diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py index 1978c0a1b0b..ac98939288e 100644 --- a/litellm/proxy/_types.py +++ b/litellm/proxy/_types.py @@ -566,6 +566,7 @@ class LiteLLMRoutes(enum.Enum): model_info_routes = [ "/model/info", "/v1/model/info", + "/model_group/info", ] llm_api_routes = ( diff --git a/tests/test_litellm/proxy/auth/test_route_checks.py b/tests/test_litellm/proxy/auth/test_route_checks.py index 2eab03c2947..71ccef620e5 100644 --- a/tests/test_litellm/proxy/auth/test_route_checks.py +++ b/tests/test_litellm/proxy/auth/test_route_checks.py @@ -424,6 +424,29 @@ def test_virtual_key_llm_api_routes_rejects_non_get_mcp_server_discovery(route, assert exc_info.value.status_code == 403 +def test_virtual_key_llm_api_routes_allows_model_group_info(): + """Regression test: the UI mints virtual keys with key_type="llm_api", which + maps to allowed_routes=["llm_api_routes"]. The Playground model picker loads + its options from GET /model_group/info, so that key must reach the route or + no model can be selected. The handler already scopes the response to the + models the key can call. + """ + + valid_token = UserAPIKeyAuth( + user_id="test_user", + allowed_routes=["llm_api_routes"], + ) + + assert ( + RouteChecks.is_virtual_key_allowed_to_call_route( + route="/model_group/info", + valid_token=valid_token, + request=_mock_request("GET"), + ) + is True + ) + + @pytest.mark.parametrize( "route", [ @@ -523,7 +546,7 @@ def test_virtual_key_llm_api_routes_allows_model_info(route): assert result is True -@pytest.mark.parametrize("route", ["/model/info", "/v1/model/info"]) +@pytest.mark.parametrize("route", ["/model/info", "/v1/model/info", "/model_group/info"]) def test_model_info_not_classified_as_llm_api(route): """Membership in `llm_api_routes` must not promote /model/info to an `is_llm_api_route()`. That predicate gates DISABLE_LLM_API_ENDPOINTS, @@ -535,10 +558,10 @@ def test_model_info_not_classified_as_llm_api(route): assert RouteChecks.is_llm_api_route(route=route) is False -@pytest.mark.parametrize("route", ["/v2/model/info", "/model_group/info"]) +@pytest.mark.parametrize("route", ["/v2/model/info"]) def test_virtual_key_llm_api_routes_denies_other_model_info_routes(route): - """The grant is scoped to the two /model/info paths. The paginated Admin UI - listing and the model-group endpoint stay outside it. + """The grant covers the model metadata reads an AI API key needs. The + paginated Admin UI listing stays outside it. """ valid_token = UserAPIKeyAuth(