From bcb87f5d554da84f267f71ab46973f93d5e7c17e Mon Sep 17 00:00:00 2001
From: diegosouzapw <diegosouzapw@users.noreply.github.com>
Date: Mon, 30 Mar 2026 20:31:32 -0300
Subject: [PATCH] feat: Return only accessible models from /models for
 restricted API keys (#781)

---
 src/app/api/v1/models/catalog.ts | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/app/api/v1/models/catalog.ts b/src/app/api/v1/models/catalog.ts
index 3be16b456e..73d4998c6f 100644
--- a/src/app/api/v1/models/catalog.ts
+++ b/src/app/api/v1/models/catalog.ts
@@ -485,10 +485,31 @@ export async function getUnifiedModelsResponse(
       console.log("Could not fetch custom models");
     }
 
+    // Filter by API key permissions if requested
+    const authHeader = request.headers.get("authorization");
+    let finalModels = models;
+    if (authHeader && authHeader.startsWith("Bearer ")) {
+      const apiKey = authHeader.slice(7);
+      const { isModelAllowedForKey } = await import("@/lib/db/apiKeys");
+
+      const filtered = [];
+      for (const m of models) {
+        // m.id is the full identifier (e.g. openai/gpt-4o), m.root is the raw model string
+        // check either one as the config could use either patterns
+        if (
+          (await isModelAllowedForKey(apiKey, m.id)) ||
+          (await isModelAllowedForKey(apiKey, m.root))
+        ) {
+          filtered.push(m);
+        }
+      }
+      finalModels = filtered;
+    }
+
     return Response.json(
       {
         object: "list",
-        data: models,
+        data: finalModels,
       },
       {
         headers: corsHeaders,