fix(proxy): honor exclude_team_ids on the team tags page

The tags page took its team from team_ids alone, so a team that was both
named and excluded still returned its tag spend, while the aggregated team
report returned nothing for the same request. It now returns an empty page
after the permission check. Also drops a comment that restated the code.

litellm/proxy/management_endpoints/daily_activity_routes.py

@@ -64,6 +64,7 @@ from litellm.types.repositories.daily_activity import (
     ExportType,
     KeyMetadataRow,
     KeySpendRow,
+    TagPage,
     UserMetadataRow,
     UserSpendRow,
 )
@@ -406,11 +407,10 @@ def _register_tag_page_route(router: APIRouter, resolver: EntityScopeResolver, p
                 prisma_client,
                 user_aggregated=False,
             )
-            page: Final = await repository.tag_page(
-                resolved.scope,
-                team_id=team_ids[0],
-                offset=offset,
-                limit=limit,
+            page: Final = (
+                TagPage(rows=(), total_tags=0)
+                if team_ids[0] in resolved.scope.exclude_entity_ids
+                else await repository.tag_page(resolved.scope, team_id=team_ids[0], offset=offset, limit=limit)
             )
             return DailyActivityTagPageResponse(
                 tags=list(page.rows),

litellm/repositories/daily_activity_sql.py

@@ -117,7 +117,6 @@ def build_where_clause(scope: DailyActivityScope, *, start_index: int = 1) -> tu
     return " AND ".join(conditions), params
 
 
-# Same rule as common_daily_activity._is_user_agent_tag
 _NOT_USER_AGENT_TAG: Final = "NOT (LOWER(BTRIM(tag)) LIKE 'user-agent:%' OR LOWER(BTRIM(tag)) LIKE 'user agent:%')"
 
 

tests/unit/proxy/management_endpoints/test_daily_activity_routes.py

@@ -1378,6 +1378,20 @@ def test_team_tag_page_returns_404_for_a_non_member(
     repository.tag_page.assert_not_awaited()
 
 
+def test_team_tag_page_is_empty_for_a_team_that_is_also_excluded(
+    daily_activity_client: tuple[TestClient, _FakeRepository],
+) -> None:
+    client, repository = daily_activity_client
+    response: Final = client.get(
+        "/team/daily/activity/aggregated/tags",
+        params={**_entity_params("team_ids", "team-a"), "exclude_team_ids": "team-a", "offset": 0, "limit": 5},
+    )
+
+    assert response.status_code == 200, response.text
+    assert response.json() == {"tags": [], "total_tags": 0, "offset": 0, "limit": 5}
+    repository.tag_page.assert_not_awaited()
+
+
 def test_team_aggregated_ignores_group_by_and_reads_the_team_table(
     daily_activity_client: tuple[TestClient, _FakeRepository],
 ) -> None: