yassin e02f19fdd9 fix(auth): exempt the reserved UI session team from the absent-team refusal ... Every Admin UI session key is stamped with team_id=litellm-dashboard, a reserved sentinel that /team/new refuses to create, so resolving it against the database can only fail. The absent-versus-unreadable distinction #36837 added read that as a deleted team and 404'd every dashboard request. Resolve the sentinel from the token instead of asking for a row that will never exist. The reserved id alone does not earn the exemption. The synthesized team's empty models reads as every model, so an identity that merely names the sentinel is widened rather than waved through, and several auth paths take team_id straight from data the proxy did not mint: JWT claims, an OAuth2 introspection response, a custom auth handler's return value. Rather than enumerate the producers to exclude, require proof of where the credential came from. A database-minted session key is already marked as a virtual key. The EXPERIMENTAL_UI_LOGIN blob has no key row, and a proxy-admin one returns before the virtual-key paths, so mark it where it is decrypted with the proxy's own ui_hash_key. Both markers are stripped from validated input, so no claim, header or handler return can carry one in. That leaves the id itself, which /team/new reserves but key creation did not, so a proxy admin could put an ordinary key on the sentinel team and it would inherit the exemption along with the skip of its owner's user-level model check. Reserve the id on the key create and update paths too. The UI mints its session key through generate_key_helper_fn directly, so it never passes through either one. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>		2026-08-14 16:43:17 -07:00
..
_experimental/mcp_server	fix(mcp): expose client HTTP headers to logging callbacks and hooks (#36724)	2026-08-13 20:07:16 -07:00
a2a	fix(a2a): reject malformed protocolVersion suffixes while keeping semver prereleases	2026-07-21 13:24:58 -07:00
agent_endpoints	fix(proxy): deny agent access when key and team grants resolve to nothing (#36221)	2026-08-07 20:44:11 +00:00
analytics_endpoints	feat(ui): split failed requests into their own series on the cache dashboard (#34862)	2026-07-29 09:48:17 -07:00
anthropic_endpoints	fix(types): correct annotations that were false about their runtime values	2026-08-06 04:37:48 +00:00
auth	fix(auth): exempt the reserved UI session team from the absent-team refusal	2026-08-14 16:43:17 -07:00
batches_endpoints	fix(proxy/batches): stop forwarding custom_llm_provider twice in list and cancel (#32813)	2026-08-13 12:50:32 -07:00
client	feat(cli): make the hidden lite command list configurable (#36816)	2026-08-13 17:23:03 -07:00
common_utils	fix(proxy): fail config load when a callbacks entry is not dispatchable (#36858)	2026-08-13 19:26:48 -07:00
config_resolvers	feat(proxy): add SAML 2.0 SSO for the admin UI (#31429)	2026-07-24 12:51:28 -07:00
credential_endpoints	fix(proxy): return the real status code when a credential update is rejected (#36166)	2026-08-07 08:02:52 +00:00
db	perf(spend-logs): bound retention cleanup so one run cannot saturate the database (#36594)	2026-08-13 18:56:37 -07:00
discovery_endpoints	test: remove tests that never execute	2026-08-12 10:45:38 -07:00
enterprise_billing	feat(proxy): push-based OTLP billable-request metering for enterprise deployments (#31592)	2026-07-15 12:12:52 -07:00
experimental/mcp_server
fine_tuning_endpoints	fix(proxy): authenticate managed ids before routing	2026-08-08 02:42:34 -07:00
google_endpoints	chore: litellm oss staging160626 (#30527)	2026-06-16 18:23:13 -07:00
guardrails	fix(guardrails): scan and re-emit raw Anthropic SSE streams in the bedrock post-call hook (#36598)	2026-08-13 07:23:49 +00:00
health_endpoints	fix(ui): treat router redis as configured for the no-redis banner	2026-08-11 02:40:14 +00:00
hooks	feat: pre-adoption shadow eval for the auto-router (blind pairwise judge, derived state) (#36587)	2026-08-13 13:15:45 -07:00
image_endpoints	fix(proxy)!: share one destination check between body and path-supplied model	2026-08-05 15:17:43 -07:00
logging_endpoints	feat(proxy): add POST /v1/callbacks/logs to replay logging payloads through callbacks (#31134)	2026-06-24 15:25:10 -07:00
management_endpoints	fix(auth): exempt the reserved UI session team from the absent-team refusal	2026-08-14 16:43:17 -07:00
management_helpers	fix(access groups): sync assigned_team_ids from the team write paths (#36825)	2026-08-14 04:45:36 +00:00
memory	fix(proxy): give proxy_admin_viewer read parity with proxy_admin (#35851)	2026-08-05 18:33:55 +00:00
middleware	feat(sgr): make the gateway middleware the source of truth for successful requests (#35717)	2026-08-05 12:40:47 -07:00
openai_files_endpoint	fix(proxy/batches): stop forwarding custom_llm_provider twice in list and cancel (#32813)	2026-08-13 12:50:32 -07:00
pass_through_endpoints	fix(proxy): track spend for OpenAI passthrough /v1/embeddings (#36660)	2026-08-13 20:48:16 -07:00
policy_engine	fix(policy_engine): warn that the config-defined policy reactivates when all DB versions are deleted	2026-07-30 19:48:35 -07:00
prompts	fix(proxy): give proxy_admin_viewer read parity with proxy_admin (#35851)	2026-08-05 18:33:55 +00:00
proxy_server	feat(proxy): serve Anthropic-native /v1/models for Claude Code gateway discovery (#35455)	2026-08-14 10:22:58 -07:00
public_endpoints	test: drop redundant explanatory comments from riva provider tests	2026-08-13 19:24:45 -07:00
rag_endpoints	fix(rag): track LLM completion usage and spend for /v1/rag/query (#32438)	2026-07-17 17:45:27 +00:00
realtime_endpoints	chore: litellm oss 170626 (#30637)	2026-06-17 21:11:12 -07:00
response_api_endpoints	feat(router): make routing groups callable as virtual models and list them in /v1/models (#36519)	2026-08-11 18:41:19 -07:00
shutdown	feat(proxy): native /health/drain preStop hook for graceful shutdown (#29439)	2026-06-02 16:30:44 -07:00
spend_tracking	fix(ptu): stop per-token billing on a PTU-configured deployment (#36829)	2026-08-13 20:16:12 -07:00
test_configs
types_utils	fix(proxy): resolve router_settings.plugins dotted paths and load plugins from installed packages (#33644)	2026-07-17 11:23:18 -07:00
ui_crud_endpoints	feat(ptu): gate PTU flat-cost attribution behind an opt-in env var (#36138)	2026-08-10 12:23:20 -07:00
utils	fix(mcp): expose client HTTP headers to logging callbacks and hooks (#36724)	2026-08-13 20:07:16 -07:00
vector_store_endpoints	feat(proxy): add GET /v1/indexes to list vector store indexes (#36289)	2026-08-10 15:09:59 -07:00
vector_store_files_endpoints	fix(proxy): authenticate managed ids before routing	2026-08-08 02:42:34 -07:00
video_endpoints	test(videos): add 1:1 test file scaffold for videos component paths (#30631)	2026-06-29 09:12:51 +05:30
__init__.py
conftest.py	test(proxy): stop monkeypatch.undo re-planting fixture-mocked prisma_client	2026-08-13 20:11:06 -07:00
test_aiohttp_cleanup_closed.py
test_aiohttp_session_recovery.py
test_api_key_masking_in_errors.py
test_audio_speech_prometheus_hooks.py	fix(proxy): extend response headers hook to streaming, TTS, image gen, and pass-through (#24232)	2026-06-09 22:10:23 +02:00
test_batch_expiry.py	fix(proxy): strip LiteLLM policy tracking from OpenAI batch metadata (#28425)	2026-05-26 11:35:42 -07:00
test_batch_metadata_none_fix.py
test_batch_retrieve_bedrock.py
test_batch_x_litellm_model_encoding.py	test(batches): move orphan tests into tests/test_litellm for CI coverage (#30510)	2026-06-16 10:20:59 -07:00
test_blocked_response_usage.py	feat: litellm oss staging (#31935)	2026-07-03 09:27:31 +05:30
test_budget_reservation.py	feat(proxy): add apply_user_budget_to_team_keys opt-in (#36102)	2026-08-07 15:40:13 +00:00
test_caching_routes.py	Litellm oss staging 040626 (#29671)	2026-06-04 11:07:20 -07:00
test_chat_completion_metadata.py
test_common_request_processing.py	fix(proxy): resolve the global SSE keepalive interval through the per-deployment engine	2026-08-11 23:37:43 -07:00
test_component_allowlists.py	fix(gateway): keep the Prometheus /metrics Mount in the gateway route trim (#32317)	2026-07-07 18:36:38 +03:00
test_conftest.py	test(proxy): stop monkeypatch.undo re-planting fixture-mocked prisma_client	2026-08-13 20:11:06 -07:00
test_cors_config.py
test_custom_proxy.py
test_dynamic_mcp_route.py	Litellm oss staging 040626 (#29671)	2026-06-04 11:07:20 -07:00
test_empty_model_list.py
test_enforce_user_param.py
test_fallback_management_endpoints.py
test_fastapi_offline_routes.py
test_filter_models_by_team_access_group.py	fix: resolve access group names in _filter_models_by_team_id (#25224)	2026-05-01 11:55:36 +05:30
test_health_check_functions.py	feat(proxy): skip disable_background_health_check models on GET /health when flag set (#27716)	2026-05-13 09:49:05 -07:00
test_health_check_max_tokens.py	fix: skip health check for semantic auto_router deployments (#31668)	2026-06-29 19:47:20 -07:00
test_langfuse_passthrough_security.py
test_lazy_openapi_snapshot.py	feat(proxy): add GET /v1/indexes to list vector store indexes (#36289)	2026-08-10 15:09:59 -07:00
test_litellm_pre_call_utils.py	feat(proxy): per-key prompt caching toggle via enable_prompt_caching (#36466)	2026-08-11 11:53:11 -07:00
test_max_budget_env_var.py
test_mcp_asgi_response.py	fix(mcp): surface upstream 401 for token-forwarding MCP servers (#27847)	2026-05-13 12:03:36 -07:00
test_model_based_routing_files_batches.py	test(batches): move orphan tests into tests/test_litellm for CI coverage (#30510)	2026-06-16 10:20:59 -07:00
test_model_dump_with_preserved_fields.py
test_model_id_header_propagation.py	feat(proxy): add x-litellm-model-name response header with deployment model string (#33698)	2026-07-17 20:29:42 -07:00
test_model_info_default_limits.py	fix(proxy): align /v1/model/info with router deployments (#30025)	2026-06-10 19:38:21 -07:00
test_model_level_guardrails.py	fix(proxy): apply key/team router_settings.model_group_alias (#35486)	2026-08-03 22:09:47 +00:00
test_model_list_healthy_only.py	feat: litellm oss 110626 (#30202)	2026-06-11 22:30:26 -07:00
test_modify_response_streaming_passthrough.py	fix(proxy): use e.request_data for logging_obj in ModifyResponseException streaming passthrough (#30800)	2026-06-18 23:29:08 -07:00
test_openapi_schema_validation.py	fix(proxy): preserve HTTP operations when injecting WebSocket stubs into OpenAPI schema	2026-05-06 00:28:42 +02:00
test_plugin_routes.py	feat: litellm plugin architecture v2 (#30688)	2026-06-20 20:37:22 -07:00
test_pricing_field_strip.py	chore: litellm oss staging160626 (#30527)	2026-06-16 18:23:13 -07:00
test_prometheus_cleanup.py
test_provider_url_destination_guard.py	fix(proxy)!: share one destination check between body and path-supplied model	2026-08-05 15:17:43 -07:00
test_proxy_cli.py	feat(proxy): bound DB statement and lock time via general_settings (#35496)	2026-08-01 13:54:17 -07:00
test_proxy_logging_hook_detection.py	fix(proxy): recognize inherited apply_guardrail overrides and keep masking guardrails on their own stream hook	2026-07-30 15:33:49 -07:00
test_proxy_server.py	perf(spend-logs): bound retention cleanup so one run cannot saturate the database (#36594)	2026-08-13 18:56:37 -07:00
test_proxy_types.py	fix(proxy): allow /key/update to identify the key by key_alias (#34851)	2026-07-29 09:48:08 -07:00
test_proxy_utils.py	fix(proxy): add config_updated_at audit timestamp for virtual keys (#36488)	2026-08-11 11:02:57 -07:00
test_pyroscope.py	Implement normalize_nonempty_secret_str function to trim whitespace from secrets and treat empty values as unset. Update proxy_server to use this function for Grafana credentials. Enhance tests to validate the new normalization behavior.	2026-05-04 18:17:31 +00:00
test_read_model_list.py	feat: add minimal rust router + axum ai-gateway calling router.realtime (2/2) (#31135)	2026-06-23 19:16:34 -07:00
test_redis_auth_cache_flag.py	fix(proxy): share CLI SSO login sessions across workers without enable_redis_auth_cache (#33261)	2026-07-22 10:29:34 -07:00
test_response_model_sanitization.py	perf: eliminate per-request callback scanning on proxy hot path (#27858)	2026-05-14 09:28:31 -07:00
test_route_a2a_models.py	feat(router): make routing groups callable as virtual models and list them in /v1/models (#36519)	2026-08-11 18:41:19 -07:00
test_route_llm_request.py	feat(router): make routing groups callable as virtual models and list them in /v1/models (#36519)	2026-08-11 18:41:19 -07:00
test_sensitive_route_auth.py
test_shared_health_check.py	feat(proxy): skip disable_background_health_check models on GET /health when flag set (#27716)	2026-05-13 09:49:05 -07:00
test_spend_log_cleanup.py	perf(spend-logs): bound retention cleanup so one run cannot saturate the database (#36594)	2026-08-13 18:56:37 -07:00
test_swagger_chat_completions.py
test_team_member_update.py	feat(ui): add budget duration to edit team member form (#29717)	2026-06-06 17:24:55 -07:00
test_team_org_move.py
test_tools_allowlist_enforcement.py	fix(responses-bridge): custom tool round-trip and allowlist preservation for Codex CLI (#32258)	2026-07-06 17:34:27 -07:00
test_update_llm_router_resilience.py	fix(proxy): stop model writes 500ing on another pod's delete (#35400)	2026-07-31 18:10:48 -07:00