From 2a14059c11f04819ce5aee3d698de9fda92689b9 Mon Sep 17 00:00:00 2001
From: AxelRay <110029405+axelray-dev@users.noreply.github.com>
Date: Wed, 23 Sep 2026 15:52:11 +0800
Subject: [PATCH] fix(proxy): satisfy type discipline gate

---
 .../management_endpoints/common_daily_activity.py    | 12 +++++++-----
 .../management_endpoints/internal_user_endpoints.py  |  4 +++-
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/litellm/proxy/management_endpoints/common_daily_activity.py b/litellm/proxy/management_endpoints/common_daily_activity.py
index c4db06e8982..329fef4260d 100644
--- a/litellm/proxy/management_endpoints/common_daily_activity.py
+++ b/litellm/proxy/management_endpoints/common_daily_activity.py
@@ -566,8 +566,8 @@ async def _get_deleted_keys_for_user(
 ) -> Sequence["PrismaDeletedVerificationToken"]:
     try:
         return await DeletedVerificationTokenRepository(prisma_client).table.find_many(
-            where={"user_id": user_id},
-            order={"deleted_at": "desc"},
+            where={"user_id": user_id},  # mutable-ok: Prisma query payload is consumed as a mutable mapping
+            order={"deleted_at": "desc"},  # mutable-ok: Prisma query payload is consumed as a mutable mapping
         )
     except Exception as e:
         verbose_proxy_logger.warning("Failed to fetch deleted key metadata for user %s: %s", user_id, e)
@@ -580,10 +580,12 @@ async def get_user_api_key_filter(
     api_key: str | None,
 ) -> list[str]:
     """Return the key digests that should scope a user's activity query."""
-    active_keys: Final = await VerificationTokenRepository(prisma_client).table.find_many(where={"user_id": user_id})
+    active_keys: Final = await VerificationTokenRepository(prisma_client).table.find_many(
+        where={"user_id": user_id},  # mutable-ok: Prisma query payload is consumed as a mutable mapping
+    )
     deleted_keys: Final = await _get_deleted_keys_for_user(prisma_client, user_id)
 
-    user_api_keys: Final = list(
+    user_api_keys: Final = list(  # mutable-ok: helper returns a list for the downstream SQL filter
         dict.fromkeys(
             key.token
             for key in (*active_keys, *deleted_keys)
@@ -592,7 +594,7 @@ async def get_user_api_key_filter(
     )
     if api_key is None:
         return user_api_keys
-    return [api_key] if api_key in user_api_keys else []
+    return [api_key] if api_key in user_api_keys else []  # mutable-ok: preserve the list return shape
 
 
 def _adjust_dates_for_timezone(
diff --git a/litellm/proxy/management_endpoints/internal_user_endpoints.py b/litellm/proxy/management_endpoints/internal_user_endpoints.py
index da228f8b9c5..13218b2b8b9 100644
--- a/litellm/proxy/management_endpoints/internal_user_endpoints.py
+++ b/litellm/proxy/management_endpoints/internal_user_endpoints.py
@@ -3033,7 +3033,9 @@ async def get_user_daily_activity_aggregated(
         if caller_user_id is not None and requested_user_id != caller_user_id:
             raise HTTPException(
                 status_code=status.HTTP_403_FORBIDDEN,
-                detail={"error": "Non-admin users can only view their own spend data."},
+                detail={
+                    "error": "Non-admin users can only view their own spend data."
+                },  # mutable-ok: FastAPI requires a mutable error payload
             )
 
         api_key_filter: Final = (