[Infra] Merge daily branch with main

[yuneng-jiang]

Relevant issues

Pre-Submission checklist

https://app.circleci.com/pipelines/github/BerriAI/litellm?branch=litellm_yj_march_17_2026

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Type

🚄 Infrastructure

Changes

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Mar 18, 2026 10:19pm

[codspeed-hq]

Merging this PR will not alter performance

✅ 16 untouched benchmarks

---

_{Comparing litellm_yj_march_17_2026 (1e6abf8) with main (cbb4c2c)¹}

Footnotes

1. No successful run was found on main (8e61b32) during the generation of this report, so cbb4c2c was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

In general, to fix log injection issues, any user-controlled value written to logs should be sanitized to remove or neutralize control characters that can affect log structure (e.g., \r, \n, \t). For plain-text logs, a common approach is to strip or replace line breaks with safe characters or spaces before passing them to the logger. This preserves the semantic content of the value while ensuring each log entry remains on a single line and cannot be spoofed by attackers.

For this specific case, the vulnerable sink is the verbose_proxy_logger.debug call in list_team_v2 that logs user_api_key_dict.user_id. The best minimal fix without changing functionality is to introduce a small local sanitization helper (or just sanitize inline) for user_api_key_dict.user_id before it is logged, replacing any \r and \n characters with empty strings. We will only touch the shown snippet in litellm/proxy/management_endpoints/team_endpoints.py. A clear and localized change is to define a sanitized variable safe_user_id_for_log immediately before the log statement:

safe_user_id_for_log = (
    str(user_api_key_dict.user_id).replace("\r", "").replace("\n", "")
    if user_api_key_dict.user_id is not None
    else None
)
verbose_proxy_logger.debug(
    "list_team_v2: org admin access for user=%s, org_ids=%s, user_id_filter=%s",
    safe_user_id_for_log,
    org_admin_org_ids,
    user_id,
)

This preserves the log message semantics while ensuring that any newline characters in user_id cannot affect log structure. No new imports or external dependencies are required; we use only built-in string methods. We are careful not to alter the values used for actual authorization logic—only the value passed into the logger is sanitized, so functionality remains unchanged.

To fix the problem, sanitize the user-controlled value before it is written to the log. In this context that means ensuring user_id (and any other directly logged user input) cannot inject line breaks or other control characters that could confuse log parsing. A simple and compatible mitigation for plain-text logs is to strip or replace \r and \n (and optionally other control characters) from the string before logging.

The single best minimally invasive fix here is to introduce a small helper function in this file that takes a string (or None) and returns a sanitized version with \r and \n removed. Then, wrap user_id in this helper when passing it to verbose_proxy_logger.debug at line 3463. This preserves all existing functionality (same value, minus dangerous line breaks) while eliminating the injection vector. The helper can be defined once near the top of the file (after imports) and reused wherever needed.

Concretely:

• In litellm/proxy/management_endpoints/team_endpoints.py, add a function such as _sanitize_for_logging(value: Optional[str]) -> Optional[str] that removes \r and \n from non-None strings.
• At the debug logging call around lines 3459–3464, change the third argument from user_id to _sanitize_for_logging(user_id) so that the logged value is safe.
• No new imports are required; we only use basic string operations.

[greptile-apps]

Greptile Summary

This PR merges the litellm_yj_march_17_2026 daily branch into main, delivering three main changes: (1) org admin access control for the /v2/team/list endpoint, (2) a members_count field on team list response items, and (3) performance indexes on LiteLLM_TeamTable. On the UI side, duplicate file-preview markup in ChatUI.tsx is extracted into a new FilePreviewCard component.

Key changes:

• list_team_v2: org admins may now query teams scoped to their organizations, bypassing the previous proxy-admin-only gate. A new _get_org_admin_org_ids helper fetches the caller's org memberships on every non-admin request.
• _build_team_list_where_conditions: refactored to use get_user_object (cached) instead of a raw prisma_client.db.litellm_usertable.find_unique call; returns None early when no results are possible to skip the DB round-trip.
• New TeamListItem type extends LiteLLM_TeamTable with members_count: int.
• DB migration adds indexes on organization_id, team_alias, and created_at — directly supporting the new query patterns.
• New FilePreviewCard component with full unit test coverage.
• Existing security tests updated to mock get_user_object instead of the raw Prisma table (appropriate — the underlying code changed, not the contract).

Confidence Score: 3/5

• Safe to review further; contains a privilege-escalation risk in the org admin + user_id code path that should be resolved before merging.
• The schema changes and UI refactor are clean. However, the new org admin access path in list_team_v2 allows an org admin to retrieve any user's teams across ALL organizations (not just their own) by passing an arbitrary user_id parameter. The intentional comment in the code acknowledges the lack of an org filter, but granting cross-org visibility to org admins is a privilege escalation beyond what they should be allowed to see. The redundant get_user_object call per request also adds unnecessary latency for all non-admin list requests.
• litellm/proxy/management_endpoints/team_endpoints.py — specifically the _build_team_list_where_conditions function's user_id + org_admin_org_ids interaction.

Important Files Changed

Filename	Overview
litellm/proxy/management_endpoints/team_endpoints.py	Core change: org admin access added to /v2/team/list, members_count added to list items, and user lookup refactored to get_user_object. Contains a privilege escalation risk when org admin queries with user_id parameter.
litellm/types/proxy/management_endpoints/team_endpoints.py	New TeamListItem type extending LiteLLM_TeamTable with a members_count: int = 0 field; TeamListResponse.teams union updated to include it. Backward-compatible change.
litellm-proxy-extras/litellm_proxy_extras/migrations/20260318140652_add_index_to_team_table/migration.sql	Adds three indexes (organization_id, team_alias, created_at) to LiteLLM_TeamTable. Clean performance improvement aligned with the new query patterns.
schema.prisma	Prisma schema updated with the same three indexes on LiteLLM_TeamTable; mirrors the migration SQL and the proxy-extras schema.
tests/test_litellm/proxy/management_endpoints/test_team_endpoints.py	Existing security tests updated to mock get_user_object (no real DB calls); three new org-admin scenario tests added (sees org teams, blocked from other orgs, user_id filter). All tests remain mock-only, appropriate for this directory.
ui/litellm-dashboard/src/components/playground/chat_ui/FilePreviewCard.tsx	New reusable component extracted from duplicated inline code in ChatUI.tsx; clean and well-tested.
ui/litellm-dashboard/src/components/playground/chat_ui/ChatUI.tsx	Replaced two copies of the file-preview card markup with <FilePreviewCard /> — pure refactor, no logic changes.
ui/litellm-dashboard/src/components/playground/chat_ui/FilePreviewCard.test.tsx	Comprehensive unit tests for the new FilePreviewCard component, covering PDF vs image rendering, remove callback, and uppercase .PDF extension handling.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[GET /v2/team/list] --> B{prisma_client connected?}
    B -- No --> Z[500 Error]
    B -- Yes --> C{is_proxy_admin?}
    C -- Yes --> G[Build where conditions\nno user filter imposed]
    C -- No --> D[_get_org_admin_org_ids\ncalls get_user_object for caller]
    D --> E{org_admin_org_ids\nreturned?}
    E -- Yes --> F{org filter\nprovided?}
    F -- org not in admin orgs --> Z2[403 Error]
    F -- allowed --> G
    E -- No --> H{allowed_route_check\ninside_route?}
    H -- Fails --> Z3[401 Error]
    H -- Passes --> I[Auto-inject\ncaller user_id]
    I --> G
    G --> J[_build_team_list_where_conditions]
    J --> K{user_id provided?}
    K -- Yes --> L[get_user_object for target user\n2nd DB call]
    L --> M{user has teams?}
    M -- No --> N[Return empty result\nskip DB]
    M -- Yes --> O[Filter by user team IDs\nNo org constraint applied ⚠️]
    K -- No --> P{org_admin_org_ids?}
    P -- Yes --> Q[Filter by admin org IDs]
    P -- No --> R[No user/org filter]
    O --> S[DB query + paginate]
    Q --> S
    R --> S
    N --> T[Return empty page]
    S --> U[_convert_teams_to_response_models\nadds members_count]
    U --> V[Return TeamListResponse]

Loading

_{Last reviewed commit: "Merge branch 'main' ..."}

[greptile-apps]

Org admin can view any user's teams across all orgs (privilege escalation)

When user_id is provided, the org-admin scope check is deliberately skipped (elif org_admin_org_ids is not None and not user_id). This means an org admin from org_A can pass user_id=<any_user> and retrieve all of that user's teams — even teams that belong to org_B or org_C, organizations the admin has no authority over.

The original /v2/team/list endpoint rejected org admins entirely; this PR grants them broader access than intended. The org-filter should be applied even when user_id is specified, e.g. by intersecting the user's team IDs with teams belonging to org_admin_org_ids.

Example of a more constrained fix:

# When user_id AND org_admin_org_ids are both present, combine the filters
if not user_team_ids:
    return None
where_conditions["team_id"] = {"in": user_team_ids}
if org_admin_org_ids is not None:
    # Limit to teams in the admin's orgs
    where_conditions["organization_id"] = {"in": org_admin_org_ids}

[greptile-apps]

Extra DB call on every non-admin /v2/team/list request

_get_org_admin_org_ids invokes get_user_object unconditionally for every non-proxy-admin call to list_team_v2. This adds a database round-trip (or cache lookup) on every request even when the caller is a plain user who will never be an org admin. While list_team_v2 is a management endpoint (not the inference critical path), the lookup is also repeated inside _build_team_list_where_conditions when a user_id filter is provided, so an org-admin query with user_id causes two get_user_object calls.

Consider passing the already-fetched caller user object into _build_team_list_where_conditions to avoid the second lookup, and caching the org-admin status on the UserAPIKeyAuth dict if this endpoint is called frequently.

[greptile-apps]

Whitespace-only leftover in test file

The change to test_list_team_v2_with_invalid_status converted indentation/trailing whitespace in surrounding tests but left one trailing-space line:

    mock_prisma_client = Mock()
    
    # Mock prisma_client to be non-None

The blank line between mock_prisma_client = Mock() and the comment still has trailing whitespace (the old style). Minor, but inconsistent with the rest of the cleanup in this file.

[ryan-crabbe]

lgtm

[superpoussin22]

think you should add IF NOT EXISTS in litellm-proxy-extras/litellm_proxy_extras/migrations/20260318140652_add_index_to_team_table/migration.sql @ryan-crabbe @yuneng-jiang