From 90b03faf902c9d80d115db659565eb30722f4ae4 Mon Sep 17 00:00:00 2001
From: Jacinta Ferrant <jacinta.ferrant@gmail.com>
Date: Thu, 18 Jun 2026 20:56:06 -0700
Subject: [PATCH] test(rust): add FFI boundary tests for
 build_pattern_prefilter

Signed-off-by: Jacinta Ferrant <jacinta.ferrant@gmail.com>
---
 tests/rust_core_unit_tests/__init__.py        |  0
 .../test_pattern_prefilter.py                 | 51 +++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 tests/rust_core_unit_tests/__init__.py
 create mode 100644 tests/rust_core_unit_tests/test_pattern_prefilter.py

diff --git a/tests/rust_core_unit_tests/__init__.py b/tests/rust_core_unit_tests/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/tests/rust_core_unit_tests/test_pattern_prefilter.py b/tests/rust_core_unit_tests/test_pattern_prefilter.py
new file mode 100644
index 00000000000..393d7619cec
--- /dev/null
+++ b/tests/rust_core_unit_tests/test_pattern_prefilter.py
@@ -0,0 +1,51 @@
+import pytest
+
+litellm_core = pytest.importorskip(
+    "litellm_core",
+    reason="litellm_core Rust extension not built; run `maturin develop` in rust/",
+)
+build_pattern_prefilter = litellm_core.build_pattern_prefilter
+
+SSN_PATTERN = r"\b\d{3}-\d{2}-\d{4}\b"
+API_KEY_PATTERN = r"sk-[A-Za-z0-9]{20,}"
+LOOKBEHIND_PATTERN = r"(?<!\d)foo"
+
+
+class TestPatternPrefilter:
+    def test_no_match_returns_false(self):
+        prefilter, rejected = build_pattern_prefilter([SSN_PATTERN, API_KEY_PATTERN])
+        assert rejected == []
+        assert prefilter.any_match("hello world, nothing sensitive here") is False
+
+    def test_match_returns_true(self):
+        prefilter, rejected = build_pattern_prefilter([SSN_PATTERN, API_KEY_PATTERN])
+        assert rejected == []
+        assert prefilter.any_match("my ssn is 123-45-6789") is True
+
+    def test_case_insensitive_match(self):
+        prefilter, _ = build_pattern_prefilter([r"secret-token"])
+        assert prefilter.any_match("here is a SECRET-TOKEN") is True
+
+    def test_lookbehind_pattern_is_rejected_by_index(self):
+        prefilter, rejected = build_pattern_prefilter(
+            [SSN_PATTERN, LOOKBEHIND_PATTERN, API_KEY_PATTERN]
+        )
+        assert rejected == [1]
+
+    def test_rejected_pattern_does_not_affect_others(self):
+        prefilter, rejected = build_pattern_prefilter([LOOKBEHIND_PATTERN, SSN_PATTERN])
+        assert rejected == [0]
+        assert prefilter.any_match("hello world") is False
+        assert prefilter.any_match("my ssn is 123-45-6789") is True
+
+    def test_all_patterns_rejected_falls_back_to_true(self):
+        prefilter, rejected = build_pattern_prefilter([LOOKBEHIND_PATTERN])
+        assert rejected == [0]
+        # No usable set was built; the safe default is to never claim "no match".
+        assert prefilter.any_match("anything at all") is True
+
+    def test_empty_pattern_list_falls_back_to_true(self):
+        prefilter, rejected = build_pattern_prefilter([])
+        assert rejected == []
+        # No usable set was built; the safe default is to never claim "no match".
+        assert prefilter.any_match("anything at all") is True