arize-phoenix 8.29.0__tar.gz → 8.31.0__tar.gz

{arize_phoenix-8.29.0 → arize_phoenix-8.31.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arize-phoenix
-Version: 8.29.0
+Version: 8.31.0
 Summary: AI Observability and Evaluation
 Project-URL: Documentation, https://docs.arize.com/phoenix/
 Project-URL: Issues, https://github.com/Arize-ai/phoenix/issues

{arize_phoenix-8.29.0 → arize_phoenix-8.31.0}/src/phoenix/config.py

@@ -244,6 +244,14 @@ ENV_PHOENIX_TLS_ENABLED = "PHOENIX_TLS_ENABLED"
 """
 Whether to enable TLS for Phoenix HTTP and gRPC servers.
 """
+ENV_PHOENIX_TLS_ENABLED_FOR_HTTP = "PHOENIX_TLS_ENABLED_FOR_HTTP"
+"""
+Whether to enable TLS for Phoenix HTTP server. Overrides PHOENIX_TLS_ENABLED.
+"""
+ENV_PHOENIX_TLS_ENABLED_FOR_GRPC = "PHOENIX_TLS_ENABLED_FOR_GRPC"
+"""
+Whether to enable TLS for Phoenix gRPC server. Overrides PHOENIX_TLS_ENABLED.
+"""
 ENV_PHOENIX_TLS_CERT_FILE = "PHOENIX_TLS_CERT_FILE"
 """
 Path to the TLS certificate file for HTTPS connections.
@@ -392,15 +400,32 @@ class TLSConfigVerifyClient(TLSConfig):
         return self._ca_data
 
 
-def get_env_tls_enabled() -> bool:
+def get_env_tls_enabled_for_http() -> bool:
+    """
+    Gets whether TLS is enabled for the HTTP server.
+
+    This function checks both PHOENIX_TLS_ENABLED_FOR_HTTP and PHOENIX_TLS_ENABLED environment variables.
+    If PHOENIX_TLS_ENABLED_FOR_HTTP is set, it takes precedence over PHOENIX_TLS_ENABLED.
+
+    Returns:
+        bool: True if TLS is enabled for HTTP server, False otherwise. Defaults to False if neither
+        environment variable is set.
+    """  # noqa: E501
+    return _bool_val(ENV_PHOENIX_TLS_ENABLED_FOR_HTTP, _bool_val(ENV_PHOENIX_TLS_ENABLED, False))
+
+
+def get_env_tls_enabled_for_grpc() -> bool:
     """
-    Gets the value of the PHOENIX_TLS_ENABLED environment variable.
+    Gets whether TLS is enabled for the gRPC server.
+
+    This function checks both PHOENIX_TLS_ENABLED_FOR_GRPC and PHOENIX_TLS_ENABLED environment variables.
+    If PHOENIX_TLS_ENABLED_FOR_GRPC is set, it takes precedence over PHOENIX_TLS_ENABLED.
 
     Returns:
-        bool: True if TLS is enabled, False otherwise. Defaults to False if the environment
-        variable is not set.
+        bool: True if TLS is enabled for gRPC server, False otherwise. Defaults to False if neither
+        environment variable is set.
     """  # noqa: E501
-    return _bool_val(ENV_PHOENIX_TLS_ENABLED, False)
+    return _bool_val(ENV_PHOENIX_TLS_ENABLED_FOR_GRPC, _bool_val(ENV_PHOENIX_TLS_ENABLED, False))
 
 
 def get_env_tls_verify_client() -> bool:
@@ -434,7 +459,7 @@ def get_env_tls_config() -> Optional[TLSConfig]:
         ValueError: If required files are missing or don't exist when TLS is enabled
     """  # noqa: E501
     # Check if TLS is enabled
-    if not get_env_tls_enabled():
+    if not (get_env_tls_enabled_for_http() or get_env_tls_enabled_for_grpc()):
         return None
 
     # Get certificate file path if specified
@@ -1193,7 +1218,7 @@ def get_env_root_url() -> URL:
     host = get_env_host()
     if host == "0.0.0.0":
         host = "127.0.0.1"
-    scheme = "https" if get_env_tls_enabled() else "http"
+    scheme = "https" if get_env_tls_enabled_for_http() else "http"
     return URL(urljoin(f"{scheme}://{host}:{get_env_port()}", get_env_host_root_path()))
 
 
@@ -1202,7 +1227,7 @@ def get_base_url() -> str:
     host = get_env_host()
     if host == "0.0.0.0":
         host = "127.0.0.1"
-    scheme = "https" if get_env_tls_enabled() else "http"
+    scheme = "https" if get_env_tls_enabled_for_http() else "http"
     base_url = get_env_collector_endpoint() or f"{scheme}://{host}:{get_env_port()}"
     return base_url if base_url.endswith("/") else base_url + "/"
 

{arize_phoenix-8.29.0 → arize_phoenix-8.31.0}/src/phoenix/server/api/helpers/playground_spans.py

@@ -1,4 +1,5 @@
 import json
+import logging
 from collections import defaultdict
 from collections.abc import Mapping
 from dataclasses import asdict
@@ -54,6 +55,8 @@ ChatCompletionMessage: TypeAlias = tuple[
 ]
 ToolCallID: TypeAlias = str
 
+logger = logging.getLogger(__name__)
+
 
 class streaming_llm_span:
     """
@@ -117,6 +120,7 @@ class streaming_llm_span:
                     exception_stacktrace=format_exc(),
                 )
             )
+            logger.exception(exc_value)
         if self._text_chunks or self._tool_call_chunks:
             self._attributes.update(
                 chain(

arize_phoenix-8.31.0/src/phoenix/server/authorization.py

@@ -0,0 +1,53 @@
+"""
+Authorization dependencies for FastAPI routes.
+
+Usage:
+    Use the provided dependencies (e.g., require_admin) with FastAPI's Depends to restrict access to
+    certain routes.
+
+    These dependencies will raise HTTP 403 if the user is not authorized.
+
+    Example:
+
+        from fastapi import APIRouter, Depends
+        from phoenix.server.authorization import require_admin
+
+        router = APIRouter()
+
+        @router.post("/dangerous-thing", dependencies=[Depends(require_admin)])
+        async def dangerous_thing(...):
+            ...
+
+    The require_admin dependency allows only admin or system users to access the route.
+    It expects authentication to be enabled and the request.user to be set by the authentication.
+"""
+
+from fastapi import HTTPException, Request
+from fastapi import status as fastapi_status
+
+from phoenix.server.bearer_auth import PhoenixUser
+
+
+def require_admin(request: Request) -> None:
+    """
+    FastAPI dependency to restrict access to admin or system users only.
+
+    Usage:
+        Add as a dependency to any route that should only be accessible by admin or system users:
+
+            @router.post("/dangerous-thing", dependencies=[Depends(require_admin)])
+            async def dangerous_thing(...):
+                ...
+
+    Behavior:
+        - Allows access if the authenticated user is an admin or a system user.
+        - Raises HTTP 403 Forbidden if the user is not authorized.
+        - Expects authentication to be enabled and request.user to be set by the authentication.
+    """
+    user = getattr(request, "user", None)
+    # System users have all privileges
+    if not (isinstance(user, PhoenixUser) and user.is_admin):
+        raise HTTPException(
+            status_code=fastapi_status.HTTP_403_FORBIDDEN,
+            detail="Only admin or system users can perform this action.",
+        )

{arize_phoenix-8.29.0 → arize_phoenix-8.31.0}/src/phoenix/server/grpc_server.py

@@ -18,6 +18,7 @@ from phoenix.config import (
     TLSConfigVerifyClient,
     get_env_grpc_port,
     get_env_tls_config,
+    get_env_tls_enabled_for_grpc,
 )
 from phoenix.server.bearer_auth import ApiKeyInterceptor
 from phoenix.trace.otel import decode_otlp_span
@@ -90,7 +91,8 @@ class GrpcServer:
             options=(("grpc.so_reuseport", 0),),
             interceptors=interceptors,
         )
-        if tls_config := get_env_tls_config():
+        if get_env_tls_enabled_for_grpc():
+            assert (tls_config := get_env_tls_config())
             private_key_certificate_chain_pairs = [(tls_config.key_data, tls_config.cert_data)]
             server_credentials = (
                 grpc.ssl_server_credentials(

{arize_phoenix-8.29.0 → arize_phoenix-8.31.0}/src/phoenix/server/main.py

@@ -42,6 +42,8 @@ from phoenix.config import (
     get_env_smtp_username,
     get_env_smtp_validate_certs,
     get_env_tls_config,
+    get_env_tls_enabled_for_grpc,
+    get_env_tls_enabled_for_http,
     get_pids_path,
 )
 from phoenix.core.model_schema_adapter import create_model_from_inferences
@@ -101,8 +103,13 @@ _WELCOME_MESSAGE = Environment(loader=BaseLoader()).from_string("""
 |  🚀 Phoenix Server 🚀
 |  Phoenix UI: {{ ui_path }}
 |  Authentication: {{ auth_enabled }}
-{%- if tls_enabled %}
-|  TLS: Enabled
+{%- if auth_enabled_for_http or auth_enabled_for_grpc %}
+{%- if tls_enabled_for_http %}
+|  TLS: Enabled for HTTP
+{%- endif %}
+{%- if tls_enabled_for_grpc %}
+|  TLS: Enabled for gRPC
+{%- endif %}
 {%- if tls_verify_client %}
 |  TLS Client Verification: Enabled
 {%- endif %}
@@ -367,22 +374,25 @@ def main() -> None:
     allowed_origins = get_env_allowed_origins()
 
     # Get TLS configuration
+    tls_enabled_for_http = get_env_tls_enabled_for_http()
+    tls_enabled_for_grpc = get_env_tls_enabled_for_grpc()
     tls_config = get_env_tls_config()
-    tls_enabled = tls_config is not None
-    tls_verify_client = tls_enabled and isinstance(tls_config, TLSConfigVerifyClient)
+    tls_verify_client = tls_config is not None and isinstance(tls_config, TLSConfigVerifyClient)
 
     # Print information about the server
-    scheme = "https" if tls_enabled else "http"
-    root_path = urljoin(f"{scheme}://{host}:{port}", host_root_path)
+    http_scheme = "https" if tls_enabled_for_http else "http"
+    grpc_scheme = "https" if tls_enabled_for_grpc else "http"
+    root_path = urljoin(f"{http_scheme}://{host}:{port}", host_root_path)
     msg = _WELCOME_MESSAGE.render(
         version=phoenix_version,
         ui_path=root_path,
-        grpc_path=f"{scheme}://{host}:{get_env_grpc_port()}",
+        grpc_path=f"{grpc_scheme}://{host}:{get_env_grpc_port()}",
         http_path=urljoin(root_path, "v1/traces"),
         storage=get_printable_db_url(db_connection_str),
         schema=get_env_database_schema(),
         auth_enabled=authentication_enabled,
-        tls_enabled=tls_enabled,
+        tls_enabled_for_http=tls_enabled_for_http,
+        tls_enabled_for_grpc=tls_enabled_for_grpc,
         tls_verify_client=tls_verify_client,
         allowed_origins=allowed_origins,
     )
@@ -444,7 +454,8 @@ def main() -> None:
         root_path=host_root_path,
     )
 
-    if tls_config:
+    if tls_enabled_for_http:
+        assert tls_config
         # Configure SSL context with certificate and key
         server_config.ssl_keyfile = str(tls_config.key_file)
         server_config.ssl_keyfile_password = tls_config.key_file_password

{arize_phoenix-8.29.0 → arize_phoenix-8.31.0}/src/phoenix/server/static/.vite/manifest.json

@@ -1,22 +1,22 @@
 {
-  "_components-DepxScNF.js": {
-    "file": "assets/components-DepxScNF.js",
+  "_components-C0W7rSGA.js": {
+    "file": "assets/components-C0W7rSGA.js",
     "name": "components",
     "imports": [
       "_vendor-BfhM_F1u.js",
-      "_pages-CJUakDKi.js",
+      "_pages-wYat6c3P.js",
       "_vendor-arizeai-CxXYQNUl.js",
       "_vendor-codemirror-B0NIFPOL.js",
       "_vendor-three-C5WAXd5r.js"
     ]
   },
-  "_pages-CJUakDKi.js": {
-    "file": "assets/pages-CJUakDKi.js",
+  "_pages-wYat6c3P.js": {
+    "file": "assets/pages-wYat6c3P.js",
     "name": "pages",
     "imports": [
       "_vendor-BfhM_F1u.js",
       "_vendor-arizeai-CxXYQNUl.js",
-      "_components-DepxScNF.js",
+      "_components-C0W7rSGA.js",
       "_vendor-codemirror-B0NIFPOL.js",
       "_vendor-recharts-CrrDFWK1.js"
     ]
@@ -69,15 +69,15 @@
     "name": "vendor-three"
   },
   "index.tsx": {
-    "file": "assets/index-DUj7q3Q4.js",
+    "file": "assets/index-BmLpy9qA.js",
     "name": "index",
     "src": "index.tsx",
     "isEntry": true,
     "imports": [
       "_vendor-BfhM_F1u.js",
       "_vendor-arizeai-CxXYQNUl.js",
-      "_pages-CJUakDKi.js",
-      "_components-DepxScNF.js",
+      "_pages-wYat6c3P.js",
+      "_components-C0W7rSGA.js",
       "_vendor-three-C5WAXd5r.js",
       "_vendor-codemirror-B0NIFPOL.js",
       "_vendor-shiki-C5bJ-RPf.js",