uPjz6UdZddlmZddlmZmZmZddlmZddl m Z ddl m Z ddl mZddlmZdd lmZdd lmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"eZ#ee$d <d e%d edefdZ&de'dedefdZ(e#jSddgee ged:de%dzfdZ*e#jWddgee geee fdede fdZ,e#jSddgee ge!d e%fdZ-e#jWddgee geee fd e%de de fdZ.e#j_d dgee geee fd!e%de"de fd"Z0e#jSd#dgee ged$e%d%e%fd&Z1e#jed'dgee g(d e%fd)Z3e#jSd*dgee ged!e%fd+Z4e#j_d*dgee geee fd!e%dede fd,Z5e#jed*dgee g(d!e%fd-Z6e#jSd.dgee g(d!e%fd/Z7e#jWd0dgee g(ee fdede fd1Z8e#jSd2dgee ged3Z9e#jWd4dgee geee fdede fd5Z:e#jSd6dgee ged7e%fd8Z;e#jed6dgee g(d7e%fd9Z6sb %w'%%$" __ "  &B __ "$  r4z/policies/listPolicies)r= dependenciesresponse_modelNr&cKddlm} t}||j||d{ng}|Dchc]}|jdk(s|j  }}|dv}|r?|j jDcgc]\}}||vr t||c}}ng} || z} t| t| S7cc}wcc}}w#t$r1} tjd| td t|  d} ~ wwxYww) aL List all policies from the database and config.yaml. Optionally filter by version_status. Config-defined policies are returned with definition_location "config" and are treated as production versions. On a name conflict with a production DB policy, only the DB policy is returned, mirroring runtime resolution where only production DB versions override config. A draft or published DB version does not hide the config policy, since the config version is still the one being enforced. Query params: - version_status: Optional. One of "draft", "published", "production". If omitted, all versions are returned. Example Request: ```bash curl -X GET "http://localhost:4000/policies/list" \ -H "Authorization: Bearer " curl -X GET "http://localhost:4000/policies/list?version_status=production" \ -H "Authorization: Bearer " ``` Example Response: ```json { "policies": [ { "policy_id": "123e4567-e89b-12d3-a456-426614174000", "policy_name": "global-baseline", "version_number": 1, "version_status": "production", "inherit": null, "description": "Base guardrails for all requests", "guardrails_add": ["pii_masking"], "guardrails_remove": [], "condition": null, "created_at": "2024-01-01T00:00:00Z", "updated_at": "2024-01-01T00:00:00Z" } ], "total_count": 1 } ``` r prisma_clientNr&r")Nr")policies total_countzError listing policies: %s status_codedetail)litellm.proxy.proxy_serverrDr get_all_policies_from_dbr&rlist_config_policiesitemsr3rlen Exceptionr exceptionrstr) r&rDregistry db_policies db_policydb_policy_namesinclude_configrrconfig_policiesrFes r2 list_policiesr[Hs.d9<-/(33MR`3a a a  4?" &/)BZBZ^jBjI ! !" " !/2F F,4+H+H+J+P+P+R 'Ko5.k6B   &7#X3x=QQ% b"   <&&'CQGCF;; C C C)C C C =D>C C D,DDDz /policiesrequestuser_api_key_dictcKddlm}| tdd |j}t j |||d{}|S7#t $rg}tjd|d t|jvrtd d |jd tdt|d}~wwxYww) a Create a new policy. Example Request: ```bash curl -X POST "http://localhost:4000/policies" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "policy_name": "global-baseline", "description": "Base guardrails for all requests", "guardrails_add": ["pii_masking", "prompt_injection"], "guardrails_remove": [] }' ``` Example Response: ```json { "policy_id": "123e4567-e89b-12d3-a456-426614174000", "policy_name": "global-baseline", "inherit": null, "description": "Base guardrails for all requests", "guardrails_add": ["pii_masking", "prompt_injection"], "guardrails_remove": [], "condition": null, "created_at": "2024-01-01T00:00:00Z", "updated_at": "2024-01-01T00:00:00Z" } ``` rrCNrHDatabase not connectedrI)policy_requestrD created_byzError creating policy: %szunique constraintzPolicy with name 'z' already exists) rLrDruser_idr add_policy_to_dbrQrrRrSlowerr)r\r]rDraresultrZs r2 create_policyrgsR94LMM<-55 13DD"'!E     <&&'BAF #a&,,. 0+G,?,?+@@PQ CF;;<>A;> A8,A33A88A;cKddlm}| tdd |j}t j |||j |d{S7#t$r}}tjd|d t|jvsd t|jvrtd t|tdt|d}~wwxYww) z Create a new draft version of a policy. Copies all fields from the source. Source is current production if source_policy_id is not provided. rrCNrHr_rI)rrDsource_policy_idraz!Error creating policy version: %s not foundz no production) rLrDrrcr create_new_versionrorQrrRrSre)rr\r]rDrarZs r2create_policy_versionrss94LMM <-55 (*==#'$55! >    <&&'JAN #a&,,. (Os1v||~,MCA? ?CF;;  published - published -> production (demotes current production to published) - production -> published (demotes, policy becomes inactive) rrCNrHr_rI)r$ new_statusrD updated_byz!Error updating version status: %szinvalid statusz only draftzcannot promoterbrprq) rLrDrrcr update_version_statusr&rQrrRrSre)r$r\r]rDrvrZs r2update_policy_version_statusrxs"94LMM<-55 (*@@--'! A     <&&'JAN s1v||~ -Q1OScgjklgmgsgsguSuCA? ? #a&,,. (CA? ?CF;; >#'?     <&&'H!LCF;;" ``` rrCNrHr_rIr$rDrqPolicy with ID not foundzError getting policy: %s) rLrDrr get_policy_by_id_from_dbrQrrRrS)r$rDrfrZs r2 get_policyr}s 94LMM <13LL'M   >C/)T^8_` `    <&&'A1ECF;;<8BAAABAB%,BBBcKddlm}| tdd tj ||d{}|tdd |d t |d d d k7r tdd|j }tj||||d{}|S7g7#t$rt$r1}tjd|tdt|d}~wwxYww)a Update an existing policy. Example Request: ```bash curl -X PUT "http://localhost:4000/policies/123e4567-e89b-12d3-a456-426614174000" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "description": "Updated description", "guardrails_add": ["pii_masking", "toxicity_filter"] }' ``` rrCNrHr_rIrrqrrr&r"draftrbzcOnly draft versions can be updated. Publish or create a new version to change published/production.)r$r`rDrvzError updating policy: %s) rLrDrr rgetattrrcupdate_policy_in_dbrQrrRrS)r$r\r]rDexistingrvrfrZs r2 update_policyrs294LMM< 3 5 N N'!O!    C/)T^8_` ` 8-| < G|  .55 13GG"'! H    '    <&&'BAFCF;;" ``` Example Response: ```json { "message": "Policy 123e4567-e89b-12d3-a456-426614174000 deleted successfully" } ``` rrCNrHr_rIrrqrrzError deleting policy: %s) rLrDrr rdelete_policy_from_dbrQrrRrS)r$rDrrfrZs r2 delete_policyrs,94LMM< 3 5 N N'!O!    C/)T^8_` `13II'J       <&&'BAFCF;;A8A45A8-A6.A83B>4A86A88B; ,B66B;;B>z)/policies/{policy_id}/resolved-guardrailscKddlm}| tdd tj ||d{}|tdd |d tj |j | d{}|j|j |d S7^7 #t$rt$r}td t|d}~wt$r1}tjd|tdt|d}~wwxYww)a Get the resolved guardrails for a policy (including inherited guardrails). This endpoint resolves the full inheritance chain and returns the final set of guardrails that would be applied for this policy. Example Request: ```bash curl -X GET "http://localhost:4000/policies/123e4567-e89b-12d3-a456-426614174000/resolved-guardrails" \ -H "Authorization: Bearer " ``` Example Response: ```json { "policy_id": "123e4567-e89b-12d3-a456-426614174000", "policy_name": "healthcare-compliance", "resolved_guardrails": ["pii_masking", "prompt_injection", "toxicity_filter"] } ``` rrCNrHr_rIrrqrrri)r$rresolved_guardrailsrbzError resolving guardrails: %s) rLrDrr rresolve_guardrails_from_dbrr$ ValueErrorrSrQrrR)r$rDrresolvedrZs r2get_resolved_guardrailsr s694LMM<13LL'M   >C/)T^8_` `!4 5 P P**'!Q!    ))!--#+      <CF;; <&&'GKCF;;" \ -H "Content-Type: application/json" \ -d '{ "pipeline": { "mode": "pre_call", "steps": [ {"guardrail": "pii-guard", "on_pass": "next", "on_fail": "block"} ] }, "test_messages": [{"role": "user", "content": "My SSN is 123-45-6789"}] }' ``` rbzInvalid pipeline: rINtest)messagesmodelmetadata completionz test-pipeline)stepsmodedatar] call_typerzError testing pipeline: %srH) r r,rQr test_messagesr execute_stepsrrr1rrRrS)r\r]validated_pipelinerZrrfs r2 test_pipelinerOs@N$5$I8H8H$I ))D <.<<$**#((/"'     ""% N6H4LMMN  <&&'CQGCF;;"). Example Request: ```bash curl -X GET "http://localhost:4000/policies/attachments/list" \ -H "Authorization: Bearer " ``` Example Response: ```json { "attachments": [ { "attachment_id": "123e4567-e89b-12d3-a456-426614174000", "policy_name": "global-baseline", "scope": "*", "teams": [], "keys": [], "models": [], "created_at": "2024-01-01T00:00:00Z", "updated_at": "2024-01-01T00:00:00Z" } ], "total_count": 1 } ``` rrCN) attachmentsrGz$Error listing policy attachments: %srHrI)rLrDr get_all_attachments_from_db enumerateget_config_attachmentsr>rrPrQrrRrrS)rDrTdb_attachmentsr5r6config_attachmentsrrZs r2list_policy_attachmentsrsL9 <13VcVoxCCMRRRuw&/x/N/N/P%Q% !z .eZ @% % ,.@@ + QTU`Qabb S% <&&'MqQCF;;>CCz/policies/attachmentscKddlm}ddlm}m}| t dd t j|d d{}|Dchc]}|j}}|j|vrt d d |jd ||| j|j|j|j|jd{}|r#t ddjd|D|j} tj!||| d{} | S7cc}w7b7#t $rt"$r1} t%j&d| t dt)| d} ~ wwxYww)a Create a new policy attachment. Example Request: ```bash curl -X POST "http://localhost:4000/policies/attachments" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "policy_name": "global-baseline", "scope": "*" }' ``` Example with team-specific attachment: ```bash curl -X POST "http://localhost:4000/policies/attachments" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "policy_name": "healthcare-compliance", "teams": ["healthcare-team", "medical-research"] }' ``` Example Response: ```json { "attachment_id": "123e4567-e89b-12d3-a456-426614174000", "policy_name": "global-baseline", "scope": "*", "teams": [], "keys": [], "models": [], "created_at": "2024-01-01T00:00:00Z", "updated_at": "2024-01-01T00:00:00Z" } ``` r)PolicyValidator) llm_routerrDNrHr_rIr"rErqzPolicy 'z%' not found. Create the policy first.)rDr)rr:r;r<rbz | c34K|]}|jywN)message).0rZs r2 z+create_policy_attachment..sBcQR199Bcs)attachment_requestrDraz$Error creating policy attachment: %s),litellm.proxy.policy_engine.policy_validatorrrLrrDrr rMrfind_invalid_scope_entriesr:r;r<joinrcr add_attachment_to_dbrQrrRrS) r\r]rrrDrFp policy_names scope_errorsrarfrZs r2create_policy_attachmentrsbMD4LMM"<,.GG frGss6>?q}}? ?   l 2!'"5"5!66[\ %4'J% $ $++-->> %   C BcVbBc8cd d-55 57LL&'!M    7t?   <&&'MqQCF;;" ``` rrCNrHr_rIr8rDrqAttachment with ID rz#Error getting policy attachment: %s) rLrDrr get_attachment_by_id_from_dbrQrrRrS)r8rDrfrZs r2get_policy_attachmentr s 94LMM<57TT''U   >,]O:F     <&&'LaPCF;;" ``` Example Response: ```json { "message": "Attachment 123e4567-e89b-12d3-a456-426614174000 deleted successfully" } ``` rrCNrHr_rIrrqrrz$Error deleting policy attachment: %s) rLrDrr rdelete_attachment_from_dbrQrrRrS)r8rDrrfrZs r2delete_policy_attachmentrGs,94LMM< 7 9 V V''!W!    ,]O:F  67QQ''R      <&&'MqQCF;;getr[postrgrlrsputrxrdeleterrrrrrrrrrrr4r2rs# 551/BSJK$  s F GW  S >N Sm $ +,-'   F<d F<  F