litellm/tests/integration/authorization
yuneng-jiang fc27dfdc7d
test(integration): give each owned proxy a private database and Redis by default (#47213)
* test(integration): give each owned proxy a private database and Redis by default

owned_proxy and owned_proxy_process now boot on a scratch database and a
per-proxy redis-server unless the caller opts into the worker's state with
state=OwnedState.SHARED_WITH_WORKER, passes its own DATABASE_URL, or strips
DATABASE_URL. Under the replica profile the private database gets the
writer and reader roles so the reader path stays covered.

Gateway carries the database_url its proxy writes to, and the Scenario
cleanup checks and delete_key_if_present read from it, so they keep
checking something on a private database.

The 189 test files with owned proxy sites that depend on the worker's
database or Redis opt in with a shares_worker_state module marker, which a
module-scoped conftest fixture turns into the shared state. The 7 helper
modules with such sites opt in per call, since conftest fixtures and other
test files reach them.

* test(integration): reach session fixtures with the shared marker and keep the worker retry default

The module-scoped fixture that applied shares_worker_state ran after
session-scoped fixtures, so proxies those booted went private in marked
files. The marker is now applied around each marked item's setup, call
and teardown, which covers fixtures of every scope.

Owned proxies on the worker database inherited the worker gateway's
router_settings.num_retries of 0 from it. A private proxy now gets the same
default in its config copy unless the config sets num_retries itself.

Five providers files read the owned proxy's spend rows or response cache
through the worker's database or Redis and opt into sharing.
2026-10-18 03:37:41 +00:00
..
__init__.py test: migrate tests/proxy_behavior into integration and unit tiers (#45939) 2026-10-11 08:28:42 -07:00
_guardrail_opt_out.py fix(proxy): gate disable_global_guardrails on keys and teams to proxy admins (#42699) 2026-09-23 18:03:02 -07:00
_hidden_alias_budget.py fix(auth): resolve hidden model_group_alias entries in the zero-cost budget check (#43741) 2026-10-03 16:35:11 -07:00
_responses_compact.py fix(proxy): check previous_response_id ownership on /v1/responses/compact (#46408) 2026-10-14 17:57:34 +00:00
test_access_group_budget.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_access_group_model_listing.py test(integration): cover orgs_users_customers endpoint contracts (#44725) 2026-10-14 07:38:06 +00:00
test_agent_access.py test(integration): cover agents_a2a endpoint contracts (#44650) 2026-10-14 03:40:07 +00:00
test_agent_least_privilege.py feat(proxy): add agent_access_default_deny for least-privilege agent access (#43979) 2026-10-15 16:49:26 -07:00
test_alias_chain_budget_waiver.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_audio_model_access.py test(integration): cover audio endpoint contracts (#44699) 2026-10-14 03:41:20 +00:00
test_audit_any_sweep_auth.py test(integration): cover chat_completions endpoint contracts (#44688) 2026-10-14 03:45:38 +00:00
test_auth_object_prefetch.py test: migrate tests/proxy_behavior into integration and unit tiers (#45939) 2026-10-11 08:28:42 -07:00
test_bedrock_passthrough_model_access.py test(integration): regression tests for July cost tracking, budgeting and spend bugs (#42694) 2026-09-23 09:51:56 -07:00
test_claude_code_gateway_oauth.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_cli_sso_login_ui_disabled.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_customer_model_allowlist.py feat(proxy): limit which models an end user can call (#43904) 2026-10-05 21:58:03 +00:00
test_deprecated_key_lookup_cache.py test(proxy): migrate DB and Redis backed proxy tests into tests/integration (#43996) 2026-10-01 09:23:36 -07:00
test_end_user_block.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_guardrail_submissions.py test(integration): cover guardrails_policies endpoint contracts (#44722) 2026-10-14 04:07:26 +00:00
test_hidden_alias_budget_bypass.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_hidden_alias_budget_bypass_chaos.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_jwt_auto_register_map_existing_key.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_jwt_default_team_provisioning.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_jwt_key_mapping_lifecycle.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_jwt_mapped_key_email_backfill.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_key_alias_model_access.py fix(proxy): authorize key model aliases the same way as team aliases (#43049) 2026-09-24 19:51:02 -07:00
test_key_bound_to_unknown_user.py test(integration): move legacy proxy, router and Redis tests into tests/integration (#44128) 2026-10-01 23:00:54 -07:00
test_key_guardrail_opt_out.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_key_guardrail_opt_out_chaos.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_key_guardrail_opt_out_runtime.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_memory_ownership.py test(integration): cover prompts_tags_caching endpoint contracts (#44686) 2026-10-14 04:10:31 +00:00
test_model_access_allow_lists.py test: replace 61 live logging and otel tests with offline unit and integration coverage (#45362) 2026-10-08 15:55:57 -07:00
test_object_permission_lookup.py feat(proxy): add opt-in vector_store_deny_by_default for least-privilege vector store access (#44244) 2026-10-06 12:50:25 -07:00
test_passthrough_route_denylist.py feat(proxy): add denied_passthrough_routes deny list for custom pass-through endpoints (#44924) 2026-10-07 16:19:53 -07:00
test_rag_query_vector_store_allowlist.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_rag_team_provider_credentials.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_realtime_client_secret_access.py test(integration): cover realtime endpoint contracts (#44689) 2026-10-14 03:49:34 +00:00
test_responses_compact_id_ownership.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_responses_compact_id_ownership_chaos.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_responses_id_ownership.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_search_tool_allowlist.py test(integration): remove BUG skips for 3 tests that pass on main (#46725) 2026-10-15 18:50:26 +00:00
test_search_tool_deny_by_default.py feat(auth): deny search tools by default when search_tool_deny_by_default is set (#44490) 2026-10-06 12:50:26 -07:00
test_sso_blank_identity.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_team_admin_gate.py fix(cache): keep cache hits free of unset fields, and follow intentional behavior changes in CircleCI suites (#46359) 2026-10-14 08:56:05 -07:00
test_team_member_permissions.py test(integration): cover teams endpoint contracts (#44705) 2026-10-14 06:29:20 +00:00
test_team_scoped_models.py test(integration): cover teams endpoint contracts (#44705) 2026-10-14 06:29:20 +00:00
test_tool_search_replay_allowlist.py fix(responses bridge): round-trip tool_search_call and tool_search_output items between turns (#46444) 2026-10-14 21:40:14 -07:00
test_tool_search_replay_guardrails.py test(integration): give each owned proxy a private database and Redis by default (#47213) 2026-10-18 03:37:41 +00:00
test_unknown_key_generic_401.py fix(auth): return a generic 401 for an unknown key (#39787) 2026-10-15 01:05:25 -07:00
test_user_self_update_guard.py test(integration): cover orgs_users_customers endpoint contracts (#44725) 2026-10-14 07:38:06 +00:00
test_warmed_policy.py test(integration): cover keys_auth endpoint contracts (#44674) 2026-10-14 07:12:28 +00:00
test_websocket_rejection_logging.py test(integration): give chaos and timing tests a harness API and gate raw signals (#46031) 2026-10-12 05:27:33 -07:00
test_wildcard_model_access.py test(integration): move legacy proxy, router and Redis tests into tests/integration (#44128) 2026-10-01 23:00:54 -07:00
test_workflow_ownership.py test(integration): cover prompts_tags_caching endpoint contracts (#44686) 2026-10-14 04:10:31 +00:00