arize-phoenix 8.25.0__tar.gz → 8.26.0__tar.gz

{arize_phoenix-8.25.0 → arize_phoenix-8.26.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arize-phoenix
-Version: 8.25.0
+Version: 8.26.0
 Summary: AI Observability and Evaluation
 Project-URL: Documentation, https://docs.arize.com/phoenix/
 Project-URL: Issues, https://github.com/Arize-ai/phoenix/issues

{arize_phoenix-8.25.0 → arize_phoenix-8.26.0}/src/phoenix/config.py

@@ -144,6 +144,17 @@ ENV_PHOENIX_SERVER_INSTRUMENTATION_OTLP_TRACE_COLLECTOR_GRPC_ENDPOINT = (
 ENV_PHOENIX_ENABLE_AUTH = "PHOENIX_ENABLE_AUTH"
 ENV_PHOENIX_DISABLE_RATE_LIMIT = "PHOENIX_DISABLE_RATE_LIMIT"
 ENV_PHOENIX_SECRET = "PHOENIX_SECRET"
+"""
+The secret key used for signing JWTs. It must be at least 32 characters long and include at least
+one digit and one lowercase letter.
+"""
+ENV_PHOENIX_ADMIN_SECRET = "PHOENIX_ADMIN_SECRET"
+"""
+A secret key that can be used as a bearer token instead of an API key. It authenticates as the
+first system user. This key must be at least 32 characters long, include at least one digit and
+one lowercase letter, and must be different from PHOENIX_SECRET. Additionally, it must not be set
+if PHOENIX_SECRET is not configured.
+"""
 ENV_PHOENIX_DEFAULT_ADMIN_INITIAL_PASSWORD = "PHOENIX_DEFAULT_ADMIN_INITIAL_PASSWORD"
 """
 The initial password for the default admin account, which defaults to 'admin' if not
@@ -383,6 +394,29 @@ def get_env_phoenix_secret() -> Optional[str]:
     return phoenix_secret
 
 
+def get_env_phoenix_admin_secret() -> Optional[str]:
+    """
+    Gets the value of the PHOENIX_ADMIN_SECRET environment variable
+    and performs validation.
+    """
+    phoenix_admin_secret = getenv(ENV_PHOENIX_ADMIN_SECRET)
+    if phoenix_admin_secret is None:
+        return None
+    if (phoenix_secret := get_env_phoenix_secret()) is None:
+        raise ValueError(
+            f"`{ENV_PHOENIX_ADMIN_SECRET}` must be not be set without "
+            f"setting `{ENV_PHOENIX_SECRET}`."
+        )
+    from phoenix.auth import REQUIREMENTS_FOR_PHOENIX_SECRET
+
+    REQUIREMENTS_FOR_PHOENIX_SECRET.validate(phoenix_admin_secret, "Phoenix secret")
+    if phoenix_admin_secret == phoenix_secret:
+        raise ValueError(
+            f"`{ENV_PHOENIX_ADMIN_SECRET}` must be different from `{ENV_PHOENIX_SECRET}`"
+        )
+    return phoenix_admin_secret
+
+
 def get_env_default_admin_initial_password() -> str:
     from phoenix.auth import DEFAULT_ADMIN_PASSWORD
 
@@ -1108,7 +1142,21 @@ def get_env_allowed_origins() -> Optional[list[str]]:
 def verify_server_environment_variables() -> None:
     """Verify that the environment variables are set correctly. Raises an error otherwise."""
     get_env_root_url()
+    get_env_phoenix_secret()
+    get_env_phoenix_admin_secret()
 
 
 SKLEARN_VERSION = cast(tuple[int, int], tuple(map(int, version("scikit-learn").split(".", 2)[:2])))
 PLAYGROUND_PROJECT_NAME = "playground"
+
+SYSTEM_USER_ID: Optional[int] = None
+"""
+The ID of the system user in the database.
+
+This value is set during application startup by the facilitator and is used to
+identify the system user for authentication purposes.
+
+When the PHOENIX_ADMIN_SECRET is used as a bearer token in API requests, the
+request is authenticated as the system user with the user_id set to this
+SYSTEM_USER_ID value (only if this variable is not None).
+"""

{arize_phoenix-8.25.0 → arize_phoenix-8.26.0}/src/phoenix/db/facilitator.py

@@ -13,6 +13,7 @@ from sqlalchemy import (
     select,
 )
 
+from phoenix import config
 from phoenix.auth import (
     DEFAULT_ADMIN_EMAIL,
     DEFAULT_ADMIN_USERNAME,
@@ -54,6 +55,7 @@ class Facilitator:
         for fn in (
             _ensure_enums,
             _ensure_user_roles,
+            _get_system_user_id,
             partial(_ensure_admins, email_sender=self._email_sender),
         ):
             await fn(self._db)
@@ -130,6 +132,23 @@ async def _ensure_user_roles(db: DbSessionFactory) -> None:
         await session.flush()
 
 
+async def _get_system_user_id(db: DbSessionFactory) -> None:
+    """
+    Set the system user ID in the config. This is used to identify the system user in the database.
+    """
+    async with db() as session:
+        system_user_id = await session.scalar(
+            select(models.User.id)
+            .join(models.UserRole)
+            .where(models.UserRole.name == UserRole.SYSTEM.value)
+            .order_by(models.User.id)
+            .limit(1)
+        )
+    if system_user_id is None:
+        raise ValueError("System user not found in database")
+    config.SYSTEM_USER_ID = system_user_id
+
+
 async def _ensure_admins(
     db: DbSessionFactory,
     *,

{arize_phoenix-8.25.0 → arize_phoenix-8.26.0}/src/phoenix/server/bearer_auth.py

@@ -12,12 +12,14 @@ from starlette.authentication import AuthCredentials, AuthenticationBackend, Bas
 from starlette.requests import HTTPConnection
 from starlette.status import HTTP_401_UNAUTHORIZED
 
+from phoenix import config
 from phoenix.auth import (
     PHOENIX_ACCESS_TOKEN_COOKIE_NAME,
     CanReadToken,
     ClaimSetStatus,
     Token,
 )
+from phoenix.config import get_env_phoenix_admin_secret
 from phoenix.db import enums
 from phoenix.db.enums import UserRole
 from phoenix.db.models import User as OrmUser
@@ -50,6 +52,12 @@ class BearerTokenAuthBackend(HasTokenStore, AuthenticationBackend):
             scheme, _, token = header.partition(" ")
             if scheme.lower() != "bearer" or not token:
                 return None
+            if (
+                (admin_secret := get_env_phoenix_admin_secret())
+                and token == admin_secret
+                and config.SYSTEM_USER_ID is not None
+            ):
+                return AuthCredentials(), PhoenixSystemUser(UserId(config.SYSTEM_USER_ID))
         elif access_token := conn.cookies.get(PHOENIX_ACCESS_TOKEN_COOKIE_NAME):
             token = access_token
         else:
@@ -85,6 +93,15 @@ class PhoenixUser(BaseUser):
         return True
 
 
+class PhoenixSystemUser(PhoenixUser):
+    def __init__(self, user_id: UserId) -> None:
+        self._user_id = user_id
+
+    @property
+    def is_admin(self) -> bool:
+        return True
+
+
 class ApiKeyInterceptor(HasTokenStore, AsyncServerInterceptor):
     async def intercept(
         self,
@@ -98,6 +115,12 @@ class ApiKeyInterceptor(HasTokenStore, AsyncServerInterceptor):
                 scheme, _, token = datum.value.partition(" ")
                 if scheme.lower() != "bearer" or not token:
                     break
+                if (
+                    (admin_secret := get_env_phoenix_admin_secret())
+                    and token == admin_secret
+                    and config.SYSTEM_USER_ID is not None
+                ):
+                    return await method(request_or_iterator, context)
                 claims = await self._token_store.read(Token(token))
                 if not (isinstance(claims, UserClaimSet) and isinstance(claims.subject, UserId)):
                     break
@@ -124,6 +147,8 @@ async def is_authenticated(
         raise HTTPException(status_code=HTTP_401_UNAUTHORIZED, detail="Invalid token")
     if websocket and not isinstance((user := websocket.user), PhoenixUser):
         raise WebSocketException(code=HTTP_401_UNAUTHORIZED, reason="Invalid token")
+    if isinstance(user, PhoenixSystemUser):
+        return
     claims = user.claims
     if claims.status is ClaimSetStatus.EXPIRED:
         raise HTTPException(status_code=HTTP_401_UNAUTHORIZED, detail="Expired token")

{arize_phoenix-8.25.0 → arize_phoenix-8.26.0}/src/phoenix/server/static/.vite/manifest.json

@@ -1,22 +1,22 @@
 {
-  "_components-DM3pknSX.js": {
-    "file": "assets/components-DM3pknSX.js",
+  "_components-B5CAbHpr.js": {
+    "file": "assets/components-B5CAbHpr.js",
     "name": "components",
     "imports": [
       "_vendor-DCvpCpca.js",
-      "_pages-BkMw0RH2.js",
+      "_pages-cfOsoZi6.js",
       "_vendor-arizeai-Ce3Kd6MM.js",
       "_vendor-codemirror-CoZ2wzq8.js",
       "_vendor-three-C5WAXd5r.js"
     ]
   },
-  "_pages-BkMw0RH2.js": {
-    "file": "assets/pages-BkMw0RH2.js",
+  "_pages-cfOsoZi6.js": {
+    "file": "assets/pages-cfOsoZi6.js",
     "name": "pages",
     "imports": [
       "_vendor-DCvpCpca.js",
       "_vendor-arizeai-Ce3Kd6MM.js",
-      "_components-DM3pknSX.js",
+      "_components-B5CAbHpr.js",
       "_vendor-codemirror-CoZ2wzq8.js",
       "_vendor-recharts-Bv0CPtHC.js"
     ]
@@ -69,15 +69,15 @@
     "name": "vendor-three"
   },
   "index.tsx": {
-    "file": "assets/index-DzdpogRs.js",
+    "file": "assets/index-DIP5WhNE.js",
     "name": "index",
     "src": "index.tsx",
     "isEntry": true,
     "imports": [
       "_vendor-DCvpCpca.js",
       "_vendor-arizeai-Ce3Kd6MM.js",
-      "_pages-BkMw0RH2.js",
-      "_components-DM3pknSX.js",
+      "_pages-cfOsoZi6.js",
+      "_components-B5CAbHpr.js",
       "_vendor-three-C5WAXd5r.js",
       "_vendor-codemirror-CoZ2wzq8.js",
       "_vendor-shiki-CkOPKXne.js",