ethyca-fides 2.71.2b0__py2.py3-none-any.whl → 2.72.0rc0__py2.py3-none-any.whl

fides/_version.py

@@ -8,11 +8,11 @@ import json
 
 version_json = '''
 {
- "date": "2025-10-03T09:34:20-0700",
+ "date": "2025-10-09T10:22:06-0400",
  "dirty": false,
  "error": null,
- "full-revisionid": "521a48a9c7dbc813d08cf2053f318328912e86b6",
- "version": "2.71.2b0"
+ "full-revisionid": "575604a24ea4839fcb584f4d7fc920dd0471d024",
+ "version": "2.72.0rc0"
 }
 '''  # END VERSION_JSON
 

fides/api/alembic/migrations/versions/4bfbeff34611_add_polling_status.py

@@ -17,19 +17,52 @@ depends_on = None
 
 
 def upgrade():
-    # Check if value already exists
-    connection = op.get_bind()
-    result = connection.execute(
-        sa.text(
-            "SELECT 1 FROM pg_enum WHERE enumlabel = 'polling' "
-            "AND enumtypid = (SELECT oid FROM pg_type WHERE typname = 'executionlogstatus')"
-        )
+    op.execute("ALTER TYPE executionlogstatus ADD VALUE 'polling'")
+
+
+def downgrade():
+    # Remove any records that have the 'polling' enum value before dropping it
+    # Fallback to 'paused' (awaiting_processing) for backward compatibility
+
+    op.execute("UPDATE requesttask SET status = 'paused' WHERE status = 'polling'")
+    op.execute("UPDATE executionlog SET status = 'paused' WHERE status = 'polling'")
+    op.execute(
+        "UPDATE digest_task_execution SET status = 'paused' WHERE status = 'polling'"
+    )
+    op.execute("UPDATE monitortask SET status = 'paused' WHERE status = 'polling'")
+    op.execute(
+        "UPDATE monitortaskexecutionlog SET status = 'paused' WHERE status = 'polling'"
     )
 
-    if not result.fetchone():
-        op.execute("ALTER TYPE executionlogstatus ADD VALUE 'polling'")
+    # Recreate the enum without the 'polling' value
+    op.execute("ALTER TYPE executionlogstatus RENAME TO executionlogstatus_old")
+    op.execute(
+        "CREATE TYPE executionlogstatus AS ENUM ("
+        "'in_processing', 'pending', 'complete', 'error', 'paused', 'retrying', 'skipped'"
+        ")"
+    )
 
+    # Update all tables that use the enum type
+    op.execute(
+        "ALTER TABLE requesttask ALTER COLUMN status TYPE executionlogstatus USING "
+        "status::text::executionlogstatus"
+    )
+    op.execute(
+        "ALTER TABLE executionlog ALTER COLUMN status TYPE executionlogstatus USING "
+        "status::text::executionlogstatus"
+    )
+    op.execute(
+        "ALTER TABLE digest_task_execution ALTER COLUMN status TYPE executionlogstatus USING "
+        "status::text::executionlogstatus"
+    )
+    op.execute(
+        "ALTER TABLE monitortask ALTER COLUMN status TYPE executionlogstatus USING "
+        "status::text::executionlogstatus"
+    )
+    op.execute(
+        "ALTER TABLE monitortaskexecutionlog ALTER COLUMN status TYPE executionlogstatus USING "
+        "status::text::executionlogstatus"
+    )
 
-def downgrade():
-    # The 'polling' value will remain in the enum but won't be used by older app versions
-    pass
+    # Drop the old enum type
+    op.execute("DROP TYPE executionlogstatus_old")

fides/api/api/v1/endpoints/connection_endpoints.py

@@ -24,6 +24,7 @@ from starlette.status import (
 from fides.api.api import deps
 from fides.api.models.connection_oauth_credentials import OAuthConfig
 from fides.api.models.connectionconfig import ConnectionConfig, ConnectionType
+from fides.api.models.event_audit import EventAuditType
 from fides.api.oauth.utils import verify_oauth_client
 from fides.api.schemas.connection_configuration import connection_secrets_schemas
 from fides.api.schemas.connection_configuration.connection_config import (
@@ -40,13 +41,14 @@ from fides.api.schemas.connection_configuration.connection_secrets import (
 )
 from fides.api.schemas.connection_configuration.enums.system_type import SystemType
 from fides.api.schemas.connection_configuration.enums.test_status import TestStatus
+from fides.api.service.deps import get_connection_service
 from fides.api.util.api_router import APIRouter
 from fides.api.util.connection_util import (
     connection_status,
     delete_connection_config,
     get_connection_config_or_error,
     patch_connection_configs,
-    validate_secrets,
+    update_connection_secrets,
 )
 from fides.common.api.scope_registry import (
     CONNECTION_CREATE_OR_UPDATE,
@@ -61,6 +63,8 @@ from fides.common.api.v1.urn_registry import (
     CONNECTIONS,
     V1_URL_PREFIX,
 )
+from fides.service.connection.connection_service import ConnectionService
+from fides.service.event_audit_service import EventAuditService
 
 router = APIRouter(tags=["Connections"], prefix=V1_URL_PREFIX)
 
@@ -220,28 +224,6 @@ def delete_connection(
     delete_connection_config(db, connection_key)
 
 
-def validate_and_update_secrets(
-    connection_key: FidesKey,
-    connection_config: ConnectionConfig,
-    db: Session,
-    unvalidated_secrets: connection_secrets_schemas,
-    verify: Optional[bool],
-) -> TestStatusMessage:
-    connection_config.secrets = validate_secrets(
-        db, unvalidated_secrets, connection_config
-    ).model_dump(mode="json")
-    # Save validated secrets, regardless of whether they've been verified.
-    logger.info("Updating connection config secrets for '{}'", connection_key)
-    connection_config.save(db=db)
-
-    msg = f"Secrets updated for ConnectionConfig with key: {connection_key}."
-
-    if verify:
-        return connection_status(connection_config, msg, db)
-
-    return TestStatusMessage(msg=msg, test_status=None)
-
-
 @router.put(
     CONNECTION_SECRETS,
     status_code=HTTP_200_OK,
@@ -251,7 +233,7 @@ def validate_and_update_secrets(
 def put_connection_config_secrets(
     connection_key: FidesKey,
     *,
-    db: Session = Depends(deps.get_db),
+    connection_service: ConnectionService = Depends(get_connection_service),
     unvalidated_secrets: connection_secrets_schemas,
     verify: Optional[bool] = True,
 ) -> TestStatusMessage:
@@ -261,10 +243,8 @@ def put_connection_config_secrets(
     The specific secrets will be connection-dependent. For example, the components needed to connect to a Postgres DB
     will differ from Dynamo DB.
     """
-    connection_config = get_connection_config_or_error(db, connection_key)
-
-    return validate_and_update_secrets(
-        connection_key, connection_config, db, unvalidated_secrets, verify
+    return update_connection_secrets(
+        connection_service, connection_key, unvalidated_secrets, verify
     )
 
 
@@ -277,7 +257,7 @@ def put_connection_config_secrets(
 def patch_connection_config_secrets(
     connection_key: FidesKey,
     *,
-    db: Session = Depends(deps.get_db),
+    connection_service: ConnectionService = Depends(get_connection_service),
     unvalidated_secrets: connection_secrets_schemas,
     verify: Optional[bool] = True,
 ) -> TestStatusMessage:
@@ -287,22 +267,12 @@ def patch_connection_config_secrets(
     The specific secrets will be connection-dependent. For example, the components needed to connect to a Postgres DB
     will differ from Dynamo DB.
     """
-    connection_config = get_connection_config_or_error(db, connection_key)
-
-    existing_secrets: Optional[Dict[str, Any]] = connection_config.secrets
-
-    # We create the new secrets object by combining the existing secrets with the new secrets.
-    patched_secrets = {}
-    if existing_secrets:
-        patched_secrets = {**existing_secrets}
-
-    patched_secrets = {
-        **patched_secrets,
-        **unvalidated_secrets,  # type: ignore[dict-item]
-    }
-
-    return validate_and_update_secrets(
-        connection_key, connection_config, db, patched_secrets, verify  # type: ignore[arg-type]
+    return update_connection_secrets(
+        connection_service,
+        connection_key,
+        unvalidated_secrets,
+        verify,
+        merge_with_existing=True,
     )
 
 
@@ -354,6 +324,16 @@ def put_connection_oauth_config(
     )
     connection_config.save(db=db)
 
+    event_audit_service = EventAuditService(db)
+    connection_service = ConnectionService(db, event_audit_service)
+
+    # Create secrets audit event for OAuth credential changes
+    connection_service.create_secrets_audit_event(
+        EventAuditType.connection_secrets_updated,
+        connection_config,
+        oauth_config.model_dump(exclude_unset=True),  # The OAuth secrets being updated
+    )
+
     msg = (
         f"OAuth2 configuration updated for ConnectionConfig with key: {connection_key}."
     )
@@ -455,6 +435,19 @@ def patch_connection_oauth_config(
             detail="Invalid OAuth2 configuration.",
         ) from exc
 
+    # Create audit event for OAuth config update (OAuth credentials are secrets)
+    event_audit_service = EventAuditService(db)
+    connection_service = ConnectionService(db, event_audit_service)
+
+    # Create secrets audit event for OAuth credential changes
+    connection_service.create_secrets_audit_event(
+        EventAuditType.connection_secrets_updated,
+        connection_config,
+        validated_config.model_dump(
+            exclude_unset=True
+        ),  # The OAuth secrets being updated
+    )
+
     msg = (
         f"OAuth2 configuration updated for ConnectionConfig with key: {connection_key}."
     )

fides/api/api/v1/endpoints/saas_config_endpoints.py

@@ -3,10 +3,12 @@ from typing import Optional
 from zipfile import BadZipFile, ZipFile
 
 from fastapi import Body, Depends, HTTPException, Request
+from fastapi.encoders import jsonable_encoder
 from fastapi.params import Security
 from fastapi.responses import JSONResponse
 from fideslang.validation import FidesKey
 from loguru import logger
+from pydantic import ValidationError
 from sqlalchemy.orm import Session
 from starlette.status import (
     HTTP_200_OK,
@@ -18,9 +20,15 @@ from starlette.status import (
 )
 
 from fides.api.api import deps
-from fides.api.common_exceptions import FidesopsException, KeyOrNameAlreadyExists
+from fides.api.common_exceptions import (
+    FidesopsException,
+    KeyOrNameAlreadyExists,
+    SaaSConfigNotFoundException,
+)
+from fides.api.common_exceptions import ValidationError as FidesValidationError
 from fides.api.models.connectionconfig import ConnectionConfig, ConnectionType
 from fides.api.models.datasetconfig import DatasetConfig
+from fides.api.models.event_audit import EventAuditStatus, EventAuditType
 from fides.api.models.sql_models import System  # type: ignore
 from fides.api.oauth.utils import verify_oauth_client
 from fides.api.schemas.connection_configuration.connection_config import (
@@ -29,7 +37,6 @@ from fides.api.schemas.connection_configuration.connection_config import (
 from fides.api.schemas.connection_configuration.saas_config_template_values import (
     SaasConnectionTemplateValues,
 )
-from fides.api.schemas.saas.connector_template import ConnectorTemplate
 from fides.api.schemas.saas.saas_config import (
     SaaSConfig,
     SaaSConfigValidationDetails,
@@ -42,13 +49,11 @@ from fides.api.service.authentication.authentication_strategy_oauth2_authorizati
     OAuth2AuthorizationCodeAuthenticationStrategy,
 )
 from fides.api.service.connectors.saas.connector_registry_service import (
-    ConnectorRegistry,
     CustomConnectorTemplateLoader,
-    create_connection_config_from_template_no_save,
-    upsert_dataset_config_from_template,
 )
 from fides.api.util.api_router import APIRouter
-from fides.api.util.connection_util import validate_secrets
+from fides.api.util.connection_util import validate_secrets_error_message
+from fides.api.util.event_audit_util import generate_connection_audit_event_details
 from fides.common.api.scope_registry import (
     CONNECTION_AUTHORIZE,
     CONNECTOR_TEMPLATE_REGISTER,
@@ -59,13 +64,17 @@ from fides.common.api.scope_registry import (
 )
 from fides.common.api.v1.urn_registry import (
     AUTHORIZE,
-    CONNECTION_TYPES,
     REGISTER_CONNECTOR_TEMPLATE,
     SAAS_CONFIG,
     SAAS_CONFIG_VALIDATE,
     SAAS_CONNECTOR_FROM_TEMPLATE,
     V1_URL_PREFIX,
 )
+from fides.service.connection.connection_service import (
+    ConnectionService,
+    ConnectorTemplateNotFound,
+)
+from fides.service.event_audit_service import EventAuditService
 
 router = APIRouter(tags=["SaaS Configs"], prefix=V1_URL_PREFIX)
 
@@ -168,12 +177,29 @@ def patch_saas_config(
     Given a SaaS config element, update the corresponding ConnectionConfig object
     or report failure
     """
+
     logger.info(
         "Updating SaaS config '{}' on connection config '{}'",
         saas_config.fides_key,
         connection_config.key,
     )
     connection_config.update_saas_config(db, saas_config=saas_config)
+
+    # Create audit event for SaaS config update
+    event_audit_service = EventAuditService(db)
+    event_details, description = generate_connection_audit_event_details(
+        EventAuditType.connection_updated,
+        connection_config=connection_config,
+    )
+    event_audit_service.create_event_audit(
+        event_type=EventAuditType.connection_updated,
+        status=EventAuditStatus.succeeded,
+        resource_type="connection_config",
+        resource_identifier=connection_config.key,
+        description=description,
+        event_details=event_details,
+    )
+
     return connection_config.saas_config  # type: ignore
 
 
@@ -305,59 +331,45 @@ def instantiate_connection(
     Looks up the connector type in the SaaS connector registry and, if all required
     fields are provided, persists the associated connection config and dataset to the database.
     """
-    connector_template: Optional[ConnectorTemplate] = (
-        ConnectorRegistry.get_connector_template(saas_connector_type)
-    )
-    if not connector_template:
-        raise HTTPException(
-            status_code=HTTP_404_NOT_FOUND,
-            detail=f"SaaS connector type '{saas_connector_type}' is not yet available in Fidesops. For a list of available SaaS connectors, refer to {CONNECTION_TYPES}.",
+    event_audit_service = EventAuditService(db)
+    connection_service = ConnectionService(db, event_audit_service)
+    try:
+        connection_config, dataset_config = connection_service.instantiate_connection(
+            saas_connector_type, template_values, system
         )
-
-    if DatasetConfig.filter(
-        db=db,
-        conditions=(DatasetConfig.fides_key == template_values.instance_key),  # type: ignore[arg-type]
-    ).count():
+    except ConnectorTemplateNotFound as exc:
         raise HTTPException(
-            status_code=HTTP_400_BAD_REQUEST,
-            detail=f"SaaS connector instance key '{template_values.instance_key}' already exists.",
-        )
-
-    try:
-        connection_config: ConnectionConfig = (
-            create_connection_config_from_template_no_save(
-                db, connector_template, template_values
-            )
+            status_code=HTTP_404_NOT_FOUND,
+            detail=f"{exc.args[0]}",
         )
     except KeyOrNameAlreadyExists as exc:
         raise HTTPException(
             status_code=HTTP_400_BAD_REQUEST,
             detail=exc.args[0],
         )
-
-    connection_config.secrets = validate_secrets(
-        db, template_values.secrets, connection_config
-    ).model_dump(mode="json")
-    if system:
-        connection_config.system_id = system.id
-    connection_config.save(db=db)  # Not persisted to db until secrets are validated
-
-    try:
-        dataset_config: DatasetConfig = upsert_dataset_config_from_template(
-            db, connection_config, connector_template, template_values
+    except SaaSConfigNotFoundException:
+        raise HTTPException(
+            status_code=HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=validate_secrets_error_message(),
         )
-    except Exception:
-        connection_config.delete(db)
+    except FidesValidationError as e:
+        # Check if the exception has the original pydantic errors attached
+        raise HTTPException(status_code=HTTP_422_UNPROCESSABLE_ENTITY, detail=e.message)
+    except ValidationError as e:
+        errors = e.errors(include_url=False, include_input=False)
+        for err in errors:
+            # Additionally, manually remove the context from the error message -
+            # this may contain sensitive information
+            err.pop("ctx", None)
+        raise HTTPException(
+            status_code=HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=jsonable_encoder(errors),
+        )
+    except Exception as exc:
         raise HTTPException(
             status_code=HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f"SaaS Connector could not be created from the '{saas_connector_type}' template at this time.",
+            detail=f"{exc.args[0]}",
         )
-    logger.info(
-        "SaaS Connector and Dataset {} successfully created from '{}' template.",
-        template_values.instance_key,
-        saas_connector_type,
-    )
-
     return SaasConnectionTemplateResponse(
         connection=connection_config, dataset=dataset_config.ctl_dataset
     )

fides/api/api/v1/endpoints/system.py

@@ -30,7 +30,7 @@ from fides.api.db.system import (
     upsert_system,
     validate_privacy_declarations,
 )
-from fides.api.models.connectionconfig import ConnectionConfig, ConnectionType
+from fides.api.models.connectionconfig import ConnectionConfig
 from fides.api.models.fides_user import FidesUser
 from fides.api.models.sql_models import System  # type:ignore[attr-defined]
 from fides.api.oauth.roles import APPROVER
@@ -57,14 +57,12 @@ from fides.api.schemas.system import (
     BasicSystemResponse,
     SystemResponse,
 )
-from fides.api.service.deps import get_system_service
+from fides.api.service.deps import get_connection_service, get_system_service
 from fides.api.util.api_router import APIRouter
 from fides.api.util.connection_util import (
-    connection_status,
     delete_connection_config,
-    get_connection_config_or_error,
     patch_connection_configs,
-    validate_secrets,
+    update_connection_secrets,
 )
 from fides.common.api.scope_registry import (
     CONNECTION_CREATE_OR_UPDATE,
@@ -81,6 +79,7 @@ from fides.common.api.v1.urn_registry import (
     SYSTEM_CONNECTIONS,
     V1_URL_PREFIX,
 )
+from fides.service.connection.connection_service import ConnectionService
 from fides.service.system.system_service import SystemService
 
 SYSTEM_ROUTER = APIRouter(tags=["System"], prefix=f"{V1_URL_PREFIX}/system")
@@ -160,6 +159,7 @@ def patch_connection_secrets(
     db: Session = Depends(deps.get_db),
     unvalidated_secrets: connection_secrets_schemas,
     verify: Optional[bool] = True,
+    connection_service: ConnectionService = Depends(get_connection_service),
 ) -> TestStatusMessage:
     """
     Patch secrets that will be used to connect to a specified connection_type.
@@ -169,45 +169,13 @@ def patch_connection_secrets(
     """
 
     system = get_system(db, fides_key)
-    connection_config: ConnectionConfig = get_connection_config_or_error(
-        db, system.connection_configs.key
+    return update_connection_secrets(
+        connection_service,
+        system.connection_configs.key,
+        unvalidated_secrets,
+        verify,
+        merge_with_existing=True,
     )
-    # Inserts unchanged sensitive values. The FE does not send masked values sensitive secrets.
-    if connection_config.secrets is not None:
-        for key, value in connection_config.secrets.items():
-            if key not in unvalidated_secrets:
-                # unvalidated_secrets is actually a dictionary here.  connection_secrets_schemas
-                # are just provided for documentation but the data was not parsed up front.
-                # That happens below in validate_secrets.
-                unvalidated_secrets[key] = value  # type: ignore
-    else:
-        connection_config.secrets = {}
-
-    validated_secrets = validate_secrets(
-        db, unvalidated_secrets, connection_config
-    ).model_dump(mode="json")
-
-    for key, value in validated_secrets.items():
-        connection_config.secrets[key] = value  # type: ignore
-
-    # Deauthorize an OAuth connection when the secrets are updated. This is necessary because
-    # the existing access tokens may not be valid anymore. This only applies to SaaS connection
-    # configurations that use the "oauth2_authorization_code" authentication strategy.
-    if (
-        connection_config.authorized
-        and connection_config.connection_type == ConnectionType.saas
-    ):
-        del connection_config.secrets["access_token"]
-
-    # Save validated secrets, regardless of whether they've been verified.
-    logger.info("Updating connection config secrets for '{}'", connection_config.key)
-    connection_config.save(db=db)
-
-    msg = f"Secrets updated for ConnectionConfig with key: {connection_config.key}."
-    if verify:
-        return connection_status(connection_config, msg, db)
-
-    return TestStatusMessage(msg=msg, test_status=None)
 
 
 @SYSTEM_CONNECTIONS_ROUTER.delete(

fides/api/api/v1/endpoints/user_endpoints.py

@@ -36,7 +36,7 @@ from fides.api.models.fides_user import FidesUser
 from fides.api.models.fides_user_invite import FidesUserInvite
 from fides.api.models.fides_user_permissions import FidesUserPermissions
 from fides.api.models.sql_models import System  # type: ignore[attr-defined]
-from fides.api.oauth.roles import APPROVER, VIEWER
+from fides.api.oauth.roles import APPROVER, EXTERNAL_RESPONDENT, VIEWER
 from fides.api.oauth.utils import (
     create_temporary_user_for_login_flow,
     extract_payload,
@@ -608,6 +608,7 @@ def get_users(
     db: Session = Depends(get_db),
     params: Params = Depends(),
     username: Optional[str] = None,
+    include_external: bool = True,
     client: ClientDetail = Security(verify_user_read_scopes),
     authorization: str = Security(oauth2_scheme),
 ) -> AbstractPage[FidesUser]:
@@ -625,6 +626,12 @@ def get_users(
         # User has USER_READ scope, can see all users
         if username:
             query = query.filter(FidesUser.username.ilike(f"%{escape_like(username)}%"))
+
+        # Filter out external respondents if include_external is False
+        if not include_external:
+            query = query.join(FidesUserPermissions).filter(
+                ~FidesUserPermissions.roles.op("@>")([EXTERNAL_RESPONDENT])
+            )
     else:
         # User has USER_READ_OWN scope, only show their own data
         query = query.filter(FidesUser.id == client.user_id)

fides/api/app_setup.py

@@ -39,9 +39,6 @@ from fides.api.oauth.system_manager_oauth_util import (
     verify_oauth_client_for_system_from_request_body_cli,
 )
 from fides.api.oauth.utils import get_root_client, verify_oauth_client_prod
-from fides.api.service.connectors.saas.connector_registry_service import (
-    update_saas_configs,
-)
 
 # pylint: disable=wildcard-import, unused-wildcard-import
 from fides.api.service.saas_request.override_implementations import *
@@ -55,6 +52,7 @@ from fides.api.util.rate_limit import (
     fides_limiter,
     is_rate_limit_enabled,
 )
+from fides.api.util.saas_config_updater import update_saas_configs
 from fides.config import CONFIG
 from fides.config.config_proxy import ConfigProxy
 

fides/api/common_exceptions.py

@@ -406,3 +406,7 @@ class MonitorConfigNotFoundException(BaseException):
 
 class MissingNamespaceSchemaException(BaseException):
     """Attempting to use namespace fides_meta without specifying the schema to validate it."""
+
+
+class ConnectionNotFoundException(BaseException):
+    """ConnectionConfig could not be found"""

fides/api/email_templates/get_email_template.py

@@ -9,6 +9,7 @@ from fides.api.email_templates.template_names import (
     CONSENT_REQUEST_VERIFICATION_TEMPLATE,
     EMAIL_ERASURE_REQUEST_FULFILLMENT,
     EXTERNAL_USER_WELCOME,
+    MANUAL_TASK_DIGEST,
     PRIVACY_REQUEST_COMPLETE_ACCESS_TEMPLATE,
     PRIVACY_REQUEST_COMPLETE_DELETION_TEMPLATE,
     PRIVACY_REQUEST_ERROR_NOTIFICATION_TEMPLATE,
@@ -59,6 +60,8 @@ def get_email_template(  # pylint: disable=too-many-return-statements, too-many-
         return template_env.get_template(USER_INVITE)
     if action_type == MessagingActionType.EXTERNAL_USER_WELCOME:
         return template_env.get_template(EXTERNAL_USER_WELCOME)
+    if action_type == MessagingActionType.MANUAL_TASK_DIGEST:
+        return template_env.get_template(MANUAL_TASK_DIGEST)
 
     logger.error("No corresponding template linked to the {}", action_type)
     raise EmailTemplateUnhandledActionType(

fides/api/email_templates/template_names.py

@@ -11,3 +11,4 @@ PRIVACY_REQUEST_REVIEW_APPROVE_TEMPLATE = "privacy_request_review_approve.html"
 TEST_MESSAGE_TEMPLATE = "test_message.html"
 USER_INVITE = "user_invite.html"
 EXTERNAL_USER_WELCOME = "external_user_welcome.html"
+MANUAL_TASK_DIGEST = "manual_task_digest.html"