From 3c8ae26e3572e02a63a2a6f1d074d5ee2ec311cc Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Wed, 10 Jun 2026 18:59:25 -0700
Subject: [PATCH] test(proxy/client): isolate client tests from the developer's
 real CLI token

Client falls back to the key stored by lite login when no api_key is
given, so test_client_without_api_key failed on any machine whose
~/.litellm/token.json was issued for the URL the test uses. An autouse
conftest fixture now stubs load_cli_token for the whole client test
directory; the same latent leak existed in test_models.py and
test_model_groups.py. Also dedupes test functions in test_client.py
that shadowed each other and adds coverage for the CLI token fallback
and its base_url origin check, which had no tests at the Client level
---
 tests/test_litellm/proxy/client/conftest.py   |  9 ++++
 .../test_litellm/proxy/client/test_client.py  | 41 +++++++++++++------
 2 files changed, 37 insertions(+), 13 deletions(-)
 create mode 100644 tests/test_litellm/proxy/client/conftest.py

diff --git a/tests/test_litellm/proxy/client/conftest.py b/tests/test_litellm/proxy/client/conftest.py
new file mode 100644
index 00000000000..21f3c0e0a17
--- /dev/null
+++ b/tests/test_litellm/proxy/client/conftest.py
@@ -0,0 +1,9 @@
+import pytest
+
+
+@pytest.fixture(autouse=True)
+def isolate_from_real_cli_token(monkeypatch):
+    """Never let tests read the developer's real ~/.litellm/token.json from `lite login`."""
+    monkeypatch.setattr(
+        "litellm.litellm_core_utils.cli_token_utils.load_cli_token", lambda: None
+    )
diff --git a/tests/test_litellm/proxy/client/test_client.py b/tests/test_litellm/proxy/client/test_client.py
index c97094802ce..70eb546e608 100644
--- a/tests/test_litellm/proxy/client/test_client.py
+++ b/tests/test_litellm/proxy/client/test_client.py
@@ -74,18 +74,40 @@ def test_client_without_api_key(base_url):
     assert client.http._api_key is None
 
 
-def test_client_initialization():
-    """Test that the client is initialized correctly."""
+def test_client_falls_back_to_stored_cli_token(base_url, monkeypatch):
+    """Test that the client uses the `lite login` token issued for this server"""
+    monkeypatch.setattr(
+        "litellm.litellm_core_utils.cli_token_utils.load_cli_token",
+        lambda: {"key": "sk-cli-token", "base_url": base_url},
+    )
+
+    client = Client(base_url=base_url)
+
+    assert client._api_key == "sk-cli-token"
+    assert client.http._api_key == "sk-cli-token"
+
+
+def test_client_ignores_cli_token_issued_for_other_server(base_url, monkeypatch):
+    """Test that the client never sends a stored CLI token to a different server"""
+    monkeypatch.setattr(
+        "litellm.litellm_core_utils.cli_token_utils.load_cli_token",
+        lambda: {"key": "sk-cli-token", "base_url": "https://other-proxy.example"},
+    )
+
+    client = Client(base_url=base_url)
+
+    assert client._api_key is None
+    assert client.http._api_key is None
+
+
+def test_client_custom_timeout():
+    """Test that the client passes a custom timeout to the http client."""
     client = Client(
         base_url="http://localhost:4000",
         api_key="test-key",
         timeout=60,
     )
 
-    # Check that http client is initialized correctly
-    assert isinstance(client.http, HTTPClient)
-    assert client.http._base_url == "http://localhost:4000"
-    assert client.http._api_key == "test-key"
     assert client.http._timeout == 60
 
 
@@ -97,10 +119,3 @@ def test_client_default_timeout():
     )
 
     assert client.http._timeout == 30
-
-
-def test_client_without_api_key():
-    """Test that the client works without an API key."""
-    client = Client(base_url="http://localhost:4000")
-
-    assert client.http._api_key is None