mirror of
https://github.com/BerriAI/litellm.git
synced 2026-10-12 03:48:56 +00:00
4a963a6c0b
Some checks failed
CI Coverage / assert-ci-coverage (push) Waiting to run
CodeQL / Analyze (actions) (push) Waiting to run
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
CodeQL / Analyze (python) (push) Waiting to run
CodSpeed Benchmarks / benchmarks (push) Waiting to run
Helm unit test / unit-test (push) Waiting to run
Lens Worker Image / lens-worker-image (push) Waiting to run
Publish basedpyright base counts / publish (push) Waiting to run
Scorecard supply-chain security / Scorecard analysis (push) Waiting to run
Code Quality Checks / code-quality (push) Waiting to run
Code Quality Checks / python-310-import-smoke (push) Waiting to run
UI Unit Tests / ui-unit-tests (push) Waiting to run
LiteLLM Rust / rust-lint (push) Waiting to run
LiteLLM Rust / rust-test (push) Waiting to run
LiteLLM Rust / rust-wheel (push) Waiting to run
Unit Tests: Documentation Validation / documentation (push) Waiting to run
Unit Tests: Proxy DB Operations / assert-shard-coverage (push) Waiting to run
Unit Tests: Proxy DB Operations / auth-checks (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / budgets (push) Blocked by required conditions
Unit Tests / Build the Rust bridge (push) Waiting to run
Unit Tests / caching-local (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / custom-logging (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / db-and-spend (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / endpoints-and-responses (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / guardrails-hooks (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / jwt-and-keys (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / key-generation (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / logging-misc (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / proxy-runtime (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / proxy-server-core (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / proxy-utils (push) Blocked by required conditions
Unit Tests / core-utils (push) Blocked by required conditions
Unit Tests / enterprise-managed-files (push) Blocked by required conditions
Unit Tests / enterprise-package (push) Blocked by required conditions
Unit Tests / enterprise-routing (push) Blocked by required conditions
Unit Tests / integrations (push) Blocked by required conditions
Unit Tests / OpenAI and Meta Providers (push) Blocked by required conditions
Unit Tests / All Other Providers (push) Blocked by required conditions
Unit Tests / Vertex AI (push) Blocked by required conditions
Unit Tests / misc (push) Blocked by required conditions
Unit Tests / misc-dirs (push) Blocked by required conditions
Unit Tests / proxy-auth (push) Blocked by required conditions
Unit Tests / proxy-endpoints (push) Blocked by required conditions
Unit Tests / proxy-extras (push) Blocked by required conditions
Unit Tests / proxy-feature-endpoints (push) Blocked by required conditions
Unit Tests / proxy-hooks-client (push) Blocked by required conditions
Unit Tests / proxy-infra (push) Blocked by required conditions
Unit Tests / proxy-infra-root (push) Blocked by required conditions
Unit Tests / proxy-server (push) Blocked by required conditions
Unit Tests / responses-caching-types (push) Blocked by required conditions
Unit Tests / unit (push) Blocked by required conditions
GitHub Actions Security Analysis / zizmor (push) Waiting to run
VS Code Extension / vscode-extension (push) Has been cancelled
* fix(proxy): judge the free-model budget waiver by the group an alias routes to A hidden model_group_alias can reuse the name of a real model_name. The router serves that name from the alias target, but two of the three checks behind the free-model budget waiver read the deployments of both the alias target and the real model that shares the name. So an over-budget key was served through an alias whose name belongs to a model with an explicit $0 price when the target is $0 only by the cost map, which the same key is refused on by its own name. The mirror case refused a free target because the shadowed name belongs to a PTU-priced deployment. Resolve the alias once and have the explicit-cost and PTU checks read the routed group, the same group the price check already reads. * test(proxy): cover the plain alias form of a shadowed free model name The same wrong verdict exists for a plain string alias, so the unpriced-target case now runs for both alias shapes. * fix(proxy): judge an alias chain's budget waiver by the deployments it is served from The explicit-price and PTU checks read the alias target through Router.get_model_list(), which follows a second alias hop when the target is itself an alias key. The router never takes that hop, so an alias chain was judged by a deployment the request never reaches. The checks now take the deployments named after the routed group, or the wildcard deployment serving it when none carries its name. * fix(proxy): refuse the budget waiver when an alias chain is served by a priced wildcard route * test(integration): cover the shadowing alias budget gate end to end Adds the audit cells for a hidden alias whose name shadows an explicitly free group: streamed SDK refusals on chat, responses and messages, embeddings, the free wildcard and mixed-group paths, per-model budgets, JWT and custom auth callers, cache hits, alias removal under traffic, provider failure and fallback, a concurrent outage burst, and a worker kill on an owned two-worker proxy * test(integration): cite the cost-map rows the shadowing alias cells rely on --------- Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| _guardrail_opt_out.py | ||
| _hidden_alias_budget.py | ||
| test_access_group_model_listing.py | ||
| test_audit_any_sweep_auth.py | ||
| test_bedrock_passthrough_model_access.py | ||
| test_cli_sso_login_ui_disabled.py | ||
| test_customer_model_allowlist.py | ||
| test_deprecated_key_lookup_cache.py | ||
| test_hidden_alias_budget_bypass.py | ||
| test_hidden_alias_budget_bypass_chaos.py | ||
| test_jwt_auto_register_map_existing_key.py | ||
| test_jwt_default_team_provisioning.py | ||
| test_jwt_mapped_key_email_backfill.py | ||
| test_key_alias_model_access.py | ||
| test_key_bound_to_unknown_user.py | ||
| test_key_guardrail_opt_out.py | ||
| test_key_guardrail_opt_out_chaos.py | ||
| test_key_guardrail_opt_out_runtime.py | ||
| test_object_permission_lookup.py | ||
| test_rag_query_vector_store_allowlist.py | ||
| test_team_admin_gate.py | ||
| test_team_member_permissions.py | ||
| test_team_scoped_models.py | ||
| test_warmed_policy.py | ||
| test_wildcard_model_access.py | ||