mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-14 23:21:35 +00:00
6e26087cf4
* fix(proxy): only enforce budgets on routes that can spend Budget checks ran inside common_checks with no route filter, so an over-budget user, team, organization or tag got a 429 on every authenticated route, including the management calls the Admin UI makes on load. An internal user who exhausted their budget could not open the dashboard to see why, and a max_budget of 0 locked them out from the moment the account existed. Gate the scope budget checks on RouteChecks.is_llm_api_route, matching the virtual key budget check, the reservation path and the global proxy budget check, which already scope themselves this way. /health/services keeps enforcing because it fires Slack, email and webhook sends. The Admin UI is affected because a UI login mints a virtual key scoped to the litellm-dashboard pseudo-team. That token was shielded from personal budgets by the team-key exemption until #32005 removed it. * fix(proxy): keep budget enforcement on provider-calling health routes /health and /health/test_connection are not LLM API routes but both run litellm.ahealth_check against real deployments, so exempting them let an exhausted budget keep incurring provider spend. Add them alongside /health/services in BUDGET_ENFORCED_SIDE_EFFECT_ROUTES and cover all three with a regression test. * chore(ui): drop env-dependent schema.d.ts regeneration from this PR The regenerated diff was union-member reordering only, with no change to the represented types, and the ordering differs between a local run and CI. Keeping the committed file as-is lets the drift check pass and keeps this PR to the auth change. * chore(ui): restore schema.d.ts to the branch base The previous commit restored it from the staging tip, which pulled in unrelated merged changes. This PR changes no backend models, so the file should be untouched. |
||
|---|---|---|
| .. | ||
| test_admin_viewer_handler_access.py | ||
| test_auth_checks.py | ||
| test_auth_exception_handler.py | ||
| test_auth_hot_path_network_requests.py | ||
| test_auth_utils.py | ||
| test_banned_params_extra_body.py | ||
| test_cli_auth.py | ||
| test_custom_auth_end_user_budget.py | ||
| test_handle_jwt.py | ||
| test_info_routes.py | ||
| test_litellm_license.py | ||
| test_login_utils.py | ||
| test_mcp_ip_filtering.py | ||
| test_model_checks.py | ||
| test_model_checks_fallbacks.py | ||
| test_multi_budget_windows.py | ||
| test_network.py | ||
| test_oauth2_proxy_hook.py | ||
| test_object_permission_loading.py | ||
| test_onboarding.py | ||
| test_organization_budget_enforcement.py | ||
| test_password_hashing.py | ||
| test_resolvers_exceptions.py | ||
| test_resolvers_models.py | ||
| test_resolvers_seam.py | ||
| test_resolvers_store.py | ||
| test_route_checks.py | ||
| test_router_override_fallback_auth.py | ||
| test_team_member_budget.py | ||
| test_unmapped_model_budget_enforcement.py | ||
| test_user_api_key_auth.py | ||