From e989016c2d355694d7dbec1dc2926cb52df5805d Mon Sep 17 00:00:00 2001 From: Yassin Kortam Date: Thu, 11 Jun 2026 09:46:52 -0700 Subject: [PATCH] fix(auth_v2): match request paths with keyMatch so obj patterns span segments Use keyMatch instead of keyMatch2 in the Casbin matcher so a "/*" or "/scim/v2/*" obj pattern unambiguously spans path separators - a require_permission check on a multi-level route like /api/v1/models now matches the granting policy rather than risking a 403. keyMatch is the canonical trailing-wildcard route matcher; the anchored act matcher is unchanged, so a "GET" policy still cannot grant "GETX". --- litellm/proxy/auth_v2/rbac.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/litellm/proxy/auth_v2/rbac.py b/litellm/proxy/auth_v2/rbac.py index 1924497f9fe..f679e1c20c3 100644 --- a/litellm/proxy/auth_v2/rbac.py +++ b/litellm/proxy/auth_v2/rbac.py @@ -54,7 +54,7 @@ g = _, _ e = some(where (p.eft == allow)) [matchers] -m = g(r.sub, p.sub) && keyMatch2(r.obj, p.obj) && regexMatch(r.act, "^(" + p.act + ")$") +m = g(r.sub, p.sub) && keyMatch(r.obj, p.obj) && regexMatch(r.act, "^(" + p.act + ")$") """ _DEFAULT_GROUPING: List[Tuple[str, str]] = [