From 6f24d85490f03c8af4f6b94e93aff0ffa2240c1b Mon Sep 17 00:00:00 2001
From: milan <milan@berri.ai>
Date: Tue, 25 Aug 2026 18:26:57 +0000
Subject: [PATCH 1/2] fix(proxy): grant users with empty models list direct
 access in model listing

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/proxy/proxy_server.py                 |  4 +-
 .../test_team_model_name_translation.py       | 55 +++++++++++++++++++
 2 files changed, 58 insertions(+), 1 deletion(-)

diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index 0abcdeaf3f6..3d3169eeab9 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -12382,8 +12382,10 @@ def get_direct_access_models(
 
     The 'all-proxy-models' sentinel grants direct access to every non-team
     deployment, mirroring how get_key_models expands it for the key/team path.
+    An empty models list means unrestricted access at call time (see
+    can_user_call_model), so it resolves the same way.
     """
-    if SpecialModelNames.all_proxy_models.value in user_db_object.models:
+    if not user_db_object.models or SpecialModelNames.all_proxy_models.value in user_db_object.models:
         return llm_router.get_model_ids(exclude_team_models=True)
 
     return [
diff --git a/tests/test_litellm/proxy/proxy_server/test_team_model_name_translation.py b/tests/test_litellm/proxy/proxy_server/test_team_model_name_translation.py
index 2f4018b55ab..cb1521f10ae 100644
--- a/tests/test_litellm/proxy/proxy_server/test_team_model_name_translation.py
+++ b/tests/test_litellm/proxy/proxy_server/test_team_model_name_translation.py
@@ -1507,6 +1507,61 @@ def test_get_direct_access_models_resolves_explicit_model_names():
     router.get_model_list.assert_called_once_with(model_name="gpt-4o")
 
 
+def test_get_direct_access_models_empty_models_grants_all_non_team_models():
+    """An empty user.models list means unrestricted access at call time
+    (can_user_call_model), so the listing must resolve it like 'all-proxy-models'
+    instead of returning nothing. Regression for a user with models=[] and no
+    teams seeing an empty Models+Endpoints page."""
+    router = MagicMock()
+    router.get_model_ids.return_value = ["global-id-1", "global-id-2"]
+
+    user = LiteLLM_UserTable(user_id="u", models=[], teams=[])
+
+    result = ps.get_direct_access_models(user_db_object=user, llm_router=router)
+
+    assert result == ["global-id-1", "global-id-2"]
+    router.get_model_ids.assert_called_once_with(exclude_team_models=True)
+    router.get_model_list.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_populate_team_access_grants_empty_models_user_direct_access(monkeypatch):
+    """An internal user with models=[] and no teams can call every non-team model,
+    so the Models+Endpoints page must list them instead of rendering empty."""
+    global_row = {
+        "model_name": "gpt-4o",
+        "litellm_params": {"model": "gpt-4o"},
+        "model_info": {"id": "global-id-1", "db_model": False},
+    }
+
+    router = MagicMock()
+    router.get_model_ids.return_value = ["global-id-1"]
+
+    user_row = LiteLLM_UserTable(
+        user_id="u",
+        user_role=LitellmUserRoles.INTERNAL_USER.value,
+        models=[],
+        teams=[],
+    )
+    prisma_client = MagicMock()
+    prisma_client.db.litellm_usertable.find_unique = AsyncMock(return_value=user_row)
+
+    monkeypatch.setattr(ps, "get_all_team_models", AsyncMock(return_value={}))
+
+    caller = UserAPIKeyAuth(user_id="u", user_role=LitellmUserRoles.INTERNAL_USER, team_models=[])
+
+    populated = await ps._populate_team_access_on_models(
+        user_api_key_dict=caller,
+        prisma_client=prisma_client,
+        llm_router=router,
+        all_models=[global_row],
+    )
+    visible = ps._filter_models_to_user_accessible(populated)
+
+    assert [m["model_info"]["id"] for m in visible] == ["global-id-1"]
+    assert visible[0]["model_info"]["direct_access"] is True
+
+
 @pytest.mark.asyncio
 async def test_populate_team_access_grants_all_proxy_models_user_direct_access(
     monkeypatch,

From bd2b93c6889614f04986fcd9d94067e061a20567 Mon Sep 17 00:00:00 2001
From: milan <milan@berri.ai>
Date: Tue, 25 Aug 2026 20:19:47 +0000
Subject: [PATCH 2/2] chore(proxy): drop redundant docstring note in
 get_direct_access_models

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/proxy/proxy_server.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index 3d3169eeab9..f536f521d57 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -12382,8 +12382,6 @@ def get_direct_access_models(
 
     The 'all-proxy-models' sentinel grants direct access to every non-team
     deployment, mirroring how get_key_models expands it for the key/team path.
-    An empty models list means unrestricted access at call time (see
-    can_user_call_model), so it resolves the same way.
     """
     if not user_db_object.models or SpecialModelNames.all_proxy_models.value in user_db_object.models:
         return llm_router.get_model_ids(exclude_team_models=True)