mirror of
https://github.com/netbirdio/netbird.git
synced 2026-07-23 17:01:29 +02:00
c48347c51e
Add an always-on (no-credentials) e2e regression guard for the report
that a model-allowlist guardrail attached to a policy has no effect for
PATH-ROUTED providers, where the model travels in the URL rather than the
JSON body: Google Vertex (…/models/{model}:rawPredict) and AWS Bedrock
(/model/{id}/invoke).
Each provider is tested in isolation: its own provider, its own guardrail
whose allowlist holds only that provider's allowed model, and its own
policy — so the guardrail the proxy enforces is never a mixed
cross-provider list. Over the tunnel, the allowed model (in the URL path)
is served 200 and an unselected model is denied 403 by the guardrail
(llm_policy.model_blocked) before the upstream. The Vertex case mirrors
the customer verbatim (allow Sonnet; the unselected model is the exact
claude-opus-4-6 they reported reaching unblocked); the Bedrock case sends
a region-prefixed, versioned inference-profile id so URL-path model
normalization is exercised too.
The provider is catch-all, so the router forwards any model and a 403 can
only be the guardrail, never model_not_routable. Only the upstream LLM is
mocked (the vLLM nginx answers any path 200); management synth/reconcile,
the proxy middleware chain (URL-path model extraction, router, guardrail)
and the tunnel are all real, and the guardrail denies before the upstream
is dialed so the mock cannot influence the block. A static bearer api key
makes the router inject a static Authorization header instead of minting a
GCP token, so the test runs with no credentials and always executes.