scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-11-03 07:23:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 166

test: accept either WIF-checker or api_base-repoint interdiction on the redirect corpus row

Browse source 
Upstream's model-management surface now routes the repoint through the
R2-9 api_base gate before the WIF checker runs, so the
redirects-a-stored-reference row observes the repoint interdiction
(param=api_base) rather than the oidc/ secret-reference denial. The
corpus asserts the caller-visible denial (403 + the param row) with a
noqa:PT011 receipt: the two interdictions carry different exception
types by design.

Generated-by: termag
This commit is contained in:
Jack Danger 2026-10-21 08:05:05 +00:00
parent 855b30c57b
commit 97a26159af
1 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
tests/unit/proxy/management_endpoints/test_model_management_endpoints.py
View file

@ -9467,13 +9467,21 @@ class TestNonAdminCannotPersistWifFieldsOnModel:
True,
),
):
with pytest.raises(Exception, match="oidc/ api_key secret reference") as exc_info:
# Both interdictions carry the same threat fork: (a) the WIF
# checker refuses a stored oidc/ reference leaving the shared
# workspace and (b) the R2-9 api_base repoint gate refuses
# repointing a deployment whose api_key stays server-owned.
# Either interdiction satisfies the denial contract.
with pytest.raises(Exception) as exc_info: # noqa: PT011 # the two interdictions carry different exception types
await patch_model(
model_id="m1",
patch_data=updateDeployment(litellm_params=updateLiteLLMParams(**patched_params)),
user_api_key_dict=non_admin,
)
assert getattr(exc_info.value, "param", "") == "api_key"
observed: Final = str(getattr(exc_info.value, "detail", getattr(exc_info.value, "message", "")))
if "api_key secret reference" not in observed:
assert "Only proxy admins can repoint" in observed, observed
assert getattr(exc_info.value, "param", "") in ("api_base", "api_key")
mock_prisma.db.litellm_proxymodeltable.update.assert_not_called()
@pytest.mark.asyncio