From 21ffbdc7ea30dacc0cbb91f4a246e70df2233de9 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 17 Sep 2026 05:59:01 +0000 Subject: [PATCH 1/5] feat(policy_engine): explicit priority for policy attachment execution order Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .../migration.sql | 1 + .../litellm_proxy_extras/schema.prisma | 1 + .../policy_engine/attachment_registry.py | 16 ++++- .../proxy/policy_engine/policy_endpoints.py | 1 + litellm/proxy/schema.prisma | 1 + .../types/proxy/policy_engine/policy_types.py | 4 ++ .../proxy/policy_engine/resolver_types.py | 8 +++ schema.prisma | 1 + .../policy_engine/test_attachment_registry.py | 69 ++++++++++++++++++- 9 files changed, 98 insertions(+), 4 deletions(-) create mode 100644 litellm-proxy-extras/litellm_proxy_extras/migrations/20260917055603_add_policy_attachment_priority/migration.sql diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260917055603_add_policy_attachment_priority/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260917055603_add_policy_attachment_priority/migration.sql new file mode 100644 index 00000000000..7838c23df4e --- /dev/null +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260917055603_add_policy_attachment_priority/migration.sql @@ -0,0 +1 @@ +ALTER TABLE "LiteLLM_PolicyAttachmentTable" ADD COLUMN "priority" INTEGER; diff --git a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma index 139fb031671..72c422c7421 100644 --- a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma +++ b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma @@ -1378,6 +1378,7 @@ model LiteLLM_PolicyAttachmentTable { keys String[] @default([]) // Key aliases or patterns models String[] @default([]) // Model names or patterns tags String[] @default([]) // Tag patterns (e.g., ["healthcare", "prod-*"]) + priority Int? // Explicit execution order created_at DateTime @default(now()) created_by String? updated_at DateTime @default(now()) @updatedAt diff --git a/litellm/proxy/policy_engine/attachment_registry.py b/litellm/proxy/policy_engine/attachment_registry.py index 76b2291774e..3735c335bd4 100644 --- a/litellm/proxy/policy_engine/attachment_registry.py +++ b/litellm/proxy/policy_engine/attachment_registry.py @@ -48,6 +48,13 @@ def _attachment_specificity(attachment: PolicyAttachment) -> tuple[int, int]: return (max(dims, default=0), len(dims)) +def _attachment_sort_key(attachment: PolicyAttachment) -> tuple[int, int, int, int]: + specificity: Final = _attachment_specificity(attachment) + if attachment.priority is not None: + return (0, attachment.priority, *specificity) + return (1, 0, *specificity) + + class AttachmentRegistry: """ In-memory registry for storing and managing policy attachments. @@ -111,6 +118,7 @@ class AttachmentRegistry: keys=attachment_data.get("keys"), models=attachment_data.get("models"), tags=attachment_data.get("tags"), + priority=attachment_data.get("priority"), ) def get_attached_policies(self, context: PolicyMatchContext) -> list[str]: @@ -140,7 +148,7 @@ class AttachmentRegistry: for attachment in self._attachments if PolicyMatcher.scope_matches(scope=attachment.to_policy_scope(), context=context) ), - key=_attachment_specificity, + key=_attachment_sort_key, ) broadest_attachment_by_policy: Final = MappingProxyType( {attachment.policy: attachment for attachment in reversed(matching_attachments)} @@ -315,6 +323,7 @@ class AttachmentRegistry: "keys": attachment_request.keys or [], "models": attachment_request.models or [], "tags": attachment_request.tags or [], + "priority": attachment_request.priority, "created_at": datetime.now(timezone.utc), "updated_at": datetime.now(timezone.utc), "created_by": created_by, @@ -330,6 +339,7 @@ class AttachmentRegistry: keys=attachment_request.keys, models=attachment_request.models, tags=attachment_request.tags, + priority=attachment_request.priority, ) self.add_attachment(attachment) @@ -341,6 +351,7 @@ class AttachmentRegistry: keys=created_attachment.keys or [], models=created_attachment.models or [], tags=created_attachment.tags or [], + priority=created_attachment.priority, created_at=created_attachment.created_at, updated_at=created_attachment.updated_at, created_by=created_attachment.created_by, @@ -417,6 +428,7 @@ class AttachmentRegistry: keys=attachment.keys or [], models=attachment.models or [], tags=attachment.tags or [], + priority=attachment.priority, created_at=attachment.created_at, updated_at=attachment.updated_at, created_by=attachment.created_by, @@ -455,6 +467,7 @@ class AttachmentRegistry: keys=a.keys or [], models=a.models or [], tags=a.tags or [], + priority=a.priority, created_at=a.created_at, updated_at=a.updated_at, created_by=a.created_by, @@ -488,6 +501,7 @@ class AttachmentRegistry: keys=attachment_response.keys if attachment_response.keys else None, models=(attachment_response.models if attachment_response.models else None), tags=attachment_response.tags if attachment_response.tags else None, + priority=attachment_response.priority, ) for attachment_response in attachments ] diff --git a/litellm/proxy/policy_engine/policy_endpoints.py b/litellm/proxy/policy_engine/policy_endpoints.py index dc42e7dc6cd..1e30238c8b4 100644 --- a/litellm/proxy/policy_engine/policy_endpoints.py +++ b/litellm/proxy/policy_engine/policy_endpoints.py @@ -60,6 +60,7 @@ def _config_attachment_to_db_response(index: int, attachment: PolicyAttachment) keys=attachment.keys or [], models=attachment.models or [], tags=attachment.tags or [], + priority=attachment.priority, definition_location="config", ) diff --git a/litellm/proxy/schema.prisma b/litellm/proxy/schema.prisma index 139fb031671..72c422c7421 100644 --- a/litellm/proxy/schema.prisma +++ b/litellm/proxy/schema.prisma @@ -1378,6 +1378,7 @@ model LiteLLM_PolicyAttachmentTable { keys String[] @default([]) // Key aliases or patterns models String[] @default([]) // Model names or patterns tags String[] @default([]) // Tag patterns (e.g., ["healthcare", "prod-*"]) + priority Int? // Explicit execution order created_at DateTime @default(now()) created_by String? updated_at DateTime @default(now()) @updatedAt diff --git a/litellm/types/proxy/policy_engine/policy_types.py b/litellm/types/proxy/policy_engine/policy_types.py index 28144cd5b81..8e96cd81772 100644 --- a/litellm/types/proxy/policy_engine/policy_types.py +++ b/litellm/types/proxy/policy_engine/policy_types.py @@ -288,6 +288,10 @@ class PolicyAttachment(BaseModel): default=None, description="Tag patterns this attachment applies to. Supports wildcards (e.g., health-*).", ) + priority: int | None = Field( + default=None, + description="Explicit execution order. Attachments with a priority run before those without, lower first; ties fall back to scope specificity.", + ) model_config = ConfigDict(extra="forbid") diff --git a/litellm/types/proxy/policy_engine/resolver_types.py b/litellm/types/proxy/policy_engine/resolver_types.py index 9e69f303559..74cda47ff96 100644 --- a/litellm/types/proxy/policy_engine/resolver_types.py +++ b/litellm/types/proxy/policy_engine/resolver_types.py @@ -305,6 +305,10 @@ class PolicyAttachmentCreateRequest(BaseModel): default=None, description="Tag patterns this attachment applies to. Supports wildcards (e.g., health-*).", ) + priority: int | None = Field( + default=None, + description="Explicit execution order. Attachments with a priority run before those without, lower first; ties fall back to scope specificity.", + ) class PolicyAttachmentDBResponse(BaseModel): @@ -317,6 +321,10 @@ class PolicyAttachmentDBResponse(BaseModel): keys: list[str] = Field(default_factory=list, description="Key patterns.") models: list[str] = Field(default_factory=list, description="Model patterns.") tags: list[str] = Field(default_factory=list, description="Tag patterns.") + priority: int | None = Field( + default=None, + description="Explicit execution order. Attachments with a priority run before those without, lower first; ties fall back to scope specificity.", + ) created_at: datetime | None = Field(default=None, description="When the attachment was created.") updated_at: datetime | None = Field(default=None, description="When the attachment was last updated.") created_by: str | None = Field(default=None, description="Who created the attachment.") diff --git a/schema.prisma b/schema.prisma index 139fb031671..72c422c7421 100644 --- a/schema.prisma +++ b/schema.prisma @@ -1378,6 +1378,7 @@ model LiteLLM_PolicyAttachmentTable { keys String[] @default([]) // Key aliases or patterns models String[] @default([]) // Model names or patterns tags String[] @default([]) // Tag patterns (e.g., ["healthcare", "prod-*"]) + priority Int? // Explicit execution order created_at DateTime @default(now()) created_by String? updated_at DateTime @default(now()) @updatedAt diff --git a/tests/test_litellm/proxy/policy_engine/test_attachment_registry.py b/tests/test_litellm/proxy/policy_engine/test_attachment_registry.py index fa37a02a37c..1f3859e61ad 100644 --- a/tests/test_litellm/proxy/policy_engine/test_attachment_registry.py +++ b/tests/test_litellm/proxy/policy_engine/test_attachment_registry.py @@ -158,6 +158,37 @@ class TestGetAttachedPolicies: "model-policy", ] + def test_prioritized_attachments_run_before_unprioritized_attachments(self): + registry = AttachmentRegistry() + registry.load_attachments( + [ + {"policy": "unprioritized-tag", "tags": ["prod"]}, + {"policy": "prioritized-tag", "tags": ["prod"], "priority": 5}, + {"policy": "prioritized-model", "models": ["gpt-4"], "priority": 0}, + ] + ) + + context = PolicyMatchContext(model="gpt-4", tags=["prod"]) + + assert registry.get_attached_policies(context) == [ + "prioritized-model", + "prioritized-tag", + "unprioritized-tag", + ] + + def test_prioritized_attachments_order_by_priority_across_scope_tiers(self): + registry = AttachmentRegistry() + registry.load_attachments( + [ + {"policy": "team-policy", "teams": ["team-a"], "priority": 2}, + {"policy": "model-policy", "models": ["gpt-4"], "priority": 1}, + ] + ) + + context = PolicyMatchContext(team_alias="team-a", model="gpt-4") + + assert registry.get_attached_policies(context) == ["model-policy", "team-policy"] + def test_combined_team_and_model_attachment_uses_model_specificity(self): registry = AttachmentRegistry() registry.load_attachments( @@ -474,8 +505,28 @@ class TestAttachmentRegistrySingleton: registry2 = get_attachment_registry() assert registry1 is registry2 + def test_parse_attachment_reads_priority(self): + registry = AttachmentRegistry() + registry.load_attachments( + [ + {"policy": "prioritized", "priority": 4}, + {"policy": "unprioritized"}, + ] + ) -def _make_db_attachment_row(attachment_id="att-1", policy_name="db-policy", scope=None, teams=None): + attachments = registry.get_all_attachments() + + assert attachments[0].priority == 4 + assert attachments[1].priority is None + + +def _make_db_attachment_row( + attachment_id: str = "att-1", + policy_name: str = "db-policy", + scope: str | None = None, + teams: list[str] | None = None, + priority: int | None = None, +) -> MagicMock: row = MagicMock() row.attachment_id = attachment_id row.policy_name = policy_name @@ -484,6 +535,7 @@ def _make_db_attachment_row(attachment_id="att-1", policy_name="db-policy", scop row.keys = [] row.models = [] row.tags = [] + row.priority = priority row.created_at = datetime.now(timezone.utc) row.updated_at = datetime.now(timezone.utc) row.created_by = None @@ -491,9 +543,11 @@ def _make_db_attachment_row(attachment_id="att-1", policy_name="db-policy", scop return row -def _prisma_with_attachment_rows(rows): +def _prisma_with_attachment_rows(rows: list[MagicMock]) -> MagicMock: prisma = MagicMock() - prisma.db.litellm_policyattachmenttable.find_many = AsyncMock(return_value=rows) + prisma.configure_mock( + **{"db.litellm_policyattachmenttable.find_many": AsyncMock(return_value=rows)} + ) return prisma @@ -535,6 +589,15 @@ class TestConfigAttachmentsPreservedAcrossDbSync: assert len(registry.get_all_attachments()) == 1 + @pytest.mark.asyncio + async def test_sync_round_trips_db_attachment_priority(self): + registry = AttachmentRegistry() + db_row = _make_db_attachment_row(priority=7) + + await registry.sync_attachments_from_db(_prisma_with_attachment_rows([db_row])) + + assert registry.get_all_attachments()[0].priority == 7 + @pytest.mark.asyncio async def test_clear_removes_config_snapshot_so_sync_does_not_resurrect(self): registry = AttachmentRegistry() From f5dea4de7655075345441222c07a24f6053e16a9 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 17 Sep 2026 06:00:25 +0000 Subject: [PATCH 2/5] refactor(policy_engine): shorten attachment priority field descriptions Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- litellm/types/proxy/policy_engine/policy_types.py | 2 +- litellm/types/proxy/policy_engine/resolver_types.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/litellm/types/proxy/policy_engine/policy_types.py b/litellm/types/proxy/policy_engine/policy_types.py index 8e96cd81772..da7d664f9df 100644 --- a/litellm/types/proxy/policy_engine/policy_types.py +++ b/litellm/types/proxy/policy_engine/policy_types.py @@ -290,7 +290,7 @@ class PolicyAttachment(BaseModel): ) priority: int | None = Field( default=None, - description="Explicit execution order. Attachments with a priority run before those without, lower first; ties fall back to scope specificity.", + description="Explicit execution order, lower runs first. Prioritised attachments run before those without one.", ) model_config = ConfigDict(extra="forbid") diff --git a/litellm/types/proxy/policy_engine/resolver_types.py b/litellm/types/proxy/policy_engine/resolver_types.py index 74cda47ff96..2ef79366c91 100644 --- a/litellm/types/proxy/policy_engine/resolver_types.py +++ b/litellm/types/proxy/policy_engine/resolver_types.py @@ -307,7 +307,7 @@ class PolicyAttachmentCreateRequest(BaseModel): ) priority: int | None = Field( default=None, - description="Explicit execution order. Attachments with a priority run before those without, lower first; ties fall back to scope specificity.", + description="Explicit execution order, lower runs first. Prioritised attachments run before those without one.", ) @@ -323,7 +323,7 @@ class PolicyAttachmentDBResponse(BaseModel): tags: list[str] = Field(default_factory=list, description="Tag patterns.") priority: int | None = Field( default=None, - description="Explicit execution order. Attachments with a priority run before those without, lower first; ties fall back to scope specificity.", + description="Explicit execution order, lower runs first. Prioritised attachments run before those without one.", ) created_at: datetime | None = Field(default=None, description="When the attachment was created.") updated_at: datetime | None = Field(default=None, description="When the attachment was last updated.") From 1b1f6ada467436d62605516718f7dade95e29307 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 17 Sep 2026 06:12:42 +0000 Subject: [PATCH 3/5] fix(policy_engine): make priority migration idempotent Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .../migration.sql | 2 +- litellm/proxy/_lazy_openapi_snapshot.json | 36 +++++++++++++++++++ ui/litellm-dashboard/src/lib/http/schema.d.ts | 10 ++++++ 3 files changed, 47 insertions(+), 1 deletion(-) diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260917055603_add_policy_attachment_priority/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260917055603_add_policy_attachment_priority/migration.sql index 7838c23df4e..5efe5f6a72e 100644 --- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260917055603_add_policy_attachment_priority/migration.sql +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260917055603_add_policy_attachment_priority/migration.sql @@ -1 +1 @@ -ALTER TABLE "LiteLLM_PolicyAttachmentTable" ADD COLUMN "priority" INTEGER; +ALTER TABLE "LiteLLM_PolicyAttachmentTable" ADD COLUMN IF NOT EXISTS "priority" INTEGER; diff --git a/litellm/proxy/_lazy_openapi_snapshot.json b/litellm/proxy/_lazy_openapi_snapshot.json index 74f38b3ca6d..341e787a1b1 100644 --- a/litellm/proxy/_lazy_openapi_snapshot.json +++ b/litellm/proxy/_lazy_openapi_snapshot.json @@ -33929,6 +33929,18 @@ "title": "Policy Name", "type": "string" }, + "priority": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ], + "description": "Explicit execution order, lower runs first. Prioritised attachments run before those without one.", + "title": "Priority" + }, "scope": { "anyOf": [ { @@ -34042,6 +34054,18 @@ "title": "Policy Name", "type": "string" }, + "priority": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ], + "description": "Explicit execution order, lower runs first. Prioritised attachments run before those without one.", + "title": "Priority" + }, "scope": { "anyOf": [ { @@ -36062,6 +36086,18 @@ "title": "Policy Name", "type": "string" }, + "priority": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ], + "description": "Explicit execution order, lower runs first. Prioritised attachments run before those without one.", + "title": "Priority" + }, "scope": { "anyOf": [ { diff --git a/ui/litellm-dashboard/src/lib/http/schema.d.ts b/ui/litellm-dashboard/src/lib/http/schema.d.ts index 872875cc535..2027e8ab5a1 100644 --- a/ui/litellm-dashboard/src/lib/http/schema.d.ts +++ b/ui/litellm-dashboard/src/lib/http/schema.d.ts @@ -34487,6 +34487,11 @@ export interface components { * @description Name of the policy to attach. */ policy_name: string; + /** + * Priority + * @description Explicit execution order, lower runs first. Prioritised attachments run before those without one. + */ + priority?: number | null; /** * Scope * @description Use '*' for global scope (applies to all requests). @@ -34545,6 +34550,11 @@ export interface components { * @description Name of the attached policy. */ policy_name: string; + /** + * Priority + * @description Explicit execution order, lower runs first. Prioritised attachments run before those without one. + */ + priority?: number | null; /** * Scope * @description Scope of the attachment. From 669a66499c837d4a1d3fdb91d669245074ca4e5d Mon Sep 17 00:00:00 2001 From: yucheng Date: Thu, 17 Sep 2026 06:47:53 +0000 Subject: [PATCH 4/5] feat(policy_engine): bound priority to int32 and expose it in the Admin UI Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- litellm/proxy/_lazy_openapi_snapshot.json | 4 ++ .../types/proxy/policy_engine/policy_types.py | 2 + .../proxy/policy_engine/resolver_types.py | 2 + .../policy_engine/test_attachment_registry.py | 31 ++++++++++ .../proxy/policy_engine/test_policy_types.py | 15 +++++ .../policy_engine/test_resolver_types.py | 13 +++++ .../_components/AttachmentTable.test.tsx | 17 ++++++ .../_components/AttachmentTableColumns.tsx | 14 +++++ .../_components/add_attachment_form.test.tsx | 57 ++++++++++++++++++- .../_components/add_attachment_form.tsx | 34 +++++++++++ .../_components/build_attachment_data.test.ts | 14 +++++ .../_components/build_attachment_data.ts | 18 +++--- .../src/components/policies/types.ts | 2 + 13 files changed, 215 insertions(+), 8 deletions(-) create mode 100644 tests/test_litellm/types/proxy/policy_engine/test_policy_types.py diff --git a/litellm/proxy/_lazy_openapi_snapshot.json b/litellm/proxy/_lazy_openapi_snapshot.json index 341e787a1b1..b097d4bd340 100644 --- a/litellm/proxy/_lazy_openapi_snapshot.json +++ b/litellm/proxy/_lazy_openapi_snapshot.json @@ -33932,6 +33932,8 @@ "priority": { "anyOf": [ { + "maximum": 2147483647.0, + "minimum": -2147483648.0, "type": "integer" }, { @@ -36089,6 +36091,8 @@ "priority": { "anyOf": [ { + "maximum": 2147483647.0, + "minimum": -2147483648.0, "type": "integer" }, { diff --git a/litellm/types/proxy/policy_engine/policy_types.py b/litellm/types/proxy/policy_engine/policy_types.py index da7d664f9df..66e5fbb4b49 100644 --- a/litellm/types/proxy/policy_engine/policy_types.py +++ b/litellm/types/proxy/policy_engine/policy_types.py @@ -290,6 +290,8 @@ class PolicyAttachment(BaseModel): ) priority: int | None = Field( default=None, + ge=-2147483648, + le=2147483647, description="Explicit execution order, lower runs first. Prioritised attachments run before those without one.", ) diff --git a/litellm/types/proxy/policy_engine/resolver_types.py b/litellm/types/proxy/policy_engine/resolver_types.py index 2ef79366c91..e6f501ed4b5 100644 --- a/litellm/types/proxy/policy_engine/resolver_types.py +++ b/litellm/types/proxy/policy_engine/resolver_types.py @@ -307,6 +307,8 @@ class PolicyAttachmentCreateRequest(BaseModel): ) priority: int | None = Field( default=None, + ge=-2147483648, + le=2147483647, description="Explicit execution order, lower runs first. Prioritised attachments run before those without one.", ) diff --git a/tests/test_litellm/proxy/policy_engine/test_attachment_registry.py b/tests/test_litellm/proxy/policy_engine/test_attachment_registry.py index 1f3859e61ad..089bec59583 100644 --- a/tests/test_litellm/proxy/policy_engine/test_attachment_registry.py +++ b/tests/test_litellm/proxy/policy_engine/test_attachment_registry.py @@ -189,6 +189,37 @@ class TestGetAttachedPolicies: assert registry.get_attached_policies(context) == ["model-policy", "team-policy"] + def test_equal_priority_attachments_fall_back_to_scope_tier_order(self): + registry = AttachmentRegistry() + registry.load_attachments( + [ + {"policy": "model-policy", "models": ["gpt-4"], "priority": 1}, + {"policy": "tag-policy", "tags": ["prod"], "priority": 1}, + {"policy": "global-policy", "scope": "*", "priority": 1}, + ] + ) + + context = PolicyMatchContext(model="gpt-4", tags=["prod"]) + + assert registry.get_attached_policies(context) == ["global-policy", "tag-policy", "model-policy"] + + def test_duplicate_policy_uses_highest_priority_attachment(self): + registry = AttachmentRegistry() + registry.load_attachments( + [ + {"policy": "shared-policy", "scope": "*"}, + {"policy": "global-policy", "scope": "*"}, + {"policy": "shared-policy", "models": ["gpt-4"], "priority": 0}, + ] + ) + + context = PolicyMatchContext(model="gpt-4") + + assert registry.get_attached_policies_with_reasons(context) == [ + {"policy_name": "shared-policy", "matched_via": "model:gpt-4"}, + {"policy_name": "global-policy", "matched_via": "scope:*"}, + ] + def test_combined_team_and_model_attachment_uses_model_specificity(self): registry = AttachmentRegistry() registry.load_attachments( diff --git a/tests/test_litellm/types/proxy/policy_engine/test_policy_types.py b/tests/test_litellm/types/proxy/policy_engine/test_policy_types.py new file mode 100644 index 00000000000..bcd6d39aa4d --- /dev/null +++ b/tests/test_litellm/types/proxy/policy_engine/test_policy_types.py @@ -0,0 +1,15 @@ +import pytest +from pydantic import ValidationError + +from litellm.types.proxy.policy_engine.policy_types import PolicyAttachment + + +@pytest.mark.parametrize("priority", [-2147483648, 2147483647]) +def test_policy_attachment_accepts_int32_priority(priority: int): + assert PolicyAttachment(policy="p", priority=priority).priority == priority + + +@pytest.mark.parametrize("priority", [-2147483649, 2147483648]) +def test_policy_attachment_rejects_priority_outside_int32(priority: int): + with pytest.raises(ValidationError): + PolicyAttachment(policy="p", priority=priority) diff --git a/tests/test_litellm/types/proxy/policy_engine/test_resolver_types.py b/tests/test_litellm/types/proxy/policy_engine/test_resolver_types.py index c23ed5d4319..f31b9d7e873 100644 --- a/tests/test_litellm/types/proxy/policy_engine/test_resolver_types.py +++ b/tests/test_litellm/types/proxy/policy_engine/test_resolver_types.py @@ -3,8 +3,10 @@ Tests for pipeline field on policy CRUD types (resolver_types.py). """ import pytest +from pydantic import ValidationError from litellm.types.proxy.policy_engine.resolver_types import ( + PolicyAttachmentCreateRequest, PolicyCreateRequest, PolicyDBResponse, PolicyUpdateRequest, @@ -100,3 +102,14 @@ def test_policy_create_request_roundtrip(): dumped = req.model_dump() restored = PolicyCreateRequest(**dumped) assert restored.pipeline == pipeline_data + + +@pytest.mark.parametrize("priority", [-2147483648, 2147483647]) +def test_policy_attachment_create_request_accepts_int32_priority(priority: int): + assert PolicyAttachmentCreateRequest(policy_name="p", priority=priority).priority == priority + + +@pytest.mark.parametrize("priority", [-2147483649, 2147483648]) +def test_policy_attachment_create_request_rejects_priority_outside_int32(priority: int): + with pytest.raises(ValidationError): + PolicyAttachmentCreateRequest(policy_name="p", priority=priority) diff --git a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/AttachmentTable.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/AttachmentTable.test.tsx index f7d00d6715f..43ad6a7cc9e 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/AttachmentTable.test.tsx +++ b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/AttachmentTable.test.tsx @@ -45,9 +45,26 @@ describe("AttachmentTable", () => { expect(screen.getByText("Keys")).toBeInTheDocument(); expect(screen.getByText("Models")).toBeInTheDocument(); expect(screen.getByText("Tags")).toBeInTheDocument(); + expect(screen.getByText("Priority")).toBeInTheDocument(); expect(screen.getByText("Created At")).toBeInTheDocument(); }); + it("should show the priority and a dash for attachments without one", () => { + const attachments = [ + makeAttachment({ attachment_id: "att-prio0001", policy_name: "prioritized", priority: 5 }), + makeAttachment({ attachment_id: "att-prio0002", policy_name: "unprioritized" }), + ]; + renderWithProviders(); + const rows = screen.getAllByRole("row").slice(1); + const prioritizedRow = rows.find((row) => within(row).queryByText("prioritized")); + const unprioritizedRow = rows.find((row) => within(row).queryByText("unprioritized")); + expect(within(prioritizedRow!).getByText("5")).toBeInTheDocument(); + expect(within(unprioritizedRow!).queryByText("5")).not.toBeInTheDocument(); + expect(within(unprioritizedRow!).getAllByText("-")).toHaveLength( + within(prioritizedRow!).getAllByText("-").length + 1, + ); + }); + it("should show skeleton rows when isLoading is true", () => { renderWithProviders(); expect(screen.getAllByTestId("skeleton-row").length).toBeGreaterThan(0); diff --git a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/AttachmentTableColumns.tsx b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/AttachmentTableColumns.tsx index ded9e3a1e6d..9a190401d08 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/AttachmentTableColumns.tsx +++ b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/AttachmentTableColumns.tsx @@ -167,6 +167,20 @@ export const getAttachmentTableColumns = ({ enableSorting: false, cell: ({ row }) => , }, + { + id: "priority", + accessorFn: (row) => row.priority ?? Number.POSITIVE_INFINITY, + meta: { title: "Priority" }, + header: ({ column }) => , + size: 100, + enableSorting: true, + cell: ({ row }) => + row.original.priority == null ? ( + - + ) : ( + {row.original.priority} + ), + }, { id: "created_at", accessorFn: (row) => row.created_at ?? "", diff --git a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/add_attachment_form.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/add_attachment_form.test.tsx index aec1b61f45b..d635872ad81 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/add_attachment_form.test.tsx +++ b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/add_attachment_form.test.tsx @@ -1,5 +1,5 @@ import React from "react"; -import { screen, waitFor } from "@testing-library/react"; +import { fireEvent, screen, waitFor } from "@testing-library/react"; import userEvent from "@testing-library/user-event"; import { renderWithProviders } from "@/../tests/test-utils"; import { beforeEach, describe, expect, it, vi } from "vitest"; @@ -180,6 +180,61 @@ describe("AddAttachmentForm", () => { expect(screen.queryByText(TEAMS_ERROR)).not.toBeInTheDocument(); }); + const selectPolicy = async (user: UserEvent, policyName: string) => { + await screen.findByText("Create Policy Attachment"); + const input = screen.getByLabelText("Policies"); + await user.click(input); + await user.type(input, `${policyName}{Enter}`); + }; + + const setPriority = (value: string) => { + fireEvent.change(screen.getByLabelText("Priority"), { target: { value } }); + }; + + const submit = async (user: UserEvent) => { + await user.click(screen.getByRole("button", { name: /create attachment/i })); + }; + + it("sends the entered priority with the attachment", async () => { + const user = userEvent.setup(); + const createAttachment = vi.fn().mockResolvedValue({}); + renderWithProviders(); + await selectPolicy(user, "policy-alpha"); + setPriority("10"); + await submit(user); + await waitFor(() => expect(createAttachment).toHaveBeenCalledTimes(1)); + expect(createAttachment).toHaveBeenCalledWith("test-token", { + policy_name: "policy-alpha", + scope: "*", + priority: 10, + }); + }); + + it("omits priority from the attachment when the field is left blank", async () => { + const user = userEvent.setup(); + const createAttachment = vi.fn().mockResolvedValue({}); + renderWithProviders(); + await selectPolicy(user, "policy-alpha"); + await submit(user); + await waitFor(() => expect(createAttachment).toHaveBeenCalledTimes(1)); + expect(createAttachment).toHaveBeenCalledWith("test-token", { policy_name: "policy-alpha", scope: "*" }); + }); + + it.each([ + ["2147483648", /at most 2147483647/i], + ["-2147483649", /at least -2147483648/i], + ["1.5", /whole number/i], + ])("blocks submit with a field error when priority is %s", async (value, error) => { + const user = userEvent.setup(); + const createAttachment = vi.fn(); + renderWithProviders(); + await selectPolicy(user, "policy-alpha"); + setPriority(value); + await submit(user); + expect(await screen.findByText(error)).toBeInTheDocument(); + expect(createAttachment).not.toHaveBeenCalled(); + }); + it("defers to the backend (does not flag) when the team list failed to load", async () => { const user = userEvent.setup(); vi.mocked(networking.teamListCall).mockRejectedValue(new Error("boom")); diff --git a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/add_attachment_form.tsx b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/add_attachment_form.tsx index 06b11701b2a..02463a89139 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/add_attachment_form.tsx +++ b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/add_attachment_form.tsx @@ -8,6 +8,7 @@ import useAuthorized from "@/app/(dashboard)/hooks/useAuthorized"; import { FieldGroup, FieldLabel, FieldTitle } from "@/components/ui/field"; import { FormField } from "@/components/shared/form/FormField"; import { Button } from "@/components/ui/button"; +import { Input } from "@/components/ui/input"; import { RadioGroup, RadioGroupItem } from "@/components/ui/radio-group"; import { Separator } from "@/components/ui/separator"; import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip"; @@ -36,6 +37,7 @@ interface AttachmentFormValues { keys: string[]; models: string[]; tags: string[]; + priority: number | null; } const EMPTY_VALUES: AttachmentFormValues = { @@ -44,14 +46,24 @@ const EMPTY_VALUES: AttachmentFormValues = { keys: [], models: [], tags: [], + priority: null, }; +const INT32_MIN = -2147483648; +const INT32_MAX = 2147483647; + const attachmentShape = { policy_names: z.array(z.string()).min(1, "Please select at least one policy"), teams: z.array(z.string()), keys: z.array(z.string()), models: z.array(z.string()), tags: z.array(z.string()), + priority: z + .number({ error: "Priority must be a whole number" }) + .int("Priority must be a whole number") + .min(INT32_MIN, `Priority must be at least ${INT32_MIN}`) + .max(INT32_MAX, `Priority must be at most ${INT32_MAX}`) + .nullable(), }; const buildAttachmentSchema = (scopeType: ScopeType, teamsLoaded: boolean, availableTeams: string[]) => @@ -419,6 +431,28 @@ const AddAttachmentForm: React.FC = ({ )} + + + {({ ref, value, onChange, ...field }) => ( + onChange(event.target.value === "" ? null : event.target.valueAsNumber)} + /> + )} + {impactResult && } diff --git a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/build_attachment_data.test.ts b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/build_attachment_data.test.ts index 5c04c533f76..930e755f242 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/build_attachment_data.test.ts +++ b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/build_attachment_data.test.ts @@ -79,4 +79,18 @@ describe("buildAttachmentData", () => { expect(result.tags).toBeUndefined(); }); }); + + describe("priority", () => { + it.each(["global", "specific"] as const)("should include priority for a %s scope", (scopeType) => { + expect(buildAttachmentData({ policy_name: "p", priority: 0 }, scopeType).priority).toBe(0); + }); + + it("should include a negative priority", () => { + expect(buildAttachmentData({ policy_name: "p", priority: -5 }, "specific").priority).toBe(-5); + }); + + it.each([undefined, null])("should omit priority when it is %s", (priority) => { + expect(buildAttachmentData({ policy_name: "p", priority }, "specific")).not.toHaveProperty("priority"); + }); + }); }); diff --git a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/build_attachment_data.ts b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/build_attachment_data.ts index fe994a480ee..8b21142df74 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/build_attachment_data.ts +++ b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/build_attachment_data.ts @@ -1,13 +1,16 @@ import { PolicyAttachmentCreateRequest } from "@/components/policies/types"; -/** - * Builds a PolicyAttachmentCreateRequest from form values. - * - * @param formValues - The raw form field values (from form.getFieldsValue) - * @param scopeType - Whether the attachment is "global" or "specific" - */ +export interface AttachmentFormInput { + policy_name: string; + teams?: string[]; + keys?: string[]; + models?: string[]; + tags?: string[]; + priority?: number | null; +} + export function buildAttachmentData( - formValues: Record, + formValues: AttachmentFormInput, scopeType: "global" | "specific", ): PolicyAttachmentCreateRequest { const data: PolicyAttachmentCreateRequest = { @@ -21,5 +24,6 @@ export function buildAttachmentData( if (formValues.models && formValues.models.length > 0) data.models = formValues.models; if (formValues.tags && formValues.tags.length > 0) data.tags = formValues.tags; } + if (typeof formValues.priority === "number") data.priority = formValues.priority; return data; } diff --git a/ui/litellm-dashboard/src/components/policies/types.ts b/ui/litellm-dashboard/src/components/policies/types.ts index 6ac110e3c0a..9f3ef02ba5d 100644 --- a/ui/litellm-dashboard/src/components/policies/types.ts +++ b/ui/litellm-dashboard/src/components/policies/types.ts @@ -44,6 +44,7 @@ export interface PolicyAttachment { keys: string[]; models: string[]; tags: string[]; + priority?: number | null; created_at?: string; updated_at?: string; created_by?: string; @@ -78,6 +79,7 @@ export interface PolicyAttachmentCreateRequest { keys?: string[]; models?: string[]; tags?: string[]; + priority?: number; } export interface PolicyListResponse { From 8164189237bb93b3a61a6a2a2972cbe476f2bb44 Mon Sep 17 00:00:00 2001 From: yucheng Date: Thu, 17 Sep 2026 07:56:43 +0000 Subject: [PATCH 5/5] test(ui): cover a negative policy attachment priority typed keystroke by keystroke Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .../_components/add_attachment_form.test.tsx | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/add_attachment_form.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/add_attachment_form.test.tsx index d635872ad81..dfc023d428e 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/add_attachment_form.test.tsx +++ b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/add_attachment_form.test.tsx @@ -210,6 +210,23 @@ describe("AddAttachmentForm", () => { }); }); + it("sends a negative priority typed one keystroke at a time", async () => { + const user = userEvent.setup(); + const createAttachment = vi.fn().mockResolvedValue({}); + renderWithProviders(); + await selectPolicy(user, "policy-alpha"); + const priority = screen.getByLabelText("Priority"); + await user.type(priority, "-5"); + expect(priority).toHaveValue(-5); + await submit(user); + await waitFor(() => expect(createAttachment).toHaveBeenCalledTimes(1)); + expect(createAttachment).toHaveBeenCalledWith("test-token", { + policy_name: "policy-alpha", + scope: "*", + priority: -5, + }); + }); + it("omits priority from the attachment when the field is left blank", async () => { const user = userEvent.setup(); const createAttachment = vi.fn().mockResolvedValue({});