tPj} UddlZddlZddlmZmZmZmZddlmZddl m Z ddl m Z ddl mZddlmZddlmZmZdd lmZdd lmZmZdd lmZdd lmZmZmZdd l m!Z!ddl"m#Z#erddl$m%Z%dZ&ee'd<dede(fdZ)e&fdede*de+ee(e,ffdZ-de.e(efde.e(e(ffdZ/Gdde0Z1Gdde0Z2GddeZ3y) N) TYPE_CHECKINGAnyFinalLiteral)quote) HTTPException) DualCache)verbose_proxy_logger)version)CustomGuardraillog_guardrail_information)get_llm_provider)get_async_httpx_clienthttpxSpecialProvider)UserAPIKeyAuth),TRUSTED_PILLAR_RESPONSE_HEADERS_METADATA_KEY*add_guardrail_to_applied_guardrails_header&get_metadata_variable_name_from_kwargs)GuardrailEventHooks)LLMResponseTypes)GuardrailConfigModeli MAX_PILLAR_HEADER_VALUE_BYTESdatareturncLtj|dd}t|dS)zJ JSON-serialize and URL-encode data for safe header transmission. F),:) ensure_ascii separatorssafe)jsondumpsr)r json_payloads {/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/guardrails/guardrail_hooks/pillar/pillar.py_encode_json_for_headerr'-s#**T*UL B ''evidence max_bytesct|ts=t|}t|j d|kr||dfSd}|t|dfSg}t|}d}|D]a}t|t r t |}n|}|j |t|}t|j d|kr\d}t|t rt|jdd}|rtdt|dz} t|j d|kDrh|rft|| kDr|d | n|d d }td| dz} |r|d nd} | |d<d|d <t|}t|j d|kDr|rft|j d|krG|jt|}d|||fS) a Truncate evidence payload so the encoded header value stays within max_bytes. Returns: truncated_evidence: Evidence list/value after truncation encoded_value: URL-encoded JSON string for header was_truncated: Whether truncation occurred zutf-8Fz [truncated]Tr)r Nz...[truncated]evidence_truncated) isinstancelistr'lenencodedictappendstrgetmaxpop) r)r*encodedtruncated_value truncatedtruncated_flagentry working_entry evidence_textsteptruncated_texts r&_truncate_evidence_payloadrC5s h %)(3 w~~g& '9 4We+ +!. 7 H$NN"$I%i0GN5 eT " KM!M'))4 w~~g& '9 4  mT * 1 1*b ABM1c-0A56'..12Y>==@=ORV=VM&D5$9\ijmkm\nMq$!),DIV n%E\iN0>M*-:>M"675i@G '..12Y>=w~~g./9< ))4=5@ g~ --r(metadata_storec(i}d|vrt|dj|d<d|vrt|d|d<d|vr#t|d\}}}||d<|rd|d<||d<d |vrt t|d d |d <|r||d <d|t <|S)zP Create URL-safe Pillar response headers and apply truncation metadata. pillar_flaggedzx-pillar-flaggedpillar_scannerszx-pillar-scannerspillar_evidenceTpillar_evidence_truncatedzx-pillar-evidencepillar_session_id_responser r!zx-pillar-session-idpillar_response_headers)r6lowerr'rCrr)rDheaderstruncated_evidence encoded_valuer=s r&build_pillar_response_headersrPls&(G>)&).9I*J&K&Q&Q&S"#N*'>~N_?`'a#$N*-?() :>N6 7'4#$#~5).s>B^3_/`gi)j%&4;01GKCD Nr(ceZdZdZy)PillarGuardrailMissingSecretsz0Exception raised when Pillar API key is missing.N__name__ __module__ __qualname____doc__r(r&rRrRs:r(rRceZdZdZy)PillarGuardrailAPIErrorz>Exception raised when there's an error calling the Pillar API.NrSrXr(r&rZrZsHr(rZceZdZdZgdZdZddgZdZdZdZ d8d e dzd e dzd e dzd e dzd e dzde dzde dzde dzde dzde dzddffd Z edededededdee zezdzf dZededededdee zezdzfdZededededefdZdededefdZd ededefd!Zdedee e ffd"Zd#ee e fd$e d%e dzddfd&Zd'e e zezdzd(e dzd)e dzd*e de dzf d+Zed%e e zezde fd,Zdede e e ffd-Z!dedee e"ffd.Z#d#ee e fd/ee e"fdee e"ffd0Z$d1ee e"fd2eddfd3Z%d1ee e"fddfd4Z&ede'd5dzfd6Z(e)de*e+fd7Z,xZ-S)9PillarGuardrailz Pillar Security Guardrail for LiteLLM. Provides comprehensive AI security scanning for input prompts and output responses using the Pillar Security API. )blockmonitormaskr^allowr]zhttps://api.pillar.securityg@Nguardrail_nameapi_keyapi_baseon_flagged_action async_modepersist_sessioninclude_scannersinclude_evidencefallback_on_errortimeoutrc  ttj|_|xstj j d|_|j d} t| |xs#t jdxs |j|_ |xstj j d} | r| |jvr| |_ n)| rtjd| |j |_ tj"d|j|j%|d dd |_|j%|d dd |_|j%|ddd |_|j%|ddd |_| xstj j d} | r| |j.vr| |_n4| r!tjd| |j2|j2|_tj"d|j0| | |_nB t7tj j dt9|j:|_tA|d|tE|jGd| y#t<t>f$rRtjdtj j d|j:|j:|_YwxYw)a Initialize the Pillar guardrail. Args: guardrail_name: Name of the guardrail instance api_key: Pillar API key api_base: Pillar API base URL on_flagged_action: Action to take when content is flagged ('block' or 'monitor') fallback_on_error: Action when API errors occur ('allow' or 'block') timeout: Timeout for API calls in seconds **kwargs: Additional arguments passed to parent class Note: LiteLLM virtual key context (user_id, team_id, key_alias, etc.) is always automatically passed as X-LiteLLM-* headers to enable application/user tracking. ) llm_providerPILLAR_API_KEYNCouldn't get Pillar API key, either set the `PILLAR_API_KEY` in the environment or pass it as a parameter to the guardrail in the config filePILLAR_API_BASEPILLAR_ON_FLAGGED_ACTIONz"Invalid action '%s', using defaultz8Pillar Guardrail: Initialized with on_flagged_action: %s PILLAR_ASYNCre)provided_valueenv_vardefault setting_namePILLAR_PERSISTrfPILLAR_INCLUDE_SCANNERSTrgPILLAR_INCLUDE_EVIDENCErhPILLAR_FALLBACK_ON_ERRORz0Invalid fallback action '%s', using default '%s'z8Pillar Guardrail: Initialized with fallback_on_error: %sPILLAR_TIMEOUTzPPillar Guardrail: Invalid PILLAR_TIMEOUT value '%s', falling back to default %ss)rasupported_event_hooksrX)$rrGuardrailCallback async_handlerosenvironr7rbrRgetenv BASE_API_URLrcSUPPORTED_ON_FLAGGED_ACTIONSrdr warningDEFAULT_ON_FLAGGED_ACTIONdebug_resolve_bool_configrerfrgrhSUPPORTED_FALLBACK_ACTIONSriDEFAULT_FALLBACK_ACTIONrjfloatr6DEFAULT_TIMEOUT ValueError TypeErrorsuper__init__r1get_supported_event_hooks)selfrarbrcrdrerfrgrhrirjkwargsmsgaction __class__s r&rzPillarGuardrail.__init__s<4AUAgAghB"**..1A"B << M 04 4 UBII.?$@UDDUDU #Pbjjnn5O&P f A AA%+D "$,,-QSYZ%)%C%CD """#]_c_u_uv33%"% 4  $88*$* 9  !% 9 9+-+ !:!  !% 9 9+-+ !:! #Pbjjnn5O&P f ? ??%+D "$,,FPTPlPl&*%A%AD """#]_c_u_uv  "DL 4$RZZ^^4Dc$J^J^F_%`a   )"&t'E'E'G"H   * 4$,,fJJNN#34(( $33  4sAI??AK K user_api_key_dictcacher call_type) completiontext_completion embeddingsimage_generation moderationaudio_transcriptionpass_through_endpointrerankmcp_callanthropic_messagesc,Ktj}|j||dur"tjd|j |Stjd|j ||d{}t||j |S7w)a Pre-call hook to scan the request for security threats before sending to LLM. Args: user_api_key_dict: User API key authentication info cache: LiteLLM cache instance data: Request data call_type: Type of LLM call Returns: Original data if safe, raises HTTPException if blocked Raises: HTTPException: If request should be blocked due to security threats r event_typeTz3Pillar Guardrail: Pre-call scanning disabled for %szPillar Guardrail: Pre-call hookN request_datara)rpre_callshould_run_guardrailr rrarun_pillar_guardrailr)rrrrrrresults r&async_pre_call_hookz#PillarGuardrail.async_pre_call_hooksD088  $ $$: $ Fd R & &'\^b^q^q rK""#DE"77>OPP 3UYUhUhi QA2B4B5B)rrrrr responsesrrc,Ktj}|j||dur"tjd|j |Stjd|j ||d{}t||j |S7w)a During-call hook to scan the request in parallel with LLM processing. Args: data: Request data user_api_key_dict: User API key authentication info call_type: Type of LLM call Returns: Original data if safe, raises HTTPException if blocked Raises: HTTPException: If request should be blocked due to security threats rTz6Pillar Guardrail: During-call scanning disabled for %sz-Pillar Guardrail: During-call moderation hookNr)r during_callrr rrarr)rrrrrrs r&async_moderation_hookz%PillarGuardrail.async_moderation_hookFs<0;;  $ $$: $ Fd R & &'_aeatat uK""#RS"77>OPP 3UYUhUhi QrresponsectKtj}|j||dur"tjd|j |Stjdt |dr|jni}|jdgDcgc]%}|jds|jd'}}|stjd|S|j}|jd g|z|d <|j||d {t||j |Scc}w7"w) a Post-call hook to scan LLM responses before returning to user. Args: data: Original request data user_api_key_dict: User API key authentication info response: LLM response to scan Returns: Original response if safe, raises HTTPException if blocked Raises: HTTPException: If response should be blocked due to security threats rTz4Pillar Guardrail: Post-call scanning disabled for %sz Pillar Guardrail: Post-call hook model_dumpchoicesmessagezJPillar Guardrail: No response content to scan, skipping post-call analysismessagesNr) r post_callrr rrahasattrrr7copyrr) rrrrr response_dictchoiceresponse_messagespost_call_datas r&async_post_call_success_hookz,PillarGuardrail.async_post_call_success_hookqs0*099  $ $$: $ Fd R & &']_c_r_r sO""#EF29<1P++-VX 0=0A0A)R0P$ &,TZT^T^_hTiFJJy !$ $ ! & &'s tO!% %)XXj"%=@Q%Qz"''8IJJJ 3UYUhUhi%$  Ks%BD8D1(D1;AD8D6#D8cK|jdstjd|S |j|}|j |}|j ||d{}|j |||S7#t$rD}t|tr|tjd||j||cYd}~Sd}~wwxYww)a Core method to run the Pillar guardrail scan. Args: data: Request data containing messages and metadata user_api_key_dict: User API key authentication info containing key context Returns: Original data if safe or in monitor mode Raises: HTTPException: If content is flagged and action is 'block', or if API fails and fallback_on_error is 'block' rz?Pillar Guardrail: No messages detected, bypassing security scan)rMpayloadNz/Pillar Guardrail: API communication failed - %s) r7r r_prepare_headers_prepare_payload_call_pillar_api_process_pillar_response Exceptionr0rerror_handle_api_error)rrrrMrres r&rz$PillarGuardrail.run_pillar_guardrailsxx # & &'h iK 3!223DEG!2248G$($9$9%:%H  ) )(D 9K 3!]+ ! & &'XZ[ \))!T2 2 3sF)C8A?$A=%A?<C=A?? C 9CC CC  Crc|jdk(rtjd|Stjdtdddt |d) ad Handle API errors based on fallback_on_error configuration. Args: error: The exception that occurred during API communication data: Original request data Returns: Original data if fallback_on_error is 'allow' Raises: HTTPException: If fallback_on_error is 'block' r`zXPillar Guardrail: API unavailable, proceeding without scanning (fallback_on_error=allow)zMPillar Guardrail: API unavailable, blocking request (fallback_on_error=block)iz%Pillar Security Guardrail UnavailablezQSecurity scanning service is temporarily unavailable and fallback is set to block)rroriginal_error status_codedetail)rir rrr6)rrrs r&rz!PillarGuardrail._handle_api_errors_  ! !W , ( (j K ( (_  Dr&)%j r(c6|js d}t|d|jdd}|j|d|j|j|d|j|j|d|j |j|d|j |j|j|j|j|j|j|jd }|jD]\}}|s t|||<|S) z Prepare headers for the Pillar API request. Args: user_api_key_dict: User API key authentication info containing key context Returns: Dictionary of headers to send to Pillar API rnzBearer zapplication/json) Authorizationz Content-Type plr_scanners plr_evidence plr_async plr_persist)zX-LiteLLM-Key-NamezX-LiteLLM-Key-AliaszX-LiteLLM-User-IdzX-LiteLLM-User-EmailzX-LiteLLM-Team-IdzX-LiteLLM-Team-NamezX-LiteLLM-Org-Id)rbrR_set_bool_headerrgrhrerfkey_name key_aliasuser_id user_emailteam_id team_aliasorg_iditemsr6)rrrrMcontext_mapping header_namevalues r&rz PillarGuardrail._prepare_headerss||M 04 4 't||n5.*  g~t7L7LM g~t7L7LM g{DOOD g}d6J6JK#4"<"<#4#>#>!2!:!:$5$@$@!2!:!:#4#?#? 1 8 8" #2"7"7"9 2 K'*5z $ 2r(rMrrc$|y|rd||<yd||<y)zFApply a boolean value as a lowercase string HTTP header when provided.NtruefalserX)rrMrrs r&rz PillarGuardrail._set_bool_header!s! = ).v G r(rrrsrtruc$| |j|S|r)t j |}| |j|S|S#t$rtjd|||cYSwxYw#t$rtjd|||cYSwxYw)zKResolve configuration precedence: explicit value -> environment -> default.zMPillar Guardrail: Invalid boolean value '%s' for %s, falling back to default.zQPillar Guardrail: Invalid boolean env value '%s' for %s, falling back to default.)_parse_bool_valuerr rr~r)rrrrsrtru env_values r&rz$PillarGuardrail._resolve_bool_config(s  % --n== !yy1I$#11)<<+ $,,c"    "#(00k! #N #s"AA*"A'&A'*"BBct|tr|St|tr t|St|j j }|dvry|dvryt d|)z;Normalise various truthy/falsey inputs to a strict boolean.>1yonyesrT>0nnooffrFzUnrecognised boolean value: )r0boolintr6striprLr)r value_strs r&rz!PillarGuardrail._parse_bool_valueKsm eT "L eS !; u:++-335 7 7 8 87w?@@r(c@|jd}|sy t||jd|jd|jd\}}}}|xsd|xsdfS#t$r1|xsd|jdxs|jdxsdfcYSwxYw) z Extract the model and provider from the request data. Args: data: Request data Returns: Tuple of (model_name, provider_name) model)unknownrcustom_llm_providerrcrb)rrrcrbrprovider)r7rr)rrr clean_modelr_s r&_extract_model_and_providerz+PillarGuardrail._extract_model_and_provider[sxx(' *:$(HH-B$C*-+ + 'K1a +)X-BB B "./T488J3GT9  sA A##7BBcZ|jdg}|jdg}dtd}|||d}|jd}|r||d<|jdijd }|r||d <|j|\}} ||d <| |d <tjd |||| |S)ah Prepare the payload for the Pillar API request following the /api/v1/protect contract. This method supports multi-modal content (images, files, audio, video, etc.) as messages are passed through without modification. The messages array can contain any OpenAI-compatible message structure including: - Text content (string) - Multi-modal content blocks (image_url, image_file, audio, video, document, file) - Attachments - Tool calls Args: data: Request data Returns: Formatted payload for Pillar API rtoolslitellm)sourcer )rrmetadatauserrrpillar_session_id session_idrrzNPillar Guardrail: Request context - user=%s, session=%s, model=%s, provider=%s)r7litellm_versionrr r) rrrrrrrrrrs r&rz PillarGuardrail._prepare_payloadys$((:r2xx,& !  &) !(GI !HHZ4889LM $.GL !::4@x & "" \      r(rc Ktjdt|jdg|jj |j d|||jd{}|j|j}|jd}|jd}tjd|||S7_w) z Call the Pillar API and return the response. Args: headers: HTTP headers for the request payload: Request payload Returns: Pillar API response as dictionary z;Pillar Guardrail: Scanning %s messages for security threatsrz/api/v1/protect)urlrMr#rjNflaggedrz F} U  .jARARSaAbdh6i,.M. ) -n = Z '.jARARS]A^`d6e,: j)$3#6#6|#D  & &'^`q r".86G23;LN7 8,3'(  0?0C0CJPR0SN, -  0?0C0CJPR0SN, -  ( ()L M%%066G''61$))*de)8)<)<=VXZ)["0?M*-(00h''94$))*st%n5r(cd|jdi}|jr|jdi|d<|jr|jdg|d<dd|d}tjdt d| ) a Raise an HTTPException for Pillar security detections. Args: pillar_response: Response from Pillar API containing detection details Raises: HTTPException: Always raises with security detection details rr r)z$Blocked by Pillar Security GuardrailzSecurity threats detected)rdetection_messager z=Pillar Guardrail: Request blocked - Security threats detectedir)r7rgrhr rr)rr pillar_response_dict error_details r&rz1PillarGuardrail._raise_pillar_detection_exception s /--l;'   />/B/B:r/R  ,  />/B/B:r/R  ,r3s 55"17O0 90X'/u/(#(#(@]4.4.4.afgjloquguav4.n$sCx.T#s(^@;I;IiI l  ol  r(