Shivam Rawat dc4f5b12ef fix(proxy): enforce allowed_passthrough_routes for auth=true pass-thr… (#29256) ... * fix(proxy): enforce allowed_passthrough_routes for auth=true pass-through Pass-through endpoints with auth=true were injected into openai_routes, so teams with openai_routes access bypassed per-team allowed_passthrough_routes. Gate auth-enforced pass-through at JWT, virtual-key, and non-admin route checks. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(proxy): clarify JWT passthrough denial Co-authored-by: Cursor <cursoragent@cursor.com> * fix(proxy): make pass-through auth checks method-aware Prevent allowlist bypass when the same path is registered with different auth settings per HTTP method. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix passthrough route auth checks * fix(proxy): reject unregistered pass-through HTTP methods Enforce method-aware JWT checks and return 405 when stale FastAPI routes accept requests outside the current pass-through registry. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(proxy): remove duplicate request_method in JWT team lookup Fixes SyntaxError on proxy startup caused by passing request_method twice to find_team_with_model_access. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix passthrough route auth enforcement * fix(proxy): raise passthrough-specific 403 directly in virtual-key path * fix(proxy): load team for RBAC role-claim JWT passthrough gating * Revert "chore(tests): migrate Bedrock CI to AWS account 941277531214 (#28728)" (#29326) This reverts the Bedrock CI account migration (#28728). The original account (888602223428) was put under an AWS security restriction after a leaked key and has since been reactivated, while the replacement account (941277531214) lacks access to several models the suites exercise (legacy Bedrock Claude 3 models, Cohere, Nova Canvas image gen, Bedrock batch inference, and flagship Opus). Pointing CI back at the reactivated account restores that coverage. This is the exact inverse of #28728: all hardcoded 941277531214 references go back to 888602223428 (provisioned/imported-model ARNs, AgentCore runtime ARNs and their suffixes, batch execution role ARN, and the example proxy config), the S3 buckets revert to litellm-proxy and load-testing-oct, the guardrail IDs revert to wf0hkdb5x07f and ff6ujrregl1q, the SageMaker endpoint and Knowledge Base revert to their original ids, and the live-call tests go back to the legacy model strings. The grid_spec fail_reason workaround for the unentitled Opus cells is dropped while keeping the unrelated bedrock_effort_ceiling field added after the migration. The CircleCI AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars still point at 941277531214 and must be set to the reactivated account's fresh credentials separately via the CircleCI API; AWS_REGION_NAME stays us-west-2. (cherry picked from commit f11c12d157) * fix(proxy): scope pass-through 405 to registry routes; grant rerank passthrough in rpm tests The auth=true pass-through 405 guard fired for mapped provider routes (e.g. /assemblyai/*) that are not in the in-memory registry, since get_registered_pass_through_route returns None for them while is_registered_pass_through_route matches via mapped_pass_through_routes. Only raise 405 when the path is registered but the request method is not allowed, so mapped provider pass-throughs fall through to the default target params as before. The rpm-limit pass-through tests register /v1/rerank with auth=true but gave their keys no allowed_passthrough_routes, so the new default-deny returned 403 before the rate limiter ran (non-deterministically, depending on registry insertion order). Grant the keys explicit passthrough access so the tests exercise rate limiting under the new auth model. * fix(proxy): guard request method lookup against scopes without a method Starlette's Request.method property reads scope["method"] and raises KeyError when the scope omits it (e.g. minimally-constructed test requests). getattr only swallows AttributeError, so the new _get_request_method helper propagated the KeyError up through user_api_key_auth and surfaced as a ProxyException. Catch KeyError (and AttributeError) and fall back to None. * test(passthrough): pin SERVER_ROOT_PATH in unregistered-method test test_custom_proxy.py sets os.environ['SERVER_ROOT_PATH'] = '/my-custom-path' at module import with no cleanup. When that module is collected into the same xdist worker as this test, the leaked root path is prepended to registered pass-through paths, so is_registered_pass_through_route misses '/test/path' and the handler returns 404 instead of the expected 405 (order-dependent). Pin SERVER_ROOT_PATH to '' so the test is deterministic. * test(passthrough): restore regression coverage for non-auth-enforced pass-through via llm_api_routes * fix(proxy): record auth flag in pass-through registry for allowlist enforcement Auth-enforced pass-through detection inferred enforcement from the FastAPI dependency stored at registration time. The management create and update endpoints register routes with dependencies=None even though auth defaults to true, so is_auth_enforced_pass_through_route treated those DB-created routes as unenforced. A key allowed for llm_api_routes could then call a management-created auth-enabled pass-through route without matching allowed_passthrough_routes. Store the auth setting on each registry entry and read it directly when deciding whether the allowlist applies, instead of deriving it from dependency metadata. * fix(proxy): include bool in pass-through registry value type for auth flag The auth flag stored in _registered_pass_through_routes is a bool, which was not part of the registry value Union, so mypy rejected the dict literal. Add bool to the Union and narrow route_methods to a list before the membership check so the in-operator stays valid. * fix(proxy): preserve stored auth flag on pass-through endpoint update model_dump(exclude_none=True) re-included the auth=True default whenever a partial update omitted auth, silently flipping an existing auth=false pass-through to auth-enforced and 403ing every team/key without allowed_passthrough_routes. Merge only explicitly set fields via exclude_unset so omitted fields keep their stored value. --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com>		2026-05-30 17:07:24 -07:00
..
llm_provider_handlers	perf: reduce per-request and per-chunk overhead across Anthropic streaming hot paths (#28289)	2026-05-23 12:15:59 -07:00
test_llm_pass_through_endpoints.py	fix(vertex passthrough): log :embedContent and :batchEmbedContents responses (#26146)	2026-04-24 16:07:11 -07:00
test_method_specific_routing.py	style: run black formatter on files from main merge	2026-04-17 13:02:59 -07:00
test_pass_through_endpoints.py	fix(proxy): enforce allowed_passthrough_routes for auth=true pass-thr… (#29256)	2026-05-30 17:07:24 -07:00
test_passthrough_auth_default.py	fix(passthrough): default auth=True; drop enterprise gate on the safe option	2026-04-29 23:10:59 +00:00
test_passthrough_endpoints_common_utils.py	style: run black formatter on files from main merge	2026-04-17 13:02:59 -07:00
test_passthrough_guardrails.py	style: run black formatter on files from main merge	2026-04-17 13:02:59 -07:00
test_passthrough_guardrails_field_targeting.py	style: run black formatter on files from main merge	2026-04-17 13:02:59 -07:00
test_passthrough_post_call_guardrails.py	fix(proxy): invoke post-call guardrails on pass-through endpoint responses (#20270) (#26262)	2026-04-27 08:58:22 +05:30
test_streaming_handler_interrupt.py	refactor: trim explanatory comments from streaming-flush fix	2026-04-30 02:39:28 +00:00
test_vertex_ai_batch_passthrough.py	fix(vertex-ai): fix zero cost/usage on completed Vertex AI batch jobs (#27912)	2026-05-15 04:47:02 -07:00
test_vertex_passthrough_load_balancing.py	fix(proxy): Bedrock Knowledge Base pass-through: preserve SigV4 headers and signed request body (#27526)	2026-05-25 19:21:55 +05:30