fix(auth): expand all-team-models sentinel in can_key_call_model for batch validation

[Sameerlite]

Problem

Fixes LIT-4035
Keys with models=["all-team-models"] were rejected during batch JSONL model validation with a 403:

key not allowed to access model. This key can only access models=['all-team-models'].
Tried to access openai/openai/gpt-5.5-batch

The batch rate limiter hook (_enforce_batch_file_model_access) calls can_key_call_model to validate every body.model entry in the JSONL. can_key_call_model was passing valid_token.models directly to _can_object_call_model, which tried to match the model name literally against "all-team-models" — a sentinel string, not an actual model name.

Normal completion routes don't hit this because _enforce_key_and_fallback_model_access skips the key check entirely when all-team-models is present and defers to can_team_access_model.

Fix

Add _resolve_key_models_for_auth_check that expands all-team-models → valid_token.team_models before the check — the same semantics get_key_models in model_checks.py already applies for /v1/models listing. This makes batch JSONL validation consistent with every other auth path.

Tests

• test_can_key_call_model_all_team_models_uses_team_allowlist — unit test for the can_key_call_model fix
• test_pre_call_allows_all_team_models_key_when_model_in_team_allowlist — end-to-end hook test confirming batch validation passes for all-team-models keys

---

Note

Medium Risk
Changes authorization for team-scoped keys and batch JSONL model checks; behavior tightens access (fail-closed on team fetch) but touches security-sensitive proxy auth paths.

Overview
Fixes 403 false denials for API keys whose allowlist is all-team-models by expanding that sentinel before key-level checks, and aligns batch JSONL model validation with live chat/completion auth.

can_key_call_model now runs through _resolve_key_models_for_auth_check, which maps all-team-models → valid_token.team_models (same idea as get_key_models). Keys with the sentinel but no team_id keep the unresolved sentinel so access is denied instead of treated as unrestricted. get_key_models only performs that expansion when team_id is set.

For batch uploads, _enforce_batch_file_model_access no longer relies on a lone can_key_call_model call on cached key fields. Keys with all-team-models load the current team via get_team_object and enforce can_team_access_model, key access-group override, and per-member model scope—matching common_checks. Team lookup failures fail closed (403) rather than falling back to stale team_models on the token.

Tests cover key auth expansion edge cases and batch hook behavior (allowlist match, stale vs current team list, team fetch errors). A small unrelated tool_use_system_prompt_tokens entry was added to a model-cost JSON schema test.

^{Reviewed by Cursor Bugbot for commit 3994f85. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR fixes a 403 false-denial bug where API keys with models=[\"all-team-models\"] were rejected during batch JSONL model validation because the sentinel string was matched literally instead of being expanded to the team's allowlist.

• auth_checks.py: New _resolve_key_models_for_auth_check maps all-team-models → valid_token.team_models before key-level auth; keys with no team_id keep the unresolved sentinel so access is denied rather than silently granted. can_key_call_model now uses this expansion.
• batch_rate_limiter.py: _enforce_batch_file_model_access now fetches a fresh team_object for all-team-models keys (when DB is available) and enforces can_team_access_model + key access-group + per-member scope, mirroring the common_checks logic used for live completions.
• model_checks.py: Guards the all-team-models expansion in get_key_models with team_id is not None, aligning it with the new sentinel-resolution semantics.

Confidence Score: 5/5

The auth changes are fail-closed: no team_id means deny, and a team fetch error returns 403 rather than falling back to stale data.

The sentinel expansion logic is correct and mirrors existing get_key_models semantics. The batch hook's team-object branch faithfully replicates the common_checks flow. The two observations raised are non-blocking: one is a listing-endpoint cosmetic edge case for a rare orphan-key configuration, and the other is a caching note already mitigated by user_api_key_cache.

model_checks.py has a subtle listing-behaviour change worth a second look if orphan all-team-models keys are used in production.

Important Files Changed

Filename	Overview
litellm/proxy/auth/auth_checks.py	Adds _resolve_key_models_for_auth_check to expand all-team-models sentinel before key-level auth checks, and threads it through can_key_call_model. Logic is correct and consistent with existing sentinel semantics.
litellm/proxy/auth/model_checks.py	Adds team_id is not None guard to the all-team-models expansion in get_key_models. Aligns with _resolve_key_models_for_auth_check, but subtly changes /v1/models listing behavior for orphan keys (no team_id): sentinel now appears literally in the model list instead of silently expanding to [] (unrestricted).
litellm/proxy/hooks/batch_rate_limiter.py	Replaces the simple can_key_call_model call with a full can_team_access_model + _key_access_group_grants_model + _check_team_member_model_access flow for all-team-models keys, including an upfront get_team_object DB fetch. _check_team_member_model_access calls get_team_membership once per model in the loop, though caching mitigates repeated hits for the same user/team pair.
tests/test_litellm/proxy/auth/test_auth_checks.py	Adds three well-targeted unit tests covering the sentinel expansion fix: allowlist match, empty-team-models (unrestricted), and orphan-key denial. Also minor whitespace cleanup in an unrelated test.
tests/test_litellm/proxy/hooks/test_batch_file_validation.py	Comprehensive new batch hook tests: happy path (no DB / cached path), DB-fetched current team object, stale vs. current team list, per-member scope denial, and fail-closed on team fetch errors.
tests/test_litellm/test_utils.py	Unrelated addition of tool_use_system_prompt_tokens to the model-cost JSON schema validator — simple schema expansion, no issues.

_{Reviews (8): Last reviewed commit: "test(batch): cover team_object grant and..." | Re-trigger Greptile}

[codecov]

Codecov Report

❌ Patch coverage is 96.87500% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
litellm/proxy/hooks/batch_rate_limiter.py	95.65%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 2 · PR risk: 0/10

[Sameerlite]

@greptileai

[Sameerlite]

@greptileai

[Sameerlite]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Stale team_models in batch auth
  • Batch JSONL model validation now loads the current team object for all-team-models keys and applies team access checks before allowing referenced models.

_{You can send follow-ups to the cloud agent here.}

[Sameerlite]

@greptileai

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
2 out of 3 committers have signed the CLA.

✅ mateo-berri
✅ Sameerlite
❌ cursoragent
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Sameerlite]

@greptileai

[Sameerlite]

@greptileai

[Sameerlite]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Team fetch failure bypasses auth
  • Batch validation now fails closed when current team lookup fails for all-team-models keys instead of falling back to stale key-level model auth.

_{You can send follow-ups to the cloud agent here.}

[Sameerlite]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 3994f85. Configure here.}

[Sameerlite]

@greptieai

[mateo-berri]

@greptileai

[mateo-berri]

@greptileai

[mateo-berri]

LGTM; thanks!