From f81fbdabe674b1cb6491d810095a9959f5b94f1a Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Wed, 29 Apr 2026 19:27:25 -0700 Subject: [PATCH] [Fix] RBAC: Add /invitation/info to admin_viewer_routes Greptile review caught that the /invitation/info handler relaxation was dead code: the route_checks layer rejects admin viewers before the handler runs because /invitation/info was never added to admin_viewer_routes. Add /invitation/info to admin_viewer_routes and extend the route-level parametrized test to cover it. The handler-level integration test passed previously because `app.dependency_overrides[user_api_key_auth]` bypasses route_checks; this new route-level test exercises the layer that production traffic hits. --- litellm/proxy/_types.py | 2 ++ tests/test_litellm/proxy/auth/test_route_checks.py | 2 ++ 2 files changed, 4 insertions(+) diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py index 522bb47936d..2ce8d82c833 100644 --- a/litellm/proxy/_types.py +++ b/litellm/proxy/_types.py @@ -756,6 +756,8 @@ class LiteLLMRoutes(enum.Enum): "/config/field/info", "/budget/list", "/budget/settings", + # Invitation viewing (admin viewer cannot create/delete; can read). + "/invitation/info", # Model cost map maintenance views (read-only status / source). "/schedule/model_cost_map_reload/status", "/model/cost_map/source", diff --git a/tests/test_litellm/proxy/auth/test_route_checks.py b/tests/test_litellm/proxy/auth/test_route_checks.py index 4c8832dee60..f85384bcb77 100644 --- a/tests/test_litellm/proxy/auth/test_route_checks.py +++ b/tests/test_litellm/proxy/auth/test_route_checks.py @@ -1323,6 +1323,8 @@ ADMIN_VIEWER_SETTINGS_ROUTES = [ # Budgets page "/budget/list", "/budget/settings", + # Invitation viewing (admin viewer cannot create/delete; can read) + "/invitation/info", # Model cost map (read-only status / source) "/schedule/model_cost_map_reload/status", "/model/cost_map/source",