ci: install fastapi with litellm; cover guardrail edge paths

Base litellm does not include fastapi (it's in their proxy extra), so
test collection failed with ModuleNotFoundError in CI. Proxy deployments
always ship fastapi; CI now installs it alongside litellm and the test
module skips gracefully without it.

Adds edge-path tests (no-messages data, non-text content parts, opaque
responses, observability failure) bringing the adapter to 100% line
coverage.

Author: sidmohan0

.github/workflows/ci.yml

@@ -58,7 +58,7 @@ jobs:
         if: matrix.install-profile == 'nlp-advanced'
         run: |
           pip install -e ".[test,cli,nlp,nlp-advanced]" -r requirements-test.txt
-          pip install "litellm>=1.90,<2"  # exercises the LiteLLM guardrail adapter tests
+          pip install "litellm>=1.90,<2" fastapi  # exercises the LiteLLM guardrail adapter tests (proxy deployments always have fastapi)
           python -m spacy download en_core_web_lg
           datafog download-model urchade/gliner_multi_pii-v1 --engine gliner
 

datafog/integrations/litellm_guardrail.py

@@ -26,7 +26,8 @@
 Errors and block messages report entity type counts only — matched PII is
 never echoed into logs, exceptions, or proxy responses.
 
-Requires ``litellm`` (this module is not imported by ``datafog`` core).
+Requires ``litellm`` and ``fastapi`` (this module is not imported by
+``datafog`` core; the LiteLLM proxy, where this runs, always ships fastapi).
 """
 
 import logging

tests/test_litellm_guardrail.py

@@ -9,6 +9,7 @@
 import pytest
 
 litellm = pytest.importorskip("litellm")
+pytest.importorskip("fastapi")  # adapter raises fastapi.HTTPException on block
 
 from datafog.integrations.litellm_guardrail import DataFogGuardrail  # noqa: E402
 
@@ -119,6 +120,92 @@ async def test_redacts_model_response(self):
         )
         assert EMAIL not in response.choices[0].message.content
 
+    async def test_response_without_choices_is_returned_untouched(self):
+        guardrail = DataFogGuardrail(guardrail_name="datafog-pii")
+        opaque = object()
+        result = await guardrail.async_post_call_success_hook(
+            data={}, user_api_key_dict=None, response=opaque
+        )
+        assert result is opaque
+
+    async def test_non_text_response_content_is_skipped_not_crashed(self):
+        guardrail = DataFogGuardrail(guardrail_name="datafog-pii")
+        response = _model_response("placeholder")
+        response.choices[0].message.content = [{"type": "tool_use"}]
+        result = await guardrail.async_post_call_success_hook(
+            data={}, user_api_key_dict=None, response=response
+        )
+        assert result.choices[0].message.content == [{"type": "tool_use"}]
+
+    async def test_post_call_fail_open_returns_unredacted_response(self, monkeypatch):
+        guardrail = DataFogGuardrail(guardrail_name="datafog-pii", fail_policy="open")
+        monkeypatch.setattr(
+            "datafog.integrations.litellm_guardrail._redact_text",
+            lambda *a, **k: (_ for _ in ()).throw(RuntimeError("boom")),
+        )
+        response = _model_response(f"reach me at {EMAIL}")
+        result = await guardrail.async_post_call_success_hook(
+            data={}, user_api_key_dict=None, response=response
+        )
+        assert result.choices[0].message.content == f"reach me at {EMAIL}"
+
+
+@pytest.mark.asyncio
+class TestEdgeShapes:
+    async def test_data_without_messages_passes_through(self):
+        guardrail = DataFogGuardrail(guardrail_name="datafog-pii")
+        data = {"input": f"embed {EMAIL}"}
+        result = await guardrail.async_pre_call_hook(
+            user_api_key_dict=None, cache=None, data=data, call_type="aembedding"
+        )
+        assert result == data
+
+    async def test_message_without_content_key_passes_through(self):
+        guardrail = DataFogGuardrail(guardrail_name="datafog-pii")
+        data = {"messages": [{"role": "assistant", "tool_calls": []}]}
+        result = await guardrail.async_pre_call_hook(
+            user_api_key_dict=None, cache=None, data=data, call_type="completion"
+        )
+        assert result == data
+
+    async def test_mixed_content_parts_skips_non_text_and_redacts_text(self):
+        guardrail = DataFogGuardrail(guardrail_name="datafog-pii")
+        data = _chat_data(
+            [
+                {"type": "image_url", "image_url": {"url": "data:image/png;base64,xx"}},
+                {"type": "text", "text": f"card {CARD}"},
+            ]
+        )
+        result = await guardrail.async_pre_call_hook(
+            user_api_key_dict=None, cache=None, data=data, call_type="completion"
+        )
+        parts = result["messages"][0]["content"]
+        assert parts[0]["type"] == "image_url"  # untouched
+        assert CARD not in parts[1]["text"]
+
+    async def test_non_string_non_list_content_passes_through(self):
+        guardrail = DataFogGuardrail(guardrail_name="datafog-pii")
+        data = _chat_data(None)
+        result = await guardrail.async_pre_call_hook(
+            user_api_key_dict=None, cache=None, data=data, call_type="completion"
+        )
+        assert result["messages"][0]["content"] is None
+
+    async def test_logging_helper_failure_never_breaks_traffic(self, monkeypatch):
+        guardrail = DataFogGuardrail(guardrail_name="datafog-pii")
+        monkeypatch.setattr(
+            DataFogGuardrail,
+            "add_standard_logging_guardrail_information_to_request_data",
+            lambda self, **kw: (_ for _ in ()).throw(RuntimeError("obs down")),
+        )
+        data = await guardrail.async_pre_call_hook(
+            user_api_key_dict=None,
+            cache=None,
+            data=_chat_data(f"reach me at {EMAIL}"),
+            call_type="completion",
+        )
+        assert EMAIL not in data["messages"][0]["content"]  # redaction still happened
+
 
 @pytest.mark.asyncio
 class TestConfig: