The _add_tag_to_deployment function was directly modifying the
deployment's litellm_params in memory and writing it back to the
database, which caused encrypted API keys and other sensitive fields
to be lost. This fix retrieves the model from the database first,
preserves all existing fields including encrypted ones, adds only the
new tag to the tags array, and updates the database with the modified
params while keeping encrypted fields intact.
Added comprehensive unit tests covering preservation of encrypted
fields, handling of both string and dict litellm_params formats,
duplicate tag prevention, and error handling for missing models.
Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
Fixes#17552
- Change Prisma include from 'users' to 'members'
- Use LiteLLM_OrganizationTableWithMembers type for membership validation
- Access organization.members instead of organization.users
- Add tests for membership validation
* test: add failing tests for SSO user not added to Entra-synced teams bug
Adds tests reproducing the bug where new SSO users with teams=None
(from NewUserResponse) are not added to Entra ID synced teams because
add_missing_team_member() returns early when teams is None.
Tests demonstrate:
- NewUserResponse with teams=None fails to add user to teams (bug)
- LiteLLM_UserTable with teams=[] correctly adds user to teams (control)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: treat None as empty list in add_missing_team_member for new SSO users
Fixed bug where new SSO users logging in via Microsoft SSO were not added
to their Entra-synced teams. The issue was an early return when
user_info.teams is None (default for NewUserResponse). Now treats None
as an empty list so new users are properly added to all their SSO teams.
Location: litellm/proxy/management_endpoints/ui_sso.py:438-440
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix: skip user budget/model validation for org-scoped teams
When creating a team with organization_id, budget and model constraints
should be validated against the organization's limits, not the user's
personal limits. This allows org admins with restrictive personal
budgets to create teams within their organization's more generous limits.
Adds 4 unit tests to verify:
- Org-scoped teams bypass user budget validation
- Org-scoped teams bypass user model validation
- Standalone teams still validate against user limits
* fix: enforce user budget/model limits for standalone teams in update_team
- Add user-level budget and model validation to update_team endpoint for standalone teams,
matching the existing pattern in new_team
- Org-scoped teams correctly bypass user validation and use organization limits instead
- Add 5 new comprehensive tests covering standalone/org team budget/model validation
* fix: Add direct TPM/RPM org limit validation and consolidate user team limit checks
- Add direct TPM/RPM comparison against org limits in _check_org_team_limits()
- Consolidate budget/models/TPM/RPM user validation into _check_user_team_limits() helper
- Ensure user limits only apply to standalone teams (organization_id=None)
- Org-scoped teams now validate TPM/RPM against org limits (not user limits)
- Add 8 tests for TPM/RPM validation scenarios (org and user limits)
- Reduce code duplication between new_team() and update_team()
* add NewModelGroupRequest
* add endpoint for create_model_group
* fix model_access_group_management_router
* add UpdateModelGroupRequest, info and delete
* fix model management tag
* fix validate_models_exist
* fix get_all_access_groups_from_db
* test_create_duplicate_access_group_fails
* test fixes
* fix working create access groups
* fix access group management endpoints
* add is db model checks for model access groups
* Use end user budget instead of key budget when creating new team
* Fixed implementation to use user's max budget from the UserTable instead of EndUserTable
* fix: ensure end user endpoints use "handle_exception_on_proxy" correctly
* test 404 on info and update for non-existent user
* test 404 for no customer found
* fix 404 handling for customer endpoints
* test_error_schema_consistency
* test_customer_endpoints_error_schema_consistency
