You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "janiussyafiq (via GitHub)" <gi...@apache.org> on 2026/06/29 04:39:24 UTC
[PR] fix(ai-lakera-guard): streaming alert mode honors fail_open on Lakera errors [apisix]
janiussyafiq opened a new pull request, #13622:
URL: https://github.com/apache/apisix/pull/13622
Streaming `action=alert` discarded the response scan's deny result, so a Lakera error/timeout with `fail_open=false` leaked the streamed response instead of failing closed. Alert mode now buffers when `fail_open=false` so errors/timeouts fail closed, while flagged verdicts are still released (shadow mode unchanged). Added streaming alert tests for the error, buffered-release, and `fail_open=true` live paths; docs updated.
Fixes #13619
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(ai-lakera-guard): streaming alert mode honors fail_open on Lakera errors [apisix]
Posted by "janiussyafiq (via GitHub)" <gi...@apache.org>.
janiussyafiq commented on code in PR #13622:
URL: https://github.com/apache/apisix/pull/13622#discussion_r3489758340
##########
apisix/plugins/ai-lakera-guard.lua:
##########
@@ -240,8 +240,7 @@ function _M.lua_body_filter(conf, ctx, headers, body)
end
if ctx.var.request_type == "ai_stream" then
- -- alert (shadow) mode non-blocking
- if conf.action == "alert" then
+ if conf.action == "alert" and conf.fail_open then
Review Comment:
alert mode still take place, however if fail_open=false, then for streaming we will need to buffer the response since in case of a lakera error/timeout we adhere to block the response. if fail_open=true then we don't need to apply that buffering mechanism. WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(ai-lakera-guard): streaming alert mode honors fail_open on Lakera errors [apisix]
Posted by "nic-6443 (via GitHub)" <gi...@apache.org>.
nic-6443 merged PR #13622:
URL: https://github.com/apache/apisix/pull/13622
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(ai-lakera-guard): streaming alert mode honors fail_open on Lakera errors [apisix]
Posted by "nic-6443 (via GitHub)" <gi...@apache.org>.
nic-6443 commented on code in PR #13622:
URL: https://github.com/apache/apisix/pull/13622#discussion_r3489524804
##########
apisix/plugins/ai-lakera-guard.lua:
##########
@@ -240,8 +240,7 @@ function _M.lua_body_filter(conf, ctx, headers, body)
end
if ctx.var.request_type == "ai_stream" then
- -- alert (shadow) mode non-blocking
- if conf.action == "alert" then
+ if conf.action == "alert" and conf.fail_open then
Review Comment:
action and fail_open are two independent functions. Does it make sense that this modification now requires the alert to rely on the fail_open configuration to take effect?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org