fix(proxy): honor wildcards in JWT role_permissions model RBAC

litellm/proxy/auth/handle_jwt.py

@@ -52,6 +52,7 @@ from litellm.proxy.utils import PrismaClient, ProxyLogging
 
 from .auth_checks import (
     _allowed_routes_check,
+    _check_model_access_helper,
     allowed_routes_check,
     get_actual_routes,
     get_end_user_object,
@@ -874,7 +875,13 @@ class JWTAuthManager:
         if role_based_models is None or model is None:
             return True
 
-        if model not in role_based_models:
+        from litellm.proxy.proxy_server import llm_router
+
+        if not _check_model_access_helper(
+            model=model,
+            llm_router=llm_router,
+            models=role_based_models,
+        ):
             raise HTTPException(
                 status_code=403,
                 detail=f"Role={rbac_role} not allowed to call model={model}. Allowed models={role_based_models}",

tests/proxy_unit_tests/test_user_api_key_auth.py

@@ -1035,6 +1035,33 @@ def test_can_rbac_role_call_model():
         )
 
 
+def test_can_rbac_role_call_model_wildcard():
+    from litellm.proxy.auth.handle_jwt import JWTAuthManager
+    from litellm.proxy._types import RoleBasedPermissions
+
+    perms = [
+        RoleBasedPermissions(
+            role=LitellmUserRoles.INTERNAL_USER,
+            models=["bedrock-claude-*"],
+        ),
+        RoleBasedPermissions(
+            role=LitellmUserRoles.PROXY_ADMIN,
+            models=["*"],
+        ),
+    ]
+
+    assert JWTAuthManager.can_rbac_role_call_model(
+        rbac_role=LitellmUserRoles.INTERNAL_USER,
+        general_settings={"role_permissions": perms},
+        model="bedrock-claude-draft-rep-sonnet",
+    )
+    assert JWTAuthManager.can_rbac_role_call_model(
+        rbac_role=LitellmUserRoles.PROXY_ADMIN,
+        general_settings={"role_permissions": perms},
+        model="any-model-name",
+    )
+
+
 def test_can_rbac_role_call_model_no_role_permissions():
     from litellm.proxy.auth.handle_jwt import JWTAuthManager