From 89a11500333397191f214bb08ae1bc67f8504635 Mon Sep 17 00:00:00 2001
From: Jugal Bhatt <jugalbhatt3@gmail.com>
Date: Wed, 13 Aug 2025 10:49:02 -0700
Subject: [PATCH] Allow routes for admin viewer

---
 litellm/proxy/_types.py            | 13 ++++++++++++-
 litellm/proxy/auth/route_checks.py | 17 +++++++++++++----
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index cf8b3d147f..de28255395 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -527,9 +527,20 @@ class LiteLLMRoutes(enum.Enum):
         "/organization/member_update",
     ]
 
+    # Routes accessible by Admin Viewer (read-only admin access)
+    admin_viewer_routes = [
+        "/user/list",
+        "/user/available_users", 
+        "/user/available_roles",
+        "/user/daily/activity",
+        "/team/daily/activity",
+        "/tag/daily/activity",
+        "/tag/list",
+    ] + info_routes
+
     # All routes accesible by an Org Admin
     org_admin_allowed_routes = (
-        org_admin_only_routes + management_routes + self_managed_routes
+        org_admin_only_routes + management_routes + self_managed_routes + admin_viewer_routes
     )
 
 
diff --git a/litellm/proxy/auth/route_checks.py b/litellm/proxy/auth/route_checks.py
index f6b088d15a..22e6bbffb3 100644
--- a/litellm/proxy/auth/route_checks.py
+++ b/litellm/proxy/auth/route_checks.py
@@ -159,11 +159,12 @@ class RouteChecks:
                     status_code=status.HTTP_403_FORBIDDEN,
                     detail=f"user not allowed to access this OpenAI routes, role= {_user_role}",
                 )
+            
+            # Check if this is a write operation on management routes
             if RouteChecks.check_route_access(
                 route=route, allowed_routes=LiteLLMRoutes.management_routes.value
             ):
-
-                # the Admin Viewer is only allowed to call /user/update for their own user_id and can only update
+                # For management routes, only allow read operations or specific allowed updates
                 if route == "/user/update":
                     # Check the Request params are valid for PROXY_ADMIN_VIEW_ONLY
                     if request_data is not None and isinstance(request_data, dict):
@@ -174,17 +175,25 @@ class RouteChecks:
                                     status_code=status.HTTP_403_FORBIDDEN,
                                     detail=f"user not allowed to access this route, role= {_user_role}. Trying to access: {route} and updating invalid param: {param}. only user_email and password can be updated",
                                 )
-                else:
+                elif route in ["/user/new", "/user/delete", "/team/new", "/team/update", "/team/delete", "/model/new", "/model/update", "/model/delete"]:
+                    # Block write operations for PROXY_ADMIN_VIEW_ONLY
                     raise HTTPException(
                         status_code=status.HTTP_403_FORBIDDEN,
                         detail=f"user not allowed to access this route, role= {_user_role}. Trying to access: {route}",
                     )
+                # Allow read operations on management routes (like /user/info, /team/info, /model/info)
+                pass
+            elif RouteChecks.check_route_access(
+                route=route, allowed_routes=LiteLLMRoutes.admin_viewer_routes.value
+            ):
+                # Allow access to admin viewer routes (read-only admin endpoints)
+                pass
             else:
+                # For other routes, block access
                 raise HTTPException(
                     status_code=status.HTTP_403_FORBIDDEN,
                     detail=f"user not allowed to access this route, role= {_user_role}. Trying to access: {route}",
                 )
-
         elif (
             _user_role == LitellmUserRoles.INTERNAL_USER.value
             and RouteChecks.check_route_access(