From 1f2baf509e1d683e53a11daec6ac673d4dec9d52 Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Thu, 20 Aug 2026 05:28:19 -0700
Subject: [PATCH] test(cli): model keyring's null backend in the vault test
 double

FakeSecretVault could only stand in for a discarding backend by passing
KeyringDiscardsWrites as its `failure`, which also made read() and erase()
hand it back. Neither SecretRead nor SecretErase admits that outcome and the
real KeyringVault never produces it there, so the login path's match was
falling through on a value it can never see. Give the double a `discards`
flag that reports it from write() alone, which is what the null backend does.

Also widen lint-format-check-changed's pathspec. Git wildmatch runs without
FNM_PATHNAME here, so 'litellm/**/*.py' still requires an intermediate
directory and silently skipped all 21 top-level modules, litellm/__init__.py
and litellm/main.py among them. All 21 already pass ruff format.
---
 Makefile                                                  | 2 +-
 tests/test_litellm/conftest.py                            | 8 +++++++-
 tests/test_litellm/proxy/client/cli/test_auth_commands.py | 3 +--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index ab6eba880bf..a47b3f0f66a 100644
--- a/Makefile
+++ b/Makefile
@@ -146,7 +146,7 @@ lint-install:
 # only the litellm Python files changed vs the base are checked, so a pre-existing
 # format issue elsewhere doesn't block an unrelated commit.
 lint-format-check-changed: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
-	@files=$$(git diff --name-only --diff-filter=ACMR origin/litellm_internal_staging...HEAD -- 'litellm/**/*.py' | grep -v '^litellm/enterprise/' || true); \
+	@files=$$(git diff --name-only --diff-filter=ACMR origin/litellm_internal_staging...HEAD -- 'litellm/*.py' | grep -v '^litellm/enterprise/' || true); \
 	if [ -z "$$files" ]; then \
 		echo "No changed litellm Python files to format-check."; \
 	else \
diff --git a/tests/test_litellm/conftest.py b/tests/test_litellm/conftest.py
index b42355fa045..1229642dea0 100644
--- a/tests/test_litellm/conftest.py
+++ b/tests/test_litellm/conftest.py
@@ -23,6 +23,7 @@ from litellm import router as litellm_router_module
 from litellm import utils as litellm_utils_module
 from litellm._logging import ALL_LOGGERS
 from litellm.litellm_core_utils.cli_keyring import (
+    KeyringDiscardsWrites,
     KeyringUnreachable,
     KeyringUnusable,
     SecretErase,
@@ -132,7 +133,8 @@ class FakeSecretVault:
 
     `available=False` models a keychain that is locked or has no backend, `writable=False` one that
     refuses to store, `erasable=False` one that will not release what it already holds, and `failure`
-    picks which unusable state those report.
+    picks which unusable state those report. `discards=True` is keyring's null backend, which answers
+    reads and erases like any other yet keeps nothing it is given, so only writes report it.
     """
 
     def __init__(
@@ -142,12 +144,14 @@ class FakeSecretVault:
         available: bool = True,
         writable: bool = True,
         erasable: bool = True,
+        discards: bool = False,
         failure: KeyringUnusable = KeyringUnreachable(),
     ) -> None:
         self.blob: str | None = blob
         self.available: bool = available
         self.writable: bool = writable
         self.erasable: bool = erasable
+        self.discards: bool = discards
         self.failure: KeyringUnusable = failure
         self.reads: int = 0
         self.writes: list[str] = []
@@ -163,6 +167,8 @@ class FakeSecretVault:
         self.writes.append(blob)
         if not (self.available and self.writable):
             return self.failure
+        if self.discards:
+            return KeyringDiscardsWrites()
         self.blob = blob
         return SecretStored()
 
diff --git a/tests/test_litellm/proxy/client/cli/test_auth_commands.py b/tests/test_litellm/proxy/client/cli/test_auth_commands.py
index 1dd8a7ead92..4f44514167c 100644
--- a/tests/test_litellm/proxy/client/cli/test_auth_commands.py
+++ b/tests/test_litellm/proxy/client/cli/test_auth_commands.py
@@ -16,7 +16,6 @@ from litellm.constants import CLI_JWT_EXPIRATION_HOURS
 from litellm.litellm_core_utils.cli_keyring import (
     DISABLE_KEYRING_ENV_VAR,
     KeyringDisabled,
-    KeyringDiscardsWrites,
     KeyringNotInstalled,
 )
 from litellm.litellm_core_utils.cli_token_utils import CliTokenRecord, save_cli_token
@@ -1068,7 +1067,7 @@ class TestKeychainBackedCommands:
     ):
         """A backend that accepts writes and stores nothing must not be reported as keychain
         storage, because the file is then told to drop the only remaining copy."""
-        result = self._login(secret_vault_factory(available=False, failure=KeyringDiscardsWrites()))
+        result = self._login(secret_vault_factory(discards=True))
 
         token_file = isolated_home / ".litellm" / "token.json"
         assert result.exit_code == 0