fix(proxy): allow internal roles to access vector store CRUD routes

[shivamrawat1]

Description
Internal user and internal viewer keys could call vector store list, create, search, and file endpoints, but GET/POST/DELETE on /v1/vector_stores/{vector_store_id} returned 403 because the bare resource path was missing from openai_routes. This adds that route pattern and regression tests so retrieve, update, and delete pass the LLM API route gate for those roles. Object-level vector store access checks are unchanged.

Cause
LiteLLMRoutes.openai_routes included /v1/vector_stores and sub-routes like /v1/vector_stores/{vector_store_id}/search and .../files, but not /v1/vector_stores/{vector_store_id} itself. RouteChecks.is_llm_api_route() returned False for retrieve/update/delete URLs, so non_proxy_admin_allowed_routes_check() did not treat them as LLM API routes and internal roles hit the admin-only fallback.

Fix
Add /vector_stores/{vector_store_id} and /v1/vector_stores/{vector_store_id} to openai_routes in litellm/proxy/_types.py. Add regression tests in tests/test_litellm/proxy/auth/test_route_checks.py covering route classification and internal user / internal viewer access for GET, POST, and DELETE on the bare path.

[greptile-apps]

Greptile Summary

This PR fixes a 403 for internal roles (INTERNAL_USER, INTERNAL_USER_VIEW_ONLY) calling retrieve, update, or delete on individual vector stores by adding the missing /vector_stores/{vector_store_id} and /v1/vector_stores/{vector_store_id} entries to LiteLLMRoutes.openai_routes in _types.py.

• Core fix (litellm/proxy/_types.py): Two route patterns added, one with and one without the /v1 prefix, consistent with all other vector store sub-route pairs already present.
• Regression tests (test_route_checks.py): test_vector_store_routes_are_llm_api_routes verifies route classification for the new and existing sub-routes; test_vector_store_crud_accessible_to_internal_roles verifies the end-to-end non_proxy_admin_allowed_routes_check passes for GET/POST/DELETE under both internal roles. The CRUD test only parametrizes the /v1/ prefix, leaving the bare-path form without non_proxy_admin_allowed_routes_check coverage (minor gap).

Confidence Score: 5/5

Safe to merge — the change is additive (two new list entries) and cannot revoke access that previously worked.

The fix is a two-line addition to a string list; the matching logic (_route_matches_pattern) already handles these templated patterns correctly and the regex anchoring prevents sub-route spillover. Regression tests cover both roles and all three HTTP methods. The only gap is that the CRUD integration test omits the non-v1-prefixed route, but the classification test already verifies that form.

The test file has a minor coverage gap in test_vector_store_crud_accessible_to_internal_roles; no production files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/_types.py	Adds /vector_stores/{vector_store_id} and /v1/vector_stores/{vector_store_id} to openai_routes, filling the gap that caused 403s for internal roles on retrieve/update/delete.
tests/test_litellm/proxy/auth/test_route_checks.py	Adds two new test functions covering route classification and internal-role access for GET/POST/DELETE on the bare vector store path; the CRUD parametrize only tests the /v1/ prefix, leaving the non-prefixed form untested at that level.

_{Reviews (1): Last reviewed commit: "fix(proxy): allow internal roles to acce..." | Re-trigger Greptile}

[greptile-apps]

The CRUD parametrize only exercises the /v1/ prefix, but the fix adds both /vector_stores/{vector_store_id} and /v1/vector_stores/{vector_store_id}. A regression in the non-prefixed form would pass test_vector_store_routes_are_llm_api_routes (which covers both at classification level) but the non_proxy_admin_allowed_routes_check path would go unchecked. Adding "/vector_stores/vs_123" to the method, route parametrize closes the gap.

Suggested change

	"method, route",
	[
	("GET", "/v1/vector_stores/vs_123"),
	("POST", "/v1/vector_stores/vs_123"),
	("DELETE", "/v1/vector_stores/vs_123"),
	],
	)
	"method, route",
	[
	("GET", "/v1/vector_stores/vs_123"),
	("POST", "/v1/vector_stores/vs_123"),
	("DELETE", "/v1/vector_stores/vs_123"),
	("GET", "/vector_stores/vs_123"),
	("POST", "/vector_stores/vs_123"),
	("DELETE", "/vector_stores/vs_123"),
	],
	)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[veria-ai]

Medium: View-only vector store mutation

Adding the item route to openai_routes makes RouteChecks.non_proxy_admin_allowed_routes_check allow it for INTERNAL_USER_VIEW_ONLY before the view-only role branch runs. A user with that role can call POST or DELETE /v1/vector_stores/{vector_store_id} and update or delete an accessible vector store; keep the route gate method-aware so viewers only get GET access, while write methods require a non-viewer role or explicit write permission.

[veria-ai]

PR overview

This pull request updates proxy route authorization so internal roles can access OpenAI-compatible vector store CRUD routes. The touched proxy route definitions affect access handling for /v1/vector_stores/{vector_store_id} operations.

There is still an open authorization issue where a view-only internal user may be allowed to perform write operations against an accessible vector store. That creates a limited but concrete integrity and availability risk, since such a user could update or delete vector store data they should only be able to read. No issues have been addressed yet, so the PR still needs a method-aware route check before it is security-ready.

Open issues (1)

• Medium: View-only vector store mutation — litellm/proxy/_types.py:377

Fixed/addressed: 0 · PR risk: 6/10

[mateo-berri]

LGTM; thanks!