[Fix] Proxy/Key Management: Honor team_member_permissions /key/list In /key/list Endpoint

[yuneng-berri]

Relevant issues

Pre-Submission checklist

• I have Added testing in the tests/test_litellm/ directory
• My PR's scope is as isolated as possible

Changes

Bug

When a team grants /key/list via team_member_permissions, the UI documents that all team members can see all keys within the team. In practice they could not — non-admin members fell into the service-account-only path in list_keys() and never saw other members' personal keys. Only admin team members and the master key got full visibility.

Root cause

list_keys() in litellm/proxy/management_endpoints/key_management_endpoints.py classified each of the caller's teams as either:

• admin_team_ids → full key visibility for the team, or
• member_team_ids → only service-account keys (user_id IS NULL) visible.

The classification only checked admin status. team_member_permissions["/key/list"] was never consulted, so a permitted non-admin member always landed in the service-account-only branch.

Fix

Added a small helper _get_team_ids_with_key_list_permission_from_objects() that returns non-admin teams where the caller has /key/list permission via team_member_permissions. list_keys() merges those team IDs into admin_team_ids so the existing full-visibility filter path applies. Reuses existing helpers (_team_member_has_permission, _is_user_team_admin); no architectural change.

Tests

6 new unit tests in tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py:

• test_list_keys_team_member_with_key_list_permission_sees_all_team_keys — bug-fix pin: team granting /key/list is classified as full-visibility.
• test_list_keys_team_member_without_key_list_permission_only_service_accounts — existing-behavior pin: member without permission still service-account-only.
• test_list_keys_team_member_with_permission_in_one_team_only — granular: per-team permission classification.
• test_list_keys_team_admin_unaffected_by_member_permission_logic — admin path unchanged.
• test_build_key_filter_conditions_full_visibility_team_includes_service_accounts — direct SQL filter check (no user_id constraint → service-account keys + other members' keys visible).
• test_build_key_filter_conditions_member_only_team_restricts_to_service_accounts — existing-behavior pin on the SQL filter shape.

End-to-end verification against a live proxy: pre-fix the caller saw 2 of 3 expected keys (own + service-account, missing the other member's personal key); post-fix all 3 are returned. Adjacent-behavior checks (same caller in a control team without the permission, master-key admin path) continue to pass on both states.

Type

🐛 Bug Fix

[greptile-apps]

Greptile Summary

This PR fixes a bug where non-admin team members granted /key/list via team_member_permissions still fell into the service-account-only visibility path in list_keys. The fix adds a focused helper _get_team_ids_with_key_list_permission_from_objects that identifies these teams and merges them into admin_team_ids, leveraging the existing _build_key_filter_conditions deduplication logic that already excludes admin teams from the restricted filter. Six new unit tests cover the full classification matrix (permission-granted members, members without permission, per-team granularity, admin-path invariance, and direct SQL filter shape).

Confidence Score: 5/5

Safe to merge — minimal, targeted fix with no backwards-incompatible changes, good test coverage, and correct interaction with the existing filter deduplication logic.

No bugs or security issues found. The fix is additive-only (expands visibility for explicitly-permissioned members), correctly relies on the existing member_only_team_ids exclusion in _build_key_filter_conditions, and is well-covered by the new tests.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/management_endpoints/key_management_endpoints.py	Adds _get_team_ids_with_key_list_permission_from_objects helper and merges its result into admin_team_ids inside list_keys; logic is correct and _build_key_filter_conditions already excludes admin teams from the service-account-only path
tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py	Adds 6 focused unit tests covering: permission-granted members classified in admin_team_ids, members without permission stay in member_team_ids, per-team granularity, admin path unaffected, and direct SQL filter shape validation

_{Reviews (1): Last reviewed commit: "[Fix] Proxy/Key Management: Honor team_m..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!