RedisCache() without arguments fails at construction with
"ValueError: Either 'host' or 'url' must be specified for redis."
The actual Redis connection is irrelevant since async_set_cache is mocked.
Unlike test_get_team_redis which uses client_no_auth (which sets REDIS_HOST
via fake_env_vars), test_team_update_redis has no fixture setting that env var.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
JWT auth is an enterprise-only feature. Tests that call user_api_key_auth
with enable_jwt_auth=True must set premium_user=True on the proxy server
to bypass the enterprise gate, otherwise they fail with:
ValueError: JWT Auth is an enterprise only feature.
This follows the same pattern as PR #21285 (fix/jwt-enterprise-license-test).
Fixed tests:
- test_team_token_output
- test_allowed_routes_admin
- test_allow_access_by_email
- test_end_user_jwt_auth
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove unused RouteChoice import from semantic_guard.py TYPE_CHECKING block
(only referenced in docstring, never used as a type annotation)
- Remove redundant explicit router import from policy_endpoints/__init__.py
(already re-exported by the preceding import * on the same line)
Fixes Ruff F401 errors caught in CI linting.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The suggest() method was calling llm_router.acompletion(), which requires
the proxy router to be initialised. This caused:
ValueError: LLM router not initialized
in every test (and in any deployment without a configured router).
AiPolicySuggester is a self-contained feature that calls an LLM directly;
it has no need for proxy routing. Switch to litellm.acompletion, which is
always available and is what the tests already mock.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
When model_info is explicitly set to None in litellm_params (via
get_litellm_params.py), the pattern .get("model_info", {}) returns
None instead of {}, causing AttributeError on the chained .get("id").
This commonly occurs when Anthropic API returns usage limit errors,
the router falls back to Vertex AI, and the fallback succeeds — the
log_success_event callback fires with model_info=None.
Uses the (x or {}) pattern already established in router.py.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Refactor to fetch team objects once via _fetch_user_team_objects(),
then derive admin and member team IDs from the shared result. Eliminates
duplicate DB query between get_admin_team_ids and get_member_team_ids.
Empty system messages were skipped for Anthropic's system param but
not removed from the messages list, causing BadRequestError when
anthropic_messages_pt encountered the unsupported "system" role.
Fixes#21622
Regular team members could not see service accounts belonging to their
team. Additionally, former team members could still see service accounts
they created via the created_by filter after leaving the team.
- Add get_member_team_ids() to retrieve all teams a user belongs to
- Regular members now see team service accounts (user_id=NULL) but not
other members' personal keys
- Scope created_by filter to the user's current team memberships
- Add 7 unit tests covering the new visibility rules
PAT_TOKEN_2 does not have the scope for addPullRequestReview.
github.token cannot approve its own PR either, so drop the approval
step entirely. Auto-merge with github.token is enough: the PR will
merge automatically once required CI checks pass.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(policy): add estimated_latency_ms to all policy templates
* feat(policy): add estimated_latency_ms to backup templates
* feat(ui): show latency overhead badge in AI policy suggestions
Now that "Allow GitHub Actions to create and approve pull requests" is
enabled in repo settings:
- PR creation uses github.token (no secret needed)
- Approval uses PAT_TOKEN_2 (GitHub requires a different identity from
the PR creator to approve)
- Auto-merge is enabled with --squash so the PR merges as soon as
required checks pass
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
github.token cannot open PRs when "Allow GitHub Actions to create and
approve pull requests" is disabled in repo settings. PAT_TOKEN_2
bypasses that restriction.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The workflow fails with:
The option "--no-update" does not exist
--no-update was removed in Poetry 2.x. Plain `poetry lock` is the
correct equivalent — it re-solves only what pyproject.toml requires
without upgrading already-locked packages.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Drop the PAT_TOKEN_2 secret (whose scope is unknown) in favour of the
built-in github.token, which is always available. Grant it exactly the
two permissions it needs:
- contents: write → push the auto/regenerate-* branch
- pull-requests: write → open the PR via gh cli
No external secret needed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GH_TOKEN is not configured in this repository. The correct PAT secret
is PAT_TOKEN_2, which has the permissions needed to push branches and
open PRs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
When secrets.GH_TOKEN is not configured, the workflow fails immediately with:
"Input required and not supplied: token"
Using || github.token ensures a valid token is always available.
GH_TOKEN (PAT) is preferred when set; github.token is used as fallback.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
A heredoc inside \$() inside a double-quoted string inside a YAML multiline
run block breaks the YAML parser at line 60. Replaced with: write the PR
body to /tmp/pr-body.md using a standalone heredoc, then pass it via
gh pr create --body-file.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The admin bulk-delete path (prisma_client.delete_data) was never comparing
the DB return value against the requested tokens, so failed_tokens was
always empty for admins even when the DB silently skipped some tokens.
Adds the same mismatch check as the non-admin path, and a new test that
exercises admin bulk-delete returning fewer tokens than requested.
Fixes gap identified by Greptile review on #21609.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub Advanced Security flagged that the workflow had no permissions block,
leaving GITHUB_TOKEN with its default broad scope. All write operations
(git push, gh pr create) already use GH_TOKEN (PAT), so the implicit
GITHUB_TOKEN only needs read access.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
A re-run within the same second (or a leftover branch) would cause
`git push` to fail. Adding -f is safe since this is a bot-owned branch
that is immediately turned into a PR and never used for anything else.
Fixes inline suggestion from Greptile review.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Without the token in the checkout step the subsequent `git push` uses the
default GITHUB_TOKEN which lacks permission to push new branches, causing
the workflow to fail silently. Fixes issue flagged by Greptile review.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds a workflow that triggers whenever pyproject.toml is merged into main
and opens a PR with the refreshed lock file, fixing the recurring CI failure:
"pyproject.toml changed significantly since poetry.lock was last generated."
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
