mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-16 23:41:43 +00:00
8f401a8aaf
Move the admin surface toward explicit, backend-owned routers instead of trimming the proxy app by path allowlist. This adds a backend/routers package whose teams router is the source of truth for /admin/teams CRUD plus membership; proxy_server imports and mounts it (guarded by the backend package being importable, since the pip wheel ships only litellm), and backend/main keeps those explicit routes regardless of the allowlist. Every route authenticates through the auth_v2 AuthSecurity stored on app.state.auth_v2 (a require_roles gate over the Principal) rather than the legacy user_api_key_auth dependency; app.state.auth_v2 is wired in the proxy startup once the DB is connected. Two resolver fixes were needed to make the DB-backed path actually work, since it was previously only exercised against an in-memory store: API-key principals now resolve their platform role from the owning user (get_key_object does not join user_role onto the token), and team group writes wrap members_with_roles in prisma Json so upsert_group persists. db_team_to_scim now carries members so team membership round-trips on read. |
||
|---|---|---|
| .. | ||
| auth | ||
| routers | ||
| routes | ||
| Dockerfile | ||
| main.py | ||