* feat: initial commit with prompt management support on pre-call hooks
allows prompt templates to work before assigning specific models
* feat: initial logic for independent prompt management settings
* feat(proxy_server.py): working logic for loading in the prompt templates from config yaml
allows creating an independent 'prompts' section in the config yaml
* feat(prompt_registry.py): working e2e custom prompt templates with guardrails and models
* refactor(prompts/): move folder inside proxy folder
easier management for prompt endpoints
* feat(prompt_endpoints.py): working `/prompt/list` endpoint
returns all available prompts on proxy
* feat(key_management_endpoints.py): support storing 'prompts' in key metadata
allows giving keys access to specific prompts
* feat(prompt_endpoints.py): enable key-based access to /prompts/list
ensures key can only see prompts it has access to
* fix(init_prompts.py): fix linting error
* fix: fix ruff check
* fix(proxy/_types.py): add 'prompts' to newteamrequest
* fix(litellm_logging.py): update logged message with scrubbed value
* feat: initial commit with prompt management support on pre-call hooks
allows prompt templates to work before assigning specific models
* feat: initial logic for independent prompt management settings
* feat(proxy_server.py): working logic for loading in the prompt templates from config yaml
allows creating an independent 'prompts' section in the config yaml
* feat(prompt_registry.py): working e2e custom prompt templates with guardrails and models
* refactor(prompts/): move folder inside proxy folder
easier management for prompt endpoints
* fix: fix linting error
* fix: fix check
- Add extra_headers handling to hosted_vllm/openai_like embedding providers
- Matches existing pattern used in OpenAI embeddings section
- Fixes issue where custom headers were dropped for vLLM embedding requests
Fixes#13088
* fix(bedrock): prevent duplicate role assumption in EKS/IRSA environments
Fixes issue where AWS role assumption would fail in EKS/IRSA environments
when trying to assume the same role that's already being used.
The problem occurred when:
1. EKS/IRSA automatically assumes a role (e.g., LitellmRole)
2. LiteLLM tries to assume the same role again, causing AccessDenied errors
3. Different models with different roles would fail due to incorrect role context
Changes:
- Added check in _auth_with_aws_role() to detect if already using target role
- Skip role assumption if current identity matches target role
- Return current credentials instead of attempting duplicate assumption
- Added comprehensive test coverage for the fix
This ensures proper role chaining works in EKS/IRSA environments where:
- Service Account can assume Role A
- Role A can assume Role B for different models/accounts
Resolves the AccessDenied errors reported in bedrock usage scenarios.
* fix(bedrock): simplify role assumption for EKS/IRSA environments
Fixes AWS Bedrock role assumption in EKS/IRSA environments by properly
handling ambient credentials when no explicit credentials are provided.
The issue occurred because commit 197e7efa8f
introduced changes that broke role assumption in EKS/IRSA environments.
Changes:
- Simplified _auth_with_aws_role() to use ambient credentials when no
explicit AWS credentials are provided (aws_access_key_id and
aws_secret_access_key are both None)
- This allows web identity tokens in EKS/IRSA to work automatically
through boto3's credential chain
- Maintains backward compatibility for explicit credential scenarios
Added comprehensive test coverage:
- test_eks_irsa_ambient_credentials_used: Verifies ambient credentials work
- test_explicit_credentials_used_when_provided: Ensures explicit creds still work
- test_partial_credentials_still_use_ambient: Edge case handling
- test_cross_account_role_assumption: Multi-account scenarios
- test_role_assumption_with_custom_session_name: Custom session names
- test_role_assumption_ttl_calculation: TTL calculation verification
- test_role_assumption_error_handling: Error propagation
- test_multiple_role_assumptions_in_sequence: Sequential role assumptions
This fix ensures that in EKS/IRSA environments:
1. Service accounts can assume their initial role via web identity
2. That role can then assume other roles across accounts as configured
3. Different models can use different roles without conflicts
* fix(bedrock): add automatic IRSA detection for EKS environments
- Detect AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN environment variables
- Automatically use web identity token flow when IRSA is detected
- Read web identity token from file and pass to existing auth method
- Add test coverage for IRSA environment detection
- Fixes authentication errors in EKS with IRSA when no explicit credentials provided
* fix(bedrock): skip role assumption when IRSA role matches requested role
- Detect when AWS_ROLE_ARN environment variable matches the requested role
- Skip unnecessary role assumption when already running as the target role
- Use existing env vars authentication method for IRSA credentials
- Add test coverage for same-role IRSA scenario
- Fixes 'not authorized to perform: sts:AssumeRole' errors when trying to assume the same role
* fix(bedrock): use boto3's native IRSA support for cross-account role assumption
- Replace custom web identity token handling with boto3's built-in IRSA support
- boto3 automatically reads AWS_WEB_IDENTITY_TOKEN_FILE and assumes initial role
- Then use standard assume_role for cross-account access
- Update test to mock boto3 STS client instead of internal methods
- Fixes 'OIDC token could not be retrieved from secret manager' error
* fix(bedrock): improve IRSA error handling and add debug logging
- Add debug logging to show current identity and role assumption attempts
- Provide clearer error messages for trust policy issues
- Fix region handling in IRSA flow
- Re-raise exceptions instead of silently falling through
- This helps diagnose cross-account role assumption permission issues
* fix(bedrock): manually assume IRSA role with correct session name for cross-account scenarios
- When doing cross-account role assumption, manually assume the IRSA role first with the desired session name
- This ensures the session name in the assumed role ARN matches what's expected in trust policies
- For same-account scenarios, continue using boto3's automatic IRSA support
- Updated tests to handle the new flow
- This fixes the issue where cross-account trust policies require specific session names
* fix: Fix linting issues in base_aws_llm.py
- Fix f-string without placeholders (F541)
- Refactor _auth_with_aws_role to reduce statements count (PLR0915)
- Extract _handle_irsa_cross_account helper method
- Extract _handle_irsa_same_account helper method
- Extract _extract_credentials_and_ttl helper method
---------
Co-authored-by: openhands <openhands@all-hands.dev>
* advancedatepicker for tag usage and team usage
* reduce white space in date picker
* selected time range option is visible
* dont wait for apply button to select relative time options
* qa - agents
* refactored WAU, MAU and DAU endpoints
* fixes for dau, wau, mau
* use stack=true
* fixes for DAU calc
* fixes for rendering WAU, MAU
* use 1 section for topline
* Fixes for endpoint
* remove filter
* fix spacing
* fix activity
* working UI rendering
* fixes for chart data
* allow selecting specific tags
* add DistinctTagResponse endpoints
* use wide selector
* add types
* fixes for UI rendering
* get_per_user_analytics
* add openssl in apk install in runtime stage in dockerfile.non_rootdocker-compose logs -f litellm
* Improve Docker-compose.yaml for local debugging
---------
Co-authored-by: Krish Dholakia <krrishdholakia@gmail.com>
* fix(guardrails): Fix PANW Prisma AIRS post-call hook method name
- Changed async_post_call_hook to async_post_call_success_hook to match proxy calling convention
- Added event_hook parameter to initialization to ensure proper hook registration
- Fixes post-call response scanning for PANW Prisma AIRS guardrails
Resolves issue where post-call hooks were not being invoked due to method name mismatch.
* Update PANW Prisma AIRS tests to use correct method name
* fix(router.py): add acompletion_streaming_iterator inside router
allows router to catch errors mid-stream for fallbacks
Work for https://github.com/BerriAI/litellm/issues/6532
* fix(router.py): working mid-stream fallbacks
* fix(router.py): more iterations
* fix(router.py): working mid-stream fallbacks with fallbacks set on router
* fix(router.py): pass prior content back in new request as assistant prefix message
* fix(router.py): add a system prompt to help guide non-prefix supporting models to use the continued text correctly
* fix(common_utils.py): support converting `prefix: true` for non-prefix supporting models
* fix: reduce LOC in function
* test(test_router.py): add unit tests for new function
* test: add basic unit test
* fix(router.py): ensure return type of fallback stream is compatible with CustomStreamWrapper
prevent client code from breaking
* fix: cleanup
* test: update test
* fix: fix linting error
* fix(router.py): return combined usage
ensures accurate usage tracking on clientside for stream w/ fallbacks
* fix(router.py): add acompletion_streaming_iterator inside router
allows router to catch errors mid-stream for fallbacks
Work for https://github.com/BerriAI/litellm/issues/6532
* fix(router.py): working mid-stream fallbacks
* fix(router.py): more iterations
* fix(router.py): working mid-stream fallbacks with fallbacks set on router
* fix(router.py): pass prior content back in new request as assistant prefix message
* fix(router.py): add a system prompt to help guide non-prefix supporting models to use the continued text correctly
* fix(common_utils.py): support converting `prefix: true` for non-prefix supporting models
* fix: reduce LOC in function
* test(test_router.py): add unit tests for new function
* test: add basic unit test
* fix(router.py): ensure return type of fallback stream is compatible with CustomStreamWrapper
prevent client code from breaking
* fix: cleanup
* test: update test
* fix: fix linting error
* fix(router.py): safe deep copy kwargs
OTEL adds a parent_otel_span which cannot be deepcopied
* fix: use safe deep copy in other places as well
* test: add script to check and ban copy.deepcopy of kwargs
enforce safe_deep_copy usage
* build(ui/): new component for adding model group alias on UI
* fix(proxy_server.py): support updating model_group_alias via /config/update
allows ui component to work
* fix(router.py): update model_group_alias in router settings based on db value
* fix: fix code qa error
