fix(proxy): allow proxy_admin_viewer to list all API keys

[Jwrede]

Summary

• Add PROXY_ADMIN_VIEW_ONLY to the role check in validate_key_list_check() so Admin Viewer users can access /key/list
• Without this fix, Admin Viewer users see "Access Denied" on the API keys page because the function only allowed PROXY_ADMIN to bypass the user_id requirement

Fixes #26689

Test plan

• New test test_validate_key_list_check_proxy_admin_viewer -- verifies PROXY_ADMIN_VIEW_ONLY with user_id=None returns None (allowed)
• Existing test_validate_key_list_check_proxy_admin still passes
• All 7 validate_key_list_check tests pass

[Jwrede]

@greptileai review

[greptile-apps]

Greptile Summary

This PR fixes a permission gap where PROXY_ADMIN_VIEW_ONLY users were blocked from listing API keys because validate_key_list_check only bypassed the user_id requirement for PROXY_ADMIN. The fix is a one-liner addition to the role list, which is already consistent with how the same viewer role is handled later in the caller (lines 4712–4715).

• validate_key_list_check now returns None early for both PROXY_ADMIN and PROXY_ADMIN_VIEW_ONLY, matching the existing use_substring_matching pattern that already treats these two roles identically.
• A new mock-based test covers the viewer role path; no existing tests are modified.

Confidence Score: 5/5

Safe to merge — minimal, targeted read-path fix with no write-access implications.

The change adds a read-only viewer role to a listing gate that already treats both admin roles identically elsewhere in the same endpoint, and is covered by a new mock test. No existing tests are touched, no write paths are affected.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/management_endpoints/key_management_endpoints.py	Adds PROXY_ADMIN_VIEW_ONLY to the role bypass in validate_key_list_check, consistent with existing handling of that role at line 4712–4715 in the same function's caller
tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py	Adds a new mock-only test for the viewer role fix; no existing tests are modified or weakened

_{Reviews (2): Last reviewed commit: "fix(proxy): allow proxy_admin_viewer to ..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[veria-ai]

High: Bearer-equivalent key hashes exposed to view-only admins

/key/list returns token values from _list_key_helper by default, and _hash_token_if_needed() leaves non-sk- values unchanged during auth lookup. A proxy_admin_viewer can now list every stored key hash and use one directly as Authorization: Bearer <hash> to make requests as that key, bypassing the role's LLM-route restrictions.

Keep the all-key listing for this role only if the response no longer includes bearer-equivalent token hashes, or change authentication so stored hashes are not accepted as presented bearer credentials.

[Jwrede]

This is not a new concern introduced by this PR. The /key/list endpoint returns SHA-256 hashed tokens to PROXY_ADMIN users today -- adding PROXY_ADMIN_VIEW_ONLY grants the same visibility that full admins already have. The viewer role is designed to have read-only parity with admin. If token hash exposure in /key/list responses is a concern, it applies to the existing PROXY_ADMIN path equally and should be addressed separately.

[veria-ai]

High: Admin viewers can obtain bearer-equivalent key hashes

This PR lets proxy_admin_viewer bypass the normal /key/list ownership checks. Because this endpoint returns stored token hashes and the auth path accepts those hashes as bearer tokens, a view-only admin can list all keys and then authenticate as any of them.

---

Status: 1 new · 1 open
Risk: 8/10

[github-actions]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.