litellm/tests/unit/proxy/auth
joshua-berri d11917e89c
fix(proxy): preserve caller metadata on auth failures (#51745)
* fix(proxy): keep x-litellm-spend-logs-metadata on auth-rejected failure spend logs

Budget, invalid-key and other auth-stage rejections are raised before the
request headers are merged into metadata, so the persisted failure row lost
the caller's spend logs metadata header. The auth failure handler now parses
it with the same pre-call helper and stamps it into the metadata bucket it
already uses for the requester IP and user agent.

* fix(proxy): type the spend logs metadata header parser honestly

The parser takes the request headers as a str mapping and returns the parsed
JSON as object, which is what successful requests already store. The auth
failure path keeps only JSON objects. The precedence regression now also
asserts the caller's request body is left untouched.

* fix(proxy): stamp the auth failure spend logs metadata into the route's bucket

A chat request whose body also carried litellm_metadata got the header in
litellm_metadata, which the failure spend row never reads on chat routes.
The header now goes into the bucket picked by metadata_variable_name_for_request
for the route, and the failure row lifts spend_logs_metadata from that bucket
the same way it already lifts the requester IP and user agent. The regression
tests now assert on the built failure spend row.

* fix(proxy): keep the auth failure spend logs metadata fix inside the auth handler

Restores the failure spend row's lifted fields to main, so failures after auth
on litellm_metadata routes keep their current logging. The auth handler now
writes the parsed header into metadata, which the failure spend row reads on
every route, and into the route's own bucket for callbacks on litellm_metadata
routes.

* fix(proxy): make the spend logs metadata header field read-only and test the real spend writer

The header collector now sets spend_logs_metadata when it is built, so the
field can be ReadOnly with the same stored value. The auth failure tests run
the real DBSpendUpdateWriter and read the queued spend log row from a fake
database client instead of an autospec writer.

* test(proxy): read auth failure spend rows from a real unconnected PrismaClient

Replaces the mocked database client and the class-level queue byte reset.
The test now enqueues into a real PrismaClient's own queue and dequeues
its row in cleanup, which keeps the shared byte counter balanced.

---------

Co-authored-by: Joshua Valluru <326636767+joshua-berri@users.noreply.github.com>
2026-11-13 16:13:50 -08:00
..
__init__.py ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903) 2026-09-24 22:59:11 +00:00
test_access_group_rules.py feat(auth): grant access groups through principal attribute rules (#50455) 2026-11-09 13:59:40 -08:00
test_admin_viewer_handler_access.py test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998) 2026-10-01 10:11:45 -07:00
test_auth_checks.py feat(redis): serve the proxy's common Redis call with Rust stores (#50170) 2026-11-06 06:01:11 +00:00
test_auth_checks_object_access_and_lookup.py refactor(redis): delete the Python RedisBatch now that every request op is native (#51383) 2026-11-13 03:22:28 +00:00
test_auth_exception_handler.py fix(proxy): preserve caller metadata on auth failures (#51745) 2026-11-13 16:13:50 -08:00
test_auth_hot_path_network_requests.py test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998) 2026-10-01 10:11:45 -07:00
test_auth_object_prefetch.py feat(redis): serve the proxy's common Redis call with Rust stores (#50170) 2026-11-06 06:01:11 +00:00
test_auth_utils.py fix(interactions): route Vertex lifecycle calls through the selected deployment (#51511) 2026-11-13 00:02:43 -08:00
test_authorization.py fix(proxy): share ownership permissions for spend logs and traces (#44239) 2026-10-03 01:38:54 +00:00
test_banned_params_extra_body.py test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998) 2026-10-01 10:11:45 -07:00
test_cli_auth.py test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998) 2026-10-01 10:11:45 -07:00
test_custom_auth_end_user_budget.py fix(auth): allow video retrieval after budget exhaustion (#51227) 2026-11-11 17:10:01 -08:00
test_customer_hierarchy_auth.py feat(customer-portal): add free tier limits with Enterprise upgrade path (#51687) 2026-11-13 14:43:15 -05:00
test_customer_member_auto_create.py feat(customer-portal): add free tier limits with Enterprise upgrade path (#51687) 2026-11-13 14:43:15 -05:00
test_customer_spend.py fix(proxy): enforce settled customer budgets across workers (#51568) 2026-11-13 07:33:24 -08:00
test_default_end_user_budget_simple.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_fallback_budget.py refactor(router): route the router family through RoutingContext and close the outside surface (#49118) 2026-10-30 19:18:54 -07:00
test_fallback_model_access.py feat(customer-portal): complete hierarchy management (#51521) 2026-11-13 17:58:34 +00:00
test_fallback_rate_limit.py fix(router): re-check and reserve per-model rate limits on fallback targets (#50994) 2026-11-10 16:36:10 -08:00
test_handle_jwt.py feat(auth): grant access groups through principal attribute rules (#50455) 2026-11-09 13:59:40 -08:00
test_info_routes.py test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998) 2026-10-01 10:11:45 -07:00
test_jwt.py fix(proxy): refresh cached team on /team/block and /team/unblock (#35643) 2026-10-19 22:50:33 +00:00
test_legacy_empty_models_check.py feat(proxy): log keys and teams still on the deprecated empty models defaults at boot (#50720) 2026-11-10 04:05:25 +00:00
test_litellm_license.py fix(proxy): stop logging license values during verification (#44956) 2026-10-06 17:05:07 -07:00
test_login_utils.py feat(proxy): hash UI passwords with PBKDF2 in FIPS mode (#49874) 2026-11-06 01:31:59 -08:00
test_master_key_boot_check.py fix(security): remove the publicly known master key from the repo (#44718) 2026-10-06 10:55:24 -07:00
test_mcp_ip_filtering.py refactor(mcp): drop the experimental label from the MCP server and client paths (#48513) 2026-10-27 17:47:50 +00:00
test_model_access_group_budgets.py feat(proxy): customer budget rollup, reset on the budget row's window, named templates, team overrides, multi-window limits and pause_allow_increase (#51582) 2026-11-13 16:05:35 +00:00
test_model_checks.py fix(proxy): list callable ids for partial aliases over a catch-all deployment (#50963) 2026-11-10 22:20:06 -08:00
test_model_checks_fallbacks.py refactor(router): route the router family through RoutingContext and close the outside surface (#49118) 2026-10-30 19:18:54 -07:00
test_models_fallback_endpoint.py refactor(router): move router callers onto the entry points and invert the proxy imports (#48847) 2026-10-29 17:26:33 +00:00
test_multi_budget_windows.py test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998) 2026-10-01 10:11:45 -07:00
test_multipart_bypass_repro.py ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903) 2026-09-24 22:59:11 +00:00
test_network.py test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998) 2026-10-01 10:11:45 -07:00
test_oauth2_proxy_hook.py test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998) 2026-10-01 10:11:45 -07:00
test_object_permission_loading.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_onboarding.py feat(proxy): hash UI passwords with PBKDF2 in FIPS mode (#49874) 2026-11-06 01:31:59 -08:00
test_organization_budget_enforcement.py test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998) 2026-10-01 10:11:45 -07:00
test_password_hashing.py test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998) 2026-10-01 10:11:45 -07:00
test_password_policy.py feat(proxy): hash UI passwords with PBKDF2 in FIPS mode (#49874) 2026-11-06 01:31:59 -08:00
test_personal_key_team_model_access.py fix(auth): let dashboard sessions use the user's team models (#51663) 2026-11-13 17:13:06 -05:00
test_proxy_routes.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_rds_iam_token.py fix(proxy): preserve AWS session tokens for RDS IAM auth (#46559) 2026-10-15 22:51:39 +00:00
test_resolvers_exceptions.py fix(auth): return a generic 401 for an unknown key (#39787) 2026-10-15 01:05:25 -07:00
test_resolvers_grants.py fix(proxy): recheck missing users when resolving session grants (#51030) 2026-11-10 21:55:53 +00:00
test_resolvers_models.py test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998) 2026-10-01 10:11:45 -07:00
test_resolvers_seam.py test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998) 2026-10-01 10:11:45 -07:00
test_resolvers_store.py fix(auth): return a generic 401 for an unknown key (#39787) 2026-10-15 01:05:25 -07:00
test_route_checks.py feat(proxy): customer org, team and member hierarchy with budget templates (#51459) 2026-11-12 15:11:51 -08:00
test_router_override_fallback_auth.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_scalar_budget_windows.py feat(proxy): customer budget rollup, reset on the budget row's window, named templates, team overrides, multi-window limits and pause_allow_increase (#51582) 2026-11-13 16:05:35 +00:00
test_search_tool_deny_by_default.py fix(proxy): scope dashboard search grants to user (#48464) 2026-10-26 15:01:40 -07:00
test_team_grants.py test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998) 2026-10-01 10:11:45 -07:00
test_team_member_budget.py feat(teams): show caller member spend and budget on Your Teams (#45674) 2026-10-24 17:09:55 -07:00
test_unmapped_model_budget_enforcement.py refactor(router): delete the python router core, the rust core is the only core (#50178) 2026-11-05 10:40:46 -08:00
test_user_api_key_auth.py fix(proxy): refuse a key pinned to another customer org before registering an unknown org alias (#51674) 2026-11-13 11:03:43 -08:00
test_user_api_key_auth_request_flow.py feat(proxy): run requests with unknown customer ids untracked instead of refusing them (#51548) 2026-11-13 16:56:21 +00:00
test_vector_store_access_groups.py feat(access-groups): grant vector stores through access groups (#50290) 2026-11-12 14:59:17 -08:00