mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-05 08:07:05 +00:00
78addb230b
* fix(proxy): deny when agent grants resolve to nothing `get_allowed_agents` returned a plain list where the empty value meant both "this caller was never restricted" and "this caller's grants resolved to nothing". Downstream read either as allow-all, so a key restricted to one agent inside a team restricted to another reached every agent on the proxy, and an access group that resolved to no agents did the same. Replace it with `resolve_agent_access`, returning a tagged UnrestrictedAgentAccess | RestrictedAgentAccess. Only a caller with no grant anywhere is unrestricted; an empty restricted set denies. Access group lookup failures now propagate to the key/team resolvers so a DB error still fails open exactly as before, while a group that genuinely resolves to nothing denies. * style(proxy): drop redundant comments from the agent access match |
||
|---|---|---|
| .. | ||
| auth | ||
| __init__.py | ||
| test_a2a_endpoints.py | ||
| test_a2a_version_e2e.py | ||
| test_agent_header_isolation.py | ||
| test_agent_headers.py | ||
| test_agent_registry.py | ||
| test_databricks_oauth.py | ||
| test_endpoints.py | ||
| test_model_list_helpers.py | ||