fix: use referer from headers for base url in password reset url (#4746)

* fix: use referer or base url in password reset url

* clean up

src/phoenix/server/api/routers/auth.py

@@ -2,6 +2,8 @@
 import secrets
 from datetime import datetime, timedelta, timezone
 from functools import partial
+from pathlib import Path
+from urllib.parse import urlencode, urlparse, urlunparse
 
 from fastapi import APIRouter, Depends, HTTPException, Request, Response
 from sqlalchemy import select
@@ -29,10 +31,9 @@
     set_refresh_token_cookie,
     validate_password_format,
 )
-from phoenix.config import get_base_url, get_env_disable_rate_limit
+from phoenix.config import get_base_url, get_env_disable_rate_limit, get_env_host_root_path
 from phoenix.db import enums, models
 from phoenix.server.bearer_auth import PhoenixUser, create_access_and_refresh_tokens
-from phoenix.server.email.templates.types import PasswordResetTemplateBody
 from phoenix.server.email.types import EmailSender
 from phoenix.server.rate_limiters import ServerRateLimiter, fastapi_ip_rate_limiter
 from phoenix.server.types import (
@@ -218,7 +219,12 @@ async def initiate_password_reset(request: Request) -> Response:
         expiration_time=datetime.now(timezone.utc) + token_expiry,
     )
     token, _ = await token_store.create_password_reset_token(password_reset_token_claims)
-    await sender.send_password_reset_email(email, PasswordResetTemplateBody(token, get_base_url()))
+    url = urlparse(request.headers.get("referer") or get_base_url())
+    path = Path(get_env_host_root_path()) / "reset-password-with-token"
+    query_string = urlencode(dict(token=token))
+    components = (url.scheme, url.netloc, path.as_posix(), "", query_string, "")
+    reset_url = urlunparse(components)
+    await sender.send_password_reset_email(email, reset_url)
     return Response(status_code=HTTP_204_NO_CONTENT)
 
 

src/phoenix/server/email/sender.py

@@ -1,10 +1,7 @@
-from dataclasses import asdict
 from pathlib import Path
 
 from fastapi_mail import ConnectionConfig, FastMail, MessageSchema
 
-from phoenix.server.email.templates.types import PasswordResetTemplateBody
-
 EMAIL_TEMPLATE_FOLDER = Path(__file__).parent / "templates"
 
 
@@ -15,12 +12,12 @@ def __init__(self, conf: ConnectionConfig) -> None:
     async def send_password_reset_email(
         self,
         email: str,
-        values: PasswordResetTemplateBody,
+        reset_url: str,
     ) -> None:
         message = MessageSchema(
             subject="[Phoenix] Password Reset Request",
             recipients=[email],
-            template_body=asdict(values),
+            template_body=dict(reset_url=reset_url),
             subtype="html",
         )
         await self._fm.send_message(

src/phoenix/server/email/templates/password_reset.html

@@ -11,10 +11,7 @@
       reset your password:
     </p>
     <p>
-      <a
-        id="reset-url"
-        href="{{ base_url }}reset-password-with-token?token={{ token }}"
-        >Reset Password</a
+      <a id="reset-url" href="{{ reset_url }}">Reset Password</a
       >
     </p>
     <p>If you did not make this request, please contact your administrator.</p>

src/phoenix/server/email/types.py

@@ -2,12 +2,10 @@
 
 from typing import Protocol
 
-from phoenix.server.email.templates.types import PasswordResetTemplateBody
-
 
 class EmailSender(Protocol):
     async def send_password_reset_email(
         self,
         email: str,
-        values: PasswordResetTemplateBody,
+        reset_url: str,
     ) -> None: ...