scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-11 03:38:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 83

use helper _is_org_admin_for_user_id

Browse source
This commit is contained in:
Ishaan Jaff 2024-10-26 11:39:23 +04:00
parent 2f8478769b
commit 443580b9fe
1 changed files with 40 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

53
litellm/proxy/auth/route_checks.py
View file

@ -248,20 +248,13 @@ class RouteChecks:
return True
# Check if Org Admin can access info for user_id
if prisma_client is not None:
# Org Admins can access info for users in their org
_queried_user_info = await prisma_client.db.litellm_usertable.find_unique(
where={"user_id": user_id}, include={"organization_memberships": True}
if (
await RouteChecks._is_org_admin_for_user_id(
user_id=user_id, user_obj=user_obj
)
if _queried_user_info is not None:
for _membership in _queried_user_info.organization_memberships:
if OrganizationRoleBasedAccessChecks._user_is_admin_in_org(
user_object=user_obj,
organization_id=_membership.organization_id,
):
return True
is True
):
return True
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
@ -269,3 +262,37 @@ class RouteChecks:
user_id, valid_token.user_id
),
)
@staticmethod
async def _is_org_admin_for_user_id(
user_id: str, user_obj: Optional[LiteLLM_UserTable]
) -> bool:
"""
Returns True if the user_obj is an admin in any organization that the user_id belongs to.
When this is true, the user_obj is allowed to access /user/info for user_id
Args:
user_id (str): The user_id to check if the user_obj is an admin for
user_obj (LiteLLM_UserTable): The user object containing organization memberships
Returns:
bool: True if user_obj is an admin in any organization that the user_id belongs to, False otherwise
"""
from litellm.proxy.proxy_server import prisma_client
if prisma_client is not None:
_queried_user_info = await prisma_client.db.litellm_usertable.find_unique(
where={"user_id": user_id}, include={"organization_memberships": True}
)
if _queried_user_info is not None:
for _membership in _queried_user_info.organization_memberships:
if OrganizationRoleBasedAccessChecks._user_is_admin_in_org(
user_object=user_obj,
organization_id=_membership.organization_id,
):
return True
return False