From d0fda0409c05dc1e712ca5c956751c82faa13ed4 Mon Sep 17 00:00:00 2001 From: Deepanshu Date: Fri, 28 Aug 2026 15:21:33 -0400 Subject: [PATCH] test(proxy): port direct unit coverage for resolve_authoritative_metadata_variable_name from #38289 PR #38289 (e8e6ae682e) independently ported the same unforgeable-marker fix already hardened here onto its own, unrenamed copy of the function (resolve_success_event_metadata_variable_name), plus direct unit tests for it. That fix logic was already a subset of what this branch has (the rename to resolve_authoritative_metadata_variable_name and its use at admission time, not just success), so nothing to pull in there, but the direct unit tests had no equivalent here beyond end-to-end coverage through the hook itself. Ported them under the current name. --- .../hooks/test_tag_rate_limits_shared.py | 38 +++++++++---------- 1 file changed, 17 insertions(+), 21 deletions(-) diff --git a/tests/test_litellm/proxy/hooks/test_tag_rate_limits_shared.py b/tests/test_litellm/proxy/hooks/test_tag_rate_limits_shared.py index 38747090c59..2e4954cd030 100644 --- a/tests/test_litellm/proxy/hooks/test_tag_rate_limits_shared.py +++ b/tests/test_litellm/proxy/hooks/test_tag_rate_limits_shared.py @@ -17,7 +17,7 @@ from litellm.proxy.hooks.tag_rate_limits_shared import ( fixed_length_identity, order_tags_for_identity_resolution, partition_key, - resolve_success_event_metadata_variable_name, + resolve_authoritative_metadata_variable_name, ) from litellm.types.router import TagRateLimitEntry, TagRateLimitScope @@ -140,40 +140,38 @@ def test_extract_key_alias_ignores_a_non_mapping_authoritative_field(): # --------------------------------------------------------------------------- -# resolve_success_event_metadata_variable_name -- veria-ai finding surfaced on -# PR #38347: a caller-supplied, non-empty litellm_metadata must not be -# selected over the metadata the proxy actually wrote authenticated tags into +# resolve_authoritative_metadata_variable_name -- Veria AI finding: a +# caller-supplied, non-empty litellm_metadata must not be selected over +# metadata, the field the proxy actually wrote authenticated tags into # --------------------------------------------------------------------------- -def test_resolve_success_event_metadata_variable_name_ignores_caller_forged_non_empty_litellm_metadata(): +def test_resolve_authoritative_metadata_variable_name_ignores_caller_forged_non_empty_litellm_metadata(): """A caller-supplied litellm_metadata with unrelated content (no user_api_key_auth marker) must not be picked over metadata, even though it is a non-empty dict.""" - litellm_params_for_metadata = {"litellm_metadata": {"marker": True}} - assert resolve_success_event_metadata_variable_name(litellm_params_for_metadata) == "metadata" + metadata_source = {"litellm_metadata": {"marker": True}} + assert resolve_authoritative_metadata_variable_name(metadata_source) == "metadata" -def test_resolve_success_event_metadata_variable_name_selects_litellm_metadata_when_server_written(): +def test_resolve_authoritative_metadata_variable_name_selects_litellm_metadata_when_server_written(): """A genuinely server-populated litellm_metadata (LITELLM_METADATA_ROUTES) always carries the user_api_key_auth marker stamped by add_user_api_key_auth_to_request_metadata.""" - litellm_params_for_metadata = { - "litellm_metadata": {"user_api_key_auth": object(), "tags": ["team_id:t1"]} - } - assert resolve_success_event_metadata_variable_name(litellm_params_for_metadata) == "litellm_metadata" + metadata_source = {"litellm_metadata": {"user_api_key_auth": object(), "tags": ["team_id:t1"]}} + assert resolve_authoritative_metadata_variable_name(metadata_source) == "litellm_metadata" -def test_resolve_success_event_metadata_variable_name_defaults_to_metadata_when_litellm_metadata_absent(): - assert resolve_success_event_metadata_variable_name({}) == "metadata" +def test_resolve_authoritative_metadata_variable_name_defaults_to_metadata_when_litellm_metadata_absent(): + assert resolve_authoritative_metadata_variable_name({}) == "metadata" -def test_resolve_success_event_metadata_variable_name_defaults_to_metadata_when_litellm_metadata_none(): - assert resolve_success_event_metadata_variable_name({"litellm_metadata": None}) == "metadata" +def test_resolve_authoritative_metadata_variable_name_defaults_to_metadata_when_litellm_metadata_none(): + assert resolve_authoritative_metadata_variable_name({"litellm_metadata": None}) == "metadata" -def test_resolve_success_event_metadata_variable_name_defaults_to_metadata_when_litellm_metadata_empty(): - assert resolve_success_event_metadata_variable_name({"litellm_metadata": {}}) == "metadata" +def test_resolve_authoritative_metadata_variable_name_defaults_to_metadata_when_litellm_metadata_empty(): + assert resolve_authoritative_metadata_variable_name({"litellm_metadata": {}}) == "metadata" # --------------------------------------------------------------------------- @@ -429,7 +427,5 @@ def test_bucket_ttl_seconds_defaults_to_period_plus_one_hour_when_unset(): def test_bucket_ttl_seconds_honors_key_ttl_seconds_override(): - entry = TagRateLimitEntry( - name="per_minute", tag_id="end_user_id", limit=1, period_seconds=60, key_ttl_seconds=120 - ) + entry = TagRateLimitEntry(name="per_minute", tag_id="end_user_id", limit=1, period_seconds=60, key_ttl_seconds=120) assert bucket_ttl_seconds(entry) == 120