feat: add guardrails

.gitignore

@@ -24,6 +24,10 @@ config.yaml
 .vscode/
 .DS_Store
 
+# Documentation
+docs/
+.claude/
+
 prd/
 memory-bank/
 .cursor/

Cargo.toml

@@ -58,6 +58,7 @@ utoipa = { version = "5.0.0", features = ["axum_extras", "chrono", "uuid", "open
 utoipa-swagger-ui = { version = "8", features = ["axum"] }
 utoipa-scalar = { version = "0.3.0", features = ["axum"] }
 log = "0.4"
+thiserror = "2"
 
 [lib]
 name = "hub_lib"
@@ -72,6 +73,9 @@ tempfile = "3.8"
 testcontainers = "0.20.0"
 testcontainers-modules = { version = "0.8.0", features = ["postgres"] }
 axum-test = "17"
+temp-env = "0.3"
 sqlx = { version = "0.8", features = ["runtime-tokio", "postgres", "migrate"] }
 tokio = { version = "1.45.0", features = ["full"] }
 reqwest = { version = "0.12", features = ["json"] }
+opentelemetry = { version = "0.27" }
+opentelemetry_sdk = { version = "0.27", features = ["testing"] }

config-example.yaml

@@ -94,6 +94,9 @@ pipelines:
   # Default pipeline for chat completions
   - name: default
     type: chat
+    guards:  # Optional: reference guards by name (defined in guardrails section below)
+      - pii-check
+      - injection-check
     plugins:
       - logging:
           level: info  # Supported levels: debug, info, warning, error
@@ -125,3 +128,36 @@ pipelines:
       - model-router:
           models:  # List the models you want to use for embeddings
             - textembedding-gecko
+
+guardrails:
+  providers:
+    - name: traceloop
+      api_base: ${TRACELOOP_BASE_URL}  # or use direct URL
+      api_key: ${TRACELOOP_API_KEY}  # or use "<your-api-key>"
+  guards:
+    # PII Detection - Pre-call guard
+    - name: pii-check
+      provider: traceloop
+      evaluator_slug: pii-detector
+      mode: pre_call  # Runs before the model call
+      on_failure: block  # Options: block, warn
+      required: true  # If true, request fails if guard is unavailable
+
+    # Prompt Injection Detection - Pre-call guard
+    - name: injection-check
+      provider: traceloop
+      evaluator_slug: prompt-injection
+      params:
+        threshold: 0.8
+      mode: pre_call
+      on_failure: block
+      required: false
+
+    # Toxicity Detection - Post-call guard
+    - name: toxicity-filter
+      provider: traceloop
+      evaluator_slug: toxicity-detector
+      params:
+        threshold: 0.8
+      mode: post_call  # Runs after the model call
+      on_failure: block

src/config/lib.rs

@@ -1,3 +1,4 @@
+use crate::guardrails::types::GuardrailsConfig;
 use crate::types::{GatewayConfig, ModelConfig, Pipeline, PipelineType, PluginConfig, Provider};
 use serde::Deserialize;
 use std::sync::OnceLock;
@@ -11,6 +12,8 @@ struct YamlCompatiblePipeline {
     r#type: PipelineType,
     #[serde(with = "serde_yaml::with::singleton_map_recursive")]
     plugins: Vec<PluginConfig>,
+    #[serde(default)]
+    guards: Vec<String>,
     #[serde(default = "default_enabled_true_lib")]
     #[allow(dead_code)]
     enabled: bool, // Keep for YAML parsing, but won't be mapped to core Pipeline
@@ -31,6 +34,8 @@ struct YamlRoot {
     models: Vec<ModelConfig>,
     #[serde(default)]
     pipelines: Vec<YamlCompatiblePipeline>,
+    #[serde(default)]
+    guardrails: Option<GuardrailsConfig>,
 }
 
 fn substitute_env_vars(content: &str) -> Result<String, Box<dyn std::error::Error>> {
@@ -83,11 +88,12 @@ pub fn load_config(path: &str) -> Result<GatewayConfig, Box<dyn std::error::Erro
                     name: p_yaml.name,
                     r#type: p_yaml.r#type,
                     plugins: p_yaml.plugins,
-                    // p_yaml.enabled is parsed from YAML but not stored in core Pipeline struct
+                    guards: p_yaml.guards,
                 }
             })
             .collect(),
         general: None,
+        guardrails: yaml_root.guardrails,
     };
     let _ = TRACE_CONTENT_ENABLED.set(
         gateway_config