litellm/tests/test_litellm/proxy/auth
devin-ai-integration[bot] d08746feb1
feat(proxy): email alerts at configured percentages of a team member budget (#42665)
* feat(proxy): email alerts at configured percentages of a team member budget

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(alerting): label team member budget crossings as team member budget

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* test(auth): cover the team member alert dispatch from _check_team_member_budget

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(email): drop the emoji from the team member budget alert template

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(proxy): ignore team member alert thresholds outside 1 to 100 on both the backend and the dashboard

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(proxy): bound team member alert threshold key length before int parsing

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* test(integration): drop the legacy covers marker from the team member alert test

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(team): reject malformed team_member_max_budget_alert_emails on team writes

Thresholds outside 1-100, non-list recipients, and invalid emails now return 422 on
/team/new, /team/update and PATCH /team/{id} instead of being stored and silently
ignored. The value is stored canonically. Read-side LiteLLM_TeamTable is unchanged,
and the PATCH body stays a raw merge patch so a null threshold still deletes it.

* fix(auth): enforce and alert on team member budgets only in common_checks

The builder re-checked the team member budget inline before common_checks ran the same
check, so one request that crossed a team_member_max_budget_alert_emails threshold
dispatched two alerts. Drop the inline check; common_checks is the single authorization
point and already covers per-member rows, the team default member budget, zero-cost
skips and the cross-pod spend counter. Its 422 message now uses the TeamMember=user:team
form the builder and budget reservation already returned.

* Revert "fix(team): reject malformed team_member_max_budget_alert_emails on team writes"

This reverts commit 703e754b46.

* fix(alerting): keep BaseBudgetAlertType.get_event_message zero-arg

Requiring user_info broke existing callers and out-of-tree subclasses. The team member
label now comes from SlackAlerting.budget_alerts, so the interface and its Readme are
unchanged from main.

* fix(mcp): keep team member budget enforcement on the MCP OAuth auth dependency

The MCP OAuth dependency stops at _user_api_key_auth_builder and never reaches common_checks, so removing the builder's inline member budget check would have let over-budget members through there. Enforce it explicitly for that caller.

* fix(auth): keep main's team member budget enforcement, alert once per request

Restore the builder's team member budget check and 422 message exactly as on main and drop the MCP-only gate. The builder sends the member alert only on the request it rejects; common_checks sends it for requests that get past the builder, so no request alerts twice.

* test(integration): read team member alert deliveries without a shared accumulator

* test(integration): match team member alert deliveries by subject so other alerts cannot race the count

* refactor(proxy): build the team member alert threshold config without mutable collections

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* refactor(proxy): collapse the alert recipient isinstance checks into one call

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* test(integration): read the SMTP sink through lock-guarded snapshots and assert the exact deliveries

---------

Co-authored-by: ryan <ryan@berri.ai>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-26 02:42:45 +00:00
..
test_admin_viewer_handler_access.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_auth_checks.py feat(proxy): email alerts at configured percentages of a team member budget (#42665) 2026-09-26 02:42:45 +00:00
test_auth_exception_handler.py fix(proxy): return 422 instead of 429 for BudgetExceededError 2026-09-20 06:00:06 +00:00
test_auth_hot_path_network_requests.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_auth_object_prefetch.py fix(auth): keep prefetched org entries on the 5s getter TTL 2026-09-14 18:13:49 +00:00
test_auth_utils.py fix(bedrock/claude_platform): strip body params the AWS endpoint rejects (#31203) 2026-09-22 09:57:05 -07:00
test_banned_params_extra_body.py fix(proxy): ban caller-supplied aws identity selectors in request bodies 2026-08-10 22:05:49 -07:00
test_cli_auth.py test: assert the poll call shape after the timeout refactor 2026-08-25 11:00:29 -07:00
test_custom_auth_end_user_budget.py fix(proxy): keep custom-auth end-user caps under a key default budget 2026-09-17 20:31:26 +00:00
test_fallback_budget.py fix(proxy)!: enforce fallback budget by default 2026-09-16 14:15:27 -07:00
test_fallback_model_access.py feat(proxy): gate fallback model access enforcement behind enforce_fallback_model_access 2026-08-27 15:45:10 -07:00
test_handle_jwt.py fix(jwt): let x-litellm-team-id select DB membership teams when the token also carries a team claim (#43206) 2026-09-25 15:28:14 -07:00
test_info_routes.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_litellm_license.py fix(license): let a wildcard allowed_features license grant the auto_router feature 2026-09-17 15:08:09 -07:00
test_login_utils.py fix(proxy): revoke UI session tokens on logout and password change (#42463) 2026-09-23 10:31:38 +02:00
test_master_key_boot_check.py refactor(proxy): rename the local development override to dangerously_permit_weak_or_unset_master_key so the name says exactly what it permits 2026-09-19 18:53:14 -07:00
test_mcp_ip_filtering.py fix(proxy): mark session/SSO/SAML cookies Secure behind a TLS-terminating reverse proxy (#39391) 2026-09-02 16:42:29 -07:00
test_model_access_group_budgets.py fix(auth): put TQ008 suppressions on the patch call lines 2026-09-14 18:13:49 +00:00
test_model_checks.py fix(proxy): detach stored credential when model editor selects None (LIT-7597) 2026-09-21 19:22:57 +00:00
test_model_checks_fallbacks.py perf: build log messages lazily so filtered-out log records cost nothing (#35703) 2026-08-04 04:34:52 +00:00
test_multi_budget_windows.py fix(proxy): return 422 instead of 429 for BudgetExceededError 2026-09-20 06:00:06 +00:00
test_network.py fix(proxy): keep mapped-notation trusted proxy ranges matching mapped peers 2026-09-17 06:41:23 +00:00
test_oauth2_proxy_hook.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_object_permission_loading.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_onboarding.py fix(proxy): revoke UI session tokens on logout and password change (#42463) 2026-09-23 10:31:38 +02:00
test_organization_budget_enforcement.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_password_hashing.py chore: fixes 2026-03-30 18:36:58 -07:00
test_password_policy.py feat(auth): breached password detection, self-service change-password and forced password reset 2026-09-21 18:48:35 +00:00
test_resolvers_exceptions.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_grants.py test(auth): model the membership row read in the fakes the loader now reaches 2026-09-19 16:32:22 -07:00
test_resolvers_models.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_seam.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_store.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_route_checks.py feat(agents): add optional per-agent kill switch webhook (#42841) 2026-09-24 18:26:50 -05:00
test_router_override_fallback_auth.py chore(proxy): clean up request parameter validation and provider destination handling (#34189) 2026-07-22 00:57:58 +00:00
test_team_grants.py feat(team): team-level model_max_budget with key-level overrides 2026-09-16 00:40:58 +00:00
test_team_member_budget.py Fix team member budget enforcement without user row (#27273) 2026-05-06 11:42:29 -07:00
test_unmapped_model_budget_enforcement.py fix(router): never price a strategy-router alias (#36691) 2026-08-12 14:26:30 -07:00
test_user_api_key_auth.py feat(proxy): email alerts at configured percentages of a team member budget (#42665) 2026-09-26 02:42:45 +00:00