ethyca-fides 2.63.1b3__py2.py3-none-any.whl → 2.63.1b4__py2.py3-none-any.whl

fides/api/models/privacy_request/request_task.py

@@ -14,20 +14,19 @@ from sqlalchemy_utils.types.encrypted.encrypted_type import (
     StringEncryptedType,
 )
 
-from fides.api.db.base_class import Base  # type: ignore[attr-defined]
-from fides.api.db.base_class import JSONTypeOverride
-from fides.api.db.util import EnumColumn
+from fides.api.db.base_class import Base, JSONTypeOverride  # type: ignore[attr-defined]
 from fides.api.graph.config import (
     ROOT_COLLECTION_ADDRESS,
     TERMINATOR_ADDRESS,
     CollectionAddress,
 )
+from fides.api.models.field_types import EncryptedLargeDataDescriptor
 from fides.api.models.privacy_request.execution_log import (
     COMPLETED_EXECUTION_LOG_STATUSES,
 )
+from fides.api.models.worker_task import ExecutionLogStatus, WorkerTask
 from fides.api.schemas.base_class import FidesSchema
 from fides.api.schemas.policy import ActionType
-from fides.api.schemas.privacy_request import ExecutionLogStatus
 from fides.api.util.cache import (
     FidesopsRedis,
     celery_tasks_in_flight,
@@ -68,7 +67,8 @@ class TraversalDetails(FidesSchema):
         )
 
 
-class RequestTask(Base):
+# TODO: At some point we will refactor this model to store all task types in a common table that links to tables with specific task attributes.
+class RequestTask(WorkerTask, Base):
     """
     An individual Task for a Privacy Request.
 
@@ -91,21 +91,6 @@ class RequestTask(Base):
     )  # Of the format dataset_name:collection_name for convenience
     dataset_name = Column(String, nullable=False, index=True)
     collection_name = Column(String, nullable=False, index=True)
-    action_type = Column(EnumColumn(ActionType), nullable=False, index=True)
-
-    # Note that RequestTasks share statuses with ExecutionLogs.  When a RequestTask changes state, an ExecutionLog
-    # is also created with that state.  These are tied tightly together in GraphTask.
-    status = Column(
-        EnumColumn(
-            ExecutionLogStatus,
-            native_enum=False,
-            values_callable=lambda x: [
-                i.value for i in x
-            ],  # Using ExecutionLogStatus values in database, even though app is using the names.
-        ),  # character varying in database
-        index=True,
-        nullable=False,
-    )
 
     upstream_tasks = Column(
         MutableList.as_mutable(JSONB)
@@ -121,7 +106,8 @@ class RequestTask(Base):
     # Raw data retrieved from an access request is stored here.  This contains all of the
     # intermediate data we retrieved, needed for downstream tasks, but hasn't been filtered
     # by data category for the end user.
-    access_data = Column(  # An encrypted JSON String - saved as a list of Rows
+    _access_data = Column(  # An encrypted JSON String - saved as a list of Rows
+        "access_data",
         StringEncryptedType(
             type_in=JSONTypeOverride,
             key=CONFIG.security.app_encryption_key,
@@ -132,7 +118,8 @@ class RequestTask(Base):
 
     # This is the raw access data saved in erasure format (with placeholders preserved) to perform a masking request.
     # First saved on the access node, and then copied to the corresponding erasure node.
-    data_for_erasures = Column(  # An encrypted JSON String - saved as a list of rows
+    _data_for_erasures = Column(  # An encrypted JSON String - saved as a list of rows
+        "data_for_erasures",
         StringEncryptedType(
             type_in=JSONTypeOverride,
             key=CONFIG.security.app_encryption_key,
@@ -141,6 +128,15 @@ class RequestTask(Base):
         ),
     )
 
+    # Use descriptors for automatic external storage handling
+    access_data = EncryptedLargeDataDescriptor(
+        field_name="access_data", empty_default=[]
+    )
+
+    data_for_erasures = EncryptedLargeDataDescriptor(
+        field_name="data_for_erasures", empty_default=[]
+    )
+
     # Written after an erasure is completed
     rows_masked = Column(Integer)
     # Written after a consent request is completed - not all consent
@@ -177,12 +173,22 @@ class RequestTask(Base):
         """Convenience helper for asserting whether the task is a terminator task"""
         return self.request_task_address == TERMINATOR_ADDRESS
 
+    @classmethod
+    def allowed_action_types(cls) -> List[str]:
+        return [e.value for e in ActionType]
+
     def get_cached_task_id(self) -> Optional[str]:
         """Gets the cached celery task ID for this request task."""
         cache: FidesopsRedis = get_cache()
         task_id = cache.get(get_async_task_tracking_cache_key(self.id))
         return task_id
 
+    def cleanup_external_storage(self) -> None:
+        """Clean up all external storage files for this request task"""
+        # Access the descriptor from the class to call cleanup
+        RequestTask.access_data.cleanup(self)
+        RequestTask.data_for_erasures.cleanup(self)
+
     def get_access_data(self) -> List[Row]:
         """Helper to retrieve access data or default to empty list"""
         return self.access_data or []
@@ -191,6 +197,11 @@ class RequestTask(Base):
         """Helper to retrieve erasure data needed to build masking requests or default to empty list"""
         return self.data_for_erasures or []
 
+    def delete(self, db: Session) -> None:
+        """Override delete to cleanup external storage first"""
+        self.cleanup_external_storage()
+        super().delete(db)
+
     def update_status(self, db: Session, status: ExecutionLogStatus) -> None:
         """Helper method to update a task's status"""
         self.status = status
@@ -236,7 +247,7 @@ class RequestTask(Base):
         if not tasks_complete and should_log:
             logger.debug(
                 "Upstream tasks incomplete for {} task {}.",
-                self.action_type.value,
+                self.action_type,
                 self.collection_address,
             )
 
@@ -267,7 +278,7 @@ class RequestTask(Base):
             logger.debug(
                 "Celery Task ID {} found for {} task {}.",
                 celery_task_id,
-                self.action_type.value,
+                self.action_type,
                 self.collection_address,
             )
 
@@ -277,7 +288,7 @@ class RequestTask(Base):
             logger.debug(
                 "Celery Task {} already processing for {} task {}.",
                 celery_task_id,
-                self.action_type.value,
+                self.action_type,
                 self.collection_address,
             )
 

fides/api/models/worker_task.py

@@ -0,0 +1,96 @@
+import enum
+from typing import Any, List
+
+from sqlalchemy import Column, DateTime, String
+from sqlalchemy.sql import text
+
+from fides.api.db.util import EnumColumn
+
+
+class ExecutionLogStatus(enum.Enum):
+    """Enum for task execution log statuses, reflecting where they are in their workflow"""
+
+    in_processing = "in_processing"
+    pending = "pending"
+    complete = "complete"
+    error = "error"
+    awaiting_processing = "paused"  # "paused" in the database to avoid a migration, but use "awaiting_processing" in the app
+    retrying = "retrying"
+    skipped = "skipped"
+
+
+class WorkerTask:
+    """
+    A task for a worker to execute.
+    """
+
+    # Field called action_type to avoid migrations in RequestTask when creating this model
+    action_type = Column(String, nullable=False, index=True)
+    # Note that WorkerTask share statuses with ExecutionLogs.  When a WorkerTask changes state, an ExecutionLog
+    # is also created with that state.  These are tied tightly together in GraphTask.
+    status = Column(
+        EnumColumn(
+            ExecutionLogStatus,
+            native_enum=False,
+            values_callable=lambda x: [
+                i.value for i in x
+            ],  # Using ExecutionLogStatus values in database, even though app is using the names.
+        ),  # character varying in database
+        index=True,
+        nullable=False,
+    )
+
+    def __init__(self, *args: Any, **kwargs: Any) -> None:
+        action_type = kwargs.get("action_type")
+        if action_type is not None:
+            self.validate_action_type(action_type)
+        super().__init__(*args, **kwargs)
+
+    @classmethod
+    def validate_action_type(cls, action_type: str) -> None:
+        """
+        Validates that the action type is allowed for the worker task.
+        """
+        if action_type not in cls.allowed_action_types():
+            raise ValueError(f"Invalid action_type '{action_type}' for {cls.__name__}")
+
+    @classmethod
+    def allowed_action_types(cls) -> List[str]:
+        """
+        Subclasses must implement this method to return a list of allowed action types.
+        """
+        raise NotImplementedError("Subclasses must implement allowed_action_types")
+
+
+class TaskExecutionLog:
+    """
+    Stores the individual execution logs associated with a WorkerTask.
+    """
+
+    status = Column(
+        EnumColumn(
+            ExecutionLogStatus,
+            native_enum=True,
+            values_callable=lambda x: [
+                i.value for i in x
+            ],  # Using ExecutionLogStatus values in database, even though app is using the names.
+        ),
+        index=True,
+        nullable=False,
+    )
+    # Contains info, warning, or error messages
+    message = Column(String)
+
+    # Use clock_timestamp() instead of NOW() to get the actual current time at row creation,
+    # regardless of transaction state. This prevents timestamp caching within transactions
+    # and ensures more accurate creation times.
+    # https://www.postgresql.org/docs/current/functions-datetime.html#FUNCTIONS-DATETIME-CURRENT
+
+    created_at = Column(
+        DateTime(timezone=True), server_default=text("clock_timestamp()")
+    )
+    updated_at = Column(
+        DateTime(timezone=True),
+        server_default=text("clock_timestamp()"),
+        onupdate=text("clock_timestamp()"),
+    )

fides/api/schemas/external_storage.py

@@ -0,0 +1,22 @@
+"""Schema for external storage metadata."""
+
+from typing import Optional
+
+from pydantic import Field
+
+from fides.api.schemas.base_class import FidesSchema
+from fides.api.schemas.storage.storage import StorageType
+
+
+class ExternalStorageMetadata(FidesSchema):
+    """Metadata for externally stored encrypted data."""
+
+    storage_type: StorageType
+    file_key: str = Field(description="Path/key of the file in external storage")
+    filesize: int = Field(description="Size of the stored file in bytes", ge=0)
+    storage_key: Optional[str] = Field(
+        default=None, description="Storage configuration key used"
+    )
+
+    class Config:
+        use_enum_values = True

fides/api/schemas/privacy_request.py

@@ -8,6 +8,7 @@ from pydantic import ConfigDict, Field, field_serializer, field_validator
 from fides.api.custom_types import SafeStr
 from fides.api.graph.config import CollectionAddress
 from fides.api.models.audit_log import AuditLogAction
+from fides.api.models.worker_task import ExecutionLogStatus
 from fides.api.schemas.api import BulkResponse, BulkUpdateFailed
 from fides.api.schemas.base_class import FidesSchema
 from fides.api.schemas.policy import ActionType, CurrentStep
@@ -141,18 +142,6 @@ class FieldsAffectedResponse(FidesSchema):
     model_config = ConfigDict(from_attributes=True, use_enum_values=True)
 
 
-class ExecutionLogStatus(EnumType):
-    """Enum for execution log statuses, reflecting where they are in their workflow"""
-
-    in_processing = "in_processing"
-    pending = "pending"
-    complete = "complete"
-    error = "error"
-    awaiting_processing = "paused"  # "paused" in the database to avoid a migration, but use "awaiting_processing" in the app
-    retrying = "retrying"
-    skipped = "skipped"
-
-
 class ExecutionLogStatusSerializeOverride(FidesSchema):
     """Override to serialize "paused" Execution Logs as awaiting_processing instead"""
 

fides/api/service/connectors/base_erasure_email_connector.py

@@ -5,6 +5,7 @@ from sqlalchemy.orm import Session
 from fides.api.models.connectionconfig import ConnectionConfig, ConnectionType
 from fides.api.models.policy import Rule
 from fides.api.models.privacy_request import ExecutionLog, PrivacyRequest
+from fides.api.models.worker_task import ExecutionLogStatus
 from fides.api.schemas.connection_configuration.connection_secrets_email import (
     AdvancedSettings,
     BaseEmailSchema,
@@ -15,7 +16,6 @@ from fides.api.schemas.messaging.messaging import (
     MessagingActionType,
 )
 from fides.api.schemas.policy import ActionType
-from fides.api.schemas.privacy_request import ExecutionLogStatus
 from fides.api.schemas.redis_cache import Identity
 from fides.api.service.connectors.base_email_connector import (
     BaseEmailConnector,

fides/api/service/connectors/consent_email_connector.py

@@ -16,6 +16,7 @@ from fides.api.models.privacy_notice import (
 )
 from fides.api.models.privacy_preference import PrivacyPreferenceHistory
 from fides.api.models.privacy_request import ExecutionLog, PrivacyRequest
+from fides.api.models.worker_task import ExecutionLogStatus
 from fides.api.schemas.connection_configuration.connection_secrets_email import (
     AdvancedSettingsWithExtendedIdentityTypes,
     ExtendedEmailSchema,
@@ -29,7 +30,7 @@ from fides.api.schemas.messaging.messaging import (
 from fides.api.schemas.policy import ActionType
 from fides.api.schemas.privacy_notice import PrivacyNoticeHistorySchema
 from fides.api.schemas.privacy_preference import MinimalPrivacyPreferenceHistorySchema
-from fides.api.schemas.privacy_request import Consent, ExecutionLogStatus
+from fides.api.schemas.privacy_request import Consent
 from fides.api.schemas.redis_cache import Identity
 from fides.api.service.connectors.base_email_connector import (
     BaseEmailConnector,

fides/api/service/connectors/dynamic_erasure_email_connector.py

@@ -17,11 +17,12 @@ from fides.api.models.privacy_request import (
     RequestTask,
     TraversalDetails,
 )
+from fides.api.models.worker_task import ExecutionLogStatus
 from fides.api.schemas.connection_configuration.connection_secrets_dynamic_erasure_email import (
     DynamicErasureEmailSchema,
 )
 from fides.api.schemas.policy import ActionType
-from fides.api.schemas.privacy_request import ExecutionLogStatus, PrivacyRequestStatus
+from fides.api.schemas.privacy_request import PrivacyRequestStatus
 from fides.api.service.connectors.base_connector import BaseConnector
 from fides.api.service.connectors.base_erasure_email_connector import (
     BaseErasureEmailConnector,

fides/api/service/connectors/erasure_email_connector.py

@@ -10,9 +10,9 @@ from fides.api.models.connectionconfig import (
     ConnectionType,
 )
 from fides.api.models.privacy_request import ExecutionLog
+from fides.api.models.worker_task import ExecutionLogStatus
 from fides.api.schemas.connection_configuration import EmailSchema
 from fides.api.schemas.policy import ActionType
-from fides.api.schemas.privacy_request import ExecutionLogStatus
 from fides.api.service.connectors.base_erasure_email_connector import (
     BaseErasureEmailConnector,
     filter_user_identities_for_connector,