mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-06 08:16:43 +00:00
592518202c
* feat(terraform): add litellm_jwt_key_mapping resource Adds a Terraform resource for the proxy's JWT to virtual key mappings, so a JWT client identified by a claim such as client_id, azp or sub maps to a virtual key and inherits its models, budgets, rate limits and spend tracking. Covers the four mapping endpoints: /jwt/key/mapping/new, /info, /update and /delete. is_active is applied through a follow-up update because the create endpoint always starts a mapping active, a dropped description is sent as an empty string because the update endpoint ignores absent fields, changing the mapped key rotates it in place, and changing the claim name or value forces replacement since the update endpoint cannot change them. * fix(terraform): revert key on failed jwt_key_mapping update Classic SDKv2 persists a failed Update's diff-applied values to state regardless of the error, so a rejected key rotation left the new key in state while the proxy kept the old one and the next plan falsely converged. Revert key via GetChange and resync description/is_active/computed fields from a post-failure Read, since Read alone can't recover key (the proxy never returns it). Also drop the case-insensitive "mapping not found" body match: the proxy raises 404 for all three not-found paths (info, update, delete), so checking the status code alone is sufficient. Clarify the docs: referencing a litellm_key resource's write-only key is not a null-then-400 situation, it's a static "Missing required argument" error at plan time, in every apply ordering. * fix(terraform): stop leaving an active mapping behind on failed cleanup Two issues flagged by review: - Create has no way to ask the proxy for an inactive mapping, so an is_active=false mapping is briefly active while the follow-up deactivation runs. If that deactivation call itself fails, the mapping used to stay active and untracked. It's now deleted instead, closing the exposure rather than leaving it open indefinitely. - On a failed update, only `key` was reverted before the recovery read. If that read also failed, description/is_active kept the rejected values, so a later plan could report false convergence. Now all three are reverted before the read runs. Both come with regression tests, mutation-verified against the pre-fix code. * fix(deps): bump restrictedpython to 8.5 for GHSA-ffg3-p8fm-mjx2 Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * chore: retrigger ci Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(tests): stub anthropic judge credentials in funnel seeding test Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * revert(deps): keep uv.lock unchanged to keep the PR terraform-only Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: Fabrice Pont <fabrice.pont@doctolib.com> Co-authored-by: yassin <yassin@berri.ai> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| access_group.md | ||
| agent.md | ||
| budget.md | ||
| credential.md | ||
| fallback.md | ||
| guardrail.md | ||
| jwt_key_mapping.md | ||
| key.md | ||
| key_block.md | ||
| mcp_server.md | ||
| model.md | ||
| project.md | ||
| prompt.md | ||
| search_tool.md | ||
| tag.md | ||
| team.md | ||
| team_block.md | ||
| team_member.md | ||
| team_member_add.md | ||
| unified_access_group.md | ||
| user.md | ||
| vector_store.md | ||