litellm/litellm/proxy/auth
devin-ai-integration[bot] e135a199ad
Some checks failed
LiteLLM Rust / rust-lint (push) Has been cancelled
LiteLLM Rust / rust-test (push) Has been cancelled
LiteLLM Rust / rust-wheel (push) Has been cancelled
fix(proxy): fail parked DB lookups at a deadline and flip readiness while they stall (#42654)
* fix(proxy): fail parked DB lookups at a deadline and flip readiness while they stall

Under a load burst with a slow authentication database every request parked inside
the pod with no deadline while /health/readiness kept answering 200 (its own ping
gets a fresh connection), so the load balancer kept sending traffic until the pod hit
its memory limit, and the parked requests completed against the provider minutes
after every client had hung up

Every pre-request read (key, team, user, end user, budget, membership, organization,
object permission, jwt mapping, project, proxy budget, spend counter reseed) now runs
under one deadline, PROXY_DB_LOOKUP_DEADLINE_SECONDS (default 10 s). A lookup that
hits it fails the request with the existing 503 "authentication database is
temporarily unreachable" answer, honours allow_requests_on_db_unavailable, and never
triggers the transport reconnect (the transport is fine, the query is slow), which is
what turned the repro's stall into "too many clients". Writes stay unbounded

A deadline hit marks the pod stalled for PROXY_DB_LOOKUP_STALL_WINDOW_SECONDS
(default 30 s, 0 disables), during which /health/readiness answers 503 with
"db": "stalled" behind the same fail-open gate, so the pod leaves rotation before it
fills its memory. The existing litellm_in_flight_requests gauge already exposes the
parked set on /metrics

The deadline is enforced on the wall clock: bounded_db_lookup waits on the lookup
task with asyncio.wait and raises DBLookupDeadlineExceeded when the deadline passes
even if the lookup absorbs its cancellation, where asyncio.wait_for on 3.12+ would
sit on the cancelled task for as long as it takes

The failure spend-log row no longer re-runs the key and team lookups when the
failure itself is a database connection or deadline error, so a request that hit
the deadline is answered after one deadline instead of two

* fix(proxy): bound the spend counter gate wait and narrow the stalled lookup shortcut

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(proxy): keep the global spend lookup on the prisma client handle

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Co-authored-by: yassin <yassin@berri.ai>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-24 10:09:49 -05:00
..
resolvers fix(proxy): import UserNotFoundError in grants resolver from the types module 2026-09-14 20:23:54 +00:00
auth_checks.py fix(proxy): fail parked DB lookups at a deadline and flip readiness while they stall (#42654) 2026-09-24 10:09:49 -05:00
auth_checks_organization.py chore(lint): strip inert type: ignore comments and zero LIT009, LIT010, LIT011 headroom 2026-08-05 02:37:24 -07:00
auth_exception_handler.py fix(proxy): answer 503 no_db_connection on management routes when the caller's user read hits a database outage (#42410) 2026-09-21 22:37:33 -07:00
auth_method.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
auth_object_prefetch.py fix(auth): keep prefetched org entries on the 5s getter TTL 2026-09-14 18:13:49 +00:00
auth_utils.py feat(lint): add LIT013 flagging *-ok suppressions that suppress nothing and remove the 240 stale ones (#42793) 2026-09-23 17:50:09 -07:00
auto_router_checks.py feat(auto-router): allow opted-in team members to manage their routers 2026-09-14 23:56:55 -07:00
budget_throttle.py feat(lint): enforce Final on locals and freeze function parameters (LIT010, LIT011) 2026-08-04 12:54:39 -07:00
fallback_budget.py fix(proxy)!: enforce fallback budget by default 2026-09-16 14:15:27 -07:00
fallback_model_access.py feat(proxy): gate fallback model access enforcement behind enforce_fallback_model_access 2026-08-27 15:45:10 -07:00
handle_jwt.py fix(jwt): say x-litellm-team-id matched no team id or alias in the 403 (#42495) 2026-09-22 10:51:49 -07:00
ip_address_utils.py fix(proxy): mark session/SSO/SAML cookies Secure behind a TLS-terminating reverse proxy (#39391) 2026-09-02 16:42:29 -07:00
litellm_license.py fix(license): let a wildcard allowed_features license grant the auto_router feature 2026-09-17 15:08:09 -07:00
login_throttle.py fix(proxy): reject blank trusted_proxy_ranges entries before they are dropped 2026-09-18 11:50:30 +00:00
login_utils.py fix(proxy): revoke UI session tokens on logout and password change (#42463) 2026-09-23 10:31:38 +02:00
master_key_boot_check.py refactor(proxy): rename the local development override to dangerously_permit_weak_or_unset_master_key so the name says exactly what it permits 2026-09-19 18:53:14 -07:00
model_access_denied.py refactor(proxy): replace configurable model access denied message with a fixed clean client message 2026-09-16 01:44:36 +00:00
model_checks.py fix(model_checks): drop wildcard routes like bedrock/* from /v1/models (#31731) 2026-09-04 01:36:46 +00:00
network.py feat(proxy): hard-block throttled Admin UI sign-ins with no credential bypass 2026-09-17 16:10:23 +00:00
oauth2_check.py feat(lint): enforce Final on locals and freeze function parameters (LIT010, LIT011) 2026-08-04 12:54:39 -07:00
oauth2_proxy_hook.py feat(lint): enforce Final on locals and freeze function parameters (LIT010, LIT011) 2026-08-04 12:54:39 -07:00
password_policy.py test: deflake fuzzy picker, breached-password HIBP, and MCP stdio timeout tests (rolling deflake 2026-09-22) (#42125) 2026-09-23 08:44:59 -07:00
public_key.pem fix: remove leading space from license public_key.pem (#25339) 2026-04-08 21:30:38 -07:00
rds_iam_token.py chore(lint): strip inert type: ignore comments and zero LIT009, LIT010, LIT011 headroom 2026-08-05 02:37:24 -07:00
roles.py feat(lint): enforce Final on locals and freeze function parameters (LIT010, LIT011) 2026-08-04 12:54:39 -07:00
route_checks.py fix(proxy): revoke UI session tokens on logout and password change (#42463) 2026-09-23 10:31:38 +02:00
team_grants.py feat(team): team-level model_max_budget with key-level overrides 2026-09-16 00:40:58 +00:00
trusted_proxy_utils.py feat(lint): enforce Final on locals and freeze function parameters (LIT010, LIT011) 2026-08-04 12:54:39 -07:00
user_api_key_auth.py fix(proxy): fail parked DB lookups at a deadline and flip readiness while they stall (#42654) 2026-09-24 10:09:49 -05:00