fix(purview_dlp): resolve user_id before buffering stream

Co-authored-by: Yassin Kortam <yassin@berri.ai>
This commit is contained in:
Cursor Agent 2026-05-22 17:09:48 +00:00
parent 6bfd1f04cc
commit 9fea60df5e
No known key found for this signature in database

View file

@ -393,6 +393,10 @@ class MicrosoftPurviewDLPGuardrail(PurviewGuardrailBase, CustomGuardrail):
from litellm.llms.base_llm.base_model_iterator import MockResponseIterator
from litellm.main import stream_chunk_builder
# Resolve user ID up-front so identity failures don't waste work
# buffering and assembling the stream.
user_id = self._resolve_user_id_for_blocking(request_data, user_api_key_dict)
# Buffer the entire stream before any DLP scan.
all_chunks: List[ModelResponseStream] = []
async for chunk in response:
@ -400,8 +404,6 @@ class MicrosoftPurviewDLPGuardrail(PurviewGuardrailBase, CustomGuardrail):
assembled_response = stream_chunk_builder(chunks=all_chunks)
user_id = self._resolve_user_id_for_blocking(request_data, user_api_key_dict)
if assembled_response is None and all_chunks:
# Fail closed: stream_chunk_builder dropped all chunks, so we cannot
# scan the content. Refuse to release the buffered chunks.