scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-03 02:22:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 81
litellm/tests/test_litellm/proxy
History
user 3372db4f8f
fix(proxy): scope team and agent activity endpoints per-entity (VERIA-43) 
Two related cross-tenant leaks in the daily-activity endpoints:

1. `/team/daily/activity` set a single `has_full_team_view` flag that
   went True if the caller was admin/perm-holder of ANY one of the
   requested teams. An admin of team A could pass `team_ids=A,B` and
   read team B's per-API-key breakdown even when they were only a
   plain member of team B. Require admin/permission on EVERY requested
   team for the unfiltered view; otherwise force fallback to the
   caller's own API keys for the whole request. Callers wanting wider
   coverage can split into separate requests.

2. `/agent/daily/activity` initialized an empty `where_condition` and
   returned every agent's spend/token rows on the proxy when
   `agent_ids` was omitted — the dashboard's "Top Agents Driving
   Spend" panel triggered this for any authenticated user. For
   non-admin callers, scope the query to agents they're permitted to
   invoke (`AgentRequestHandler.get_allowed_agents`) or, when their
   key/team has no explicit agent allowlist, to agents they created
   (`created_by`). Explicit `agent_ids` is intersected with the same
   permitted set rather than trusted. When the resolved set is empty,
   return an empty paginated page without issuing the query.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-01 21:54:32 +00:00
..
_experimental/mcp_server Merge pull request #26849 from stuxf/fix/mcp-oauth-discovery-ssrf 2026-04-30 13:44:16 -07:00
agent_endpoints style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
anthropic_endpoints test: isolate proxy master_key/prisma_client module globals between tests 2026-04-23 15:31:16 -07:00
auth Merge pull request #26835 from stuxf/codex/cli-sso-flow-binding 2026-04-30 17:10:27 -07:00
client tighten cli sso session flow 2026-04-29 17:13:25 -07:00
common_utils Reorder counter invalidation to run after DB write 2026-04-30 17:50:58 -07:00
db Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_dbReconnectNonBlocking_local 2026-04-29 13:57:35 -07:00
discovery_endpoints style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
experimental/mcp_server Litellm fix GitHub action testing (#11163) 2025-05-26 14:41:42 -07:00
google_endpoints run pre_call_hook on Google generateContent endpoints 2026-04-30 16:43:42 -07:00
guardrails chore(proxy): harden request control fields 2026-04-29 22:35:17 -07:00
health_endpoints fix: /health/readiness 503 loop when DB is unreachable (#26134) 2026-04-20 15:29:43 -07:00
hooks Merge branch 'litellm_internal_staging' into litellm_project_rate_limiting 2026-04-17 19:10:06 -07:00
image_endpoints style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
management_endpoints fix(proxy): scope team and agent activity endpoints per-entity (VERIA-43) 2026-05-01 21:54:32 +00:00
management_helpers feat(proxy): move search tool access to object permissions 2026-04-29 12:29:20 +05:30
memory Litellm memory improvements v2 (#26541) 2026-04-25 19:03:43 -07:00
middleware style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
openai_files_endpoint Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_yj_apr17 2026-04-17 17:36:40 -07:00
pass_through_endpoints Merge pull request #26827 from stuxf/fix/passthrough-auth-default 2026-04-30 17:06:37 -07:00
policy_engine style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
prompts style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
public_endpoints Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_/wonderful-bouman 2026-04-17 21:32:09 -07:00
rag_endpoints tests and route permissions (#21508) 2026-02-18 16:58:38 -08:00
realtime_endpoints test: isolate proxy master_key/prisma_client module globals between tests 2026-04-23 15:31:16 -07:00
response_api_endpoints style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
spend_tracking chore(auth): substitute alias for master key on UserAPIKeyAuth 2026-04-29 18:53:12 +00:00
test_configs Litellm fix GitHub action testing (#11163) 2025-05-26 14:41:42 -07:00
ui_crud_endpoints Merge pull request #26442 from BerriAI/litellm_feat-restrict-org-admin-permissions 2026-04-25 08:50:26 -07:00
vector_store_endpoints Merge pull request #26802 from BerriAI/litellm_lazyLoadedFrontPage 2026-04-30 13:04:42 -07:00
__init__.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
conftest.py test: isolate proxy master_key/prisma_client module globals between tests 2026-04-23 15:31:16 -07:00
test_aiohttp_cleanup_closed.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_aiohttp_session_recovery.py fix: use AsyncMock for concurrent test consistency 2026-03-18 00:54:23 +00:00
test_api_key_masking_in_errors.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_audio_speech_prometheus_hooks.py fix req changes 2026-02-28 21:32:57 +05:30
test_batch_expiry.py fix(proxy): improve team expiry enforcement validation 2026-03-03 17:29:39 -08:00
test_batch_metadata_none_fix.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_batch_retrieve_bedrock.py fix(proxy/batches): forward model to retrieve_batch for bedrock 2026-04-29 22:48:03 +02:00
test_caching_routes.py [Bug Fix] Ensure /redis/info works on GCP Redis (#11732) 2025-06-14 15:35:09 -07:00
test_chat_completion_metadata.py fix: propagate JWT auth metadata to OTEL spans (#19627) 2026-01-23 21:21:23 -08:00
test_common_request_processing.py feat(proxy): LiteLLM headers on Google native generateContent routes (#25500) 2026-04-29 12:34:14 -07:00
test_cors_config.py refactor: extract _get_cors_config() for testability, fix no-op CORS tests 2026-04-11 22:24:04 +05:30
test_custom_proxy.py fix(ui/): fix routing for custom server root path (#15701) 2025-10-23 13:59:29 -07:00
test_empty_model_list.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_enforce_user_param.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_fallback_management_endpoints.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_fastapi_offline_routes.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_health_check_functions.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_health_check_max_tokens.py fix(proxy): avoid duplicate reasoning capability lookup 2026-04-17 12:49:31 +05:30
test_litellm_pre_call_utils.py Merge pull request #26851 from stuxf/codex/fix-callback-env-secret-resolution 2026-04-30 13:11:32 -07:00
test_max_budget_env_var.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_model_dump_with_preserved_fields.py Fix_mapped tests part 2 2026-02-26 12:43:39 +05:30
test_model_id_header_propagation.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_model_info_default_limits.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_model_level_guardrails.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_openapi_schema_validation.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_prometheus_cleanup.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_proxy_cli.py feat(proxy): add --timeout_worker_healthcheck flag for uvicorn worker triage 2026-04-27 11:06:56 -07:00
test_proxy_server.py Refresh Redis TTL on counter writes and skip stale in-memory on Redis miss 2026-04-30 17:50:58 -07:00
test_proxy_types.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_proxy_utils.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_pyroscope.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_response_model_sanitization.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_route_a2a_models.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_route_llm_request.py run pre_call_hook on Google generateContent endpoints 2026-04-30 16:43:42 -07:00
test_shared_health_check.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_spend_log_cleanup.py fix: harden CORS, create_views exception handling, and spend log cleanup loop 2026-04-11 18:58:04 +05:30
test_swagger_chat_completions.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_team_member_update.py fix mapped tests (#12320) 2025-07-04 10:04:43 -07:00
test_team_org_move.py fix(team_endpoints): auto-add SSO team members to org on move (proxy admin only) (#26377) 2026-04-24 08:36:25 -07:00
test_tools_allowlist_enforcement.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_update_llm_router_resilience.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_utils.py add NO_OPENAPI env var to disable /openapi.json endpoint (#25547) 2026-04-14 23:37:49 +05:30