yuneng-jiang 6076c0a058 fix(jwt,otel): backport session conversation id and JWT team header selection to rc/1.103.0 (#43343) ... * feat(otel): emit gen_ai.conversation.id from the caller's session id on v2 LLM spans (#42486) * feat(otel): emit gen_ai.conversation.id from the caller's session id on v2 LLM spans Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(otel): keep the caller's header session under missing_session_id: generate and read replayed payload session ids Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(otel): drop only the proxy-minted session id so a caller id on the other metadata key survives Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(otel): keep a replayed session id hidden when it only echoes the payload trace id Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(otel): keep a replayed session id even when the payload trace id fell back to it Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(otel): stop reading the replayed payload's session id, the generated marker does not survive replay Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(integration): audit gen_ai.conversation.id on otel v2 spans through a real proxy, sink and postgres Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(integration): keep otel conversation rigs alive for the whole session so shuffled shards do not reboot the proxy per test Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(otel): stop the audit rig proxies from probing sibling test peers for model info Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(otel): record accepted OTLP batches in the sink instead of mutating the collector Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(otel): guard the accepted batch deque so snapshots cannot race sink appends Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: mrinal <mrinal@berri.ai> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: yucheng <yucheng@berri.ai> (cherry picked from commit a3196907e4) * fix(jwt): accept a team alias in x-litellm-team-id (#42445) * fix(jwt): accept a team alias in x-litellm-team-id The header only matched canonical team ids, so a JWT caller selecting one of their teams by its alias got a 403 even though they belonged to it. The header value is now resolved through the existing alias lookup before the JWT allowed-team check and the DB membership fallback, while a value that is already a team id never costs an alias lookup and denials keep naming the value the caller sent Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(jwt): only alias a header team id the database provably lacks Under fallback_to_db_teams a header value whose team row read fails for any reason other than TeamNotFoundError now keeps the membership denial instead of falling through to the alias lookup, so a degraded read cannot select a different team that carries the value as an alias. Drops the HeaderTeam docstring that only restated its fields Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: ryan <ryan@berri.ai> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> (cherry picked from commit 071cb49d32) * fix(jwt): say x-litellm-team-id matched no team id or alias in the 403 (#42495) * fix(jwt): say x-litellm-team-id matched no team id or alias in the 403 Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(jwt): tell the caller when x-litellm-team-id names an alias shared by several teams Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(jwt): deny a shared x-litellm-team-id alias exactly like an unknown value A distinct 403 for an alias several teams share was raised before the allowed-teams check, so any JWT could probe which aliases exist. The alias lookup now treats the duplicate as a miss, and both denials say the value does not resolve to a team id or a unique team alias, which is true for unknown, unauthorized and duplicate values alike Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: ryan <ryan@berri.ai> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> (cherry picked from commit 08639fcf42) * fix(jwt): let x-litellm-team-id select DB membership teams when the token also carries a team claim (#43206) * fix(jwt): let x-litellm-team-id select DB membership teams when the token also carries a team claim Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * docs(jwt): describe header team selection under fallback_to_db_teams Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: yassin <yassin@berri.ai> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> (cherry picked from commit 7b4fd47c6e) --------- Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: mrinal <mrinal@berri.ai> Co-authored-by: yucheng <yucheng@berri.ai> Co-authored-by: ryan <ryan@berri.ai> Co-authored-by: yassin <yassin@berri.ai>		2026-09-26 15:03:25 -07:00
..
test_admin_viewer_handler_access.py	test: drop the cwd-relative sys.path.insert calls from the test suite (#37802)	2026-08-22 09:25:58 -07:00
test_auth_checks.py	Merge pull request #41681 from BerriAI/litellm_org_alias_from_team	2026-09-19 15:25:14 -07:00
test_auth_exception_handler.py	refactor(proxy): replace configurable model access denied message with a fixed clean client message	2026-09-16 01:44:36 +00:00
test_auth_hot_path_network_requests.py	test: drop the cwd-relative sys.path.insert calls from the test suite (#37802)	2026-08-22 09:25:58 -07:00
test_auth_object_prefetch.py	fix(auth): keep prefetched org entries on the 5s getter TTL	2026-09-14 18:13:49 +00:00
test_auth_utils.py	Merge remote-tracking branch 'origin/main' into litellm_model_access_denied_message	2026-09-16 16:27:18 +00:00
test_banned_params_extra_body.py	fix(proxy): ban caller-supplied aws identity selectors in request bodies	2026-08-10 22:05:49 -07:00
test_cli_auth.py	test: assert the poll call shape after the timeout refactor	2026-08-25 11:00:29 -07:00
test_custom_auth_end_user_budget.py	fix(proxy): keep custom-auth end-user caps under a key default budget	2026-09-17 20:31:26 +00:00
test_fallback_budget.py	fix(proxy)!: enforce fallback budget by default	2026-09-16 14:15:27 -07:00
test_fallback_model_access.py	feat(proxy): gate fallback model access enforcement behind enforce_fallback_model_access	2026-08-27 15:45:10 -07:00
test_handle_jwt.py	fix(jwt,otel): backport session conversation id and JWT team header selection to rc/1.103.0 (#43343)	2026-09-26 15:03:25 -07:00
test_info_routes.py	style: run black formatter on files from main merge	2026-04-17 13:02:59 -07:00
test_litellm_license.py	fix(license): let a wildcard allowed_features license grant the auto_router feature	2026-09-17 15:08:09 -07:00
test_login_utils.py	fix(proxy): reject blank trusted_proxy_ranges entries before they are dropped	2026-09-18 11:50:30 +00:00
test_mcp_ip_filtering.py	fix(proxy): mark session/SSO/SAML cookies Secure behind a TLS-terminating reverse proxy (#39391)	2026-09-02 16:42:29 -07:00
test_model_access_group_budgets.py	fix(auth): put TQ008 suppressions on the patch call lines	2026-09-14 18:13:49 +00:00
test_model_checks.py	fix(proxy): register transcribe as a known provider for model grants	2026-09-18 21:04:25 -07:00
test_model_checks_fallbacks.py	perf: build log messages lazily so filtered-out log records cost nothing (#35703)	2026-08-04 04:34:52 +00:00
test_multi_budget_windows.py	fix(proxy): enforce budgets against authoritative DB spend when the cross-pod counter is unreliable (#30684)	2026-06-18 10:35:41 -07:00
test_network.py	fix(proxy): keep mapped-notation trusted proxy ranges matching mapped peers	2026-09-17 06:41:23 +00:00
test_oauth2_proxy_hook.py	test: drop the cwd-relative sys.path.insert calls from the test suite (#37802)	2026-08-22 09:25:58 -07:00
test_object_permission_loading.py	test: drop the cwd-relative sys.path.insert calls from the test suite (#37802)	2026-08-22 09:25:58 -07:00
test_onboarding.py	feat(auth): enforce configurable password policy and SSO-only login (#39381)	2026-09-02 14:28:13 -07:00
test_organization_budget_enforcement.py	test: drop the cwd-relative sys.path.insert calls from the test suite (#37802)	2026-08-22 09:25:58 -07:00
test_password_hashing.py	chore: fixes	2026-03-30 18:36:58 -07:00
test_password_policy.py	feat(auth): enforce configurable password policy and SSO-only login (#39381)	2026-09-02 14:28:13 -07:00
test_resolvers_exceptions.py	feat(auth): resolve caller identity once into a Principal at the auth seam (#30887)	2026-06-20 18:49:41 -07:00
test_resolvers_grants.py	fix(auth): refresh lite login session token grants from the live user and team rows	2026-09-10 18:33:49 -07:00
test_resolvers_models.py	feat(auth): resolve caller identity once into a Principal at the auth seam (#30887)	2026-06-20 18:49:41 -07:00
test_resolvers_seam.py	feat(auth): resolve caller identity once into a Principal at the auth seam (#30887)	2026-06-20 18:49:41 -07:00
test_resolvers_store.py	feat(auth): resolve caller identity once into a Principal at the auth seam (#30887)	2026-06-20 18:49:41 -07:00
test_route_checks.py	Merge pull request #41485 from BerriAI/litellm_jwt_token_exchange_grant	2026-09-18 21:27:20 -07:00
test_router_override_fallback_auth.py	chore(proxy): clean up request parameter validation and provider destination handling (#34189)	2026-07-22 00:57:58 +00:00
test_team_grants.py	feat(team): team-level model_max_budget with key-level overrides	2026-09-16 00:40:58 +00:00
test_team_member_budget.py	Fix team member budget enforcement without user row (#27273)	2026-05-06 11:42:29 -07:00
test_unmapped_model_budget_enforcement.py	fix(router): never price a strategy-router alias (#36691)	2026-08-12 14:26:30 -07:00
test_user_api_key_auth.py	refactor(auth): resolve org identity through an auth_checks helper	2026-09-18 23:59:33 +00:00