litellm/tests/integration/authorization
ryan-crabbe-berri 4c78023db2
feat(teams): let proxy admins grant team admins the right to raise their team budget (#45404)
* feat(teams): let proxy admins grant team admins the right to raise their team budget

Adds a raise_max_budget entry to team_admin_editable_team_fields. With max_budget alone a team admin can still only keep or lower the team budget. Adding raise_max_budget lets them raise it, capped by the organization's max_budget when the team belongs to one, while removing the budget stays with proxy admins. The entry is rejected without max_budget, /team/info reports may_raise_max_budget to the caller, and the Admin UI nests the new checkbox under Max Budget with a tooltip and shows the team admin a hint under the budget field.

* fix(ui): shorten the raise_max_budget tooltip and link it to the docs

* fix(teams): pin the organization in the guarded team budget write

A granted raise is checked against the team's organization at read time, so the write now also requires organization_id to be unchanged. A concurrent move into a budgeted org returns 409 instead of landing an uncapped raise. Also types the new test helpers.

* test(teams): type the team row store methods and the touched race test arguments

* test(teams): annotate the last fixture and parametrize arguments in the raise_max_budget tests
2026-10-09 13:39:08 -07:00
..
_guardrail_opt_out.py fix(proxy): gate disable_global_guardrails on keys and teams to proxy admins (#42699) 2026-09-23 18:03:02 -07:00
_hidden_alias_budget.py fix(auth): resolve hidden model_group_alias entries in the zero-cost budget check (#43741) 2026-10-03 16:35:11 -07:00
test_access_group_model_listing.py test(integration): regression tests for July cost tracking, budgeting and spend bugs (#42694) 2026-09-23 09:51:56 -07:00
test_alias_chain_budget_waiver.py fix(router): price a model group from the deployments that serve it (#44732) 2026-10-06 05:31:09 +00:00
test_audit_any_sweep_auth.py refactor(types): replace Any with proven types in 9 files (#44389) 2026-10-03 21:03:16 +00:00
test_bedrock_passthrough_model_access.py test(integration): regression tests for July cost tracking, budgeting and spend bugs (#42694) 2026-09-23 09:51:56 -07:00
test_cli_sso_login_ui_disabled.py test: replace 61 live logging and otel tests with offline unit and integration coverage (#45362) 2026-10-08 15:55:57 -07:00
test_customer_model_allowlist.py feat(proxy): limit which models an end user can call (#43904) 2026-10-05 21:58:03 +00:00
test_deprecated_key_lookup_cache.py test(proxy): migrate DB and Redis backed proxy tests into tests/integration (#43996) 2026-10-01 09:23:36 -07:00
test_hidden_alias_budget_bypass.py fix(proxy): judge the free-model budget waiver by the group an alias routes to (#44638) 2026-10-06 02:44:35 +00:00
test_hidden_alias_budget_bypass_chaos.py fix(auth): resolve hidden model_group_alias entries in the zero-cost budget check (#43741) 2026-10-03 16:35:11 -07:00
test_jwt_auto_register_map_existing_key.py feat(jwt): auto_register_map_existing_key maps JWT to the user's existing virtual key (#42375) 2026-10-02 12:11:33 -07:00
test_jwt_default_team_provisioning.py test(integration): regression tests for July cost tracking, budgeting and spend bugs (#42694) 2026-09-23 09:51:56 -07:00
test_jwt_mapped_key_email_backfill.py test(integration): regression tests for July cost tracking, budgeting and spend bugs (#42694) 2026-09-23 09:51:56 -07:00
test_key_alias_model_access.py fix(proxy): authorize key model aliases the same way as team aliases (#43049) 2026-09-24 19:51:02 -07:00
test_key_bound_to_unknown_user.py test(integration): move legacy proxy, router and Redis tests into tests/integration (#44128) 2026-10-01 23:00:54 -07:00
test_key_guardrail_opt_out.py fix(proxy): gate disable_global_guardrails on keys and teams to proxy admins (#42699) 2026-09-23 18:03:02 -07:00
test_key_guardrail_opt_out_chaos.py fix(proxy): gate disable_global_guardrails on keys and teams to proxy admins (#42699) 2026-09-23 18:03:02 -07:00
test_key_guardrail_opt_out_runtime.py fix(proxy): gate disable_global_guardrails on keys and teams to proxy admins (#42699) 2026-09-23 18:03:02 -07:00
test_model_access_allow_lists.py test: replace 61 live logging and otel tests with offline unit and integration coverage (#45362) 2026-10-08 15:55:57 -07:00
test_object_permission_lookup.py feat(proxy): add opt-in vector_store_deny_by_default for least-privilege vector store access (#44244) 2026-10-06 12:50:25 -07:00
test_passthrough_route_denylist.py feat(proxy): add denied_passthrough_routes deny list for custom pass-through endpoints (#44924) 2026-10-07 16:19:53 -07:00
test_rag_query_vector_store_allowlist.py feat(proxy): add opt-in vector_store_deny_by_default for least-privilege vector store access (#44244) 2026-10-06 12:50:25 -07:00
test_search_tool_deny_by_default.py feat(auth): deny search tools by default when search_tool_deny_by_default is set (#44490) 2026-10-06 12:50:26 -07:00
test_team_admin_gate.py feat(teams): let proxy admins grant team admins the right to raise their team budget (#45404) 2026-10-09 13:39:08 -07:00
test_team_member_permissions.py test(integration): move legacy proxy, router and Redis tests into tests/integration (#44128) 2026-10-01 23:00:54 -07:00
test_team_scoped_models.py test(integration): scope the team-scoped models upstream check to its own model (#45106) 2026-10-07 11:09:56 -07:00
test_warmed_policy.py test(integration): pin the team-admin status-code matrix across every management route (#43249) 2026-09-26 11:32:24 -07:00
test_websocket_rejection_logging.py test(proxy): audit the websocket rejection log on every live route (#45293) 2026-10-08 12:04:23 -07:00
test_wildcard_model_access.py test(integration): move legacy proxy, router and Redis tests into tests/integration (#44128) 2026-10-01 23:00:54 -07:00