ethyca-fides 2.69.0rc0__tar.gz → 2.69.0rc1__tar.gz

{ethyca_fides-2.69.0rc0/src/ethyca_fides.egg-info → ethyca_fides-2.69.0rc1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ethyca_fides
-Version: 2.69.0rc0
+Version: 2.69.0rc1
 Summary: Open-source ecosystem for data privacy as code.
 Home-page: https://github.com/ethyca/fides
 Author: Ethyca, Inc.

{ethyca_fides-2.69.0rc0 → ethyca_fides-2.69.0rc1}/pyproject.toml

@@ -163,7 +163,8 @@ extension-pkg-whitelist = ["pydantic", "zlib", "cassandra"]
 ############
 [tool.pytest.ini_options]
 env = [
-  "FIDES__TEST_MODE=true"
+  "FIDES__TEST_MODE=true",
+  "FIDES__SECURITY__AUTH_RATE_LIMIT=1000/minute"
 ]
 log_cli=false
 filterwarnings = "ignore::DeprecationWarning:aiofiles.*:"

{ethyca_fides-2.69.0rc0 → ethyca_fides-2.69.0rc1/src/ethyca_fides.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ethyca_fides
-Version: 2.69.0rc0
+Version: 2.69.0rc1
 Summary: Open-source ecosystem for data privacy as code.
 Home-page: https://github.com/ethyca/fides
 Author: Ethyca, Inc.

{ethyca_fides-2.69.0rc0 → ethyca_fides-2.69.0rc1}/src/ethyca_fides.egg-info/SOURCES.txt

@@ -904,8 +904,6 @@ src/fides/ui-build/static/admin/properties.html
 src/fides/ui-build/static/admin/systems.html
 src/fides/ui-build/static/admin/taxonomy.html
 src/fides/ui-build/static/admin/user-management.html
-src/fides/ui-build/static/admin/_next/static/0uUBOyZCwjdyYdhNzpRkz/_buildManifest.js
-src/fides/ui-build/static/admin/_next/static/0uUBOyZCwjdyYdhNzpRkz/_ssgManifest.js
 src/fides/ui-build/static/admin/_next/static/chunks/1099-db533dd22b80bca6.js
 src/fides/ui-build/static/admin/_next/static/chunks/1316-2606e19807c08aa5.js
 src/fides/ui-build/static/admin/_next/static/chunks/1345-6986414ab6ad3389.js
@@ -926,7 +924,7 @@ src/fides/ui-build/static/admin/_next/static/chunks/3855-3154d56888ac46ed.js
 src/fides/ui-build/static/admin/_next/static/chunks/3872-25eec062abd0f847.js
 src/fides/ui-build/static/admin/_next/static/chunks/3923-3be9b867f33e524c.js
 src/fides/ui-build/static/admin/_next/static/chunks/401-029e2ff644cae40c.js
-src/fides/ui-build/static/admin/_next/static/chunks/4121-bbce1026a2ffe962.js
+src/fides/ui-build/static/admin/_next/static/chunks/4121-b04a7859ee8f0b59.js
 src/fides/ui-build/static/admin/_next/static/chunks/4259.d1507e0db19cbed7.js
 src/fides/ui-build/static/admin/_next/static/chunks/431-86ad2beeb93c95c9.js
 src/fides/ui-build/static/admin/_next/static/chunks/4608-99e453c666a7b89a.js
@@ -1033,7 +1031,7 @@ src/fides/ui-build/static/admin/_next/static/chunks/pages/poc/form-experiments/F
 src/fides/ui-build/static/admin/_next/static/chunks/pages/poc/form-experiments/FormikControlled-2e99b5eb12982aeb.js
 src/fides/ui-build/static/admin/_next/static/chunks/pages/poc/form-experiments/FormikField-c7d62113680196dd.js
 src/fides/ui-build/static/admin/_next/static/chunks/pages/poc/form-experiments/FormikSpreadField-af097d661f6abcf4.js
-src/fides/ui-build/static/admin/_next/static/chunks/pages/privacy-requests/[id]-7e3f8b6eb83c5142.js
+src/fides/ui-build/static/admin/_next/static/chunks/pages/privacy-requests/[id]-71b89f125d817d47.js
 src/fides/ui-build/static/admin/_next/static/chunks/pages/privacy-requests/configure-3823ee301161be4f.js
 src/fides/ui-build/static/admin/_next/static/chunks/pages/privacy-requests/configure/messaging-4c8e1a7e407d3c7f.js
 src/fides/ui-build/static/admin/_next/static/chunks/pages/privacy-requests/configure/storage-faf42d1a9cd6a861.js
@@ -1100,6 +1098,8 @@ src/fides/ui-build/static/admin/_next/static/media/inter-vietnamese-500-normal.7
 src/fides/ui-build/static/admin/_next/static/media/inter-vietnamese-600-normal.eb82de1d.woff2
 src/fides/ui-build/static/admin/_next/static/media/inter-vietnamese-700-normal.00e401a9.woff2
 src/fides/ui-build/static/admin/_next/static/media/logo-white.c9bf4196.svg
+src/fides/ui-build/static/admin/_next/static/zEliM9juvmcu4yond1mtG/_buildManifest.js
+src/fides/ui-build/static/admin/_next/static/zEliM9juvmcu4yond1mtG/_ssgManifest.js
 src/fides/ui-build/static/admin/add-systems/manual.html
 src/fides/ui-build/static/admin/add-systems/multiple.html
 src/fides/ui-build/static/admin/consent/configure.html

{ethyca_fides-2.69.0rc0 → ethyca_fides-2.69.0rc1}/src/fides/_version.py

@@ -8,11 +8,11 @@ import json
 
 version_json = '''
 {
- "date": "2025-08-28T05:01:43-0700",
+ "date": "2025-08-28T18:28:20-0700",
  "dirty": false,
  "error": null,
- "full-revisionid": "01dddf60bc67c9798b38acc7eeec07cc78d49ddc",
- "version": "2.69.0rc0"
+ "full-revisionid": "af95d4c10df1e7d85a73f90bdd397b8b92c9096e",
+ "version": "2.69.0rc1"
 }
 '''  # END VERSION_JSON
 

{ethyca_fides-2.69.0rc0 → ethyca_fides-2.69.0rc1}/src/fides/api/api/v1/endpoints/oauth_endpoints.py

@@ -37,6 +37,7 @@ from fides.api.service.authentication.authentication_strategy_oauth2_authorizati
 )
 from fides.api.util.api_router import APIRouter
 from fides.api.util.connection_util import connection_status
+from fides.api.util.endpoint_utils import fides_limiter
 from fides.common.api.scope_registry import (
     CLIENT_CREATE,
     CLIENT_DELETE,
@@ -65,8 +66,10 @@ router = APIRouter(tags=["OAuth"], prefix=V1_URL_PREFIX)
     TOKEN,
     response_model=AccessToken,
 )
+@fides_limiter.limit(CONFIG.security.auth_rate_limit)
 async def acquire_access_token(
     request: Request,
+    response: Response,
     form_data: OAuth2ClientCredentialsRequestForm = Depends(),
     db: Session = Depends(get_db),
 ) -> AccessToken:

{ethyca_fides-2.69.0rc0 → ethyca_fides-2.69.0rc1}/src/fides/api/api/v1/endpoints/privacy_request_endpoints.py

@@ -1930,7 +1930,7 @@ def finalize_privacy_request(
 
     queue_privacy_request(
         privacy_request_id=privacy_request_id,
-        from_step=CurrentStep.finalize_erasure.value,
+        from_step=CurrentStep.finalization.value,
     )
 
     return privacy_request  # type: ignore[return-value]

{ethyca_fides-2.69.0rc0 → ethyca_fides-2.69.0rc1}/src/fides/api/api/v1/endpoints/user_endpoints.py

@@ -5,7 +5,7 @@ from datetime import datetime
 from typing import List, Optional
 
 import jose.exceptions
-from fastapi import Depends, HTTPException, Security
+from fastapi import Depends, HTTPException, Request, Response, Security
 from fastapi.security import SecurityScopes
 from fastapi_pagination import Page, Params
 from fastapi_pagination.bases import AbstractPage
@@ -59,6 +59,7 @@ from fides.api.schemas.user import (
 )
 from fides.api.service.deps import get_user_service
 from fides.api.util.api_router import APIRouter
+from fides.api.util.endpoint_utils import fides_limiter
 from fides.common.api.scope_registry import (
     SCOPE_REGISTRY,
     SYSTEM_MANAGER_DELETE,
@@ -207,6 +208,17 @@ def update_user_password(
 
     current_user.update_password(db=db, new_password=data.new_password)
 
+    # Delete the user's associated OAuth client to invalidate all existing sessions
+    if current_user.client:
+        try:
+            current_user.client.delete(db)
+        except Exception as exc:
+            logger.exception(
+                "Unable to delete user client during password reset for user {}: {}",
+                current_user.id,
+                exc,
+            )
+
     logger.info("Updated user with id: '{}'.", current_user.id)
     return current_user
 
@@ -235,6 +247,18 @@ def force_update_password(
         )
 
     user.update_password(db=db, new_password=data.new_password)
+
+    # Delete the user's associated OAuth client to invalidate all existing sessions
+    if user.client:
+        try:
+            user.client.delete(db)
+        except Exception as exc:
+            logger.exception(
+                "Unable to delete user client during admin-forced password reset for user {}: {}",
+                user.id,
+                exc,
+            )
+
     logger.info("Updated user with id: '{}'.", user.id)
     return user
 
@@ -617,8 +641,11 @@ def get_users(
     status_code=HTTP_200_OK,
     response_model=UserLoginResponse,
 )
+@fides_limiter.limit(CONFIG.security.auth_rate_limit)
 def user_login(
     *,
+    request: Request,
+    response: Response,
     db: Session = Depends(get_db),
     config: FidesConfig = Depends(get_config),
     user_data: UserLogin,

{ethyca_fides-2.69.0rc0 → ethyca_fides-2.69.0rc1}/src/fides/api/models/client.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 import json
 from datetime import datetime
-from typing import Any, Optional
+from typing import TYPE_CHECKING, Any, Optional
 
 from sqlalchemy import ARRAY, Column, ForeignKey, String
 from sqlalchemy.ext.declarative import declared_attr
@@ -22,10 +22,12 @@ from fides.api.cryptography.schemas.jwt import (
     JWE_PAYLOAD_SYSTEMS,
 )
 from fides.api.db.base_class import Base
-from fides.api.models.fides_user import FidesUser
 from fides.api.oauth.jwt import generate_jwe
 from fides.config import FidesConfig
 
+if TYPE_CHECKING:
+    from fides.api.models.fides_user import FidesUser
+
 DEFAULT_SCOPES: list[str] = []
 DEFAULT_ROLES: list[str] = []
 DEFAULT_SYSTEMS: list[str] = []
@@ -48,9 +50,11 @@ class ClientDetail(Base):
         ARRAY(String), nullable=False, server_default="{}", default=dict
     )
     fides_key = Column(String, index=True, unique=True, nullable=True)
-    user_id = Column(
-        String, ForeignKey(FidesUser.id_field_path), nullable=True, unique=True
-    )
+    user_id = Column(String, ForeignKey("fidesuser.id"), nullable=True, unique=True)
+
+    if TYPE_CHECKING:
+        # Explicitly annotate the backref relationship for mypy
+        user: Optional["FidesUser"]
 
     @classmethod
     def create_client_and_secret(

{ethyca_fides-2.69.0rc0 → ethyca_fides-2.69.0rc1}/src/fides/api/models/fides_user.py

@@ -22,7 +22,7 @@ from fides.api.cryptography.cryptographic_util import (
 from fides.api.db.base_class import Base
 from fides.api.models.audit_log import AuditLog
 
-# Intentionally importing SystemManager here to build the FidesUser.systems relationship
+# SystemManager import is handled in base.py to avoid circular imports
 from fides.api.schemas.user import DisabledReason
 from fides.config import CONFIG
 
@@ -32,7 +32,6 @@ if TYPE_CHECKING:
         FidesUserRespondentEmailVerification,
     )
     from fides.api.models.sql_models import System  # type: ignore[attr-defined]
-    from fides.api.models.system_manager import SystemManager
 
 
 class FidesUser(Base):

{ethyca_fides-2.69.0rc0 → ethyca_fides-2.69.0rc1}/src/fides/api/oauth/utils.py

@@ -222,7 +222,9 @@ async def get_current_user(
             created_at=datetime.utcnow(),
         )
 
-    return client.user  # type: ignore[attr-defined]
+    if client.user is None:
+        raise AuthorizationError(detail="Client has no associated user")
+    return client.user
 
 
 def verify_callback_oauth_policy_pre_webhook(
@@ -367,8 +369,10 @@ def extract_token_and_load_client(
         logger.debug("Auth token expired.")
         raise AuthorizationError(detail="Not Authorized for this action")
 
+    issued_at_dt = datetime.fromisoformat(issued_at)
+
     if is_token_expired(
-        datetime.fromisoformat(issued_at),
+        issued_at_dt,
         token_duration_override or CONFIG.security.oauth_access_token_expire_minutes,
     ):
         raise AuthorizationError(detail="Not Authorized for this action")
@@ -391,6 +395,21 @@ def extract_token_and_load_client(
         logger.debug("Auth token belongs to an invalid client_id.")
         raise AuthorizationError(detail="Not Authorized for this action")
 
+    # Invalidate tokens issued prior to the user's most recent password reset.
+    # This ensures any existing sessions are expired immediately after a password change.
+    try:
+        if client.user is not None and client.user.password_reset_at is not None:
+            password_reset_at = client.user.password_reset_at
+            if password_reset_at and issued_at_dt < password_reset_at:
+                logger.debug("Auth token issued before latest password reset.")
+                raise AuthorizationError(detail="Not Authorized for this action")
+    except (
+        Exception
+    ) as exc:  # pragma: no cover - defensive: never block auth on relationship issues
+        logger.exception(
+            "Unable to evaluate password reset timestamp for client user: {}", exc
+        )
+
     # Populate request-scoped context with the authenticated user identifier.
     # Prefer the linked user_id; fall back to the client id when this is the
     # special root client (which has no associated FidesUser row).

{ethyca_fides-2.69.0rc0 → ethyca_fides-2.69.0rc1}/src/fides/config/security_settings.py

@@ -101,6 +101,10 @@ class SecuritySettings(FidesSettings):
         default="1000/minute",
         description="The number of requests from a single IP address allowed to hit an endpoint within a rolling 60 second period.",
     )
+    auth_rate_limit: str = Field(
+        default="10/minute",
+        description="The number of authentication requests from a single IP address allowed to hit authentication endpoints (login, OAuth token) within the specified time period.",
+    )
     root_user_scopes: List[str] = Field(
         default=SCOPE_REGISTRY,
         description="The list of scopes that are given to the root user.",
@@ -213,13 +217,13 @@ class SecuritySettings(FidesSettings):
         oauth_root_client_secret_hash = (hashed_client_id, salt.encode(encoding))  # type: ignore
         return oauth_root_client_secret_hash
 
-    @field_validator("request_rate_limit")
+    @field_validator("request_rate_limit", "auth_rate_limit")
     @classmethod
-    def validate_request_rate_limit(
+    def validate_rate_limits(
         cls,
         v: str,
     ) -> str:
-        """Validate the formatting of `request_rate_limit`"""
+        """Validate the formatting of rate limit fields"""
         try:
             # Defer to `limits.parse_many` https://limits.readthedocs.io/en/stable/api.html#limits.parse_many
             parse_many(v)

{ethyca_fides-2.69.0rc0 → ethyca_fides-2.69.0rc1}/src/fides/ui-build/static/admin/404.html

@@ -1 +1 @@
-<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width"/><meta name="next-head-count" content="2"/><link data-next-font="" rel="preconnect" href="/" crossorigin="anonymous"/><link rel="preload" href="/_next/static/css/abf2e162b1cd0e61.css" as="style"/><link rel="stylesheet" href="/_next/static/css/abf2e162b1cd0e61.css" data-n-g=""/><noscript data-n-css=""></noscript><script defer="" nomodule="" src="/_next/static/chunks/polyfills-42372ed130431b0a.js"></script><script src="/_next/static/chunks/webpack-aa7ff73977a15cb3.js" defer=""></script><script src="/_next/static/chunks/framework-c92fc3344e6fd165.js" defer=""></script><script src="/_next/static/chunks/main-090643377c8254e6.js" defer=""></script><script src="/_next/static/chunks/pages/_app-36bec04369a1a7c4.js" defer=""></script><script src="/_next/static/chunks/pages/404-fde1f56225d1ef4f.js" defer=""></script><script src="/_next/static/0uUBOyZCwjdyYdhNzpRkz/_buildManifest.js" defer=""></script><script src="/_next/static/0uUBOyZCwjdyYdhNzpRkz/_ssgManifest.js" defer=""></script><style>.data-ant-cssinjs-cache-path{content:"";}</style></head><body><div id="__next"><div style="height:100%;display:flex"></div></div><script id="__NEXT_DATA__" type="application/json">{"props":{"pageProps":{}},"page":"/404","query":{},"buildId":"0uUBOyZCwjdyYdhNzpRkz","nextExport":true,"autoExport":true,"isFallback":false,"scriptLoader":[]}</script></body></html>
+<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width"/><meta name="next-head-count" content="2"/><link data-next-font="" rel="preconnect" href="/" crossorigin="anonymous"/><link rel="preload" href="/_next/static/css/abf2e162b1cd0e61.css" as="style"/><link rel="stylesheet" href="/_next/static/css/abf2e162b1cd0e61.css" data-n-g=""/><noscript data-n-css=""></noscript><script defer="" nomodule="" src="/_next/static/chunks/polyfills-42372ed130431b0a.js"></script><script src="/_next/static/chunks/webpack-aa7ff73977a15cb3.js" defer=""></script><script src="/_next/static/chunks/framework-c92fc3344e6fd165.js" defer=""></script><script src="/_next/static/chunks/main-090643377c8254e6.js" defer=""></script><script src="/_next/static/chunks/pages/_app-36bec04369a1a7c4.js" defer=""></script><script src="/_next/static/chunks/pages/404-fde1f56225d1ef4f.js" defer=""></script><script src="/_next/static/zEliM9juvmcu4yond1mtG/_buildManifest.js" defer=""></script><script src="/_next/static/zEliM9juvmcu4yond1mtG/_ssgManifest.js" defer=""></script><style>.data-ant-cssinjs-cache-path{content:"";}</style></head><body><div id="__next"><div style="height:100%;display:flex"></div></div><script id="__NEXT_DATA__" type="application/json">{"props":{"pageProps":{}},"page":"/404","query":{},"buildId":"zEliM9juvmcu4yond1mtG","nextExport":true,"autoExport":true,"isFallback":false,"scriptLoader":[]}</script></body></html>

ethyca_fides-2.69.0rc1/src/fides/ui-build/static/admin/_next/static/chunks/4121-b04a7859ee8f0b59.js

@@ -0,0 +1 @@
+"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[4121],{44121:function(e,s,a){a.d(s,{Z:function(){return ea}});var t=a(24246),n=a(96306),l=a(91437),i=()=>(0,t.jsxs)(n.xuv,{children:[(0,t.jsx)(n.xuv,{pb:4,fontSize:"18px",fontWeight:"semibold",children:"Role Description"}),(0,t.jsx)(n.gCW,{spacing:4,children:l.K.map(e=>(0,t.jsxs)(n.xuv,{width:"100%",padding:4,borderRadius:"md",backgroundColor:"gray.75",fontSize:"14px",children:[(0,t.jsx)(n.xuv,{fontWeight:"semibold",children:e.label}),(0,t.jsx)(n.xuv,{color:"gray.700",children:e.description})]},e.roleKey))})]}),r=a(16134),d=a(54682),o=a(19904),c=a(34090),h=a(86677),u=a(27378),m=a(812),p=a(46238),x=a(58452),j=a(77830),w=a(46628),g=a(26917),b=a(1315),f=a(95492),y=a(65497);let v=e=>{let{assignedSystems:s,onAssignedSystemChange:a}=e,l=(0,r.C)(y.Ux);if((0,y.d6)(l,{skip:!l}),0===s.length)return null;let i=e=>{a(s.filter(s=>s.fides_key!==e.fides_key))};return(0,t.jsxs)(n.iA_,{size:"sm","data-testid":"assign-systems-delete-table",children:[(0,t.jsx)(n.hrZ,{children:(0,t.jsxs)(n.Tr,{children:[(0,t.jsx)(n.Th,{children:"System"}),(0,t.jsx)(n.Th,{})]})}),(0,t.jsx)(n.p3B,{children:s.map(e=>(0,t.jsxs)(n.Tr,{_hover:{bg:"gray.50"},"data-testid":"row-".concat(e.fides_key),children:[(0,t.jsx)(n.Td,{children:e.name}),(0,t.jsx)(n.Td,{textAlign:"end",children:(0,t.jsx)(n.wpx,{"aria-label":"Unassign system from user",icon:(0,t.jsx)(f.l,{}),onClick:()=>i(e),"data-testid":"unassign-btn"})})]},e.fides_key))})]})};var _=e=>{let{allSystems:s,assignedSystems:a,onChange:l}=e,i=e=>{a.find(s=>s.fides_key===e.fides_key)?l(a.filter(s=>s.fides_key!==e.fides_key)):l([...a,e])};return(0,t.jsx)(n.xuv,{overflowY:"auto",maxHeight:"300px",children:(0,t.jsxs)(n.iA_,{size:"sm","data-testid":"assign-systems-table",maxHeight:"50vh",overflowY:"scroll",children:[(0,t.jsx)(n.hrZ,{position:"sticky",top:0,background:"white",zIndex:1,children:(0,t.jsxs)(n.Tr,{children:[(0,t.jsx)(n.Th,{children:"System"}),(0,t.jsx)(n.Th,{children:"Assign"})]})}),(0,t.jsx)(n.p3B,{children:s.map(e=>{let s=!!a.find(s=>s.fides_key===e.fides_key);return(0,t.jsxs)(n.Tr,{_hover:{bg:"gray.50"},"data-testid":"row-".concat(e.fides_key),children:[(0,t.jsx)(n.Td,{children:e.name}),(0,t.jsx)(n.Td,{children:(0,t.jsx)(n.rAg,{checked:s,onChange:()=>i(e),"data-testid":"assign-switch"})})]},e.fides_key)})})]})})};let C=(e,s)=>{var a,t;return(null===(a=e.name)||void 0===a?void 0:a.toLocaleLowerCase().includes(s.toLocaleLowerCase()))||(null===(t=e.description)||void 0===t?void 0:t.toLocaleLowerCase().includes(s.toLocaleLowerCase()))};var S=e=>{let{isOpen:s,onClose:a,assignedSystems:l,onAssignedSystemChange:i}=e,{data:r}=(0,b.K3)(),[d,o]=(0,u.useState)(""),[c,h]=(0,u.useState)(l),m=async()=>{i(c),a()},p=!r||0===r.length,x=(0,u.useMemo)(()=>r?r.filter(e=>C(e,d)):[],[r,d]),j=(0,u.useMemo)(()=>{let e=new Set(c.map(e=>e.fides_key));return x.every(s=>e.has(s.fides_key))},[x,c]);return(0,t.jsxs)(n.u_l,{isOpen:s,onClose:a,size:"2xl",children:[(0,t.jsx)(n.ZAr,{}),(0,t.jsxs)(n.hzk,{p:8,"data-testid":"confirmation-modal",children:[(0,t.jsxs)(n.xBx,{fontWeight:"medium",display:"flex",justifyContent:"space-between",alignItems:"center",children:[(0,t.jsx)(n.xvT,{children:"Assign systems"}),(0,t.jsxs)(n.j8w,{color:"success",children:["Assigned to ",l.length," systems"]})]}),(0,t.jsx)(n.fef,{"data-testid":"assign-systems-modal-body",children:p?(0,t.jsx)(n.xvT,{children:"No systems found"}):(0,t.jsxs)(n.Kqy,{spacing:4,children:[(0,t.jsxs)(n.kCb,{justifyContent:"space-between",children:[(0,t.jsx)(n.xvT,{fontSize:"sm",flexGrow:1,fontWeight:"medium",children:"Assign systems in your organization to this user"}),(0,t.jsx)(n.xuv,{children:(0,t.jsxs)(n.NIc,{display:"flex",alignItems:"center",children:[(0,t.jsx)(n.lXp,{fontSize:"sm",htmlFor:"assign-all-systems",mb:"0",children:"Assign all systems"}),(0,t.jsx)(n.rAg,{size:"small",id:"assign-all-systems",checked:j,onChange:e=>{e&&r?h(x):h(r?r.filter(e=>!x.includes(e)):[])},"data-testid":"assign-all-systems-toggle"})]})})]}),(0,t.jsx)(g.Z,{value:d,onChange:o,placeholder:"Search for systems","data-testid":"system-search",withIcon:!0}),(0,t.jsx)(_,{allSystems:x,assignedSystems:c,onChange:h})]})}),(0,t.jsx)(n.mzw,{justifyContent:"flex-start",children:(0,t.jsxs)("div",{children:[(0,t.jsx)(n.wpx,{onClick:a,className:"mr-2","data-testid":"cancel-btn",children:"Cancel"}),p?null:(0,t.jsx)(n.wpx,{type:"primary",onClick:m,"data-testid":"confirm-btn",children:"Confirm"})]})})]})]})},k=e=>{let{label:s,roleKey:a,isSelected:l,isDisabled:i,assignedSystems:r,onAssignedSystemChange:o}=e,{setFieldValue:h}=(0,c.u6)(),u=(0,n.qY0)(),m=i?"You do not have sufficient permissions to assign this role.":void 0;return l?(0,t.jsxs)(n.Kqy,{borderRadius:"md",border:"1px solid",borderColor:"gray.200",p:4,backgroundColor:"gray.50","aria-selected":"true",spacing:4,"data-testid":"selected",children:[(0,t.jsxs)(n.kCb,{alignItems:"center",justifyContent:"space-between",children:[(0,t.jsx)(n.xvT,{fontSize:"md",fontWeight:"semibold",children:s}),(0,t.jsx)(n.StI,{})]}),a!==d.A7.APPROVER&&a!==d.A7.RESPONDENT&&a!==d.A7.EXTERNAL_RESPONDENT?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)(n.kCb,{alignItems:"center",children:[(0,t.jsx)(n.xvT,{fontSize:"sm",fontWeight:"semibold",mr:1,children:"Assigned systems"}),(0,t.jsx)(p.b,{label:"Assigned systems refer to those systems that have been specifically allocated to a user for management purposes. Users assigned to a system possess full edit permissions and are listed as the Data Steward for the respective system."})]}),(0,t.jsx)(n.wpx,{disabled:i,title:m,type:"primary",size:"small",onClick:u.onOpen,"data-testid":"assign-systems-btn",children:"Assign systems +"}),(0,t.jsx)(v,{assignedSystems:r,onAssignedSystemChange:o}),u.isOpen?(0,t.jsx)(S,{isOpen:u.isOpen,onClose:u.onClose,assignedSystems:r,onAssignedSystemChange:o}):null]}):null]}):(0,t.jsx)(n.wpx,{onClick:()=>{h("roles",[a])},"data-testid":"role-option-".concat(s),title:m,disabled:i,children:s})};let E={roles:[]};var R=()=>{var e,s;let a=(0,n.pmc)(),i=(0,h.useRouter)(),g=(0,r.C)(y.Ux);(0,y.d6)(g,{skip:!g});let{isOpen:b,onOpen:f,onClose:v}=(0,n.qY0)(),_=(0,r.C)(y.R$),[C,S]=(0,u.useState)(_),[R]=(0,y.G$)();(0,u.useEffect)(()=>{S(_)},[_]);let{data:A,isLoading:T}=(0,y.gU)(null!=g?g:"",{skip:!g}),[P]=(0,y.lD)(),N=!!(null==A?void 0:null===(e=A.roles)||void 0===e?void 0:e.includes(d.A7.EXTERNAL_RESPONDENT)),I=async e=>{if(b&&v(),!g)return;let s=e.roles.includes(d.A7.APPROVER),t=await P({user_id:g,payload:{roles:e.roles}});if((0,m.D4)(t)){a((0,w.Vo)((0,m.e$)(t.error)));return}if(!s){let e=C.map(e=>e.fides_key),s=await R({userId:g,fidesKeys:e});if((0,m.D4)(s)){a((0,w.Vo)((0,m.e$)(s.error)));return}}a((0,w.t5)("Permissions updated"))},O=async e=>{g&&(C.length>0&&e.roles.includes(d.A7.APPROVER)?f():await I(e))},z=(0,o.Tg)([d.Sh.USER_PERMISSION_ASSIGN_OWNERS]);if(!g)return null;if(T)return(0,t.jsx)(n.$jN,{});if(!z&&(null==A?void 0:null===(s=A.roles)||void 0===s?void 0:s.includes(d.A7.OWNER)))return(0,t.jsx)(n.xvT,{"data-testid":"insufficient-access",children:"You do not have sufficient access to change this user's permissions."});let q=(null==A?void 0:A.roles)?{roles:A.roles}:E,U=l.K.filter(e=>N?e.roleKey===d.A7.EXTERNAL_RESPONDENT:e.roleKey!==d.A7.EXTERNAL_RESPONDENT),D=N?"External respondent role cannot be changed":void 0;return(0,t.jsx)(c.J9,{onSubmit:O,initialValues:q,enableReinitialize:!0,children:e=>{let{values:s,isSubmitting:a,dirty:l}=e;return(0,t.jsxs)(c.l0,{children:[(0,t.jsxs)(n.Kqy,{spacing:7,children:[(0,t.jsxs)(n.Kqy,{spacing:3,"data-testid":"role-options",children:[(0,t.jsxs)(n.kCb,{alignItems:"center",children:[(0,t.jsx)(n.xvT,{fontSize:"sm",fontWeight:"semibold",mr:1,children:"User role"}),(0,t.jsx)(p.b,{label:"A user's role in the organization determines what parts of the UI they can access and which functions are available to them."})]}),U.map(e=>{let a=s.roles.indexOf(e.roleKey)>=0,n=e.roleKey===d.A7.OWNER?!z:N;return(0,t.jsx)(k,{isSelected:a,isDisabled:n,assignedSystems:C,onAssignedSystemChange:S,...e},e.roleKey)}),!N&&(0,t.jsx)(n.esZ,{title:"To invite a new External respondent user, create a manual task integration and then click on the 'Manage secure access' button",children:(0,t.jsx)(n.wpx,{disabled:!0,"data-testid":"role-option-External respondent",children:"External respondent"})})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(n.wpx,{onClick:()=>i.push(j.e3),children:"Cancel"}),(0,t.jsx)(n.esZ,{title:D,children:(0,t.jsx)(n.wpx,{className:"ml-2",type:"primary",htmlType:"submit",loading:a,disabled:!l&&C===_||N,"data-testid":"save-btn",children:"Save"})})]})]}),(0,t.jsx)(x.Z,{isOpen:b,onClose:v,onConfirm:()=>I(s),title:"Change role to Approver",testId:"downgrade-to-approver-confirmation-modal",continueButtonText:"Yes",message:(0,t.jsx)(n.xvT,{children:"Switching to an approver role will remove all assigned systems. Do you wish to proceed?"})})]})}})},A=a(61038),T=a(55484),P=a(25980),N=a(40324),I=a(96006),O=a(7426);let{useGetEmailInviteStatusQuery:z}=a(78780).u.injectEndpoints({endpoints:e=>({getEmailInviteStatus:e.query({query:()=>({url:"/messaging/email-invite/status"}),providesTags:()=>["Email Invite Status"]})})});var q=a(76174),U=a(91317),D=a(16125),Z=a(52253),W=a(36835),K=a(31883);let L=T.Ry().shape({password:I.a.label("Password"),passwordConfirmation:T.Z_().required().oneOf([T.iH("password")],"Passwords must match").label("Password confirmation")}),V={password:"",passwordConfirmation:""},B=e=>{let s=(0,n.qY0)(),a=(0,n.pmc)(),[t]=(0,y.ls)(),l=(0,h.useRouter)(),i=(0,D.I0)(),d=(0,r.C)(W.dy),o=async n=>{let r=await t({id:e,new_password:n.password});if((0,K.D4)(r))a((0,w.Vo)((0,m.e$)(r.error)));else if(a((0,w.t5)("Successfully reset user's password. Please inform the user of their new password.")),s.onClose(),(null==d?void 0:d.id)===e){try{localStorage.removeItem(Z.xH)}catch(e){}i((0,W.kS)()),l.push(Z._e)}};return{...s,handleResetPassword:o}};var Y=e=>{let{id:s}=e,{handleResetPassword:a,isOpen:l,onClose:i,onOpen:r}=B(s);return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.wpx,{onClick:r,"data-testid":"reset-password-btn",children:"Reset password"}),(0,t.jsxs)(n.u_l,{isCentered:!0,isOpen:l,onClose:i,children:[(0,t.jsx)(n.ZAr,{}),(0,t.jsx)(n.hzk,{children:(0,t.jsx)(c.J9,{initialValues:V,validationSchema:L,onSubmit:a,children:e=>{let{isSubmitting:s,dirty:a,isValid:l}=e;return(0,t.jsxs)(c.l0,{children:[(0,t.jsx)(n.xBx,{children:"Reset Password"}),(0,t.jsx)(n.olH,{}),(0,t.jsx)(n.fef,{children:(0,t.jsxs)(n.Kqy,{direction:"column",spacing:4,children:[(0,t.jsx)(n.xvT,{mb:2,children:"Choose a new password for this user."}),(0,t.jsx)(N.j0,{name:"password",label:"Password",placeholder:"********",type:"password",tooltip:"Password must contain at least 8 characters, 1 number, 1 capital letter, 1 lowercase letter, and at least 1 symbol.",autoComplete:"new-password"}),(0,t.jsx)(N.j0,{name:"passwordConfirmation",label:"Confirm Password",placeholder:"********",type:"password",tooltip:"Must match above password.",autoComplete:"confirm-password"})]})}),(0,t.jsx)(n.mzw,{children:(0,t.jsxs)("div",{className:"w-full gap-2",children:[(0,t.jsx)(n.wpx,{onClick:i,className:"w-1/2",children:"Cancel"}),(0,t.jsx)(n.wpx,{type:"primary",disabled:!a||!l,loading:s,htmlType:"submit",className:"w-1/2","data-testid":"submit-btn",children:"Change Password"})]})})]})}})})]})]})};let F=e=>{let s=(0,n.qY0)(),a=(0,n.pmc)(),[t,l]=(0,u.useState)(""),[i,r]=(0,u.useState)(""),[d,{isLoading:o}]=(0,y.ev)(),c=(0,h.useRouter)(),m=(0,D.I0)(),p=!!(e&&i&&t),x=async()=>{p&&d({id:e,old_password:t,new_password:i}).unwrap().then(()=>{a((0,w.t5)("Password updated"));try{localStorage.removeItem(Z.xH)}catch(e){}m((0,W.kS)()),s.onClose(),c.push(Z._e)})};return{...s,changePasswordValidation:p,handleChange:e=>{"oldPassword"===e.target.name?l(e.target.value):r(e.target.value)},handleChangePassword:x,isLoading:o,newPasswordValue:i,oldPasswordValue:t}};var H=e=>{let{id:s}=e,{changePasswordValidation:a,handleChange:l,handleChangePassword:i,isLoading:r,isOpen:d,newPasswordValue:o,oldPasswordValue:c,onClose:h,onOpen:u}=F(s);return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.wpx,{onClick:u,"data-testid":"update-password-btn",children:"Update password"}),(0,t.jsxs)(n.u_l,{isCentered:!0,isOpen:d,onClose:h,children:[(0,t.jsx)(n.ZAr,{}),(0,t.jsxs)(n.hzk,{children:[(0,t.jsx)(n.xBx,{children:"Update Password"}),(0,t.jsx)(n.olH,{}),(0,t.jsx)(n.fef,{pb:6,children:(0,t.jsxs)(n.Kqy,{direction:"column",spacing:"15px",children:[(0,t.jsx)(n.NIc,{children:(0,t.jsx)(n.IIB,{isRequired:!0,name:"oldPassword",onChange:l,placeholder:"Old Password",type:"password",value:c,"data-testid":"input-oldPassword"})}),(0,t.jsx)(n.NIc,{children:(0,t.jsx)(n.IIB,{isRequired:!0,name:"newPassword",onChange:l,placeholder:"New Password",type:"password",value:o,"data-testid":"input-newPassword"})})]})}),(0,t.jsxs)(n.mzw,{children:[(0,t.jsx)(n.wpx,{onClick:h,className:"mr-2 w-1/2",children:"Cancel"}),(0,t.jsx)(n.wpx,{type:"primary",disabled:!a,loading:r,onClick:i,htmlType:"submit",className:"mr-3 w-1/2","data-testid":"submit-btn",children:"Change Password"})]})]})]})]})},$=()=>{var e;let s=(0,r.C)(y.Ux),a=(0,r.C)(U.dy),l=!!a&&a.id===s,{data:i}=(0,y.gU)(null!=s?s:"",{skip:!s});return(null==i?void 0:null===(e=i.roles)||void 0===e?void 0:e.includes(d.A7.EXTERNAL_RESPONDENT))?null:(0,t.jsx)(n.xuv,{children:s?(0,t.jsxs)(n.Ugi,{children:[l?(0,t.jsx)(H,{id:s}):null,(0,t.jsx)(o.ZP,{scopes:[d.Sh.USER_PASSWORD_RESET],children:(0,t.jsx)(Y,{id:s})})]}):null})};let M=(e,s,a,t)=>!e||e&&!s||e&&s&&!0===a&&!!t,X=(e,s,a)=>!!(e&&s&&a),G=(e,s,a,t,n,l)=>!!e&&!s&&M(a,t,n,l),J=(e,s,a,t)=>M(e,s,a,t),Q={username:"",first_name:"",email_address:"",last_name:"",password:"",password_login_enabled:!1},ee=(e,s,a,t,n)=>T.Ry().shape({username:T.Z_().required().label("Username"),email_address:T.Z_().email().required().label("Email address"),first_name:T.Z_().label("First name"),last_name:T.Z_().label("Last name"),password:T.Z_().when(["password_login_enabled"],{is:l=>G(e,s,a,t,n,l),then:()=>I.a.label("Password"),otherwise:()=>T.Z_().optional().label("Password")}),password_login_enabled:T.O7().label("Allow password login")});var es=e=>{let{onSubmit:s,initialValues:a,canEditNames:l}=e,i=(0,h.useRouter)(),d=(0,n.pmc)(),o=(0,r.T)(),u=(0,n.qY0)(),{data:p}=z(),{data:x}=(0,q.qv)();(0,O.tB)({api_set:!1});let g=(0,r.C)(y.ZC),b=(0,r.C)(O.iR),{plus:v}=(0,P.hz)(),_=(null==p?void 0:p.enabled)||!1,C=(null==b?void 0:b.allow_username_password_login)||!1,S=!g,k=!S&&!l,E=x&&x.length>0||!1,R=X(v,E,C),T=null!=a?a:Q;g&&"password_login_enabled"in g&&(T={...T,password_login_enabled:!!g.password_login_enabled});let I=ee(S,_,v,E,C),U=async e=>{let a=G(S,_,v,E,C,e.password_login_enabled),t={username:e.username,email_address:e.email_address,first_name:e.first_name,last_name:e.last_name};R&&(t.password_login_enabled=e.password_login_enabled),a&&e.password&&(t.password=e.password);let n=await s(t);if((0,m.D4)(n)){d((0,w.Vo)((0,m.e$)(n.error)));return}d((0,w.t5)("".concat(S?"User created. By default, new users are set to the Viewer role. To change the role, please go to the Permissions tab.":"User updated."))),(null==n?void 0:n.data)&&o((0,y.Vv)(n.data.id))};return(0,t.jsx)(c.J9,{onSubmit:U,initialValues:T,validationSchema:I,"data-testid":"user-form",children:e=>{let{dirty:s,isSubmitting:a,isValid:l,values:r}=e;return(0,t.jsx)(c.l0,{children:(0,t.jsxs)(n.Kqy,{maxW:["xs","xs","100%"],width:"100%",spacing:7,children:[(0,t.jsxs)(n.Kqy,{spacing:6,maxWidth:"55%",children:[(0,t.jsxs)(n.kCb,{children:[(0,t.jsxs)(n.xvT,{display:"flex",alignItems:"center",fontSize:"sm",fontWeight:"semibold",children:["Profile"," ",(null==g?void 0:g.disabled)&&(0,t.jsx)(n.j8w,{color:"success",className:"ml-2","data-testid":"invite-sent-badge",children:"Invite sent"})]}),(0,t.jsx)(n.xuv,{marginLeft:"auto",children:(0,t.jsxs)(n.Ugi,{children:[J(v,E,C||!1,r.password_login_enabled)&&(0,t.jsx)($,{"data-testid":"password-management"}),S?null:(0,t.jsxs)(n.xuv,{children:[(0,t.jsx)(n.wpx,{"aria-label":"delete",icon:(0,t.jsx)(f.l,{}),onClick:u.onOpen,"data-testid":"delete-user-btn"}),(0,t.jsx)(A.Z,{user:g,...u})]})]})})]}),(0,t.jsx)(N.j0,{name:"username",label:"Username",variant:"block",placeholder:"Enter new username",disabled:!S,isRequired:!0,"data-testid":"input-username"}),(0,t.jsx)(N.j0,{name:"email_address",label:"Email address",variant:"block",placeholder:"Enter email of user",isRequired:!0,"data-testid":"input-email-address"}),(0,t.jsx)(N.j0,{name:"first_name",label:"First name",variant:"block",placeholder:"Enter first name of user",disabled:k,"data-testid":"input-first-name"}),(0,t.jsx)(N.j0,{name:"last_name",label:"Last name",variant:"block",placeholder:"Enter last name of user",disabled:k,"data-testid":"input-last-name"}),R&&(0,t.jsx)(N.w8,{name:"password_login_enabled",label:"Allow password login",tooltip:"When enabled, user can log in with username and password. When disabled, user must use SSO.",variant:"stacked",isDisabled:!S,"data-testid":"toggle-allow-password-login",size:"default"}),G(S,_,v,E,C,r.password_login_enabled)&&(0,t.jsx)(N.j0,{name:"password",label:"Password",variant:"block",placeholder:"********",type:"password",tooltip:"Password must contain at least 8 characters, 1 number, 1 capital letter, 1 lowercase letter, and at least 1 symbol.",isRequired:!0,"data-testid":"input-password"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(n.wpx,{onClick:()=>i.push(j.e3),className:"mr-3","data-testid":"cancel-btn",children:"Cancel"}),(0,t.jsx)(n.wpx,{htmlType:"submit",type:"primary",disabled:!s||!l,loading:a,"data-testid":"save-user-btn",children:"Save"})]})]})})}})},ea=e=>{let{onSubmit:s,initialValues:a,...l}=e,c=(0,r.C)(y.Ux);(0,y.Fk)(c,{skip:!c});let h=(0,o.Tg)([d.Sh.USER_PERMISSION_UPDATE]),u=!c||!h,m=[{label:"Profile",key:"profile",children:(0,t.jsx)(es,{onSubmit:s,initialValues:a,...l})},{label:"Permissions",key:"permissions",children:(0,t.jsxs)(n.kCb,{gap:"97px",children:[(0,t.jsx)(n.xuv,{w:{base:"100%",md:"50%",xl:"50%"},children:(0,t.jsx)(R,{})}),(0,t.jsx)(n.xuv,{position:"absolute",top:"96px",right:6,height:"calc(100% + 100px)",overflowY:"scroll",padding:6,w:"35%",borderLeftWidth:"1px",children:(0,t.jsx)(i,{})})]}),disabled:u,forceRender:!u}];return(0,t.jsx)(n.A5g,{items:m})}},31883:function(e,s,a){a.d(s,{Bw:function(){return t.Bw},D4:function(){return t.D4}});var t=a(19043)}}]);