[release] v0.94.4

api/ee/src/apis/fastapi/organizations/models.py

@@ -1,5 +1,6 @@
 from typing import Optional
 from datetime import datetime
+from uuid import UUID
 
 from pydantic import BaseModel, Field
 
@@ -25,7 +26,7 @@ class OrganizationDomainVerify(BaseModel):
 class OrganizationDomainResponse(BaseModel):
     """Response model for a domain."""
 
-    id: str
+    id: UUID
     slug: str
 
     name: Optional[str]
@@ -38,7 +39,7 @@ class OrganizationDomainResponse(BaseModel):
     created_at: datetime
     updated_at: Optional[datetime]
 
-    organization_id: str
+    organization_id: UUID
 
     class Config:
         from_attributes = True
@@ -76,7 +77,7 @@ class OrganizationProviderUpdate(BaseModel):
 class OrganizationProviderResponse(BaseModel):
     """Response model for an SSO provider."""
 
-    id: str
+    id: UUID
     slug: str
 
     name: Optional[str]
@@ -89,7 +90,7 @@ class OrganizationProviderResponse(BaseModel):
     created_at: datetime
     updated_at: Optional[datetime]
 
-    organization_id: str
+    organization_id: UUID
 
     class Config:
         from_attributes = True

api/ee/tests/pytest/unit/test_organization_fastapi_models.py

@@ -0,0 +1,48 @@
+from datetime import datetime, timezone
+from uuid import uuid4
+
+from ee.src.apis.fastapi.organizations.models import (
+    OrganizationDomainResponse,
+    OrganizationProviderResponse,
+)
+from ee.src.core.organizations.types import OrganizationDomain, OrganizationProvider
+
+
+def test_domain_response_accepts_uuid_backed_domain_dto():
+    domain = OrganizationDomain(
+        id=uuid4(),
+        organization_id=uuid4(),
+        slug="example.com",
+        name="Example",
+        description="Example domain",
+        token="verify-me",
+        flags={"is_verified": False},
+        created_at=datetime.now(timezone.utc),
+        updated_at=None,
+    )
+
+    response = OrganizationDomainResponse.model_validate(domain)
+
+    dumped = response.model_dump(mode="json")
+    assert isinstance(dumped["id"], str)
+    assert isinstance(dumped["organization_id"], str)
+
+
+def test_provider_response_accepts_uuid_backed_provider_dto():
+    provider = OrganizationProvider(
+        id=uuid4(),
+        organization_id=uuid4(),
+        slug="oidc",
+        name="OIDC",
+        description="OIDC provider",
+        settings={"issuer_url": "https://issuer.example.com"},
+        flags={"is_active": True, "is_valid": True},
+        created_at=datetime.now(timezone.utc),
+        updated_at=None,
+    )
+
+    response = OrganizationProviderResponse.model_validate(provider)
+
+    dumped = response.model_dump(mode="json")
+    assert isinstance(dumped["id"], str)
+    assert isinstance(dumped["organization_id"], str)

api/oss/src/core/secrets/dtos.py

@@ -84,31 +84,38 @@ def validate_secret_data_based_on_kind(cls, values: Dict[str, Any]):
             data = data.model_dump()
             values["data"] = data
 
+        standard_provider_kinds = {provider.value for provider in StandardProviderKind}
+        custom_provider_kinds = {provider.value for provider in CustomProviderKind}
+
         if kind == SecretKind.PROVIDER_KEY.value:
             if not isinstance(data, dict):
                 raise ValueError(
                     "The provided request secret dto is not a valid type for StandardProviderDTO"
                 )
-            if not isinstance(data["provider"], dict) or "key" not in data["provider"]:
+            provider = data.get("provider")
+            if not isinstance(provider, dict) or "key" not in provider:
                 raise ValueError(
                     "The provided request secret dto is missing required fields for StandardProviderSettingsDTO"
                 )
-            if data["kind"] not in StandardProviderKind.__members__.values():
+            # Accept the legacy provider slug on input, but persist the canonical value.
+            if data.get("kind") == StandardProviderKind.MISTRALAI.value:
+                data["kind"] = StandardProviderKind.MISTRAL.value
+            if data.get("kind") not in standard_provider_kinds:
                 raise ValueError(
                     "The provided kind in data is not a valid StandardProviderKind enum"
                 )
 
         elif kind == SecretKind.CUSTOM_PROVIDER.value:
+            if not isinstance(data, dict):
+                raise ValueError(
+                    "The provided request secret dto is not a valid type for CustomProviderDTO"
+                )
             # Fix inconsistent API naming - Users might enter 'togetherai' but the API requires 'together_ai'
             # This ensures compatibility with LiteLLM which requires the provider in "together_ai" format
             if data.get("kind", "") == "togetherai":
                 data["kind"] = "together_ai"
 
-            if not isinstance(data, dict):
-                raise ValueError(
-                    "The provided request secret dto is not a valid type for CustomProviderDTO"
-                )
-            if data["kind"] not in CustomProviderKind.__members__.values():
+            if data.get("kind") not in custom_provider_kinds:
                 raise ValueError(
                     "The provided kind in data is not a valid CustomProviderKind enum"
                 )

api/oss/src/core/secrets/utils.py

@@ -7,6 +7,35 @@
 from oss.src.models.api.evaluation_model import LMProvidersEnum
 
 
+_LEGACY_SYSTEM_ENV_NAMES = {
+    LMProvidersEnum.mistral.value: ("MISTRALAI_API_KEY",),
+}
+
+_PROVIDER_ENV_ALIASES = {
+    "mistralai": LMProvidersEnum.mistral.value,
+}
+
+
+def _get_system_env_secret(secret_name: str) -> str | None:
+    for env_name in (secret_name, *_LEGACY_SYSTEM_ENV_NAMES.get(secret_name, ())):
+        env_var = os.getenv(env_name)
+        if env_var:
+            return env_var
+
+    return None
+
+
+def _provider_slug_to_env_var(provider_slug: str) -> str:
+    if not provider_slug:
+        return ""
+
+    canonical_provider = LMProvidersEnum.__members__.get(provider_slug.replace("_", ""))
+    if canonical_provider:
+        return canonical_provider.value
+
+    return _PROVIDER_ENV_ALIASES.get(provider_slug, f"{provider_slug.upper()}_API_KEY")
+
+
 async def get_system_llm_providers_secrets() -> Dict[str, Any]:
     """
     Fetches LLM providers secrets from system environment variables.
@@ -15,7 +44,7 @@ async def get_system_llm_providers_secrets() -> Dict[str, Any]:
     secrets = {}
     for llm_provider in LMProvidersEnum:
         secret_name = llm_provider.value
-        env_var = os.getenv(secret_name)
+        env_var = _get_system_env_secret(secret_name)
         if env_var:
             secrets[secret_name] = env_var
 
@@ -46,7 +75,7 @@ async def get_user_llm_providers_secrets(project_id: str) -> Dict[str, Any]:
     for secret in secrets:
         kind = secret["data"].get("kind")
         provider_slug = kind.value if kind else ""
-        secret_name = f"{provider_slug.upper()}_API_KEY"
+        secret_name = _provider_slug_to_env_var(provider_slug)
         if provider_slug:
             provider = secret["data"].get("provider")
             readable_secrets[secret_name] = provider.get("key") if provider else None

api/oss/src/models/api/evaluation_model.py

@@ -153,7 +153,6 @@ class LLMRunRateLimit(BaseModel):
 class LMProvidersEnum(str, Enum):
     openai = "OPENAI_API_KEY"
     mistral = "MISTRAL_API_KEY"
-    mistralai = "MISTRALAI_API_KEY"
     cohere = "COHERE_API_KEY"
     anthropic = "ANTHROPIC_API_KEY"
     anyscale = "ANYSCALE_API_KEY"

api/oss/tests/legacy/conftest.py

@@ -43,7 +43,6 @@ def sample_testset_endpoint_json():
 API_KEYS_MAPPING = {
     "OPENAI_API_KEY": "openai",
     "MISTRAL_API_KEY": "mistral",
-    "MISTRALAI_API_KEY": "mistralai",
     "COHERE_API_KEY": "cohere",
     "ANTHROPIC_API_KEY": "anthropic",
     "ANYSCALE_API_KEY": "anyscale",

api/oss/tests/pytest/unit/secrets/test_dtos.py

@@ -0,0 +1,60 @@
+import pytest
+from pydantic import ValidationError
+
+from oss.src.core.secrets.dtos import CreateSecretDTO, UpdateSecretDTO
+
+
+def test_create_secret_normalizes_mistralai_standard_provider_payload():
+    payload = {
+        "header": {"name": "Mistral AI", "description": ""},
+        "secret": {
+            "kind": "provider_key",
+            "data": {
+                "kind": "mistralai",
+                "provider": {
+                    "key": "TEST_KEY",
+                },
+            },
+        },
+    }
+
+    secret = CreateSecretDTO.model_validate(payload)
+
+    assert secret.secret.data.kind == "mistral"
+    assert secret.secret.data.provider.key == "TEST_KEY"
+
+
+def test_update_secret_normalizes_mistralai_standard_provider_payload():
+    payload = {
+        "secret": {
+            "kind": "provider_key",
+            "data": {
+                "kind": "mistralai",
+                "provider": {
+                    "key": "TEST_KEY",
+                },
+            },
+        },
+    }
+
+    secret = UpdateSecretDTO.model_validate(payload)
+
+    assert secret.secret.data.kind == "mistral"
+    assert secret.secret.data.provider.key == "TEST_KEY"
+
+
+def test_create_secret_rejects_missing_standard_provider_kind():
+    payload = {
+        "header": {"name": "Mistral AI", "description": ""},
+        "secret": {
+            "kind": "provider_key",
+            "data": {
+                "provider": {
+                    "key": "TEST_KEY",
+                },
+            },
+        },
+    }
+
+    with pytest.raises(ValidationError, match="StandardProviderKind"):
+        CreateSecretDTO.model_validate(payload)

api/oss/tests/pytest/unit/secrets/test_utils.py

@@ -0,0 +1,64 @@
+from types import SimpleNamespace
+
+import pytest
+
+from oss.src.core.secrets.enums import StandardProviderKind
+from oss.src.core.secrets.utils import (
+    get_system_llm_providers_secrets,
+    get_user_llm_providers_secrets,
+)
+
+
+class _FakeVaultService:
+    def __init__(self, *_args, **_kwargs):
+        pass
+
+    async def list_secrets(self, project_id):
+        del project_id
+        return [
+            SimpleNamespace(
+                kind="provider_key",
+                model_dump=lambda include=None: {
+                    "data": {
+                        "kind": StandardProviderKind.MISTRALAI,
+                        "provider": {"key": "mistral-key"},
+                    }
+                },
+            ),
+            SimpleNamespace(
+                kind="provider_key",
+                model_dump=lambda include=None: {
+                    "data": {
+                        "kind": StandardProviderKind.TOGETHERAI,
+                        "provider": {"key": "together-key"},
+                    }
+                },
+            ),
+        ]
+
+
+@pytest.mark.asyncio
+async def test_get_user_llm_providers_secrets_normalizes_legacy_provider_slugs(
+    monkeypatch,
+):
+    monkeypatch.setattr("oss.src.core.secrets.utils.VaultService", _FakeVaultService)
+
+    secrets = await get_user_llm_providers_secrets(
+        "00000000-0000-0000-0000-000000000000"
+    )
+
+    assert secrets["MISTRAL_API_KEY"] == "mistral-key"
+    assert "MISTRALAI_API_KEY" not in secrets
+    assert secrets["TOGETHERAI_API_KEY"] == "together-key"
+    assert "TOGETHER_AI_API_KEY" not in secrets
+
+
+@pytest.mark.asyncio
+async def test_get_system_llm_providers_secrets_reads_legacy_mistralai_env(monkeypatch):
+    monkeypatch.delenv("MISTRAL_API_KEY", raising=False)
+    monkeypatch.setenv("MISTRALAI_API_KEY", "legacy-mistral-key")
+
+    secrets = await get_system_llm_providers_secrets()
+
+    assert secrets["MISTRAL_API_KEY"] == "legacy-mistral-key"
+    assert "MISTRALAI_API_KEY" not in secrets

api/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "api"
-version = "0.94.3"
+version = "0.94.4"
 description = "Agenta API"
 authors = [
     { name = "Mahmoud Mabrouk", email = "mahmoud@agenta.ai" },