* fix(auth): expand all-team-models sentinel in can_key_call_model
Keys with models=["all-team-models"] were denied during batch JSONL
model validation because can_key_call_model matched the literal string
against the model name. Add _resolve_key_models_for_auth_check to
expand the sentinel to team_models before the check, consistent with
get_key_models in model_checks.py and the completion-route bypass.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(auth): document empty team_models unrestricted access behavior; add regression test
Adds a docstring note to _resolve_key_models_for_auth_check explaining that
when team_models is empty, all-team-models resolves to [] which is treated as
unrestricted access (consistent with get_key_models behavior on other auth
paths). Adds a test to lock in this behavior.
* fix(auth): deny all-team-models access when key has no team_id
A key configured with models=["all-team-models"] but no team_id could
previously resolve to an empty allowlist, which _check_model_access_helper
treats as unrestricted access. Now the sentinel is only expanded when
team_id is set; otherwise the unresolved sentinel stays in the model list
and causes a deny (no real model name matches it). Same fix applied to
get_key_models in model_checks.py for consistency across batch and
non-batch auth paths.
* style: black format model_checks.py
* Fix batch all-team-models auth
* style: black format batch_rate_limiter.py
* fix(test): add tool_use_system_prompt_tokens to model prices schema validator
* fix(batch): catch get_team_object errors to avoid 404 escaping batch auth
* fix(batch): apply per-member model scope check after team auth in batch validation
* Fail closed on batch team auth fetch errors
* test(batch): cover team_object grant and member-scope denial in batch auth
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
074455c138