fix(noma-v2): fall back to key_alias for application_id in Noma dashboard

[bse-ai]

Relevant issues

Fixes #25794

Summary

Noma v1 resolved application_id from user_api_key_alias when no explicit value was set (PR #16832). Noma v2 (PR #21400) was rewritten from scratch and this fallback was not ported, causing all requests from shared LiteLLM instances to appear as a single generic "litellm" application in the Noma dashboard.

This matters for closed-source clients (e.g. Claude Code) that can't inject application_id per-request, and for shared LiteLLM instances where a global env var doesn't distinguish between users/services.

Fix: In apply_guardrail(), after checking dynamic_params.application_id and self.application_id, fall back to user_api_key_alias from litellm_metadata or metadata — matching the resolution pattern in PromptSecurityGuardrail._resolve_key_alias_from_request_data().

Fallback chain (after fix):

1. dynamic_params["application_id"] (per-request override)
2. self.application_id (config/env var)
3. litellm_metadata["user_api_key_alias"] (set by guardrail framework)
4. metadata["user_api_key_alias"] (set by proxy_server.py)
5. Omitted from payload (no fallback available)

Pre-Submission checklist

• Tests added in tests/litellm/ directory (4 tests: litellm_metadata fallback, metadata fallback, config precedence, no-fallback omission)
• All unit tests pass — 29 passed in 1.04s
• PR scope is isolated to one specific problem

Type

🐛 Bug Fix

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Apr 15, 2026 4:23pm

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Brendan Smith-Elion seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR ports the user_api_key_alias → application_id fallback from the Noma v1 guardrail to v2, ensuring per-key traceability in the Noma dashboard when no explicit application_id is configured. The fix is a targeted 9-line addition to apply_guardrail() that mirrors the existing resolution pattern in PromptSecurityGuardrail._resolve_key_alias_from_request_data(), and is accompanied by four new unit tests covering all branches of the fallback chain.

Confidence Score: 5/5

Safe to merge — minimal, well-targeted change with no regressions and comprehensive test coverage.

The fix is a 9-line addition that correctly ports v1 behavior to v2, uses the existing _get_non_empty_str helper for safe type handling, matches the established resolution pattern in prompt_security.py, and is backed by four new unit tests covering every branch of the fallback chain. No P0/P1 issues found.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/guardrails/guardrail_hooks/noma/noma_v2.py	Adds user_api_key_alias fallback in apply_guardrail() after checking dynamic_params and self.application_id; correctly uses _get_non_empty_str and matches the resolution order in prompt_security.py.
tests/test_litellm/proxy/guardrails/guardrail_hooks/test_noma_v2.py	Replaces one test that was asserting the broken behavior (key alias is ignored) with four tests covering all new branches (litellm_metadata fallback, metadata fallback, config precedence, and no-fallback omission). Remaining changes are Black reformats.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[apply_guardrail called] --> B{dynamic_params\napplication_id?}
    B -- non-empty string --> E[use dynamic_params value]
    B -- None/empty --> C{self.application_id?}
    C -- non-empty string --> E
    C -- None/empty --> D{litellm_metadata\nuser_api_key_alias?}
    D -- non-empty string --> E
    D -- None/empty --> F{metadata\nuser_api_key_alias?}
    F -- non-empty string --> E
    F -- None/empty --> G[omit application_id\nfrom payload]
    E --> H[_build_scan_payload with application_id]
    G --> H

Loading

_{Reviews (3): Last reviewed commit: "fix(noma-v2): fall back to key_alias for..." | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 16 untouched benchmarks

---

_{Comparing bse-ai:fix/noma-v2-key-alias-application-id (48b3a1b) with main (72a461b)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!