", "image_url": {"url": "https://example.com/x.png"}} + messages = [ + {"role": "user", "content": USER_QUESTION}, + { + "role": "tool", + "tool_call_id": "c1", + "content": [{"type": "text", "text": TOOL_OUTPUT}, image_part], + }, + ] + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + content = result["structured_messages"][1]["content"] + assert isinstance(content, list) + assert content[0]["type"] == "text" + assert content[0]["text"].startswith("compressed summary") + assert content[1] == image_part + + +# ── passthrough / bypass ───────────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_bypass_header_skips_compression_when_allowed(): + guardrail = _make_guardrail(allow_bypass_header=True) + inputs = _apply_inputs(AGENT_MESSAGES) + mock_post = AsyncMock() + request_data = { + "model": "gpt-4o", + "proxy_server_request": {"headers": {"x-compresr-bypass": "true"}}, + } + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail(inputs=inputs, request_data=request_data, input_type="request") + + mock_post.assert_not_called() + assert result is inputs + + +@pytest.mark.asyncio +async def test_bypass_header_ignored_by_default(guardrail: CompresrGuardrail): + inputs = _apply_inputs(AGENT_MESSAGES) + mock_post = AsyncMock(return_value=_make_single_compress_response()) + request_data = { + "model": "gpt-4o", + "proxy_server_request": {"headers": {"x-compresr-bypass": "true"}}, + } + + with patch.object(guardrail.async_handler, "post", mock_post): + await guardrail.apply_guardrail(inputs=inputs, request_data=request_data, input_type="request") + + mock_post.assert_called_once() + + +@pytest.mark.asyncio +async def test_response_input_type_passthrough(guardrail: CompresrGuardrail): + inputs = _apply_inputs(AGENT_MESSAGES) + result = await guardrail.apply_guardrail(inputs=inputs, request_data={}, input_type="response") + assert result is inputs + + +@pytest.mark.asyncio +async def test_missing_structured_messages_passthrough(guardrail: CompresrGuardrail): + inputs = GenericGuardrailAPIInputs(texts=["hello"]) + result = await guardrail.apply_guardrail(inputs=inputs, request_data={}, input_type="request") + assert result is inputs + + +# ── failure policy ──────────────────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_transport_error_raises_when_fail_closed(guardrail: CompresrGuardrail): + with patch.object( + guardrail.async_handler, + "post", + AsyncMock(side_effect=httpx.ConnectError("boom")), + ): + with pytest.raises(HTTPException) as exc_info: + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + assert exc_info.value.status_code == 502 + + +@pytest.mark.asyncio +async def test_transport_error_fail_open_forwards_uncompressed(): + guardrail = _make_guardrail(unreachable_fallback="fail_open") + inputs = _apply_inputs(AGENT_MESSAGES) + + with patch.object( + guardrail.async_handler, + "post", + AsyncMock(side_effect=httpx.ConnectError("boom")), + ): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + assert result is inputs + assert result["structured_messages"][3]["content"] == TOOL_OUTPUT + + +@pytest.mark.asyncio +async def test_non_json_response_raises_when_fail_closed(guardrail: CompresrGuardrail): + mock = MagicMock() + mock.status_code = 200 + mock.json.side_effect = ValueError("not json") + mock.text = "gateway error" + + with patch.object(guardrail.async_handler, "post", AsyncMock(return_value=mock)): + with pytest.raises(HTTPException): + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + +@pytest.mark.asyncio +async def test_http_exception_does_not_reflect_upstream_body(guardrail: CompresrGuardrail): + mock = MagicMock() + mock.status_code = 500 + mock.json.side_effect = ValueError("not json") + mock.text = "SECRET_INSTANCE_METADATA_TOKEN=aws-imds-response" + + with patch.object(guardrail.async_handler, "post", AsyncMock(return_value=mock)): + with pytest.raises(HTTPException) as exc_info: + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + assert "SECRET_INSTANCE_METADATA_TOKEN" not in json.dumps(exc_info.value.detail) + + +def test_init_rejects_non_http_api_base(): + with pytest.raises(ValueError, match="scheme"): + CompresrGuardrail( + api_base="file:///etc/passwd", + api_key=FAKE_API_KEY, + guardrail_name="compresr", + ) + + +def test_init_rejects_cloud_metadata_api_base(): + with pytest.raises(ValueError, match="metadata"): + CompresrGuardrail( + api_base="http://169.254.169.254", + api_key=FAKE_API_KEY, + guardrail_name="compresr", + ) + + +@pytest.mark.parametrize( + "api_base", + [ + "http://2852039166", # decimal encoding of 169.254.169.254 + "http://0xa9fea9fe", # hex encoding + "http://[::ffff:169.254.169.254]", # IPv4-mapped IPv6 + "http://metadata.azure.com", + "http://metadata.azure.internal", + "http://168.63.129.16", # Azure WireServer + ], +) +def test_init_rejects_encoded_cloud_metadata_api_base(api_base): + with pytest.raises(ValueError, match="metadata"): + CompresrGuardrail( + api_base=api_base, + api_key=FAKE_API_KEY, + guardrail_name="compresr", + ) + + +@pytest.mark.asyncio +async def test_apply_guardrail_ignores_user_supplied_call_id(guardrail: CompresrGuardrail): + mock_post = AsyncMock(return_value=_make_single_compress_response()) + attacker_call_id = "victim-tenant-call-id" + + with patch.object(guardrail.async_handler, "post", mock_post): + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o", "litellm_call_id": attacker_call_id}, + input_type="request", + logging_obj=_logging_obj("real-framework-call-id"), + ) + + assert not any(attacker_call_id in k for k in guardrail._originals_by_call_id) + assert any(k.endswith("real-framework-call-id") for k in guardrail._originals_by_call_id) + + +@pytest.mark.asyncio +async def test_agentic_plan_ignores_user_supplied_call_id(guardrail: CompresrGuardrail): + hash_value = "d" * 24 + guardrail._store_originals("victim-tenant-call-id", {hash_value: "victim-original"}) + + plan = await guardrail.async_build_agentic_loop_plan( + tools={ + "tool_calls": [ + { + "id": "call_abc", + "type": "function", + "name": COMPRESR_RETRIEVE_TOOL_NAME, + "arguments": {"hash": hash_value}, + } + ] + }, + model="gpt-4o", + messages=[], + response=_make_openai_response_with_tool_call( + COMPRESR_RETRIEVE_TOOL_NAME, {"hash": hash_value}, tool_id="call_abc" + ), + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={}, + logging_obj=_logging_obj("attacker-call-id"), + stream=False, + kwargs={"litellm_call_id": "victim-tenant-call-id"}, + ) + + # Attacker's scope resolves nothing, so the loop is vetoed and the victim + # original never surfaces. + assert plan.run_agentic_loop is False + assert plan.request_patch is None + + +@pytest.mark.asyncio +async def test_recovery_store_partitioned_by_caller_identity(guardrail: CompresrGuardrail): + """Two tenants that set the SAME client-forgeable x-litellm-call-id must not + read each other's stored originals, and each still reads its own.""" + shared_call_id = "shared-call-id" + expected_hash = hashlib.sha256(TOOL_OUTPUT.encode()).hexdigest()[:24] + + async def _plan_for(user_api_key: str, tool_id: str): + return await guardrail.async_build_agentic_loop_plan( + tools={"tool_calls": [_retrieve_tool_call(expected_hash, tool_id)]}, + model="gpt-4o", + messages=[], + response=_make_openai_response_with_tool_call( + COMPRESR_RETRIEVE_TOOL_NAME, {"hash": expected_hash}, tool_id=tool_id + ), + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={}, + logging_obj=_logging_obj_with_key(shared_call_id, user_api_key), + stream=False, + kwargs={}, + ) + + # Tenant A compresses and stores its original. + with patch.object(guardrail.async_handler, "post", AsyncMock(return_value=_make_single_compress_response())): + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=_logging_obj_with_key(shared_call_id, "hash-tenant-A"), + ) + + # Tenant B, same call id, different virtual-key hash → different bucket, so + # nothing resolves and the loop is vetoed (Tenant A's original never leaks). + plan_b = await _plan_for("hash-tenant-B", "call_b") + assert plan_b.run_agentic_loop is False + assert plan_b.request_patch is None + + # Tenant A retrieves its own content successfully. + plan_a = await _plan_for("hash-tenant-A", "call_a") + assert TOOL_OUTPUT in plan_a.request_patch.messages[-1]["content"] + + +@pytest.mark.asyncio +async def test_caller_scope_read_from_litellm_metadata(guardrail: CompresrGuardrail): + """/v1/messages and /v1/responses carry the auth object under + litellm_metadata rather than metadata; the store key must be scoped by it + there too, without relying on upstream's metadata backfill.""" + logging_obj = _logging_obj_with_key("call-lm", "hash-tenant-lm", meta_key="litellm_metadata") + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=logging_obj, + ) + + assert "hash-tenant-lm\x00call-lm" in guardrail._originals_by_call_id + assert "call-lm" not in guardrail._originals_by_call_id + + +@pytest.mark.asyncio +async def test_caller_scope_rejects_forged_user_api_key_string(guardrail: CompresrGuardrail): + """A client-supplied metadata.user_api_key STRING (no server-set + UserAPIKeyAuth object) must not be trusted as a tenant scope — otherwise a + caller could forge another tenant's recovery bucket on /v1/messages.""" + logging_obj = SimpleNamespace( + litellm_call_id="call-forge", + model_call_details={"litellm_params": {"metadata": {"user_api_key": "victim-tenant-hash"}}}, + ) + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=logging_obj, + ) + + # Forged string is ignored: scope resolves to empty, so recovery is + # disabled entirely (no bucket keyed on victim-tenant-hash, no unscoped + # bucket that another caller could reuse). + assert not guardrail._originals_by_call_id + + +@pytest.mark.asyncio +async def test_compress_post_called_with_real_handler_signature(): + """AsyncHTTPHandler.post has a fixed signature; an autospec mock enforces it + (unlike AsyncMock(spec=...), which silently accepts any kwarg) so a kwarg the + real handler rejects — which would raise TypeError past the fail policy — + fails the test instead.""" + guardrail = _make_guardrail() + autospec_post = create_autospec(guardrail.async_handler.post, return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", autospec_post): + result = await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=_logging_obj("call-id-1"), + ) + + assert result["structured_messages"][3]["content"].startswith("compressed summary") + + +@pytest.mark.asyncio +async def test_batch_result_count_mismatch_raises_when_fail_closed(): + guardrail = _make_guardrail(compress_system=True) + messages = [ + {"role": "system", "content": "Rules. " * 200}, + {"role": "user", "content": USER_QUESTION}, + {"role": "tool", "tool_call_id": "c1", "content": TOOL_OUTPUT}, + ] + mock_post = AsyncMock(return_value=_make_batch_compress_response(["only one"])) + + with patch.object(guardrail.async_handler, "post", mock_post): + with pytest.raises(HTTPException): + await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + +# ── recovery (compresr_retrieve) ────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_recovery_marker_tool_injection_and_original_stored( + guardrail: CompresrGuardrail, +): + inputs = _apply_inputs(AGENT_MESSAGES) + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=_logging_obj("call-id-1"), + ) + + compressed_content = result["structured_messages"][3]["content"] + expected_hash = hashlib.sha256(TOOL_OUTPUT.encode()).hexdigest()[:24] + assert f"compresr hash={expected_hash}" in compressed_content + + tools = result.get("tools") + assert tools is not None and has_compresr_retrieve_tool(tools) + + scoped_key = next(k for k in guardrail._originals_by_call_id if k.endswith("call-id-1")) + originals, _expiry = guardrail._originals_by_call_id[scoped_key] + assert originals[expected_hash] == TOOL_OUTPUT + + +@pytest.mark.asyncio +async def test_enable_retrieval_false_no_marker_no_tool(): + guardrail = _make_guardrail(enable_retrieval=False) + inputs = _apply_inputs(AGENT_MESSAGES) + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + assert result["structured_messages"][3]["content"] == "compressed summary" + assert not has_compresr_retrieve_tool(result.get("tools") or []) + assert guardrail._originals_by_call_id == {} + + +@pytest.mark.asyncio +async def test_existing_tools_preserved_when_injecting(guardrail: CompresrGuardrail): + existing_tool = {"type": "function", "function": {"name": "my_tool", "parameters": {}}} + inputs = GenericGuardrailAPIInputs( + structured_messages=[dict(m) for m in AGENT_MESSAGES], + tools=[existing_tool], + ) + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=_logging_obj("call-id-1"), + ) + + tools = result["tools"] + assert existing_tool in tools + assert has_compresr_retrieve_tool(tools) + assert len(tools) == 2 + + +@pytest.mark.asyncio +async def test_non_list_tools_left_untouched_when_injecting(guardrail: CompresrGuardrail): + # An unexpected non-list tools value must survive unchanged rather than be + # clobbered by the injected retrieve tool. + odd_tools = {"type": "function", "function": {"name": "my_tool"}} + inputs = GenericGuardrailAPIInputs( + structured_messages=[dict(m) for m in AGENT_MESSAGES], + tools=odd_tools, # type: ignore[typeddict-item] + ) + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=_logging_obj("call-id-1"), + ) + + assert result["tools"] is odd_tools + + +def test_extract_compresr_tool_calls_tolerates_missing_keys(): + # A retrieve call missing id/arguments must not KeyError in the post-call + # hook; it extracts with safe defaults and resolves to a rejection later. + with patch( + "litellm.proxy.guardrails.guardrail_hooks.compresr.compresr.get_tool_calls_from_response", + return_value=[{"name": COMPRESR_RETRIEVE_TOOL_NAME}, {"id": "x"}], + ): + extracted = _extract_compresr_tool_calls(object()) + + assert extracted == [{"id": None, "type": "function", "name": COMPRESR_RETRIEVE_TOOL_NAME, "arguments": {}}] + + +# ── agentic loop ────────────────────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_async_should_run_agentic_loop_true_for_retrieve_call( + guardrail: CompresrGuardrail, +): + response = _make_openai_response_with_tool_call(COMPRESR_RETRIEVE_TOOL_NAME, {"hash": "a" * 24}) + tools = [dict(t) for t in [_retrieve_tool_stub()]] + + should_run, gate_tools = await guardrail.async_should_run_agentic_loop( + response=response, + model="gpt-4o", + messages=[], + tools=tools, + stream=False, + custom_llm_provider="openai", + kwargs={}, + ) + assert should_run is True + assert gate_tools["tool_calls"][0]["name"] == COMPRESR_RETRIEVE_TOOL_NAME + + +@pytest.mark.asyncio +async def test_async_should_run_agentic_loop_false_without_retrieve_tool( + guardrail: CompresrGuardrail, +): + response = _make_openai_response_with_tool_call("other_tool", {"x": 1}) + should_run, _ = await guardrail.async_should_run_agentic_loop( + response=response, + model="gpt-4o", + messages=[], + tools=[], + stream=False, + custom_llm_provider="openai", + kwargs={}, + ) + assert should_run is False + + +@pytest.mark.asyncio +async def test_agentic_plan_returns_stored_original(guardrail: CompresrGuardrail): + hash_value = hashlib.sha256(TOOL_OUTPUT.encode()).hexdigest()[:24] + guardrail._store_originals(_scoped_store_key(_logging_obj("call-id-1")), {hash_value: TOOL_OUTPUT}) + + plan = await guardrail.async_build_agentic_loop_plan( + tools={ + "tool_calls": [ + { + "id": "call_abc", + "type": "function", + "name": COMPRESR_RETRIEVE_TOOL_NAME, + "arguments": {"hash": hash_value}, + } + ] + }, + model="gpt-4o", + messages=[{"role": "user", "content": "q"}], + response=_make_openai_response_with_tool_call( + COMPRESR_RETRIEVE_TOOL_NAME, {"hash": hash_value}, tool_id="call_abc" + ), + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={}, + logging_obj=_logging_obj("call-id-1"), + stream=False, + kwargs={}, + ) + + assert plan.run_agentic_loop is True + follow_up = plan.request_patch.messages + tool_result = follow_up[-1] + assert tool_result["role"] == "tool" + assert tool_result["tool_call_id"] == "call_abc" + assert tool_result["content"] == TOOL_OUTPUT + + +@pytest.mark.asyncio +async def test_agentic_plan_preserves_list_shaped_assistant_text(guardrail: CompresrGuardrail): + """Some providers return chat assistant content as list-of-parts; the + retrieval follow-up must keep that text, not drop it to None.""" + hash_value = "a" * 24 + guardrail._store_originals(_scoped_store_key(_logging_obj("call-id-1")), {hash_value: "original"}) + response = _make_openai_response_with_tool_calls( + [(COMPRESR_RETRIEVE_TOOL_NAME, {"hash": hash_value}, "call_r")], + content=[{"type": "text", "text": "Let me fetch the original."}], + ) + + plan = await guardrail.async_build_agentic_loop_plan( + tools={"tool_calls": [_retrieve_tool_call(hash_value, "call_r")]}, + model="gpt-4o", + messages=[{"role": "user", "content": "q"}], + response=response, + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={}, + logging_obj=_logging_obj("call-id-1"), + stream=False, + kwargs={}, + ) + + assistant_message = plan.request_patch.messages[-2] + assert assistant_message["role"] == "assistant" + assert assistant_message["content"] == "Let me fetch the original." + + +@pytest.mark.asyncio +async def test_agentic_plan_strips_other_guardrails_executed_markers(guardrail: CompresrGuardrail): + # The retrieval follow-up restores content other pre-call guardrails may + # never have inspected, so their executed markers must not be replayed; + # only this guardrail's own marker survives (no recompression loop). + hash_value = "a" * 24 + guardrail._store_originals(_scoped_store_key(_logging_obj("call-id-1")), {hash_value: TOOL_OUTPUT}) + response = _make_openai_response_with_tool_calls([(COMPRESR_RETRIEVE_TOOL_NAME, {"hash": hash_value}, "call_r")]) + own_marker = guardrail._pre_call_marker() + assert own_marker is not None + kwargs = { + "metadata": { + "user_api_key": "key-hash", + PRE_CALL_EXECUTED_GUARDRAILS_KEY: [own_marker, "token:pii_guardrail"], + }, + "litellm_metadata": {PRE_CALL_EXECUTED_GUARDRAILS_KEY: ["token:other_guardrail"]}, + } + + plan = await guardrail.async_build_agentic_loop_plan( + tools={"tool_calls": [_retrieve_tool_call(hash_value, "call_r")]}, + model="gpt-4o", + messages=[{"role": "user", "content": "q"}], + response=response, + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={}, + logging_obj=_logging_obj("call-id-1"), + stream=False, + kwargs=kwargs, + ) + + out = plan.request_patch.kwargs + assert out["metadata"][PRE_CALL_EXECUTED_GUARDRAILS_KEY] == [own_marker] + assert out["metadata"]["user_api_key"] == "key-hash" + assert PRE_CALL_EXECUTED_GUARDRAILS_KEY not in out["litellm_metadata"] + assert kwargs["metadata"][PRE_CALL_EXECUTED_GUARDRAILS_KEY] == [own_marker, "token:pii_guardrail"] + assert kwargs["litellm_metadata"][PRE_CALL_EXECUTED_GUARDRAILS_KEY] == ["token:other_guardrail"] + + +@pytest.mark.asyncio +async def test_agentic_plan_rejects_hash_from_other_request( + guardrail: CompresrGuardrail, +): + hash_value = "b" * 24 + guardrail._store_originals("someone-elses-call", {hash_value: "secret"}) + + plan = await guardrail.async_build_agentic_loop_plan( + tools={ + "tool_calls": [ + { + "id": "call_abc", + "type": "function", + "name": COMPRESR_RETRIEVE_TOOL_NAME, + "arguments": {"hash": hash_value}, + } + ] + }, + model="gpt-4o", + messages=[], + response=_make_openai_response_with_tool_call( + COMPRESR_RETRIEVE_TOOL_NAME, {"hash": hash_value}, tool_id="call_abc" + ), + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={}, + logging_obj=_logging_obj("my-call"), + stream=False, + kwargs={}, + ) + + # Hash belongs to another caller's scope; the loop is vetoed and the secret + # never surfaces. + assert plan.run_agentic_loop is False + assert plan.request_patch is None + + +@pytest.mark.asyncio +async def test_agentic_loop_vetoed_when_no_recovery_state(guardrail: CompresrGuardrail): + # A caller-defined compresr_retrieve tool with no stored original must not + # trigger an extra provider round-trip. + hash_value = "f" * 24 + response = _make_openai_response_with_tool_call(COMPRESR_RETRIEVE_TOOL_NAME, {"hash": hash_value}, tool_id="call_x") + plan = await guardrail.async_build_agentic_loop_plan( + tools={"tool_calls": [_retrieve_tool_call(hash_value, "call_x")]}, + model="gpt-4o", + messages=[{"role": "user", "content": "q"}], + response=response, + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={}, + logging_obj=_logging_obj("call-id-1"), + stream=False, + kwargs={}, + ) + assert plan.run_agentic_loop is False + assert plan.request_patch is None + + +@pytest.mark.asyncio +async def test_agentic_loop_dedupes_repeated_retrievals(guardrail: CompresrGuardrail): + # Retrieving the same marker many times expands the original once; repeats + # get a short marker (no follow-up amplification). + hash_value = "a" * 24 + guardrail._store_originals(_scoped_store_key(_logging_obj("call-id-1")), {hash_value: TOOL_OUTPUT}) + calls = [(COMPRESR_RETRIEVE_TOOL_NAME, {"hash": hash_value}, f"call_{i}") for i in range(5)] + plan = await guardrail.async_build_agentic_loop_plan( + tools={"tool_calls": [_retrieve_tool_call(hash_value, f"call_{i}") for i in range(5)]}, + model="gpt-4o", + messages=[{"role": "user", "content": "q"}], + response=_make_openai_response_with_tool_calls(calls), + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={}, + logging_obj=_logging_obj("call-id-1"), + stream=False, + kwargs={}, + ) + tool_results = [m for m in plan.request_patch.messages if m.get("role") == "tool"] + assert len(tool_results) == 5 + assert sum(1 for m in tool_results if m["content"] == TOOL_OUTPUT) == 1 + assert all("already retrieved" in m["content"] for m in tool_results if m["content"] != TOOL_OUTPUT) + + +@pytest.mark.asyncio +async def test_agentic_loop_caps_retrieval_count(guardrail: CompresrGuardrail): + # Beyond _MAX_RETRIEVALS_PER_LOOP retrievals, extra calls get a bounded marker. + n = 10 + hashes = [f"{i:024x}" for i in range(n)] + guardrail._store_originals(_scoped_store_key(_logging_obj("call-id-1")), {h: f"original-{h}" for h in hashes}) + calls = [(COMPRESR_RETRIEVE_TOOL_NAME, {"hash": h}, f"call_{i}") for i, h in enumerate(hashes)] + plan = await guardrail.async_build_agentic_loop_plan( + tools={"tool_calls": [_retrieve_tool_call(h, f"call_{i}") for i, h in enumerate(hashes)]}, + model="gpt-4o", + messages=[{"role": "user", "content": "q"}], + response=_make_openai_response_with_tool_calls(calls), + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={}, + logging_obj=_logging_obj("call-id-1"), + stream=False, + kwargs={}, + ) + tool_results = [m for m in plan.request_patch.messages if m.get("role") == "tool"] + assert len(tool_results) == n + over_limit = [m for m in tool_results if "retrieval limit reached" in m["content"]] + assert len(over_limit) == n - 8 # only the first 8 expand + + +def test_display_hash_strips_control_characters(): + """The compresr_retrieve `hash` argument is model/tool-output-influenced, so + control characters (newlines, ANSI escapes) must be stripped — not just + length-capped — before it is echoed into logs or the fallback message.""" + from litellm.proxy.guardrails.guardrail_hooks.compresr.compresr import _display_hash + + assert _display_hash("a" * 24) == "a" * 24 # a real marker hash passes through + assert "\n" not in _display_hash("abc\ndef\rFORGED LOG LINE") + assert "\x1b" not in _display_hash("hash\x1b[31mred") + capped = _display_hash("z" * 100) + assert capped.endswith("…") and len(capped) <= 33 + + +@pytest.mark.asyncio +async def test_agentic_plan_builds_anthropic_followup_shape( + guardrail: CompresrGuardrail, +): + hash_value = "c" * 24 + guardrail._store_originals(_scoped_store_key(_logging_obj("call-id-1")), {hash_value: TOOL_OUTPUT}) + + response = MagicMock() + response.output = None + response.content = [{"type": "tool_use", "id": "toolu_1"}] + + plan = await guardrail.async_build_agentic_loop_plan( + tools={ + "tool_calls": [ + { + "id": "toolu_1", + "type": "function", + "name": COMPRESR_RETRIEVE_TOOL_NAME, + "arguments": {"hash": hash_value}, + } + ] + }, + model="claude-sonnet-5", + messages=[{"role": "user", "content": "q"}], + response=response, + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={"max_tokens": 1024}, + logging_obj=_logging_obj("call-id-1"), + stream=False, + kwargs={}, + ) + + follow_up = plan.request_patch.messages + assistant_msg, user_msg = follow_up[-2], follow_up[-1] + assert assistant_msg["role"] == "assistant" + assert assistant_msg["content"][0]["type"] == "tool_use" + assert user_msg["content"][0]["type"] == "tool_result" + assert user_msg["content"][0]["tool_use_id"] == "toolu_1" + assert user_msg["content"][0]["content"] == TOOL_OUTPUT + assert plan.request_patch.max_tokens == 1024 + + +@pytest.mark.asyncio +async def test_agentic_plan_builds_responses_followup_shape( + guardrail: CompresrGuardrail, +): + """The /v1/responses path echoes the function_call and pairs it with a + function_call_output keyed by the same call_id.""" + hash_value = "e" * 24 + guardrail._store_originals(_scoped_store_key(_logging_obj("call-id-1")), {hash_value: TOOL_OUTPUT}) + + response = MagicMock() + response.output = [{"type": "function_call", "call_id": "fc_1"}] # responses-API shape + response.content = None + + plan = await guardrail.async_build_agentic_loop_plan( + tools={ + "tool_calls": [ + { + "id": "fc_1", + "type": "function", + "name": COMPRESR_RETRIEVE_TOOL_NAME, + "arguments": {"hash": hash_value}, + } + ] + }, + model="gpt-4o", + messages=[{"role": "user", "content": "q"}], + response=response, + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={}, + logging_obj=_logging_obj("call-id-1"), + stream=False, + kwargs={}, + ) + + call_item, output_item = plan.request_patch.messages[-2], plan.request_patch.messages[-1] + assert call_item["type"] == "function_call" + assert call_item["call_id"] == "fc_1" + assert output_item["type"] == "function_call_output" + assert output_item["call_id"] == "fc_1" + assert output_item["output"] == TOOL_OUTPUT + + +@pytest.mark.asyncio +async def test_agentic_plan_chat_parallel_tool_calls_echoes_only_retrieve( + guardrail: CompresrGuardrail, +): + """When the model calls a real tool alongside compresr_retrieve in one turn, + only the retrieve call may be echoed in the reconstructed assistant message: + every echoed tool_call must have a matching tool result or the provider 400s. + The real call is re-planned by the follow-up; the assistant text is kept.""" + hash_value = "f" * 24 + guardrail._store_originals(_scoped_store_key(_logging_obj("call-id-1")), {hash_value: TOOL_OUTPUT}) + + response = _make_openai_response_with_tool_calls( + [ + ("get_weather", {"city": "Paris"}, "call_weather"), + (COMPRESR_RETRIEVE_TOOL_NAME, {"hash": hash_value}, "call_retrieve"), + ], + content="Let me expand that note and check the weather.", + ) + + plan = await guardrail.async_build_agentic_loop_plan( + tools={"tool_calls": [_retrieve_tool_call(hash_value, "call_retrieve")]}, + model="gpt-4o", + messages=[{"role": "user", "content": "q"}], + response=response, + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={}, + logging_obj=_logging_obj("call-id-1"), + stream=False, + kwargs={}, + ) + + follow_up = plan.request_patch.messages + assistant_msg = follow_up[-2] + echoed_ids = {tc["id"] for tc in assistant_msg["tool_calls"]} + result_ids = {m["tool_call_id"] for m in follow_up if m.get("role") == "tool"} + # get_weather is not echoed; every echoed tool_call is answered. + assert echoed_ids == {"call_retrieve"} + assert echoed_ids == result_ids + assert assistant_msg["content"] == "Let me expand that note and check the weather." + assert follow_up[-1]["content"] == TOOL_OUTPUT + + +@pytest.mark.asyncio +async def test_agentic_plan_anthropic_parallel_preserves_text_and_balances( + guardrail: CompresrGuardrail, +): + """Anthropic parallel-tool-call turn: the assistant text is preserved, the + real tool_use is dropped (re-planned), and the reconstructed turn stays + balanced — one tool_result per echoed tool_use.""" + hash_value = "a" * 23 + "9" + guardrail._store_originals(_scoped_store_key(_logging_obj("call-id-1")), {hash_value: TOOL_OUTPUT}) + + response = MagicMock() + response.output = None + response.content = [ + {"type": "text", "text": "Checking the weather and expanding the note."}, + {"type": "tool_use", "id": "toolu_weather", "name": "get_weather", "input": {"city": "Paris"}}, + { + "type": "tool_use", + "id": "toolu_retrieve", + "name": COMPRESR_RETRIEVE_TOOL_NAME, + "input": {"hash": hash_value}, + }, + ] + + plan = await guardrail.async_build_agentic_loop_plan( + tools={"tool_calls": [_retrieve_tool_call(hash_value, "toolu_retrieve")]}, + model="claude-sonnet-5", + messages=[{"role": "user", "content": "q"}], + response=response, + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={"max_tokens": 1024}, + logging_obj=_logging_obj("call-id-1"), + stream=False, + kwargs={}, + ) + + assistant_msg, user_msg = plan.request_patch.messages[-2], plan.request_patch.messages[-1] + assert assistant_msg["content"][0] == { + "type": "text", + "text": "Checking the weather and expanding the note.", + } + echoed_ids = [b["id"] for b in assistant_msg["content"] if b["type"] == "tool_use"] + answered_ids = [b["tool_use_id"] for b in user_msg["content"]] + # get_weather dropped; balanced tool_use/tool_result pairing. + assert echoed_ids == ["toolu_retrieve"] + assert answered_ids == echoed_ids + + +# ── store hygiene ───────────────────────────────────────────────────── + + +def test_originals_store_prunes_expired(guardrail: CompresrGuardrail): + guardrail._originals_by_call_id["old"] = ({"a" * 24: "x"}, 0.0) # already expired + guardrail._store_originals("new", {"b" * 24: "y"}) + assert "old" not in guardrail._originals_by_call_id + assert "new" in guardrail._originals_by_call_id + + +def test_originals_store_caps_tracked_calls(guardrail: CompresrGuardrail): + for i in range(300): + guardrail._store_originals(f"call-{i}", {("%024x" % i): "x"}) + assert len(guardrail._originals_by_call_id) <= 256 + # Most recent entries survive. + assert "call-299" in guardrail._originals_by_call_id + + +def test_originals_store_caps_bytes_per_call(): + guardrail = _make_guardrail(max_bytes_per_call=1000) + hashes = tuple(f"{i:024x}" for i in range(5)) + values = tuple("x" * 400 for _ in range(5)) + guardrail._store_originals("c", dict(zip(hashes, values))) + + stored, _expiry = guardrail._originals_by_call_id["c"] + assert sum(len(v.encode("utf-8")) for v in stored.values()) <= 1000 + # Oldest entries are evicted first; newest survives. + assert hashes[-1] in stored + assert hashes[0] not in stored + + +def test_originals_store_byte_cap_survives_lone_surrogates(): + # Regression: eviction path must use surrogatepass to match the hash + # function; a bare encode("utf-8") crashed on lone surrogates. + guardrail = _make_guardrail(max_bytes_per_call=500) + surrogate_value = "\ud800" * 60 + hashes = tuple(f"{i:024x}" for i in range(3)) + guardrail._store_originals("c", dict(zip(hashes, (surrogate_value, surrogate_value, surrogate_value)))) + + stored, _expiry = guardrail._originals_by_call_id["c"] + assert hashes[-1] in stored + assert hashes[0] not in stored + + +def test_originals_store_caps_total_bytes_across_calls(monkeypatch: pytest.MonkeyPatch): + # Global byte budget: many distinct call ids must not retain unbounded memory. + monkeypatch.setattr( + "litellm.proxy.guardrails.guardrail_hooks.compresr.compresr._MAX_TOTAL_STORE_BYTES", + 10_000, + ) + guardrail = _make_guardrail(max_bytes_per_call=4_000) + for i in range(20): + guardrail._store_originals(f"call-{i}", {f"{i:024x}": "x" * 3_000}) + + total = sum( + len(v.encode("utf-8")) + for originals, _expiry in guardrail._originals_by_call_id.values() + for v in originals.values() + ) + assert total <= 10_000 + assert guardrail._store_total_bytes == total # running counter stays exact + # Oldest calls evicted; the most-recent call's originals survive. + assert "call-0" not in guardrail._originals_by_call_id + assert "call-19" in guardrail._originals_by_call_id + + +def test_originals_store_global_cap_keeps_current_when_single_call_is_large( + monkeypatch: pytest.MonkeyPatch, +): + # One call over the global cap is still kept (only max_bytes_per_call trims it); + # global eviction never empties the store. + monkeypatch.setattr( + "litellm.proxy.guardrails.guardrail_hooks.compresr.compresr._MAX_TOTAL_STORE_BYTES", + 1_000, + ) + guardrail = _make_guardrail(max_bytes_per_call=5_000) + guardrail._store_originals("solo", {f"{0:024x}": "x" * 4_000}) + assert "solo" in guardrail._originals_by_call_id + + +def test_recovery_markers_respect_per_call_byte_cap(): + # Regression: markers were built from every original before _store_originals + # applied the byte cap, so an evicted original left a dangling marker the + # model could never retrieve. Recovery must be attached only for originals + # that fit the cap, so every shipped marker stays retrievable. + guardrail = _make_guardrail(max_bytes_per_call=1000) + contexts = ["a" * 400, "b" * 400, "c" * 400] + messages = [{"role": "tool", "content": text} for text in contexts] + results = [{"compressed_context": f"small-{i}"} for i in range(3)] + + applied = guardrail._apply_compression_results( + messages, [0, 1, 2], contexts, results, recovery_enabled=True + ) + + # 400 + 400 fit under 1000; the third (which would reach 1200) is skipped. + assert applied.messages_compressed == 3 + assert len(applied.originals) == 2 + third_hash = _content_hash("c" * 400) + assert third_hash not in applied.originals + assert f"compresr hash={third_hash}" not in applied.compressed_messages[2]["content"] + + # Every marker still shipped must resolve to a stored original. + guardrail._store_originals("c", applied.originals) + for hash_value in applied.originals: + assert guardrail._retrieve_original("c", hash_value) is not None + assert f"compresr hash={hash_value}" in "".join( + str(m["content"]) for m in applied.compressed_messages + ) + + +def test_recovery_markers_respect_byte_cap_across_reused_store_key(): + # Regression: the per-call budget must also count bytes already stored under + # the same store key (a later turn reusing the call id). Otherwise merging + # this call's originals with the existing entry overflows the cap and + # _store_originals evicts an original this call just shipped a marker for. + guardrail = _make_guardrail(max_bytes_per_call=100) + old_hash = _content_hash("A" * 50) + guardrail._store_originals("k", {old_hash: "A" * 50}) + guardrail._store_originals("k", {_content_hash("C" * 40): "C" * 40}) + existing = guardrail._originals_by_call_id["k"][0] + + # This turn recompresses the same "A" (already stored) plus a new "D". + contexts = ["D" * 40, "A" * 50] + messages = [{"role": "tool", "content": text} for text in contexts] + results = [{"compressed_context": "dd"}, {"compressed_context": "aa"}] + applied = guardrail._apply_compression_results( + messages, [0, 1], contexts, results, recovery_enabled=True, existing_originals=existing + ) + + guardrail._store_originals("k", applied.originals) + # No marker shipped this turn may dangle after the store enforces the cap. + for hash_value in applied.originals: + assert guardrail._retrieve_original("k", hash_value) is not None + assert f"compresr hash={hash_value}" in "".join( + str(m["content"]) for m in applied.compressed_messages + ) + # The zero-cost repeat of an already-stored original stays retrievable. + assert old_hash in applied.originals + assert guardrail._retrieve_original("k", old_hash) is not None + + +# ── dynamic (adaptive) compression — latte_v2 Kneedle ───────────────── + + +@pytest.mark.asyncio +async def test_dynamic_flag_in_payload(): + """dynamic=True must appear in the compress payload; unset bounds omitted.""" + guardrail = _make_guardrail(dynamic=True) + messages = [ + {"role": "user", "content": USER_QUESTION}, + {"role": "tool", "tool_call_id": "call_x", "name": "search", "content": TOOL_OUTPUT}, + ] + mock_post = AsyncMock(return_value=_make_single_compress_response()) + with patch.object(guardrail.async_handler, "post", mock_post): + await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + payload = mock_post.call_args.kwargs["json"] + assert payload["dynamic"] is True + assert "dynamic_min_ratio" not in payload + assert "dynamic_max_ratio" not in payload + + +@pytest.mark.asyncio +async def test_dynamic_bounds_in_payload_when_set(): + guardrail = _make_guardrail(dynamic=True, dynamic_min_ratio=2.0, dynamic_max_ratio=8.0) + messages = [ + {"role": "user", "content": USER_QUESTION}, + {"role": "tool", "tool_call_id": "call_x", "name": "search", "content": TOOL_OUTPUT}, + ] + mock_post = AsyncMock(return_value=_make_single_compress_response()) + with patch.object(guardrail.async_handler, "post", mock_post): + await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + payload = mock_post.call_args.kwargs["json"] + assert payload["dynamic"] is True + assert payload["dynamic_min_ratio"] == 2.0 + assert payload["dynamic_max_ratio"] == 8.0 + + +@pytest.mark.asyncio +async def test_dynamic_on_by_default(): + guardrail = _make_guardrail() # dynamic defaults on (latte_v2) + messages = [ + {"role": "user", "content": USER_QUESTION}, + {"role": "tool", "tool_call_id": "call_x", "name": "search", "content": TOOL_OUTPUT}, + ] + mock_post = AsyncMock(return_value=_make_single_compress_response()) + with patch.object(guardrail.async_handler, "post", mock_post): + await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + assert mock_post.call_args.kwargs["json"]["dynamic"] is True + + +# ── generic passthrough compression params ──────────────────────────── + + +@pytest.mark.asyncio +async def test_compression_params_passthrough_in_payload(): + """Extra params in compression_params are forwarded verbatim; named fields + still win on collision.""" + guardrail = _make_guardrail(compression_params={"heuristic_chunking": True, "coarse": False}) + messages = [ + {"role": "user", "content": USER_QUESTION}, + {"role": "tool", "tool_call_id": "call_x", "name": "search", "content": TOOL_OUTPUT}, + ] + mock_post = AsyncMock(return_value=_make_single_compress_response()) + with patch.object(guardrail.async_handler, "post", mock_post): + await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + payload = mock_post.call_args.kwargs["json"] + assert payload["heuristic_chunking"] is True + # named `coarse` (default True) wins over the passthrough's coarse=False + assert payload["coarse"] is True + + +@pytest.mark.asyncio +async def test_compression_params_cannot_override_request_content_fields(): + """context/query/inputs carry the actual content being compressed; a + passthrough collision on them must be dropped, not silently win.""" + guardrail = _make_guardrail( + compression_params={ + "context": "injected", + "query": "injected", + "inputs": [], + "heuristic_chunking": True, + } + ) + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + payload = mock_post.call_args.kwargs["json"] + assert payload["context"] == TOOL_OUTPUT + assert payload["query"] == 'web_search: {"query": "2026 EV range"}' + assert "inputs" not in payload + assert payload["heuristic_chunking"] is True + + +# ── compress_last_user ──────────────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_compress_last_user_compresses_with_verbatim_query(): + """compress_last_user=True compresses the last user message, but the query + sent to Compresr is still the original verbatim user text.""" + guardrail = _make_guardrail(compress_last_user=True) + long_question = "Which 2026 EV has the longest range? " * 20 # > 500 chars + messages = [{"role": "user", "content": long_question}] + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + payload = mock_post.call_args.kwargs["json"] + assert payload["context"] == long_question + assert payload["query"] == long_question # verbatim, not the compressed text + assert result["structured_messages"][0]["content"] == "compressed summary" + + +# ── malformed-but-200 token stats (must not defeat fail policy) ─────── + + +@pytest.mark.asyncio +async def test_non_numeric_token_stats_do_not_raise(guardrail: CompresrGuardrail): + """A 200 response with non-numeric token counts must not raise: _call_compress + already succeeded, so a bare int() here would 500 even under fail policy.""" + resp = _make_single_compress_response() + resp.json.return_value["data"]["original_tokens"] = "not-a-number" + resp.json.return_value["data"]["compressed_tokens"] = None + + with patch.object(guardrail.async_handler, "post", AsyncMock(return_value=resp)): + result = await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + assert result["structured_messages"][3]["content"].startswith("compressed summary") + + +# ── HTTP status errors (non-2xx from the shared handler) ────────────── + + +def _http_status_error(status: int = 500, text: str = "upstream error body") -> httpx.HTTPStatusError: + # The shared AsyncHTTPHandler.post() raises HTTPStatusError on any non-2xx, + # carrying the upstream body and request headers; this simulates that. + request = httpx.Request("POST", f"{FAKE_API_BASE}/api/compress/question-specific/") + response = httpx.Response(status, text=text, request=request) + return httpx.HTTPStatusError(str(status), request=request, response=response) + + +@pytest.mark.asyncio +async def test_http_status_error_raises_when_fail_closed(guardrail: CompresrGuardrail): + with patch.object(guardrail.async_handler, "post", AsyncMock(side_effect=_http_status_error(500))): + with pytest.raises(HTTPException) as exc_info: + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + assert exc_info.value.status_code == 502 + + +@pytest.mark.asyncio +async def test_http_status_error_fail_open_forwards_uncompressed(): + guardrail = _make_guardrail(unreachable_fallback="fail_open") + inputs = _apply_inputs(AGENT_MESSAGES) + with patch.object(guardrail.async_handler, "post", AsyncMock(side_effect=_http_status_error(429))): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + ) + assert result is inputs + assert result["structured_messages"][3]["content"] == TOOL_OUTPUT + + +@pytest.mark.asyncio +async def test_http_status_error_does_not_leak_upstream_body(guardrail: CompresrGuardrail): + secret = "SECRET_INSTANCE_METADATA_TOKEN=aws-imds-response" + with patch.object(guardrail.async_handler, "post", AsyncMock(side_effect=_http_status_error(500, text=secret))): + with pytest.raises(HTTPException) as exc_info: + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + assert secret not in json.dumps(exc_info.value.detail) + + +# ── non-transport httpx errors must still honor the fail policy ──────── +# TooManyRedirects and DecodingError are httpx.RequestError but NOT +# httpx.TransportError, so a narrow except would let them escape as a 500 +# even under fail_open. These lock in that they are routed through the policy. + + +@pytest.mark.asyncio +@pytest.mark.parametrize( + "error", + [ + httpx.TooManyRedirects("redirect loop"), + httpx.DecodingError("bad content-encoding"), + ], +) +async def test_request_errors_raise_when_fail_closed(guardrail: CompresrGuardrail, error): + with patch.object(guardrail.async_handler, "post", AsyncMock(side_effect=error)): + with pytest.raises(HTTPException) as exc_info: + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + assert exc_info.value.status_code == 502 + + +@pytest.mark.asyncio +@pytest.mark.parametrize( + "error", + [ + httpx.TooManyRedirects("redirect loop"), + httpx.DecodingError("bad content-encoding"), + ], +) +async def test_request_errors_fail_open_forwards_uncompressed(error): + guardrail = _make_guardrail(unreachable_fallback="fail_open") + inputs = _apply_inputs(AGENT_MESSAGES) + with patch.object(guardrail.async_handler, "post", AsyncMock(side_effect=error)): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + ) + assert result is inputs + assert result["structured_messages"][3]["content"] == TOOL_OUTPUT + + +@pytest.mark.asyncio +async def test_undecodable_body_on_200_forwards_uncompressed_when_fail_open(): + """A 200 whose body raises DecodingError on .json()/.text must not 500.""" + guardrail = _make_guardrail(unreachable_fallback="fail_open") + resp = MagicMock() + resp.status_code = 200 + resp.json.side_effect = httpx.DecodingError("bad content-encoding") + type(resp).text = property(lambda self: (_ for _ in ()).throw(httpx.DecodingError("bad content-encoding"))) + inputs = _apply_inputs(AGENT_MESSAGES) + with patch.object(guardrail.async_handler, "post", AsyncMock(return_value=resp)): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + ) + assert result is inputs + assert result["structured_messages"][3]["content"] == TOOL_OUTPUT + + +@pytest.mark.asyncio +async def test_recursion_error_on_json_forwards_when_fail_open(): + """A deeply nested JSON body can raise RecursionError while parsing; it must + route through the fail policy, not escape as a 500.""" + guardrail = _make_guardrail(unreachable_fallback="fail_open") + resp = MagicMock() + resp.status_code = 200 + resp.json.side_effect = RecursionError("maximum recursion depth exceeded") + resp.text = "" + inputs = _apply_inputs(AGENT_MESSAGES) + with patch.object(guardrail.async_handler, "post", AsyncMock(return_value=resp)): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + ) + assert result is inputs + + +@pytest.mark.asyncio +async def test_lone_surrogate_in_content_does_not_crash(guardrail: CompresrGuardrail): + """A lone Unicode surrogate (reachable via a JSON \\uXXXX escape) in content + must not crash hashing/byte-accounting after the fail-policy decision.""" + surrogate_output = ("x" * 600) + "\ud800" + messages = [ + {"role": "user", "content": USER_QUESTION}, + { + "role": "assistant", + "content": None, + "tool_calls": [{"id": "call_1", "type": "function", "function": {"name": "web_search", "arguments": "{}"}}], + }, + {"role": "tool", "tool_call_id": "call_1", "content": surrogate_output}, + ] + mock_post = AsyncMock(return_value=_make_single_compress_response()) + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=_apply_inputs(messages), + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=_logging_obj("call-id-1"), + ) + assert result["structured_messages"][2]["content"].startswith("compressed summary") + # The original (surrogate included) is recoverable by its hash. + stored = next(iter(guardrail._originals_by_call_id.values()))[0] + assert surrogate_output in stored.values() + + +@pytest.mark.asyncio +async def test_identical_compressed_text_treated_as_noop(guardrail: CompresrGuardrail): + """If the service returns text byte-identical to the original, nothing + changed: the exact inputs object is returned so no write-back is forced.""" + inputs = _apply_inputs(AGENT_MESSAGES) + mock_post = AsyncMock(return_value=_make_single_compress_response(compressed_context=TOOL_OUTPUT)) + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=_logging_obj("call-id-1"), + ) + assert result is inputs + + +# ── recovery requires a framework-issued call id ────────────────────── + + +@pytest.mark.asyncio +async def test_recovery_disabled_without_call_id(): + # enable_retrieval defaults True, but with no framework litellm_call_id we + # cannot scope stored originals to the request, so compression proceeds + # without markers, the retrieve tool, or any stored originals. + guardrail = _make_guardrail() + inputs = _apply_inputs(AGENT_MESSAGES) + mock_post = AsyncMock(return_value=_make_single_compress_response()) + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=inputs, + request_data={"model": "gpt-4o"}, + input_type="request", + ) + assert result["structured_messages"][3]["content"] == "compressed summary" + assert not has_compresr_retrieve_tool(result.get("tools") or []) + assert guardrail._originals_by_call_id == {} + + +def test_config_model_exposes_unreachable_fallback(): + from litellm.types.proxy.guardrails.guardrail_hooks.compresr import ( + CompresrGuardrailConfigModel, + ) + + field = CompresrGuardrailConfigModel.model_fields.get("unreachable_fallback") + assert field is not None + assert field.default == "fail_closed" + + +# ── audit fixes ─────────────────────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_cancelled_error_propagates_not_swallowed(): + # Regression: CancelledError is a BaseException, not caught by + # (RequestError, Timeout). It must re-raise so cooperative cancellation + # (asyncio.wait_for, client disconnect) still fires. + import asyncio as _asyncio + + guardrail = _make_guardrail(unreachable_fallback="fail_open") + with patch.object(guardrail.async_handler, "post", AsyncMock(side_effect=_asyncio.CancelledError())): + with pytest.raises(_asyncio.CancelledError): + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + ) + + +def test_max_bytes_per_call_negative_rejected(): + # Regression: a negative value silently disabled the byte cap (< 0 behaves + # like 0 in _bound_call_bytes). Validate at construction so the footgun + # surfaces as a ValueError at startup, not silent unbounded storage. + with pytest.raises(ValueError, match="max_bytes_per_call"): + _make_guardrail(max_bytes_per_call=-1) + + +@pytest.mark.asyncio +async def test_max_tokens_zero_from_optional_params_wins_over_kwargs(): + # Regression: `or` short-circuits on falsy values, so an explicit + # max_tokens=0 from optional_params fell through to kwargs["max_tokens"]. + # Must use `is not None`. + guardrail = _make_guardrail() + hash_value = "deadbeef" + guardrail._store_originals(_scoped_store_key(_logging_obj("call-1")), {hash_value: TOOL_OUTPUT}) + response = MagicMock() + response.content = [{"type": "tool_use", "id": "toolu_1"}] + plan = await guardrail.async_build_agentic_loop_plan( + tools={ + "tool_calls": [ + { + "id": "toolu_1", + "type": "function", + "name": COMPRESR_RETRIEVE_TOOL_NAME, + "arguments": {"hash": hash_value}, + } + ] + }, + model="claude-sonnet-5", + messages=[{"role": "user", "content": "q"}], + response=response, + anthropic_messages_provider_config=None, + anthropic_messages_optional_request_params={"max_tokens": 0}, + logging_obj=_logging_obj("call-1"), + stream=False, + kwargs={"max_tokens": 999}, + ) + assert plan.request_patch.max_tokens == 0 + + +@pytest.mark.asyncio +async def test_recovery_disabled_when_no_caller_scope(): + # Regression: on a no-auth deployment (no UserAPIKeyAuth in metadata) the + # store key would fall back to the client-settable call id alone, letting + # any caller retrieve any other caller's originals. Recovery must be off. + guardrail = _make_guardrail() + logging_obj = MagicMock() + logging_obj.litellm_call_id = "call-abc" + logging_obj.model_call_details = {"litellm_params": {"metadata": {}}} + mock_post = AsyncMock(return_value=_make_single_compress_response()) + with patch.object(guardrail.async_handler, "post", mock_post): + result = await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=logging_obj, + ) + assert not has_compresr_retrieve_tool(result.get("tools") or []) + assert guardrail._originals_by_call_id == {} + + +@pytest.mark.asyncio +async def test_warns_once_per_interval_when_recovery_skipped_without_scope(): + # enable_retrieval is on but the request has no per-key auth scope: recovery + # is silently skipped, so a call-time warning must surface it, rate-limited + # within the interval but re-arming after it so an ongoing misconfiguration + # stays visible. + guardrail = _make_guardrail() + logging_obj = MagicMock() + logging_obj.litellm_call_id = "call-abc" + logging_obj.model_call_details = {"litellm_params": {"metadata": {}}} + mock_post = AsyncMock(return_value=_make_single_compress_response()) + + def _no_scope_warnings(mock_log): + return [c for c in mock_log.warning.call_args_list if "no per-key auth scope" in str(c)] + + with patch.object(guardrail.async_handler, "post", mock_post): + with patch("litellm.proxy.guardrails.guardrail_hooks.compresr.compresr.verbose_proxy_logger") as mock_log: + for _ in range(3): + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=logging_obj, + ) + assert len(_no_scope_warnings(mock_log)) == 1 + + guardrail._no_scope_warning_expiry = 0.0 + await guardrail.apply_guardrail( + inputs=_apply_inputs(AGENT_MESSAGES), + request_data={"model": "gpt-4o"}, + input_type="request", + logging_obj=logging_obj, + ) + assert len(_no_scope_warnings(mock_log)) == 2 diff --git a/tests/test_litellm/proxy/guardrails/test_guardrail_endpoints.py b/tests/test_litellm/proxy/guardrails/test_guardrail_endpoints.py index 21e7186fca3..359b1807344 100644 --- a/tests/test_litellm/proxy/guardrails/test_guardrail_endpoints.py +++ b/tests/test_litellm/proxy/guardrails/test_guardrail_endpoints.py @@ -1291,6 +1291,136 @@ async def test_apply_guardrail_invokes_logging_pipeline(mocker): } +def _patch_apply_guardrail_env(mocker, guardrail_result): + mock_guardrail = mocker.Mock() + mock_guardrail.apply_guardrail = AsyncMock(return_value=guardrail_result) + + mock_registry = mocker.Mock() + mock_registry.get_initialized_guardrail_callback.return_value = mock_guardrail + mocker.patch( + "litellm.proxy.guardrails.guardrail_endpoints.GUARDRAIL_REGISTRY", mock_registry + ) + + mock_logging_obj = mocker.Mock() + mock_logging_obj.async_success_handler = AsyncMock() + mock_logging_obj.model_call_details = {} + mock_processor = mocker.Mock() + mock_processor.common_processing_pre_call_logic = AsyncMock( + return_value=({"guardrail_name": "test-guardrail"}, mock_logging_obj) + ) + mocker.patch( + "litellm.proxy.common_request_processing.ProxyBaseLLMRequestProcessing", + return_value=mock_processor, + ) + + mock_proxy_logging = mocker.Mock() + mock_proxy_logging.post_call_success_hook = AsyncMock() + mocker.patch("litellm.proxy.proxy_server.proxy_logging_obj", mock_proxy_logging) + mocker.patch("litellm.proxy.proxy_server.general_settings", {}) + mocker.patch("litellm.proxy.proxy_server.proxy_config", mocker.Mock()) + mocker.patch("litellm.proxy.proxy_server.version", "test") + mocker.patch("litellm.litellm_core_utils.thread_pool_executor.executor") + + return mock_guardrail + + +@pytest.mark.asyncio +async def test_apply_guardrail_forwards_metadata_to_guardrail(mocker): + """Client-supplied metadata must reach apply_guardrail via request_data so + parameterized custom guardrails can read per-request configuration.""" + mock_guardrail = _patch_apply_guardrail_env(mocker, {"texts": ["ok"]}) + + request = ApplyGuardrailRequest( + guardrail_name="test-guardrail", + text="What are tax loopholes?", + metadata={"forbidden_topics": ["tax"]}, + ) + await apply_guardrail( + fastapi_request=mocker.Mock(), + request=request, + user_api_key_dict=UserAPIKeyAuth(), + ) + + mock_guardrail.apply_guardrail.assert_awaited_once_with( + inputs={"texts": ["What are tax loopholes?"]}, + request_data={"metadata": {"forbidden_topics": ["tax"]}}, + input_type="request", + ) + + +@pytest.mark.asyncio +async def test_apply_guardrail_forwards_metadata_and_messages_together(mocker): + """metadata and messages must coexist in request_data; the dict merge must + not clobber messages when both fields are sent.""" + mock_guardrail = _patch_apply_guardrail_env(mocker, {"texts": ["ok"]}) + + messages = [{"role": "user", "content": "What are tax loopholes?"}] + request = ApplyGuardrailRequest( + guardrail_name="test-guardrail", + text="What are tax loopholes?", + messages=messages, + metadata={"forbidden_topics": ["tax"]}, + ) + await apply_guardrail( + fastapi_request=mocker.Mock(), + request=request, + user_api_key_dict=UserAPIKeyAuth(), + ) + + mock_guardrail.apply_guardrail.assert_awaited_once_with( + inputs={"texts": ["What are tax loopholes?"]}, + request_data={ + "messages": messages, + "metadata": {"forbidden_topics": ["tax"]}, + }, + input_type="request", + ) + + +@pytest.mark.asyncio +async def test_apply_guardrail_omits_metadata_when_not_sent(mocker): + """Without metadata, request_data stays empty (backward-compatible).""" + mock_guardrail = _patch_apply_guardrail_env(mocker, {"texts": ["ok"]}) + + request = ApplyGuardrailRequest(guardrail_name="test-guardrail", text="hello") + await apply_guardrail( + fastapi_request=mocker.Mock(), + request=request, + user_api_key_dict=UserAPIKeyAuth(), + ) + + mock_guardrail.apply_guardrail.assert_awaited_once_with( + inputs={"texts": ["hello"]}, + request_data={}, + input_type="request", + ) + + +@pytest.mark.asyncio +async def test_apply_guardrail_forwards_explicit_empty_messages_and_metadata(mocker): + """Explicitly-sent empty messages/metadata must be forwarded, not dropped; + only omitted fields stay out of request_data.""" + mock_guardrail = _patch_apply_guardrail_env(mocker, {"texts": ["ok"]}) + + request = ApplyGuardrailRequest( + guardrail_name="test-guardrail", + text="hello", + messages=[], + metadata={}, + ) + await apply_guardrail( + fastapi_request=mocker.Mock(), + request=request, + user_api_key_dict=UserAPIKeyAuth(), + ) + + mock_guardrail.apply_guardrail.assert_awaited_once_with( + inputs={"texts": ["hello"]}, + request_data={"messages": [], "metadata": {}}, + input_type="request", + ) + + @pytest.mark.asyncio async def test_get_guardrail_info_endpoint_config_guardrail(mocker): """ diff --git a/tests/test_litellm/proxy/management_endpoints/test_ui_sso.py b/tests/test_litellm/proxy/management_endpoints/test_ui_sso.py index 2a4e2ed6b25..92d1b870d75 100644 --- a/tests/test_litellm/proxy/management_endpoints/test_ui_sso.py +++ b/tests/test_litellm/proxy/management_endpoints/test_ui_sso.py @@ -2186,6 +2186,36 @@ class TestCLIKeyRegenerationFlow: assert not _is_valid_cli_sso_login_id("cli-test\x001234567890") assert not _is_valid_cli_sso_login_id("sk-test1234567890") + def test_cli_sso_flow_lookup_tells_legacy_clients_to_upgrade(self): + """Legacy CLIs send self-generated sk- login ids; the 400 must say the CLI is outdated""" + from litellm.proxy.management_endpoints.ui_sso import ( + _get_cli_sso_flow_or_raise, + ) + + mock_cache = MagicMock() + mock_cache.get_cache.return_value = None + + with pytest.raises(HTTPException) as legacy_exc: + _get_cli_sso_flow_or_raise( + login_id="sk-85c789af-fc21-474c-9dc9-b5d794fe07ec", + cache=mock_cache, + ) + assert legacy_exc.value.status_code == 400 + assert "out of date" in legacy_exc.value.detail + assert "pip install" in legacy_exc.value.detail + mock_cache.get_cache.assert_not_called() + + with pytest.raises(HTTPException) as generic_exc: + _get_cli_sso_flow_or_raise(login_id="not-a-valid-id", cache=mock_cache) + assert generic_exc.value.status_code == 400 + assert generic_exc.value.detail == "Invalid CLI login session id" + + with pytest.raises(HTTPException) as expired_exc: + _get_cli_sso_flow_or_raise(login_id="cli-test_1234567890", cache=mock_cache) + assert expired_exc.value.status_code == 400 + assert "session not found or expired" in expired_exc.value.detail + assert "enable_redis_auth_cache" in expired_exc.value.detail + @pytest.mark.asyncio async def test_cli_sso_start_creates_bound_flow(self): """Test CLI SSO start creates a polling secret bound flow""" diff --git a/tests/test_litellm/proxy/middleware/test_billable_request_metrics_middleware.py b/tests/test_litellm/proxy/middleware/test_billable_request_metrics_middleware.py new file mode 100644 index 00000000000..9363c50407d --- /dev/null +++ b/tests/test_litellm/proxy/middleware/test_billable_request_metrics_middleware.py @@ -0,0 +1,458 @@ +""" +Tests for BillableRequestMetricsMiddleware and route classification. + +These verify the metering gate (records only on 2xx to a billable endpoint), +correct category/route classification, model-id extraction, and that the +middleware is a transparent pass-through when no recorder is injected. +""" + +import asyncio +import threading +from typing import List, Optional, Tuple + +import pytest +from starlette.applications import Starlette +from starlette.middleware.base import BaseHTTPMiddleware +from starlette.requests import Request +from starlette.responses import JSONResponse, Response +from starlette.routing import Route +from starlette.testclient import TestClient + +from litellm.proxy.middleware.billable_request_metrics_middleware import ( + BillableCategory, + BillableRequestMetricsMiddleware, + _extract_model_id, + classify_billable_request, +) +from litellm.proxy.middleware.in_flight_requests_middleware import ( + InFlightRequestsMiddleware, +) + + +class FakeRecorder: + def __init__(self) -> None: + self.calls: List[dict] = [] + + def record(self, *, category: BillableCategory, route: str, status_code: int, model_id: Optional[str]) -> None: + self.calls.append( + {"category": category, "route": route, "status_code": status_code, "model_id": model_id} + ) + + +def _make_app(recorder: Optional[FakeRecorder], status_code: int = 200, model_id: Optional[str] = None) -> Starlette: + async def handler(request: Request) -> Response: + headers = {"x-litellm-model-id": model_id} if model_id else {} + return JSONResponse({}, status_code=status_code, headers=headers) + + paths = [ + "/v1/chat/completions", + "/chat/completions", + "/v1/embeddings", + "/v1/completions", + "/mcp", + "/github/mcp", + "/toolset/my-tools/mcp", + "/v1/mcp/tools", + "/v1/mcp/server", + "/a2a/agent-1/message/send", + "/v1/a2a/discover", + "/health", + "/ui", + ] + app = Starlette(routes=[Route(p, handler, methods=["GET", "POST"]) for p in paths]) + app.add_middleware(BillableRequestMetricsMiddleware, recorder=recorder) + return app + + +# ── Structure ─────────────────────────────────────────────────────────────── + + +def test_is_pure_asgi_not_base_http_middleware(): + assert not issubclass(BillableRequestMetricsMiddleware, BaseHTTPMiddleware) + + +# ── classify_billable_request ───────────────────────────────────────────────── + + +@pytest.mark.parametrize( + "path,expected", + [ + ("/v1/chat/completions", (BillableCategory.LLM, "/chat/completions")), + ("/chat/completions", (BillableCategory.LLM, "/chat/completions")), + ("/openai/deployments/gpt-4o/chat/completions", (BillableCategory.LLM, "/chat/completions")), + ("/engines/gpt-4o/chat/completions", (BillableCategory.LLM, "/chat/completions")), + ("/v1/completions", (BillableCategory.LLM, "/completions")), + ("/completions", (BillableCategory.LLM, "/completions")), + ("/v1/embeddings", (BillableCategory.LLM, "/embeddings")), + ("/v1/responses", (BillableCategory.LLM, "/responses")), + ("/v1/rerank", (BillableCategory.LLM, "/rerank")), + ("/v1/audio/transcriptions", (BillableCategory.LLM, "/audio/transcriptions")), + # Routes from the metering-bypass finding: authenticated inference + # endpoints that must bill and previously classified as None. + ("/v1/images/edits", (BillableCategory.LLM, "/images/edits")), + ("/images/edits", (BillableCategory.LLM, "/images/edits")), + ("/openai/deployments/dall-e/images/edits", (BillableCategory.LLM, "/images/edits")), + ("/v1/images/variations", (BillableCategory.LLM, "/images/variations")), + ("/v1/messages", (BillableCategory.LLM, "/v1/messages")), + ("/interactions", (BillableCategory.LLM, "/interactions")), + ("/v1beta/interactions", (BillableCategory.LLM, "/v1beta/interactions")), + ("/v1/videos", (BillableCategory.LLM, "/videos")), + ("/v1/videos/video_123/remix", (BillableCategory.LLM, "/remix")), + ("/v1/ocr", (BillableCategory.LLM, "/ocr")), + ("/v1beta/models/gemini-2.5-pro:generateContent", (BillableCategory.LLM, ":generateContent")), + ("/v1beta/models/gemini-2.5-pro:streamGenerateContent", (BillableCategory.LLM, ":streamGenerateContent")), + # SpendLogs-producing routes surfaced by the route-inventory audit + ("/v1/search", (BillableCategory.LLM, "/search")), + ("/v1/vector_stores/vs_1/search", (BillableCategory.LLM, "/search")), + ("/v1/rag/query", (BillableCategory.LLM, "/rag/query")), + ("/rag/ingest", (BillableCategory.LLM, "/rag/ingest")), + # Provider passthrough carries real inference and writes SpendLogs + ("/bedrock/model/anthropic.claude-v2/invoke", (BillableCategory.LLM, "/bedrock")), + ("/vertex-ai/publishers/google/models/gemini:predict", (BillableCategory.LLM, "/vertex-ai")), + ("/cohere/v2/chat", (BillableCategory.LLM, "/cohere")), + # Passthrough inference bills under its provider prefix + ("/anthropic/v1/messages", (BillableCategory.LLM, "/anthropic")), + ("/mcp", (BillableCategory.MCP, "/mcp")), + ("/mcp/", (BillableCategory.MCP, "/mcp")), + ("/mcp/tools/list", (BillableCategory.MCP, "/mcp")), + ("/github/mcp", (BillableCategory.MCP, "/mcp")), + ("/github/mcp/", (BillableCategory.MCP, "/mcp")), + ("/toolset/my-tools/mcp", (BillableCategory.MCP, "/mcp")), + ("/github,slack/mcp", (BillableCategory.MCP, "/mcp")), + # REST wrapper tool execution fires the same MCP spend logging as /mcp + ("/mcp-rest/tools/call", (BillableCategory.MCP, "/mcp")), + ("/a2a/agent-1/message/send", (BillableCategory.A2A, "/a2a")), + ("/v1/a2a/agent-9/message/send", (BillableCategory.A2A, "/a2a")), + ], +) +def test_classify_billable(path: str, expected: Tuple[BillableCategory, str]): + assert classify_billable_request(path) == expected + + +@pytest.mark.parametrize( + "path", + [ + "/health", + "/health/readiness", + "/metrics", + "/ui", + "/", + "/v1/models", + "/key/generate", + "/v1/files", + # tokenization helper, not an inference call + "/v1/messages/count_tokens", + # OpenAI Assistants thread messages write no SpendLogs row + "/v1/threads/thread_abc123/messages", + "/threads/thread_abc123/messages", + # Google Interactions reads and cancel are not inference calls + "/interactions/int_123", + "/v1beta/interactions/int_123", + "/interactions/int_123/cancel", + "/v1beta/interactions/int_123/cancel", + # observability passthrough writes no SpendLogs row + "/langfuse/api/public/ingestion", + # a bare provider prefix is not an inference call + "/bedrock", + "/v1/mcp", + "/v1/mcp/tools", + "/v1/mcp/server", + "/v1/mcp/server/health", + "/v1/mcp/server/some-id", + "/v1/mcp/server/register", + "/v1/mcp/oauth/some-id/authorize", + "/a2a/agent-1/.well-known/agent-card.json", + "/v1/a2a/discover", + "/.well-known/oauth-protected-resource/github/mcp", + "/mcp-rest/tools/list", + "/mcp-rest/test/connection", + "/mcp-rest/test/tools/list", + ], +) +def test_classify_non_billable_returns_none(path: str): + assert classify_billable_request(path) is None + + +@pytest.mark.parametrize( + "path", + [ + "/v1/mcp/tools", + "/v1/mcp/server", + "/v1/mcp/server/register", + "/v1/a2a/discover", + ], +) +def test_classify_management_writes_are_not_billable(path: str): + assert classify_billable_request(path, "POST") is None + + +@pytest.mark.parametrize( + "path", + [ + "/a2a/agent-1", + "/a2a/agent-1/", + "/v1/a2a/agent-1", + ], +) +def test_classify_bare_a2a_route_is_not_billable(path: str): + """ + The bare A2A route multiplexes JSON-RPC methods off the request body. Only + message/send and message/stream write a SpendLogs row; tasks/get, + tasks/cancel and the pushNotificationConfig RPCs are forwarded upstream and + write none. Billing the path would count those task RPCs and push the metric + above the dashboard's successful-request count, so it must stay unbilled. + """ + assert classify_billable_request(path, "POST") is None + + +@pytest.mark.parametrize( + "path", + ["/v1/videos", "/v1/responses", "/v1/chat/completions", "/v1/messages"], +) +def test_classify_get_reads_are_not_billable(path: str): + """GETs on inference resources (list videos, fetch a response) write no + SpendLogs row and must not bill; only POST inference calls count.""" + assert classify_billable_request(path, "GET") is None + + +def test_classify_mcp_not_method_gated(): + assert classify_billable_request("/mcp/tools/list", "GET") == (BillableCategory.MCP, "/mcp") + + +def test_chat_completions_not_misclassified_as_plain_completions(): + """The /chat/completions suffix must win over /completions so the route label is correct.""" + category, route = classify_billable_request("/v1/chat/completions") + assert route == "/chat/completions" + + +# ── _extract_model_id ───────────────────────────────────────────────────────── + + +def test_extract_model_id_present(): + headers = [(b"content-type", b"application/json"), (b"x-litellm-model-id", b"deploy-123")] + assert _extract_model_id(headers) == "deploy-123" + + +def test_extract_model_id_case_insensitive(): + assert _extract_model_id([(b"X-LiteLLM-Model-Id", b"deploy-9")]) == "deploy-9" + + +def test_extract_model_id_absent(): + assert _extract_model_id([(b"content-type", b"application/json")]) is None + + +# ── Middleware recording behaviour ──────────────────────────────────────────── + + +def test_records_once_on_2xx_llm_with_model_id(): + recorder = FakeRecorder() + TestClient(_make_app(recorder, status_code=200, model_id="deploy-7")).post("/v1/chat/completions") + assert recorder.calls == [ + {"category": BillableCategory.LLM, "route": "/chat/completions", "status_code": 200, "model_id": "deploy-7"} + ] + + +def test_records_mcp_category(): + recorder = FakeRecorder() + TestClient(_make_app(recorder)).post("/github/mcp") + assert len(recorder.calls) == 1 and recorder.calls[0]["category"] == BillableCategory.MCP + + +def test_records_a2a_category(): + recorder = FakeRecorder() + TestClient(_make_app(recorder)).post("/a2a/agent-1/message/send") + assert len(recorder.calls) == 1 and recorder.calls[0]["category"] == BillableCategory.A2A + + +def test_does_not_record_mcp_management_read(): + recorder = FakeRecorder() + TestClient(_make_app(recorder)).get("/v1/mcp/tools") + assert recorder.calls == [] + + +def test_does_not_record_mcp_management_write(): + recorder = FakeRecorder() + TestClient(_make_app(recorder)).post("/v1/mcp/server") + assert recorder.calls == [] + + +def test_does_not_record_a2a_discovery(): + recorder = FakeRecorder() + TestClient(_make_app(recorder)).post("/v1/a2a/discover") + assert recorder.calls == [] + + +def test_does_not_record_on_4xx(): + recorder = FakeRecorder() + TestClient(_make_app(recorder, status_code=404)).post("/v1/chat/completions") + assert recorder.calls == [] + + +def test_does_not_record_on_5xx(): + recorder = FakeRecorder() + TestClient(_make_app(recorder, status_code=503)).post("/v1/chat/completions") + assert recorder.calls == [] + + +def test_does_not_record_non_billable_path(): + recorder = FakeRecorder() + TestClient(_make_app(recorder, status_code=200)).get("/health") + assert recorder.calls == [] + + +def test_no_model_id_when_header_absent(): + recorder = FakeRecorder() + TestClient(_make_app(recorder, status_code=200, model_id=None)).post("/github/mcp") + assert recorder.calls[0]["model_id"] is None + + +def test_passthrough_when_recorder_is_none(): + """Non-enterprise: middleware records nothing and does not break the response.""" + response = TestClient(_make_app(None, status_code=200)).post("/v1/chat/completions") + assert response.status_code == 200 + + +def test_record_raising_does_not_fail_the_request(): + """A broken exporter must never surface to the client: the response was + already served when record() runs, so exceptions are swallowed and logged.""" + + class ExplodingRecorder: + def record(self, *, category, route, status_code, model_id): + raise RuntimeError("exporter down") + + app = _make_app(None, status_code=200) + app.user_middleware.clear() + app.add_middleware(BillableRequestMetricsMiddleware, recorder=ExplodingRecorder()) + response = TestClient(app).post("/v1/chat/completions") + assert response.status_code == 200 + + +def test_non_http_scope_is_ignored(): + recorder = FakeRecorder() + + class _Inner: + async def __call__(self, scope, receive, send): + return None + + mw = BillableRequestMetricsMiddleware(_Inner(), recorder=recorder) + asyncio.run(mw({"type": "lifespan"}, None, None)) # type: ignore[arg-type] + assert recorder.calls == [] + + +# ── lazy recorder factory ───────────────────────────────────────────────────── + + +def test_recorder_factory_not_called_at_init(): + """The factory must run on the first request, not at middleware construction: + building at import time captured recorder=None before the YAML config's + environment_variables loaded the license and cert env vars.""" + calls = [] + + def factory(): + calls.append(1) + return FakeRecorder() + + class _Inner: + async def __call__(self, scope, receive, send): + return None + + BillableRequestMetricsMiddleware(_Inner(), recorder_factory=factory) + assert calls == [] + + +def test_recorder_factory_resolved_once_on_first_request(): + recorder = FakeRecorder() + calls = [] + + def factory(): + calls.append(1) + return recorder + + client = TestClient(_make_app_with_factory(factory, status_code=200)) + client.post("/v1/chat/completions") + client.post("/v1/chat/completions") + assert calls == [1] + assert len(recorder.calls) == 2 + + +def test_recorder_factory_returning_none_is_cached(): + calls = [] + + def factory(): + calls.append(1) + return None + + client = TestClient(_make_app_with_factory(factory, status_code=200)) + assert client.post("/v1/chat/completions").status_code == 200 + assert client.post("/v1/chat/completions").status_code == 200 + assert calls == [1] + + +def test_recorder_factory_resolved_once_under_concurrency(): + """Concurrent first requests must not each build a recorder: every extra + build leaks a MeterProvider and its background exporter thread.""" + calls = [] + release = threading.Event() + + def slow_factory(): + calls.append(1) + release.wait(timeout=2) + return FakeRecorder() + + class _Inner: + async def __call__(self, scope, receive, send): + return None + + mw = BillableRequestMetricsMiddleware(_Inner(), recorder_factory=slow_factory) + threads = [threading.Thread(target=mw._resolve_recorder) for _ in range(8)] + for t in threads: + t.start() + release.set() + for t in threads: + t.join(timeout=5) + assert calls == [1] + + +def _make_app_with_factory(factory, status_code: int) -> Starlette: + async def handler(request: Request) -> Response: + return JSONResponse({}, status_code=status_code) + + app = Starlette(routes=[Route("/v1/chat/completions", handler, methods=["POST"])]) + app.add_middleware(BillableRequestMetricsMiddleware, recorder_factory=factory) + return app + + +# ── Shutdown ordering ─────────────────────────────────────────────────────── + + +def test_record_runs_before_request_leaves_the_in_flight_tracker(): + """ + The count is recorded after the inner app returns. If this middleware sat + outside InFlightRequestsMiddleware, a request could be seen as drained while + its record() had not run, letting proxy_shutdown_event flush and stop the + exporter underneath it. Nested inside, the in-flight count still covers it. + """ + observed: List[int] = [] + + class _CountingRecorder: + def record(self, *, category: BillableCategory, route: str, status_code: int, model_id: Optional[str]) -> None: + observed.append(InFlightRequestsMiddleware.get_count()) + + async def inner(scope, receive, send) -> None: + await send({"type": "http.response.start", "status": 200, "headers": []}) + await send({"type": "http.response.body", "body": b"{}"}) + + stack = InFlightRequestsMiddleware(BillableRequestMetricsMiddleware(inner, recorder=_CountingRecorder())) + assert TestClient(stack).post("/v1/chat/completions").status_code == 200 + + assert observed == [1] + assert InFlightRequestsMiddleware.get_count() == 0 + + +def test_billable_middleware_is_registered_inside_the_in_flight_tracker(): + """Starlette makes the last-added middleware outermost, so the in-flight + tracker must be registered after the billing middleware to wrap it.""" + from litellm.proxy.proxy_server import app as proxy_app + + classes = [middleware.cls for middleware in proxy_app.user_middleware] + assert classes.index(InFlightRequestsMiddleware) < classes.index(BillableRequestMetricsMiddleware) diff --git a/tests/test_litellm/proxy/test_route_llm_request.py b/tests/test_litellm/proxy/test_route_llm_request.py index 74a0efba43d..303871e3981 100644 --- a/tests/test_litellm/proxy/test_route_llm_request.py +++ b/tests/test_litellm/proxy/test_route_llm_request.py @@ -8,7 +8,7 @@ sys.path.insert(0, os.path.abspath("../../..")) # Adds the parent directory to from unittest.mock import MagicMock -from litellm.proxy.route_llm_request import route_request +from litellm.proxy.route_llm_request import ProxyModelNotFoundError, route_request @pytest.mark.parametrize( @@ -42,6 +42,200 @@ async def test_route_request_dynamic_credentials(route_type): getattr(llm_router, route_type).assert_called_once_with(**data) +@pytest.mark.asyncio +async def test_route_request_proxy_admin_can_call_all_team_scoped_deployments_without_team_id(): + import litellm + + from litellm.proxy._types import LitellmUserRoles, UserAPIKeyAuth + + router = litellm.Router( + model_list=[ + { + "model_name": "internal-team-azure-east", + "litellm_params": { + "model": "azure/gpt-4o", + "api_key": "fake", + "api_base": "https://east.example.openai.azure.com", + "api_version": "2024-02-15-preview", + "mock_response": "east", + }, + "model_info": { + "id": "team-azure-east", + "team_id": "team-a", + "team_public_model_name": "team-azure", + }, + }, + { + "model_name": "internal-team-azure-west", + "litellm_params": { + "model": "azure/gpt-4o", + "api_key": "fake", + "api_base": "https://west.example.openai.azure.com", + "api_version": "2024-02-15-preview", + "mock_response": "west", + }, + "model_info": { + "id": "team-azure-west", + "team_id": "team-a", + "team_public_model_name": "team-azure", + }, + }, + ] + ) + admin_auth = UserAPIKeyAuth(user_role=LitellmUserRoles.PROXY_ADMIN) + data = { + "model": "team-azure", + "messages": [{"role": "user", "content": "Hello"}], + "metadata": {"user_api_key_auth": admin_auth}, + } + + llm_call = await route_request( + data=data, + llm_router=router, + user_model=None, + route_type="acompletion", + user_api_key_dict=admin_auth, + ) + response = await llm_call + deployments = await router.async_get_healthy_deployments( + model="team-azure", + request_kwargs=data, + ) + + assert response.choices[0].message.content in {"east", "west"} + assert {deployment["model_info"]["id"] for deployment in deployments} == { + "team-azure-east", + "team-azure-west", + } + + non_admin_auth = UserAPIKeyAuth(user_role=LitellmUserRoles.INTERNAL_USER) + with pytest.raises(ProxyModelNotFoundError): + await route_request( + data={ + **data, + "metadata": {"user_api_key_auth": non_admin_auth}, + }, + llm_router=router, + user_model=None, + route_type="acompletion", + user_api_key_dict=non_admin_auth, + ) + + from litellm.types.router import Deployment + + router.add_deployment( + Deployment( + model_name="internal-team-only", + litellm_params={ + "model": "azure/gpt-4o", + "api_key": "fake", + "api_base": "https://internal.example.openai.azure.com", + "api_version": "2024-02-15-preview", + }, + model_info={ + "id": "internal-team-only-id", + "team_id": "team-a", + }, + ) + ) + internal_deployments = await router.async_get_healthy_deployments( + model="internal-team-only", + request_kwargs={ + **data, + "model": "internal-team-only", + }, + ) + + assert {deployment["model_info"]["id"] for deployment in internal_deployments} == {"internal-team-only-id"} + + router.add_deployment( + Deployment( + model_name="internal-other-team-azure", + litellm_params={ + "model": "azure/gpt-4o", + "api_key": "fake", + "api_base": "https://other.example.openai.azure.com", + "api_version": "2024-02-15-preview", + "mock_response": "other", + }, + model_info={ + "id": "other-team-azure", + "team_id": "team-b", + "team_public_model_name": "team-azure", + }, + ) + ) + + with pytest.raises(litellm.BadRequestError, match="multiple teams"): + ambiguous_call = await route_request( + data=data, + llm_router=router, + user_model=None, + route_type="acompletion", + user_api_key_dict=admin_auth, + ) + await ambiguous_call + + router.add_deployment( + Deployment( + model_name="team-azure", + litellm_params={ + "model": "azure/gpt-4o", + "api_key": "fake", + "api_base": "https://legacy.example.openai.azure.com", + "api_version": "2024-02-15-preview", + }, + model_info={ + "id": "legacy-team-azure", + "team_id": "team-a", + "team_public_model_name": "team-azure", + }, + ) + ) + router.add_deployment( + Deployment( + model_name="team-azure", + litellm_params={ + "model": "azure/gpt-4o", + "api_key": "fake", + "api_base": "https://other-legacy.example.openai.azure.com", + "api_version": "2024-02-15-preview", + }, + model_info={ + "id": "other-legacy-team-azure", + "team_id": "team-b", + "team_public_model_name": "team-azure", + }, + ) + ) + + with pytest.raises(litellm.BadRequestError, match="multiple teams"): + await router.async_get_healthy_deployments( + model="team-azure", + request_kwargs=data, + ) + + router.add_deployment( + Deployment( + model_name="team-azure", + litellm_params={ + "model": "azure/gpt-4o", + "api_key": "fake", + "api_base": "https://global.example.openai.azure.com", + "api_version": "2024-02-15-preview", + }, + model_info={"id": "global-team-azure"}, + ) + ) + + collision_deployments = await router.async_get_healthy_deployments( + model="team-azure", + request_kwargs=data, + ) + + assert {deployment["model_info"]["id"] for deployment in collision_deployments} == {"global-team-azure"} + + @pytest.mark.asyncio async def test_route_request_no_model_required(): """Test route types that don't require model parameter""" diff --git a/tests/test_litellm/proxy/utils/proxy_logging/test_callback_capabilities_class.py b/tests/test_litellm/proxy/utils/proxy_logging/test_callback_capabilities_class.py index 45b81acbce1..9452e8042bd 100644 --- a/tests/test_litellm/proxy/utils/proxy_logging/test_callback_capabilities_class.py +++ b/tests/test_litellm/proxy/utils/proxy_logging/test_callback_capabilities_class.py @@ -330,6 +330,13 @@ def test_get_combined_callback_list_matrix(proxy_logging): } +def test_get_combined_callback_list_preserves_insertion_order(proxy_logging): + assert proxy_logging.get_combined_callback_list( + dynamic_success_callbacks=["prometheus", "langfuse", "datadog", "otel", "s3"], + global_callbacks=["langfuse", "gcs_bucket", "arize", "logfire"], + ) == ["prometheus", "langfuse", "datadog", "otel", "s3", "gcs_bucket", "arize", "logfire"] + + def test_get_combined_callback_list_unhashable_dynamic_raises(proxy_logging): with pytest.raises(TypeError): proxy_logging.get_combined_callback_list( diff --git a/tests/test_litellm/test_router/test_io_token_rate_limits.py b/tests/test_litellm/test_router/test_io_token_rate_limits.py index 939e3189596..a5a68271111 100644 --- a/tests/test_litellm/test_router/test_io_token_rate_limits.py +++ b/tests/test_litellm/test_router/test_io_token_rate_limits.py @@ -977,3 +977,65 @@ class TestRouterIOTokenIntegration: assert info is not None assert info.itpm == 100 assert info.otpm == 20 + + +class TestContextSlotRetention: + def test_setter_stores_kwargs_only_for_io_limited_deployments(self): + """ + The context slot pins the entire request kwargs (messages included) + for the lifetime of the surrounding asyncio context, and pooled + resources created mid-request (e.g. redis connections) capture that + context, extending the pin far past the request. Only ITPM/OTPM + pre-call checks read the slot, so the setter must store None for + deployments without io token limits and still clear reservation + sentinels from kwargs either way. + """ + kwargs = { + "messages": [{"role": "user", "content": "x" * 1000}], + "metadata": {ITPM_RESERVED_KEY: 999, ITPM_CACHE_KEY: "forged"}, + } + set_io_token_rate_limit_request_kwargs(kwargs, store_in_context=False) + assert get_io_token_rate_limit_request_kwargs() is None + assert ITPM_RESERVED_KEY not in kwargs["metadata"] + assert ITPM_CACHE_KEY not in kwargs["metadata"] + + set_io_token_rate_limit_request_kwargs(kwargs, store_in_context=True) + assert get_io_token_rate_limit_request_kwargs() is kwargs + + set_io_token_rate_limit_request_kwargs(kwargs, store_in_context=False) + assert get_io_token_rate_limit_request_kwargs() is None + + @pytest.mark.asyncio + async def test_router_does_not_pin_kwargs_without_io_limits(self): + router = Router( + model_list=[ + { + "model_name": "plain", + "litellm_params": {"model": "openai/gpt-4o-mini", "api_key": "sk-test"}, + } + ] + ) + set_io_token_rate_limit_request_kwargs(None) + kwargs = {"messages": [{"role": "user", "content": "hello"}], "metadata": {}} + deployment = router.get_deployment_by_model_group_name("plain") + assert deployment is not None + router._update_kwargs_with_deployment(deployment=deployment.model_dump(), kwargs=kwargs) + assert get_io_token_rate_limit_request_kwargs() is None + + @pytest.mark.asyncio + async def test_router_pins_kwargs_for_io_limited_deployment(self): + router = Router( + model_list=[ + { + "model_name": "limited", + "litellm_params": {"model": "openai/gpt-4o-mini", "api_key": "sk-test", "itpm": 100}, + } + ], + optional_pre_call_checks=["enforce_model_rate_limits"], + ) + set_io_token_rate_limit_request_kwargs(None) + kwargs = {"messages": [{"role": "user", "content": "hello"}], "metadata": {}} + deployment = router.get_deployment_by_model_group_name("limited") + assert deployment is not None + router._update_kwargs_with_deployment(deployment=deployment.model_dump(), kwargs=kwargs) + assert get_io_token_rate_limit_request_kwargs() is kwargs diff --git a/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/GuardrailTestPanel.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/GuardrailTestPanel.test.tsx index 94ed707f31d..d6f5f22616b 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/GuardrailTestPanel.test.tsx +++ b/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/GuardrailTestPanel.test.tsx @@ -53,7 +53,72 @@ describe("GuardrailTestPanel", () => { // Verify onSubmit was called with the correct text await waitFor(() => { - expect(mockOnSubmit).toHaveBeenCalledWith("Test input text"); + expect(mockOnSubmit).toHaveBeenCalledWith("Test input text", null); }); }); + + it("should submit parsed metadata when a JSON object is provided", async () => { + /** + * Tests that a JSON object typed into the Metadata field is parsed and + * passed to onSubmit so it reaches the apply_guardrail request body. + */ + const user = userEvent.setup(); + + render( + , + ); + + const textarea = screen.getByPlaceholderText("Enter text to test with guardrails..."); + await user.type(textarea, "Test input text"); + + const metadataField = screen.getByPlaceholderText('{"forbidden_topics": ["tax", "finance"]}'); + await user.click(metadataField); + await user.paste('{"forbidden_topics": ["tax"]}'); + + await user.click(screen.getByRole("button", { name: /Test 2 guardrails/ })); + + await waitFor(() => { + expect(mockOnSubmit).toHaveBeenCalledWith("Test input text", { forbidden_topics: ["tax"] }); + }); + }); + + it("should block submission and show an error for invalid metadata JSON", async () => { + /** + * Tests that invalid JSON in the Metadata field prevents submission + * instead of silently sending a request without metadata. + */ + const user = userEvent.setup(); + + render( + , + ); + + const textarea = screen.getByPlaceholderText("Enter text to test with guardrails..."); + await user.type(textarea, "Test input text"); + + const metadataField = screen.getByPlaceholderText('{"forbidden_topics": ["tax", "finance"]}'); + await user.click(metadataField); + await user.paste("{not json"); + + await user.click(screen.getByRole("button", { name: /Test 2 guardrails/ })); + + await waitFor(() => { + expect(screen.getByText("Invalid JSON")).toBeInTheDocument(); + }); + expect(mockOnSubmit).not.toHaveBeenCalled(); + }); }); diff --git a/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/GuardrailTestPanel.tsx b/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/GuardrailTestPanel.tsx index a65b980d8b8..e310da55063 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/GuardrailTestPanel.tsx +++ b/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/GuardrailTestPanel.tsx @@ -10,7 +10,7 @@ const { Text } = Typography; interface GuardrailTestPanelProps { guardrailNames: string[]; - onSubmit: (text: string) => void; + onSubmit: (text: string, metadata?: Record | null) => void; isLoading: boolean; results: Array<{ guardrailName: string; response_text: string; latency: number }> | null; errors: Array<{ guardrailName: string; error: Error; latency: number }> | null; @@ -26,6 +26,23 @@ export function GuardrailTestPanel({ onClose, }: GuardrailTestPanelProps) { const [inputText, setInputText] = useState(""); + const [metadataText, setMetadataText] = useState(""); + const [metadataError, setMetadataError] = useState(null); + + const parseMetadata = (raw: string): { metadata: Record | null; error: string | null } => { + if (!raw.trim()) { + return { metadata: null, error: null }; + } + try { + const parsed = JSON.parse(raw); + if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) { + return { metadata: null, error: "Metadata must be a JSON object" }; + } + return { metadata: parsed, error: null }; + } catch { + return { metadata: null, error: "Invalid JSON" }; + } + }; const handleSubmit = () => { if (!inputText.trim()) { @@ -33,7 +50,15 @@ export function GuardrailTestPanel({ return; } - onSubmit(inputText); + const { metadata, error } = parseMetadata(metadataText); + if (error) { + setMetadataError(error); + NotificationsManager.fromBackend(`Metadata: ${error}`); + return; + } + setMetadataError(null); + + onSubmit(inputText, metadata); }; const handleKeyDown = (e: React.KeyboardEvent) => { @@ -142,6 +167,33 @@ export function GuardrailTestPanel({ +
+
+ + + + +
+