arize-phoenix 10.0.4__py3-none-any.whl → 12.28.1__py3-none-any.whl

phoenix/server/api/routers/v1/__init__.py

@@ -1,20 +1,22 @@
 from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.security import APIKeyHeader
-from starlette.status import HTTP_403_FORBIDDEN
 
-from phoenix.server.bearer_auth import is_authenticated
+from phoenix.server.bearer_auth import PhoenixUser, is_authenticated
 
 from .annotation_configs import router as annotation_configs_router
 from .annotations import router as annotations_router
 from .datasets import router as datasets_router
+from .documents import router as documents_router
 from .evaluations import router as evaluations_router
 from .experiment_evaluations import router as experiment_evaluations_router
 from .experiment_runs import router as experiment_runs_router
 from .experiments import router as experiments_router
 from .projects import router as projects_router
 from .prompts import router as prompts_router
+from .sessions import router as sessions_router
 from .spans import router as spans_router
 from .traces import router as traces_router
+from .users import router as users_router
 from .utils import add_errors_to_responses
 
 REST_API_VERSION = "1.0"
@@ -27,7 +29,21 @@ async def prevent_access_in_read_only_mode(request: Request) -> None:
     if request.app.state.read_only:
         raise HTTPException(
             detail="The Phoenix REST API is disabled in read-only mode.",
-            status_code=HTTP_403_FORBIDDEN,
+            status_code=403,
+        )
+
+
+async def restrict_access_by_viewers(request: Request) -> None:
+    """
+    Prevents access to the REST API for viewers, except for GET requests
+    and specific allowed POST routes.
+    """
+    if request.method == "GET":
+        return
+    if isinstance(request.user, PhoenixUser) and request.user.is_viewer:
+        raise HTTPException(
+            status_code=403,
+            detail="Viewers cannot perform this action.",
         )
 
 
@@ -48,13 +64,14 @@ def create_v1_router(authentication_enabled: bool) -> APIRouter:
             )
         )
         dependencies.append(Depends(is_authenticated))
+        dependencies.append(Depends(restrict_access_by_viewers))
 
     router = APIRouter(
         prefix="/v1",
         dependencies=dependencies,
         responses=add_errors_to_responses(
             [
-                HTTP_403_FORBIDDEN  # adds a 403 response to routes in the generated OpenAPI schema
+                403  # adds a 403 response to routes in the generated OpenAPI schema
             ]
         ),
     )
@@ -69,4 +86,7 @@ def create_v1_router(authentication_enabled: bool) -> APIRouter:
     router.include_router(evaluations_router)
     router.include_router(prompts_router)
     router.include_router(projects_router)
+    router.include_router(sessions_router)
+    router.include_router(documents_router)
+    router.include_router(users_router)
     return router

phoenix/server/api/routers/v1/annotation_configs.py

@@ -1,17 +1,12 @@
 import logging
 from typing import Annotated, List, Literal, Optional, Union
 
-from fastapi import APIRouter, HTTPException, Path, Query
+from fastapi import APIRouter, Depends, HTTPException, Path, Query
 from pydantic import Field, RootModel
 from sqlalchemy import delete, select
 from sqlalchemy.exc import IntegrityError as PostgreSQLIntegrityError
 from sqlean.dbapi2 import IntegrityError as SQLiteIntegrityError  # type: ignore[import-untyped]
 from starlette.requests import Request
-from starlette.status import (
-    HTTP_400_BAD_REQUEST,
-    HTTP_404_NOT_FOUND,
-    HTTP_409_CONFLICT,
-)
 from strawberry.relay import GlobalID
 from typing_extensions import TypeAlias, assert_never
 
@@ -44,6 +39,7 @@ from phoenix.server.api.types.AnnotationConfig import (
 from phoenix.server.api.types.AnnotationConfig import (
     FreeformAnnotationConfig as FreeformAnnotationConfigType,
 )
+from phoenix.server.authorization import is_not_locked
 
 logger = logging.getLogger(__name__)
 
@@ -205,7 +201,7 @@ async def list_annotation_configs(
         except ValueError:
             raise HTTPException(
                 detail=f"Invalid cursor: {cursor}",
-                status_code=HTTP_400_BAD_REQUEST,
+                status_code=400,
             )
         if cursor_gid.type_name not in (
             CategoricalAnnotationConfigType.__name__,
@@ -214,7 +210,7 @@ async def list_annotation_configs(
         ):
             raise HTTPException(
                 detail=f"Invalid cursor: {cursor}",
-                status_code=HTTP_400_BAD_REQUEST,
+                status_code=400,
             )
         cursor_id = int(cursor_gid.node_id)
 
@@ -260,14 +256,13 @@ async def get_annotation_config_by_name_or_id(
             query = query.where(models.AnnotationConfig.name == config_identifier)
         config = await session.scalar(query)
         if not config:
-            raise HTTPException(
-                status_code=HTTP_404_NOT_FOUND, detail="Annotation configuration not found"
-            )
+            raise HTTPException(status_code=404, detail="Annotation configuration not found")
         return GetAnnotationConfigResponseBody(data=db_to_api_annotation_config(config))
 
 
 @router.post(
     "/annotation_configs",
+    dependencies=[Depends(is_not_locked)],
     summary="Create an annotation configuration",
 )
 async def create_annotation_config(
@@ -280,7 +275,7 @@ async def create_annotation_config(
     try:
         db_config = _to_db_annotation_config(input_config)
     except ValueError as error:
-        raise HTTPException(status_code=HTTP_400_BAD_REQUEST, detail=str(error))
+        raise HTTPException(status_code=400, detail=str(error))
 
     async with request.app.state.db() as session:
         annotation_config = models.AnnotationConfig(
@@ -292,7 +287,7 @@ async def create_annotation_config(
             await session.commit()
         except (PostgreSQLIntegrityError, SQLiteIntegrityError):
             raise HTTPException(
-                status_code=HTTP_409_CONFLICT,
+                status_code=409,
                 detail="The name of the annotation configuration is already taken",
             )
         return CreateAnnotationConfigResponseBody(
@@ -302,6 +297,7 @@ async def create_annotation_config(
 
 @router.put(
     "/annotation_configs/{config_id}",
+    dependencies=[Depends(is_not_locked)],
     summary="Update an annotation configuration",
 )
 async def update_annotation_config(
@@ -318,22 +314,18 @@ async def update_annotation_config(
         ContinuousAnnotationConfigType.__name__,
         FreeformAnnotationConfigType.__name__,
     ):
-        raise HTTPException(
-            status_code=HTTP_400_BAD_REQUEST, detail="Invalid annotation configuration ID"
-        )
+        raise HTTPException(status_code=400, detail="Invalid annotation configuration ID")
     config_rowid = int(config_gid.node_id)
 
     try:
         db_config = _to_db_annotation_config(input_config)
     except ValueError as error:
-        raise HTTPException(status_code=HTTP_400_BAD_REQUEST, detail=str(error))
+        raise HTTPException(status_code=400, detail=str(error))
 
     async with request.app.state.db() as session:
         existing_config = await session.get(models.AnnotationConfig, config_rowid)
         if not existing_config:
-            raise HTTPException(
-                status_code=HTTP_404_NOT_FOUND, detail="Annotation configuration not found"
-            )
+            raise HTTPException(status_code=404, detail="Annotation configuration not found")
 
         existing_config.name = input_config.name
         existing_config.config = db_config
@@ -342,7 +334,7 @@ async def update_annotation_config(
             await session.commit()
         except (PostgreSQLIntegrityError, SQLiteIntegrityError):
             raise HTTPException(
-                status_code=HTTP_409_CONFLICT,
+                status_code=409,
                 detail="The name of the annotation configuration is already taken",
             )
 
@@ -357,15 +349,19 @@ async def delete_annotation_config(
     request: Request,
     config_id: str = Path(..., description="ID of the annotation configuration"),
 ) -> DeleteAnnotationConfigResponseBody:
-    config_gid = GlobalID.from_id(config_id)
+    try:
+        config_gid = GlobalID.from_id(config_id)
+    except Exception:
+        raise HTTPException(
+            status_code=422,
+            detail=f"Invalid annotation configuration ID format: {config_id}",
+        )
     if config_gid.type_name not in (
         CategoricalAnnotationConfigType.__name__,
         ContinuousAnnotationConfigType.__name__,
         FreeformAnnotationConfigType.__name__,
     ):
-        raise HTTPException(
-            status_code=HTTP_400_BAD_REQUEST, detail="Invalid annotation configuration ID"
-        )
+        raise HTTPException(status_code=400, detail="Invalid annotation configuration ID")
     config_rowid = int(config_gid.node_id)
     async with request.app.state.db() as session:
         stmt = (
@@ -375,9 +371,7 @@ async def delete_annotation_config(
         )
         annotation_config = await session.scalar(stmt)
         if annotation_config is None:
-            raise HTTPException(
-                status_code=HTTP_404_NOT_FOUND, detail="Annotation configuration not found"
-            )
+            raise HTTPException(status_code=404, detail="Annotation configuration not found")
         await session.commit()
     return DeleteAnnotationConfigResponseBody(data=db_to_api_annotation_config(annotation_config))
 
@@ -397,9 +391,7 @@ def _get_annotation_config_db_id(config_gid: str) -> int:
 def _reserve_note_annotation_name(data: AnnotationConfigData) -> str:
     name = data.name
     if name == "note":
-        raise HTTPException(
-            status_code=HTTP_409_CONFLICT, detail="The name 'note' is reserved for span notes"
-        )
+        raise HTTPException(status_code=409, detail="The name 'note' is reserved for span notes")
     return name