test(router): cover the team-scoped credential deployment lookups

The router coverage gate in code-quality flags every router.py function
no router test calls by name, and the two helpers get_credential_deployment
gained (the team public-name lookup and the team-aware wildcard lookup)
were only reached through it. Each now has a test of its own: the
public-name lookup resolves only for the owning team, and the wildcard
lookup prefers the team's own pattern over the shared one and never hands
another team's wildcard deployment to a caller outside that team.
This commit is contained in:
mateo-berri 2026-09-19 01:05:01 -07:00
parent 7133baa777
commit 00214ac371

View file

@ -5784,6 +5784,54 @@ def test_get_credential_deployment_skips_a_paused_deployment():
assert router.get_credential_deployment(model_id="paused-dep") is None
def test_get_team_public_name_deployment_only_resolves_the_owning_team():
router = litellm.Router(
model_list=[
{
"model_name": "mistral/mistral-ocr-latest",
"litellm_params": {"model": "mistral/mistral-ocr-latest", "api_key": "sk-team-a"},
"model_info": {"id": "team-a-ocr", "team_id": "team-a", "team_public_model_name": "ocr"},
}
]
)
owning_team = router._get_team_public_name_deployment(model_id="ocr", team_id="team-a")
assert owning_team is not None and owning_team.model_info.id == "team-a-ocr"
assert router._get_team_public_name_deployment(model_id="ocr", team_id="team-b") is None
assert router._get_team_public_name_deployment(model_id="ocr", team_id=None) is None
assert router.get_credential_deployment(model_id="ocr", team_id="team-a").model_info.id == "team-a-ocr"
assert router.get_credential_deployment(model_id="ocr", team_id="team-b") is None
def test_get_wildcard_deployment_usable_by_team_prefers_the_team_pattern():
router = litellm.Router(
model_list=[
{
"model_name": "mistral/*",
"litellm_params": {"model": "mistral/*", "api_key": "sk-shared"},
"model_info": {"id": "shared-wildcard"},
},
{
"model_name": "mistral/*",
"litellm_params": {"model": "mistral/*", "api_key": "sk-team-a"},
"model_info": {"id": "team-a-wildcard", "team_id": "team-a", "team_public_model_name": "mistral/*"},
},
]
)
ocr = "mistral/mistral-ocr-latest"
team_match = router._get_wildcard_deployment_usable_by_team(model_id=ocr, team_id="team-a")
other_team_match = router._get_wildcard_deployment_usable_by_team(model_id=ocr, team_id="team-b")
anonymous_match = router._get_wildcard_deployment_usable_by_team(model_id=ocr, team_id=None)
assert team_match is not None and team_match.model_info.id == "team-a-wildcard"
assert other_team_match is not None and other_team_match.model_info.id == "shared-wildcard"
assert anonymous_match is not None and anonymous_match.model_info.id == "shared-wildcard"
assert router._get_wildcard_deployment_usable_by_team(model_id="openai/gpt-5.6", team_id="team-a") is None
assert router.get_credential_deployment(model_id=ocr, team_id="team-b").model_info.id == "shared-wildcard"
def test_get_deployment_credentials_with_provider_aws_bedrock_runtime_endpoint():
"""
Test that get_deployment_credentials_with_provider correctly copies