From f48dfdbdd9a729d199778359856b2460e215a397 Mon Sep 17 00:00:00 2001 From: user <70670632+stuxf@users.noreply.github.com> Date: Thu, 30 Apr 2026 11:17:04 -0700 Subject: [PATCH] fix(proxy): require opt in for audit header fallback --- litellm/proxy/management_helpers/audit_logs.py | 2 +- .../proxy_unit_tests/test_audit_logs_proxy.py | 18 +++++++++++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/litellm/proxy/management_helpers/audit_logs.py b/litellm/proxy/management_helpers/audit_logs.py index 0d8c343fda4..d3b225e6e4d 100644 --- a/litellm/proxy/management_helpers/audit_logs.py +++ b/litellm/proxy/management_helpers/audit_logs.py @@ -42,7 +42,7 @@ def get_audit_log_changed_by( ) -> Optional[str]: if litellm_changed_by and _allows_litellm_changed_by_header(user_api_key_dict): return litellm_changed_by - return user_api_key_dict.user_id or litellm_changed_by or litellm_proxy_admin_name + return user_api_key_dict.user_id or litellm_proxy_admin_name def _resolve_audit_log_callback(name: str) -> Optional[CustomLogger]: diff --git a/tests/proxy_unit_tests/test_audit_logs_proxy.py b/tests/proxy_unit_tests/test_audit_logs_proxy.py index 248f27ee555..9e2b69176ec 100644 --- a/tests/proxy_unit_tests/test_audit_logs_proxy.py +++ b/tests/proxy_unit_tests/test_audit_logs_proxy.py @@ -107,9 +107,25 @@ def test_get_audit_log_changed_by_honors_header_with_team_opt_in(): ) -def test_get_audit_log_changed_by_falls_back_to_header_when_user_id_missing(): +def test_get_audit_log_changed_by_ignores_header_without_opt_in_when_user_id_missing(): user_api_key_dict = UserAPIKeyAuth(api_key="test-key") + assert ( + get_audit_log_changed_by( + litellm_changed_by="spoofed-user", + user_api_key_dict=user_api_key_dict, + litellm_proxy_admin_name="proxy-admin", + ) + == "proxy-admin" + ) + + +def test_get_audit_log_changed_by_honors_header_with_opt_in_when_user_id_missing(): + user_api_key_dict = UserAPIKeyAuth( + api_key="test-key", + metadata={"allow_litellm_changed_by_header": True}, + ) + assert ( get_audit_log_changed_by( litellm_changed_by="delegated-user",