From a0958d5c217321242ebc5227850eceea7276b855 Mon Sep 17 00:00:00 2001 From: "devin-ai-integration[bot]" <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 3 Sep 2026 15:12:06 -0700 Subject: [PATCH] perf(auth): skip object permission DB lookup when no vector stores requested (#39347) * perf(auth): skip object permission DB lookup when no vector stores requested Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(auth): justify module patches Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: yassin Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- litellm/proxy/auth/auth_checks.py | 2 +- .../proxy/auth/test_auth_checks.py | 32 +++++++++++++++++++ 2 files changed, 33 insertions(+), 1 deletion(-) diff --git a/litellm/proxy/auth/auth_checks.py b/litellm/proxy/auth/auth_checks.py index 0db4cbc3bf2..2b328b455dc 100644 --- a/litellm/proxy/auth/auth_checks.py +++ b/litellm/proxy/auth/auth_checks.py @@ -5788,7 +5788,7 @@ async def vector_store_access_check( vector_store_ids_to_run: Final = litellm.vector_store_registry.get_vector_store_ids_to_run( non_default_params=request_body, tools=request_body.get("tools", None) ) - if vector_store_ids_to_run is None: + if not vector_store_ids_to_run: verbose_proxy_logger.debug("Vector store to run not found, skipping vector store access check") return True diff --git a/tests/test_litellm/proxy/auth/test_auth_checks.py b/tests/test_litellm/proxy/auth/test_auth_checks.py index ffe3e0fee12..be83ca57e76 100644 --- a/tests/test_litellm/proxy/auth/test_auth_checks.py +++ b/tests/test_litellm/proxy/auth/test_auth_checks.py @@ -1349,6 +1349,38 @@ async def test_vector_store_access_check_early_returns( assert result == expected_result +@pytest.mark.asyncio +async def test_vector_store_access_check_skips_db_lookup_when_no_vector_stores_requested(): + """Registry returns [] (not None) for plain requests; no object permission DB lookup should happen.""" + valid_token = UserAPIKeyAuth(token="test-token", object_permission_id="perm-123") + team_object = MagicMock() + team_object.object_permission_id = "team-permission" + + mock_prisma_client = MagicMock() + find_unique = AsyncMock() + mock_prisma_client.db.litellm_objectpermissiontable.find_unique = find_unique + + mock_vector_store_registry = MagicMock() + mock_vector_store_registry.get_vector_store_ids_to_run.return_value = [] + + with ( + patch( # test-quality-ok: production auth reads these module globals; no dependency injection seam exists + "litellm.proxy.proxy_server.prisma_client", mock_prisma_client + ), + patch( # test-quality-ok: production auth reads this module global; no dependency injection seam exists + "litellm.vector_store_registry", mock_vector_store_registry + ), + ): + result = await vector_store_access_check( + request_body={"messages": [{"role": "user", "content": "test"}]}, + team_object=team_object, + valid_token=valid_token, + ) + + assert result is True + find_unique.assert_not_awaited() + + @pytest.mark.parametrize( "object_permissions,vector_store_ids,should_raise,error_type", [