feat(store): add openai_response_store HttpFilter (praxis-proxy#582)

Signed-off-by: Sébastien Han <seb@redhat.com>

Author: leseb

Cargo.lock

@@ -71,6 +71,7 @@ praxis-filter = { version = "0.3.1", path = "filter", package = "praxis-proxy-fi
 praxis-protocol = { version = "0.3.1", path = "protocol", package = "praxis-proxy-protocol" }
 praxis-tls = { version = "0.3.1", path = "tls", package = "praxis-proxy-tls" }
 praxis-test-utils = { path = "tests/utils" }
+secrecy = { version = "0.10.3", features = ["serde"] }
 serde = { version = "1.0.228", features = ["derive", "rc"] }
 serde_json = "1.0.150"
 rcgen = "0.14.8"

Cargo.toml

@@ -5,13 +5,12 @@
 
 use tracing::debug;
 
+use super::super::cluster::MAX_TIMEOUT_MS;
 use crate::{
     config::{Listener, ProtocolKind},
     errors::ProxyError,
 };
 
-use super::super::cluster::MAX_TIMEOUT_MS;
-
 // -----------------------------------------------------------------------------
 // Timeout Constants
 // -----------------------------------------------------------------------------

core/src/config/validate/listener/timeouts.rs

@@ -133,6 +133,7 @@ page.
 | [format-routing.yaml](configs/ai/openai/responses/format-routing.yaml) | Route by AI API format (Responses vs Chat Completions) |
 | [responses-routing.yaml](configs/ai/openai/responses/responses-routing.yaml) | Route Responses API by mode (stateless vs stateful) |
 | [request-validate.yaml](configs/ai/openai/responses/request-validate.yaml) | Validate Responses API requests and reject invalid parameter combinations |
+| [response-store.yaml](configs/ai/openai/responses/response-store.yaml) | Persist non-streaming Responses API responses to SQLite |
 
 ### Branching
 

examples/README.md

@@ -66,11 +66,16 @@ filter_chains:
           mode: x-praxis-responses-mode
 
       - filter: openai_responses_validate
-        # Future #354 orchestration filters would follow here
-        # for stateful requests (gated by filter conditions on the
-        # x-praxis-responses-mode header or responses.* metadata)
-        # before all valid requests route to the inference backend:
-        #   - filter: response_store
+
+      - filter: openai_response_store
+        backend: sqlite
+        # In-memory:
+        #   database_url: "sqlite::memory:"
+        # File-backed:
+        database_url: "sqlite://responses.db?mode=rwc"
+        responses_table: openai_responses
+        conversations_table: openai_conversations
+        # Future #354 orchestration filters would follow here:
         #   - filter: rehydrate
         #   - filter: compact
         #   - filter: tool_parse

examples/configs/ai/openai/responses/full-flow.yaml

@@ -0,0 +1,44 @@
+# Response Store
+#
+# Persists non-streaming Responses API responses to a SQLite
+# database. The `openai_responses_format` filter must run first to
+# classify the request body — `openai_response_store` reads its
+# metadata to decide whether to persist.
+#
+# Streaming responses (`stream: true`) are skipped; streaming
+# persistence will be handled by a separate filter. Non-2xx
+# responses and non-JSON content types are also skipped.
+#
+# The store is lazily initialized on the first qualifying
+# request. If initialization fails (bad URL, permissions),
+# the failure is permanent and the filter becomes a no-op.
+
+listeners:
+  - name: ai-gateway
+    address: "127.0.0.1:8080"
+    filter_chains: [responses-pipeline]
+
+filter_chains:
+  - name: responses-pipeline
+    filters:
+      - filter: openai_responses_format
+
+      - filter: openai_response_store
+        backend: sqlite
+        # In-memory:
+        #   database_url: "sqlite::memory:"
+        # File-backed:
+        database_url: "sqlite://responses.db?mode=rwc"
+        responses_table: openai_responses
+        conversations_table: openai_conversations
+
+      - filter: router
+        routes:
+          - path: "/v1/responses"
+            cluster: "inference-backend"
+
+      - filter: load_balancer
+        clusters:
+          - name: "inference-backend"
+            endpoints:
+              - "127.0.0.1:8000"

examples/configs/ai/openai/responses/response-store.yaml

@@ -15,7 +15,7 @@ name = "praxis_filter"
 
 [features]
 default = ["ai-inference"]
-ai-inference = ["dep:sqlx"]
+ai-inference = ["dep:secrecy", "dep:sqlx", "dep:tokio"]
 ext-proc = ["dep:praxis-proto", "dep:tonic", "dep:prost-wkt-types"]
 
 [lints]
@@ -32,11 +32,13 @@ praxis-proto = { workspace = true, optional = true }
 rand = { workspace = true }
 prost-wkt-types = { workspace = true, optional = true }
 regex = { workspace = true }
+secrecy = { workspace = true, optional = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 serde_yaml = { workspace = true }
 sqlx = { workspace = true, optional = true }
 thiserror = { workspace = true }
+tokio = { workspace = true, optional = true }
 tonic = { workspace = true, optional = true }
 tracing = { workspace = true }
 zeroize = { workspace = true }

filter/Cargo.toml

@@ -14,7 +14,7 @@ mod prompt_enrich;
 #[cfg(feature = "ai-inference")]
 #[allow(
     dead_code,
-    reason = "store module is the foundation for upcoming response store filter"
+    reason = "store module provides foundation for response store filter and upcoming CRUD endpoints"
 )]
 pub(crate) mod store;
 #[cfg(feature = "ai-inference")]
@@ -26,6 +26,8 @@ pub use inference::ModelToHeaderFilter;
 #[cfg(feature = "ai-inference")]
 pub use openai::OpenaiResponsesValidateFilter;
 #[cfg(feature = "ai-inference")]
+pub use openai::ResponseStoreFilter;
+#[cfg(feature = "ai-inference")]
 pub use openai::ResponsesFormatFilter;
 #[cfg(feature = "ai-inference")]
 pub use prompt_enrich::PromptEnrichFilter;

filter/src/builtins/http/ai/mod.rs

@@ -7,4 +7,4 @@ pub(crate) mod responses;
 
 #[cfg(feature = "ai-inference")]
 pub use responses::OpenaiResponsesValidateFilter;
-pub use responses::ResponsesFormatFilter;
+pub use responses::{ResponseStoreFilter, ResponsesFormatFilter};

filter/src/builtins/http/ai/openai/mod.rs

@@ -25,6 +25,8 @@ mod config;
 )]
 pub(crate) mod store;
 
+pub use store::ResponseStoreFilter;
+
 #[cfg(test)]
 #[allow(
     clippy::unwrap_used,