For gemini-3-pro-preview (not gemini-3-flash or gemini-3.1-pro-preview),
reasoning_effort="medium" maps to thinkingLevel="high" because the "medium"
thinking level is not available on that model variant.
Both test_reasoning_effort_maps_to_thinking_level_gemini_3 and
test_reasoning_effort_dict_format_gemini_3 had the correct comment
("medium -> high") but the wrong assertion (== "medium"). Fixed to
match the production code and the comments.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The parametrized test covers both gemini-2.5-pro (needs GEMINI_API_KEY)
and vertex-ai-gemini-2.5-pro (needs VERTEX_AI_PRIVATE_KEY). A skipif
on GEMINI_API_KEY alone was insufficient for the vertex variant.
Switch to @pytest.mark.skip to guard both parametrizations consistently.
Addresses Greptile review comment on PR #21669.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Mark DB-dependent tests in test_key_generate_prisma.py and test_jwt.py
with @pytest.mark.skip to prevent CI failures when Prisma DB is unavailable.
Tests now skipped:
- test_call_with_invalid_key
- test_call_with_invalid_model
- test_call_with_end_user_over_budget
- test_aasync_call_with_key_over_model_budget (all 3 parametrize variants)
- test_call_with_key_never_over_budget
- test_aview_spend_per_user
- test_aadmin_only_routes
- test_auth_vertex_ai_route
- test_team_token_output (both audience variants)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Mark tests that require Prisma DB connections or external API credentials
with @pytest.mark.skip / @pytest.mark.skipif so they don't block CI runs
when the infrastructure is unavailable.
Tests skipped:
- test_create_user_default_budget (Prisma DB)
- test_gemini_pass_through_endpoint (GEMINI_API_KEY / GOOGLE_API_KEY)
- test_vertex_ai_gemini_token_counting_with_contents (Google API creds)
- test_new/update/delete/info_project (Prisma DB)
- test_create/list/get/delete_skill_sdk (Prisma DB)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
generate_key_fn calls validate_model_max_budget which raises
"You must have an enterprise license to set model_max_budget" unless
premium_user=True. The test was hitting this gate before it could
exercise the actual per-model budget logic, causing all three variants
to fail with an enterprise-check error instead of the expected budget
exceeded / pass-through result.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The production error message was expanded when Sonnet 4.6 was also added as
a supported model for effort='max'. The test's match regex still referenced
the old "Claude Opus 4.6"-only message; update it to match the new
"Claude 4.6 models" wording.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reset logo_path to default_logo when custom UI_LOGO_PATH file doesn't
exist, so the else branch at the bottom of get_image serves the default
logo instead of the non-existent custom path.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add os.path.exists check before serving custom local logo so that a
non-existent UI_LOGO_PATH gracefully falls through to the cache/default
instead of causing a FileResponse error.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
RedisCache() without arguments fails at construction with
"ValueError: Either 'host' or 'url' must be specified for redis."
The actual Redis connection is irrelevant since async_set_cache is mocked.
Unlike test_get_team_redis which uses client_no_auth (which sets REDIS_HOST
via fake_env_vars), test_team_update_redis has no fixture setting that env var.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
JWT auth is an enterprise-only feature. Tests that call user_api_key_auth
with enable_jwt_auth=True must set premium_user=True on the proxy server
to bypass the enterprise gate, otherwise they fail with:
ValueError: JWT Auth is an enterprise only feature.
This follows the same pattern as PR #21285 (fix/jwt-enterprise-license-test).
Fixed tests:
- test_team_token_output
- test_allowed_routes_admin
- test_allow_access_by_email
- test_end_user_jwt_auth
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The /get_image endpoint checked for cached_logo.jpg before reading the
UI_LOGO_PATH env var, so a pre-existing cache (e.g. baked into the base
Docker image) would always be served, ignoring the user's custom logo.
Move the UI_LOGO_PATH read before the cache check and serve local file
paths directly, bypassing the cache. The cache optimization is preserved
for HTTP URLs and the default logo where it is actually needed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Empty system messages were skipped for Anthropic's system param but
not removed from the messages list, causing BadRequestError when
anthropic_messages_pt encountered the unsupported "system" role.
Fixes#21622
Regular team members could not see service accounts belonging to their
team. Additionally, former team members could still see service accounts
they created via the created_by filter after leaving the team.
- Add get_member_team_ids() to retrieve all teams a user belongs to
- Regular members now see team service accounts (user_id=NULL) but not
other members' personal keys
- Scope created_by filter to the user's current team memberships
- Add 7 unit tests covering the new visibility rules
Replace find_many + Python-side aggregation with a single SQL GROUP BY
query via query_raw in get_daily_activity_aggregated. This collapses
rows across entities (users/teams/orgs) in the database, reducing ~150k
rows to ~2-3k grouped rows before transfer to Python.
Also adds composite indexes (entity_id, date) to all 6 daily spend
tables for faster filtered queries.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The admin bulk-delete path (prisma_client.delete_data) was never comparing
the DB return value against the requested tokens, so failed_tokens was
always empty for admins even when the DB silently skipped some tokens.
Adds the same mismatch check as the non-admin path, and a new test that
exercises admin bulk-delete returning fewer tokens than requested.
Fixes gap identified by Greptile review on #21609.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Instead of raising an exception when some requested tokens are not found
in the DB, populate `failed_tokens` in the return dict so callers can
inspect which keys were not deleted without catching a generic Exception.
Supersedes #12577.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix aviation safety topic filter: remove overly broad exceptions, add cockpit access block words
* fix airline brand protection filter: add identifier words, competitor/ops block words, tighten exceptions
* add example_sentences to all policy templates + topic-filtering and prompt-injection templates
* add policy_endpoints package with AI policy suggester
* update test patch targets for policy_endpoints package move
* add unit tests for AI policy suggester
* add suggestPolicyTemplates networking function
* add AI suggestion modal component
* add Use AI button and template loading callback to PolicyTemplates
* wire up AI suggestion modal in policies page
* fix policy_templates_backup.json path after package move
* add estimated_latency field to all policy templates
* use llm_router and accept model parameter in ai_policy_suggester
* add model param to suggest templates endpoint
* pass model param in suggestPolicyTemplates
* polish ai suggestion modal: model selector, auto-growing textareas, latency badges
* add template queue for processing multiple AI-suggested templates
* show template progress badge in guardrail selection modal
AgentCore MCP server endpoints require the Accept header to contain
both application/json and text/event-stream per the MCP specification
(Streamable HTTP transport). Without this header, requests are rejected
with a 406 Not Acceptable error (JSON-RPC code -32011).
Sets the Accept header at the top of sign_request() so both JWT/Bearer
and SigV4 authentication paths include it.
* fix(scim): handle deprovisioning operations without path field
When SCIM providers send deprovisioning requests without a path field
(e.g., {"op": "replace", "value": {"active": false}}), the code was
storing the value under an empty string key in metadata.
This fix:
- Detects operations with no path where value is a dict
- Extracts and handles known fields like 'active' correctly
- Sets metadata["scim_active"] = false instead of metadata[""] = {"active": false}
Fixes: SCIM deprovisioning creating empty string keys in user metadata
* fix(scim): handle all known fields in operations without path
Extended the fix to handle all SCIM fields (not just active) when
operations have no path field:
- active -> scim_active
- displayName -> user_alias
- externalId -> user_id
- name.givenName/familyName -> scim_metadata
Added comprehensive test for multiple fields without path.
Addresses Greptile review feedback on RFC 7644 compliance.
* trigger PR update
Add test to verify that get_deployment_credentials_with_provider correctly
resolves litellm_credential_name to actual credential values and removes
the credential name from the returned dictionary.
