litellm/tests/test_litellm/proxy/auth
Shivi Jain aa130f4e4c feat(proxy): add project-level model_itpm_limit/model_otpm_limit
We already support model_tpm_limit/model_rpm_limit per project, but
that treats input and output tokens as one combined bucket, which
doesn't match how Bedrock Mantle actually meters usage. This adds
model_itpm_limit/model_otpm_limit so a project can cap input and output
tokens separately, same shape as the existing fields.

There's already deployment-level itpm/otpm support in
router_utils/pre_call_checks/io_token_rate_limit_check.py, but that
code only ever deals with one deployment at a time, whereas the proxy
hook (parallel_request_limiter_v3.py) has to juggle key/team/org/project
limits together on the same request. Rather than bolt a second copy of
the reservation logic on, this just adds project-scoped ITPM/OTPM as
two more descriptors into the same reservation path the hook already
uses for TPM/RPM.

If a project sets both the combined TPM limit and the new itpm/otpm
limits on the same model, both get enforced, not one overriding the
other, matching what the deployment-level check already does. Input
and output are reserved separately up front, and if one side reserves
fine but the other is over limit, we roll back the side that already
went through so nothing gets left over-counted. On the way back,
cached prompt tokens get excluded from the ITPM count since that's how
Bedrock bills it, but that's purely for the rate limit math, cost and
usage logging still see the full token count.
2026-07-22 22:02:52 +05:30
..
test_admin_viewer_handler_access.py fix(rbac): restore admin-viewer read parity for Logs page + settings reads 2026-04-29 19:21:41 -07:00
test_auth_checks.py fix(auth): set budget_reset_at when JWT upsert seeds a budget_duration (#34050) 2026-07-20 17:23:44 -07:00
test_auth_exception_handler.py fix(proxy): return 5xx on DB infra errors during auth; reserve 401 for genuine auth failures (#29986) 2026-06-10 23:48:11 +00:00
test_auth_hot_path_network_requests.py perf(auth): negative-cache missing user/key lookups on the request hot path (#32368) 2026-07-08 09:59:57 +03:00
test_auth_utils.py feat(proxy): add project-level model_itpm_limit/model_otpm_limit 2026-07-22 22:02:52 +05:30
test_banned_params_extra_body.py chore(tests): drop redundant membership check; trim test comment 2026-05-14 03:39:15 +00:00
test_cli_auth.py fix(cli): surface actionable CLI SSO errors when CLI and proxy versions skew (#33309) 2026-07-15 10:17:40 -07:00
test_custom_auth_end_user_budget.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_handle_jwt.py fix(proxy): populate user_email on UserAPIKeyAuth for JWT auth (#34174) 2026-07-21 16:11:47 -07:00
test_info_routes.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_litellm_license.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_login_utils.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_mcp_ip_filtering.py feat(mcp): add mcp_xff_num_trusted_hops to harden X-Forwarded-For client IP resolution (#31257) 2026-06-25 07:31:29 -07:00
test_model_checks.py revert: undo teamless all-team-models denial from #32022 and #29746 (#32032) 2026-07-03 18:56:07 -07:00
test_model_checks_fallbacks.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_multi_budget_windows.py fix(proxy): enforce budgets against authoritative DB spend when the cross-pod counter is unreliable (#30684) 2026-06-18 10:35:41 -07:00
test_network.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_oauth2_proxy_hook.py chore(auth): require trusted proxy for header identity auth 2026-04-29 21:20:21 -07:00
test_object_permission_loading.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_onboarding.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_organization_budget_enforcement.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_password_hashing.py chore: fixes 2026-03-30 18:36:58 -07:00
test_resolvers_exceptions.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_models.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_seam.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_resolvers_store.py feat(auth): resolve caller identity once into a Principal at the auth seam (#30887) 2026-06-20 18:49:41 -07:00
test_route_checks.py refactor(auth): resolve PATCH team org-context from the route template 2026-07-11 11:24:41 -07:00
test_router_override_fallback_auth.py chore(proxy): clean up request parameter validation and provider destination handling (#34189) 2026-07-22 00:57:58 +00:00
test_team_member_budget.py Fix team member budget enforcement without user row (#27273) 2026-05-06 11:42:29 -07:00
test_unmapped_model_budget_enforcement.py perf: eliminate per-request callback scanning on proxy hot path (#27858) 2026-05-14 09:28:31 -07:00
test_user_api_key_auth.py fix(proxy): populate user_email on UserAPIKeyAuth for JWT auth (#34174) 2026-07-21 16:11:47 -07:00