[Feature] UI - Admin Settings: Add option for Authentication for public AI Hub by yuneng-jiang · Pull Request #20444 · BerriAI/litellm

yuneng-jiang · 2026-02-04T23:57:37Z

Relevant issues

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

I have Added testing in the tests/litellm/ directory, Adding at least 1 test is a hard requirement - see details
My PR passes all unit tests on make test-unit
My PR's scope is as isolated as possible, it only solves 1 specific problem

CI (LiteLLM team)

CI status guideline:

50-55 passing tests: main is stable with minor issues.

45-49 passing tests: acceptable but needs attention

<= 40 passing tests: unstable; be careful with your merges and assess the risk.

Branch creation CI run
Link:
CI run for the last commit
Link:
Merge / cherry-pick CI run
Links:

Type

🆕 New Feature
🧹 Refactoring
✅ Test

Changes

Adds a UI setting require_auth_for_public_ai_hub that allows administrators to require authentication for accessing the public AI Hub. When enabled, unauthenticated users are redirected to the login page. Refactors useAuthorized hook to consolidate token validation logic using checkTokenValidity and decodeToken utilities. Adds tests for ModelHubTable authentication flow, UISettings component, useAuthorized hook, and jwtUtils functions.

Screenshots

vercel · 2026-02-04T23:57:43Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Feb 5, 2026 1:07am

greptile-apps · 2026-02-05T00:00:31Z

Greptile Overview

Greptile Summary

This PR adds a UI setting require_auth_for_public_ai_hub that allows administrators to require authentication for accessing the public AI Hub. The implementation includes both frontend and backend changes along with comprehensive test coverage.

Key Changes:

Added require_auth_for_public_ai_hub boolean field to backend UISettings model and allowlist
Refactored useAuthorized hook to use new checkTokenValidity and decodeToken utility functions
Made /get/ui_settings endpoint public (removed auth requirement) so the setting can be fetched before authentication
Added authentication check in ModelHubTable component that redirects unauthenticated users to login when the setting is enabled
Added UI toggle in admin settings panel to control the feature
Comprehensive test coverage for new utilities, hooks, and authentication flow

Issues Found:

Critical: Frontend checks the setting but backend /public/model_hub endpoint still has hardcoded dependencies=[Depends(user_api_key_auth)], meaning it always requires authentication regardless of this setting
Moderate: The refactored useAuthorized hook returns decoded user data even when isAuthorized is false, potentially exposing data from expired tokens

The refactoring of JWT utilities and useAuthorized hook is well-designed with good separation of concerns and comprehensive test coverage.

Confidence Score: 3/5

This PR has a critical backend enforcement gap that prevents the feature from working as intended
The frontend implementation is solid with good tests, but the backend /public/model_hub endpoint doesn't respect the require_auth_for_public_ai_hub setting. Additionally, the useAuthorized refactor has a data exposure issue with expired tokens. These issues need to be resolved before merge.
litellm/proxy/public_endpoints/public_endpoints.py (not in this PR) needs to be updated to conditionally apply authentication based on the setting, and ui/litellm-dashboard/src/app/(dashboard)/hooks/useAuthorized.ts should gate decoded fields by authorization status

Important Files Changed

Filename	Overview
litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py	Added `require_auth_for_public_ai_hub` boolean field to UISettings model and allowlist - backend definition is correct
ui/litellm-dashboard/src/components/AIHub/ModelHubTable.tsx	Added frontend auth check using `require_auth_for_public_ai_hub` setting - redirects to login when enabled and token invalid, but backend enforcement is missing
ui/litellm-dashboard/src/app/(dashboard)/hooks/useAuthorized.ts	Refactored to use new `checkTokenValidity` and `decodeToken` utilities, consolidated redirect logic into single useEffect - cleaner implementation
ui/litellm-dashboard/src/utils/jwtUtils.ts	Added `decodeToken` and `checkTokenValidity` utility functions with proper error handling - good refactor for code reuse
ui/litellm-dashboard/src/components/networking.tsx	Removed authentication header from `getUiSettings` call - correctly made endpoint public

Sequence Diagram

sequenceDiagram
    participant User
    participant Browser
    participant ModelHubTable
    participant useUISettings
    participant Networking
    participant Backend
    participant Database

    User->>Browser: Access Public AI Hub
    Browser->>ModelHubTable: Render component
    ModelHubTable->>useUISettings: Fetch UI settings
    useUISettings->>Networking: getUiSettings()
    Networking->>Backend: GET /get/ui_settings (no auth)
    Backend->>Database: Query ui_settings
    Database-->>Backend: Return settings
    Backend-->>Networking: Return {require_auth_for_public_ai_hub: true/false}
    Networking-->>useUISettings: Settings data
    useUISettings-->>ModelHubTable: Settings with require_auth flag
    
    alt require_auth_for_public_ai_hub is true
        ModelHubTable->>ModelHubTable: getCookie("token")
        ModelHubTable->>ModelHubTable: checkTokenValidity(token)
        alt token is invalid
            ModelHubTable->>Browser: router.replace("/ui/login")
            Browser->>User: Redirect to login page
        else token is valid
            ModelHubTable->>Backend: Fetch model hub data (authenticated)
            Backend-->>ModelHubTable: Return data
            ModelHubTable->>User: Display AI Hub
        end
    else require_auth_for_public_ai_hub is false
        ModelHubTable->>Backend: Fetch model hub data
        Backend-->>ModelHubTable: Return data
        ModelHubTable->>User: Display AI Hub (public access)
    end

greptile-apps

_{3 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py

greptile-apps

_{5 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-05T01:16:46Z

ui/litellm-dashboard/src/components/AIHub/ModelHubTable.tsx

+  // Check authentication requirement for public AI Hub
+  useEffect(() => {
+    // Only check when UI settings are loaded and this is a public page
+    if (isUISettingsLoading || !publicPage) {
+      return;
+    }
+
+    const requireAuth = uiSettings?.values?.require_auth_for_public_ai_hub;
+
+    // If require_auth_for_public_ai_hub is true, verify token
+    if (requireAuth === true) {
+      const token = getCookie("token");
+      const isTokenValid = checkTokenValidity(token);
+
+      // If token is invalid, redirect to login
+      if (!isTokenValid) {
+        router.replace(`${getProxyBaseUrl()}/ui/login`);
+        return;
+      }
+    }
+    // If require_auth_for_public_ai_hub is false, allow public access (no change)
+  }, [isUISettingsLoading, publicPage, uiSettings, router]);


Frontend implements the require_auth_for_public_ai_hub check, but the backend /public/model_hub endpoint at litellm/proxy/public_endpoints/public_endpoints.py:27 still has dependencies=[Depends(user_api_key_auth)] hardcoded. This means the backend always requires authentication regardless of this setting.

The setting should control the backend endpoint's authentication dependency, not just redirect on the frontend. Otherwise, unauthenticated users will be blocked by the API even if the setting is disabled.

Prompt To Fix With AI

This is a comment left during a code review. Path: ui/litellm-dashboard/src/components/AIHub/ModelHubTable.tsx Line: 84:105 Comment: Frontend implements the `require_auth_for_public_ai_hub` check, but the backend `/public/model_hub` endpoint at `litellm/proxy/public_endpoints/public_endpoints.py:27` still has `dependencies=[Depends(user_api_key_auth)]` hardcoded. This means the backend always requires authentication regardless of this setting. The setting should control the backend endpoint's authentication dependency, not just redirect on the frontend. Otherwise, unauthenticated users will be blocked by the API even if the setting is disabled. How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-05T01:16:47Z

ui/litellm-dashboard/src/app/(dashboard)/hooks/useAuthorized.ts

    accessToken: decoded?.key ?? null,
    userId: decoded?.user_id ?? null,
    userEmail: decoded?.user_email ?? null,
-    userRole: formatUserRole(decoded?.user_role ?? null),
+    userRole: formatUserRole(decoded?.user_role),
    premiumUser: decoded?.premium_user ?? null,
    disabledPersonalKeyCreation: decoded?.disabled_non_admin_personal_key_creation ?? null,
    showSSOBanner: decoded?.login_method === "username_password",


Decoded user data is returned even when isAuthorized is false. This exposes data from expired/invalid tokens. Consider gating these fields by isAuthorized like the token field on line 65.

Prompt To Fix With AI

This is a comment left during a code review. Path: ui/litellm-dashboard/src/app/(dashboard)/hooks/useAuthorized.ts Line: 66:72 Comment: Decoded user data is returned even when `isAuthorized` is false. This exposes data from expired/invalid tokens. Consider gating these fields by `isAuthorized` like the `token` field on line 65. How can I resolve this? If you propose a fix, please make it concise.

Add option for authentication for public AI Hub

ec4f7a3

greptile-apps bot reviewed Feb 5, 2026

View reviewed changes

litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py Show resolved Hide resolved

yuneng-jiang marked this pull request as draft February 5, 2026 00:10

yuneng-jiang added 4 commits February 4, 2026 16:37

useAuthorized refactor

c47866a

ai hub req auth working

28bae22

Adding tests

bdf47eb

Adding tests for model hub

d016ac8

vercel bot deployed to Preview February 5, 2026 01:07 View deployment

yuneng-jiang marked this pull request as ready for review February 5, 2026 01:12

greptile-apps bot reviewed Feb 5, 2026

View reviewed changes

yuneng-jiang merged commit 4de0ed7 into main Feb 6, 2026
59 of 66 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Feature] UI - Admin Settings: Add option for Authentication for public AI Hub#20444

[Feature] UI - Admin Settings: Add option for Authentication for public AI Hub#20444
yuneng-jiang merged 5 commits intomainfrom
litellm_ui_config_req_auth_mh

yuneng-jiang commented Feb 4, 2026 •

edited

Loading

Uh oh!

vercel bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Feb 5, 2026 •

edited

Loading

Important Files Changed

Uh oh!

greptile-apps bot left a comment

Uh oh!

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot Feb 5, 2026

Uh oh!

greptile-apps bot Feb 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

yuneng-jiang commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Relevant issues

Pre-Submission checklist

CI (LiteLLM team)

Type

Changes

Screenshots

Uh oh!

vercel bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Overview

Greptile Summary

Confidence Score: 3/5

Important Files Changed

Sequence Diagram

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

yuneng-jiang commented Feb 4, 2026 •

edited

Loading

vercel bot commented Feb 4, 2026 •

edited

Loading

greptile-apps bot commented Feb 5, 2026 •

edited

Loading