`import *` does not re-export names starting with `_`, so the private
competitor-enrichment helpers added in endpoints.py were invisible when
imported from the package:
from litellm.proxy.management_endpoints.policy_endpoints import (
_build_all_names_per_competitor, ...
)
This caused an ImportError that prevented the entire test module from
collecting. Add explicit imports for each private helper so they are
accessible from the package namespace.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The production error message was expanded when Sonnet 4.6 was also added as
a supported model for effort='max'. The test's match regex still referenced
the old "Claude Opus 4.6"-only message; update it to match the new
"Claude 4.6 models" wording.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reset logo_path to default_logo when custom UI_LOGO_PATH file doesn't
exist, so the else branch at the bottom of get_image serves the default
logo instead of the non-existent custom path.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add os.path.exists check before serving custom local logo so that a
non-existent UI_LOGO_PATH gracefully falls through to the cache/default
instead of causing a FileResponse error.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
RedisCache() without arguments fails at construction with
"ValueError: Either 'host' or 'url' must be specified for redis."
The actual Redis connection is irrelevant since async_set_cache is mocked.
Unlike test_get_team_redis which uses client_no_auth (which sets REDIS_HOST
via fake_env_vars), test_team_update_redis has no fixture setting that env var.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
JWT auth is an enterprise-only feature. Tests that call user_api_key_auth
with enable_jwt_auth=True must set premium_user=True on the proxy server
to bypass the enterprise gate, otherwise they fail with:
ValueError: JWT Auth is an enterprise only feature.
This follows the same pattern as PR #21285 (fix/jwt-enterprise-license-test).
Fixed tests:
- test_team_token_output
- test_allowed_routes_admin
- test_allow_access_by_email
- test_end_user_jwt_auth
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove unused RouteChoice import from semantic_guard.py TYPE_CHECKING block
(only referenced in docstring, never used as a type annotation)
- Remove redundant explicit router import from policy_endpoints/__init__.py
(already re-exported by the preceding import * on the same line)
Fixes Ruff F401 errors caught in CI linting.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The suggest() method was calling llm_router.acompletion(), which requires
the proxy router to be initialised. This caused:
ValueError: LLM router not initialized
in every test (and in any deployment without a configured router).
AiPolicySuggester is a self-contained feature that calls an LLM directly;
it has no need for proxy routing. Switch to litellm.acompletion, which is
always available and is what the tests already mock.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The /get_image endpoint checked for cached_logo.jpg before reading the
UI_LOGO_PATH env var, so a pre-existing cache (e.g. baked into the base
Docker image) would always be served, ignoring the user's custom logo.
Move the UI_LOGO_PATH read before the cache check and serve local file
paths directly, bypassing the cache. The cache optimization is preserved
for HTTP URLs and the default logo where it is actually needed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Same approach as the duplicate issue detector — uses opencode run
with gh pr commands to find potentially duplicate open PRs when
external contributors open new PRs. Skips core team and bots.
When model_info is explicitly set to None in litellm_params (via
get_litellm_params.py), the pattern .get("model_info", {}) returns
None instead of {}, causing AttributeError on the chained .get("id").
This commonly occurs when Anthropic API returns usage limit errors,
the router falls back to Vertex AI, and the fallback succeeds — the
log_success_event callback fires with model_info=None.
Uses the (x or {}) pattern already established in router.py.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Refactor to fetch team objects once via _fetch_user_team_objects(),
then derive admin and member team IDs from the shared result. Eliminates
duplicate DB query between get_admin_team_ids and get_member_team_ids.
Empty system messages were skipped for Anthropic's system param but
not removed from the messages list, causing BadRequestError when
anthropic_messages_pt encountered the unsupported "system" role.
Fixes#21622
Regular team members could not see service accounts belonging to their
team. Additionally, former team members could still see service accounts
they created via the created_by filter after leaving the team.
- Add get_member_team_ids() to retrieve all teams a user belongs to
- Regular members now see team service accounts (user_id=NULL) but not
other members' personal keys
- Scope created_by filter to the user's current team memberships
- Add 7 unit tests covering the new visibility rules
PAT_TOKEN_2 does not have the scope for addPullRequestReview.
github.token cannot approve its own PR either, so drop the approval
step entirely. Auto-merge with github.token is enough: the PR will
merge automatically once required CI checks pass.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(policy): add estimated_latency_ms to all policy templates
* feat(policy): add estimated_latency_ms to backup templates
* feat(ui): show latency overhead badge in AI policy suggestions
Now that "Allow GitHub Actions to create and approve pull requests" is
enabled in repo settings:
- PR creation uses github.token (no secret needed)
- Approval uses PAT_TOKEN_2 (GitHub requires a different identity from
the PR creator to approve)
- Auto-merge is enabled with --squash so the PR merges as soon as
required checks pass
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
