diff --git a/terraform/provider/litellm/resource_team_member.go b/terraform/provider/litellm/resource_team_member.go index 4e7b628076d..fa7fad597cb 100644 --- a/terraform/provider/litellm/resource_team_member.go +++ b/terraform/provider/litellm/resource_team_member.go @@ -171,15 +171,24 @@ func resourceLiteLLMTeamMemberRead(d *schema.ResourceData, m interface{}) error d.Set("role", found.Role) } + // Always reconcile the per-team budget: if the membership row, its budget + // table, or max_budget is gone, clear the attribute so out-of-band removals + // show up as drift instead of keeping the stale value in state. + var maxBudget *float64 for _, membership := range info.TeamMemberships { if membership.UserID != userID { continue } - if membership.LiteLLMBudgetTable != nil && membership.LiteLLMBudgetTable.MaxBudget != nil { - d.Set("max_budget_in_team", *membership.LiteLLMBudgetTable.MaxBudget) + if membership.LiteLLMBudgetTable != nil { + maxBudget = membership.LiteLLMBudgetTable.MaxBudget } break } + if maxBudget != nil { + d.Set("max_budget_in_team", *maxBudget) + } else { + d.Set("max_budget_in_team", nil) + } d.SetId(fmt.Sprintf("%s:%s", teamID, userID)) return nil @@ -234,10 +243,7 @@ func resourceLiteLLMTeamMemberDelete(d *schema.ResourceData, m interface{}) erro if resp.StatusCode == http.StatusNotFound || resp.StatusCode == http.StatusBadRequest { body, _ := io.ReadAll(resp.Body) bodyStr := string(body) - if resp.StatusCode == http.StatusNotFound || - strings.Contains(bodyStr, "User not found in team") || - strings.Contains(bodyStr, "does not exist") || - strings.Contains(bodyStr, "Team not found") { + if isTeamMemberAlreadyGone(resp.StatusCode, bodyStr) { log.Printf("[WARN] Team member already gone (%s): %s", resp.Status, bodyStr) d.SetId("") return nil @@ -254,3 +260,21 @@ func resourceLiteLLMTeamMemberDelete(d *schema.ResourceData, m interface{}) erro d.SetId("") return nil } + +// isTeamMemberAlreadyGone reports whether a /team/member_delete error means the +// member or team was already removed outside Terraform. Only 404s and the +// proxy's concrete "not found" messages qualify, so unrelated 400 validation +// errors still fail the destroy. +func isTeamMemberAlreadyGone(statusCode int, body string) bool { + if statusCode == http.StatusNotFound { + return true + } + if statusCode != http.StatusBadRequest { + return false + } + if strings.Contains(body, "User not found in team") { + return true + } + // "Team id= does not exist in db" + return strings.Contains(body, "Team id=") && strings.Contains(body, "does not exist in db") +} diff --git a/terraform/provider/litellm/resource_team_member_test.go b/terraform/provider/litellm/resource_team_member_test.go index fb0e59dd562..30991d8524f 100644 --- a/terraform/provider/litellm/resource_team_member_test.go +++ b/terraform/provider/litellm/resource_team_member_test.go @@ -132,3 +132,90 @@ func TestTeamMemberDeleteTreatsAlreadyGoneAsSuccess(t *testing.T) { t.Fatalf("expected empty id after gone delete, id=%q", d.Id()) } } + +func TestTeamMemberReadClearsRemovedBudget(t *testing.T) { + cases := map[string]string{ + "no membership row": `[]`, + "null budget table": `[{"user_id":"user-1","litellm_budget_table":null}]`, + "null max_budget": `[{"user_id":"user-1","litellm_budget_table":{"max_budget":null}}]`, + "other member budget": `[{"user_id":"user-2","litellm_budget_table":{"max_budget":9}}]`, + } + for name, memberships := range cases { + t.Run(name, func(t *testing.T) { + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + w.Write([]byte(`{ + "team_id":"team-1", + "team_info":{"members_with_roles":[{"user_id":"user-1","user_email":"u@example.com","role":"user"}]}, + "team_memberships":` + memberships + ` + }`)) + })) + defer srv.Close() + + client := NewClient(srv.URL, "test-key", true) + d := schema.TestResourceDataRaw(t, resourceLiteLLMTeamMember().Schema, map[string]interface{}{ + "team_id": "team-1", + "user_id": "user-1", + "user_email": "u@example.com", + "role": "user", + "max_budget_in_team": 12.5, + }) + d.SetId("team-1:user-1") + + if err := resourceLiteLLMTeamMemberRead(d, client); err != nil { + t.Fatalf("read failed: %v", err) + } + if d.Id() == "" { + t.Fatalf("expected member to remain in state") + } + if got := d.Get("max_budget_in_team").(float64); got != 0 { + t.Fatalf("max_budget_in_team=%v want cleared (0)", got) + } + }) + } +} + +func TestIsTeamMemberAlreadyGone(t *testing.T) { + cases := []struct { + status int + body string + want bool + }{ + {http.StatusNotFound, ``, true}, + {http.StatusBadRequest, `{"detail":{"error":"User not found in team"}}`, true}, + {http.StatusBadRequest, `{"detail":{"error":"Team id=team-1 does not exist in db"}}`, true}, + {http.StatusBadRequest, `{"detail":{"error":"Either user_id or user_email needs to be passed in"}}`, false}, + {http.StatusBadRequest, `{"detail":{"error":"budget does not exist"}}`, false}, + {http.StatusForbidden, `{"detail":{"error":"User not found in team"}}`, false}, + } + for _, c := range cases { + if got := isTeamMemberAlreadyGone(c.status, c.body); got != c.want { + t.Errorf("isTeamMemberAlreadyGone(%d, %q)=%v want %v", c.status, c.body, got, c.want) + } + } +} + +func TestTeamMemberDeleteFailsOnUnrelatedBadRequest(t *testing.T) { + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + w.WriteHeader(http.StatusBadRequest) + w.Write([]byte(`{"detail":{"error":"Either user_id or user_email needs to be passed in"}}`)) + })) + defer srv.Close() + + client := NewClient(srv.URL, "test-key", true) + d := schema.TestResourceDataRaw(t, resourceLiteLLMTeamMember().Schema, map[string]interface{}{ + "team_id": "team-1", + "user_id": "user-1", + "user_email": "u@example.com", + "role": "user", + }) + d.SetId("team-1:user-1") + + if err := resourceLiteLLMTeamMemberDelete(d, client); err == nil { + t.Fatalf("expected delete to fail on unrelated 400") + } + if d.Id() == "" { + t.Fatalf("expected id to be kept after failed delete") + } +}