scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-08 03:08:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 115

test(proxy): port direct unit coverage for resolve_authoritative_metadata_variable_name from #38289

Browse source 
PR #38289 (e8e6ae682e) independently ported the same unforgeable-marker fix
already hardened here onto its own, unrenamed copy of the function
(resolve_success_event_metadata_variable_name), plus direct unit tests for
it. That fix logic was already a subset of what this branch has (the
rename to resolve_authoritative_metadata_variable_name and its use at
admission time, not just success), so nothing to pull in there, but the
direct unit tests had no equivalent here beyond end-to-end coverage
through the hook itself. Ported them under the current name.
This commit is contained in:
Deepanshu 2026-08-28 15:21:33 -04:00
parent 4ceac641a4
commit d0fda0409c
1 changed files with 17 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
tests/test_litellm/proxy/hooks/test_tag_rate_limits_shared.py
View file

@ -17,7 +17,7 @@ from litellm.proxy.hooks.tag_rate_limits_shared import (
fixed_length_identity,
order_tags_for_identity_resolution,
partition_key,
resolve_success_event_metadata_variable_name,
resolve_authoritative_metadata_variable_name,
)
from litellm.types.router import TagRateLimitEntry, TagRateLimitScope
@ -140,40 +140,38 @@ def test_extract_key_alias_ignores_a_non_mapping_authoritative_field():
# ---------------------------------------------------------------------------
# resolve_success_event_metadata_variable_name -- veria-ai finding surfaced on
# PR #38347: a caller-supplied, non-empty litellm_metadata must not be
# selected over the metadata the proxy actually wrote authenticated tags into
# resolve_authoritative_metadata_variable_name -- Veria AI finding: a
# caller-supplied, non-empty litellm_metadata must not be selected over
# metadata, the field the proxy actually wrote authenticated tags into
# ---------------------------------------------------------------------------
def test_resolve_success_event_metadata_variable_name_ignores_caller_forged_non_empty_litellm_metadata():
def test_resolve_authoritative_metadata_variable_name_ignores_caller_forged_non_empty_litellm_metadata():
"""A caller-supplied litellm_metadata with unrelated content (no
user_api_key_auth marker) must not be picked over metadata, even though
it is a non-empty dict."""
litellm_params_for_metadata = {"litellm_metadata": {"marker": True}}
assert resolve_success_event_metadata_variable_name(litellm_params_for_metadata) == "metadata"
metadata_source = {"litellm_metadata": {"marker": True}}
assert resolve_authoritative_metadata_variable_name(metadata_source) == "metadata"
def test_resolve_success_event_metadata_variable_name_selects_litellm_metadata_when_server_written():
def test_resolve_authoritative_metadata_variable_name_selects_litellm_metadata_when_server_written():
"""A genuinely server-populated litellm_metadata (LITELLM_METADATA_ROUTES)
always carries the user_api_key_auth marker stamped by
add_user_api_key_auth_to_request_metadata."""
litellm_params_for_metadata = {
"litellm_metadata": {"user_api_key_auth": object(), "tags": ["team_id:t1"]}
}
assert resolve_success_event_metadata_variable_name(litellm_params_for_metadata) == "litellm_metadata"
metadata_source = {"litellm_metadata": {"user_api_key_auth": object(), "tags": ["team_id:t1"]}}
assert resolve_authoritative_metadata_variable_name(metadata_source) == "litellm_metadata"
def test_resolve_success_event_metadata_variable_name_defaults_to_metadata_when_litellm_metadata_absent():
assert resolve_success_event_metadata_variable_name({}) == "metadata"
def test_resolve_authoritative_metadata_variable_name_defaults_to_metadata_when_litellm_metadata_absent():
assert resolve_authoritative_metadata_variable_name({}) == "metadata"
def test_resolve_success_event_metadata_variable_name_defaults_to_metadata_when_litellm_metadata_none():
assert resolve_success_event_metadata_variable_name({"litellm_metadata": None}) == "metadata"
def test_resolve_authoritative_metadata_variable_name_defaults_to_metadata_when_litellm_metadata_none():
assert resolve_authoritative_metadata_variable_name({"litellm_metadata": None}) == "metadata"
def test_resolve_success_event_metadata_variable_name_defaults_to_metadata_when_litellm_metadata_empty():
assert resolve_success_event_metadata_variable_name({"litellm_metadata": {}}) == "metadata"
def test_resolve_authoritative_metadata_variable_name_defaults_to_metadata_when_litellm_metadata_empty():
assert resolve_authoritative_metadata_variable_name({"litellm_metadata": {}}) == "metadata"
# ---------------------------------------------------------------------------
@ -429,7 +427,5 @@ def test_bucket_ttl_seconds_defaults_to_period_plus_one_hour_when_unset():
def test_bucket_ttl_seconds_honors_key_ttl_seconds_override():
entry = TagRateLimitEntry(
name="per_minute", tag_id="end_user_id", limit=1, period_seconds=60, key_ttl_seconds=120
)
entry = TagRateLimitEntry(name="per_minute", tag_id="end_user_id", limit=1, period_seconds=60, key_ttl_seconds=120)
assert bucket_ttl_seconds(entry) == 120