fix(sso): type the sso team list so the basedpyright gate stays at its ceiling

litellm/proxy/management_endpoints/ui_sso.py

@@ -1241,7 +1241,7 @@ def generic_response_convertor(
     )
 
     token: Final = cast(dict[str, object], response)  # cast-ok: the IdP userinfo JSON object fastapi-sso hands back
-    all_teams: Final = []
+    all_teams: Final = list[str]()
     if sso_jwt_handler is not None:
         team_ids = sso_jwt_handler.get_all_jwt_team_ids(token)
         all_teams.extend(team_ids)
@@ -1274,9 +1274,7 @@ def generic_response_convertor(
         if not isinstance(scalar_team_id, str) or scalar_team_id in all_teams
         else [*all_teams, scalar_team_id]
     )
-    team_ids_to_join: Final = [
-        team_id for team_id in team_ids_with_scalar if not (isinstance(team_id, str) and not team_id.strip())
-    ]
+    team_ids_to_join: Final = [team_id for team_id in team_ids_with_scalar if team_id.strip()]
 
     # Determine user role based on role_mappings if available
     # Only apply role_mappings for GENERIC SSO provider

tests/integration/authorization/test_jwt_team_claim_upsert.py

@@ -30,7 +30,7 @@ def test_jwt_teams_array_claim_creates_and_joins_every_team_only_when_team_id_up
     gateway: Gateway, tmp_path: Path, team_id_upsert: bool
 ) -> None:
     private_key: Final = rsa.generate_private_key(public_exponent=65537, key_size=2048)
-    public_jwk: Final = jwt.algorithms.RSAAlgorithm.to_jwk(private_key.public_key())
+    public_jwk: Final[str] = jwt.algorithms.RSAAlgorithm.to_jwk(private_key.public_key())
 
     def respond(request: Request) -> Reply:
         assert request.method == "GET", request