fix(proxy_server.py): allow user to create key for themselves

docs/my-website/docs/proxy/ui.md

@@ -37,14 +37,10 @@ http://0.0.0.0:8000/ui # <proxy_base_url>/ui
 
 ### 3. Create Key
 
-<Image img={require('../../img/litellm_ui_login.png')} />  
+<Image img={require('../../img/litellm_ui_create_key.png')} />  
 
-### 1. Start the proxy
-```
-litellm --config /path/to/config.yaml
-```
 
-## 1. Setup SSO/Auth for UI
+## Setup SSO/Auth for UI
 
 <Tabs>
 

litellm/proxy/proxy_server.py

@@ -650,9 +650,26 @@ async def user_api_key_auth(
                 elif route == "/model/info":
                     # /model/info just shows models user has access to
                     pass
-                elif allow_user_auth == True and route == "/key/generate":
+                elif route == "/key/generate":
-                    pass
+                    """
+                    Make sure user can only create a key for themselves
+                    - if user_id passed in -> check if it matches the user id for that key
+                    """
+                    request_data = await _read_request_body(request=request)
+                    user_id_passed_to_key_generate = request_data.get("user_id", None)
+                    if (
+                        user_id_passed_to_key_generate is not None
+                        and user_id_passed_to_key_generate != valid_token.user_id
+                    ):
+                        raise HTTPException(
+                            status_code=status.HTTP_403_FORBIDDEN,
+                            detail="key not allowed to crea this user's info",
+                        )
                 elif allow_user_auth == True and route == "/key/delete":
+                    """
+                    [TODO] Make sure user can only delete a key for themselves
+                    - if user_id passed in -> check if it matches the user id for that key
+                    """
                     pass
                 elif route == "/spend/logs":
                     # check if user can access this route