mirror of
https://github.com/BerriAI/litellm.git
synced 2026-10-13 03:59:12 +00:00
ebc8e56aec
* fix(proxy): keep the personal budget on a proxy-admin user object A token carrying the proxy_admin role (JWT admin scope, SSO) replaced the fetched LiteLLM_UserTable row with a bare admin object, so max_budget never reached common_checks and admins spent past their personal budget on /chat/completions. Keep the row and force only user_role. Co-authored-by: L4XB <lukas.buck@e-mail.de> Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(e2e): budget denial for a proxy-admin JWT is the 422 ExceededBudget response Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(proxy): carry only the personal budget onto a forced proxy-admin user object Keeping the whole DB row also carried its models list, so a proxy admin whose row had no-default-models or a restricted list got 403 on personal requests. Build the admin object as before and copy max_budget and user_email across. The built-in admin identity (the master key and the UI username/password login) keeps ignoring its row's budget. * test(proxy): pin the contrast case in the admin model-list and admin-name budget tests Each test now also shows the same cached row refusing a non-exempt token, so the pass case cannot go green on a row the gate never read. * test(e2e): drive the personal-budget case with a proxy_admin user row and a plain JWT The Buildkite stack keeps the default admin_allowed_routes, so an admin-scope JWT gets 403 on /chat/completions before any budget check and the case could never pass there. A plain token whose sub resolves to a proxy_admin row goes through the same forced-admin rebuild. Drop the stage-mirror admin_allowed_routes edit, which the deployed stack never read. * ci: rerun e2e after an unrelated Gemini streaming spend-row timeout --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: L4XB <lukas.buck@e-mail.de> Co-authored-by: yucheng-berri <293926326+yucheng-berri@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| a2a | ||
| access_control | ||
| batches | ||
| claude_code | ||
| coverage_registry | ||
| gateway | ||
| guardrails | ||
| llm_translation | ||
| logging | ||
| management | ||
| mcp | ||
| migrations | ||
| other | ||
| perf | ||
| quota_management | ||
| router | ||
| secret_manager | ||
| ui | ||
| AGENTS.md | ||
| conftest.py | ||
| CONTRIBUTING.md | ||
| e2e_config.py | ||
| e2e_db.py | ||
| e2e_http.py | ||
| e2e_metadata.py | ||
| fixture_bundle.py | ||
| fixture_canonical.py | ||
| fixture_mode.py | ||
| fixture_profile.py | ||
| idp.py | ||
| idp_realm.json | ||
| junit_properties.py | ||
| lifecycle.py | ||
| memory_readings.py | ||
| models.py | ||
| otel_client.py | ||
| PROVIDER_CACHE.md | ||
| provider_cache.py | ||
| provider_cache_redis.py | ||
| provider_cache_routing.py | ||
| provider_edge.py | ||
| provider_edge_bedrock.py | ||
| proxy_client.py | ||
| pytest.ini | ||
| stack_lock.py | ||
| transport.py | ||