fix(proxy): enforce auth defaults for raw pass-through config

[lzhan011]

TLDR

Problem this solves:

• Raw pass-through config can skip centralized policy checks
• Missing auth disagrees with the typed secure default

How it solves it:

• Defaults missing raw auth values to true
• Covers route registration and centralized checks with regressions

User Flow

Before: a proxy admin omits auth and an exhausted key can still reach the pass-through upstream

1. The admin configures /internal/provider without an auth field and restarts the proxy
2. A developer sends POST https://litellm-domain/internal/provider with a valid virtual key whose budget is exhausted
3. The request reaches the configured upstream instead of returning a budget error
4. The developer can continue using the upstream beyond the key's configured policy

After: the same request is stopped by the policy already attached to the key

1. The admin configures /internal/provider without an auth field and restarts the proxy
2. A developer sends POST https://litellm-domain/internal/provider with a valid virtual key whose budget is exhausted
3. The proxy returns HTTP 429 with the budget-exceeded error before contacting the upstream
4. The developer can no longer bypass the key's configured policy through this route

Relevant issues

Fixes #35534

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• The test files covering my change pass locally
• My PR passes all required CI/CD checks
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 on the latest head

Local checks

• Related auth selection: 36 passed, 133 deselected
• The branch is rebased onto the latest litellm_internal_staging
• The PR has no merge conflicts

Screenshots / Proof of Fix

A live before/after curl run needs a DB-backed proxy so the same virtual key can be placed over budget. This checkout has no PostgreSQL service or DATABASE_URL

Before (97dbd8e)

1. Not captured locally because the required DB-backed key state is unavailable

After (754c3d5)

1. Not captured locally for the same reason

Type

Bug Fix

Caveats (if any)

CI baseline

• OSV currently flags pypdf 6.15.0 and tornado 6.5.7 from the staging uv.lock
• Fork PRs are prohibited from modifying uv.lock by the repository dependency guard
• Canonical dependency PR fix(deps): raise the tornado and pypdf floors for six new advisories #39188 is tracking the staging security update

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[CLAassistant]

All committers have signed the CLA.

[greptile-apps]

Greptile Summary

This PR aligns omitted raw pass-through authentication settings with the typed secure default and adds focused regression coverage

• Defaults omitted raw endpoint authentication to enabled during route registration
• Keeps centralized policy checks active when raw endpoint configuration omits auth
• Adds registration and centralized-check regression tests

Confidence Score: 5/5

The PR appears safe to merge

No blocking failure remains

Important Files Changed

Filename	Overview
litellm/proxy/auth/user_api_key_auth.py	Centralized checks now treat an omitted raw pass-through auth field as authenticated, matching the request-time default
litellm/proxy/pass_through_endpoints/pass_through_endpoints.py	Raw pass-through route registration now defaults omitted authentication to enabled
tests/test_litellm/proxy/auth/test_user_api_key_auth.py	Adds focused coverage confirming centralized checks still execute when raw pass-through configuration omits auth
tests/test_litellm/proxy/pass_through_endpoints/test_passthrough_auth_default.py	Adds focused registration coverage for the secure omitted-auth default

_{Reviews (2): Last reviewed commit: "fix(proxy): enforce auth defaults for ra..." | Re-trigger Greptile}

[codspeed]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing lzhan011:bugfix/pass-through-auth-default (b69818f) with litellm_internal_staging (987ab76)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[lzhan011]

@greptileai please re-review the auth-default changes after rebasing onto the latest staging branch and retaining the focused regression coverage

[lzhan011]

OSV failure is tracked in #39217 and comes from unchanged staging locks; this PR only changes pass-through authentication code and tests