revert(auth): backport the teamless all-team-models denial revert (#32032) to 1.91.0rc1

[mateo-berri]

Relevant issues

Backports #32032 to the 1.91.0rc1 patch line. That PR reverted the teamless all-team-models denial introduced by #29746 and #32022, restoring the original behavior where a teamless key with models=["all-team-models"] is treated as unrestricted (equivalent to an empty models field)

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

The full touched test surface passes locally on this branch: tests/test_litellm/proxy/auth/test_auth_checks.py, tests/test_litellm/proxy/auth/test_model_checks.py and tests/test_litellm/proxy/hooks/test_batch_file_validation.py (237 passed), plus tests/test_litellm/proxy/auth/test_user_api_key_auth.py (103 passed). That includes the six regression tests from #32032 covering listing, inference, resolved-model and batch surfaces

Type

🐛 Bug Fix

Changes

Single cherry-pick of the #32032 squash (5ece78f) onto patch-1.91.0rc1, with original authorship preserved

The rc line contains #29746 (backported as 074455c) but never received #32022, so the #32022-revert hunks in user_api_key_auth.py and can_key_call_resolved_model resolved as already applied (the rc line was still in the pre-#32022 state the revert restores) and that file carries no net change. The two effective prod changes are exactly the #29746 teamless-denial reverts: _resolve_key_models_for_auth_check returns [] (unrestricted) for teamless keys instead of the unresolvable sentinel, and get_key_models drops the team_id is not None guard

One conflict, in tests/test_litellm/proxy/auth/test_auth_checks.py, where the rc line's #29746 denial test differed from staging's; resolved by taking the incoming side, which is upstream's post-revert content verbatim. After resolution, _resolve_key_models_for_auth_check, can_key_call_resolved_model and _enforce_key_and_fallback_model_access are byte-identical to current litellm_internal_staging, and model_checks.py is byte-identical as a whole file

No version bump, per rc line convention (rc number lives in the git tag only)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR backports #32032 to the patch-1.91.0rc1 line, reverting the teamless all-team-models access denial introduced by #29746. After the revert, a key with models=["all-team-models"] and no team_id is once again treated as unrestricted (equivalent to an empty models field) rather than being denied because the sentinel cannot be resolved.

• _resolve_key_models_for_auth_check now returns [] (unrestricted) for teamless keys instead of propagating the unresolvable sentinel string, which previously caused implicit denial in can_key_call_model.
• get_key_models drops the team_id is not None guard, expanding the sentinel to team_models (empty for teamless keys) and returning [] for the model-listing path as well.
• The previously denial-asserting test is updated to assert unrestricted access, and six new regression tests cover the listing, inference, resolved-model, and batch surfaces.

Confidence Score: 4/5

Safe to merge; the two production changes are minimal, well-scoped reverts and the test additions strengthen regression coverage on all touched surfaces.

Both production hunks faithfully restore the original pre-#29746 semantics: _resolve_key_models_for_auth_check returns [] for teamless keys (treated as unrestricted by can_key_call_model) and get_key_models expands the sentinel to team_models without a team_id guard. The return value of [] from get_key_models is consistently interpreted as 'unrestricted' by all callers (matching the docstring). The previously denial-asserting test is correctly updated to reflect the reverted behavior, and six new regression tests cover the inference, listing, resolved-model, and batch paths. No unintended side-effects were found; the edge case where a teamless key has non-empty team_models is practically unreachable in a well-formed deployment.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/auth/auth_checks.py	_resolve_key_models_for_auth_check: returns [] for teamless all-team-models keys (unrestricted) instead of the sentinel list (implicit denial). Logic and docstring are consistent.
litellm/proxy/auth/model_checks.py	get_key_models: drops the team_id is not None guard so the all-team-models sentinel is always expanded to team_models; for teamless keys team_models is [] so the function returns [] (unrestricted), matching auth_checks.py semantics.
tests/test_litellm/proxy/auth/test_auth_checks.py	Denial test renamed and assertions flipped to match reverted behavior; five new regression tests added covering _resolve_key_models_for_auth_check, _enforce_key_and_fallback_model_access, and can_key_call_resolved_model for teamless all-team-models keys.
tests/test_litellm/proxy/auth/test_model_checks.py	New test test_get_key_models_teamless_all_team_models_returns_unrestricted verifies that get_key_models returns [] (unrestricted) for teamless all-team-models keys and that the sentinel string does not leak into the result.
tests/test_litellm/proxy/hooks/test_batch_file_validation.py	New test test_pre_call_allows_teamless_all_team_models_key verifies the batch path allows teamless all-team-models keys, consistent with the inference path revert.

_{Reviews (1): Last reviewed commit: "revert: undo teamless all-team-models de..." | Re-trigger Greptile}

[veria-ai]

High: Teamless key model restriction bypass

An authenticated user can create a personal key with models: ["all-team-models"] and no team_id; this now resolves to [], which _check_model_access_helper treats as all-model access. Keep the sentinel unresolved for teamless keys so it fails closed instead of granting every proxy model; the matching get_key_models change should also preserve that behavior for teamless keys.

Suggested change

	return []
	return models

[mateo-berri]

This is the intended behavior of the backported change, not a regression introduced here. Treating a teamless key with models=["all-team-models"] as unrestricted was the long-standing semantics; the fail-closed denial this suggestion asks for is exactly what #29746 and #32022 introduced and what #32032 deliberately reverted upstream (already merged to litellm_internal_staging) because the denial broke existing deployments. This PR only brings the rc line back in sync: the touched functions are byte-identical to current staging. If teamless all-team-models keys should fail closed, that is a product decision to relitigate upstream, and the backport should not diverge from staging on it

[veria-ai]

PR overview

This pull request backports an authentication-related revert for the 1.91.0 release candidate, changing how teamless personal keys interact with the all-team-models model setting. The touched auth logic affects model access resolution for keys that may or may not be associated with a team.

There is one open access-control issue remaining: an authenticated user can create a teamless personal key using the all-team-models setting and end up with access to all proxy models instead of being denied. Because this is a concrete authorization bypass with broad model access impact, the PR still carries significant security risk until the teamless case fails closed. No issues have been addressed yet in the current review set.

Open issues (1)

• High: Teamless key model restriction bypass — litellm/proxy/auth/auth_checks.py:2954

Fixed/addressed: 0 · PR risk: 7/10