scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-09 22:31:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 86

fix(proxy): require admin role for credential management endpoints

Browse source 
Add PROXY_ADMIN role authorization check to credential CRUD endpoints
(POST /credentials, DELETE /credentials/{name}, PATCH /credentials/{name}).

Previously these endpoints only verified authentication (valid API key)
but did not check the caller's role, allowing any authenticated user
to create, modify, or delete credentials.
This commit is contained in:
manusjs 2026-06-16 22:06:53 +00:00
parent 27c1dfbdc7
commit cee37b828d
1 changed files with 16 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
litellm/proxy/credential_endpoints/endpoints.py
View file

@ -10,7 +10,7 @@ import litellm
from litellm._logging import verbose_proxy_logger
from litellm.litellm_core_utils.credential_accessor import CredentialAccessor
from litellm.litellm_core_utils.litellm_logging import _get_masked_values
from litellm.proxy._types import CommonProxyErrors, UserAPIKeyAuth
from litellm.proxy._types import CommonProxyErrors, LitellmUserRoles, UserAPIKeyAuth
from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
from litellm.proxy.common_utils.encrypt_decrypt_utils import encrypt_value_helper
from litellm.proxy.utils import handle_exception_on_proxy, jsonify_object
@ -60,6 +60,11 @@ async def create_credential(
from litellm.proxy.proxy_server import llm_router, prisma_client
try:
if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN:
raise HTTPException(
status_code=403,
detail={"error": "Only proxy admins can manage credentials"},
)
if prisma_client is None:
raise HTTPException(
status_code=500,
@ -241,6 +246,11 @@ async def delete_credential(
from litellm.proxy.proxy_server import prisma_client
try:
if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN:
raise HTTPException(
status_code=403,
detail={"error": "Only proxy admins can manage credentials"},
)
if prisma_client is None:
raise HTTPException(
status_code=500,
@ -320,6 +330,11 @@ async def update_credential(
from litellm.proxy.proxy_server import prisma_client
try:
if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN:
raise HTTPException(
status_code=403,
detail={"error": "Only proxy admins can manage credentials"},
)
if prisma_client is None:
raise HTTPException(
status_code=500,