litellm/tests/unit/proxy/utils/proxy_logging
yucheng-berri 788868a52f
fix(security)!: build proxy-only failure logs from an allowlist and drop caller guardrail info (#48599)
* fix(proxy): build proxy-only failure logs from an allowlist and ignore request-time GCS credentials

* fix(proxy): drop caller metadata from proxy-only failure logs

metadata and litellm_metadata leave the proxy-only failure-log allowlist, so a rejected request can no longer point its failure log at its own Langsmith or Langfuse host through nested metadata.

* fix(proxy): keep allowlisted metadata in proxy-only failure logs

* test(proxy): isolate proxy-only failure log metadata tests

* fix(logging): ignore non-list request tags when building the logging payload

A guardrail-rejected request with metadata tags set to a non-list value crashed
the standard logging payload, so its spend row lost model attribution.

* fix(proxy): keep router attribution and drop unauthenticated tags in proxy-only failure logs

A request rejected before routing now logs the configured deployment and model group even when its metadata or litellm_metadata carries its own values. Requests rejected at auth no longer write caller tags into failure logs and tag spend.

* fix(proxy): always strip client guardrail info and mirror failure attribution into litellm_metadata

allow_client_pricing_override no longer keeps a caller-supplied standard_logging_guardrail_information on the chat or pass-through paths, since its guardrail_cost is billed. Proxy-only failure logs now also carry key and team attribution in litellm_metadata.

* refactor(proxy): keep the proxy-only failure-log fixes inside the type gates

Types the picked helpers so basedpyright and the type-discipline gate stay at main's counts. No runtime change.

* fix(proxy): keep the WS frame guardrail-info strip and string interaction tags as sent

The guardrail-info key left the pricing strip list, so the Responses WS frame guard now drops it by name. get_request_tags no longer raises on string tags, so background interaction polling checks for them before keeping them as sent.

---------

Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
2026-10-27 12:40:59 -07:00
..
__init__.py test(proxy): move utils, agent_endpoints and endpoint tests into tests/unit/proxy (#44006) 2026-10-01 11:06:42 -07:00
_harness_smoke_test.py test(proxy): move utils, agent_endpoints and endpoint tests into tests/unit/proxy (#44006) 2026-10-01 11:06:42 -07:00
conftest.py test(proxy): delete the legacy proxy test tree and shard tests/unit/proxy by glob (#44018) 2026-10-01 11:40:45 -07:00
test_alerting.py fix(proxy): cooldown errors carry 429, Sentry starts at boot without request bodies, tracing failures log at ERROR, exporter counters exported (#46344) 2026-10-16 00:53:52 +00:00
test_callback_capabilities_class.py test(proxy): move utils, agent_endpoints and endpoint tests into tests/unit/proxy (#44006) 2026-10-01 11:06:42 -07:00
test_callback_capabilities_dataclass.py test(proxy): move utils, agent_endpoints and endpoint tests into tests/unit/proxy (#44006) 2026-10-01 11:06:42 -07:00
test_during_call_hook.py test(proxy): move utils, agent_endpoints and endpoint tests into tests/unit/proxy (#44006) 2026-10-01 11:06:42 -07:00
test_guardrail_pipeline.py feat(policy-engine): stream detect-only post_call pipeline steps live when buffering is off (#45516) 2026-10-09 15:46:51 -07:00
test_internal_usage_cache.py test(proxy): move utils, agent_endpoints and endpoint tests into tests/unit/proxy (#44006) 2026-10-01 11:06:42 -07:00
test_lifecycle.py fix(proxy): build configured logging callbacks at boot so a broken callback fails startup instead of the first request (#46378) 2026-10-14 16:51:55 +00:00
test_mcp_bridging.py feat(mcp): hand listed-tool description and input schema to pre-call hooks per caller (#41162) 2026-10-04 00:53:58 -07:00
test_module_helpers.py test(proxy): move utils, agent_endpoints and endpoint tests into tests/unit/proxy (#44006) 2026-10-01 11:06:42 -07:00
test_post_call_failure_hook.py fix(security)!: build proxy-only failure logs from an allowlist and drop caller guardrail info (#48599) 2026-10-27 12:40:59 -07:00
test_post_call_success_hook.py test(proxy): move utils, agent_endpoints and endpoint tests into tests/unit/proxy (#44006) 2026-10-01 11:06:42 -07:00
test_pre_call_hook.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_streaming_hooks.py refactor(anthropic): rename llms/anthropic/pass_through to llms/anthropic/messages (#48510) 2026-10-27 10:08:25 -07:00