scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-20 00:11:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 75

fix(mcp): add @default(now()) to MCPToolsetTable.updated_at; fix test for non-admin toolset access

Browse source
This commit is contained in:
Ishaan Jaffer 2026-03-23 11:39:00 -07:00
parent 77131a50db
commit d685a876e8
2 changed files with 20 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
schema.prisma
View file

@ -331,7 +331,7 @@ model LiteLLM_MCPToolsetTable {
tools Json @default("[]") // [{server_id: string, tool_name: string}]
created_at DateTime @default(now())
created_by String?
updated_at DateTime @updatedAt
updated_at DateTime @default(now()) @updatedAt
updated_by String?
}

21
tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_toolset_scope.py
View file

@ -59,7 +59,8 @@ class TestApplyToolsetScope:
assert op.mcp_tool_permissions == toolset_perms
@pytest.mark.asyncio
async def test_creates_object_permission_when_none(self):
async def test_admin_creates_object_permission_when_none(self):
"""Admin key with object_permission=None can access any toolset."""
from litellm.proxy._experimental.mcp_server.server import _apply_toolset_scope
toolset_perms = {"server-a": ["tool1"]}
@ -68,7 +69,11 @@ class TestApplyToolsetScope:
"global_mcp_server_manager.resolve_toolset_tool_permissions",
new=AsyncMock(return_value=toolset_perms),
):
auth = UserAPIKeyAuth(api_key="sk-test", object_permission=None)
auth = UserAPIKeyAuth(
api_key="sk-test",
user_role=LitellmUserRoles.PROXY_ADMIN,
object_permission=None,
)
result = await _apply_toolset_scope(auth, "toolset-123")
op = result.object_permission
@ -76,6 +81,18 @@ class TestApplyToolsetScope:
assert op.mcp_servers == ["server-a"]
assert op.mcp_tool_permissions == toolset_perms
@pytest.mark.asyncio
async def test_non_admin_no_object_permission_raises_403(self):
"""Non-admin key with object_permission=None is denied (no grants configured)."""
from fastapi import HTTPException
from litellm.proxy._experimental.mcp_server.server import _apply_toolset_scope
auth = UserAPIKeyAuth(api_key="sk-test", object_permission=None)
with pytest.raises(HTTPException) as exc_info:
await _apply_toolset_scope(auth, "toolset-123")
assert exc_info.value.status_code == 403
class TestFetchMCPToolsetsAccess:
"""Tests for GET /v1/mcp/toolset access control."""