ethyca-fides 2.58.2rc0__py2.py3-none-any.whl → 2.58.3b0__py2.py3-none-any.whl

fides/api/models/comment.py

@@ -3,15 +3,17 @@ from typing import TYPE_CHECKING, Any
 
 from sqlalchemy import Column
 from sqlalchemy import Enum as EnumColumn
-from sqlalchemy import ForeignKey, String, UniqueConstraint
+from sqlalchemy import ForeignKey, String, UniqueConstraint, orm
 from sqlalchemy.ext.declarative import declared_attr
 from sqlalchemy.orm import Session, relationship
 
 from fides.api.db.base_class import Base
+from fides.api.models.attachment import Attachment, AttachmentReferenceType
 
 if TYPE_CHECKING:
-    from fides.api.models.attachment import Attachment
+    from fides.api.models.attachment import AttachmentReference
     from fides.api.models.fides_user import FidesUser
+    from fides.api.models.privacy_request import PrivacyRequest
 
 
 class CommentType(str, EnumType):
@@ -87,23 +89,51 @@ class Comment(Base):
     references = relationship(
         "CommentReference",
         back_populates="comment",
-        cascade="all, delete",
-        uselist=True,
-    )
-
-    attachments = relationship(
-        "Attachment",
-        secondary="attachment_reference",
-        primaryjoin="Comment.id == AttachmentReference.reference_id",
-        secondaryjoin="Attachment.id == AttachmentReference.attachment_id",
-        order_by="Attachment.created_at",
+        cascade="all, delete-orphan",
         uselist=True,
+        foreign_keys=[CommentReference.comment_id],
+        primaryjoin=lambda: Comment.id == orm.foreign(CommentReference.comment_id),
     )
 
     def delete(self, db: Session) -> None:
         """Delete the comment and all associated references."""
         # Delete the comment
-        for attachment in self.attachments:
-            if len(attachment.references) == 1:
-                attachment.delete(db)
+        Attachment.delete_attachments_for_reference_and_type(
+            db, self.id, AttachmentReferenceType.comment
+        )
+        for reference in self.references:
+            reference.delete(db)
         db.delete(self)
+
+    @staticmethod
+    def delete_comments_for_reference_and_type(
+        db: Session, reference_id: str, reference_type: CommentReferenceType
+    ) -> None:
+        """
+        Deletes comments associated with a given reference_id and reference_type.
+        Delete all references to the comments.
+
+        Args:
+            db: Database session.
+            reference_id: The reference id to delete.
+            reference_type: The reference type to delete
+
+        Examples:
+          - Delete all comments associated with a privacy request.
+            ``Comment.delete_comments_for_reference_and_type(
+                db, privacy_request.id, CommentReferenceType.privacy_request
+            )``
+        """
+        # Query comments explicitly to avoid lazy loading
+        comments = (
+            db.query(Comment)
+            .join(CommentReference)
+            .filter(
+                CommentReference.reference_id == reference_id,
+                CommentReference.reference_type == reference_type,
+            )
+            .all()
+        )
+
+        for comment in comments:
+            comment.delete(db)

fides/api/models/detection_discovery.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 from datetime import datetime
 from enum import Enum
+from re import match
 from typing import Any, Dict, Iterable, List, Optional, Type
 
 from loguru import logger
@@ -35,9 +36,17 @@ class MonitorFrequency(Enum):
     DAILY = "Daily"
     WEEKLY = "Weekly"
     MONTHLY = "Monthly"
+    QUARTERLY = "Quarterly"
+    YEARLY = "Yearly"
     NOT_SCHEDULED = "Not scheduled"
 
 
+# pattern for a string of 4 comma-separated integers,
+# used to represent the months of the year that the monitor will run
+# on quarterly basis, in cron format
+QUARTERLY_MONTH_PATTERN = r"^\d+,\d+,\d+,\d+$"
+
+
 class MonitorConfig(Base):
     """
     Monitor configuration used for data detection and discovery.
@@ -138,6 +147,13 @@ class MonitorConfig(Base):
             or self.monitor_execution_trigger.get("hour", None) is None
         ):
             return MonitorFrequency.NOT_SCHEDULED
+        month_trigger = self.monitor_execution_trigger.get("month", None)
+        if month_trigger is not None:
+            if isinstance(month_trigger, str) and match(
+                QUARTERLY_MONTH_PATTERN, month_trigger
+            ):
+                return MonitorFrequency.QUARTERLY
+            return MonitorFrequency.YEARLY
         if self.monitor_execution_trigger.get("day", None) is not None:
             return MonitorFrequency.MONTHLY
         if self.monitor_execution_trigger.get("day_of_week", None) is not None:
@@ -201,6 +217,10 @@ class MonitorConfig(Base):
         a Tuesday.
         - with an `execution_frequency` of "monthly", it will result in monthly
         execution at 12:00:00+00:00 on the 14th day of every month.
+        - with an `execution_frequency` of "quarterly", it will result in quarterly
+        execution at 12:00:00+00:00 on the 14th day of the first month of each quarter.
+        - with an `execution_frequency` of "yearly", it will result in yearly
+        execution at 12:00:00+00:00 on May 14th of each year.
 
         See https://apscheduler.readthedocs.io/en/3.x/modules/triggers/cron.html
         for more information about the cron trigger parameters.
@@ -221,6 +241,17 @@ class MonitorConfig(Base):
                 cron_trigger_dict["day_of_week"] = execution_start_date.weekday()
             if execution_frequency == MonitorFrequency.MONTHLY:
                 cron_trigger_dict["day"] = execution_start_date.day
+            if execution_frequency == MonitorFrequency.QUARTERLY:
+                cron_trigger_dict["day"] = execution_start_date.day
+                # Calculate which month of the quarter (0-2) this is
+                month_of_quarter = (execution_start_date.month - 1) % 3
+                # Set to run in the same month of each quarter (1, 4, 7, 10 for first month)
+                cron_trigger_dict["month"] = (
+                    f"{1 + month_of_quarter},{4 + month_of_quarter},{7 + month_of_quarter},{10 + month_of_quarter}"
+                )
+            if execution_frequency == MonitorFrequency.YEARLY:
+                cron_trigger_dict["day"] = execution_start_date.day
+                cron_trigger_dict["month"] = execution_start_date.month
             data["monitor_execution_trigger"] = cron_trigger_dict
 
 

fides/api/models/fides_user.py

@@ -1,7 +1,6 @@
 # pylint: disable=unused-import
 from __future__ import annotations
 
-import uuid
 from datetime import datetime
 from typing import TYPE_CHECKING, Any, List
 
@@ -10,6 +9,10 @@ from sqlalchemy import Boolean, Column, DateTime
 from sqlalchemy import Enum as EnumColumn
 from sqlalchemy import String
 from sqlalchemy.orm import Session, relationship
+from sqlalchemy_utils.types.encrypted.encrypted_type import (
+    AesGcmEngine,
+    StringEncryptedType,
+)
 
 from fides.api.common_exceptions import SystemManagerException
 from fides.api.cryptography.cryptographic_util import (
@@ -20,8 +23,8 @@ from fides.api.db.base_class import Base
 from fides.api.models.audit_log import AuditLog
 
 # Intentionally importing SystemManager here to build the FidesUser.systems relationship
-from fides.api.models.system_manager import SystemManager  # type: ignore[unused-import]
 from fides.api.schemas.user import DisabledReason
+from fides.config import CONFIG
 
 if TYPE_CHECKING:
     from fides.api.models.sql_models import System  # type: ignore[attr-defined]
@@ -34,12 +37,22 @@ class FidesUser(Base):
     email_address = Column(CIText, unique=True, nullable=True)
     first_name = Column(String, nullable=True)
     last_name = Column(String, nullable=True)
-    hashed_password = Column(String, nullable=False)
-    salt = Column(String, nullable=False)
+    hashed_password = Column(String, nullable=True)
+    salt = Column(String, nullable=True)
     disabled = Column(Boolean, nullable=False, server_default="f")
     disabled_reason = Column(EnumColumn(DisabledReason), nullable=True)
     last_login_at = Column(DateTime(timezone=True), nullable=True)
     password_reset_at = Column(DateTime(timezone=True), nullable=True)
+    password_login_enabled = Column(Boolean, nullable=True)
+    totp_secret = Column(
+        StringEncryptedType(
+            type_in=String(),
+            key=CONFIG.security.app_encryption_key,
+            engine=AesGcmEngine,
+            padding="pkcs5",
+        ),
+        nullable=True,
+    )
 
     # passive_deletes="all" prevents audit logs from having their
     # privacy_request_id set to null when a privacy_request is deleted.
@@ -79,11 +92,11 @@ class FidesUser(Base):
         """Create a FidesUser by hashing the password with a generated salt
         and storing the hashed password and the salt"""
 
-        # we set a dummy password if one isn't provided because this means it's part of the user
-        # invite flow and the password will be set by the user after they accept their invite
-        hashed_password, salt = FidesUser.hash_password(
-            data.get("password") or str(uuid.uuid4())
-        )
+        if password := data.get("password"):
+            hashed_password, salt = FidesUser.hash_password(password)
+        else:
+            hashed_password = None
+            salt = None
 
         user = super().create(
             db,
@@ -96,6 +109,7 @@ class FidesUser(Base):
                 "last_name": data.get("last_name"),
                 "disabled": data.get("disabled") or False,
                 "disabled_reason": data.get("disabled_reason"),
+                "password_login_enabled": data.get("password_login_enabled"),
             },
             check_name=check_name,
         )
@@ -104,6 +118,9 @@ class FidesUser(Base):
 
     def credentials_valid(self, password: str, encoding: str = "UTF-8") -> bool:
         """Verifies that the provided password is correct."""
+        if self.salt is None:
+            return False
+
         provided_password_hash = hash_credential_with_salt(
             password.encode(encoding),
             self.salt.encode(encoding),

fides/api/models/fides_user_invite.py

@@ -67,6 +67,8 @@ class FidesUserInvite(Base):
 
     def invite_code_valid(self, invite_code: str, encoding: str = "UTF-8") -> bool:
         """Verifies that the provided invite code is correct."""
+        if self.salt is None:
+            return False
 
         invite_code_hash = hash_credential_with_salt(
             invite_code.encode(encoding),

fides/api/models/privacy_experience.py

@@ -20,6 +20,7 @@ from fides.api.models import (
 from fides.api.models.location_regulation_selections import PrivacyNoticeRegion
 from fides.api.models.privacy_notice import PrivacyNotice
 from fides.api.models.property import Property
+from fides.api.models.tcf_publisher_restrictions import TCFConfiguration
 from fides.api.schemas.language import SupportedLanguage
 
 
@@ -46,6 +47,21 @@ class Layer1ButtonOption(Enum):
 
     ACKNOWLEDGE = "acknowledge"
     OPT_IN_OPT_OUT = "opt_in_opt_out"
+    OPT_IN_ONLY = "opt_in_only"
+
+
+class RejectAllMechanism(Enum):
+    """
+    Reject all mechanism options - not formalized in the db.
+    Used to configure the behavior of the reject all button in TCF experiences
+    """
+
+    # Reject both consent and legitimate interest preferences (all purposes, special features, vendors)
+    # This is the default behavior
+    REJECT_ALL = "reject_all"
+    # Reject only consent preferences (all purposes, special features, vendors).
+    # Do not reject any legitimate interest preferences.
+    REJECT_CONSENT_ONLY = "reject_consent_only"
 
 
 # Fides JS UX Types - there should only be one of these defined per region
@@ -179,6 +195,10 @@ class PrivacyExperienceConfig(PrivacyExperienceConfigBase, Base):
     The Privacy Experience Configuration model that stores shared configuration for Privacy Experiences.
 
     - Translations, Notices, and Regions (via Privacy Experiences) are linked to this resource.
+
+    If you're adding a new PrivacyExperienceConfig, make sure to use the `create` method since it has
+    custom logic that ensures other resources are created/updated as needed, as well as setting the
+    expected values for some fields in the experience config itself.
     """
 
     allow_language_selection = Column(
@@ -203,6 +223,20 @@ class PrivacyExperienceConfig(PrivacyExperienceConfigBase, Base):
         String, ForeignKey(ExperienceConfigTemplate.id_field_path)
     )  # The template from which this config was created if applicable
 
+    # Mechanism to use when the reject all button is clicked in a TCF experience
+    # Nullable because this is not applicable for other experience types
+    reject_all_mechanism = Column(
+        EnumColumn(RejectAllMechanism),
+        nullable=True,
+    )
+    # Optional FK to a TCF Configuration
+
+    tcf_configuration_id = Column(
+        String,
+        ForeignKey(TCFConfiguration.id_field_path, ondelete="SET NULL"),
+        nullable=True,
+    )
+
     # Relationships
     experiences = relationship(
         "PrivacyExperience",
@@ -232,6 +266,12 @@ class PrivacyExperienceConfig(PrivacyExperienceConfigBase, Base):
         lazy="selectin",
     )
 
+    tcf_configuration: RelationshipProperty[Optional[TCFConfiguration]] = relationship(
+        "TCFConfiguration",
+        back_populates="privacy_experience_configs",
+        lazy="selectin",
+    )
+
     @property
     def regions(self) -> List[PrivacyNoticeRegion]:
         """Return the regions using this experience config"""
@@ -304,6 +344,15 @@ class PrivacyExperienceConfig(PrivacyExperienceConfigBase, Base):
         # Link Properties to this Privacy Experience config via the PrivacyExperienceConfigProperty table
         link_properties_to_experience_config(db, properties, experience_config)
 
+        # If the reject all mechanism is not set and the experience config is a TCF experience,
+        # set the reject all mechanism to REJECT_ALL
+        if (
+            experience_config.component == ComponentType.tcf_overlay
+            and experience_config.reject_all_mechanism is None
+        ):
+            experience_config.reject_all_mechanism = RejectAllMechanism.REJECT_ALL  # type: ignore
+            experience_config.save(db)
+
         return experience_config
 
     def update(self, db: Session, *, data: dict[str, Any]) -> PrivacyExperienceConfig:
@@ -507,6 +556,24 @@ class PrivacyExperienceConfigHistory(
         index=True,
     )  # If a translation is deleted, this is set to null, but the overall record remains in the database for reporting purposes
 
+    # Mechanism to use when the reject all button is clicked in a TCF experience
+    # Nullable because this is not applicable for other experience types
+    reject_all_mechanism = Column(
+        EnumColumn(RejectAllMechanism),
+        nullable=True,
+    )
+    # Optional FK to a TCF Configuration
+    tcf_configuration_id = Column(
+        String,
+        ForeignKey(TCFConfiguration.id_field_path, ondelete="SET NULL"),
+        nullable=True,
+    )
+
+    tcf_configuration: RelationshipProperty[Optional[TCFConfiguration]] = relationship(
+        "TCFConfiguration",
+        lazy="selectin",
+    )
+
     version = Column(Float, nullable=False, default=1.0)
 
 
@@ -569,6 +636,7 @@ class PrivacyExperience(Base):
     tcf_special_features: List = []
     tcf_system_consents: List = []
     tcf_system_legitimate_interests: List = []
+    tcf_publisher_restrictions: List = []
     gvl: Optional[Dict] = {}
     # TCF Developer-Friendly Meta added at runtime as the result of build_tc_data_for_mobile
     meta: Dict = {}

fides/api/models/privacy_request/privacy_request.py

@@ -39,10 +39,14 @@ from fides.api.graph.config import (
     CollectionAddress,
 )
 from fides.api.migrations.hash_migration_mixin import HashMigrationMixin
-from fides.api.models.attachment import Attachment, AttachmentReference
+from fides.api.models.attachment import (
+    Attachment,
+    AttachmentReference,
+    AttachmentReferenceType,
+)
 from fides.api.models.audit_log import AuditLog
 from fides.api.models.client import ClientDetail
-from fides.api.models.comment import Comment, CommentReference
+from fides.api.models.comment import Comment, CommentReference, CommentReferenceType
 from fides.api.models.fides_user import FidesUser
 from fides.api.models.manual_webhook import AccessManualWebhook
 from fides.api.models.policy import (
@@ -169,18 +173,25 @@ class PrivacyRequest(
         backref="privacy_requests",
     )
     attachments = relationship(
-        Attachment,
+        "Attachment",
         secondary="attachment_reference",
-        primaryjoin="PrivacyRequest.id == AttachmentReference.reference_id",
+        primaryjoin="and_(PrivacyRequest.id == AttachmentReference.reference_id, "
+        "AttachmentReference.reference_type == 'privacy_request')",
         secondaryjoin="Attachment.id == AttachmentReference.attachment_id",
         order_by="Attachment.created_at",
+        viewonly=True,
+        uselist=True,
     )
+
     comments = relationship(
-        Comment,
+        "Comment",
         secondary="comment_reference",
-        primaryjoin="PrivacyRequest.id == CommentReference.reference_id",
+        primaryjoin="and_(PrivacyRequest.id == CommentReference.reference_id, "
+        "CommentReference.reference_type == 'privacy_request')",
         secondaryjoin="Comment.id == CommentReference.comment_id",
         order_by="Comment.created_at",
+        viewonly=True,
+        uselist=True,
     )
     property_id = Column(String, nullable=True)
 
@@ -323,6 +334,12 @@ class PrivacyRequest(
         deleting this object from the database
         """
         self.clear_cached_values()
+        Attachment.delete_attachments_for_reference_and_type(
+            db, self.id, AttachmentReferenceType.privacy_request
+        )
+        Comment.delete_comments_for_reference_and_type(
+            db, self.id, CommentReferenceType.privacy_request
+        )
 
         for provided_identity in self.provided_identities:  # type: ignore[attr-defined]
             provided_identity.delete(db=db)