ryan-crabbe-berriandGitHub fe63650ebd fix(proxy): gate team allowed_passthrough_routes to proxy admins (#28097) ...

* fix(proxy): gate team allowed_passthrough_routes to proxy admins

allowed_passthrough_routes short-circuits the role-based route gate, so
the keys endpoints already restrict it to proxy admins. The team writers
(/team/new, /team/update) had no equivalent check, letting an org admin
(a non-proxy-admin who clears the route gate and _verify_team_access)
self-grant pass-through routes on their team. Lift the keys check into a
shared helper and apply it to both team endpoints.

Resolves LIT-3019

* docs(proxy): note view-only admins are intentionally excluded from passthrough gate

Clarifies the proxy-admin guard per review feedback; no behavior change.

Refs LIT-3019

2026-05-18 08:56:25 -07:00

..

_experimental/mcp_server

fix(mcp-oauth): PROXY_BASE_URL escape hatch + diagnostic logging for {"detail":"invalid_request"} (#28086)

2026-05-16 17:48:03 -07:00

agent_endpoints

…

anthropic_endpoints

…

auth

feat(otel): OTel-standard attributes on the proxy SERVER span (status code, route/path, preprocessing latency) (#28040)

2026-05-16 13:45:08 -07:00

client

…

common_utils

Litellm key rotation bug (#27756)

2026-05-12 17:16:37 -07:00

db

feat: add componentized proxy deployment with gateway, backend, ui, and migrations (#27557)

2026-05-16 09:25:17 -07:00

discovery_endpoints

…

experimental/mcp_server

…

google_endpoints

…

guardrails

feat(lasso): add tool-calling support to LassoGuardrail (#27648)

2026-05-14 08:35:24 -07:00

health_endpoints

fix(proxy): expose db status on public /health/readiness

2026-05-13 13:02:38 -07:00

hooks

fix(rate-limit): stop v3 limiter from leaking internal stash to provider body (#27913)

2026-05-14 10:53:04 -07:00

image_endpoints

…

management_endpoints

fix(proxy): gate team allowed_passthrough_routes to proxy admins (#28097)

2026-05-18 08:56:25 -07:00

management_helpers

decouple S3 audit-log config via s3_audit_callback_params

2026-05-05 13:23:32 -07:00

memory

…

middleware

fix(proxy): point /metrics 401 at the opt-out flag

2026-05-08 18:09:14 -07:00

openai_files_endpoint

…

pass_through_endpoints

fix(vertex-ai): fix zero cost/usage on completed Vertex AI batch jobs (#27912)

2026-05-15 04:47:02 -07:00

policy_engine

…

prompts

…

public_endpoints

…

rag_endpoints

fix: harden /key/update authorization checks (#27878)

2026-05-14 04:16:04 +00:00

realtime_endpoints

…

response_api_endpoints

…

spend_tracking

fix(spend-logs): redact echoed prompts in error_information (LIT-2992) (#27689)

2026-05-13 22:11:24 -07:00

test_configs

…

types_utils

chore(proxy): also scrub guardrail callbacks / module paths from DB overlay

2026-05-14 01:24:51 +00:00

ui_crud_endpoints

…

vector_store_endpoints

…

__init__.py

…

conftest.py

…

test_aiohttp_cleanup_closed.py

…

test_aiohttp_session_recovery.py

…

test_api_key_masking_in_errors.py

…

test_audio_speech_prometheus_hooks.py

…

test_batch_expiry.py

…

test_batch_metadata_none_fix.py

…

test_batch_retrieve_bedrock.py

…

test_budget_reservation.py

fix(proxy): gate image-gen reservation strictly on model mode

2026-05-09 09:16:27 -07:00

test_caching_routes.py

…

test_chat_completion_metadata.py

…

test_common_request_processing.py

Preserve LiteLLM headers for passthrough responses (#27412)

2026-05-07 12:59:36 -07:00

test_component_allowlists.py

feat: add componentized proxy deployment with gateway, backend, ui, and migrations (#27557)

2026-05-16 09:25:17 -07:00

test_cors_config.py

…

test_custom_proxy.py

…

test_dynamic_mcp_route.py

feat(mcp): support MCP access group names in URL-based namespacing (#27726)

2026-05-13 20:20:38 -07:00

test_empty_model_list.py

…

test_enforce_user_param.py

…

test_fallback_management_endpoints.py

…

test_fastapi_offline_routes.py

…

test_filter_models_by_team_access_group.py

…

test_health_check_functions.py

feat(proxy): skip disable_background_health_check models on GET /health when flag set (#27716)

2026-05-13 09:49:05 -07:00

test_health_check_max_tokens.py

Litellm agent oss staging 05 11 2026 (#27733)

2026-05-13 14:09:12 -07:00

test_langfuse_passthrough_security.py

…

test_lazy_openapi_snapshot.py

…

test_litellm_pre_call_utils.py

fix(proxy): parse string metadata before pre-auth tag merge

2026-05-12 18:06:12 -07:00

test_max_budget_env_var.py

…

test_mcp_asgi_response.py

fix(mcp): surface upstream 401 for token-forwarding MCP servers (#27847)

2026-05-13 12:03:36 -07:00

test_model_dump_with_preserved_fields.py

…

test_model_id_header_propagation.py

…

test_model_info_default_limits.py

…

test_model_level_guardrails.py

fix(proxy): run model-level post_call guardrails on streaming requests (#26922)

2026-05-07 11:53:03 -07:00

test_openapi_schema_validation.py

fix(proxy): preserve HTTP operations when injecting WebSocket stubs into OpenAPI schema

2026-05-06 00:28:42 +02:00

test_pricing_field_strip.py

…

test_prometheus_cleanup.py

…

test_provider_url_destination_guard.py

…

test_proxy_cli.py

test(proxy): isolate run_server CLI tests from prisma DB-setup path

2026-05-15 16:51:45 -07:00

test_proxy_logging_hook_detection.py

perf: eliminate per-request callback scanning on proxy hot path (#27858)

2026-05-14 09:28:31 -07:00

test_proxy_server.py

fix(proxy): sort BYOK models by their displayed name in /v2/model/info (#28079)

2026-05-16 15:46:21 -07:00

test_proxy_types.py

…

test_proxy_utils.py

feat(otel): OTel-standard attributes on the proxy SERVER span (status code, route/path, preprocessing latency) (#28040)

2026-05-16 13:45:08 -07:00

test_pyroscope.py

…

test_redis_auth_cache_flag.py

…

test_response_model_sanitization.py

perf: eliminate per-request callback scanning on proxy hot path (#27858)

2026-05-14 09:28:31 -07:00

test_route_a2a_models.py

…

test_route_llm_request.py

feat(proxy): fix vector store retrieve/list/update/delete without model (#27929)

2026-05-15 04:37:59 -07:00

test_sensitive_route_auth.py

…

test_shared_health_check.py

feat(proxy): skip disable_background_health_check models on GET /health when flag set (#27716)

2026-05-13 09:49:05 -07:00

test_spend_log_cleanup.py

fix(proxy): keep spend log cleanup running after batch failures and surface DB errors (#27303)

2026-05-06 18:39:15 +00:00

test_swagger_chat_completions.py

…

test_team_member_update.py

…

test_team_org_move.py

…

test_tools_allowlist_enforcement.py

…

test_update_llm_router_resilience.py

…

test_utils.py

…