refactor: extract _check_shield_moderation helper, fix integration tests

Move the moderation logic out of infer_endpoint into a private helper
to avoid increasing the function's cyclomatic complexity (stays at C 13).

Add shield moderation mock to the integration tests so they don't hit
the real run_shield_moderation path with non-async client mocks.

Signed-off-by: Major Hayden <major@redhat.com>

Author: major

src/app/endpoints/rlsapi_v1.py

@@ -319,6 +319,63 @@ def _queue_splunk_event(  # pylint: disable=too-many-arguments,too-many-position
     background_tasks.add_task(send_splunk_event, event, sourcetype)
 
 
+async def _check_shield_moderation(
+    input_text: str,
+    request_id: str,
+    background_tasks: BackgroundTasks,
+    infer_request: RlsapiV1InferRequest,
+    request: Request,
+) -> Optional[RlsapiV1InferResponse]:
+    """Run shield moderation and return a refusal response if blocked.
+
+    Uses all configured shields in Llama Stack. When no shields are
+    registered, moderation is a no-op and returns None immediately.
+
+    Args:
+        input_text: The combined user input to moderate.
+        request_id: Unique identifier for the request.
+        background_tasks: FastAPI background tasks for async Splunk event sending.
+        infer_request: The original inference request (for Splunk event context).
+        request: The FastAPI request object (for Splunk event context).
+
+    Returns:
+        An RlsapiV1InferResponse containing the refusal message if the input
+        was blocked, or None if moderation passed.
+    """
+    client = AsyncLlamaStackClientHolder().get_client()
+    moderation_result = await run_shield_moderation(client, input_text)
+
+    if moderation_result.decision != "blocked":
+        return None
+
+    logger.info(
+        "Request %s blocked by shield moderation: %s",
+        request_id,
+        moderation_result.message,
+    )
+    _queue_splunk_event(
+        background_tasks,
+        infer_request,
+        request,
+        request_id,
+        moderation_result.message,
+        0.0,
+        "infer_shield_blocked",
+    )
+    return RlsapiV1InferResponse(
+        data=RlsapiV1InferData(
+            text=moderation_result.message,
+            request_id=request_id,
+            tool_calls=None,
+            tool_results=None,
+            rag_chunks=None,
+            referenced_documents=None,
+            input_tokens=None,
+            output_tokens=None,
+        )
+    )
+
+
 def _record_inference_failure(  # pylint: disable=too-many-arguments,too-many-positional-arguments
     background_tasks: BackgroundTasks,
     infer_request: RlsapiV1InferRequest,
@@ -451,36 +508,11 @@ async def infer_endpoint(  # pylint: disable=R0914
 
     # Run shield moderation on user input before inference.
     # Uses all configured shields; no-op when no shields are registered.
-    client = AsyncLlamaStackClientHolder().get_client()
-    moderation_result = await run_shield_moderation(client, input_source)
-
-    if moderation_result.decision == "blocked":
-        logger.info(
-            "Request %s blocked by shield moderation: %s",
-            request_id,
-            moderation_result.message,
-        )
-        _queue_splunk_event(
-            background_tasks,
-            infer_request,
-            request,
-            request_id,
-            moderation_result.message,
-            0.0,
-            "infer_shield_blocked",
-        )
-        return RlsapiV1InferResponse(
-            data=RlsapiV1InferData(
-                text=moderation_result.message,
-                request_id=request_id,
-                tool_calls=None,
-                tool_results=None,
-                rag_chunks=None,
-                referenced_documents=None,
-                input_tokens=None,
-                output_tokens=None,
-            )
-        )
+    blocked_response = await _check_shield_moderation(
+        input_source, request_id, background_tasks, infer_request, request
+    )
+    if blocked_response is not None:
+        return blocked_response
 
     start_time = time.monotonic()
 

tests/integration/endpoints/test_rlsapi_v1_integration.py

@@ -32,6 +32,7 @@
 from models.rlsapi.responses import RlsapiV1InferResponse
 from tests.unit.utils.auth_helpers import mock_authorization_resolvers
 from utils.suid import check_suid
+from utils.types import ShieldModerationPassed
 from version import __version__
 
 # ==========================================
@@ -80,6 +81,15 @@ def mock_authorization_fixture(mocker: MockerFixture) -> None:
     mock_authorization_resolvers(mocker)
 
 
+@pytest.fixture(autouse=True, name="mock_shield_passed")
+def mock_shield_passed_fixture(mocker: MockerFixture) -> None:
+    """Mock shield moderation to pass for all integration tests."""
+    mocker.patch(
+        "app.endpoints.rlsapi_v1.run_shield_moderation",
+        new=mocker.AsyncMock(return_value=ShieldModerationPassed()),
+    )
+
+
 def _create_mock_response_output(mocker: MockerFixture, text: str) -> Any:
     """Create a mock Responses API output item with assistant message."""
     mock_output_item = mocker.Mock()