arize-phoenix 12.4.0__py3-none-any.whl → 12.5.0__py3-none-any.whl

phoenix/server/api/mutations/annotation_config_mutations.py

@@ -23,7 +23,7 @@ from phoenix.db.types.annotation_configs import (
 from phoenix.db.types.annotation_configs import (
     FreeformAnnotationConfig as FreeformAnnotationConfigModel,
 )
-from phoenix.server.api.auth import IsNotReadOnly
+from phoenix.server.api.auth import IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import BadRequest, Conflict, NotFound
 from phoenix.server.api.queries import Query
@@ -197,7 +197,7 @@ def _to_pydantic_freeform_annotation_config(
 
 @strawberry.type
 class AnnotationConfigMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore[misc]
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore[misc]
     async def create_annotation_config(
         self,
         info: Info[Context, None],
@@ -236,7 +236,7 @@ class AnnotationConfigMutationMixin:
             annotation_config=to_gql_annotation_config(annotation_config),
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore[misc]
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore[misc]
     async def update_annotation_config(
         self,
         info: Info[Context, None],
@@ -285,7 +285,7 @@ class AnnotationConfigMutationMixin:
             annotation_config=to_gql_annotation_config(annotation_config),
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore[misc]
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore[misc]
     async def delete_annotation_configs(
         self,
         info: Info[Context, None],
@@ -317,7 +317,7 @@ class AnnotationConfigMutationMixin:
             ],
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore[misc]
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore[misc]
     async def add_annotation_config_to_project(
         self,
         info: Info[Context, None],
@@ -377,7 +377,7 @@ class AnnotationConfigMutationMixin:
                 project=Project(project_rowid=project_id),
             )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore[misc]
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore[misc]
     async def remove_annotation_config_from_project(
         self,
         info: Info[Context, None],

phoenix/server/api/mutations/api_key_mutations.py

@@ -1,5 +1,5 @@
 from datetime import datetime, timezone
-from typing import Optional
+from typing import Literal, Optional
 
 import strawberry
 from sqlalchemy import select
@@ -9,7 +9,7 @@ from strawberry.types import Info
 
 from phoenix.db import models
 from phoenix.db.models import UserRoleName
-from phoenix.server.api.auth import IsAdmin, IsLocked, IsNotReadOnly
+from phoenix.server.api.auth import IsAdmin, IsLocked, IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import Unauthorized
 from phoenix.server.api.queries import Query
@@ -61,7 +61,7 @@ class DeleteApiKeyMutationPayload:
 
 @strawberry.type
 class ApiKeyMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsAdmin, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsAdmin, IsLocked])  # type: ignore
     async def create_system_api_key(
         self, info: Info[Context, None], input: CreateApiKeyInput
     ) -> CreateSystemApiKeyMutationPayload:
@@ -113,12 +113,20 @@ class ApiKeyMutationMixin:
         except AttributeError:
             raise ValueError("User not found")
         issued_at = datetime.now(timezone.utc)
+        # Determine user role for API key
+        user_role: Literal["ADMIN", "MEMBER", "VIEWER"]
+        if user.is_admin:
+            user_role = "ADMIN"
+        elif user.is_viewer:
+            user_role = "VIEWER"
+        else:
+            user_role = "MEMBER"
         claims = ApiKeyClaims(
             subject=user.identity,
             issued_at=issued_at,
             expiration_time=input.expires_at or None,
             attributes=ApiKeyAttributes(
-                user_role="ADMIN" if user.is_admin else "MEMBER",
+                user_role=user_role,
                 name=input.name,
                 description=input.description,
             ),
@@ -137,7 +145,7 @@ class ApiKeyMutationMixin:
             query=Query(),
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsAdmin])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsAdmin])  # type: ignore
     async def delete_system_api_key(
         self, info: Info[Context, None], input: DeleteApiKeyInput
     ) -> DeleteApiKeyMutationPayload:

phoenix/server/api/mutations/chat_mutations.py

@@ -30,7 +30,7 @@ from phoenix.db.helpers import (
     get_dataset_example_revisions,
     insert_experiment_with_examples_snapshot,
 )
-from phoenix.server.api.auth import IsLocked, IsNotReadOnly
+from phoenix.server.api.auth import IsLocked, IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import BadRequest, CustomGraphQLError, NotFound
 from phoenix.server.api.helpers.dataset_helpers import get_dataset_example_output
@@ -131,7 +131,7 @@ class ChatCompletionOverDatasetMutationPayload:
 
 @strawberry.type
 class ChatCompletionMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     @classmethod
     async def chat_completion_over_dataset(
         cls,
@@ -302,7 +302,7 @@ class ChatCompletionMutationMixin:
             payload.examples.append(example_payload)
         return payload
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     @classmethod
     async def chat_completion(
         cls, info: Info[Context, None], input: ChatCompletionInput

phoenix/server/api/mutations/dataset_label_mutations.py

@@ -10,7 +10,7 @@ from strawberry.relay.types import GlobalID
 from strawberry.types import Info
 
 from phoenix.db import models
-from phoenix.server.api.auth import IsLocked, IsNotReadOnly
+from phoenix.server.api.auth import IsLocked, IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import BadRequest, Conflict, NotFound
 from phoenix.server.api.queries import Query
@@ -78,7 +78,7 @@ class UnsetDatasetLabelsMutationPayload:
 
 @strawberry.type
 class DatasetLabelMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def create_dataset_label(
         self,
         info: Info[Context, None],
@@ -100,7 +100,7 @@ class DatasetLabelMutationMixin:
             dataset_label=to_gql_dataset_label(dataset_label_orm)
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def update_dataset_label(
         self, info: Info[Context, None], input: UpdateDatasetLabelInput
     ) -> UpdateDatasetLabelMutationPayload:
@@ -133,7 +133,7 @@ class DatasetLabelMutationMixin:
             dataset_label=to_gql_dataset_label(dataset_label_orm)
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def delete_dataset_labels(
         self, info: Info[Context, None], input: DeleteDatasetLabelsInput
     ) -> DeleteDatasetLabelsMutationPayload:
@@ -166,7 +166,7 @@ class DatasetLabelMutationMixin:
             ]
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def set_dataset_labels(
         self, info: Info[Context, None], input: SetDatasetLabelsInput
     ) -> SetDatasetLabelsMutationPayload:
@@ -248,7 +248,7 @@ class DatasetLabelMutationMixin:
             query=Query(),
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def unset_dataset_labels(
         self, info: Info[Context, None], input: UnsetDatasetLabelsInput
     ) -> UnsetDatasetLabelsMutationPayload:

phoenix/server/api/mutations/dataset_mutations.py

@@ -18,7 +18,7 @@ from strawberry.types import Info
 
 from phoenix.db import models
 from phoenix.db.helpers import get_eval_trace_ids_for_datasets, get_project_names_for_datasets
-from phoenix.server.api.auth import IsLocked, IsNotReadOnly
+from phoenix.server.api.auth import IsLocked, IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import BadRequest, NotFound
 from phoenix.server.api.helpers.dataset_helpers import (
@@ -50,7 +50,7 @@ class DatasetMutationPayload:
 
 @strawberry.type
 class DatasetMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def create_dataset(
         self,
         info: Info[Context, None],
@@ -74,7 +74,7 @@ class DatasetMutationMixin:
         info.context.event_queue.put(DatasetInsertEvent((dataset.id,)))
         return DatasetMutationPayload(dataset=to_gql_dataset(dataset))
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def patch_dataset(
         self,
         info: Info[Context, None],
@@ -103,7 +103,7 @@ class DatasetMutationMixin:
         info.context.event_queue.put(DatasetInsertEvent((dataset.id,)))
         return DatasetMutationPayload(dataset=to_gql_dataset(dataset))
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def add_spans_to_dataset(
         self,
         info: Info[Context, None],
@@ -223,7 +223,7 @@ class DatasetMutationMixin:
         info.context.event_queue.put(DatasetInsertEvent((dataset.id,)))
         return DatasetMutationPayload(dataset=to_gql_dataset(dataset))
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def add_examples_to_dataset(
         self, info: Info[Context, None], input: AddExamplesToDatasetInput
     ) -> DatasetMutationPayload:
@@ -350,7 +350,7 @@ class DatasetMutationMixin:
         info.context.event_queue.put(DatasetInsertEvent((dataset.id,)))
         return DatasetMutationPayload(dataset=to_gql_dataset(dataset))
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def delete_dataset(
         self,
         info: Info[Context, None],
@@ -381,7 +381,7 @@ class DatasetMutationMixin:
         info.context.event_queue.put(DatasetDeleteEvent((dataset.id,)))
         return DatasetMutationPayload(dataset=to_gql_dataset(dataset))
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def patch_dataset_examples(
         self,
         info: Info[Context, None],
@@ -474,7 +474,7 @@ class DatasetMutationMixin:
         info.context.event_queue.put(DatasetInsertEvent((dataset.id,)))
         return DatasetMutationPayload(dataset=to_gql_dataset(dataset))
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def delete_dataset_examples(
         self, info: Info[Context, None], input: DeleteDatasetExamplesInput
     ) -> DatasetMutationPayload:

phoenix/server/api/mutations/dataset_split_mutations.py

@@ -10,7 +10,7 @@ from strawberry.scalars import JSON
 from strawberry.types import Info
 
 from phoenix.db import models
-from phoenix.server.api.auth import IsLocked, IsNotReadOnly
+from phoenix.server.api.auth import IsLocked, IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import BadRequest, Conflict, NotFound
 from phoenix.server.api.helpers.playground_users import get_user
@@ -96,7 +96,7 @@ class RemoveDatasetExamplesFromDatasetSplitsMutationPayload:
 
 @strawberry.type
 class DatasetSplitMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def create_dataset_split(
         self, info: Info[Context, None], input: CreateDatasetSplitInput
     ) -> DatasetSplitMutationPayload:
@@ -119,7 +119,7 @@ class DatasetSplitMutationMixin:
             dataset_split=to_gql_dataset_split(dataset_split_orm), query=Query()
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def patch_dataset_split(
         self, info: Info[Context, None], input: PatchDatasetSplitInput
     ) -> DatasetSplitMutationPayload:
@@ -152,7 +152,7 @@ class DatasetSplitMutationMixin:
             query=Query(),
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def delete_dataset_splits(
         self, info: Info[Context, None], input: DeleteDatasetSplitInput
     ) -> DeleteDatasetSplitsMutationPayload:
@@ -191,7 +191,7 @@ class DatasetSplitMutationMixin:
             query=Query(),
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def add_dataset_examples_to_dataset_splits(
         self, info: Info[Context, None], input: AddDatasetExamplesToDatasetSplitsInput
     ) -> AddDatasetExamplesToDatasetSplitsMutationPayload:
@@ -284,7 +284,7 @@ class DatasetSplitMutationMixin:
             examples=[to_gql_dataset_example(example) for example in examples],
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def remove_dataset_examples_from_dataset_splits(
         self, info: Info[Context, None], input: RemoveDatasetExamplesFromDatasetSplitsInput
     ) -> RemoveDatasetExamplesFromDatasetSplitsMutationPayload:
@@ -345,7 +345,7 @@ class DatasetSplitMutationMixin:
             examples=[to_gql_dataset_example(example) for example in examples],
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def create_dataset_split_with_examples(
         self, info: Info[Context, None], input: CreateDatasetSplitWithExamplesInput
     ) -> DatasetSplitMutationPayloadWithExamples:

phoenix/server/api/mutations/experiment_mutations.py

@@ -7,7 +7,7 @@ from strawberry.types import Info
 
 from phoenix.db import models
 from phoenix.db.helpers import get_eval_trace_ids_for_experiments, get_project_names_for_experiments
-from phoenix.server.api.auth import IsNotReadOnly
+from phoenix.server.api.auth import IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import CustomGraphQLError
 from phoenix.server.api.input_types.DeleteExperimentsInput import DeleteExperimentsInput
@@ -24,7 +24,7 @@ class ExperimentMutationPayload:
 
 @strawberry.type
 class ExperimentMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def delete_experiments(
         self,
         info: Info[Context, None],

phoenix/server/api/mutations/export_events_mutations.py

@@ -8,7 +8,7 @@ from strawberry import ID, UNSET
 from strawberry.types import Info
 
 import phoenix.core.model_schema as ms
-from phoenix.server.api.auth import IsNotReadOnly
+from phoenix.server.api.auth import IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.input_types.ClusterInput import ClusterInput
 from phoenix.server.api.types.Event import parse_event_ids_by_inferences_role, unpack_event_id
@@ -19,7 +19,7 @@ from phoenix.server.api.types.InferencesRole import AncillaryInferencesRole, Inf
 @strawberry.type
 class ExportEventsMutationMixin:
     @strawberry.mutation(
-        permission_classes=[IsNotReadOnly],
+        permission_classes=[IsNotReadOnly, IsNotViewer],
         description=(
             "Given a list of event ids, export the corresponding data subset in Parquet format."
             " File name is optional, but if specified, should be without file extension. By default"
@@ -51,7 +51,7 @@ class ExportEventsMutationMixin:
         return ExportedFile(file_name=file_name)
 
     @strawberry.mutation(
-        permission_classes=[IsNotReadOnly],
+        permission_classes=[IsNotReadOnly, IsNotViewer],
         description=(
             "Given a list of clusters, export the corresponding data subset in Parquet format."
             " File name is optional, but if specified, should be without file extension. By default"

phoenix/server/api/mutations/model_mutations.py

@@ -12,7 +12,7 @@ from strawberry.relay import GlobalID
 from strawberry.types import Info
 
 from phoenix.db import models
-from phoenix.server.api.auth import IsNotReadOnly
+from phoenix.server.api.auth import IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import BadRequest, Conflict, NotFound
 from phoenix.server.api.queries import Query
@@ -81,7 +81,7 @@ class DeleteModelMutationPayload:
 
 @strawberry.type
 class ModelMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def create_model(
         self,
         info: Info[Context, None],
@@ -114,7 +114,7 @@ class ModelMutationMixin:
             query=Query(),
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def update_model(
         self,
         info: Info[Context, None],
@@ -167,7 +167,7 @@ class ModelMutationMixin:
             query=Query(),
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def delete_model(
         self,
         info: Info[Context, None],

phoenix/server/api/mutations/project_mutations.py

@@ -8,7 +8,7 @@ from strawberry.types import Info
 
 from phoenix.config import DEFAULT_PROJECT_NAME
 from phoenix.db import models
-from phoenix.server.api.auth import IsNotReadOnly
+from phoenix.server.api.auth import IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import BadRequest, Conflict
 from phoenix.server.api.input_types.ClearProjectInput import ClearProjectInput
@@ -27,7 +27,7 @@ class ProjectMutationPayload:
 
 @strawberry.type
 class ProjectMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def create_project(
         self,
         info: Info[Context, None],
@@ -52,7 +52,7 @@ class ProjectMutationMixin:
         info.context.event_queue.put(ProjectInsertEvent((project.id,)))
         return ProjectMutationPayload(project=to_gql_project(project), query=Query())
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def delete_project(self, info: Info[Context, None], id: GlobalID) -> Query:
         project_id = from_global_id_with_expected_type(global_id=id, expected_type_name="Project")
         async with info.context.db() as session:
@@ -69,7 +69,7 @@ class ProjectMutationMixin:
         info.context.event_queue.put(ProjectDeleteEvent((project_id,)))
         return Query()
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def clear_project(self, info: Info[Context, None], input: ClearProjectInput) -> Query:
         project_id = from_global_id_with_expected_type(
             global_id=input.id, expected_type_name="Project"

phoenix/server/api/mutations/project_session_annotations_mutations.py

@@ -8,7 +8,7 @@ from strawberry import Info
 from strawberry.relay import GlobalID
 
 from phoenix.db import models
-from phoenix.server.api.auth import IsLocked, IsNotReadOnly
+from phoenix.server.api.auth import IsLocked, IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import BadRequest, Conflict, NotFound, Unauthorized
 from phoenix.server.api.helpers.annotations import get_user_identifier
@@ -38,7 +38,7 @@ class ProjectSessionAnnotationMutationPayload:
 
 @strawberry.type
 class ProjectSessionAnnotationMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def create_project_session_annotations(
         self, info: Info[Context, None], input: CreateProjectSessionAnnotationInput
     ) -> ProjectSessionAnnotationMutationPayload:
@@ -85,7 +85,7 @@ class ProjectSessionAnnotationMutationMixin:
             query=Query(),
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def update_project_session_annotations(
         self, info: Info[Context, None], input: UpdateAnnotationInput
     ) -> ProjectSessionAnnotationMutationPayload:
@@ -126,7 +126,7 @@ class ProjectSessionAnnotationMutationMixin:
             query=Query(),
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def delete_project_session_annotation(
         self, info: Info[Context, None], id: GlobalID
     ) -> ProjectSessionAnnotationMutationPayload:

phoenix/server/api/mutations/project_trace_retention_policy_mutations.py

@@ -16,7 +16,7 @@ from phoenix.db.types.trace_retention import (
     TraceRetentionCronExpression,
     TraceRetentionRule,
 )
-from phoenix.server.api.auth import IsAdminIfAuthEnabled, IsLocked, IsNotReadOnly
+from phoenix.server.api.auth import IsAdminIfAuthEnabled, IsLocked, IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import BadRequest, NotFound
 from phoenix.server.api.queries import Query
@@ -113,7 +113,9 @@ class ProjectTraceRetentionPolicyMutationPayload:
 
 @strawberry.type
 class ProjectTraceRetentionPolicyMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsAdminIfAuthEnabled, IsLocked])  # type: ignore
+    @strawberry.mutation(
+        permission_classes=[IsNotReadOnly, IsNotViewer, IsAdminIfAuthEnabled, IsLocked]
+    )  # type: ignore
     async def create_project_trace_retention_policy(
         self,
         info: Info[Context, None],
@@ -146,7 +148,9 @@ class ProjectTraceRetentionPolicyMutationMixin:
             node=ProjectTraceRetentionPolicy(id=policy.id, db_policy=policy),
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsAdminIfAuthEnabled, IsLocked])  # type: ignore
+    @strawberry.mutation(
+        permission_classes=[IsNotReadOnly, IsNotViewer, IsAdminIfAuthEnabled, IsLocked]
+    )  # type: ignore
     async def patch_project_trace_retention_policy(
         self,
         info: Info[Context, None],
@@ -204,7 +208,7 @@ class ProjectTraceRetentionPolicyMutationMixin:
             node=ProjectTraceRetentionPolicy(id=policy.id, db_policy=policy),
         )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsAdminIfAuthEnabled])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsAdminIfAuthEnabled])  # type: ignore
     async def delete_project_trace_retention_policy(
         self,
         info: Info[Context, None],

phoenix/server/api/mutations/prompt_label_mutations.py

@@ -10,7 +10,7 @@ from strawberry.relay import GlobalID
 from strawberry.types import Info
 
 from phoenix.db import models
-from phoenix.server.api.auth import IsLocked, IsNotReadOnly
+from phoenix.server.api.auth import IsLocked, IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import Conflict, NotFound
 from phoenix.server.api.queries import Query
@@ -69,7 +69,7 @@ class PromptLabelAssociationMutationPayload:
 
 @strawberry.type
 class PromptLabelMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def create_prompt_label(
         self, info: Info[Context, None], input: CreatePromptLabelInput
     ) -> PromptLabelMutationPayload:
@@ -89,7 +89,7 @@ class PromptLabelMutationMixin:
                 query=Query(),
             )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def patch_prompt_label(
         self, info: Info[Context, None], input: PatchPromptLabelInput
     ) -> PromptLabelMutationPayload:
@@ -117,7 +117,7 @@ class PromptLabelMutationMixin:
                 query=Query(),
             )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def delete_prompt_labels(
         self, info: Info[Context, None], input: DeletePromptLabelsInput
     ) -> PromptLabelDeleteMutationPayload:
@@ -139,7 +139,7 @@ class PromptLabelMutationMixin:
                 query=Query(),
             )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def set_prompt_labels(
         self, info: Info[Context, None], input: SetPromptLabelsInput
     ) -> PromptLabelAssociationMutationPayload:
@@ -168,7 +168,7 @@ class PromptLabelMutationMixin:
                 query=Query(),
             )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def unset_prompt_labels(
         self, info: Info[Context, None], input: UnsetPromptLabelsInput
     ) -> PromptLabelAssociationMutationPayload:
@@ -188,7 +188,7 @@ class PromptLabelMutationMixin:
             )
             result = await session.execute(stmt)
 
-            if result.rowcount != len(label_ids):
+            if result.rowcount != len(label_ids):  # type: ignore[attr-defined]
                 label_ids_str = ", ".join(str(i) for i in label_ids)
                 raise NotFound(
                     f"No association between prompt={prompt_id} and labels={label_ids_str}."

phoenix/server/api/mutations/prompt_mutations.py

@@ -13,7 +13,7 @@ from strawberry.types import Info
 from phoenix.db import models
 from phoenix.db.types.identifier import Identifier as IdentifierModel
 from phoenix.db.types.model_provider import ModelProvider
-from phoenix.server.api.auth import IsLocked, IsNotReadOnly
+from phoenix.server.api.auth import IsLocked, IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import BadRequest, Conflict, NotFound
 from phoenix.server.api.helpers.prompts.models import (
@@ -75,7 +75,7 @@ class DeletePromptMutationPayload:
 
 @strawberry.type
 class PromptMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def create_chat_prompt(
         self, info: Info[Context, None], input: CreateChatPromptInput
     ) -> Prompt:
@@ -142,7 +142,7 @@ class PromptMutationMixin:
                 raise Conflict(f"A prompt named '{input.name}' already exists")
         return to_gql_prompt_from_orm(prompt)
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def create_chat_prompt_version(
         self,
         info: Info[Context, None],
@@ -220,7 +220,7 @@ class PromptMutationMixin:
 
         return to_gql_prompt_from_orm(prompt)
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def delete_prompt(
         self, info: Info[Context, None], input: DeletePromptInput
     ) -> DeletePromptMutationPayload:
@@ -231,13 +231,13 @@ class PromptMutationMixin:
             stmt = delete(models.Prompt).where(models.Prompt.id == prompt_id)
             result = await session.execute(stmt)
 
-            if result.rowcount == 0:
+            if result.rowcount == 0:  # type: ignore[attr-defined]
                 raise NotFound(f"Prompt with ID '{input.prompt_id}' not found")
 
             await session.commit()
         return DeletePromptMutationPayload(query=Query())
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def clone_prompt(self, info: Info[Context, None], input: ClonePromptInput) -> Prompt:
         prompt_id = from_global_id_with_expected_type(
             global_id=input.prompt_id, expected_type_name=Prompt.__name__
@@ -290,7 +290,7 @@ class PromptMutationMixin:
                 raise Conflict(f"A prompt named '{input.name}' already exists")
         return to_gql_prompt_from_orm(new_prompt)
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def patch_prompt(self, info: Info[Context, None], input: PatchPromptInput) -> Prompt:
         prompt_id = from_global_id_with_expected_type(
             global_id=input.prompt_id, expected_type_name=Prompt.__name__

phoenix/server/api/mutations/prompt_version_tag_mutations.py

@@ -10,7 +10,7 @@ from strawberry.types import Info
 
 from phoenix.db import models
 from phoenix.db.types.identifier import Identifier as IdentifierModel
-from phoenix.server.api.auth import IsLocked, IsNotReadOnly
+from phoenix.server.api.auth import IsLocked, IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import BadRequest, Conflict, NotFound
 from phoenix.server.api.queries import Query
@@ -42,7 +42,7 @@ class PromptVersionTagMutationPayload:
 
 @strawberry.type
 class PromptVersionTagMutationMixin:
-    @strawberry.mutation(permission_classes=[IsNotReadOnly])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer])  # type: ignore
     async def delete_prompt_version_tag(
         self, info: Info[Context, None], input: DeletePromptVersionTagInput
     ) -> PromptVersionTagMutationPayload:
@@ -78,7 +78,7 @@ class PromptVersionTagMutationMixin:
                 prompt_version_tag=None, query=Query(), prompt=to_gql_prompt_from_orm(prompt)
             )
 
-    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.mutation(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def set_prompt_version_tag(
         self, info: Info[Context, None], input: SetPromptVersionTagInput
     ) -> PromptVersionTagMutationPayload: