Skip to content

Conversation

@LLY0203
Copy link

@LLY0203 LLY0203 commented Jul 9, 2025

Feature or Bugfix

  • Feature

Detail

  • Send a one-time email notification to the owners of affected entities when a new enforcement rule is created.
  • Schedule a weekly ECS task to email each owner a consolidated list of resources missing required metadata forms.

Relates

Security

Please answer the questions below briefly where applicable, or write N/A. Based on
OWASP 10.

  • Does this PR introduce or modify any input fields or queries - this includes
    fetching data from storage outside the application (e.g. a database, an S3 bucket)?
    • Is the input sanitized?
    • What precautions are you taking before deserializing the data you consume?
    • Is injection prevented by parametrizing queries?
    • Have you ensured no eval or similar functions are used?
  • Does this PR introduce any functionality or component that requires authorization?
    • How have you ensured it respects the existing AuthN/AuthZ mechanisms?
    • Are you logging failed auth attempts?
  • Are you using or adding any cryptographic features?
    • Do you use a standard proven implementations?
    • Are the used keys controlled by the customer? Where are they stored?
  • Are you introducing any new policies/roles/users?
    • Have you used the least-privilege principle? How?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

MetadataFormEntityTypes.Share.value: MetadataFormEnforcementScope.Dataset,
}

ENTITY_LINK_MAP = {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any particular reason you need this exact new mapping? Why can't we reuse the existing one?

# Send notification by email
try:
# skip if the owner is an individual user
if entity['attached'] is None and "@" not in owner:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't this condition very specific? What 'individual user' means? May be we can put it in shared functions, so we could refer to it in other places as well?

"""

try:
if recipient_groups_list is None:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest

recipient_groups_list = recipient_groups_list or []
recipient_email_ids = recipient_email_ids or []

)

subject = (
f'ACTION REQUIRED: Data.all | Metadata form "{mf_name}" required for {entity["type"]} {entity["uri"]}'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

May be we can add entity name here.
Smth like 'dataset TestName (uri)'

identityProvider = ServiceProviderFactory.get_service_provider_instance()

# find all metadata forms
all_mfs = MetadataFormRepository.query_user_metadata_forms(session, is_da_admin=True, groups=None, env_uris=None, org_uris=None, filter=None).all()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This task is executed in Ecs and not so time-sensitive. But for issue #1807 this will be timesensitive issue.

  1. I would place this function in mf_enforcement_service since it performs business logic and can be reused
  2. Maybe we should think about creating a view in DB, where all unattached entities will be stored. It can speed up such operations

Copy link
Contributor

@SofiaSazonova SofiaSazonova left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some comments about structure

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants