test(proxy): move management_endpoints, management_helpers and guardrails tests into tests/unit/proxy

[devin-ai-integration]

TLDR

Problem this solves:

• tests/test_litellm/proxy still holds the management_endpoints, management_helpers and guardrails tests
• They should live in the unit tier at tests/unit/proxy/<same path>

How it solves it:

• git mv of all three directories (165 files, every one a pure rename, no name collisions)
• Stubs the few tests that were really calling OpenAI or Microsoft Graph at the HTTP boundary
• Rewrites the proxy-endpoints shard paths in test-unit.yml, shard name unchanged
• Moves the two mutmut path strings in pyproject.toml, nothing else in that file

PR 3 of 7, stacked on #43998

Screenshots / Proof of Fix

Coverage ledger

Same ledger.py as #43998, base origin/litellm_migrate_proxy_tests_p2

base origin/litellm_migrate_proxy_tests_p2: 8645 node ids in 165 legacy files
head litellm_migrate_proxy_tests_p3: 8645 node ids
renamed files: 165, deleted legacy files: 0
carried over after path mapping: 8645
missing explained: 0
missing unexplained: 0
head ids with no base counterpart: 0

Runs

The proxy-endpoints shard command restricted to the moved dirs, env -i with outbound sockets blocked, -n 4: 8647 passed, 7 skipped, 1 xfailed. The four pre-existing destination files that test-unit-proxy-db.yml owns, run once on their own: 95 passed, 81 skipped. assert_ci_coverage.py in both modes prints OK and is unchanged

Non-rename edits

file	+/-	reason
management_endpoints/policy_endpoints/test_ai_policy_suggester.py	20/1	network the unit tier blocks: the reasoning-model test sent a real request to OpenAI. A respx 401 on /responses now answers it through the shared httpx_transport fixture, so the AuthenticationError discriminator is unchanged
management_endpoints/test_ui_sso.py	13/2	network: the two Microsoft callback tests called the real Graph API for groups and passed only because it failed open. A respx stub returning {"value": []} now serves it
management_endpoints/test_internal_user_endpoints.py	1/1	jwt_key_mapping_doubles import path. Main's #44007 already injects the HIBP client into the breached-password test, so it needs no stub here
management_endpoints/test_team_endpoints.py, test_organization_endpoints.py, management_v1/test_users.py, management_v1/test_teams.py, guardrails/guardrail_hooks/test_cisco_ai_defense_chat.py, test_cisco_ai_defense_mcp.py	1/1 to 2/2	tests.test_litellm.proxy.* helper imports and docstring paths now point at tests.unit.proxy.*
guardrails/guardrail_hooks/test_straiker.py	12/4	network: the v3 completion test called tiktoken.encoding_for_model, which downloads BPE files from openaipublic.blob.core.windows.net. It now gets a real local byte-level tiktoken.Encoding, served only for text-davinci-003 through a MappingProxyType lookup, so any other model raises KeyError. Mutating straiker.py:490 to encoding_for_model("gpt-4o") turns it red
tests/test_litellm/test_conftest.py	1/1	the subprocess node id it runs moved to tests/unit/proxy/management_endpoints/
9 new __init__.py	0/0	empty package markers for moved dirs so tests/unit/test_package_layout.py passes
management_helpers/test_team_metadata_validation.py	1/1	bare import team_metadata_validator_impls is now package-qualified since the moved dir is a package
.github/workflows/test-unit.yml	7/3	proxy-endpoints runs the three new dirs and ignores the 4 destination files test-unit-proxy-db.yml already owns, so each file runs in exactly one GHA shard
pyproject.toml	2/2	the mutmut tests_dir and --ignore=.../test_saml_sso.py strings
Makefile	1/1	test-unit-proxy-guardrails paths
tests/test_models.py, tests/test_team_members.py	1/1, 2/2	skip-reason strings that point at the moved files

.circleci/scripts/unit_selection.sh is unchanged: the moved files fall into the unit catch-all and the four proxy-db files keep their existing entries

Type

✅ Test

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

Link to Devin session: https://app.devin.ai/sessions/d9bda95617da464e88d3619765819d0e
Open in Devin Desktop: https://app.devin.ai/desktop/session/d9bda95617da464e88d3619765819d0e?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

@greptileai review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[greptile-apps]

Confidence Score: 5/5

[Low risk] Reorganizes test files into a new directory structure.

The PR appears safe to merge; no outstanding finding or new actionable issue remains.

Summary

This PR moves management-endpoint, management-helper, and guardrail tests into tests/unit/proxy, updates their test-runner paths, and replaces external HTTP calls with local test responses.

• Both previous Greptile findings are resolved in the current code.
• No new actionable issue was identified.

_{Reviews (4) · Last reviewed commit: "test(proxy): pin the completion tokenize..."}

[devin-ai-integration]

@greptileai review

[devin-ai-integration]

@greptileai review

[devin-ai-integration]

@greptileai review