tiennm99/litellm
1
0
Fork 0
mirror of https://github.com/tiennm99/litellm.git synced 2026-08-16 16:24:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

[Fix] Skip all-team-models sentinel in team change validation

Browse Source 
When moving a key to a different team, `validate_key_team_change` was
treating "all-team-models" as a literal model name and checking if the
target team could access it. This always failed because "all-team-models"
is a UI/backend sentinel meaning "use whatever the team allows."

Also reorder checks so the membership check runs after data validation
(models, rate limits) but before permission checks, keeping the admin
early-return after all validation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
yuneng-jiang
2026-03-13 18:08:02 -07:00
co-authored by Claude Opus 4.6
parent 8069829c59
commit c637c93a6a
1 changed files with 15 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
litellm/proxy/management_endpoints/key_management_endpoints.py
+15 -11
View File
@@ -2301,23 +2301,16 @@ async def validate_key_team_change(
# Check if the team has access to the key's models
if len(key.models) > 0:
for model in key.models:
# Skip special sentinel values — "all-team-models" means
# "use whatever the team allows", so it's always valid.
if model == SpecialModelNames.all_team_models.value:
continue
await can_team_access_model(
model=model,
team_object=team,
llm_router=llm_router,
)
# Check if the key's user_id is a member of the team
member_object = _get_user_in_team(
team_table=cast(LiteLLM_TeamTableCachedObj, team), user_id=key.user_id
)
if key.user_id is not None:
if not member_object:
raise HTTPException(
status_code=403,
detail=f"User={key.user_id} is not a member of the team={team.team_id}. Check team members via `/team/info`.",
)
# Check if the key's tpm/rpm limit is less than the team's tpm/rpm limit
if key.tpm_limit is not None:
if team.tpm_limit and key.tpm_limit > team.tpm_limit:
@@ -2331,6 +2324,17 @@ async def validate_key_team_change(
detail=f"Key={key.token} has a rpm_limit={key.rpm_limit} which is greater than the team's rpm_limit={team.rpm_limit}.",
)
# Check if the key's user_id is a member of the team
member_object = _get_user_in_team(
team_table=cast(LiteLLM_TeamTableCachedObj, team), user_id=key.user_id
)
if key.user_id is not None:
if not member_object:
raise HTTPException(
status_code=403,
detail=f"User={key.user_id} is not a member of the team={team.team_id}. Check team members via `/team/info`.",
)
# Check if the person initiating the change is a Proxy Admin or Team Admin
if change_initiated_by.user_role == LitellmUserRoles.PROXY_ADMIN.value:
return