From 3b47355449deae9738960b16147a7648faae6b34 Mon Sep 17 00:00:00 2001 From: Jugal Bhatt Date: Wed, 13 Aug 2025 16:04:43 -0700 Subject: [PATCH] Enhance route access checks for PROXY_ADMIN_VIEW_ONLY role in RouteChecks class - Added additional routes for key management operations to the access control logic. - Improved handling of routes that start with "/key/" and end with "/regenerate" to ensure proper access restrictions. --- litellm/proxy/auth/route_checks.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/litellm/proxy/auth/route_checks.py b/litellm/proxy/auth/route_checks.py index 6976555aee1..8883f7d5429 100644 --- a/litellm/proxy/auth/route_checks.py +++ b/litellm/proxy/auth/route_checks.py @@ -405,7 +405,7 @@ class RouteChecks: status_code=status.HTTP_403_FORBIDDEN, detail=f"user not allowed to access this route, role= {_user_role}. Trying to access: {route} and updating invalid param: {param}. only user_email and password can be updated", ) - elif route in ["/user/new", "/user/delete", "/team/new", "/team/update", "/team/delete", "/model/new", "/model/update", "/model/delete"]: + elif route in ["/user/new", "/user/delete", "/team/new", "/team/update", "/team/delete", "/model/new", "/model/update", "/model/delete", "/key/generate", "/key/delete", "/key/update", "/key/regenerate", "/key/service-account/generate", "/key/block", "/key/unblock"] or route.startswith("/key/") and route.endswith("/regenerate"): # Block write operations for PROXY_ADMIN_VIEW_ONLY raise HTTPException( status_code=status.HTTP_403_FORBIDDEN,