From 5fc83d90bfa3fb1dace5b9130a9b5d63f73136be Mon Sep 17 00:00:00 2001
From: "xy.kong" <xy.kong@gmail.com>
Date: Sun, 22 Mar 2026 02:37:28 +0800
Subject: [PATCH] fix(ui): disable /config/list fetch in useProxyConfig for
 non-admin users

The useProxyConfig hook called GET /config/list unconditionally on mount,
regardless of user role. Since /config/list is admin-only (returns 400
for non-admin), every page load for internal_user sessions generated a
400 error log entry.

Add isProxyAdminRole check to the query's enabled flag so the fetch
is skipped entirely for non-admin users. The isProxyAdminRole utility
already exists in @/utils/roles.

Fixes #24309
---
 .../src/app/(dashboard)/hooks/proxyConfig/useProxyConfig.ts  | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/ui/litellm-dashboard/src/app/(dashboard)/hooks/proxyConfig/useProxyConfig.ts b/ui/litellm-dashboard/src/app/(dashboard)/hooks/proxyConfig/useProxyConfig.ts
index b823ce4ffd8..d9c9ff66a2a 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/hooks/proxyConfig/useProxyConfig.ts
+++ b/ui/litellm-dashboard/src/app/(dashboard)/hooks/proxyConfig/useProxyConfig.ts
@@ -1,6 +1,7 @@
 import { useQuery, useMutation, UseMutationResult } from "@tanstack/react-query";
 import { createQueryKeys } from "../common/queryKeysFactory";
 import useAuthorized from "../useAuthorized";
+import { isProxyAdminRole } from "@/utils/roles";
 import { proxyBaseUrl, getGlobalLitellmHeaderName, deriveErrorMessage, handleError } from "@/components/networking";
 
 /**
@@ -146,7 +147,7 @@ export const deleteProxyConfigFieldCall = async (
  * @returns React Query result with the config list data
  */
 export const useProxyConfig = (configType: ConfigType) => {
-  const { accessToken } = useAuthorized();
+  const { accessToken, userRole } = useAuthorized();
   return useQuery<ProxyConfigResponse>({
     queryKey: proxyConfigKeys.list({
       filters: {
@@ -154,7 +155,7 @@ export const useProxyConfig = (configType: ConfigType) => {
       },
     }),
     queryFn: async () => await getProxyConfigCall(accessToken!, configType),
-    enabled: Boolean(accessToken),
+    enabled: Boolean(accessToken) && isProxyAdminRole(userRole ?? ""),
   });
 };