scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-11-12 08:42:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 207

fix(proxy): cast permission maps for basedpyright unknown-type gate

Browse source 
isinstance(dict) still leaves dict[Unknown, Unknown]; cast to
dict[str, object] (with cast-ok) before .get so reportUnknownMemberType
/ reportUnknownArgumentType do not grow past the merge-base ceiling.
Also cast json.loads permissions to the same shape.
This commit is contained in:
er-s-an 2026-10-18 09:49:05 +08:00
parent c7f6718216
commit 402387ab35
2 changed files with 15 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
litellm/proxy/auth/route_checks.py
View file

@ -301,7 +301,12 @@ class RouteChecks:
def _has_truthy_permission(permissions: object | None, name: str) -> bool:
"""True when `name` is opted in with a truthy value (dict) or listed (sequence)."""
if isinstance(permissions, dict):
return bool(permissions.get(name))
typed: Final = (
cast( # cast-ok: isinstance(dict) narrows to dict[Unknown, Unknown]; keys are permission names
dict[str, object], permissions
)
)
return bool(typed.get(name))
if isinstance(permissions, (list, tuple, set)):
return name in permissions
return False

11
litellm/proxy/management_endpoints/key_management_endpoints.py
View file

@ -3529,7 +3529,12 @@ def _refuse_get_spend_routes_unless_premium(
"""
if not isinstance(permissions, dict):
return
if permissions.get("get_spend_routes") and premium_user is not True:
typed_permissions: Final = (
cast( # cast-ok: isinstance(dict) narrows to dict[Unknown, Unknown]; permission map is str-keyed
dict[str, object], permissions
)
)
if typed_permissions.get("get_spend_routes") and premium_user is not True:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={
@ -5283,7 +5288,9 @@ async def generate_key_helper_fn(
if isinstance(saved_token["metadata"], str):
saved_token["metadata"] = json.loads(saved_token["metadata"])
if isinstance(saved_token["permissions"], str):
parsed_permissions: Final = json.loads(saved_token["permissions"])
parsed_permissions: Final = cast( # cast-ok: permissions column stores a JSON object of permission flags
dict[str, object], json.loads(saved_token["permissions"])
)
# Refuse only when the permission is requested (truthy). An explicit
# false must not trip a substring check on the serialized JSON.
_refuse_get_spend_routes_unless_premium(parsed_permissions, premium_user)