fix managed downstream deny-all semantics

src/server/services/downstreamApiKeyService.test.ts

@@ -141,6 +141,7 @@ describe('downstreamApiKeyService', () => {
       supportedModels: [],
       allowedRouteIds: [],
       siteWeightMultipliers: {},
+      denyAllWhenEmpty: true,
     };
 
     expect(await service.isModelAllowedByPolicyOrAllowedRoutes('gpt-4o-mini', policy)).toBe(false);

src/server/services/downstreamApiKeyService.ts

@@ -234,7 +234,7 @@ export async function isModelAllowedByPolicyOrAllowedRoutes(model: string, polic
   const hasPatternRules = patterns.length > 0;
   const hasRouteRules = allowedRouteIds.length > 0;
 
-  if (!hasPatternRules && !hasRouteRules) return false;
+  if (!hasPatternRules && !hasRouteRules) return policy.denyAllWhenEmpty === true ? false : true;
 
   if (hasPatternRules && patterns.some((pattern) => matchesDownstreamModelPattern(model, pattern))) {
     return true;
@@ -278,6 +278,7 @@ export function toPolicyFromView(view: Pick<DownstreamApiKeyPolicyView, 'support
     supportedModels: normalizeSupportedModelsInput(view.supportedModels),
     allowedRouteIds: normalizeAllowedRouteIdsInput(view.allowedRouteIds),
     siteWeightMultipliers: normalizeSiteWeightMultipliersInput(view.siteWeightMultipliers),
+    denyAllWhenEmpty: true,
   };
 }
 

src/server/services/downstreamPolicyTypes.ts

@@ -2,6 +2,7 @@ export interface DownstreamRoutingPolicy {
   supportedModels: string[];
   allowedRouteIds: number[];
   siteWeightMultipliers: Record<number, number>;
+  denyAllWhenEmpty?: boolean;
 }
 
 export const EMPTY_DOWNSTREAM_ROUTING_POLICY: DownstreamRoutingPolicy = {
@@ -9,9 +10,3 @@ export const EMPTY_DOWNSTREAM_ROUTING_POLICY: DownstreamRoutingPolicy = {
   allowedRouteIds: [],
   siteWeightMultipliers: {},
 };
-
-export const GLOBAL_UNRESTRICTED_DOWNSTREAM_ROUTING_POLICY: DownstreamRoutingPolicy = {
-  supportedModels: ['*'],
-  allowedRouteIds: [],
-  siteWeightMultipliers: {},
-};

src/server/services/tokenRouter.downstream-policy.test.ts

@@ -137,6 +137,7 @@ describe('TokenRouter downstream policy', () => {
       allowedRouteIds: [],
       supportedModels: [],
       siteWeightMultipliers: {},
+      denyAllWhenEmpty: true,
     });
 
     expect(deniedPick).toBeNull();

src/server/services/tokenRouter.ts

@@ -537,7 +537,7 @@ function isModelAllowedByDownstreamPolicy(requestedModel: string, policy: Downst
     : [];
   const hasSupportedPatterns = supportedPatterns.length > 0;
   const hasAllowedRoutes = policy.allowedRouteIds.length > 0;
-  if (!hasSupportedPatterns && !hasAllowedRoutes) return false;
+  if (!hasSupportedPatterns && !hasAllowedRoutes) return policy.denyAllWhenEmpty === true ? false : true;
   const matchedSupportedPattern = supportedPatterns.some((pattern) => matchesModelPattern(requestedModel, pattern));
   if (matchedSupportedPattern) return true;
   if (hasAllowedRoutes) return true;