From 9fea60df5e7180a4aa36accabbd559d97c2a3de2 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 22 May 2026 17:09:48 +0000 Subject: [PATCH] fix(purview_dlp): resolve user_id before buffering stream Co-authored-by: Yassin Kortam --- .../guardrail_hooks/microsoft_purview/purview_dlp.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/litellm/proxy/guardrails/guardrail_hooks/microsoft_purview/purview_dlp.py b/litellm/proxy/guardrails/guardrail_hooks/microsoft_purview/purview_dlp.py index eeee76b731e..ecc18114871 100644 --- a/litellm/proxy/guardrails/guardrail_hooks/microsoft_purview/purview_dlp.py +++ b/litellm/proxy/guardrails/guardrail_hooks/microsoft_purview/purview_dlp.py @@ -393,6 +393,10 @@ class MicrosoftPurviewDLPGuardrail(PurviewGuardrailBase, CustomGuardrail): from litellm.llms.base_llm.base_model_iterator import MockResponseIterator from litellm.main import stream_chunk_builder + # Resolve user ID up-front so identity failures don't waste work + # buffering and assembling the stream. + user_id = self._resolve_user_id_for_blocking(request_data, user_api_key_dict) + # Buffer the entire stream before any DLP scan. all_chunks: List[ModelResponseStream] = [] async for chunk in response: @@ -400,8 +404,6 @@ class MicrosoftPurviewDLPGuardrail(PurviewGuardrailBase, CustomGuardrail): assembled_response = stream_chunk_builder(chunks=all_chunks) - user_id = self._resolve_user_id_for_blocking(request_data, user_api_key_dict) - if assembled_response is None and all_chunks: # Fail closed: stream_chunk_builder dropped all chunks, so we cannot # scan the content. Refuse to release the buffered chunks.