tPj]rUdZddlmZddlZddlZddlZddlZddlZddlm Z m Z ddl m Z ddl mZddlmZmZmZmZmZddlmZdd lmZdd lmZdd lmZdd lmZdd lm Z ddl!m"Z"ddl#m$Z$m%Z%ddl&m'Z'm(Z(erddl)m*Z*eiZ+de,d<dZ-de,d<dZ.de,d<ej^dZ0de,d<dZ1de,d<dZ2de,d<dZ3de,d <e3d!fZ4de,d"<d#Z5de,d$<e6e3d!d%hZ7de,d&<e6hd'Z8de,d(<e6e'jre'jte'jve'jxe'jzhZ>de,d)<d*e'jrfd+e'jtfd,e'jvffZ?de,d-<e d.d./Gd0d1Z@e d.d./Gd2d3ZAe d.d./Gd4d5ZBe@eAzeBzZCd6e,d7<e d.d./Gd8d9ZDe d.d./Gd:d;ZEe d.d./Gd<d=ZFeEeFzZGd6e,d><eCeDzeFzZHd6e,d?<e d.d./Gd@dAZIe d.d./GdBdCZJdYdDZKdZdEZLd[dFZMd\dGZNd]dHZOd^dIZPd_dJZQd`dKZRdadLZSdbdMZTdcdNZUdddOZVdedPZWdfdQZX dgdRZY dhdSZZdidTZ[djdUZ\ dkdVZ]dldWZ^dmdXZ_y)na Run the configured pre-call guardrails over every record of a batch input file. Runs after ``batch_file_validation.check_batch_file_upload``, so every line here is already known to parse as a JSON object carrying ``custom_id``, ``method``, ``url`` and ``body``. ) annotationsN)IteratorMapping) dataclass)MappingProxyType) TYPE_CHECKINGBinaryIOFinalNoReturn TypeAlias)urlsplit HTTPException) assert_never)GuardrailRaisedException)is_guardrail_intervention)get_call_types_for_route)UserAPIKeyAuth)BatchGuardrailRecordBatchGuardrailReport) CallTypesCallTypesLiteral) ProxyLoggingzFinal[Mapping[str, object]] EMPTY_MAPPING r _SCAN_WINDOWi_REWRITE_SPOOL_BYTESz[\x00-\x1f\x7f]_CONTROL_CHARACTERS_CUSTOM_ID_LOG_LIMIT2_SUMMARY_LIMITlitellm_metadata_SCAN_METADATA_KEYmetadata_SCAN_METADATA_BAGSsensitive_data_routing_applied_ROUTE_APPLIED_KEY guardrails_INJECTED_KEYS>tagsheadersr)_guardrail_pipelinesuser_api_key_metadatauser_api_key_team_metadata_pipeline_managed_guardrails_SCAN_METADATA_KEYS_SCANNABLE_CALL_TYPESmessagespromptinput_BODY_SHAPE_CALL_TYPEST)frozenslotsceZdZUded<y)UnparseableRecordint line_numberN__name__ __module__ __qualname____annotations__z/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/openai_files_endpoints/batch_guardrails.pyr:r:^srCr:c,eZdZUded<ded<ded<y)UnscannableRecordr;r< str | None custom_idurlNr=rBrCrDrFrFcs OrCrFc,eZdZUded<ded<ded<y)UnroutableRecordr;r<rGrH guardrailNr=rBrCrDrKrKjsrCrKr BatchScanFailurec0eZdZUdZded<ded<ded<y) _Redactionz\A rewritten record on its way to the scan spool, held only for the window it was scanned in.r;r<rGrHstrtextN)r>r?r@__doc__rArBrCrDrOrOtsf IrCrOc6eZdZUded<ded<ded<ded<y)RecordRedactedr;r<rGrHoffsetlengthNr=rBrCrDrTrT}s K KnrCrTc0eZdZUded<ded<dZded<y) RecordDroppedr;r<rGrHNrL)r>r?r@rArLrBrCrDrXrXs Iz rCrX _RecordChange _ScanOutcomecTeZdZUdZded<ded<ded< ed dZd d Zdd Zy )BatchScanResultzUWhat the scan decided, per record. Empty changes means the upload proceeds untouched.ztuple[_RecordChange, ...]changesr;scanned_recordsr redactionscT|jtd|jDz S)Nc3BK|]}t|tsdywN) isinstancerX.0changes rD z4BatchScanResult.submitted_records..s)l*U[]jJk!)ls)r^sumr]selfs rDsubmitted_recordsz!BatchScanResult.submitted_recordss"##c)l$,,)l&lllrCcdjd|jdtD}t|jtz }|dkr|S|d|dS)z^Compact per-record outcome for the server-side log line, capped so one upload cannot flood it.z, c 3K|]=}d|jt|jdt|trdnd?yw)zline  redacteddroppedN)r< _describerHrdrTres rDrhz*BatchScanResult.summary..sN! F&&' &2B2B(C'DA'?zYO Q! sAANrz, and z more)joinr]r"len)rkshown remainings rDsummaryzBatchScanResult.summarys]yy! ,,7!   t||,~= !QuLugVI;e,LLrCcdt|jtd|jDS)Nc 3K|]U}t|j|jt|trdndt|t r |j ndWyw)rprqN)linerHactionrL)rr<rHrdrTrXrLres rDrhz)BatchScanResult.report..sZ# %++$..)3FN)K:QZ2r?r@rRrApropertyrlrwr~rBrCrDr\r\s9_ &&` mmM  rCr\c"eZdZUded<ded<y) _ParsedRecordr;r<Mapping[str, object]payloadNr=rBrCrDrrs !!rCrc tdd|iS)Nierror) status_codedetailr)messages rD _rejectedrs S'71C DDrCc|xtdx\}td|dxtdx'\}}}td|t|d|xsdd td x&\}}}td|t|d |xsd d  t |y)zLMap a scan failure onto the 400 contract the files endpoint already returns.r<NzThe 'body' of batch input line z8 is not an object, so guardrails cannot be applied to itr<rHrIzBatch input line z targets zno urlz and its body has no messages, prompt or input, so guardrails cannot read it. Give the record a chat, completion, embedding, responses or messages bodyr<rHrLz$ was routed to a different model by z a guardrailz|, and every record of a batch file goes to one provider, so the file cannot be submitted. Send that record outside the batch)r:rrFrrrKr)failurer<rHrIrLs rD raise_publicrs  7  71+>vw 8V  U U#K=91E0FiPSP_W_O`a\\ V  ` `#K=91E0FFj- ./SS a   !rCctd)z>Every record was blocked, so there is no batch left to create.zcEvery record in the batch input file was blocked by a guardrail, so there is nothing left to submit)rrBrCrDraise_nothing_to_submitrs m rCcjt|tr |jS|jyt |S)a Whether the guardrail judged the record, as opposed to failing to judge it. Stricter than ``is_guardrail_intervention``, which answers a different question and counts every ``GuardrailRaisedException`` as a block. Several integrations raise that same exception for an unreachable backend or an unparseable response, and only when the operator configured the guardrail to fail closed, so treating it as a block would turn "refuse this request" into "drop this record and submit the rest", which is the silent loss of enforcement this whole path exists to prevent. A guardrail that does not say it blocked content aborts the upload. Guardrails that report a technical failure as an ``HTTPException`` carrying a block status are caught by ``__cause__``: raising ``from`` the underlying error is a deliberate statement that something else caused this, which a verdict on content never is. Implicit context is left alone, since a block raised inside an unrelated ``except`` would read as a failure. F)rdrblocked_content __cause__r)excs rD_is_content_blockrs3 #/0""" }}  $S ))rCct|dd}t|tr|St|dd}t|tr|j dnd}t|tr|SdS)zIThe guardrail that raised, from whichever place it recorded its own name.guardrail_nameNr)getattrrdrPdictget)rnamedrenricheds rD_naming_guardrailrs]3 0$7E% C40F6@6Nfjj!12TXH!(C08:d:rCcN|sytjd|dt}d|dS)Nroz (custom_id ))rsubr )rHsafes rDrrrrs2 %))#y9:O;OPD $q !!rCc#dKt|dD]\}}|js||fyw)a Yield every non-blank line with its 1-based number, so both passes number records alike. Bytes, not text. The upload validation immediately before this parses each line as bytes, where the json module sniffs the encoding itself and accepts a leading byte order mark or a lone surrogate. Decoding to `str` first is stricter than that, so a file written by any of the editors that emit a BOM would pass validation and then fail the scan. rc)startN) enumeratestripsourcer<raw_lines rD _iter_linesrs8"+6!;( X >> x' '(s$0 0c#vKt|D]'\}}t|tj|)yw)zMYield one record per line, relying on the upload validation that already ran.)r<rN)rrjsonloadsrs rD _iter_recordsrs7!,V!4S X TZZ=QRRSs79c t|jjddjd}t |}|yt d|Dd}|dS|jS#t$rYywxYw)ab Resolve the route a record names, tolerating how callers actually write it. An absolute url has to reduce to its path or nothing matches, and a record naming ``/v1/responses`` in full would fall through to its body, where ``input`` reads as an embedding and the record gets scanned as the wrong call type rather than the right one. ?r/Nc32K|]}|tvs |ywN)r2)rfcs rDrhz&_call_type_from_url..-sQ1a;P6PQQs )r pathsplitrstrip ValueErrorrnextvalue)rIr call_types scannables rD_call_type_from_urlrssm((..s3A6==cB 16JQ QSWXI$49)//9  s6A)) A54A5cVtfdtDd}|dS|jS)Nc32K|]\}}|vs |ywrrB)rffield call_typebodys rDrhz'_call_type_from_body..2sc'7uiUZ^bUbcs )rr6r)rshapes` rD_call_type_from_bodyr1s*c;QceijE=41ekk1rCc^t|tr |r t|nd}||St|S)aH Resolve how to scan a record: its url when we recognize one, otherwise its body shape. An unrecognized url falls through to the body rather than rejecting, because a record we can still read is a record we can still scan, and the provider transformers treat an unknown url as chat rather than as an error. N)rdrPrr)rIrfrom_urls rD_scannable_call_typer6s33=S#2F3)#.TXH+8K1Ed1KKrCc|jd}t|tr!|jddj dSt|t t frt|ts t|SdS)z The record's identifier, rendered as text. The batch spec asks for a string, but callers do send numbers, and reporting those as null would leave the one field a caller reconciles on empty for exactly the records it needs. rHutf-8replaceN)rrdrPencodedecoder;floatbool)rrHs rD _custom_id_ofrBsd{{;/I)S!3::7CC' C<@T]_cId3y>njnnrCcdtjtfdt|DS)a Order-insensitive projection, so a guardrail re-serializing a dict does not read as a change. An absent key projects to ``null`` while a key holding ``None`` projects to the string ``"null"``, so adding or dropping a null-valued key still reads as a change. c3lK|]+}||vrtj|dtndf-yw)T) sort_keysdefaultN)rdumpsrP)rfkeyrs rDrhz_fingerprint..Ys5 cfSt $**T#Y$DY] ^ s14)rrr}sorted)rkeyss` rD _fingerprintrQs1 ::  jpqujv   rCczt|jDcic]\}}|tvs||c}}Scc}}w)z Narrow the request metadata to the keys guardrail dispatch reads. Passing the whole thing through would carry values that cannot be copied, such as the parent OTel span, and would hand every record proxy state it has no business seeing. )ritemsr1)request_metadatarrs rDbuild_scan_metadatar_s; &6&<&<&>] U#I\B\e] ]s7 7 c <K|jjd}t|tst |j St |j}|jjd}t||}|/t|j |t|tr|SdStj|}ttD cic] } | |vs| || c} } tD]} |j| dtD]#} tjt||| <% |j!|||dd{} | jd}t|tr<|jt*r't-|j ||jd St/|t/| ztz }t1| |t1||k(rytD]} | j| d| j3| t5|j |t7j8i|jd| i Scc} w7#t"$r7} t%| r&t'|j |t)| cYd} ~ Sd} ~ wwxYww) NrrrIrT)user_api_key_dictdatarguardrails_onlyrr% sensitive_data_routing_guardrail)r<rHrQ)rrrdrr:r<rrrFrPcopydeepcopyrr*popr& pre_call_hook ExceptionrrXrr(rK frozensetrupdaterOrr)record scan_metadatarproxy_logging_objrrHrIr scan_inputr own_injectedinjectedscannedrreroutedcompareds rD _scan_recordrksm ..$$V,D dD ! V-?-?@@$V^^4I##E*C+C6I **!#s+  26  ,0==+>J*n+dsX[_cXcCcN+deL"'x&'(B#}}T--@A 8B &7%D%D/ &E&  kk*-H(D!hll3E&F**ll#EF  !7);;~MHGX&,tX*FF"$ Hd#$ NN< && ZZ;6>>;67; < O,e  S ! V-?-?9`qru`vw w sbCJ II%AJ6IIIDJI J"+J JJJJJcKtjfd|Dddid{}tdt||DS7 w)zV``return_exceptions=True`` so one record raising never leaves its siblings unobserved.c3:K|]}t|ywr)r)rfrrrrs rDrhz_scan_window..s iX^,v}.?AR S isreturn_exceptionsTNc3DK|]\}}| |j|fywrr)rfroutcomes rDrhz_scan_window..s%s?67_f_r&$$g.ss  )asynciogatherr}zip)windowrrroutcomess ``` rD _scan_windowrsM$NN ibh iH sc&RZF[s ss s$A A !A c|jjd}|jdd|j}|j |t |j |j|t|S)z[Park the rewritten record on disk so only its location is carried for the rest of the scan.rr)r<rHrUrV) rQrseektellwriterTr<rHrt)r_ redactionencodedrUs rD_spoolrsg^^**73GOOAqOO%FW ))%%7|  rCcPtd|D}t|xs|ddS)zVA guardrail that blocked outranks a record we merely refused; then earliest line wins.c3HK|]}t|dts|ywrb)rd BaseException)rfproblems rDrhz_worst..scgZPQ Ta=b'cs""c |dS)NrrB)r s rDz_worst..s wqzrCrrc)r}min)problemsraiseds rD_worstrs*cccF v!'A B1 EErCc  Kt| ggg g tjt d  fd } t |D]9} j |t tk\s'|d{s9ns|d{|jdr8 jtt}t|tr||Ss jtttdt!  S77#t$r jwxYw#|jdwxYww) a Stream a batch input file and run the pre-call guardrail chain against every record. A record a guardrail rewrites is kept in its rewritten form and a record it blocks is dropped, which is what the online path does per request. Both are returned for reporting. A guardrail exception that is not a block is re-raised untouched so its status code survives, since dropping a record that was never inspected is worse than refusing the file. max_sizec|K rjt tt d{D]f\}}t |t rjt |2t |trj|Tj||fh jyy7wr) appendrtrr}rdrOrrXclear) r<rr]rrr_rrrrs rDdrainz$scan_batch_input_file..drains  NN3v; '.:f }.?AR/) <$ Wgz2NN6*g#>?7NN7+OO['$:; < LLN )s7B<B:BB<Nrc|jSrr)rgs rDr z'scan_batch_input_file..s 9K9KrCr)r]r^r_)rNone)rtempfileSpooledTemporaryFilerrrrtrr closerrr}rdr\rri) file_sourcerrrritemworstr]rr_rrrs `` @@@@@@rDscan_batch_input_filer"sC//?@MJLH*,G)+F "G 55%J   !+. D MM$ 6{l*g    'MM eHo. e] +K  fW*KLMG  '    sZ;E1D+8 D+D'D+ D+D)D+B E'D+)D++EE EEcn|j|j|j|jSr)rrUreadrV)r_rgs rD _read_spooledr%s%OOFMM" ??6== ))rCc t|jDcic] }t|ts|j|"c}}t d|jD}t jt}d} t|D]^\}}||vr |j|}||jdnt|j|} |j|rd| zn| d}` |j#d|j#d|Scc}w#t$r|j!wxYw#|j#dwxYw)a Re-emit the file with redacted records rewritten and dropped records left out. Untouched records are copied through as written rather than re-serialized, so enabling the feature does not reformat records no guardrail objected to. Blank lines between records are not carried over, since they are not records. Rewritten records are read back from the scan's spool rather than from memory, so a file whose records are mostly rewritten does not put a second copy of itself on the heap. c3VK|]!}t|ts|j#ywr)rdrXr<res rDrhz+rewrite_batch_input_file..&s"tfR\]cerRsv11ts))rF Tr)rr]rdrTr<rrrrrrrr%r_rr rr) rresultrgrprqoutput wrote_anyr<rrzs rDrewrite_batch_input_filer,s+'28..gJvWeDf  V #gHtttG11%FI %0%=  !Kg%\\+.F-3^8??5)vO`O`bhAiD LL =I    KKN M- h    s#D D 9A,DD**D--E)rrPrr)rrMrr )rr )rr rr)rr rrG)rHrGrrP)rr rzIterator[tuple[int, bytes]])rr rzIterator[_ParsedRecord])rIrPrCallTypesLiteral | None)rrrr-)rIobjectrrrr-)rrrrG)rrrzfrozenset[str]rrP)rrrr) rrrrrrrrrz_ScanOutcome | None) rztuple[_ParsedRecord, ...]rrrrrrrz4tuple[tuple[int, _ScanOutcome | BaseException], ...])r_r rrOrrT)rz8tuple[tuple[int, BatchScanFailure | BaseException], ...]rz BatchScanFailure | BaseException) rr rrrrrrrz"BatchScanFailure | BatchScanResult)r_r rgrTrbytes)rr r)r\rr )`rR __future__rrrrrercollections.abcrr dataclassesrtypesrtypingrr r r r urllib.parser fastapirtyping_extensionsrlitellm.exceptionsr%litellm.integrations.custom_guardrailr2litellm.litellm_core_utils.api_route_to_call_typesrlitellm.proxy._typesrlitellm.types.llms.openairrlitellm.types.utilsrrlitellm.proxy.utilsrrrArrcompilerr r"r$r&r(rr*r1 acompletionatext_completion aembedding aresponsesanthropic_messagesr2r6r:rFrKrMrOrTrXrYrZr\rrrrrrrrrrrrrrrrrrrrr"r%r,rBrCrDrFs# -!"FF!!*7KW/P;0-=b-A *A e*e)(RZZ(:;U;!e!.E.0*=U==E<"#5z<"PQQ' U  )""$$  u&&' y))* i""#! $d#$ $d#$  $d#$ 02CCFVV)V $d#$ $d#oo$o $d#!!$! *M9 y9*Z7-G iG $d#" " $" J $d#""$" E".*.;" (S :,2 L o  @ @'@&@$ @  @F t % t' t& t$ t : t F AA+A& A $ A ( AH* !rC