From 2d793a3acd086937b3b81eaade4281b7c7f4423b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jean=20Carlos=20Nu=C3=B1ez?= Date: Sun, 5 Apr 2026 14:35:37 -0500 Subject: [PATCH] Update litellm/proxy/auth/model_checks.py Update litellm/proxy/auth/model_checks.py Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> --- litellm/proxy/auth/model_checks.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/litellm/proxy/auth/model_checks.py b/litellm/proxy/auth/model_checks.py index 25f385ba474..e9066da2ea6 100644 --- a/litellm/proxy/auth/model_checks.py +++ b/litellm/proxy/auth/model_checks.py @@ -165,8 +165,10 @@ async def get_key_models_with_db_access_groups( db_models = await _get_models_from_db_access_groups( access_group_ids=user_api_key_dict.access_group_ids, ) - if db_models: - key_models = db_models + # Fail-closed: if the access group is configured but resolves to nothing + # (deleted group, DB unavailable, or empty group), use a sentinel so + # get_complete_model_list() does NOT fall through to team_models. + key_models = db_models if db_models else ["__access_group_no_models__"] return key_models