arize-phoenix 11.16.1__tar.gz → 11.17.0__tar.gz

{arize_phoenix-11.16.1 → arize_phoenix-11.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arize-phoenix
-Version: 11.16.1
+Version: 11.17.0
 Summary: AI Observability and Evaluation
 Project-URL: Documentation, https://arize.com/docs/phoenix/
 Project-URL: Issues, https://github.com/Arize-ai/phoenix/issues

{arize_phoenix-11.16.1 → arize_phoenix-11.17.0}/src/phoenix/auth.py

@@ -47,6 +47,18 @@ def is_valid_password(*, password: Secret, salt: bytes, password_hash: bytes) ->
     return password_hash == compute_password_hash(password=password, salt=salt)
 
 
+def sanitize_email(email: str) -> str:
+    """
+    Sanitizes an email address by trimming whitespace and converting to lowercase.
+
+    Args:
+        email (str): the email address to sanitize
+    Returns:
+        str: the sanitized email address
+    """
+    return email.strip().lower()
+
+
 def validate_email_format(email: str) -> None:
     """
     Checks that the email has a valid format.

{arize_phoenix-11.16.1 → arize_phoenix-11.17.0}/src/phoenix/config.py

@@ -333,6 +333,10 @@ Whether to verify client certificates for mutual TLS (mTLS) authentication.
 When set to true, clients must provide valid certificates signed by the CA specified in
 PHOENIX_TLS_CA_FILE.
 """
+ENV_PHOENIX_DEFAULT_RETENTION_POLICY_DAYS = "PHOENIX_DEFAULT_RETENTION_POLICY_DAYS"
+"""
+The default retention policy for traces in days.
+"""
 
 
 @dataclass(frozen=True)
@@ -494,6 +498,20 @@ def get_env_tls_verify_client() -> bool:
     return _bool_val(ENV_PHOENIX_TLS_VERIFY_CLIENT, False)
 
 
+def get_env_default_retention_policy_days() -> int:
+    """
+    Returns the number of days for the default retention policy as set by the
+    PHOENIX_DEFAULT_RETENTION_POLICY_DAYS environment variable, defaulting to 0 if not set.
+
+    Returns:
+        int: Number of days for the default retention policy. Defaults to 0 if the environment variable is not set.
+    """  # noqa: E501
+    days = _int_val(ENV_PHOENIX_DEFAULT_RETENTION_POLICY_DAYS, 0)
+    if days < 0:
+        raise ValueError("PHOENIX_DEFAULT_RETENTION_POLICY_DAYS must be non-negative")
+    return days
+
+
 def get_env_tls_config() -> Optional[TLSConfig]:
     """
     Retrieves and validates TLS configuration from environment variables.
@@ -865,6 +883,8 @@ def get_env_admins() -> dict[str, str]:
     """
     if not (env_value := getenv(ENV_PHOENIX_ADMINS)):
         return {}
+    from phoenix.auth import sanitize_email
+
     usernames = set()
     emails = set()
     ans = {}
@@ -881,7 +901,7 @@ def get_env_admins() -> dict[str, str]:
                 f"Expected format: 'username=email'"
             )
         username = pair[:last_equals_pos].strip()
-        email_addr = pair[last_equals_pos + 1 :].strip()
+        email_addr = sanitize_email(pair[last_equals_pos + 1 :])
         try:
             email_addr = validate_email(email_addr, check_deliverability=False).normalized
         except EmailNotValidError:

{arize_phoenix-11.16.1 → arize_phoenix-11.17.0}/src/phoenix/db/facilitator.py

@@ -28,6 +28,7 @@ from phoenix.auth import (
 from phoenix.config import (
     get_env_admins,
     get_env_default_admin_initial_password,
+    get_env_default_retention_policy_days,
     get_env_disable_basic_auth,
 )
 from phoenix.db import models
@@ -334,7 +335,9 @@ async def _ensure_default_project_trace_retention_policy(db: DbSessionFactory) -
         ):
             return
         cron_expression = TraceRetentionCronExpression(root="0 0 * * 0")
-        rule = TraceRetentionRule(root=MaxDaysRule(max_days=0))
+        rule = TraceRetentionRule(
+            root=MaxDaysRule(max_days=get_env_default_retention_policy_days())
+        )
         await session.execute(
             sa.insert(models.ProjectTraceRetentionPolicy),
             [

{arize_phoenix-11.16.1 → arize_phoenix-11.17.0}/src/phoenix/server/api/mutations/user_mutations.py

@@ -21,6 +21,7 @@ from phoenix.auth import (
     PASSWORD_REQUIREMENTS,
     PHOENIX_ACCESS_TOKEN_COOKIE_NAME,
     PHOENIX_REFRESH_TOKEN_COOKIE_NAME,
+    sanitize_email,
     validate_email_format,
     validate_password_format,
 )
@@ -115,20 +116,23 @@ class UserMutationMixin:
         info: Info[Context, None],
         input: CreateUserInput,
     ) -> UserMutationPayload:
+        # Sanitize email by trimming and lowercasing
+        email = sanitize_email(input.email)
+
         user: models.User
         if input.auth_method is AuthMethod.OAUTH2:
             user = models.OAuth2User(
-                email=input.email,
+                email=email,
                 username=input.username,
             )
         else:
             assert input.password
-            validate_email_format(input.email)
+            validate_email_format(email)
             validate_password_format(input.password)
             salt = secrets.token_bytes(DEFAULT_SECRET_LENGTH)
             password_hash = await info.context.hash_password(Secret(input.password), salt)
             user = models.LocalUser(
-                email=input.email,
+                email=email,
                 username=input.username,
                 password_hash=password_hash,
                 password_salt=salt,

{arize_phoenix-11.16.1 → arize_phoenix-11.17.0}/src/phoenix/server/api/routers/auth.py

@@ -6,7 +6,7 @@ from pathlib import Path
 from urllib.parse import urlencode, urlparse, urlunparse
 
 from fastapi import APIRouter, Depends, HTTPException, Request, Response
-from sqlalchemy import select
+from sqlalchemy import func, select
 from sqlalchemy.orm import joinedload
 from starlette.status import (
     HTTP_204_NO_CONTENT,
@@ -29,6 +29,7 @@ from phoenix.auth import (
     delete_oauth2_state_cookie,
     delete_refresh_token_cookie,
     is_valid_password,
+    sanitize_email,
     set_access_token_cookie,
     set_refresh_token_cookie,
     validate_password_format,
@@ -87,9 +88,14 @@ async def login(request: Request) -> Response:
     if not email or not password:
         raise HTTPException(status_code=HTTP_401_UNAUTHORIZED, detail="Email and password required")
 
+    # Sanitize email by trimming and lowercasing
+    email = sanitize_email(email)
+
     async with request.app.state.db() as session:
         user = await session.scalar(
-            select(models.User).filter_by(email=email).options(joinedload(models.User.role))
+            select(models.User)
+            .where(func.lower(models.User.email) == email)
+            .options(joinedload(models.User.role))
         )
         if (
             user is None
@@ -207,6 +213,10 @@ async def initiate_password_reset(request: Request) -> Response:
     data = await request.json()
     if not (email := data.get("email")):
         raise MISSING_EMAIL
+
+    # Sanitize email by trimming and lowercasing
+    email = sanitize_email(email)
+
     sender: EmailSender = request.app.state.email_sender
     if sender is None:
         raise SMTP_UNAVAILABLE
@@ -214,7 +224,7 @@ async def initiate_password_reset(request: Request) -> Response:
     async with request.app.state.db() as session:
         user = await session.scalar(
             select(models.User)
-            .filter_by(email=email)
+            .where(func.lower(models.User.email) == email)
             .options(
                 joinedload(models.User.password_reset_token).load_only(models.PasswordResetToken.id)
             )

{arize_phoenix-11.16.1 → arize_phoenix-11.17.0}/src/phoenix/server/api/routers/oauth2.py

@@ -27,6 +27,7 @@ from phoenix.auth import (
     PHOENIX_OAUTH2_STATE_COOKIE_NAME,
     delete_oauth2_nonce_cookie,
     delete_oauth2_state_cookie,
+    sanitize_email,
     set_access_token_cookie,
     set_oauth2_nonce_cookie,
     set_oauth2_state_cookie,
@@ -217,7 +218,7 @@ class UserInfo:
         if not (idp_user_id := (self.idp_user_id or "").strip()):
             raise ValueError("idp_user_id cannot be empty")
         object.__setattr__(self, "idp_user_id", idp_user_id)
-        if not (email := (self.email or "").strip()):
+        if not (email := sanitize_email(self.email or "")):
             raise ValueError("email cannot be empty")
         object.__setattr__(self, "email", email)
         if username := (self.username or "").strip():
@@ -356,7 +357,7 @@ async def _get_existing_oauth2_user(
             - User has a password set
             - User has mismatched OAuth2 credentials
     """  # noqa: E501
-    if not (email := (user_info.email or "").strip()):
+    if not (email := sanitize_email(user_info.email or "")):
         raise ValueError("Email is required.")
     if not (oauth2_user_id := (user_info.idp_user_id or "").strip()):
         raise ValueError("OAuth2 user ID is required.")
@@ -370,7 +371,7 @@ async def _get_existing_oauth2_user(
         if email and email != user.email:
             user.email = email
     else:
-        user = await session.scalar(stmt.filter_by(email=email))
+        user = await session.scalar(stmt.where(func.lower(models.User.email) == email))
         if user is None or not isinstance(user, models.OAuth2User):
             raise SignInNotAllowed("Sign in is not allowed.")
         # Case 1: Different OAuth2 client - update both client and user IDs
@@ -520,7 +521,7 @@ async def _email_and_username_exist(
             select(
                 cast(
                     func.coalesce(
-                        func.max(case((models.User.email == email, 1), else_=0)),
+                        func.max(case((func.lower(models.User.email) == email, 1), else_=0)),
                         0,
                     ),
                     Boolean,
@@ -532,7 +533,7 @@ async def _email_and_username_exist(
                     ),
                     Boolean,
                 ).label("username_exists"),
-            ).where(or_(models.User.email == email, models.User.username == username))
+            ).where(or_(func.lower(models.User.email) == email, models.User.username == username))
         )
     ).all()
     return email_exists, username_exists

{arize_phoenix-11.16.1 → arize_phoenix-11.17.0}/src/phoenix/server/api/routers/v1/users.py

@@ -31,6 +31,7 @@ from phoenix.auth import (
     DEFAULT_SYSTEM_EMAIL,
     DEFAULT_SYSTEM_USERNAME,
     compute_password_hash,
+    sanitize_email,
     validate_email_format,
     validate_password_format,
 )
@@ -205,6 +206,8 @@ async def create_user(
 ) -> CreateUserResponseBody:
     user_data = request_body.user
     email, username, role = user_data.email, user_data.username, user_data.role
+    # Sanitize email by trimming and lowercasing
+    email = sanitize_email(email)
     validate_email_format(email)
 
     # Prevent creation of SYSTEM users

{arize_phoenix-11.16.1 → arize_phoenix-11.17.0}/src/phoenix/server/static/.vite/manifest.json

@@ -1,22 +1,22 @@
 {
-  "_components-CK8hwrPx.js": {
-    "file": "assets/components-CK8hwrPx.js",
+  "_components-B7NKnJXz.js": {
+    "file": "assets/components-B7NKnJXz.js",
     "name": "components",
     "imports": [
       "_vendor-_6rG8OMg.js",
-      "_pages-D8Hgmz1V.js",
+      "_pages-CvqPVUA3.js",
       "_vendor-arizeai-BznCmJFh.js",
       "_vendor-codemirror-29fWLPAy.js",
       "_vendor-three-C5WAXd5r.js"
     ]
   },
-  "_pages-D8Hgmz1V.js": {
-    "file": "assets/pages-D8Hgmz1V.js",
+  "_pages-CvqPVUA3.js": {
+    "file": "assets/pages-CvqPVUA3.js",
     "name": "pages",
     "imports": [
       "_vendor-_6rG8OMg.js",
       "_vendor-arizeai-BznCmJFh.js",
-      "_components-CK8hwrPx.js",
+      "_components-B7NKnJXz.js",
       "_vendor-codemirror-29fWLPAy.js",
       "_vendor-recharts-Cu431IpB.js"
     ]
@@ -69,15 +69,15 @@
     "name": "vendor-three"
   },
   "index.tsx": {
-    "file": "assets/index-UY6kXBX7.js",
+    "file": "assets/index-9n9lXgT6.js",
     "name": "index",
     "src": "index.tsx",
     "isEntry": true,
     "imports": [
       "_vendor-_6rG8OMg.js",
       "_vendor-arizeai-BznCmJFh.js",
-      "_pages-D8Hgmz1V.js",
-      "_components-CK8hwrPx.js",
+      "_pages-CvqPVUA3.js",
+      "_components-B7NKnJXz.js",
       "_vendor-three-C5WAXd5r.js",
       "_vendor-codemirror-29fWLPAy.js",
       "_vendor-shiki-Ce9e01lU.js",