fix(ui): restore the Logs Deleted Teams tab for organization admins

[yuneng-berri]

TLDR

Problem this solves:

• Org admins lost the Logs page's Deleted Teams tab
• The proxy grants them that data, scoped to their orgs
• Their session role reads "Internal User", so role gates miss them

How it solves it:

• New shared useIsOrgAdmin hook reads organization membership
• A capability can now opt into allowing org admins
• Left nav drops its private copy of the same lookup

User Flow

Before: an org admin opening the Logs page has no way to reach the teams deleted inside their own organization, even though the proxy will hand them over

1. They sign in as a user whose role shows as Internal User and who is an org admin of their organization
2. They open http://localhost:4000/ui/?page=logs and see two tabs, Request Logs and Deleted Keys
3. There is no Deleted Teams tab, so a team that was deleted inside their organization cannot be found anywhere in the UI
4. Calling GET /v2/team/list?page=1&page_size=100&status=deleted with their own key still returns 200 and that exact team, so the data was theirs the whole time
5. A plain Internal User in the same organization also sees two tabs, which is correct: the same call returns 401 for them

After: the same org admin gets the tab back and sees the team they deleted

1. Same sign-in, same user
2. They open http://localhost:4000/ui/?page=logs and now see three tabs, Request Logs, Deleted Keys and Deleted Teams
3. They click Deleted Teams and the team deleted inside their organization is listed by alias and id
4. Only their own organization's deleted teams appear, so an org admin still cannot see another organization's teams
5. A plain Internal User in the same organization is unchanged at two tabs, and the page issues no request that would come back 401

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

Live proxy on :4000, Admin UI dev server on :3000. Before was captured with the two gate files at their merged state from #36333 (f1ed4690bb), after at this branch's head

1. Build the org admin the product way, and give them a deleted team to look at

POST /user/new and /user/update both reject user_role: "org_admin" with 422, so an org admin is a plain internal_user who holds an org_admin membership

export P=http://localhost:4000 MASTER_KEY=sk-1234
ORG_ID=$(curl -s -X POST $P/organization/new -H "Authorization: Bearer $MASTER_KEY" -H "Content-Type: application/json" -d '{"organization_alias":"orgadmin-regression-org"}' | jq -r .organization_id)
OA=$(curl -s -X POST $P/user/new -H "Authorization: Bearer $MASTER_KEY" -H "Content-Type: application/json" -d '{"user_email":"orgadmin-regr@example.com","user_role":"internal_user"}')
export ORG_ADMIN_KEY=$(echo $OA | jq -r .key)
curl -s -X POST $P/organization/member_add -H "Authorization: Bearer $MASTER_KEY" -H "Content-Type: application/json" -d "{\"organization_id\":\"$ORG_ID\",\"member\":{\"role\":\"org_admin\",\"user_id\":\"$(echo $OA | jq -r .user_id)\"}}" | jq -c '.updated_organization_memberships[0] | {user_role}'
TEAM_ID=$(curl -s -X POST $P/team/new -H "Authorization: Bearer $MASTER_KEY" -H "Content-Type: application/json" -d "{\"team_alias\":\"orgadmin-regr-deleted-team\",\"organization_id\":\"$ORG_ID\"}" | jq -r .team_id)
curl -s -X POST $P/team/delete -H "Authorization: Bearer $MASTER_KEY" -H "Content-Type: application/json" -d "{\"team_ids\":[\"$TEAM_ID\"]}"

{"user_role":"org_admin"}
{"deleted_teams":["45b5ed4b-faf0-4fae-a605-346a93eefd69"]}

2. The entitlement the UI was gating away, on the exact URL the dashboard fires

for ROLE in MASTER ORG_ADMIN TEAM_ADMIN INTERNAL_USER; do
  eval "KEY=\$${ROLE}_KEY"
  CODE=$(curl -s -o /tmp/r.json -w '%{http_code}' "$P/v2/team/list?page=1&page_size=100&status=deleted" -H "Authorization: Bearer $KEY")
  printf '%-14s HTTP %s  ' "$ROLE" "$CODE"
  jq -c 'if has("teams") then {returned:(.teams|length), orgs:([.teams[].organization_id]|unique|map(.//"(none)")), deleted_team_ids:(if (.teams|length)<=3 then [.teams[].team_id] else "…" end)} else (.detail.error // .error.message) end' /tmp/r.json
done

MASTER         HTTP 200  {"returned":100,"orgs":["(none)","bf52718c-f519-44e3-ab24-2bfebbc20108","ebefd216-d3d6-457a-9f0a-0ae84c61a172"],"deleted_team_ids":"…"}
ORG_ADMIN      HTTP 200  {"returned":1,"orgs":["ebefd216-d3d6-457a-9f0a-0ae84c61a172"],"deleted_team_ids":["45b5ed4b-faf0-4fae-a605-346a93eefd69"]}
TEAM_ADMIN     HTTP 401  "Only admin users can query all teams/other teams. Your user role=internal_user"
INTERNAL_USER  HTTP 401  "Only admin users can query all teams/other teams. Your user role=internal_user"

The org admin's 200 is scoped rather than merely non-empty: one team, in exactly their own organization

3. Why no role gate could have worked

The org admin's session carries the same role string as a plain internal user

curl -s -i -X POST $P/login -F "username=orgadmin-regr@example.com" -F "password=$PASSWORD" \
  | grep -i '^set-cookie: token=' | sed -E 's/^set-cookie: token=([^;]*).*/\1/' | cut -d. -f2 \
  | base64 -d 2>/dev/null | jq -c '{user_email, user_role}'

{"user_email":"orgadmin-regr@example.com","user_role":"internal_user"}

4. The other three capabilities stay denied, because the proxy still refuses org admins

for EP in /v1/tool/list /policies/list /prompts/list /audit; do
  curl -s -o /dev/null -w "org_admin  GET $EP -> %{http_code}\n" "$P$EP" -H "Authorization: Bearer $ORG_ADMIN_KEY"
done

org_admin  GET /v1/tool/list -> 401
org_admin  GET /policies/list -> 401
org_admin  GET /prompts/list -> 401
org_admin  GET /audit -> 401

5. UI steps to screenshot

Run the proxy with python litellm/proxy/proxy_cli.py --config litellm/proxy/dev_config.yaml --detailed_debug --reload --use_v2_migration_resolver and the dashboard with npm run dev in ui/litellm-dashboard, then for each of the three users below: sign in at http://localhost:4000/ui/, open http://localhost:3000/?page=logs, and screenshot the tab strip with the browser network tab open

1. As the org admin from step 1: expect Request Logs, Deleted Keys and Deleted Teams. Click Deleted Teams and expect orgadmin-regr-deleted-team in the table. The network tab shows /v2/team/list?page=1&page_size=100&status=deleted coming back 200
2. As a plain internal user with no org_admin membership: expect Request Logs and Deleted Keys only, and no /v2/team/list?...&status=deleted or /audit request at all
3. As proxy_admin: expect all four tabs, Request Logs, Audit Logs, Deleted Keys and Deleted Teams, unchanged from today

Type

🐛 Bug Fix

Caveats (if any)

• Org admins get three tabs, not four; Audit Logs stays admin-only
• Follow-up available: org-admin audit logs need an organization_id filter
• Two test files gained the query provider their component tree needs

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[greptile-apps]

Greptile Summary

The PR restores the Deleted Teams tab for organization administrators while preserving existing restrictions on other admin-only capabilities

• Adds a shared organization-admin membership hook
• Extends capability checks with an explicit organization-admin allowance
• Reuses the shared lookup in the sidebar
• Adds regression coverage for tab visibility and network access

Confidence Score: 5/5

The PR appears safe to merge

No blocking failure remains

Important Files Changed

Filename	Overview
ui/litellm-dashboard/src/app/(dashboard)/hooks/useIsOrgAdmin.ts	Centralizes organization-admin detection using the session role and organization memberships
ui/litellm-dashboard/src/app/(dashboard)/hooks/useCan.ts	Supplies organization-admin status to shared capability checks
ui/litellm-dashboard/src/utils/capabilities.ts	Grants organization administrators only the deleted-teams capability while retaining role-based checks
ui/litellm-dashboard/src/utils/roles.ts	Adds reusable helpers for recognizing organization-admin membership and session roles
ui/litellm-dashboard/src/utils/capabilities.test.ts	Replaces the previously flagged provenance comments with a named constant and tests backend-aligned entitlements
ui/litellm-dashboard/src/components/view_logs/index.test.tsx	Covers organization-admin tab visibility, audit-log exclusion, and tab selection behavior
ui/litellm-dashboard/src/components/view_logs/index.integration.test.tsx	Verifies organization administrators fetch deleted teams without requesting audit logs

_{Reviews (2): Last reviewed commit: "Merge remote-tracking branch 'origin/lit..." | Re-trigger Greptile}

[yuneng-berri]

@greptileai Addressed the comment policy finding: dropped both comments and moved the intent into a named constant instead

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!