mirror of
https://github.com/BerriAI/litellm.git
synced 2026-11-13 08:52:02 +00:00
96b916028a
* fix(proxy): give rag ingest managed file ids and team credentials on vector store file routes RAG ingest through a team's OpenAI deployment now registers the uploaded file as a LiteLLM managed file and returns its managed id, so GET /v1/files lists it for the caller. Re-ingesting a managed id attaches the provider file and returns the caller's managed id Model-less vector store file calls (create, list, retrieve, content, update, delete) from a team key now use the team's OpenAI deployment that ingest uploads through, via the router, and fall back to the direct path when the key may not use one. Explicit api_key, api_base, litellm_credential_name, and forwarded provider keys still win, and blank values count as absent * fix(proxy): route managed vector store file ids to their team deployment and keep missing-file 404s off the router Model-less team vector store file calls now go straight to the provider with the team deployment's credentials, so 404s on missing files no longer put the team deployment in cooldown. A managed file id on the vector store file routes now uses the deployment named by its llm_output_file_model_id when that deployment is proxy-wide or belongs to the caller's team, and falls back to target_model_names otherwise. * fix(rag): keep managed ids and team checks on every file and search path Ingest no longer registers a raw file id when file_url is empty, a managed file id on a proxy without the managed files hook answers 400, and vector store search and /v1/rag/query hits show the managed id ingest returned. Model-less vector store file calls use the team deployment only after the key, team, and member model checks pass, fall through to the router when the team has no OpenAI deployment, and log the deployment they used. * fix(rag): keep provider ids on lookup failures and mint managed ids only for keys that can use them A database error while mapping search hits to managed ids keeps OpenAI's ids instead of failing a finished search. Ingest registers a managed id only when the caller passes the team deployment's model checks, so a model-limited key keeps the raw id it can still use, and the file routes share that check. * fix(rag): attach the managed file copy that matches the ingest credentials * fix(vector_store_files): route a managed file id to the caller team's copy * fix(vector_store_files): keep the upload copy for a store registered with its own credentials * fix(vector_store_files): use a managed file's team copy only when the store holds it * fix(vector_store_files): attach a managed file's team copy and keep named credential options out of the store check * fix(vector_store_files): attach the team copy only to a store that routes to the team deployment * fix(vector_store_files): keep a managed store's routing and check the upload copy through its own deployment * fix(vector_store_files): route a managed file to its upload deployment only when the key may call it A managed file id names its upload deployment, and with require_managed_files off that id is not checked against an ownership record. The routes now use that deployment only when the caller may call its public model, else they keep target_model_names routing as on main. * fix(vector_store_files): log a pinned managed file call under its deployment's public model name * fix(vector_store_files): send a pinned managed file call's deployment key only to that deployment's base * fix(vector_store_files): keep stored credential headers intact and fail the store check on errors other than 404 * fix(vector_store_files): answer a failed store check with the provider status and copy credentials read by name * fix(vector_store_files): send a call to the upload copy when the store check fails without a 404 A store check error other than a 404 now leaves the call on the upload copy, the way main always routed it, so the real call keeps the router's retries, the provider's status, and its failure log instead of failing on one transient error * fix(vector_store_files): keep a credential's no-log key out of the store check A named credential carrying a no-log key made the store check call aretrieve with no-log twice, so every managed id call through that deployment answered 500 where main answered 200 --------- Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| _guardrail_opt_out.py | ||
| _hidden_alias_budget.py | ||
| _responses_compact.py | ||
| test_access_group_budget.py | ||
| test_access_group_model_listing.py | ||
| test_access_group_rules.py | ||
| test_agent_access.py | ||
| test_agent_denial_logging.py | ||
| test_agent_least_privilege.py | ||
| test_alias_chain_budget_waiver.py | ||
| test_audio_model_access.py | ||
| test_audit_any_sweep_auth.py | ||
| test_auth_object_prefetch.py | ||
| test_bedrock_passthrough_model_access.py | ||
| test_claude_code_gateway_oauth.py | ||
| test_cli_sso_login_ui_disabled.py | ||
| test_customer_model_allowlist.py | ||
| test_deprecated_key_lookup_cache.py | ||
| test_end_user_block.py | ||
| test_guardrail_submissions.py | ||
| test_hidden_alias_budget_bypass.py | ||
| test_hidden_alias_budget_bypass_chaos.py | ||
| test_jwt_auto_register_map_existing_key.py | ||
| test_jwt_default_team_provisioning.py | ||
| test_jwt_key_mapping_lifecycle.py | ||
| test_jwt_mapped_key_email_backfill.py | ||
| test_key_alias_model_access.py | ||
| test_key_bound_to_unknown_user.py | ||
| test_key_budget_owner_updates.py | ||
| test_key_guardrail_opt_out.py | ||
| test_key_guardrail_opt_out_chaos.py | ||
| test_key_guardrail_opt_out_runtime.py | ||
| test_lakera_v2_on_flagged.py | ||
| test_legacy_empty_models_boot_warning.py | ||
| test_memory_ownership.py | ||
| test_model_access_allow_lists.py | ||
| test_object_permission_lookup.py | ||
| test_passthrough_route_denylist.py | ||
| test_rag_query_vector_store_allowlist.py | ||
| test_rag_team_provider_credentials.py | ||
| test_realtime_client_secret_access.py | ||
| test_responses_compact_id_ownership.py | ||
| test_responses_compact_id_ownership_chaos.py | ||
| test_responses_id_ownership.py | ||
| test_responses_lifecycle_during_call_guardrail.py | ||
| test_search_tool_allowlist.py | ||
| test_search_tool_deny_by_default.py | ||
| test_sso_blank_identity.py | ||
| test_team_admin_gate.py | ||
| test_team_member_permissions.py | ||
| test_team_scoped_models.py | ||
| test_tool_search_replay_allowlist.py | ||
| test_tool_search_replay_guardrails.py | ||
| test_unknown_key_generic_401.py | ||
| test_user_self_update_guard.py | ||
| test_warmed_policy.py | ||
| test_websocket_rejection_logging.py | ||
| test_wildcard_model_access.py | ||
| test_workflow_ownership.py | ||