From 3169cb286b4ebcf032d0061a2b72f659843a53bc Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 21:42:40 +0000
Subject: [PATCH] test(proxy): assert SSO rotation ciphertext fails to decrypt
 under old master key

---
 .../test_key_management_endpoints.py                     | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py b/tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py
index fbe9a992257..e0320427682 100644
--- a/tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py
+++ b/tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py
@@ -14709,6 +14709,15 @@ async def test_rotate_sso_config_reencrypts_all_string_fields(monkeypatch):
     # non-string field passes through unchanged
     assert rotated["role_mappings"] == {"admin": ["proxy_admin"]}
 
+    assert (
+        decrypt_value_helper(
+            rotated["google_client_secret"],
+            key="google_client_secret",
+            exception_type="debug",
+        )
+        != "google-secret"
+    )
+
     monkeypatch.setattr("litellm.proxy.proxy_server.master_key", new_key)
     assert (
         decrypt_value_helper(