test(cache_warming): fold the SCIM gate into the ceiling matrix

The standalone predicate test asserted four return values of
user_is_scim_deactivated and never exercised warming, which is coverage of the
helper rather than of the feature; the helper is already pinned by the auth and MCP
paths that own its behavior. The ceiling matrix is the right home, since it is the
test that answers whether a refusal actually stops a replay, so SCIM deactivation
joins the blocked key, expired key, blocked team, denied model and budget arms and
asserts the session is not warmed. Removing the gate fails that arm.
This commit is contained in:
Tin Chi Lo 2026-07-30 02:15:28 -07:00
parent 4bef86c1e1
commit bb0d5684f7

View file

@ -58,6 +58,7 @@ _PAST = (datetime.now(timezone.utc) - timedelta(hours=1)).replace(microsecond=0)
("key-model-over-budget", False),
("over-budget", False),
("rate-limited", False),
("scim-deactivated-owner", False),
],
)
async def test_every_ceiling_the_request_path_enforces_gates_warming(arm, warmed):
@ -104,6 +105,14 @@ async def test_every_ceiling_the_request_path_enforces_gates_warming(arm, warmed
fields = {"rpm_limit": 1}
await counters.async_set_cache(key="{api_key:k}:window", value=str(int(time.time())))
await counters.async_set_cache(key="{api_key:k}:requests", value=1)
elif arm == "scim-deactivated-owner":
from litellm.proxy._types import LiteLLM_UserTable
await key_cache.async_set_cache(
key="u",
value=LiteLLM_UserTable(user_id="u", max_budget=None, spend=0.0, metadata={"scim_active": False}),
)
fields = {"user_id": "u"}
priced = arm == "over-budget"
llm_router = priced_rig(redis) if priced else warming_rig(redis=redis)[0]
@ -383,21 +392,6 @@ async def test_a_replay_never_falls_back_to_a_group_warming_did_not_validate():
assert all(call["disable_fallbacks"] is True for call in llm_router.completion_calls)
def test_scim_deactivation_is_one_predicate_shared_with_the_auth_paths():
"""The gate sat inline at five call sites and warming became the sixth caller without it, so it lives
beside get_user_object now and every path calls the same predicate."""
from litellm.proxy._types import LiteLLM_UserTable
from litellm.proxy.auth.auth_checks import user_is_scim_deactivated
def user(metadata):
return LiteLLM_UserTable(user_id="u1", max_budget=None, spend=0.0, metadata=metadata)
assert user_is_scim_deactivated(user({"scim_active": False})) is True
assert user_is_scim_deactivated(user({"scim_active": True})) is False
assert user_is_scim_deactivated(user({})) is False
assert user_is_scim_deactivated(None) is False
@pytest.mark.asyncio
async def test_the_concurrency_bound_bounds_decompressed_payloads_not_just_replays():
"""Every session is started at once, so anything a session materializes before acquiring its slot scales