feat(_types.py): support setting allowed passthrough routes on keys + teams

ensures specific keys can call specific routes

litellm/proxy/_types.py

@@ -1281,6 +1281,7 @@ class NewTeamRequest(TeamBase):
     guardrails: Optional[List[str]] = None
     prompts: Optional[List[str]] = None
     object_permission: Optional[LiteLLM_ObjectPermissionBase] = None
+    allowed_passthrough_routes: Optional[list] = None
     team_member_budget: Optional[float] = (
         None  # allow user to set a budget for all team members
     )
@@ -1336,6 +1337,7 @@ class UpdateTeamRequest(LiteLLMPydanticObjectBase):
     team_member_rpm_limit: Optional[int] = None
     team_member_tpm_limit: Optional[int] = None
     team_member_key_duration: Optional[str] = None
+    allowed_passthrough_routes: Optional[list] = None
 
 
 class ResetTeamBudgetRequest(LiteLLMPydanticObjectBase):

litellm/proxy/management_endpoints/team_endpoints.py

@@ -27,6 +27,7 @@ from litellm.proxy._types import (
     CommonProxyErrors,
     DeleteTeamRequest,
     LiteLLM_AuditLogs,
+    LiteLLM_ManagementEndpoint_MetadataFields,
     LiteLLM_ManagementEndpoint_MetadataFields_Premium,
     LiteLLM_ModelTable,
     LiteLLM_OrganizationTable,
@@ -56,9 +57,6 @@ from litellm.proxy._types import (
     UpdateTeamRequest,
     UserAPIKeyAuth,
 )
-from litellm.proxy.management_helpers.object_permission_utils import (
-    _set_object_permission,
-)
 from litellm.proxy.auth.auth_checks import (
     allowed_route_check_inside_route,
     can_org_access_model,
@@ -76,6 +74,7 @@ from litellm.proxy.management_endpoints.tag_management_endpoints import (
     get_daily_activity,
 )
 from litellm.proxy.management_helpers.object_permission_utils import (
+    _set_object_permission,
     handle_update_object_permission_common,
 )
 from litellm.proxy.management_helpers.team_member_permission_checks import (
@@ -321,6 +320,7 @@ async def new_team(  # noqa: PLR0915
     - team_member_key_duration: Optional[str] - The duration for a team member's key. e.g. "1d", "1w", "1mo"
     - prompts: Optional[List[str]] - List of allowed prompts for the team. If specified, the team will only be able to use these specific prompts.
     
+
     Returns:
     - team_id: (str) Unique team id - used for tracking spend across multiple keys for same team id.
 
@@ -478,7 +478,7 @@ async def new_team(  # noqa: PLR0915
 
         ## Create Team Member Budget Table
         data_json = data.json()
-        
+
         ## Handle Object Permission - MCP, Vector Stores etc.
         data_json = await _set_object_permission(
             data_json=data_json,
@@ -514,6 +514,14 @@ async def new_team(  # noqa: PLR0915
                     value=getattr(data, field),
                 )
 
+        for field in LiteLLM_ManagementEndpoint_MetadataFields:
+            if getattr(data, field, None) is not None:
+                _set_object_metadata_field(
+                    object_data=complete_team_data,
+                    field_name=field,
+                    value=getattr(data, field),
+                )
+
         # If budget_duration is set, set `budget_reset_at`
         if complete_team_data.budget_duration is not None:
             from litellm.proxy.common_utils.timezone_utils import get_budget_reset_time
@@ -619,7 +627,6 @@ async def _update_model_table(
     return _model_id
 
 
-
 def validate_team_org_change(
     team: LiteLLM_TeamTable, organization: LiteLLM_OrganizationTable, llm_router: Router
 ) -> bool:
@@ -877,6 +884,13 @@ async def update_team(
                 field_name=field,
             )
 
+    for field in LiteLLM_ManagementEndpoint_MetadataFields:
+        if field in updated_kv and updated_kv[field] is not None:
+            _update_team_metadata_field(
+                updated_kv=updated_kv,
+                field_name=field,
+            )
+
     if "model_aliases" in updated_kv:
         updated_kv.pop("model_aliases")
         _model_id = await _update_model_table(