devin-ai-integration[bot] 225fd3bcdf feat(proxy): add denied_passthrough_routes deny list for custom pass-through endpoints (#44924) ... * feat(proxy): add denied_passthrough_routes deny list for custom pass-through endpoints Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(proxy): harden denied_passthrough_routes against non-admin clears and dot-segment paths Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * chore(ui): regenerate schema.d.ts for typed denied_passthrough_routes Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(proxy): match trailing-slash deny entries, block null metadata from dropping denies Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(proxy): close bulk update, encoded ?/# and ordering gaps in passthrough deny list Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(proxy): check denied pass-through routes against the path the forwarder sends upstream Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(proxy): type matching_denied_passthrough_route metadata mappings * fix(proxy): treat a `/` deny entry as denying every pass-through route Also types the new deny-list tests and drops their get_server_root_path mock in favour of unsetting SERVER_ROOT_PATH. * test(proxy): type the deny-list tests and drop unrelated test reformatting --------- Co-authored-by: mrinal <mrinal@berri.ai> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Yucheng He <yucheng@berri.ai>		2026-10-07 16:19:53 -07:00
..
_guardrail_opt_out.py	fix(proxy): gate disable_global_guardrails on keys and teams to proxy admins (#42699)	2026-09-23 18:03:02 -07:00
_hidden_alias_budget.py	fix(auth): resolve hidden model_group_alias entries in the zero-cost budget check (#43741)	2026-10-03 16:35:11 -07:00
test_access_group_model_listing.py	test(integration): regression tests for July cost tracking, budgeting and spend bugs (#42694)	2026-09-23 09:51:56 -07:00
test_alias_chain_budget_waiver.py	fix(router): price a model group from the deployments that serve it (#44732)	2026-10-06 05:31:09 +00:00
test_audit_any_sweep_auth.py	refactor(types): replace Any with proven types in 9 files (#44389)	2026-10-03 21:03:16 +00:00
test_bedrock_passthrough_model_access.py	test(integration): regression tests for July cost tracking, budgeting and spend bugs (#42694)	2026-09-23 09:51:56 -07:00
test_cli_sso_login_ui_disabled.py	fix(auth): clear the recent-miss user memo when /user/new creates the user (#45020)	2026-10-07 06:45:41 -07:00
test_customer_model_allowlist.py	feat(proxy): limit which models an end user can call (#43904)	2026-10-05 21:58:03 +00:00
test_deprecated_key_lookup_cache.py	test(proxy): migrate DB and Redis backed proxy tests into tests/integration (#43996)	2026-10-01 09:23:36 -07:00
test_hidden_alias_budget_bypass.py	fix(proxy): judge the free-model budget waiver by the group an alias routes to (#44638)	2026-10-06 02:44:35 +00:00
test_hidden_alias_budget_bypass_chaos.py	fix(auth): resolve hidden model_group_alias entries in the zero-cost budget check (#43741)	2026-10-03 16:35:11 -07:00
test_jwt_auto_register_map_existing_key.py	feat(jwt): auto_register_map_existing_key maps JWT to the user's existing virtual key (#42375)	2026-10-02 12:11:33 -07:00
test_jwt_default_team_provisioning.py	test(integration): regression tests for July cost tracking, budgeting and spend bugs (#42694)	2026-09-23 09:51:56 -07:00
test_jwt_mapped_key_email_backfill.py	test(integration): regression tests for July cost tracking, budgeting and spend bugs (#42694)	2026-09-23 09:51:56 -07:00
test_key_alias_model_access.py	fix(proxy): authorize key model aliases the same way as team aliases (#43049)	2026-09-24 19:51:02 -07:00
test_key_bound_to_unknown_user.py	test(integration): move legacy proxy, router and Redis tests into tests/integration (#44128)	2026-10-01 23:00:54 -07:00
test_key_guardrail_opt_out.py	fix(proxy): gate disable_global_guardrails on keys and teams to proxy admins (#42699)	2026-09-23 18:03:02 -07:00
test_key_guardrail_opt_out_chaos.py	fix(proxy): gate disable_global_guardrails on keys and teams to proxy admins (#42699)	2026-09-23 18:03:02 -07:00
test_key_guardrail_opt_out_runtime.py	fix(proxy): gate disable_global_guardrails on keys and teams to proxy admins (#42699)	2026-09-23 18:03:02 -07:00
test_object_permission_lookup.py	feat(proxy): add opt-in vector_store_deny_by_default for least-privilege vector store access (#44244)	2026-10-06 12:50:25 -07:00
test_passthrough_route_denylist.py	feat(proxy): add denied_passthrough_routes deny list for custom pass-through endpoints (#44924)	2026-10-07 16:19:53 -07:00
test_rag_query_vector_store_allowlist.py	feat(proxy): add opt-in vector_store_deny_by_default for least-privilege vector store access (#44244)	2026-10-06 12:50:25 -07:00
test_search_tool_deny_by_default.py	feat(auth): deny search tools by default when search_tool_deny_by_default is set (#44490)	2026-10-06 12:50:26 -07:00
test_team_admin_gate.py	test(ci): repair MCP Responses and budget fixtures (#43788)	2026-09-29 23:29:52 -07:00
test_team_member_permissions.py	test(integration): move legacy proxy, router and Redis tests into tests/integration (#44128)	2026-10-01 23:00:54 -07:00
test_team_scoped_models.py	test(integration): scope the team-scoped models upstream check to its own model (#45106)	2026-10-07 11:09:56 -07:00
test_warmed_policy.py	test(integration): pin the team-admin status-code matrix across every management route (#43249)	2026-09-26 11:32:24 -07:00
test_wildcard_model_access.py	test(integration): move legacy proxy, router and Redis tests into tests/integration (#44128)	2026-10-01 23:00:54 -07:00