From 39dc32bb144a9370a06d51fb7f3d8bd29cdf2191 Mon Sep 17 00:00:00 2001 From: Alexsander Hamir Date: Tue, 10 Feb 2026 16:08:58 -0800 Subject: [PATCH] fix: make OIDC Google tests use context-manager mocks to prevent real API calls - Use with patch(): so mocks are active when get_secret() runs - Patch HTTPHandler in main as fallback to avoid real httpx usage - Fixes failures in CI (ConnectError / Google OIDC provider failed) when decorator-based patches did not apply reliably --- .../test_secret_managers_main.py | 70 +++++++++++++------ 1 file changed, 48 insertions(+), 22 deletions(-) diff --git a/tests/test_litellm/secret_managers/test_secret_managers_main.py b/tests/test_litellm/secret_managers/test_secret_managers_main.py index 4baf715549d..4a6e303586a 100644 --- a/tests/test_litellm/secret_managers/test_secret_managers_main.py +++ b/tests/test_litellm/secret_managers/test_secret_managers_main.py @@ -46,15 +46,24 @@ def mock_env(): yield os.environ -@patch("litellm.secret_managers.main.oidc_cache") -@patch("litellm.secret_managers.main._get_oidc_http_handler") -@patch("httpx.Client") # Prevent any real HTTP connections -def test_oidc_google_success(mock_httpx_client, mock_get_http_handler, mock_oidc_cache): - mock_oidc_cache.get_cache.return_value = None - mock_handler = MockHTTPHandler(timeout=600.0) - mock_get_http_handler.return_value = mock_handler +def test_oidc_google_success(): + """Test Google OIDC token fetch with mocked handler (no real network calls).""" secret_name = "oidc/google/[invalid url, do not cite]" - result = get_secret(secret_name) + mock_handler = MockHTTPHandler(timeout=600.0) + mock_get_http_handler = Mock(return_value=mock_handler) + mock_oidc_cache = Mock() + mock_oidc_cache.get_cache.return_value = None + + with patch("litellm.secret_managers.main.oidc_cache", mock_oidc_cache): + with patch( + "litellm.secret_managers.main._get_oidc_http_handler", + mock_get_http_handler, + ): + with patch( + "litellm.secret_managers.main.HTTPHandler", + side_effect=lambda timeout=None: mock_handler, + ): + result = get_secret(secret_name) assert result == "mocked_token" assert mock_handler.last_params == {"audience": "[invalid url, do not cite]"} @@ -63,32 +72,49 @@ def test_oidc_google_success(mock_httpx_client, mock_get_http_handler, mock_oidc ) -@patch("litellm.secret_managers.main.oidc_cache") -@patch("litellm.secret_managers.main._get_oidc_http_handler") -def test_oidc_google_cached(mock_get_http_handler, mock_oidc_cache): +def test_oidc_google_cached(): + """Test Google OIDC uses cache and does not call HTTP (no real network calls).""" + secret_name = "oidc/google/[invalid url, do not cite]" + mock_get_http_handler = Mock() + mock_oidc_cache = Mock() mock_oidc_cache.get_cache.return_value = "cached_token" - secret_name = "oidc/google/[invalid url, do not cite]" - result = get_secret(secret_name) + with patch("litellm.secret_managers.main.oidc_cache", mock_oidc_cache): + with patch( + "litellm.secret_managers.main._get_oidc_http_handler", + mock_get_http_handler, + ): + with patch( + "litellm.secret_managers.main.HTTPHandler", + Mock(side_effect=AssertionError("HTTPHandler should not be used")), + ): + result = get_secret(secret_name) assert result == "cached_token", f"Expected cached token, got {result}" mock_oidc_cache.get_cache.assert_called_with(key=secret_name) - # Verify HTTP handler was never called since we had a cached token mock_get_http_handler.assert_not_called() -@patch("litellm.secret_managers.main.oidc_cache") -@patch("litellm.secret_managers.main._get_oidc_http_handler") -def test_oidc_google_failure(mock_get_http_handler, mock_oidc_cache): +def test_oidc_google_failure(): + """Test Google OIDC raises when provider returns error (no real network calls).""" + secret_name = "oidc/google/https://example.com/api" mock_handler = MockHTTPHandler(timeout=600.0) mock_handler.status_code = 400 - mock_get_http_handler.return_value = mock_handler + mock_get_http_handler = Mock(return_value=mock_handler) + mock_oidc_cache = Mock() mock_oidc_cache.get_cache.return_value = None - - secret_name = "oidc/google/https://example.com/api" - with pytest.raises(ValueError, match="Google OIDC provider failed"): - get_secret(secret_name) + with patch("litellm.secret_managers.main.oidc_cache", mock_oidc_cache): + with patch( + "litellm.secret_managers.main._get_oidc_http_handler", + mock_get_http_handler, + ): + with patch( + "litellm.secret_managers.main.HTTPHandler", + side_effect=lambda timeout=None: mock_handler, + ): + with pytest.raises(ValueError, match="Google OIDC provider failed"): + get_secret(secret_name) def test_oidc_circleci_success(monkeypatch):