From 8001e5be17d54de18a2cdc28965fdeb686e7cc29 Mon Sep 17 00:00:00 2001
From: er-s-an <92594860+er-s-an@users.noreply.github.com>
Date: Sun, 18 Oct 2026 09:58:06 +0800
Subject: [PATCH] fix(proxy): avoid reportArgumentType when writing parsed
 permissions

Assign json.loads result like aliases/config/metadata, then cast only at
the refuse-helper call site so dict[str, object] is not written into the
typed saved_token __setitem__ slot (basedpyright reportArgumentType).
---
 .../key_management_endpoints.py                     | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/litellm/proxy/management_endpoints/key_management_endpoints.py b/litellm/proxy/management_endpoints/key_management_endpoints.py
index a402adafcd3..2fec88964ca 100644
--- a/litellm/proxy/management_endpoints/key_management_endpoints.py
+++ b/litellm/proxy/management_endpoints/key_management_endpoints.py
@@ -5288,13 +5288,16 @@ async def generate_key_helper_fn(
         if isinstance(saved_token["metadata"], str):
             saved_token["metadata"] = json.loads(saved_token["metadata"])
         if isinstance(saved_token["permissions"], str):
-            parsed_permissions: Final = cast(  # cast-ok: permissions column stores a JSON object of permission flags
-                dict[str, object], json.loads(saved_token["permissions"])
-            )
+            # Same json.loads → assign pattern as aliases/config/metadata above.
+            saved_token["permissions"] = json.loads(saved_token["permissions"])
             # Refuse only when the permission is requested (truthy). An explicit
             # false must not trip a substring check on the serialized JSON.
-            _refuse_get_spend_routes_unless_premium(parsed_permissions, premium_user)
-            saved_token["permissions"] = parsed_permissions
+            _refuse_get_spend_routes_unless_premium(
+                cast(  # cast-ok: permissions column stores a JSON object of permission flags
+                    dict[str, object], saved_token["permissions"]
+                ),
+                premium_user,
+            )
         if isinstance(saved_token["model_max_budget"], str):
             saved_token["model_max_budget"] = json.loads(saved_token["model_max_budget"])
         router_settings = cast(dict | None, saved_token.get("router_settings"))