diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py index 36790e9feae..6a556417078 100644 --- a/litellm/proxy/_types.py +++ b/litellm/proxy/_types.py @@ -684,6 +684,8 @@ class LiteLLMRoutes(enum.Enum): "/team/daily/activity", "/tag/daily/activity", "/tag/list", + "/audit", + "/audit/{id}", ] + info_routes # All routes accesible by an Org Admin diff --git a/tests/test_litellm/proxy/auth/test_route_checks.py b/tests/test_litellm/proxy/auth/test_route_checks.py index c16ee783797..f20c14aa611 100644 --- a/tests/test_litellm/proxy/auth/test_route_checks.py +++ b/tests/test_litellm/proxy/auth/test_route_checks.py @@ -976,6 +976,43 @@ def test_proxy_admin_viewer_can_access_global_spend_tags(): ) +@pytest.mark.parametrize("route", ["/audit", "/audit/some-log-id"]) +def test_proxy_admin_viewer_can_access_audit_logs(route): + """ + Test that proxy_admin_viewer can access /audit endpoints. + + Admin viewers should be able to view audit logs since these are read-only. + """ + + user_obj = LiteLLM_UserTable( + user_id="viewer_user", + user_email="viewer@example.com", + user_role=LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY.value, + ) + + valid_token = UserAPIKeyAuth( + user_id="viewer_user", + user_role=LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY.value, + ) + + request = MagicMock(spec=Request) + request.query_params = {} + + try: + RouteChecks.non_proxy_admin_allowed_routes_check( + user_obj=user_obj, + _user_role=LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY.value, + route=route, + request=request, + valid_token=valid_token, + request_data={}, + ) + except Exception as e: + pytest.fail( + f"proxy_admin_viewer should be able to access {route} route. Got error: {str(e)}" + ) + + class TestModelsRouteExemptFromDisableLLMEndpoints: """ Test that /models and /v1/models are exempt from DISABLE_LLM_API_ENDPOINTS.