rasa-pro 3.11.0a4.dev2__py3-none-any.whl → 3.11.0rc1__py3-none-any.whl

rasa/engine/validation.py

@@ -1,7 +1,7 @@
 import dataclasses
 import inspect
-import re
 import logging
+import re
 import sys
 import typing
 from typing import (
@@ -31,9 +31,17 @@ from rasa.dialogue_understanding.coexistence.constants import (
     STICKY,
     NON_STICKY,
 )
+from rasa.dialogue_understanding.coexistence.intent_based_router import (
+    IntentBasedRouter,
+)
+from rasa.dialogue_understanding.coexistence.llm_based_router import LLMBasedRouter
 from rasa.dialogue_understanding.generator import (
     LLMBasedCommandGenerator,
 )
+from rasa.dialogue_understanding.generator.constants import (
+    LLM_CONFIG_KEY,
+    FLOW_RETRIEVAL_KEY,
+)
 from rasa.dialogue_understanding.patterns.chitchat import FLOW_PATTERN_CHITCHAT
 from rasa.engine.constants import RESERVED_PLACEHOLDERS
 from rasa.engine.exceptions import GraphSchemaValidationException
@@ -47,18 +55,31 @@ from rasa.engine.graph import (
 from rasa.engine.storage.resource import Resource
 from rasa.engine.storage.storage import ModelStorage
 from rasa.engine.training.fingerprinting import Fingerprintable
-from rasa.shared.constants import DOCS_URL_GRAPH_COMPONENTS, ROUTE_TO_CALM_SLOT
+from rasa.shared.constants import (
+    DOCS_URL_GRAPH_COMPONENTS,
+    ROUTE_TO_CALM_SLOT,
+    EMBEDDINGS_CONFIG_KEY,
+    API_BASE_CONFIG_KEY,
+    DEPLOYMENT_CONFIG_KEY,
+    API_VERSION_CONFIG_KEY,
+    API_KEY,
+    AWS_REGION_NAME_CONFIG_KEY,
+    MODEL_GROUP_ID_CONFIG_KEY,
+    ROUTER_CONFIG_KEY,
+    MODELS_CONFIG_KEY,
+    ROUTER_STRATEGY_CONFIG_KEY,
+    VALID_ROUTER_STRATEGIES,
+    ROUTER_STRATEGIES_REQUIRING_REDIS_CACHE,
+    ROUTER_STRATEGIES_NOT_REQUIRING_CACHE,
+    REDIS_HOST_CONFIG_KEY,
+)
 from rasa.shared.core.constants import ACTION_RESET_ROUTING, ACTION_TRIGGER_CHITCHAT
 from rasa.shared.core.domain import Domain
 from rasa.shared.core.flows import FlowsList, Flow
 from rasa.shared.core.slots import Slot
 from rasa.shared.exceptions import RasaException
 from rasa.shared.nlu.training_data.message import Message
-
-from rasa.dialogue_understanding.coexistence.intent_based_router import (
-    IntentBasedRouter,
-)
-from rasa.dialogue_understanding.coexistence.llm_based_router import LLMBasedRouter
+from rasa.shared.utils.cli import print_error_and_exit
 
 TypeAnnotation = Union[TypeVar, Text, Type, Optional[AvailableEndpoints]]
 
@@ -845,6 +866,275 @@ def validate_coexistance_routing_setup(
     )
 
 
+def _validate_component_model_client_config(
+    component_config: Dict[str, Any],
+    key: str,
+    model_group_syntax_used: List[bool],
+    model_group_ids: List[str],
+    component_name: Optional[str] = None,
+) -> None:
+    """Validate the LLM configuration of a component.
+
+    Checks if the llm is defined using the new syntax or the old syntax.
+    If the new syntax is used, it checks that no other parameters are present.
+
+    Args:
+        component_config: The config of the component
+        key: either 'llm' or 'embeddings'
+        model_group_syntax_used:
+            list of booleans indicating whether the new syntax is used
+        model_group_ids: list of model group ids
+        component_name: the name of the component
+    """
+    if key not in component_config:
+        # no llm configuration present
+        return
+
+    if MODELS_CONFIG_KEY in component_config[key]:
+        model_group_syntax_used.append(True)
+        model_group_ids.append(component_config[key][MODELS_CONFIG_KEY])
+
+        if len(component_config[key]) > 1:
+            print_error_and_exit(
+                f"You specified a '{MODELS_CONFIG_KEY}' for the '{key}' "
+                f"config key for the component "
+                f"'{component_name or component_config['name']}'. "
+                "No other parameters are allowed under the "
+                f"'{key}' key in that case. Please update your config."
+            )
+    else:
+        model_group_syntax_used.append(False)
+
+        # check that api_key is not set in config
+        if API_KEY in component_config[key]:
+            print_error_and_exit(
+                f"You specified '{API_KEY}' in the config for"
+                f"{component_name or component_config['name']}, which "
+                "is not allowed. Set API keys through "
+                "environment variables."
+            )
+
+
+def validate_model_client_configuration_setup(config: Dict[str, Any]) -> None:
+    """Validates the model client configuration setup.
+
+    Checks the model configuration of the components in the pipeline.
+    Validation fails, if
+    - the LLM/embeddings is/are defined using the old and the new syntax at
+      the same time (either at component level itself or across different components)
+    - the LLM/embeddings is/are defined using the new syntax, but no model
+      group is defined or the referenced model group does not exist
+
+    Args:
+        config: The config dictionary
+    """
+
+    def is_uniform_bool_list(bool_list: List[bool]) -> bool:
+        # check if list contains only True or False
+        return all(bool_list) or not any(bool_list)
+
+    model_group_syntax_used: List[bool] = []
+    model_group_ids: List[str] = []
+
+    if "pipeline" not in config:
+        return
+
+    for component in config["pipeline"]:
+        for key in [LLM_CONFIG_KEY, EMBEDDINGS_CONFIG_KEY]:
+            _validate_component_model_client_config(
+                component, key, model_group_syntax_used, model_group_ids
+            )
+
+        # as flow retrieval is not a component itself, we need to
+        # check it separately
+        if FLOW_RETRIEVAL_KEY in component:
+            if EMBEDDINGS_CONFIG_KEY in component[FLOW_RETRIEVAL_KEY]:
+                _validate_component_model_client_config(
+                    component[FLOW_RETRIEVAL_KEY],
+                    EMBEDDINGS_CONFIG_KEY,
+                    model_group_syntax_used,
+                    model_group_ids,
+                    component["name"] + "." + FLOW_RETRIEVAL_KEY,
+                )
+
+    if not is_uniform_bool_list(model_group_syntax_used):
+        print_error_and_exit(
+            "Some of your components refer to an LLM using the "
+            f"'{MODELS_CONFIG_KEY}' parameter, other components directly"
+            f"define the LLM under the '{LLM_CONFIG_KEY}' or the "
+            f"'{EMBEDDINGS_CONFIG_KEY}' key. You cannot use"
+            "a both types of definition. Please chose one syntax "
+            "and update your config."
+        )
+
+    # Print a deprecation warning in case the old syntax is used.
+    if len(model_group_syntax_used) > 0 and model_group_syntax_used[0] is False:
+        structlogger.warning(
+            "validate_llm_configuration_setup",
+            event_info=(
+                "Defining the LLM configuration in the config.yml file itself is"
+                " deprecated and will be removed in Rasa 4.0.0. "
+                "Please use the new syntax and define your LLM configuration"
+                "in the endpoints.yml file."
+            ),
+        )
+
+    endpoints = AvailableEndpoints.get_instance()
+    if len(model_group_ids) > 0 and endpoints.model_groups is None:
+        print_error_and_exit(
+            "You are referring to (a) model group(s) in your "
+            "config.yml file, but no model group was defined in "
+            "the endpoints.yml file. Please define the model "
+            "group(s)."
+        )
+
+    if endpoints.model_groups is None:
+        return
+
+    existing_model_group_ids = [
+        model_group[MODEL_GROUP_ID_CONFIG_KEY] for model_group in endpoints.model_groups
+    ]
+
+    for model_group_id in model_group_ids:
+        if model_group_id not in existing_model_group_ids:
+            print_error_and_exit(
+                "One of your components is referring to the model group "
+                f"'{model_group_id}', but this model group does not exist in the "
+                f"endpoints.yml file. Please chose one of the existing "
+                f"model groups ({existing_model_group_ids}) or define "
+                f"the a model group for '{model_group_id}'."
+            )
+
+
+def _validate_unique_model_group_ids(model_groups: List[Dict[str, Any]]) -> None:
+    # Each model id must be unique within the model_groups
+    model_ids = [model_group[MODEL_GROUP_ID_CONFIG_KEY] for model_group in model_groups]
+    if len(model_ids) != len(set(model_ids)):
+        print_error_and_exit(
+            "Each model group id must be unique. Please make sure that "
+            "the model group ids are unique in your endpoints.yml file."
+        )
+
+
+def _validate_model_group_with_multiple_models(
+    model_groups: List[Dict[str, Any]],
+) -> None:
+    # You cannot define multiple models within a model group, when no router is defined.
+    for model_group in model_groups:
+        if (
+            len(model_group[MODELS_CONFIG_KEY]) > 1
+            and ROUTER_CONFIG_KEY not in model_group
+        ):
+            print_error_and_exit(
+                f"You defined multiple models for the model group "
+                f"'{model_group[MODEL_GROUP_ID_CONFIG_KEY]}', but no router. "
+                f"If a model group contains "
+                f"multiple models, a router must be defined. Please define a router "
+                f"for the model group '{model_group[MODEL_GROUP_ID_CONFIG_KEY]}'."
+            )
+
+
+def _validate_model_group_router_setting(
+    model_groups: List[Dict[str, Any]],
+) -> None:
+    # You cannot define multiple models within a model group, when no router is defined.
+    for model_group in model_groups:
+        if ROUTER_CONFIG_KEY not in model_group:
+            continue
+
+        router_config = model_group[ROUTER_CONFIG_KEY]
+        if ROUTER_STRATEGY_CONFIG_KEY in router_config:
+            router_strategy = router_config.get(ROUTER_STRATEGY_CONFIG_KEY)
+            if router_strategy and router_strategy not in VALID_ROUTER_STRATEGIES:
+                print_error_and_exit(
+                    f"The router strategy you defined for the model group "
+                    f"'{model_group[MODEL_GROUP_ID_CONFIG_KEY]}' is not valid. "
+                    f"Valid router strategies are categorized as follows:\n"
+                    f"- Strategies requiring Redis caching: "
+                    f"{', '.join(ROUTER_STRATEGIES_REQUIRING_REDIS_CACHE)}\n"
+                    f"- Strategies not requiring caching: "
+                    f"{', '.join(ROUTER_STRATEGIES_NOT_REQUIRING_CACHE)}"
+                )
+            if (
+                router_strategy in ROUTER_STRATEGIES_REQUIRING_REDIS_CACHE
+                and REDIS_HOST_CONFIG_KEY not in router_config
+            ):
+                structlogger.warning(
+                    "validation.router_strategy.redis_host_not_defined",
+                    event_info=(
+                        f"The router strategy '{router_strategy}' requires a Redis host"
+                        f" to be defined. Without a Redis host, the system defaults to "
+                        f"'in-memory' caching. Please add the '{REDIS_HOST_CONFIG_KEY}'"
+                        f" to the router configuration for the model group "
+                        f"'{model_group[MODEL_GROUP_ID_CONFIG_KEY]}'."
+                    ),
+                )
+
+
+def _validate_usage_of_environment_variables_in_model_group_config(
+    model_groups: List[Dict[str, Any]],
+) -> None:
+    # Limit the use of ${env_var} in the model_groups config to the following variables:
+    # deployment, api_base, api_key, api_version, aws_region_name
+    allowed_env_vars = {
+        DEPLOYMENT_CONFIG_KEY,
+        API_BASE_CONFIG_KEY,
+        API_KEY,
+        API_VERSION_CONFIG_KEY,
+        AWS_REGION_NAME_CONFIG_KEY,
+    }
+
+    for model_group in model_groups:
+        for model_config in model_group[MODELS_CONFIG_KEY]:
+            for key, value in model_config.items():
+                if isinstance(value, str):
+                    if re.match(r"\${(\w+)}", value) and key not in allowed_env_vars:
+                        print_error_and_exit(
+                            f"You defined '{key}' as environment variable in model "
+                            f"group '{model_group[MODEL_GROUP_ID_CONFIG_KEY]}', "
+                            f"which is not allowed. "
+                            f"You can only use environment variables for the following "
+                            f"keys: {', '.join(allowed_env_vars)}. "
+                            f"Please update your config."
+                        )
+
+
+def _validate_api_key_is_an_environment_variable(
+    model_groups: List[Dict[str, Any]],
+) -> None:
+    # the api key can only be set as an environment variable
+    for model_group in model_groups:
+        for model_config in model_group[MODELS_CONFIG_KEY]:
+            for key, value in model_config.items():
+                if (
+                    key == API_KEY
+                    and isinstance(value, str)
+                    and not re.match(r"\${(\w+)}", value)
+                ):
+                    print_error_and_exit(
+                        f"You defined the '{API_KEY}' in model group "
+                        f"'{model_group[MODEL_GROUP_ID_CONFIG_KEY]}' as a string. "
+                        f"The '{API_KEY}' must be set as an environment variable. "
+                        f"Please update your config."
+                    )
+
+
+def validate_model_group_configuration_setup() -> None:
+    """Validates the model group configuration setup in endpoints.yml."""
+    endpoints = AvailableEndpoints.get_instance()
+
+    if endpoints.model_groups is None:
+        return
+
+    _validate_unique_model_group_ids(endpoints.model_groups)
+    _validate_model_group_with_multiple_models(endpoints.model_groups)
+    _validate_usage_of_environment_variables_in_model_group_config(
+        endpoints.model_groups
+    )
+    _validate_api_key_is_an_environment_variable(endpoints.model_groups)
+    _validate_model_group_router_setting(endpoints.model_groups)
+
+
 def validate_command_generator_exclusivity(schema: GraphSchema) -> None:
     """Validate that multiple command generators are not defined at same time."""
     from rasa.dialogue_understanding.generator import (

rasa/model_manager/config.py

@@ -1,8 +1,10 @@
 import sys
 import os
 
+DEFAULT_SERVER_BASE_WORKING_DIRECTORY = "working-data"
+
 SERVER_BASE_WORKING_DIRECTORY = os.environ.get(
-    "RASA_MODEL_SERVER_BASE_DIRECTORY", "working-data"
+    "RASA_MODEL_SERVER_BASE_DIRECTORY", DEFAULT_SERVER_BASE_WORKING_DIRECTORY
 )
 
 SERVER_BASE_URL = os.environ.get("RASA_MODEL_SERVER_BASE_URL", None)
@@ -14,5 +16,17 @@ SERVER_MODEL_REMOTE_STORAGE = os.environ.get("RASA_REMOTE_STORAGE", None)
 # we will use the same python to run training / bots
 RASA_PYTHON_PATH = sys.executable
 
-# the max limit for parallel training and bot run requests
-MAX_PARALLEL_TRAININGS = os.getenv("MAX_PARALLEL_TRAININGS", 10)
+# the max limit for parallel training requests
+DEFAULT_MAX_PARALLEL_TRAININGS = 10
+
+MAX_PARALLEL_TRAININGS = os.getenv(
+    "MAX_PARALLEL_TRAININGS", DEFAULT_MAX_PARALLEL_TRAININGS
+)
+# the max limit for parallel running bots
+DEFAULT_MAX_PARALLEL_BOT_RUNS = 10
+
+MAX_PARALLEL_BOT_RUNS = os.getenv(
+    "MAX_PARALLEL_BOT_RUNS", DEFAULT_MAX_PARALLEL_BOT_RUNS
+)
+
+DEFAULT_SERVER_PATH_PREFIX = "talk"

rasa/model_manager/model_api.py

@@ -16,6 +16,7 @@ from rasa.model_manager.config import SERVER_BASE_URL
 from rasa.constants import MODEL_ARCHIVE_EXTENSION
 from rasa.model_manager.runner_service import (
     BotSession,
+    BotSessionStatus,
     fetch_remote_model_to_dir,
     run_bot,
     terminate_bot,
@@ -24,11 +25,13 @@ from rasa.model_manager.runner_service import (
 from rasa.model_manager.socket_bridge import create_bridge_server
 from rasa.model_manager.trainer_service import (
     TrainingSession,
+    TrainingSessionStatus,
     run_training,
     terminate_training,
     update_training_status,
 )
 from rasa.model_manager.utils import (
+    InvalidPathException,
     get_logs_content,
     logs_base_path,
     models_base_path,
@@ -91,7 +94,7 @@ def base_server_url(request: Request) -> str:
     if SERVER_BASE_URL:
         return SERVER_BASE_URL.rstrip("/")
     else:
-        return f"{request.scheme}://{request.host}"
+        return f"{request.scheme}://{request.host}/{config.DEFAULT_SERVER_PATH_PREFIX}"
 
 
 async def continuously_update_process_status() -> None:
@@ -134,7 +137,8 @@ def internal_blueprint() -> Blueprint:
             [
                 training
                 for training in trainings.values()
-                if training.status == "running" and training.process.poll() is None
+                if training.status == TrainingSessionStatus.RUNNING
+                and training.process.poll() is None
             ]
         )
 
@@ -152,7 +156,7 @@ def internal_blueprint() -> Blueprint:
     @bp.on_request  # type: ignore[misc]
     async def limit_parallel_bot_runs(request: Request) -> Any:
         """Limit the number of parallel bot runs."""
-        from rasa.model_manager.config import MAX_PARALLEL_TRAININGS
+        from rasa.model_manager.config import MAX_PARALLEL_BOT_RUNS
 
         if not request.url.endswith("/bot"):
             return None
@@ -161,15 +165,15 @@ def internal_blueprint() -> Blueprint:
             [
                 bot
                 for bot in running_bots.values()
-                if bot.status in {"running", "queued"}
+                if bot.status in {BotSessionStatus.RUNNING, BotSessionStatus.QUEUED}
             ]
         )
 
-        if running_requests >= int(MAX_PARALLEL_TRAININGS):
+        if running_requests >= int(MAX_PARALLEL_BOT_RUNS):
             return response.json(
                 {
                     "message": f"Too many parallel bot runs, above "
-                    f"the limit of {MAX_PARALLEL_TRAININGS}. "
+                    f"the limit of {MAX_PARALLEL_BOT_RUNS}. "
                     f"Retry later or increase your server's "
                     f"memory and CPU resources."
                 },
@@ -244,6 +248,8 @@ def internal_blueprint() -> Blueprint:
             return json({"message": "Training id is required"}, status=400)
 
         try:
+            # file deepcode ignore PT: path traversal is prevented
+            # by the `subpath` function found in the `rasa.model_manager.utils` module
             training_session = run_training(
                 training_id=training_id,
                 assistant_id=assistant_id,
@@ -254,8 +260,10 @@ def internal_blueprint() -> Blueprint:
             return json(
                 {"training_id": training_id, "model_name": training_session.model_name}
             )
-        except Exception as e:
-            return json({"message": str(e)}, status=500)
+        except InvalidPathException as exc:
+            return json({"message": str(exc)}, status=403)
+        except Exception as exc:
+            return json({"message": str(exc)}, status=500)
 
     @bp.get("/training/<training_id>")
     async def get_training(request: Request, training_id: str) -> response.HTTPResponse:

rasa/model_manager/runner_service.py

@@ -87,7 +87,7 @@ async def is_bot_startup_finished(bot: BotSession) -> bool:
         return False
 
 
-def update_bot_to_stopped(bot: BotSession) -> None:
+def set_bot_status_to_stopped(bot: BotSession) -> None:
     """Set a bots state to stopped."""
     structlogger.info(
         "model_runner.bot_stopped",
@@ -97,7 +97,7 @@ def update_bot_to_stopped(bot: BotSession) -> None:
     bot.status = BotSessionStatus.STOPPED
 
 
-def update_bot_to_running(bot: BotSession) -> None:
+def set_bot_status_to_running(bot: BotSession) -> None:
     """Set a bots state to running."""
     structlogger.info(
         "model_runner.bot_running",
@@ -119,7 +119,9 @@ def get_open_port() -> int:
     return port
 
 
-def write_config_data_to_files(encoded_configs: Dict[str, str], base_path: str) -> None:
+def write_encoded_config_data_to_files(
+    encoded_configs: Dict[str, bytes], base_path: str
+) -> None:
     """Write the encoded config data to files."""
     for key, value in encoded_configs.items():
         write_encoded_data_to_file(value, subpath(base_path, f"{key}.yml"))
@@ -155,7 +157,7 @@ def prepare_bot_directory(
         dst=subpath(bot_base_path, "models"),
     )
 
-    write_config_data_to_files(encoded_configs, bot_base_path)
+    write_encoded_config_data_to_files(encoded_configs, bot_base_path)
 
 
 def fetch_remote_model_to_dir(
@@ -253,9 +255,9 @@ def run_bot(
 async def update_bot_status(bot: BotSession) -> None:
     """Update the status of a bot based on the process return code."""
     if bot.has_died_recently():
-        update_bot_to_stopped(bot)
+        set_bot_status_to_stopped(bot)
     elif await bot.completed_startup_recently():
-        update_bot_to_running(bot)
+        set_bot_status_to_running(bot)
 
 
 def terminate_bot(bot: BotSession) -> None:

rasa/model_manager/socket_bridge.py

@@ -84,6 +84,7 @@ def create_bridge_server(sio: AsyncServer, running_bots: Dict[str, BotSession])
 
     @sio.on("disconnect")
     async def disconnect(sid: str) -> None:
+        """Disconnect the bot connection."""
         structlogger.debug("model_runner.bot_disconnect", sid=sid)
         if sid in socket_proxy_clients:
             await socket_proxy_clients[sid].disconnect()
@@ -91,10 +92,12 @@ def create_bridge_server(sio: AsyncServer, running_bots: Dict[str, BotSession])
 
     @sio.on("*")
     async def handle_message(event: str, sid: str, data: Dict[str, Any]) -> None:
-        # bridge both, incoming messages to the bot_url but also
-        # send the response back to the client. both need to happen
-        # in parallel in an async way
+        """ "Bridge messages between user and bot.
 
+        Both incoming user messages to the bot_url and
+        bot responses sent back to the client need to
+        happen in parallel in an async way.
+        """
         client = socket_proxy_clients.get(sid)
         if client is None:
             structlogger.error("model_runner.bot_not_connected", sid=sid)

rasa/model_manager/trainer_service.py

@@ -52,12 +52,12 @@ class TrainingSession(BaseModel):
 
 def train_path(training_id: str) -> str:
     """Return the path to the training directory for a given training id."""
-    return subpath(config.SERVER_BASE_WORKING_DIRECTORY, f"trainings/{training_id}")
+    return subpath(config.SERVER_BASE_WORKING_DIRECTORY + "/trainings", training_id)
 
 
 def cache_for_assistant_path(assistant_id: str) -> str:
     """Return the path to the cache directory for a given assistant id."""
-    return subpath(config.SERVER_BASE_WORKING_DIRECTORY, f"caches/{assistant_id}")
+    return subpath(config.SERVER_BASE_WORKING_DIRECTORY + "/caches", assistant_id)
 
 
 def terminate_training(training: TrainingSession) -> None:
@@ -132,8 +132,8 @@ def move_model_to_local_storage(training: TrainingSession) -> None:
     ensure_base_directory_exists(models_base_path())
 
     model_path = subpath(
-        train_path(training.training_id),
-        f"models/{training.model_name}.{MODEL_ARCHIVE_EXTENSION}",
+        train_path(training.training_id) + "/models",
+        f"{training.model_name}.{MODEL_ARCHIVE_EXTENSION}",
     )
 
     if os.path.exists(model_path):
@@ -217,9 +217,11 @@ def write_training_data_to_files(
     }
 
     for key, file in data_to_be_written_to_files.items():
+        parent_path, file_name = os.path.split(file)
+
         write_encoded_data_to_file(
             encoded_training_data.get(key, ""),
-            subpath(training_base_path, file),
+            subpath(training_base_path + "/" + parent_path, file_name),
         )
 
 

rasa/model_manager/utils.py

@@ -2,7 +2,16 @@ import os
 import base64
 from typing import Optional
 
+import structlog
+
 from rasa.model_manager import config
+from rasa.shared.exceptions import RasaException
+
+structlogger = structlog.get_logger()
+
+
+class InvalidPathException(RasaException):
+    """Raised if a path is invalid - e.g. path traversal is detected."""
 
 
 def write_encoded_data_to_file(encoded_data: bytes, file: str) -> None:
@@ -17,7 +26,7 @@ def write_encoded_data_to_file(encoded_data: bytes, file: str) -> None:
 
 
 def logs_base_path() -> str:
-    """Return the path to the logs directory."""
+    """Return the path to the logs' directory."""
     return subpath(config.SERVER_BASE_WORKING_DIRECTORY, "logs")
 
 
@@ -31,7 +40,7 @@ def ensure_base_directory_exists(directory: str) -> None:
 
 
 def models_base_path() -> str:
-    """Return the path to the models directory."""
+    """Return the path to the models' directory."""
     return subpath(config.SERVER_BASE_WORKING_DIRECTORY, "models")
 
 
@@ -48,13 +57,24 @@ def subpath(parent: str, child: str) -> str:
     """Return the path to the child directory of the parent directory.
 
     Ensures, that child doesn't navigate to parent directories. Prevents
-    path traversal.
+    path traversal. Raises an InvalidPathException if the path is invalid.
+
+    Based on Snyk's directory traversal mitigation:
+    https://learn.snyk.io/lesson/directory-traversal/
     """
-    path = os.path.abspath(os.path.join(parent, child))
-    if not path.startswith(os.path.abspath(parent)):
-        raise ValueError(f"Invalid path: {path}")
+    safe_path = os.path.abspath(os.path.join(parent, child))
+    parent = os.path.abspath(parent)
+
+    common_base = os.path.commonpath([parent, safe_path])
+    if common_base != parent:
+        raise InvalidPathException(f"Invalid path: {safe_path}")
+
+    if os.path.basename(safe_path) != child:
+        raise InvalidPathException(
+            f"Invalid path - path traversal detected: {safe_path}"
+        )
 
-    return path
+    return safe_path
 
 
 def get_logs_content(action_id: str) -> Optional[str]:
@@ -63,4 +83,5 @@ def get_logs_content(action_id: str) -> Optional[str]:
         with open(logs_path(action_id), "r") as file:
             return file.read()
     except FileNotFoundError:
+        structlogger.debug("model_service.logs.not_found", action_id=action_id)
         return None