From 7ff66f523e64bf71e6578656042d73dbf15992c7 Mon Sep 17 00:00:00 2001 From: mateo-berri <277851410+mateo-berri@users.noreply.github.com> Date: Fri, 26 Jun 2026 02:10:14 +0000 Subject: [PATCH] fix(jwt): drop user team IDs from db-fallback model-access 403 detail The model-access-denied 403 in _resolve_db_team_fallback echoed the user's full DB team-id list in its detail. It is only the caller's own memberships, but it is inconsistent with the membership-validation 403 in the same feature that was deliberately scrubbed of team IDs. Replace the enumerated list with a generic "no team you are a member of has access" message. Regression extends test_resolve_db_team_fallback_distinguishes_no_membership_vs_model_denied to assert the team id is absent from the detail. --- litellm/proxy/auth/handle_jwt.py | 5 +++-- tests/test_litellm/proxy/auth/test_handle_jwt.py | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py index bfccace9f85..046755305a9 100644 --- a/litellm/proxy/auth/handle_jwt.py +++ b/litellm/proxy/auth/handle_jwt.py @@ -2061,8 +2061,9 @@ class JWTAuthManager: raise HTTPException( status_code=403, detail=( - f"No team has access to the requested model: {requested_model}. " - f"Checked teams={user_team_ids}. Check `/models` to see all available models." + f"No team you are a member of has access to the requested " + f"model: {requested_model}. Check `/models` to see the models " + f"available to you." ), ) raise HTTPException( diff --git a/tests/test_litellm/proxy/auth/test_handle_jwt.py b/tests/test_litellm/proxy/auth/test_handle_jwt.py index 3573850a0f9..23c616ad5c4 100644 --- a/tests/test_litellm/proxy/auth/test_handle_jwt.py +++ b/tests/test_litellm/proxy/auth/test_handle_jwt.py @@ -5020,6 +5020,7 @@ async def test_resolve_db_team_fallback_distinguishes_no_membership_vs_model_den assert model_denied.value.status_code == 403 assert "requested model" in model_denied.value.detail assert "gpt-4" in model_denied.value.detail + assert "only_team" not in model_denied.value.detail assert no_member.value.status_code == 403 assert "not a member of any team" in no_member.value.detail