arize-phoenix 12.4.0__py3-none-any.whl → 12.6.0__py3-none-any.whl

phoenix/server/api/routers/auth.py

@@ -161,7 +161,7 @@ async def refresh_tokens(request: Request) -> Response:
         or (expiration_time := refresh_token_claims.expiration_time) is None
     ):
         raise HTTPException(status_code=401, detail="Invalid refresh token")
-    if expiration_time.timestamp() < datetime.now().timestamp():
+    if expiration_time.timestamp() <= datetime.now(timezone.utc).timestamp():
         raise HTTPException(status_code=401, detail="Expired refresh token")
     await token_store.revoke(refresh_token_id)
 
@@ -253,7 +253,7 @@ async def reset_password(request: Request) -> Response:
         not (token := data.get("token"))
         or not isinstance((claims := await token_store.read(token)), PasswordResetTokenClaims)
         or not claims.expiration_time
-        or claims.expiration_time < datetime.now(timezone.utc)
+        or claims.expiration_time <= datetime.now(timezone.utc)
     ):
         raise INVALID_TOKEN
     assert (user_id := claims.subject)

phoenix/server/api/routers/v1/__init__.py

@@ -1,7 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.security import APIKeyHeader
 
-from phoenix.server.bearer_auth import is_authenticated
+from phoenix.server.bearer_auth import PhoenixUser, is_authenticated
 
 from .annotation_configs import router as annotation_configs_router
 from .annotations import router as annotations_router
@@ -33,6 +33,20 @@ async def prevent_access_in_read_only_mode(request: Request) -> None:
         )
 
 
+async def restrict_access_by_viewers(request: Request) -> None:
+    """
+    Prevents access to the REST API for viewers, except for GET requests
+    and specific allowed POST routes.
+    """
+    if request.method == "GET":
+        return
+    if isinstance(request.user, PhoenixUser) and request.user.is_viewer:
+        raise HTTPException(
+            status_code=403,
+            detail="Viewers cannot perform this action.",
+        )
+
+
 def create_v1_router(authentication_enabled: bool) -> APIRouter:
     """
     Instantiates the v1 REST API router.
@@ -50,6 +64,7 @@ def create_v1_router(authentication_enabled: bool) -> APIRouter:
             )
         )
         dependencies.append(Depends(is_authenticated))
+        dependencies.append(Depends(restrict_access_by_viewers))
 
     router = APIRouter(
         prefix="/v1",

phoenix/server/api/routers/v1/annotation_configs.py

@@ -349,7 +349,13 @@ async def delete_annotation_config(
     request: Request,
     config_id: str = Path(..., description="ID of the annotation configuration"),
 ) -> DeleteAnnotationConfigResponseBody:
-    config_gid = GlobalID.from_id(config_id)
+    try:
+        config_gid = GlobalID.from_id(config_id)
+    except Exception:
+        raise HTTPException(
+            status_code=422,
+            detail=f"Invalid annotation configuration ID format: {config_id}",
+        )
     if config_gid.type_name not in (
         CategoricalAnnotationConfigType.__name__,
         ContinuousAnnotationConfigType.__name__,

phoenix/server/api/routers/v1/datasets.py

@@ -209,7 +209,13 @@ class GetDatasetResponseBody(ResponseBody[DatasetWithExampleCount]):
 async def get_dataset(
     request: Request, id: str = Path(description="The ID of the dataset")
 ) -> GetDatasetResponseBody:
-    dataset_id = GlobalID.from_id(id)
+    try:
+        dataset_id = GlobalID.from_id(id)
+    except Exception as e:
+        raise HTTPException(
+            detail=f"Invalid dataset ID format: {id}",
+            status_code=422,
+        ) from e
 
     if (type_name := dataset_id.type_name) != DATASET_NODE_NAME:
         raise HTTPException(detail=f"ID {dataset_id} refers to a f{type_name}", status_code=404)
@@ -400,7 +406,12 @@ async def upload_dataset(
         description="If true, fulfill request synchronously and return JSON containing dataset_id.",
     ),
 ) -> Optional[UploadDatasetResponseBody]:
-    request_content_type = request.headers["content-type"]
+    request_content_type = request.headers.get("content-type")
+    if not request_content_type:
+        raise HTTPException(
+            detail="Missing content-type header",
+            status_code=400,
+        )
     examples: Union[Examples, Awaitable[Examples]]
     if request_content_type.startswith("application/json"):
         try:
@@ -709,8 +720,24 @@ async def get_dataset_examples(
         ),
     ),
 ) -> ListDatasetExamplesResponseBody:
-    dataset_gid = GlobalID.from_id(id)
-    version_gid = GlobalID.from_id(version_id) if version_id else None
+    try:
+        dataset_gid = GlobalID.from_id(id)
+    except Exception as e:
+        raise HTTPException(
+            detail=f"Invalid dataset ID format: {id}",
+            status_code=422,
+        ) from e
+
+    if version_id:
+        try:
+            version_gid = GlobalID.from_id(version_id)
+        except Exception as e:
+            raise HTTPException(
+                detail=f"Invalid dataset version ID format: {version_id}",
+                status_code=422,
+            ) from e
+    else:
+        version_gid = None
 
     if (dataset_type := dataset_gid.type_name) != "Dataset":
         raise HTTPException(detail=f"ID {dataset_gid} refers to a {dataset_type}", status_code=404)
@@ -992,12 +1019,25 @@ def _get_content_jsonl_openai_evals(examples: list[models.DatasetExampleRevision
 async def _get_db_examples(
     *, session: Any, id: str, version_id: Optional[str]
 ) -> tuple[str, list[models.DatasetExampleRevision]]:
-    dataset_id = from_global_id_with_expected_type(GlobalID.from_id(id), DATASET_NODE_NAME)
+    try:
+        dataset_id = from_global_id_with_expected_type(GlobalID.from_id(id), DATASET_NODE_NAME)
+    except Exception as e:
+        raise HTTPException(
+            detail=f"Invalid dataset ID format: {id}",
+            status_code=422,
+        ) from e
+
     dataset_version_id: Optional[int] = None
     if version_id:
-        dataset_version_id = from_global_id_with_expected_type(
-            GlobalID.from_id(version_id), DATASET_VERSION_NODE_NAME
-        )
+        try:
+            dataset_version_id = from_global_id_with_expected_type(
+                GlobalID.from_id(version_id), DATASET_VERSION_NODE_NAME
+            )
+        except Exception as e:
+            raise HTTPException(
+                detail=f"Invalid dataset version ID format: {version_id}",
+                status_code=422,
+            ) from e
     latest_version = (
         select(
             models.DatasetExampleRevision.dataset_example_id,

phoenix/server/api/routers/v1/experiment_runs.py

@@ -159,7 +159,13 @@ async def list_experiment_runs(
         gt=0,
     ),
 ) -> ListExperimentRunsResponseBody:
-    experiment_gid = GlobalID.from_id(experiment_id)
+    try:
+        experiment_gid = GlobalID.from_id(experiment_id)
+    except Exception as e:
+        raise HTTPException(
+            detail=f"Invalid experiment ID format: {experiment_id}",
+            status_code=422,
+        ) from e
     try:
         experiment_rowid = from_global_id_with_expected_type(experiment_gid, "Experiment")
     except ValueError:

phoenix/server/api/routers/v1/experiments.py

@@ -104,7 +104,13 @@ async def create_experiment(
     request_body: CreateExperimentRequestBody,
     dataset_id: str = Path(..., title="Dataset ID"),
 ) -> CreateExperimentResponseBody:
-    dataset_globalid = GlobalID.from_id(dataset_id)
+    try:
+        dataset_globalid = GlobalID.from_id(dataset_id)
+    except Exception as e:
+        raise HTTPException(
+            detail=f"Invalid dataset ID format: {dataset_id}",
+            status_code=422,
+        ) from e
     try:
         dataset_rowid = from_global_id_with_expected_type(dataset_globalid, "Dataset")
     except ValueError:
@@ -117,6 +123,12 @@ async def create_experiment(
     if dataset_version_globalid_str is not None:
         try:
             dataset_version_globalid = GlobalID.from_id(dataset_version_globalid_str)
+        except Exception as e:
+            raise HTTPException(
+                detail=f"Invalid dataset version ID format: {dataset_version_globalid_str}",
+                status_code=422,
+            ) from e
+        try:
             dataset_version_id = from_global_id_with_expected_type(
                 dataset_version_globalid, "DatasetVersion"
             )
@@ -232,7 +244,13 @@ class GetExperimentResponseBody(ResponseBody[Experiment]):
     response_description="Experiment retrieved successfully",
 )
 async def get_experiment(request: Request, experiment_id: str) -> GetExperimentResponseBody:
-    experiment_globalid = GlobalID.from_id(experiment_id)
+    try:
+        experiment_globalid = GlobalID.from_id(experiment_id)
+    except Exception as e:
+        raise HTTPException(
+            detail=f"Invalid experiment ID format: {experiment_id}",
+            status_code=422,
+        ) from e
     try:
         experiment_rowid = from_global_id_with_expected_type(experiment_globalid, "Experiment")
     except ValueError:
@@ -282,7 +300,13 @@ async def list_experiments(
     request: Request,
     dataset_id: str = Path(..., title="Dataset ID"),
 ) -> ListExperimentsResponseBody:
-    dataset_gid = GlobalID.from_id(dataset_id)
+    try:
+        dataset_gid = GlobalID.from_id(dataset_id)
+    except Exception as e:
+        raise HTTPException(
+            detail=f"Invalid dataset ID format: {dataset_id}",
+            status_code=422,
+        ) from e
     try:
         dataset_rowid = from_global_id_with_expected_type(dataset_gid, "Dataset")
     except ValueError:
@@ -397,7 +421,13 @@ async def get_experiment_json(
     request: Request,
     experiment_id: str = Path(..., title="Experiment ID"),
 ) -> Response:
-    experiment_globalid = GlobalID.from_id(experiment_id)
+    try:
+        experiment_globalid = GlobalID.from_id(experiment_id)
+    except Exception as e:
+        raise HTTPException(
+            detail=f"Invalid experiment ID format: {experiment_id}",
+            status_code=422,
+        ) from e
     try:
         experiment_rowid = from_global_id_with_expected_type(experiment_globalid, "Experiment")
     except ValueError:
@@ -464,7 +494,13 @@ async def get_experiment_csv(
     request: Request,
     experiment_id: str = Path(..., title="Experiment ID"),
 ) -> Response:
-    experiment_globalid = GlobalID.from_id(experiment_id)
+    try:
+        experiment_globalid = GlobalID.from_id(experiment_id)
+    except Exception as e:
+        raise HTTPException(
+            detail=f"Invalid experiment ID format: {experiment_id}",
+            status_code=422,
+        ) from e
     try:
         experiment_rowid = from_global_id_with_expected_type(experiment_globalid, "Experiment")
     except ValueError:

phoenix/server/api/routers/v1/projects.py

@@ -9,7 +9,6 @@ from strawberry.relay import GlobalID
 from phoenix.config import DEFAULT_PROJECT_NAME
 from phoenix.db import models
 from phoenix.db.helpers import exclude_experiment_projects
-from phoenix.db.models import UserRoleName
 from phoenix.server.api.routers.v1.models import V1RoutesBaseModel
 from phoenix.server.api.routers.v1.utils import (
     PaginatedResponseBody,
@@ -18,7 +17,7 @@ from phoenix.server.api.routers.v1.utils import (
     add_errors_to_responses,
 )
 from phoenix.server.api.types.Project import Project as ProjectNodeType
-from phoenix.server.authorization import is_not_locked
+from phoenix.server.authorization import is_not_locked, require_admin
 
 router = APIRouter(tags=["projects"])
 
@@ -210,7 +209,7 @@ async def create_project(
 
 @router.put(
     "/projects/{project_identifier}",
-    dependencies=[Depends(is_not_locked)],
+    dependencies=[Depends(require_admin), Depends(is_not_locked)],
     operation_id="updateProject",
     summary="Update a project by ID or name",  # noqa: E501
     description="Update an existing project with new configuration. Project names cannot be changed. The project identifier is either project ID or project name. Note: When using a project name as the identifier, it cannot contain slash (/), question mark (?), or pound sign (#) characters.",  # noqa: E501
@@ -245,20 +244,6 @@ async def update_project(
     Raises:
         HTTPException: If the project identifier format is invalid or the project is not found.
     """  # noqa: E501
-    if request.app.state.authentication_enabled:
-        async with request.app.state.db() as session:
-            # Check if the user is an admin
-            stmt = (
-                select(models.UserRole.name)
-                .join(models.User)
-                .where(models.User.id == int(request.user.identity))
-            )
-            role_name: UserRoleName = await session.scalar(stmt)
-        if role_name != "ADMIN" and role_name != "SYSTEM":
-            raise HTTPException(
-                status_code=403,
-                detail="Only admins can update projects",
-            )
     async with request.app.state.db() as session:
         project = await _get_project_by_identifier(session, project_identifier)
 
@@ -272,6 +257,7 @@ async def update_project(
 
 @router.delete(
     "/projects/{project_identifier}",
+    dependencies=[Depends(require_admin)],
     operation_id="deleteProject",
     summary="Delete a project by ID or name",  # noqa: E501
     description="Delete an existing project and all its associated data. The project identifier is either project ID or project name. The default project cannot be deleted. Note: When using a project name as the identifier, it cannot contain slash (/), question mark (?), or pound sign (#) characters.",  # noqa: E501
@@ -305,20 +291,6 @@ async def delete_project(
     Raises:
         HTTPException: If the project identifier format is invalid, the project is not found, or it's the default project.
     """  # noqa: E501
-    if request.app.state.authentication_enabled:
-        async with request.app.state.db() as session:
-            # Check if the user is an admin
-            stmt = (
-                select(models.UserRole.name)
-                .join(models.User)
-                .where(models.User.id == int(request.user.identity))
-            )
-            role_name: UserRoleName = await session.scalar(stmt)
-        if role_name != "ADMIN" and role_name != "SYSTEM":
-            raise HTTPException(
-                status_code=403,
-                detail="Only admins can delete projects",
-            )
     async with request.app.state.db() as session:
         project = await _get_project_by_identifier(session, project_identifier)
 

phoenix/server/api/routers/v1/users.py

@@ -208,13 +208,6 @@ async def create_user(
             detail="Cannot create users with SYSTEM role",
         )
 
-    # TODO: Implement VIEWER role
-    if role == "VIEWER":
-        raise HTTPException(
-            status_code=400,
-            detail="VIEWER role not yet implemented",
-        )
-
     user: models.User
     if isinstance(user_data, LocalUserData):
         password = (user_data.password or secrets.token_hex()).strip()

phoenix/server/api/subscriptions.py

@@ -27,7 +27,7 @@ from phoenix.config import PLAYGROUND_PROJECT_NAME
 from phoenix.datetime_utils import local_now, normalize_datetime
 from phoenix.db import models
 from phoenix.db.helpers import insert_experiment_with_examples_snapshot
-from phoenix.server.api.auth import IsLocked, IsNotReadOnly
+from phoenix.server.api.auth import IsLocked, IsNotReadOnly, IsNotViewer
 from phoenix.server.api.context import Context
 from phoenix.server.api.exceptions import BadRequest, CustomGraphQLError, NotFound
 from phoenix.server.api.helpers.playground_clients import (
@@ -94,7 +94,7 @@ ChatStream: TypeAlias = AsyncGenerator[ChatCompletionSubscriptionPayload, None]
 
 @strawberry.type
 class Subscription:
-    @strawberry.subscription(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.subscription(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def chat_completion(
         self, info: Info[Context, None], input: ChatCompletionInput
     ) -> AsyncIterator[ChatCompletionSubscriptionPayload]:
@@ -193,7 +193,7 @@ class Subscription:
         info.context.event_queue.put(SpanInsertEvent(ids=(playground_project_id,)))
         yield ChatCompletionSubscriptionResult(span=Span(span_rowid=db_span.id, db_span=db_span))
 
-    @strawberry.subscription(permission_classes=[IsNotReadOnly, IsLocked])  # type: ignore
+    @strawberry.subscription(permission_classes=[IsNotReadOnly, IsNotViewer, IsLocked])  # type: ignore
     async def chat_completion_over_dataset(
         self, info: Info[Context, None], input: ChatCompletionOverDatasetInput
     ) -> AsyncIterator[ChatCompletionSubscriptionPayload]:

phoenix/server/api/types/Dataset.py

@@ -3,7 +3,7 @@ from datetime import datetime
 from typing import ClassVar, Optional, cast
 
 import strawberry
-from sqlalchemy import and_, func, or_, select
+from sqlalchemy import Text, and_, func, or_, select
 from sqlalchemy.sql.functions import count
 from strawberry import UNSET
 from strawberry.relay import Connection, GlobalID, Node, NodeID
@@ -19,6 +19,7 @@ from phoenix.server.api.types.DatasetExperimentAnnotationSummary import (
     DatasetExperimentAnnotationSummary,
 )
 from phoenix.server.api.types.DatasetLabel import DatasetLabel, to_gql_dataset_label
+from phoenix.server.api.types.DatasetSplit import DatasetSplit, to_gql_dataset_split
 from phoenix.server.api.types.DatasetVersion import DatasetVersion
 from phoenix.server.api.types.Experiment import Experiment, to_gql_experiment
 from phoenix.server.api.types.node import from_global_id_with_expected_type
@@ -87,6 +88,7 @@ class Dataset(Node):
         self,
         info: Info[Context, None],
         dataset_version_id: Optional[GlobalID] = UNSET,
+        split_ids: Optional[list[GlobalID]] = UNSET,
     ) -> int:
         dataset_id = self.id_attr
         version_id = (
@@ -97,6 +99,20 @@ class Dataset(Node):
             if dataset_version_id
             else None
         )
+
+        # Parse split IDs if provided
+        split_rowids: Optional[list[int]] = None
+        if split_ids:
+            split_rowids = []
+            for split_id in split_ids:
+                try:
+                    split_rowid = from_global_id_with_expected_type(
+                        global_id=split_id, expected_type_name=models.DatasetSplit.__name__
+                    )
+                    split_rowids.append(split_rowid)
+                except Exception:
+                    raise BadRequest(f"Invalid split ID: {split_id}")
+
         revision_ids = (
             select(func.max(models.DatasetExampleRevision.id))
             .join(models.DatasetExample)
@@ -113,11 +129,36 @@ class Dataset(Node):
             revision_ids = revision_ids.where(
                 models.DatasetExampleRevision.dataset_version_id <= version_id_subquery
             )
-        stmt = (
-            select(count(models.DatasetExampleRevision.id))
-            .where(models.DatasetExampleRevision.id.in_(revision_ids))
-            .where(models.DatasetExampleRevision.revision_kind != "DELETE")
-        )
+
+        # Build the count query
+        if split_rowids:
+            # When filtering by splits, count distinct examples that belong to those splits
+            stmt = (
+                select(count(models.DatasetExample.id.distinct()))
+                .join(
+                    models.DatasetExampleRevision,
+                    onclause=(
+                        models.DatasetExample.id == models.DatasetExampleRevision.dataset_example_id
+                    ),
+                )
+                .join(
+                    models.DatasetSplitDatasetExample,
+                    onclause=(
+                        models.DatasetExample.id
+                        == models.DatasetSplitDatasetExample.dataset_example_id
+                    ),
+                )
+                .where(models.DatasetExampleRevision.id.in_(revision_ids))
+                .where(models.DatasetExampleRevision.revision_kind != "DELETE")
+                .where(models.DatasetSplitDatasetExample.dataset_split_id.in_(split_rowids))
+            )
+        else:
+            stmt = (
+                select(count(models.DatasetExampleRevision.id))
+                .where(models.DatasetExampleRevision.id.in_(revision_ids))
+                .where(models.DatasetExampleRevision.revision_kind != "DELETE")
+            )
+
         async with info.context.db() as session:
             return (await session.scalar(stmt)) or 0
 
@@ -126,10 +167,12 @@ class Dataset(Node):
         self,
         info: Info[Context, None],
         dataset_version_id: Optional[GlobalID] = UNSET,
+        split_ids: Optional[list[GlobalID]] = UNSET,
         first: Optional[int] = 50,
         last: Optional[int] = UNSET,
         after: Optional[CursorString] = UNSET,
         before: Optional[CursorString] = UNSET,
+        filter: Optional[str] = UNSET,
     ) -> Connection[DatasetExample]:
         args = ConnectionArgs(
             first=first,
@@ -145,6 +188,20 @@ class Dataset(Node):
             if dataset_version_id
             else None
         )
+
+        # Parse split IDs if provided
+        split_rowids: Optional[list[int]] = None
+        if split_ids:
+            split_rowids = []
+            for split_id in split_ids:
+                try:
+                    split_rowid = from_global_id_with_expected_type(
+                        global_id=split_id, expected_type_name=models.DatasetSplit.__name__
+                    )
+                    split_rowids.append(split_rowid)
+                except Exception:
+                    raise BadRequest(f"Invalid split ID: {split_id}")
+
         revision_ids = (
             select(func.max(models.DatasetExampleRevision.id))
             .join(models.DatasetExample)
@@ -176,6 +233,31 @@ class Dataset(Node):
             )
             .order_by(models.DatasetExampleRevision.dataset_example_id.desc())
         )
+
+        # Filter by split IDs if provided
+        if split_rowids:
+            query = (
+                query.join(
+                    models.DatasetSplitDatasetExample,
+                    onclause=(
+                        models.DatasetExample.id
+                        == models.DatasetSplitDatasetExample.dataset_example_id
+                    ),
+                )
+                .where(models.DatasetSplitDatasetExample.dataset_split_id.in_(split_rowids))
+                .distinct()
+            )
+        # Apply filter if provided - search through JSON fields (input, output, metadata)
+        if filter is not UNSET and filter:
+            # Create a filter that searches for the filter string in JSON fields
+            # Using PostgreSQL's JSON operators for case-insensitive text search
+            filter_condition = or_(
+                func.cast(models.DatasetExampleRevision.input, Text).ilike(f"%{filter}%"),
+                func.cast(models.DatasetExampleRevision.output, Text).ilike(f"%{filter}%"),
+                func.cast(models.DatasetExampleRevision.metadata_, Text).ilike(f"%{filter}%"),
+            )
+            query = query.where(filter_condition)
+
         async with info.context.db() as session:
             dataset_examples = [
                 DatasetExample(
@@ -187,6 +269,13 @@ class Dataset(Node):
             ]
         return connection_from_list(data=dataset_examples, args=args)
 
+    @strawberry.field
+    async def splits(self, info: Info[Context, None]) -> list[DatasetSplit]:
+        return [
+            to_gql_dataset_split(split)
+            for split in await info.context.data_loaders.dataset_dataset_splits.load(self.id_attr)
+        ]
+
     @strawberry.field(
         description="Number of experiments for a specific version if version is specified, "
         "or for all versions if version is not specified."

phoenix/server/api/types/Experiment.py

@@ -11,19 +11,27 @@ from strawberry.types import Info
 
 from phoenix.db import models
 from phoenix.server.api.context import Context
+from phoenix.server.api.exceptions import BadRequest
+from phoenix.server.api.input_types.ExperimentRunSort import (
+    ExperimentRunSort,
+    add_order_by_and_page_start_to_query,
+    get_experiment_run_cursor,
+)
 from phoenix.server.api.types.CostBreakdown import CostBreakdown
 from phoenix.server.api.types.DatasetVersion import DatasetVersion
 from phoenix.server.api.types.ExperimentAnnotationSummary import ExperimentAnnotationSummary
 from phoenix.server.api.types.ExperimentRun import ExperimentRun, to_gql_experiment_run
 from phoenix.server.api.types.pagination import (
-    ConnectionArgs,
+    Cursor,
     CursorString,
-    connection_from_list,
+    connection_from_cursors_and_nodes,
 )
 from phoenix.server.api.types.Project import Project
 from phoenix.server.api.types.SpanCostDetailSummaryEntry import SpanCostDetailSummaryEntry
 from phoenix.server.api.types.SpanCostSummary import SpanCostSummary
 
+_DEFAULT_EXPERIMENT_RUNS_PAGE_SIZE = 50
+
 
 @strawberry.type
 class Experiment(Node):
@@ -57,33 +65,60 @@ class Experiment(Node):
     async def runs(
         self,
         info: Info[Context, None],
-        first: Optional[int] = 50,
-        last: Optional[int] = UNSET,
+        first: Optional[int] = _DEFAULT_EXPERIMENT_RUNS_PAGE_SIZE,
         after: Optional[CursorString] = UNSET,
-        before: Optional[CursorString] = UNSET,
+        sort: Optional[ExperimentRunSort] = UNSET,
     ) -> Connection[ExperimentRun]:
-        args = ConnectionArgs(
-            first=first,
-            after=after if isinstance(after, CursorString) else None,
-            last=last,
-            before=before if isinstance(before, CursorString) else None,
+        if first is not None and first <= 0:
+            raise BadRequest("first must be a positive integer if set")
+        experiment_rowid = self.id_attr
+        page_size = first or _DEFAULT_EXPERIMENT_RUNS_PAGE_SIZE
+        experiment_runs_query = (
+            select(models.ExperimentRun)
+            .where(models.ExperimentRun.experiment_id == experiment_rowid)
+            .options(joinedload(models.ExperimentRun.trace).load_only(models.Trace.trace_id))
+            .limit(page_size + 1)
         )
-        experiment_id = self.id_attr
+
+        after_experiment_run_rowid = None
+        after_sort_column_value = None
+        if after:
+            cursor = Cursor.from_string(after)
+            after_experiment_run_rowid = cursor.rowid
+            if cursor.sort_column is not None:
+                after_sort_column_value = cursor.sort_column.value
+
+        experiment_runs_query = add_order_by_and_page_start_to_query(
+            query=experiment_runs_query,
+            sort=sort,
+            experiment_rowid=experiment_rowid,
+            after_experiment_run_rowid=after_experiment_run_rowid,
+            after_sort_column_value=after_sort_column_value,
+        )
+
         async with info.context.db() as session:
-            runs = (
-                await session.scalars(
-                    select(models.ExperimentRun)
-                    .where(models.ExperimentRun.experiment_id == experiment_id)
-                    .order_by(
-                        models.ExperimentRun.dataset_example_id.asc(),
-                        models.ExperimentRun.repetition_number.asc(),
-                    )
-                    .options(
-                        joinedload(models.ExperimentRun.trace).load_only(models.Trace.trace_id)
-                    )
-                )
-            ).all()
-        return connection_from_list([to_gql_experiment_run(run) for run in runs], args)
+            results = (await session.execute(experiment_runs_query)).all()
+
+        has_next_page = False
+        if len(results) > page_size:
+            results = results[:page_size]
+            has_next_page = True
+
+        cursors_and_nodes = []
+        for result in results:
+            run = result[0]
+            annotation_score = result[1] if len(result) > 1 else None
+            gql_run = to_gql_experiment_run(run)
+            cursor = get_experiment_run_cursor(
+                run=run, annotation_score=annotation_score, sort=sort
+            )
+            cursors_and_nodes.append((cursor, gql_run))
+
+        return connection_from_cursors_and_nodes(
+            cursors_and_nodes=cursors_and_nodes,
+            has_previous_page=False,  # set to false since we are only doing forward pagination (https://relay.dev/graphql/connections.htm#sec-undefined.PageInfo.Fields) # noqa: E501
+            has_next_page=has_next_page,
+        )
 
     @strawberry.field
     async def run_count(self, info: Info[Context, None]) -> int: