fix: prevent nil translator panic when backend schema is unsupported (#1952)

**Description**

When the ExtProc cannot create a translator for an unsupported backend
schema, `GetTranslator` returns an error. However, `rp.upstreamFilter =
u` was assigned *before* translator creation. When the response arrived,
the router's nil check (`if r.upstreamFilter != nil`) passed because `u`
existed, but `u.translator` was nil — causing a panic in
`ProcessResponseHeaders`.

This moves the `rp.upstreamFilter = u` assignment to after successful
translator creation. If `GetTranslator` fails, `upstreamFilter` stays
nil and the existing guard at `processor_impl.go:164` routes the
response to `passThroughProcessor` instead of panicking.

**Related Issues/PRs (if applicable)**

Fixes #1941

**Special notes for reviewers (if applicable)**

`rp.upstreamFilterCount++` intentionally remains before the translator
check — it tracks the number of `SetBackend` calls (including failed
ones) and is used by `onRetry()` to detect retry scenarios. This is
unchanged from the previous behavior.

Signed-off-by: Erica Hughberg <erica.sundberg.90@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

Author: 3 people

internal/extproc/processor_impl.go

@@ -590,13 +590,13 @@ func (u *upstreamProcessor[ReqT, RespT, RespChunkT, EndpointSpecT]) SetBackend(c
 	if u.modelNameOverride != "" {
 		u.requestHeaders[internalapi.ModelNameHeaderKeyDefault] = u.modelNameOverride
 	}
-	rp.upstreamFilter = u
-	u.parent = rp
+	u.parent = rp // Set parent before GetTranslator so it can access rp.eh
 
 	u.translator, err = u.parent.eh.GetTranslator(b.Schema, u.modelNameOverride)
 	if err != nil {
 		return fmt.Errorf("failed to create translator for backend %s: %w", b.Name, err)
 	}
+	rp.upstreamFilter = u // Only assign after translator is confirmed valid
 
 	switch redactor := u.translator.(type) {
 	case translator.ResponseRedactor:

internal/extproc/processor_impl_test.go

@@ -433,6 +433,43 @@ func Test_chatCompletionProcessorUpstreamFilter_SetBackend(t *testing.T) {
 	require.Zero(t, mm.inputTokenCount)
 	mm.RequireSelectedBackend(t, "some-backend")
 	require.Equal(t, r, p.parent)
+	// Verify upstreamFilter is NOT set when translator creation fails.
+	// This prevents a nil-translator panic when the router processes the response
+	// (the nil check on upstreamFilter at ProcessResponseHeaders/ProcessResponseBody
+	// must fall through to passThroughProcessor).
+	require.Nil(t, r.upstreamFilter, "upstreamFilter must remain nil when SetBackend fails")
+}
+
+// Test_chatCompletionProcessorUpstreamFilter_SetBackend_unsupportedSchema_noResponsePanic
+// verifies that when SetBackend fails due to an unsupported schema, subsequent
+// response processing does not panic. Before the fix for #1941, upstreamFilter
+// was assigned before the translator was created, so the router's nil check on
+// upstreamFilter would pass but the nil translator would cause a panic.
+func Test_chatCompletionProcessorUpstreamFilter_SetBackend_unsupportedSchema_noResponsePanic(t *testing.T) {
+	headers := map[string]string{":path": "/foo"}
+	mm := &mockMetrics{}
+	p := &chatCompletionProcessorUpstreamFilter{
+		requestHeaders: headers,
+		metrics:        mm,
+	}
+	r := &chatCompletionProcessorRouterFilter{}
+
+	err := p.SetBackend(t.Context(), &filterapi.Backend{
+		Name:   "bad-backend",
+		Schema: filterapi.VersionedAPISchema{Name: "unsupported-schema", Version: "v1"},
+	}, nil, r)
+	require.Error(t, err)
+	require.Nil(t, r.upstreamFilter, "upstreamFilter must remain nil on translator creation failure")
+
+	// Simulate response arriving after the failed SetBackend.
+	// This must NOT panic; it should fall through to passThroughProcessor.
+	resp, err := r.ProcessResponseHeaders(t.Context(), nil)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	resp, err = r.ProcessResponseBody(t.Context(), &extprocv3.HttpBody{Body: []byte("error"), EndOfStream: true})
+	require.NoError(t, err)
+	require.NotNil(t, resp)
 }
 
 func Test_chatCompletionProcessorUpstreamFilter_ProcessRequestHeaders(t *testing.T) {