mirror of
https://github.com/tiennm99/litellm.git
synced 2026-06-18 00:48:01 +00:00
Krish Dholakia
67f90254ed
* feat(guardrails): team-based guardrail registration and approval workflow Add team-based guardrail submission system where teams can register Generic Guardrail API guardrails for admin review. Includes: - POST /guardrails/register endpoint for team-scoped submissions - Admin review endpoints (list/get/approve/reject submissions) - Team Guardrails tab in the UI dashboard - extra_headers support for forwarding client headers to guardrail APIs - Prisma schema migration for status, submitted_at, reviewed_at fields - Documentation for team-based guardrails and static/dynamic headers Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(guardrails): address review feedback - SSRF, silent failure, redundant query - Validate api_base URL scheme (http/https only) and hostname in register_guardrail to prevent SSRF via team submissions - Return warning field in approve response when in-memory initialization fails so admins know the guardrail won't work until next sync cycle - Eliminate redundant DB query in list_guardrail_submissions by fetching all team guardrails once and deriving both filtered list and summary counts from the single result set Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(guardrails): add pending_review status guard to reject endpoint Prevent rejecting already-active or already-rejected guardrails, which would create a DB/memory inconsistency (active in memory but rejected in DB). Now mirrors the approve endpoint's status check. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
93 lines
2.5 KiB
Bash
Executable File
93 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Creates a team, generates a team key, and submits a test guardrail with it.
|
|
# Requires: curl, jq
|
|
#
|
|
# Usage:
|
|
# ADMIN_KEY=sk-your-admin-key ./scripts/create_team_key_and_submit_guardrail.sh
|
|
# BASE_URL=http://localhost:4000 ADMIN_KEY=sk-your-admin-key ./scripts/create_team_key_and_submit_guardrail.sh
|
|
|
|
set -e
|
|
|
|
BASE_URL="${BASE_URL:-http://localhost:4000}"
|
|
BASE_URL="${BASE_URL%/}"
|
|
|
|
if [ -z "${ADMIN_KEY}" ]; then
|
|
echo "Error: ADMIN_KEY is required (admin API key for the proxy)."
|
|
echo "Usage: ADMIN_KEY=sk-your-admin-key $0"
|
|
exit 1
|
|
fi
|
|
|
|
AUTH_HEADER="Authorization: Bearer ${ADMIN_KEY}"
|
|
|
|
echo "Using BASE_URL=${BASE_URL}"
|
|
echo "Creating team..."
|
|
|
|
TEAM_RESP=$(curl -s -X POST "${BASE_URL}/team/new" \
|
|
-H "${AUTH_HEADER}" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{
|
|
"team_alias": "guardrail-test-team"
|
|
}')
|
|
|
|
if ! echo "$TEAM_RESP" | jq -e .team_id >/dev/null 2>&1; then
|
|
echo "Failed to create team. Response:"
|
|
echo "$TEAM_RESP" | jq . 2>/dev/null || echo "$TEAM_RESP"
|
|
exit 1
|
|
fi
|
|
|
|
TEAM_ID=$(echo "$TEAM_RESP" | jq -r .team_id)
|
|
echo "Created team_id: ${TEAM_ID}"
|
|
|
|
echo "Creating key for team..."
|
|
|
|
KEY_RESP=$(curl -s -X POST "${BASE_URL}/key/generate" \
|
|
-H "${AUTH_HEADER}" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{
|
|
\"team_id\": \"${TEAM_ID}\"
|
|
}")
|
|
|
|
if ! echo "$KEY_RESP" | jq -e .key >/dev/null 2>&1; then
|
|
echo "Failed to create key. Response:"
|
|
echo "$KEY_RESP" | jq . 2>/dev/null || echo "$KEY_RESP"
|
|
exit 1
|
|
fi
|
|
|
|
TEAM_KEY=$(echo "$KEY_RESP" | jq -r .key)
|
|
echo "Created team key: ${TEAM_KEY}"
|
|
|
|
GUARDRAIL_NAME="test-guardrail-$(date +%s)"
|
|
echo "Submitting guardrail: ${GUARDRAIL_NAME}"
|
|
|
|
REGISTER_RESP=$(curl -s -X POST "${BASE_URL}/guardrails/register" \
|
|
-H "Authorization: Bearer ${TEAM_KEY}" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{
|
|
\"guardrail_name\": \"${GUARDRAIL_NAME}\",
|
|
\"litellm_params\": {
|
|
\"guardrail\": \"generic_guardrail_api\",
|
|
\"mode\": \"pre_call\",
|
|
\"api_base\": \"https://example.com/guardrail\"
|
|
},
|
|
\"guardrail_info\": {
|
|
\"description\": \"Test guardrail submitted via team key\"
|
|
}
|
|
}")
|
|
|
|
if ! echo "$REGISTER_RESP" | jq -e .guardrail_id >/dev/null 2>&1; then
|
|
echo "Failed to register guardrail. Response:"
|
|
echo "$REGISTER_RESP" | jq . 2>/dev/null || echo "$REGISTER_RESP"
|
|
exit 1
|
|
fi
|
|
|
|
GUARDRAIL_ID=$(echo "$REGISTER_RESP" | jq -r .guardrail_id)
|
|
echo "Registered guardrail_id: ${GUARDRAIL_ID}"
|
|
|
|
echo ""
|
|
echo "Done."
|
|
echo " team_id: ${TEAM_ID}"
|
|
echo " team_key: ${TEAM_KEY}"
|
|
echo " guardrail_id: ${GUARDRAIL_ID}"
|
|
echo " guardrail_name: ${GUARDRAIL_NAME}"
|