From 5493dd26ff3b1e35793f7541af8ea46d46573b67 Mon Sep 17 00:00:00 2001
From: ryan-crabbe-berri <ryan@berri.ai>
Date: Fri, 5 Jun 2026 11:41:15 -0700
Subject: [PATCH] test(proxy): cover auth_v2 policy-admin gate (_require_admin)
 - privilege escalation guard

The policy CRUD endpoints were gated by _require_admin but it had no test. Add
deny/allow coverage: only PROXY_ADMIN may edit policies; view-only admins, every
other role, and no role are rejected with 403. This is the guard that stops a
non-admin from editing the casbin policy store, so a silent regression here would
be a privilege escalation.
---
 .../auth/v2/test_management_endpoints.py      | 32 ++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/tests/test_litellm/proxy/auth/v2/test_management_endpoints.py b/tests/test_litellm/proxy/auth/v2/test_management_endpoints.py
index 8270a830d7d..d926b07c0a5 100644
--- a/tests/test_litellm/proxy/auth/v2/test_management_endpoints.py
+++ b/tests/test_litellm/proxy/auth/v2/test_management_endpoints.py
@@ -1,4 +1,34 @@
-from litellm.proxy.auth.v2.management_endpoints import rule_to_row_data, row_to_rule
+from types import SimpleNamespace
+
+import pytest
+from fastapi import HTTPException
+
+from litellm.proxy._types import LitellmUserRoles
+from litellm.proxy.auth.v2.management_endpoints import (
+    _require_admin,
+    row_to_rule,
+    rule_to_row_data,
+)
+
+
+def test_require_admin_allows_only_proxy_admin():
+    # No raise for a full proxy admin.
+    _require_admin(SimpleNamespace(user_role=LitellmUserRoles.PROXY_ADMIN))
+
+
+def test_require_admin_blocks_non_admins():
+    # Privilege-escalation guard: only PROXY_ADMIN may edit policies. View-only
+    # admins and every other role (and no role) must be rejected with 403.
+    for role in (
+        LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY,
+        LitellmUserRoles.INTERNAL_USER,
+        LitellmUserRoles.INTERNAL_USER_VIEW_ONLY,
+        LitellmUserRoles.TEAM,
+        None,
+    ):
+        with pytest.raises(HTTPException) as exc:
+            _require_admin(SimpleNamespace(user_role=role))
+        assert exc.value.status_code == 403
 
 
 class _Row: