ethyca-fides 2.69.1rc0__py2.py3-none-any.whl → 2.76.0rc2__py2.py3-none-any.whl

fides/api/api/v1/endpoints/storage_endpoints.py

@@ -95,7 +95,11 @@ def upload_data(
     """
     logger.info("Finding privacy request with id '{}'", request_id)
 
-    privacy_request = PrivacyRequest.get(db, object_id=request_id)
+    privacy_request = (
+        PrivacyRequest.query_without_large_columns(db)
+        .filter(PrivacyRequest.id == request_id)
+        .first()
+    )
     if not privacy_request:
         raise HTTPException(
             status_code=HTTP_404_NOT_FOUND,

fides/api/api/v1/endpoints/system.py

@@ -1,29 +1,27 @@
-import datetime
-from typing import Annotated, Dict, List, Optional, Union
+from typing import Annotated, Dict, List, Literal, Optional, Union
 
 from fastapi import Depends, HTTPException, Query, Response, Security
 from fastapi_pagination import Page, Params
 from fastapi_pagination.bases import AbstractPage
-from fastapi_pagination.ext.async_sqlalchemy import paginate as async_paginate
 from fastapi_pagination.ext.sqlalchemy import paginate
 from fideslang.models import System as SystemSchema
 from fideslang.validation import FidesKey
 from loguru import logger
 from pydantic import Field
-from sqlalchemy import or_
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.future import select
 from sqlalchemy.orm import Session
 from starlette import status
-from starlette.status import HTTP_200_OK, HTTP_204_NO_CONTENT, HTTP_404_NOT_FOUND
+from starlette.status import (
+    HTTP_200_OK,
+    HTTP_204_NO_CONTENT,
+    HTTP_400_BAD_REQUEST,
+    HTTP_404_NOT_FOUND,
+)
 
 from fides.api.api import deps
 from fides.api.api.v1.endpoints.saas_config_endpoints import instantiate_connection
-from fides.api.db.crud import (
-    get_resource,
-    get_resource_with_custom_fields,
-    list_resource,
-)
+from fides.api.db.crud import get_resource, get_resource_with_custom_fields
 from fides.api.db.ctl_session import get_async_db
 from fides.api.db.system import (
     create_system,
@@ -32,12 +30,10 @@ from fides.api.db.system import (
     upsert_system,
     validate_privacy_declarations,
 )
-from fides.api.models.connectionconfig import ConnectionConfig, ConnectionType
+from fides.api.models.connectionconfig import ConnectionConfig
 from fides.api.models.fides_user import FidesUser
-from fides.api.models.sql_models import (  # type:ignore[attr-defined]
-    PrivacyDeclaration,
-    System,
-)
+from fides.api.models.sql_models import System  # type:ignore[attr-defined]
+from fides.api.oauth.roles import APPROVER
 from fides.api.oauth.system_manager_oauth_util import (
     verify_oauth_client_for_system_from_fides_key,
     verify_oauth_client_for_system_from_request_body_cli,
@@ -56,17 +52,18 @@ from fides.api.schemas.connection_configuration.connection_secrets import (
 from fides.api.schemas.connection_configuration.saas_config_template_values import (
     SaasConnectionTemplateValues,
 )
-from fides.api.schemas.filter_params import FilterParams
-from fides.api.schemas.system import BasicSystemResponse, SystemResponse
+from fides.api.schemas.system import (
+    AssignStewardRequest,
+    BasicSystemResponse,
+    SystemResponse,
+)
+from fides.api.service.deps import get_connection_service, get_system_service
 from fides.api.util.api_router import APIRouter
 from fides.api.util.connection_util import (
-    connection_status,
     delete_connection_config,
-    get_connection_config_or_error,
     patch_connection_configs,
-    validate_secrets,
+    update_connection_secrets,
 )
-from fides.api.util.filter_utils import apply_filters_to_query
 from fides.common.api.scope_registry import (
     CONNECTION_CREATE_OR_UPDATE,
     CONNECTION_DELETE,
@@ -82,6 +79,8 @@ from fides.common.api.v1.urn_registry import (
     SYSTEM_CONNECTIONS,
     V1_URL_PREFIX,
 )
+from fides.service.connection.connection_service import ConnectionService
+from fides.service.system.system_service import SystemService
 
 SYSTEM_ROUTER = APIRouter(tags=["System"], prefix=f"{V1_URL_PREFIX}/system")
 SYSTEM_CONNECTIONS_ROUTER = APIRouter(
@@ -160,6 +159,7 @@ def patch_connection_secrets(
     db: Session = Depends(deps.get_db),
     unvalidated_secrets: connection_secrets_schemas,
     verify: Optional[bool] = True,
+    connection_service: ConnectionService = Depends(get_connection_service),
 ) -> TestStatusMessage:
     """
     Patch secrets that will be used to connect to a specified connection_type.
@@ -169,45 +169,13 @@ def patch_connection_secrets(
     """
 
     system = get_system(db, fides_key)
-    connection_config: ConnectionConfig = get_connection_config_or_error(
-        db, system.connection_configs.key
+    return update_connection_secrets(
+        connection_service,
+        system.connection_configs.key,
+        unvalidated_secrets,
+        verify,
+        merge_with_existing=True,
     )
-    # Inserts unchanged sensitive values. The FE does not send masked values sensitive secrets.
-    if connection_config.secrets is not None:
-        for key, value in connection_config.secrets.items():
-            if key not in unvalidated_secrets:
-                # unvalidated_secrets is actually a dictionary here.  connection_secrets_schemas
-                # are just provided for documentation but the data was not parsed up front.
-                # That happens below in validate_secrets.
-                unvalidated_secrets[key] = value  # type: ignore
-    else:
-        connection_config.secrets = {}
-
-    validated_secrets = validate_secrets(
-        db, unvalidated_secrets, connection_config
-    ).model_dump(mode="json")
-
-    for key, value in validated_secrets.items():
-        connection_config.secrets[key] = value  # type: ignore
-
-    # Deauthorize an OAuth connection when the secrets are updated. This is necessary because
-    # the existing access tokens may not be valid anymore. This only applies to SaaS connection
-    # configurations that use the "oauth2_authorization_code" authentication strategy.
-    if (
-        connection_config.authorized
-        and connection_config.connection_type == ConnectionType.saas
-    ):
-        del connection_config.secrets["access_token"]
-
-    # Save validated secrets, regardless of whether they've been verified.
-    logger.info("Updating connection config secrets for '{}'", connection_config.key)
-    connection_config.save(db=db)
-
-    msg = f"Secrets updated for ConnectionConfig with key: {connection_config.key}."
-    if verify:
-        return connection_status(connection_config, msg, db)
-
-    return TestStatusMessage(msg=msg, test_status=None)
 
 
 @SYSTEM_CONNECTIONS_ROUTER.delete(
@@ -349,6 +317,123 @@ async def delete(
     }
 
 
+@SYSTEM_ROUTER.post(
+    "/bulk-delete",
+    dependencies=[
+        Security(
+            verify_oauth_client_prod,
+            scopes=[SYSTEM_DELETE],
+        )
+    ],
+    status_code=status.HTTP_200_OK,
+)
+async def system_bulk_delete(
+    fides_keys: List[str],
+    db: AsyncSession = Depends(get_async_db),
+) -> Dict:
+    """Delete multiple systems by their fides_keys."""
+
+    deleted: List[Dict] = []
+
+    async with db.begin():
+        # Retrieve all systems within the same transactional context
+        stmt = select(System).filter(System.fides_key.in_(fides_keys))
+        result = await db.execute(stmt)
+        systems_to_delete = result.scalars().all()
+
+        for system in systems_to_delete:
+            await db.delete(system)
+            deleted.append(SystemSchema.model_validate(system).model_dump(mode="json"))
+
+    return {
+        "message": f"Deleted {len(deleted)} system(s)",
+        "deleted": deleted,
+    }
+
+
+@SYSTEM_ROUTER.post(
+    "/assign-steward",
+    dependencies=[
+        Security(
+            verify_oauth_client_prod,
+            scopes=[SYSTEM_UPDATE],
+        )
+    ],
+)
+async def bulk_assign_steward(
+    data: AssignStewardRequest,
+    db: Session = Depends(deps.get_db),
+) -> Dict:
+    """Assign the given `data_steward` (username) as a system manager for the list of `system_keys`.
+
+    This mirrors the behavior of the user permissions endpoint that assigns systems to a given user but
+    from the perspective of the System API. It validates that:
+
+    1. The provided user exists.
+    2. The user already has permissions (cannot be None).
+    3. The user is not an approver (approvers are explicitly disallowed from being system managers).
+    4. All provided `system_keys` resolve to existing System records.
+    5. There are no duplicate keys in the payload.
+    """
+
+    data_steward = data.data_steward
+    system_keys = data.system_keys
+
+    user: Optional[FidesUser] = FidesUser.get_by(
+        db, field="username", value=data_steward
+    )
+    if not user:
+        raise HTTPException(
+            status_code=HTTP_404_NOT_FOUND,
+            detail=f"No user found with username {data_steward}.",
+        )
+
+    # Validate user has permissions assigned
+    if not (user.permissions and user.permissions.roles):  # type: ignore[attr-defined]
+        raise HTTPException(
+            status_code=HTTP_400_BAD_REQUEST,
+            detail=f"User {data_steward} needs permissions before they can be assigned as system manager.",
+        )
+
+    # Approvers are not allowed to be system managers
+    if APPROVER in user.permissions.roles:  # type: ignore[attr-defined]
+        raise HTTPException(
+            status_code=HTTP_400_BAD_REQUEST,
+            detail=f"User {data_steward} is an {APPROVER} and cannot be assigned as a system manager.",
+        )
+
+    # Check for duplicate system keys
+    if len(set(system_keys)) != len(system_keys):
+        raise HTTPException(
+            status_code=HTTP_400_BAD_REQUEST,
+            detail=f"Cannot add user {data_steward} as system manager. Duplicate systems in request body.",
+        )
+
+    # Retrieve systems and validate existence
+    systems_query = db.query(System).filter(System.fides_key.in_(system_keys))
+    if systems_query.count() != len(system_keys):
+        raise HTTPException(
+            status_code=HTTP_404_NOT_FOUND,
+            detail=f"Cannot add user {data_steward} as system manager. System(s) not found.",
+        )
+
+    systems = systems_query.all()
+
+    logger.info(
+        "Assigning user {} as data steward for {} systems", data_steward, len(systems)
+    )
+
+    updated_count = 0
+    for system in systems:
+        if user not in system.data_stewards:
+            user.set_as_system_manager(db, system)
+            updated_count += 1
+
+    return {
+        "message": f"User {data_steward} assigned as data steward to {updated_count} system(s)",
+    }
+
+
 @SYSTEM_ROUTER.post(
     "/",
     response_model=SystemResponse,
@@ -384,62 +469,34 @@ async def create(
     name="List systems (optionally paginated)",
 )
 async def ls(  # pylint: disable=invalid-name
-    db: AsyncSession = Depends(get_async_db),
+    system_service: SystemService = Depends(get_system_service),
     size: Optional[int] = Query(None, ge=1, le=100),
     page: Optional[int] = Query(None, ge=1),
     search: Optional[str] = None,
     data_uses: Optional[List[FidesKey]] = Query(None),
     data_categories: Optional[List[FidesKey]] = Query(None),
     data_subjects: Optional[List[FidesKey]] = Query(None),
-    show_deleted: Optional[bool] = Query(False),
-) -> List:
+    show_deleted: bool = Query(False),
+    sort_by: Optional[List[Literal["name"]]] = Query(None),
+    sort_asc: Optional[bool] = Query(True),
+) -> Union[List[System], Page[System]]:
     """Get a list of all of the Systems.
     If any parameters or filters are provided the response will be paginated and/or filtered.
     Otherwise all Systems will be returned (this may be a slow operation if there are many systems,
     so using the pagination parameters is recommended).
     """
-    if not (size or page or search or data_uses or data_categories or data_subjects):
-        # if no advanced parameters are passed, we return a very basic list of all System resources
-        # to maintain backward compatibility of the original API, which backs some important client usages, e.g. the fides CLI
 
-        return await list_resource(System, db)
-
-    query = select(System)
-
-    pagination_params = Params(page=page or 1, size=size or 50)
-    # Need to join with PrivacyDeclaration in order to be able to filter
-    # by data use, data category, and data subject
-    if any([data_uses, data_categories, data_subjects]):
-        query = query.outerjoin(
-            PrivacyDeclaration, System.id == PrivacyDeclaration.system_id
-        )
-
-    # Filter out any vendor deleted systems, unless explicitly asked for
-    if not show_deleted:
-        query = query.filter(
-            or_(
-                System.vendor_deleted_date.is_(None),
-                System.vendor_deleted_date >= datetime.datetime.now(),
-            )
-        )
-
-    filter_params = FilterParams(
+    return await system_service.get_systems(
         search=search,
         data_uses=data_uses,
         data_categories=data_categories,
         data_subjects=data_subjects,
+        size=size,
+        page=page,
+        show_deleted=show_deleted,
+        sort_by=sort_by,
+        sort_asc=sort_asc,
     )
-    filtered_query = apply_filters_to_query(
-        query=query,
-        filter_params=filter_params,
-        search_model=System,
-        taxonomy_model=PrivacyDeclaration,
-    )
-
-    # Add a distinct so we only get one row per system
-    duplicates_removed = filtered_query.distinct(System.id)
-
-    return await async_paginate(db, duplicates_removed, pagination_params)
 
 
 @SYSTEM_ROUTER.patch(
@@ -500,7 +557,7 @@ async def get(
 )
 def instantiate_connection_from_template(
     fides_key: str,
-    saas_connector_type: str,
+    connector_template_type: str,
     template_values: SaasConnectionTemplateValues,
     db: Session = Depends(deps.get_db),
 ) -> SaasConnectionTemplateResponse:
@@ -510,4 +567,4 @@ def instantiate_connection_from_template(
     """
 
     system = get_system(db, fides_key)
-    return instantiate_connection(db, saas_connector_type, template_values, system)
+    return instantiate_connection(db, connector_template_type, template_values, system)

fides/api/api/v1/endpoints/user_endpoints.py

@@ -36,7 +36,7 @@ from fides.api.models.fides_user import FidesUser
 from fides.api.models.fides_user_invite import FidesUserInvite
 from fides.api.models.fides_user_permissions import FidesUserPermissions
 from fides.api.models.sql_models import System  # type: ignore[attr-defined]
-from fides.api.oauth.roles import APPROVER, VIEWER
+from fides.api.oauth.roles import APPROVER, EXTERNAL_RESPONDENT, VIEWER
 from fides.api.oauth.utils import (
     create_temporary_user_for_login_flow,
     extract_payload,
@@ -117,7 +117,7 @@ def verify_user_read_scopes(
     db: Session = Depends(get_db),
 ) -> ClientDetail:
     """
-    Custom dependency that verifies the user has either USER_READ or USER_READ_OWN scope.
+    Custom dependency that verifies the user has either user:read or user:read-own scope.
     Returns the client if authorized.
     """
     token_data, client = extract_token_and_load_client(authorization, db)
@@ -159,7 +159,7 @@ async def update_user(
 ) -> FidesUser:
     """
     Update a user given a `user_id`. If the user is not updating their own data,
-    they need the USER_UPDATE scope
+    they need the user:update scope
     """
     user = FidesUser.get(db=db, object_id=user_id)
     if not user:
@@ -571,7 +571,7 @@ def get_user(
     client: ClientDetail = Security(verify_user_read_scopes),
     authorization: str = Security(oauth2_scheme),
 ) -> FidesUser:
-    """Returns a User based on an Id. Users with USER_READ_OWN scope can only access their own data."""
+    """Returns a User based on an Id. Users with user:read-own scope can only access their own data. Users with user:read can access other's data."""
     user: Optional[FidesUser] = FidesUser.get_by_key_or_id(db, data={"id": user_id})
     if user is None:
         raise HTTPException(status_code=HTTP_404_NOT_FOUND, detail="User not found")
@@ -608,6 +608,8 @@ def get_users(
     db: Session = Depends(get_db),
     params: Params = Depends(),
     username: Optional[str] = None,
+    include_external: bool = True,
+    exclude_approvers: bool = False,
     client: ClientDetail = Security(verify_user_read_scopes),
     authorization: str = Security(oauth2_scheme),
 ) -> AbstractPage[FidesUser]:
@@ -625,6 +627,17 @@ def get_users(
         # User has USER_READ scope, can see all users
         if username:
             query = query.filter(FidesUser.username.ilike(f"%{escape_like(username)}%"))
+
+        # Filter out external respondents if include_external is False
+        # Filter out approvers if exclude_approvers is True
+        if not include_external or exclude_approvers:
+            query = query.join(FidesUserPermissions)
+            if not include_external:
+                query = query.filter(
+                    ~FidesUserPermissions.roles.op("@>")([EXTERNAL_RESPONDENT])
+                )
+            if exclude_approvers:
+                query = query.filter(~FidesUserPermissions.roles.op("@>")([APPROVER]))
     else:
         # User has USER_READ_OWN scope, only show their own data
         query = query.filter(FidesUser.id == client.user_id)

fides/api/app_setup.py

@@ -39,9 +39,6 @@ from fides.api.oauth.system_manager_oauth_util import (
     verify_oauth_client_for_system_from_request_body_cli,
 )
 from fides.api.oauth.utils import get_root_client, verify_oauth_client_prod
-from fides.api.service.connectors.saas.connector_registry_service import (
-    update_saas_configs,
-)
 
 # pylint: disable=wildcard-import, unused-wildcard-import
 from fides.api.service.saas_request.override_implementations import *
@@ -55,6 +52,7 @@ from fides.api.util.rate_limit import (
     fides_limiter,
     is_rate_limit_enabled,
 )
+from fides.api.util.saas_config_updater import update_saas_configs
 from fides.config import CONFIG
 from fides.config.config_proxy import ConfigProxy
 

fides/api/common_exceptions.py

@@ -179,6 +179,10 @@ class AwaitingAsyncTask(BaseException):
     """Request Task is Awaiting Processing - Awaiting Async Task"""
 
 
+class AwaitingAsyncProcessing(BaseException):
+    """Request Task is actively being processed by external system - Fides is polling"""
+
+
 class UpstreamTasksNotReady(BaseException):
     """Privacy Request Task awaiting upstream tasks"""
 
@@ -402,3 +406,7 @@ class MonitorConfigNotFoundException(BaseException):
 
 class MissingNamespaceSchemaException(BaseException):
     """Attempting to use namespace fides_meta without specifying the schema to validate it."""
+
+
+class ConnectionNotFoundException(BaseException):
+    """ConnectionConfig could not be found"""

fides/api/db/base.py

@@ -9,6 +9,7 @@ from fides.api.models.audit_log import AuditLog
 from fides.api.models.authentication_request import AuthenticationRequest
 from fides.api.models.client import ClientDetail
 from fides.api.models.comment import Comment, CommentReference
+from fides.api.models.connection_oauth_credentials import OAuthConfig
 from fides.api.models.connectionconfig import ConnectionConfig
 from fides.api.models.consent_automation import ConsentAutomation
 from fides.api.models.custom_asset import CustomAsset
@@ -21,6 +22,9 @@ from fides.api.models.detection_discovery.monitor_task import (
     MonitorTask,
     MonitorTaskExecutionLog,
 )
+from fides.api.models.detection_discovery.web_monitor import WebMonitorGroupJob
+from fides.api.models.digest import DigestCondition, DigestConfig
+from fides.api.models.event_audit import EventAudit
 from fides.api.models.experience_notices import ExperienceNotices
 from fides.api.models.fides_cloud import FidesCloud
 from fides.api.models.fides_user import FidesUser
@@ -29,6 +33,7 @@ from fides.api.models.fides_user_permissions import FidesUserPermissions
 from fides.api.models.fides_user_respondent_email_verification import (
     FidesUserRespondentEmailVerification,
 )
+from fides.api.models.identity_definition import IdentityDefinition
 from fides.api.models.identity_salt import IdentitySalt
 from fides.api.models.location_regulation_selections import LocationRegulationSelections
 from fides.api.models.manual_task import (
@@ -75,8 +80,10 @@ from fides.api.models.property import (
     Property,
 )
 from fides.api.models.registration import UserRegistration
+from fides.api.models.saas_template_dataset import SaasTemplateDataset
 from fides.api.models.storage import StorageConfig
 from fides.api.models.system_compass_sync import SystemCompassSync
+from fides.api.models.system_group import SystemGroup, SystemGroupMember
 from fides.api.models.system_history import SystemHistory
 from fides.api.models.system_manager import SystemManager
 from fides.api.models.taxonomy import (
@@ -90,3 +97,4 @@ from fides.api.models.tcf_publisher_restrictions import (
     TCFPublisherRestriction,
 )
 from fides.api.models.tcf_purpose_overrides import TCFPurposeOverride
+from fides.api.models.v3.privacy_preferences import PrivacyPreferences

fides/api/db/crud.py

@@ -1,6 +1,6 @@
 """
-Contains all of the generic CRUD endpoints that can be
-generated programmatically for each resource.
+DEPRECATED: This module uses manual transaction handling which can
+lead to unexpected behavior. Use fides.api.db.safe_crud instead.
 """
 
 from collections import defaultdict
@@ -18,6 +18,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.future import select
 from sqlalchemy.sql import Select
 from starlette.status import HTTP_422_UNPROCESSABLE_ENTITY
+from typing_extensions import deprecated
 
 from fides.api.models.sql_models import (  # type: ignore[attr-defined]
     CustomField,
@@ -32,6 +33,9 @@ T = TypeVar("T", bound="FidesBase")
 
 
 # CRUD Functions
+@deprecated(
+    "This function uses a manual session.begin() which can lead to unexpected transaction handling. Use create_resource from safe_crud instead."
+)
 async def create_resource(
     sql_model: Type[T], resource_dict: Dict, async_session: AsyncSession
 ) -> T:
@@ -66,6 +70,9 @@ async def create_resource(
         return await get_resource(sql_model, resource_dict["fides_key"], async_session)
 
 
+@deprecated(
+    "This function uses manual session.begin() which can lead to unexpected transaction handling. Use get_custom_fields_filtered from safe_crud instead."
+)
 async def get_custom_fields_filtered(
     async_session: AsyncSession,
     resource_types_to_ids: Dict[ResourceTypes, List[str]] = defaultdict(list),
@@ -111,6 +118,9 @@ async def get_custom_fields_filtered(
                 raise sa_error
 
 
+@deprecated(
+    "This function uses manual session.begin() which can lead to unexpected transaction handling. Use get_resource from safe_crud instead."
+)
 async def get_resource(
     sql_model: Type[T],
     fides_key: str,
@@ -142,6 +152,9 @@ async def get_resource(
             return sql_resource
 
 
+@deprecated(
+    "This function uses manual session.begin() which can lead to unexpected transaction handling. Use get_resource_with_custom_fields from safe_crud instead."
+)
 async def get_resource_with_custom_fields(
     sql_model: Type[T], fides_key: str, async_session: AsyncSession
 ) -> Dict[str, Any]:
@@ -193,6 +206,9 @@ async def get_resource_with_custom_fields(
     return resource_dict
 
 
+@deprecated(
+    "This function uses manual session.begin() which can lead to unexpected transaction handling. Use list_resource from safe_crud instead."
+)
 async def list_resource(sql_model: Type[T], async_session: AsyncSession) -> List[T]:
     """
     Get a list of all of the resources of this type from the database.
@@ -203,6 +219,9 @@ async def list_resource(sql_model: Type[T], async_session: AsyncSession) -> List
     return await list_resource_query(async_session, query, sql_model)
 
 
+@deprecated(
+    "This function uses manual session.begin() which can lead to unexpected transaction handling. Use list_resource_query from safe_crud instead."
+)
 async def list_resource_query(
     async_session: AsyncSession, query: Select, sql_model: Type[T]
 ) -> List[T]:
@@ -225,6 +244,9 @@ async def list_resource_query(
             return sql_resources
 
 
+@deprecated(
+    "This function uses manual session.begin() which can lead to unexpected transaction handling. Use update_resource from safe_crud instead."
+)
 async def update_resource(
     sql_model: Type[T], resource_dict: Dict, async_session: AsyncSession
 ) -> Dict:
@@ -251,6 +273,9 @@ async def update_resource(
         return await get_resource(sql_model, resource_dict["fides_key"], async_session)
 
 
+@deprecated(
+    "This function uses manual session.begin() which can lead to unexpected transaction handling. Use upsert_resources from safe_crud instead."
+)
 async def upsert_resources(
     sql_model: Type[T], resource_dicts: List[Dict], async_session: AsyncSession
 ) -> Tuple[int, int]:
@@ -300,6 +325,9 @@ async def upsert_resources(
                 raise sa_error
 
 
+@deprecated(
+    "This function uses manual session.begin() which can lead to unexpected transaction handling. Use delete_resource from safe_crud instead."
+)
 async def delete_resource(
     sql_model: Type[T], fides_key: str, async_session: AsyncSession
 ) -> T: