From 0a86bdabdb0c98fc56af27beb0b1141e34b65e23 Mon Sep 17 00:00:00 2001 From: er-s-an <92594860+er-s-an@users.noreply.github.com> Date: Sun, 18 Oct 2026 09:29:07 +0800 Subject: [PATCH] fix(proxy): avoid C901 growth on get_spend_routes update/regenerate gates Call the shared refuse helper unconditionally; default permissions={} is inert and only a truthy get_spend_routes trips the Enterprise 403. Drops the model_fields_set if-wrappers that pushed C901 past the merge-base ceiling. --- .../proxy/management_endpoints/key_management_endpoints.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/litellm/proxy/management_endpoints/key_management_endpoints.py b/litellm/proxy/management_endpoints/key_management_endpoints.py index d0cfe013056..77a6243c4d3 100644 --- a/litellm/proxy/management_endpoints/key_management_endpoints.py +++ b/litellm/proxy/management_endpoints/key_management_endpoints.py @@ -3555,8 +3555,8 @@ async def _validate_update_key_data( # Reject NaN/±inf spend before it can reach the DB / spend counter. validate_finite_spend(data.spend) - if "permissions" in data.model_fields_set: - _refuse_get_spend_routes_unless_premium(data.permissions, premium_user) + # Default permissions={} is inert; only a truthy get_spend_routes trips the gate. + _refuse_get_spend_routes_unless_premium(data.permissions, premium_user) validate_budget_duration(data.budget_duration) _is_proxy_admin: Final = user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value @@ -6381,8 +6381,7 @@ async def regenerate_key_fn( data=data, user_api_key_dict=user_api_key_dict, ) - if "permissions" in data.model_fields_set: - _refuse_get_spend_routes_unless_premium(data.permissions, premium_user) + _refuse_get_spend_routes_unless_premium(data.permissions, premium_user) # Mirror /key/generate's post-handle_key_type recheck so a # non-admin can't elevate via a key_type preset that the # regenerate flow would otherwise carry through unchecked.