tPj}UddlZddlZddlZddlZddlmZddlmZddlmZm Z m Z m Z ddl m Z ddlmZddlZddlmZmZddlmZdd lmZdd lmZdd lmZdd lmZmZdd lmZddl m!Z!ddl"m#Z#ddl$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+dZ,e e-d<dZ.e e-d<ddgZ/e e0e1e-d<e dZ2e eze'ze)zZ3da4erddl5m6Z6GddeZ7GddeZ8y)N)AsyncGeneratordatetime) TYPE_CHECKINGAnyFinalLiteral)urljoin) HTTPException) DualCache ModelResponse)verbose_proxy_logger)%LiteLLMResponsesTransformationHandler)CustomGuardrail)MockResponseIterator)get_async_httpx_clienthttpxSpecialProvider)stream_chunk_builder)UserAPIKeyAuth)GuardrailEventHooks) CallTypesCallTypesLiteralEmbeddingResponseGuardrailStatus ImageResponseModelResponseStreamTextCompletionResponseuser USER_ROLE assistantASSISTANT_ROLE sensitiveData dataDetectorSENSITIVE_DATA_DETECTOR_KEYS)rr F)GuardrailConfigModelcHeZdZdZdeffd ZdeeefdzdefdZ xZ S)NomaBlockedMessagez5Exception raised when Noma guardrail blocks a messageclassification_responsec.t|dd|dy)Niz!Request blocked by Noma guardrail)errordetails) status_codedetail)super__init__)selfr( __class__s w/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/guardrails/guardrail_hooks/noma/noma.pyr/zNomaBlockedMessage.__init__Bs# <2  result_objNreturncN|rt|tsy|jdduSa Check if a result object has a "result" field that is True. Args: result_obj: A dictionary that may contain a "result" field Returns: True if the "result" field exists and is True, False otherwise FresultT isinstancedictgetr0r4s r2_is_result_truez"NomaBlockedMessage._is_result_trueK'J!=~~h'4//r3) __name__ __module__ __qualname____doc__r;r/strrboolr> __classcell__r1s@r2r'r'?s2?   0$sCx.4*? 0D 0r3r'c eZdZdZdZdZedeefdZ d7de dzde dzd e dzd e dzd e dzd e dzf fd Z d8dZ d9dedededzde dzfdZ d9dededededzde dzf dZdedefdZdede fdZdedede dzfdZdedede fdZdee efdzde fdZdede fdZdede fd Zdededdfd!Zdedededdfd"Zd#ed$e deddfd%Zd&ed'e d(ed)e!de"e zezdzf d*Z#d(ed&ed)e!de"e zezdzfd+Z$d(ed&edefd,Z% d9dedededzde"e zezdzfd-Z& d9dededededzdef d.Z'd/ed0e dzdeded1edef d2Z(d#ed$e deddfd3Z)e*de+d4dzfd5Z,d&ededede-e.dffd6Z/xZ0S): NomaGuardrailz Noma Security Guardrail for LiteLLM This guardrail integrates with Noma Security's AI-DR API to provide content moderation and safety checks for LLM inputs and outputs. https://api.noma.security/z/ai-dr/v2/prompt/scanr5c~tjtjtjtjgSN)rpre_call during_call post_call pre_mcp_call)clss r2get_supported_event_hooksz'NomaGuardrail.get_supported_event_hooksfs2 ( (  + +  ) )  , ,   r3Napi_keyapi_baseapplication_id monitor_modeblock_failuresanonymize_inputc tstjdtddat t j |_t|_ |xstjjd|_ |xs.tjjdtj|_|xstjjd|_d |_|7tjjd d j'd k(|_n||_|7tjjd d j'd k(|_n||_|7tjjdd j'd k(|_n||_|j/dt1|j3t5|ldi|y)NzGuardrail provider 'noma' is deprecated. Please migrate to 'noma_v2'. The legacy 'noma' API will no longer be supported after March 31, 2026.) stacklevelT) llm_provider NOMA_API_KEY NOMA_API_BASENOMA_APPLICATION_IDlitellmNOMA_MONITOR_MODEfalsetrueNOMA_BLOCK_FAILURESNOMA_ANONYMIZE_INPUTsupported_event_hooks)_LEGACY_NOMA_DEPRECATION_WARNEDwarningswarnDeprecationWarningrrGuardrailCallback async_handlerr_responses_transform_handlerosenvironr<rSrI_DEFAULT_API_BASErTrUdefault_application_idlowerrVrWrX setdefaultlistrRr.r/) r0rSrTrUrVrWrXkwargsr1s r2r/zNomaGuardrail.__init__ost/ MMZ#  /3 +3AUAgAgh,Q,S)@"**.."@  dBJJNN?MDcDc$d ,U ?T0U&/#   " /BG L R R TX^ ^D  ,D   !"$**..1F"O"U"U"W[a"aD "0D   "#%::>>2H'#R#X#X#Z^d#dD #2D 148V8V8X3YZ "6"r3c tj|y#t$r }tjd|Yd}~yd}~wwxYw)zJCreate a background task for Noma API calls without blocking the main flowz)Failed to create background Noma task: %sN)asyncio create_task Exceptionrr*)r0coroes r2_create_background_noma_checkz+NomaGuardrail._create_background_noma_checks=  W    % W & &'RTU V V Ws A<A request_data user_auth event_typec Ktj}|j|}|jdxsg}|sy|jj |\}}|rddd|dgd} |j d| |syd |i} |j| d||| d{} tj} | |z j} |j| }|jd | |||j| j| | |jrG|jttj || d{tj |S|j#| trB|j%| t}|r*|j'||t)j*d ||S|j-ttj || d{tj |S7d77w)z/Shared logic for processing user message checksmessagesNmessagesystem input_texttypetextrrolecontentrinputpayloadllm_request_idr~r extra_datanomaguardrail_providerguardrail_json_responser~guardrail_status start_timeend_timedurationrz*Noma guardrail anonymized user message: %s)rnow)get_guardrail_dynamic_request_body_paramsr<rn1convert_chat_completion_messages_to_responses_apiinsert_call_noma_api total_seconds_determine_guardrail_status:add_standard_logging_guardrail_information_to_request_data timestamprV_handle_verdict_backgroundrjsondumps_should_anonymize_extract_anonymized_content_replace_user_message_contentrdebug_check_verdict)r0r~rrrrr input_items instructionssystem_messager response_jsonrrranonymized_contents r2_process_user_message_checkz)NomaGuardrail._process_user_message_checks %LLN  JJ<X &**:6<"$($E$E$w$w % ! \ ! )<@%N   q. 1!;/%)%8%8%! &9&  #,,.#j0??A#'"B"B="Q GG%$1%-!++-'')! H    11)TZZ =TVcd d d::k* *  ! !- ;(,(H(HXa(b !22TV[,\ "&. &--1 1 & &'TVW X0 1s000 AAAclassification_objc|syg}d}|jD]\}}|tvr=t|tr-|jD]\}}|j |sd}Kt|tr(d|vr$|j |sq|j |t|ts|jD]-\}} |j | s|j |d|/|xrt |dk(S)aC Check if only sensitive data detectors (PII, PCI, secrets) have result=true in the classification. Args: classification_obj: The prompt or response classification object from Noma API Returns: True if only sensitiveData detectors have result=true, False otherwise FTr8.r)itemsr$r:r;r>appendlen) r0rfailed_detectorssensitive_data_detectedkeyvalue data_type data_result nested_key nested_values r2"_should_only_sensitive_data_failedz0NomaGuardrail._should_only_sensitive_data_failedas "#%"',224 GJC22z%7N.3kkm7*I{++K826/7 E4(X->''.$++C0E4(05 G,J ++L9(//3%q 0EFG G('E3/?+@A+EEr3 message_typec|jdg}|sy|D]J}|jd|k(s|jdijdijddcSy)aD Extract anonymized content from Noma API response. Args: response_json: The full response from Noma API message_type: Either 'user' or 'assistant' to determine which content to extract Returns: The anonymized content string if available, None otherwise scanResultNrresultsanonymizedContent anonymized)r<)r0rr scan_result result_items r2rz)NomaGuardrail._extract_anonymized_contentss+..|R@ ' iKv&,6"y"599:MrRVVWceghh ir3cD|js |jsy|jdd}|sy|jdg}|syt|trt |dk(ry|D]9}|jd|k(s|j |jdicSy)a Determine if content should be anonymized based on Noma API response. Logic: - If aggregatedScanResult=False: Content is safe, anonymize if anonymized version exists - If aggregatedScanResult=True: Check if only sensitiveData detectors have result=True - If yes: Anonymize - If no: Block (other violations detected) Args: response_json: The full response from Noma API message_type: Either 'user' or 'assistant' to determine which classification to check Returns: True if content should be anonymized, False if it should be blocked FrTrrrr)rVrXr<r:rurr)r0rrrrrs r2rzNomaGuardrail._should_anonymizes$   D$8$8)6(9(9:PRW(X&+..|R@ +t,K0@A0E& _Kv&,6>>{yZ\?]^^ _r3r4cN|rt|tsy|jdduSr7r9r=s r2r>zNomaGuardrail._is_result_truer?r3rc|jdg}|sytt|dz ddD]'}||jdtk(s|||d<yy)z Replace the user message content in request data with anonymized version. Args: request_data: The original request data anonymized_content: The anonymized content to replace with rNrr)r<rangerr)r0r~rris r2rz+NomaGuardrail._replace_user_message_contentse'**:r: s8}q("b1 A{v&)3); I& r3ct|tjsy|jD]E}t|tjs|j j s5||j _Gy)z Replace the LLM response content with anonymized version. Args: response: The original LLM response anonymized_content: The anonymized content to replace with N)r:r`r rrrr)r0rrrs r2rz+NomaGuardrail._replace_llm_response_contentsT(G$9$9: && TV[,\ "%/vZyI$,,S1/vZyI$))#. Y & &'TVW X X Ys8B1ABAB A=A83B8A==Buser_api_key_dictcachedata call_typec <Ktjdtj}|tj j k(rtj}|j||dur|S|jr$ |j|j|||S |j||tjd{S#t$r!}tjd|Yd}~|Sd}~wwxYw71#t$rt$r}ddlm}|j"}|j%dt'||d|j)|j)d tj tjd ||j*r|cYd}~Sd}~wwxYww) NzRunning Noma pre-call hookrrFz2Failed to start background Noma pre-call check: %srrrrrzNoma pre-call hook failed: %s)rrrrMr call_mcp_toolrrPshould_run_guardrailrVr}rrzr*_check_user_messager'rrrrDrrW) r0rrrrrr|rrs r2async_pre_call_hookz!NomaGuardrail.async_pre_call_hook's ""#?@(11  //55 5,99J  $ $$: $ F% OK    d2243V3VW[]n3opK 11$8IK^KgKghh h  d$**+_abccK d i!    ) , J  K K#)(+A!!>%//1#--/.77 L  ! & &'F J""K) ssA6F9!CF$C5C3C5F C0C+%F+C00F3C55FBFFFFFc Ktj}|tjjk(rtj }|j ||dur|S|jr$ |j|j|||S |j||tjd{S#t$r!}tjd|Yd}~|Sd}~wwxYw71#t$rt$r}ddlm}|j }|j#dt%||d|j'|j'dtj tjd ||j(r|cYd}~Sd}~wwxYww) NrTz4Failed to start background Noma moderation check: %srrrrrrzNoma moderation hook failed: %s)rrNrrrrPrrVr}rrzrr*rr'rrrrDrrW)r0rrrrr|rrs r2async_moderation_hookz#NomaGuardrail.async_moderation_hookZss +>*I*I  //55 5,99J  $ $$: $ Fd RK    f2243V3VW[]n3opK 11$8IK^KjKjkk k  f$**+acdeeK f l!    ) , J  K K#)(+A!!>%//1#--/.:: L  ! & &'H! L""K) ssA!F$!B1F$C ,C-C 0F1 C:CFCFC F2BE?9F:F?FFc Ktj}|j||dur|S|jr% |j |j ||||S |j|||tjd{S#t $r!}tjd|Yd}~|Sd}~wwxYw71#t$rt $r}ddl m }|j}|jdt||d|j|jdtj tjd ||j r|cYd}~Sd}~wwxYww) NrTz3Failed to start background Noma post-call check: %srrrrrrzNoma post-call hook failed: %s)rrOrrVr}rrzrr*_check_llm_responser'rrrrDrrW)r0rrrrr|rrs r2async_post_call_success_hookz*NomaGuardrail.async_post_call_success_hooks[ 2E1N1N  $ $$: $ Fd RO    e2277hHYZ O 11$BSUhUrUrss s  e$**+`bcddO e t!    ) , J  K K#)(+A!!>%//1#--/.88 L  ! & &'G K""O' sq4E"BE%B5B3B5E B0B+%E+B00E3B55EBEEEEEcPK|j|||d{}|s|S|S7 w)z(Check user message for policy violationsN)r)r0r~rr user_messages r2rz!NomaGuardrail._check_user_messages6%)$D$D\S\^h$ii   js &$ &cRK|j||||d{}|s|S|S7 w)z(Check LLM response for policy violationsN)r)r0r~rrrrs r2rz!NomaGuardrail._check_llm_responses6 $?? hXacmnnO os '% 'rrrc K|jd}i|jrdd|jini|rd|ini}t|jxsdtj }|j j||i|d|jdxs[|jdijd ijd xs(|jxs|jxs |j|jdijd d|jr |jn |j||d i d{} | j| jS7$w)Nlitellm_call_id AuthorizationzBearer zX-Noma-Request-IDrJzx-noma-contextrUmetadataheaderszx-noma-application-idrequester_ip_address) applicationId ipAddressuserId sessionId requestId)rr)r<rSr rTrI_AIDR_ENDPOINTrmpostrU key_aliasrr user_emailuser_idraise_for_statusr) r0rrr~rrcall_idrendpointrs r2rzNomaGuardrail._call_noma_apisy&))*;< >Bll74<<.!9:PR 18#W-b "$--"O3OQ^QmQmn $ 2 2 7 7    %/^^4D%E&3#'' B7;;IrJNNOfg&3**&3!**&322!-!1!1*b!A!E!EF\^b!c7@7K7Ky33QZQbQb!(!/ # !8!  $ !!#}}) sD>E'E%%E'cjK|jdd}|r\d|d|}|jrtj|ytj||jdi}t |d|d|}|jrtj |ytj|yw)z Check the aggregatedScanResult from the Noma API and raise an exception if needed. aggregatedScanResult=True means unsafe (block), False means safe (allow) rFrrrrN)r<rVrrrr'r)r0rrrrroriginal_responses r2rzNomaGuardrail._check_verdicts)6(9(9:PRW(X !+D6G9EC  $,,S1$**3/+8+<+<\2+N!():;;+D6G9EC  $))#.$**3/sB1B3r%cddlm}|S)NrNomaGuardrailConfigModel)3litellm.types.proxy.guardrails.guardrail_hooks.nomarrs r2get_config_modelzNomaGuardrail.get_config_models ('r3cKg}|23d{}|j|76|syt|}t|tr |j |||t j d{7}nN#t$rt$r9}|jrtjd||D]}| Yd}~yd}~wwxYwt|} | 23d{7}|6y|D]}| yw)z6Process streaming response chunks with Noma guardrail.N)chunksz(Noma streaming post-call hook failed: %s)model_response) rrr:r rrrOr'rzrWrr*r) r0rrr~ all_chunkschunkassembled_model_responseprocessed_responser| mock_responses r2'async_post_call_streaming_iterator_hookz5NomaGuardrail.async_post_call_streaming_iterator_hooks8: # % %%   e $ %8 YmZ   . > 262J2J ,%'11 3--" &  &&$**+UWXY' EK   $8GY#ZM,  e  -  EK smC,$"$C,$ C,%A1*A-+A10C,1B</B72C,7B<<C, CCCC,)NNNNNN)r5NrL)1r@rArBrCrqr classmethodrurrRrDrEr/r}r;rr LLMResponserrrr MessageRolerrrr>rrrrrr rrzrrrrrrr staticmethodrrrrrrFrGs@r2rIrI[s\5,N $/B*C  ##%)$(&*'+,#t,#*,#d ,# Tk ,# t ,#,#\W W26 H'H'"H'($. H' t H'^26 JJJ" J ($. J t JX"1"1/"1H%FT%Fd%FN[]`cg]g.(t(;(SW(T 0$sCx.4*? 0D 0$TW$r2s * !!,1BJ./8 5##2A>1ReDI.R)* M!$55 E "'X008n On r3