Fix issue where wildcard policy not engaging for provider

Author: Arshardh

gateway/gateway-controller/pkg/utils/llm_provider_transformer_test.go

@@ -4857,7 +4857,7 @@ func TestTransform_PathMatchingEdgeCases_AllowAll_PolicyMoreGeneral(t *testing.T
 
 func TestTransform_PathMatchingEdgeCases_AllowAll_NestedWildcardPolicies(t *testing.T) {
 	// AllowAll: Multiple nested wildcard policies with no exceptions
-	// All policies should attach to catch-all operations
+	// Broader wildcard policies should also apply to nested wildcard operations
 	transformer, _ := setupTestTransformer(t)
 
 	policies := []api.LLMPolicy{
@@ -4916,8 +4916,9 @@ func TestTransform_PathMatchingEdgeCases_AllowAll_NestedWildcardPolicies(t *test
 	nestedOp := findOperation(spec.Operations, "api/v1/*", "GET")
 	require.NotNil(t, nestedOp, "api/v1/* GET should exist")
 	require.NotNil(t, nestedOp.Policies)
-	assert.Len(t, *nestedOp.Policies, 1)
-	assert.Equal(t, "NestedPolicy", (*nestedOp.Policies)[0].Name)
+	assert.Len(t, *nestedOp.Policies, 2)
+	assert.Equal(t, "TopLevelPolicy", (*nestedOp.Policies)[0].Name)
+	assert.Equal(t, "NestedPolicy", (*nestedOp.Policies)[1].Name)
 
 	// Find api/* operation
 	topOp := findOperation(spec.Operations, "api/*", "GET")

gateway/gateway-controller/pkg/utils/llm_transformer.go

@@ -224,18 +224,11 @@ func (t *LLMProviderTransformer) transformProxy(proxy *api.LLMProxyConfiguration
 
 	// Phase 2: Process User-Defined Policies
 	if proxy.Spec.Policies != nil {
+		registerExplicitLLMPolicyOperations(operationRegistry, *proxy.Spec.Policies, nil)
+
 		for _, llmPol := range *proxy.Spec.Policies {
 			for _, pathEntry := range llmPol.Paths {
-				// Expand wildcard methods in policy
-				var policyMethods []string
-				if len(pathEntry.Methods) == 1 && string(pathEntry.Methods[0]) == "*" {
-					policyMethods = constants.WILDCARD_HTTP_METHODS
-				} else {
-					policyMethods = make([]string, len(pathEntry.Methods))
-					for i, m := range pathEntry.Methods {
-						policyMethods[i] = string(m)
-					}
-				}
+				policyMethods := expandLLMPolicyMethods(pathEntry.Methods)
 
 				for _, policyMethod := range policyMethods {
 					attachedPolicyPaths := make(map[string]bool)
@@ -244,11 +237,7 @@ func (t *LLMProviderTransformer) transformProxy(proxy *api.LLMProxyConfiguration
 					// Create operation if it doesn't exist (dynamic operation creation)
 					key := pathMethodKey{path: pathEntry.Path, method: policyMethod}
 					if _, exists := operationRegistry[key]; !exists {
-						op := &api.Operation{
-							Path:   pathEntry.Path,
-							Method: api.OperationMethod(policyMethod),
-						}
-						operationRegistry[key] = op
+						op := ensureOperation(operationRegistry, pathEntry.Path, policyMethod)
 						methodOperations = append(methodOperations, op)
 					}
 
@@ -451,18 +440,13 @@ func (t *LLMProviderTransformer) transformProvider(provider *api.LLMProviderConf
 
 		// Phase 3: Process User-Defined Policies
 		if provider.Spec.Policies != nil {
+			registerExplicitLLMPolicyOperations(operationRegistry, *provider.Spec.Policies, func(path, method string) bool {
+				return !isDeniedByException(path, method, deniedPathMethods)
+			})
+
 			for _, llmPol := range *provider.Spec.Policies {
 				for _, pathEntry := range llmPol.Paths {
-					// Expand wildcard methods in policy
-					var policyMethods []string
-					if len(pathEntry.Methods) == 1 && string(pathEntry.Methods[0]) == "*" {
-						policyMethods = constants.WILDCARD_HTTP_METHODS
-					} else {
-						policyMethods = make([]string, len(pathEntry.Methods))
-						for i, m := range pathEntry.Methods {
-							policyMethods[i] = string(m)
-						}
-					}
+					policyMethods := expandLLMPolicyMethods(pathEntry.Methods)
 
 					for _, policyMethod := range policyMethods {
 						attachedPolicyPaths := make(map[string]bool)
@@ -477,11 +461,7 @@ func (t *LLMProviderTransformer) transformProvider(provider *api.LLMProviderConf
 						key := pathMethodKey{path: pathEntry.Path, method: policyMethod}
 						if _, exists := operationRegistry[key]; !exists {
 							// Create operation for user policy
-							op := &api.Operation{
-								Path:   pathEntry.Path,
-								Method: api.OperationMethod(policyMethod),
-							}
-							operationRegistry[key] = op
+							op := ensureOperation(operationRegistry, pathEntry.Path, policyMethod)
 							methodOperations = append(methodOperations, op)
 						}
 
@@ -567,18 +547,13 @@ func (t *LLMProviderTransformer) transformProvider(provider *api.LLMProviderConf
 
 		// Phase 3: Process Policies with Dynamic Operation Creation
 		if provider.Spec.Policies != nil {
+			registerExplicitLLMPolicyOperations(operationRegistry, *provider.Spec.Policies, func(path, method string) bool {
+				return isAllowedByAccessControl(path, method, normalizedExceptions)
+			})
+
 			for _, llmPol := range *provider.Spec.Policies {
 				for _, pathEntry := range llmPol.Paths {
-					// Expand wildcard methods in policy
-					var policyMethods []string
-					if len(pathEntry.Methods) == 1 && string(pathEntry.Methods[0]) == "*" {
-						policyMethods = constants.WILDCARD_HTTP_METHODS
-					} else {
-						policyMethods = make([]string, len(pathEntry.Methods))
-						for i, m := range pathEntry.Methods {
-							policyMethods[i] = string(m)
-						}
-					}
+					policyMethods := expandLLMPolicyMethods(pathEntry.Methods)
 
 					for _, policyMethod := range policyMethods {
 						attachedPolicyPaths := make(map[string]bool)
@@ -590,11 +565,7 @@ func (t *LLMProviderTransformer) transformProvider(provider *api.LLMProviderConf
 							key := pathMethodKey{path: pathEntry.Path, method: policyMethod}
 							if _, exists := operationRegistry[key]; !exists {
 								// Create operation for specific policy path covered by wildcard access control
-								op := &api.Operation{
-									Path:   pathEntry.Path,
-									Method: api.OperationMethod(policyMethod),
-								}
-								operationRegistry[key] = op
+								op := ensureOperation(operationRegistry, pathEntry.Path, policyMethod)
 								methodOperations = append(methodOperations, op)
 							}
 						}
@@ -803,6 +774,51 @@ func appendOperationPolicy(op *api.Operation, pol api.Policy) {
 	op.Policies = &existing
 }
 
+// ensureOperation checks if an operation for the given path+method exists in the registry, and creates it if not
+func ensureOperation(operationRegistry map[pathMethodKey]*api.Operation, path, method string) *api.Operation {
+	key := pathMethodKey{path: path, method: method}
+	if op, exists := operationRegistry[key]; exists {
+		return op
+	}
+
+	op := &api.Operation{
+		Path:   path,
+		Method: api.OperationMethod(method),
+	}
+	operationRegistry[key] = op
+	return op
+}
+
+// expandLLMPolicyMethods takes the methods defined in an LLM policy and expands them to actual HTTP methods if wildcard is used
+func expandLLMPolicyMethods(methods []api.LLMPolicyPathMethods) []string {
+	if len(methods) == 1 && string(methods[0]) == constants.WILD_CARD {
+		return append([]string(nil), constants.WILDCARD_HTTP_METHODS...)
+	}
+
+	expanded := make([]string, len(methods))
+	for i, method := range methods {
+		expanded[i] = string(method)
+	}
+	return expanded
+}
+
+// registerExplicitLLMPolicyOperations iterates through the explicitly defined policies in the LLM policy and ensures that operations
+// exist for their paths and methods in the operation registry. The shouldRegister callback allows conditional registration based on
+// path and method (e.g., to skip paths/methods denied by access control exceptions).
+func registerExplicitLLMPolicyOperations(operationRegistry map[pathMethodKey]*api.Operation, policies []api.LLMPolicy,
+	shouldRegister func(path, method string) bool) {
+	for _, llmPol := range policies {
+		for _, pathEntry := range llmPol.Paths {
+			for _, method := range expandLLMPolicyMethods(pathEntry.Methods) {
+				if shouldRegister != nil && !shouldRegister(pathEntry.Path, method) {
+					continue
+				}
+				ensureOperation(operationRegistry, pathEntry.Path, method)
+			}
+		}
+	}
+}
+
 func getOperationsForMethod(operationRegistry map[pathMethodKey]*api.Operation, method string) []*api.Operation {
 	ops := make([]*api.Operation, 0)
 	for key, op := range operationRegistry {

gateway/gateway-controller/pkg/utils/llm_transformer_test.go

@@ -1006,6 +1006,80 @@ func TestTransformProvider_ExpandsWildcardPolicyPathWithTemplateMappings(t *test
 	assert.Equal(t, "value", (*wildcardPolicy.Params)["userParam"])
 }
 
+func TestTransformProvider_PolicyOrderDoesNotAffectWildcardCoverage(t *testing.T) {
+	store := storage.NewConfigStore()
+	db := newTestMockDB()
+	routerConfig := &config.RouterConfig{ListenerPort: 8080}
+	transformer := NewLLMProviderTransformer(store, db, routerConfig, newTestPolicyVersionResolver())
+
+	template := &models.StoredLLMProviderTemplate{
+		UUID: "0000-template-1-0000-000000000001",
+		Configuration: api.LLMProviderTemplate{
+			Metadata: api.Metadata{Name: "openai"},
+			Spec:     api.LLMProviderTemplateData{},
+		},
+	}
+	db.SaveLLMProviderTemplate(template)
+	err := store.AddTemplate(template)
+	require.NoError(t, err)
+
+	upstreamURL := "https://api.openai.com"
+	provider := &api.LLMProviderConfiguration{
+		Metadata: api.Metadata{Name: "openai-provider"},
+		Spec: api.LLMProviderConfigData{
+			DisplayName: "OpenAI Provider",
+			Version:     "1.0.0",
+			Template:    "openai",
+			Upstream: api.LLMProviderConfigData_Upstream{
+				Url: &upstreamURL,
+			},
+			AccessControl: api.LLMAccessControl{Mode: api.AllowAll},
+			Policies: &[]api.LLMPolicy{
+				{
+					Name:    "set-headers-all",
+					Version: "v1",
+					Paths: []api.LLMPolicyPath{{
+						Path:    "/*",
+						Methods: []api.LLMPolicyPathMethods{"POST"},
+						Params:  map[string]interface{}{"scope": "all"},
+					}},
+				},
+				{
+					Name:    "set-headers",
+					Version: "v1",
+					Paths: []api.LLMPolicyPath{{
+						Path:    "/chat/completions",
+						Methods: []api.LLMPolicyPathMethods{"POST"},
+						Params:  map[string]interface{}{"scope": "specific"},
+					}},
+				},
+			},
+		},
+	}
+
+	result, err := transformer.Transform(provider, &api.RestAPI{})
+	require.NoError(t, err)
+	require.NotNil(t, result)
+
+	chatOp := findOperation(result.Spec.Operations, "/chat/completions", "POST")
+	require.NotNil(t, chatOp)
+	require.NotNil(t, chatOp.Policies)
+
+	policyNames := make(map[string]bool)
+	for _, policy := range *chatOp.Policies {
+		policyNames[policy.Name] = true
+	}
+
+	assert.True(t, policyNames["set-headers-all"], "/chat/completions should inherit the wildcard policy")
+	assert.True(t, policyNames["set-headers"], "/chat/completions should keep its specific policy")
+
+	wildcardOp := findOperation(result.Spec.Operations, "/*", "POST")
+	require.NotNil(t, wildcardOp)
+	require.NotNil(t, wildcardOp.Policies)
+	assert.Len(t, *wildcardOp.Policies, 1)
+	assert.Equal(t, "set-headers-all", (*wildcardOp.Policies)[0].Name)
+}
+
 func TestTransformProvider_WithUpstreamAuth(t *testing.T) {
 	store := storage.NewConfigStore()
 	db := newTestMockDB()