mirror of
https://github.com/tiennm99/litellm.git
synced 2026-07-17 00:17:16 +00:00
yuneng-jiangandGitHub
f62ae93e13
* test(proxy): add create_scratch_actor harness helper
Adds create_scratch_actor() to the management behavior-suite conftest and
extends create_scratch_team() with team_member_permissions / models kwargs,
needed by the PR3 team-key-permission and team-model matrices. The new
helper mints a scratch-prefixed user + verification token (+ org
memberships), all reclaimed by the existing scratch-prefix teardown.
* test(proxy): pin /key block, unblock, health, aliases behavior
Adds behavior-pinning matrices for POST /key/block, POST /key/unblock,
POST /key/health, and GET /key/aliases. Pins that the management-route gate
401s ORG_ADMIN-role callers before _check_key_admin_access runs, the
block/unblock round-trip on the blocked column, missing-key 404, and the
_apply_non_admin_alias_scope visibility rules for /key/aliases.
* test(proxy): pin /key/bulk_update + /team/key/bulk_update behavior
Adds behavior-pinning matrices for POST /key/bulk_update (PROXY_ADMIN-only;
ORG_ADMIN stopped 401 at the route gate, INTERNAL_USER-role 403 at the
handler) and POST /team/key/bulk_update (team-member-permission gate keyed
on KEY_UPDATE). Pins batch semantics: empty/over-cap 400, per-key failure
isolation into failed_updates, all_keys_in_team broadcast, and no-keys 404.
Adds an optional key_alias arg to create_scratch_key for multi-key scenarios.
* test(proxy): pin /key SA-generate, v2-info, reset-spend behavior
Adds behavior-pinning matrices for POST /key/service-account/generate
(team-membership + team-member-permission gating; SA keys carry no user_id),
POST /v2/key/info (per-key _can_user_query_key_info silently drops invisible
keys), and POST /key/{key}/reset_spend (PROXY_ADMIN or team admin only;
missing key 404, reset-value 400). Pins that ORG_ADMIN-role callers are
stopped 401 at the management-route gate on the two non-info routes.
* test(proxy): close PR1/PR2 key-side deferred coverage gaps
Closes the four key-side gaps deferred from PR1/PR2:
- 404 on missing key for /key/update and /key/delete (not 401/403)
- denied /key/update leaves max_budget/tpm_limit/rpm_limit untouched
- /key/regenerate enforces litellm.upperbound_key_generate_params (#26340)
- /key/list key_alias substring vs exact (admin-only) + team_id filter,
and a non-admin filtering a foreign team is 403
* test(proxy): pin /team block, unblock, available, filter/ui, members/me
Adds behavior-pinning matrices for POST /team/block + /team/unblock
(management-route gate fronts _verify_team_access; reachable only by
PROXY_ADMIN and an org admin of the team's own org), GET /team/available
(default empty path), GET /team/filter/ui (route-gated PROXY-ADMIN-only
despite the handler having no gate), and GET /team/{team_id}/members/me
(caller resolves its own membership; non-member 404, no-user_id key 400).
* test(proxy): pin /team model add/delete + permissions endpoints
Adds behavior-pinning matrices for POST /team/model/add + /team/model/delete
(route-gated PROXY-ADMIN-only; missing team 404), GET /team/permissions_list +
POST /team/permissions_update (self-managed; proxy/team/org admin pass), and
POST /team/permissions_bulk_update (PROXY_ADMIN-only). Pins the deliberate
divergence that the available-team self-join grants read access via
permissions_list but never write access via permissions_update.
* test(proxy): pin /team delete, bulk_member_add, v2/list, daily/activity
Adds behavior-pinning matrices for POST /team/delete (per-team
_verify_team_access; batch aborts whole on a missing id), POST
/team/bulk_member_add (route-gated PROXY-ADMIN-only; empty/over-cap 400),
GET /v2/team/list (_enforce_list_team_v2_access — bare query 401s regular
users, org-scoped for org admins) and GET /team/daily/activity (non-member
team_ids filter 404, the VERIA-43 fix).
* test(proxy): add route-coverage gate + close team org-relocation gap
Adds test_route_coverage.py (PR3.M1): parses every @router route literal
from the two management-endpoint source files and asserts each is exercised
by >=1 behavior-suite scenario — a permanent regression guard for future
routes. Closes the last PR1/PR2 deferred gap: the /team/update org-relocation
allowed branch, exercised by a dual-org-admin minted via create_scratch_actor.
test_team_model uses literal route URLs so the coverage parser resolves them.
* test(proxy): bound plain route params to one path segment in coverage gate
Plain path params ({team_id}) now compile to [^/?]+ instead of [^?]+, so a
parameter cannot span '/'. Starlette ':path' params still match across '/'.
Keeps the route-coverage guard from falsely reporting a future multi-segment
route as covered. All 37 routes remain covered.
83 lines
2.8 KiB
Python
83 lines
2.8 KiB
Python
import uuid
|
|
|
|
import pytest
|
|
|
|
from .actors import Actor
|
|
|
|
pytestmark = pytest.mark.asyncio(loop_scope="session")
|
|
|
|
|
|
# POST /v2/key/info resolves the posted keys, then drops any key the caller
|
|
# cannot see via _can_user_query_key_info — silently, no 403. A non-admin sees
|
|
# a key it owns (user_id match) or a key whose team it belongs to. The world's
|
|
# TEAM_ALPHA members all see each other's keys; CROSS_ORG_USER and the org
|
|
# admins see only their own. The request is posted with every world key, and
|
|
# the returned info set is asserted to equal the visible subset.
|
|
_ALPHA_KEYS = frozenset(
|
|
{
|
|
Actor.TEAM_ADMIN,
|
|
Actor.INTERNAL_USER,
|
|
Actor.OWNER,
|
|
Actor.UNRELATED_SAME_ORG,
|
|
Actor.SERVICE_ACCOUNT,
|
|
}
|
|
)
|
|
_VISIBILITY = {
|
|
Actor.PROXY_ADMIN: frozenset(Actor),
|
|
Actor.ORG_ADMIN: frozenset({Actor.ORG_ADMIN}),
|
|
Actor.TEAM_ADMIN: _ALPHA_KEYS,
|
|
Actor.INTERNAL_USER: _ALPHA_KEYS,
|
|
Actor.OWNER: _ALPHA_KEYS,
|
|
Actor.UNRELATED_SAME_ORG: _ALPHA_KEYS,
|
|
Actor.SERVICE_ACCOUNT: _ALPHA_KEYS,
|
|
Actor.CROSS_ORG_USER: frozenset({Actor.CROSS_ORG_USER}),
|
|
Actor.ORG_B_ADMIN: frozenset({Actor.ORG_B_ADMIN}),
|
|
}
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"actor,expected_visible",
|
|
list(_VISIBILITY.items()),
|
|
ids=[a.value for a in _VISIBILITY],
|
|
)
|
|
async def test_key_info_v2_visibility(actor, expected_visible, proxy_client, world):
|
|
caller = world.keys[actor]
|
|
user_id_to_actor = {world.keys[a].user_id: a for a in Actor}
|
|
|
|
resp = await proxy_client.post(
|
|
"/v2/key/info",
|
|
headers={"Authorization": f"Bearer {caller.cleartext}"},
|
|
json={"keys": [world.keys[a].cleartext for a in Actor]},
|
|
)
|
|
assert resp.status_code == 200, f"{actor.value}: {resp.status_code} {resp.text}"
|
|
|
|
visible = {
|
|
user_id_to_actor[entry["user_id"]]
|
|
for entry in resp.json()["info"]
|
|
if entry.get("user_id") in user_id_to_actor
|
|
}
|
|
assert visible == set(expected_visible), (
|
|
f"{actor.value}: expected {sorted(a.value for a in expected_visible)}, "
|
|
f"got {sorted(a.value for a in visible)}"
|
|
)
|
|
|
|
|
|
async def test_key_info_v2_no_body_is_422(proxy_client, world):
|
|
"""A request with no body is a 422 — the handler has no keys to resolve."""
|
|
resp = await proxy_client.post(
|
|
"/v2/key/info",
|
|
headers={"Authorization": f"Bearer {world.keys[Actor.PROXY_ADMIN].cleartext}"},
|
|
)
|
|
assert resp.status_code == 422, resp.text
|
|
|
|
|
|
async def test_key_info_v2_unknown_key_returns_empty_info(proxy_client, world):
|
|
"""Keys that resolve to no rows yield an empty info list, not an error."""
|
|
resp = await proxy_client.post(
|
|
"/v2/key/info",
|
|
headers={"Authorization": f"Bearer {world.keys[Actor.PROXY_ADMIN].cleartext}"},
|
|
json={"keys": ["sk-" + uuid.uuid4().hex]},
|
|
)
|
|
assert resp.status_code == 200, resp.text
|
|
assert resp.json()["info"] == []
|