lukaszraczylo 72b0df5b0c feat(auth): let a user join several groups and hold a personal grant ...

A user entry can now list several groups in "groups", next to the
existing "group" field. A user can also hold a personal grant with its
own "providers" and optional "models" lists. Users with one group and
no personal grant behave exactly as before.

A request is allowed only when one grant allows the provider, the model
and, for passthrough, the path. Grants never merge, so one grant cannot
supply the provider while another supplies the model or the path. The
personal grant uses the path list of the first group. A personal
"models" list without "providers" is a configuration error.

Each member group applies its own limits. Caching stays on unless a
member group turns it off, and the shortest group TTL wins. The
/v1/models cache uses a stable, length-prefixed key, so reloads do not
grow it.

Tests cover the grant union, cross-grant denials, passthrough path and
model coupling, reloads and the cache key. The yaegi-check harness
asserts the same cases under the interpreter.

Claude-Session: https://claude.ai/code/session_019uJHQKcNLMACkXssb3L7Q3

2026-09-11 22:45:45 +01:00

..

pricing-sync

fix(pricing): content-digest snapshot instead of a wall-clock date

2026-08-22 02:12:29 +01:00

yaegi-check

feat(auth): let a user join several groups and hold a personal grant

2026-09-11 22:45:45 +01:00