From 6c918acf285673b81365842a82071610a517ba76 Mon Sep 17 00:00:00 2001
From: Ishaan Jaffer <ishaan@berri.ai>
Date: Fri, 24 Apr 2026 19:52:01 -0700
Subject: [PATCH] test: verify /project/list and /project/info accessible to
 non-admin users

Add parametrized test covering internal_user, internal_user_viewer, and
proxy_admin_viewer roles against both project routes to ensure the
route-check middleware lets them through.
---
 .../proxy/auth/test_route_checks.py           | 41 +++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/tests/test_litellm/proxy/auth/test_route_checks.py b/tests/test_litellm/proxy/auth/test_route_checks.py
index bca6b9e78d9..d4774a189ad 100644
--- a/tests/test_litellm/proxy/auth/test_route_checks.py
+++ b/tests/test_litellm/proxy/auth/test_route_checks.py
@@ -1327,6 +1327,47 @@ def test_available_roles_accessible_to_non_admin_users(user_role):
     )
 
 
+@pytest.mark.parametrize(
+    "route",
+    ["/project/list", "/project/info"],
+)
+@pytest.mark.parametrize(
+    "user_role",
+    [
+        LitellmUserRoles.INTERNAL_USER.value,
+        LitellmUserRoles.INTERNAL_USER_VIEW_ONLY.value,
+        LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY.value,
+    ],
+)
+def test_project_routes_accessible_to_non_admin_users(route, user_role):
+    """
+    /project/list and /project/info should be reachable by non-admin users.
+    The endpoints themselves enforce team-membership access control, so the
+    route-check middleware must let non-admin callers through.
+    """
+    user_obj = LiteLLM_UserTable(
+        user_id="test_user",
+        user_email="test@example.com",
+        user_role=user_role,
+    )
+    valid_token = UserAPIKeyAuth(
+        user_id="test_user",
+        user_role=user_role,
+    )
+    request = MagicMock(spec=Request)
+    request.query_params = {}
+
+    # Should not raise — project list/info are in self_managed_routes
+    RouteChecks.non_proxy_admin_allowed_routes_check(
+        user_obj=user_obj,
+        _user_role=user_role,
+        route=route,
+        request=request,
+        valid_token=valid_token,
+        request_data={},
+    )
+
+
 # ── _user_is_org_admin tests ──────────────────────────────────────────────────
 
 from datetime import datetime