mirror of
https://github.com/BerriAI/litellm.git
synced 2026-10-13 03:59:12 +00:00
f516668f96
* test(managed_files): pin ownership checks on batch and fine-tuning create Tenant B can create a batch or fine-tuning job from tenant A's managed file id today. These fail on main for acreate_batch input_file_id and acreate_fine_tuning_job training_file and validation_file * fix(managed_files): check input file ownership on batch and fine-tuning create Batch create and fine-tuning create only mapped the managed input file to provider ids and never checked who owned it, so any key with access to the model could build a batch or job on another tenant's file and then own the outputs. Both now run check_file_ids_access like chat and responses do, which 403s a non-owner and 404s a managed id with no ownership row. Fine-tuning also checks validation_file, which was never looked at * test(batches): pin that a pre-call ownership denial stops every batch create branch LIT-4797 noted an endpoint-level check missed the load-balanced branch because it dispatches first. The ownership check lives in the pre-call hook, which runs before branch selection, so a 403 there must keep both the load-balanced and unified-file branches from reaching the router * test(integration): pin managed-file ownership on batch and fine-tuning create Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(managed_files): check ownership before the batch rate limiter reads the input file and keep key-owned resources across key regenerate Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| auth | ||
| guardrails | ||
| hooks | ||
| management_endpoints | ||
| __init__.py | ||
| test_afile_retrieve_returns_unified_id.py | ||
| test_audit_logging_endpoints.py | ||
| test_batch_retrieve_input_file_id.py | ||
| test_batch_retrieve_registers_missing_output_file_id.py | ||
| test_batch_retrieve_returns_unified_input_file_id.py | ||
| test_batch_update_db_managed_output_file_id.py | ||
| test_deleted_file_returns_403_not_404.py | ||
| test_enterprise_routes.py | ||
| test_file_deletion_blocking.py | ||
| test_liteadmin.py | ||
| test_managed_files_access_check.py | ||
| test_managed_files_hook.py | ||