refactor: reduce function size below 50 LOC

litellm/proxy/auth/route_checks.py

@@ -117,6 +117,32 @@ class RouteChecks:
 
         return masker._mask_value(user_id)
 
+    @staticmethod
+    def _raise_admin_only_route_exception(
+        user_obj: Optional[LiteLLM_UserTable],
+        route: str,
+    ) -> None:
+        """
+        Raise exception for routes that require proxy admin access
+
+        Args:
+            user_obj (Optional[LiteLLM_UserTable]): The user object
+            route (str): The route being accessed
+
+        Raises:
+            Exception: With user role and masked user_id information
+        """
+        user_role = "unknown"
+        user_id = "unknown"
+        if user_obj is not None:
+            user_role = user_obj.user_role or "unknown"
+            user_id = user_obj.user_id or "unknown"
+
+        masked_user_id = RouteChecks._mask_user_id(user_id)
+        raise Exception(
+            f"Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route={route}. Your role={user_role}. Your user_id={masked_user_id}"
+        )
+
     @staticmethod
     def non_proxy_admin_allowed_routes_check(
         user_obj: Optional[LiteLLM_UserTable],
@@ -215,29 +241,13 @@ class RouteChecks:
                     route_allowed = True
                     break
 
-            if route_allowed:
-                pass
-            else:
-                user_role = "unknown"
-                user_id = "unknown"
-                if user_obj is not None:
-                    user_role = user_obj.user_role or "unknown"
-                    user_id = user_obj.user_id or "unknown"
-
-                masked_user_id = RouteChecks._mask_user_id(user_id)
-                raise Exception(
-                    f"Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route={route}. Your role={user_role}. Your user_id={masked_user_id}"
+            if not route_allowed:
+                RouteChecks._raise_admin_only_route_exception(
+                    user_obj=user_obj, route=route
                 )
         else:
-            user_role = "unknown"
-            user_id = "unknown"
-            if user_obj is not None:
-                user_role = user_obj.user_role or "unknown"
-                user_id = user_obj.user_id or "unknown"
-
-            masked_user_id = RouteChecks._mask_user_id(user_id)
-            raise Exception(
-                f"Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route={route}. Your role={user_role}. Your user_id={masked_user_id}"
+            RouteChecks._raise_admin_only_route_exception(
+                user_obj=user_obj, route=route
             )
 
     @staticmethod

litellm/proxy/management_endpoints/key_management_endpoints.py

@@ -1277,6 +1277,7 @@ async def update_key_fn(
     - temp_budget_increase: Optional[float] - Temporary budget increase for the key (Enterprise only).
     - temp_budget_expiry: Optional[str] - Expiry time for the temporary budget increase (Enterprise only).
     - allowed_routes: Optional[list] - List of allowed routes for the key. Store the actual route or store a wildcard pattern for a set of routes. Example - ["/chat/completions", "/embeddings", "/keys/*"]
+    - allowed_passthrough_routes: Optional[list] - List of allowed pass through routes for the key. Store the actual route or store a wildcard pattern for a set of routes. Example - ["/my-custom-endpoint"]. Use this instead of allowed_routes, if you just want to specify which pass through routes the key can access, without specifying the routes. If allowed_routes is specified, allowed_passthrough_routes is ignored.
     - prompts: Optional[List[str]] - List of allowed prompts for the key. If specified, the key will only be able to use these specific prompts.
     - object_permission: Optional[LiteLLM_ObjectPermissionBase] - key-specific object permission. Example - {"vector_stores": ["vector_store_1", "vector_store_2"], "mcp_tool_permissions": {"server_id_1": ["tool1", "tool2"]}}. IF null or {} then no object permission.
     - auto_rotate: Optional[bool] - Whether this key should be automatically rotated