scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-16 23:41:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 103

fix(auth_v2): match request paths with keyMatch so obj patterns span segments

Browse source 
Use keyMatch instead of keyMatch2 in the Casbin matcher so a "/*" or
"/scim/v2/*" obj pattern unambiguously spans path separators - a require_permission
check on a multi-level route like /api/v1/models now matches the granting policy
rather than risking a 403. keyMatch is the canonical trailing-wildcard route
matcher; the anchored act matcher is unchanged, so a "GET" policy still cannot
grant "GETX".
This commit is contained in:
Yassin Kortam 2026-06-11 09:46:52 -07:00
parent a7f9d5d6b9
commit e989016c2d
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
litellm/proxy/auth_v2/rbac.py
View file

@ -54,7 +54,7 @@ g = _, _
e = some(where (p.eft == allow))
[matchers]
m = g(r.sub, p.sub) && keyMatch2(r.obj, p.obj) && regexMatch(r.act, "^(" + p.act + ")$")
m = g(r.sub, p.sub) && keyMatch(r.obj, p.obj) && regexMatch(r.act, "^(" + p.act + ")$")
"""
_DEFAULT_GROUPING: List[Tuple[str, str]] = [