fix(jwt): drop user team IDs from db-fallback model-access 403 detail

The model-access-denied 403 in _resolve_db_team_fallback echoed the user's
full DB team-id list in its detail. It is only the caller's own memberships,
but it is inconsistent with the membership-validation 403 in the same feature
that was deliberately scrubbed of team IDs. Replace the enumerated list with a
generic "no team you are a member of has access" message. Regression extends
test_resolve_db_team_fallback_distinguishes_no_membership_vs_model_denied to
assert the team id is absent from the detail.
This commit is contained in:
mateo-berri 2026-06-26 02:10:14 +00:00
parent 1f038f8800
commit 7ff66f523e
No known key found for this signature in database
2 changed files with 4 additions and 2 deletions

View file

@ -2061,8 +2061,9 @@ class JWTAuthManager:
raise HTTPException(
status_code=403,
detail=(
f"No team has access to the requested model: {requested_model}. "
f"Checked teams={user_team_ids}. Check `/models` to see all available models."
f"No team you are a member of has access to the requested "
f"model: {requested_model}. Check `/models` to see the models "
f"available to you."
),
)
raise HTTPException(

View file

@ -5020,6 +5020,7 @@ async def test_resolve_db_team_fallback_distinguishes_no_membership_vs_model_den
assert model_denied.value.status_code == 403
assert "requested model" in model_denied.value.detail
assert "gpt-4" in model_denied.value.detail
assert "only_team" not in model_denied.value.detail
assert no_member.value.status_code == 403
assert "not a member of any team" in no_member.value.detail