litellm/tests/test_litellm/proxy/auth
yuneng-jiang 49995ba9ce
fix(proxy)!: apply request-parameter checks consistently across body, path and form inputs (#36011)
Cherry-pick of the #36011 merge (six commits) as a single unit.

(cherry picked from commit c898d341c0)

Backport adaptation for stable/1.91.x:
- litellm/proxy/auth/auth_utils.py: took only the `extract_nested_form_metadata`
  import this commit adds. The neighbouring
  `LITELLM_PASS_THROUGH_ENDPOINT_MARKER` import is context in the upstream diff,
  not an addition; that symbol does not exist on this line and is referenced
  nowhere here, so importing it would have broken module import.
- litellm/proxy/health_endpoints/_health_endpoints.py: kept this line's `typing`
  import idiom and added `Final` and `Mapping` there, rather than taking
  upstream's `from collections.abc import Iterable, Mapping`. This line never
  took staging's collections.abc migration and still sources `Iterable` from
  `typing`.
- litellm/proxy/litellm_pre_call_utils.py: added `Final` to the `typing` import,
  required by the extracted `reject_url_valued_destination`. Upstream already
  had it from a later lint pass that is not on this line.
- tests/test_litellm/proxy/auth/test_auth_utils.py: kept this commit's own
  `TestIsRequestBodySafeChecksBracketNotationMetadata` and omitted the
  staging-prior `TestGetKeyTagRateLimits`, whose subject `get_key_tag_rpm_limit`
  does not exist on this line.
2026-08-08 11:49:23 -07:00
..
test_admin_viewer_handler_access.py fix(rbac): restore admin-viewer read parity for Logs page + settings reads 2026-04-29 19:21:41 -07:00
test_auth_checks.py revert: undo teamless all-team-models denial from #32022 and #29746 (#32032) 2026-07-04 02:41:01 +00:00
test_auth_exception_handler.py fix(proxy): return 5xx on DB infra errors during auth; reserve 401 for genuine auth failures (#29986) 2026-06-10 23:48:11 +00:00
test_auth_hot_path_network_requests.py fix: update docker test file to right path 2026-02-19 18:44:28 +05:30
test_auth_utils.py fix(proxy)!: apply request-parameter checks consistently across body, path and form inputs (#36011) 2026-08-08 11:49:23 -07:00
test_banned_params_extra_body.py chore(tests): drop redundant membership check; trim test comment 2026-05-14 03:39:15 +00:00
test_cli_auth.py cover cli sso start validation 2026-04-29 17:25:32 -07:00
test_custom_auth_end_user_budget.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_handle_jwt.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_info_routes.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_litellm_license.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_login_utils.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_mcp_ip_filtering.py feat(mcp): add mcp_xff_num_trusted_hops to harden X-Forwarded-For client IP resolution (#31257) 2026-06-25 07:31:29 -07:00
test_model_checks.py revert: undo teamless all-team-models denial from #32022 and #29746 (#32032) 2026-07-04 02:41:01 +00:00
test_model_checks_fallbacks.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_multi_budget_windows.py fix(proxy): enforce budgets against authoritative DB spend when the cross-pod counter is unreliable (#30684) 2026-06-18 10:35:41 -07:00
test_network.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_oauth2_proxy_hook.py chore(auth): require trusted proxy for header identity auth 2026-04-29 21:20:21 -07:00
test_object_permission_loading.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_onboarding.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_organization_budget_enforcement.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_password_hashing.py chore: fixes 2026-03-30 18:36:58 -07:00
test_resolvers_exceptions.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_models.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_seam.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_store.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_route_checks.py feat(proxy): allow llm_api_routes virtual keys to list MCP tools via /v1/mcp/tools (#31031) 2026-06-22 17:36:26 -07:00
test_router_override_fallback_auth.py chore(proxy): clean up request parameter validation and provider destination handling (#34189) 2026-08-08 11:44:54 -07:00
test_team_member_budget.py Fix team member budget enforcement without user row (#27273) 2026-05-06 11:42:29 -07:00
test_unmapped_model_budget_enforcement.py perf: eliminate per-request callback scanning on proxy hot path (#27858) 2026-05-14 09:28:31 -07:00
test_user_api_key_auth.py fix(auth): cache auth-path team object under canonical team_id key (#31418) 2026-06-26 23:36:50 +03:00