diff --git a/litellm/proxy/auth/v2/authenticators.py b/litellm/proxy/auth/v2/authenticators.py index 6250882f208..2e305555852 100644 --- a/litellm/proxy/auth/v2/authenticators.py +++ b/litellm/proxy/auth/v2/authenticators.py @@ -6,11 +6,9 @@ from fastapi import HTTPException, status @runtime_checkable class Authenticator(Protocol): - def can_handle(self, api_key: Optional[str]) -> bool: - ... + def can_handle(self, api_key: Optional[str]) -> bool: ... - async def authenticate(self, api_key: str, ctx: "AuthContext") -> Any: - ... + async def authenticate(self, api_key: str, ctx: "AuthContext") -> Any: ... class AuthContext: @@ -122,9 +120,7 @@ class JWTAuthenticator: settings = _load_jwt_settings() key_set = await JWKSProvider(settings.jwks_uri).get_key_set() try: - claims = verify( - api_key, key_set, settings.issuer, settings.audience - ) + claims = verify(api_key, key_set, settings.issuer, settings.audience) except JWTVerificationError as e: raise HTTPException( status_code=status.HTTP_401_UNAUTHORIZED, @@ -218,9 +214,7 @@ class OAuth2IntrospectionAuthenticator: import httpx auth = ( - (settings.client_id, settings.client_secret) - if settings.client_id - else None + (settings.client_id, settings.client_secret) if settings.client_id else None ) async with httpx.AsyncClient() as client: response = await client.post( diff --git a/litellm/proxy/auth/v2/entry.py b/litellm/proxy/auth/v2/entry.py index 9764f3f8c03..e440ecf6e02 100644 --- a/litellm/proxy/auth/v2/entry.py +++ b/litellm/proxy/auth/v2/entry.py @@ -74,9 +74,7 @@ async def user_api_key_auth_v2( try: authorize(principal, route, request_data, enforcer) except AuthorizationDenied as e: - raise HTTPException( - status_code=status.HTTP_403_FORBIDDEN, detail=str(e) - ) + raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=str(e)) identity.request_route = route return identity diff --git a/litellm/proxy/auth/v2/jwt_claims.py b/litellm/proxy/auth/v2/jwt_claims.py index f612eb6af53..af262a8c8de 100644 --- a/litellm/proxy/auth/v2/jwt_claims.py +++ b/litellm/proxy/auth/v2/jwt_claims.py @@ -34,9 +34,7 @@ def extract_identity(claims: Dict[str, Any], settings: JWTSettings) -> JWTIdenti """ user_id = claims.get(settings.user_id_claim) if not user_id: - raise JWTClaimError( - f"token missing user id claim '{settings.user_id_claim}'" - ) + raise JWTClaimError(f"token missing user id claim '{settings.user_id_claim}'") team_id = claims.get(settings.team_claim) if settings.team_claim else None diff --git a/litellm/proxy/auth/v2/jwt_verifier.py b/litellm/proxy/auth/v2/jwt_verifier.py index c5cbb73bae4..32f3f0fc840 100644 --- a/litellm/proxy/auth/v2/jwt_verifier.py +++ b/litellm/proxy/auth/v2/jwt_verifier.py @@ -9,7 +9,9 @@ class JWTVerificationError(Exception): """Raised when a token fails signature or standard-claim validation.""" -def build_claims_options(issuer: Optional[str], audience: Optional[str]) -> Dict[str, Any]: +def build_claims_options( + issuer: Optional[str], audience: Optional[str] +) -> Dict[str, Any]: options: Dict[str, Any] = {"exp": {"essential": True}} if issuer: options["iss"] = {"essential": True, "value": issuer} diff --git a/tests/test_litellm/proxy/auth/v2/test_jwt_claims.py b/tests/test_litellm/proxy/auth/v2/test_jwt_claims.py index 5223f04cb51..8c5a8085b85 100644 --- a/tests/test_litellm/proxy/auth/v2/test_jwt_claims.py +++ b/tests/test_litellm/proxy/auth/v2/test_jwt_claims.py @@ -35,8 +35,13 @@ def test_team_and_role_are_mapped(): def test_unmapped_role_value_yields_no_role(): # An arbitrary IdP role string must not be trusted as a litellm role. - settings = JWTSettings(jwks_uri="x", role_claim="role", role_map={"a": "proxy_admin"}) - assert extract_identity({"sub": "u1", "role": "totally-unknown"}, settings).role is None + settings = JWTSettings( + jwks_uri="x", role_claim="role", role_map={"a": "proxy_admin"} + ) + assert ( + extract_identity({"sub": "u1", "role": "totally-unknown"}, settings).role + is None + ) def test_missing_user_id_raises():