3 people 7ca796beb1 fix(proxy): restrict vector store index create/delete to proxy admins (#29202) ...

* fix(proxy): restrict vector store index create/delete to proxy admins

Prevent non-admin API keys from registering indexes via POST /v1/indexes or deleting Azure AI Search indexes through managed pass-through routes.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(proxy): tighten vector store index lifecycle checks

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-05-30 15:10:21 -07:00

..

_experimental/mcp_server

refactor(proxy/auth): normalize Bearer prefix in safe-hash helper (#29343)

2026-05-30 14:04:22 -07:00

a2a

feat(a2a): well-known agent-card discovery + LangGraph Platform mode (#28860)

2026-05-29 20:50:42 -07:00

agent_endpoints

feat(a2a): well-known agent-card discovery + LangGraph Platform mode (#28860)

2026-05-29 20:50:42 -07:00

anthropic_endpoints

…

auth

fix(proxy): enforce tag budgets for key-level tags (#29108)

2026-05-28 11:39:02 -07:00

client

fix: scope CLI stored token to base_url to prevent cross-domain credential leakage (#26945)

2026-05-01 12:11:32 -07:00

common_utils

fix(proxy): strip LiteLLM policy tracking from OpenAI batch metadata (#28425)

2026-05-26 11:35:42 -07:00

db

feat: add componentized proxy deployment with gateway, backend, ui, and migrations (#27557)

2026-05-16 09:25:17 -07:00

discovery_endpoints

…

experimental/mcp_server

…

google_endpoints

Gemini managed agents support (#28270)

2026-05-19 16:02:03 -07:00

guardrails

fix(guardrails): return HTTP 400 for litellm content filter blocks (#28418)

2026-05-30 14:28:46 -07:00

health_endpoints

fix(proxy): expose db status on public /health/readiness

2026-05-13 13:02:38 -07:00

hooks

fix(proxy): map stripped batch body.model to proxy alias for auth (#29264)

2026-05-29 19:58:04 -07:00

image_endpoints

…

management_endpoints

fix(mcp): ignore stale ids on key save (#29128)

2026-05-29 20:50:24 -07:00

management_helpers

fix(mcp): ignore stale ids on key save (#29128)

2026-05-29 20:50:24 -07:00

memory

…

middleware

fix(proxy): point /metrics 401 at the opt-out flag

2026-05-08 18:09:14 -07:00

openai_files_endpoint

…

pass_through_endpoints

fix(proxy): Bedrock Knowledge Base pass-through: preserve SigV4 headers and signed request body (#27526)

2026-05-25 19:21:55 +05:30

policy_engine

fix(guardrails): return HTTP 400 for litellm content filter blocks (#28418)

2026-05-30 14:28:46 -07:00

prompts

…

proxy_server

tests(proxy_server): surface current behavior in tests (#29309)

2026-05-29 23:17:24 -07:00

public_endpoints

feat(a2a): well-known agent-card discovery + LangGraph Platform mode (#28860)

2026-05-29 20:50:42 -07:00

rag_endpoints

fix: harden /key/update authorization checks (#27878)

2026-05-14 04:16:04 +00:00

realtime_endpoints

…

response_api_endpoints

…

spend_tracking

fix(spend-logs): redact echoed prompts in error_information (LIT-2992) (#27689)

2026-05-13 22:11:24 -07:00

test_configs

…

types_utils

chore(proxy): also scrub guardrail callbacks / module paths from DB overlay

2026-05-14 01:24:51 +00:00

ui_crud_endpoints

chore(ci): merge dev branch (#28657)

2026-05-25 13:48:47 -07:00

vector_store_endpoints

fix(proxy): restrict vector store index create/delete to proxy admins (#29202)

2026-05-30 15:10:21 -07:00

__init__.py

…

conftest.py

…

test_aiohttp_cleanup_closed.py

…

test_aiohttp_session_recovery.py

…

test_api_key_masking_in_errors.py

…

test_audio_speech_prometheus_hooks.py

…

test_batch_expiry.py

fix(proxy): strip LiteLLM policy tracking from OpenAI batch metadata (#28425)

2026-05-26 11:35:42 -07:00

test_batch_metadata_none_fix.py

…

test_batch_retrieve_bedrock.py

…

test_budget_reservation.py

fix(proxy): gate image-gen reservation strictly on model mode

2026-05-09 09:16:27 -07:00

test_caching_routes.py

…

test_chat_completion_metadata.py

…

test_common_request_processing.py

perf: reduce per-request and per-chunk overhead across Anthropic streaming hot paths (#28289)

2026-05-23 12:15:59 -07:00

test_component_allowlists.py

feat: add componentized proxy deployment with gateway, backend, ui, and migrations (#27557)

2026-05-16 09:25:17 -07:00

test_cors_config.py

…

test_custom_proxy.py

…

test_dynamic_mcp_route.py

feat(mcp): support MCP access group names in URL-based namespacing (#27726)

2026-05-13 20:20:38 -07:00

test_empty_model_list.py

…

test_enforce_user_param.py

…

test_fallback_management_endpoints.py

…

test_fastapi_offline_routes.py

…

test_filter_models_by_team_access_group.py

fix: resolve access group names in _filter_models_by_team_id (#25224)

2026-05-01 11:55:36 +05:30

test_health_check_functions.py

feat(proxy): skip disable_background_health_check models on GET /health when flag set (#27716)

2026-05-13 09:49:05 -07:00

test_health_check_max_tokens.py

Litellm agent oss staging 05 11 2026 (#27733)

2026-05-13 14:09:12 -07:00

test_langfuse_passthrough_security.py

…

test_lazy_openapi_snapshot.py

[Fix] Tests: Move Misplaced Import in Lazy OpenAPI Snapshot Test

2026-05-01 14:24:53 -07:00

test_litellm_pre_call_utils.py

fix(proxy): enforce tag budgets for key-level tags (#29108)

2026-05-28 11:39:02 -07:00

test_max_budget_env_var.py

…

test_mcp_asgi_response.py

fix(mcp): surface upstream 401 for token-forwarding MCP servers (#27847)

2026-05-13 12:03:36 -07:00

test_model_dump_with_preserved_fields.py

…

test_model_id_header_propagation.py

…

test_model_info_default_limits.py

…

test_model_level_guardrails.py

fix(proxy): run model-level post_call guardrails on streaming requests (#26922)

2026-05-07 11:53:03 -07:00

test_openapi_schema_validation.py

fix(proxy): preserve HTTP operations when injecting WebSocket stubs into OpenAPI schema

2026-05-06 00:28:42 +02:00

test_pricing_field_strip.py

fix(proxy): move pricing strip below the litellm_metadata JSON-string parse

2026-05-03 02:04:05 +00:00

test_prometheus_cleanup.py

…

test_provider_url_destination_guard.py

chore(proxy): move URL-valued model/file_id guard from SDK to proxy

2026-05-02 02:17:46 +00:00

test_proxy_cli.py

Add granian as a ASGI compliant web server. Provider better throughput stability, (#26027)

2026-05-21 19:08:37 -07:00

test_proxy_logging_hook_detection.py

perf: reduce per-request and per-chunk overhead across Anthropic streaming hot paths (#28289)

2026-05-23 12:15:59 -07:00

test_proxy_server.py

feat(a2a): well-known agent-card discovery + LangGraph Platform mode (#28860)

2026-05-29 20:50:42 -07:00

test_proxy_types.py

refactor(proxy/auth): normalize Bearer prefix in safe-hash helper (#29343)

2026-05-30 14:04:22 -07:00

test_proxy_utils.py

feat(otel): typed semconv-aligned OpenTelemetry instrumentation (#28909)

2026-05-29 23:15:27 -07:00

test_pyroscope.py

Implement normalize_nonempty_secret_str function to trim whitespace from secrets and treat empty values as unset. Update proxy_server to use this function for Grafana credentials. Enhance tests to validate the new normalization behavior.

2026-05-04 18:17:31 +00:00

test_redis_auth_cache_flag.py

…

test_response_model_sanitization.py

perf: eliminate per-request callback scanning on proxy hot path (#27858)

2026-05-14 09:28:31 -07:00

test_route_a2a_models.py

…

test_route_llm_request.py

feat(proxy): fix vector store retrieve/list/update/delete without model (#27929)

2026-05-15 04:37:59 -07:00

test_sensitive_route_auth.py

…

test_shared_health_check.py

feat(proxy): skip disable_background_health_check models on GET /health when flag set (#27716)

2026-05-13 09:49:05 -07:00

test_spend_log_cleanup.py

fix(proxy): keep spend log cleanup running after batch failures and surface DB errors (#27303)

2026-05-06 18:39:15 +00:00

test_swagger_chat_completions.py

fix(proxy): avoid misleading multi-method operation ids

2026-04-30 20:44:14 -07:00

test_team_member_update.py

…

test_team_org_move.py

…

test_tools_allowlist_enforcement.py

…

test_update_llm_router_resilience.py

…

test_utils.py

…