src/app/endpoints/rlsapi_v1.py (1)

464-483: Consider extracting shared response creation logic.

The verbose path duplicates the client.responses.create() call that exists in retrieve_simple_response(). Consider refactoring to avoid duplication.

♻️ Proposed refactor to reduce duplication

 async def retrieve_simple_response(
     question: str,
     instructions: str,
     tools: Optional[list[Any]] = None,
     model_id: Optional[str] = None,
-) -> str:
+    return_full_response: bool = False,
+) -> str | OpenAIResponseObject:
     """Retrieve a simple response from the LLM for a stateless query.
-
-    Uses the Responses API for simple stateless inference, consistent with
-    other endpoints (query, streaming_query).
-
-    Args:
-        question: The combined user input (question + context).
-        instructions: System instructions for the LLM.
-        tools: Optional list of MCP tool definitions for the LLM.
-        model_id: Fully qualified model identifier in provider/model format.
-            When omitted, the configured default model is used.
-
-    Returns:
-        The LLM-generated response text.
-
-    Raises:
-        APIConnectionError: If the Llama Stack service is unreachable.
-        HTTPException: 503 if no default model is configured.
+    ...
+    Args:
+        ...
+        return_full_response: If True, return the full OpenAIResponseObject.
+
+    Returns:
+        The LLM-generated response text, or full response object if requested.
     """
     client = AsyncLlamaStackClientHolder().get_client()
     resolved_model_id = model_id or await _get_default_model_id()
     logger.debug("Using model %s for rlsapi v1 inference", resolved_model_id)

     response = await client.responses.create(
         input=question,
         model=resolved_model_id,
         instructions=instructions,
         tools=tools or [],
         stream=False,
         store=False,
     )
     response = cast(OpenAIResponseObject, response)
-    extract_token_usage(response.usage, resolved_model_id)
 
-    return extract_text_from_response_items(response.output)
+    if return_full_response:
+        return response
+
+    extract_token_usage(response.usage, resolved_model_id)
+    return extract_text_from_response_items(response.output)

Then in infer_endpoint:

-        if verbose_enabled:
-            client = AsyncLlamaStackClientHolder().get_client()
-            response = await client.responses.create(
-                input=input_source,
-                model=model_id,
-                instructions=instructions,
-                tools=mcp_tools or [],
-                stream=False,
-                store=False,
-            )
-            response = cast(OpenAIResponseObject, response)
-            response_text = extract_text_from_response_items(response.output)
-        else:
-            response = None
-            response_text = await retrieve_simple_response(...)
+        if verbose_enabled:
+            response = await retrieve_simple_response(
+                input_source, instructions, tools=mcp_tools,
+                model_id=model_id, return_full_response=True
+            )
+            response = cast(OpenAIResponseObject, response)
+            response_text = extract_text_from_response_items(response.output)
+        else:
+            response = None
+            response_text = await retrieve_simple_response(
+                input_source, instructions, tools=mcp_tools, model_id=model_id
+            )

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/app/endpoints/rlsapi_v1.py` around lines 464 - 483, The verbose and
non-verbose branches duplicate the client.responses.create call; refactor by
extracting the shared response-creation logic into a single helper (for example
a new function used by infer_endpoint and retrieve_simple_response) that calls
AsyncLlamaStackClientHolder().get_client().responses.create with parameters
(input_source, model_id, instructions, tools, stream, store) and returns the
response object/text; then have infer_endpoint call that helper (or have
retrieve_simple_response delegate to it) and remove the duplicated
client.responses.create usage in the verbose branch so both paths share the same
implementation.

tests/unit/app/endpoints/test_rlsapi_v1.py (1)

650-702: Add the missing dual-opt-in negative-path test.

This covers the happy path well, but it should also verify that metadata is not returned when include_metadata=True and allow_verbose_infer=False (to lock in the dual-gate contract).

Suggested test addition

+async def test_infer_include_metadata_ignored_when_verbose_infer_disabled(
+    mocker: MockerFixture,
+    mock_configuration: AppConfig,
+    mock_auth_resolvers: None,
+) -> None:
+    """Metadata should remain excluded unless both request and config opt in."""
+    custom_mock = mocker.Mock()
+    custom_mock.allow_verbose_infer = False
+    custom_mock.system_prompt = "You are a helpful assistant."
+    config_mock = mocker.Mock()
+    config_mock.inference = mock_configuration.inference
+    config_mock.customization = custom_mock
+    mocker.patch("app.endpoints.rlsapi_v1.configuration", config_mock)
+
+    mock_response = mocker.Mock()
+    mock_response.output = [
+        _create_mock_response_output(mocker, "Response with metadata disabled.")
+    ]
+    mock_usage = mocker.Mock()
+    mock_usage.input_tokens = 99
+    mock_usage.output_tokens = 11
+    mock_response.usage = mock_usage
+    _setup_responses_mock(mocker, mocker.AsyncMock(return_value=mock_response))
+
+    infer_request = RlsapiV1InferRequest(
+        question="How do I list files?", include_metadata=True
+    )
+    mock_request = _create_mock_request(mocker)
+    mock_background_tasks = _create_mock_background_tasks(mocker)
+
+    response = await infer_endpoint(
+        infer_request=infer_request,
+        request=mock_request,
+        background_tasks=mock_background_tasks,
+        auth=MOCK_AUTH,
+    )
+
+    assert response.data.tool_calls is None
+    assert response.data.tool_results is None
+    assert response.data.rag_chunks is None
+    assert response.data.referenced_documents is None
+    assert response.data.input_tokens is None
+    assert response.data.output_tokens is None

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/unit/app/endpoints/test_rlsapi_v1.py` around lines 650 - 702, Add a new
unit test mirroring test_infer_include_metadata_returns_verbose_response but
with the module-level configuration's customization.allow_verbose_infer set to
False; construct an RlsapiV1InferRequest(include_metadata=True), call
infer_endpoint (same mocks as the existing test), and assert the returned
RlsapiV1InferResponse does NOT include metadata fields (tool_calls,
tool_results, rag_chunks, referenced_documents) and that token fields are absent
or zero as appropriate, ensuring the dual-opt-in behavior enforced by
configuration.customization.allow_verbose_infer is validated.

tests/unit/app/endpoints/test_rlsapi_v1.py (2)

656-708: Add a serialized-shape assertion for the verbose path.

You already validate non-None fields; consider also asserting the serialized data keys to pin the public payload contract end-to-end.

Suggested test hardening

     assert response.data.input_tokens == 42
     assert response.data.output_tokens == 18
+    data_keys = set(response.model_dump(exclude_none=True)["data"].keys())
+    assert data_keys == {
+        "text",
+        "request_id",
+        "tool_calls",
+        "tool_results",
+        "rag_chunks",
+        "referenced_documents",
+        "input_tokens",
+        "output_tokens",
+    }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/unit/app/endpoints/test_rlsapi_v1.py` around lines 656 - 708, Add a
serialized-shape assertion in
test_infer_include_metadata_returns_verbose_response to lock the public payload
keys by converting the returned response data to its dict/serialized form (e.g.,
via response.data.dict() or response.dict()["data"]) and asserting the expected
set of keys is present; specifically ensure keys like "text", "request_id",
"tool_calls", "tool_results", "rag_chunks", "referenced_documents",
"input_tokens", and "output_tokens" are included alongside any other mandatory
keys your API returns so the verbose path contract is asserted end-to-end.

---

710-753: Also assert key omission when include_metadata=True but config disables verbose.

This branch is the security/compatibility edge of dual opt-in; adding a serialized-key check ensures metadata is truly excluded in output, not just None in the model instance.

Suggested assertion to lock response shape

     assert response.data.input_tokens is None
     assert response.data.output_tokens is None
+    data_keys = set(response.model_dump(exclude_none=True)["data"].keys())
+    assert data_keys == {
+        "text",
+        "request_id",
+    }, f"Expected only text and request_id, got {data_keys}"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/unit/app/endpoints/test_rlsapi_v1.py` around lines 710 - 753, The test
test_infer_include_metadata_ignored_when_verbose_infer_disabled should also
assert that the serialized response omits metadata keys, not just that model
attributes are None; after calling infer_endpoint, serialize the response (e.g.,
response.dict() or response.json() into a dict) and assert that keys
["tool_calls","tool_results","rag_chunks","referenced_documents","input_tokens","output_tokens"]
are not present under the "data" object; update this test to perform that
serialized-key absence check so infer_endpoint / RlsapiV1InferRequest behavior
is enforced end-to-end.