fix: empty guardrails/policies arrays should not trigger enterprise license check

[veeceey]

Summary

Fixes #20304

The UI sends empty arrays ([]) for enterprise-only fields (guardrails, policies, logging) even when the user has not configured these features. The backend check updated_kv[field] is not None evaluates to True for empty arrays, triggering a false enterprise license requirement and blocking open-source users from performing basic team operations.

Changes

Backend (litellm/proxy/management_endpoints/common_utils.py):

• Added and updated_kv[field] != [] and updated_kv[field] != {} guards to both premium and standard metadata field loops in _update_metadata_fields, so empty collections are treated the same as absent/None fields.

UI (ui/litellm-dashboard/src/components/team/team_info.tsx):

• Changed guardrails, logging, and policies to be conditionally included in the update payload only when they have actual values, instead of defaulting to [].

Tests (tests/test_litellm/proxy/management_endpoints/test_common_utils.py):

• Added 7 unit tests covering: empty lists, empty dicts, None values, absent fields (no trigger), non-empty lists and values (trigger), and the exact UI payload shape from the bug report.

Test plan

• pytest tests/test_litellm/proxy/management_endpoints/test_common_utils.py -v -- all 7 tests pass
• Manual: start proxy without LITELLM_LICENSE, update a team via the UI, verify no 403 error
• Manual: set enterprise license, configure guardrails on a team, verify it still works

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Feb 6, 2026 8:42pm

[greptile-apps]

Greptile Overview

Greptile Summary

• Adjusts backend _update_metadata_fields to ignore empty lists/dicts for metadata/premium fields, preventing false enterprise license checks when UI sends default empty collections.
• Updates Team settings UI to omit guardrails, logging, and policies from the update payload unless they have non-empty values.
• Adds regression unit tests for empty/none/absent vs non-empty values to validate premium-check triggering behavior.
• Net effect: open-source users can update teams without being blocked by UI-default enterprise fields, while non-empty enterprise config still triggers license enforcement.

Confidence Score: 3/5

• This PR is generally safe to merge, but has a functional edge case and a brittle test import that should be addressed first.
• Backend change fixes the reported false-positive license enforcement, and UI now avoids sending default empty enterprise arrays. However, treating empty lists/dicts as absent in _update_metadata_fields also prevents intentional clearing of previously-set values via []/{}. The new tests also modify sys.path in a cwd-dependent way, which can fail in CI or import the wrong module.
• litellm/proxy/management_endpoints/common_utils.py; tests/test_litellm/proxy/management_endpoints/test_common_utils.py

Important Files Changed

Filename	Overview
litellm/proxy/management_endpoints/common_utils.py	Skips moving metadata fields when updated value is an empty list/dict; fixes false premium checks but also blocks intentionally clearing premium/metadata fields via empty collections.
tests/test_litellm/proxy/management_endpoints/test_common_utils.py	Adds regression tests for empty collection payloads; currently uses a cwd-relative sys.path insertion that can break imports in CI and makes tests non-hermetic.
ui/litellm-dashboard/src/components/team/team_info.tsx	Omits guardrails/logging/policies from update payload when arrays are empty, preventing backend from interpreting UI defaults as enterprise feature usage.

Sequence Diagram

sequenceDiagram
  participant UI as TeamInfoView (UI)
  participant API as teamUpdateCall (UI networking)
  participant BE as Team update endpoint
  participant CU as _update_metadata_fields
  participant LIC as _premium_user_check

  UI->>API: PUT /team/update (updateData)
  Note over UI: guardrails/logging/policies omitted when empty
  API->>BE: HTTP request with JSON body
  BE->>CU: _update_metadata_fields(updated_kv)
  CU->>CU: For each metadata field
  alt field present && value is not None && not []/{}
    CU->>LIC: _premium_user_check()
    CU->>CU: Move field into updated_kv["metadata"]
  else empty/absent
    CU-->>BE: Skip license check + skip moving field
  end
  BE-->>API: 200 OK (or 403 if premium check fails)
  API-->>UI: Update result

Loading

[greptile-apps]

_{3 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Empty update blocked

_update_metadata_fields now skips empty lists/dicts, which prevents the license check but also prevents users from intentionally clearing a previously-set field (e.g., setting policies: [] / metadata.guardrails: [] to remove all policies/guardrails). Since _update_metadata_field moves these keys into metadata, this makes “clear the field” impossible via the update payload.

If clearing should be supported, the condition here needs to distinguish “UI default empty” vs “explicit clear”, or add an explicit clear_* mechanism rather than treating [] as absent.

[veeceey]

Good catch — this was indeed a bug. The empty-collection guard was in the wrong place: it was in _update_metadata_fields (plural), which meant empty lists/dicts were skipped entirely (both the premium check and the field update).

Fixed by moving the empty-collection logic into _update_metadata_field (singular) so that it only bypasses the _premium_user_check() call for empty collections but still proceeds with writing the value into metadata. This means:

• UI default empty arrays (guardrails: [] sent when nothing is configured) → no premium check, field still written (harmless no-op in metadata)
• User intentionally clearing a field (guardrails: [] to remove all guardrails) → no premium check, field is cleared in metadata as intended
• Non-empty values (guardrails: ["my-guardrail"]) → premium check enforced as before

Added test_empty_list_still_updates_metadata and test_empty_dict_still_updates_metadata to verify the clearing behavior.

[greptile-apps]

Fragile import hack

This test mutates sys.path (sys.path.insert(0, os.path.abspath("../../../"))), which is relative to the current working directory, not the test file location. In many CI runners cwd is the repo root, so this resolves to the wrong path and can cause import failures or accidentally import a different litellm.

Prefer relying on pytest’s package discovery (or compute the path from __file__) instead of cwd-relative sys.path edits.

[veeceey]

Fixed — removed the sys.path.insert(0, os.path.abspath("../../../")) hack along with the unused os, sys, pytest, and FastAPI imports. The test file now relies on standard pytest discovery and uses only the imports it needs (unittest.mock.patch and the function under test).

[veeceey]

Ran the tests locally for this PR:

pytest tests/test_litellm/proxy/management_endpoints/test_common_utils.py -v

10 passed in 0.13s

All TestUpdateMetadataFieldsEmptyCollections cases pass — empty lists/dicts/None/absent fields correctly skip the premium check, non-empty values still trigger it, metadata updates still work in both cases, and the typical UI payload scenario is covered.

[shivamrawat1]

@greptile re-review this

[greptile-apps]

Greptile Overview

Greptile Summary

Fixes issue #20304 where empty arrays for enterprise fields (guardrails, policies, logging) sent by the UI triggered false enterprise license requirements. The fix moves the empty-collection check from _update_metadata_fields into _update_metadata_field, allowing empty arrays to bypass the premium license check while still being written to metadata (enabling users to intentionally clear fields).

Key changes:

• Backend: Added empty collection guard (!= [] and != {}) in _update_metadata_field before _premium_user_check(), so empty values skip license enforcement but still update metadata
• UI: Changed to conditionally omit guardrails, logging, and policies from payload when empty (using ?.length > 0 check)
• Tests: Added 10 comprehensive unit tests covering empty/non-empty lists/dicts, None values, and the exact UI payload structure

The fix correctly addresses the previous review feedback by ensuring users can clear fields (sending [] writes to metadata) without triggering license errors.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The fix is well-designed and addresses the core issue effectively. The logic change is isolated to the premium check condition, preserving all other behavior. The comprehensive test suite (10 tests) validates both the bug fix (empty arrays don't trigger license check) and the enhancement (empty arrays still update metadata for field clearing). Previous review feedback about the inability to clear fields has been properly addressed by moving the check into the singular function. The UI changes are defensive (only send non-empty values), and the backend handles both cases correctly.
• No files require special attention

Important Files Changed

Filename	Overview
litellm/proxy/management_endpoints/common_utils.py	Moved empty collection check from _update_metadata_fields into _update_metadata_field to allow field clearing while bypassing premium check for empty values
tests/test_litellm/proxy/management_endpoints/test_common_utils.py	Added comprehensive tests covering empty collections bypassing premium check while still updating metadata; removed fragile sys.path imports
ui/litellm-dashboard/src/components/team/team_info.tsx	Changed to conditionally exclude empty guardrails, logging, and policies arrays from payload instead of sending empty defaults

Sequence Diagram

sequenceDiagram
    participant UI as UI (team_info.tsx)
    participant Backend as _update_metadata_fields
    participant Field as _update_metadata_field
    participant Check as _premium_user_check

    Note over UI: User updates team settings
    
    alt Empty guardrails/policies
        UI->>Backend: updateData with no guardrails/policies keys
        Note over UI: Only include if length > 0
    else Non-empty values
        UI->>Backend: updateData with guardrails: ["my-guardrail"]
    end

    Backend->>Backend: Loop through premium fields
    
    alt Field exists in updated_kv (top-level)
        Backend->>Field: _update_metadata_field(field_name)
        
        alt Value is [] or {}
            Field->>Field: Skip premium check
            Note over Field: Empty collections bypass license check
            Field->>Field: Move [] to metadata
            Note over Field: Still allows clearing fields
        else Value is non-empty
            Field->>Check: _premium_user_check()
            Note over Check: Enforce license requirement
            Field->>Field: Move value to metadata
        else Value is None
            Field->>Field: Skip update entirely
        end
    end

    Backend-->>UI: Success (no 403 for empty arrays)

Loading

[greptile-apps]

_{3 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}