From 6434010c2b9b22e8a04865674c747d70dd63dc6e Mon Sep 17 00:00:00 2001
From: Ryan Crabbe <ryan@berri.ai>
Date: Sat, 4 Apr 2026 17:45:51 -0700
Subject: [PATCH] refactor(proxy): extract _apply_non_admin_alias_scope to fix
 PLR0915

Extracts the non-admin scoping logic from key_aliases into a helper to
bring the function under ruff's 50-statement limit. No behavior change.
---
 .../key_management_endpoints.py               | 65 +++++++++++--------
 1 file changed, 39 insertions(+), 26 deletions(-)

diff --git a/litellm/proxy/management_endpoints/key_management_endpoints.py b/litellm/proxy/management_endpoints/key_management_endpoints.py
index 686ccb809e4..33122147394 100644
--- a/litellm/proxy/management_endpoints/key_management_endpoints.py
+++ b/litellm/proxy/management_endpoints/key_management_endpoints.py
@@ -4246,6 +4246,42 @@ async def list_keys(
         )
 
 
+async def _apply_non_admin_alias_scope(
+    user_api_key_dict: UserAPIKeyAuth,
+    prisma_client: Any,
+    query_params: List[Any],
+    where_parts: List[str],
+) -> None:
+    """Append SQL scope conditions so non-admin users only see aliases for
+    keys they own or keys belonging to teams they are members of."""
+    scope_conditions: List[str] = []
+    if user_api_key_dict.user_id:
+        query_params.append(user_api_key_dict.user_id)
+        scope_conditions.append(f"user_id = ${len(query_params)}")
+
+    # Look up the user's teams from the user table
+    user_teams: List[str] = []
+    if user_api_key_dict.user_id:
+        user_row = await prisma_client.db.litellm_usertable.find_unique(
+            where={"user_id": user_api_key_dict.user_id}
+        )
+        if user_row is not None:
+            user_teams = getattr(user_row, "teams", []) or []
+
+    if user_teams:
+        team_placeholders = ", ".join(
+            f"${len(query_params) + i + 1}" for i in range(len(user_teams))
+        )
+        query_params.extend(user_teams)
+        scope_conditions.append(f"team_id IN ({team_placeholders})")
+
+    if scope_conditions:
+        where_parts.append(f"({' OR '.join(scope_conditions)})")
+    else:
+        # No user_id and no teams — return nothing
+        where_parts.append("FALSE")
+
+
 @router.get(
     "/key/aliases",
     tags=["key management"],
@@ -4306,32 +4342,9 @@ async def key_aliases(
             LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY.value,
         ]
         if not is_proxy_admin:
-            scope_conditions: List[str] = []
-            if user_api_key_dict.user_id:
-                query_params.append(user_api_key_dict.user_id)
-                scope_conditions.append(f"user_id = ${len(query_params)}")
-
-            # Look up the user's teams from the user table
-            user_teams: List[str] = []
-            if user_api_key_dict.user_id:
-                user_row = await prisma_client.db.litellm_usertable.find_unique(
-                    where={"user_id": user_api_key_dict.user_id}
-                )
-                if user_row is not None:
-                    user_teams = getattr(user_row, "teams", []) or []
-
-            if user_teams:
-                team_placeholders = ", ".join(
-                    f"${len(query_params) + i + 1}" for i in range(len(user_teams))
-                )
-                query_params.extend(user_teams)
-                scope_conditions.append(f"team_id IN ({team_placeholders})")
-
-            if scope_conditions:
-                where_parts.append(f"({' OR '.join(scope_conditions)})")
-            else:
-                # No user_id and no teams — return nothing
-                where_parts.append("FALSE")
+            await _apply_non_admin_alias_scope(
+                user_api_key_dict, prisma_client, query_params, where_parts
+            )
 
         if search:
             query_params.append(f"%{search}%")