mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-09 22:31:41 +00:00
Three fixes from this review round, plus a CI shard registration and a comment-density pass. A caller admitted through JWT or a custom auth path has no DB-backed key hash (UserAPIKeyAuth.api_key is None or some other non-sk- value), which crashed the capability token mint instead of leaving the tool_use untouched. _mint_caller_capability_token now returns None for that case, and _endpoints_for_request treats it the same as an unreachable base URL. A resolved master-key caller carried the real master key as its own api_key, which _worker_text later placed in the outbound request's metadata["user_api_key"] -- reachable by any raw-metadata logging callback. Now substitutes LITELLM_PROXY_MASTER_KEY_ALIAS there, matching what normal master-key auth already does for exactly this reason. The worker call went straight to llm_router.acompletion, skipping every registered rate-limit and budget callback (they run as async_pre_call_hook, which only proxy_logging_obj.pre_call_hook walks). A caller already over budget or rate-limited could keep spending through this endpoint indefinitely. _worker_text now calls pre_call_hook first and lets a block propagate. Registers tests/test_litellm/proxy/shunt_endpoints in test-unit.yml's proxy-endpoints shard; CI's shard-coverage assertion failed without it since the directory held tests but named no owning shard. Trims several docstrings/module comments in the shunt modules down to the non-obvious "why" they were justified by, cutting repetition and one stale field name a rename had left behind. |
||
|---|---|---|
| .. | ||
| actions | ||
| codeql | ||
| e2e-stack | ||
| ISSUE_TEMPLATE | ||
| observatory | ||
| screenshots | ||
| scripts | ||
| workflows | ||
| ci-coverage-allowlist.yml | ||
| CODEOWNERS | ||
| dependabot.yaml | ||
| deploy-on-aws.png | ||
| deploy-on-gcp.png | ||
| deploy-to-aws.png | ||
| FUNDING.yml | ||
| mutmut-coverage.rc | ||
| pull_request_template.md | ||
| template.yaml | ||