Validate safety identifier endpoint hosts

[fallintoplace]

Summary

• parse custom base URLs before deciding whether the safety identifier is supported
• accept the primary API hostname and anchored regional subdomains
• reject suffix-domain, userinfo, and missing-boundary lookalikes
• add regression coverage for primary, European, and US regional endpoints

Why

The previous substring check treated any URL containing api.openai.com as an official endpoint. An exact-host replacement fixed those lookalikes but excluded official regional endpoints such as eu.api.openai.com.

Matching the primary hostname or an anchored subdomain preserves regional endpoint support without accepting attacker-controlled suffix domains.

Testing

• uv run ruff check
• uv run mypy src/guardrails/utils/safety_identifier.py
• uv run pyright src/guardrails/utils/safety_identifier.py
• uv run pytest -q (441 passed)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b70d0713aa

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Recognize official regional API hosts

When a client uses an official regional data-residency URL such as https://eu.api.openai.com/v1, the parsed hostname is eu.api.openai.com, so this exact comparison returns false. The previous substring check accepted these regional OpenAI hosts; this change therefore stops sending safety_identifier for those clients even though they are still using the official OpenAI API. Recognize the supported regional hostnames while continuing to reject lookalike domains.

Useful? React with 👍 / 👎.