ethyca-fides 2.69.0rc1__py2.py3-none-any.whl → 2.69.0rc3__py2.py3-none-any.whl

fides/_version.py

@@ -8,11 +8,11 @@ import json
 
 version_json = '''
 {
- "date": "2025-08-28T18:28:20-0700",
+ "date": "2025-08-29T09:53:24-0700",
  "dirty": false,
  "error": null,
- "full-revisionid": "af95d4c10df1e7d85a73f90bdd397b8b92c9096e",
- "version": "2.69.0rc1"
+ "full-revisionid": "f143c508f26aa8241e7b79378e76ca087c9e8487",
+ "version": "2.69.0rc3"
 }
 '''  # END VERSION_JSON
 

fides/api/api/v1/endpoints/user_endpoints.py

@@ -208,17 +208,6 @@ def update_user_password(
 
     current_user.update_password(db=db, new_password=data.new_password)
 
-    # Delete the user's associated OAuth client to invalidate all existing sessions
-    if current_user.client:
-        try:
-            current_user.client.delete(db)
-        except Exception as exc:
-            logger.exception(
-                "Unable to delete user client during password reset for user {}: {}",
-                current_user.id,
-                exc,
-            )
-
     logger.info("Updated user with id: '{}'.", current_user.id)
     return current_user
 
@@ -247,18 +236,6 @@ def force_update_password(
         )
 
     user.update_password(db=db, new_password=data.new_password)
-
-    # Delete the user's associated OAuth client to invalidate all existing sessions
-    if user.client:
-        try:
-            user.client.delete(db)
-        except Exception as exc:
-            logger.exception(
-                "Unable to delete user client during admin-forced password reset for user {}: {}",
-                user.id,
-                exc,
-            )
-
     logger.info("Updated user with id: '{}'.", user.id)
     return user
 

fides/api/models/client.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 import json
 from datetime import datetime
-from typing import TYPE_CHECKING, Any, Optional
+from typing import Any, Optional
 
 from sqlalchemy import ARRAY, Column, ForeignKey, String
 from sqlalchemy.ext.declarative import declared_attr
@@ -22,12 +22,10 @@ from fides.api.cryptography.schemas.jwt import (
     JWE_PAYLOAD_SYSTEMS,
 )
 from fides.api.db.base_class import Base
+from fides.api.models.fides_user import FidesUser
 from fides.api.oauth.jwt import generate_jwe
 from fides.config import FidesConfig
 
-if TYPE_CHECKING:
-    from fides.api.models.fides_user import FidesUser
-
 DEFAULT_SCOPES: list[str] = []
 DEFAULT_ROLES: list[str] = []
 DEFAULT_SYSTEMS: list[str] = []
@@ -50,11 +48,9 @@ class ClientDetail(Base):
         ARRAY(String), nullable=False, server_default="{}", default=dict
     )
     fides_key = Column(String, index=True, unique=True, nullable=True)
-    user_id = Column(String, ForeignKey("fidesuser.id"), nullable=True, unique=True)
-
-    if TYPE_CHECKING:
-        # Explicitly annotate the backref relationship for mypy
-        user: Optional["FidesUser"]
+    user_id = Column(
+        String, ForeignKey(FidesUser.id_field_path), nullable=True, unique=True
+    )
 
     @classmethod
     def create_client_and_secret(

fides/api/models/fides_user.py

@@ -22,7 +22,7 @@ from fides.api.cryptography.cryptographic_util import (
 from fides.api.db.base_class import Base
 from fides.api.models.audit_log import AuditLog
 
-# SystemManager import is handled in base.py to avoid circular imports
+# Intentionally importing SystemManager here to build the FidesUser.systems relationship
 from fides.api.schemas.user import DisabledReason
 from fides.config import CONFIG
 
@@ -32,6 +32,7 @@ if TYPE_CHECKING:
         FidesUserRespondentEmailVerification,
     )
     from fides.api.models.sql_models import System  # type: ignore[attr-defined]
+    from fides.api.models.system_manager import SystemManager
 
 
 class FidesUser(Base):

fides/api/oauth/utils.py

@@ -222,9 +222,7 @@ async def get_current_user(
             created_at=datetime.utcnow(),
         )
 
-    if client.user is None:
-        raise AuthorizationError(detail="Client has no associated user")
-    return client.user
+    return client.user  # type: ignore[attr-defined]
 
 
 def verify_callback_oauth_policy_pre_webhook(
@@ -369,10 +367,8 @@ def extract_token_and_load_client(
         logger.debug("Auth token expired.")
         raise AuthorizationError(detail="Not Authorized for this action")
 
-    issued_at_dt = datetime.fromisoformat(issued_at)
-
     if is_token_expired(
-        issued_at_dt,
+        datetime.fromisoformat(issued_at),
         token_duration_override or CONFIG.security.oauth_access_token_expire_minutes,
     ):
         raise AuthorizationError(detail="Not Authorized for this action")
@@ -395,21 +391,6 @@ def extract_token_and_load_client(
         logger.debug("Auth token belongs to an invalid client_id.")
         raise AuthorizationError(detail="Not Authorized for this action")
 
-    # Invalidate tokens issued prior to the user's most recent password reset.
-    # This ensures any existing sessions are expired immediately after a password change.
-    try:
-        if client.user is not None and client.user.password_reset_at is not None:
-            password_reset_at = client.user.password_reset_at
-            if password_reset_at and issued_at_dt < password_reset_at:
-                logger.debug("Auth token issued before latest password reset.")
-                raise AuthorizationError(detail="Not Authorized for this action")
-    except (
-        Exception
-    ) as exc:  # pragma: no cover - defensive: never block auth on relationship issues
-        logger.exception(
-            "Unable to evaluate password reset timestamp for client user: {}", exc
-        )
-
     # Populate request-scoped context with the authenticated user identifier.
     # Prefer the linked user_id; fall back to the client id when this is the
     # special root client (which has no associated FidesUser row).

fides/api/schemas/saas/connector_template.py

@@ -4,6 +4,8 @@ from fideslang.models import Dataset
 from pydantic import BaseModel, field_validator
 
 from fides.api.models.datasetconfig import validate_masking_strategy_override
+from fides.api.schemas.enums.connection_category import ConnectionCategory
+from fides.api.schemas.enums.integration_feature import IntegrationFeature
 from fides.api.schemas.policy import ActionType
 from fides.api.schemas.saas.saas_config import SaaSConfig
 from fides.api.util.saas_util import load_config_from_string, load_dataset_from_string
@@ -22,6 +24,9 @@ class ConnectorTemplate(BaseModel):
     authorization_required: bool
     user_guide: Optional[str] = None
     supported_actions: List[ActionType]
+    category: Optional[ConnectionCategory] = None
+    tags: Optional[List[str]] = None
+    enabled_features: Optional[List[IntegrationFeature]] = None
 
     @field_validator("config")
     @classmethod

fides/api/service/connectors/saas/connector_registry_service.py

@@ -26,6 +26,7 @@ from fides.api.service.authentication.authentication_strategy_oauth2_authorizati
 )
 from fides.api.util.saas_util import (
     encode_file_contents,
+    extract_display_info_from_config,
     load_config,
     load_config_from_string,
     load_dataset_from_string,
@@ -78,6 +79,8 @@ class FileConnectorTemplateLoader(ConnectorTemplateLoader):
                     == OAuth2AuthorizationCodeAuthenticationStrategy.name
                 )
 
+                display_info = extract_display_info_from_config(config)
+
                 try:
                     icon = encode_file_contents(f"data/saas/icon/{connector_type}.svg")
                 except FileNotFoundError:
@@ -100,6 +103,7 @@ class FileConnectorTemplateLoader(ConnectorTemplateLoader):
                         authorization_required=authorization_required,
                         user_guide=config.user_guide,
                         supported_actions=config.supported_actions,
+                        **display_info,
                     )
                 except Exception:
                     logger.exception("Unable to load {} connector", connector_type)
@@ -165,6 +169,8 @@ class CustomConnectorTemplateLoader(ConnectorTemplateLoader):
             == OAuth2AuthorizationCodeAuthenticationStrategy.name
         )
 
+        display_info = extract_display_info_from_config(config)
+
         connector_template = ConnectorTemplate(
             config=template.config,
             dataset=template.dataset,
@@ -173,6 +179,7 @@ class CustomConnectorTemplateLoader(ConnectorTemplateLoader):
             authorization_required=authorization_required,
             user_guide=config.user_guide,
             supported_actions=config.supported_actions,
+            **display_info,
         )
 
         # register the template in the loader's template dictionary

fides/api/util/connection_type.py

@@ -230,23 +230,6 @@ def get_saas_connection_types(
     for item in saas_types:
         connector_template = ConnectorRegistry.get_connector_template(item)
         if connector_template is not None:
-            # Read display info from SAAS config if available
-            category = None
-            tags = None
-            enabled_features = None
-
-            try:
-                saas_config = SaaSConfig(
-                    **load_config_from_string(connector_template.config)
-                )
-                if saas_config.display_info:
-                    category = saas_config.display_info.category
-                    tags = saas_config.display_info.tags
-                    enabled_features = saas_config.display_info.enabled_features
-            except Exception:
-                # If config parsing fails, leave display info as None
-                pass
-
             saas_connection_types.append(
                 ConnectionSystemTypeMap(
                     identifier=item,
@@ -256,9 +239,9 @@ def get_saas_connection_types(
                     authorization_required=connector_template.authorization_required,
                     user_guide=connector_template.user_guide,
                     supported_actions=connector_template.supported_actions,
-                    category=category,
-                    tags=tags,
-                    enabled_features=enabled_features,
+                    category=connector_template.category,
+                    tags=connector_template.tags,
+                    enabled_features=connector_template.enabled_features,
                 )
             )
 

fides/api/util/saas_util.py

@@ -16,7 +16,7 @@ from fides.api.common_exceptions import FidesopsException, ValidationError
 from fides.api.cryptography.cryptographic_util import bytes_to_b64_str
 from fides.api.graph.config import Collection, CollectionAddress, Field, GraphDataset
 from fides.api.models.privacy_request import PrivacyRequest
-from fides.api.schemas.saas.saas_config import SaaSRequest
+from fides.api.schemas.saas.saas_config import SaaSConfig, SaaSRequest
 from fides.api.schemas.saas.shared_schemas import SaaSRequestParams
 from fides.config import CONFIG
 from fides.config.helpers import load_file
@@ -126,6 +126,17 @@ def replace_dataset_placeholders(
     return load_dataset_from_string(yaml_str)
 
 
+def extract_display_info_from_config(config: SaaSConfig) -> Dict[str, Any]:
+    """Extract display info fields from SaaSConfig for caching in ConnectorTemplate."""
+    return {
+        "category": config.display_info.category if config.display_info else None,
+        "tags": config.display_info.tags if config.display_info else None,
+        "enabled_features": (
+            config.display_info.enabled_features if config.display_info else None
+        ),
+    }
+
+
 def load_dataset_with_replacement(
     filename: str, string_to_replace: str, replacement: str
 ) -> Dict:

fides/ui-build/static/admin/404.html

@@ -1 +1 @@
-<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width"/><meta name="next-head-count" content="2"/><link data-next-font="" rel="preconnect" href="/" crossorigin="anonymous"/><link rel="preload" href="/_next/static/css/abf2e162b1cd0e61.css" as="style"/><link rel="stylesheet" href="/_next/static/css/abf2e162b1cd0e61.css" data-n-g=""/><noscript data-n-css=""></noscript><script defer="" nomodule="" src="/_next/static/chunks/polyfills-42372ed130431b0a.js"></script><script src="/_next/static/chunks/webpack-aa7ff73977a15cb3.js" defer=""></script><script src="/_next/static/chunks/framework-c92fc3344e6fd165.js" defer=""></script><script src="/_next/static/chunks/main-090643377c8254e6.js" defer=""></script><script src="/_next/static/chunks/pages/_app-36bec04369a1a7c4.js" defer=""></script><script src="/_next/static/chunks/pages/404-fde1f56225d1ef4f.js" defer=""></script><script src="/_next/static/zEliM9juvmcu4yond1mtG/_buildManifest.js" defer=""></script><script src="/_next/static/zEliM9juvmcu4yond1mtG/_ssgManifest.js" defer=""></script><style>.data-ant-cssinjs-cache-path{content:"";}</style></head><body><div id="__next"><div style="height:100%;display:flex"></div></div><script id="__NEXT_DATA__" type="application/json">{"props":{"pageProps":{}},"page":"/404","query":{},"buildId":"zEliM9juvmcu4yond1mtG","nextExport":true,"autoExport":true,"isFallback":false,"scriptLoader":[]}</script></body></html>
+<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width"/><meta name="next-head-count" content="2"/><link data-next-font="" rel="preconnect" href="/" crossorigin="anonymous"/><link rel="preload" href="/_next/static/css/abf2e162b1cd0e61.css" as="style"/><link rel="stylesheet" href="/_next/static/css/abf2e162b1cd0e61.css" data-n-g=""/><noscript data-n-css=""></noscript><script defer="" nomodule="" src="/_next/static/chunks/polyfills-42372ed130431b0a.js"></script><script src="/_next/static/chunks/webpack-b5eb3e1da37616d2.js" defer=""></script><script src="/_next/static/chunks/framework-c92fc3344e6fd165.js" defer=""></script><script src="/_next/static/chunks/main-090643377c8254e6.js" defer=""></script><script src="/_next/static/chunks/pages/_app-11b4a4ade9d6979e.js" defer=""></script><script src="/_next/static/chunks/pages/404-9c9efb820bb6b432.js" defer=""></script><script src="/_next/static/psdvcOGkJ2TvIpb4oMjqu/_buildManifest.js" defer=""></script><script src="/_next/static/psdvcOGkJ2TvIpb4oMjqu/_ssgManifest.js" defer=""></script><style>.data-ant-cssinjs-cache-path{content:"";}</style></head><body><div id="__next"><div style="height:100%;display:flex"></div></div><script id="__NEXT_DATA__" type="application/json">{"props":{"pageProps":{}},"page":"/404","query":{},"buildId":"psdvcOGkJ2TvIpb4oMjqu","nextExport":true,"autoExport":true,"isFallback":false,"scriptLoader":[]}</script></body></html>

fides/ui-build/static/admin/_next/static/chunks/4121-bd6f467aacd80f91.js

@@ -0,0 +1 @@
+"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[4121],{44121:function(e,s,a){a.d(s,{Z:function(){return Q}});var t=a(24246),n=a(96306),i=a(91437),l=()=>(0,t.jsxs)(n.xuv,{children:[(0,t.jsx)(n.xuv,{pb:4,fontSize:"18px",fontWeight:"semibold",children:"Role Description"}),(0,t.jsx)(n.gCW,{spacing:4,children:i.K.map(e=>(0,t.jsxs)(n.xuv,{width:"100%",padding:4,borderRadius:"md",backgroundColor:"gray.75",fontSize:"14px",children:[(0,t.jsx)(n.xuv,{fontWeight:"semibold",children:e.label}),(0,t.jsx)(n.xuv,{color:"gray.700",children:e.description})]},e.roleKey))})]}),r=a(16134),d=a(54682),o=a(19904),c=a(34090),h=a(86677),m=a(27378),p=a(812),u=a(46238),x=a(58452),j=a(77830),w=a(46628),g=a(26917),b=a(1315),f=a(95492),y=a(65497);let v=e=>{let{assignedSystems:s,onAssignedSystemChange:a}=e,i=(0,r.C)(y.Ux);if((0,y.d6)(i,{skip:!i}),0===s.length)return null;let l=e=>{a(s.filter(s=>s.fides_key!==e.fides_key))};return(0,t.jsxs)(n.iA_,{size:"sm","data-testid":"assign-systems-delete-table",children:[(0,t.jsx)(n.hrZ,{children:(0,t.jsxs)(n.Tr,{children:[(0,t.jsx)(n.Th,{children:"System"}),(0,t.jsx)(n.Th,{})]})}),(0,t.jsx)(n.p3B,{children:s.map(e=>(0,t.jsxs)(n.Tr,{_hover:{bg:"gray.50"},"data-testid":"row-".concat(e.fides_key),children:[(0,t.jsx)(n.Td,{children:e.name}),(0,t.jsx)(n.Td,{textAlign:"end",children:(0,t.jsx)(n.wpx,{"aria-label":"Unassign system from user",icon:(0,t.jsx)(f.l,{}),onClick:()=>l(e),"data-testid":"unassign-btn"})})]},e.fides_key))})]})};var _=e=>{let{allSystems:s,assignedSystems:a,onChange:i}=e,l=e=>{a.find(s=>s.fides_key===e.fides_key)?i(a.filter(s=>s.fides_key!==e.fides_key)):i([...a,e])};return(0,t.jsx)(n.xuv,{overflowY:"auto",maxHeight:"300px",children:(0,t.jsxs)(n.iA_,{size:"sm","data-testid":"assign-systems-table",maxHeight:"50vh",overflowY:"scroll",children:[(0,t.jsx)(n.hrZ,{position:"sticky",top:0,background:"white",zIndex:1,children:(0,t.jsxs)(n.Tr,{children:[(0,t.jsx)(n.Th,{children:"System"}),(0,t.jsx)(n.Th,{children:"Assign"})]})}),(0,t.jsx)(n.p3B,{children:s.map(e=>{let s=!!a.find(s=>s.fides_key===e.fides_key);return(0,t.jsxs)(n.Tr,{_hover:{bg:"gray.50"},"data-testid":"row-".concat(e.fides_key),children:[(0,t.jsx)(n.Td,{children:e.name}),(0,t.jsx)(n.Td,{children:(0,t.jsx)(n.rAg,{checked:s,onChange:()=>l(e),"data-testid":"assign-switch"})})]},e.fides_key)})})]})})};let C=(e,s)=>{var a,t;return(null===(a=e.name)||void 0===a?void 0:a.toLocaleLowerCase().includes(s.toLocaleLowerCase()))||(null===(t=e.description)||void 0===t?void 0:t.toLocaleLowerCase().includes(s.toLocaleLowerCase()))};var S=e=>{let{isOpen:s,onClose:a,assignedSystems:i,onAssignedSystemChange:l}=e,{data:r}=(0,b.K3)(),[d,o]=(0,m.useState)(""),[c,h]=(0,m.useState)(i),p=async()=>{l(c),a()},u=!r||0===r.length,x=(0,m.useMemo)(()=>r?r.filter(e=>C(e,d)):[],[r,d]),j=(0,m.useMemo)(()=>{let e=new Set(c.map(e=>e.fides_key));return x.every(s=>e.has(s.fides_key))},[x,c]);return(0,t.jsxs)(n.u_l,{isOpen:s,onClose:a,size:"2xl",children:[(0,t.jsx)(n.ZAr,{}),(0,t.jsxs)(n.hzk,{p:8,"data-testid":"confirmation-modal",children:[(0,t.jsxs)(n.xBx,{fontWeight:"medium",display:"flex",justifyContent:"space-between",alignItems:"center",children:[(0,t.jsx)(n.xvT,{children:"Assign systems"}),(0,t.jsxs)(n.j8w,{color:"success",children:["Assigned to ",i.length," systems"]})]}),(0,t.jsx)(n.fef,{"data-testid":"assign-systems-modal-body",children:u?(0,t.jsx)(n.xvT,{children:"No systems found"}):(0,t.jsxs)(n.Kqy,{spacing:4,children:[(0,t.jsxs)(n.kCb,{justifyContent:"space-between",children:[(0,t.jsx)(n.xvT,{fontSize:"sm",flexGrow:1,fontWeight:"medium",children:"Assign systems in your organization to this user"}),(0,t.jsx)(n.xuv,{children:(0,t.jsxs)(n.NIc,{display:"flex",alignItems:"center",children:[(0,t.jsx)(n.lXp,{fontSize:"sm",htmlFor:"assign-all-systems",mb:"0",children:"Assign all systems"}),(0,t.jsx)(n.rAg,{size:"small",id:"assign-all-systems",checked:j,onChange:e=>{e&&r?h(x):h(r?r.filter(e=>!x.includes(e)):[])},"data-testid":"assign-all-systems-toggle"})]})})]}),(0,t.jsx)(g.Z,{value:d,onChange:o,placeholder:"Search for systems","data-testid":"system-search",withIcon:!0}),(0,t.jsx)(_,{allSystems:x,assignedSystems:c,onChange:h})]})}),(0,t.jsx)(n.mzw,{justifyContent:"flex-start",children:(0,t.jsxs)("div",{children:[(0,t.jsx)(n.wpx,{onClick:a,className:"mr-2","data-testid":"cancel-btn",children:"Cancel"}),u?null:(0,t.jsx)(n.wpx,{type:"primary",onClick:p,"data-testid":"confirm-btn",children:"Confirm"})]})})]})]})},k=e=>{let{label:s,roleKey:a,isSelected:i,isDisabled:l,assignedSystems:r,onAssignedSystemChange:o}=e,{setFieldValue:h}=(0,c.u6)(),m=(0,n.qY0)(),p=l?"You do not have sufficient permissions to assign this role.":void 0;return i?(0,t.jsxs)(n.Kqy,{borderRadius:"md",border:"1px solid",borderColor:"gray.200",p:4,backgroundColor:"gray.50","aria-selected":"true",spacing:4,"data-testid":"selected",children:[(0,t.jsxs)(n.kCb,{alignItems:"center",justifyContent:"space-between",children:[(0,t.jsx)(n.xvT,{fontSize:"md",fontWeight:"semibold",children:s}),(0,t.jsx)(n.StI,{})]}),a!==d.A7.APPROVER&&a!==d.A7.RESPONDENT&&a!==d.A7.EXTERNAL_RESPONDENT?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)(n.kCb,{alignItems:"center",children:[(0,t.jsx)(n.xvT,{fontSize:"sm",fontWeight:"semibold",mr:1,children:"Assigned systems"}),(0,t.jsx)(u.b,{label:"Assigned systems refer to those systems that have been specifically allocated to a user for management purposes. Users assigned to a system possess full edit permissions and are listed as the Data Steward for the respective system."})]}),(0,t.jsx)(n.wpx,{disabled:l,title:p,type:"primary",size:"small",onClick:m.onOpen,"data-testid":"assign-systems-btn",children:"Assign systems +"}),(0,t.jsx)(v,{assignedSystems:r,onAssignedSystemChange:o}),m.isOpen?(0,t.jsx)(S,{isOpen:m.isOpen,onClose:m.onClose,assignedSystems:r,onAssignedSystemChange:o}):null]}):null]}):(0,t.jsx)(n.wpx,{onClick:()=>{h("roles",[a])},"data-testid":"role-option-".concat(s),title:p,disabled:l,children:s})};let E={roles:[]};var A=()=>{var e,s;let a=(0,n.pmc)(),l=(0,h.useRouter)(),g=(0,r.C)(y.Ux);(0,y.d6)(g,{skip:!g});let{isOpen:b,onOpen:f,onClose:v}=(0,n.qY0)(),_=(0,r.C)(y.R$),[C,S]=(0,m.useState)(_),[A]=(0,y.G$)();(0,m.useEffect)(()=>{S(_)},[_]);let{data:T,isLoading:P}=(0,y.gU)(null!=g?g:"",{skip:!g}),[R]=(0,y.lD)(),N=!!(null==T?void 0:null===(e=T.roles)||void 0===e?void 0:e.includes(d.A7.EXTERNAL_RESPONDENT)),O=async e=>{if(b&&v(),!g)return;let s=e.roles.includes(d.A7.APPROVER),t=await R({user_id:g,payload:{roles:e.roles}});if((0,p.D4)(t)){a((0,w.Vo)((0,p.e$)(t.error)));return}if(!s){let e=C.map(e=>e.fides_key),s=await A({userId:g,fidesKeys:e});if((0,p.D4)(s)){a((0,w.Vo)((0,p.e$)(s.error)));return}}a((0,w.t5)("Permissions updated"))},I=async e=>{g&&(C.length>0&&e.roles.includes(d.A7.APPROVER)?f():await O(e))},z=(0,o.Tg)([d.Sh.USER_PERMISSION_ASSIGN_OWNERS]);if(!g)return null;if(P)return(0,t.jsx)(n.$jN,{});if(!z&&(null==T?void 0:null===(s=T.roles)||void 0===s?void 0:s.includes(d.A7.OWNER)))return(0,t.jsx)(n.xvT,{"data-testid":"insufficient-access",children:"You do not have sufficient access to change this user's permissions."});let q=(null==T?void 0:T.roles)?{roles:T.roles}:E,U=i.K.filter(e=>N?e.roleKey===d.A7.EXTERNAL_RESPONDENT:e.roleKey!==d.A7.EXTERNAL_RESPONDENT),D=N?"External respondent role cannot be changed":void 0;return(0,t.jsx)(c.J9,{onSubmit:I,initialValues:q,enableReinitialize:!0,children:e=>{let{values:s,isSubmitting:a,dirty:i}=e;return(0,t.jsxs)(c.l0,{children:[(0,t.jsxs)(n.Kqy,{spacing:7,children:[(0,t.jsxs)(n.Kqy,{spacing:3,"data-testid":"role-options",children:[(0,t.jsxs)(n.kCb,{alignItems:"center",children:[(0,t.jsx)(n.xvT,{fontSize:"sm",fontWeight:"semibold",mr:1,children:"User role"}),(0,t.jsx)(u.b,{label:"A user's role in the organization determines what parts of the UI they can access and which functions are available to them."})]}),U.map(e=>{let a=s.roles.indexOf(e.roleKey)>=0,n=e.roleKey===d.A7.OWNER?!z:N;return(0,t.jsx)(k,{isSelected:a,isDisabled:n,assignedSystems:C,onAssignedSystemChange:S,...e},e.roleKey)}),!N&&(0,t.jsx)(n.esZ,{title:"To invite a new External respondent user, create a manual task integration and then click on the 'Manage secure access' button",children:(0,t.jsx)(n.wpx,{disabled:!0,"data-testid":"role-option-External respondent",children:"External respondent"})})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(n.wpx,{onClick:()=>l.push(j.e3),children:"Cancel"}),(0,t.jsx)(n.esZ,{title:D,children:(0,t.jsx)(n.wpx,{className:"ml-2",type:"primary",htmlType:"submit",loading:a,disabled:!i&&C===_||N,"data-testid":"save-btn",children:"Save"})})]})]}),(0,t.jsx)(x.Z,{isOpen:b,onClose:v,onConfirm:()=>O(s),title:"Change role to Approver",testId:"downgrade-to-approver-confirmation-modal",continueButtonText:"Yes",message:(0,t.jsx)(n.xvT,{children:"Switching to an approver role will remove all assigned systems. Do you wish to proceed?"})})]})}})},T=a(61038),P=a(55484),R=a(25980),N=a(40324),O=a(96006),I=a(7426);let{useGetEmailInviteStatusQuery:z}=a(78780).u.injectEndpoints({endpoints:e=>({getEmailInviteStatus:e.query({query:()=>({url:"/messaging/email-invite/status"}),providesTags:()=>["Email Invite Status"]})})});var q=a(76174),U=a(91317),D=a(31883);let Z=P.Ry().shape({password:O.a.label("Password"),passwordConfirmation:P.Z_().required().oneOf([P.iH("password")],"Passwords must match").label("Password confirmation")}),W={password:"",passwordConfirmation:""},K=e=>{let s=(0,n.qY0)(),a=(0,n.pmc)(),[t]=(0,y.ls)(),i=async n=>{let i=await t({id:e,new_password:n.password});(0,D.D4)(i)?a((0,w.Vo)((0,p.e$)(i.error))):(a((0,w.t5)("Successfully reset user's password. Please inform the user of their new password.")),s.onClose())};return{...s,handleResetPassword:i}};var L=e=>{let{id:s}=e,{handleResetPassword:a,isOpen:i,onClose:l,onOpen:r}=K(s);return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.wpx,{onClick:r,"data-testid":"reset-password-btn",children:"Reset password"}),(0,t.jsxs)(n.u_l,{isCentered:!0,isOpen:i,onClose:l,children:[(0,t.jsx)(n.ZAr,{}),(0,t.jsx)(n.hzk,{children:(0,t.jsx)(c.J9,{initialValues:W,validationSchema:Z,onSubmit:a,children:e=>{let{isSubmitting:s,dirty:a,isValid:i}=e;return(0,t.jsxs)(c.l0,{children:[(0,t.jsx)(n.xBx,{children:"Reset Password"}),(0,t.jsx)(n.olH,{}),(0,t.jsx)(n.fef,{children:(0,t.jsxs)(n.Kqy,{direction:"column",spacing:4,children:[(0,t.jsx)(n.xvT,{mb:2,children:"Choose a new password for this user."}),(0,t.jsx)(N.j0,{name:"password",label:"Password",placeholder:"********",type:"password",tooltip:"Password must contain at least 8 characters, 1 number, 1 capital letter, 1 lowercase letter, and at least 1 symbol.",autoComplete:"new-password"}),(0,t.jsx)(N.j0,{name:"passwordConfirmation",label:"Confirm Password",placeholder:"********",type:"password",tooltip:"Must match above password.",autoComplete:"confirm-password"})]})}),(0,t.jsx)(n.mzw,{children:(0,t.jsxs)("div",{className:"w-full gap-2",children:[(0,t.jsx)(n.wpx,{onClick:l,className:"w-1/2",children:"Cancel"}),(0,t.jsx)(n.wpx,{type:"primary",disabled:!a||!i,loading:s,htmlType:"submit",className:"w-1/2","data-testid":"submit-btn",children:"Change Password"})]})})]})}})})]})]})};let V=e=>{let s=(0,n.qY0)(),a=(0,n.pmc)(),[t,i]=(0,m.useState)(""),[l,r]=(0,m.useState)(""),[d,{isLoading:o}]=(0,y.ev)(),c=!!(e&&l&&t),h=async()=>{c&&d({id:e,old_password:t,new_password:l}).unwrap().then(()=>{a((0,w.t5)("Password updated")),s.onClose()})};return{...s,changePasswordValidation:c,handleChange:e=>{"oldPassword"===e.target.name?i(e.target.value):r(e.target.value)},handleChangePassword:h,isLoading:o,newPasswordValue:l,oldPasswordValue:t}};var B=e=>{let{id:s}=e,{changePasswordValidation:a,handleChange:i,handleChangePassword:l,isLoading:r,isOpen:d,newPasswordValue:o,oldPasswordValue:c,onClose:h,onOpen:m}=V(s);return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.wpx,{onClick:m,"data-testid":"update-password-btn",children:"Update password"}),(0,t.jsxs)(n.u_l,{isCentered:!0,isOpen:d,onClose:h,children:[(0,t.jsx)(n.ZAr,{}),(0,t.jsxs)(n.hzk,{children:[(0,t.jsx)(n.xBx,{children:"Update Password"}),(0,t.jsx)(n.olH,{}),(0,t.jsx)(n.fef,{pb:6,children:(0,t.jsxs)(n.Kqy,{direction:"column",spacing:"15px",children:[(0,t.jsx)(n.NIc,{children:(0,t.jsx)(n.IIB,{isRequired:!0,name:"oldPassword",onChange:i,placeholder:"Old Password",type:"password",value:c,"data-testid":"input-oldPassword"})}),(0,t.jsx)(n.NIc,{children:(0,t.jsx)(n.IIB,{isRequired:!0,name:"newPassword",onChange:i,placeholder:"New Password",type:"password",value:o,"data-testid":"input-newPassword"})})]})}),(0,t.jsxs)(n.mzw,{children:[(0,t.jsx)(n.wpx,{onClick:h,className:"mr-2 w-1/2",children:"Cancel"}),(0,t.jsx)(n.wpx,{type:"primary",disabled:!a,loading:r,onClick:l,htmlType:"submit",className:"mr-3 w-1/2","data-testid":"submit-btn",children:"Change Password"})]})]})]})]})},Y=()=>{var e;let s=(0,r.C)(y.Ux),a=(0,r.C)(U.dy),i=!!a&&a.id===s,{data:l}=(0,y.gU)(null!=s?s:"",{skip:!s});return(null==l?void 0:null===(e=l.roles)||void 0===e?void 0:e.includes(d.A7.EXTERNAL_RESPONDENT))?null:(0,t.jsx)(n.xuv,{children:s?(0,t.jsxs)(n.Ugi,{children:[i?(0,t.jsx)(B,{id:s}):null,(0,t.jsx)(o.ZP,{scopes:[d.Sh.USER_PASSWORD_RESET],children:(0,t.jsx)(L,{id:s})})]}):null})};let F=(e,s,a,t)=>!e||e&&!s||e&&s&&!0===a&&!!t,$=(e,s,a)=>!!(e&&s&&a),M=(e,s,a,t,n,i)=>!!e&&!s&&F(a,t,n,i),X=(e,s,a,t)=>F(e,s,a,t),H={username:"",first_name:"",email_address:"",last_name:"",password:"",password_login_enabled:!1},G=(e,s,a,t,n)=>P.Ry().shape({username:P.Z_().required().label("Username"),email_address:P.Z_().email().required().label("Email address"),first_name:P.Z_().label("First name"),last_name:P.Z_().label("Last name"),password:P.Z_().when(["password_login_enabled"],{is:i=>M(e,s,a,t,n,i),then:()=>O.a.label("Password"),otherwise:()=>P.Z_().optional().label("Password")}),password_login_enabled:P.O7().label("Allow password login")});var J=e=>{let{onSubmit:s,initialValues:a,canEditNames:i}=e,l=(0,h.useRouter)(),d=(0,n.pmc)(),o=(0,r.T)(),m=(0,n.qY0)(),{data:u}=z(),{data:x}=(0,q.qv)();(0,I.tB)({api_set:!1});let g=(0,r.C)(y.ZC),b=(0,r.C)(I.iR),{plus:v}=(0,R.hz)(),_=(null==u?void 0:u.enabled)||!1,C=(null==b?void 0:b.allow_username_password_login)||!1,S=!g,k=!S&&!i,E=x&&x.length>0||!1,A=$(v,E,C),P=null!=a?a:H;g&&"password_login_enabled"in g&&(P={...P,password_login_enabled:!!g.password_login_enabled});let O=G(S,_,v,E,C),U=async e=>{let a=M(S,_,v,E,C,e.password_login_enabled),t={username:e.username,email_address:e.email_address,first_name:e.first_name,last_name:e.last_name};A&&(t.password_login_enabled=e.password_login_enabled),a&&e.password&&(t.password=e.password);let n=await s(t);if((0,p.D4)(n)){d((0,w.Vo)((0,p.e$)(n.error)));return}d((0,w.t5)("".concat(S?"User created. By default, new users are set to the Viewer role. To change the role, please go to the Permissions tab.":"User updated."))),(null==n?void 0:n.data)&&o((0,y.Vv)(n.data.id))};return(0,t.jsx)(c.J9,{onSubmit:U,initialValues:P,validationSchema:O,"data-testid":"user-form",children:e=>{let{dirty:s,isSubmitting:a,isValid:i,values:r}=e;return(0,t.jsx)(c.l0,{children:(0,t.jsxs)(n.Kqy,{maxW:["xs","xs","100%"],width:"100%",spacing:7,children:[(0,t.jsxs)(n.Kqy,{spacing:6,maxWidth:"55%",children:[(0,t.jsxs)(n.kCb,{children:[(0,t.jsxs)(n.xvT,{display:"flex",alignItems:"center",fontSize:"sm",fontWeight:"semibold",children:["Profile"," ",(null==g?void 0:g.disabled)&&(0,t.jsx)(n.j8w,{color:"success",className:"ml-2","data-testid":"invite-sent-badge",children:"Invite sent"})]}),(0,t.jsx)(n.xuv,{marginLeft:"auto",children:(0,t.jsxs)(n.Ugi,{children:[X(v,E,C||!1,r.password_login_enabled)&&(0,t.jsx)(Y,{"data-testid":"password-management"}),S?null:(0,t.jsxs)(n.xuv,{children:[(0,t.jsx)(n.wpx,{"aria-label":"delete",icon:(0,t.jsx)(f.l,{}),onClick:m.onOpen,"data-testid":"delete-user-btn"}),(0,t.jsx)(T.Z,{user:g,...m})]})]})})]}),(0,t.jsx)(N.j0,{name:"username",label:"Username",variant:"block",placeholder:"Enter new username",disabled:!S,isRequired:!0,"data-testid":"input-username"}),(0,t.jsx)(N.j0,{name:"email_address",label:"Email address",variant:"block",placeholder:"Enter email of user",isRequired:!0,"data-testid":"input-email-address"}),(0,t.jsx)(N.j0,{name:"first_name",label:"First name",variant:"block",placeholder:"Enter first name of user",disabled:k,"data-testid":"input-first-name"}),(0,t.jsx)(N.j0,{name:"last_name",label:"Last name",variant:"block",placeholder:"Enter last name of user",disabled:k,"data-testid":"input-last-name"}),A&&(0,t.jsx)(N.w8,{name:"password_login_enabled",label:"Allow password login",tooltip:"When enabled, user can log in with username and password. When disabled, user must use SSO.",variant:"stacked",isDisabled:!S,"data-testid":"toggle-allow-password-login",size:"default"}),M(S,_,v,E,C,r.password_login_enabled)&&(0,t.jsx)(N.j0,{name:"password",label:"Password",variant:"block",placeholder:"********",type:"password",tooltip:"Password must contain at least 8 characters, 1 number, 1 capital letter, 1 lowercase letter, and at least 1 symbol.",isRequired:!0,"data-testid":"input-password"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(n.wpx,{onClick:()=>l.push(j.e3),className:"mr-3","data-testid":"cancel-btn",children:"Cancel"}),(0,t.jsx)(n.wpx,{htmlType:"submit",type:"primary",disabled:!s||!i,loading:a,"data-testid":"save-user-btn",children:"Save"})]})]})})}})},Q=e=>{let{onSubmit:s,initialValues:a,...i}=e,c=(0,r.C)(y.Ux);(0,y.Fk)(c,{skip:!c});let h=(0,o.Tg)([d.Sh.USER_PERMISSION_UPDATE]),m=!c||!h,p=[{label:"Profile",key:"profile",children:(0,t.jsx)(J,{onSubmit:s,initialValues:a,...i})},{label:"Permissions",key:"permissions",children:(0,t.jsxs)(n.kCb,{gap:"97px",children:[(0,t.jsx)(n.xuv,{w:{base:"100%",md:"50%",xl:"50%"},children:(0,t.jsx)(A,{})}),(0,t.jsx)(n.xuv,{position:"absolute",top:"96px",right:6,height:"calc(100% + 100px)",overflowY:"scroll",padding:6,w:"35%",borderLeftWidth:"1px",children:(0,t.jsx)(l,{})})]}),disabled:m,forceRender:!m}];return(0,t.jsx)(n.A5g,{items:p})}},31883:function(e,s,a){a.d(s,{Bw:function(){return t.Bw},D4:function(){return t.D4}});var t=a(19043)}}]);