fix(auth): deny wildcard model access for unrecognized provider prefixes

[abhay-codes07]

Relevant issues

Fixes #33030

Pre-Submission checklist

• I have added meaningful tests
• My PR passes lint / format / unit tests locally
• My PR's scope is as isolated as possible; it only solves 1 specific problem

Screenshots / Proof of Fix

Access-control bug in the proxy's wildcard model-access check, reproducible offline (no keys/network).

Root cause: _model_custom_llm_provider_matches_wildcard_pattern re-prefixes the model returned by get_llm_provider with the inferred provider. For a bare name (gpt-4o → openai/gpt-4o) that is correct, but get_llm_provider("bedrockz/anthropic.claude-3-5-sonnet-20240620") loosely resolves the provider to bedrock without stripping the bedrockz/ prefix, so the re-check runs against bedrock/bedrockz/anthropic..., which matches bedrock/* and grants access.

Before (base 3d63eda) — the repo's own regression tests fail:

FAILED tests/proxy_unit_tests/test_auth_checks.py::test_can_key_call_model_wildcard_access[key_models4-bedrockz/anthropic.claude-3-5-sonnet-20240620-False]
FAILED tests/proxy_unit_tests/test_auth_checks.py::test_can_team_access_model[bedrockz/anthropic.claude-3-5-sonnet-20240620-team_models5-False]
2 failed, 16 passed

(This is the auth-and-jwt job that is currently red on PRs against litellm_oss_daily_2026_07_10.)

After (this PR):

tests/proxy_unit_tests/test_auth_checks.py .. (test_can_key_call_model_wildcard_access + test_can_team_access_model)
18 passed

New focused, offline unit test (fails on base, passes here):

tests/test_litellm/proxy/auth/test_auth_checks.py::test_model_matches_any_wildcard_pattern_in_list_respects_provider_prefix[...]  6 passed

Matrix verified via the matcher directly:

model	allowed	result
openai/gpt-4o	openai/*	✅ allow
bedrock/anthropic.claude-3-5-sonnet-20240620	bedrock/*	✅ allow
bedrockz/anthropic.claude-3-5-sonnet-20240620	bedrock/*	⛔ deny (was wrongly allowed)
openaiz/gpt-4o-mini	openai/*	⛔ deny
gpt-4 (bare)	openai/*	✅ allow (inference preserved)
bedrock/claude-3-6-sonnet-20240620	bedrock/claude-3-5-*	⛔ deny

Type

🐛 Bug Fix

Changes

Only infer a provider for a bare model name. If get_llm_provider returns a model that still contains / (an unrecognized prefix it could not strip), skip the re-prefix and return False, so a wildcard like bedrock/* no longer matches a different prefix such as bedrockz/*. Valid prefixes and bare-name provider inference are unchanged.

---

cc @ishaan-jaff @krrish-berri-2 — this also fixes the auth-and-jwt regression currently red on litellm_oss_daily_* (the two bedrockz access-check cases). Small and isolated; would appreciate a look. Thanks!

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[greptile-apps]

Greptile Summary

This PR fixes an access-control bypass in the proxy's wildcard model-permission check where _model_custom_llm_provider_matches_wildcard_pattern would re-prefix an unrecognized provider string (e.g. bedrockz/model) with the loosely inferred provider (bedrock), producing bedrock/bedrockz/model which then spuriously matched a bedrock/* wildcard.

• Auth fix in auth_checks.py: After calling get_llm_provider, the function now checks whether resolved_model still contains a /. If it does, the prefix was not recognized/stripped, so the function returns False immediately instead of building a bogus double-prefixed string. Valid bare names (e.g. gpt-4o) and recognized provider prefixes are unaffected.
• New tests in test_auth_checks.py: Six parametrized offline cases covering bare-name inference, valid provider wildcard match, two unrecognized-prefix denial cases, and sub-pattern precision checks.

Confidence Score: 4/5

Safe to merge — the change is small and isolated to the wildcard provider-matching helper, existing direct-match paths are untouched, and new tests confirm the fixed behavior.

The fix correctly guards against the double-prefix construction for unrecognized provider strings. In practice all recognized provider prefixes are stripped by get_llm_provider, so legitimate provider-prefixed models continue to be handled by the earlier direct-match path and are unaffected.

No files require special attention; auth_checks.py is the only changed production file and the modification is confined to a single guard condition in one helper function.

Important Files Changed

Filename	Overview
litellm/proxy/auth/auth_checks.py	Fixes spurious wildcard match in _model_custom_llm_provider_matches_wildcard_pattern by returning False when get_llm_provider leaves a / in the resolved model name (indicating an unrecognized provider prefix that it could not strip).
tests/test_litellm/proxy/auth/test_auth_checks.py	Adds 6 parametrized offline unit tests covering bare-name inference, valid provider prefix match, and the two unrecognized-prefix denial cases that were the root of the bug. No real network calls; imports are inline to avoid side effects.

_{Reviews (1): Last reviewed commit: "fix(auth): deny wildcard model access fo..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!