fix(jwt,otel): backport session conversation id and JWT team header selection to rc/1.103.0

litellm/integrations/otel/logger.py

@@ -561,6 +561,7 @@ def _finish_carrier(
             time_to_first_chunk_seconds=call.time_to_first_chunk_seconds,
             request_route=request_root_http_route(),
             trace=call.trace,
+            session_id=call.session_id,
         )
         end_time_ns: Final = to_ns(end_time)
         if carrier is not None and carrier.span is not None:

litellm/integrations/otel/mappers/genai.py

@@ -43,6 +43,7 @@ class GenAIMapper:
         GenAI.OPERATION_NAME: lambda d: d.operation.value,
         GenAI.PROVIDER_NAME: lambda d: d.provider or None,
         GenAI.OUTPUT_TYPE: lambda d: d.output_type.value if d.output_type else None,
+        GenAI.CONVERSATION_ID: lambda d: d.session_id,
         GenAI.REQUEST_MODEL: lambda d: d.request_model or None,
         GenAI.REQUEST_TEMPERATURE: lambda d: d.request_params.temperature,
         GenAI.REQUEST_TOP_P: lambda d: d.request_params.top_p,

litellm/integrations/otel/model/metadata.py

@@ -41,7 +41,7 @@
 from types import MappingProxyType
 from typing import TYPE_CHECKING, Any, Final, cast
 
-from litellm.constants import LITELLM_LOGGING_NO_UPSTREAM_LLM_CALL
+from litellm.constants import LITELLM_LOGGING_NO_UPSTREAM_LLM_CALL, SESSION_ID_GENERATED_METADATA_KEY
 from litellm.integrations.otel.model.semconv import resolve_operation
 from litellm.integrations.otel.model.trace_controls import TraceControls, caller_trace_controls
 from litellm.integrations.otel.model.utils import as_str, as_str_mapping, to_seconds
@@ -226,13 +226,15 @@ class LLMCallEvent:
     provisional_span_name: str
     time_to_first_chunk_seconds: float | None
     trace: TraceControls
+    session_id: str | None
 
     @classmethod
     def from_dict(cls, kwargs: Mapping[str, Any]) -> LLMCallEvent:
         raw_payload: Final = kwargs.get("standard_logging_object")
         payload: Final = cast("StandardLoggingPayload", raw_payload) if raw_payload else None
         operation: Final = resolve_operation(as_str(kwargs.get("call_type")))
         model: Final = as_str(kwargs.get("model")) or ""
+        trace: Final = caller_trace_controls(kwargs)
         return cls(
             call_id=_call_id(payload, kwargs),
             payload=payload,
@@ -242,10 +244,40 @@ def from_dict(cls, kwargs: Mapping[str, Any]) -> LLMCallEvent:
             upstream_started=kwargs.get("api_call_start_time") is not None,
             provisional_span_name=f"{operation.value} {model}".strip(),
             time_to_first_chunk_seconds=time_to_first_chunk_seconds(kwargs),
-            trace=caller_trace_controls(kwargs),
+            trace=trace,
+            session_id=caller_session_id(kwargs, trace),
         )
 
 
+def caller_session_id(kwargs: Mapping[str, object], trace: TraceControls) -> str | None:
+    """The conversation id the caller sent (``litellm_session_id``, else the
+    ``session_id`` trace control); ``None`` when the request carried none.
+
+    ``get_litellm_params`` back-fills ``litellm_session_id`` from ``metadata.trace_id``
+    (which the proxy stamps with the OTel trace id) and ``missing_session_id: generate``
+    mints one into the body; neither is a caller conversation, so both are ignored,
+    while a ``langfuse_session_id`` header still counts under the generate policy.
+    ``StandardLoggingPayload.session_id`` is never read: the payload drops the
+    generated marker, so a replayed minted id would pass for a caller's."""
+    params: Final[Mapping[str, object]] = as_str_mapping(kwargs.get("litellm_params")) or MappingProxyType({})
+    bodies: Final = tuple(
+        metadata
+        for key in ("metadata", "litellm_metadata")
+        if (metadata := as_str_mapping(params.get(key))) is not None
+    )
+    from_body: Final = tuple(session for body in bodies if (session := as_str(body.get("session_id"))))
+    minted: Final = frozenset(
+        session
+        for body in bodies
+        if body.get(SESSION_ID_GENERATED_METADATA_KEY) and (session := as_str(body.get("session_id")))
+    )
+    if minted:
+        return next((session for session in (trace.session_id, *from_body) if session and session not in minted), None)
+    explicit: Final = as_str(params.get("litellm_session_id"))
+    echoes_trace_id: Final = explicit is not None and any(as_str(body.get("trace_id")) == explicit for body in bodies)
+    return (None if echoes_trace_id else explicit) or trace.session_id or None
+
+
 def time_to_first_chunk_seconds(kwargs: Mapping[str, Any]) -> float | None:
     """Seconds from the upstream request being issued (``api_call_start_time``)
     to the first streamed chunk (``completion_start_time``); ``None`` for

litellm/integrations/otel/model/payloads.py

@@ -407,6 +407,7 @@ class LLMCallSpanData:
     call_type: str | None = None
     request_route: str | None = None
     trace: TraceControls = field(default_factory=TraceControls)
+    session_id: str | None = None
     embedding_output: EmbeddingOutput | None = None
 
     @classmethod
@@ -417,6 +418,7 @@ def from_standard_logging_payload(
         time_to_first_chunk_seconds: float | None = None,
         request_route: str | None = None,
         trace: TraceControls | None = None,
+        session_id: str | None = None,
     ) -> LLMCallSpanData:
         params: Final = cast(Mapping[str, object], payload.get("model_parameters") or {})
         # The single parse of the request's metadata — the request-vs-provider
@@ -463,6 +465,7 @@ def from_standard_logging_payload(
             call_type=call_type or None,
             request_route=request_route or context.identity.request_route,
             trace=trace or TraceControls(),
+            session_id=session_id or None,
             embedding_output=embedding_output if capture_content else None,
         )
 

litellm/proxy/_types.py

@@ -5236,11 +5236,12 @@ class LiteLLM_JWTAuth(LiteLLMPydanticObjectBase):
         default=False,
         description=(
             "When True, users whose JWT contains no team claims are authenticated "
-            "using their database team memberships instead of receiving HTTP 403. "
-            "Usage is attributed to the user's first resolvable DB team, or to the "
-            "team specified via the x-litellm-team-id request header (validated "
-            "against DB membership). Requires user_id_upsert=True so that user "
-            "records exist before the fallback runs."
+            "using their database team memberships instead of receiving HTTP 403, "
+            "with usage attributed to the user's first resolvable DB team. Whether or "
+            "not the JWT carries team claims, the x-litellm-team-id request header may "
+            "select any team the user is a member of in the database (validated against "
+            "DB membership); without the header the JWT team stays the default. Requires "
+            "user_id_upsert=True so that user records exist before the fallback runs."
         ),
     )
     issuers: list[JWTIssuerConfig] | None = Field(