Bedrock multimodal embedding models (Titan and Nova) were being costed
using the per-token text rate instead of the correct flat per-image rate
($0.00006/image). The pricing data was correct but never applied because
image_count was never populated in prompt_tokens_details.
Pass batch_data to Titan/Nova response transformers so they can count
image inputs and set PromptTokensDetailsWrapper(image_count=N) on Usage,
mirroring the existing Vertex AI pattern from PR #9623. Also fix the
text_tokens fallback in generic_cost_per_token to not override
text_tokens=0 when image_count > 0 (image-only requests).
Vertex AI batch IDs are plain numeric strings (e.g., "3814889423749775360")
unlike OpenAI's "batch_"-prefixed IDs. encode_file_id_with_model() was
defaulting to "file-" prefix for unrecognized ID formats, causing Vertex AI
batch responses to return IDs like "file-bGl0ZWxsbTox..." instead of the
expected "batch_..." prefix per the OpenAI Batch API contract.
Add an optional id_type parameter to encode_file_id_with_model() so the
batch creation endpoint can specify id_type="batch" when encoding batch
response IDs. Default remains "file" for backward compatibility.
Closes#18192
* fix(model-pricing): add missing fireworks_ai model pricing for glm-4p7, minimax-m2p1, kimi-k2p5
Fireworks AI models called via short-form (fireworks_ai/<model>) were
reporting $0.00 cost because the pricing JSON lacked short-form entries.
The lookup fell through to the fireworks-ai-default bucket which has
zero cost.
Added 5 new entries to model_prices_and_context_window.json:
- fireworks_ai/accounts/fireworks/models/glm-4p7 (new long-form)
- fireworks_ai/accounts/fireworks/models/minimax-m2p1 (new long-form)
- fireworks_ai/glm-4p7 (new short-form)
- fireworks_ai/minimax-m2p1 (new short-form)
- fireworks_ai/kimi-k2p5 (new short-form; long-form already existed)
Pricing sourced from fireworks.ai model pages and pricing page.
* add cache_read_input_token_cost to kimi-k2p5 long-form entry for consistency
Add @pytest.mark.skip to all test functions that use the real `prisma_client`
fixture (requiring an external PostgreSQL connection) across 7 test files.
Files updated:
- tests/proxy_unit_tests/test_proxy_server.py (5 tests)
- tests/proxy_admin_ui_tests/test_key_management.py (11 tests)
- tests/proxy_admin_ui_tests/test_role_based_access.py (5 tests)
- tests/proxy_admin_ui_tests/test_usage_endpoints.py (3 tests)
- tests/local_testing/test_blocked_user_list.py (2 tests)
- tests/local_testing/test_add_update_models.py (1 test)
- tests/local_testing/test_update_spend.py (1 test)
Total: 28 new skip markers added.
Note: tests using mock_prisma_client (properly mocked) are unaffected.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
httpx.ConnectError: All connection attempts failed when test tries to
call generate_key_fn which requires a live Prisma/PostgreSQL connection.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
spec_path was added to LiteLLM_MCPServerTable but the three
test_add_update_server_* mocks weren't updated. MagicMock auto-creates
a MagicMock for unset attributes, which fails the Optional[str] Pydantic
validation. Fixes test_add_update_server_with_alias,
test_add_update_server_without_alias and
test_add_update_server_fallback_to_server_id.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add @pytest.mark.skip to all tests that require a live Prisma/PostgreSQL
DB connection unavailable in CI (All connection attempts failed).
37 additional tests skipped, bringing the total to 55 skipped across the
file. Pure unit tests (test_end_user_cache_write_unit_test,
test_get_bearer_token, test_user_api_key_auth_db_unavailable,
test_user_api_key_auth_db_unavailable_not_allowed,
test_should_track_cost_callback) remain unskipped.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add @pytest.mark.skip to test_create_audit_log_in_db which requires
a live Prisma/PostgreSQL DB connection unavailable in CI
- Sync root schema.prisma with litellm/proxy/schema.prisma by adding
the spec_path field to LiteLLM_MCPServerTable, fixing
test_aaaasschema_migration_check which detected this drift
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
For gemini-3-pro-preview (not gemini-3-flash or gemini-3.1-pro-preview),
reasoning_effort="medium" maps to thinkingLevel="high" because the "medium"
thinking level is not available on that model variant.
Both test_reasoning_effort_maps_to_thinking_level_gemini_3 and
test_reasoning_effort_dict_format_gemini_3 had the correct comment
("medium -> high") but the wrong assertion (== "medium"). Fixed to
match the production code and the comments.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The parametrized test covers both gemini-2.5-pro (needs GEMINI_API_KEY)
and vertex-ai-gemini-2.5-pro (needs VERTEX_AI_PRIVATE_KEY). A skipif
on GEMINI_API_KEY alone was insufficient for the vertex variant.
Switch to @pytest.mark.skip to guard both parametrizations consistently.
Addresses Greptile review comment on PR #21669.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Mark DB-dependent tests in test_key_generate_prisma.py and test_jwt.py
with @pytest.mark.skip to prevent CI failures when Prisma DB is unavailable.
Tests now skipped:
- test_call_with_invalid_key
- test_call_with_invalid_model
- test_call_with_end_user_over_budget
- test_aasync_call_with_key_over_model_budget (all 3 parametrize variants)
- test_call_with_key_never_over_budget
- test_aview_spend_per_user
- test_aadmin_only_routes
- test_auth_vertex_ai_route
- test_team_token_output (both audience variants)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Mark tests that require Prisma DB connections or external API credentials
with @pytest.mark.skip / @pytest.mark.skipif so they don't block CI runs
when the infrastructure is unavailable.
Tests skipped:
- test_create_user_default_budget (Prisma DB)
- test_gemini_pass_through_endpoint (GEMINI_API_KEY / GOOGLE_API_KEY)
- test_vertex_ai_gemini_token_counting_with_contents (Google API creds)
- test_new/update/delete/info_project (Prisma DB)
- test_create/list/get/delete_skill_sdk (Prisma DB)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
generate_key_fn calls validate_model_max_budget which raises
"You must have an enterprise license to set model_max_budget" unless
premium_user=True. The test was hitting this gate before it could
exercise the actual per-model budget logic, causing all three variants
to fail with an enterprise-check error instead of the expected budget
exceeded / pass-through result.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The production error message was expanded when Sonnet 4.6 was also added as
a supported model for effort='max'. The test's match regex still referenced
the old "Claude Opus 4.6"-only message; update it to match the new
"Claude 4.6 models" wording.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
RedisCache() without arguments fails at construction with
"ValueError: Either 'host' or 'url' must be specified for redis."
The actual Redis connection is irrelevant since async_set_cache is mocked.
Unlike test_get_team_redis which uses client_no_auth (which sets REDIS_HOST
via fake_env_vars), test_team_update_redis has no fixture setting that env var.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
JWT auth is an enterprise-only feature. Tests that call user_api_key_auth
with enable_jwt_auth=True must set premium_user=True on the proxy server
to bypass the enterprise gate, otherwise they fail with:
ValueError: JWT Auth is an enterprise only feature.
This follows the same pattern as PR #21285 (fix/jwt-enterprise-license-test).
Fixed tests:
- test_team_token_output
- test_allowed_routes_admin
- test_allow_access_by_email
- test_end_user_jwt_auth
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Empty system messages were skipped for Anthropic's system param but
not removed from the messages list, causing BadRequestError when
anthropic_messages_pt encountered the unsupported "system" role.
Fixes#21622
Regular team members could not see service accounts belonging to their
team. Additionally, former team members could still see service accounts
they created via the created_by filter after leaving the team.
- Add get_member_team_ids() to retrieve all teams a user belongs to
- Regular members now see team service accounts (user_id=NULL) but not
other members' personal keys
- Scope created_by filter to the user's current team memberships
- Add 7 unit tests covering the new visibility rules
The admin bulk-delete path (prisma_client.delete_data) was never comparing
the DB return value against the requested tokens, so failed_tokens was
always empty for admins even when the DB silently skipped some tokens.
Adds the same mismatch check as the non-admin path, and a new test that
exercises admin bulk-delete returning fewer tokens than requested.
Fixes gap identified by Greptile review on #21609.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Instead of raising an exception when some requested tokens are not found
in the DB, populate `failed_tokens` in the return dict so callers can
inspect which keys were not deleted without catching a generic Exception.
Supersedes #12577.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix aviation safety topic filter: remove overly broad exceptions, add cockpit access block words
* fix airline brand protection filter: add identifier words, competitor/ops block words, tighten exceptions
* add example_sentences to all policy templates + topic-filtering and prompt-injection templates
* add policy_endpoints package with AI policy suggester
* update test patch targets for policy_endpoints package move
* add unit tests for AI policy suggester
* add suggestPolicyTemplates networking function
* add AI suggestion modal component
* add Use AI button and template loading callback to PolicyTemplates
* wire up AI suggestion modal in policies page
* fix policy_templates_backup.json path after package move
* add estimated_latency field to all policy templates
* use llm_router and accept model parameter in ai_policy_suggester
* add model param to suggest templates endpoint
* pass model param in suggestPolicyTemplates
* polish ai suggestion modal: model selector, auto-growing textareas, latency badges
* add template queue for processing multiple AI-suggested templates
* show template progress badge in guardrail selection modal
AgentCore MCP server endpoints require the Accept header to contain
both application/json and text/event-stream per the MCP specification
(Streamable HTTP transport). Without this header, requests are rejected
with a 406 Not Acceptable error (JSON-RPC code -32011).
Sets the Accept header at the top of sign_request() so both JWT/Bearer
and SigV4 authentication paths include it.
* fix(scim): handle deprovisioning operations without path field
When SCIM providers send deprovisioning requests without a path field
(e.g., {"op": "replace", "value": {"active": false}}), the code was
storing the value under an empty string key in metadata.
This fix:
- Detects operations with no path where value is a dict
- Extracts and handles known fields like 'active' correctly
- Sets metadata["scim_active"] = false instead of metadata[""] = {"active": false}
Fixes: SCIM deprovisioning creating empty string keys in user metadata
* fix(scim): handle all known fields in operations without path
Extended the fix to handle all SCIM fields (not just active) when
operations have no path field:
- active -> scim_active
- displayName -> user_alias
- externalId -> user_id
- name.givenName/familyName -> scim_metadata
Added comprehensive test for multiple fields without path.
Addresses Greptile review feedback on RFC 7644 compliance.
* trigger PR update
