mirror of
https://github.com/BerriAI/litellm.git
synced 2026-10-06 02:48:13 +00:00
* refactor(messages): take the provider client from the injected HTTP pool The messages route kept its own process-wide reqwest client, so it ignored ssl_verify, CA bundles, client certs, proxies and every other setting that litellm-http resolves. The machine now takes the HttpClientPool and the call's HttpClientConfig, as OCR does, and the bridge passes its shared pool. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(http): hand out an owned Client and move chat, audio and OIDC onto the pool HttpClientPool now returns litellm_http::Client, a newtype only crates/http can build, so every provider client carries the resolved TLS, proxy and timeout settings. Chat completions and audio transcription drop their process-wide reqwest clients and take the pool and call config like messages; their 600s ceiling moves to the request. OidcResolver takes its client instead of building one, and the bridge hands it the pooled one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(secrets): build Google, Azure and CyberArk manager clients from the pool The native secret managers built bare reqwest clients, so they ignored the host's TLS and proxy settings. load_native_manager now takes the pool and the host config and hands each manager a pooled client. CyberArk's CYBERARK_SSL_VERIFY and CYBERARK_CLIENT_CERT/KEY become an override on the host config instead of a hand-built client. To express a certificate and key in separate files, HttpClientConfig::client_certificate is now a ClientIdentity that is either one PEM or a split pair. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(clippy): only crates/http may build a reqwest client Fence reqwest::Client, ClientBuilder and the TLS builder methods with disallowed-types and disallowed-methods so new code takes a litellm_http::Client from the pool. crates/http is exempt as the one place clients are built, and testkit as a dev-only installer. Tests move to litellm_http::Client::plain_for_test or a pooled client. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(secrets-cyberark): keep verifying certificates when the host disables it Python hands CyberArk its own ssl_verify, which wins over the global setting, so CYBERARK_SSL_VERIFY unset or true still verifies even when the host sets ssl_verify false. The pooled client copied the host's Disabled and would send the API key unverified; fall back to the built-in roots instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(python-bridge): treat a missing litellm package as no host HTTP settings Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: Yujong Lee <yujong@berri.ai> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
87 lines
2.7 KiB
Rust
87 lines
2.7 KiB
Rust
#![allow(dead_code)]
|
|
|
|
use std::{
|
|
collections::HashMap,
|
|
sync::{Arc, Mutex},
|
|
};
|
|
|
|
use litellm_cache::JsonCodec;
|
|
use litellm_cache_gcs::{GcsCache, GcsConfig, StaticTokenSource, TokenSource};
|
|
use percent_encoding::percent_decode_str;
|
|
use serde_json::Value;
|
|
use wiremock::{Mock, MockServer, Request, Respond, ResponseTemplate, http::Method, matchers::any};
|
|
|
|
pub type JsonGcsCache = GcsCache<JsonCodec<Value>>;
|
|
|
|
pub fn config(server: &MockServer, gcs_path: Option<&str>) -> GcsConfig {
|
|
GcsConfig {
|
|
bucket_name: "bucket".into(),
|
|
gcs_path: gcs_path.map(str::to_string),
|
|
path_service_account: None,
|
|
endpoint: server.uri(),
|
|
}
|
|
}
|
|
|
|
pub fn cache_with_token(
|
|
server: &MockServer,
|
|
gcs_path: Option<&str>,
|
|
token: Arc<dyn TokenSource>,
|
|
) -> JsonGcsCache {
|
|
GcsCache::with_token_source(
|
|
config(server, gcs_path),
|
|
litellm_http::Client::plain_for_test(),
|
|
JsonCodec::new(),
|
|
token,
|
|
)
|
|
}
|
|
|
|
pub fn cache(server: &MockServer, gcs_path: Option<&str>) -> JsonGcsCache {
|
|
cache_with_token(server, gcs_path, Arc::new(StaticTokenSource("tok".into())))
|
|
}
|
|
|
|
/// An in-memory bucket speaking the JSON API's media upload and `alt=media` download.
|
|
#[derive(Clone, Default)]
|
|
pub struct FakeBucket {
|
|
objects: Arc<Mutex<HashMap<String, Vec<u8>>>>,
|
|
}
|
|
|
|
impl FakeBucket {
|
|
pub async fn serve() -> MockServer {
|
|
let server = MockServer::start().await;
|
|
Mock::given(any())
|
|
.respond_with(Self::default())
|
|
.mount(&server)
|
|
.await;
|
|
server
|
|
}
|
|
}
|
|
|
|
impl Respond for FakeBucket {
|
|
fn respond(&self, request: &Request) -> ResponseTemplate {
|
|
let mut objects = self.objects.lock().unwrap();
|
|
match request.method {
|
|
Method::POST => {
|
|
let name = request
|
|
.url
|
|
.query_pairs()
|
|
.find_map(|(key, value)| (key == "name").then(|| value.into_owned()))
|
|
.expect("uploads carry the object name");
|
|
objects.insert(name, request.body.clone());
|
|
ResponseTemplate::new(200)
|
|
}
|
|
Method::GET => {
|
|
let encoded = request
|
|
.url
|
|
.path()
|
|
.strip_prefix("/storage/v1/b/bucket/o/")
|
|
.expect("downloads address an object");
|
|
let name = percent_decode_str(encoded).decode_utf8().unwrap();
|
|
match objects.get(name.as_ref()) {
|
|
Some(body) => ResponseTemplate::new(200).set_body_bytes(body.clone()),
|
|
None => ResponseTemplate::new(404),
|
|
}
|
|
}
|
|
_ => ResponseTemplate::new(405),
|
|
}
|
|
}
|
|
}
|