litellm/tests/test_litellm/proxy/auth
devin-ai-integration[bot] d963e9fa6e
fix(proxy): keep team member budget enforced at the cap and across Redis counter expiry (#40304)
* fix(proxy): keep team member budget enforced at the cap and across Redis counter expiry

The cached-key auth path admitted a request when the team member counter sat exactly at max_budget, and a Redis counter that expired during a long stream was reconciled against this pod's stale in-memory copy, driving the shared counter negative and reopening the budget. Reject at >= like every other budget check, read Redis before the per-pod copy when judging the reconcile delta, and add the settled request cost after a DB reseed since reserved keys skip the normal increment

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* test(proxy): reseeded reservation counter also carries the settled request cost

The reseed test asserted counter == DB floor. The floor is read before the async spend flush writes this request, so the counter now lands at floor plus settled cost, matching the after leg in the PR proof

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: yassin <yassin@berri.ai>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-08 15:06:20 -07:00
..
test_admin_viewer_handler_access.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_auth_checks.py fix(proxy): only a provably missing user row counts as unrestricted in the websocket passthrough gate 2026-09-04 19:35:08 -07:00
test_auth_exception_handler.py fix(proxy): word database 503s by whether the fault is transient (#39256) 2026-09-02 15:05:55 -07:00
test_auth_hot_path_network_requests.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_auth_utils.py fix(proxy): log budget reservation notice once at config load (#40167) 2026-09-07 18:18:28 -07:00
test_banned_params_extra_body.py fix(proxy): ban caller-supplied aws identity selectors in request bodies 2026-08-10 22:05:49 -07:00
test_cli_auth.py test: assert the poll call shape after the timeout refactor 2026-08-25 11:00:29 -07:00
test_custom_auth_end_user_budget.py fix(proxy): registry caches stop per-request tag and end-user Postgres reads in auth (#36801) 2026-08-17 18:52:13 +00:00
test_fallback_model_access.py feat(proxy): gate fallback model access enforcement behind enforce_fallback_model_access 2026-08-27 15:45:10 -07:00
test_handle_jwt.py test: require a match= on broad pytest.raises, and drop duplicate parametrize cases (#37769) 2026-08-20 20:24:49 -07:00
test_info_routes.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_litellm_license.py feat(router): meter auto-router tier and prompt customization against the auto_router license feature (#39674) 2026-09-05 09:51:23 -07:00
test_login_utils.py feat(auth): enforce configurable password policy and SSO-only login (#39381) 2026-09-02 14:28:13 -07:00
test_mcp_ip_filtering.py fix(proxy): mark session/SSO/SAML cookies Secure behind a TLS-terminating reverse proxy (#39391) 2026-09-02 16:42:29 -07:00
test_model_access_group_budgets.py fix(budgets): make the model access group ceiling exclusive 2026-08-29 15:20:10 -07:00
test_model_checks.py refactor(azure_ai): type the Foundry param mapping override and drop test docstrings 2026-09-05 19:21:34 -07:00
test_model_checks_fallbacks.py perf: build log messages lazily so filtered-out log records cost nothing (#35703) 2026-08-04 04:34:52 +00:00
test_multi_budget_windows.py fix(proxy): enforce budgets against authoritative DB spend when the cross-pod counter is unreliable (#30684) 2026-06-18 10:35:41 -07:00
test_network.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_oauth2_proxy_hook.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_object_permission_loading.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_onboarding.py feat(auth): enforce configurable password policy and SSO-only login (#39381) 2026-09-02 14:28:13 -07:00
test_organization_budget_enforcement.py test: drop the cwd-relative sys.path.insert calls from the test suite (#37802) 2026-08-22 09:25:58 -07:00
test_password_hashing.py chore: fixes 2026-03-30 18:36:58 -07:00
test_password_policy.py feat(auth): enforce configurable password policy and SSO-only login (#39381) 2026-09-02 14:28:13 -07:00
test_resolvers_exceptions.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_models.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_seam.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_store.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_route_checks.py fix(proxy): let authorized internal users open vector store details (#40150) 2026-09-07 13:10:09 -07:00
test_router_override_fallback_auth.py chore(proxy): clean up request parameter validation and provider destination handling (#34189) 2026-07-22 00:57:58 +00:00
test_team_member_budget.py Fix team member budget enforcement without user row (#27273) 2026-05-06 11:42:29 -07:00
test_unmapped_model_budget_enforcement.py fix(router): never price a strategy-router alias (#36691) 2026-08-12 14:26:30 -07:00
test_user_api_key_auth.py fix(proxy): keep team member budget enforced at the cap and across Redis counter expiry (#40304) 2026-09-08 15:06:20 -07:00