ethyca-fides 2.68.1b4__py2.py3-none-any.whl → 2.69.0rc1__py2.py3-none-any.whl

fides/_version.py

@@ -8,11 +8,11 @@ import json
 
 version_json = '''
 {
- "date": "2025-08-27T12:07:27-0600",
+ "date": "2025-08-28T18:28:20-0700",
  "dirty": false,
  "error": null,
- "full-revisionid": "062904c4ee33fadc4f937ccfd3fd2f2e2a2cbae8",
- "version": "2.68.1b4"
+ "full-revisionid": "af95d4c10df1e7d85a73f90bdd397b8b92c9096e",
+ "version": "2.69.0rc1"
 }
 '''  # END VERSION_JSON
 

fides/api/api/v1/endpoints/oauth_endpoints.py

@@ -37,6 +37,7 @@ from fides.api.service.authentication.authentication_strategy_oauth2_authorizati
 )
 from fides.api.util.api_router import APIRouter
 from fides.api.util.connection_util import connection_status
+from fides.api.util.endpoint_utils import fides_limiter
 from fides.common.api.scope_registry import (
     CLIENT_CREATE,
     CLIENT_DELETE,
@@ -65,8 +66,10 @@ router = APIRouter(tags=["OAuth"], prefix=V1_URL_PREFIX)
     TOKEN,
     response_model=AccessToken,
 )
+@fides_limiter.limit(CONFIG.security.auth_rate_limit)
 async def acquire_access_token(
     request: Request,
+    response: Response,
     form_data: OAuth2ClientCredentialsRequestForm = Depends(),
     db: Session = Depends(get_db),
 ) -> AccessToken:

fides/api/api/v1/endpoints/privacy_request_endpoints.py

@@ -86,7 +86,7 @@ from fides.api.oauth.utils import (
 from fides.api.schemas.api import ResponseWithMessage
 from fides.api.schemas.dataset import CollectionAddressResponse, DryRunDatasetResponse
 from fides.api.schemas.external_https import PrivacyRequestResumeFormat
-from fides.api.schemas.policy import ActionType
+from fides.api.schemas.policy import ActionType, CurrentStep
 from fides.api.schemas.privacy_request import (
     BulkPostPrivacyRequests,
     BulkReviewResponse,
@@ -1930,6 +1930,7 @@ def finalize_privacy_request(
 
     queue_privacy_request(
         privacy_request_id=privacy_request_id,
+        from_step=CurrentStep.finalization.value,
     )
 
     return privacy_request  # type: ignore[return-value]

fides/api/api/v1/endpoints/user_endpoints.py

@@ -5,7 +5,7 @@ from datetime import datetime
 from typing import List, Optional
 
 import jose.exceptions
-from fastapi import Depends, HTTPException, Security
+from fastapi import Depends, HTTPException, Request, Response, Security
 from fastapi.security import SecurityScopes
 from fastapi_pagination import Page, Params
 from fastapi_pagination.bases import AbstractPage
@@ -59,6 +59,7 @@ from fides.api.schemas.user import (
 )
 from fides.api.service.deps import get_user_service
 from fides.api.util.api_router import APIRouter
+from fides.api.util.endpoint_utils import fides_limiter
 from fides.common.api.scope_registry import (
     SCOPE_REGISTRY,
     SYSTEM_MANAGER_DELETE,
@@ -207,6 +208,17 @@ def update_user_password(
 
     current_user.update_password(db=db, new_password=data.new_password)
 
+    # Delete the user's associated OAuth client to invalidate all existing sessions
+    if current_user.client:
+        try:
+            current_user.client.delete(db)
+        except Exception as exc:
+            logger.exception(
+                "Unable to delete user client during password reset for user {}: {}",
+                current_user.id,
+                exc,
+            )
+
     logger.info("Updated user with id: '{}'.", current_user.id)
     return current_user
 
@@ -235,6 +247,18 @@ def force_update_password(
         )
 
     user.update_password(db=db, new_password=data.new_password)
+
+    # Delete the user's associated OAuth client to invalidate all existing sessions
+    if user.client:
+        try:
+            user.client.delete(db)
+        except Exception as exc:
+            logger.exception(
+                "Unable to delete user client during admin-forced password reset for user {}: {}",
+                user.id,
+                exc,
+            )
+
     logger.info("Updated user with id: '{}'.", user.id)
     return user
 
@@ -617,8 +641,11 @@ def get_users(
     status_code=HTTP_200_OK,
     response_model=UserLoginResponse,
 )
+@fides_limiter.limit(CONFIG.security.auth_rate_limit)
 def user_login(
     *,
+    request: Request,
+    response: Response,
     db: Session = Depends(get_db),
     config: FidesConfig = Depends(get_config),
     user_data: UserLogin,

fides/api/models/client.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 import json
 from datetime import datetime
-from typing import Any, Optional
+from typing import TYPE_CHECKING, Any, Optional
 
 from sqlalchemy import ARRAY, Column, ForeignKey, String
 from sqlalchemy.ext.declarative import declared_attr
@@ -22,10 +22,12 @@ from fides.api.cryptography.schemas.jwt import (
     JWE_PAYLOAD_SYSTEMS,
 )
 from fides.api.db.base_class import Base
-from fides.api.models.fides_user import FidesUser
 from fides.api.oauth.jwt import generate_jwe
 from fides.config import FidesConfig
 
+if TYPE_CHECKING:
+    from fides.api.models.fides_user import FidesUser
+
 DEFAULT_SCOPES: list[str] = []
 DEFAULT_ROLES: list[str] = []
 DEFAULT_SYSTEMS: list[str] = []
@@ -48,9 +50,11 @@ class ClientDetail(Base):
         ARRAY(String), nullable=False, server_default="{}", default=dict
     )
     fides_key = Column(String, index=True, unique=True, nullable=True)
-    user_id = Column(
-        String, ForeignKey(FidesUser.id_field_path), nullable=True, unique=True
-    )
+    user_id = Column(String, ForeignKey("fidesuser.id"), nullable=True, unique=True)
+
+    if TYPE_CHECKING:
+        # Explicitly annotate the backref relationship for mypy
+        user: Optional["FidesUser"]
 
     @classmethod
     def create_client_and_secret(

fides/api/models/fides_user.py

@@ -22,7 +22,7 @@ from fides.api.cryptography.cryptographic_util import (
 from fides.api.db.base_class import Base
 from fides.api.models.audit_log import AuditLog
 
-# Intentionally importing SystemManager here to build the FidesUser.systems relationship
+# SystemManager import is handled in base.py to avoid circular imports
 from fides.api.schemas.user import DisabledReason
 from fides.config import CONFIG
 
@@ -32,7 +32,6 @@ if TYPE_CHECKING:
         FidesUserRespondentEmailVerification,
     )
     from fides.api.models.sql_models import System  # type: ignore[attr-defined]
-    from fides.api.models.system_manager import SystemManager
 
 
 class FidesUser(Base):

fides/api/oauth/utils.py

@@ -222,7 +222,9 @@ async def get_current_user(
             created_at=datetime.utcnow(),
         )
 
-    return client.user  # type: ignore[attr-defined]
+    if client.user is None:
+        raise AuthorizationError(detail="Client has no associated user")
+    return client.user
 
 
 def verify_callback_oauth_policy_pre_webhook(
@@ -367,8 +369,10 @@ def extract_token_and_load_client(
         logger.debug("Auth token expired.")
         raise AuthorizationError(detail="Not Authorized for this action")
 
+    issued_at_dt = datetime.fromisoformat(issued_at)
+
     if is_token_expired(
-        datetime.fromisoformat(issued_at),
+        issued_at_dt,
         token_duration_override or CONFIG.security.oauth_access_token_expire_minutes,
     ):
         raise AuthorizationError(detail="Not Authorized for this action")
@@ -391,6 +395,21 @@ def extract_token_and_load_client(
         logger.debug("Auth token belongs to an invalid client_id.")
         raise AuthorizationError(detail="Not Authorized for this action")
 
+    # Invalidate tokens issued prior to the user's most recent password reset.
+    # This ensures any existing sessions are expired immediately after a password change.
+    try:
+        if client.user is not None and client.user.password_reset_at is not None:
+            password_reset_at = client.user.password_reset_at
+            if password_reset_at and issued_at_dt < password_reset_at:
+                logger.debug("Auth token issued before latest password reset.")
+                raise AuthorizationError(detail="Not Authorized for this action")
+    except (
+        Exception
+    ) as exc:  # pragma: no cover - defensive: never block auth on relationship issues
+        logger.exception(
+            "Unable to evaluate password reset timestamp for client user: {}", exc
+        )
+
     # Populate request-scoped context with the authenticated user identifier.
     # Prefer the linked user_id; fall back to the client id when this is the
     # special root client (which has no associated FidesUser row).

fides/api/schemas/enums/integration_feature.py

@@ -21,3 +21,6 @@ class IntegrationFeature(str, Enum):
 
     # Enables Data Subject Request automation for SAAS integrations
     DSR_AUTOMATION = "DSR_AUTOMATION"
+
+    # Enables conditions configuration for manual task creation - shows "Conditions" tab
+    CONDITIONS = "CONDITIONS"

fides/api/service/privacy_request/request_runner_service.py

@@ -614,6 +614,9 @@ def run_privacy_request(
                 # The access, consent, and erasure runners for DSR 3.0 throw this exception after its
                 # Request Tasks have been built.  The Privacy Request will be requeued from
                 # the appropriate checkpoint when all the Request Tasks have run.
+                logger.info(
+                    "Privacy Request exited awaiting sub task processing (Request Tasks)"
+                )
                 return
 
             except ValidationError as exc:

fides/config/security_settings.py

@@ -101,6 +101,10 @@ class SecuritySettings(FidesSettings):
         default="1000/minute",
         description="The number of requests from a single IP address allowed to hit an endpoint within a rolling 60 second period.",
     )
+    auth_rate_limit: str = Field(
+        default="10/minute",
+        description="The number of authentication requests from a single IP address allowed to hit authentication endpoints (login, OAuth token) within the specified time period.",
+    )
     root_user_scopes: List[str] = Field(
         default=SCOPE_REGISTRY,
         description="The list of scopes that are given to the root user.",
@@ -213,13 +217,13 @@ class SecuritySettings(FidesSettings):
         oauth_root_client_secret_hash = (hashed_client_id, salt.encode(encoding))  # type: ignore
         return oauth_root_client_secret_hash
 
-    @field_validator("request_rate_limit")
+    @field_validator("request_rate_limit", "auth_rate_limit")
     @classmethod
-    def validate_request_rate_limit(
+    def validate_rate_limits(
         cls,
         v: str,
     ) -> str:
-        """Validate the formatting of `request_rate_limit`"""
+        """Validate the formatting of rate limit fields"""
         try:
             # Defer to `limits.parse_many` https://limits.readthedocs.io/en/stable/api.html#limits.parse_many
             parse_many(v)

fides/ui-build/static/admin/404.html

@@ -1 +1 @@
-<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width"/><meta name="next-head-count" content="2"/><link data-next-font="" rel="preconnect" href="/" crossorigin="anonymous"/><link rel="preload" href="/_next/static/css/43d0c0fc207767eb.css" as="style"/><link rel="stylesheet" href="/_next/static/css/43d0c0fc207767eb.css" data-n-g=""/><noscript data-n-css=""></noscript><script defer="" nomodule="" src="/_next/static/chunks/polyfills-42372ed130431b0a.js"></script><script src="/_next/static/chunks/webpack-4502d4d67006b48f.js" defer=""></script><script src="/_next/static/chunks/framework-c92fc3344e6fd165.js" defer=""></script><script src="/_next/static/chunks/main-090643377c8254e6.js" defer=""></script><script src="/_next/static/chunks/pages/_app-284cba7174fa1f16.js" defer=""></script><script src="/_next/static/chunks/pages/404-9644eb282f2dcd71.js" defer=""></script><script src="/_next/static/LRCvfOqg1kP5kGnkD84G4/_buildManifest.js" defer=""></script><script src="/_next/static/LRCvfOqg1kP5kGnkD84G4/_ssgManifest.js" defer=""></script><style>.data-ant-cssinjs-cache-path{content:"";}</style></head><body><div id="__next"><div style="height:100%;display:flex"></div></div><script id="__NEXT_DATA__" type="application/json">{"props":{"pageProps":{}},"page":"/404","query":{},"buildId":"LRCvfOqg1kP5kGnkD84G4","nextExport":true,"autoExport":true,"isFallback":false,"scriptLoader":[]}</script></body></html>
+<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width"/><meta name="next-head-count" content="2"/><link data-next-font="" rel="preconnect" href="/" crossorigin="anonymous"/><link rel="preload" href="/_next/static/css/abf2e162b1cd0e61.css" as="style"/><link rel="stylesheet" href="/_next/static/css/abf2e162b1cd0e61.css" data-n-g=""/><noscript data-n-css=""></noscript><script defer="" nomodule="" src="/_next/static/chunks/polyfills-42372ed130431b0a.js"></script><script src="/_next/static/chunks/webpack-aa7ff73977a15cb3.js" defer=""></script><script src="/_next/static/chunks/framework-c92fc3344e6fd165.js" defer=""></script><script src="/_next/static/chunks/main-090643377c8254e6.js" defer=""></script><script src="/_next/static/chunks/pages/_app-36bec04369a1a7c4.js" defer=""></script><script src="/_next/static/chunks/pages/404-fde1f56225d1ef4f.js" defer=""></script><script src="/_next/static/zEliM9juvmcu4yond1mtG/_buildManifest.js" defer=""></script><script src="/_next/static/zEliM9juvmcu4yond1mtG/_ssgManifest.js" defer=""></script><style>.data-ant-cssinjs-cache-path{content:"";}</style></head><body><div id="__next"><div style="height:100%;display:flex"></div></div><script id="__NEXT_DATA__" type="application/json">{"props":{"pageProps":{}},"page":"/404","query":{},"buildId":"zEliM9juvmcu4yond1mtG","nextExport":true,"autoExport":true,"isFallback":false,"scriptLoader":[]}</script></body></html>