Ashwin Bharambe 2c56a8560d fix(context): prevent provider data leak between streaming requests (#3924) ... ## Summary - `preserve_contexts_async_generator` left `PROVIDER_DATA_VAR` (and other context vars) populated after a streaming generator completed on HEAD~1, so the asyncio context for request N+1 started with request N's provider payload. - FastAPI dependencies and middleware execute before `request_provider_data_context` rebinds the header data, meaning auth/logging hooks could observe a prior tenant's credentials or treat them as authenticated. Traces and any background work that inspects the context outside the `with` block leak as well—this is a real security regression, not just a CLI artifact. - The wrapper now restores each tracked `ContextVar` to the value it held before the iteration (falling back to clearing when necessary) after every yield and when the generator terminates, so provider data is wiped while callers that set their own defaults keep them. ## Test Plan - `uv run pytest tests/unit/core/test_provider_data_context.py -q` - `uv run pytest tests/unit/distribution/test_context.py -q` Both suites fail on HEAD~1 and pass with this change.		2025-10-30 14:14:36 -07:00
..
routers	chore(cleanup)!: kill vector_db references as far as possible (#3864)	2025-10-20 20:06:16 -07:00
test_provider_data_context.py	fix(context): prevent provider data leak between streaming requests (#3924)	2025-10-30 14:14:36 -07:00
test_stack_validation.py	chore: Updating how default embedding model is set in stack (#3818)	2025-10-20 14:22:45 -07:00
test_storage_references.py	feat(stores)!: use backend storage references instead of configs (#3697)	2025-10-20 13:20:09 -07:00