scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-10 22:41:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 82

[Fix] RBAC: Add /invitation/info to admin_viewer_routes

Browse source 
Greptile review caught that the /invitation/info handler relaxation was
dead code: the route_checks layer rejects admin viewers before the handler
runs because /invitation/info was never added to admin_viewer_routes.

Add /invitation/info to admin_viewer_routes and extend the route-level
parametrized test to cover it.

The handler-level integration test passed previously because
`app.dependency_overrides[user_api_key_auth]` bypasses route_checks; this
new route-level test exercises the layer that production traffic hits.
This commit is contained in:
Yuneng Jiang 2026-04-29 19:27:25 -07:00
parent cfda5e17ac
commit f81fbdabe6
No known key found for this signature in database
2 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
litellm/proxy/_types.py
View file

@ -756,6 +756,8 @@ class LiteLLMRoutes(enum.Enum):
"/config/field/info",
"/budget/list",
"/budget/settings",
# Invitation viewing (admin viewer cannot create/delete; can read).
"/invitation/info",
# Model cost map maintenance views (read-only status / source).
"/schedule/model_cost_map_reload/status",
"/model/cost_map/source",

2
tests/test_litellm/proxy/auth/test_route_checks.py
View file

@ -1323,6 +1323,8 @@ ADMIN_VIEWER_SETTINGS_ROUTES = [
# Budgets page
"/budget/list",
"/budget/settings",
# Invitation viewing (admin viewer cannot create/delete; can read)
"/invitation/info",
# Model cost map (read-only status / source)
"/schedule/model_cost_map_reload/status",
"/model/cost_map/source",