Ashwin Bharambe 4e6c769cc4 fix(context): prevent provider data leak between streaming requests (#3924) ... ## Summary - `preserve_contexts_async_generator` left `PROVIDER_DATA_VAR` (and other context vars) populated after a streaming generator completed on HEAD~1, so the asyncio context for request N+1 started with request N's provider payload. - FastAPI dependencies and middleware execute before `request_provider_data_context` rebinds the header data, meaning auth/logging hooks could observe a prior tenant's credentials or treat them as authenticated. Traces and any background work that inspects the context outside the `with` block leak as well—this is a real security regression, not just a CLI artifact. - The wrapper now restores each tracked `ContextVar` to the value it held before the iteration (falling back to clearing when necessary) after every yield and when the generator terminates, so provider data is wiped while callers that set their own defaults keep them. ## Test Plan - `uv run pytest tests/unit/core/test_provider_data_context.py -q` - `uv run pytest tests/unit/distribution/test_context.py -q` Both suites fail on HEAD~1 and pass with this change.		2025-10-27 23:01:12 -07:00
..
routers	chore: support default model in moderations API (#3890)	2025-10-23 16:03:53 -07:00
test_provider_data_context.py	fix(context): prevent provider data leak between streaming requests (#3924)	2025-10-27 23:01:12 -07:00
test_stack_validation.py	chore: support default model in moderations API (#3890)	2025-10-23 16:03:53 -07:00
test_storage_references.py	feat(stores)!: use backend storage references instead of configs (#3697)	2025-10-20 13:20:09 -07:00