mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-12 23:01:41 +00:00
78addb230b
* fix(proxy): deny when agent grants resolve to nothing `get_allowed_agents` returned a plain list where the empty value meant both "this caller was never restricted" and "this caller's grants resolved to nothing". Downstream read either as allow-all, so a key restricted to one agent inside a team restricted to another reached every agent on the proxy, and an access group that resolved to no agents did the same. Replace it with `resolve_agent_access`, returning a tagged UnrestrictedAgentAccess | RestrictedAgentAccess. Only a caller with no grant anywhere is unrestricted; an empty restricted set denies. Access group lookup failures now propagate to the key/team resolvers so a DB error still fails open exactly as before, while a group that genuinely resolves to nothing denies. * style(proxy): drop redundant comments from the agent access match |
||
|---|---|---|
| .. | ||
| a2a_protocol/providers/pydantic_ai_agents | ||
| integrations/helicone | ||
| litellm_core_utils | ||
| llms | ||
| proxy | ||
| test_bedrock_extended_beta_models.py | ||
| test_bedrock_nemotron_super.py | ||
| test_no_hardcoded_secrets.py | ||
| test_proxy_auth.py | ||
| test_router_retry_backoff_headers.py | ||
| test_sambanova_model_metadata.py | ||
| test_stream_chunk_builder_images.py | ||