From 493c28a45ca517e78699372db38db674ba546277 Mon Sep 17 00:00:00 2001 From: juser0719 Date: Fri, 16 Oct 2026 09:23:12 +0900 Subject: [PATCH] fix(auth): let PROXY_ADMIN_VIEW_ONLY call the Usage Ask AI route POST /usage/ai/chat is written for admins and admin viewers alike (_user_has_admin_view), but the viewer route gate only passes POSTs on the explicit allowlist, and this path was never added. Viewers got 'user not allowed to access this route'. The route only reads the daily activity aggregates that /user/daily/activity already serves them. --- litellm/proxy/_types.py | 2 ++ tests/unit/proxy/auth/test_route_checks.py | 1 + 2 files changed, 3 insertions(+) diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py index 6608e152466..0012083dd35 100644 --- a/litellm/proxy/_types.py +++ b/litellm/proxy/_types.py @@ -957,6 +957,8 @@ class LiteLLMRoutes(enum.Enum): "/user/available_users", "/user/available_roles", "/user/daily/activity", + # Usage > Ask AI: a POST that only reads daily activity aggregates. + "/usage/ai/chat", "/user/daily/activity/aggregated", "/user/daily/activity/aggregated/keys", "/user/daily/activity/aggregated/search", diff --git a/tests/unit/proxy/auth/test_route_checks.py b/tests/unit/proxy/auth/test_route_checks.py index 21958e88008..b13d1826b2d 100644 --- a/tests/unit/proxy/auth/test_route_checks.py +++ b/tests/unit/proxy/auth/test_route_checks.py @@ -350,6 +350,7 @@ def test_proxy_admin_viewer_blocked_management_writes(blocked_route): "/model/info", "/jwt/key/mapping/list", "/jwt/key/mapping/info", + "/usage/ai/chat", ], ) def test_proxy_admin_viewer_allowed_management_reads(allowed_read_route):