litellm ryan march 31

[ryan-crabbe-berri]

changes

fix(ui): allow changing team organization from team settings
docs: document default_team_params in config reference
feat(teams): resolve access group resources in team endpoints
fix(ui): add paginated team search to usage page filter
fix(ui): wire team_id filter to key alias dropdown on Virtual Keys tab
feat(teams): resolve access group resources in team endpoints

circleci

https://app.circleci.com/pipelines/github/BerriAI/litellm?branch=litellm_ryan-march-31

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Apr 4, 2026 5:10pm

[codspeed-hq]

Merging this PR will not alter performance

✅ 16 untouched benchmarks

---

_{Comparing litellm_ryan-march-31 (76c0591) with main (a5322c6)}

[greptile-apps]

Greptile Summary

This PR bundles five improvements: (1) resolving access-group models/MCP-servers/agents on team list and team-info endpoints via a batch DB fetch; (2) a new team_id filter on /key/aliases with corresponding UI wiring through PaginatedKeyAliasSelect; (3) a paginated team multi-select filter on the Usage Page; (4) allowing org reassignment from Team Settings via a proper <Select> (fixes the previous empty-string-instead-of-null regression); and (5) several PLR0915 refactors that extract long inline blocks into named helpers.

Key points:

• The batch-fetch pattern in _batch_resolve_access_group_resources is correct and avoids N+1 queries.
• The organization_id ?? null fix in TeamInfo.tsx resolves the prior concern about writing empty strings to the DB.
• The team_id security scoping for non-admin users is correct: the scope conditions ensure a user who requests team_id=X but isn't a member of team X receives an empty result.
• Access-group model display for isAllModels (when direct models list is empty but access-group models exist) still shows "All Proxy Models" in both ModelsCell.tsx and TeamInfo.tsx; this was noted in prior review threads and has not been resolved in this PR.
• The hardcoded \"Team ID\" string in PaginatedKeyAliasSelect still couples the component to the filter label — also noted in prior threads.

Confidence Score: 4/5

Safe to merge after addressing prior review threads; no new critical issues introduced.

All new backend logic (batch access-group fetch, team_id filter, access-control helpers) is correct and well-tested. The organization_id null fix from a prior review thread is confirmed present. The remaining open concerns (isAllModels ignoring access_group_models in ModelsCell and TeamInfo, hardcoded "Team ID" filter key) were carried over from previous threads and are not newly introduced by this PR. Score is 4 rather than 5 because those prior threads are still unresolved in the merged code.

ui/litellm-dashboard/src/app/(dashboard)/teams/components/TeamsTable/ModelsCell.tsx and ui/litellm-dashboard/src/components/team/TeamInfo.tsx — the isAllModels / access_group_models display bug from prior threads remains open.

Important Files Changed

Filename	Overview
litellm/proxy/management_endpoints/team_endpoints.py	Adds batch access-group resource resolution helpers and extracts two large inline blocks into named functions; logic is correct but _resolve_team_access_group_resources is defined before its dependency _batch_resolve_access_group_resources (valid Python, minor readability concern).
litellm/proxy/management_endpoints/key_management_endpoints.py	Extracts non-admin alias scope logic into _apply_non_admin_alias_scope and adds team_id filter; security scoping is correct — non-admin users querying a team they're not a member of receive an empty result.
litellm/types/proxy/management_endpoints/team_endpoints.py	Adds three Optional[List[str]] fields to TeamListItem for access-group-resolved models, MCP server IDs, and agent IDs; clean schema extension.
ui/litellm-dashboard/src/components/team/TeamInfo.tsx	Fixes organization_id from empty-string to null on clear, replaces read-only Input with Select dropdown; models section now shows access-group badges in green but still shows "All proxy models" when direct models is empty regardless of access_group_models (pre-existing, in prior review thread).
ui/litellm-dashboard/src/app/(dashboard)/teams/components/TeamsTable/ModelsCell.tsx	Refactored to use unified ModelEntry[] combining direct and access-group models with colour-coded badges; isAllModels still ignores access_group_models when direct models is empty (pre-existing, in prior review thread).
ui/litellm-dashboard/src/components/common_components/team_multi_select.tsx	New paginated team multi-select component using useInfiniteTeams with debounced search and scroll-based pagination; implementation is correct.
ui/litellm-dashboard/src/components/KeyAliasSelect/PaginatedKeyAliasSelect/PaginatedKeyAliasSelect.tsx	Passes allFilters prop through and extracts team_id via hardcoded "Team ID" key; functionally correct but tightly coupled to filter label naming convention (noted in prior review thread).
ui/litellm-dashboard/src/components/UsagePage/components/EntityUsage/EntityUsage.tsx	Adds TeamMultiSelect as the filter control for entityType="team" and hides the legacy UsageExportHeader filter for this case; correctly reuses selectedTags state.
tests/test_litellm/proxy/management_endpoints/test_team_endpoints.py	Adds six async unit tests for _batch_resolve_access_group_resources covering empty input, single group, multi-group, missing group, null prisma client, and deduplication; all use mocks, no real network calls.
ui/litellm-dashboard/src/components/molecules/filter.tsx	Adds allFilters prop to FilterOptionCustomComponentProps and threads it through to custom filter components; minimal, correct change.

Sequence Diagram

sequenceDiagram
    participant UI as UI (Virtual Keys Tab)
    participant FilterComponent as FilterComponent
    participant PaginatedKeyAliasSelect as PaginatedKeyAliasSelect
    participant useInfiniteKeyAliases as useInfiniteKeyAliases
    participant keyAliasesCall as keyAliasesCall (networking.tsx)
    participant Backend as /key/aliases (FastAPI)
    participant DB as PostgreSQL

    UI->>FilterComponent: Render with "Team ID" filter option
    FilterComponent->>PaginatedKeyAliasSelect: allFilters={"Team ID": "team-xyz"}
    PaginatedKeyAliasSelect->>useInfiniteKeyAliases: (pageSize, search, teamId="team-xyz")
    useInfiniteKeyAliases->>keyAliasesCall: (token, page, size, search, team_id="team-xyz")
    keyAliasesCall->>Backend: GET /key/aliases?team_id=team-xyz
    Backend->>Backend: _apply_non_admin_alias_scope (scope WHERE)
    Backend->>DB: SELECT key_alias FROM LiteLLM_VerificationToken WHERE ... AND team_id=$N
    DB-->>Backend: Filtered aliases
    Backend-->>UI: PaginatedKeyAliasResponse

    Note over UI,Backend: Access group resolution path
    UI->>Backend: GET /team/info?team_id=abc
    Backend->>Backend: _resolve_team_access_group_resources
    Backend->>Backend: _batch_resolve_access_group_resources
    Backend->>DB: SELECT FROM litellm_accessgrouptable WHERE access_group_id IN (...)
    DB-->>Backend: Access group rows (models, mcp_servers, agents)
    Backend-->>UI: TeamInfoResponseObject with access_group_models populated

Loading

_{Reviews (4): Last reviewed commit: "chore: regen poetry.lock for litellm-pro..." | Re-trigger Greptile}

[greptile-apps]

Raw SQL for new team_id filter

The team_id filter is added using the existing raw-SQL pattern in this function. The comment at the top of the function explains why raw SQL is used here (Prisma doesn't support column-level SELECT projection on find_many), and the value is correctly parameterized, so there is no injection risk. However, CLAUDE.md explicitly states: "Do not write raw SQL for proxy DB operations. Use Prisma model methods instead of execute_raw/query_raw." The existing code already violates this rule, but extending it amplifies the concern. If a Prisma-level approach is ever adopted (e.g. returning only the key_alias column), the team_id filter should migrate with it.

[greptile-apps]

Empty string sent as organization_id when field is cleared

Ant Design's <Select allowClear> returns undefined when the user clears the selection. The expression values.organization_id ?? "" converts undefined to "", so the API call receives { organization_id: "" }. Prisma will write an empty string to the organization_id column rather than null, which is inconsistent with the rest of the codebase (organization IDs are UUIDs or null). This can corrupt the team record.

Use null as the fallback so the backend receives a proper null value to clear the association:

Suggested change

	...(secretManagerSettings !== undefined ? { secret_manager_settings: secretManagerSettings } : {}),
	},
	...(values.policies?.length > 0 ? { policies: values.policies } : {}),
	organization_id: values.organization_id,
	...(values.organization_id !== info.organization_id
	? { organization_id: values.organization_id ?? "" }
	...(values.organization_id !== info.organization_id
	? { organization_id: values.organization_id ?? null }
	: {}),

[greptile-apps]

"All proxy models" badge hides access-group models when direct models list is empty

The condition info.models.length === 0 || info.models.includes("all-proxy-models") short-circuits to the red "All proxy models" badge even when info.access_group_models is non-empty. A team that has no directly-assigned models but inherits models from access groups will therefore display "All Proxy Models" — which is the opposite of the access restriction that is actually in place.

The same issue exists in ModelsCell.tsx where isAllModels is computed purely from team.models without considering team.access_group_models.

A straightforward fix is to treat the team as having restricted models when access_group_models are present:

// TeamInfo.tsx
const hasNoModels =
  (info.models.length === 0 || info.models.includes("all-proxy-models")) &&
  !(info.access_group_models?.length);

Then branch on hasNoModels instead of the inline condition.

[greptile-apps]

isAllModels ignores access-group models — same bug as in TeamInfo.tsx

isAllModels is set to true whenever team.models is empty, even if team.access_group_models has entries. Because isAllModels === true causes modelEntries to be [], the component then renders the red "All Proxy Models" badge rather than the inherited access-group models. A team restricted to, say, ["gpt-4"] via an access group would incorrectly appear to have unrestricted model access in the table.

Fix by also checking whether access-group models exist:

const isAllModels =
  (!team.models || team.models.length === 0 || team.models.includes("all-proxy-models")) &&
  !(team.access_group_models?.length);

[greptile-apps]

Hardcoded "Team ID" key couples component to filter naming convention

allFilters?.["Team ID"] relies on the filter option being named exactly "Team ID" in the parent FilterComponent. If that name ever changes (e.g. to "team_id" or "Team"), this silently returns undefined and the filter stops working with no error. Consider accepting team_id as an explicit prop rather than reading it from the opaque allFilters bag, or at least exporting the key string as a shared constant.