Incorporate new _check_key_admin_access() calls from the base branch
into block_key/unblock_key alongside our existence-check fix.
Update test mocks: replace references to removed get_key_object and
_cache_key_object with _delete_cache_key_object in both the shared
_setup_block_unblock_mocks helper and individual test functions.
Co-authored-by: yuneng-jiang <yuneng-jiang@users.noreply.github.com>
- Add guard assertion before non-null click on custom code switch
- Use await act(async ...) for timer advancement to avoid act warnings
- Pin locale in date range assertion for CI determinism
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds /key/info, /key/list, /key/aliases, and /team/daily/activity
to the hardcoded PERMISSION_OPTIONS in TeamSSOSettings.tsx.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Resolved conflicts in ScoreChart.test.tsx and HelpLink.test.tsx by
preferring origin/main's renderWithProviders pattern and merging
unique tests from both branches.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Remove Ant Design CSS class selector coupling in ExportFormatSelector test
- Lift mock fns out of TestTable component body to enable callback assertions
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add explicit vi import to ScoreChart.test.tsx
- Use custom matcher for I/O modes to avoid cross-element text issues
- Use version-agnostic regex for Save button assertion
- Add comments noting placeholder data in GuardrailConfig tests
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add typeof string guards to all array element returns in resolveMode
to prevent non-string values from sneaking through via any-widening.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace unsafe `as string[]` cast in modeMatches with runtime type
check via `.some()`.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Move vi.useRealTimers() to afterEach for proper cleanup
- Use label-based DOM queries instead of fragile positional indexes
- Remove leftover debug console.log from AgentHubTableColumns.tsx
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add modeMatches() helper so array guardrail_mode values (e.g.
["pre_call", "post_call"]) place the entry in all matching timeline
buckets, not just the first. Updated test to verify both buckets.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The backend type for guardrail_mode is Optional[Union[str, List[str], Dict]]
but the UI typed it as just string, causing a crash when .replace() was
called on null/object/array values.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
These were only used in block_key/unblock_key for cache refresh,
which now uses _delete_cache_key_object instead.
Co-authored-by: yuneng-jiang <yuneng-jiang@users.noreply.github.com>
- test_block_key_nonexistent_key_returns_404: verifies block_key returns
404 (not misleading 401) when the key doesn't exist in the DB
- test_unblock_key_nonexistent_key_returns_404: same for unblock_key
- test_block_key_existing_key_succeeds: verifies block_key succeeds and
invalidates cache for existing keys
- Update test_unblock_key_supports_both_sk_and_hashed_tokens to reflect
the new cache invalidation pattern (_delete_cache_key_object instead
of get_key_object + _cache_key_object)
Co-authored-by: yuneng-jiang <yuneng-jiang@users.noreply.github.com>
The block_key() and unblock_key() handlers previously returned a
misleading 401 'Authentication Error' when the body 'key' didn't exist
in the database, even though authentication (via Authorization header)
succeeded correctly.
Root cause: After auth passed, the handlers called get_key_object() for
cache refresh. This function was designed for auth token lookup and
raises ProxyException(code=401) when a token isn't found. Additionally,
Prisma's update() silently returns None for non-existent records instead
of raising an error, so the code reached get_key_object() without
detecting the missing key.
Fix:
- Add an explicit existence check (find_unique) before the update
- Return 404 ProxyException with 'Key not found' if the key doesn't exist
- Replace get_key_object() + manual cache update with _delete_cache_key_object()
to invalidate the cache (next read will re-fetch from DB)
- Reuse the find_unique result for audit logs, eliminating duplicate queries
Co-authored-by: yuneng-jiang <yuneng-jiang@users.noreply.github.com>
Extract duplicate file preview JSX blocks (responses and chat image
previews) into a reusable FilePreviewCard component, reducing ~50
lines of duplicated markup in ChatUI.tsx.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
On /key/block, /key/unblock, and /key/update, the request body 'key'
field could contaminate the api_key Security dependency, causing the
auth layer to authenticate against the target key instead of the
caller's bearer token. This returned 401 for a nonexistent body key
even when the Authorization header contained a valid master key.
Added a guard in user_api_key_auth that re-reads the Authorization
header directly from the request, ensuring the header is always the
authoritative source for authentication.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Document intentional legacy-matching behavior: when user_id is
provided to an org admin, no org filter is applied (returns all of
that user's teams across all orgs, same as legacy endpoint)
- Fix two existing security tests to properly patch user_api_key_cache,
proxy_logging_obj, and get_user_object instead of relying on
incidental error handling
- Add three new org admin test cases:
- Org admin sees org-scoped teams (200 with correct where clause)
- Org admin rejected when filtering by other org (403)
- Org admin with user_id filter returns target user's teams
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Replace raw find_unique with get_user_object in
_build_team_list_where_conditions for cache/metrics consistency
- Remove over-complex OR clause for org admin + user_id: when user_id
is provided, filter by that user's direct team memberships (same as
regular users) since the access control gate already verified the
org admin's authority
- Preserve caller-supplied organization_id instead of overwriting with
org_admin_org_ids
- Update test mock to match get_user_object call path
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- _get_org_admin_org_ids: catch only ValueError (user not found) instead
of bare Exception — DB errors now propagate as 500s instead of silently
demoting org admins to regular users
- _build_team_list_where_conditions: return None (not a sentinel string)
when user has no team memberships; list_team_v2 short-circuits to empty
response without hitting the DB
- Org admin + team_id + user_id: use exact team_id match with org scope
instead of OR expansion that effectively ignored the team_id filter
- Org admin + user_id (no team_id): OR(org teams, direct memberships)
now matches legacy _authorize_and_filter_teams behaviour
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Fix org admin own-query regression: always check org admin status
before the standard route check so own-queries see all org teams
- Clear user_id when org admin is detected so org scope replaces
user-membership scope
- Remove dead isinstance(organization_id, list) branch
- Remove unused datetime import
- Remove orphaned _convert_teams_to_response helper
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add org admin support to /v2/team/list so org admins can list teams
within their organizations instead of getting 401. Also enrich the
response with members_count and add missing indexes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
