From 168b5bc4fbaaeae00ae88d8173f55944a12ef84e Mon Sep 17 00:00:00 2001 From: yassin Date: Tue, 15 Sep 2026 22:05:08 +0000 Subject: [PATCH 1/9] feat(proxy): configurable client-facing model access denied message Add litellm_settings.model_access_denied_message, a template ({model} placeholder) returned to clients instead of the detailed "can only access models=[...]" text on key/team/user/org/project and team-member model access denials. The full denial reason is still written to the proxy logs at WARNING. Unset keeps the existing detailed message, status codes and error types are unchanged. Expose the new setting and the existing expose_router_debug_in_errors flag in the Admin UI general settings (String editor, Boolean toggle with an explicit True default) and allow both as safe DB overrides so they persist and propagate across workers. Resolves LIT-5283 Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- litellm/__init__.py | 1 + litellm/constants.py | 3 + litellm/proxy/auth/auth_checks.py | 24 ++++- litellm/proxy/proxy_server.py | 31 +++++- .../proxy/auth/test_auth_checks.py | 94 +++++++++++++++++++ tests/test_litellm/proxy/test_proxy_server.py | 66 +++++++++++++ .../general_settings.integration.test.tsx | 33 ++++++- .../_components/general_settings.tsx | 14 ++- 8 files changed, 259 insertions(+), 7 deletions(-) diff --git a/litellm/__init__.py b/litellm/__init__.py index ccfbf80369f..97457f3e3cc 100644 --- a/litellm/__init__.py +++ b/litellm/__init__.py @@ -219,6 +219,7 @@ redact_user_api_key_info: Optional[bool] = False # major release; opt in early with `litellm.expose_router_debug_in_errors # = False`. expose_router_debug_in_errors: bool = True +model_access_denied_message: str | None = None filter_invalid_headers: Optional[bool] = False add_user_information_to_llm_headers: Optional[bool] = ( None # adds user_id, team_id, token hash (params from StandardLoggingMetadata) to request headers diff --git a/litellm/constants.py b/litellm/constants.py index ba5ec73d435..9a9bb59d8b2 100644 --- a/litellm/constants.py +++ b/litellm/constants.py @@ -98,6 +98,7 @@ BASE64_TRUNCATION_OFFLOAD_THRESHOLD_CHARS: Final = 256 * 1024 REDACTED_BY_LITELLM: Final = "redacted-by-litellm" # in-memory stand-in handed to provider converters for redacted arguments; never stored REDACTED_TOOL_CALL_ARGUMENTS_PLACEHOLDER: Final = "{}" +MODEL_ACCESS_DENIED_MESSAGE_MODEL_PLACEHOLDER: Final = "{model}" MAX_STRING_LENGTH_STDOUT_LOG: Final = get_env_int("MAX_STRING_LENGTH_STDOUT_LOG", 4096) @@ -1796,6 +1797,8 @@ LITELLM_SETTINGS_SAFE_DB_OVERRIDES: Final = [ "max_ui_session_budget", "budget_rollover", "mcp_tool_search", + "model_access_denied_message", + "expose_router_debug_in_errors", ] SPECIAL_LITELLM_AUTH_TOKEN: Final = ["ui-token"] DEFAULT_MANAGEMENT_OBJECT_IN_MEMORY_CACHE_TTL = int(os.getenv("DEFAULT_MANAGEMENT_OBJECT_IN_MEMORY_CACHE_TTL", 60)) diff --git a/litellm/proxy/auth/auth_checks.py b/litellm/proxy/auth/auth_checks.py index 355fc3f6a21..6435ce0d12f 100644 --- a/litellm/proxy/auth/auth_checks.py +++ b/litellm/proxy/auth/auth_checks.py @@ -32,6 +32,7 @@ from litellm.constants import ( DEFAULT_MAX_RECURSE_DEPTH, EMAIL_BUDGET_ALERT_MAX_SPEND_ALERT_PERCENTAGE, END_USER_RESTRICTED_REGISTRY_MAX_SIZE, + MODEL_ACCESS_DENIED_MESSAGE_MODEL_PLACEHOLDER, MODEL_ACCESS_GROUP_REGISTRY_MAX_SIZE, REGISTRY_ERROR_NEGATIVE_CACHE_TTL, TAG_REGISTRY_MAX_SIZE, @@ -4033,6 +4034,14 @@ async def _get_agent_ids_from_access_groups( ) +def _client_facing_model_access_denied_message(internal_message: str, model: str | list[str]) -> str: + template: Final = litellm.model_access_denied_message + if not template: + return internal_message + verbose_proxy_logger.warning(internal_message) + return template.replace(MODEL_ACCESS_DENIED_MESSAGE_MODEL_PLACEHOLDER, str(model)) + + def _resolve_all_team_model_sentinel_for_auth_check( models: list[str], llm_router: Router | None, @@ -4155,7 +4164,10 @@ def _can_object_call_model( return True raise ProxyException( - message=f"{object_type} not allowed to access model. This {object_type} can only access models={models}. Tried to access {model}", + message=_client_facing_model_access_denied_message( + internal_message=f"{object_type} not allowed to access model. This {object_type} can only access models={models}. Tried to access {model}", + model=model, + ), type=ProxyErrorTypes.get_model_access_error_type_for_object(object_type=object_type), param="model", code=status.HTTP_403_FORBIDDEN, @@ -4781,7 +4793,10 @@ async def can_user_call_model( if SpecialModelNames.no_default_models.value in user_object.models: raise ProxyException( - message=f"User not allowed to access model. No default model access, only team models allowed. Tried to access {model}", + message=_client_facing_model_access_denied_message( + internal_message=f"User not allowed to access model. No default model access, only team models allowed. Tried to access {model}", + model=model, + ), type=ProxyErrorTypes.key_model_access_denied, param="model", code=status.HTTP_403_FORBIDDEN, @@ -5383,7 +5398,10 @@ async def _check_team_member_model_access( ) except ProxyException: raise ProxyException( - message=f"Team member not allowed to access model. User={valid_token.user_id}, Team={team_object.team_id}, Model={model}. Allowed member models = {member_allowed_models}", + message=_client_facing_model_access_denied_message( + internal_message=f"Team member not allowed to access model. User={valid_token.user_id}, Team={team_object.team_id}, Model={model}. Allowed member models = {member_allowed_models}", + model=model, + ), type=ProxyErrorTypes.team_model_access_denied, param="model", code=status.HTTP_403_FORBIDDEN, diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py index f63e088ebf7..f758628c02a 100644 --- a/litellm/proxy/proxy_server.py +++ b/litellm/proxy/proxy_server.py @@ -17435,11 +17435,13 @@ GeneralSettingsUILiteLLMValue = float | bool | str | None class GeneralSettingsUILiteLLMFieldSpec(TypedDict): - type: Literal["Float", "Dollar", "Boolean", "Select"] + type: Literal["Float", "Dollar", "Boolean", "Select", "String"] description: str options: NotRequired[tuple[str, ...]] tab: NotRequired[str] # Admin UI sub-tab this field renders under; None groups it with the rest - default: NotRequired[float] # reset/clear restores this instead of None; fields whose None means fail-open set it + default: NotRequired[ + float | bool + ] # reset/clear restores this instead of None; fields whose None means fail-open set it _GENERAL_SETTINGS_UI_LITELLM_FIELDS: Final[dict[str, GeneralSettingsUILiteLLMFieldSpec]] = { @@ -17481,6 +17483,24 @@ _GENERAL_SETTINGS_UI_LITELLM_FIELDS: Final[dict[str, GeneralSettingsUILiteLLMFie "with this budget. Clearing restores the $1 default." ), }, + "model_access_denied_message": { + "type": "String", + "description": ( + "Client-facing error message returned when a key, team, user, org or project is not allowed " + "to call the requested model. {model} is replaced with the requested model name. The full " + "denial reason (allowed models and access groups) is still written to the proxy logs. " + "Leave empty to return the detailed message to clients." + ), + }, + "expose_router_debug_in_errors": { + "type": "Boolean", + "default": True, + "description": ( + "Append router debug details (model group, configured fallbacks, fallback errors, cooldown " + "info) to error messages returned to clients. Turn off to keep those details in the proxy " + "logs only." + ), + }, } @@ -17528,6 +17548,13 @@ def _validate_general_settings_ui_litellm_value(field_name: str, value: object) detail={"error": f"{field_name} must be a positive dollar amount or empty"}, ) return float(value) + case "String": + if not isinstance(value, str): + raise HTTPException( + status_code=400, + detail={"error": f"{field_name} must be a string or empty"}, + ) + return value case _: assert_never(field_type) diff --git a/tests/test_litellm/proxy/auth/test_auth_checks.py b/tests/test_litellm/proxy/auth/test_auth_checks.py index 8c8b755195f..e99e92fcd02 100644 --- a/tests/test_litellm/proxy/auth/test_auth_checks.py +++ b/tests/test_litellm/proxy/auth/test_auth_checks.py @@ -1679,6 +1679,100 @@ def test_can_object_call_model_no_access_to_alias_or_underlying(): assert "my-fake-gpt" in str(exc_info.value.message) +_DENIED_MESSAGE_TEMPLATE: Final = "The model `{model}` is unavailable for this API key or does not exist." + + +def test_can_object_call_model_denial_uses_configured_message_and_logs_detail(monkeypatch, caplog): + """LIT-5283: with model_access_denied_message set, the client sees only the template with + {model} filled in, while the allowed models / access groups stay in the proxy log.""" + monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) + + with caplog.at_level("WARNING", logger="LiteLLM Proxy"): + with pytest.raises(ProxyException) as exc_info: + _can_object_call_model( + model="anthropic-sonnet-4-5", + llm_router=None, + models=["internal-models"], + object_type="key", + ) + + assert ( + exc_info.value.message == "The model `anthropic-sonnet-4-5` is unavailable for this API key or does not exist." + ) + assert exc_info.value.type == ProxyErrorTypes.key_model_access_denied + assert exc_info.value.param == "model" + assert int(exc_info.value.code) == status.HTTP_403_FORBIDDEN + assert "internal-models" in caplog.text + assert "anthropic-sonnet-4-5" in caplog.text + + +@pytest.mark.parametrize("unset_value", [None, ""]) +def test_can_object_call_model_denial_unchanged_when_message_not_configured(monkeypatch, unset_value): + monkeypatch.setattr(litellm, "model_access_denied_message", unset_value) + + with pytest.raises(ProxyException) as exc_info: + _can_object_call_model( + model="anthropic-sonnet-4-5", + llm_router=None, + models=["internal-models"], + object_type="team", + ) + + assert exc_info.value.message == ( + "team not allowed to access model. This team can only access models=['internal-models']. " + "Tried to access anthropic-sonnet-4-5" + ) + + +@pytest.mark.asyncio +async def test_can_user_call_model_no_default_models_uses_configured_message(monkeypatch): + from litellm.proxy._types import SpecialModelNames + from litellm.proxy.auth.auth_checks import can_user_call_model + + monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) + user_object = LiteLLM_UserTable(user_id="test-user", models=[SpecialModelNames.no_default_models.value]) + + with pytest.raises(ProxyException) as exc_info: + await can_user_call_model(model="restricted-model", llm_router=None, user_object=user_object) + + assert exc_info.value.message == "The model `restricted-model` is unavailable for this API key or does not exist." + assert int(exc_info.value.code) == status.HTTP_403_FORBIDDEN + + +@pytest.mark.asyncio +async def test_check_team_member_model_access_denied_uses_configured_message(monkeypatch): + from litellm.proxy._types import LiteLLM_TeamMembership + from litellm.proxy.auth.auth_checks import _check_team_member_model_access + from litellm.proxy.common_utils.user_api_key_cache import team_membership_reservation_cache_key + + monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) + membership = LiteLLM_TeamMembership( + user_id="alice", + team_id="team-a", + litellm_budget_table=LiteLLM_BudgetTable(allowed_models=["fast-models"]), + ) + cache = UserApiKeyCache() + await cache.async_set_cache( + key=team_membership_reservation_cache_key(user_id="alice", team_id="team-a"), + value=membership, + model_type=LiteLLM_TeamMembership, + ) + + with pytest.raises(ProxyException) as exc_info: + await _check_team_member_model_access( + model="mock-vision", + team_object=LiteLLM_TeamTable(team_id="team-a"), + valid_token=UserAPIKeyAuth(token="sk-test", user_id="alice", team_id="team-a"), + llm_router=_make_team_scoped_router(), + prisma_client=None, + user_api_key_cache=cache, + proxy_logging_obj=MagicMock(), + ) + + assert exc_info.value.message == "The model `mock-vision` is unavailable for this API key or does not exist." + assert exc_info.value.type == ProxyErrorTypes.team_model_access_denied + + # -- Team-member access-group resolution with team-scoped DB models ----------- diff --git a/tests/test_litellm/proxy/test_proxy_server.py b/tests/test_litellm/proxy/test_proxy_server.py index 42af8e0af21..17847575de1 100644 --- a/tests/test_litellm/proxy/test_proxy_server.py +++ b/tests/test_litellm/proxy/test_proxy_server.py @@ -10860,6 +10860,72 @@ def test_validate_max_ui_session_budget_empty_restores_default(empty_value): assert _validate_general_settings_ui_litellm_value("max_ui_session_budget", empty_value) == 1.0 +@pytest.mark.asyncio +async def test_update_config_field_model_access_denied_message_sets_live_value(monkeypatch): + """LIT-5283: the client-facing model access denial message is editable from the Admin UI + General tab as a String field, applies live via setattr, and persists under litellm_settings.""" + from unittest.mock import MagicMock + + import litellm.proxy.proxy_server as ps + from litellm.proxy._types import ConfigFieldUpdate, LitellmUserRoles, UserAPIKeyAuth + from litellm.proxy.proxy_server import update_config_general_settings + + saved: dict = {} + + async def fake_get_config(): + return {"litellm_settings": {}} + + async def fake_save_config(new_config=None): + saved.update(new_config or {}) + + monkeypatch.setattr(ps.proxy_config, "get_config", fake_get_config) + monkeypatch.setattr(ps.proxy_config, "save_config", fake_save_config) + monkeypatch.setattr(ps, "prisma_client", MagicMock()) + monkeypatch.setattr(litellm, "store_audit_logs", False) + monkeypatch.setattr(litellm, "model_access_denied_message", None) + + admin = UserAPIKeyAuth(api_key="k", user_id="a", user_role=LitellmUserRoles.PROXY_ADMIN) + await update_config_general_settings( + data=ConfigFieldUpdate( + field_name="model_access_denied_message", + field_value="Model `{model}` is unavailable for this key.", + config_type="general_settings", + ), + user_api_key_dict=admin, + ) + + assert litellm.model_access_denied_message == "Model `{model}` is unavailable for this key." + assert saved["litellm_settings"]["model_access_denied_message"] == "Model `{model}` is unavailable for this key." + + +@pytest.mark.parametrize("bad_value", [True, 3, 1.5, ["x"], {"a": "b"}]) +def test_validate_model_access_denied_message_rejects_non_strings(bad_value): + from fastapi import HTTPException + + from litellm.proxy.proxy_server import _validate_general_settings_ui_litellm_value + + with pytest.raises(HTTPException) as exc_info: + _validate_general_settings_ui_litellm_value("model_access_denied_message", bad_value) + assert exc_info.value.status_code == 400 + + +@pytest.mark.parametrize("empty_value", [None, ""]) +def test_validate_model_access_denied_message_empty_restores_detailed_default(empty_value): + from litellm.proxy.proxy_server import _validate_general_settings_ui_litellm_value + + assert _validate_general_settings_ui_litellm_value("model_access_denied_message", empty_value) is None + + +@pytest.mark.parametrize("empty_value", [None, ""]) +def test_validate_expose_router_debug_in_errors_empty_restores_true_default(empty_value): + """Clearing the field from the Admin UI must restore the historical default (debug details + exposed), not the generic Boolean fallback of False.""" + from litellm.proxy.proxy_server import _validate_general_settings_ui_litellm_value + + assert _validate_general_settings_ui_litellm_value("expose_router_debug_in_errors", empty_value) is True + assert _validate_general_settings_ui_litellm_value("expose_router_debug_in_errors", False) is False + + def test_general_settings_ui_defaults_unchanged_for_existing_fields(): """The spec-default mechanism added for max_ui_session_budget must not change what clearing the pre-existing fields restores (None for Float/Select, False for Boolean).""" diff --git a/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.integration.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.integration.test.tsx index 9cd1444b0b9..1e29b181b78 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.integration.test.tsx +++ b/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.integration.test.tsx @@ -1,4 +1,4 @@ -import { renderWithProviders, screen, within } from "../../../../../tests/test-utils"; +import { fireEvent, renderWithProviders, screen, within } from "../../../../../tests/test-utils"; import userEvent from "@testing-library/user-event"; import { beforeEach, describe, expect, it, vi } from "vitest"; import GeneralSettings from "./general_settings"; @@ -53,6 +53,14 @@ const SETTINGS_FIXTURE = [ stored_in_db: true, field_default_value: 1.0, }, + { + field_name: "model_access_denied_message", + field_type: "String", + field_value: null, + field_description: "client-facing denial message", + stored_in_db: null, + field_default_value: null, + }, ]; const settingsRow = async (fieldName: string) => { @@ -99,6 +107,29 @@ describe("GeneralSettings General tab", () => { expect(deleteConfigFieldSetting).toHaveBeenCalledWith("token", "max_ui_session_budget"); expect(numericValueIn(row)).toBe(1); }); + + it("saves a typed model_access_denied_message and resets it when cleared", async () => { + const user = userEvent.setup(); + renderWithProviders(); + + await user.click(screen.getByText("General")); + const row = await settingsRow("model_access_denied_message"); + const input = within(row).getByRole("textbox") as HTMLInputElement; + expect(input.value).toBe(""); + + fireEvent.change(input, { target: { value: "Model `{model}` is unavailable for this key." } }); + await user.click(within(row).getByRole("button", { name: /update/i })); + expect(updateConfigFieldSetting).toHaveBeenCalledWith( + "token", + "model_access_denied_message", + "Model `{model}` is unavailable for this key.", + ); + + fireEvent.change(input, { target: { value: "" } }); + await user.click(within(row).getByRole("button", { name: /update/i })); + expect(deleteConfigFieldSetting).toHaveBeenCalledWith("token", "model_access_denied_message"); + expect(vi.mocked(updateConfigFieldSetting).mock.calls).toHaveLength(1); + }); }); // The five tabs here are proxy-wide settings. Auto-routers moved to Models + Endpoints. diff --git a/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.tsx b/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.tsx index df9e328ec3b..040b1f3c375 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.tsx +++ b/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.tsx @@ -39,6 +39,8 @@ export interface generalSettingsItem { const NUMERIC_INPUT_WIDTH = "w-36"; const toNumericValue = (raw: string): number | null => (raw === "" ? null : Number(raw)); +const toStringValue = (raw: string): string | null => (raw === "" ? null : raw); +const RESETS_WHEN_CLEARED = new Set(["Select", "String"]); const SettingValueEditor: React.FC<{ setting: generalSettingsItem; @@ -107,6 +109,16 @@ const SettingValueEditor: React.FC<{ ); } + if (setting.field_type === "String") { + return ( + onChange(setting.field_name, toStringValue(event.target.value))} + /> + ); + } return null; }; @@ -210,7 +222,7 @@ const GeneralSettings: React.FC = ({ accessToken, user const fieldValue = setting?.field_value; if (fieldValue == null) { - if (setting?.field_type === "Select") handleResetField(fieldName); + if (setting && RESETS_WHEN_CLEARED.has(setting.field_type)) handleResetField(fieldName); return; } try { From d4d8cc9092c5a825dc2972e124101198f9fe6a90 Mon Sep 17 00:00:00 2001 From: yassin Date: Tue, 15 Sep 2026 22:44:03 +0000 Subject: [PATCH 2/9] fix(proxy): apply access denied message to JWT paths, sanitize denial log, await dashboard saves Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- litellm/proxy/auth/auth_checks.py | 10 ++-- litellm/proxy/auth/handle_jwt.py | 13 ++++- litellm/proxy/proxy_server.py | 12 ++-- .../proxy/auth/test_auth_checks.py | 22 ++++++- .../proxy/auth/test_handle_jwt.py | 57 +++++++++++++++++++ tests/test_litellm/proxy/test_proxy_server.py | 54 ++++++++++++------ .../general_settings.integration.test.tsx | 25 ++++++++ .../_components/general_settings.tsx | 32 +++++------ 8 files changed, 176 insertions(+), 49 deletions(-) diff --git a/litellm/proxy/auth/auth_checks.py b/litellm/proxy/auth/auth_checks.py index 6435ce0d12f..b13214eaf5e 100644 --- a/litellm/proxy/auth/auth_checks.py +++ b/litellm/proxy/auth/auth_checks.py @@ -4034,11 +4034,11 @@ async def _get_agent_ids_from_access_groups( ) -def _client_facing_model_access_denied_message(internal_message: str, model: str | list[str]) -> str: +def client_facing_model_access_denied_message(internal_message: str, model: str | list[str]) -> str: template: Final = litellm.model_access_denied_message if not template: return internal_message - verbose_proxy_logger.warning(internal_message) + verbose_proxy_logger.warning(internal_message.replace("\r", "").replace("\n", "")) return template.replace(MODEL_ACCESS_DENIED_MESSAGE_MODEL_PLACEHOLDER, str(model)) @@ -4164,7 +4164,7 @@ def _can_object_call_model( return True raise ProxyException( - message=_client_facing_model_access_denied_message( + message=client_facing_model_access_denied_message( internal_message=f"{object_type} not allowed to access model. This {object_type} can only access models={models}. Tried to access {model}", model=model, ), @@ -4793,7 +4793,7 @@ async def can_user_call_model( if SpecialModelNames.no_default_models.value in user_object.models: raise ProxyException( - message=_client_facing_model_access_denied_message( + message=client_facing_model_access_denied_message( internal_message=f"User not allowed to access model. No default model access, only team models allowed. Tried to access {model}", model=model, ), @@ -5398,7 +5398,7 @@ async def _check_team_member_model_access( ) except ProxyException: raise ProxyException( - message=_client_facing_model_access_denied_message( + message=client_facing_model_access_denied_message( internal_message=f"Team member not allowed to access model. User={valid_token.user_id}, Team={team_object.team_id}, Model={model}. Allowed member models = {member_allowed_models}", model=model, ), diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py index 94ca3047f45..6e5e75a5e20 100644 --- a/litellm/proxy/auth/handle_jwt.py +++ b/litellm/proxy/auth/handle_jwt.py @@ -66,6 +66,7 @@ from litellm.types.agents import AgentResponse from .auth_checks import ( _allowed_routes_check, allowed_routes_check, + client_facing_model_access_denied_message, get_actual_routes, get_end_user_object, get_org_object, @@ -1339,7 +1340,10 @@ class JWTAuthManager: if model not in role_based_models: raise HTTPException( status_code=403, - detail=f"Role={rbac_role} not allowed to call model={model}. Allowed models={role_based_models}", + detail=client_facing_model_access_denied_message( + internal_message=f"Role={rbac_role} not allowed to call model={model}. Allowed models={role_based_models}", + model=model, + ), ) return True @@ -1370,7 +1374,12 @@ class JWTAuthManager: if requested_model not in allowed_models: raise HTTPException( status_code=403, - detail={"error": f"model={requested_model} not allowed. Allowed_models={allowed_models}"}, + detail={ + "error": client_facing_model_access_denied_message( + internal_message=f"model={requested_model} not allowed. Allowed_models={allowed_models}", + model=requested_model, + ) + }, ) return diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py index f758628c02a..b0e1cc2e0fe 100644 --- a/litellm/proxy/proxy_server.py +++ b/litellm/proxy/proxy_server.py @@ -17435,12 +17435,12 @@ GeneralSettingsUILiteLLMValue = float | bool | str | None class GeneralSettingsUILiteLLMFieldSpec(TypedDict): - type: Literal["Float", "Dollar", "Boolean", "Select", "String"] - description: str - options: NotRequired[tuple[str, ...]] - tab: NotRequired[str] # Admin UI sub-tab this field renders under; None groups it with the rest - default: NotRequired[ - float | bool + type: ReadOnly[Literal["Float", "Dollar", "Boolean", "Select", "String"]] + description: ReadOnly[str] + options: ReadOnly[NotRequired[tuple[str, ...]]] + tab: ReadOnly[NotRequired[str]] # Admin UI sub-tab this field renders under; None groups it with the rest + default: ReadOnly[ + NotRequired[float | bool] ] # reset/clear restores this instead of None; fields whose None means fail-open set it diff --git a/tests/test_litellm/proxy/auth/test_auth_checks.py b/tests/test_litellm/proxy/auth/test_auth_checks.py index e99e92fcd02..0052cfb66d3 100644 --- a/tests/test_litellm/proxy/auth/test_auth_checks.py +++ b/tests/test_litellm/proxy/auth/test_auth_checks.py @@ -1683,8 +1683,6 @@ _DENIED_MESSAGE_TEMPLATE: Final = "The model `{model}` is unavailable for this A def test_can_object_call_model_denial_uses_configured_message_and_logs_detail(monkeypatch, caplog): - """LIT-5283: with model_access_denied_message set, the client sees only the template with - {model} filled in, while the allowed models / access groups stay in the proxy log.""" monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) with caplog.at_level("WARNING", logger="LiteLLM Proxy"): @@ -1706,6 +1704,26 @@ def test_can_object_call_model_denial_uses_configured_message_and_logs_detail(mo assert "anthropic-sonnet-4-5" in caplog.text +def test_can_object_call_model_denial_log_strips_newlines_from_requested_model(monkeypatch, caplog): + monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) + + with caplog.at_level("WARNING", logger="LiteLLM Proxy"): + with pytest.raises(ProxyException): + _can_object_call_model( + model="gpt-5.6\r\nWARNING forged log line", + llm_router=None, + models=["internal-models"], + object_type="key", + ) + + denial_records = [r for r in caplog.records if "not allowed to access model" in r.getMessage()] + assert len(denial_records) == 1 + assert denial_records[0].getMessage() == ( + "key not allowed to access model. This key can only access models=['internal-models']. " + "Tried to access gpt-5.6WARNING forged log line" + ) + + @pytest.mark.parametrize("unset_value", [None, ""]) def test_can_object_call_model_denial_unchanged_when_message_not_configured(monkeypatch, unset_value): monkeypatch.setattr(litellm, "model_access_denied_message", unset_value) diff --git a/tests/test_litellm/proxy/auth/test_handle_jwt.py b/tests/test_litellm/proxy/auth/test_handle_jwt.py index 814e31535e0..921472f2f43 100644 --- a/tests/test_litellm/proxy/auth/test_handle_jwt.py +++ b/tests/test_litellm/proxy/auth/test_handle_jwt.py @@ -9,6 +9,8 @@ from fastapi import HTTPException import httpx import pytest +import litellm + from litellm.proxy._types import ( DEFAULT_JWKS_STALE_TTL, JWTLiteLLMRoleMap, @@ -21,6 +23,8 @@ from litellm.proxy._types import ( Member, ProxyErrorTypes, ProxyException, + RoleBasedPermissions, + ScopeMapping, ) from litellm.caching.dual_cache import DualCache from litellm.proxy.agent_endpoints.agent_registry import AgentRegistry @@ -6965,3 +6969,56 @@ async def test_auth_builder_denies_jwt_naming_unregistered_agent_before_admin_ch ) assert exc_info.value.status_code == 403 + + +_JWT_DENIED_MESSAGE_TEMPLATE = "The model `{model}` is unavailable for this identity." + + +@pytest.mark.parametrize( + "configured_message, expected_detail", + [ + (None, "Role=internal_user not allowed to call model=gpt-5.6. Allowed models=['gpt-5.6-mini']"), + ("", "Role=internal_user not allowed to call model=gpt-5.6. Allowed models=['gpt-5.6-mini']"), + (_JWT_DENIED_MESSAGE_TEMPLATE, "The model `gpt-5.6` is unavailable for this identity."), + ], +) +def test_can_rbac_role_call_model_denial_honors_configured_message(monkeypatch, configured_message, expected_detail): + monkeypatch.setattr(litellm, "model_access_denied_message", configured_message) + general_settings = { + "role_permissions": [ + RoleBasedPermissions(role=LitellmUserRoles.INTERNAL_USER, models=["gpt-5.6-mini"]), + ] + } + + with pytest.raises(HTTPException) as exc_info: + JWTAuthManager.can_rbac_role_call_model( + rbac_role=LitellmUserRoles.INTERNAL_USER, + general_settings=general_settings, + model="gpt-5.6", + ) + + assert exc_info.value.status_code == 403 + assert exc_info.value.detail == expected_detail + + +@pytest.mark.parametrize( + "configured_message, expected_error", + [ + (None, "model=gpt-5.6 not allowed. Allowed_models=['gpt-5.6-mini']"), + ("", "model=gpt-5.6 not allowed. Allowed_models=['gpt-5.6-mini']"), + (_JWT_DENIED_MESSAGE_TEMPLATE, "The model `gpt-5.6` is unavailable for this identity."), + ], +) +def test_check_scope_based_access_denial_honors_configured_message(monkeypatch, configured_message, expected_error): + monkeypatch.setattr(litellm, "model_access_denied_message", configured_message) + + with pytest.raises(HTTPException) as exc_info: + JWTAuthManager.check_scope_based_access( + scope_mappings=[ScopeMapping(scope="litellm.api.consumer", models=["gpt-5.6-mini"])], + scopes=["litellm.api.consumer"], + request_data={"model": "gpt-5.6"}, + general_settings={}, + ) + + assert exc_info.value.status_code == 403 + assert exc_info.value.detail == {"error": expected_error} diff --git a/tests/test_litellm/proxy/test_proxy_server.py b/tests/test_litellm/proxy/test_proxy_server.py index 17847575de1..dd05b90bb67 100644 --- a/tests/test_litellm/proxy/test_proxy_server.py +++ b/tests/test_litellm/proxy/test_proxy_server.py @@ -10862,24 +10862,15 @@ def test_validate_max_ui_session_budget_empty_restores_default(empty_value): @pytest.mark.asyncio async def test_update_config_field_model_access_denied_message_sets_live_value(monkeypatch): - """LIT-5283: the client-facing model access denial message is editable from the Admin UI - General tab as a String field, applies live via setattr, and persists under litellm_settings.""" - from unittest.mock import MagicMock + from unittest.mock import AsyncMock, MagicMock import litellm.proxy.proxy_server as ps from litellm.proxy._types import ConfigFieldUpdate, LitellmUserRoles, UserAPIKeyAuth from litellm.proxy.proxy_server import update_config_general_settings - saved: dict = {} - - async def fake_get_config(): - return {"litellm_settings": {}} - - async def fake_save_config(new_config=None): - saved.update(new_config or {}) - - monkeypatch.setattr(ps.proxy_config, "get_config", fake_get_config) - monkeypatch.setattr(ps.proxy_config, "save_config", fake_save_config) + save_config = AsyncMock() + monkeypatch.setattr(ps.proxy_config, "get_config", AsyncMock(return_value={"litellm_settings": {}})) + monkeypatch.setattr(ps.proxy_config, "save_config", save_config) monkeypatch.setattr(ps, "prisma_client", MagicMock()) monkeypatch.setattr(litellm, "store_audit_logs", False) monkeypatch.setattr(litellm, "model_access_denied_message", None) @@ -10895,7 +10886,11 @@ async def test_update_config_field_model_access_denied_message_sets_live_value(m ) assert litellm.model_access_denied_message == "Model `{model}` is unavailable for this key." - assert saved["litellm_settings"]["model_access_denied_message"] == "Model `{model}` is unavailable for this key." + save_config.assert_awaited_once() + saved_config = save_config.await_args.kwargs["new_config"] + assert saved_config["litellm_settings"]["model_access_denied_message"] == ( + "Model `{model}` is unavailable for this key." + ) @pytest.mark.parametrize("bad_value", [True, 3, 1.5, ["x"], {"a": "b"}]) @@ -10918,14 +10913,41 @@ def test_validate_model_access_denied_message_empty_restores_detailed_default(em @pytest.mark.parametrize("empty_value", [None, ""]) def test_validate_expose_router_debug_in_errors_empty_restores_true_default(empty_value): - """Clearing the field from the Admin UI must restore the historical default (debug details - exposed), not the generic Boolean fallback of False.""" from litellm.proxy.proxy_server import _validate_general_settings_ui_litellm_value assert _validate_general_settings_ui_litellm_value("expose_router_debug_in_errors", empty_value) is True assert _validate_general_settings_ui_litellm_value("expose_router_debug_in_errors", False) is False +@pytest.mark.parametrize( + "field_name, booted_value, db_value, read_setting", + [ + ( + "model_access_denied_message", + None, + "Model `{model}` is unavailable for this key.", + lambda: litellm.model_access_denied_message, + ), + ("expose_router_debug_in_errors", True, False, lambda: litellm.expose_router_debug_in_errors), + ], +) +def test_model_access_denied_settings_propagate_on_config_reload( + monkeypatch, field_name, booted_value, db_value, read_setting +): + import litellm.proxy.proxy_server as ps + + monkeypatch.setattr(litellm, field_name, booted_value) + assert read_setting() == booted_value + + ps.ProxyConfig()._update_config_fields( + current_config={"litellm_settings": {}}, + param_name="litellm_settings", + db_param_value={field_name: db_value}, + ) + + assert read_setting() == db_value + + def test_general_settings_ui_defaults_unchanged_for_existing_fields(): """The spec-default mechanism added for max_ui_session_budget must not change what clearing the pre-existing fields restores (None for Float/Select, False for Boolean).""" diff --git a/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.integration.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.integration.test.tsx index 1e29b181b78..d002d7c116f 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.integration.test.tsx +++ b/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.integration.test.tsx @@ -130,6 +130,31 @@ describe("GeneralSettings General tab", () => { expect(deleteConfigFieldSetting).toHaveBeenCalledWith("token", "model_access_denied_message"); expect(vi.mocked(updateConfigFieldSetting).mock.calls).toHaveLength(1); }); + + it("keeps the stored value visible when the reset request fails", async () => { + vi.mocked(getGeneralSettingsCall).mockResolvedValue( + SETTINGS_FIXTURE.map((s) => + s.field_name === "model_access_denied_message" + ? { ...s, field_value: "Model `{model}` is unavailable.", stored_in_db: true } + : { ...s }, + ), + ); + vi.mocked(deleteConfigFieldSetting).mockRejectedValueOnce(new Error("proxy unreachable")); + const user = userEvent.setup(); + renderWithProviders(); + + await user.click(screen.getByText("General")); + const row = await settingsRow("model_access_denied_message"); + const input = within(row).getByRole("textbox") as HTMLInputElement; + expect(within(row).getByText("In DB")).toBeInTheDocument(); + + fireEvent.change(input, { target: { value: "" } }); + await user.click(within(row).getByRole("button", { name: /update/i })); + + expect(deleteConfigFieldSetting).toHaveBeenCalledWith("token", "model_access_denied_message"); + expect(within(row).getByText("In DB")).toBeInTheDocument(); + expect(within(row).queryByText("Not Set")).not.toBeInTheDocument(); + }); }); // The five tabs here are proxy-wide settings. Auto-routers moved to Models + Endpoints. diff --git a/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.tsx b/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.tsx index 040b1f3c375..38aa85b0f1e 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.tsx +++ b/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.tsx @@ -40,7 +40,7 @@ const NUMERIC_INPUT_WIDTH = "w-36"; const toNumericValue = (raw: string): number | null => (raw === "" ? null : Number(raw)); const toStringValue = (raw: string): string | null => (raw === "" ? null : raw); -const RESETS_WHEN_CLEARED = new Set(["Select", "String"]); +const RESETS_WHEN_CLEARED: ReadonlySet = new Set(["Select", "String"]); const SettingValueEditor: React.FC<{ setting: generalSettingsItem; @@ -213,7 +213,7 @@ const GeneralSettings: React.FC = ({ accessToken, user setGeneralSettings(updatedSettings); }; - const handleUpdateField = (fieldName: string) => { + const handleUpdateField = async (fieldName: string) => { if (!accessToken) { return; } @@ -222,37 +222,33 @@ const GeneralSettings: React.FC = ({ accessToken, user const fieldValue = setting?.field_value; if (fieldValue == null) { - if (setting && RESETS_WHEN_CLEARED.has(setting.field_type)) handleResetField(fieldName); + if (setting && RESETS_WHEN_CLEARED.has(setting.field_type)) await handleResetField(fieldName); return; } try { - updateConfigFieldSetting(accessToken, fieldName, fieldValue); - // update value in state - - const updatedSettings = generalSettings.map((setting) => - setting.field_name === fieldName ? { ...setting, stored_in_db: true } : setting, + await updateConfigFieldSetting(accessToken, fieldName, fieldValue); + setGeneralSettings((current) => + current.map((setting) => (setting.field_name === fieldName ? { ...setting, stored_in_db: true } : setting)), ); - setGeneralSettings(updatedSettings); } catch (error) { // do something } }; - const handleResetField = (fieldName: string) => { + const handleResetField = async (fieldName: string) => { if (!accessToken) { return; } try { - deleteConfigFieldSetting(accessToken, fieldName); - // update value in state - - const updatedSettings = generalSettings.map((setting) => - setting.field_name === fieldName - ? { ...setting, stored_in_db: null, field_value: setting.field_default_value ?? null } - : setting, + await deleteConfigFieldSetting(accessToken, fieldName); + setGeneralSettings((current) => + current.map((setting) => + setting.field_name === fieldName + ? { ...setting, stored_in_db: null, field_value: setting.field_default_value ?? null } + : setting, + ), ); - setGeneralSettings(updatedSettings); } catch (error) { // do something } From b99f0c812f0d820242f9ac8988213683cdcf0d2f Mon Sep 17 00:00:00 2001 From: yassin Date: Tue, 15 Sep 2026 23:36:12 +0000 Subject: [PATCH 3/9] fix(proxy): log configured model access denial only at the auth error boundary Move the WARNING that carries the internal denial detail out of the message formatter and into the auth exception handler. The denial exceptions now carry internal_message so access-group probes and fallback paths that catch and recover from the denial no longer log a false denial for an allowed request Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- litellm/proxy/_types.py | 13 ++ litellm/proxy/auth/auth_checks.py | 47 ++++---- litellm/proxy/auth/auth_exception_handler.py | 13 ++ litellm/proxy/auth/handle_jwt.py | 23 ++-- litellm/proxy/auth/model_access_denied.py | 19 +++ .../proxy/auth/test_auth_checks.py | 49 ++++---- .../proxy/auth/test_auth_exception_handler.py | 111 +++++++++++++++++- .../proxy/auth/test_handle_jwt.py | 9 +- 8 files changed, 225 insertions(+), 59 deletions(-) create mode 100644 litellm/proxy/auth/model_access_denied.py diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py index d4eda1c9540..8949433dc34 100644 --- a/litellm/proxy/_types.py +++ b/litellm/proxy/_types.py @@ -4030,6 +4030,19 @@ class ProxyException(Exception): return error_dict +class ModelAccessDeniedProxyException(ProxyException): + def __init__( + self, + message: str, + internal_message: str, + type: str, + param: str | None, + code: int | str | None, + ) -> None: + super().__init__(message=message, type=type, param=param, code=code) + self.internal_message: Final = internal_message + + class CommonProxyErrors(str, enum.Enum): db_not_connected_error = ( "DB not connected. This endpoint needs a database; set DATABASE_URL to a " diff --git a/litellm/proxy/auth/auth_checks.py b/litellm/proxy/auth/auth_checks.py index b13214eaf5e..80bb1e3b319 100644 --- a/litellm/proxy/auth/auth_checks.py +++ b/litellm/proxy/auth/auth_checks.py @@ -32,7 +32,6 @@ from litellm.constants import ( DEFAULT_MAX_RECURSE_DEPTH, EMAIL_BUDGET_ALERT_MAX_SPEND_ALERT_PERCENTAGE, END_USER_RESTRICTED_REGISTRY_MAX_SIZE, - MODEL_ACCESS_DENIED_MESSAGE_MODEL_PLACEHOLDER, MODEL_ACCESS_GROUP_REGISTRY_MAX_SIZE, REGISTRY_ERROR_NEGATIVE_CACHE_TTL, TAG_REGISTRY_MAX_SIZE, @@ -61,6 +60,7 @@ from litellm.proxy._types import ( LiteLLM_UserTable, LiteLLMRoutes, LitellmUserRoles, + ModelAccessDeniedProxyException, NewTeamRequest, ProxyErrorTypes, ProxyException, @@ -72,6 +72,7 @@ from litellm.proxy.auth.budget_throttle import ( budget_throttle_percentage, should_throttle_budget_exceeded, ) +from litellm.proxy.auth.model_access_denied import client_facing_model_access_denied_message from litellm.proxy.auth.route_checks import RouteChecks from litellm.proxy.common_utils.auth_cache_invalidation_pubsub import publish_auth_cache_invalidation from litellm.proxy.common_utils.cache_pydantic_utils import CacheCodec @@ -4034,14 +4035,6 @@ async def _get_agent_ids_from_access_groups( ) -def client_facing_model_access_denied_message(internal_message: str, model: str | list[str]) -> str: - template: Final = litellm.model_access_denied_message - if not template: - return internal_message - verbose_proxy_logger.warning(internal_message.replace("\r", "").replace("\n", "")) - return template.replace(MODEL_ACCESS_DENIED_MESSAGE_MODEL_PLACEHOLDER, str(model)) - - def _resolve_all_team_model_sentinel_for_auth_check( models: list[str], llm_router: Router | None, @@ -4163,11 +4156,13 @@ def _can_object_call_model( ): return True - raise ProxyException( - message=client_facing_model_access_denied_message( - internal_message=f"{object_type} not allowed to access model. This {object_type} can only access models={models}. Tried to access {model}", - model=model, - ), + internal_message: Final = ( + f"{object_type} not allowed to access model. This {object_type} can only access models={models}. " + f"Tried to access {model}" + ) + raise ModelAccessDeniedProxyException( + message=client_facing_model_access_denied_message(internal_message=internal_message, model=model), + internal_message=internal_message, type=ProxyErrorTypes.get_model_access_error_type_for_object(object_type=object_type), param="model", code=status.HTTP_403_FORBIDDEN, @@ -4792,11 +4787,13 @@ async def can_user_call_model( return True if SpecialModelNames.no_default_models.value in user_object.models: - raise ProxyException( - message=client_facing_model_access_denied_message( - internal_message=f"User not allowed to access model. No default model access, only team models allowed. Tried to access {model}", - model=model, - ), + internal_message: Final = ( + f"User not allowed to access model. No default model access, only team models allowed. " + f"Tried to access {model}" + ) + raise ModelAccessDeniedProxyException( + message=client_facing_model_access_denied_message(internal_message=internal_message, model=model), + internal_message=internal_message, type=ProxyErrorTypes.key_model_access_denied, param="model", code=status.HTTP_403_FORBIDDEN, @@ -5397,11 +5394,13 @@ async def _check_team_member_model_access( team_id=team_object.team_id, ) except ProxyException: - raise ProxyException( - message=client_facing_model_access_denied_message( - internal_message=f"Team member not allowed to access model. User={valid_token.user_id}, Team={team_object.team_id}, Model={model}. Allowed member models = {member_allowed_models}", - model=model, - ), + internal_message: Final = ( + f"Team member not allowed to access model. User={valid_token.user_id}, Team={team_object.team_id}, " + f"Model={model}. Allowed member models = {member_allowed_models}" + ) + raise ModelAccessDeniedProxyException( + message=client_facing_model_access_denied_message(internal_message=internal_message, model=model), + internal_message=internal_message, type=ProxyErrorTypes.team_model_access_denied, param="model", code=status.HTTP_403_FORBIDDEN, diff --git a/litellm/proxy/auth/auth_exception_handler.py b/litellm/proxy/auth/auth_exception_handler.py index 661b6a83c38..4a764cae6cc 100644 --- a/litellm/proxy/auth/auth_exception_handler.py +++ b/litellm/proxy/auth/auth_exception_handler.py @@ -15,6 +15,7 @@ from litellm.integrations.otel.runtime import seed_request_identity from litellm.litellm_core_utils.core_helpers import is_expected_client_error from litellm.proxy._types import ( LitellmUserRoles, + ModelAccessDeniedProxyException, ProxyErrorTypes, ProxyException, UserAPIKeyAuth, @@ -25,6 +26,7 @@ from litellm.proxy.auth.auth_utils import ( mark_invalid_virtual_key_error, normalize_request_route, ) +from litellm.proxy.auth.model_access_denied import ModelAccessDeniedHTTPException from litellm.proxy.db.exception_handler import PrismaDBExceptionHandler from litellm.types.services import ServiceTypes @@ -75,6 +77,14 @@ def _as_proxy_exception(e: Exception) -> ProxyException: ) +def _model_access_denied_internal_message(e: Exception) -> str | None: + if not litellm.model_access_denied_message: + return None + if not isinstance(e, (ModelAccessDeniedProxyException, ModelAccessDeniedHTTPException)): + return None + return e.internal_message.replace("\r", "").replace("\n", "") + + def _get_user_agent(request: Request) -> str | None: if "headers" not in request.scope: return None @@ -166,6 +176,9 @@ class UserAPIKeyAuthExceptionHandler: # survives a raising callback pipeline. Classify and route malformed virtual-key # rejections to WARNING on stdout (suppressible via LITELLM_LOG=ERROR). log_extra: Final = {"requester_ip": requester_ip} + denied_internal_message: Final = _model_access_denied_internal_message(e) + if denied_internal_message is not None: + verbose_proxy_logger.warning(denied_internal_message, extra=log_extra) is_invalid_virtual_key: Final = is_invalid_virtual_key_error(e) is_quiet_log: Final = is_invalid_virtual_key and not litellm.log_client_error_tracebacks logger: Final = verbose_proxy_stdout_logger if is_quiet_log else verbose_proxy_logger diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py index 6e5e75a5e20..ea6d52b28f0 100644 --- a/litellm/proxy/auth/handle_jwt.py +++ b/litellm/proxy/auth/handle_jwt.py @@ -52,6 +52,10 @@ from litellm.proxy._types import ( UserAPIKeyAuth, ) from litellm.proxy.auth.auth_checks import can_team_access_model +from litellm.proxy.auth.model_access_denied import ( + ModelAccessDeniedHTTPException, + client_facing_model_access_denied_message, +) from litellm.proxy.auth.resolvers.grants import GrantResolver, UserLookup, canonical_user_id from litellm.proxy.auth.route_checks import RouteChecks from litellm.proxy.auth.team_grants import team_model_aliases @@ -66,7 +70,6 @@ from litellm.types.agents import AgentResponse from .auth_checks import ( _allowed_routes_check, allowed_routes_check, - client_facing_model_access_denied_message, get_actual_routes, get_end_user_object, get_org_object, @@ -1338,12 +1341,13 @@ class JWTAuthManager: return True if model not in role_based_models: - raise HTTPException( + internal_message: Final = ( + f"Role={rbac_role} not allowed to call model={model}. Allowed models={role_based_models}" + ) + raise ModelAccessDeniedHTTPException( + internal_message=internal_message, status_code=403, - detail=client_facing_model_access_denied_message( - internal_message=f"Role={rbac_role} not allowed to call model={model}. Allowed models={role_based_models}", - model=model, - ), + detail=client_facing_model_access_denied_message(internal_message=internal_message, model=model), ) return True @@ -1372,12 +1376,13 @@ class JWTAuthManager: return if requested_model not in allowed_models: - raise HTTPException( + internal_message: Final = f"model={requested_model} not allowed. Allowed_models={allowed_models}" + raise ModelAccessDeniedHTTPException( + internal_message=internal_message, status_code=403, detail={ "error": client_facing_model_access_denied_message( - internal_message=f"model={requested_model} not allowed. Allowed_models={allowed_models}", - model=requested_model, + internal_message=internal_message, model=requested_model ) }, ) diff --git a/litellm/proxy/auth/model_access_denied.py b/litellm/proxy/auth/model_access_denied.py new file mode 100644 index 00000000000..8164e06c42a --- /dev/null +++ b/litellm/proxy/auth/model_access_denied.py @@ -0,0 +1,19 @@ +from typing import Final + +from fastapi import HTTPException + +import litellm +from litellm.constants import MODEL_ACCESS_DENIED_MESSAGE_MODEL_PLACEHOLDER + + +def client_facing_model_access_denied_message(internal_message: str, model: str | list[str]) -> str: + template: Final = litellm.model_access_denied_message + if not template: + return internal_message + return template.replace(MODEL_ACCESS_DENIED_MESSAGE_MODEL_PLACEHOLDER, str(model)) + + +class ModelAccessDeniedHTTPException(HTTPException): + def __init__(self, internal_message: str, status_code: int, detail: str | dict[str, str]) -> None: + super().__init__(status_code=status_code, detail=detail) + self.internal_message: Final = internal_message diff --git a/tests/test_litellm/proxy/auth/test_auth_checks.py b/tests/test_litellm/proxy/auth/test_auth_checks.py index 0052cfb66d3..0677fb8af29 100644 --- a/tests/test_litellm/proxy/auth/test_auth_checks.py +++ b/tests/test_litellm/proxy/auth/test_auth_checks.py @@ -25,6 +25,7 @@ from litellm.proxy._types import ( LiteLLM_TeamTable, LiteLLM_UserTable, LitellmUserRoles, + ModelAccessDeniedProxyException, ProxyErrorTypes, ProxyException, SSOUserDefinedValues, @@ -1682,11 +1683,11 @@ def test_can_object_call_model_no_access_to_alias_or_underlying(): _DENIED_MESSAGE_TEMPLATE: Final = "The model `{model}` is unavailable for this API key or does not exist." -def test_can_object_call_model_denial_uses_configured_message_and_logs_detail(monkeypatch, caplog): +def test_can_object_call_model_denial_uses_configured_message_and_keeps_detail_on_exception(monkeypatch, caplog): monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) - with caplog.at_level("WARNING", logger="LiteLLM Proxy"): - with pytest.raises(ProxyException) as exc_info: + with caplog.at_level("DEBUG", logger="LiteLLM Proxy"): + with pytest.raises(ModelAccessDeniedProxyException) as exc_info: _can_object_call_model( model="anthropic-sonnet-4-5", llm_router=None, @@ -1700,28 +1701,30 @@ def test_can_object_call_model_denial_uses_configured_message_and_logs_detail(mo assert exc_info.value.type == ProxyErrorTypes.key_model_access_denied assert exc_info.value.param == "model" assert int(exc_info.value.code) == status.HTTP_403_FORBIDDEN - assert "internal-models" in caplog.text - assert "anthropic-sonnet-4-5" in caplog.text - - -def test_can_object_call_model_denial_log_strips_newlines_from_requested_model(monkeypatch, caplog): - monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) - - with caplog.at_level("WARNING", logger="LiteLLM Proxy"): - with pytest.raises(ProxyException): - _can_object_call_model( - model="gpt-5.6\r\nWARNING forged log line", - llm_router=None, - models=["internal-models"], - object_type="key", - ) - - denial_records = [r for r in caplog.records if "not allowed to access model" in r.getMessage()] - assert len(denial_records) == 1 - assert denial_records[0].getMessage() == ( + assert exc_info.value.internal_message == ( "key not allowed to access model. This key can only access models=['internal-models']. " - "Tried to access gpt-5.6WARNING forged log line" + "Tried to access anthropic-sonnet-4-5" ) + assert "internal-models" not in caplog.text + + +@pytest.mark.asyncio +async def test_access_group_fallback_grant_does_not_log_a_denial(monkeypatch, caplog): + from litellm.proxy.auth.auth_checks import can_team_access_model + + monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) + team_object = LiteLLM_TeamTable(team_id="team-123", models=["direct-model"], access_group_ids=["ag-1"]) + + with ( + patch( # test-quality-ok: access-group lookup has no dependency-injection seam + "litellm.proxy.auth.auth_checks._get_models_from_access_groups", + new=AsyncMock(return_value=["group-model"]), + ), + caplog.at_level("DEBUG", logger="LiteLLM Proxy"), + ): + assert await can_team_access_model("group-model", team_object, None) is True + + assert "not allowed to access model" not in caplog.text @pytest.mark.parametrize("unset_value", [None, ""]) diff --git a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py index 6e9770bced8..602c074ee66 100644 --- a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py +++ b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py @@ -26,11 +26,18 @@ from prisma.errors import ( ) +import litellm from litellm._logging import verbose_proxy_logger from litellm.constants import INVALID_VIRTUAL_KEY_ERROR_MARKER from litellm.exceptions import BudgetExceededError -from litellm.proxy._types import ProxyErrorTypes, ProxyException, UserAPIKeyAuth +from litellm.proxy._types import ( + ModelAccessDeniedProxyException, + ProxyErrorTypes, + ProxyException, + UserAPIKeyAuth, +) from litellm.proxy.auth.auth_exception_handler import UserAPIKeyAuthExceptionHandler +from litellm.proxy.auth.model_access_denied import ModelAccessDeniedHTTPException class _EngineHttp500: @@ -982,3 +989,105 @@ async def test_handle_authentication_error_traceback_only_for_unexpected_errors( assert records[0].levelname == expect_level expected_logger_name = "LiteLLM Proxy.stdout" if expect_level == "WARNING" else "LiteLLM Proxy" assert records[0].name == expected_logger_name + + +_DENIED_MESSAGE_TEMPLATE = "The model `{model}` is unavailable for this API key or does not exist." + + +def _denied_proxy_exception() -> ModelAccessDeniedProxyException: + return ModelAccessDeniedProxyException( + message="The model `gpt-5.6\r\nWARNING forged log line` is unavailable for this API key or does not exist.", + internal_message="key not allowed to access model. This key can only access models=['internal-models']. " + "Tried to access gpt-5.6\r\nWARNING forged log line", + type=ProxyErrorTypes.key_model_access_denied, + param="model", + code=status.HTTP_403_FORBIDDEN, + ) + + +def _denied_jwt_exception() -> ModelAccessDeniedHTTPException: + return ModelAccessDeniedHTTPException( + internal_message="Role=engineer not allowed to call model=gpt-5.6\r\nWARNING forged log line. " + "Allowed models=['internal-models']", + status_code=status.HTTP_403_FORBIDDEN, + detail="The model `gpt-5.6` is unavailable for this API key or does not exist.", + ) + + +@pytest.mark.asyncio +@pytest.mark.parametrize( + "make_denial", + [ + pytest.param(_denied_proxy_exception, id="proxy_exception"), + pytest.param(_denied_jwt_exception, id="jwt_http_exception"), + ], +) +async def test_handle_authentication_error_logs_sanitized_model_access_denial_once(monkeypatch, make_denial, caplog): + monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) + handler = UserAPIKeyAuthExceptionHandler() + denial = make_denial() + + with ( + patch( # test-quality-ok: handler reads proxy_server globals at call time + "litellm.proxy.proxy_server.proxy_logging_obj.post_call_failure_hook", + new_callable=AsyncMock, + return_value=None, + ), + patch( # test-quality-ok: handler reads proxy_server globals at call time + "litellm.proxy.auth.auth_exception_handler.seed_request_identity", + ), + patch( # test-quality-ok: handler reads proxy_server globals at call time + "litellm.proxy.proxy_server.general_settings", + {"allow_requests_on_db_unavailable": False}, + ), + caplog.at_level("WARNING", logger="LiteLLM Proxy"), + pytest.raises(ProxyException) as exc_info, + ): + await handler._handle_authentication_error(denial, MagicMock(), {}, "/v1/chat/completions", None, "sk-bad-key") + + assert exc_info.value.code == str(status.HTTP_403_FORBIDDEN) + assert "internal-models" not in str(exc_info.value.message) + denial_records = [r for r in caplog.records if "internal-models" in r.getMessage()] + assert len(denial_records) == 1 + assert denial_records[0].levelname == "WARNING" + assert "\n" not in denial_records[0].getMessage() + assert "gpt-5.6WARNING forged log line" in denial_records[0].getMessage() + + +@pytest.mark.asyncio +@pytest.mark.parametrize("unset_value", [None, ""]) +async def test_handle_authentication_error_no_extra_denial_log_when_message_not_configured( + monkeypatch, unset_value, caplog +): + monkeypatch.setattr(litellm, "model_access_denied_message", unset_value) + handler = UserAPIKeyAuthExceptionHandler() + denial = ModelAccessDeniedProxyException( + message="key not allowed to access model. This key can only access models=['internal-models']. " + "Tried to access gpt-5.6", + internal_message="key not allowed to access model. This key can only access models=['internal-models']. " + "Tried to access gpt-5.6", + type=ProxyErrorTypes.key_model_access_denied, + param="model", + code=status.HTTP_403_FORBIDDEN, + ) + + with ( + patch( # test-quality-ok: handler reads proxy_server globals at call time + "litellm.proxy.proxy_server.proxy_logging_obj.post_call_failure_hook", + new_callable=AsyncMock, + return_value=None, + ), + patch( # test-quality-ok: handler reads proxy_server globals at call time + "litellm.proxy.auth.auth_exception_handler.seed_request_identity", + ), + patch( # test-quality-ok: handler reads proxy_server globals at call time + "litellm.proxy.proxy_server.general_settings", + {"allow_requests_on_db_unavailable": False}, + ), + caplog.at_level("WARNING", logger="LiteLLM Proxy"), + pytest.raises(ProxyException) as exc_info, + ): + await handler._handle_authentication_error(denial, MagicMock(), {}, "/v1/chat/completions", None, "sk-bad-key") + + assert "internal-models" in str(exc_info.value.message) + assert [r for r in caplog.records if r.levelname == "WARNING" and "internal-models" in r.getMessage()] == [] diff --git a/tests/test_litellm/proxy/auth/test_handle_jwt.py b/tests/test_litellm/proxy/auth/test_handle_jwt.py index 921472f2f43..9fab1e1785a 100644 --- a/tests/test_litellm/proxy/auth/test_handle_jwt.py +++ b/tests/test_litellm/proxy/auth/test_handle_jwt.py @@ -37,6 +37,7 @@ from litellm.proxy.auth.handle_jwt import ( JWTHandler, NoMatchingJWTPublicKeyError, ) +from litellm.proxy.auth.model_access_denied import ModelAccessDeniedHTTPException from litellm.types.agents import AgentResponse @@ -6990,7 +6991,7 @@ def test_can_rbac_role_call_model_denial_honors_configured_message(monkeypatch, ] } - with pytest.raises(HTTPException) as exc_info: + with pytest.raises(ModelAccessDeniedHTTPException) as exc_info: JWTAuthManager.can_rbac_role_call_model( rbac_role=LitellmUserRoles.INTERNAL_USER, general_settings=general_settings, @@ -6999,6 +7000,9 @@ def test_can_rbac_role_call_model_denial_honors_configured_message(monkeypatch, assert exc_info.value.status_code == 403 assert exc_info.value.detail == expected_detail + assert exc_info.value.internal_message == ( + "Role=internal_user not allowed to call model=gpt-5.6. Allowed models=['gpt-5.6-mini']" + ) @pytest.mark.parametrize( @@ -7012,7 +7016,7 @@ def test_can_rbac_role_call_model_denial_honors_configured_message(monkeypatch, def test_check_scope_based_access_denial_honors_configured_message(monkeypatch, configured_message, expected_error): monkeypatch.setattr(litellm, "model_access_denied_message", configured_message) - with pytest.raises(HTTPException) as exc_info: + with pytest.raises(ModelAccessDeniedHTTPException) as exc_info: JWTAuthManager.check_scope_based_access( scope_mappings=[ScopeMapping(scope="litellm.api.consumer", models=["gpt-5.6-mini"])], scopes=["litellm.api.consumer"], @@ -7022,3 +7026,4 @@ def test_check_scope_based_access_denial_honors_configured_message(monkeypatch, assert exc_info.value.status_code == 403 assert exc_info.value.detail == {"error": expected_error} + assert exc_info.value.internal_message == "model=gpt-5.6 not allowed. Allowed_models=['gpt-5.6-mini']" From f60a603519cebfdb7b209c353ff64d5bb1880fd4 Mon Sep 17 00:00:00 2001 From: yassin Date: Wed, 16 Sep 2026 00:12:49 +0000 Subject: [PATCH 4/9] fix(proxy): log configured model access denials at the final response boundary Post-auth denials from can_key_call_resolved_model (per-request alias rewrite, MCP sampling, realtime) never reach the auth exception handler, so the internal allowlist reason was dropped when model_access_denied_message was set. Log it once from the ProxyException response handler and the realtime rejection path instead, and convert JWT ModelAccessDeniedHTTPException into the specialized ProxyException so the same boundary covers it Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- litellm/proxy/auth/auth_exception_handler.py | 19 ++- litellm/proxy/proxy_server.py | 9 ++ .../proxy/auth/test_auth_exception_handler.py | 13 +-- tests/test_litellm/proxy/test_proxy_server.py | 109 +++++++++++++++++- 4 files changed, 126 insertions(+), 24 deletions(-) diff --git a/litellm/proxy/auth/auth_exception_handler.py b/litellm/proxy/auth/auth_exception_handler.py index 4a764cae6cc..bbe4b0f5c35 100644 --- a/litellm/proxy/auth/auth_exception_handler.py +++ b/litellm/proxy/auth/auth_exception_handler.py @@ -53,6 +53,14 @@ def _as_proxy_exception(e: Exception) -> ProxyException: param=None, code=getattr(e, "status_code", status.HTTP_429_TOO_MANY_REQUESTS), ) + if isinstance(e, ModelAccessDeniedHTTPException): + return ModelAccessDeniedProxyException( + message=str(e.detail), + internal_message=e.internal_message, + type=ProxyErrorTypes.auth_error, + param="None", + code=e.status_code, + ) if isinstance(e, HTTPException): return ProxyException( message=getattr(e, "detail", f"Authentication Error({e})"), @@ -77,14 +85,6 @@ def _as_proxy_exception(e: Exception) -> ProxyException: ) -def _model_access_denied_internal_message(e: Exception) -> str | None: - if not litellm.model_access_denied_message: - return None - if not isinstance(e, (ModelAccessDeniedProxyException, ModelAccessDeniedHTTPException)): - return None - return e.internal_message.replace("\r", "").replace("\n", "") - - def _get_user_agent(request: Request) -> str | None: if "headers" not in request.scope: return None @@ -176,9 +176,6 @@ class UserAPIKeyAuthExceptionHandler: # survives a raising callback pipeline. Classify and route malformed virtual-key # rejections to WARNING on stdout (suppressible via LITELLM_LOG=ERROR). log_extra: Final = {"requester_ip": requester_ip} - denied_internal_message: Final = _model_access_denied_internal_message(e) - if denied_internal_message is not None: - verbose_proxy_logger.warning(denied_internal_message, extra=log_extra) is_invalid_virtual_key: Final = is_invalid_virtual_key_error(e) is_quiet_log: Final = is_invalid_virtual_key and not litellm.log_client_error_tracebacks logger: Final = verbose_proxy_stdout_logger if is_quiet_log else verbose_proxy_logger diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py index 2307b093736..c346115085d 100644 --- a/litellm/proxy/proxy_server.py +++ b/litellm/proxy/proxy_server.py @@ -106,6 +106,7 @@ from litellm.proxy._types import ( LiteLLM_TeamTableCachedObj, LiteLLM_UserTable, LitellmUserRoles, + ModelAccessDeniedProxyException, PassThroughGenericEndpoint, ProxyErrorTypes, ProxyException, @@ -1668,6 +1669,7 @@ class UserAPIKeyCacheTTLEnum(enum.Enum): @app.exception_handler(ProxyException) async def openai_exception_handler(request: Request, exc: ProxyException): # NOTE: DO NOT MODIFY THIS, its crucial to map to Openai exceptions + _log_model_access_denial(exc) headers: Final = exc.headers error_dict: Final = exc.to_dict() status_code: Final = int(exc.code) if exc.code else status.HTTP_500_INTERNAL_SERVER_ERROR @@ -1679,6 +1681,12 @@ async def openai_exception_handler(request: Request, exc: ProxyException): ) +def _log_model_access_denial(exc: ProxyException) -> None: + if not litellm.model_access_denied_message or not isinstance(exc, ModelAccessDeniedProxyException): + return + verbose_proxy_logger.warning(exc.internal_message.replace("\r", "").replace("\n", "")) + + def _close_dangling_otel_server_span(request: Request, status_code: int, exc: Exception | None = None) -> None: parent_otel_span: Final[_Span | None] = getattr(request.state, "parent_otel_span", None) if parent_otel_span is None: @@ -11967,6 +11975,7 @@ async def realtime_websocket_endpoint( llm_router=llm_router, ) except ProxyException as e: + _log_model_access_denial(e) await _reject_realtime_session(websocket, user_api_key_dict, code=1008, reason=e.message[:120]) return await websocket.accept(**accept_kwargs) diff --git a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py index 602c074ee66..4328eac8432 100644 --- a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py +++ b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py @@ -1022,7 +1022,9 @@ def _denied_jwt_exception() -> ModelAccessDeniedHTTPException: pytest.param(_denied_jwt_exception, id="jwt_http_exception"), ], ) -async def test_handle_authentication_error_logs_sanitized_model_access_denial_once(monkeypatch, make_denial, caplog): +async def test_handle_authentication_error_keeps_internal_message_on_model_access_denial( + monkeypatch, make_denial, caplog +): monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) handler = UserAPIKeyAuthExceptionHandler() denial = make_denial() @@ -1041,17 +1043,14 @@ async def test_handle_authentication_error_logs_sanitized_model_access_denial_on {"allow_requests_on_db_unavailable": False}, ), caplog.at_level("WARNING", logger="LiteLLM Proxy"), - pytest.raises(ProxyException) as exc_info, + pytest.raises(ModelAccessDeniedProxyException) as exc_info, ): await handler._handle_authentication_error(denial, MagicMock(), {}, "/v1/chat/completions", None, "sk-bad-key") assert exc_info.value.code == str(status.HTTP_403_FORBIDDEN) assert "internal-models" not in str(exc_info.value.message) - denial_records = [r for r in caplog.records if "internal-models" in r.getMessage()] - assert len(denial_records) == 1 - assert denial_records[0].levelname == "WARNING" - assert "\n" not in denial_records[0].getMessage() - assert "gpt-5.6WARNING forged log line" in denial_records[0].getMessage() + assert exc_info.value.internal_message == denial.internal_message + assert [r for r in caplog.records if r.levelname == "WARNING" and "internal-models" in r.getMessage()] == [] @pytest.mark.asyncio diff --git a/tests/test_litellm/proxy/test_proxy_server.py b/tests/test_litellm/proxy/test_proxy_server.py index f0e8aecdcf3..c06f572aca5 100644 --- a/tests/test_litellm/proxy/test_proxy_server.py +++ b/tests/test_litellm/proxy/test_proxy_server.py @@ -19,7 +19,7 @@ import fastapi.routing import httpx import pytest import yaml -from fastapi import FastAPI +from fastapi import FastAPI, Request from fastapi.encoders import jsonable_encoder from fastapi.staticfiles import StaticFiles from fastapi.testclient import TestClient @@ -31,10 +31,17 @@ from litellm.caching.caching import RedisCache from litellm.caching.redis_cluster_cache import RedisClusterCache from litellm.litellm_core_utils.get_model_cost_map import ModelCostMapReloaded from litellm.caching.dual_cache import DualCache -from litellm.proxy._types import LitellmUserRoles, TokenCountRequest, UserAPIKeyAuth +from litellm.proxy._types import ( + LitellmUserRoles, + ModelAccessDeniedProxyException, + ProxyErrorTypes, + ProxyException, + TokenCountRequest, + UserAPIKeyAuth, +) from litellm.proxy.auth.user_api_key_auth import user_api_key_auth from litellm.proxy.hooks.parallel_request_limiter_v3 import RequestRateLimiterStash -from litellm.proxy.proxy_server import app, initialize +from litellm.proxy.proxy_server import app, initialize, openai_exception_handler from litellm.utils import _invalidate_model_cost_lowercase_map example_embedding_result = { @@ -10003,6 +10010,7 @@ async def _lit6973_drive_realtime_session( backend_logged_failure: bool = False, phase_one_exit: str | None = None, websocket: MagicMock | None = None, + model_access_exception: ProxyException | None = None, ) -> MagicMock: """Drive realtime_websocket_endpoint through one of its reservation-settling exits. @@ -10035,10 +10043,10 @@ async def _lit6973_drive_realtime_session( if backend_logged_failure: logging_obj.model_call_details[REALTIME_SESSION_FAILURE_LOGGED_KEY] = True - from litellm.proxy._types import ProxyException - model_access_error: Final = ( - ProxyException(message="key cannot access model", type="auth_error", param="model", code=401) + model_access_exception + if model_access_exception is not None + else ProxyException(message="key cannot access model", type="auth_error", param="model", code=401) if phase_one_exit == "model_access" else None ) @@ -10916,6 +10924,95 @@ def test_validate_model_access_denied_message_empty_restores_detailed_default(em assert _validate_general_settings_ui_litellm_value("model_access_denied_message", empty_value) is None +def _model_access_denied_proxy_exception(): + return ModelAccessDeniedProxyException( + message="The model `gpt-5.6\r\nWARNING forged log line` is unavailable for this API key or does not exist.", + internal_message="key not allowed to access model. This key can only access models=['internal-models']. " + "Tried to access gpt-5.6\r\nWARNING forged log line", + type=ProxyErrorTypes.key_model_access_denied, + param="model", + code=403, + ) + + +def _http_request_scope(): + return Request({"type": "http", "method": "POST", "path": "/v1/chat/completions", "headers": []}) + + +@pytest.mark.asyncio +async def test_openai_exception_handler_logs_sanitized_model_access_denial(monkeypatch, caplog): + monkeypatch.setattr( + litellm, "model_access_denied_message", "The model `{model}` is unavailable for this API key or does not exist." + ) + + with caplog.at_level("WARNING", logger="LiteLLM Proxy"): + response = await openai_exception_handler(_http_request_scope(), _model_access_denied_proxy_exception()) + + assert response.status_code == 403 + body = json.loads(response.body) + assert "internal-models" not in body["error"]["message"] + denial_records = [r for r in caplog.records if "internal-models" in r.getMessage()] + assert len(denial_records) == 1 + assert denial_records[0].levelname == "WARNING" + assert "\n" not in denial_records[0].getMessage() + assert "\r" not in denial_records[0].getMessage() + assert "gpt-5.6WARNING forged log line" in denial_records[0].getMessage() + + +@pytest.mark.asyncio +@pytest.mark.parametrize("unset_value", [None, ""]) +async def test_openai_exception_handler_no_denial_log_when_message_not_configured(monkeypatch, unset_value, caplog): + monkeypatch.setattr(litellm, "model_access_denied_message", unset_value) + + with caplog.at_level("WARNING", logger="LiteLLM Proxy"): + response = await openai_exception_handler(_http_request_scope(), _model_access_denied_proxy_exception()) + + assert response.status_code == 403 + assert [r for r in caplog.records if r.levelname == "WARNING" and "internal-models" in r.getMessage()] == [] + + +@pytest.mark.asyncio +async def test_openai_exception_handler_no_denial_log_for_plain_proxy_exception(monkeypatch, caplog): + monkeypatch.setattr( + litellm, "model_access_denied_message", "The model `{model}` is unavailable for this API key or does not exist." + ) + denial = ProxyException( + message="Authentication Error, Invalid proxy server token passed", + type=ProxyErrorTypes.auth_error, + param="None", + code=401, + ) + + with caplog.at_level("WARNING", logger="LiteLLM Proxy"): + response = await openai_exception_handler(_http_request_scope(), denial) + + assert response.status_code == 401 + assert [r for r in caplog.records if r.levelname == "WARNING"] == [] + + +@pytest.mark.asyncio +async def test_realtime_model_access_denial_logs_sanitized_internal_message(monkeypatch, caplog): + monkeypatch.setattr( + litellm, "model_access_denied_message", "The model `{model}` is unavailable for this API key or does not exist." + ) + reservation = {"reserved_cost": 0.0, "input_cost": 0.0, "finalized": False, "entries": []} + + with caplog.at_level("WARNING", logger="LiteLLM Proxy"): + ws = await _lit6973_drive_realtime_session( + reservation, + backend_logged_success=False, + phase_one_exit="model_access", + model_access_exception=_model_access_denied_proxy_exception(), + ) + + ws.close.assert_awaited_once() + assert "internal-models" not in ws.close.await_args.kwargs["reason"] + denial_records = [r for r in caplog.records if "internal-models" in r.getMessage()] + assert len(denial_records) == 1 + assert "\n" not in denial_records[0].getMessage() + assert "gpt-5.6WARNING forged log line" in denial_records[0].getMessage() + + @pytest.mark.parametrize("empty_value", [None, ""]) def test_validate_expose_router_debug_in_errors_empty_restores_true_default(empty_value): from litellm.proxy.proxy_server import _validate_general_settings_ui_litellm_value From 241b177f05a9dfa56621eea65f85ee24294e4d1f Mon Sep 17 00:00:00 2001 From: yassin Date: Wed, 16 Sep 2026 00:22:48 +0000 Subject: [PATCH 5/9] fix(proxy): log the internal model access denial reason for MCP sampling denials MCP sampling catches the denial itself and returns ErrorData, so the central ProxyException handler never sees it. Log the sanitized internal reason there and share the CR/LF stripping through ModelAccessDeniedProxyException.sanitized_internal_message Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .../mcp_server/sampling_handler.py | 5 ++++- litellm/proxy/_types.py | 3 +++ litellm/proxy/proxy_server.py | 2 +- .../test_mcp_sampling_model_access.py | 18 ++++++++++++++++++ 4 files changed, 26 insertions(+), 2 deletions(-) diff --git a/litellm/proxy/_experimental/mcp_server/sampling_handler.py b/litellm/proxy/_experimental/mcp_server/sampling_handler.py index 125dc3d773d..6072e747bfe 100644 --- a/litellm/proxy/_experimental/mcp_server/sampling_handler.py +++ b/litellm/proxy/_experimental/mcp_server/sampling_handler.py @@ -771,6 +771,7 @@ async def _check_model_access(model: str, user_api_key_auth: "UserAPIKeyAuth | N try: import litellm + from litellm.proxy._types import ModelAccessDeniedProxyException from litellm.proxy.auth.auth_checks import ( _check_team_member_model_access, can_key_call_model, @@ -887,7 +888,9 @@ async def _check_model_access(model: str, user_api_key_auth: "UserAPIKeyAuth | N verbose_logger.warning( "MCP sampling: model access denied for model=%s: %s", model, - access_err, + access_err.sanitized_internal_message() + if isinstance(access_err, ModelAccessDeniedProxyException) + else access_err, ) return ErrorData( code=-1, diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py index 89a4f583dcd..e9bfb7ab5ab 100644 --- a/litellm/proxy/_types.py +++ b/litellm/proxy/_types.py @@ -4042,6 +4042,9 @@ class ModelAccessDeniedProxyException(ProxyException): super().__init__(message=message, type=type, param=param, code=code) self.internal_message: Final = internal_message + def sanitized_internal_message(self) -> str: + return self.internal_message.replace("\r", "").replace("\n", "") + class CommonProxyErrors(str, enum.Enum): db_not_connected_error = ( diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py index 9deb70a9277..12d62f6620d 100644 --- a/litellm/proxy/proxy_server.py +++ b/litellm/proxy/proxy_server.py @@ -1684,7 +1684,7 @@ async def openai_exception_handler(request: Request, exc: ProxyException): def _log_model_access_denial(exc: ProxyException) -> None: if not litellm.model_access_denied_message or not isinstance(exc, ModelAccessDeniedProxyException): return - verbose_proxy_logger.warning(exc.internal_message.replace("\r", "").replace("\n", "")) + verbose_proxy_logger.warning(exc.sanitized_internal_message()) def _close_dangling_otel_server_span(request: Request, status_code: int, exc: Exception | None = None) -> None: diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_sampling_model_access.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_sampling_model_access.py index f141cb2e316..d98db5518c3 100644 --- a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_sampling_model_access.py +++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_sampling_model_access.py @@ -137,6 +137,24 @@ class TestCheckModelAccess: assert result.code == -1 assert "claude-3-opus-20240229" in result.message + @pytest.mark.asyncio + async def test_should_log_internal_denial_reason_when_client_message_is_configured(self, monkeypatch, caplog): + import litellm + from litellm.proxy._types import UserAPIKeyAuth + + monkeypatch.setattr(litellm, "model_access_denied_message", "The model `{model}` is unavailable for this API key.") + auth = UserAPIKeyAuth(api_key="sk-test-key", models=["gpt-3.5-turbo"]) + + with caplog.at_level("WARNING", logger="LiteLLM"): + result = await _check_model_access("gpt-4o\r\nforged", user_api_key_auth=auth) + + assert result is not None + assert "gpt-4o\r\nforged" in result.message + assert "gpt-3.5-turbo" not in result.message + denial_records = [r for r in caplog.records if "gpt-3.5-turbo" in r.getMessage()] + assert len(denial_records) == 1 + assert "Tried to access gpt-4oforged" in denial_records[0].getMessage() + @pytest.mark.asyncio async def test_should_deny_empty_oauth_passthrough_placeholder(self): """Regression: process_mcp_request() returns an empty UserAPIKeyAuth() From 14d239fc849417d62e3458603a5432a216eb4944 Mon Sep 17 00:00:00 2001 From: yassin Date: Wed, 16 Sep 2026 00:46:59 +0000 Subject: [PATCH 6/9] test(proxy): pin JWT scope denial message shape through auth exception conversion Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .../proxy/auth/test_auth_exception_handler.py | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py index 4328eac8432..d5ef71cd1d1 100644 --- a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py +++ b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py @@ -36,7 +36,7 @@ from litellm.proxy._types import ( ProxyException, UserAPIKeyAuth, ) -from litellm.proxy.auth.auth_exception_handler import UserAPIKeyAuthExceptionHandler +from litellm.proxy.auth.auth_exception_handler import UserAPIKeyAuthExceptionHandler, _as_proxy_exception from litellm.proxy.auth.model_access_denied import ModelAccessDeniedHTTPException @@ -1053,6 +1053,21 @@ async def test_handle_authentication_error_keeps_internal_message_on_model_acces assert [r for r in caplog.records if r.levelname == "WARNING" and "internal-models" in r.getMessage()] == [] +def test_as_proxy_exception_keeps_jwt_scope_denial_message_shape(): + detail = {"error": "The model `gpt-5.6` is unavailable for this API key or does not exist."} + denial = ModelAccessDeniedHTTPException( + internal_message="model=gpt-5.6 not allowed. Allowed_models=['internal-models']", + status_code=status.HTTP_403_FORBIDDEN, + detail=detail, + ) + plain = _as_proxy_exception(HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=detail)) + + converted = _as_proxy_exception(denial) + + assert converted.to_dict() == plain.to_dict() + assert converted.internal_message == denial.internal_message + + @pytest.mark.asyncio @pytest.mark.parametrize("unset_value", [None, ""]) async def test_handle_authentication_error_no_extra_denial_log_when_message_not_configured( From 15f2e25e8af3015b408ceb4a2f057a93bf1bed85 Mon Sep 17 00:00:00 2001 From: yassin Date: Wed, 16 Sep 2026 01:44:36 +0000 Subject: [PATCH 7/9] refactor(proxy): replace configurable model access denied message with a fixed clean client message Drop the model_access_denied_message setting, its {model} template, the DB override entry and the Admin UI field. Model access denials now always return the fixed client message while the allowlist diagnostic is logged at the final HTTP, realtime and MCP boundaries Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- litellm/__init__.py | 1 - litellm/constants.py | 3 - litellm/proxy/auth/auth_checks.py | 8 +- litellm/proxy/auth/handle_jwt.py | 10 +- litellm/proxy/auth/model_access_denied.py | 13 +- litellm/proxy/proxy_server.py | 39 +----- tests/otel_tests/test_e2e_model_access.py | 8 +- tests/proxy_unit_tests/test_auth_checks.py | 4 +- .../test_mcp_sampling_model_access.py | 4 +- .../proxy/auth/test_auth_checks.py | 68 +++++----- .../proxy/auth/test_auth_exception_handler.py | 56 ++------- .../proxy/auth/test_auth_utils.py | 2 +- .../proxy/auth/test_handle_jwt.py | 34 ++--- .../test_realtime_webrtc_endpoints.py | 14 +-- tests/test_litellm/proxy/test_proxy_server.py | 119 +----------------- tests/test_litellm/test_router.py | 6 +- tests/test_openai_endpoints.py | 2 +- .../general_settings.integration.test.tsx | 58 +-------- .../_components/general_settings.tsx | 42 +++---- 19 files changed, 114 insertions(+), 377 deletions(-) diff --git a/litellm/__init__.py b/litellm/__init__.py index 73714cd0c9c..3668e6efb0c 100644 --- a/litellm/__init__.py +++ b/litellm/__init__.py @@ -219,7 +219,6 @@ redact_user_api_key_info: Optional[bool] = False # major release; opt in early with `litellm.expose_router_debug_in_errors # = False`. expose_router_debug_in_errors: bool = True -model_access_denied_message: str | None = None filter_invalid_headers: Optional[bool] = False add_user_information_to_llm_headers: Optional[bool] = ( None # adds user_id, team_id, token hash (params from StandardLoggingMetadata) to request headers diff --git a/litellm/constants.py b/litellm/constants.py index 7d546fdccdf..745a4d9294e 100644 --- a/litellm/constants.py +++ b/litellm/constants.py @@ -98,7 +98,6 @@ BASE64_TRUNCATION_OFFLOAD_THRESHOLD_CHARS: Final = 256 * 1024 REDACTED_BY_LITELLM: Final = "redacted-by-litellm" # in-memory stand-in handed to provider converters for redacted arguments; never stored REDACTED_TOOL_CALL_ARGUMENTS_PLACEHOLDER: Final = "{}" -MODEL_ACCESS_DENIED_MESSAGE_MODEL_PLACEHOLDER: Final = "{model}" MAX_STRING_LENGTH_STDOUT_LOG: Final = get_env_int("MAX_STRING_LENGTH_STDOUT_LOG", 4096) @@ -1801,8 +1800,6 @@ LITELLM_SETTINGS_SAFE_DB_OVERRIDES: Final = [ "max_ui_session_budget", "budget_rollover", "mcp_tool_search", - "model_access_denied_message", - "expose_router_debug_in_errors", ] SPECIAL_LITELLM_AUTH_TOKEN: Final = ["ui-token"] DEFAULT_MANAGEMENT_OBJECT_IN_MEMORY_CACHE_TTL = int(os.getenv("DEFAULT_MANAGEMENT_OBJECT_IN_MEMORY_CACHE_TTL", 60)) diff --git a/litellm/proxy/auth/auth_checks.py b/litellm/proxy/auth/auth_checks.py index 6b67fc0cb28..ba68dc8a17f 100644 --- a/litellm/proxy/auth/auth_checks.py +++ b/litellm/proxy/auth/auth_checks.py @@ -72,7 +72,7 @@ from litellm.proxy.auth.budget_throttle import ( budget_throttle_percentage, should_throttle_budget_exceeded, ) -from litellm.proxy.auth.model_access_denied import client_facing_model_access_denied_message +from litellm.proxy.auth.model_access_denied import model_access_denied_client_message from litellm.proxy.auth.route_checks import RouteChecks from litellm.proxy.common_utils.auth_cache_invalidation_pubsub import publish_auth_cache_invalidation from litellm.proxy.common_utils.cache_pydantic_utils import CacheCodec @@ -4177,7 +4177,7 @@ def _can_object_call_model( f"Tried to access {model}" ) raise ModelAccessDeniedProxyException( - message=client_facing_model_access_denied_message(internal_message=internal_message, model=model), + message=model_access_denied_client_message(model=model), internal_message=internal_message, type=ProxyErrorTypes.get_model_access_error_type_for_object(object_type=object_type), param="model", @@ -4808,7 +4808,7 @@ async def can_user_call_model( f"Tried to access {model}" ) raise ModelAccessDeniedProxyException( - message=client_facing_model_access_denied_message(internal_message=internal_message, model=model), + message=model_access_denied_client_message(model=model), internal_message=internal_message, type=ProxyErrorTypes.key_model_access_denied, param="model", @@ -5415,7 +5415,7 @@ async def _check_team_member_model_access( f"Model={model}. Allowed member models = {member_allowed_models}" ) raise ModelAccessDeniedProxyException( - message=client_facing_model_access_denied_message(internal_message=internal_message, model=model), + message=model_access_denied_client_message(model=model), internal_message=internal_message, type=ProxyErrorTypes.team_model_access_denied, param="model", diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py index ea6d52b28f0..0389f69cfeb 100644 --- a/litellm/proxy/auth/handle_jwt.py +++ b/litellm/proxy/auth/handle_jwt.py @@ -54,7 +54,7 @@ from litellm.proxy._types import ( from litellm.proxy.auth.auth_checks import can_team_access_model from litellm.proxy.auth.model_access_denied import ( ModelAccessDeniedHTTPException, - client_facing_model_access_denied_message, + model_access_denied_client_message, ) from litellm.proxy.auth.resolvers.grants import GrantResolver, UserLookup, canonical_user_id from litellm.proxy.auth.route_checks import RouteChecks @@ -1347,7 +1347,7 @@ class JWTAuthManager: raise ModelAccessDeniedHTTPException( internal_message=internal_message, status_code=403, - detail=client_facing_model_access_denied_message(internal_message=internal_message, model=model), + detail=model_access_denied_client_message(model=model), ) return True @@ -1380,11 +1380,7 @@ class JWTAuthManager: raise ModelAccessDeniedHTTPException( internal_message=internal_message, status_code=403, - detail={ - "error": client_facing_model_access_denied_message( - internal_message=internal_message, model=requested_model - ) - }, + detail={"error": model_access_denied_client_message(model=requested_model)}, ) return diff --git a/litellm/proxy/auth/model_access_denied.py b/litellm/proxy/auth/model_access_denied.py index 8164e06c42a..ffb73b343cd 100644 --- a/litellm/proxy/auth/model_access_denied.py +++ b/litellm/proxy/auth/model_access_denied.py @@ -2,15 +2,14 @@ from typing import Final from fastapi import HTTPException -import litellm -from litellm.constants import MODEL_ACCESS_DENIED_MESSAGE_MODEL_PLACEHOLDER +MODEL_ACCESS_DENIED_CLIENT_MESSAGE: Final = ( + "The requested model '{model}' is not available for this API key, or the model name is invalid. " + "Check the models available to you and try again." +) -def client_facing_model_access_denied_message(internal_message: str, model: str | list[str]) -> str: - template: Final = litellm.model_access_denied_message - if not template: - return internal_message - return template.replace(MODEL_ACCESS_DENIED_MESSAGE_MODEL_PLACEHOLDER, str(model)) +def model_access_denied_client_message(model: str | list[str]) -> str: + return MODEL_ACCESS_DENIED_CLIENT_MESSAGE.format(model=model) class ModelAccessDeniedHTTPException(HTTPException): diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py index 12d62f6620d..23bb8b6225b 100644 --- a/litellm/proxy/proxy_server.py +++ b/litellm/proxy/proxy_server.py @@ -1682,7 +1682,7 @@ async def openai_exception_handler(request: Request, exc: ProxyException): def _log_model_access_denial(exc: ProxyException) -> None: - if not litellm.model_access_denied_message or not isinstance(exc, ModelAccessDeniedProxyException): + if not isinstance(exc, ModelAccessDeniedProxyException): return verbose_proxy_logger.warning(exc.sanitized_internal_message()) @@ -17455,13 +17455,11 @@ GeneralSettingsUILiteLLMValue = float | bool | str | None class GeneralSettingsUILiteLLMFieldSpec(TypedDict): - type: ReadOnly[Literal["Float", "Dollar", "Boolean", "Select", "String"]] - description: ReadOnly[str] - options: ReadOnly[NotRequired[tuple[str, ...]]] - tab: ReadOnly[NotRequired[str]] # Admin UI sub-tab this field renders under; None groups it with the rest - default: ReadOnly[ - NotRequired[float | bool] - ] # reset/clear restores this instead of None; fields whose None means fail-open set it + type: Literal["Float", "Dollar", "Boolean", "Select"] + description: str + options: NotRequired[tuple[str, ...]] + tab: NotRequired[str] # Admin UI sub-tab this field renders under; None groups it with the rest + default: NotRequired[float] # reset/clear restores this instead of None; fields whose None means fail-open set it _GENERAL_SETTINGS_UI_LITELLM_FIELDS: Final[dict[str, GeneralSettingsUILiteLLMFieldSpec]] = { @@ -17513,24 +17511,6 @@ _GENERAL_SETTINGS_UI_LITELLM_FIELDS: Final[dict[str, GeneralSettingsUILiteLLMFie "with this budget. Clearing restores the $1 default." ), }, - "model_access_denied_message": { - "type": "String", - "description": ( - "Client-facing error message returned when a key, team, user, org or project is not allowed " - "to call the requested model. {model} is replaced with the requested model name. The full " - "denial reason (allowed models and access groups) is still written to the proxy logs. " - "Leave empty to return the detailed message to clients." - ), - }, - "expose_router_debug_in_errors": { - "type": "Boolean", - "default": True, - "description": ( - "Append router debug details (model group, configured fallbacks, fallback errors, cooldown " - "info) to error messages returned to clients. Turn off to keep those details in the proxy " - "logs only." - ), - }, } @@ -17578,13 +17558,6 @@ def _validate_general_settings_ui_litellm_value(field_name: str, value: object) detail={"error": f"{field_name} must be a positive dollar amount or empty"}, ) return float(value) - case "String": - if not isinstance(value, str): - raise HTTPException( - status_code=400, - detail={"error": f"{field_name} must be a string or empty"}, - ) - return value case _: assert_never(field_type) diff --git a/tests/otel_tests/test_e2e_model_access.py b/tests/otel_tests/test_e2e_model_access.py index e5e93c0b179..6017a820299 100644 --- a/tests/otel_tests/test_e2e_model_access.py +++ b/tests/otel_tests/test_e2e_model_access.py @@ -101,7 +101,7 @@ async def test_model_access_patterns(key_models, test_model, expect_success): assert _error_body["type"] == "key_model_access_denied" assert _error_body["param"] == "model" assert _error_body["code"] == "403" - assert "key not allowed to access model" in _error_body["message"] + assert "is not available for this API key" in _error_body["message"] @pytest.mark.asyncio @@ -299,7 +299,5 @@ def _validate_model_access_exception( assert _error_body["type"] == expected_type assert _error_body["param"] == "model" assert _error_body["code"] == "403" - if expected_type == "key_model_access_denied": - assert "key not allowed to access model" in _error_body["message"] - elif expected_type == "team_model_access_denied": - assert "eam not allowed to access model" in _error_body["message"] + assert "is not available for this API key" in _error_body["message"] + assert "not allowed to access model" not in _error_body["message"] diff --git a/tests/proxy_unit_tests/test_auth_checks.py b/tests/proxy_unit_tests/test_auth_checks.py index d436c99cd20..2538556d3b5 100644 --- a/tests/proxy_unit_tests/test_auth_checks.py +++ b/tests/proxy_unit_tests/test_auth_checks.py @@ -163,7 +163,7 @@ async def test_can_key_call_model(model, expect_to_work): if expect_to_work: await can_key_call_model(**args) else: - with pytest.raises(Exception, match='key not allowed to access model\\. This key can only access') as e: + with pytest.raises(Exception, match='is not available for this API key') as e: await can_key_call_model(**args) print(e) @@ -943,7 +943,7 @@ async def test_can_key_call_model_with_aliases(model, alias_map, expect_to_work) llm_router=router, ) else: - with pytest.raises(Exception, match='key not allowed to access model\\. This key can only access') as e: + with pytest.raises(Exception, match='is not available for this API key') as e: await can_key_call_model( model=model, llm_model_list=llm_model_list, diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_sampling_model_access.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_sampling_model_access.py index d98db5518c3..7eebf1eb436 100644 --- a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_sampling_model_access.py +++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_sampling_model_access.py @@ -138,11 +138,9 @@ class TestCheckModelAccess: assert "claude-3-opus-20240229" in result.message @pytest.mark.asyncio - async def test_should_log_internal_denial_reason_when_client_message_is_configured(self, monkeypatch, caplog): - import litellm + async def test_should_log_internal_denial_reason_and_hide_allowlist_from_client(self, caplog): from litellm.proxy._types import UserAPIKeyAuth - monkeypatch.setattr(litellm, "model_access_denied_message", "The model `{model}` is unavailable for this API key.") auth = UserAPIKeyAuth(api_key="sk-test-key", models=["gpt-3.5-turbo"]) with caplog.at_level("WARNING", logger="LiteLLM"): diff --git a/tests/test_litellm/proxy/auth/test_auth_checks.py b/tests/test_litellm/proxy/auth/test_auth_checks.py index 0677fb8af29..26ae28a57d2 100644 --- a/tests/test_litellm/proxy/auth/test_auth_checks.py +++ b/tests/test_litellm/proxy/auth/test_auth_checks.py @@ -531,12 +531,14 @@ async def test_can_team_access_model_error_lists_direct_and_access_group_models( assert await can_team_access_model("direct-model", team_object, None) is True assert await can_team_access_model("group-model", team_object, None) is True - with pytest.raises(ProxyException) as exc_info: + with pytest.raises(ModelAccessDeniedProxyException) as exc_info: await can_team_access_model("blocked-model", team_object, None) assert exc_info.value.type == ProxyErrorTypes.team_model_access_denied - assert "direct-model" in exc_info.value.message - assert "group-model" in exc_info.value.message + assert "direct-model" in exc_info.value.internal_message + assert "group-model" in exc_info.value.internal_message + assert "direct-model" not in exc_info.value.message + assert "group-model" not in exc_info.value.message @pytest.mark.asyncio @@ -1676,16 +1678,17 @@ def test_can_object_call_model_no_access_to_alias_or_underlying(): # Should raise ProxyException with appropriate error type assert exc_info.value.type == ProxyErrorTypes.key_model_access_denied - assert "key not allowed to access model" in str(exc_info.value.message) + assert "is not available for this API key" in str(exc_info.value.message) assert "my-fake-gpt" in str(exc_info.value.message) -_DENIED_MESSAGE_TEMPLATE: Final = "The model `{model}` is unavailable for this API key or does not exist." +_DENIED_MESSAGE_TEMPLATE: Final = ( + "The requested model '{model}' is not available for this API key, or the model name is invalid. " + "Check the models available to you and try again." +) -def test_can_object_call_model_denial_uses_configured_message_and_keeps_detail_on_exception(monkeypatch, caplog): - monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) - +def test_can_object_call_model_denial_hides_allowlist_and_keeps_detail_on_exception(caplog): with caplog.at_level("DEBUG", logger="LiteLLM Proxy"): with pytest.raises(ModelAccessDeniedProxyException) as exc_info: _can_object_call_model( @@ -1695,9 +1698,8 @@ def test_can_object_call_model_denial_uses_configured_message_and_keeps_detail_o object_type="key", ) - assert ( - exc_info.value.message == "The model `anthropic-sonnet-4-5` is unavailable for this API key or does not exist." - ) + assert exc_info.value.message == _DENIED_MESSAGE_TEMPLATE.format(model="anthropic-sonnet-4-5") + assert "internal-models" not in exc_info.value.message assert exc_info.value.type == ProxyErrorTypes.key_model_access_denied assert exc_info.value.param == "model" assert int(exc_info.value.code) == status.HTTP_403_FORBIDDEN @@ -1709,10 +1711,9 @@ def test_can_object_call_model_denial_uses_configured_message_and_keeps_detail_o @pytest.mark.asyncio -async def test_access_group_fallback_grant_does_not_log_a_denial(monkeypatch, caplog): +async def test_access_group_fallback_grant_does_not_log_a_denial(caplog): from litellm.proxy.auth.auth_checks import can_team_access_model - monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) team_object = LiteLLM_TeamTable(team_id="team-123", models=["direct-model"], access_group_ids=["ag-1"]) with ( @@ -1727,46 +1728,49 @@ async def test_access_group_fallback_grant_does_not_log_a_denial(monkeypatch, ca assert "not allowed to access model" not in caplog.text -@pytest.mark.parametrize("unset_value", [None, ""]) -def test_can_object_call_model_denial_unchanged_when_message_not_configured(monkeypatch, unset_value): - monkeypatch.setattr(litellm, "model_access_denied_message", unset_value) - - with pytest.raises(ProxyException) as exc_info: +@pytest.mark.parametrize( + "object_type, expected_type", + [ + ("team", ProxyErrorTypes.team_model_access_denied), + ("user", ProxyErrorTypes.user_model_access_denied), + ("org", ProxyErrorTypes.org_model_access_denied), + ], +) +def test_can_object_call_model_denial_same_client_message_for_every_object_type(object_type, expected_type): + with pytest.raises(ModelAccessDeniedProxyException) as exc_info: _can_object_call_model( model="anthropic-sonnet-4-5", llm_router=None, models=["internal-models"], - object_type="team", + object_type=object_type, ) - assert exc_info.value.message == ( - "team not allowed to access model. This team can only access models=['internal-models']. " - "Tried to access anthropic-sonnet-4-5" - ) + assert exc_info.value.message == _DENIED_MESSAGE_TEMPLATE.format(model="anthropic-sonnet-4-5") + assert exc_info.value.type == expected_type + assert f"{object_type} not allowed to access model" in exc_info.value.internal_message @pytest.mark.asyncio -async def test_can_user_call_model_no_default_models_uses_configured_message(monkeypatch): +async def test_can_user_call_model_no_default_models_hides_policy_detail(): from litellm.proxy._types import SpecialModelNames from litellm.proxy.auth.auth_checks import can_user_call_model - monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) user_object = LiteLLM_UserTable(user_id="test-user", models=[SpecialModelNames.no_default_models.value]) - with pytest.raises(ProxyException) as exc_info: + with pytest.raises(ModelAccessDeniedProxyException) as exc_info: await can_user_call_model(model="restricted-model", llm_router=None, user_object=user_object) - assert exc_info.value.message == "The model `restricted-model` is unavailable for this API key or does not exist." + assert exc_info.value.message == _DENIED_MESSAGE_TEMPLATE.format(model="restricted-model") + assert "only team models allowed" in exc_info.value.internal_message assert int(exc_info.value.code) == status.HTTP_403_FORBIDDEN @pytest.mark.asyncio -async def test_check_team_member_model_access_denied_uses_configured_message(monkeypatch): +async def test_check_team_member_model_access_denied_hides_member_allowlist(): from litellm.proxy._types import LiteLLM_TeamMembership from litellm.proxy.auth.auth_checks import _check_team_member_model_access from litellm.proxy.common_utils.user_api_key_cache import team_membership_reservation_cache_key - monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) membership = LiteLLM_TeamMembership( user_id="alice", team_id="team-a", @@ -1779,7 +1783,7 @@ async def test_check_team_member_model_access_denied_uses_configured_message(mon model_type=LiteLLM_TeamMembership, ) - with pytest.raises(ProxyException) as exc_info: + with pytest.raises(ModelAccessDeniedProxyException) as exc_info: await _check_team_member_model_access( model="mock-vision", team_object=LiteLLM_TeamTable(team_id="team-a"), @@ -1790,7 +1794,9 @@ async def test_check_team_member_model_access_denied_uses_configured_message(mon proxy_logging_obj=MagicMock(), ) - assert exc_info.value.message == "The model `mock-vision` is unavailable for this API key or does not exist." + assert exc_info.value.message == _DENIED_MESSAGE_TEMPLATE.format(model="mock-vision") + assert "fast-models" not in exc_info.value.message + assert "Allowed member models = ['fast-models']" in exc_info.value.internal_message assert exc_info.value.type == ProxyErrorTypes.team_model_access_denied diff --git a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py index d5ef71cd1d1..125b8862dfc 100644 --- a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py +++ b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py @@ -26,7 +26,6 @@ from prisma.errors import ( ) -import litellm from litellm._logging import verbose_proxy_logger from litellm.constants import INVALID_VIRTUAL_KEY_ERROR_MARKER from litellm.exceptions import BudgetExceededError @@ -991,12 +990,15 @@ async def test_handle_authentication_error_traceback_only_for_unexpected_errors( assert records[0].name == expected_logger_name -_DENIED_MESSAGE_TEMPLATE = "The model `{model}` is unavailable for this API key or does not exist." +_DENIED_CLIENT_MESSAGE = ( + "The requested model 'gpt-5.6' is not available for this API key, or the model name is invalid. " + "Check the models available to you and try again." +) def _denied_proxy_exception() -> ModelAccessDeniedProxyException: return ModelAccessDeniedProxyException( - message="The model `gpt-5.6\r\nWARNING forged log line` is unavailable for this API key or does not exist.", + message=_DENIED_CLIENT_MESSAGE, internal_message="key not allowed to access model. This key can only access models=['internal-models']. " "Tried to access gpt-5.6\r\nWARNING forged log line", type=ProxyErrorTypes.key_model_access_denied, @@ -1010,7 +1012,7 @@ def _denied_jwt_exception() -> ModelAccessDeniedHTTPException: internal_message="Role=engineer not allowed to call model=gpt-5.6\r\nWARNING forged log line. " "Allowed models=['internal-models']", status_code=status.HTTP_403_FORBIDDEN, - detail="The model `gpt-5.6` is unavailable for this API key or does not exist.", + detail=_DENIED_CLIENT_MESSAGE, ) @@ -1022,10 +1024,7 @@ def _denied_jwt_exception() -> ModelAccessDeniedHTTPException: pytest.param(_denied_jwt_exception, id="jwt_http_exception"), ], ) -async def test_handle_authentication_error_keeps_internal_message_on_model_access_denial( - monkeypatch, make_denial, caplog -): - monkeypatch.setattr(litellm, "model_access_denied_message", _DENIED_MESSAGE_TEMPLATE) +async def test_handle_authentication_error_keeps_internal_message_on_model_access_denial(make_denial, caplog): handler = UserAPIKeyAuthExceptionHandler() denial = make_denial() @@ -1054,7 +1053,7 @@ async def test_handle_authentication_error_keeps_internal_message_on_model_acces def test_as_proxy_exception_keeps_jwt_scope_denial_message_shape(): - detail = {"error": "The model `gpt-5.6` is unavailable for this API key or does not exist."} + detail = {"error": _DENIED_CLIENT_MESSAGE} denial = ModelAccessDeniedHTTPException( internal_message="model=gpt-5.6 not allowed. Allowed_models=['internal-models']", status_code=status.HTTP_403_FORBIDDEN, @@ -1066,42 +1065,3 @@ def test_as_proxy_exception_keeps_jwt_scope_denial_message_shape(): assert converted.to_dict() == plain.to_dict() assert converted.internal_message == denial.internal_message - - -@pytest.mark.asyncio -@pytest.mark.parametrize("unset_value", [None, ""]) -async def test_handle_authentication_error_no_extra_denial_log_when_message_not_configured( - monkeypatch, unset_value, caplog -): - monkeypatch.setattr(litellm, "model_access_denied_message", unset_value) - handler = UserAPIKeyAuthExceptionHandler() - denial = ModelAccessDeniedProxyException( - message="key not allowed to access model. This key can only access models=['internal-models']. " - "Tried to access gpt-5.6", - internal_message="key not allowed to access model. This key can only access models=['internal-models']. " - "Tried to access gpt-5.6", - type=ProxyErrorTypes.key_model_access_denied, - param="model", - code=status.HTTP_403_FORBIDDEN, - ) - - with ( - patch( # test-quality-ok: handler reads proxy_server globals at call time - "litellm.proxy.proxy_server.proxy_logging_obj.post_call_failure_hook", - new_callable=AsyncMock, - return_value=None, - ), - patch( # test-quality-ok: handler reads proxy_server globals at call time - "litellm.proxy.auth.auth_exception_handler.seed_request_identity", - ), - patch( # test-quality-ok: handler reads proxy_server globals at call time - "litellm.proxy.proxy_server.general_settings", - {"allow_requests_on_db_unavailable": False}, - ), - caplog.at_level("WARNING", logger="LiteLLM Proxy"), - pytest.raises(ProxyException) as exc_info, - ): - await handler._handle_authentication_error(denial, MagicMock(), {}, "/v1/chat/completions", None, "sk-bad-key") - - assert "internal-models" in str(exc_info.value.message) - assert [r for r in caplog.records if r.levelname == "WARNING" and "internal-models" in r.getMessage()] == [] diff --git a/tests/test_litellm/proxy/auth/test_auth_utils.py b/tests/test_litellm/proxy/auth/test_auth_utils.py index bd6a14cad21..db16da7237c 100644 --- a/tests/test_litellm/proxy/auth/test_auth_utils.py +++ b/tests/test_litellm/proxy/auth/test_auth_utils.py @@ -1053,7 +1053,7 @@ async def test_managed_batch_routes_pass_team_model_access_check(route, request_ is True ) - with pytest.raises(Exception, match="team not allowed to access model"): + with pytest.raises(Exception, match="is not available for this API key"): await can_team_access_model( model=model, team_object=LiteLLM_TeamTable(team_id="team-other", models=["some-other-model"]), diff --git a/tests/test_litellm/proxy/auth/test_handle_jwt.py b/tests/test_litellm/proxy/auth/test_handle_jwt.py index 9fab1e1785a..a8385eadc59 100644 --- a/tests/test_litellm/proxy/auth/test_handle_jwt.py +++ b/tests/test_litellm/proxy/auth/test_handle_jwt.py @@ -6972,19 +6972,13 @@ async def test_auth_builder_denies_jwt_naming_unregistered_agent_before_admin_ch assert exc_info.value.status_code == 403 -_JWT_DENIED_MESSAGE_TEMPLATE = "The model `{model}` is unavailable for this identity." - - -@pytest.mark.parametrize( - "configured_message, expected_detail", - [ - (None, "Role=internal_user not allowed to call model=gpt-5.6. Allowed models=['gpt-5.6-mini']"), - ("", "Role=internal_user not allowed to call model=gpt-5.6. Allowed models=['gpt-5.6-mini']"), - (_JWT_DENIED_MESSAGE_TEMPLATE, "The model `gpt-5.6` is unavailable for this identity."), - ], +_JWT_DENIED_CLIENT_MESSAGE = ( + "The requested model 'gpt-5.6' is not available for this API key, or the model name is invalid. " + "Check the models available to you and try again." ) -def test_can_rbac_role_call_model_denial_honors_configured_message(monkeypatch, configured_message, expected_detail): - monkeypatch.setattr(litellm, "model_access_denied_message", configured_message) + + +def test_can_rbac_role_call_model_denial_hides_role_allowlist_from_client(): general_settings = { "role_permissions": [ RoleBasedPermissions(role=LitellmUserRoles.INTERNAL_USER, models=["gpt-5.6-mini"]), @@ -6999,23 +6993,13 @@ def test_can_rbac_role_call_model_denial_honors_configured_message(monkeypatch, ) assert exc_info.value.status_code == 403 - assert exc_info.value.detail == expected_detail + assert exc_info.value.detail == _JWT_DENIED_CLIENT_MESSAGE assert exc_info.value.internal_message == ( "Role=internal_user not allowed to call model=gpt-5.6. Allowed models=['gpt-5.6-mini']" ) -@pytest.mark.parametrize( - "configured_message, expected_error", - [ - (None, "model=gpt-5.6 not allowed. Allowed_models=['gpt-5.6-mini']"), - ("", "model=gpt-5.6 not allowed. Allowed_models=['gpt-5.6-mini']"), - (_JWT_DENIED_MESSAGE_TEMPLATE, "The model `gpt-5.6` is unavailable for this identity."), - ], -) -def test_check_scope_based_access_denial_honors_configured_message(monkeypatch, configured_message, expected_error): - monkeypatch.setattr(litellm, "model_access_denied_message", configured_message) - +def test_check_scope_based_access_denial_hides_scope_allowlist_from_client(): with pytest.raises(ModelAccessDeniedHTTPException) as exc_info: JWTAuthManager.check_scope_based_access( scope_mappings=[ScopeMapping(scope="litellm.api.consumer", models=["gpt-5.6-mini"])], @@ -7025,5 +7009,5 @@ def test_check_scope_based_access_denial_honors_configured_message(monkeypatch, ) assert exc_info.value.status_code == 403 - assert exc_info.value.detail == {"error": expected_error} + assert exc_info.value.detail == {"error": _JWT_DENIED_CLIENT_MESSAGE} assert exc_info.value.internal_message == "model=gpt-5.6 not allowed. Allowed_models=['gpt-5.6-mini']" diff --git a/tests/test_litellm/proxy/realtime_endpoints/test_realtime_webrtc_endpoints.py b/tests/test_litellm/proxy/realtime_endpoints/test_realtime_webrtc_endpoints.py index 82f2ef097aa..f5c97142dde 100644 --- a/tests/test_litellm/proxy/realtime_endpoints/test_realtime_webrtc_endpoints.py +++ b/tests/test_litellm/proxy/realtime_endpoints/test_realtime_webrtc_endpoints.py @@ -287,7 +287,7 @@ async def test_client_secrets_transcription_rejects_disallowed_nested_model( ) assert response.status_code == 403 - assert "Tried to access gpt-realtime-whisper" in response.text + assert "The requested model 'gpt-realtime-whisper' is not available for this API key" in response.text mock_route_request.assert_not_called() finally: proxy_app.dependency_overrides.pop(user_api_key_auth, None) @@ -611,7 +611,7 @@ async def test_transcription_sessions_rejects_disallowed_resolved_model( ) assert response.status_code == 403 - assert "Tried to access gpt-realtime-whisper" in response.text + assert "The requested model 'gpt-realtime-whisper' is not available for this API key" in response.text mock_route_request.assert_not_called() finally: proxy_app.dependency_overrides.pop(user_api_key_auth, None) @@ -658,7 +658,7 @@ async def test_transcription_sessions_rejects_disallowed_team_model_scope( assert response.status_code == 403 assert "team" in response.text.lower() - assert "Tried to access gpt-realtime-whisper" in response.text + assert "The requested model 'gpt-realtime-whisper' is not available for this API key" in response.text mock_route_request.assert_not_called() finally: proxy_app.dependency_overrides.pop(user_api_key_auth, None) @@ -703,7 +703,7 @@ async def test_transcription_sessions_rejects_disallowed_project_model_scope( assert response.status_code == 403 assert "project" in response.text.lower() - assert "Tried to access gpt-realtime-whisper" in response.text + assert "The requested model 'gpt-realtime-whisper' is not available for this API key" in response.text mock_route_request.assert_not_called() finally: proxy_app.dependency_overrides.pop(user_api_key_auth, None) @@ -757,7 +757,7 @@ async def test_transcription_sessions_rejects_disallowed_team_member_model_scope ) assert response.status_code == 403 - assert "Team member not allowed to access model" in response.text + assert "is not available for this API key" in response.text mock_route_request.assert_not_called() finally: proxy_app.dependency_overrides.pop(user_api_key_auth, None) @@ -783,7 +783,7 @@ async def test_realtime_transcription_websocket_default_model_checks_key_scope() websocket.close.assert_awaited_once() _, close_kwargs = websocket.close.call_args assert close_kwargs["code"] == 1008 - assert "not allowed to access model" in close_kwargs["reason"] + assert "is not available for this API key" in close_kwargs["reason"] @pytest.mark.asyncio @@ -825,7 +825,7 @@ async def test_realtime_transcription_websocket_default_model_checks_team_scope( websocket.close.assert_awaited_once() _, close_kwargs = websocket.close.call_args assert close_kwargs["code"] == 1008 - assert "not allowed to access model" in close_kwargs["reason"] + assert "is not available for this API key" in close_kwargs["reason"] @pytest.mark.asyncio diff --git a/tests/test_litellm/proxy/test_proxy_server.py b/tests/test_litellm/proxy/test_proxy_server.py index ee85c9ba6a5..d1928b9cd52 100644 --- a/tests/test_litellm/proxy/test_proxy_server.py +++ b/tests/test_litellm/proxy/test_proxy_server.py @@ -10955,60 +10955,10 @@ def test_validate_max_ui_session_budget_empty_restores_default(empty_value): assert _validate_general_settings_ui_litellm_value("max_ui_session_budget", empty_value) == 1.0 -@pytest.mark.asyncio -async def test_update_config_field_model_access_denied_message_sets_live_value(monkeypatch): - from unittest.mock import AsyncMock, MagicMock - - import litellm.proxy.proxy_server as ps - from litellm.proxy._types import ConfigFieldUpdate, LitellmUserRoles, UserAPIKeyAuth - from litellm.proxy.proxy_server import update_config_general_settings - - save_config = AsyncMock() - monkeypatch.setattr(ps.proxy_config, "get_config", AsyncMock(return_value={"litellm_settings": {}})) - monkeypatch.setattr(ps.proxy_config, "save_config", save_config) - monkeypatch.setattr(ps, "prisma_client", MagicMock()) - monkeypatch.setattr(litellm, "store_audit_logs", False) - monkeypatch.setattr(litellm, "model_access_denied_message", None) - - admin = UserAPIKeyAuth(api_key="k", user_id="a", user_role=LitellmUserRoles.PROXY_ADMIN) - await update_config_general_settings( - data=ConfigFieldUpdate( - field_name="model_access_denied_message", - field_value="Model `{model}` is unavailable for this key.", - config_type="general_settings", - ), - user_api_key_dict=admin, - ) - - assert litellm.model_access_denied_message == "Model `{model}` is unavailable for this key." - save_config.assert_awaited_once() - saved_config = save_config.await_args.kwargs["new_config"] - assert saved_config["litellm_settings"]["model_access_denied_message"] == ( - "Model `{model}` is unavailable for this key." - ) - - -@pytest.mark.parametrize("bad_value", [True, 3, 1.5, ["x"], {"a": "b"}]) -def test_validate_model_access_denied_message_rejects_non_strings(bad_value): - from fastapi import HTTPException - - from litellm.proxy.proxy_server import _validate_general_settings_ui_litellm_value - - with pytest.raises(HTTPException) as exc_info: - _validate_general_settings_ui_litellm_value("model_access_denied_message", bad_value) - assert exc_info.value.status_code == 400 - - -@pytest.mark.parametrize("empty_value", [None, ""]) -def test_validate_model_access_denied_message_empty_restores_detailed_default(empty_value): - from litellm.proxy.proxy_server import _validate_general_settings_ui_litellm_value - - assert _validate_general_settings_ui_litellm_value("model_access_denied_message", empty_value) is None - - def _model_access_denied_proxy_exception(): return ModelAccessDeniedProxyException( - message="The model `gpt-5.6\r\nWARNING forged log line` is unavailable for this API key or does not exist.", + message="The requested model 'gpt-5.6\r\nWARNING forged log line' is not available for this API key, " + "or the model name is invalid. Check the models available to you and try again.", internal_message="key not allowed to access model. This key can only access models=['internal-models']. " "Tried to access gpt-5.6\r\nWARNING forged log line", type=ProxyErrorTypes.key_model_access_denied, @@ -11022,11 +10972,7 @@ def _http_request_scope(): @pytest.mark.asyncio -async def test_openai_exception_handler_logs_sanitized_model_access_denial(monkeypatch, caplog): - monkeypatch.setattr( - litellm, "model_access_denied_message", "The model `{model}` is unavailable for this API key or does not exist." - ) - +async def test_openai_exception_handler_logs_sanitized_model_access_denial(caplog): with caplog.at_level("WARNING", logger="LiteLLM Proxy"): response = await openai_exception_handler(_http_request_scope(), _model_access_denied_proxy_exception()) @@ -11042,22 +10988,7 @@ async def test_openai_exception_handler_logs_sanitized_model_access_denial(monke @pytest.mark.asyncio -@pytest.mark.parametrize("unset_value", [None, ""]) -async def test_openai_exception_handler_no_denial_log_when_message_not_configured(monkeypatch, unset_value, caplog): - monkeypatch.setattr(litellm, "model_access_denied_message", unset_value) - - with caplog.at_level("WARNING", logger="LiteLLM Proxy"): - response = await openai_exception_handler(_http_request_scope(), _model_access_denied_proxy_exception()) - - assert response.status_code == 403 - assert [r for r in caplog.records if r.levelname == "WARNING" and "internal-models" in r.getMessage()] == [] - - -@pytest.mark.asyncio -async def test_openai_exception_handler_no_denial_log_for_plain_proxy_exception(monkeypatch, caplog): - monkeypatch.setattr( - litellm, "model_access_denied_message", "The model `{model}` is unavailable for this API key or does not exist." - ) +async def test_openai_exception_handler_no_denial_log_for_plain_proxy_exception(caplog): denial = ProxyException( message="Authentication Error, Invalid proxy server token passed", type=ProxyErrorTypes.auth_error, @@ -11073,10 +11004,7 @@ async def test_openai_exception_handler_no_denial_log_for_plain_proxy_exception( @pytest.mark.asyncio -async def test_realtime_model_access_denial_logs_sanitized_internal_message(monkeypatch, caplog): - monkeypatch.setattr( - litellm, "model_access_denied_message", "The model `{model}` is unavailable for this API key or does not exist." - ) +async def test_realtime_model_access_denial_logs_sanitized_internal_message(caplog): reservation = {"reserved_cost": 0.0, "input_cost": 0.0, "finalized": False, "entries": []} with caplog.at_level("WARNING", logger="LiteLLM Proxy"): @@ -11095,43 +11023,6 @@ async def test_realtime_model_access_denial_logs_sanitized_internal_message(monk assert "gpt-5.6WARNING forged log line" in denial_records[0].getMessage() -@pytest.mark.parametrize("empty_value", [None, ""]) -def test_validate_expose_router_debug_in_errors_empty_restores_true_default(empty_value): - from litellm.proxy.proxy_server import _validate_general_settings_ui_litellm_value - - assert _validate_general_settings_ui_litellm_value("expose_router_debug_in_errors", empty_value) is True - assert _validate_general_settings_ui_litellm_value("expose_router_debug_in_errors", False) is False - - -@pytest.mark.parametrize( - "field_name, booted_value, db_value, read_setting", - [ - ( - "model_access_denied_message", - None, - "Model `{model}` is unavailable for this key.", - lambda: litellm.model_access_denied_message, - ), - ("expose_router_debug_in_errors", True, False, lambda: litellm.expose_router_debug_in_errors), - ], -) -def test_model_access_denied_settings_propagate_on_config_reload( - monkeypatch, field_name, booted_value, db_value, read_setting -): - import litellm.proxy.proxy_server as ps - - monkeypatch.setattr(litellm, field_name, booted_value) - assert read_setting() == booted_value - - ps.ProxyConfig()._update_config_fields( - current_config={"litellm_settings": {}}, - param_name="litellm_settings", - db_param_value={field_name: db_value}, - ) - - assert read_setting() == db_value - - def test_general_settings_ui_defaults_unchanged_for_existing_fields(): """The spec-default mechanism added for max_ui_session_budget must not change what clearing the pre-existing fields restores (None for Float/Select, False for Boolean).""" diff --git a/tests/test_litellm/test_router.py b/tests/test_litellm/test_router.py index fb42ab6c893..1e6636ec3d6 100644 --- a/tests/test_litellm/test_router.py +++ b/tests/test_litellm/test_router.py @@ -16424,7 +16424,7 @@ class TestMemberAutoRouterInference: project_id="router-project", team_id="router-team", models=["restricted-model"], ), model_type=LiteLLM_ProjectTableCachedObj, ) - with pytest.raises(ProxyException, match="not allowed to access model"): + with pytest.raises(ProxyException, match="is not available for this API key"): await self._route(self._router(), self._request(actor=self.actor.model_copy(update={ "models": ["member-router"] if ceiling == "key" else self.actor.models, "project_id": "router-project" if ceiling == "project" else None, @@ -16453,7 +16453,7 @@ class TestMemberAutoRouterInference: assert self.database.db.litellm_accessgrouptable.find_unique.await_count == 1 self.database.db.litellm_accessgrouptable.find_unique.return_value = group.model_copy(update={"access_model_names": []}) await evict_and_broadcast(cache_keys=("access_group_id:router-group",), user_api_key_cache=self.cache) - with pytest.raises(ProxyException, match="not allowed to access model"): + with pytest.raises(ProxyException, match="is not available for this API key"): await self._route(router, request) assert self.database.db.litellm_accessgrouptable.find_unique.await_count == 2 @@ -16471,7 +16471,7 @@ class TestMemberAutoRouterInference: key="team_id:router-team", model_type=LiteLLM_TeamTable, value=self.team.model_copy(update={"models": ["member-router"]}), ) - with pytest.raises(ProxyException, match="not allowed to access model"): + with pytest.raises(ProxyException, match="is not available for this API key"): await self._route(router, self._request()) self.database.db.litellm_teamtable.find_unique.reset_mock() admin: Final = self._request(tag="admin") diff --git a/tests/test_openai_endpoints.py b/tests/test_openai_endpoints.py index ab43d1acb00..e8a7732e4cb 100644 --- a/tests/test_openai_endpoints.py +++ b/tests/test_openai_endpoints.py @@ -307,7 +307,7 @@ async def test_chat_completion(): model="gpt-4", messages=[{"role": "user", "content": "Hello!"}], ) - assert "key not allowed to access model." in str(e) + assert "is not available for this API key" in str(e) @pytest.mark.asyncio diff --git a/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.integration.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.integration.test.tsx index 2dc6ecf09e5..b4df567e250 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.integration.test.tsx +++ b/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.integration.test.tsx @@ -1,4 +1,4 @@ -import { fireEvent, renderWithProviders, screen, within } from "../../../../../tests/test-utils"; +import { renderWithProviders, screen, within } from "../../../../../tests/test-utils"; import userEvent from "@testing-library/user-event"; import { beforeEach, describe, expect, it, vi } from "vitest"; import GeneralSettings from "./general_settings"; @@ -62,14 +62,6 @@ const SETTINGS_FIXTURE = [ stored_in_db: true, field_default_value: 1.0, }, - { - field_name: "model_access_denied_message", - field_type: "String", - field_value: null, - field_description: "client-facing denial message", - stored_in_db: null, - field_default_value: null, - }, ]; const settingsRow = async (fieldName: string) => { @@ -116,54 +108,6 @@ describe("GeneralSettings General tab", () => { expect(deleteConfigFieldSetting).toHaveBeenCalledWith("token", "max_ui_session_budget"); expect(numericValueIn(row)).toBe(1); }); - - it("saves a typed model_access_denied_message and resets it when cleared", async () => { - const user = userEvent.setup(); - renderWithProviders(); - - await user.click(screen.getByText("General")); - const row = await settingsRow("model_access_denied_message"); - const input = within(row).getByRole("textbox") as HTMLInputElement; - expect(input.value).toBe(""); - - fireEvent.change(input, { target: { value: "Model `{model}` is unavailable for this key." } }); - await user.click(within(row).getByRole("button", { name: /update/i })); - expect(updateConfigFieldSetting).toHaveBeenCalledWith( - "token", - "model_access_denied_message", - "Model `{model}` is unavailable for this key.", - ); - - fireEvent.change(input, { target: { value: "" } }); - await user.click(within(row).getByRole("button", { name: /update/i })); - expect(deleteConfigFieldSetting).toHaveBeenCalledWith("token", "model_access_denied_message"); - expect(vi.mocked(updateConfigFieldSetting).mock.calls).toHaveLength(1); - }); - - it("keeps the stored value visible when the reset request fails", async () => { - vi.mocked(getGeneralSettingsCall).mockResolvedValue( - SETTINGS_FIXTURE.map((s) => - s.field_name === "model_access_denied_message" - ? { ...s, field_value: "Model `{model}` is unavailable.", stored_in_db: true } - : { ...s }, - ), - ); - vi.mocked(deleteConfigFieldSetting).mockRejectedValueOnce(new Error("proxy unreachable")); - const user = userEvent.setup(); - renderWithProviders(); - - await user.click(screen.getByText("General")); - const row = await settingsRow("model_access_denied_message"); - const input = within(row).getByRole("textbox") as HTMLInputElement; - expect(within(row).getByText("In DB")).toBeInTheDocument(); - - fireEvent.change(input, { target: { value: "" } }); - await user.click(within(row).getByRole("button", { name: /update/i })); - - expect(deleteConfigFieldSetting).toHaveBeenCalledWith("token", "model_access_denied_message"); - expect(within(row).getByText("In DB")).toBeInTheDocument(); - expect(within(row).queryByText("Not Set")).not.toBeInTheDocument(); - }); }); describe("GeneralSettings Prompt Caching tab", () => { diff --git a/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.tsx b/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.tsx index ca2d80b856a..9a718cbe9b8 100644 --- a/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.tsx +++ b/ui/litellm-dashboard/src/app/(dashboard)/router-settings/_components/general_settings.tsx @@ -42,8 +42,6 @@ export interface generalSettingsItem { const NUMERIC_INPUT_WIDTH = "w-36"; const toNumericValue = (raw: string): number | null => (raw === "" ? null : Number(raw)); -const toStringValue = (raw: string): string | null => (raw === "" ? null : raw); -const RESETS_WHEN_CLEARED: ReadonlySet = new Set(["Select", "String"]); const SettingValueEditor: React.FC<{ setting: generalSettingsItem; @@ -112,16 +110,6 @@ const SettingValueEditor: React.FC<{ ); } - if (setting.field_type === "String") { - return ( - onChange(setting.field_name, toStringValue(event.target.value))} - /> - ); - } return null; }; @@ -231,7 +219,7 @@ const GeneralSettings: React.FC = ({ accessToken, user setGeneralSettings(updatedSettings); }; - const handleUpdateField = async (fieldName: string) => { + const handleUpdateField = (fieldName: string) => { if (!accessToken) { return; } @@ -240,33 +228,37 @@ const GeneralSettings: React.FC = ({ accessToken, user const fieldValue = setting?.field_value; if (fieldValue == null) { - if (setting && RESETS_WHEN_CLEARED.has(setting.field_type)) await handleResetField(fieldName); + if (setting?.field_type === "Select") handleResetField(fieldName); return; } try { - await updateConfigFieldSetting(accessToken, fieldName, fieldValue); - setGeneralSettings((current) => - current.map((setting) => (setting.field_name === fieldName ? { ...setting, stored_in_db: true } : setting)), + updateConfigFieldSetting(accessToken, fieldName, fieldValue); + // update value in state + + const updatedSettings = generalSettings.map((setting) => + setting.field_name === fieldName ? { ...setting, stored_in_db: true } : setting, ); + setGeneralSettings(updatedSettings); } catch (error) { // do something } }; - const handleResetField = async (fieldName: string) => { + const handleResetField = (fieldName: string) => { if (!accessToken) { return; } try { - await deleteConfigFieldSetting(accessToken, fieldName); - setGeneralSettings((current) => - current.map((setting) => - setting.field_name === fieldName - ? { ...setting, stored_in_db: null, field_value: setting.field_default_value ?? null } - : setting, - ), + deleteConfigFieldSetting(accessToken, fieldName); + // update value in state + + const updatedSettings = generalSettings.map((setting) => + setting.field_name === fieldName + ? { ...setting, stored_in_db: null, field_value: setting.field_default_value ?? null } + : setting, ); + setGeneralSettings(updatedSettings); } catch (error) { // do something } From b085a3c1517f5db7bacedb74cc552376544d83b6 Mon Sep 17 00:00:00 2001 From: yassin Date: Wed, 16 Sep 2026 01:51:29 +0000 Subject: [PATCH 8/9] fix(mcp): return fixed client message on sampling model access denial Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .../_experimental/mcp_server/sampling_handler.py | 15 ++++++++------- .../mcp_server/test_mcp_sampling_model_access.py | 4 ++-- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/litellm/proxy/_experimental/mcp_server/sampling_handler.py b/litellm/proxy/_experimental/mcp_server/sampling_handler.py index 6072e747bfe..fec2a1f9ee6 100644 --- a/litellm/proxy/_experimental/mcp_server/sampling_handler.py +++ b/litellm/proxy/_experimental/mcp_server/sampling_handler.py @@ -885,13 +885,14 @@ async def _check_model_access(model: str, user_api_key_auth: "UserAPIKeyAuth | N ) return None except Exception as access_err: - verbose_logger.warning( - "MCP sampling: model access denied for model=%s: %s", - model, - access_err.sanitized_internal_message() - if isinstance(access_err, ModelAccessDeniedProxyException) - else access_err, - ) + if isinstance(access_err, ModelAccessDeniedProxyException): + verbose_logger.warning( + "MCP sampling: model access denied for model=%s: %s", + model, + access_err.sanitized_internal_message(), + ) + return ErrorData(code=-1, message=access_err.message) + verbose_logger.warning("MCP sampling: model access denied for model=%s: %s", model, access_err) return ErrorData( code=-1, message=(f"Model access denied: the API key is not authorized to use model '{model}'. {access_err}"), diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_sampling_model_access.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_sampling_model_access.py index 7eebf1eb436..7c5320ed4f4 100644 --- a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_sampling_model_access.py +++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_sampling_model_access.py @@ -140,6 +140,7 @@ class TestCheckModelAccess: @pytest.mark.asyncio async def test_should_log_internal_denial_reason_and_hide_allowlist_from_client(self, caplog): from litellm.proxy._types import UserAPIKeyAuth + from litellm.proxy.auth.model_access_denied import model_access_denied_client_message auth = UserAPIKeyAuth(api_key="sk-test-key", models=["gpt-3.5-turbo"]) @@ -147,8 +148,7 @@ class TestCheckModelAccess: result = await _check_model_access("gpt-4o\r\nforged", user_api_key_auth=auth) assert result is not None - assert "gpt-4o\r\nforged" in result.message - assert "gpt-3.5-turbo" not in result.message + assert result.message == model_access_denied_client_message(model="gpt-4o\r\nforged") denial_records = [r for r in caplog.records if "gpt-3.5-turbo" in r.getMessage()] assert len(denial_records) == 1 assert "Tried to access gpt-4oforged" in denial_records[0].getMessage() From e48dde7b9b28c29a31f3d33452db75d9989813b2 Mon Sep 17 00:00:00 2001 From: yassin Date: Wed, 16 Sep 2026 16:28:13 +0000 Subject: [PATCH 9/9] fix(tests): drop leftover merge markers in test_handle_jwt Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- tests/test_litellm/proxy/auth/test_handle_jwt.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/tests/test_litellm/proxy/auth/test_handle_jwt.py b/tests/test_litellm/proxy/auth/test_handle_jwt.py index a6d5dc007a8..15defb196af 100644 --- a/tests/test_litellm/proxy/auth/test_handle_jwt.py +++ b/tests/test_litellm/proxy/auth/test_handle_jwt.py @@ -7111,8 +7111,6 @@ def test_check_scope_based_access_denial_hides_scope_allowlist_from_client(): assert exc_info.value.status_code == 403 assert exc_info.value.detail == {"error": _JWT_DENIED_CLIENT_MESSAGE} assert exc_info.value.internal_message == "model=gpt-5.6 not allowed. Allowed_models=['gpt-5.6-mini']" -||||||| 24153b5f29 -======= @pytest.mark.asyncio