fix(decisions)!: refuse safety_identifier on providers that cannot take it unless drop_params drops it

litellm/decisions/main.py

@@ -1,13 +1,13 @@
 from collections.abc import Mapping, Sequence
-from dataclasses import dataclass, field
+from dataclasses import dataclass, field, replace
 from typing import Final, TypeAlias
 
 import httpx
-from pydantic import TypeAdapter, ValidationError
+from pydantic import ConfigDict, TypeAdapter, ValidationError
 from typing_extensions import assert_never
 
 import litellm
-from litellm.litellm_core_utils.core_helpers import RESPONSE_COST_HEADER
+from litellm.litellm_core_utils.core_helpers import RESPONSE_COST_HEADER, normalize_drop_params
 from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
 from litellm.llms.base_llm.chat.transformation import BaseLLMException
 from litellm.llms.base_llm.decisions.transformation import (
@@ -40,6 +40,9 @@
 
 _SYSTEMONE_REQUEST_ADAPTER: Final[TypeAdapter[DecisionsRequestBody]] = TypeAdapter(DecisionsRequestBody)
 _OPENAI_REQUEST_ADAPTER: Final[TypeAdapter[OpenAIDecisionRequestBody]] = TypeAdapter(OpenAIDecisionRequestBody)
+_SAFETY_IDENTIFIER_ADAPTER: Final[TypeAdapter[str | None]] = TypeAdapter(
+    str | None, config=ConfigDict(title="safety_identifier")
+)
 _HANDLER: Final = BaseLLMHTTPHandler()
 
 
@@ -96,16 +99,46 @@ def _validate_request(
     )
 
 
-def _ir_request(request: DecisionsRequestFormat) -> DecisionsIRRequest:
+def _ir_request(request: DecisionsRequestFormat, safety_identifier: str | None) -> DecisionsIRRequest:
     match request:
         case DecisionsRequestBody():
-            return systemone_request_to_ir(request)
+            return replace(systemone_request_to_ir(request), safety_identifier=safety_identifier)
         case OpenAIDecisionRequestBody():
             return openai_request_to_ir(request)
         case _:
             assert_never(request)
 
 
+def _drops_params(kwargs: Mapping[str, object]) -> bool:
+    return litellm.drop_params is True or normalize_drop_params(kwargs.get("drop_params")) is True
+
+
+def _request_safety_identifier(safety_identifier: object, kwargs: Mapping[str, object]) -> str | None:
+    if isinstance(safety_identifier, str) or not _drops_params(kwargs):
+        return _SAFETY_IDENTIFIER_ADAPTER.validate_python(safety_identifier)
+    return None
+
+
+@dataclass(frozen=True, slots=True)
+class _UnsupportedSafetyIdentifier:
+    pass
+
+
+def _provider_ir_request(
+    request: DecisionsRequestFormat,
+    *,
+    safety_identifier: str | None,
+    provider_config: BaseDecisionsConfig,
+    kwargs: Mapping[str, object],
+) -> DecisionsIRRequest | _UnsupportedSafetyIdentifier:
+    ir_request: Final = _ir_request(request, safety_identifier)
+    if ir_request.safety_identifier is None or provider_config.supports_safety_identifier:
+        return ir_request
+    if _drops_params(kwargs):
+        return replace(ir_request, safety_identifier=None)
+    return _UnsupportedSafetyIdentifier()
+
+
 def _prepare_call(
     *,
     model: str,
@@ -144,8 +177,12 @@ def _prepare_call(
     except ValueError as error:
         raise litellm.BadRequestError(message=str(error), model=model, llm_provider=provider) from error
     try:
+        request_safety_identifier: Final = _request_safety_identifier(safety_identifier, kwargs)
         request: Final = _validate_request(
-            state=state, questions=questions, decision_input=decision_input, safety_identifier=safety_identifier
+            state=state,
+            questions=questions,
+            decision_input=decision_input,
+            safety_identifier=request_safety_identifier,
         )
     except ValidationError as error:
         raise litellm.BadRequestError(
@@ -169,7 +206,22 @@ def _prepare_call(
             llm_provider=provider,
         )
 
-    ir_request: Final = _ir_request(request)
+    ir_request: Final = _provider_ir_request(
+        request,
+        safety_identifier=request_safety_identifier,
+        provider_config=provider_config,
+        kwargs=kwargs,
+    )
+    if isinstance(ir_request, _UnsupportedSafetyIdentifier):
+        raise litellm.UnsupportedParamsError(
+            message=(
+                f"{provider} does not support parameters: ['safety_identifier'], for model={model}. "
+                "To drop these, set `litellm.drop_params=True` or for proxy:\n\n"
+                "`litellm_settings:\n drop_params: true`\n"
+            ),
+            model=model,
+            llm_provider=provider,
+        )
     body: Final = provider_config.transform_decisions_request(
         model=canonical_model, request=ir_request, custom_llm_provider=provider
     )

litellm/llms/base_llm/decisions/transformation.py

@@ -301,6 +301,7 @@ class BaseDecisionsConfig(ABC):
     api_key_env: tuple[str, ...] = ()
     api_base_env: tuple[str, ...] = ()
     api_key_required: bool = True
+    supports_safety_identifier: bool = False
     health_check_questions: Mapping[str, Mapping[str, object]] = MappingProxyType(
         {"reachable": MappingProxyType({"type": "noul", "instructions": "Is the service reachable?"})}
     )

litellm/llms/openai/decisions/transformation.py

@@ -292,6 +292,7 @@ def ir_to_openai_response(
 
 class OpenAIDecisionsConfig(BaseDecisionsConfig):
     path = "/v1/decisions"
+    supports_safety_identifier = True
 
     def get_default_api_base(self) -> str | None:
         return "https://api.openai.com"

litellm/proxy/decisions_endpoints/endpoints.py

@@ -1,4 +1,5 @@
 from collections.abc import Mapping
+from types import MappingProxyType
 from typing import Annotated, Final
 
 from fastapi import APIRouter, Depends, Request, Response
@@ -38,6 +39,10 @@ async def _invalid_request(
     )
 
 
+def _fields_checked_before_routing(data: Mapping[str, object]) -> Mapping[str, object]:
+    return MappingProxyType({key: value for key, value in data.items() if key != "safety_identifier"})
+
+
 async def _request_data(request: Request, user_api_key_dict: UserAPIKeyAuth) -> dict[str, object]:
     body: Final = await request.body()
     try:
@@ -75,7 +80,7 @@ async def _process_decisions(
 
     data: Final = await _request_data(request, user_api_key_dict)
     try:
-        body_adapter.validate_python(data)
+        body_adapter.validate_python(_fields_checked_before_routing(data))
     except ValidationError as error:
         raise await _invalid_request(raw_data=data, error=error, user_api_key_dict=user_api_key_dict)
     general_settings: Final = _GENERAL_SETTINGS_ADAPTER.validate_python(proxy_general_settings)

tests/integration/providers/test_databricks_decisions_wire.py

@@ -208,7 +208,6 @@ def test_an_openai_format_request_at_v1_decisions_reaches_the_serving_endpoint_a
                 "model": deployment,
                 "input": _OPENAI_INPUT,
                 "questions": [_OPENAI_TIER_QUESTION],
-                "safety_identifier": "end-user-1",
             },
         )
         assert response.status_code == 200, response.text