fix(proxy): resolve CodeQL findings on team list, sanitize log args and move UserNotFoundError out of the import cycle

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

litellm/proxy/_types.py

@@ -3954,6 +3954,13 @@ class ManagementEndpointLoggingPayload(LiteLLMPydanticObjectBase):
     end_time: datetime | None = None
 
 
+class UserNotFoundError(ValueError):
+    """The user row is provably absent, as opposed to merely unreadable, so a caller that reads a missing row as no user-level limits can key on it without also swallowing a database that would not answer."""
+
+    def __init__(self, user_id: str) -> None:
+        super().__init__(f"User doesn't exist in db. 'user_id'={user_id}. Create user via `/user/new` call.")
+
+
 class ProxyException(Exception):
     # NOTE: DO NOT MODIFY THIS
     # This is used to map exactly to OPENAI Exceptions

litellm/proxy/auth/auth_checks.py

@@ -65,6 +65,7 @@ from litellm.proxy._types import (
     RoleBasedPermissions,
     SpecialModelNames,
     UserAPIKeyAuth,
+    UserNotFoundError,
 )
 from litellm.proxy.auth.budget_throttle import (
     budget_throttle_percentage,
@@ -2375,13 +2376,6 @@ async def _backfill_null_user_email(
     return updated_row
 
 
-class UserNotFoundError(ValueError):
-    """The user row is provably absent, as opposed to merely unreadable, so a caller that reads a missing row as no user-level limits can key on it without also swallowing a database that would not answer."""
-
-    def __init__(self, user_id: str) -> None:
-        super().__init__(f"User doesn't exist in db. 'user_id'={user_id}. Create user via `/user/new` call.")
-
-
 @log_db_metrics
 async def get_user_object(
     user_id: str | None,

litellm/proxy/management_endpoints/team_endpoints.py

@@ -73,10 +73,10 @@ from litellm.proxy._types import (
     TeamModelDeleteRequest,
     UpdateTeamRequest,
     UserAPIKeyAuth,
+    UserNotFoundError,
 )
 from litellm.proxy.auth.auth_checks import (
     OrganizationNotFoundError,
-    UserNotFoundError,
     _cache_team_object,
     allowed_route_check_inside_route,
     can_org_access_model,
@@ -5107,9 +5107,9 @@ async def _enforce_list_team_v2_access(
         )
         verbose_proxy_logger.debug(
             "list_team_v2: org admin access for user=%s, org_ids=%s, user_id_filter=%s",
-            caller_user_id,
+            _sanitize_for_log(caller_user_id),
             org_admin_org_ids,
-            None if is_own_query else user_id,
+            _sanitize_for_log(None if is_own_query else user_id),
         )
         return None if is_own_query else user_id, org_admin_org_ids, own_team_ids