From ed211998734606bee6882b936ba92ba036bee152 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 26 Jun 2026 02:27:58 +0000 Subject: [PATCH] fix(jwt): keep db-team fallback off for alias-only tokens --- litellm/proxy/auth/handle_jwt.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py index 046755305a9..5967b22c8af 100644 --- a/litellm/proxy/auth/handle_jwt.py +++ b/litellm/proxy/auth/handle_jwt.py @@ -2203,12 +2203,17 @@ class JWTAuthManager: # The DB fallback only applies when the token carries no team identity at # all. `get_all_jwt_team_ids` ignores `team_id_default` so a configured - # default does not hide a claimless token, and `team_id is None` excludes + # default does not hide a claimless token, `get_team_alias` covers + # alias-only tokens so the alias still resolves via + # `find_and_validate_specific_team_id`, and `team_id is None` excludes # the RBAC team-role path (which already set `team_id`); otherwise a # provisional x-litellm-team-id header could override an RBAC-asserted team. db_team_fallback = ( jwt_handler.litellm_jwtauth.fallback_to_db_teams and not jwt_handler.get_all_jwt_team_ids(token=jwt_valid_token) + and not jwt_handler.get_team_alias( + token=jwt_valid_token, default_value=None + ) and team_id is None ) if specific_team_id and not db_team_fallback: