scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-14 23:21:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 102

fix: add explicit admin bypass to agent access checks for consistency

Browse source
This commit is contained in:
Yuneng Jiang 2026-04-16 21:12:09 -07:00
parent cdb29946eb
commit bcb2ea63f1
No known key found for this signature in database
2 changed files with 29 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
litellm/proxy/agent_endpoints/a2a_routing.py
View file

@ -11,7 +11,7 @@ import litellm
from fastapi import HTTPException
from litellm._logging import verbose_proxy_logger
from litellm.proxy._types import UserAPIKeyAuth
from litellm.proxy._types import LitellmUserRoles, UserAPIKeyAuth
async def route_a2a_agent_request(
@ -50,16 +50,21 @@ async def route_a2a_agent_request(
route_name = ROUTE_ENDPOINT_MAPPING.get(route_type, route_type)
raise ProxyModelNotFoundError(route=route_name, model_name=model_name)
# Verify the caller is permitted to use this agent
is_allowed = await AgentRequestHandler.is_agent_allowed(
agent_id=agent.agent_id,
user_api_key_auth=user_api_key_dict,
# Verify the caller is permitted to use this agent (admins bypass the check)
is_admin = user_api_key_dict is not None and (
user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN
or user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value
)
if not is_allowed:
raise HTTPException(
status_code=403,
detail=f"Agent '{agent_name}' is not allowed for your key/team. Contact proxy admin for access.",
if not is_admin:
is_allowed = await AgentRequestHandler.is_agent_allowed(
agent_id=agent.agent_id,
user_api_key_auth=user_api_key_dict,
)
if not is_allowed:
raise HTTPException(
status_code=403,
detail=f"Agent '{agent_name}' is not allowed for your key/team. Contact proxy admin for access.",
)
# Get API base URL from agent config
if not agent.agent_card_params or "url" not in agent.agent_card_params:

25
litellm/proxy/agent_endpoints/endpoints.py
View file

@ -392,19 +392,24 @@ async def get_agent_by_id(
"""
await check_feature_access_for_user(user_api_key_dict, "agents")
from litellm.proxy.agent_endpoints.auth.agent_permission_handler import (
AgentRequestHandler,
is_admin = (
user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN
or user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value
)
is_allowed = await AgentRequestHandler.is_agent_allowed(
agent_id=agent_id, user_api_key_auth=user_api_key_dict
)
if not is_allowed:
raise HTTPException(
status_code=403,
detail=f"Agent '{agent_id}' is not allowed for your key/team. Contact proxy admin for access.",
if not is_admin:
from litellm.proxy.agent_endpoints.auth.agent_permission_handler import (
AgentRequestHandler,
)
is_allowed = await AgentRequestHandler.is_agent_allowed(
agent_id=agent_id, user_api_key_auth=user_api_key_dict
)
if not is_allowed:
raise HTTPException(
status_code=403,
detail=f"Agent '{agent_id}' is not allowed for your key/team. Contact proxy admin for access.",
)
from litellm.proxy.proxy_server import prisma_client
if prisma_client is None: