Address three additional root causes that prevented connection cleanup
on client disconnect: Starlette/Uvicorn disconnect detection gap,
content= vs stream= no-op wrapper in aiohttp transport, and anyio
CancelledError interrupting cleanup awaits.
- Add `definitions` handling alongside `$defs` in schema normalization
(older JSON Schema drafts use `definitions` instead of `$defs`)
- Fall back to tool-call approach when `response_format: {type: json_object}`
has no explicit schema, since the native API requires one
- Add tests for both cases
* fix(ui/): add mcp input as an example for custom code guardrails
* feat(a2a/): ensure a2a guardrails works on response output
* feat(a2a/): support streaming guardrails
* fix(ui/): add mcp input as an example for custom code guardrails
The __init__ method was trying to access self.__annotations__ before
super().__init__() was called, resulting in an empty annotations dict.
Changed to use the class annotations directly: LiteLLM_JWTAuth.__annotations__
instead of self.__annotations__.
This fixes the ValueError:
"Invalid arguments provided: user_email_jwt_field, user_id_upsert,
user_allowed_email_domain. Allowed arguments are: ."
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Fixes issue where users with disallowed email domains receive a
generic "user doesn't exist" error instead of a clear message
about the email domain not being allowed.
Changes:
- Add explicit check for valid_user_email before get_user_object
- Raise ProxyException with clear error message when email domain
is not in the allowed list
- Prevents confusing error message for email domain restrictions
This fixes the test_allow_access_by_email test failure.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Fixes PLR0915 linting error (too many statements: 64 > 50) by extracting
repeated logic into four helper methods:
- _handle_conditional_match
- _handle_category_keyword_match
- _handle_pattern_match
- _handle_blocked_word_match
This improves code organization and maintainability while preserving
all existing functionality.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Restructure comments to make the intent clearer:
- First function: matches/tracks policies (may find nothing)
- Second function: always runs independent resolution (may find inherited guardrails)
This makes it clear why both functions must always be called.
Remove early return when applied_policy_names is empty to preserve
original behavior where PolicyResolver.resolve_guardrails_for_context()
is always called. The resolver does its own independent matching and
inheritance resolution, which can apply guardrails from parent policies
even when child policies fail their conditions.
This ensures no guardrails are silently dropped due to the refactoring.
Addresses Greptile review feedback on behavioral change.
