llama-stack-mirror/llama_stack
mergify[bot] 05b4394cf9
fix: enforce allowed_models during inference requests (backport #4197) (#4228)
The `allowed_models` configuration was only being applied when listing
models via the `/v1/models` endpoint, but the actual inference requests
weren't checking this restriction. This meant users could directly
request any model the provider supports by specifying it in their
inference call, completely bypassing the intended cost controls.

The fix adds validation to all three inference methods (chat
completions, completions, and embeddings) that checks the requested
model against the allowed_models list before making the provider API
call.

### Test plan

Added unit tests <hr>This is an automatic backport of pull request #4197
done by [Mergify](https://mergify.com).

Signed-off-by: Charlie Doern <cdoern@redhat.com>
Co-authored-by: Ashwin Bharambe <ashwin.bharambe@gmail.com>
2025-11-24 11:31:36 -08:00
..
apis revert: "chore(cleanup)!: remove tool_runtime.rag_tool" (#3877) 2025-10-21 11:22:06 -07:00
cli fix: print help for list-deps if no args (backport #4078) (#4083) 2025-11-05 14:58:47 -08:00
core fix(inference): enable routing of models with provider_data alone (backport #3928) (#4142) 2025-11-12 13:41:27 -08:00
distributions fix: harden storage semantics (backport #4118) (#4138) 2025-11-12 13:01:21 -08:00
models chore: remove dead code (#3729) 2025-10-07 20:26:02 -07:00
providers fix: enforce allowed_models during inference requests (backport #4197) (#4228) 2025-11-24 11:31:36 -08:00
strong_typing chore: refactor (chat)completions endpoints to use shared params struct (#3761) 2025-10-10 15:46:34 -07:00
testing feat(ci): add support for docker:distro in tests (#3832) 2025-10-16 19:33:13 -07:00
ui build: Bump version to 0.3.2 2025-11-12 23:19:12 +00:00
__init__.py chore(rename): move llama_stack.distribution to llama_stack.core (#2975) 2025-07-30 23:30:53 -07:00
env.py refactor(test): move tools, evals, datasetio, scoring and post training tests (#1401) 2025-03-04 14:53:47 -08:00
log.py fix(logs): restore uvicorn and llama_stack logger settings 2025-10-21 15:47:55 -07:00
schema_utils.py fix(auth): allow unauthenticated access to health and version endpoints (#3736) 2025-10-10 13:41:43 -07:00