fix(proxy): gate non-admin /key/generate budget_limits and permissions (VERIA-392)

[yucheng-berri]

Relevant issues

Linear ticket

Resolves LIT-4072

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

/key/generate, /key/update, and /key/regenerate shared the same two delegation gaps. The single-value max_budget was gated against the caller's ceiling, but the per-window entries in budget_limits and the permissions dict were ungated. A non-admin with max_budget=10 could mint, update, or regenerate a key with a $1M daily window, or self-grant ambient capabilities like get_spend_routes and enable_llm_guard_check. A CLI session token bypassed the ceiling on the same path; a NaN window value bypassed both the gate and downstream enforcement

Setup: admin creates user alice with role internal_user, max_budget=10, models ["gpt-3.5-turbo"], and a personal key for her

After (fixed code)

/key/generate budget_limits over-ceiling

curl -sS -X POST http://localhost:4000/key/generate \
  -H "Authorization: Bearer $ALICE_KEY" -H "Content-Type: application/json" \
  -d '{"budget_limits":[{"budget_duration":"1d","max_budget":1000000}]}'

{"error":{"message":"{'error': \"budget_limits entry max_budget (1000000.0) cannot exceed the caller's own max_budget (10.0).\"}","code":"400"}}

/key/generate NaN window

curl -sS -X POST http://localhost:4000/key/generate \
  -H "Authorization: Bearer $ALICE_KEY" -H "Content-Type: application/json" \
  -d '{"budget_limits":[{"budget_duration":"1d","max_budget":NaN}]}'

{"error":{"message":"{'error': 'budget_limits entry max_budget (nan) must be a finite number.'}","code":"400"}}

/key/update non-admin permissions on own key

curl -sS -X POST http://localhost:4000/key/update \
  -H "Authorization: Bearer $ALICE_KEY" -H "Content-Type: application/json" \
  -d '{"key":"sk-alice","permissions":{"get_spend_routes":true}}'

{"error":{"message":"{'error': 'Only proxy admins can set `permissions` on a key.'}","code":"403"}}

/key/regenerate non-admin budget_limits on own key

curl -sS -X POST http://localhost:4000/key/regenerate \
  -H "Authorization: Bearer $ALICE_KEY" -H "Content-Type: application/json" \
  -d '{"key":"sk-alice","budget_limits":[{"budget_duration":"1d","max_budget":1000000}]}'

{"error":{"message":"{'error': \"budget_limits entry max_budget (1000000.0) cannot exceed the caller's own max_budget (10.0).\"}","code":"400"}}

/key/regenerate non-admin permissions on own key

curl -sS -X POST http://localhost:4000/key/regenerate \
  -H "Authorization: Bearer $ALICE_KEY" -H "Content-Type: application/json" \
  -d '{"key":"sk-alice","permissions":{"get_spend_routes":true}}'

{"error":{"message":"{'error': 'Only proxy admins can set `permissions` on a key.'}","code":"403"}}

Controls

Admin can still set both fields, including over-ceiling

curl -sS -X POST http://localhost:4000/key/generate \
  -H "Authorization: Bearer sk-1234" -H "Content-Type: application/json" \
  -d '{"permissions":{"get_spend_routes":true},"budget_limits":[{"budget_duration":"1d","max_budget":1000000}]}'

{"key":"sk-1T_510Ww7uo...","permissions":{"get_spend_routes":true},"budget_limits":[{"budget_duration":"1d","max_budget":1000000.0,"reset_at":"2026-06-28T00:00:00Z"}]}

Non-admin within her ceiling still mints

curl -sS -X POST http://localhost:4000/key/generate \
  -H "Authorization: Bearer $ALICE_KEY" -H "Content-Type: application/json" \
  -d '{"budget_limits":[{"budget_duration":"1d","max_budget":5}]}'

{"key":"sk-401tRPzoNES...","budget_limits":[{"budget_duration":"1d","max_budget":5.0,"reset_at":"2026-06-28T00:00:00Z"}]}

Type

🐛 Bug Fix

Changes

Two helpers placed next to _check_allowed_routes_caller_permission

_check_budget_limits_delegation_ceiling walks every BudgetLimitEntry in data.budget_limits. It rejects non-finite values (NaN bypassed > because NaN > x is False, and the proxy never trips downstream because spend > NaN is always False), then refuses a CLI session token writing budget_limits to a personal key (the symmetric guard for the scalar max_budget already existed; None from a session token is zero delegation authority, not unlimited), then enforces the per-window ceiling. Carve-outs match the existing scalar check (proxy admin, UI-session team key, delegation_ceiling is None for regular non-admins whose admin granted them an unlimited budget)

_check_permissions_caller_permission requires PROXY_ADMIN for any non-empty permissions dict. The default {} still passes for non-admin callers

Three call sites:

• _common_key_generation_helper covers /key/generate and /key/service-account/generate
• _validate_update_key_data covers /key/update (budget_limits was already admin-only here via _is_budget_change, only permissions was open)
• regenerate_key_fn covers /key/regenerate (both fields were open; regenerate goes through prepare_key_update_data not _validate_update_key_data, so the gate lives at the handler)

PermissionsDict is a new TypedDict in litellm/proxy/_types.py next to where #31471 introduced ObjectPermissionDict. It names the keys the proxy actually reads off the dict (get_spend_routes, enable_llm_guard_check); total=False lets the dispatcher in guardrail_helpers.py accept arbitrary guardrail-name keys. Applied to _check_permissions_caller_permission, generate_key_helper_fn, and three VerificationTokenRepository builders. The wire-Pydantic field and the DB roundtrip stay as Optional[dict] per the precedent #31471 set for ObjectPermissionBase

Behavior change called out: docstrings on the four endpoints previously advertised permissions={"pii": false} and permissions={"allow_pii_controls": true} to non-admin callers. Disabling PII masking on your own key is exactly the control bypass this PR closes, so permissions is now admin-only. Docstring examples now use {"get_spend_routes": true}, a key the codebase actually honors. allow_pii_controls was removed; a grep of litellm/ and enterprise/ shows zero live readers (it appears only in docstrings and the presidio.py:731 comment)

ui/litellm-dashboard/src/lib/http/schema.d.ts regenerated via npm run gen:api to keep the dashboard types in sync with the updated FastAPI docstrings

Regression tests in tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py:

• test_budget_limits_window_cannot_exceed_caller_max_budget (non-admin, oversized window, 400)
• test_budget_limits_window_within_caller_max_budget_allowed (non-admin, in-ceiling, 200)
• test_budget_limits_window_equal_to_ceiling_allowed (boundary, pins > vs >=)
• test_budget_limits_admin_unrestricted (admin)
• test_budget_limits_session_token_personal_key_blocked (CLI session-token guard)
• test_budget_limits_nan_window_rejected (NaN finiteness guard)
• test_permissions_field_rejected_for_non_admin (generate, 403)
• test_permissions_empty_default_allowed_for_non_admin (default {} still passes)
• test_permissions_admin_can_set_any (admin)
• test_update_key_non_admin_permissions_rejected (/key/update)
• test_regenerate_key_non_admin_permissions_rejected (/key/regenerate)
• test_regenerate_key_non_admin_budget_limits_rejected (/key/regenerate)

Mutation check: each attack test fails on prior commits before each fix was applied; controls pass throughout. Full mapped test file is 314 tests, all green

---

Note

High Risk
Security fix in proxy key delegation: closes privilege escalation via ungated budget_limits and permissions on key create paths.

Overview
Closes delegation gaps on /key/generate (and shared _common_key_generation_helper path) where scalar max_budget was already capped but budget_limits windows and permissions were not.

Adds _check_budget_limits_delegation_ceiling, which rejects any per-window max_budget above the caller’s delegation ceiling for non-admins (with the same carve-outs as the existing scalar check: proxy admin, UI-session team keys, and delegation_ceiling is None). Adds _check_permissions_caller_permission, which returns 403 if a non-admin sets a non-empty permissions dict (empty {} still allowed).

Both checks run in _common_key_generation_helper immediately after the existing max_budget ceiling logic. Regression tests cover over-ceiling windows, in-ceiling success, admin bypass, non-admin permissions, and default empty permissions.

^{Reviewed by Cursor Bugbot for commit 68f7688. Bugbot is set up for automated code reviews on this repo. Configure here.}

[yucheng-berri]

@greptileai

[greptile-apps]

Greptile Summary

This PR hardens key-management delegation for generated keys. The main changes are:

• Adds helper checks for non-admin permissions and per-window budget_limits.
• Applies the new checks in the shared key generation helper.
• Adds tests for generate-time budget windows and permissions behavior.

Confidence Score: 4/5

Merge should wait for the remaining key-management authorization gaps to be addressed.

The changes improve generated-key controls, but update and regenerate paths still need matching field-level enforcement to make the contract consistent.

litellm/proxy/management_endpoints/key_management_endpoints.py

T-Rex Logs

What T-Rex did

• Tried to reproduce gate update permissions and ran into a block due to maximum steps, then inspected the update validation and endpoint code paths involved.
• Ran a focused request-level harness against regenerate_key_fn with a non-admin owner and a permissions budget payload; observed HTTP 200 OK where a 403 was expected, and the permissions update was persisted in the mock update arguments; also tested with an over-ceiling budget and saw HTTP 200 OK again.
• Collected and compared artifact outputs showing pre- and post-change budget_limits and permissions behavior across tests; baseline budget write was allowed, while post-change results rejected the ceiling, allowed small values, and showed admin over-ceiling as allowed; NaN budget remained allowed as well; non-empty permissions were rejected and empty ones allowed.
• Compared service-account generation state before and after tests and confirmed the shared-helper gates are not applied to this user-accessible route in this setup.
• Compared session-token budget_limits writes before and after and confirmed the same 200 OK behavior persists for both session-token writes and within-ceiling normal-user writes.

_{Ran code and verified through T-Rex}

Comments Outside Diff (5)

1. litellm/proxy/management_endpoints/key_management_endpoints.py, line 2175-2182 (link)

   Gate update permissions
   /key/update still never calls _check_permissions_caller_permission, so an owner or team-member path that reaches can_skip_admin_check can submit a non-empty permissions update without the new admin-only field gate. Add the same helper check here before the cross-key authorization logic, alongside the existing route gates, so all update requests enforce the new contract.

2. litellm/proxy/management_endpoints/key_management_endpoints.py, line 4412-4435 (link)

   Gate regenerate fields
   /key/regenerate only rechecks routes before loading the key; it does not call _check_permissions_caller_permission or _check_budget_limits_delegation_ceiling before _execute_virtual_key_regeneration applies the request data. This leaves regenerate on a different field-authorization path than generate, so add the new permission and per-window budget checks here using the caller and target key context before persisting the replacement key.

   Artifacts

   
   

   Repro: focused regenerate endpoint harness

   • Contains supporting evidence from the run (text/x-python; charset=utf-8).

   Repro: structured request-response and persistence output

   • Keeps the command output available without making the summary code-heavy.

   

   _{Ran code and verified through T-Rex}

3. General comment

   NaN budget_limits max_budget still bypasses non-admin /key/generate validation

   • Bug
     • A non-admin internal user with max_budget=10 can still call /key/generate with budget_limits containing max_budget=NaN and receive STATUS 200 OK on head. The PR contract says NaN budget_limits max_budget values are rejected after the change, but the executed head artifact shows the request is accepted.
   • Cause
     • In key_management_endpoints.py, _enforce_upperbound_key_params validates only top-level numeric key fields such as max_budget and does not inspect nested budget_limits entries. The new _check_budget_limits_delegation_ceiling only compares w.max_budget > delegation_ceiling; for NaN this comparison returns false, so no HTTPException is raised.
   • Fix
     • Validate every budget_limits entry before the delegation ceiling comparison and reject non-finite max_budget values, e.g. if not math.isfinite(w.max_budget): raise HTTPException(status_code=400, detail={...}), preferably in a shared helper used before serialization/storage.

   _{Ran code and verified through T-Rex}

4. General comment

   Service-account key generation bypasses shared non-admin budget_limits and permissions gates

   • Bug
     • POST /key/service-account/generate remains user-accessible for non-admin team member Alice and, on head, still accepts budget_limits entries above Alice's max_budget=10 and still accepts non-empty permissions. The validation objective expected the shared _common_key_generation_helper gates to reject these after the PR. The same route also returns HTTP 500 Internal Server Error for a NaN budget_limits max_budget instead of rejecting it as a client validation error.
   • Cause
     • The service-account generation path on head does not execute the new shared-helper validation for the tested payloads before key creation, or the route is invoking a helper implementation that lacks those gates at this commit. As a result, the service-account route behavior is unchanged from base for the delegated-budget and permissions contract.
   • Fix
     • Ensure /key/service-account/generate invokes the same validated _common_key_generation_helper path as /key/generate before key persistence, and add endpoint-level tests for non-admin service-account requests covering over-ceiling budget_limits, non-finite/NaN budget values, non-empty permissions, and allowed in-ceiling/default requests.

   _{Ran code and verified through T-Rex}

5. General comment

   CLI session tokens can still delegate personal-key budget_limits on /key/generate

   • Bug
     • The PR claim is that a CLI session token has zero delegation authority for writing budget_limits to a personal key, but executing the key generation helper on head with a session-token UserAPIKeyAuth and non-empty budget_limits still returns HTTP status: 200 OK and reaches generate_key_helper_fn. This preserves the base bypass behavior instead of rejecting it.
   • Cause
     • The new _check_budget_limits_delegation_ceiling returns without raising when delegation_ceiling is None. CLI session tokens commonly have max_budget=None; for personal key generation with no team_table, this leaves delegation_ceiling=None, so non-empty budget_limits are allowed despite the intended zero delegation authority.
   • Fix
     • Treat non-admin CLI session tokens generating personal keys as having zero budget_limits delegation authority: when user_api_key_dict.is_session_token, no requested team/team_table applies, and budget_limits is non-empty, raise a 400 before helper generation (or pass an effective delegation ceiling of 0 into the budget_limits check). Preserve the normal non-session within-ceiling path.

   _{Ran code and verified through T-Rex}

_{Reviews (18): Last reviewed commit: "fix(proxy): gate non-admin /key/generate..." | Re-trigger Greptile}

[codecov]

Codecov Report

❌ Patch coverage is 90.00000% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...y/management_endpoints/key_management_endpoints.py	90.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

[veria-ai]

PR overview

This PR updates LiteLLM proxy key management so non-admin key creation and rotation flows handle configured budget limits and permissions consistently. The touched code centers on the /key/generate and related key regeneration endpoint behavior.

Most previously identified issues have been addressed, but one significant gap remains in the key regeneration path. /key/regenerate checks budget_limits but does not apply the same ceiling to max_budget, so a non-admin key owner can rotate a key with a budget above their allowed limit. The remaining risk is concentrated in that budget escalation path and should be resolved by applying the shared update ceiling logic during regeneration.

Open issues (1)

• High: Budget escalation on key regeneration — litellm/proxy/management_endpoints/key_management_endpoints.py:4567

Fixed/addressed: 4 · PR risk: 7/10

[yucheng-berri]

@greptileai please re-review HEAD 4426589 — the follow-up commit closes B1 (session-token + personal-key bypass) and M1 (NaN window) that the last two passes flagged

@veria-ai please re-review HEAD 4426589 — the follow-up commit closes the NaN bypass on budget_limits that the last pass flagged

[mateo-berri]

@greptileai

[mateo-berri]

Is the "Validate finite windows first" a problem?

[mateo-berri]

@greptileai

[yucheng-berri]

i move the finite check first, then the role base check, if that addresses your question

[mateo-berri]

check veria concern. Legit?

[yucheng-berri]

@veria-ai you were right on both counts. Pushed fec3a0c.

Part A (explicit clear bypass): _check_permissions_caller_permission now takes field_was_set. Update and regenerate call sites pass "permissions" in data.model_fields_set, so an explicit permissions={} or permissions=null from a non-admin owner is rejected on the same code path that rejects non-empty submissions. Generate-family call sites still pass None, so the empty {} default on /key/generate stays the legitimate non-admin shape.

Part B (bulk paths): /key/bulk_update and /team/key/bulk_update go through _process_single_key_update directly. The gate now also fires inside that helper, so the team-admin / team-member-with-KEY_UPDATE attack on update_fields.permissions is rejected before any DB write.

Three new unit tests, all mutation-killed against the prior commit:

• test_update_key_non_admin_explicit_clear_rejected: explicit {} to /key/update is 403
• test_update_key_non_admin_permissions_omitted_allowed: omitting the field still passes
• test_bulk_update_non_admin_permissions_rejected: the bulk helper rejects directly

318 tests pass.

Note on the title of fec3a0c — it carries a misleading heading from a prior commit. Body and content match this Veria fix; not amending because the SHA-stable history matters for review-bot re-attachment more than a clean log here.

@greptileai please re-review HEAD fec3a0c
@cursor please review

[yucheng-berri]

@greptileai please re-review HEAD fec3a0c

@veria-ai please re-review HEAD fec3a0c

@cursor please review

[yucheng-berri]

@veria-ai @greptileai bumping for a re-review on HEAD fec3a0c

For reference, the open concerns since the last bot pass were:

• Greptile P1 "Validate finite windows first" -> fixed in fb28a4d (NaN now rejected for everyone, only the ceiling comparison stays admin-exempt)
• Veria Medium "Permissions gate bypassed on update/bulk paths" -> fixed in fec3a0c (gate now keys on "permissions" in data.model_fields_set on update/regenerate; gate also invoked inside _process_single_key_update so /key/bulk_update and /team/key/bulk_update are covered)

318 unit tests, live verify on the proxy clean across the attack matrix

[mateo-berri]

@greptileai

[mateo-berri]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Team bulk skips budget ceiling
  • Added delegation-ceiling validation for team bulk key updates and regression coverage for oversized and non-finite budget fields.

_{You can send follow-ups to the cloud agent here.}

[yucheng-berri]

Replacement PR: #31543. Single coherent commit implementing the centralized policy described in the close-out comment.

[yucheng-berri]

Reopened and reset to the scoped fix.

The branch was force-pushed back to a single commit (c149544) that does only what VERIA-392 / LIT-4072 originally describes: gate /key/generate and /key/service-account/generate for non-admin self-grant on permissions and per-window budget_limits over the caller's delegation ceiling. Two helpers, ~70 lines of source, 6 regression tests, all 309 mapped tests pass.

Everything else that grew this PR over the prior iterations was real but out of scope for this ticket. Filed as follow-up Linear tickets so each lands as its own focused PR:

• LIT-4092 - /key/update + /key/regenerate: gate permissions field admin-only (covers Veria-ai "Permissions gate can be bypassed on update paths" + the explicit-empty {} clear)
• LIT-4093 - Key bulk-update paths skip the budget admin gate (covers /key/bulk_update + /team/key/bulk_update missing _check_key_admin_access for budget fields)
• LIT-4094 - NaN / non-finite budget values bypass delegation ceiling (Greptile P1 + Cursor Bugbot finding)
• LIT-4095 - CLI session token can delegate budget for a personal key (Greptile P1 finding)
• LIT-4096 - temp_budget_increase + explicit max_budget=null clear bypass admin gate (Veria-ai "Budget mutation bypass" + "Budget cap clear skips the delegation ceiling")
• LIT-4097 - Replace mutable permissions={} default; add PermissionsDict typing (cleanup, mirrors fix(proxy): reject team-scoped object_permission on personal keys for non-admins #31471's ObjectPermissionDict pattern)

PR #31543 (the centralized helper attempt) is closed.

@greptileai please re-review HEAD c149544
@veria-ai please re-review HEAD c149544

[yucheng-berri]

bugbot run

[yucheng-berri]

@greptileai please review HEAD c149544

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Autofix Details

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: NaN budget_limits bypass ceiling check
  • budget_limits entries now reject non-finite max_budget values before any delegation bypass can occur.
• ✅ Fixed: Session token skips budget_limits guard
  • Session-token personal key generation now rejects budget_limits instead of treating a missing ceiling as unlimited delegation authority.

_{You can send follow-ups to the cloud agent here.}

[cursor]

NaN budget_limits bypass ceiling check

High Severity

The new _check_budget_limits_delegation_ceiling only rejects windows where max_budget is greater than the caller ceiling. Non-finite values such as NaN fail that comparison, so /key/generate can still persist a window budget that downstream enforcement never applies because spend checks require a finite limit.

 

^{Reviewed by Cursor Bugbot for commit c149544. Configure here.}

[cursor]

Session token skips budget_limits guard

Medium Severity

The new budget-limits delegation helper returns immediately when delegation_ceiling is None. CLI session tokens on personal keys hit that path while only scalar max_budget is blocked nearby, so a session caller can mint a personal key with large budget_limits and no team_id.

Additional Locations (1)

• litellm/proxy/management_endpoints/key_management_endpoints.py#L803-L809

 

^{Reviewed by Cursor Bugbot for commit c149544. Configure here.}

[yucheng-berri]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

2 issues from previous reviews remain unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 68f7688. Configure here.}

[yucheng-berri]

@greptileai please review

resolved