ethyca-fides 2.68.1b3__py2.py3-none-any.whl → 2.69.0__py2.py3-none-any.whl

fides/_version.py

@@ -8,11 +8,11 @@ import json
 
 version_json = '''
 {
- "date": "2025-08-25T16:34:15-0600",
+ "date": "2025-09-03T13:11:38-0400",
  "dirty": false,
  "error": null,
- "full-revisionid": "05d56cc8111caa00faea2dd8433a36fd4d5b7a8a",
- "version": "2.68.1b3"
+ "full-revisionid": "23d1e78103b4b6527ab8d28f26e0d4f052653ee7",
+ "version": "2.69.0"
 }
 '''  # END VERSION_JSON
 

fides/api/alembic/migrations/versions/b1a2c3d4e5f6_add_location_to_privacy_request.py

@@ -0,0 +1,26 @@
+"""add location to privacy request
+
+Revision ID: b1a2c3d4e5f6
+Revises: 2f3c1a2d6b10
+Create Date: 2025-08-06 18:15:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "b1a2c3d4e5f6"
+down_revision = "90502bcda282"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # Add location column to privacyrequest table
+    op.add_column("privacyrequest", sa.Column("location", sa.String(), nullable=True))
+
+
+def downgrade():
+    # Remove location column from privacyrequest table
+    op.drop_column("privacyrequest", "location")

fides/api/api/v1/api.py

@@ -5,6 +5,7 @@ from fides.api.api.v1.endpoints import (
     consent_request_endpoints,
     dataset_config_endpoints,
     drp_endpoints,
+    dsr_package_link,
     encryption_endpoints,
     identity_verification_endpoints,
     manual_webhook_endpoints,
@@ -32,6 +33,7 @@ api_router.include_router(connection_endpoints.router)
 api_router.include_router(consent_request_endpoints.router)
 api_router.include_router(dataset_config_endpoints.router)
 api_router.include_router(drp_endpoints.router)
+api_router.include_router(dsr_package_link.router)
 api_router.include_router(encryption_endpoints.router)
 api_router.include_router(masking_endpoints.router)
 api_router.include_router(oauth_endpoints.router)

fides/api/api/v1/endpoints/dsr_package_link.py

@@ -0,0 +1,169 @@
+import uuid
+
+from fastapi import Depends, HTTPException, Request, Response
+from fastapi.responses import RedirectResponse
+from sqlalchemy.orm import Session
+from starlette.status import (
+    HTTP_302_FOUND,
+    HTTP_400_BAD_REQUEST,
+    HTTP_401_UNAUTHORIZED,
+    HTTP_403_FORBIDDEN,
+    HTTP_404_NOT_FOUND,
+    HTTP_422_UNPROCESSABLE_ENTITY,
+)
+
+from fides.api.api.deps import get_db
+from fides.api.common_exceptions import AuthenticationError, AuthorizationError
+from fides.api.models.privacy_request import PrivacyRequest
+from fides.api.models.storage import get_active_default_storage_config
+from fides.api.oauth.utils import validate_download_token
+from fides.api.schemas.privacy_request import PrivacyRequestStatus
+from fides.api.schemas.storage.storage import StorageType
+from fides.api.service.storage.streaming.s3 import S3StorageClient
+from fides.api.util.api_router import APIRouter
+from fides.api.util.endpoint_utils import fides_limiter
+from fides.common.api.v1.urn_registry import PRIVACY_CENTER_DSR_PACKAGE, V1_URL_PREFIX
+from fides.config import CONFIG
+
+router = APIRouter(tags=["Privacy Center"], prefix=V1_URL_PREFIX)
+
+
+def get_privacy_request_or_error(
+    privacy_request_id: str, db: Session
+) -> PrivacyRequest:
+    """Load the privacy request or throw a 404"""
+    # Note: UUID format validation is now done earlier in the endpoint
+    privacy_request = PrivacyRequest.get(db, object_id=privacy_request_id)
+
+    if not privacy_request:
+        raise HTTPException(
+            status_code=HTTP_404_NOT_FOUND,
+            detail=f"No privacy request found with id '{privacy_request_id}'.",
+        )
+
+    if privacy_request.deleted_at is not None:
+        raise HTTPException(
+            status_code=HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=f"Privacy request with id {privacy_request_id} has been deleted.",
+        )
+
+    return privacy_request
+
+
+def raise_error(status_code: int, detail: str) -> None:
+    """Raise an HTTPException with the given status code and detail"""
+    raise HTTPException(
+        status_code=status_code,
+        detail=detail,
+    )
+
+
+@router.get(
+    PRIVACY_CENTER_DSR_PACKAGE,
+    status_code=HTTP_302_FOUND,
+)
+@fides_limiter.limit(CONFIG.security.public_request_rate_limit)
+def get_access_results_urls(
+    privacy_request_id: str,
+    token: str,
+    db: Session = Depends(get_db),
+    *,
+    request: Request,  # required for rate limiting
+    response: Response,  # required for rate limiting
+) -> RedirectResponse:
+    """
+    Public endpoint for retrieving access results URLs for a privacy request.
+    This endpoint generates fresh presigned URLs and redirects to the first available result.
+    This endpoint is designed to be accessible via email links sent to end users.
+    No authentication is required, but a valid download token is required for security.
+    Rate limiting is applied for additional security.
+
+    privacy_request_id parameter is required in the URL path.
+    token parameter is required as a query parameter for security.
+    """
+    # --------------Security checks--------------
+    # First validate the privacy request ID format to prevent SSRF attacks
+    # This is a simple string check that doesn't require database access
+    if not privacy_request_id.startswith("pri_"):
+        raise_error(
+            HTTP_400_BAD_REQUEST,
+            f"Invalid privacy request ID format: '{privacy_request_id}'. Must start with 'pri_' followed by a valid UUID v4.",
+        )
+
+    # Extract the UUID part after the prefix
+    uuid_part = privacy_request_id[4:]  # Remove "pri_" prefix
+
+    try:
+        uuid.UUID(uuid_part, version=4)
+    except ValueError:
+        raise_error(
+            HTTP_400_BAD_REQUEST,
+            f"Invalid privacy request ID format: '{privacy_request_id}'. Must start with 'pri_' followed by a valid UUID v4.",
+        )
+
+    try:
+        # Validate the download token before proceeding
+        validate_download_token(token, privacy_request_id)
+    except AuthenticationError as e:
+        raise_error(HTTP_401_UNAUTHORIZED, str(e.detail))
+    except AuthorizationError as e:
+        raise_error(HTTP_403_FORBIDDEN, str(e.detail))
+
+    # --------------Data checks--------------
+    storage_config = get_active_default_storage_config(db)
+    privacy_request = get_privacy_request_or_error(privacy_request_id, db)
+
+    if not storage_config:
+        raise_error(
+            HTTP_400_BAD_REQUEST, "No active default storage configuration found."
+        )
+
+    if privacy_request.status != PrivacyRequestStatus.complete:
+        raise_error(
+            HTTP_400_BAD_REQUEST,
+            f"Access results for privacy request '{privacy_request.id}' are not available because the request is not complete.",
+        )
+
+    if (
+        not privacy_request.access_result_urls
+        or not privacy_request.access_result_urls.get("access_result_urls")
+    ):
+        raise_error(
+            HTTP_404_NOT_FOUND,
+            f"No access results found for privacy request '{privacy_request.id}'.",
+        )
+
+    # --------------Processing--------------
+    file_name = f"{privacy_request.id}.zip"
+
+    # At this point, storage_config is guaranteed to exist due to earlier validation
+    # and we've already checked that it's not None above
+    assert storage_config is not None
+
+    if storage_config.type != StorageType.s3:
+        # Handle all other storage types (transcend, ethyca, local, etc.)
+        raise_error(
+            HTTP_400_BAD_REQUEST,
+            f"Storage type '{storage_config.type}' is not supported for download redirects. "
+            "Only S3 storage is supported for this endpoint.",
+        )
+
+    # Get bucket name from storage config
+    bucket_name = storage_config.details.get("bucket")
+    if not bucket_name:
+        raise_error(HTTP_400_BAD_REQUEST, "S3 bucket name not found in storage config.")
+
+    try:
+        # Use S3StorageClient for cleaner presigned URL generation
+        s3_storage_client = S3StorageClient(
+            storage_config.details.get("auth_method"), storage_config.secrets
+        )
+        result_url = s3_storage_client.generate_presigned_url(
+            bucket=bucket_name,
+            key=file_name,
+        )
+    except Exception as e:
+        raise_error(HTTP_400_BAD_REQUEST, f"Failed to generate presigned URL: {str(e)}")
+
+    # Convert the URL to string for RedirectResponse
+    return RedirectResponse(url=str(result_url), status_code=HTTP_302_FOUND)

fides/api/api/v1/endpoints/oauth_endpoints.py

@@ -67,6 +67,7 @@ router = APIRouter(tags=["OAuth"], prefix=V1_URL_PREFIX)
 )
 async def acquire_access_token(
     request: Request,
+    response: Response,
     form_data: OAuth2ClientCredentialsRequestForm = Depends(),
     db: Session = Depends(get_db),
 ) -> AccessToken:

fides/api/api/v1/endpoints/privacy_request_endpoints.py

@@ -86,7 +86,7 @@ from fides.api.oauth.utils import (
 from fides.api.schemas.api import ResponseWithMessage
 from fides.api.schemas.dataset import CollectionAddressResponse, DryRunDatasetResponse
 from fides.api.schemas.external_https import PrivacyRequestResumeFormat
-from fides.api.schemas.policy import ActionType
+from fides.api.schemas.policy import ActionType, CurrentStep
 from fides.api.schemas.privacy_request import (
     BulkPostPrivacyRequests,
     BulkReviewResponse,
@@ -124,6 +124,7 @@ from fides.api.util.endpoint_utils import validate_start_and_end_filters
 from fides.api.util.enums import ColumnSort
 from fides.api.util.fuzzy_search_utils import get_decrypted_identities_automaton
 from fides.api.util.storage_util import StorageJSONEncoder
+from fides.api.util.text import normalize_location_code
 from fides.common.api.scope_registry import (
     PRIVACY_REQUEST_CALLBACK_RESUME,
     PRIVACY_REQUEST_CREATE,
@@ -403,6 +404,7 @@ def _filter_privacy_request_queryset(
     errored_lt: Optional[datetime] = None,
     errored_gt: Optional[datetime] = None,
     external_id: Optional[str] = None,
+    location: Optional[str] = None,
     action_type: Optional[ActionType] = None,
     include_consent_webhook_requests: Optional[bool] = False,
     include_deleted_requests: Optional[bool] = False,
@@ -539,6 +541,29 @@ def _filter_privacy_request_queryset(
         query = query.filter(PrivacyRequest.id.ilike(f"%{request_id}%"))
     if external_id:
         query = query.filter(PrivacyRequest.external_id.ilike(f"{external_id}%"))
+    if location:
+        # Support filtering by exact location match or country prefix
+        # e.g., "US" matches both "US" and "US-CA", "US-NY", etc.
+        # "US-CA" matches only "US-CA"
+        # Also normalize input to handle underscores and case insensitivity
+
+        try:
+            normalized_location = normalize_location_code(location)
+        except ValueError:
+            # If normalization fails, treat as no results to prevent errors
+            query = query.filter(False)
+        else:
+            if "-" in normalized_location:
+                # Exact match for subdivision codes
+                query = query.filter(PrivacyRequest.location == normalized_location)
+            else:
+                # Country code - match country or any subdivision of that country
+                query = query.filter(
+                    or_(
+                        PrivacyRequest.location == normalized_location,
+                        PrivacyRequest.location.ilike(f"{normalized_location}-%"),
+                    )
+                )
     if status:
         query = query.filter(PrivacyRequest.status.in_(status))
     if created_lt:
@@ -685,6 +710,7 @@ def _shared_privacy_request_search(
     errored_lt: Optional[datetime] = None,
     errored_gt: Optional[datetime] = None,
     external_id: Optional[str] = None,
+    location: Optional[str] = None,
     action_type: Optional[ActionType] = None,
     verbose: Optional[bool] = False,
     include_identities: Optional[bool] = False,
@@ -723,6 +749,7 @@ def _shared_privacy_request_search(
         errored_lt,
         errored_gt,
         external_id,
+        location,
         action_type,
         None,
         include_deleted_requests,
@@ -796,6 +823,7 @@ def get_request_status(
     errored_lt: Optional[datetime] = None,
     errored_gt: Optional[datetime] = None,
     external_id: Optional[str] = None,
+    location: Optional[str] = None,
     action_type: Optional[ActionType] = None,
     verbose: Optional[bool] = False,
     include_identities: Optional[bool] = False,
@@ -836,6 +864,7 @@ def get_request_status(
         errored_lt=errored_lt,
         errored_gt=errored_gt,
         external_id=external_id,
+        location=location,
         action_type=action_type,
         verbose=verbose,
         include_identities=include_identities,
@@ -890,6 +919,7 @@ def privacy_request_search(
         errored_lt=privacy_request_filter.errored_lt,
         errored_gt=privacy_request_filter.errored_gt,
         external_id=privacy_request_filter.external_id,
+        location=privacy_request_filter.location,
         action_type=privacy_request_filter.action_type,
         verbose=privacy_request_filter.verbose,
         include_identities=privacy_request_filter.include_identities,
@@ -1900,6 +1930,7 @@ def finalize_privacy_request(
 
     queue_privacy_request(
         privacy_request_id=privacy_request_id,
+        from_step=CurrentStep.finalization.value,
     )
 
     return privacy_request  # type: ignore[return-value]

fides/api/api/v1/endpoints/user_endpoints.py

@@ -250,6 +250,10 @@ def logout_oauth_client(
     if authorization is None:
         raise AuthenticationError(detail="Authentication Failure")
 
+    # Validate that the token looks like a valid JWE token (5 segments separated by dots)
+    if not authorization or authorization.count(".") != 4:
+        return None
+
     try:
         token_data = json.loads(
             extract_payload(authorization, CONFIG.security.app_encryption_key)

fides/api/models/privacy_request/privacy_request.py

@@ -222,6 +222,7 @@ class PrivacyRequest(
     canceled_at = Column(DateTime(timezone=True), nullable=True)
     consent_preferences = Column(MutableList.as_mutable(JSONB), nullable=True)
     source = Column(EnumColumn(PrivacyRequestSource), nullable=True)
+    location = Column(String, nullable=True)
 
     # A PrivacyRequest can be soft deleted, so we store when it was deleted
     deleted_at = Column(DateTime(timezone=True), nullable=True)

fides/api/models/privacy_request/webhook.py

@@ -13,12 +13,17 @@ from fides.api.models.policy import PolicyPreWebhook, WebhookDirection
 from fides.api.models.pre_approval_webhook import PreApprovalWebhook
 from fides.api.models.privacy_request.request_task import RequestTask
 from fides.api.oauth.jwt import generate_jwe
-from fides.api.schemas.external_https import RequestTaskJWE, WebhookJWE
+from fides.api.schemas.external_https import (
+    DownloadTokenJWE,
+    RequestTaskJWE,
+    WebhookJWE,
+)
 from fides.api.schemas.policy import ActionType
 from fides.api.schemas.privacy_request import PrivacyRequestStatus
 from fides.api.schemas.redis_cache import Identity
 from fides.common.api.scope_registry import (
     PRIVACY_REQUEST_CALLBACK_RESUME,
+    PRIVACY_REQUEST_READ_ACCESS_RESULTS,
     PRIVACY_REQUEST_REVIEW,
 )
 from fides.config import CONFIG
@@ -92,3 +97,30 @@ def generate_request_task_callback_jwe(request_task: RequestTask) -> str:
         json.dumps(jwe.model_dump(mode="json")),
         CONFIG.security.app_encryption_key,
     )
+
+
+def generate_privacy_request_download_token(privacy_request_id: str) -> str:
+    """
+    Generate a JWE token for users to download their privacy request access package.
+    This is currently used for the DSR package link endpoint which provides a redirect
+    to a presigned URL for the access results.
+    This token expires based on the configured TTL for security.
+    """
+    from datetime import timedelta
+
+    now = datetime.now()
+    # Use the configured TTL from security settings
+    expiration = now + timedelta(
+        seconds=CONFIG.security.subject_request_download_link_ttl_seconds
+    )
+
+    jwe = DownloadTokenJWE(
+        privacy_request_id=privacy_request_id,
+        scopes=[PRIVACY_REQUEST_READ_ACCESS_RESULTS],
+        iat=now.isoformat(),
+        exp=expiration.isoformat(),
+    )
+    return generate_jwe(
+        json.dumps(jwe.model_dump(mode="json")),
+        CONFIG.security.app_encryption_key,
+    )

fides/api/oauth/utils.py

@@ -32,7 +32,11 @@ from fides.api.models.pre_approval_webhook import PreApprovalWebhook
 from fides.api.models.privacy_request import RequestTask
 from fides.api.oauth.roles import get_scopes_from_roles
 from fides.api.request_context import set_user_id
-from fides.api.schemas.external_https import RequestTaskJWE, WebhookJWE
+from fides.api.schemas.external_https import (
+    DownloadTokenJWE,
+    RequestTaskJWE,
+    WebhookJWE,
+)
 from fides.api.schemas.oauth import OAuth2ClientCredentialsBearer
 from fides.common.api.v1.urn_registry import TOKEN, V1_URL_PREFIX
 from fides.config import CONFIG, FidesConfig
@@ -49,57 +53,25 @@ oauth2_scheme = OAuth2ClientCredentialsBearer(
 
 def extract_payload(jwe_string: str, encryption_key: str) -> str:
     """Given a jwe, extracts the payload and returns it in string form."""
-    return jwe.decrypt(jwe_string, encryption_key)
+    try:
+        decrypted_payload = jwe.decrypt(jwe_string, encryption_key)
+        return decrypted_payload.decode("utf-8")
+    except exceptions.JWEError as e:
+        logger.debug("Failed to decrypt JWE: {}", e)
+        raise e
 
 
-def is_token_expired(issued_at: datetime | None, token_duration_min: int) -> bool:
-    """Returns True if the datetime is earlier than token_duration_min ago."""
-    if not issued_at:
+def is_token_expired(
+    issued_at: Optional[datetime], token_duration_minutes: int
+) -> bool:
+    """Check if a token has expired based on its issued_at timestamp and duration."""
+    if issued_at is None:
         return True
-
-    return (datetime.now() - issued_at).total_seconds() / 60.0 > token_duration_min
-
-
-def copy_func(source_function: Callable) -> Callable:
-    """Based on http://stackoverflow.com/a/6528148/190597 (Glenn Maynard)"""
-    target_function = FunctionType(
-        source_function.__code__,
-        source_function.__globals__,
-        name=source_function.__name__,
-        argdefs=source_function.__defaults__,
-        closure=source_function.__closure__,
-    )
-    updated_target_function: Callable = update_wrapper(target_function, source_function)
-    updated_target_function.__kwdefaults__ = source_function.__kwdefaults__
-    return updated_target_function
+    return (datetime.now() - issued_at).total_seconds() / 60.0 > token_duration_minutes
 
 
-async def get_current_user(
-    security_scopes: SecurityScopes,
-    authorization: str = Security(oauth2_scheme),
-    db: Session = Depends(get_db),
-) -> FidesUser:
-    """A wrapper around verify_oauth_client that returns that client's user if one exists."""
-    client = await verify_oauth_client(
-        security_scopes=security_scopes,
-        authorization=authorization,
-        db=db,
-    )
-
-    if client.id == CONFIG.security.oauth_root_client_id:
-        return FidesUser(
-            id=CONFIG.security.oauth_root_client_id,
-            username=CONFIG.security.root_username,
-            created_at=datetime.utcnow(),
-        )
-
-    return client.user  # type: ignore[attr-defined]
-
-
-def is_callback_token_expired(issued_at: datetime | None) -> bool:
-    """Returns True if the token is older than the expiration of the redis cache.  We
-    can't resume executing the privacy request if the identity data is gone.
-    """
+def is_callback_token_expired(issued_at: Optional[datetime]) -> bool:
+    """Check if a callback token has expired (24 hours)."""
     if not issued_at:
         return True
 
@@ -114,9 +86,13 @@ def _get_webhook_jwe_or_error(
     if authorization is None:
         raise AuthenticationError(detail="Authentication Failure")
 
-    token_data = json.loads(
-        extract_payload(authorization, CONFIG.security.app_encryption_key)
-    )
+    try:
+        token_data = json.loads(
+            extract_payload(authorization, CONFIG.security.app_encryption_key)
+        )
+    except exceptions.JWEError:
+        raise AuthorizationError(detail="Not Authorized for this action")
+
     try:
         token = WebhookJWE(**token_data)
     except ValidationError:
@@ -160,6 +136,98 @@ def _get_request_task_jwe_or_error(
     return token
 
 
+def validate_download_token(token: str, privacy_request_id: str) -> DownloadTokenJWE:
+    """
+    Validate a download token for accessing privacy request packages.
+
+    Args:
+        token: The JWE token to validate
+        privacy_request_id: The privacy request ID the token should grant access to
+
+    Returns:
+        The validated DownloadTokenJWE object
+
+    Raises:
+        AuthenticationError: If token is invalid or expired
+        AuthorizationError: If token doesn't grant access to the requested privacy request
+    """
+    if not token:
+        raise AuthenticationError(detail="Download token is required")
+
+    # Check if token looks like a JWE (should have 5 parts separated by dots)
+    if token.count(".") != 4:
+        raise AuthenticationError(detail="Invalid download token format")
+
+    try:
+        token_data = json.loads(
+            extract_payload(token, CONFIG.security.app_encryption_key)
+        )
+    except exceptions.JWEError:
+        raise AuthenticationError(detail="Invalid download token format")
+
+    try:
+        download_token = DownloadTokenJWE(**token_data)
+    except ValidationError:
+        raise AuthenticationError(detail="Invalid download token structure")
+
+    # Verify the token grants access to the requested privacy request
+    if download_token.privacy_request_id != privacy_request_id:
+        raise AuthorizationError(
+            detail="Download token does not grant access to this privacy request"
+        )
+
+    # Verify the token has the required scope
+    required_scope = "privacy-request-access-results:read"
+    if required_scope not in download_token.scopes:
+        raise AuthorizationError(detail="Download token lacks required permissions")
+
+    # Check if the token has expired
+    try:
+        expiration_time = datetime.fromisoformat(download_token.exp)
+        if datetime.now() > expiration_time:
+            raise AuthenticationError(detail="Download token has expired")
+    except (ValueError, TypeError):
+        raise AuthenticationError(detail="Invalid token expiration format")
+
+    return download_token
+
+
+def copy_func(source_function: Callable) -> Callable:
+    """Based on http://stackoverflow.com/a/6528148/190597 (Glenn Maynard)"""
+    target_function = FunctionType(
+        source_function.__code__,
+        source_function.__globals__,
+        name=source_function.__name__,
+        argdefs=source_function.__defaults__,
+        closure=source_function.__closure__,
+    )
+    updated_target_function: Callable = update_wrapper(target_function, source_function)
+    updated_target_function.__kwdefaults__ = source_function.__kwdefaults__
+    return updated_target_function
+
+
+async def get_current_user(
+    security_scopes: SecurityScopes,
+    authorization: str = Security(oauth2_scheme),
+    db: Session = Depends(get_db),
+) -> FidesUser:
+    """A wrapper around verify_oauth_client that returns that client's user if one exists."""
+    client = await verify_oauth_client(
+        security_scopes=security_scopes,
+        authorization=authorization,
+        db=db,
+    )
+
+    if client.id == CONFIG.security.oauth_root_client_id:
+        return FidesUser(
+            id=CONFIG.security.oauth_root_client_id,
+            username=CONFIG.security.root_username,
+            created_at=datetime.utcnow(),
+        )
+
+    return client.user  # type: ignore[attr-defined]
+
+
 def verify_callback_oauth_policy_pre_webhook(
     security_scopes: SecurityScopes,
     authorization: str = Security(oauth2_scheme),

fides/api/schemas/application_config.py

@@ -87,6 +87,12 @@ class AdminUIConfig(FidesSchema):
     model_config = ConfigDict(extra="forbid")
 
 
+class PrivacyCenterConfig(FidesSchema):
+    url: SerializeAsAny[Optional[AnyHttpUrlStringRemovesSlash]] = None
+
+    model_config = ConfigDict(extra="forbid")
+
+
 class ConsentConfig(FidesSchema):
     override_vendor_purposes: Optional[bool]
     model_config = ConfigDict(extra="forbid")
@@ -119,6 +125,7 @@ class ApplicationConfig(FidesSchema):
     security: Optional[SecurityApplicationConfig] = None
     consent: Optional[ConsentConfig] = None
     admin_ui: Optional[AdminUIConfig] = None
+    privacy_center: Optional[PrivacyCenterConfig] = None
 
     @model_validator(mode="before")
     @classmethod

fides/api/schemas/connection_configuration/connection_type_system_map.py

@@ -4,6 +4,8 @@ from pydantic import BaseModel, ConfigDict
 
 from fides.api.models.connectionconfig import ConnectionType
 from fides.api.schemas.connection_configuration.enums.system_type import SystemType
+from fides.api.schemas.enums.connection_category import ConnectionCategory
+from fides.api.schemas.enums.integration_feature import IntegrationFeature
 from fides.api.schemas.policy import ActionType
 
 
@@ -19,4 +21,8 @@ class ConnectionSystemTypeMap(BaseModel):
     authorization_required: Optional[bool] = False
     user_guide: Optional[str] = None
     supported_actions: List[ActionType]
+    # New fields for enhanced display information
+    category: Optional[ConnectionCategory] = None
+    tags: Optional[List[str]] = None
+    enabled_features: Optional[List[IntegrationFeature]] = None
     model_config = ConfigDict(use_enum_values=True, from_attributes=True)

fides/api/schemas/enums/connection_category.py

@@ -0,0 +1,20 @@
+from enum import Enum
+
+
+class ConnectionCategory(str, Enum):
+    """
+    Categories for connection types, matching frontend ConnectionCategory enum
+    """
+
+    DATA_CATALOG = "DATA_CATALOG"
+    DATA_WAREHOUSE = "DATA_WAREHOUSE"
+    DATABASE = "DATABASE"
+    IDENTITY_PROVIDER = "IDENTITY_PROVIDER"
+    WEBSITE = "WEBSITE"
+    CRM = "CRM"
+    MANUAL = "MANUAL"
+    MARKETING = "MARKETING"
+    ANALYTICS = "ANALYTICS"
+    ECOMMERCE = "ECOMMERCE"
+    COMMUNICATION = "COMMUNICATION"
+    CUSTOM = "CUSTOM"  # Fallback for uncategorized/custom uploaded integrations