mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-15 23:31:29 +00:00
e3546c20af
* feat(bedrock guardrails): add resource-less InvokeGuardrailChecks (detect-only) mode Adopted from #30830 by OS-joaocastilho; the original PR was merged into litellm_oss_staging_230626, which never landed, so this re-lands it on litellm_internal_staging Beyond the original diff, this fold includes the review fixups that were made on the staging branch (warn on unrecognized check keys, keep empty known checks as enable-with-defaults, fail fast when the checks block has no usable keys, tz-aware datetimes, stricter typing) and adapts the block path to the ModifyResponseException contract from LIT-4186, which replaced GuardrailInterventionNormalStringError after the original PR was written * fix(bedrock guardrails): only evaluate configured checks in violation collection An unsolicited score in the InvokeGuardrailChecks response (e.g. a future API revision returning checks the user never requested) previously fell through to the default 0.5 threshold and could block a request the user only asked to scan with other checks. Violation collection now skips any check absent from the configured checks block * fix(bedrock guardrails): fail closed on truncated PII results and tighten checks-path typing Truncated sensitiveInformation results now count as a violation when the PII check is configured: Bedrock omitted detections that were never scored, so sub-threshold visible entries no longer let the request pass. Also blocks on score == threshold per the documented contract (regression test added), rejects checks combined with guardrailVersion, turns a malformed 200 body into a logged guardrail_failed_to_respond 500 instead of a raw ValidationError, types the checks parameter and violations (BedrockChecksConfigModel, BedrockChecksViolation) instead of dict/object, types _sign_and_post against AWSPreparedRequest, hoists stdlib imports, and builds checks messages without intermediate mutation * fix(bedrock guardrails): tag all InvokeGuardrailChecks INPUT content as user Bedrock excludes system content from prompt-attack evaluation (per the AWS guardrails docs), so mapping a caller-supplied system/developer message onto the system role let a caller hide a prompt injection from the promptAttack check by self-labeling its role. At the proxy every INPUT message is caller-controlled, so all of it is now tagged as untrusted user input, which also matches AWS guidance to tag untrusted content as user input. OUTPUT stays assistant. Removes the now-unused role map; the input-message test asserts the new tagging as a regression * fix(bedrock guardrails): pass prepared request headers to httpx without dict coercion httpx accepts botocore's HTTPHeaders mapping directly, and wrapping it in dict() broke the existing test_bedrock_guardrail_make_api_request_passes_api_key which supplies a bare Mock as the prepared request (dict(Mock) calls Mock.keys()) --------- Co-authored-by: OS-joaocastilho <144790013+OS-joaocastilho@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| guardrail_hooks | ||
| test_content_filter_path_traversal.py | ||
| test_content_utils.py | ||
| test_custom_code_security.py | ||
| test_deferred_guardrail_logging.py | ||
| test_guardrail_coverage.py | ||
| test_guardrail_endpoints.py | ||
| test_guardrail_registry.py | ||
| test_init_guardrails.py | ||
| test_llm_as_a_judge.py | ||
| test_mcp_jwt_signer.py | ||
| test_pillar_guardrails.py | ||
| test_prompt_security_guardrails.py | ||
| test_qostodian_nexus_guardrail.py | ||