mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-29 01:42:19 +00:00
1a58162630
* refactor(messages): take the provider client from the injected HTTP pool The messages route kept its own process-wide reqwest client, so it ignored ssl_verify, CA bundles, client certs, proxies and every other setting that litellm-http resolves. The machine now takes the HttpClientPool and the call's HttpClientConfig, as OCR does, and the bridge passes its shared pool. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(http): hand out an owned Client and move chat, audio and OIDC onto the pool HttpClientPool now returns litellm_http::Client, a newtype only crates/http can build, so every provider client carries the resolved TLS, proxy and timeout settings. Chat completions and audio transcription drop their process-wide reqwest clients and take the pool and call config like messages; their 600s ceiling moves to the request. OidcResolver takes its client instead of building one, and the bridge hands it the pooled one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(secrets): build Google, Azure and CyberArk manager clients from the pool The native secret managers built bare reqwest clients, so they ignored the host's TLS and proxy settings. load_native_manager now takes the pool and the host config and hands each manager a pooled client. CyberArk's CYBERARK_SSL_VERIFY and CYBERARK_CLIENT_CERT/KEY become an override on the host config instead of a hand-built client. To express a certificate and key in separate files, HttpClientConfig::client_certificate is now a ClientIdentity that is either one PEM or a split pair. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(clippy): only crates/http may build a reqwest client Fence reqwest::Client, ClientBuilder and the TLS builder methods with disallowed-types and disallowed-methods so new code takes a litellm_http::Client from the pool. crates/http is exempt as the one place clients are built, and testkit as a dev-only installer. Tests move to litellm_http::Client::plain_for_test or a pooled client. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(secrets-cyberark): keep verifying certificates when the host disables it Python hands CyberArk its own ssl_verify, which wins over the global setting, so CYBERARK_SSL_VERIFY unset or true still verifies even when the host sets ssl_verify false. The pooled client copied the host's Disabled and would send the API key unverified; fall back to the built-in roots instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(python-bridge): treat a missing litellm package as no host HTTP settings Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: Yujong Lee <yujong@berri.ai> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
53 lines
1.7 KiB
Rust
53 lines
1.7 KiB
Rust
#![cfg(feature = "cyberark")]
|
|
|
|
#[tokio::test]
|
|
async fn cyberark_handler_reads_values_and_surfaces_errors() {
|
|
use std::time::Duration;
|
|
|
|
use litellm_secrets::{
|
|
Error, KeyManagementSettings, SecretManager, SecretValue, cyberark::CyberArkSecretManager,
|
|
get_secret_from_manager,
|
|
};
|
|
use wiremock::{
|
|
Mock, MockServer, ResponseTemplate,
|
|
matchers::{body_string, path},
|
|
};
|
|
|
|
let server = MockServer::start().await;
|
|
Mock::given(path("/authn/acct/admin/authenticate"))
|
|
.and(body_string("k3y"))
|
|
.respond_with(ResponseTemplate::new(200).set_body_string("token"))
|
|
.mount(&server)
|
|
.await;
|
|
Mock::given(path("/secrets/acct/variable/KEY"))
|
|
.respond_with(ResponseTemplate::new(200).set_body_string("value"))
|
|
.mount(&server)
|
|
.await;
|
|
let manager = SecretManager::Cyberark(CyberArkSecretManager::with_client(
|
|
litellm_http::Client::plain_for_test(),
|
|
server.uri().parse().unwrap(),
|
|
"acct".into(),
|
|
"admin".into(),
|
|
SecretValue::new("k3y"),
|
|
Some(Duration::from_secs(60)),
|
|
));
|
|
assert_eq!(
|
|
manager.system(),
|
|
litellm_secrets::KeyManagementSystem::Cyberark
|
|
);
|
|
let settings = KeyManagementSettings::default();
|
|
let value = get_secret_from_manager(&manager, "KEY", &settings, &|_: &str| None)
|
|
.await
|
|
.unwrap()
|
|
.unwrap();
|
|
assert_eq!(value.as_str(), Some("value"));
|
|
|
|
Mock::given(path("/secrets/acct/variable/ERROR"))
|
|
.respond_with(ResponseTemplate::new(500))
|
|
.mount(&server)
|
|
.await;
|
|
assert!(matches!(
|
|
get_secret_from_manager(&manager, "ERROR", &settings, &|_: &str| None).await,
|
|
Err(Error::Cyberark(_))
|
|
));
|
|
}
|