mirror of
https://github.com/BerriAI/litellm.git
synced 2026-08-28 05:25:59 +00:00
84266bf924
Introduce a single, typed caller identity that is resolved once at the auth boundary and read by reference downstream, instead of being re-derived from a 50-field key object or rebuilt from request metadata. What this adds (litellm/proxy/auth/resolvers/), organized by responsibility: - Principal: a small, frozen, identity-only value type (user / organization / teams / project / end-user / roles / scopes / network), with its sub-models and the role mapping. No budget or policy state; those stay on the key object. - DbIdentityStore: the auth flow's resolver, owning both halves of resolving a caller. resolve_key does the one combined_view lookup (cache, then DB via the shared lower-level helpers, then write-back) and returns the key object, which still flows for budget / rate-limit / policy unchanged. principal_from_key projects the identity slice of that key object into a Principal, issuing no lookup. user_api_key_auth resolves every key through the store rather than calling get_key_object directly; auth_checks.get_key_object stays as the legacy entrypoint for its other callers until they migrate. - network: the X-Forwarded-For / trusted-proxy CIDR primitives live here in one place. trusted_proxy_utils now imports them rather than keeping a second copy. At the seam, user_api_key_auth projects one per-request Principal off the resolved key object and stamps the request network context onto it once (X-Forwarded-For is trusted only when trusted_proxy_ranges is configured). It is attached to request.state.principal for the downstream consumers later phases add. The projection is additive and defensive: a failure never rejects an already-authenticated request, and a missing principal must be treated as deny by any future reader. The Principal is always identifiable (credential_ref and a stable subject off the token), never anonymous. This is additive and changes no behavior today; it is the identity foundation the spend-attribution and authorization phases build on. |
||
|---|---|---|
| .. | ||
| adaptive_router_demo | ||
| health_check | ||
| benchmark_anthropic_messages_perf.py | ||
| benchmark_chat_completions_perf.py | ||
| benchmark_mock.py | ||
| benchmark_model_response_creator.py | ||
| benchmark_proxy_vs_provider.py | ||
| benchmark_streaming_chunk_overhead.py | ||
| budget_ratchet_check.py | ||
| check_type_discipline.py | ||
| create_litellm_branch.ps1 | ||
| create_litellm_branch.sh | ||
| create_team_key_and_submit_guardrail.sh | ||
| eval_compression.py | ||
| install-cli.sh | ||
| install.sh | ||
| install_git_hooks.sh | ||
| mock_bedrock_passthrough_target.py | ||
| mock_grayswan_timeout_server.py | ||
| mutation_report.py | ||
| ruff_strict_gate.py | ||
| test_agent_mcp_endpoints.sh | ||
| test_guardrails_register_endpoints.sh | ||
| test_tool_allowlist_script.py | ||
| tpm_headline_test.sh | ||
| type_check_gate.py | ||
| type_discipline_gate.py | ||
| verify_adaptive_router.py | ||