Re: [PR] docs: clarify AI request protocol handling [apisix]

["Santoshkumarpuppala (via GitHub)" <gi...@apache.org>]

Santoshkumarpuppala commented on PR #13731:
URL: https://github.com/apache/apisix/pull/13731#issuecomment-5585871422

   Checked this against `master` while reading the new protocol paragraph. The Embeddings sentence describes a case that does not pass through — it short-circuits.
   
   `ai-prompt-guard.lua:162-164`, inside `_M.access`:
   
   ```lua
   if #messages == 0 then --nothing to check
       return 200
   end
   ```
   
   `plugin.lua:1397-1410` hands any non-nil code to `core.response.exit`, and `response.lua:126-134` calls `ngx_exit(code)` unconditionally — the `>= 400` branch only adds tracing. The client gets an empty 200 and the upstream is never called.
   
   Two controls in this repo settle the semantics rather than my reading of them: `cors.lua:338-339` uses `return 200` deliberately to end an OPTIONS preflight, and `ai-lakera-guard.lua:104-106` uses a bare `return` for the identical "no messages" condition.
   
   So the added line is wrong as written. `openai-embeddings.lua:109-117` returns `{}` for a table-typed `input`, so "an array of input strings is not inspected" is really "an array of input strings is answered with an empty 200, and the provider never sees it". Same for `字符串数组形式的输入不会被检查`.
   
   The fix is `return` instead of `return 200`. If you would rather keep this PR to docs, the paragraph needs one sentence saying what happens when the selected content set comes out empty.
   
   Worth pinning either way: `t/plugin/ai-prompt-guard.t` TEST 9 is titled "it will pass for non user" and asserts neither `--- response_body` nor `--- error_code`, so it passes whether the request is proxied or cut off — and TEST 8 configures `match_all_roles=false`, which is exactly the path that reaches `return 200`. TESTs 3, 6, 14, 20, 23 and 26 have the same gap. `t/plugin/ai-lakera-guard.t` already asserts `--- error_code: 200` with `--- response_body_like` on its allow paths, so adding `--- response_body` / `hello world` (`t/lib/server.lua:74-79`) follows a convention already here.
   
   Happy to open the one-line fix with those test assertions if that is useful.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org