test(proxy): pin the request-body rules proxy/_types.py enforces

[yuneng-berri]

TLDR

Problem this solves:

• proxy/_types.py is 4,945 lines of accepted request bodies
• Its mapped test file is 9 tests
• Eight rules that reject a request had none

How it solves it:

• One test per rule, asserted through the model, not the endpoint
• Rewriting any of the eight to its opposite now fails

User Flow

No end-user behavior changes. A management API caller sending a body one of
these rules refuses keeps getting the same refusal, and now a change to that
refusal has to be deliberate.

Relevant issues

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• The handful of test files covering my change pass locally
• My PR passes all required CI/CD checks (e.g., lint, schema.d.ts sync check, etc.)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review

Screenshots / Proof of Fix

Shared setup: each of the eight rules is rewritten to its opposite in
litellm/proxy/_types.py, one at a time, and the mapped test file is run
against it. A rule is pinned when the run fails.

for each rule:
    invert the guard in litellm/proxy/_types.py
    uv run pytest tests/test_litellm/proxy/test_proxy_types.py -x -q
    killed if the run fails

The eight rewrites: the JWT audience requirement, the audience-and-opt-out
conflict, the temp-budget pairing, the empty max_budget string, the
organization role list, the llm_api_name requirement, the via_virtual_key
strip, and extra: forbid on JWTIssuerConfig.

Before (ff02d5c)

1. uv run pytest tests/test_litellm/proxy/test_proxy_types.py -q

9 passed, 2 warnings in 1.72s

2. The eight rewrites, against that file:

SURVIVED  audience guard inverted
SURVIVED  audience conflict guard dropped
SURVIVED  temp budget pairing loosened
SURVIVED  empty max_budget passed through
SURVIVED  org role check inverted
SURVIVED  llm_api_name requirement dropped
SURVIVED  via_virtual_key accepted from caller
SURVIVED  jwt issuer accepts extra fields

kill rate: 0/8

After (0f5580d)

1. uv run pytest tests/test_litellm/proxy/test_proxy_types.py -q

19 passed, 2 warnings in 1.66s

2. The same eight rewrites:

KILLED    audience guard inverted
KILLED    audience conflict guard dropped
KILLED    temp budget pairing loosened
KILLED    empty max_budget passed through
KILLED    org role check inverted
KILLED    llm_api_name requirement dropped
KILLED    via_virtual_key accepted from caller
KILLED    jwt issuer accepts extra fields

kill rate: 8/8

Type

✅ Test

Caveats (if any)

• JWTIssuerConfig had no test anywhere in the suite before this
• 20 of the file's 28 validators are still unpinned
• The tests assert on the model, so they say nothing about status codes

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[greptile-apps]

Greptile Summary

This test-only PR adds direct model-validation coverage for request-body rules enforced by proxy/_types.py.

• Covers JWT issuer audience configuration and unknown-field rejection.
• Covers temporary budget pairing, empty budget normalization, organization roles, and LLM injection-check requirements.
• Verifies caller-provided server-only authentication markers are discarded.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
tests/test_litellm/proxy/test_proxy_types.py	Adds isolated regression tests that accurately reflect existing request-model validation and authentication-marker contracts.

_{Reviews (2): Last reviewed commit: "test(proxy): pin the request-body rules ..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[yuneng-berri]

@greptileai