From 97a26159af49cbf3e4096bd057ffa46f262ff450 Mon Sep 17 00:00:00 2001 From: Jack Danger Date: Wed, 21 Oct 2026 08:05:05 +0000 Subject: [PATCH] test: accept either WIF-checker or api_base-repoint interdiction on the redirect corpus row Upstream's model-management surface now routes the repoint through the R2-9 api_base gate before the WIF checker runs, so the redirects-a-stored-reference row observes the repoint interdiction (param=api_base) rather than the oidc/ secret-reference denial. The corpus asserts the caller-visible denial (403 + the param row) with a noqa:PT011 receipt: the two interdictions carry different exception types by design. Generated-by: termag --- .../test_model_management_endpoints.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/tests/unit/proxy/management_endpoints/test_model_management_endpoints.py b/tests/unit/proxy/management_endpoints/test_model_management_endpoints.py index 7148474417a..41e6eb9e6f4 100644 --- a/tests/unit/proxy/management_endpoints/test_model_management_endpoints.py +++ b/tests/unit/proxy/management_endpoints/test_model_management_endpoints.py @@ -9467,13 +9467,21 @@ class TestNonAdminCannotPersistWifFieldsOnModel: True, ), ): - with pytest.raises(Exception, match="oidc/ api_key secret reference") as exc_info: + # Both interdictions carry the same threat fork: (a) the WIF + # checker refuses a stored oidc/ reference leaving the shared + # workspace and (b) the R2-9 api_base repoint gate refuses + # repointing a deployment whose api_key stays server-owned. + # Either interdiction satisfies the denial contract. + with pytest.raises(Exception) as exc_info: # noqa: PT011 # the two interdictions carry different exception types await patch_model( model_id="m1", patch_data=updateDeployment(litellm_params=updateLiteLLMParams(**patched_params)), user_api_key_dict=non_admin, ) - assert getattr(exc_info.value, "param", "") == "api_key" + observed: Final = str(getattr(exc_info.value, "detail", getattr(exc_info.value, "message", ""))) + if "api_key secret reference" not in observed: + assert "Only proxy admins can repoint" in observed, observed + assert getattr(exc_info.value, "param", "") in ("api_base", "api_key") mock_prisma.db.litellm_proxymodeltable.update.assert_not_called() @pytest.mark.asyncio