| 105 | } |
| 106 | |
| 107 | func validateAgentTenantLimits(req types.AIRequest, tenant config.TenantConfig) error { |
| 108 | if !strings.EqualFold(strings.TrimSpace(req.RequestType), types.RequestTypeAgent) { |
| 109 | return nil |
| 110 | } |
| 111 | if req.Context == nil { |
| 112 | return nil |
| 113 | } |
| 114 | if tenant.MaxSteps > 0 { |
| 115 | if v, ok := toInt(req.Context["max_steps"]); ok && v > tenant.MaxSteps { |
| 116 | return fmt.Errorf("agent max_steps %d exceeds tenant limit %d", v, tenant.MaxSteps) |
| 117 | } |
| 118 | } |
| 119 | if tenant.MaxToolCalls > 0 { |
| 120 | if v, ok := toInt(req.Context["max_tool_calls"]); ok && v > tenant.MaxToolCalls { |
| 121 | return fmt.Errorf("agent max_tool_calls %d exceeds tenant limit %d", v, tenant.MaxToolCalls) |
| 122 | } |
| 123 | } |
| 124 | if tenant.MaxAgentCost > 0 { |
| 125 | if v, ok := toFloat(req.Context["estimated_agent_cost"]); ok && v > tenant.MaxAgentCost { |
| 126 | return fmt.Errorf("estimated agent cost %.2f exceeds tenant limit %.2f", v, tenant.MaxAgentCost) |
| 127 | } |
| 128 | } |
| 129 | if len(tenant.AllowedTools) > 0 { |
| 130 | raw, ok := req.Context["tools"].([]any) |
| 131 | if ok && len(raw) > 0 { |
| 132 | allowed := make(map[string]struct{}, len(tenant.AllowedTools)) |
| 133 | for _, t := range tenant.AllowedTools { |
| 134 | allowed[strings.TrimSpace(t)] = struct{}{} |
| 135 | } |
| 136 | for _, x := range raw { |
| 137 | s, _ := x.(string) |
| 138 | s = strings.TrimSpace(s) |
| 139 | if s == "" { |
| 140 | continue |
| 141 | } |
| 142 | if _, ok := allowed[s]; !ok { |
| 143 | return fmt.Errorf("tool %q is not in tenant allowed_tools", s) |
| 144 | } |
| 145 | } |
| 146 | } |
| 147 | } |
| 148 | if tenant.AgentTimeoutMS > 0 { |
| 149 | if v, ok := toInt(req.Context["agent_timeout_ms"]); ok && v > tenant.AgentTimeoutMS { |
| 150 | return fmt.Errorf("agent_timeout_ms %d exceeds tenant limit %d", v, tenant.AgentTimeoutMS) |
| 151 | } |
| 152 | } |
| 153 | return nil |
| 154 | } |
| 155 | |
| 156 | func toInt(v any) (int, bool) { |
| 157 | switch t := v.(type) { |