mirror of
https://github.com/BerriAI/litellm.git
synced 2026-08-28 05:25:59 +00:00
255d65192e
Workflow Runs, Memory and Guardrails Monitor were visible to every role while their page-load routes are proxy-admin-only, so a non-admin got a page shell and a 401. Cost Optimization was half-broken the same way: its Overall charts run on /user/daily/activity, which every role may call, but tool spend, prompt caching, prompt compression and auto-router benchmarks are all proxy-admin-only. Add viewWorkflowRuns, viewMemory, viewGuardrailUsage and viewProxyWideCostData, each gating the nav entry, the page and the request together. The first three hide their page, including the direct-URL path, since nothing on them works for a non-admin. Cost Optimization keeps its page and drops only the parts a non-admin cannot read. Gating both Agentic children left roles with no visible child rendering the parent as a leaf link to ?page=agentic, which is not a route, so a parent whose children are all filtered out is now dropped. Role lists follow what the proxy actually grants: proxy_admin and proxy_admin_viewer are served, and org admins are not, because _user_is_org_admin needs an organization_id that a page-load GET never carries. |
||
|---|---|---|
| .. | ||
| litellm-dashboard | ||
| Dockerfile | ||
| nginx.conf | ||