From 722bc63e37d5a3773f95bb6c22b11f74bb3cb65e Mon Sep 17 00:00:00 2001 From: user <70670632+stuxf@users.noreply.github.com> Date: Wed, 29 Apr 2026 23:47:29 +0000 Subject: [PATCH] chore(oauth2-proxy): drop unused patch import + tighten docstring Greptile flagged the unused ``from unittest.mock import patch`` left over from before the ``configure_proxy`` fixture refactor (the fixture uses ``monkeypatch``, no ``patch`` calls remain). Also pruned the now-stale "premium gate" paragraph from the module docstring since that gate was removed in fbcfd59b1a. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../proxy/auth/test_oauth2_proxy_hook.py | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/tests/test_litellm/proxy/auth/test_oauth2_proxy_hook.py b/tests/test_litellm/proxy/auth/test_oauth2_proxy_hook.py index 42af9e6f03..9d0bdcf351 100644 --- a/tests/test_litellm/proxy/auth/test_oauth2_proxy_hook.py +++ b/tests/test_litellm/proxy/auth/test_oauth2_proxy_hook.py @@ -3,23 +3,16 @@ Regression tests for the OAuth2-proxy header-forgery fix (GHSA-5c3m-qffq-4r9m). The hook reads HTTP request headers per ``oauth2_config_mappings`` and -constructs a ``UserAPIKeyAuth`` from them. Two separate failure modes -the fix closes: - -1. The path was not gated on ``premium_user`` (the sibling - ``enable_oauth2_auth`` and ``enable_jwt_auth`` paths are). Open-source - deployments could enable the feature without realising it requires - a hardened deployment topology. -2. Any ``UserAPIKeyAuth`` field could be mapped from a header — including - ``user_role``, which Pydantic coerces from the string ``"proxy_admin"`` - into ``LitellmUserRoles.PROXY_ADMIN``. An attacker who reaches the - proxy directly (or via a misconfigured reverse proxy) sets the mapped - header and gains full admin privileges. +constructs a ``UserAPIKeyAuth`` from them. Without the +identity-only allowlist any field could be mapped — including +``user_role``, which Pydantic coerces from the string +``"proxy_admin"`` into ``LitellmUserRoles.PROXY_ADMIN``. An attacker +who reaches the proxy directly (or via a misconfigured reverse +proxy) sets the mapped header and gains full admin privileges. """ import os import sys -from unittest.mock import patch import pytest from fastapi import Request