o ưi(@sVdZddlmZmZmZmZmZddlmZddl m Z m Z m Z m Z GdddZdS)z Policy Resolver - Resolves final guardrail list from policies. Handles: - Inheritance chain resolution (inherit with add/remove) - Applying add/remove guardrails - Evaluating model conditions - Combining guardrails from multiple matching policies )DictListOptionalSetTuple)verbose_proxy_logger)GuardrailPipelinePolicyPolicyMatchContextResolvedPolicyc @sReZdZdZe ddedeeefdee ede efddZ e ddedeeefd ee de fd d Ze  dd e deeeefd ee ede efd dZe  dd e deeeefd ee ede eeeffddZede eeefde efddZe  ddeeeefd ee deee ffddZdS)PolicyResolverz Resolves the final list of guardrails from policies. Handles: - Inheritance chains with add/remove operations - Model-based conditions N policy_namepoliciesvisitedreturncCst|durt}||vrtd|dgS||}|dur!gS|||jr7tj|j||d}||gS|gS)aX Get the inheritance chain for a policy (from root to policy). Args: policy_name: Name of the policy policies: Dictionary of all policies visited: Set of visited policies (for cycle detection) Returns: List of policy names from root ancestor to the given policy Nz*Circular inheritance detected for policy '')r rr)setrwarninggetaddinheritr resolve_inheritance_chain)r rrpolicyZ parent_chainrb/home/app/Keep/.python/lib/python3.10/site-packages/litellm/proxy/policy_engine/policy_resolver.pyrs"    z(PolicyResolver.resolve_inheritance_chaincontextc Csddlm}tj||d}t}|D]A}||}|durq|dur9|jdur9|j|j|ds9t d|dq|j D]}| |q>|j D]}||qKqt|t||dS) a Resolve the final guardrails for a single policy, including inheritance. This method: 1. Resolves the inheritance chain 2. Applies add/remove from each policy in the chain 3. Evaluates model conditions (if context provided) Args: policy_name: Name of the policy to resolve policies: Dictionary of all policies context: Optional request context for evaluating conditions Returns: ResolvedPolicy with final guardrails list r)ConditionEvaluator)r rN) conditionrPolicy 'z.' condition did not match, skipping guardrails)r guardrailsinheritance_chain)Z/litellm.proxy.policy_engine.condition_evaluatorrr rrrrevaluaterdebugrZget_addrZ get_removediscardr list) r rrrr rZchain_policy_namer guardrailrrrresolve_policy_guardrailsDs8     z(PolicyResolver.resolve_policy_guardrails policy_namesc Csddlm}ddlm}|dur|}|sgS|}|dur#|n|j|d}|s>td|j d|j d|j gSt }|D]}t j|||d } || jtd |d | jqCt|} td | | S) ax Resolve the final list of guardrails for a request context. This: 1. Finds all policies that match the context via policy_attachments (or policy_names if provided) 2. Resolves each policy's guardrails (including inheritance) 3. Evaluates model conditions 4. Combines all guardrails (union) Args: context: The request context policies: Dictionary of all policies (if None, uses global registry) policy_names: If provided, use this list instead of attachment matching Returns: List of guardrail names to apply r PolicyMatcherget_policy_registryNrz&No policies match context: team_alias=z , key_alias=z, model=r rrrz' contributes guardrails: zFinal guardrails for context: )*litellm.proxy.policy_engine.policy_matcherr)+litellm.proxy.policy_engine.policy_registryr+is_initializedget_all_policiesget_matching_policiesrr"Z team_aliasZ key_aliasmodelrr r&updaterr$) rrr'r)r+registrymatching_policy_namesZall_guardrailsr resolvedresultrrrresolve_guardrails_for_contextsH     z-PolicyResolver.resolve_guardrails_for_contextc Csddlm}ddlm}|dur|}|sgS|}|dur#|n|j|d}|s-gSg}|D])}||} | dur=q1| jdurZ| || jft d|dt | jj dq1|S) aJ Resolve pipelines from matching policies for a request context. Returns (policy_name, pipeline) tuples for policies that have pipelines. Guardrails managed by pipelines should be excluded from the flat guardrails list to avoid double execution. Args: context: The request context policies: Dictionary of all policies (if None, uses global registry) policy_names: If provided, use this list instead of attachment matching Returns: List of (policy_name, GuardrailPipeline) tuples rr(r*Nr,rz' has pipeline with z steps)r.r)r/r+r0r1r2rpipelineappendrr"lensteps) rrr'r)r+r5r6 pipelinesr rrrrresolve_pipelines_for_contexts6      z,PolicyResolver.resolve_pipelines_for_contextr>cCs0t}|D]\}}|jD]}||jq q|S)z Get the set of guardrail names managed by pipelines. These guardrails should be excluded from normal independent execution. )rr=rr%)r>ZmanagedZ _policy_namer:steprrrget_pipeline_managed_guardrailss   z.PolicyResolver.get_pipeline_managed_guardrailscCsTddlm}|dur|}|siS|}i}|D] }tj|||d||<q|S)a Resolve all policies and return their final guardrails. Useful for debugging and displaying policy configurations. Args: policies: Dictionary of all policies (if None, uses global registry) context: Optional context for evaluating conditions Returns: Dictionary mapping policy names to ResolvedPolicy objects rr*Nr-)r/r+r0r1r r&)rrr+r5r7r rrrget_all_resolved_policies s  z(PolicyResolver.get_all_resolved_policies)N)NN)__name__ __module__ __qualname____doc__ staticmethodstrrr rrrrr r r&r9rrr?rArBrrrrr s   '  >  C  4  r N)rFtypingrrrrrZlitellm._loggingrZ!litellm.types.proxy.policy_enginerr r r r rrrrs