ethyca-fides 2.56.2rc3__py2.py3-none-any.whl → 2.56.3b1__py2.py3-none-any.whl

fides/api/models/detection_discovery.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from datetime import datetime, timezone
+from datetime import datetime
 from enum import Enum
 from typing import Any, Dict, Iterable, List, Optional, Type
 
@@ -388,7 +388,9 @@ class MonitorExecution(Base):
     )
     status = Column(String, nullable=True)
     started = Column(
-        DateTime(timezone=True), nullable=True, default=datetime.now(timezone.utc)
+        DateTime(timezone=True),
+        nullable=True,
+        server_default=func.now(),
     )
     completed = Column(DateTime(timezone=True), nullable=True)
     classification_instances = Column(
@@ -398,6 +400,13 @@ class MonitorExecution(Base):
         nullable=False,
         default=list,
     )
+    # stores additional information from monitor execution failures as an array of strings,
+    # e.g. error messages, stack traces, etc.
+    messages = Column(
+        ARRAY(String),
+        nullable=False,
+        default=list,
+    )
     created_at = Column(DateTime(timezone=True), server_default=func.now())
     updated_at = Column(
         DateTime(timezone=True),

fides/api/models/privacy_request.py

@@ -1278,6 +1278,28 @@ class PrivacyRequest(
             },
         )
 
+    def add_skipped_execution_log(
+        self,
+        db: Session,
+        connection_key: Optional[str],
+        dataset_name: Optional[str],
+        collection_name: Optional[str],
+        message: str,
+        action_type: ActionType,
+    ) -> ExecutionLog:
+        return ExecutionLog.create(
+            db=db,
+            data={
+                "privacy_request_id": self.id,
+                "connection_key": connection_key,
+                "dataset_name": dataset_name,
+                "collection_name": collection_name,
+                "status": ExecutionLogStatus.skipped,
+                "message": message,
+                "action_type": action_type,
+            },
+        )
+
     def add_error_execution_log(
         self,
         db: Session,
@@ -1861,6 +1883,7 @@ class TraversalDetails(FidesSchema):
     incoming_edges: List[Tuple[str, str]]
     outgoing_edges: List[Tuple[str, str]]
     input_keys: List[str]
+    skipped_nodes: Optional[List[Tuple[str, str]]] = None
 
     # TODO: remove this method once we support custom request fields in DSR graph.
     @classmethod
@@ -1868,15 +1891,15 @@ class TraversalDetails(FidesSchema):
         """
         Creates an "empty" TraversalDetails object that only has the dataset connection key set.
         This is a bit of a hacky workaround needed to implement the Dynamic Erasure Emails feature,
-        and should be needed only until we support custom request fields as entry points to the DSR graph.
-        This is needed because custom request field nodes aren't currently reachable, so they don't have
-        a real TraversalNode associated to them.
+        but we should no longer need it once the custom_request_fields are included in our graph
+        traversal
         """
         return cls(
             dataset_connection_key=connection_key,
             incoming_edges=[],
             outgoing_edges=[],
             input_keys=[],
+            skipped_nodes=[],
         )
 
 

fides/api/task/create_request_tasks.py

@@ -451,7 +451,7 @@ def run_access_request(
         )
     else:
         try:
-            traversal: Traversal = Traversal(graph, identity, policy)
+            traversal: Traversal = Traversal(graph, identity, policy=policy)
 
             # Traversal.traverse populates traversal_nodes in place, adding parents and children to each traversal_node.
             traversal_nodes: Dict[CollectionAddress, TraversalNode] = {}
@@ -485,14 +485,32 @@ def run_access_request(
                     connection_configs,
                 )
             )
-            privacy_request.add_success_execution_log(
-                session,
-                connection_key=None,
-                dataset_name="Dataset traversal",
-                collection_name=None,
-                message=f"Traversal successful for privacy request: {privacy_request.id}",
-                action_type=ActionType.access,
-            )
+
+            # Add execution logs for skipped nodes
+            if traversal.skipped_nodes:
+                logger.warning(
+                    "Some nodes were skipped, the identities provided were not sufficient to reach them"
+                )
+                for node_address, skip_message in traversal.skipped_nodes.items():
+                    logger.debug(skip_message)
+                    privacy_request.add_skipped_execution_log(
+                        session,
+                        connection_key=None,
+                        dataset_name="Dataset traversal",
+                        collection_name=node_address.replace(":", "."),
+                        message=skip_message,
+                        action_type=ActionType.access,
+                    )
+            # Or log success if all collections are reachable
+            else:
+                privacy_request.add_success_execution_log(
+                    session,
+                    connection_key=None,
+                    dataset_name="Dataset traversal",
+                    collection_name=None,
+                    message=f"Traversal successful for privacy request: {privacy_request.id}",
+                    action_type=ActionType.access,
+                )
         except TraversalError as err:
             log_traversal_error_and_update_privacy_request(
                 privacy_request, session, err

fides/api/task/deprecated_graph_task.py

@@ -115,15 +115,33 @@ def run_access_request_deprecated(
 ) -> Dict[str, List[Row]]:
     """Deprecated: Run the access request sequentially in-memory using Dask"""
     try:
-        traversal: Traversal = Traversal(graph, identity, policy)
-        privacy_request.add_success_execution_log(
-            session,
-            connection_key=None,
-            dataset_name="Dataset traversal",
-            collection_name=None,
-            message=f"Traversal successful for privacy request: {privacy_request.id}",
-            action_type=ActionType.access,
-        )
+        traversal: Traversal = Traversal(graph, identity, policy=policy)
+        # Add execution logs for skipped nodes
+        if traversal.skipped_nodes:
+            logger.warning(
+                "Some nodes were skipped, the identities provided were not sufficient to reach them"
+            )
+
+            for node_address, skip_message in traversal.skipped_nodes.items():
+                logger.debug(skip_message)
+                privacy_request.add_skipped_execution_log(
+                    session,
+                    connection_key=None,
+                    dataset_name="Dataset traversal",
+                    collection_name=node_address.replace(":", "."),
+                    message=skip_message,
+                    action_type=ActionType.access,
+                )
+        # Or log success if all collections are reachable
+        else:
+            privacy_request.add_success_execution_log(
+                session,
+                connection_key=None,
+                dataset_name="Dataset traversal",
+                collection_name=None,
+                message=f"Traversal successful for privacy request: {privacy_request.id}",
+                action_type=ActionType.access,
+            )
 
     except TraversalError as err:
         log_traversal_error_and_update_privacy_request(privacy_request, session, err)
@@ -205,7 +223,7 @@ def run_erasure_request_deprecated(  # pylint: disable = too-many-arguments
     session: Session,
 ) -> Dict[str, int]:
     """Deprecated: Run an erasure request sequentially in-memory using Dask"""
-    traversal: Traversal = Traversal(graph, identity, policy)
+    traversal: Traversal = Traversal(graph, identity, policy=policy)
     with TaskResources(
         privacy_request, policy, connection_configs, EMPTY_REQUEST_TASK, session
     ) as resources:

fides/api/task/graph_task.py

@@ -36,7 +36,8 @@ from fides.api.models.connectionconfig import (
     ConnectionType,
 )
 from fides.api.models.datasetconfig import DatasetConfig
-from fides.api.models.policy import Policy
+from fides.api.models.policy import Policy, Rule
+from fides.api.models.privacy_preference import PrivacyPreferenceHistory
 from fides.api.models.privacy_request import ExecutionLog, PrivacyRequest, RequestTask
 from fides.api.schemas.policy import ActionType, CurrentStep
 from fides.api.schemas.privacy_request import ExecutionLogStatus
@@ -54,7 +55,9 @@ from fides.api.util.collection_util import (
     make_immutable,
     make_mutable,
 )
-from fides.api.util.consent_util import add_errored_system_status_for_consent_reporting
+from fides.api.util.consent_util import (
+    add_errored_system_status_for_consent_reporting_on_preferences,
+)
 from fides.api.util.logger import Pii
 from fides.api.util.logger_context_utils import LoggerContextKeys
 from fides.api.util.saas_util import FIDESOPS_GROUPED_INPUTS
@@ -138,13 +141,7 @@ def retry(
                         self.resources.request.id,
                     )
                     self.log_skipped(action_type, exc)
-                    for pref in self.resources.request.privacy_preferences:
-                        # For consent reporting, also caching the given system as skipped for all historical privacy preferences.
-                        pref.cache_system_status(
-                            self.resources.session,
-                            self.connector.configuration.system_key,
-                            ExecutionLogStatus.skipped,
-                        )
+                    self.cache_system_status_for_preferences()
                     return default_return
                 except BaseException as ex:  # pylint: disable=W0703
                     traceback.print_exc()
@@ -164,11 +161,7 @@ def retry(
                     action_type.value
                 ]  # Convert ActionType into a CurrentStep, no longer coerced with Pydantic V2
             )
-            add_errored_system_status_for_consent_reporting(
-                self.resources.session,
-                self.resources.request,
-                self.connector.configuration,
-            )
+            self.add_error_status_for_consent_reporting()
             if not self.request_task.id:
                 # TODO Remove when we stop support for DSR 2.0
                 # Re-raise to stop privacy request execution on failure for
@@ -730,6 +723,48 @@ class GraphTask(ABC):  # pylint: disable=too-many-instance-attributes
         self.log_end(ActionType.consent)
         return output
 
+    def cache_system_status_for_preferences(self) -> None:
+        """
+        Calls cache_system_status for all historical privacy preferences for the given request.
+
+        Purposely uses a new session.
+        """
+
+        privacy_request_id = self.resources.request.id
+
+        with get_db() as db:
+
+            privacy_preferences = db.query(PrivacyPreferenceHistory).filter(
+                PrivacyPreferenceHistory.privacy_request_id == privacy_request_id
+            )
+            for pref in privacy_preferences:
+                # For consent reporting, also caching the given system as skipped for all historical privacy preferences.
+                pref.cache_system_status(
+                    db,
+                    self.connector.configuration.system_key,  # type: ignore[arg-type]
+                    ExecutionLogStatus.skipped,
+                )
+
+    def add_error_status_for_consent_reporting(self) -> None:
+        """
+        Adds the errored system status for all historical privacy preferences for the given request that
+        are deemed relevant for the connector failure (i.e if they had a "pending" log added to them).
+
+        Purposely uses a new session.
+        """
+        privacy_request_id = self.resources.request.id
+        with get_db() as db:
+            privacy_preferences = (
+                db.query(PrivacyPreferenceHistory)
+                .filter(
+                    PrivacyPreferenceHistory.privacy_request_id == privacy_request_id
+                )
+                .all()
+            )
+            add_errored_system_status_for_consent_reporting_on_preferences(
+                db, privacy_preferences, self.connector.configuration
+            )
+
 
 def collect_queries(
     traversal: Traversal, resources: TaskResources
@@ -816,39 +851,45 @@ def build_affected_field_logs(
     }]
     """
 
-    targeted_field_paths: Dict[FieldAddress, str] = {}
+    policy_id = policy.id
 
-    for rule in policy.rules:  # type: ignore[attr-defined]
-        if rule.action_type != action_type:
-            continue
-        rule_categories: List[str] = rule.get_target_data_categories()
-        if not rule_categories:
-            continue
+    with get_db() as db:
 
-        collection_categories: Dict[
-            str, List[FieldPath]
-        ] = node.collection.field_paths_by_category  # type: ignore
-        for rule_cat in rule_categories:
-            for collection_cat, field_paths in collection_categories.items():
-                if collection_cat.startswith(rule_cat):
-                    targeted_field_paths.update(
-                        {
-                            node.address.field_address(field_path): collection_cat
-                            for field_path in field_paths
-                        }
-                    )
+        rules = db.query(Rule).filter(Rule.policy_id == policy_id)
 
-    ret: List[Dict[str, Any]] = []
-    for field_address, data_categories in targeted_field_paths.items():
-        ret.append(
-            {
-                "path": field_address.value,
-                "field_name": field_address.field_path.string_path,
-                "data_categories": [data_categories],
-            }
-        )
+        targeted_field_paths: Dict[FieldAddress, str] = {}
+
+        for rule in rules:  # type: ignore[attr-defined]
+            if rule.action_type != action_type:
+                continue
+            rule_categories: List[str] = rule.get_target_data_categories()
+            if not rule_categories:
+                continue
+
+            collection_categories: Dict[
+                str, List[FieldPath]
+            ] = node.collection.field_paths_by_category  # type: ignore
+            for rule_cat in rule_categories:
+                for collection_cat, field_paths in collection_categories.items():
+                    if collection_cat.startswith(rule_cat):
+                        targeted_field_paths.update(
+                            {
+                                node.address.field_address(field_path): collection_cat
+                                for field_path in field_paths
+                            }
+                        )
+
+        ret: List[Dict[str, Any]] = []
+        for field_address, data_categories in targeted_field_paths.items():
+            ret.append(
+                {
+                    "path": field_address.value,
+                    "field_name": field_address.field_path.string_path,
+                    "data_categories": [data_categories],
+                }
+            )
 
-    return ret
+        return ret
 
 
 def build_consent_dataset_graph(datasets: List[DatasetConfig]) -> DatasetGraph:

fides/api/util/consent_util.py

@@ -214,15 +214,30 @@ def add_errored_system_status_for_consent_reporting(
 
     Deeming them relevant if they already had a "pending" log added to them.
     """
-    for pref in privacy_request.privacy_preferences:  # type: ignore[attr-defined]
+    add_errored_system_status_for_consent_reporting_on_preferences(db, privacy_request.privacy_preferences, connection_config)  # type: ignore[attr-defined]
+
+
+def add_errored_system_status_for_consent_reporting_on_preferences(
+    db: Session,
+    privacy_preferences: List[PrivacyPreferenceHistory],
+    connection_config: ConnectionConfig,
+) -> None:
+    """
+    Cache an errored system status for consent reporting on just the subset
+    of preferences that were deemed relevant for the connector on failure,
+    from the provided list of preferences.
+
+    Deeming them relevant if they already had a "pending" log added to them.
+    """
+    for preference in privacy_preferences:
         if (
-            pref.affected_system_status
-            and pref.affected_system_status.get(connection_config.system_key)
+            preference.affected_system_status
+            and preference.affected_system_status.get(connection_config.system_key)
             == ExecutionLogStatus.pending.value
         ):
-            pref.cache_system_status(
+            preference.cache_system_status(
                 db,
-                connection_config.system_key,
+                connection_config.system_key,  # type: ignore[arg-type]
                 ExecutionLogStatus.error,
             )
 

fides/api/util/logger.py

@@ -8,7 +8,8 @@ from __future__ import annotations
 
 import logging
 import sys
-from typing import TYPE_CHECKING, Any, Dict, List, Optional
+from contextlib import contextmanager
+from typing import TYPE_CHECKING, Any, Dict, Generator, List, Optional
 
 from loguru import logger
 from loguru._handler import Message
@@ -213,3 +214,20 @@ def obfuscate_message(message: str) -> str:
 def format_and_obfuscate(record) -> str:  # type: ignore[no-untyped-def]
     record["extra"]["obfuscated_message"] = obfuscate_message(record["message"])
     return "[{level}] {extra[obfuscated_message]}\n{exception}"
+
+
+# pylint: disable=protected-access
+@contextmanager
+def suppress_logging() -> Generator:
+    """
+    Temporarily suppress all logging by setting the log level to CRITICAL.
+    """
+
+    current_level = logger._core.min_level  # type: ignore[attr-defined]
+    logger._core.min_level = logger.level("CRITICAL").no  # type: ignore[attr-defined]
+
+    try:
+        yield
+    finally:
+        # Restore original configuration
+        logger._core.min_level = current_level  # type: ignore[attr-defined]

fides/config/execution_settings.py

@@ -21,7 +21,7 @@ class ExecutionSettings(FidesSettings):
     )
     require_manual_request_approval: bool = Field(
         default=False,
-        description="Whether privacy requests require explicit approval to execute.",
+        description="Whether access and erasure privacy requests require explicit approval to execute. Consent privacy requests are always auto-approved.",
     )
     subject_identity_verification_required: bool = Field(
         default=False,

fides/config/security_settings.py

@@ -3,7 +3,6 @@
 # pylint: disable=C0115,C0116, E0213
 from typing import List, Optional, Pattern, Tuple, Union
 
-import validators
 from pydantic import Field, SerializeAsAny, ValidationInfo, field_validator
 from pydantic_settings import SettingsConfigDict
 from slowapi.wrappers import parse_many  # type: ignore
@@ -176,22 +175,17 @@ class SecuritySettings(FidesSettings):
     @field_validator("cors_origins", mode="before")
     @classmethod
     def assemble_cors_origins(cls, v: Union[str, List[str]]) -> Union[List[str], str]:
-        """Return a list of valid origins for CORS requests"""
-
-        def validate(values: List[str]) -> None:
-            for value in values:
-                if value != "*":
-                    if not validators.url(value):
-                        raise ValueError(f"{value} is not a valid url")
+        """
+        Return a list of origins for CORS requests.
 
+        This validator allows us to parse a comma-separated string of origins
+        into a list of origins, since the `cors_origins` field can be set
+        as a comma-separated string or a list of strings.
+        """
         if isinstance(v, str) and not v.startswith("["):
             values = [i.strip() for i in v.split(",")]
-            validate(values)
-
             return values
-        if isinstance(v, (list, str)):
-            validate(v)  # type: ignore
-
+        if isinstance(v, list):
             return v
         raise ValueError(v)
 

fides/data/sample_project/sample_connections/sample_connections.yml

@@ -6,12 +6,12 @@ connection:
     dataset: postgres_example_test_dataset
     system_key: cookie_house_postgresql_database
     secrets:
-      host: $FIDES_DEPLOY__CONNECTORS__POSTGRES__HOST
-      port: $FIDES_DEPLOY__CONNECTORS__POSTGRES__PORT
-      dbname: $FIDES_DEPLOY__CONNECTORS__POSTGRES__DBNAME
-      username: $FIDES_DEPLOY__CONNECTORS__POSTGRES__USERNAME
-      password: $FIDES_DEPLOY__CONNECTORS__POSTGRES__PASSWORD
-      ssh_required: $FIDES_DEPLOY__CONNECTORS__POSTGRES__SSH_REQUIRED
+      host: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__HOST"
+      port: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__PORT"
+      dbname: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__DBNAME"
+      username: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__USERNAME"
+      password: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__PASSWORD"
+      ssh_required: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__SSH_REQUIRED"
   - key: cookie_house_loyalty_database
     name: Postgres Connector (Loyalty)
     connection_type: postgres
@@ -19,11 +19,11 @@ connection:
     dataset: postgres_example_test_extended_dataset
     system_key: cookie_house_loyalty_database
     secrets:
-      host: $FIDES_DEPLOY__CONNECTORS__POSTGRES_LOYALTY__HOST
-      port: $FIDES_DEPLOY__CONNECTORS__POSTGRES__PORT
-      dbname: $FIDES_DEPLOY__CONNECTORS__POSTGRES__DBNAME
-      username: $FIDES_DEPLOY__CONNECTORS__POSTGRES__USERNAME
-      password: $FIDES_DEPLOY__CONNECTORS__POSTGRES__PASSWORD
+      host: "$FIDES_DEPLOY__CONNECTORS__POSTGRES_LOYALTY__HOST"
+      port: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__PORT"
+      dbname: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__DBNAME"
+      username: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__USERNAME"
+      password: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__PASSWORD"
     disabled: True
   - key: cookie_house_customer_database_mongodb
     name: MongoDB Connector
@@ -32,43 +32,43 @@ connection:
     dataset: mongo_test
     system_key: cookie_house_customer_database
     secrets:
-      host: $FIDES_DEPLOY__CONNECTORS__MONGO_HOST
-      port: $FIDES_DEPLOY__CONNECTORS__MONGO_PORT
-      defaultauthdb: $FIDES_DEPLOY__CONNECTORS__MONGO_DEFAULTAUTHDB
-      username: $FIDES_DEPLOY__CONNECTORS__MONGO_USERNAME
-      password: $FIDES_DEPLOY__CONNECTORS__MONGO_PASSWORD
+      host: "$FIDES_DEPLOY__CONNECTORS__MONGO_HOST"
+      port: "$FIDES_DEPLOY__CONNECTORS__MONGO_PORT"
+      defaultauthdb: "$FIDES_DEPLOY__CONNECTORS__MONGO_DEFAULTAUTHDB"
+      username: "$FIDES_DEPLOY__CONNECTORS__MONGO_USERNAME"
+      password: "$FIDES_DEPLOY__CONNECTORS__MONGO_PASSWORD"
   - key: mailchimp_connector
     name: Mailchimp Connector
     connection_type: saas
     saas_connector_type: mailchimp
     access: write
     secrets:
-      domain: $FIDES_DEPLOY__CONNECTORS__MAILCHIMP__DOMAIN
-      username: $FIDES_DEPLOY__CONNECTORS__MAILCHIMP__USERNAME
-      api_key: $FIDES_DEPLOY__CONNECTORS__MAILCHIMP__API_KEY
+      domain: "$FIDES_DEPLOY__CONNECTORS__MAILCHIMP__DOMAIN"
+      username: "$FIDES_DEPLOY__CONNECTORS__MAILCHIMP__USERNAME"
+      api_key: "$FIDES_DEPLOY__CONNECTORS__MAILCHIMP__API_KEY"
   - key: stripe_connector
     name: Stripe Connector
     connection_type: saas
     saas_connector_type: stripe
     access: write
     secrets:
-      domain: $FIDES_DEPLOY__CONNECTORS__STRIPE__DOMAIN
-      api_key: $FIDES_DEPLOY__CONNECTORS__STRIPE__API_KEY
+      domain: "$FIDES_DEPLOY__CONNECTORS__STRIPE__DOMAIN"
+      api_key: "$FIDES_DEPLOY__CONNECTORS__STRIPE__API_KEY"
   - key: hubspot_connector
     name: Hubspot Connector
     connection_type: saas
     saas_connector_type: hubspot
     access: write
     secrets:
-      domain: $FIDES_DEPLOY__CONNECTORS__HUBSPOT__DOMAIN
-      private_app_token: $FIDES_DEPLOY__CONNECTORS__HUBSPOT__PRIVATE_APP_TOKEN
+      domain: "$FIDES_DEPLOY__CONNECTORS__HUBSPOT__DOMAIN"
+      private_app_token: "$FIDES_DEPLOY__CONNECTORS__HUBSPOT__PRIVATE_APP_TOKEN"
   - key: mailchimp_transactional_connector
     name: Mailchimp Transactional Connector
     connection_type: saas
     saas_connector_type: mailchimp_transactional
     access: write
     secrets:
-      api_key: $FIDES_DEPLOY__CONNECTORS__MAILCHIMP_TRANSACTIONAL_API_KEY
+      api_key: "$FIDES_DEPLOY__CONNECTORS__MAILCHIMP_TRANSACTIONAL_API_KEY"
   - key: cookie_house_custom_request_fields_database
     name: Postgres Connector (Custom Request Fields)
     connection_type: postgres
@@ -76,8 +76,8 @@ connection:
     dataset: postgres_example_custom_request_field_dataset
     system_key: cookie_house_custom_request_fields_database
     secrets:
-      host: $FIDES_DEPLOY__CONNECTORS__POSTGRES__HOST
-      port: $FIDES_DEPLOY__CONNECTORS__POSTGRES__PORT
-      dbname: $FIDES_DEPLOY__CONNECTORS__POSTGRES__DBNAME
-      username: $FIDES_DEPLOY__CONNECTORS__POSTGRES__USERNAME
-      password: $FIDES_DEPLOY__CONNECTORS__POSTGRES__PASSWORD
+      host: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__HOST"
+      port: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__PORT"
+      dbname: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__DBNAME"
+      username: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__USERNAME"
+      password: "$FIDES_DEPLOY__CONNECTORS__POSTGRES__PASSWORD"

fides/service/dataset/dataset_config_service.py

@@ -14,6 +14,7 @@ from fides.api.common_exceptions import (
 )
 from fides.api.graph.config import GraphDataset
 from fides.api.graph.graph import DatasetGraph
+from fides.api.graph.node_filters import NodeFilter
 from fides.api.graph.traversal import Traversal, TraversalNode
 from fides.api.models.connectionconfig import ConnectionConfig
 from fides.api.models.datasetconfig import DatasetConfig
@@ -35,13 +36,14 @@ from fides.service.dataset.dataset_validator import DatasetValidator
 from fides.service.dataset.validation_steps.traversal import TraversalValidationStep
 
 
-class DatasetFilter:
+class DatasetFilter(NodeFilter):
     """
     Filter that excludes nodes that are not part of the specified dataset.
     This ensures that unreachable nodes from other datasets are not treated as errors.
     """
 
     def __init__(self, dataset_name: str):
+        super().__init__()
         self.dataset_name = dataset_name
 
     def exclude_node(self, node: TraversalNode) -> bool:
@@ -198,7 +200,7 @@ class DatasetConfigService:
             Traversal(
                 dataset_graph,
                 identity_seed,
-                policy,
+                policy=policy,
                 node_filters=[DatasetFilter(dataset_config.fides_key)],
             )
         except UnreachableNodesError as exc: