litellm/tests/unit/proxy/management_endpoints
Mateo Wang dfac770e2b
feat(proxy): map baggage values to budget tags (#47358)
* feat(proxy): map baggage values to budget tags

* fix(proxy): preserve mapped tags in the parsed request cache

* fix(proxy): preserve mapper accounting and tag policy

* fix(proxy): preserve baggage tags across native transports

* fix(proxy): keep mapper rejection and passthrough logging safe

* fix(proxy): scope baggage tag mappings to billed inference and keep them out of tag routing

Mapped tags now apply only to billed LLM API routes, skipping token counting,
model listing, MCP and A2A. They classify spend and budgets but never select
deployments unless a key, team or client set the same tag. WebSocket inference
returns 403 only while a required rule exists. A tag created with /tag/new resets
its spend counter so its budget counts from creation. The General settings editor
keeps a new mapping unsaved until every required field is filled in.

* fix(proxy): keep client-tag rejection identical with baggage, map A2A calls, skip request previews

* fix(proxy): keep mapped tags out of requester metadata, answer 503 on tag lookup errors, map custom pass-through routes, check the key before the WebSocket 403

* fix(proxy): keep caller-sent tags routable, keep mapped tags out of policy and guardrail matching, honor allow_requests_on_db_unavailable, reject control characters in baggage values

* test(proxy): cover baggage tag mappings end to end

Adds integration cells for request_tag_mappings across chat, messages,
responses, A2A and custom pass-through spend, required and budgeted
rules, the WebSocket refusal, unbilled routes, reject_clientside_metadata_tags,
tag routing and policy isolation, a dropped tag read with and without
allow_requests_on_db_unavailable, and the /tag/new spend counter reset

* fix(proxy): keep base tag merges for requests that map nothing, accept JSON-string metadata tags, count litellm_metadata caller tags

Requests with no mapped baggage now reuse the cached body exactly as before, so header and key tag merges still normalize metadata for routing. The client body copy is made only when a tag maps, and the base merges are mirrored onto it. A request that maps nothing no longer gets a 400 for non-object metadata. caller_tags now counts tags sent in both metadata and litellm_metadata. Optional mappings no longer reject JSON-string metadata tags under reject_clientside_metadata_tags.

* fix(router): keep baggage-mapped tags from selecting tag-scoped pre-routing strategies

Auto, complexity, adaptive and quality router selection, the consumed-tags stamp and compression policy lookup now read request tags without baggage-mapped tags, unless the caller sent the tag or the key, team or project carries it, matching deployment tag filtering.

* feat(proxy): parse baggage headers into request tag mappings

* fix(proxy): match plus-sign baggage keys and keep deployment tags in guardrail modes

* fix(proxy): keep baggage-mapped tags behind key, team and deployment tags and serve non-object or invalid DB mapping settings like unset

Mapped tags are added after the key, team, deployment and caller tags, so a tag-mode guardrail picks the same mode with or without baggage. A non-object metadata field maps like empty metadata, and an invalid request_tag_mappings value loaded from the DB is ignored with an ERROR log instead of failing every request

* fix(router): merge deployment tags in linear time and keep malformed client tags as sent under mapped baggage

Merge serving deployment tags into the request tags in one pass, so a large client tag list no longer blocks the event loop. Leave a non-list metadata.tags untouched when baggage maps a tag, so the request gets the same answer as without baggage. Add the C17 integration cell for the team tag's guardrail mode under a mapped deployment tag.

* test(spend): cover string metadata.tags under mapped baggage

* fix(proxy): check mapped tag budgets when metadata.tags is a non-list or holds non-strings

Mapped baggage tags are applied again after the header and key tag merges, so
a header or key tag that replaces a string metadata.tags no longer hides the
mapped tag from the tag budget check. An empty or false metadata.tags is read
like a missing one, and a tags list with non-string items is kept as sent with
the mapped tags added after it, instead of failing auth with a 401
2026-10-20 09:09:42 +00:00
..
management_v1 feat(proxy): per-model team member budgets with router fallback (#43887) 2026-10-10 20:33:55 +00:00
policy_endpoints
scim fix(scim)!: store PATCH enterprise extension attributes in metadata.scim_enterprise (#46738) 2026-10-19 15:58:29 -07:00
search_endpoints
sso fix(proxy): route SSO token exchange and userinfo calls through litellm's httpx client (#46547) 2026-10-15 15:14:25 -07:00
usage_endpoints fix(proxy)!: return provider-matching 4xx for the LIT-8062 status code follow-ups (#45537) 2026-10-13 11:42:39 -07:00
__init__.py
jwt_key_mapping_doubles.py
test_access_group_endpoints.py feat(access-groups): grant Claude Code skills through access groups (#46294) 2026-10-14 23:18:50 +00:00
test_access_group_management.py
test_activity_tenant_scoping.py
test_auto_router_endpoints.py refactor(types): move complexity router request models next to their base config (#45780) 2026-10-10 19:07:41 +00:00
test_budget_endpoints.py feat(proxy): per-model team member budgets with router fallback (#43887) 2026-10-10 20:33:55 +00:00
test_cache_settings_endpoints.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_callback_management_endpoints.py
test_common_daily_activity.py fix(proxy)!: return provider-matching 4xx for the LIT-8062 status code follow-ups (#45537) 2026-10-13 11:42:39 -07:00
test_common_utils.py feat(proxy): per-model team member budgets with router fallback (#43887) 2026-10-10 20:33:55 +00:00
test_compliance_endpoints.py
test_config_override_endpoints.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_coordination_redis_endpoints.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_cost_estimate_endpoint.py
test_cost_tracking_settings.py feat(cost): support provider/model-pattern keys in cost_discount_config (#43335) 2026-10-12 14:59:18 -07:00
test_credential_migration.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_customer_budget.py
test_customer_endpoints.py fix(proxy): allow model instances in LiteLLM_EndUserTable validation (#41677) 2026-10-15 10:57:26 -07:00
test_daily_activity_routes.py feat(proxy): split Azure PTU deployments across teams with per-team PTU ceilings and PTU-hour reporting (#43043) 2026-10-15 18:44:30 +00:00
test_delete_callbacks_endpoint.py
test_delete_verification_tokens_failed.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_encryption_endpoints.py test: migrate tests/proxy_behavior into integration and unit tiers (#45939) 2026-10-11 08:28:42 -07:00
test_entraid_app_roles.py
test_gateway_request_endpoints.py feat(proxy): track failed requests by HTTP status and caller (#45244) 2026-10-09 14:27:56 -07:00
test_id_jag_assertion_capture.py feat(sso): retain the SAML assertion at login as the saml2 subject token for oauth2_id_jag (#46745) 2026-10-16 12:16:56 -07:00
test_internal_user_endpoints.py fix(scim): write a group's roster in one locked transaction instead of one member at a time (#45197) 2026-10-15 10:57:00 -07:00
test_jwt_key_mapping.py
test_key_budget_change.py feat(proxy): opt-in self-serve budget edits for key owners on /key/update (#44763) 2026-10-19 11:40:38 -07:00
test_key_generate_prisma.py fix(auth): return a generic 401 for an unknown key (#39787) 2026-10-15 01:05:25 -07:00
test_key_management_endpoints.py feat(key_management)!: apply default_key_generate_params.allowed_routes on key generation (#41236) 2026-10-19 18:53:37 -07:00
test_management_route_coverage.py test: migrate tests/proxy_behavior into integration and unit tiers (#45939) 2026-10-11 08:28:42 -07:00
test_mcp_connector_import.py
test_mcp_management_endpoints.py fix(mcp)!: register the gateway's own DCR client for bridge servers instead of relaying the caller's loopback redirect (#46940) 2026-10-17 12:14:28 -07:00
test_mcp_servers.py test: migrate SDK and proxy-booting legacy CircleCI tests to their tiers (#45758) 2026-10-11 00:17:21 -07:00
test_model_insights_endpoints.py
test_model_management_endpoints.py fix(secret_managers)!: resolve oidc/file and oidc/env refs in admin-configured api_key per request (#47341) 2026-10-20 01:43:59 +00:00
test_org_admin_team_access.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_organization_endpoints.py feat(proxy): split Azure PTU deployments across teams with per-team PTU ceilings and PTU-hour reporting (#43043) 2026-10-15 18:44:30 +00:00
test_password_endpoints.py
test_policy_endpoints.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_project_org_authz.py
test_prompt_cache_prediction.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_prompt_caching_requests.py
test_ptu_consumption.py feat(proxy): split Azure PTU deployments across teams with per-team PTU ceilings and PTU-hour reporting (#43043) 2026-10-15 18:44:30 +00:00
test_ptu_model_settings.py feat(proxy): split Azure PTU deployments across teams with per-team PTU ceilings and PTU-hour reporting (#43043) 2026-10-15 18:44:30 +00:00
test_request_error_endpoints.py feat(proxy): track failed requests by HTTP status and caller (#45244) 2026-10-09 14:27:56 -07:00
test_roi_calculator_endpoints.py
test_router_settings_endpoints.py
test_saml_sso.py feat(sso): retain the SAML assertion at login as the saml2 subject token for oauth2_id_jag (#46745) 2026-10-16 12:16:56 -07:00
test_session_endpoints.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_sso_helper_utils.py
test_tag_management_endpoints.py feat(proxy): map baggage values to budget tags (#47358) 2026-10-20 09:09:42 +00:00
test_team_admin_field_permissions.py feat(proxy): let proxy admins open team metadata to team admins, keeping proxy settings with proxy admins (#46506) 2026-10-14 23:51:44 +00:00
test_team_callback_endpoints.py feat(otel): let a team or key excluded_services override the global setting for its OTel v2 destination (#45880) 2026-10-12 19:25:52 -04:00
test_team_default_params.py
test_team_endpoints.py fix(proxy): refresh cached team on /team/block and /team/unblock (#35643) 2026-10-19 22:50:33 +00:00
test_team_model_alias_merge.py refactor(proxy): expose public names for private proxy helpers (#45170) 2026-10-07 18:59:27 -07:00
test_tool_management_endpoints.py
test_ui_sso.py fix(sso): concurrent first sign-ins land on the winner's account, worker-kill test stops waiting on the reap (#46855) 2026-10-16 14:58:05 -07:00
test_workflow_management_endpoints.py