[PR] Let view.hide decide, and take a request's hide only when view.hide_override is on [skywalking-ai-sessionizer]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng opened a new pull request, #54:
URL: https://github.com/apache/skywalking-ai-sessionizer/pull/54

   @ArnauSB, this changes the `hide` parameter you added in #51. Please take a look.
   
   ## Why
   
   Today `view.hide` is only a minimum. Any request can add names with the `hide` parameter, and there is no setting to turn the parameter off. An operator who configures `view.hide` should be the one who decides what the instance withholds. A request should change that only when the operator allows it.
   
   ## What
   
   - **`view.hide` is the whole answer by default.** A request that carries `hide` is refused with status 400, whatever it names, `hide=` included. Serving it anything else would not be what it asked for. The error says that `view.hide` decides, and that `view.hide_override` lets a request replace it.
   - **New setting `view.hide_override`, default `false`.** When it is on, a request's `hide` replaces `view.hide` for that request. This is a replacement, not an addition, so a host that serves the API through its own route decides what each reader is kept from. A request with no `hide` is served what `view.hide` says, and `hide=` with no name withholds nothing.
   - The rules that did not change: names that cannot be withheld, `hide` spelled another way (`Hide`, `hide[]`), and a query that does not parse are still refused. A reader that withholds anything is still served no provider body.
   - `asz view` and `asz server` print at start-up when the override is on.
   - The asz.view page shows the refusal as its error when its address carries `hide` on an instance that does not take it.
   - Updated: `asz.yaml`, the configuration, asz.view, command-line and command-line internals pages, and the 0.6.0 changes. Withholding is not released yet, so the change to its default is folded into the existing 0.6.0 entries.
   
   ## Validation
   
   - `make check` passes: vet, lint, license headers, dependency licenses, and all tests.
   - Tests updated and added:
     - `internal/view/withhold_test.go`: refused by default, including `hide=`; the instance setting applies when a request sets no `hide`; with the override on, `hide` replaces it and `hide=` withholds nothing.
     - `internal/config/config_test.go`: `hide_override` loads, and a misspelling of it is refused.
     - The LangChain withholding tests run on an instance that takes the parameter.
   - Run against a built `asz view` over the `prompt-snapshot-withheld` scenario, under four configurations:
   
     | Configuration | `/view` | `?hide=system_prompt` | `?hide=tool_schemas` | `?hide=` |
     | --- | --- | --- | --- | --- |
     | default | nothing withheld | 400 | 400 | 400 |
     | `hide: [system_prompt]` | system_prompt | 400 | 400 | 400 |
     | `hide: [system_prompt]`, `hide_override: true` | system_prompt | system_prompt | tool_schemas only | nothing withheld |
     | `hide_override: true` | nothing withheld | system_prompt | tool_schemas | nothing withheld |
   
     The page at `/c/{id}?hide=system_prompt` on the default instance shows the refusal as its error.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Let view.hide decide, and take a request's hide only when view.hide_override is on [skywalking-ai-sessionizer]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng merged PR #54:
URL: https://github.com/apache/skywalking-ai-sessionizer/pull/54


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org