mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-16 23:41:43 +00:00
8f401a8aaf
Move the admin surface toward explicit, backend-owned routers instead of trimming the proxy app by path allowlist. This adds a backend/routers package whose teams router is the source of truth for /admin/teams CRUD plus membership; proxy_server imports and mounts it (guarded by the backend package being importable, since the pip wheel ships only litellm), and backend/main keeps those explicit routes regardless of the allowlist. Every route authenticates through the auth_v2 AuthSecurity stored on app.state.auth_v2 (a require_roles gate over the Principal) rather than the legacy user_api_key_auth dependency; app.state.auth_v2 is wired in the proxy startup once the DB is connected. Two resolver fixes were needed to make the DB-backed path actually work, since it was previously only exercised against an in-memory store: API-key principals now resolve their platform role from the owning user (get_key_object does not join user_role onto the token), and team group writes wrap members_with_roles in prisma Json so upsert_group persists. db_team_to_scim now carries members so team membership round-trips on read.
15 lines
631 B
Python
15 lines
631 B
Python
"""Admin routes owned by the backend (control plane).
|
|
|
|
These routers are the source of truth for the admin surface: they are defined
|
|
here and imported by ``litellm.proxy.proxy_server`` (which mounts them when the
|
|
backend package is importable) and served directly by ``backend.main``. Each
|
|
route authenticates through the ``auth_v2`` ``AuthSecurity`` stored on
|
|
``app.state.auth_v2`` rather than the legacy ``user_api_key_auth`` dependency.
|
|
"""
|
|
|
|
from .teams import ADMIN_PREFIX
|
|
from .teams import router as admin_teams_router
|
|
|
|
admin_routers = (admin_teams_router,)
|
|
|
|
__all__ = ["ADMIN_PREFIX", "admin_routers", "admin_teams_router"]
|