scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-14 23:21:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 156

test(ui_sso): cover most-permissive app_role selection in callback

Browse source
This commit is contained in:
Devin AI 2026-07-15 20:27:45 +00:00
parent f08ded5324
commit 95ea1aae1c
2 changed files with 37 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
tests/test_litellm/proxy/management_endpoints/test_entraid_app_roles.py
View file

@ -98,8 +98,6 @@ def test_defaults_to_internal_user_viewer_when_no_role():
@pytest.mark.parametrize(
"app_roles, expected",
[
# Regression for #33434: the most permissive role wins regardless of
# its position in the array, instead of always picking the first entry.
(["internal_user", "proxy_admin"], LitellmUserRoles.PROXY_ADMIN),
(["proxy_admin", "internal_user"], LitellmUserRoles.PROXY_ADMIN),
(
@ -107,11 +105,9 @@ def test_defaults_to_internal_user_viewer_when_no_role():
LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY,
),
(["org_admin", "proxy_admin_viewer"], LitellmUserRoles.ORG_ADMIN),
# Unknown roles are ignored; the single valid one is selected.
(["some_custom_role", "internal_user"], LitellmUserRoles.INTERNAL_USER),
(["PROXY_ADMIN", "internal_user"], LitellmUserRoles.PROXY_ADMIN),
(["internal_user"], LitellmUserRoles.INTERNAL_USER),
# No valid roles at all.
(["some_custom_role", "another_unknown_role"], None),
([], None),
],

37
tests/test_litellm/proxy/management_endpoints/test_ui_sso.py
View file

@ -223,6 +223,43 @@ def test_get_microsoft_callback_response():
assert result.last_name == "User"
def test_get_microsoft_callback_response_picks_most_permissive_app_role():
from litellm.proxy._types import LitellmUserRoles
mock_request = MagicMock(spec=Request)
mock_response = {
"mail": "microsoft_user@example.com",
"displayName": "Microsoft User",
"id": "msft123",
"givenName": "Microsoft",
"surname": "User",
}
with patch.dict(
os.environ,
{"MICROSOFT_CLIENT_SECRET": "mock_secret", "MICROSOFT_TENANT": "mock_tenant"},
):
mock_verify = AsyncMock(return_value=mock_response)
with patch(
"fastapi_sso.sso.microsoft.MicrosoftSSO.verify_and_process",
new=mock_verify,
), patch.object(
MicrosoftSSOHandler,
"get_app_roles_from_id_token",
return_value=["internal_user", "proxy_admin"],
):
result = asyncio.run(
MicrosoftSSOHandler.get_microsoft_callback_response(
request=mock_request,
microsoft_client_id="mock_client_id",
redirect_url="http://mock_redirect_url",
)
)
assert isinstance(result, CustomOpenID)
assert result.user_role == LitellmUserRoles.PROXY_ADMIN
def test_get_microsoft_callback_response_raw_sso_response():
# Arrange
mock_request = MagicMock(spec=Request)