@@ -293,7 +306,9 @@ export default function ModelsPage() {
))}
diff --git a/src/app/api/models/connected/route.js b/src/app/api/models/connected/route.js
index a8d24fdc..bbaa19f6 100644
--- a/src/app/api/models/connected/route.js
+++ b/src/app/api/models/connected/route.js
@@ -1,7 +1,7 @@
import { NextResponse } from "next/server";
import { getModelAliases, getProviderConnections } from "@/models";
import { disableModels, enableModels, getDisabledModels } from "@/lib/disabledModelsDb";
-import { requireAdminUser } from "@/lib/auth/currentUser";
+import { requireAdminUser, requireUsageDashboardUser } from "@/lib/auth/currentUser";
import { AI_MODELS } from "@/shared/constants/models";
import { AI_PROVIDERS, getProviderAlias, getProviderByAlias } from "@/shared/constants/providers";
import { getCapabilitiesForModel } from "open-sse/providers/capabilities.js";
@@ -47,7 +47,7 @@ function getForbiddenResponse(error) {
// GET /api/models/connected - List models from providers with a usable active connection.
export async function GET() {
try {
- await requireAdminUser();
+ const user = await requireUsageDashboardUser();
const [connections, disabledModels, modelAliases] = await Promise.all([
getProviderConnections(),
@@ -78,7 +78,6 @@ export async function GET() {
fullModel: `${model.provider}/${model.model}`,
alias: modelAliases[`${model.provider}/${model.model}`] || model.model,
disabled: disabled.includes(model.model),
- connectionCount: connectionCountByAlias.get(model.provider) || 0,
caps: {
vision: caps.vision,
search: caps.search,
@@ -86,6 +85,7 @@ export async function GET() {
},
};
})
+ .filter((model) => user.role === "admin" || !model.disabled)
.sort((a, b) => (
a.provider.name.localeCompare(b.provider.name)
|| a.name.localeCompare(b.name)
diff --git a/src/dashboardGuard.js b/src/dashboardGuard.js
index 9385ac14..8c4d9373 100644
--- a/src/dashboardGuard.js
+++ b/src/dashboardGuard.js
@@ -49,8 +49,8 @@ const ALWAYS_PROTECTED = [
const ADMIN_ONLY_PATHS = ["/api/users", "/api/tunnel", "/api/combos"];
// Combo definitions affect routing and fallback behavior, so only administrators
-// may view or change them.
-const ADMIN_ONLY_DASHBOARD_PATHS = ["/dashboard/combos", "/dashboard/models"];
+// may view or change them. The Models page is available read-only to all users.
+const ADMIN_ONLY_DASHBOARD_PATHS = ["/dashboard/combos"];
// Require auth, but allow through if requireLogin is disabled
const PROTECTED_API_PATHS = [
diff --git a/src/shared/components/Sidebar.js b/src/shared/components/Sidebar.js
index 23d22b84..b438748c 100644
--- a/src/shared/components/Sidebar.js
+++ b/src/shared/components/Sidebar.js
@@ -21,7 +21,7 @@ const COMBINED_WEB_ITEM = { id: "web", label: "Web Fetch & Search", icon: "trave
const navItems = [
{ href: "/dashboard/endpoint", label: "Endpoint & Key", icon: "api" },
{ href: "/dashboard/providers", label: "Providers", icon: "dns" },
- { href: "/dashboard/models", label: "Models", icon: "view_list", adminOnly: true },
+ { href: "/dashboard/models", label: "Models", icon: "view_list" },
// { href: "/dashboard/basic-chat", label: "Basic Chat", icon: "chat" }, // Hidden
{ href: "/dashboard/combos", label: "Combos", icon: "layers", adminOnly: true },
{ href: "/dashboard/usage", label: "Usage", icon: "bar_chart" },
diff --git a/src/sse/services/disabledModels.js b/src/sse/services/disabledModels.js
index 00529069..cf631bc9 100644
--- a/src/sse/services/disabledModels.js
+++ b/src/sse/services/disabledModels.js
@@ -2,6 +2,7 @@ import { getDisabledModels } from "@/lib/disabledModelsDb";
import { getProviderAlias } from "@/shared/constants/providers";
import { errorResponse } from "open-sse/utils/error.js";
import { HTTP_STATUS } from "open-sse/config/runtimeConfig.js";
+import { stripThinkingSuffix } from "open-sse/translator/concerns/thinkingUnified.js";
/**
* Return an error response when a resolved provider/model pair has been
@@ -15,12 +16,16 @@ export async function getDisabledModelResponse(provider, model) {
try {
const disabledModels = await getDisabledModels();
const providerAlias = getProviderAlias(provider) || provider;
+ // Thinking variants use a client-facing suffix, e.g. `gpt-5.6-sol(high)`,
+ // but dispatch to the base upstream model. Evaluate the disabled policy
+ // against that base ID as well so a suffix cannot bypass an admin disable.
+ const baseModel = stripThinkingSuffix(model);
const disabledIds = new Set([
...(disabledModels[providerAlias] || []),
...(disabledModels[provider] || []),
]);
- if (!disabledIds.has(model)) return null;
+ if (!disabledIds.has(model) && !disabledIds.has(baseModel)) return null;
return errorResponse(
HTTP_STATUS.NOT_FOUND,
diff --git a/tests/unit/disabled-models-enforcement.test.js b/tests/unit/disabled-models-enforcement.test.js
index 6134cf71..7dab1067 100644
--- a/tests/unit/disabled-models-enforcement.test.js
+++ b/tests/unit/disabled-models-enforcement.test.js
@@ -42,6 +42,20 @@ describe("getDisabledModelResponse", () => {
expect(response.status).toBe(404);
});
+ it("blocks thinking variants when their base model is disabled", async () => {
+ getDisabledModels.mockResolvedValue({ codex: ["gpt-5.6-sol"] });
+
+ const response = await getDisabledModelResponse("codex", "gpt-5.6-sol(high)");
+
+ expect(response.status).toBe(404);
+ await expect(response.json()).resolves.toMatchObject({
+ error: {
+ code: "model_not_found",
+ message: "Model codex/gpt-5.6-sol(high) is disabled by an administrator",
+ },
+ });
+ });
+
it("fails closed when disabled-model storage cannot be read", async () => {
getDisabledModels.mockRejectedValue(new Error("database unavailable"));