litellm/tests/test_litellm/proxy/auth
fedaeho 85dc7cb62e
fix(proxy): resolve model_group_alias in the zero-cost budget predicate (#43512)
`_is_model_cost_zero()` reads a group's cost through `Router.get_model_group_info()`,
which resolves `model_group_alias`, and then gates that on `_is_cost_explicitly_configured()`,
which scanned `Router.model_list` for an exact `model_name` match. Alias names live only in
`Router.model_group_alias` and are never `model_name` entries, so the scan found nothing and
returned False. That False means "the zero cost was defaulted, not configured" (the sparse
auto-registration gate added for #24770), so a model priced explicitly at 0 had budget
enforced against it when requested through an alias, while the same deployment under its own
name was exempt. Both names route to the same deployment and add nothing to spend.

The two lookups in one function disagreeing is the bug, so they now share one resolution:
`_is_cost_explicitly_configured()` resolves through `Router.get_model_list()`, the same
alias-aware path `get_model_group_info()` takes. That also reaches a deployment which prices
itself through its `model_info` block, whose cost-map entry lands under the deployment id.
`_group_declares_explicit_cost()` was an alias-aware copy of this function, wired only into
`model_has_no_cost_mapping()` and never into the budget path; its body is what
`_is_cost_explicitly_configured()` now carries, and both callers share it so the two cannot
drift apart again.

`_has_ptu_flat_cost()` scanned `model_list` the same way and runs after the gate above, so
resolving one without the other would let an aliased PTU group — explicit zero per-token
price alongside a flat capacity cost — pass as free. It resolves the same way now.

Tests cover the predicate and the request path it feeds: over-budget requests through
`_should_skip_budget_checks()` into `common_checks()` for an aliased free model (allowed) and
an aliased paid model (refused), the predicate for free, paid, PTU, hidden and dangling
aliases, and `model_has_no_cost_mapping()` through an alias so the other caller of the shared
check stays covered.

Unchanged: priced groups (the predicate returns False before the gate), unmapped groups whose
zero cost was defaulted (#24770), hidden aliases and aliases pointing at a nonexistent group
(`get_model_group_info()` returns None for both, so the cost is unknown and budget is
enforced), and non-aliased PTU groups.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-28 21:46:33 -07:00
..
test_admin_viewer_handler_access.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_auth_checks.py fix(proxy): resolve model_group_alias in the zero-cost budget predicate (#43512) 2026-09-28 21:46:33 -07:00
test_auth_exception_handler.py fix(proxy): log key owner identity on expired key auth failures (#43105) 2026-09-28 08:18:48 -07:00
test_auth_hot_path_network_requests.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_auth_object_prefetch.py fix(auth): keep prefetched org entries on the 5s getter TTL 2026-09-14 18:13:49 +00:00
test_auth_utils.py fix(bedrock/claude_platform): strip body params the AWS endpoint rejects (#31203) 2026-09-22 09:57:05 -07:00
test_banned_params_extra_body.py fix(proxy): ban caller-supplied aws identity selectors in request bodies 2026-08-10 22:05:49 -07:00
test_cli_auth.py test: assert the poll call shape after the timeout refactor 2026-08-25 11:00:29 -07:00
test_custom_auth_end_user_budget.py fix(proxy): keep custom-auth end-user caps under a key default budget 2026-09-17 20:31:26 +00:00
test_fallback_budget.py fix(proxy)!: enforce fallback budget by default 2026-09-16 14:15:27 -07:00
test_fallback_model_access.py feat(proxy): gate fallback model access enforcement behind enforce_fallback_model_access 2026-08-27 15:45:10 -07:00
test_handle_jwt.py fix(jwt): let x-litellm-team-id select DB membership teams when the token also carries a team claim (#43206) 2026-09-25 15:28:14 -07:00
test_info_routes.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_litellm_license.py fix(license): let a wildcard allowed_features license grant the auto_router feature 2026-09-17 15:08:09 -07:00
test_login_utils.py fix(proxy): revoke UI session tokens on logout and password change (#42463) 2026-09-23 10:31:38 +02:00
test_master_key_boot_check.py refactor(proxy): rename the local development override to dangerously_permit_weak_or_unset_master_key so the name says exactly what it permits 2026-09-19 18:53:14 -07:00
test_mcp_ip_filtering.py fix(proxy): mark session/SSO/SAML cookies Secure behind a TLS-terminating reverse proxy (#39391) 2026-09-02 16:42:29 -07:00
test_model_access_group_budgets.py fix(auth): put TQ008 suppressions on the patch call lines 2026-09-14 18:13:49 +00:00
test_model_checks.py fix(proxy): detach stored credential when model editor selects None (LIT-7597) 2026-09-21 19:22:57 +00:00
test_model_checks_fallbacks.py perf: build log messages lazily so filtered-out log records cost nothing (#35703) 2026-08-04 04:34:52 +00:00
test_multi_budget_windows.py fix(proxy): return 422 instead of 429 for BudgetExceededError 2026-09-20 06:00:06 +00:00
test_network.py fix(proxy): keep mapped-notation trusted proxy ranges matching mapped peers 2026-09-17 06:41:23 +00:00
test_oauth2_proxy_hook.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_object_permission_loading.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_onboarding.py fix(proxy): revoke UI session tokens on logout and password change (#42463) 2026-09-23 10:31:38 +02:00
test_organization_budget_enforcement.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_password_hashing.py chore: fixes 2026-03-30 18:36:58 -07:00
test_password_policy.py feat(auth): breached password detection, self-service change-password and forced password reset 2026-09-21 18:48:35 +00:00
test_resolvers_exceptions.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_grants.py test(auth): model the membership row read in the fakes the loader now reaches 2026-09-19 16:32:22 -07:00
test_resolvers_models.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_seam.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_store.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_route_checks.py revert: "feat(usage): search team keys beyond the top-N in the Team usage view (#42857)" (#43377) 2026-09-28 21:47:46 +00:00
test_router_override_fallback_auth.py chore(proxy): clean up request parameter validation and provider destination handling (#34189) 2026-07-22 00:57:58 +00:00
test_team_grants.py feat(team): team-level model_max_budget with key-level overrides 2026-09-16 00:40:58 +00:00
test_team_member_budget.py Fix team member budget enforcement without user row (#27273) 2026-05-06 11:42:29 -07:00
test_unmapped_model_budget_enforcement.py fix(proxy): resolve model_group_alias in the zero-cost budget predicate (#43512) 2026-09-28 21:46:33 -07:00
test_user_api_key_auth.py feat(proxy): email alerts at configured percentages of a team member budget (#42665) 2026-09-26 02:42:45 +00:00