7 Commits

Author	SHA1	Message	Date
Classic298	e790e7be7a	fix: enforce model access control on /responses endpoint (#23481) ... The /responses proxy endpoint only required authentication via get_verified_user but did not check per-model access grants. This allowed any authenticated user to access any model through this endpoint, bypassing the access control system. Extract a shared check_model_access helper into utils/access_control and replace all inline access control blocks across openai.py and ollama.py (7 locations) with calls to this helper. This eliminates code duplication and prevents future policy drift between endpoints. CWE-862: Missing Authorization CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H (6.5 Medium)	2026-04-12 11:06:33 -05:00
Timothy Jaeryang Baek	f7e07f3ca1	chore: format	2026-03-24 06:07:20 -05:00
Timothy Jaeryang Baek	945275faae	refac	2026-03-22 06:58:58 -05:00
Timothy Jaeryang Baek	de3317e26b	refac	2026-03-17 17:58:01 -05:00
Shamil	3a6b5ebb5f	refac: modernize type hints and imports in access_control module (#22594)	2026-03-11 15:28:39 -05:00
Timothy Jaeryang Baek	2751a0f0b6	refac	2026-03-01 19:09:10 -06:00
Timothy Jaeryang Baek	259d5ca596	refac	2026-03-01 13:49:36 -06:00