diff --git a/litellm/proxy/spend_tracking/spend_management_endpoints.py b/litellm/proxy/spend_tracking/spend_management_endpoints.py index 822b827f985..cb70247ac92 100644 --- a/litellm/proxy/spend_tracking/spend_management_endpoints.py +++ b/litellm/proxy/spend_tracking/spend_management_endpoints.py @@ -37,6 +37,7 @@ from litellm.litellm_core_utils.classifier_logging import classifier_audit_field from litellm.proxy._types import * from litellm.proxy._types import ProviderBudgetResponse, ProviderBudgetResponseObject from litellm.proxy.auth.user_api_key_auth import user_api_key_auth +from litellm.proxy.litellm_pre_call_utils import LiteLLMProxyRequestSetup # NOTE: Avoid module-level import from common_utils: proxy_server imports this # module while common_utils may pull proxy_server during init, which can leave @@ -1840,7 +1841,7 @@ async def get_key_spend_report( scoped_api_key = _resolve_spend_report_scope( user_api_key_dict=user_api_key_dict, requested=requested, - caller_value=user_api_key_dict.api_key, + caller_value=LiteLLMProxyRequestSetup.get_logged_api_key(user_api_key_dict), scope_name="api_key", ) db_response: Sequence[Mapping[str, object]] | None = await _query_raw_or_none( diff --git a/tests/test_litellm/proxy/spend_tracking/test_spend_management_endpoints.py b/tests/test_litellm/proxy/spend_tracking/test_spend_management_endpoints.py index c6a4173b583..dc8f8cca7b1 100644 --- a/tests/test_litellm/proxy/spend_tracking/test_spend_management_endpoints.py +++ b/tests/test_litellm/proxy/spend_tracking/test_spend_management_endpoints.py @@ -6817,6 +6817,33 @@ def test_key_spend_report_scopes_to_caller_key(client, monkeypatch): app.dependency_overrides.pop(ps.user_api_key_auth, None) +def test_key_spend_report_scopes_a_cli_session_to_the_per_user_alias_not_the_login_token(client, monkeypatch): + mock_prisma = _spend_report_mock_prisma( + query_raw_returns=[{"api_key": "cli-session-alice", "total_cost": 1.5}] + ) + monkeypatch.setattr("litellm.proxy.proxy_server.prisma_client", mock_prisma) + monkeypatch.setattr("litellm.proxy.proxy_server.premium_user", True) + app.dependency_overrides[ps.user_api_key_auth] = lambda: UserAPIKeyAuth( + user_role=LitellmUserRoles.INTERNAL_USER, + user_id="alice", + api_key="cli-session-Qm7xJ2kP9sLw4vT1nR8yAa", + key_alias="cli-session-alice", + is_session_token=True, + ) + try: + response = client.get( + "/key/spend/report", + params={"start_date": "2026-07-01", "end_date": "2026-07-31", "api_key": "cli-session-alice"}, + headers={"Authorization": "Bearer sk-test"}, + ) + assert response.status_code == 200, response.text + assert response.json() == [{"api_key": "cli-session-alice", "total_cost": 1.5}] + args, _ = mock_prisma.db.query_raw.await_args + assert args[3] == "cli-session-alice" + finally: + app.dependency_overrides.pop(ps.user_api_key_auth, None) + + def test_key_spend_report_non_admin_override_403(client, monkeypatch): mock_prisma = _spend_report_mock_prisma() monkeypatch.setattr("litellm.proxy.proxy_server.prisma_client", mock_prisma)