scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-29 01:42:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 100

refactor(auth): sync session token team grants from resolved team object

Browse source 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit is contained in:
jesus 2026-09-09 00:04:31 +00:00
parent d1fdf64aa8
commit a443a68347
1 changed files with 3 additions and 36 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
litellm/proxy/auth/user_api_key_auth.py
View file

@ -1742,15 +1742,6 @@ async def _user_api_key_auth_builder(
):
valid_token = ExperimentalUIJWTToken.get_key_object_from_ui_hash_key(api_key)
if valid_token is not None and valid_token.is_session_token:
valid_token = await _refresh_session_token_team_grants(
valid_token=valid_token,
prisma_client=prisma_client,
user_api_key_cache=user_api_key_cache,
parent_otel_span=parent_otel_span,
proxy_logging_obj=proxy_logging_obj,
)
if (
valid_token is not None
and isinstance(valid_token, UserAPIKeyAuth)
@ -2214,6 +2205,9 @@ async def _user_api_key_auth_builder(
# guardrails (or any other metadata) added after the key was cached
# are picked up on subsequent requests without a cache eviction.
valid_token.team_metadata = _team_obj.metadata
if valid_token.is_session_token:
valid_token.team_models = list(_team_obj.models) # mutable-ok: auth model requires a fresh list
valid_token.team_alias = _team_obj.team_alias
else:
valid_token.team_object_permission = None
@ -2353,33 +2347,6 @@ def _team_obj_from_token(valid_token: UserAPIKeyAuth) -> LiteLLM_TeamTableCached
)
async def _refresh_session_token_team_grants(
valid_token: UserAPIKeyAuth,
prisma_client: PrismaClient | None,
user_api_key_cache: UserApiKeyCache,
parent_otel_span: Span | None,
proxy_logging_obj: ProxyLogging,
) -> UserAPIKeyAuth:
if valid_token.team_id is None or valid_token.team_id == UI_TEAM_ID or prisma_client is None:
return valid_token
try:
team_obj: Final = await get_team_object(
team_id=valid_token.team_id,
prisma_client=prisma_client,
user_api_key_cache=user_api_key_cache,
parent_otel_span=parent_otel_span,
proxy_logging_obj=proxy_logging_obj,
)
except HTTPException:
return valid_token
return valid_token.model_copy(
update={ # mutable-ok: model_copy requires a mutable update mapping
"team_models": list(team_obj.models), # mutable-ok: auth model requires a fresh list
"team_alias": team_obj.team_alias,
}
)
def _token_can_vouch_for_team(valid_token: UserAPIKeyAuth, lookup_error: BaseException) -> bool:
"""Whether the token's own team fields may stand in for a team that failed to
resolve, without widening access.