ryan-crabbe-berri 632b69b5c8 refactor(proxy): answer every team access check with TeamAccess.allows (#43364) ... * refactor(proxy): route every team-admin decision through auth/team_access.py Move the six team-admin helpers out of common_utils, team_endpoints and key_management_endpoints into litellm/proxy/auth/team_access.py under public names, and point every management route and helper at them. The key routes keep checking team admin before org admin, so a team admin whose user row is gone still passes as before. Status codes and bodies are unchanged, which the 223-case team-admin matrix confirms at the merge base and at the tip common_utils keeps `_is_user_team_admin` as an alias because the published litellm-enterprise 0.1.71 wheel still imports it from there * refactor(proxy): answer every team access check with TeamAccess.allows Replace the six helpers in auth/team_access.py with one resolver in litellm/proxy/management/teams/access.py. Each route passes the roles it accepts (TEAM_OR_ORG_ADMIN or TEAM_ADMIN_ONLY), and /team/update and /team/info rank roles through strongest_role so org admin still outranks team admin there The org lookup moves behind an OrgRoles protocol, implemented by PrismaOrgRoles in management/users/service.py, and get_team_access in management/teams/dependencies.py is the only place that reads proxy_server globals. _check_key_admin_access keeps its name and body from main Routes that checked org admin first now read the roster first, so a team admin whose org lookup errors now passes on /team/delete, /team/block, /team/unblock, member reset_spend and reset_budget, and the team callback routes. No allowed caller is denied		2026-09-30 15:27:33 -07:00
..
_experimental	feat(mcp): scan and pin upstream tool descriptions (#43283)	2026-09-28 18:38:49 -07:00
auth	perf(proxy): hold one spend counter batch across admission and across post-call accounting (#43369)	2026-09-29 15:05:33 -07:00
common_utils	feat(router): opt in to prompt-cache cost routing (#43232)	2026-09-26 18:13:13 -07:00
db	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
example_config_yaml	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
google_endpoints	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
guardrails	feat(guardrails): send a configured gateway_name from noma_v2 to Noma (#43678)	2026-09-29 10:20:40 -07:00
hooks	fix(router): await budget redis pipeline before sync reads (internal copy of #32618) (#43125)	2026-09-24 22:27:13 -07:00
management	refactor(proxy): answer every team access check with TeamAccess.allows (#43364)	2026-09-30 15:27:33 -07:00
management_endpoints	feat(proxy): add native ROI calculator for gateway spend vs merged PRs (#43669)	2026-09-30 14:16:41 -07:00
management_helpers	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
middleware	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
public_endpoints	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
response_polling	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
roi_calculator	feat(proxy): add native ROI calculator for gateway spend vs merged PRs (#43669)	2026-09-30 14:16:41 -07:00
spend_tracking	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_configs	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
__init__.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
conftest.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_aproxy_startup.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_credential_slot_registry.py	test(proxy): classify every credential-bearing param for the canary suite (#43298)	2026-09-29 18:11:12 +00:00
test_custom_callback_input.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_custom_logger_s3_gcs.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_custom_tokenizer_bug.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_db_schema_changes.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_deprecated_key_grace_period.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_get_favicon.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_get_image.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_prisma_client_backoff_retry.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_prompt_test_endpoint.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_proxy_config_unit_test.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_proxy_custom_auth.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_proxy_reject_logging.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_proxy_server.py	fix(ci): stop stale CI reds, keep unit tests off the host env, retry CyberArk policy conflicts (#43294)	2026-09-26 09:25:13 -07:00
test_proxy_setting_guardrails.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_proxy_token_counter.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_proxy_utils.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_reducto_ocr_route.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_response_polling_pre_call_checks.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_server_root_path.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_ui_path_detection.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_unit_test_proxy_hooks.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_update_spend.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_zero_cost_model_budget_bypass.py	fix(proxy): resolve model_group_alias in the zero-cost budget predicate (#43512)	2026-09-28 21:46:33 -07:00
vertex_key.json	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00