ethyca-fides 2.58.2rc0__py2.py3-none-any.whl → 2.58.3b1__py2.py3-none-any.whl

{ethyca_fides-2.58.2rc0.dist-info → ethyca_fides-2.58.3b1.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: bdist_wheel (0.45.1)
+Generator: setuptools (78.1.0)
 Root-Is-Purelib: true
 Tag: py2-none-any
 Tag: py3-none-any

{ethyca_fides-2.58.2rc0.dist-info → ethyca_fides-2.58.3b1.dist-info}/entry_points.txt

@@ -1,3 +1,2 @@
 [console_scripts]
 fides = fides.cli:cli
-

fides/_version.py

@@ -8,11 +8,11 @@ import json
 
 version_json = '''
 {
- "date": "2025-04-09T11:48:07+0200",
+ "date": "2025-04-09T09:35:48-0700",
  "dirty": false,
  "error": null,
- "full-revisionid": "90178f03d530f5525b2acc955bdea0cde7751c7a",
- "version": "2.58.2rc0"
+ "full-revisionid": "ad12d73be3bfe01cd2fd5a4a1145760b09639d83",
+ "version": "2.58.3b1"
 }
 '''  # END VERSION_JSON
 

fides/api/alembic/migrations/versions/67d01c4e124e_add_reject_all_mechanism_to_privacy_.py

@@ -0,0 +1,56 @@
+"""add_reject_all_mechanism_to_privacy_experience_config
+
+Revision ID: 67d01c4e124e
+Revises: 1d2f04ac19f2
+Create Date: 2025-03-27 15:26:24.635947
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision = "67d01c4e124e"
+down_revision = "1d2f04ac19f2"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+
+    # Add the reject all mechanism enum and column
+    op.execute(
+        "CREATE TYPE rejectallmechanism AS ENUM ('REJECT_ALL', 'REJECT_CONSENT_ONLY')"
+    )
+    op.add_column(
+        "privacyexperienceconfig",
+        sa.Column(
+            "reject_all_mechanism",
+            sa.Enum("REJECT_ALL", "REJECT_CONSENT_ONLY", name="rejectallmechanism"),
+            nullable=True,
+        ),
+    )
+    op.add_column(
+        "privacyexperienceconfighistory",
+        sa.Column(
+            "reject_all_mechanism",
+            sa.Enum("REJECT_ALL", "REJECT_CONSENT_ONLY", name="rejectallmechanism"),
+            nullable=True,
+        ),
+    )
+
+    # Data migration - set the reject_all_mechanism for all TCF experience configs to REJECT_ALL
+    op.execute(
+        "UPDATE privacyexperienceconfig SET reject_all_mechanism = 'REJECT_ALL' WHERE component = 'tcf_overlay'"
+    )
+    # ### end Alembic commands ###
+
+
+def downgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_column("privacyexperienceconfig", "reject_all_mechanism")
+    op.drop_column("privacyexperienceconfighistory", "reject_all_mechanism")
+    op.execute("DROP TYPE IF EXISTS rejectallmechanism")
+    # ### end Alembic commands ###

fides/api/alembic/migrations/versions/6e565c16dae1_add_tcf_publisher_restrictions.py

@@ -0,0 +1,107 @@
+"""Add TCF Publisher Restrictions
+
+Revision ID: 6e565c16dae1
+Revises: 67d01c4e124e
+Create Date: 2025-04-02 12:35:34.105607
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision = "6e565c16dae1"
+down_revision = "67d01c4e124e"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # Create tcf_configuration table
+    op.create_table(
+        "tcf_configuration",
+        sa.Column("id", sa.String(length=255), nullable=False),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("now()"),
+            nullable=True,
+        ),
+        sa.Column(
+            "updated_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("now()"),
+            nullable=True,
+        ),
+        sa.Column("name", sa.String(), nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("name"),
+    )
+    # Create tcf_publisher_restriction table
+    op.create_table(
+        "tcf_publisher_restriction",
+        sa.Column("id", sa.String(length=255), nullable=False),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("now()"),
+            nullable=True,
+        ),
+        sa.Column(
+            "updated_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("now()"),
+            nullable=True,
+        ),
+        sa.Column("tcf_configuration_id", sa.String(255), nullable=False),
+        sa.Column("purpose_id", sa.Integer(), nullable=False),
+        sa.Column(
+            "restriction_type",
+            sa.Enum(
+                "purpose_restriction",
+                "require_consent",
+                "require_legitimate_interest",
+                name="tcfrestrictiontype",
+            ),
+            nullable=False,
+        ),
+        sa.Column(
+            "vendor_restriction",
+            sa.Enum(
+                "restrict_all_vendors",
+                "allow_specific_vendors",
+                "restrict_specific_vendors",
+                name="tcfvendorrestriction",
+            ),
+            nullable=False,
+        ),
+        sa.Column(
+            "range_entries",
+            postgresql.ARRAY(postgresql.JSONB(astext_type=sa.Text())),
+            server_default="{}",
+            nullable=False,
+        ),
+        sa.ForeignKeyConstraint(
+            ["tcf_configuration_id"],
+            ["tcf_configuration.id"],
+            ondelete="CASCADE",
+        ),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(
+        op.f("ix_tcf_publisher_restriction_config_purpose"),
+        "tcf_publisher_restriction",
+        ["tcf_configuration_id", "purpose_id"],
+        unique=False,
+    )
+
+
+def downgrade():
+    # Drop tables
+    op.drop_table("tcf_publisher_restriction")
+    op.drop_table("tcf_configuration")
+
+    # Drop enums
+    op.execute("DROP TYPE tcfrestrictiontype")
+    op.execute("DROP TYPE tcfvendorrestriction")

fides/api/alembic/migrations/versions/9288f729cac4_add_tcf_configuration_fk_to_experience_.py

@@ -0,0 +1,62 @@
+"""Add tcf_configuration FK to experience config
+
+Revision ID: 9288f729cac4
+Revises: 99c603c1b8f9
+Create Date: 2025-04-07 18:49:31.843362
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "9288f729cac4"
+down_revision = "99c603c1b8f9"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.add_column(
+        "privacyexperienceconfig",
+        sa.Column("tcf_configuration_id", sa.String(), nullable=True),
+    )
+    op.create_foreign_key(
+        "privacyexperienceconfig_tcf_configuration_fkey",
+        "privacyexperienceconfig",
+        "tcf_configuration",
+        ["tcf_configuration_id"],
+        ["id"],
+        ondelete="SET NULL",
+    )
+    op.add_column(
+        "privacyexperienceconfighistory",
+        sa.Column("tcf_configuration_id", sa.String(), nullable=True),
+    )
+    op.create_foreign_key(
+        "privacyexperienceconfighistory_tcf_configuration_fkey",
+        "privacyexperienceconfighistory",
+        "tcf_configuration",
+        ["tcf_configuration_id"],
+        ["id"],
+        ondelete="SET NULL",
+    )
+    # ### end Alembic commands ###
+
+
+def downgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_constraint(
+        "privacyexperienceconfighistory_tcf_configuration_fkey",
+        "privacyexperienceconfighistory",
+        type_="foreignkey",
+    )
+    op.drop_column("privacyexperienceconfighistory", "tcf_configuration_id")
+    op.drop_constraint(
+        "privacyexperienceconfig_tcf_configuration_fkey",
+        "privacyexperienceconfig",
+        type_="foreignkey",
+    )
+    op.drop_column("privacyexperienceconfig", "tcf_configuration_id")
+    # ### end Alembic commands ###

fides/api/alembic/migrations/versions/99c603c1b8f9_add_password_login_enabled_and_totp_secret_to_fidesuser.py

@@ -0,0 +1,45 @@
+"""add password login enabled and totp secret to fidesuser
+
+Revision ID: 99c603c1b8f9
+Revises: 6e565c16dae1
+Create Date: 2025-04-02 01:55:57.890545
+
+"""
+
+import sqlalchemy as sa
+import sqlalchemy_utils
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "99c603c1b8f9"
+down_revision = "6e565c16dae1"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.add_column(
+        "fidesuser",
+        sa.Column(
+            "password_login_enabled",
+            sa.Boolean(),
+            nullable=True,
+        ),
+    )
+    op.add_column(
+        "fidesuser",
+        sa.Column(
+            "totp_secret",
+            sqlalchemy_utils.types.encrypted.encrypted_type.StringEncryptedType(),
+            nullable=True,
+        ),
+    )
+    op.alter_column("fidesuser", "hashed_password", nullable=True)
+    op.alter_column("fidesuser", "salt", nullable=True)
+
+
+def downgrade():
+    op.alter_column("fidesuser", "hashed_password", nullable=False)
+    op.alter_column("fidesuser", "salt", nullable=False)
+    op.drop_column("fidesuser", "totp_secret")
+    op.drop_column("fidesuser", "password_login_enabled")

fides/api/api/deps.py

@@ -12,6 +12,7 @@ from fides.config import get_config as get_app_config
 from fides.config.config_proxy import ConfigProxy
 
 _engine = None
+_readonly_engine = None
 
 
 def get_config() -> FidesConfig:
@@ -28,9 +29,24 @@ def get_db() -> Generator:
         db.close()
 
 
+def get_readonly_db() -> Generator:
+    """Return our readonly database session"""
+    try:
+        db = get_readonly_api_session()
+        yield db
+    finally:
+        db.close()
+
+
 @contextmanager
-def get_db_contextmanager() -> Generator[Session, None, None]:
-    """Return our database session as a context manager"""
+def get_autoclose_db_session() -> Generator[Session, None, None]:
+    """
+    Return a database session as a context manager that automatically closes when the context exits.
+
+    Unlike get_api_session which is managed by FastAPI's dependency injection,
+    this context manager explicitly closes the session when exiting the context.
+    Use this when you need manual control over the session lifecycle outside of API endpoints.
+    """
     try:
         db = get_api_session()
         yield db
@@ -55,6 +71,26 @@ def get_api_session() -> Session:
     return db
 
 
+def get_readonly_api_session() -> Session:
+    """Gets the shared read-only database session to use for API functionality"""
+    if not CONFIG.database.sqlalchemy_readonly_database_uri:
+        return get_api_session()
+
+    global _readonly_engine  # pylint: disable=W0603
+    if not _readonly_engine:
+        _readonly_engine = get_db_engine(
+            database_uri=CONFIG.database.sqlalchemy_readonly_database_uri,
+            pool_size=CONFIG.database.api_engine_pool_size,
+            max_overflow=CONFIG.database.api_engine_max_overflow,
+            keepalives_idle=CONFIG.database.api_engine_keepalives_idle,
+            keepalives_interval=CONFIG.database.api_engine_keepalives_interval,
+            keepalives_count=CONFIG.database.api_engine_keepalives_count,
+        )
+    SessionLocal = get_db_session(CONFIG, engine=_readonly_engine)
+    db = SessionLocal()
+    return db
+
+
 def get_config_proxy(db: Session = Depends(get_db)) -> ConfigProxy:
     return ConfigProxy(db)
 

fides/api/api/v1/endpoints/user_endpoints.py

@@ -54,11 +54,7 @@ from fides.api.schemas.user import (
     UserResponse,
     UserUpdate,
 )
-from fides.api.service.user.fides_user_service import (
-    accept_invite,
-    invite_user,
-    perform_login,
-)
+from fides.api.service.deps import get_user_service
 from fides.api.util.api_router import APIRouter
 from fides.common.api.scope_registry import (
     SCOPE_REGISTRY,
@@ -75,6 +71,7 @@ from fides.common.api.v1 import urn_registry as urls
 from fides.common.api.v1.urn_registry import V1_URL_PREFIX
 from fides.config import CONFIG, FidesConfig, get_config
 from fides.config.config_proxy import ConfigProxy
+from fides.service.user.user_service import UserService
 
 router = APIRouter(tags=["Users"], prefix=V1_URL_PREFIX)
 
@@ -423,6 +420,7 @@ def create_user(
     db: Session = Depends(get_db),
     user_data: UserCreate,
     config_proxy: ConfigProxy = Depends(get_config_proxy),
+    user_service: UserService = Depends(get_user_service),
 ) -> FidesUser:
     """
     Create a user given a username and password.
@@ -461,7 +459,7 @@ def create_user(
     user = FidesUser.create(db=db, data=user_data.model_dump(mode="json"))
 
     # invite user via email
-    invite_user(db=db, config_proxy=config_proxy, user=user)
+    user_service.invite_user(user)
 
     logger.info("Created user with id: '{}'.", user.id)
     FidesUserPermissions.create(
@@ -544,6 +542,7 @@ def user_login(
     db: Session = Depends(get_db),
     config: FidesConfig = Depends(get_config),
     user_data: UserLogin,
+    user_service: UserService = Depends(get_user_service),
 ) -> UserLoginResponse:
     """Login the user by creating a client if it doesn't exist, and have that client
     generate a token."""
@@ -602,8 +601,7 @@ def user_login(
         # from complaining.
         user = user_check
 
-        client = perform_login(
-            db,
+        client = user_service.perform_login(
             config.security.oauth_client_id_length_bytes,
             config.security.oauth_client_secret_length_bytes,
             user,
@@ -666,9 +664,9 @@ def verify_invite_code(
 def accept_user_invite(
     *,
     db: Session = Depends(get_db),
-    config: FidesConfig = Depends(get_config),
     user_data: UserForcePasswordReset,
     verified_invite: FidesUserInvite = Depends(verify_invite_code),
+    user_service: UserService = Depends(get_user_service),
 ) -> UserLoginResponse:
     """Sets the password and enables the user if a valid username and invite code are provided."""
 
@@ -681,9 +679,7 @@ def accept_user_invite(
             detail=f"User with username {verified_invite.username} does not exist.",
         )
 
-    user, access_code = accept_invite(
-        db=db, config=config, user=user, new_password=user_data.new_password
-    )
+    user, access_code = user_service.accept_invite(user, user_data.new_password)
 
     return UserLoginResponse(
         user_data=user,

fides/api/cryptography/identity_salt.py

@@ -3,9 +3,8 @@ from functools import cache
 
 from loguru import logger
 
-from fides.api.db.session import get_db_session
+from fides.api.api.deps import get_autoclose_db_session
 from fides.api.models.identity_salt import IdentitySalt
-from fides.config import CONFIG
 
 
 @cache
@@ -15,14 +14,14 @@ def get_identity_salt() -> str:
     This function is cached to avoid repeated calls to the database for the same value.
     """
 
-    SessionLocal = get_db_session(CONFIG)
-    db = SessionLocal()
-    existing_salt = db.query(IdentitySalt).first()
-    if existing_salt is None:
-        new_salt = IdentitySalt.create(
-            db, data={"encrypted_value": {"value": secrets.token_hex(32)}}
-        )
-        logger.info("Created new identity salt.")
-        return new_salt.encrypted_value.get("value")
-    logger.info("Caching existing identity salt.")
-    return existing_salt.encrypted_value.get("value")
+    with get_autoclose_db_session() as db:
+        existing_salt = db.query(IdentitySalt).first()
+        if existing_salt is None:
+            new_salt = IdentitySalt.create(
+                db, data={"encrypted_value": {"value": secrets.token_hex(32)}}
+            )
+            logger.info("Created new identity salt.")
+            return new_salt.encrypted_value.get("value")
+
+        logger.info("Caching existing identity salt.")
+        return existing_salt.encrypted_value.get("value")

fides/api/custom_types.py

@@ -66,8 +66,13 @@ def validate_html_str(val: str) -> str:
         "strong",
         "u",
     }
+
+    ALLOWED_ATTRIBUTES = {
+        "a": {"href", "hreflang", "target"},
+    }
+
     if val:
-        return clean(val, tags=ALLOWED_HTML_TAGS)
+        return clean(val, tags=ALLOWED_HTML_TAGS, attributes=ALLOWED_ATTRIBUTES)
     return val
 
 

fides/api/db/base.py

@@ -8,6 +8,7 @@ from fides.api.models.attachment import Attachment, AttachmentReference
 from fides.api.models.audit_log import AuditLog
 from fides.api.models.authentication_request import AuthenticationRequest
 from fides.api.models.client import ClientDetail
+from fides.api.models.comment import Comment, CommentReference
 from fides.api.models.connectionconfig import ConnectionConfig
 from fides.api.models.consent_automation import ConsentAutomation
 from fides.api.models.custom_asset import CustomAsset
@@ -58,4 +59,8 @@ from fides.api.models.storage import StorageConfig
 from fides.api.models.system_compass_sync import SystemCompassSync
 from fides.api.models.system_history import SystemHistory
 from fides.api.models.system_manager import SystemManager
+from fides.api.models.tcf_publisher_restrictions import (
+    TCFConfiguration,
+    TCFPublisherRestriction,
+)
 from fides.api.models.tcf_purpose_overrides import TCFPurposeOverride

fides/api/db/system.py

@@ -406,9 +406,7 @@ async def create_system(
 
     # create the system resource using generic creation
     # the system must be created before the privacy declarations so that it can be referenced
-    resource_dict = resource.model_dump(
-        mode="json"
-    )  # mode=json helps Url fields be converted to strings before saving to db
+    resource_dict = resource.model_dump()
 
     # set the current user's ID
     resource_dict["user_id"] = current_user_id

fides/api/migrations/hash_migration_job.py

@@ -2,7 +2,7 @@ from loguru import logger
 from sqlalchemy import text
 from sqlalchemy.orm import Session
 
-from fides.api.api.deps import get_db_contextmanager
+from fides.api.api.deps import get_autoclose_db_session
 from fides.api.db.base_class import FidesBase
 from fides.api.migrations.hash_migration_mixin import HashMigrationMixin
 from fides.api.migrations.hash_migration_tracker import HashMigrationTracker
@@ -47,7 +47,7 @@ def bcrypt_migration_task() -> None:
     Job to migrate all the tables using bcrypt hashes for general data (excludes tables with credentials).
     """
 
-    with get_db_contextmanager() as db:
+    with get_autoclose_db_session() as db:
         # Do a single pass to check if any of the models have already been migrated.
         # This will allow us to optimize searching for these models by not calling
         # the previously used bcrypt hash.