From 941eaf3ab8074b4ecf77134a11a68a1c1bfe6c73 Mon Sep 17 00:00:00 2001 From: jesus Date: Tue, 8 Sep 2026 18:03:45 +0000 Subject: [PATCH] fix(proxy): read team members straight off the team row in the project permission check Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .../proxy/management_endpoints/project_endpoints.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/enterprise/litellm_enterprise/proxy/management_endpoints/project_endpoints.py b/enterprise/litellm_enterprise/proxy/management_endpoints/project_endpoints.py index 87b467cce4f..ee3bae1fba9 100644 --- a/enterprise/litellm_enterprise/proxy/management_endpoints/project_endpoints.py +++ b/enterprise/litellm_enterprise/proxy/management_endpoints/project_endpoints.py @@ -43,6 +43,7 @@ if TYPE_CHECKING: router = APIRouter() _OBJECT_PERMISSION_PAYLOAD: Final = TypeAdapter(dict[str, object]) +_TEAM_MEMBERS: Final = TypeAdapter(list[Member]) def _team_table(prisma_client: PrismaClient) -> TableActions["prisma_models.LiteLLM_TeamTable"]: @@ -113,12 +114,13 @@ async def _check_user_permission_for_project( if team_row is None: return False - team: Final = LiteLLM_TeamTable.model_validate(team_row.model_dump()) + raw_members: Final = team_row.members_with_roles + members: Final = _TEAM_MEMBERS.validate_python(raw_members) if isinstance(raw_members, list) else () is_role_admin: Final = any( member.user_id is not None and member.user_id == user_api_key_dict.user_id and member.role == "admin" - for member in team.members_with_roles + for member in members ) - return is_role_admin or user_api_key_dict.user_id in (team.admins or []) + return is_role_admin or user_api_key_dict.user_id in (team_row.admins or []) async def _validate_team_exists(