From 3630642110e0055040f5c5666cb2ff1c195d519e Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Fri, 11 Sep 2026 16:21:20 +0000
Subject: [PATCH] fix(ui): allow Org Admin session role to resolve user emails
 in logs

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .../src/app/(dashboard)/hooks/users/useUsers.test.ts | 12 +++++++++++-
 .../src/app/(dashboard)/hooks/users/useUsers.ts      |  8 ++++----
 ui/litellm-dashboard/src/utils/roles.ts              |  6 ++++++
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/ui/litellm-dashboard/src/app/(dashboard)/hooks/users/useUsers.test.ts b/ui/litellm-dashboard/src/app/(dashboard)/hooks/users/useUsers.test.ts
index 2e8471ba84f..f49c728446b 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/hooks/users/useUsers.test.ts
+++ b/ui/litellm-dashboard/src/app/(dashboard)/hooks/users/useUsers.test.ts
@@ -235,7 +235,7 @@ describe("useInfiniteUsers", () => {
   });
 
   it("should execute query for each admin role", async () => {
-    const adminRoles = ["Admin", "Admin Viewer", "proxy_admin", "proxy_admin_viewer", "org_admin"];
+    const adminRoles = ["Admin", "Admin Viewer", "proxy_admin", "proxy_admin_viewer", "org_admin", "Org Admin"];
 
     for (const role of adminRoles) {
       vi.clearAllMocks();
@@ -384,6 +384,16 @@ describe("useUserEmailLookup", () => {
     expect(userListCall).not.toHaveBeenCalled();
   });
 
+  it("queries for the formatted Org Admin session role", async () => {
+    mockUseAuthorized.mockReturnValue({ ...DEFAULT_AUTH, userRole: "Org Admin" });
+    vi.mocked(userListCall).mockResolvedValue(buildUserListResponse(1, 1, 1));
+
+    const { result } = renderHook(() => useUserEmailLookup(["user-1-0"]), { wrapper });
+
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+    expect(result.current.data).toEqual({ "user-1-0": "user-1-0@example.com" });
+  });
+
   it("does not query for a non-admin role", async () => {
     mockUseAuthorized.mockReturnValue({ ...DEFAULT_AUTH, userRole: "Internal User" });
 
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/hooks/users/useUsers.ts b/ui/litellm-dashboard/src/app/(dashboard)/hooks/users/useUsers.ts
index 84aeba90ae2..3b7f9fbeb02 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/hooks/users/useUsers.ts
+++ b/ui/litellm-dashboard/src/app/(dashboard)/hooks/users/useUsers.ts
@@ -1,7 +1,7 @@
 import { userListCall, UserInfo, UserListResponse } from "@/components/networking";
 import { useInfiniteQuery, useQuery } from "@tanstack/react-query";
 import { createQueryKeys } from "../common/queryKeysFactory";
-import { all_admin_roles } from "@/utils/roles";
+import { canListUsers } from "@/utils/roles";
 import useAuthorized from "@/app/(dashboard)/hooks/useAuthorized";
 
 const infiniteUsersKeys = createQueryKeys("infiniteUsers");
@@ -34,7 +34,7 @@ export const useInfiniteUsers = (pageSize: number = DEFAULT_PAGE_SIZE, searchEma
       }
       return undefined;
     },
-    enabled: Boolean(accessToken) && all_admin_roles.includes(userRole!),
+    enabled: Boolean(accessToken) && canListUsers(userRole),
   });
 };
 
@@ -52,7 +52,7 @@ export const useUserEmailLookup = (userIds: readonly string[]) => {
         response.users.filter((user) => Boolean(user.user_email)).map((user) => [user.user_id, user.user_email]),
       );
     },
-    enabled: Boolean(accessToken) && distinctIds.length > 0 && all_admin_roles.includes(userRole!),
+    enabled: Boolean(accessToken) && distinctIds.length > 0 && canListUsers(userRole),
   });
 };
 
@@ -64,6 +64,6 @@ export const useUserLookup = (userId: string | null) => {
       const response = await userListCall(accessToken!, [userId!], 1, 1);
       return response.users.find((user) => user.user_id === userId) ?? null;
     },
-    enabled: Boolean(accessToken) && Boolean(userId) && all_admin_roles.includes(userRole!),
+    enabled: Boolean(accessToken) && Boolean(userId) && canListUsers(userRole),
   });
 };
diff --git a/ui/litellm-dashboard/src/utils/roles.ts b/ui/litellm-dashboard/src/utils/roles.ts
index 62a5f02cc39..1cb7e75c19b 100644
--- a/ui/litellm-dashboard/src/utils/roles.ts
+++ b/ui/litellm-dashboard/src/utils/roles.ts
@@ -28,6 +28,12 @@ export const isAdminRole = (role: string): boolean => {
   return all_admin_roles.includes(role);
 };
 
+// /user/list admits proxy admins and org admins; the session role for the latter is the formatted
+// "Org Admin", which all_admin_roles does not carry
+const rolesAllowedToListUsers: string[] = [...all_admin_roles, "Org Admin"];
+
+export const canListUsers = (role: string | null): boolean => rolesAllowedToListUsers.includes(role ?? "");
+
 export const isProxyAdminRole = (role: string): boolean => {
   return role === "proxy_admin" || role === "Admin";
 };