From 2855e33b4f8b3543e50cb7503865c4e5ff652c74 Mon Sep 17 00:00:00 2001
From: kimsehwan96 <sktpghks138@gmail.com>
Date: Mon, 27 Apr 2026 17:00:58 +0900
Subject: [PATCH] [Feature] Allow Admin Viewers to Access Spend Logs

Add /spend/logs, /spend/logs/ui, /spend/logs/v2, /spend/logs/session/ui,
/spend/logs/ui/{request_id} to admin_viewer_routes so proxy_admin_viewer
can view spend logs across the platform.
---
 litellm/proxy/_types.py                       |  5 ++
 .../proxy/auth/test_route_checks.py           | 48 +++++++++++++++++++
 2 files changed, 53 insertions(+)

diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index 92c920ca594..c932225e8d3 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -727,6 +727,11 @@ class LiteLLMRoutes(enum.Enum):
         "/tag/list",
         "/audit",
         "/audit/{id}",
+        "/spend/logs",
+        "/spend/logs/ui",
+        "/spend/logs/v2",
+        "/spend/logs/session/ui",
+        "/spend/logs/ui/{request_id}",
         "/global/activity",
         "/global/activity/model",
         "/global/activity/cache_hits",
diff --git a/tests/test_litellm/proxy/auth/test_route_checks.py b/tests/test_litellm/proxy/auth/test_route_checks.py
index a5d405cfc2d..a13afab278c 100644
--- a/tests/test_litellm/proxy/auth/test_route_checks.py
+++ b/tests/test_litellm/proxy/auth/test_route_checks.py
@@ -1198,6 +1198,54 @@ def test_proxy_admin_viewer_can_access_audit_logs(route):
         )
 
 
+@pytest.mark.parametrize(
+    "route",
+    [
+        "/spend/logs",
+        "/spend/logs/ui",
+        "/spend/logs/v2",
+        "/spend/logs/session/ui",
+        "/spend/logs/ui/some-request-id",
+    ],
+)
+def test_proxy_admin_viewer_can_access_spend_logs(route):
+    """
+    Test that proxy_admin_viewer can access /spend/logs endpoints.
+
+    The role description states "view all spend across the platform", so the
+    raw spend log endpoints (which back the admin Logs UI page) must be
+    reachable by proxy_admin_viewer.
+    """
+
+    user_obj = LiteLLM_UserTable(
+        user_id="viewer_user",
+        user_email="viewer@example.com",
+        user_role=LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY.value,
+    )
+
+    valid_token = UserAPIKeyAuth(
+        user_id="viewer_user",
+        user_role=LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY.value,
+    )
+
+    request = MagicMock(spec=Request)
+    request.query_params = {}
+
+    try:
+        RouteChecks.non_proxy_admin_allowed_routes_check(
+            user_obj=user_obj,
+            _user_role=LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY.value,
+            route=route,
+            request=request,
+            valid_token=valid_token,
+            request_data={},
+        )
+    except Exception as e:
+        pytest.fail(
+            f"proxy_admin_viewer should be able to access {route} route. Got error: {str(e)}"
+        )
+
+
 class TestModelsRouteExemptFromDisableLLMEndpoints:
     """
     Test that /models and /v1/models are exempt from DISABLE_LLM_API_ENDPOINTS.