zoveki 87fec5467f fix(sso): keep CLI SSO and Claude Code gateway team lists in the user record's order (#49033) ... * fix(sso): bind CLI SSO and Claude Code gateway logins to the first team on the user record * fix(proxy): keep SCIM and JWT team sync in record order, and look up SSO groups once SCIM PATCH and JWT team sync saved a user's teams from a set, so the first team on the record, the one a Claude Code gateway sign-in binds, could change on any sync. Both now keep the record's order and append new teams in the order the IdP sent them. SSO group sync now drops claim groups that are not LiteLLM teams with one lookup before adding the missing teams one at a time, so a claim full of non-team groups no longer costs one failed add per group on every sign-in. * test(sso): expect the gateway team dropdown in the user record's order * fix(sso): read team existence from the writer, keep new-user and SCIM replace team order * fix(scim): keep the teams a user already has in record order on PATCH and PUT * fix(scim): keep record team order when a SCIM POST matches an existing email * fix(scim): join new teams in request order so a failed roster write keeps it * fix(scim): let a groups replace win over later group ops in a PATCH again Applying group adds and removes after a replace made a PATCH that deactivates a user and adds a team that does not exist answer 404 and leave the user active, where it answered 200 before. Keep the record's team order, but ignore group ops after the last replace as the base did. * test(sso): type the CLI team detail row helper --------- Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com> Co-authored-by: rj-cairn <349020452+rj-cairn@users.noreply.github.com>		2026-10-30 05:07:00 -07:00
..
__init__.py	test: migrate tests/proxy_behavior into integration and unit tiers (#45939)	2026-10-11 08:28:42 -07:00
_guardrail_opt_out.py	test(integration): stop GET /__observations from draining the upstream log (#47256)	2026-10-18 09:58:05 +00:00
_hidden_alias_budget.py	test(integration): stop GET /__observations from draining the upstream log (#47256)	2026-10-18 09:58:05 +00:00
_responses_compact.py	fix(proxy): check previous_response_id ownership on /v1/responses/compact (#46408)	2026-10-14 17:57:34 +00:00
test_access_group_budget.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_access_group_model_listing.py	test(integration): stop GET /__observations from draining the upstream log (#47256)	2026-10-18 09:58:05 +00:00
test_agent_access.py	test(integration): cover agents_a2a endpoint contracts (#44650)	2026-10-14 03:40:07 +00:00
test_agent_least_privilege.py	fix(proxy): store boolean settings as JSON booleans on /config/field/update (#48595)	2026-10-28 17:39:01 +00:00
test_alias_chain_budget_waiver.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_audio_model_access.py	test(integration): cover audio endpoint contracts (#44699)	2026-10-14 03:41:20 +00:00
test_audit_any_sweep_auth.py	test(integration): look up owned cache keys and clean up sweep models (#47255)	2026-10-18 10:27:53 +00:00
test_auth_object_prefetch.py	test: migrate tests/proxy_behavior into integration and unit tiers (#45939)	2026-10-11 08:28:42 -07:00
test_bedrock_passthrough_model_access.py	test(integration): regression tests for July cost tracking, budgeting and spend bugs (#42694)	2026-09-23 09:51:56 -07:00
test_claude_code_gateway_oauth.py	fix(sso): keep CLI SSO and Claude Code gateway team lists in the user record's order (#49033)	2026-10-30 05:07:00 -07:00
test_cli_sso_login_ui_disabled.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_customer_model_allowlist.py	feat(proxy): limit which models an end user can call (#43904)	2026-10-05 21:58:03 +00:00
test_deprecated_key_lookup_cache.py	test(proxy): migrate DB and Redis backed proxy tests into tests/integration (#43996)	2026-10-01 09:23:36 -07:00
test_end_user_block.py	test(integration): stop GET /__observations from draining the upstream log (#47256)	2026-10-18 09:58:05 +00:00
test_guardrail_submissions.py	fix(proxy)!: stop answering with the literal string "None" as error type and param on the proxy-server, auth, spend, and key health routes (#39540)	2026-10-29 18:20:52 -07:00
test_hidden_alias_budget_bypass.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_hidden_alias_budget_bypass_chaos.py	test(integration): stop GET /__observations from draining the upstream log (#47256)	2026-10-18 09:58:05 +00:00
test_jwt_auto_register_map_existing_key.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_jwt_default_team_provisioning.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_jwt_key_mapping_lifecycle.py	fix(proxy)!: stop answering with the literal string "None" as error type and param on the proxy-server, auth, spend, and key health routes (#39540)	2026-10-29 18:20:52 -07:00
test_jwt_mapped_key_email_backfill.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_key_alias_model_access.py	fix(proxy): authorize key model aliases the same way as team aliases (#43049)	2026-09-24 19:51:02 -07:00
test_key_bound_to_unknown_user.py	test(integration): move legacy proxy, router and Redis tests into tests/integration (#44128)	2026-10-01 23:00:54 -07:00
test_key_budget_owner_updates.py	fix(proxy)!: gate key budget_duration and budget_id updates like max_budget (#47681)	2026-10-26 16:45:35 -07:00
test_key_guardrail_opt_out.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_key_guardrail_opt_out_chaos.py	test(integration): stop GET /__observations from draining the upstream log (#47256)	2026-10-18 09:58:05 +00:00
test_key_guardrail_opt_out_runtime.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_lakera_v2_on_flagged.py	fix(guardrails)!: make lakera_v2 on_flagged block reject PII-only detections, add mask (#48944)	2026-10-29 11:48:37 -07:00
test_memory_ownership.py	fix(proxy)!: stop answering with the literal string "None" as error type and param on the proxy-server, auth, spend, and key health routes (#39540)	2026-10-29 18:20:52 -07:00
test_model_access_allow_lists.py	test: replace 61 live logging and otel tests with offline unit and integration coverage (#45362)	2026-10-08 15:55:57 -07:00
test_object_permission_lookup.py	feat(proxy): add opt-in vector_store_deny_by_default for least-privilege vector store access (#44244)	2026-10-06 12:50:25 -07:00
test_passthrough_route_denylist.py	feat(proxy): add denied_passthrough_routes deny list for custom pass-through endpoints (#44924)	2026-10-07 16:19:53 -07:00
test_rag_query_vector_store_allowlist.py	test(integration): stop GET /__observations from draining the upstream log (#47256)	2026-10-18 09:58:05 +00:00
test_rag_team_provider_credentials.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_realtime_client_secret_access.py	test(integration): cover realtime endpoint contracts (#44689)	2026-10-14 03:49:34 +00:00
test_responses_compact_id_ownership.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_responses_compact_id_ownership_chaos.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_responses_id_ownership.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_search_tool_allowlist.py	test(integration): expect the Exa search envelope's provider_metadata after #47423 (#47572)	2026-10-20 15:29:30 +00:00
test_search_tool_deny_by_default.py	feat(auth): deny search tools by default when search_tool_deny_by_default is set (#44490)	2026-10-06 12:50:26 -07:00
test_sso_blank_identity.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_team_admin_gate.py	fix(proxy)!: stop answering with the literal string "None" as error type and param on the proxy-server, auth, spend, and key health routes (#39540)	2026-10-29 18:20:52 -07:00
test_team_member_permissions.py	test(integration): stop GET /__observations from draining the upstream log (#47256)	2026-10-18 09:58:05 +00:00
test_team_scoped_models.py	test(integration): stop GET /__observations from draining the upstream log (#47256)	2026-10-18 09:58:05 +00:00
test_tool_search_replay_allowlist.py	fix(responses bridge): round-trip tool_search_call and tool_search_output items between turns (#46444)	2026-10-14 21:40:14 -07:00
test_tool_search_replay_guardrails.py	test(integration): give each owned proxy a private database and Redis by default (#47213)	2026-10-18 03:37:41 +00:00
test_unknown_key_generic_401.py	fix(proxy)!: stop answering with the literal string "None" as error type and param on the proxy-server, auth, spend, and key health routes (#39540)	2026-10-29 18:20:52 -07:00
test_user_self_update_guard.py	fix(proxy)!: stop answering with the literal string "None" as error type and param on the proxy-server, auth, spend, and key health routes (#39540)	2026-10-29 18:20:52 -07:00
test_warmed_policy.py	fix(proxy)!: stop answering with the literal string "None" as error type and param on the proxy-server, auth, spend, and key health routes (#39540)	2026-10-29 18:20:52 -07:00
test_websocket_rejection_logging.py	test(integration): give chaos and timing tests a harness API and gate raw signals (#46031)	2026-10-12 05:27:33 -07:00
test_wildcard_model_access.py	test(integration): stop GET /__observations from draining the upstream log (#47256)	2026-10-18 09:58:05 +00:00
test_workflow_ownership.py	fix(proxy)!: stop answering with the literal string "None" as error type and param on the proxy-server, auth, spend, and key health routes (#39540)	2026-10-29 18:20:52 -07:00