ethyca-fides 2.73.2b0__py2.py3-none-any.whl → 2.76.0rc2__py2.py3-none-any.whl

fides/api/service/privacy_request/request_service.py

@@ -133,8 +133,9 @@ def poll_for_exited_privacy_request_tasks(self: DatabaseTask) -> Set[str]:
         # Privacy Requests that didn't need approval are "In Processing".
         # Privacy Requests in these states should be examined to see if all of its Request Tasks have had a chance
         # to complete.
+        # Use query_without_large_columns to prevent OOM errors when processing many privacy requests
         in_progress_privacy_requests = (
-            db.query(PrivacyRequest)
+            PrivacyRequest.query_without_large_columns(db)
             .filter(
                 PrivacyRequest.status.in_(
                     [
@@ -528,8 +529,9 @@ def requeue_interrupted_tasks(self: DatabaseTask) -> None:
             logger.debug("Starting check for interrupted tasks to requeue")
 
             # Get all in-progress privacy requests that haven't been updated in the last 5 minutes
+            # Use query_without_large_columns to prevent OOM errors when processing many privacy requests
             in_progress_requests = (
-                db.query(PrivacyRequest)
+                PrivacyRequest.query_without_large_columns(db)
                 .filter(
                     PrivacyRequest.status.in_(
                         [

fides/api/service/saas_request/saas_request_override_factory.py

@@ -1,6 +1,6 @@
 from enum import Enum
 from inspect import Signature, signature
-from typing import TYPE_CHECKING, Callable, Dict, List, Union
+from typing import TYPE_CHECKING, Callable, Dict, List, Optional, Union
 
 from loguru import logger
 
@@ -319,7 +319,12 @@ def validate_polling_result_override_function(f: Callable) -> None:
 
     # Check return type annotation - handle both direct class and string literals
     return_annotation = sig.return_annotation
-    if return_annotation not in (PollingResult, "PollingResult"):
+    if return_annotation not in (
+        PollingResult,
+        "PollingResult",
+        Optional[PollingResult],
+        "Optional[PollingResult]",
+    ):
         raise InvalidSaaSRequestOverrideException(
             "Polling result override function must return a PollingResult"
         )

fides/api/task/conditional_dependencies/privacy_request/convenience_fields.py

@@ -0,0 +1,155 @@
+from typing import Any, Optional
+
+from fides.api.models.location_regulation_selections import get_location_by_id
+from fides.api.models.policy import Policy
+from fides.api.schemas.policy import ActionType
+from fides.api.task.conditional_dependencies.privacy_request.schemas import (
+    ConditionalDependencyFieldInfo,
+    ConditionalDependencyFieldType,
+    PrivacyRequestConvenienceFields,
+    PrivacyRequestLocationConvenienceFields,
+    PrivacyRequestPolicyConvenienceFields,
+)
+
+
+def build_convenience_field_list() -> list[ConditionalDependencyFieldInfo]:
+    """Builds a list of ConditionalDependencyFieldInfo objects for convenience fields."""
+    return [
+        # Policy convenience fields
+        ConditionalDependencyFieldInfo(
+            field_path=PrivacyRequestConvenienceFields.rule_action_types.value,
+            field_type=ConditionalDependencyFieldType.array,
+            description="List of action types from policy rules (e.g., ['access', 'erasure']). Use with list_contains operator.",
+            is_convenience_field=True,
+        ),
+        ConditionalDependencyFieldInfo(
+            field_path=PrivacyRequestConvenienceFields.has_access_rule.value,
+            field_type=ConditionalDependencyFieldType.boolean,
+            description="Whether the policy has at least one rule with action_type 'access'.",
+            is_convenience_field=True,
+        ),
+        ConditionalDependencyFieldInfo(
+            field_path=PrivacyRequestConvenienceFields.has_erasure_rule.value,
+            field_type=ConditionalDependencyFieldType.boolean,
+            description="Whether the policy has at least one rule with action_type 'erasure'.",
+            is_convenience_field=True,
+        ),
+        ConditionalDependencyFieldInfo(
+            field_path=PrivacyRequestConvenienceFields.has_consent_rule.value,
+            field_type=ConditionalDependencyFieldType.boolean,
+            description="Whether the policy has at least one rule with action_type 'consent'.",
+            is_convenience_field=True,
+        ),
+        ConditionalDependencyFieldInfo(
+            field_path=PrivacyRequestConvenienceFields.has_update_rule.value,
+            field_type=ConditionalDependencyFieldType.boolean,
+            description="Whether the policy has at least one rule with action_type 'update'.",
+            is_convenience_field=True,
+        ),
+        ConditionalDependencyFieldInfo(
+            field_path=PrivacyRequestConvenienceFields.rule_count.value,
+            field_type=ConditionalDependencyFieldType.integer,
+            description="Number of rules in the policy.",
+            is_convenience_field=True,
+        ),
+        ConditionalDependencyFieldInfo(
+            field_path=PrivacyRequestConvenienceFields.rule_names.value,
+            field_type=ConditionalDependencyFieldType.array,
+            description="List of rule names from the policy. Use with list_contains operator.",
+            is_convenience_field=True,
+        ),
+        ConditionalDependencyFieldInfo(
+            field_path=PrivacyRequestConvenienceFields.has_storage_destination.value,
+            field_type=ConditionalDependencyFieldType.boolean,
+            description="Whether any rule in the policy has a storage destination configured.",
+            is_convenience_field=True,
+        ),
+        # Location hierarchy convenience fields
+        ConditionalDependencyFieldInfo(
+            field_path=PrivacyRequestConvenienceFields.location_country.value,
+            field_type=ConditionalDependencyFieldType.string,
+            description="The country code for the location (e.g., 'us' for 'us_ca', 'fr' for France). Use with eq operator to check if a location is in a specific country.",
+            is_convenience_field=True,
+        ),
+        ConditionalDependencyFieldInfo(
+            field_path=PrivacyRequestConvenienceFields.location_groups.value,
+            field_type=ConditionalDependencyFieldType.array,
+            description="List of location groups this location belongs to (e.g., ['us'] for US states, ['eea'] for EU countries). Use with list_contains operator.",
+            is_convenience_field=True,
+        ),
+        ConditionalDependencyFieldInfo(
+            field_path=PrivacyRequestConvenienceFields.location_regulations.value,
+            field_type=ConditionalDependencyFieldType.array,
+            description="List of regulations applicable to this location (e.g., ['ccpa'] for California, ['gdpr'] for EU). Use with list_contains operator.",
+            is_convenience_field=True,
+        ),
+    ]
+
+
+def get_policy_convenience_fields(
+    policy: Policy,
+) -> dict[str, Any]:
+    """Gets convenience fields for a policy."""
+    extra_fields: dict[str, Any] = {}
+    extra_fields["id"] = policy.id
+
+    # Get rules for convenience field derivation
+    rules = policy.rules if hasattr(policy, "rules") and policy.rules else []
+    action_types = policy.get_all_action_types()
+
+    # Add convenience fields for rules
+    extra_fields[PrivacyRequestPolicyConvenienceFields.rule_action_types.value] = [
+        action_type.value for action_type in action_types if action_type
+    ]
+    for action_type in ActionType:
+        extra_fields[f"has_{action_type.value}_rule"] = action_type in action_types
+    extra_fields[PrivacyRequestPolicyConvenienceFields.rule_count.value] = (
+        len(rules) if rules else 0
+    )
+    extra_fields[PrivacyRequestPolicyConvenienceFields.rule_names.value] = [
+        rule.name for rule in rules if hasattr(rule, "name") and rule.name
+    ]
+    extra_fields[
+        PrivacyRequestPolicyConvenienceFields.has_storage_destination.value
+    ] = any(
+        hasattr(rule, "storage_destination") and rule.storage_destination is not None
+        for rule in rules
+    )
+    return extra_fields
+
+
+def get_location_convenience_fields(location: Optional[str]) -> dict[str, Any]:
+    """Gets convenience fields for a location to support hierarchy-based conditions."""
+    extra_fields: dict[str, Any] = {
+        PrivacyRequestLocationConvenienceFields.location_country.value: None,
+        PrivacyRequestLocationConvenienceFields.location_groups.value: [],
+        PrivacyRequestLocationConvenienceFields.location_regulations.value: [],
+    }
+
+    if not location:
+        return extra_fields
+
+    location_data = get_location_by_id(location)
+    if not location_data:
+        return extra_fields
+
+    # If location has parent groups, the first one is typically the country
+    # (e.g., us_ca belongs to [us])
+    belongs_to = location_data.belongs_to or []
+    extra_fields[PrivacyRequestLocationConvenienceFields.location_groups.value] = (
+        belongs_to
+    )
+
+    # Set location_country to the first parent if the location is a subdivision
+    # This helps with conditions like "is this a US state?"
+    if belongs_to and not location_data.is_country:
+        extra_fields[PrivacyRequestLocationConvenienceFields.location_country.value] = (
+            belongs_to[0]
+        )
+
+    # Add regulations applicable to this location
+    extra_fields[PrivacyRequestLocationConvenienceFields.location_regulations.value] = (
+        location_data.regulation or []
+    )
+
+    return extra_fields

fides/api/task/conditional_dependencies/privacy_request/privacy_request_data.py

@@ -0,0 +1,140 @@
+from typing import Any, Optional
+
+from pydantic.v1.utils import deep_update
+
+from fides.api.models.policy import Policy
+from fides.api.models.privacy_request import PrivacyRequest
+from fides.api.schemas.policy import Policy as PolicySchema
+from fides.api.task.conditional_dependencies.privacy_request.convenience_fields import (
+    get_location_convenience_fields,
+    get_policy_convenience_fields,
+)
+from fides.api.task.conditional_dependencies.privacy_request.schemas import (
+    PrivacyRequestLocationConvenienceFields,
+)
+from fides.api.task.conditional_dependencies.util import (
+    extract_nested_field_value,
+    set_nested_value,
+    transform_value_for_evaluation,
+)
+
+
+class PrivacyRequestDataTransformer:
+    """
+    Transforms a PrivacyRequest ORM object into a dictionary structure for condition evaluation.
+
+    - This class extracts the fields referenced in conditions and builds a minimal nested structure
+    for evaluation. Privacy request fields must be prefixed with the "privacy_request" namespace.
+    - This class is used to get the privacy request data for condition evaluation.
+        - The task.conditional_dependencies.evaluator expects the data to be in a nested dictionary structure
+        and uses the operators defined in the task.conditional_dependencies.operators.py which have defined
+        data type compatibility.
+
+    Note: Privacy request relationships are eager loaded in the execute_request_tasks.py file.
+    """
+
+    def __init__(self, privacy_request: PrivacyRequest):
+        self.privacy_request = privacy_request
+        self.policy_data = self._transform_policy_object(privacy_request.policy)
+        self.identity_data = self.privacy_request.get_persisted_identity()
+        self.custom_privacy_request_fields_data = (
+            self.privacy_request.get_persisted_custom_privacy_request_fields()
+        )
+        self.location_convenience_fields = get_location_convenience_fields(
+            privacy_request.location
+        )
+
+    def to_evaluation_data(self, field_addresses: set[str]) -> dict[str, Any]:
+        """
+        Transforms the PrivacyRequest into an evaluation-ready dictionary structure.
+
+        Args:
+            field_addresses: Set of field addresses referenced in conditions
+        """
+        if not field_addresses:
+            return {}
+
+        result: dict[str, Any] = {"privacy_request": {}}
+        field_paths: set[str] = {addr.replace(":", ".") for addr in field_addresses}
+
+        # Extract each field dynamically based on its path
+        for field_path in field_paths:
+            value = self._extract_value_by_path(field_path)
+            privacy_request_data: Optional[dict[str, Any]] = set_nested_value(
+                field_path.split("."), value
+            )
+            if privacy_request_data:
+                result = deep_update(result, privacy_request_data)
+
+        return result
+
+    def _extract_value_by_path(self, field_address: str) -> Any:
+        """
+        Extracts a value from PrivacyRequest by following the field address path.
+
+        Args:
+            field_address: The field address path (e.g., "privacy_request.location", "privacy_request.policy.rules")
+
+        """
+        # first part will always be privacy_request
+        parts: list[str] = field_address.split(".")[1:]
+        current: Any = self.privacy_request
+        is_labeled_field = False
+
+        # Handle location convenience fields - these are derived fields, not direct attributes
+        # Check if we're accessing a location convenience field before trying to extract from privacy_request
+
+        if len(parts) == 1 and parts[0] in [
+            e.value for e in PrivacyRequestLocationConvenienceFields
+        ]:
+            return self.location_convenience_fields.get(parts[0])
+
+        # Route to the appropriate data source based on the first path component
+        if parts[0] == "policy":
+            current = self.policy_data
+            parts.pop(0)
+        elif parts[0] == "identity":
+            current = self.identity_data
+            # Identity fields may contain LabeledIdentity objects with label/value structure
+            is_labeled_field = True
+            parts.pop(0)
+        elif parts[0] == "custom_privacy_request_fields":
+            current = self.custom_privacy_request_fields_data
+            # Custom fields are stored as {"label": ..., "value": ...} dicts
+            is_labeled_field = True
+            parts.pop(0)
+
+        current = extract_nested_field_value(current, parts)
+
+        # If we started with an Identity object and didn't extract any field from it
+        # (current is still the identity object), return None
+        # Otherwise, transform the value (which could be a BaseModel like LabeledIdentity)
+        if current is self.identity_data:
+            return None
+
+        # Transform the value first (converts LabeledIdentity to dict, handles other types)
+        current = transform_value_for_evaluation(current)
+
+        # For labeled fields (custom privacy request fields and identity fields with labels),
+        # extract just the value from the {"label": ..., "value": ...} structure
+        if is_labeled_field and isinstance(current, dict) and "value" in current:
+            current = current["value"]
+
+        return current
+
+    def _transform_policy_object(self, policy: Policy) -> dict[str, Any]:
+        """
+        Transforms a Policy ORM object to a dictionary using existing Pydantic schema
+        and adds convenience fields.
+
+        Args:
+            policy: The Policy ORM object
+        """
+        if not policy:
+            return {}
+        extra_fields = get_policy_convenience_fields(policy)
+
+        # Convert Policy ORM object to dictionary using Pydantic schema
+        policy_dict = PolicySchema.model_validate(policy).model_dump()
+        policy_dict.update(extra_fields)
+        return policy_dict

fides/api/task/conditional_dependencies/privacy_request/schemas.py

@@ -0,0 +1,212 @@
+from enum import Enum
+from typing import Optional, Union
+
+from pydantic import BaseModel, Field, field_validator
+
+
+class PrivacyRequestTopLevelFields(Enum):
+    """Top level fields for privacy request."""
+
+    privacy_request = "privacy_request"
+    policy = "privacy_request.policy"
+    identity = "privacy_request.identity"
+
+
+class PrivacyRequestPolicyConvenienceFields(Enum):
+    """Convenience fields for privacy request policy."""
+
+    rule_action_types = "rule_action_types"
+    has_access_rule = "has_access_rule"
+    has_erasure_rule = "has_erasure_rule"
+    has_consent_rule = "has_consent_rule"
+    has_update_rule = "has_update_rule"
+    rule_count = "rule_count"
+    rule_names = "rule_names"
+    has_storage_destination = "has_storage_destination"
+
+
+class PrivacyRequestLocationConvenienceFields(Enum):
+    """Convenience fields for privacy request location."""
+
+    location_country = "location_country"
+    location_groups = "location_groups"
+    location_regulations = "location_regulations"
+
+
+class PrivacyRequestConvenienceFields(Enum):
+    """Convenience fields for privacy request."""
+
+    # Policy convenience fields
+    rule_action_types = f"{PrivacyRequestTopLevelFields.policy.value}.{PrivacyRequestPolicyConvenienceFields.rule_action_types.value}"
+    has_access_rule = f"{PrivacyRequestTopLevelFields.policy.value}.{PrivacyRequestPolicyConvenienceFields.has_access_rule.value}"
+    has_erasure_rule = f"{PrivacyRequestTopLevelFields.policy.value}.{PrivacyRequestPolicyConvenienceFields.has_erasure_rule.value}"
+    has_consent_rule = f"{PrivacyRequestTopLevelFields.policy.value}.{PrivacyRequestPolicyConvenienceFields.has_consent_rule.value}"
+    has_update_rule = f"{PrivacyRequestTopLevelFields.policy.value}.{PrivacyRequestPolicyConvenienceFields.has_update_rule.value}"
+    rule_count = f"{PrivacyRequestTopLevelFields.policy.value}.{PrivacyRequestPolicyConvenienceFields.rule_count.value}"
+    rule_names = f"{PrivacyRequestTopLevelFields.policy.value}.{PrivacyRequestPolicyConvenienceFields.rule_names.value}"
+    has_storage_destination = f"{PrivacyRequestTopLevelFields.policy.value}.{PrivacyRequestPolicyConvenienceFields.has_storage_destination.value}"
+    # Location hierarchy convenience fields
+    location_country = f"{PrivacyRequestTopLevelFields.privacy_request.value}.{PrivacyRequestLocationConvenienceFields.location_country.value}"
+    location_groups = f"{PrivacyRequestTopLevelFields.privacy_request.value}.{PrivacyRequestLocationConvenienceFields.location_groups.value}"
+    location_regulations = f"{PrivacyRequestTopLevelFields.privacy_request.value}.{PrivacyRequestLocationConvenienceFields.location_regulations.value}"
+
+
+class PrivacyRequestFields(Enum):
+    """Fields for privacy request."""
+
+    created_at = f"{PrivacyRequestTopLevelFields.privacy_request.value}.created_at"
+    due_date = f"{PrivacyRequestTopLevelFields.privacy_request.value}.due_date"
+    identity_verified_at = (
+        f"{PrivacyRequestTopLevelFields.privacy_request.value}.identity_verified_at"
+    )
+    location = f"{PrivacyRequestTopLevelFields.privacy_request.value}.location"
+    origin = f"{PrivacyRequestTopLevelFields.privacy_request.value}.origin"
+    requested_at = f"{PrivacyRequestTopLevelFields.privacy_request.value}.requested_at"
+    source = f"{PrivacyRequestTopLevelFields.privacy_request.value}.source"
+    submitted_by = f"{PrivacyRequestTopLevelFields.privacy_request.value}.submitted_by"
+
+
+class PolicyFields(Enum):
+    """Fields for policy."""
+
+    id = "privacy_request.policy.id"
+    name = f"{PrivacyRequestTopLevelFields.policy.value}.name"
+    key = f"{PrivacyRequestTopLevelFields.policy.value}.key"
+    description = f"{PrivacyRequestTopLevelFields.policy.value}.description"
+    execution_timeframe = (
+        f"{PrivacyRequestTopLevelFields.policy.value}.execution_timeframe"
+    )
+    rules = f"{PrivacyRequestTopLevelFields.policy.value}.rules"
+
+
+class IdentityFields(Enum):
+    """Fields for identity."""
+
+    email = f"{PrivacyRequestTopLevelFields.identity.value}.email"
+    phone_number = f"{PrivacyRequestTopLevelFields.identity.value}.phone_number"
+    external_id = f"{PrivacyRequestTopLevelFields.identity.value}.external_id"
+    fides_user_device_id = (
+        f"{PrivacyRequestTopLevelFields.identity.value}.fides_user_device_id"
+    )
+    ljt_readerID = f"{PrivacyRequestTopLevelFields.identity.value}.ljt_readerID"
+    ga_client_id = f"{PrivacyRequestTopLevelFields.identity.value}.ga_client_id"
+
+
+class ConditionalDependencyFieldType(Enum):
+    """Type of the field for conditional dependencies."""
+
+    string = "string"
+    boolean = "boolean"
+    array = "array"
+    integer = "integer"
+    float = "float"
+    date = "date"
+
+
+class CustomFieldPathPrefix(Enum):
+    """Valid path prefixes for custom fields in privacy request conditional dependencies.
+
+    Custom privacy request fields are dynamically created based on privacy center
+    configuration and are stored on the privacy request itself (not the policy).
+    """
+
+    custom_privacy_request_fields = "privacy_request.custom_privacy_request_fields"
+
+    @classmethod
+    def is_valid_custom_field_path(cls, field_path: str) -> bool:
+        """Check if a field path is a valid custom field path.
+
+        Args:
+            field_path: The field path to validate
+
+        Returns:
+            True if the path starts with a valid custom field prefix, False otherwise
+        """
+        return any(field_path.startswith(prefix.value + ".") for prefix in cls)
+
+    @classmethod
+    def get_custom_field_name(cls, field_path: str) -> Optional[str]:
+        """Extract the custom field name from a valid custom field path.
+
+        Args:
+            field_path: The field path to extract the field name from
+
+        Returns:
+            The custom field name if the path is valid, None otherwise
+        """
+        for prefix in cls:
+            if field_path.startswith(prefix.value + "."):
+                return field_path[len(prefix.value) + 1 :]
+        return None
+
+
+# Union type for all valid field paths
+# Pydantic will validate against enum values for standard fields
+# Custom field paths (dynamically created, validated at runtime) follow the pattern:
+# privacy_request.custom_privacy_request_fields.{field_name}
+ConditionalDependencyFieldPath = Union[
+    PrivacyRequestFields,
+    PolicyFields,
+    IdentityFields,
+    PrivacyRequestConvenienceFields,
+    str,  # Custom field paths (must match prefix pattern, validated below)
+]
+
+
+class ConditionalDependencyFieldInfo(BaseModel):
+    """Information about a field available for conditional dependencies."""
+
+    field_path: ConditionalDependencyFieldPath = Field(
+        ...,
+        description="Path to the field in the PrivacyRequest. Must be one of the standard field paths or a valid custom field path.",
+    )
+    field_type: ConditionalDependencyFieldType = Field(
+        ..., description="Type of the field from ConditionalDependencyFieldType"
+    )
+    description: Optional[str] = Field(None, description="Description of the field")
+    is_convenience_field: bool = Field(
+        False,
+        description="Whether this is a convenience field (derived from other fields)",
+    )
+
+    @field_validator("field_path")
+    @classmethod
+    def validate_field_path(cls, value: Union[Enum, str]) -> Union[Enum, str]:
+        """Validate that field_path is either an enum value or a valid custom field path.
+
+        Args:
+            value: The field path to validate (can be an enum member or string)
+
+        Returns:
+            The validated field path
+
+        Raises:
+            ValueError: If the field path is not valid
+        """
+        # If it's already an enum member, it's valid
+        if isinstance(value, Enum):
+            return value
+
+        # If it's a string, check if it matches an enum value or is a valid custom field path
+        if isinstance(value, str):
+            # Check if it matches any enum value
+            all_enum_values = (
+                {field.value for field in PrivacyRequestFields}
+                | {field.value for field in PolicyFields}
+                | {field.value for field in IdentityFields}
+                | {field.value for field in PrivacyRequestConvenienceFields}
+            )
+
+            if value in all_enum_values:
+                return value
+
+            # If it doesn't match an enum value, it must be a valid custom field path
+            if not CustomFieldPathPrefix.is_valid_custom_field_path(value):
+                raise ValueError(
+                    f"Invalid field_path '{value}'. Must be one of the standard field paths "
+                    f"or a valid custom field path starting with one of: "
+                    f"{', '.join(prefix.value for prefix in CustomFieldPathPrefix)}"
+                )
+            return value
+
+        return value

fides/api/task/conditional_dependencies/util.py

@@ -0,0 +1,111 @@
+from datetime import datetime
+from typing import Any
+from uuid import UUID
+
+from pydantic import BaseModel
+
+
+# pylint: disable=too-many-return-statements
+def transform_value_for_evaluation(value: Any) -> Any:
+    """
+    Transforms a value to its evaluation-ready form.
+
+    Handles various data types defensively to ensure compatibility with
+    the operators defined in task.conditional_dependencies.operators.py
+
+    Args:
+        value: The value to transform
+
+    Returns:
+        The transformed value compatible with evaluation operators
+    """
+    if value is None:
+        return None
+
+    # Handle Pydantic models first (before checking for other attributes)
+    if isinstance(value, BaseModel):
+        return value.model_dump(mode="json")
+
+    # Handle enums (must come before other checks as enums might have other attributes)
+    if hasattr(value, "value") and not isinstance(value, BaseModel):
+        return value.value
+
+    # Handle date/time types
+    if isinstance(value, datetime):
+        return value.isoformat()
+
+    # Handle UUIDs
+    if isinstance(value, UUID):
+        return str(value)
+
+    # Handle bytes types - convert to strings for string operators
+    if isinstance(value, (bytes, bytearray)):
+        try:
+            return value.decode("utf-8")
+        except UnicodeDecodeError:
+            # If decode fails, use repr for a string representation
+            return repr(value)
+
+    # Handle complex numbers - convert to string as they can't be compared with < > etc
+    if isinstance(value, complex):
+        return str(value)
+
+    # Handle set/frozenset/tuple - convert to lists for list operators
+    # (operators.py list operations check isinstance(x, list))
+    if isinstance(value, (set, frozenset, tuple)):
+        return list(value)
+
+    # Return value as-is if no transformation needed
+    return value
+
+
+def extract_nested_field_value(data: Any, field_path: list[str]) -> Any:
+    """
+    Extracts a value from a dictionary by following the path.
+
+    Args:
+        data: The dictionary to extract from
+        field_path: The path to extract the value from
+
+    Returns:
+        The extracted value
+    """
+    current: Any = data
+    for part in field_path:
+        if current is None:
+            return None
+        if hasattr(current, part):
+            current = getattr(current, part)
+        elif isinstance(current, list) and part.isdigit():
+            if 0 <= int(part) < len(current):
+                current = current[int(part)]
+            else:
+                return None
+        elif isinstance(current, dict) and part in current:
+            current = current[part]
+        else:
+            # If we can't find the part, return None
+            return None
+    return current
+
+
+def set_nested_value(path: list[str], value: Any) -> dict[str, Any]:
+    """
+    Returns a dictionary with a nested value set at the path.
+
+    Args:
+        path: List of keys to traverse (e.g., ["policy", "key"])
+        value: The value to set at the end of the path
+    """
+    result: dict[str, Any] = {}
+    final_key = path[-1]
+    current = result
+
+    for key in path[:-1]:
+        if key not in current:
+            current[key] = {}
+        current = current[key]
+
+    # Set the final value
+    current[final_key] = value
+    return result