ethyca-fides 2.62.1b2__tar.gz → 2.62.1b3__tar.gz

{ethyca_fides-2.62.1b2/src/ethyca_fides.egg-info → ethyca_fides-2.62.1b3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ethyca_fides
-Version: 2.62.1b2
+Version: 2.62.1b3
 Summary: Open-source ecosystem for data privacy as code.
 Home-page: https://github.com/ethyca/fides
 Author: Ethyca, Inc.

{ethyca_fides-2.62.1b2 → ethyca_fides-2.62.1b3/src/ethyca_fides.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ethyca_fides
-Version: 2.62.1b2
+Version: 2.62.1b3
 Summary: Open-source ecosystem for data privacy as code.
 Home-page: https://github.com/ethyca/fides
 Author: Ethyca, Inc.

{ethyca_fides-2.62.1b2 → ethyca_fides-2.62.1b3}/src/ethyca_fides.egg-info/SOURCES.txt

@@ -97,6 +97,7 @@ src/fides/api/alembic/migrations/versions/3c5e1253465d_adds_provided_identity_ta
 src/fides/api/alembic/migrations/versions/3caf11127442_add_connection_key_to_execution_log.py
 src/fides/api/alembic/migrations/versions/3cc39a6ce32b_cookie_system_unique_constraint.py
 src/fides/api/alembic/migrations/versions/3d9c476d7cea_classification_management.py
+src/fides/api/alembic/migrations/versions/440a5b9a3493_add_fides_user_respondent_email_.py
 src/fides/api/alembic/migrations/versions/451684a726a5_save_privacy_preferences_on_device_id.py
 src/fides/api/alembic/migrations/versions/45c7a349db68_remove_qualifier_lists_from_data_set_.py
 src/fides/api/alembic/migrations/versions/48d9caacebd4_create_privacy_declarations_table.py
@@ -397,6 +398,7 @@ src/fides/api/models/fides_cloud.py
 src/fides/api/models/fides_user.py
 src/fides/api/models/fides_user_invite.py
 src/fides/api/models/fides_user_permissions.py
+src/fides/api/models/fides_user_respondent_email_verification.py
 src/fides/api/models/identity_salt.py
 src/fides/api/models/location_regulation_selections.py
 src/fides/api/models/manual_webhook.py
@@ -817,6 +819,8 @@ src/fides/ui-build/static/admin/properties.html
 src/fides/ui-build/static/admin/systems.html
 src/fides/ui-build/static/admin/taxonomy.html
 src/fides/ui-build/static/admin/user-management.html
+src/fides/ui-build/static/admin/_next/static/D-B-G-FV05_6iwXWBGS0J/_buildManifest.js
+src/fides/ui-build/static/admin/_next/static/D-B-G-FV05_6iwXWBGS0J/_ssgManifest.js
 src/fides/ui-build/static/admin/_next/static/chunks/1099-b652e6f9a0cd778b.js
 src/fides/ui-build/static/admin/_next/static/chunks/1100-e19e94b0a6486255.js
 src/fides/ui-build/static/admin/_next/static/chunks/1327-da0303f70d12fb20.js
@@ -885,7 +889,7 @@ src/fides/ui-build/static/admin/_next/static/chunks/main-app-59156a9331ac7bce.js
 src/fides/ui-build/static/admin/_next/static/chunks/polyfills-42372ed130431b0a.js
 src/fides/ui-build/static/admin/_next/static/chunks/webpack-3a61b934ba2fb620.js
 src/fides/ui-build/static/admin/_next/static/chunks/pages/404-e868487119cd14fc.js
-src/fides/ui-build/static/admin/_next/static/chunks/pages/_app-94950df9c97cd079.js
+src/fides/ui-build/static/admin/_next/static/chunks/pages/_app-f1add6386651ca3d.js
 src/fides/ui-build/static/admin/_next/static/chunks/pages/_error-bede3a8288930dcf.js
 src/fides/ui-build/static/admin/_next/static/chunks/pages/add-systems-0234733a90ed5127.js
 src/fides/ui-build/static/admin/_next/static/chunks/pages/consent-dd2a0e3b536b8b42.js
@@ -1012,8 +1016,6 @@ src/fides/ui-build/static/admin/_next/static/media/inter-vietnamese-500-normal.7
 src/fides/ui-build/static/admin/_next/static/media/inter-vietnamese-600-normal.eb82de1d.woff2
 src/fides/ui-build/static/admin/_next/static/media/inter-vietnamese-700-normal.00e401a9.woff2
 src/fides/ui-build/static/admin/_next/static/media/logo-white.c9bf4196.svg
-src/fides/ui-build/static/admin/_next/static/ulYEH5vwbFjKDz3nI321R/_buildManifest.js
-src/fides/ui-build/static/admin/_next/static/ulYEH5vwbFjKDz3nI321R/_ssgManifest.js
 src/fides/ui-build/static/admin/add-systems/manual.html
 src/fides/ui-build/static/admin/add-systems/multiple.html
 src/fides/ui-build/static/admin/consent/configure.html

{ethyca_fides-2.62.1b2 → ethyca_fides-2.62.1b3}/src/fides/_version.py

@@ -8,11 +8,11 @@ import json
 
 version_json = '''
 {
- "date": "2025-06-03T15:45:25-0300",
+ "date": "2025-06-03T15:22:24-0600",
  "dirty": false,
  "error": null,
- "full-revisionid": "2c58fc8696c47cf695b2beb925ac37c9ff867299",
- "version": "2.62.1b2"
+ "full-revisionid": "0bfda78b61acfccbc5c37a58dfa776037a2ca718",
+ "version": "2.62.1b3"
 }
 '''  # END VERSION_JSON
 

ethyca_fides-2.62.1b3/src/fides/api/alembic/migrations/versions/440a5b9a3493_add_fides_user_respondent_email_.py

@@ -0,0 +1,80 @@
+"""Add fides_user_respondent_email_verification table
+
+Revision ID: 440a5b9a3493
+Revises: 2263583b0e44
+Create Date: 2025-05-29 15:41:59.521940
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "440a5b9a3493"
+down_revision = "2263583b0e44"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_table(
+        "fides_user_respondent_email_verification",
+        sa.Column("id", sa.String(), nullable=False),
+        sa.Column("user_id", sa.String(), nullable=False),
+        sa.Column("access_token", sa.String(), nullable=False),
+        sa.Column(
+            "access_token_expires_at", sa.DateTime(timezone=True), nullable=False
+        ),
+        sa.Column("identity_verified_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            nullable=False,
+            server_default=sa.text("now()"),
+        ),
+        sa.Column(
+            "updated_at",
+            sa.DateTime(timezone=True),
+            nullable=False,
+            server_default=sa.text("now()"),
+        ),
+        sa.ForeignKeyConstraint(
+            ["user_id"],
+            ["fidesuser.id"],
+            ondelete="CASCADE",
+        ),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(
+        "ix_fides_user_respondent_email_verification_id",
+        "fides_user_respondent_email_verification",
+        ["id"],
+        unique=True,
+    )
+    op.create_index(
+        "ix_fides_user_respondent_email_verification_access_token",
+        "fides_user_respondent_email_verification",
+        ["access_token"],
+        unique=True,
+    )
+    op.create_index(
+        "ix_fides_user_respondent_email_verification_user_id",
+        "fides_user_respondent_email_verification",
+        ["user_id"],
+    )
+
+
+def downgrade():
+    op.drop_index(
+        "ix_fides_user_respondent_email_verification_user_id",
+        table_name="fides_user_respondent_email_verification",
+    )
+    op.drop_index(
+        "ix_fides_user_respondent_email_verification_access_token",
+        table_name="fides_user_respondent_email_verification",
+    )
+    op.drop_index(
+        "ix_fides_user_respondent_email_verification_id",
+        table_name="fides_user_respondent_email_verification",
+    )
+    op.drop_table("fides_user_respondent_email_verification")

{ethyca_fides-2.62.1b2 → ethyca_fides-2.62.1b3}/src/fides/api/db/base.py

@@ -22,6 +22,9 @@ from fides.api.models.fides_cloud import FidesCloud
 from fides.api.models.fides_user import FidesUser
 from fides.api.models.fides_user_invite import FidesUserInvite
 from fides.api.models.fides_user_permissions import FidesUserPermissions
+from fides.api.models.fides_user_respondent_email_verification import (
+    FidesUserRespondentEmailVerification,
+)
 from fides.api.models.identity_salt import IdentitySalt
 from fides.api.models.location_regulation_selections import LocationRegulationSelections
 from fides.api.models.manual_webhook import AccessManualWebhook

{ethyca_fides-2.62.1b2 → ethyca_fides-2.62.1b3}/src/fides/api/models/audit_log.py

@@ -11,9 +11,6 @@ class AuditLogAction(str, EnumType):
     """Enum for audit log actions, reflecting what a user did."""
 
     approved = "approved"
-    attachment_uploaded = "attachment_uploaded"
-    attachment_deleted = "attachment_deleted"
-    attachment_retrieved = "attachment_retrieved"
     denied = "denied"
     email_sent = "email_sent"
     finished = "finished"

{ethyca_fides-2.62.1b2 → ethyca_fides-2.62.1b3}/src/fides/api/models/fides_user.py

@@ -23,12 +23,16 @@ from fides.api.db.base_class import Base
 from fides.api.models.audit_log import AuditLog
 
 # Intentionally importing SystemManager here to build the FidesUser.systems relationship
-from fides.api.models.system_manager import SystemManager  # type: ignore[unused-import]
 from fides.api.schemas.user import DisabledReason
 from fides.config import CONFIG
 
 if TYPE_CHECKING:
+    from fides.api.models.fides_user_permissions import FidesUserPermissions
+    from fides.api.models.fides_user_respondent_email_verification import (
+        FidesUserRespondentEmailVerification,
+    )
     from fides.api.models.sql_models import System  # type: ignore[attr-defined]
+    from fides.api.models.system_manager import SystemManager
 
 
 class FidesUser(Base):
@@ -71,6 +75,20 @@ class FidesUser(Base):
     )
 
     systems = relationship("System", secondary="systemmanager", back_populates="data_stewards")  # type: ignore
+    # permissions relationship is defined via backref in FidesUserPermissions
+    email_verifications = relationship(
+        "FidesUserRespondentEmailVerification",
+        back_populates="user",
+        cascade="all,delete",
+        lazy="dynamic",
+        foreign_keys="[FidesUserRespondentEmailVerification.user_id]",
+    )
+    permissions = relationship(
+        "FidesUserPermissions",
+        back_populates="user",
+        cascade="all,delete",
+        uselist=False,
+    )
 
     @property
     def system_ids(self) -> List[str]:
@@ -92,12 +110,11 @@ class FidesUser(Base):
     ) -> FidesUser:
         """Create a FidesUser by hashing the password with a generated salt
         and storing the hashed password and the salt"""
+        hashed_password = None
+        salt = None
 
         if password := data.get("password"):
             hashed_password, salt = FidesUser.hash_password(password)
-        else:
-            hashed_password = None
-            salt = None
 
         user = super().create(
             db,
@@ -117,6 +134,18 @@ class FidesUser(Base):
 
         return user  # type: ignore
 
+    @classmethod
+    def create_respondent(cls, db: Session, data: dict[str, Any]) -> FidesUser:
+        """Create a respondent user. This user will not be able to login with a password and
+        requires an email address to be provided.
+        """
+        if not data.get("email_address"):
+            raise ValueError("Email address is required for external respondents")
+        if data.get("password"):
+            raise ValueError("Password login is not allowed for external respondents")
+        data["password_login_enabled"] = False
+        return cls.create(db, data)
+
     def credentials_valid(self, password: str, encoding: str = "UTF-8") -> bool:
         """Verifies that the provided password is correct."""
         if self.salt is None:
@@ -134,6 +163,9 @@ class FidesUser(Base):
 
         No validations are performed on the old/existing password within this function.
         """
+        if self.permissions is not None:
+            if self.permissions.is_respondent():
+                raise ValueError("Password changes are not allowed for respondents")
 
         hashed_password, salt = FidesUser.hash_password(new_password)
         self.hashed_password = hashed_password  # type: ignore
@@ -141,6 +173,17 @@ class FidesUser(Base):
         self.password_reset_at = datetime.utcnow()  # type: ignore
         self.save(db)
 
+    def update_email_address(self, db: Session, new_email_address: str) -> None:
+        """Updates the user's email address to the specified value."""
+        if self.permissions is not None:
+            if self.permissions.is_respondent():
+                raise ValueError(
+                    "Email address changes are not allowed for respondents"
+                )
+
+        self.email_address = new_email_address  # type: ignore
+        self.save(db)
+
     def set_as_system_manager(self, db: Session, system: System) -> None:
         """Add a user as one of the system managers for the given system
         If applicable, also update the systems on the user's client
@@ -157,6 +200,10 @@ class FidesUser(Base):
                 f"User '{self.username}' is already a system manager of '{system.name}'."
             )
 
+        if self.permissions is not None:
+            if self.permissions.is_respondent():
+                raise SystemManagerException("Respondents cannot be system managers.")
+
         self.systems.append(system)
         self.save(db=db)
 

ethyca_fides-2.62.1b3/src/fides/api/models/fides_user_permissions.py

@@ -0,0 +1,46 @@
+from typing import List, cast
+
+from sqlalchemy import ARRAY, Column, ForeignKey, String
+from sqlalchemy.orm import Session, relationship
+
+from fides.api.db.base_class import Base
+from fides.api.models.fides_user import FidesUser
+from fides.api.oauth.roles import (
+    EXTERNAL_RESPONDENT,
+    RESPONDENT,
+    ROLES_TO_SCOPES_MAPPING,
+)
+
+
+class FidesUserPermissions(Base):
+    """The DB ORM model for FidesUserPermissions"""
+
+    user_id = Column(String, ForeignKey(FidesUser.id), nullable=False, unique=True)
+    roles = Column(ARRAY(String), nullable=False, server_default="{}", default=dict)
+    user = relationship(FidesUser, back_populates="permissions", uselist=False)
+
+    @property
+    def total_scopes(self) -> List[str]:
+        """Returns the scopes the user has inherited via their roles."""
+        all_scopes = []
+        for role in self.roles:
+            all_scopes += ROLES_TO_SCOPES_MAPPING.get(role, [])
+
+        return sorted(list(set(all_scopes)))
+
+    def is_respondent(self) -> bool:
+        """Check if the user is a respondent."""
+        return any(role in self.roles for role in [RESPONDENT, EXTERNAL_RESPONDENT])
+
+    def update_roles(self, db: Session, new_roles: List[str]) -> None:
+        """Update the user's roles if allowed.
+        Raises ValueError if role changes are not allowed."""
+        if self.is_respondent():
+            raise ValueError("Role changes are not allowed for respondents")
+
+        self.roles = new_roles
+        self.save(db)
+
+    def update(self, db: Session, *, data: dict) -> "FidesUserPermissions":
+        """Update the user permissions with the provided data."""
+        return cast(FidesUserPermissions, super().update(db, data=data))

ethyca_fides-2.62.1b3/src/fides/api/models/fides_user_respondent_email_verification.py

@@ -0,0 +1,112 @@
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+from typing import TYPE_CHECKING, Any, Optional
+
+from sqlalchemy import Column, DateTime, ForeignKey, String
+from sqlalchemy.ext.declarative import declared_attr
+from sqlalchemy.orm import Session, relationship
+
+from fides.api.cryptography.cryptographic_util import generate_secure_random_string
+from fides.api.db.base_class import Base
+from fides.api.util.identity_verification import IdentityVerificationMixin
+from fides.config import get_config
+
+CONFIG = get_config()
+
+
+if TYPE_CHECKING:
+    from fides.api.models.fides_user import FidesUser
+
+# Access links stay active for 45 days - the same as the DSR expiration. A new link is generated for each email.
+# The emails are created for new DSRs which are assigned to the respondent.
+ACCESS_LINK_TTL_DAYS = 45
+
+
+class FidesUserRespondentEmailVerification(Base, IdentityVerificationMixin):
+    """Model for handling email verification for external respondents.
+
+    This handles two types of verification:
+    1. Access links - long-lived (45 days) for initial access
+    2. Verification codes - short-lived (1 hour) for actual verification
+
+    When an email is sent to an external respondent, a new verification is created with a new access token is created.
+    When a respondent clicks the link in the email, the access token is verified and a verification code is generated.
+    The verification code is sent to the respondent's email address and the respondent is prompted to enter the code.
+    Verification is handled by the `IdentityVerificationMixin` class.
+    """
+
+    @declared_attr
+    def __tablename__(self) -> str:
+        return "fides_user_respondent_email_verification"
+
+    user_id = Column(
+        String,
+        ForeignKey("fidesuser.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+
+    access_token = Column(
+        String, nullable=False, unique=True, index=True
+    )  # Token for the access link
+    access_token_expires_at = Column(DateTime(timezone=True), nullable=False)
+    identity_verified_at = Column(DateTime(timezone=True), nullable=True)
+
+    user = relationship(
+        "FidesUser",
+        back_populates="email_verifications",
+        foreign_keys=[user_id],
+    )
+
+    @classmethod
+    def create(
+        cls, db: Session, *, data: dict[str, Any], check_name: bool = False
+    ) -> FidesUserRespondentEmailVerification:
+        """
+        Create a FidesUserEmailVerification record with a new access token.
+        The verification code will be generated when the access link is used.
+        """
+        # Generate a secure token for the access link
+        access_token = generate_secure_random_string(32)
+        expires_at = datetime.now(timezone.utc) + timedelta(days=ACCESS_LINK_TTL_DAYS)
+
+        verification = super().create(
+            db,
+            data={
+                "user_id": data["user_id"],
+                "access_token": access_token,
+                "access_token_expires_at": expires_at,
+            },
+        )
+
+        return verification
+
+    def is_access_token_expired(self) -> bool:
+        """Check if the access token has expired."""
+        if not self.access_token_expires_at:
+            return True
+
+        current_time_utc = datetime.now(timezone.utc)
+        return current_time_utc > self.access_token_expires_at
+
+    def verify_access_token(self, token: str) -> bool:
+        """Verify the access token and generate a verification code if valid."""
+        if self.is_access_token_expired():
+            return False
+
+        return self.access_token == token
+
+    def verify_identity(
+        self,
+        db: Session,
+        provided_code: Optional[str] = None,
+    ) -> None:
+        """A method to call the internal identity verification method provided by the
+        `IdentityVerificationMixin`."""
+        if self.is_access_token_expired():
+            raise ValueError("Access token has expired.")
+
+        self._verify_identity(provided_code=provided_code)
+        self.identity_verified_at = datetime.now(timezone.utc)
+        self.save(db)

{ethyca_fides-2.62.1b2 → ethyca_fides-2.62.1b3}/src/fides/api/oauth/roles.py

@@ -27,6 +27,8 @@ from fides.common.api.scope_registry import (
     PRIVACY_NOTICE_READ,
     PRIVACY_REQUEST_CALLBACK_RESUME,
     PRIVACY_REQUEST_DELETE,
+    PRIVACY_REQUEST_MANUAL_STEPS_RESPOND,
+    PRIVACY_REQUEST_MANUAL_STEPS_REVIEW,
     PRIVACY_REQUEST_NOTIFICATIONS_CREATE_OR_UPDATE,
     PRIVACY_REQUEST_NOTIFICATIONS_READ,
     PRIVACY_REQUEST_READ,
@@ -52,6 +54,8 @@ CONTRIBUTOR = "contributor"
 OWNER = "owner"
 VIEWER = "viewer"
 VIEWER_AND_APPROVER = "viewer_and_approver"
+RESPONDENT = "respondent"
+EXTERNAL_RESPONDENT = "external_respondent"
 
 
 class RoleRegistryEnum(Enum):
@@ -62,6 +66,8 @@ class RoleRegistryEnum(Enum):
     Approver - Limited viewer but can approve Privacy Requests
     Viewer + Approver = Full View and can approve Privacy Requests
     Contributor - Can't configure storage and messaging
+    Respondent - Internal user who can respond to manual steps
+    External Respondent - External user who can only respond to assigned manual steps
     """
 
     owner = OWNER
@@ -69,6 +75,8 @@ class RoleRegistryEnum(Enum):
     viewer = VIEWER
     approver = APPROVER
     contributor = CONTRIBUTOR
+    respondent = RESPONDENT
+    external_respondent = EXTERNAL_RESPONDENT
 
 
 approver_scopes = [
@@ -79,6 +87,7 @@ approver_scopes = [
     PRIVACY_REQUEST_VIEW_DATA,
     PRIVACY_REQUEST_DELETE,
     USER_READ,  # allows approver to view user management table and update their own password
+    PRIVACY_REQUEST_MANUAL_STEPS_REVIEW,  # allows approvers to see all manual steps
 ]
 
 
@@ -114,6 +123,14 @@ viewer_scopes = [  # Intentionally omitted USER_PERMISSION_READ and PRIVACY_REQU
     USER_READ,
 ]
 
+respondent_scopes = [
+    PRIVACY_REQUEST_MANUAL_STEPS_RESPOND,  # allows respondents to respond to assigned manual steps
+]
+
+external_respondent_scopes = [
+    PRIVACY_REQUEST_MANUAL_STEPS_RESPOND,  # allows external respondents to respond to assigned manual steps
+]
+
 not_contributor_scopes = [
     CONNECTOR_TEMPLATE_REGISTER,
     STORAGE_CREATE_OR_UPDATE,
@@ -130,6 +147,8 @@ ROLES_TO_SCOPES_MAPPING: Dict[str, List] = {
     VIEWER: sorted(viewer_scopes),
     APPROVER: sorted(approver_scopes),
     CONTRIBUTOR: sorted(list(set(SCOPE_REGISTRY) - set(not_contributor_scopes))),
+    RESPONDENT: sorted(respondent_scopes),
+    EXTERNAL_RESPONDENT: sorted(external_respondent_scopes),
 }
 
 

{ethyca_fides-2.62.1b2 → ethyca_fides-2.62.1b3}/src/fides/api/service/privacy_request/request_runner_service.py

@@ -1,3 +1,4 @@
+import time
 from datetime import datetime, timedelta
 from typing import Any, Dict, List, Optional, Set, Tuple
 
@@ -67,6 +68,7 @@ from fides.api.tasks import DatabaseTask, celery_app
 from fides.api.tasks.scheduled.scheduler import scheduler
 from fides.api.util.collection_util import Row
 from fides.api.util.logger import Pii, _log_exception, _log_warning
+from fides.api.util.logger_context_utils import LoggerContextKeys, log_context
 from fides.common.api.v1.urn_registry import (
     PRIVACY_REQUEST_TRANSFER_TO_PARENT,
     V1_URL_PREFIX,
@@ -200,6 +202,11 @@ def run_webhooks_and_report_status(
     return True
 
 
+@log_context(
+    capture_args={
+        "privacy_request_id": LoggerContextKeys.privacy_request_id,
+    }
+)
 def upload_access_results(  # pylint: disable=R0912
     session: Session,
     policy: Policy,
@@ -210,6 +217,7 @@ def upload_access_results(  # pylint: disable=R0912
     fides_connector_datasets: Set[str],
 ) -> List[str]:
     """Process the data uploads after the access portion of the privacy request has completed"""
+    start_time = time.time()
     download_urls: List[str] = []
     if not access_result:
         logger.info("No results returned for access request")
@@ -251,12 +259,30 @@ def upload_access_results(  # pylint: disable=R0912
             )
             if download_url:
                 download_urls.append(download_url)
+                privacy_request.add_success_execution_log(
+                    session,
+                    connection_key=None,
+                    dataset_name="Access Package Upload",
+                    collection_name=None,
+                    message="Access Package Upload successful for privacy request.",
+                    action_type=ActionType.access,
+                )
+            logger.bind(
+                time_taken=time.time() - start_time,
+            ).info("Access Package Upload successful for privacy request.")
         except common_exceptions.StorageUploadError as exc:
-            logger.error(
-                "Error uploading subject access data for rule {} on policy {}: {}",
-                rule.key,
-                policy.key,
-                Pii(str(exc)),
+            logger.bind(
+                policy_key=policy.key,
+                rule_key=rule.key,
+                error=Pii(str(exc)),
+            ).error("Error uploading subject access data for rule.")
+            privacy_request.add_error_execution_log(
+                session,
+                connection_key=None,
+                dataset_name="Access Package Upload",
+                collection_name=None,
+                message="Access Package Upload failed for privacy request.",
+                action_type=ActionType.access,
             )
             privacy_request.status = PrivacyRequestStatus.error
     # Save the results we uploaded to the user for later retrieval
@@ -596,19 +622,22 @@ def run_privacy_request(
                     # If dev mode, log traceback
                     _log_exception(e, CONFIG.dev_mode)
                     return
-            privacy_request.finished_processing_at = datetime.utcnow()
-            AuditLog.create(
-                db=session,
-                data={
-                    "user_id": "system",
-                    "privacy_request_id": privacy_request.id,
-                    "action": AuditLogAction.finished,
-                    "message": "",
-                },
-            )
-            privacy_request.status = PrivacyRequestStatus.complete
-            logger.info("Privacy request run completed.")
-            privacy_request.save(db=session)
+
+            # Only mark as complete if not in error state
+            if privacy_request.status != PrivacyRequestStatus.error:
+                privacy_request.finished_processing_at = datetime.utcnow()
+                AuditLog.create(
+                    db=session,
+                    data={
+                        "user_id": "system",
+                        "privacy_request_id": privacy_request.id,
+                        "action": AuditLogAction.finished,
+                        "message": "",
+                    },
+                )
+                privacy_request.status = PrivacyRequestStatus.complete
+                logger.info("Privacy request run completed.")
+                privacy_request.save(db=session)
 
 
 def initiate_privacy_request_completion_email(

{ethyca_fides-2.62.1b2 → ethyca_fides-2.62.1b3}/src/fides/api/tasks/storage.py

@@ -11,6 +11,7 @@ from botocore.exceptions import ClientError, ParamValidationError
 from fideslang.validation import AnyHttpUrlString
 from loguru import logger
 
+from fides.api.common_exceptions import StorageUploadError
 from fides.api.cryptography.cryptographic_util import bytes_to_b64_str
 from fides.api.schemas.storage.storage import ResponseFormat, StorageSecrets
 from fides.api.service.privacy_request.dsr_package.dsr_report_builder import (
@@ -160,9 +161,9 @@ def upload_to_s3(  # pylint: disable=R0913
         logger.error(
             "Encountered error while uploading and generating link for s3 object: {}", e
         )
-        raise e
+        raise StorageUploadError(f"Error uploading to S3: {e}")
     except ParamValidationError as e:
-        raise ValueError(f"The parameters you provided are incorrect: {e}")
+        raise StorageUploadError(f"The parameters you provided are incorrect: {e}")
 
 
 def upload_to_gcs(
@@ -205,7 +206,7 @@ def upload_to_gcs(
             "Encountered error while uploading and generating link for Google Cloud Storage object: {}",
             e,
         )
-        raise e
+        raise StorageUploadError(f"Error uploading to Google Cloud Storage: {e}")
 
 
 def upload_to_local(