feat: add search_tools field to ObjectPermission schema and types

- Add search_tools String[] column to LiteLLM_ObjectPermissionTable in all 3 Prisma schema files
- Add Prisma migration for the new column
- Add search_tools field to LiteLLM_ObjectPermissionBase and LiteLLM_ObjectPermissionTable Python types
- Add ProxyErrorTypes for search tool access denied (key, team, org)
- Add get_search_tool_access_error_type_for_object() classmethod to ProxyErrorTypes

Co-authored-by: yuneng-jiang <yuneng-jiang@users.noreply.github.com>

litellm-proxy-extras/litellm_proxy_extras/migrations/20260319000000_add_search_tools_to_object_permissions/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_ObjectPermissionTable" ADD COLUMN     "search_tools" TEXT[] DEFAULT ARRAY[]::TEXT[];

litellm-proxy-extras/litellm_proxy_extras/schema.prisma

@@ -269,6 +269,7 @@ model LiteLLM_ObjectPermissionTable {
   mcp_access_groups     String[]       @default([])
   mcp_tool_permissions  Json?          // Tool-level permissions for MCP servers. Format: {"server_id": ["tool_name_1", "tool_name_2"]}
   vector_stores         String[]       @default([])
+  search_tools          String[]       @default([]) // Search tool names allowed for this key/team/org. Empty = no access (least privilege).
   agents                String[]       @default([])
   agent_access_groups   String[]       @default([])
   models                String[]       @default([])

litellm/proxy/_types.py

@@ -856,6 +856,7 @@ class LiteLLM_ObjectPermissionBase(LiteLLMPydanticObjectBase):
     mcp_access_groups: Optional[List[str]] = None
     mcp_tool_permissions: Optional[Dict[str, List[str]]] = None
     vector_stores: Optional[List[str]] = None
+    search_tools: Optional[List[str]] = None
     agents: Optional[List[str]] = None
     agent_access_groups: Optional[List[str]] = None
     models: Optional[List[str]] = None
@@ -1843,6 +1844,7 @@ class LiteLLM_ObjectPermissionTable(LiteLLMPydanticObjectBase):
     """
 
     vector_stores: Optional[List[str]] = []
+    search_tools: Optional[List[str]] = []
     agents: Optional[List[str]] = []
     agent_access_groups: Optional[List[str]] = []
 
@@ -3527,6 +3529,21 @@ class ProxyErrorTypes(str, enum.Enum):
     Organization does not have access to the vector store
     """
 
+    key_search_tool_access_denied = "key_search_tool_access_denied"
+    """
+    Key does not have access to the search tool
+    """
+
+    team_search_tool_access_denied = "team_search_tool_access_denied"
+    """
+    Team does not have access to the search tool
+    """
+
+    org_search_tool_access_denied = "org_search_tool_access_denied"
+    """
+    Organization does not have access to the search tool
+    """
+
     team_member_already_in_team = "team_member_already_in_team"
     """
     Team member is already in team
@@ -3569,6 +3586,20 @@ class ProxyErrorTypes(str, enum.Enum):
         elif object_type == "org":
             return cls.org_vector_store_access_denied
 
+    @classmethod
+    def get_search_tool_access_error_type_for_object(
+        cls, object_type: Literal["key", "team", "org"]
+    ) -> "ProxyErrorTypes":
+        """
+        Get the search tool access error type for object_type
+        """
+        if object_type == "key":
+            return cls.key_search_tool_access_denied
+        elif object_type == "team":
+            return cls.team_search_tool_access_denied
+        elif object_type == "org":
+            return cls.org_search_tool_access_denied
+
 
 DB_CONNECTION_ERROR_TYPES = (
     httpx.ConnectError,

litellm/proxy/schema.prisma

@@ -269,6 +269,7 @@ model LiteLLM_ObjectPermissionTable {
   mcp_access_groups     String[]       @default([])
   mcp_tool_permissions  Json?          // Tool-level permissions for MCP servers. Format: {"server_id": ["tool_name_1", "tool_name_2"]}
   vector_stores         String[]       @default([])
+  search_tools          String[]       @default([]) // Search tool names allowed for this key/team/org. Empty = no access (least privilege).
   agents                String[]       @default([])
   agent_access_groups   String[]       @default([])
   models                String[]       @default([])

schema.prisma

@@ -269,6 +269,7 @@ model LiteLLM_ObjectPermissionTable {
   mcp_access_groups     String[]       @default([])
   mcp_tool_permissions  Json?          // Tool-level permissions for MCP servers. Format: {"server_id": ["tool_name_1", "tool_name_2"]}
   vector_stores         String[]       @default([])
+  search_tools          String[]       @default([]) // Search tool names allowed for this key/team/org. Empty = no access (least privilege).
   agents                String[]       @default([])
   agent_access_groups   String[]       @default([])
   models                String[]       @default([])