Kishorekarthik P 6632e8b74f fix(proxy): let internal users read request/response for their own spend logs ... The Logs drawer gets messages/response from GET /spend/logs/ui/{request_id}; the list endpoint omits those heavy columns for every caller, admins included. That detail route was missing from LiteLLMRoutes.spend_tracking_routes, and check_route_access anchors patterns, so /spend/logs/ui never matched it. Every internal_user got a 403 before the handler ran and the UI fell back to the "Request/Response Data Not Available" banner, even on their own requests Adds the route to spend_tracking_routes so internal_user, internal_user_view_only, admin_viewer and org_admin all inherit it, and drops the now-redundant explicit entry from admin_viewer_routes. The handler already authorizes non-admins per row via _assert_user_can_view_request_id, so no handler-side scoping change is needed That helper returned silently when no spend-log row existed, which the detail handler treats as authorized before asking every custom logger for the payload by raw request_id. With retention pruning the row can be gone while the payload is still in cold storage, so opening the route would have let a non-admin read another tenant's prompt out of S3/GCS. A missing row now falls through to the same 403 as a foreign row, which also removes the exists-but-not-yours oracle Fixes #34099		2026-09-10 15:04:15 -07:00
..
test_admin_viewer_handler_access.py
test_auth_checks.py	fix(proxy): bound concurrent key and spend-counter DB lookups to stop prisma pool thrash (#40387)	2026-09-10 05:44:30 +00:00
test_auth_exception_handler.py
test_auth_hot_path_network_requests.py
test_auth_utils.py	Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_bedrock_aws_session_tags	2026-09-10 09:42:22 -07:00
test_banned_params_extra_body.py
test_cli_auth.py
test_custom_auth_end_user_budget.py
test_fallback_model_access.py
test_handle_jwt.py
test_info_routes.py
test_litellm_license.py
test_login_utils.py	fix(auth): drop env-credential hint from 401 when env login is disabled	2026-09-08 13:05:38 +02:00
test_mcp_ip_filtering.py
test_model_access_group_budgets.py
test_model_checks.py
test_model_checks_fallbacks.py
test_multi_budget_windows.py
test_network.py
test_oauth2_proxy_hook.py
test_object_permission_loading.py
test_onboarding.py
test_organization_budget_enforcement.py
test_password_hashing.py
test_password_policy.py
test_resolvers_exceptions.py
test_resolvers_models.py
test_resolvers_seam.py
test_resolvers_store.py
test_route_checks.py	fix(proxy): let internal users read request/response for their own spend logs	2026-09-10 15:04:15 -07:00
test_router_override_fallback_auth.py
test_team_grants.py
test_team_member_budget.py
test_unmapped_model_budget_enforcement.py
test_user_api_key_auth.py	feat(proxy): expose reversible Claude Code model listing aliases (#40515)	2026-09-09 22:04:37 -07:00