Tin Chi Lo ea9865c0ac fix(ui): stamp a bounded exp on the UI session cookie at a single mint choke point ... The dashboard `token` cookie is an HS256 JWT signed with the proxy master key, minted from six places, and none of them stamped an `exp`, so the cookie never expired and a leaked one stayed valid until the master key rotated. The same gap broke callers that do the right thing: `_user_id_from_session_cookie` requires an `exp` claim, so it rejected every genuine login cookie and the MCP SSO interpose was an unconditional redirect-to-login loop. Routes all six mints through `encode_ui_session_jwt`, which stamps `exp = LITELLM_UI_SESSION_DURATION` (default 24h), the same window that already bounds the virtual key carried inside the payload. The helper lives in its own module because `login_utils` already imports from `ui_sso`, so a shared helper in either would close an import cycle for the other.		2026-07-22 18:30:19 -07:00
..
test_admin_viewer_handler_access.py	fix(rbac): restore admin-viewer read parity for Logs page + settings reads	2026-04-29 19:21:41 -07:00
test_auth_checks.py	fix(auth): set budget_reset_at when JWT upsert seeds a budget_duration (#34050)	2026-07-20 17:23:44 -07:00
test_auth_exception_handler.py	fix(proxy): return 5xx on DB infra errors during auth; reserve 401 for genuine auth failures (#29986)	2026-06-10 23:48:11 +00:00
test_auth_hot_path_network_requests.py	perf(auth): negative-cache missing user/key lookups on the request hot path (#32368)	2026-07-08 09:59:57 +03:00
test_auth_utils.py	chore(proxy): clean up request parameter validation and provider destination handling (#34189)	2026-07-22 00:57:58 +00:00
test_banned_params_extra_body.py	chore(tests): drop redundant membership check; trim test comment	2026-05-14 03:39:15 +00:00
test_cli_auth.py	fix(cli): surface actionable CLI SSO errors when CLI and proxy versions skew (#33309)	2026-07-15 10:17:40 -07:00
test_custom_auth_end_user_budget.py	feat(auth): resolve caller identity once into a Principal at the auth seam (#30887)	2026-06-20 18:49:41 -07:00
test_handle_jwt.py	fix(proxy): populate user_email on UserAPIKeyAuth for JWT auth (#34174)	2026-07-21 16:11:47 -07:00
test_info_routes.py	style: run black formatter on files from main merge	2026-04-17 13:02:59 -07:00
test_litellm_license.py	style: run black formatter on files from main merge	2026-04-17 13:02:59 -07:00
test_login_utils.py	style: run black formatter on files from main merge	2026-04-17 13:02:59 -07:00
test_mcp_ip_filtering.py	feat(mcp): add mcp_xff_num_trusted_hops to harden X-Forwarded-For client IP resolution (#31257)	2026-06-25 07:31:29 -07:00
test_model_checks.py	revert: undo teamless all-team-models denial from #32022 and #29746 (#32032)	2026-07-03 18:56:07 -07:00
test_model_checks_fallbacks.py	style: run black formatter on files from main merge	2026-04-17 13:02:59 -07:00
test_multi_budget_windows.py	fix(proxy): enforce budgets against authoritative DB spend when the cross-pod counter is unreliable (#30684)	2026-06-18 10:35:41 -07:00
test_network.py	feat(auth): resolve caller identity once into a Principal at the auth seam (#30887)	2026-06-20 18:49:41 -07:00
test_oauth2_proxy_hook.py	chore(auth): require trusted proxy for header identity auth	2026-04-29 21:20:21 -07:00
test_object_permission_loading.py	style: run black formatter on files from main merge	2026-04-17 13:02:59 -07:00
test_onboarding.py	feat(auth): resolve caller identity once into a Principal at the auth seam (#30887)	2026-06-20 18:49:41 -07:00
test_organization_budget_enforcement.py	style: run black formatter on files from main merge	2026-04-17 13:02:59 -07:00
test_password_hashing.py	chore: fixes	2026-03-30 18:36:58 -07:00
test_resolvers_exceptions.py	feat(auth): resolve caller identity once into a Principal at the auth seam (#30887)	2026-06-20 18:49:41 -07:00
test_resolvers_models.py	feat(auth): resolve caller identity once into a Principal at the auth seam (#30887)	2026-06-20 18:49:41 -07:00
test_resolvers_seam.py	feat(auth): resolve caller identity once into a Principal at the auth seam (#30887)	2026-06-20 18:49:41 -07:00
test_resolvers_store.py	feat(auth): resolve caller identity once into a Principal at the auth seam (#30887)	2026-06-20 18:49:41 -07:00
test_route_checks.py	refactor(auth): resolve PATCH team org-context from the route template	2026-07-11 11:24:41 -07:00
test_router_override_fallback_auth.py	chore(proxy): clean up request parameter validation and provider destination handling (#34189)	2026-07-22 00:57:58 +00:00
test_team_member_budget.py	Fix team member budget enforcement without user row (#27273)	2026-05-06 11:42:29 -07:00
test_ui_session_jwt.py	fix(ui): stamp a bounded exp on the UI session cookie at a single mint choke point	2026-07-22 18:30:19 -07:00
test_unmapped_model_budget_enforcement.py	perf: eliminate per-request callback scanning on proxy hot path (#27858)	2026-05-14 09:28:31 -07:00
test_user_api_key_auth.py	fix(proxy): populate user_email on UserAPIKeyAuth for JWT auth (#34174)	2026-07-21 16:11:47 -07:00