Mrunmayee Daware 07f72a67b1 fix(proxy): authorize the public name of a team-scoped model on batch retrieve/cancel (#47067) ... * fix(proxy): authorize the public name of a team-scoped model on batch retrieve/cancel A unified batch id resolves to the deployment's internal model_name (model_name_{team_id}_{uuid}), which is in no key or team allowlist, so authorize_model_for_key always denied and team keys got 403 retrieving or cancelling their own batches. Authorize against model_info team_public_model_name when the resolved deployment is team-scoped, falling back to the resolved name otherwise. Fixes #46958 * fix(proxy): authorize team-scoped batch models by their public name on both auth paths * fix(proxy): accept the owning team's public name for its own team deployment on every auth path Managed batch, file, fine-tuning, vector store, character and video ids resolve to the team deployment's internal name again, so teams that granted the internal name keep access. The model access check now also accepts the owning team's public name and its legacy team aliases for that internal name, and only when the caller's team owns the deployment. * fix(proxy): match a team deployment's public and alias names against the caller's own grants --------- Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com> (cherry picked from commit e979bd0ecf)		2026-10-19 22:45:17 -07:00
..
__init__.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_admin_viewer_handler_access.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_auth_checks.py	refactor(proxy): expose public names for private proxy helpers (#45170)	2026-10-07 18:59:27 -07:00
test_auth_checks_object_access_and_lookup.py	refactor(proxy): expose public names for private proxy helpers (#45170)	2026-10-07 18:59:27 -07:00
test_auth_exception_handler.py	refactor(proxy): expose public names for private proxy helpers (#45170)	2026-10-07 18:59:27 -07:00
test_auth_hot_path_network_requests.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_auth_object_prefetch.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_auth_utils.py	fix(proxy): authorize the public name of a team-scoped model on batch retrieve/cancel (#47067)	2026-10-19 22:45:17 -07:00
test_authorization.py	fix(proxy): share ownership permissions for spend logs and traces (#44239)	2026-10-03 01:38:54 +00:00
test_banned_params_extra_body.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_cli_auth.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_custom_auth_end_user_budget.py	refactor(proxy): expose public names for private proxy helpers (#45170)	2026-10-07 18:59:27 -07:00
test_default_end_user_budget_simple.py	refactor(proxy): expose public names for private proxy helpers (#45170)	2026-10-07 18:59:27 -07:00
test_fallback_budget.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_fallback_model_access.py	feat(auth): deny search tools by default when search_tool_deny_by_default is set (#44490)	2026-10-06 12:50:26 -07:00
test_handle_jwt.py	feat(proxy): add denied_passthrough_routes deny list for custom pass-through endpoints (#44924)	2026-10-07 16:19:53 -07:00
test_info_routes.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_jwt.py	fix(security): remove the publicly known master key from the repo (#44718)	2026-10-06 10:55:24 -07:00
test_litellm_license.py	fix(proxy): stop logging license values during verification (#44956)	2026-10-06 17:05:07 -07:00
test_login_utils.py	refactor(proxy): expose public names for private proxy helpers (#45170)	2026-10-07 18:59:27 -07:00
test_master_key_boot_check.py	fix(security): remove the publicly known master key from the repo (#44718)	2026-10-06 10:55:24 -07:00
test_mcp_ip_filtering.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_model_access_group_budgets.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_model_checks.py	fix(proxy): admit litellm_proxy/hosted_vllm in provider-endpoint discovery (#38617)	2026-10-07 21:15:57 -07:00
test_model_checks_fallbacks.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_models_fallback_endpoint.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_multi_budget_windows.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_multipart_bypass_repro.py	ci: move tests/proxy_unit_tests to tests/unit/proxy and run the proxy-db shards from litellm-tests (#42903)	2026-09-24 22:59:11 +00:00
test_network.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_oauth2_proxy_hook.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_object_permission_loading.py	refactor(proxy): expose public names for private proxy helpers (#45170)	2026-10-07 18:59:27 -07:00
test_onboarding.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_organization_budget_enforcement.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_password_hashing.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_password_policy.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_proxy_routes.py	refactor(proxy): expose public names for private proxy helpers (#45170)	2026-10-07 18:59:27 -07:00
test_resolvers_exceptions.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_resolvers_grants.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_resolvers_models.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_resolvers_seam.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_resolvers_store.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_route_checks.py	refactor(proxy): expose public names for private proxy helpers (#45170)	2026-10-07 18:59:27 -07:00
test_router_override_fallback_auth.py	refactor(proxy): expose public names for private proxy helpers (#45170)	2026-10-07 18:59:27 -07:00
test_search_tool_deny_by_default.py	feat(auth): deny search tools by default when search_tool_deny_by_default is set (#44490)	2026-10-06 12:50:26 -07:00
test_team_grants.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_team_member_budget.py	test(proxy): move auth, hooks, policy_engine and client tests into tests/unit/proxy (#43998)	2026-10-01 10:11:45 -07:00
test_unmapped_model_budget_enforcement.py	refactor(proxy): expose public names for private proxy helpers (#45170)	2026-10-07 18:59:27 -07:00
test_user_api_key_auth.py	fix(proxy): answer a rejected websocket handshake without crashing the HTTP exception handler (#45251)	2026-10-07 22:27:46 -07:00
test_user_api_key_auth_request_flow.py	refactor(proxy): expose public names for private proxy helpers (#45170)	2026-10-07 18:59:27 -07:00