Skip to content

fix(ui): guard PriceDataManagementTab TabPanel with admin role check#24312

Merged
RheagalFire merged 1 commit intoBerriAI:litellm_oss_staging_03_21_2026from
xykong:fix/price-data-management-tab-admin-guard
Mar 22, 2026
Merged

fix(ui): guard PriceDataManagementTab TabPanel with admin role check#24312
RheagalFire merged 1 commit intoBerriAI:litellm_oss_staging_03_21_2026from
xykong:fix/price-data-management-tab-admin-guard

Conversation

@xykong
Copy link
Contributor

@xykong xykong commented Mar 21, 2026

Summary

Fixes a missing role guard on the PriceDataManagementTab TabPanel that causes repeated 401 errors in proxy logs for all non-admin user sessions.

Fixes #24308

Root Cause

In ModelsAndEndpointsView.tsx, the Tab label was already correctly guarded:

{all_admin_roles.includes(userRole) && <Tab>Price Data Reload</Tab>}  // ✅ guarded

But the corresponding TabPanel was rendered unconditionally:

<PriceDataManagementTab />  // ❌ no role guard — always mounts

PriceDataManagementTab polls two admin-only endpoints every ~30 seconds:

  • GET /schedule/model_cost_map_reload/status
  • GET /model/cost_map/source

For internal_user and other non-admin roles, every poll produces a 401 Unauthorized error in the server logs.

Change

- <PriceDataManagementTab />
+ {all_admin_roles.includes(userRole) && <PriceDataManagementTab />}

One-line fix. Aligns the TabPanel render condition with the existing Tab label guard.

Testing

  • internal_user sessions no longer trigger 401 errors for /schedule/model_cost_map_reload/status or /model/cost_map/source
  • ✅ Admin users still see and can use the Price Data Reload tab normally
  • ✅ No visual regression for admin users

Impact

  • Minimal: 1-line change
  • No breaking changes
  • Affected roles: internal_user, team, any non-admin role

The Tab label for 'Price Data Reload' was already guarded with
all_admin_roles.includes(userRole), but the corresponding TabPanel
was rendered unconditionally, causing the PriceDataManagementTab
component to mount for all users.

This component polls admin-only routes every ~30s:
- GET /schedule/model_cost_map_reload/status
- GET /model/cost_map/source

For internal_user sessions, each poll produced a 401 ERROR log.
Align the TabPanel render condition with the existing Tab guard.

Fixes BerriAI#24308
@vercel
Copy link

vercel bot commented Mar 21, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
litellm Ready Ready Preview, Comment Mar 21, 2026 6:38pm

Request Review

@greptile-apps
Copy link
Contributor

greptile-apps bot commented Mar 21, 2026

Greptile Summary

This PR fixes a missing role guard on the PriceDataManagementTab TabPanel in ModelsAndEndpointsView.tsx, where the Tab label was already correctly guarded but the corresponding panel was unconditionally mounted — causing PriceDataManagementTab to poll two admin-only endpoints (/schedule/model_cost_map_reload/status and /model/cost_map/source) every ~30 seconds for all non-admin sessions, flooding proxy logs with 401 errors.

  • Fix: Wraps <PriceDataManagementTab /> with {all_admin_roles.includes(userRole) && ...}, exactly mirroring the guard already on the Tab label (line 386).
  • Consistency: The pattern all_admin_roles.includes(userRole) is used uniformly throughout the file for every other admin-only Tab — this change aligns the panel with that convention.
  • Pre-existing note: The other admin-only TabPanels (CredentialsPanel, PassThroughSettings, HealthCheckComponent, ModelRetrySettingsTab, ModelGroupAliasSettings) remain unconditionally rendered for non-admin users as a pre-existing condition. If any of those components also poll admin-only endpoints, they could cause similar 401 noise — worth auditing in a follow-up.
  • Impact: Minimal, one-line change. No breaking changes introduced.

Confidence Score: 5/5

  • This PR is safe to merge — it is a minimal, targeted fix that prevents a component from mounting for non-admin users, with no risk of regression for admin users.
  • The change is a single line that mirrors an identical guard already present on the corresponding Tab label. The all_admin_roles.includes(userRole) pattern is used consistently throughout the file and is the correct predicate. There are no logic inversions, no new dependencies, and no side effects. Admin users are unaffected.
  • No files require special attention.

Important Files Changed

Filename Overview
ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/ModelsAndEndpointsView.tsx Adds all_admin_roles.includes(userRole) guard to PriceDataManagementTab's TabPanel, matching the identical guard already on its Tab label. One-line fix that prevents non-admin sessions from mounting the component and triggering repeated 401 errors against admin-only polling endpoints.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[ModelsAndEndpointsView renders] --> B{Is user an admin?}

    B -- Yes --> C[Render Tab: Price Data Reload]
    B -- Yes --> D[Render TabPanel: PriceDataManagementTab]
    D --> E[Polls status endpoint every 30s]
    D --> F[Polls cost_map source every 30s]

    B -- No --> G[Tab NOT rendered]
    B -- No, before fix --> H[TabPanel STILL mounted - BUG]
    B -- No, after fix --> I[TabPanel NOT mounted - FIXED]

    H --> J[401 Unauthorized errors in proxy logs]
    I --> K[No unnecessary API calls]
Loading

Last reviewed commit: "fix(ui): guard Price..."

@codspeed-hq
Copy link
Contributor

codspeed-hq bot commented Mar 21, 2026

Merging this PR will not alter performance

✅ 16 untouched benchmarks


Comparing xykong:fix/price-data-management-tab-admin-guard (aa06bc8) with main (b64b0d4)

Open in CodSpeed

@RheagalFire RheagalFire changed the base branch from main to litellm_oss_staging_03_21_2026 March 22, 2026 09:44
@RheagalFire RheagalFire merged commit 053e923 into BerriAI:litellm_oss_staging_03_21_2026 Mar 22, 2026
38 of 39 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: PriceDataManagementTab always rendered for non-admin users — causes repeated 401 errors on cost_map routes

2 participants