diff --git a/litellm/proxy/auth/auth_checks.py b/litellm/proxy/auth/auth_checks.py index 8887d86570a..0a8712d2c56 100644 --- a/litellm/proxy/auth/auth_checks.py +++ b/litellm/proxy/auth/auth_checks.py @@ -7060,6 +7060,7 @@ async def _check_team_member_budget( ) if team_member_budget is not None: + valid_token.team_member_budget = team_member_budget # rebind-ok: carrier for router fallback checks team_member_spend = (loaded_membership.spend if loaded_membership is not None else 0.0) or 0.0 # Read from cross-pod counter (Redis-first) if available diff --git a/litellm/proxy/auth/fallback_budget.py b/litellm/proxy/auth/fallback_budget.py index a126a53821b..bd85398fd4c 100644 --- a/litellm/proxy/auth/fallback_budget.py +++ b/litellm/proxy/auth/fallback_budget.py @@ -130,6 +130,18 @@ async def is_token_within_budget_for_model( if is_model_cost_zero(model=model, llm_router=llm_router): return True + # Gating check: team member overall budget within their team. + # Prevents zero-cost models with paid fallbacks from exceeding the member's team budget cap. + team_member_budget: Final = valid_token.team_member_budget + if team_member_budget is not None and valid_token.user_id is not None and valid_token.team_id is not None: + team_member_spend: Final = await _counter_spend( + counter_key=f"spend:team_member:{valid_token.user_id}:{valid_token.team_id}", + fallback_spend=valid_token.team_member_spend or 0.0, + max_budget=team_member_budget, + ) + if team_member_spend >= team_member_budget: + return False + key_budget: Final = valid_token.max_budget if key_budget is not None and valid_token.token is not None: key_spend: Final = await _counter_spend( diff --git a/litellm/proxy/auth/team_grants.py b/litellm/proxy/auth/team_grants.py index a48bb12cfb7..0a66af65998 100644 --- a/litellm/proxy/auth/team_grants.py +++ b/litellm/proxy/auth/team_grants.py @@ -73,6 +73,7 @@ class TeamGrants(TypedDict, total=False): team_member_spend: ReadOnly[float | None] team_member_tpm_limit: ReadOnly[int | None] team_member_rpm_limit: ReadOnly[int | None] + team_member_budget: ReadOnly[float | None] _TEAM_GRANT_AUTH_FIELDS: Final[frozenset[str]] = frozenset( @@ -210,4 +211,9 @@ def team_grants( team_member_rpm_limit=( team_membership.safe_get_team_member_rpm_limit() if team_membership is not None else None ), + team_member_budget=( + team_membership.litellm_budget_table.max_budget + if team_membership is not None and team_membership.litellm_budget_table is not None + else None + ), ) diff --git a/litellm/proxy/auth/user_api_key_auth.py b/litellm/proxy/auth/user_api_key_auth.py index 27fa4731baf..101fbf6111a 100644 --- a/litellm/proxy/auth/user_api_key_auth.py +++ b/litellm/proxy/auth/user_api_key_auth.py @@ -2976,6 +2976,7 @@ async def validate_resolved_virtual_key( # noqa: C901 # Preserve ordering of e team_member_budget: Final = team_member_info.litellm_budget_table.effective_max_budget( now=datetime.now(timezone.utc), ) + valid_token.team_member_budget = team_member_budget # rebind-ok: carrier for router fallback checks if team_member_budget is not None and team_member_budget > 0: # Read from cross-pod counter (Redis-first) if available from litellm.proxy.proxy_server import get_current_spend diff --git a/litellm/proxy/utils.py b/litellm/proxy/utils.py index b01f53c8c6b..dfbc1e5a308 100644 --- a/litellm/proxy/utils.py +++ b/litellm/proxy/utils.py @@ -5771,6 +5771,7 @@ class PrismaClient: tm.spend AS team_member_spend, b_tm.tpm_limit AS team_member_tpm_limit, b_tm.rpm_limit AS team_member_rpm_limit, + b_tm.max_budget AS team_member_budget, m.aliases AS team_model_aliases, -- Added comma to separate b.* columns b.max_budget AS litellm_budget_table_max_budget, diff --git a/litellm/types/proxy/auth/user_api_key_auth.py b/litellm/types/proxy/auth/user_api_key_auth.py index c2f7c487b7b..6e9c115a2e6 100644 --- a/litellm/types/proxy/auth/user_api_key_auth.py +++ b/litellm/types/proxy/auth/user_api_key_auth.py @@ -78,6 +78,7 @@ class LiteLLM_VerificationTokenView(LiteLLM_VerificationToken): team_member_spend: float | None = None team_member_tpm_limit: int | None = None team_member_rpm_limit: int | None = None + team_member_budget: float | None = None # End User Params end_user_id: str | None = None diff --git a/tests/unit/proxy/auth/test_fallback_budget.py b/tests/unit/proxy/auth/test_fallback_budget.py index 1117ca43657..4e7574819da 100644 --- a/tests/unit/proxy/auth/test_fallback_budget.py +++ b/tests/unit/proxy/auth/test_fallback_budget.py @@ -115,6 +115,16 @@ async def test_paid_target_refused_when_over_user_budget(): token = _token(user_spend=1900.0, user_max_budget=50.0) assert await is_token_within_budget_for_model(model="paid-model", valid_token=token, llm_router=_router()) is False +@pytest.mark.asyncio +async def test_paid_target_refused_when_over_team_member_budget(): + token = _token(user_id="u1", team_id="t1", team_member_budget=50.0, team_member_spend=100.0) + assert await is_token_within_budget_for_model(model="paid-model", valid_token=token, llm_router=_router()) is False + +@pytest.mark.asyncio +async def test_paid_target_allowed_when_under_team_member_budget(): + token = _token(user_id="u1", team_id="t1", team_member_budget=50.0, team_member_spend=10.0) + assert await is_token_within_budget_for_model(model="paid-model", valid_token=token, llm_router=_router()) is True + @pytest.mark.asyncio async def test_team_member_budget_refuses_an_exhausted_paid_target() -> None: diff --git a/tests/unit/proxy/auth/test_team_grants.py b/tests/unit/proxy/auth/test_team_grants.py index f74531beaf0..39f9e063cde 100644 --- a/tests/unit/proxy/auth/test_team_grants.py +++ b/tests/unit/proxy/auth/test_team_grants.py @@ -50,7 +50,7 @@ def _membership() -> LiteLLM_TeamMembership: user_id=USER_ID, team_id=TEAM_ID, spend=3.25, - litellm_budget_table=LiteLLM_BudgetTable(tpm_limit=500, rpm_limit=5), + litellm_budget_table=LiteLLM_BudgetTable(tpm_limit=500, rpm_limit=5, max_budget=100.0), ) @@ -85,6 +85,7 @@ def test_team_grants_cover_every_team_field_the_key_path_gets(): assert token.team_member_spend == 3.25 assert token.team_member_tpm_limit == 500 assert token.team_member_rpm_limit == 5 + assert token.team_member_budget == 100.0 def test_team_grants_without_team_leave_token_defaults(): diff --git a/ui/litellm-dashboard/src/lib/http/schema.d.ts b/ui/litellm-dashboard/src/lib/http/schema.d.ts index 2b6898e39d9..579041248e6 100644 --- a/ui/litellm-dashboard/src/lib/http/schema.d.ts +++ b/ui/litellm-dashboard/src/lib/http/schema.d.ts @@ -49273,6 +49273,8 @@ export interface components { /** Team Max Budget */ team_max_budget?: number | null; team_member?: components["schemas"]["Member"] | null; + /** Team Member Budget */ + team_member_budget?: number | null; /** Team Member Rpm Limit */ team_member_rpm_limit?: number | null; /** Team Member Spend */