ethyca-fides 2.62.1b2__py2.py3-none-any.whl → 2.62.1rc0__py2.py3-none-any.whl

fides/_version.py

@@ -8,11 +8,11 @@ import json
 
 version_json = '''
 {
- "date": "2025-06-03T15:45:25-0300",
+ "date": "2025-06-06T15:00:50-0400",
  "dirty": false,
  "error": null,
- "full-revisionid": "2c58fc8696c47cf695b2beb925ac37c9ff867299",
- "version": "2.62.1b2"
+ "full-revisionid": "4fca3c3a4592528e57449b8ee9cafed8010d6052",
+ "version": "2.62.1rc0"
 }
 '''  # END VERSION_JSON
 

fides/api/api/v1/endpoints/privacy_request_endpoints.py

@@ -120,7 +120,7 @@ from fides.api.util.collection_util import Row
 from fides.api.util.endpoint_utils import validate_start_and_end_filters
 from fides.api.util.enums import ColumnSort
 from fides.api.util.fuzzy_search_utils import get_decrypted_identities_automaton
-from fides.api.util.storage_util import StorageJSONEncoder
+from fides.api.util.storage_util import storage_json_encoder
 from fides.common.api.scope_registry import (
     PRIVACY_REQUEST_CALLBACK_RESUME,
     PRIVACY_REQUEST_CREATE,
@@ -2129,7 +2129,7 @@ def get_test_privacy_request_results(
 
     # Escape datetime and ObjectId values
     raw_data = privacy_request.get_raw_access_results()
-    escaped_json = json.dumps(raw_data, indent=2, cls=StorageJSONEncoder)
+    escaped_json = json.dumps(raw_data, indent=2, default=storage_json_encoder)
     results = json.loads(escaped_json)
 
     filtered_results: Dict[str, Any] = filter_access_results(

fides/api/main.py

@@ -240,6 +240,7 @@ async def log_request(request: Request, call_next: Callable) -> Response:
         status_code=response.status_code,
         handler_time=f"{total_time}ms",
         path=request.url.path,
+        fides_client=request.headers.get("Fides-Client", "unknown"),
     ).info("Request received")
     return response
 

fides/api/models/attachment.py

@@ -12,14 +12,12 @@ from sqlalchemy.orm import Session, relationship
 
 from fides.api.db.base_class import Base
 from fides.api.schemas.storage.storage import StorageDetails, StorageType
-from fides.api.service.storage.gcs import get_gcs_client
 from fides.api.service.storage.s3 import (
     generic_delete_from_s3,
     generic_retrieve_from_s3,
     generic_upload_to_s3,
 )
-from fides.api.service.storage.util import AllowedFileType, get_local_filename
-from fides.config import CONFIG
+from fides.api.service.storage.util import get_local_filename
 
 if TYPE_CHECKING:
     from fides.api.models.comment import Comment
@@ -117,13 +115,8 @@ class Attachment(Base):
         uselist=False,
     )
 
-    @property
-    def content_type(self) -> str:
-        """Returns the content type of the attachment."""
-        return AllowedFileType[self.file_name.split(".")[-1]].value
-
     def upload(self, attachment: IO[bytes]) -> None:
-        """Uploads an attachment to S3, GCS, or local storage."""
+        """Uploads an attachment to S3 or local storage."""
         if self.config.type == StorageType.s3:
             bucket_name = f"{self.config.details[StorageDetails.BUCKET.value]}"
             auth_method = self.config.details[StorageDetails.AUTH_METHOD.value]
@@ -137,23 +130,6 @@ class Attachment(Base):
             log.info(f"Uploaded {self.file_name} to S3 bucket {bucket_name}/{self.id}")
             return
 
-        if self.config.type == StorageType.gcs:
-            bucket_name = f"{self.config.details[StorageDetails.BUCKET.value]}"
-            auth_method = self.config.details[StorageDetails.AUTH_METHOD.value]
-            storage_client = get_gcs_client(auth_method, self.config.secrets)
-            bucket = storage_client.bucket(bucket_name)
-            blob = bucket.blob(f"{self.id}/{self.file_name}")
-
-            # Reset the file pointer to the beginning
-            try:
-                attachment.seek(0)
-            except Exception as e:
-                raise ValueError(f"Failed to reset file pointer for attachment: {e}")
-
-            blob.upload_from_file(attachment)
-            log.info(f"Uploaded {self.file_name} to GCS bucket {bucket_name}/{self.id}")
-            return
-
         if self.config.type == StorageType.local:
             filename = get_local_filename(f"{self.id}/{self.file_name}")
 
@@ -188,16 +164,13 @@ class Attachment(Base):
         self,
     ) -> Tuple[int, AnyHttpUrlString]:
         """
-        Retrieves the size of the attachment and a presigned/signed URL.
+        Retrieves a the size of the attachment and the presigned URL to retrieve it.
         - For s3:
           - the size is retrieved from the s3 object metadata
-          - returns presigned URL
-        - For gcs:
-          - the size is retrieved from the blob metadata
-          - returns signed URL
+          - the presigned URL is retrieved from the s3 client
         - For local:
           - the size is retrieved from the file size
-          - returns the local file path
+          - the URL is the local file path
         """
         if self.config.type == StorageType.s3:
             bucket_name = f"{self.config.details[StorageDetails.BUCKET.value]}"
@@ -207,81 +180,19 @@ class Attachment(Base):
                 bucket_name=bucket_name,
                 file_key=f"{self.id}/{self.file_name}",
                 auth_method=auth_method,
-                get_content=False,
             )
             return size, url
 
-        if self.config.type == StorageType.gcs:
-            bucket_name = f"{self.config.details[StorageDetails.BUCKET.value]}"
-            auth_method = self.config.details[StorageDetails.AUTH_METHOD.value]
-            storage_client = get_gcs_client(auth_method, self.config.secrets)
-            bucket = storage_client.bucket(bucket_name)
-            blob = bucket.blob(f"{self.id}/{self.file_name}")
-
-            # Ensure we have the blob metadata
-            blob.reload()
-            url = blob.generate_signed_url(
-                version="v4",
-                expiration=CONFIG.security.subject_request_download_link_ttl_seconds,
-                method="GET",
-            )
-            return blob.size, url
-
-        if self.config.type == StorageType.local:
-            filename = get_local_filename(f"{self.id}/{self.file_name}")
-            size = os.path.getsize(filename)
-            return size, filename
-
-        raise ValueError(f"Unsupported storage type: {self.config.type}")
-
-    def retrieve_attachment_content(
-        self,
-    ) -> Tuple[int, bytes]:
-        """
-        Retrieves the size of the attachment and its actual content.
-        - For s3:
-          - the size is retrieved from the s3 object metadata
-          - returns the actual content
-        - For gcs:
-          - the size is retrieved from the blob metadata
-          - returns the actual content
-        - For local:
-          - the size is retrieved from the file size
-          - returns the actual content
-        """
-        if self.config.type == StorageType.s3:
-            bucket_name = f"{self.config.details[StorageDetails.BUCKET.value]}"
-            auth_method = self.config.details[StorageDetails.AUTH_METHOD.value]
-            size, content = generic_retrieve_from_s3(
-                storage_secrets=self.config.secrets,
-                bucket_name=bucket_name,
-                file_key=f"{self.id}/{self.file_name}",
-                auth_method=auth_method,
-                get_content=True,
-            )
-            return size, content
-
-        if self.config.type == StorageType.gcs:
-            bucket_name = f"{self.config.details[StorageDetails.BUCKET.value]}"
-            auth_method = self.config.details[StorageDetails.AUTH_METHOD.value]
-            storage_client = get_gcs_client(auth_method, self.config.secrets)
-            bucket = storage_client.bucket(bucket_name)
-            blob = bucket.blob(f"{self.id}/{self.file_name}")
-
-            content = blob.download_as_bytes()
-            return len(content), content
-
         if self.config.type == StorageType.local:
             filename = get_local_filename(f"{self.id}/{self.file_name}")
             with open(filename, "rb") as file:
-                content = file.read()
-                size = len(content)
-                return size, content
+                size = len(file.read())
+                return size, filename
 
         raise ValueError(f"Unsupported storage type: {self.config.type}")
 
     def delete_attachment_from_storage(self) -> None:
-        """Deletes an attachment from S3, GCS, or local storage."""
+        """Deletes an attachment from S3 or local storage."""
         if self.config.type == StorageType.s3:
             bucket_name = f"{self.config.details[StorageDetails.BUCKET.value]}"
             auth_method = self.config.details[StorageDetails.AUTH_METHOD.value]
@@ -293,27 +204,9 @@ class Attachment(Base):
             )
             return
 
-        if self.config.type == StorageType.gcs:
-            bucket_name = f"{self.config.details[StorageDetails.BUCKET.value]}"
-            auth_method = self.config.details[StorageDetails.AUTH_METHOD.value]
-            storage_client = get_gcs_client(auth_method, self.config.secrets)
-            bucket = storage_client.bucket(bucket_name)
-
-            # List and delete all blobs in the folder
-            prefix = f"{self.id}/"
-            blobs = bucket.list_blobs(prefix=prefix)
-            for blob in blobs:
-                blob.delete()
-            return
-
         if self.config.type == StorageType.local:
-            folder_path = os.path.dirname(
-                get_local_filename(f"{self.id}/{self.file_name}")
-            )
-            if os.path.exists(folder_path):
-                import shutil
-
-                shutil.rmtree(folder_path)
+            filename = get_local_filename(f"{self.id}/{self.file_name}")
+            os.remove(filename)
             return
 
         raise ValueError(f"Unsupported storage type: {self.config.type}")

fides/api/models/detection_discovery.py

@@ -9,7 +9,6 @@ from loguru import logger
 from sqlalchemy import ARRAY, Boolean, Column, DateTime, ForeignKey, String, func
 from sqlalchemy.dialects.postgresql import JSONB
 from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy.ext.declarative import declared_attr
 from sqlalchemy.ext.mutable import MutableDict
 from sqlalchemy.future import select
 from sqlalchemy.orm import Session, relationship
@@ -48,29 +47,6 @@ class MonitorFrequency(Enum):
 QUARTERLY_MONTH_PATTERN = r"^\d+,\d+,\d+,\d+$"
 
 
-class SharedMonitorConfig(Base, FidesBase):
-    """SQL model for shareable monitor configurations"""
-
-    @declared_attr
-    def __tablename__(self) -> str:
-        return "shared_monitor_config"
-
-    # Basic info
-    name = Column(String, nullable=False)
-    key = Column(String, unique=True, nullable=False)
-    description = Column(String, nullable=True)
-
-    # Classification parameters (including regex patterns)
-    classify_params = Column(
-        MutableDict.as_mutable(JSONB),
-        index=False,
-        unique=False,
-        nullable=False,
-        server_default="{}",
-        default=dict,
-    )
-
-
 class MonitorConfig(Base):
     """
     Monitor configuration used for data detection and discovery.
@@ -111,9 +87,7 @@ class MonitorConfig(Base):
     )  # stores the cron-based kwargs for scheduling the monitor execution.
     # see https://apscheduler.readthedocs.io/en/3.x/modules/triggers/cron.html
 
-    # We use _classify_params for the actual column to prevent direct access
-    _classify_params = Column(
-        "classify_params",
+    classify_params = Column(
         MutableDict.as_mutable(JSONB),
         index=False,
         unique=False,
@@ -150,45 +124,6 @@ class MonitorConfig(Base):
         backref="monitor_config",
     )
 
-    shared_config_id = Column(
-        String,
-        ForeignKey(SharedMonitorConfig.id_field_path, ondelete="RESTRICT"),
-        nullable=True,
-        index=True,
-    )
-
-    shared_config = relationship(SharedMonitorConfig)
-
-    @property
-    def classify_params(self) -> dict:
-        """
-        Returns the merged classify parameters from both the monitor config and
-        the shared config (if it exists).
-
-        The shared config parameters take precedence over the monitor's own parameters,
-        but only for values that are not falsy (None, empty, etc.).
-        """
-        # Start with an empty dict
-        merged_params = {}
-
-        # Add this monitor's params if available
-        if self._classify_params:
-            merged_params.update(self._classify_params)
-
-        # Add/override with shared config params if available
-        if self.shared_config and self.shared_config.classify_params:
-            # Only update with non-falsy values from shared config
-            for key, value in self.shared_config.classify_params.items():
-                if value:  # Only override if the value is not falsy
-                    merged_params[key] = value
-
-        return merged_params
-
-    @classify_params.setter
-    def classify_params(self, value: Dict[str, Any]) -> None:
-        """Setter for the classify_params to maintain compatibility with existing code"""
-        self._classify_params = value
-
     @property
     def connection_config_key(self) -> str:
         """Derives the `connection_config_key`"""

fides/api/models/privacy_request/privacy_request.py

@@ -1089,46 +1089,6 @@ class PrivacyRequest(
         if attachment:
             attachment.delete(db)
 
-    def _get_manual_webhook_attachments(
-        self, db: Session, manual_webhook_id: str, reference_type: str
-    ) -> List[Attachment]:
-        """Helper method to get attachments that have references to both this privacy request and the specified manual webhook"""
-        query = """
-            SELECT DISTINCT a.*
-            FROM attachment a
-            INNER JOIN attachment_reference ar1 ON a.id = ar1.attachment_id
-            INNER JOIN attachment_reference ar2 ON a.id = ar2.attachment_id
-            WHERE ar1.reference_id = :privacy_request_id
-            AND ar1.reference_type = 'privacy_request'
-            AND ar2.reference_id = :manual_webhook_id
-            AND ar2.reference_type = :reference_type
-        """
-        result = db.execute(
-            query,
-            {
-                "privacy_request_id": self.id,
-                "manual_webhook_id": manual_webhook_id,
-                "reference_type": reference_type,
-            },
-        )
-        return [Attachment(**row) for row in result]
-
-    def get_access_manual_webhook_attachments(
-        self, db: Session, manual_webhook_id: str
-    ) -> List[Attachment]:
-        """Get all attachments that have references to both this privacy request and the specified access manual webhook"""
-        return self._get_manual_webhook_attachments(
-            db, manual_webhook_id, "access_manual_webhook"
-        )
-
-    def get_erasure_manual_webhook_attachments(
-        self, db: Session, manual_webhook_id: str
-    ) -> List[Attachment]:
-        """Get all attachments that have references to both this privacy request and the specified erasure manual webhook"""
-        return self._get_manual_webhook_attachments(
-            db, manual_webhook_id, "erasure_manual_webhook"
-        )
-
     def get_existing_request_task(
         self,
         db: Session,
@@ -1268,6 +1228,7 @@ class PrivacyRequest(
         """
         if not self.policy.get_rules_for_action(action_type=ActionType.access):
             return None
+
         self.filtered_final_upload = results
         self.save(db)
 

fides/api/service/connectors/query_configs/saas_query_config.py

@@ -52,6 +52,7 @@ from fides.api.util.saas_util import (
     get_identities,
 )
 from fides.common.api.v1.urn_registry import REQUEST_TASK_CALLBACK, V1_URL_PREFIX
+from fides.config.config_proxy import ConfigProxy
 
 T = TypeVar("T")
 
@@ -143,12 +144,16 @@ class SaaSQueryConfig(QueryConfig[SaaSRequestParams]):
         """
         Returns a tuple of the preferred action and SaaSRequest to use for masking.
         An update request is preferred, but we can use a gdpr delete endpoint or
-        delete endpoint.
+        delete endpoint if not MASKING_STRICT.
         """
 
         update: Optional[SaaSRequest] = self.get_erasure_request_by_action("update")
-        gdpr_delete: Optional[SaaSRequest] = self.data_protection_request
-        delete: Optional[SaaSRequest] = self.get_erasure_request_by_action("delete")
+        gdpr_delete: Optional[SaaSRequest] = None
+        delete: Optional[SaaSRequest] = None
+
+        if not ConfigProxy(db).execution.masking_strict:
+            gdpr_delete = self.data_protection_request
+            delete = self.get_erasure_request_by_action("delete")
 
         try:
             # Return first viable option

fides/api/service/connectors/saas_connector.py

@@ -530,15 +530,11 @@ class SaaSConnector(BaseConnector[AuthenticatedClient], Contextualizable):
 
         session = Session.object_session(privacy_request)
         masking_request = query_config.get_masking_request(session)
-        rows_updated = 0
-
         if not masking_request:
-            logger.info(
-                "No masking request found for the '{}' collection in {}",
-                self.current_collection_name,
-                self.saas_config.fides_key,  # type: ignore
+            raise Exception(
+                f"Either no masking request configured or no valid masking request for {node.address.collection}. "
+                f"Check that MASKING_STRICT env var is appropriately set"
             )
-            return rows_updated
 
         self.set_saas_request_state(masking_request)
 
@@ -569,6 +565,7 @@ class SaaSConnector(BaseConnector[AuthenticatedClient], Contextualizable):
             cast(Optional[List[PostProcessorStrategy]], masking_request.postprocessors),
         )
 
+        rows_updated = 0
         client = self.create_client()
         for row in rows:
             try:

fides/api/service/privacy_request/dsr_package/dsr_report_builder.py

@@ -11,7 +11,7 @@ from jinja2 import Environment, FileSystemLoader
 
 from fides.api.models.privacy_request import PrivacyRequest
 from fides.api.schemas.policy import ActionType
-from fides.api.util.storage_util import StorageJSONEncoder
+from fides.api.util.storage_util import storage_json_encoder
 
 DSR_DIRECTORY = Path(__file__).parent.resolve()
 
@@ -41,9 +41,7 @@ class DsrReportBuilder:
 
         # Jinja template environment initialization
         def pretty_print(value: str, indent: int = 4) -> str:
-            return json.dumps(
-                value, indent=indent, default=StorageJSONEncoder().default
-            )
+            return json.dumps(value, indent=indent, default=storage_json_encoder)
 
         jinja2.filters.FILTERS["pretty_print"] = pretty_print
         self.template_loader = Environment(

fides/api/service/storage/s3.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from typing import IO, Any, Dict, Tuple, Union
+from typing import IO, Any, Dict, Tuple
 
 from boto3.s3.transfer import TransferConfig
 from botocore.exceptions import ClientError, ParamValidationError
@@ -129,38 +129,25 @@ def generic_retrieve_from_s3(
     bucket_name: str,
     file_key: str,
     auth_method: str,
-    get_content: bool = False,
-) -> Tuple[int, Union[str, bytes]]:
+) -> Tuple[int, AnyHttpUrlString]:
     """
-    Retrieves a file from S3 and returns its size and either a presigned URL or the actual content.
-
-    Args:
-        storage_secrets: Dictionary containing S3 credentials
-        bucket_name: Name of the S3 bucket
-        file_key: Key of the file in the bucket
-        auth_method: Authentication method to use
-        get_content: If True, returns the actual content instead of a presigned URL
+    Retrieves file metadata and generates a presigned URL for downloading an S3 object.
 
-    Returns:
-        Tuple containing (file_size, presigned_url_or_content)
+    :param storage_secrets: S3 storage secrets
+    :param bucket_name: Name of the S3 bucket
+    :param file_key: Key of the file in the bucket
+    :param auth_method: Authentication method for S3
+    :return: Tuple containing (file_size, presigned_url)
     """
     logger.info("Retrieving S3 object: {}", file_key)
-    s3_client = get_s3_client(auth_method, storage_secrets)
 
+    s3_client = maybe_get_s3_client(auth_method, storage_secrets)
     try:
-        if get_content:
-            # Get the actual content
-            response = s3_client.get_object(Bucket=bucket_name, Key=file_key)
-            content = response["Body"].read()
-            return response["ContentLength"], content
-
-        # Get presigned URL
-        presigned_url = create_presigned_url_for_s3(s3_client, bucket_name, file_key)
-        # Get file size
-        response = s3_client.head_object(Bucket=bucket_name, Key=file_key)
-        return int(response["ContentLength"]), str(presigned_url)
-    except ClientError as e:
-        logger.error(f"Error retrieving file from S3: {e}")
+        get_allowed_file_type_or_raise(file_key)
+        file_size = get_file_size(s3_client, bucket_name, file_key)
+        return file_size, create_presigned_url_for_s3(s3_client, bucket_name, file_key)
+    except Exception as e:
+        logger.error("Encountered error while retrieving S3 object: {}", e)
         raise e
 
 
@@ -171,8 +158,7 @@ def generic_delete_from_s3(
     auth_method: str,
 ) -> None:
     """
-    Deletes arbitrary data from s3. If file_key ends with a filename, deletes just that file.
-    If file_key ends with a '/', deletes all objects with that prefix.
+    Deletes arbitrary data from s3
 
     :param storage_secrets: S3 storage secrets
     :param bucket_name: Name of the S3 bucket
@@ -183,17 +169,6 @@ def generic_delete_from_s3(
 
     s3_client = maybe_get_s3_client(auth_method, storage_secrets)
     try:
-        # If the file_key ends with a '/', it's a folder prefix
-        if file_key.endswith("/"):
-            # List all objects with the prefix, handling pagination
-            paginator = s3_client.get_paginator("list_objects_v2")
-            for page in paginator.paginate(Bucket=bucket_name, Prefix=file_key):
-                if "Contents" in page:
-                    for obj in page["Contents"]:
-                        s3_client.delete_object(Bucket=bucket_name, Key=obj["Key"])
-            return
-
-        # Delete single object
         s3_client.delete_object(Bucket=bucket_name, Key=file_key)
     except Exception as e:
         logger.error("Encountered error while deleting s3 object: {}", e)

fides/api/tasks/storage.py

@@ -30,7 +30,7 @@ from fides.api.util.cache import get_cache, get_encryption_cache_key
 from fides.api.util.encryption.aes_gcm_encryption_scheme import (
     encrypt_to_bytes_verify_secrets_length,
 )
-from fides.api.util.storage_util import StorageJSONEncoder
+from fides.api.util.storage_util import storage_json_encoder
 from fides.config import CONFIG
 
 if TYPE_CHECKING:
@@ -75,7 +75,7 @@ def write_to_in_memory_buffer(
     logger.debug("Writing data to in-memory buffer")
 
     if resp_format == ResponseFormat.json.value:
-        json_str = json.dumps(data, indent=2, default=StorageJSONEncoder().default)
+        json_str = json.dumps(data, indent=2, default=storage_json_encoder)
         return BytesIO(
             encrypt_access_request_results(json_str, privacy_request.id).encode(
                 CONFIG.security.encoding

fides/api/util/storage_util.py

@@ -1,5 +1,5 @@
 from datetime import datetime
-from typing import Any, Union
+from typing import Any, Dict, Union
 
 from bson import ObjectId
 from pydantic import ValidationError
@@ -11,7 +11,6 @@ from fides.api.schemas.storage.storage import (
     StorageType,
 )
 from fides.api.schemas.storage.storage_secrets_docs_only import possible_storage_secrets
-from fides.api.util.custom_json_encoder import CustomJSONEncoder
 
 
 def get_schema_for_secrets(
@@ -49,15 +48,10 @@ def get_schema_for_secrets(
         raise ValueError(errors)
 
 
-class StorageJSONEncoder(CustomJSONEncoder):
-    """
-    A JSON encoder specifically for storage operations that maintains the original
-    format for datetime and ObjectId while inheriting other functionality from CustomJSONEncoder.
-    """
-
-    def default(self, o: Any) -> Any:
-        if isinstance(o, datetime):
-            return o.strftime("%Y-%m-%dT%H:%M:%S")
-        if isinstance(o, ObjectId):
-            return {"$oid": str(o)}
-        return super().default(o)
+def storage_json_encoder(field: Any) -> Union[str, Dict[str, str]]:
+    """Specify str format for datetime objects"""
+    if isinstance(field, datetime):
+        return field.strftime("%Y-%m-%dT%H:%M:%S")
+    if isinstance(field, ObjectId):
+        return {"$oid": str(field)}
+    return field

fides/config/config_proxy.py

@@ -106,6 +106,7 @@ class ExecutionSettingsProxy(ConfigProxyBase):
     subject_identity_verification_required: bool
     disable_consent_identity_verification: bool
     require_manual_request_approval: bool
+    masking_strict: bool
 
     def __getattribute__(self, name: str) -> Any:
         """

fides/config/execution_settings.py

@@ -11,6 +11,10 @@ ENV_PREFIX = "FIDES__EXECUTION__"
 class ExecutionSettings(FidesSettings):
     """Configuration settings for DSR execution."""
 
+    masking_strict: bool = Field(
+        default=True,
+        description="If set to True, only use UPDATE requests to mask data. If False, Fides will use any defined DELETE or GDPR DELETE endpoints to remove PII, which may extend beyond the specific data categories that configured in your execution policy.",
+    )
     privacy_request_delay_timeout: int = Field(
         default=3600,
         description="The amount of time to wait for actions which delay privacy requests (e.g., pre- and post-processing webhooks).",