23 commits

Author	SHA1	Message	Date
yuneng-jiang	122675c309	feat(ui): let admins supply a dark-mode variant of their custom logo (#37662) ... * feat(ui): let admins supply a dark-mode variant of their custom logo A deployment branded through UI_LOGO_PATH got its light artwork on the dark sidebar, and there was nothing an admin could set to change that. Adds UI_LOGO_PATH_DARK, exposed as the logo_url_dark theme setting and a second field on the UI theme page. /get_image now walks an ordered list of candidates for the requested theme and serves the first usable one: the dark logo, then the light logo, then the bundled default. Falling through rather than failing is the point. An admin who never sets a dark logo keeps their own light one instead of reverting to LiteLLM's, and a dark logo that goes missing later degrades to their light logo rather than dropping their branding entirely. * fix(ui): recover from a dark logo the browser cannot load A dark logo given as an http(s) URL is loaded by the browser straight from the sidebar, so it never passes through the proxy's fallback chain. A URL that 404s left a broken image where the admin's light logo should have been, while the same logo given as a local path fell back cleanly. The sidebar now remembers the dark URL that failed and drops to the light logo, matching how the proxy resolves an unusable dark logo and how the provider Logo component already handles a broken image.	2026-08-20 12:48:55 -07:00
ryan-crabbe-berri	7b574b9df6	chore(ui): drop the antd dependency and its leftovers (#37574) ... Nothing in the dashboard renders antd any more, so the package and the scaffolding around it can go. This removes `antd` and `@ant-design/cssinjs` from package.json, deletes the global StyleProvider the root layout wrapped every page in, drops the `antd` cascade layer and the z-index override that lifted Base UI popups over an antd Modal, and retires the lint rules that policed antd imports and antd class selectors in tests. Fifteen test files still carried `vi.mock("antd", ...)` factories for components that stopped importing antd during the migration. They were inert, and they resolve the real module, so they would have broken the moment the package left node_modules. The compatibility shims keep their behaviour and lose the antd name: `antdRules`/`antdRequired` become `validatorRules`/`requiredRule`, `isAntdUrl` becomes `isValidUrl`, and `ABOVE_ANTD_MODAL` becomes `NESTED_DIALOG_LAYER`. Comments that explain why a contract looks the way it does still name antd, because that history is the reason.	2026-08-19 20:44:27 -07:00
ryan-crabbe-berri	fc8a6b2a8d	refactor(ui): migrate shared primitives and common components off antd (#37521) ... * refactor(ui): migrate shared primitives and common components off antd Adds the success variant to the shared Alert plus success, warning and info variants to Badge, introduces UtcDateTimeInput to replace antd's DatePicker, and converts the common components and key/team helpers onto the shadcn primitives. * fix(ui): keep MultiSelect and budget input faithful to their antd behaviour Restore the clear-all control MultiSelect lost, split comma-separated custom entries into one value per token, and stop rounding the budget input on every keystroke so a fractional amount survives typing. * test(ui): drive the access group picker through the migrated MultiSelect AccessGroupSelector no longer renders an antd Select, so the placeholder is an input label rather than a text node and the popup inerts the page until it closes.	2026-08-20 00:25:09 +00:00
ryan-crabbe-berri	68d4ba5da5	refactor(ui): move dashboard toasts from antd message/notification onto sonner (#37207) ... * refactor(ui): move dashboard toasts from antd message/notification onto sonner Add lib/toast.ts as the single toast surface (success/info/warning/error/ fromError/dismiss) backed by sonner, with a <Toaster /> in the root layout. fromError titles a toast from the proxy error type or the HTTP status instead of matching prose phrases, and shows the extracted proxy message as the description. MessageManager and NotificationManager become thin facades over lib/toast so the ~250 existing call sites keep working; the mutable antd instance setters, setMessageInstance/setNotificationInstance, and the antd App/message/ notification providers in AntdGlobalProvider are gone. Prunes the eslint suppression baseline accordingly. * test(ui): mock the MessageManager seam in the Fallbacks tests and drop toast doc comments AddFallbacks and FallbackSelectionForm asserted on a mocked antd message spy that MessageManager no longer calls; they now mock the facade the components import. Also removes the explanatory comments Greptile flagged in lib/toast.ts and both facades. * fix(ui): keep NotificationManager's antd config-object contract on the sonner facade success/info/warning/error accept the { message, description, duration } object form again (CreateMCPServer's admin-review notice uses it) and fromBackend keeps its extra.duration seconds argument, both mapped onto lib/toast. Prunes stale suppressions picked up by the rebase. * feat(ui): read the proxy error type and code out of JSON envelopes embedded in string errors Legacy networking helpers throw new Error(responseText) and callers prefix that text, so the envelope arrives as a substring. fromError now parses the first embedded JSON object for type/code and shows the unwrapped message in its place, so those toasts get a status title (Request Error, Not Found) and a readable description instead of raw JSON.	2026-08-17 18:22:41 -07:00
Yuneng Jiang	6670061a33	test(ui): assert presence and state so dashboard tests fail when behaviour breaks ... One test could not fail: it asserted on the Promise returned by an unawaited findAllByText, and a pending Promise is always truthy, so the organization detail view had no working coverage at all. Rewrites 316 assertions across 128 files onto matchers that describe what the user perceives, and awaits the queries that were being compared as Promises. Most of this was mechanical, but the fixers behind these rules are not trustworthy, so every site they damaged was repaired by hand. The quiet one worth naming: prefer-to-have-text-content wraps strings in new RegExp() without escaping, turning toContain("100K+ requests") into a pattern meaning "100 followed by one-or-more K". That compiles, lints clean, and keeps passing while no longer asserting what it claims.	2026-08-17 14:46:55 -07:00
Yassin Kortam	e0f388cb5c	feat(ui): render request metrics on the /ui/chat surface (#36845) ... /ui/chat never rendered a metrics bar. The Responses helper already parses usage off the response.completed event, but the chat page passed positional undefined where onTimingData, onUsageData and onTotalLatency sit, ChatMessage had nowhere to hold them, and ChatMessages never rendered ResponseMetrics. Thread the three callbacks through, persist the values on the assistant message, and reuse the playground's ResponseMetrics to show latency, TTFT, input/output/total tokens and cost. Also map the cost the proxy reports on the streamed usage object, which only the chat-completions helper did before.	2026-08-13 17:31:13 -07:00
ryan-crabbe-berri	2792887e47	fix(proxy): give proxy_admin_viewer read parity with proxy_admin (#35851) ... * fix(proxy): give proxy_admin_viewer read parity with proxy_admin Route-level checks already default-allow management GETs for the viewer role, but ~15 handlers compared user_role to PROXY_ADMIN only, dropping viewers into regular-user scoping (/key/list, /user/info, /model/info, guardrails, prompts, agents, memory, workflows, MCP catalog, coordination redis settings, credential migration check, enterprise projects). Swap those read paths to user_api_key_has_admin_view; write gates unchanged. The dashboard now presents the viewer session as Admin for all gating (effectiveSessionRole) so every page fetches with admin visibility, with userRoleLabel/isViewOnly preserving the account-menu label and the playground cost guard. The server remains the write authority. * refactor(agents): remove side-effectful health_check param from GET /v1/agents Addresses a security review finding on the admin viewer read parity change: listing agents with health_check=true made the proxy issue a server-side GET to every agent URL, so a read-scoped caller could trigger request fan-out beyond their object permissions. The list endpoint is now a pure read for every role. Removes the query param, the URL probing helper and its timeouts, the AgentHealthCheck httpx provider tag, and the dashboard's Health Check toggle. Requests still passing health_check=true get the full list back with the param ignored. * fix(proxy): keep credential encryption check proxy_admin only The residual scan behind GET /credentials/migrate-encryption/check loads every model, credential, MCP, team, and verification-token row and runs a decryption attempt on each stored value. Extending it to proxy_admin_viewer let a read-only account repeatedly trigger deployment-wide scans, so the route keeps its original full-admin gate. * fix(agents): restore health_check, keep list fast path proxy_admin only Restores the agent health_check feature exactly as before this PR: the query param, the URL probing helper, the httpx provider tag, and the dashboard toggle all return, so existing callers keep the filtering contract. The viewer expansion is instead reverted at its source: the GET /v1/agents admin fast path stays PROXY_ADMIN only, so a proxy_admin_viewer goes through the object-permission scoped branch as before and cannot fan out health checks beyond their allowlist. The viewer read of a single agent stays viewer-inclusive since it has no side effects.	2026-08-05 18:33:55 +00:00
Yuneng Jiang	2b9b681e12	fix(ui/chat): resolve chat routes at render time so navigation works under server_root_path ... CHAT_ROUTES was built once at module load via migratedHref, capturing an empty server root path before the UI-config bootstrap sets it. Under SERVER_ROOT_PATH every chat route came out unprefixed, so router.push hard-navigated to a 404; during a send that page unload also aborted the streaming request, so the first message of a new conversation never rendered and only a second send appeared to work. Compute the routes at render time via getChatRoutes(), update the send URL with a shallow history.pushState instead of a router navigation, and source the active conversation id from the hook's local state so it propagates without a router round-trip	2026-07-15 13:48:27 -07:00
Krrish Dholakia	afa739b423	fix(ui): design polish and per-tab routing for chat UI ... Moves Chats/Integrations/Credentials/API Keys/Usage from client-side tab state to real nested routes (/chat, /chat/integrations, /chat/credentials, /chat/api-keys, /chat/usage) so each is bookmarkable and survives a hard reload. Extracts the chat sidebar into ChatShell and shared state (MCP server selection, conversation history) into ChatShellContext, both consumed via the new app/chat/layout.tsx. Along the way: fixes conversation URLs pointing at the wrong path (/ui/chat instead of /chat in dev, which 404'd after sending the first message) by reusing the existing migratedHref helper instead of a one-off uiConfig-based path; fixes the topnav view-switcher always showing "AI Gateway" as selected even while on the chat route; and cleans up several shadcn/tailwind styling bugs introduced by the antd migration (boxed tab outline instead of underline, model-selector dropdown overflowing its popover, sidebar nav labels centered instead of left-aligned, duplicate logo, dead non-interactive controls).	2026-07-03 15:35:52 -07:00
ryan-crabbe-berri	27069bd74f	feat(ui): shadcn migration foundation: Tailwind v4, shadcn init, antd cascade fix (#31995) ... * feat(ui): shadcn migration foundation: Tailwind v4, shadcn init, antd cascade fix Upgrade the dashboard from Tailwind v3 to v4 with CSS-first config: the official upgrade codemod renamed utilities across 151 files, and tailwind.config.js (plus the dead tailwind.config.ts) is replaced by @theme tokens, @source globs, and @plugin directives in globals.css. The Tremor safelist becomes @source inline patterns and the legacy tremor theme tokens carry over verbatim. ui_colors.json was build-time only and fed the dying Tremor palette, so its brand values are inlined and the file removed; runtime theming replaces that path next. shadcn is initialized with a hand-authored components.json (rsc, cssVariables, baseColor gray) pointing utils at the existing lib/cva.config.ts, which now exports cn (cva beta cx + twMerge) instead of adding class-variance-authority as a second variant library. The two ad-hoc cn helpers fold into it. Button lands as the canary primitive, adapted to cva beta and React 18 forwardRef, with tests covering the variant, twMerge, asChild, and ref seams. --radius is 0.5rem so the shadcn radius scale reproduces Tailwind defaults and legacy rounded-* classes render unchanged. antd v5 emits unlayered CSS-in-JS that would beat every layered v4 utility, so AntdGlobalProvider now wraps the app in StyleProvider layer and ConfigProvider cssVar, and globals.css declares @layer theme, base, antd, components, utilities. antd wins over preflight but yields to utilities, which is what lets migrated shadcn pages coexist with legacy antd pages. Preflight stays global with the three v3 behaviors pinned (default border color, button cursor, placeholder color). * fix(ui): restore tremor opacity tints removed by tailwind v4 Tailwind v4 removed the *-opacity-* utilities, but the precompiled @tremor/react dist still composes them with shade-500 palette classes (bg-opacity-10 over bg-<color>-500 etc.), so Badge, BadgeDelta, Callout, light Icon and Button, BarList, and ProgressBar lost their tints and rendered solid 500-shade fills. Adversarial review caught it; the original smoke pages only exercised antd Tags. tremor-v3-compat.css restores exactly the pairs tremor emits: for each of the 22 safelisted colors, bg-opacity-{10,20,40}, hover/group-hover bg-opacity-{20,30}, and ring-opacity-{20,40} against the -500 shade, via color-mix into the utilities layer. Tremor's colorPalette maps both background and iconRing to 500, so the -500 pairing covers every composition in the dist; dark: variants are inert until dark mode ships. The shim dies with @tremor/react at the end of the migration. The upgrade codemod also missed two hand-rolled modal scrims using bg-black bg-opacity-{30,50} (solid black under v4); now bg-black/30 and bg-black/50. Removed the docker/build_admin_ui.sh copy of enterprise_colors.json into the deleted ui_colors.json; that build-time rebrand path is retired and its runtime replacement lands with the theming phase. * fix(ui): pair ring-opacity-40 with shade 300 in tremor compat shim Tremor's colorPalette maps ring to shade 300, and the only consumer of ring-opacity-40 (Icon variant outlined) composes it with that shade, so the shade-500 rows were dead and outlined icon rings would render at full opacity. Latent today (no dashboard usage of the outlined variant); caught by adversarial review. ring-opacity-20 stays at 500 (iconRing), matching Badge and BadgeDelta.	2026-07-02 19:02:27 -07:00
Krrish Dholakia	accbd7e587	feat: litellm plugin architecture v2 (#30688) ... * feat: plugin architecture — toggle between AI Gateway and external plugins Adds a generic plugin system so any external service can register with litellm and appear as a mode in the UI alongside the AI Gateway. Backend (litellm/proxy/plugin_routes.py — new): - GET /api/plugins: returns registered plugins from config; returns plugin_key only to authenticated requests - ANY /plugin-proxy/{name}/{path}: reverse proxies API calls to plugin Config: general_settings: plugins: - name: my-plugin display_name: My Plugin url: https://my-plugin.example.com plugin_key: sk-... # plugin auth key, passed to iframe UI: - PluginModeContext.tsx: fetches /api/plugins, persists mode to localStorage - leftnav.tsx: mode switcher dropdown at top of sidebar; plugin mode shows plugin-specific nav items - layout.tsx: renders iframe to plugin URL in plugin mode; passes plugin_key as ?token= for auto sign-in Plugin contract: expose GET /api/plugin-manifest returning { name, display_name, nav_items[], capabilities[] }. No litellm changes needed to add new plugins — config only. Reference implementation: LiteLLM-Labs/litellm-agent-control-plane * feat: add Plugins tab to Admin Settings UI Allows admins to add/edit/delete plugin registrations directly in the litellm UI under Admin Settings > Plugins, instead of editing config.yaml. Uses existing /config/field/update API to persist to general_settings.plugins. Each plugin entry has: name (identifier), display_name, url, plugin_key. * fix(ci): black, prettier, eslint, async-client violations - Black: format plugin_routes.py and proxy_server.py - Prettier: format PluginModeContext.tsx and PluginSettings.tsx - ESLint: replace raw fetch() with createApiClient in PluginModeContext - ESLint: use lazy useState initializer to read localStorage instead of calling setModeState inside useEffect (react-hooks/set-state-in-effect) - code-quality: replace httpx.AsyncClient per-request with get_async_httpx_client() shared client (avoids +500ms overhead) * fix(ci): schema.d.ts regen, Black proxy_server.py, ApiClientConfig fix - Regenerate schema.d.ts for new /api/plugins routes - Re-run Black 26.3.1 on proxy_server.py (matches CI version) - Fix PluginModeContext: createApiClient requires getBaseUrl field * fix: security hardening + CI fixes Security (Greptile 1/5 → addressing all 3 findings): - plugin_routes.py: add Depends(user_api_key_auth) to both /api/plugins and /plugin-proxy/{name}/{path} — was an unauthenticated open relay - plugin_routes.py: /api/plugins now returns plugin_key only to callers with a valid litellm token (enforced by user_api_key_auth), not just any header presence - layout.tsx: replace ?token= URL param with postMessage(targetOrigin) — token no longer exposed in browser history / logs / Referer headers CI: - backend/routes/allowlist.py: add /api/plugins and /plugin-proxy/ to fix test_gateway_plus_backend_covers_full_app - schema.d.ts: regenerated with enterprise routes included - Black + Prettier formatting * fix: regenerate schema.d.ts with enterprise routes included Install litellm-enterprise workspace member before gen:api so audit and other enterprise routes appear in the generated types, matching what CI produces with uv sync --extra proxy. * fix: exclude plugin routes from OpenAPI schema, restore upstream schema.d.ts Both /api/plugins and /plugin-proxy/ are internal infrastructure routes, not part of the public litellm API surface. Marking include_in_schema=False prevents Python-version-dependent schema diffs from breaking the schema sync check across different environments. * fix: schema.d.ts - passing schema base + exact plugin route types from openapi-typescript Use the CI-correct schema from a recently passing branch as base, then inject plugin route entries (paths + operations) generated by openapi-typescript from the plugin routes' OpenAPI spec. This avoids Python-version-dependent formatting differences that made local gen:api produce incorrect output. * fix: schema.d.ts - insert plugin ops at correct route registration position Plugin operations belong after delete_memory_v1_memory__key__delete (memory_router is included immediately before plugin_router in proxy_server.py), not after list_organization which is alphabetically but not registration-order. * fix: schema.d.ts - correct op positions from hunk analysis list_plugins_api_plugins_get goes after event_logging_batch op (hunk 1: line 33583). plugin_proxy ops go after create_policy_policies_post (hunk 2: line 44634). Previous location after delete_memory_v1_memory__key__delete was wrong. * fix: schema.d.ts - proxy ops go before create_policy (after otel_spans) * fix(security): restrict plugin_key to proxy_admin role only Veria finding: plugin_key was returned to any authenticated caller. Now only proxy_admin users receive plugin credentials in /api/plugins response — regular internal users see plugin name/url but not the key. * fix: update schema.d.ts docstring for list_plugins * fix: clear plugin registry on config reload (Greptile medium) register_plugins_from_config now replaces the registry instead of merging, so plugins removed from config are unreachable immediately without requiring a process restart. * fix(security): encrypted token exchange for plugin iframe — no raw litellm credential exposure The dashboard was sending the user's litellm bearer token to the plugin iframe via postMessage, allowing a compromised plugin to act as that user. Fix: - GET /api/plugins/auth-token: proxy encrypts caller token with Fernet keyed from LITELLM_SALT_KEY, returns ciphertext only - UI postMessages the ciphertext (not raw token) to the iframe - Plugin decrypts server-side with same LITELLM_SALT_KEY via POST /api/plugin-auth - Raw litellm credential never leaves the proxy in plaintext Additional hardening already in place: - /plugin-proxy/* strips Authorization header, injects plugin_key instead - plugin_key only returned to proxy_admin role via /api/plugins - Plugin registry cleared (not merged) on config reload Adds docs/plugin_architecture.md with plugin integration guide. * fix(code-quality): use get_async_httpx_client in plugin_proxy * fix: add /api/plugins/auth-token to schema.d.ts * fix: use apiClient for auth-token fetch, copy correct layout.tsx and PluginModeContext - Replace raw fetch() with createApiClient (fixes no-restricted-syntax ESLint rule) - Copy correct layout.tsx with encrypted token + postMessage approach - Copy correct PluginModeContext.tsx with accessToken prop injection - Update schema.d.ts with auth-token path and operation entries * fix: add plugin_auth_token operation to schema.d.ts * fix(security): strip cookie/set-cookie + fix compressed response headers Veria High: cookie header was forwarded to plugin backends allowing capture of litellm JWT session cookies. Strip cookie on requests. Strip set-cookie from responses so plugins cannot overwrite litellm session cookies. Greptile P1: httpx decompresses responses but resp.headers still contained Content-Encoding/Transfer-Encoding/Content-Length from the wire. Forwarding these caused double-decompression and length errors. Now filtered via _RESPONSE_STRIP before returning to the browser. * fix: update plugin_key help text — no more ?token= reference * fix(security): disable follow_redirects to prevent SSRF follow_redirects=True allowed a plugin backend to return a 3xx to an internal URL, causing the proxy to fetch that internal service and relay the response. Disabled: clients handle their own redirects. * fix: forward user identity headers to plugin to address confused deputy Plugins receive X-LiteLLM-User-Id and X-LiteLLM-User-Role so they can enforce their own per-user access control before acting on requests that arrive with the shared plugin_key credential. * fix(security): restrict /plugin-proxy/* to proxy_admin role Closes the confused deputy gap: regular users could invoke any plugin endpoint using the shared plugin_key as a bearer credential. Now only proxy_admin callers can use the plugin proxy route. Plugin UIs communicate with the plugin service directly via the iframe (using the encrypted token exchange); this proxy route is for administrative/server-to-server access only. * fix: update schema.d.ts for admin-only proxy route docstring * fix(bug): use PassThroughEndpoint instead of None for get_async_httpx_client get_async_httpx_client(llm_provider=None) raises TypeError — the function concatenates the provider string and None is not a str. Use httpxSpecialProvider.PassThroughEndpoint, the enum value used by other internal proxy pass-through routes. * fix(security): add 30s TTL to encrypted plugin auth tokens Veria medium: encrypted tokens had no expiry, allowing indefinite replay. Fernet embeds a timestamp; decrypt_token now passes ttl=30 so tokens older than 30 seconds are rejected even with a valid HMAC. Plugin's /api/plugin-auth must call litellm within 30s of the iframe receiving the postMessage — normal browser behavior, tight enough to close the replay window. * feat(ui): topnav plugin switcher, embed plugins at their root Builds on the plugin architecture already on this branch (encrypted-token postMessage handshake, /api/plugins, PluginSettings) and removes the parts of the embed that assumed a specific plugin's shape. The mode switcher moves out of the sidebar into the topnav and lists AI Gateway plus each registered plugin by its display_name. Selecting a plugin hides litellm's sidebar entirely and renders the plugin full-bleed at its root url; the plugin draws its own navigation inside the iframe. This drops the hardcoded "Agent Control Plane" label and the hardcoded Sessions/Agents/Routines/... nav groups (agentControlPlaneMenuGroups / acpPagePaths) that only matched the agent platform and 404'd for a plugin that serves only / (e.g. the chat UI). The encrypted-token postMessage flow is unchanged. Note: embedding at root means a plugin must route internally from /; plugins that previously relied on the /sessions entrypoint should redirect from their root. * fix(security): audience-scoped identity claim replaces litellm token Veria: shared LITELLM_SALT_KEY with plugins + encrypting user bearer token created delegation/impersonation risk. Architecture change: - /api/plugins/auth-token now issues a plugin-scoped identity CLAIM {user_id, user_role, plugin, exp} encrypted with HMAC(LITELLM_SALT_KEY, plugin_name) - Each plugin holds only its own HMAC-derived key; cannot forge claims for other plugins or recover LITELLM_SALT_KEY - Claim contains NO litellm bearer token — compromised plugin learns caller identity only, cannot act as that user against the proxy - 30s TTL enforced in both Fernet header and explicit exp field - LAP /api/plugin-auth verifies claim, returns its own master key to browser (LAP key never exposed without valid claim) * fix(plugins): allow registering plugins from the admin UI Adding a plugin in the UI POSTs general_settings.plugins to /config/field/update, which rejected it with "Invalid field=plugins passed in." because `plugins` was not a field on ConfigGeneralSettings. Add a typed PluginConfig model and a `plugins` field so the update validates and persists. The in-memory plugin registry only refreshed at startup, so a plugin added via the UI did not appear in /api/plugins (the view switcher) until a restart. Refresh the registry from the new general_settings whenever the plugins field is updated. While here, type the registry as dict[str, PluginConfig] instead of raw dicts so list_plugins and plugin_proxy access typed attributes. Fix the Plugin Key field copy: it is optional and only used to authenticate litellm's server-side reverse proxy to a plugin's own backend (/plugin-proxy/<name>/*). It is not involved in iframe auth, which forwards the user's litellm token. Plugins that use the forwarded token leave it blank. * fix: regenerate schema.d.ts with PluginConfig type and updated auth-token endpoint * fix: use CI-compatible schema base for plugin entries * fix(plugins): load DB-persisted plugins on startup Plugins added through the admin UI are saved to DB general_settings, but the registry only initialised from the YAML config at boot, so UI-added plugins disappeared from the view switcher after a restart (the Plugins table still listed them since it reads the DB directly). Refresh the registry from the DB general_settings when it is merged in at startup. * fix: add PluginConfig schema, plugins field, fix list_plugins return type * fix: correct PluginConfig and plugins field positions in schema * fix: correct plugins field position in schema (after pass_through_endpoints) * fix: update PluginConfig.plugin_key description to match _types.py source * fix: move plugins field after pass_through_request_timeout (correct alphabetical position) * fix: redact plugin_key in config/field/info response Veria medium: proxy_admin_viewer could read plugin_key via GET /config/field/info?field_name=plugins. Now plugin_key is replaced with *** in the response regardless of caller role. The credential is only usable server-side. * fix(security): correct plugin docs salt-key guidance, drop iframe clipboard-read Address the two open Veria findings on the plugin architecture. The plugin docs told external services to decrypt the iframe auth payload with the proxy's LITELLM_SALT_KEY directly. That is both insecure and wrong: the running code derives a per-plugin key as HMAC-SHA256(LITELLM_SALT_KEY, plugin_name) and ships only a short-lived identity claim with no litellm bearer token. Sharing the master salt would let a compromised plugin decrypt any litellm secret recovered from a dump or backup. Rewrite the doc to match the implementation: the proxy computes the per-plugin key once and provisions it as a dedicated secret, the plugin validates the claim's audience and 30s TTL, and LITELLM_SALT_KEY never leaves the proxy. Also refresh the now-stale module and UI comments that still described the old shared-key token flow. Drop clipboard-read from the plugin iframe's allow attribute so an untrusted plugin can no longer read the user's clipboard; clipboard-write is retained. * fix(ci): modernize PluginConfig typing, refresh budget baselines via merge * fix(plugins): close iframe auth race and empty-plugins mode fallback Address the two open Greptile behavioral findings. The iframe auth handshake only posted the encrypted claim on the iframe's `load` event. When the auth-token fetch resolved after the iframe had already loaded, that listener never fired again and the plugin never received the claim. Send the claim immediately as well as on subsequent loads so both orderings are covered. The plugin mode fallback guarded on a non-empty plugins list, so removing all plugins left a user stranded on a stale mode with a blank iframe instead of returning to the AI Gateway. Track a loaded flag and fall back to ai-gateway once plugins have loaded whenever the stored mode is no longer registered, including the empty-list case. Add a PluginModeContext regression test covering the empty-list fallback and the still-registered path. * chore: re-trigger CI (GH Actions missed the prior head; re-run flaky live-API suites) * fix(plugins): scope iframe auth claim to the active plugin The iframe auth-token fetch omitted plugin_name, so the proxy always issued a claim encrypted under the default plugin's per-plugin key. For any other active plugin the iframe received a claim it could not decrypt and sign-in silently broke, and because the cached claim was posted to whichever plugin was mounted, a compromised iframe could replay the default plugin's claim. The active plugin's name was also missing from the fetch effect's dependencies, so switching plugins never refreshed the claim. Request the claim with the active plugin's name, re-fetch when the active plugin changes, and only deliver a claim while it still matches the mounted plugin so one plugin's claim is never replayed to another. * fix(plugins): never overwrite a stored plugin_key with its redaction placeholder /config/field/info redacts every plugin_key to "***", so an admin editing a plugin in the settings UI posted that placeholder straight back and the update handler persisted "***" as the real credential, permanently destroying the key. Preserve the stored credential on update: a blank or redacted plugin_key now sources the existing key from the saved config, only a real value replaces it, and a placeholder with no stored key is dropped rather than written. The edit modal also starts the key field blank so an untouched save keeps the current key, with the field labelled accordingly. * fix(security): sandbox proxied plugin responses on the dashboard origin The /plugin-proxy reverse proxy returned the plugin's body and content-type on the litellm dashboard origin, so a compromised plugin could serve an HTML/JS document that a proxy_admin navigates to and have it execute with the admin's session against same-origin management APIs. Force every proxied response inert: set Content-Security-Policy: sandbox (opaque origin, scripts disabled) and X-Content-Type-Options: nosniff, applied after the plugin's own headers so they cannot be overridden. The header construction moves to a pure helper with a unit test covering the sandbox enforcement and the existing wire/cookie header stripping. * fix(plugins): recover to ai-gateway when the plugins fetch fails The loaded flag was only set on a successful /api/plugins response, so when the fetch failed a user with a plugin mode stored in localStorage stayed on the blank plugin placeholder with no switcher to escape. Mark loaded in a finally so the stored mode still falls back to ai-gateway on failure, and add a regression test for the failed-fetch path. * fix(security): never return plugin_key from /api/plugins The plugin list endpoint returned the plaintext plugin_key to proxy_admin callers, and the dashboard fetches /api/plugins on every load into React state, so the credential was exposed to DevTools, memory snapshots, and any same-origin script. The browser never uses the key; the proxy injects it server-side from the registry and admin key management runs through the redacted /config/field/info path. Drop plugin_key from the response for every caller and update the regression test to assert it is never returned. * chore(ui): regenerate schema.d.ts for updated list_plugins docstring * fix(security): strip every litellm auth header before forwarding to plugins The plugin reverse proxy only removed Authorization and x-api-key, but user_api_key_auth also authenticates a caller via API-Key, x-goog-api-key, Ocp-Apim-Subscription-Key, x-litellm-api-key, and any configured custom key header. A malicious plugin could lure a proxy_admin into calling /plugin-proxy/... with the litellm key in one of those headers; the request authenticated locally and then forwarded the same key to the plugin, letting it impersonate the admin. Add a canonical SpecialHeaders.litellm_credential_header_names() that the auth header enum is the single source for, and strip that whole set plus the live general_settings.litellm_key_header_name from every forwarded request. New auth headers added to SpecialHeaders are now stripped automatically. Regression tests cover each credential header, the custom configured header, and the canonical list's contents.	2026-06-20 20:37:22 -07:00
ryan-crabbe-berri	7edf3a9cb5	style(ui): run prettier --write across the dashboard (#29622) ... Formatting-only pass; no logic changes. Brings the UI into compliance with .prettierrc so the new format-check CI job passes	2026-06-04 11:37:54 -07:00
ryan-crabbe-berri	73e9071311	refactor(ui): extract auth state into AuthContext (#28910) ... * refactor(ui): extract auth state into AuthContext Move auth state (token, userID, userRole, accessToken, premiumUser, userEmail, disabledPersonalKeyCreation, showSSOBanner) out of src/app/page.tsx into a new AuthProvider at src/contexts/AuthContext.tsx. Wrapped at the root layout so login/onboarding/dashboard routes all have access via useAuth(). Day 1 foundation for the App Router migration: migrated (dashboard)/X/page.tsx route entry points won't have a parent passing props, so shared auth state must live in a context they can read from. Sub-components are unchanged — they still receive accessToken/userID/userRole as props from page.tsx (which now reads them from useAuth()). Only the page.tsx → top-level-page-component handoff is de-drilled; deeper prop drilling is left for the per-page migration to address. Net change: -86 lines from page.tsx (state + two effects moved), +5 in layout.tsx (provider wrap), new AuthContext.tsx (~140 lines), test update to wrap CreateKeyPage in AuthProvider. Fixes LIT-3366 Part of LIT-3128 * fix(ui): await getUiConfig before clearing authLoading The AuthContext refactor flipped authLoading to false synchronously on mount while letting getUiConfig() run fire-and-forget. On SERVER_ROOT_PATH deployments this races the unauthenticated login-redirect effect: the redirect fires with proxyBaseUrl still at its module-init value, sending users to /ui/login instead of {SERVER_ROOT_PATH}/ui/login. Restores the original sequencing inside AuthProvider's mount effect and adds a Playwright spec wired into the existing SERVER_ROOT_PATH workflow matrix. The spec delays the config endpoint via page.route() to make the race deterministic across CI runners.	2026-05-26 17:53:03 -07:00
yuneng-jiang	34d954f8cb	[Fix] UI: Migrate AntD message API to use context-based MessageManager ... AntD v5 static message API doesn't render without an App wrapper or useMessage() context holder. Mirrors the existing notification pattern by adding message.useMessage() to AntdGlobalProvider and routing all calls through a new MessageManager module. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-19 23:29:38 -07:00
yuneng-jiang	8269f31921	refactor: extract ReactQueryProvider into dedicated context file ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-02-28 17:47:47 -08:00
yuneng-jiang	c7d203366c	[Fix] UI - QueryClient: move to single root-level provider ... A new QueryClient() was instantiated inside 5 component render functions and at module-level in 3 more pages, with no shared QueryClientProvider in either layout. This caused isolated, ephemeral caches with no cross-page sharing and cache destruction on every re-render. Moves QueryClient to a single module-level constant in AntdGlobalProvider (the existing root-level "use client" wrapper in app/layout.tsx) and removes the per-page QueryClient instantiations and QueryClientProvider wrappers from all 8 affected pages. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-02-28 17:44:09 -08:00
Zhenting Huang	647ea3bfcb	feat(proxy): add custom favicon support\n\nAdd ability to configure a custom favicon for the litellm proxy UI.\n\n- Add favicon_url field to UIThemeConfig model\n- Add LITELLM_FAVICON_URL env var support\n- Add /get_favicon endpoint to serve custom favicons\n- Update ThemeContext to dynamically set favicon\n- Add favicon URL input to UI theme settings page\n- Add comprehensive tests\n\nCloses #8323 (#21653)	2026-02-21 00:46:51 -08:00
Swayambhu	a48a8ec945	refactor: Directly use Ant Design's notification hook instead of App.useApp for notification management.	2026-02-06 15:35:11 +05:30
Swayambhu	eee37c569d	fix: ensure Ant Design notification instance is initialized only once using useRef.	2026-02-06 10:01:44 +05:30
Swayambhu	08a6fe2bfa	refactor: migrate Ant Design notifications to use App.useApp() context via a new global provider. ... 1. notifications_manager.tsx - Hybrid notification approach: Added notificationInstance variable to store the context-based instance Added setNotificationInstance() function to inject the instance from context Created getNotification() helper that prefers context instance, falls back to static Added COMMON_NOTIFICATION_PROPS (exported) with showProgress: true and pauseOnHover: true All notification methods ( error , warning , info , success , fromBackend ) now spread COMMON_NOTIFICATION_PROPS 2. AntdGlobalProvider.tsx - New context provider: Wraps app with Antd's <App> component Uses App.useApp() hook to get the context-based notification instance Injects it into NotificationManager via setNotificationInstance()	2026-02-06 09:44:02 +05:30
=	5197268a58	added and ran prettier autoformatter	2025-10-04 18:19:48 -07:00
Jack Temple	382614911f	fix: make /get/ui_theme_settings public for all users to access custom branding	2025-09-30 09:23:23 -05:00
Cole McIntosh	596592599a	feat: Add logo customization for LiteLLM admin UI (#12958) ... * feat: Add logo customization for LiteLLM admin UI - Add simple logo customization page under Settings > UI Theme - Support custom logo URL with instant preview - Clean reset to default functionality - Wrap app with ThemeProvider for proper context - Backend properly handles null/empty logo URLs * style: Update save button to use indigo color and 'Save Changes' text for consistency * fix: Restore CloudZero background job initialization Address PR review feedback by restoring the _initialize_spend_tracking_background_jobs method that handles both CloudZero and Prometheus background job initialization. This ensures critical spend tracking functionality is not lost while preserving the logo customization feature. Changes: - Restore _initialize_spend_tracking_background_jobs method - Replace inline Prometheus initialization with proper method call - Maintain CloudZero background job setup for cost tracking	2025-08-06 08:10:08 -07:00