mirror of
https://github.com/BerriAI/litellm.git
synced 2026-10-16 04:29:31 +00:00
ea777eb21b
* fix(auth): return a generic 401 for an unknown key The wrong-key 401 shipped the internal verification table name and the submitted key's full SHA-256 hash to any unauthenticated caller. Both now go to the proxy's own log and the response carries only "Invalid API key provided." The Admin UI detected a dead session by string-matching that message, so it now reads the structured error type instead. * Update ui/litellm-dashboard/src/lib/http/client.ts Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * fix(auth): log the missing key hash where every resolve path passes Review catch: JWT key-mapping misses resolve through IdentityStore without touching the main key path, so logging the hash there left those callers with nothing but the generic 401. Log it at the store's raise site instead, which every resolve path shares, and drop the now-duplicate log. * test(auth): inject a key-less client instead of patching the DB fetch The store test tripped TQ008 by patching _fetch_key_object_from_db_with_reconnect. Hand IdentityStore a client whose get_data returns no row instead, so the miss is driven through the real lookup rather than around it. * fix(auth): log the unknown key's hash once on the auth failure line The per-lookup warnings in get_key_object and IdentityStore logged whatever value they were handed, which on the failure-logging path is the raw key a caller sent (a provider key included), let a newline in ?key= forge log lines, and fired on lookups that expect a miss. The hash now rides KeyNotFoundError onto the single existing auth failure log line next to the requester IP, with control characters escaped. Also drops the new comments and updates skipped tests that quoted the old message. * test(auth): add the blank lines ruff format expects before _InFlightCountingPrisma * test(integration): expect the generic wrong-key 401 in the management lifecycle tests * fix(auth): keep the operator wording on the unknown-key log line and drop the redundant 401 rewrite * test(auth): cover the generic unknown-key 401 across routes, proxies, and a worker kill * test(auth): cover the realtime upgrade refusing an unknown key without echoing it --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| _guardrail_opt_out.py | ||
| _hidden_alias_budget.py | ||
| _responses_compact.py | ||
| test_access_group_budget.py | ||
| test_access_group_model_listing.py | ||
| test_agent_access.py | ||
| test_alias_chain_budget_waiver.py | ||
| test_audio_model_access.py | ||
| test_audit_any_sweep_auth.py | ||
| test_auth_object_prefetch.py | ||
| test_bedrock_passthrough_model_access.py | ||
| test_claude_code_gateway_oauth.py | ||
| test_cli_sso_login_ui_disabled.py | ||
| test_customer_model_allowlist.py | ||
| test_deprecated_key_lookup_cache.py | ||
| test_end_user_block.py | ||
| test_guardrail_submissions.py | ||
| test_hidden_alias_budget_bypass.py | ||
| test_hidden_alias_budget_bypass_chaos.py | ||
| test_jwt_auto_register_map_existing_key.py | ||
| test_jwt_default_team_provisioning.py | ||
| test_jwt_key_mapping_lifecycle.py | ||
| test_jwt_mapped_key_email_backfill.py | ||
| test_key_alias_model_access.py | ||
| test_key_bound_to_unknown_user.py | ||
| test_key_guardrail_opt_out.py | ||
| test_key_guardrail_opt_out_chaos.py | ||
| test_key_guardrail_opt_out_runtime.py | ||
| test_memory_ownership.py | ||
| test_model_access_allow_lists.py | ||
| test_object_permission_lookup.py | ||
| test_passthrough_route_denylist.py | ||
| test_rag_query_vector_store_allowlist.py | ||
| test_realtime_client_secret_access.py | ||
| test_responses_compact_id_ownership.py | ||
| test_responses_compact_id_ownership_chaos.py | ||
| test_responses_id_ownership.py | ||
| test_search_tool_allowlist.py | ||
| test_search_tool_deny_by_default.py | ||
| test_sso_blank_identity.py | ||
| test_team_admin_gate.py | ||
| test_team_member_permissions.py | ||
| test_team_scoped_models.py | ||
| test_tool_search_replay_allowlist.py | ||
| test_tool_search_replay_guardrails.py | ||
| test_unknown_key_generic_401.py | ||
| test_user_self_update_guard.py | ||
| test_warmed_policy.py | ||
| test_websocket_rejection_logging.py | ||
| test_wildcard_model_access.py | ||
| test_workflow_ownership.py | ||