yucheng-berri 788868a52f fix(security)!: build proxy-only failure logs from an allowlist and drop caller guardrail info (#48599) ... * fix(proxy): build proxy-only failure logs from an allowlist and ignore request-time GCS credentials * fix(proxy): drop caller metadata from proxy-only failure logs metadata and litellm_metadata leave the proxy-only failure-log allowlist, so a rejected request can no longer point its failure log at its own Langsmith or Langfuse host through nested metadata. * fix(proxy): keep allowlisted metadata in proxy-only failure logs * test(proxy): isolate proxy-only failure log metadata tests * fix(logging): ignore non-list request tags when building the logging payload A guardrail-rejected request with metadata tags set to a non-list value crashed the standard logging payload, so its spend row lost model attribution. * fix(proxy): keep router attribution and drop unauthenticated tags in proxy-only failure logs A request rejected before routing now logs the configured deployment and model group even when its metadata or litellm_metadata carries its own values. Requests rejected at auth no longer write caller tags into failure logs and tag spend. * fix(proxy): always strip client guardrail info and mirror failure attribution into litellm_metadata allow_client_pricing_override no longer keeps a caller-supplied standard_logging_guardrail_information on the chat or pass-through paths, since its guardrail_cost is billed. Proxy-only failure logs now also carry key and team attribution in litellm_metadata. * refactor(proxy): keep the proxy-only failure-log fixes inside the type gates Types the picked helpers so basedpyright and the type-discipline gate stay at main's counts. No runtime change. * fix(proxy): keep the WS frame guardrail-info strip and string interaction tags as sent The guardrail-info key left the pricing strip list, so the Responses WS frame guard now drops it by name. get_request_tags no longer raises on string tags, so background interaction polling checks for them before keeping them as sent. --------- Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com>		2026-10-27 12:40:59 -07:00
..
helpers	fix(proxy): list team access group models in /v1/model/info and keep key model lists narrow (#32599)	2026-10-15 10:23:03 -07:00
prisma_and_spend	fix(sso): enforce free user admission without locking out existing users (#48097)	2026-10-23 14:48:29 -07:00
proxy_logging	fix(security)!: build proxy-only failure logs from an allowlist and drop caller guardrail info (#48599)	2026-10-27 12:40:59 -07:00
__init__.py	test(proxy): move utils, agent_endpoints and endpoint tests into tests/unit/proxy (#44006)	2026-10-01 11:06:42 -07:00