From acb84668996bfd9b24c9813804104f45f8d5e8d2 Mon Sep 17 00:00:00 2001
From: yuneng <yuneng@berri.ai>
Date: Tue, 22 Sep 2026 02:12:16 +0000
Subject: [PATCH] refactor(jwt): route existing-key lookup through
 VerificationTokenRepository

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/proxy/auth/user_api_key_auth.py       | 16 +-------------
 .../verification_token_repository.py          | 21 ++++++++++++++++++-
 2 files changed, 21 insertions(+), 16 deletions(-)

diff --git a/litellm/proxy/auth/user_api_key_auth.py b/litellm/proxy/auth/user_api_key_auth.py
index 452780d97ba..c9676ab2199 100644
--- a/litellm/proxy/auth/user_api_key_auth.py
+++ b/litellm/proxy/auth/user_api_key_auth.py
@@ -929,21 +929,7 @@ class _PendingAutoRegister(NamedTuple):
 
 
 async def _latest_active_key_hash_for_user(prisma_client: PrismaClient, user_id: str) -> str | None:
-    row: Final = await VerificationTokenRepository(prisma_client).table.find_first(
-        where={  # mutable-ok: the prisma where clause contract is a plain dict
-            "user_id": user_id,
-            "AND": [  # mutable-ok: prisma filter literal
-                {"OR": [{"blocked": False}, {"blocked": None}]},  # mutable-ok: prisma filter literal
-                {  # mutable-ok: prisma filter literal
-                    "OR": [  # mutable-ok: prisma filter literal
-                        {"expires": None},  # mutable-ok: prisma filter literal
-                        {"expires": {"gt": datetime.now(timezone.utc)}},  # mutable-ok: prisma filter literal
-                    ]
-                },
-            ],
-        },
-        order={"created_at": "desc"},  # mutable-ok: prisma order literal
-    )
+    row: Final = await VerificationTokenRepository(prisma_client).find_latest_active_row_by_user_id(user_id)
     return None if row is None else row.token
 
 
diff --git a/litellm/repositories/verification_token_repository.py b/litellm/repositories/verification_token_repository.py
index d02c2114136..63f0bb030d9 100644
--- a/litellm/repositories/verification_token_repository.py
+++ b/litellm/repositories/verification_token_repository.py
@@ -4,7 +4,7 @@ VerificationToken repository for database operations on LiteLLM_VerificationToke
 
 import json
 from collections.abc import Mapping, Sequence
-from datetime import datetime
+from datetime import datetime, timezone
 from types import TracebackType
 from typing import TYPE_CHECKING, Final, Protocol
 
@@ -123,6 +123,25 @@ class VerificationTokenRepository(BaseRepository[LiteLLM_VerificationToken]):
         records: Final[Sequence[PrismaVerificationToken]] = await self.table.find_many(where={"user_id": user_id})
         return self._to_model_list(records)
 
+    async def find_latest_active_row_by_user_id(self, user_id: str) -> "PrismaVerificationToken | None":
+        """Find the most recently created non-blocked, non-expired token row for a user."""
+        row: Final = await self.table.find_first(
+            where={  # mutable-ok: the prisma where clause contract is a plain dict
+                "user_id": user_id,
+                "AND": [  # mutable-ok: prisma filter literal
+                    {"OR": [{"blocked": False}, {"blocked": None}]},  # mutable-ok: prisma filter literal
+                    {  # mutable-ok: prisma filter literal
+                        "OR": [  # mutable-ok: prisma filter literal
+                            {"expires": None},  # mutable-ok: prisma filter literal
+                            {"expires": {"gt": datetime.now(timezone.utc)}},  # mutable-ok: prisma filter literal
+                        ]
+                    },
+                ],
+            },
+            order={"created_at": "desc"},  # mutable-ok: prisma order literal
+        )
+        return row
+
     async def find_by_team_id(self, team_id: str) -> list[LiteLLM_VerificationToken]:
         """Find all tokens belonging to a team."""
         records: Final[Sequence[PrismaVerificationToken]] = await self.table.find_many(where={"team_id": team_id})