fix(auth): strengthen auth method constraint (#4744)

Arize-ai · Sep 26, 2024 · d399cb4 · d399cb4
1 parent 4e68274
commit d399cb4
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 4 deletions.
diff --git a/src/phoenix/db/facilitator.py b/src/phoenix/db/facilitator.py
@@ -89,6 +89,8 @@ async def _ensure_user_roles(session: AsyncSession) -> None:
             username=DEFAULT_SYSTEM_USERNAME,
             email=DEFAULT_SYSTEM_EMAIL,
             reset_password=False,
+            password_salt=secrets.token_bytes(DEFAULT_SECRET_LENGTH),
+            password_hash=secrets.token_bytes(DEFAULT_SECRET_LENGTH),
         )
         session.add(system_user)
     if (admin_role := UserRole.ADMIN.value) not in existing_roles and (

diff --git a/src/phoenix/db/migrations/versions/cd164e83824f_users_and_tokens.py b/src/phoenix/db/migrations/versions/cd164e83824f_users_and_tokens.py
@@ -70,8 +70,8 @@ def upgrade() -> None:
             name="oauth2_client_id_and_user_id",
         ),
         sa.CheckConstraint(
-            "password_hash IS NULL or oauth2_client_id IS NULL",
-            name="at_most_one_auth_method",
+            "(password_hash IS NULL) != (oauth2_client_id IS NULL)",
+            name="exactly_one_auth_method",
         ),
         sa.UniqueConstraint(
             "oauth2_client_id",

diff --git a/src/phoenix/db/models.py b/src/phoenix/db/models.py
@@ -698,8 +698,8 @@ def _auth_method_expression(cls) -> ColumnElement[Optional[str]]:
             name="oauth2_client_id_and_user_id",
         ),
         CheckConstraint(
-            "password_hash IS NULL or oauth2_client_id IS NULL",
-            name="at_most_one_auth_method",
+            "(password_hash IS NULL) != (oauth2_client_id IS NULL)",
+            name="exactly_one_auth_method",
         ),
         UniqueConstraint(
             "oauth2_client_id",