Skip to content

Add Key info endpoint object permission data#20407

Merged
Sameerlite merged 2 commits intomainfrom
litellm_key_mcp_permissions
Feb 4, 2026
Merged

Add Key info endpoint object permission data#20407
Sameerlite merged 2 commits intomainfrom
litellm_key_mcp_permissions

Conversation

@Sameerlite
Copy link
Collaborator

@Sameerlite Sameerlite commented Feb 4, 2026

Relevant issues

Fixed #20323

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

  • I have Added testing in the tests/litellm/ directory, Adding at least 1 test is a hard requirement - see details
  • My PR passes all unit tests on make test-unit
  • My PR's scope is as isolated as possible, it only solves 1 specific problem

CI (LiteLLM team)

CI status guideline:

  • 50-55 passing tests: main is stable with minor issues.
  • 45-49 passing tests: acceptable but needs attention
  • <= 40 passing tests: unstable; be careful with your merges and assess the risk.
  • Branch creation CI run
    Link:

  • CI run for the last commit
    Link:

  • Merge / cherry-pick CI run
    Links:

Type

🆕 New Feature
🐛 Bug Fix
🧹 Refactoring
📖 Documentation
🚄 Infrastructure
✅ Test

Changes

image

@vercel
Copy link

vercel bot commented Feb 4, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
litellm Ready Ready Preview, Comment Feb 4, 2026 9:11am

Request Review

@greptile-apps
Copy link
Contributor

greptile-apps bot commented Feb 4, 2026

Greptile Overview

Greptile Summary

Enhanced the /key/info endpoint to return complete object_permission data when object_permission_id is set on a key. Previously only the ID was returned, now the full object with fields like mcp_access_groups, mcp_servers, vector_stores, and agents is included.

Key Changes:

  • Added call to attach_object_permission_to_dict helper function in info_key_fn after converting key info to dict
  • Reuses existing well-tested helper function that queries the litellm_objectpermissiontable and attaches the result
  • Added comprehensive test case test_key_info_returns_object_permission verifying the object_permission is correctly fetched and included in response
  • Consistent with existing pattern used in other endpoints (e.g., line 4098 in the same file)

Confidence Score: 5/5

  • This PR is safe to merge with minimal risk
  • The change is minimal, well-tested, and follows existing patterns in the codebase. It reuses a well-tested helper function that already has comprehensive test coverage. The implementation adds a database query, but only to the /key/info endpoint which is not a critical request path (it's a management endpoint for retrieving key information, not part of the LLM request flow). The test is thorough and verifies the expected behavior.
  • No files require special attention

Important Files Changed

Filename Overview
litellm/proxy/management_endpoints/key_management_endpoints.py Added object_permission data attachment to /key/info endpoint response by calling existing helper function
tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py Added comprehensive test verifying object_permission is correctly returned in /key/info response

Sequence Diagram

sequenceDiagram
    participant Client
    participant InfoKeyFn as info_key_fn
    participant Prisma as prisma_client
    participant AttachHelper as attach_object_permission_to_dict
    
    Client->>InfoKeyFn: GET /key/info with key param
    InfoKeyFn->>Prisma: find_unique(token, include litellm_budget_table)
    Prisma-->>InfoKeyFn: key_info with object_permission_id
    InfoKeyFn->>InfoKeyFn: Convert to dict and remove token
    InfoKeyFn->>AttachHelper: Pass key_info dict and prisma_client
    AttachHelper->>AttachHelper: Check if object_permission_id exists
    AttachHelper->>Prisma: find_unique(object_permission_id)
    Prisma-->>AttachHelper: object_permission record
    AttachHelper->>AttachHelper: Convert to dict and attach
    AttachHelper-->>InfoKeyFn: key_info with object_permission field
    InfoKeyFn-->>Client: Response with key info including object_permission
Loading

Copy link
Contributor

@greptile-apps greptile-apps bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 files reviewed, no comments

Edit Code Review Agent Settings | Greptile

@Sameerlite Sameerlite merged commit a86e501 into main Feb 4, 2026
55 of 65 checks passed
michelligabriele added a commit to michelligabriele/litellm that referenced this pull request Feb 6, 2026
…tibility

Keycloak (and similar OIDC providers) include role claims in the JWT
access token but not in the UserInfo endpoint response. Previously,
roles were only extracted from UserInfo, causing all SSO users to
default to internal_user_view_only regardless of their actual role.

Changes:
- Extract user roles from JWT access token in process_sso_jwt_access_token()
  when UserInfo doesn't provide them (tries role_mappings first, then
  GENERIC_USER_ROLE_ATTRIBUTE)
- Handle list-type role values in get_litellm_user_role() since Keycloak
  returns roles as arrays (e.g. ["proxy_admin"] instead of "proxy_admin")
- Add 9 new unit tests covering role extraction and list handling
- Update 3 existing tests for new JWT decode behavior

Closes BerriAI#20407
ishaan-jaff pushed a commit that referenced this pull request Feb 7, 2026
…tibility (#20591)

Keycloak (and similar OIDC providers) include role claims in the JWT
access token but not in the UserInfo endpoint response. Previously,
roles were only extracted from UserInfo, causing all SSO users to
default to internal_user_view_only regardless of their actual role.

Changes:
- Extract user roles from JWT access token in process_sso_jwt_access_token()
  when UserInfo doesn't provide them (tries role_mappings first, then
  GENERIC_USER_ROLE_ATTRIBUTE)
- Handle list-type role values in get_litellm_user_role() since Keycloak
  returns roles as arrays (e.g. ["proxy_admin"] instead of "proxy_admin")
- Add 9 new unit tests covering role extraction and list handling
- Update 3 existing tests for new JWT decode behavior

Closes #20407
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: /key/info endpoint does not return object_permission (mcp_access_groups, mcp_servers, etc.)

1 participant