Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Distributed fides - better handle children with no access results #2011

Closed
adamsachs opened this issue Dec 8, 2022 · 0 comments · Fixed by #2012
Closed

Distributed fides - better handle children with no access results #2011

adamsachs opened this issue Dec 8, 2022 · 0 comments · Fixed by #2012
Assignees
Labels
bug Something isn't working

Comments

@adamsachs
Copy link
Contributor

Bug Description

Currently, if a given child runs to completion successfully but simply doesn't have any access results, the parent result aggregation step poorly handles this, and puts an error detail message into the aggregate access response data. An example access result with this behavior looks like this:

{"detail": "No access request information found for privacy request id pri_967396e0-bc6d-4403-88de-5e0c9a66b1de"}

Steps to Reproduce

  1. nox -s dev -- child
  2. docker exec -ti fides-fides-1 /bin/bash to shell into the parent fides
  3. once in, run python scripts/load_fides_child_examples.py to load up the fides connector configs on the parent so that it can talk to the child
  4. exit the parent shell, and simply submit an access request from whatever client. note that we do not add any connectors on the child, which means that the child will correctly not retrieve any access data, which is the scenario we're trying to reproduce. an example access request:
curl --location --request POST 'http://0.0.0.0:8080/api/v1/privacy-request' \
--header 'Content-Type: application/json' \
--data-raw '[
    {
        "identity": {"email": "[email protected]"},
        "policy_key": "default_access_policy"
    }
]'
  1. look at your storage location (likely fides_uploads dir) and confirm the access result that's been output matches what's above

Expected behavior

If there's no access data for a given privacy request from a given child, we should simply not add any data to our aggregate result on the parent. We should include some sort of logging on parent and/or child to indicate and warn about this, just so there's some trace of the fact that we retrieved no data from the given child.

Additional context

We found this when doing some deployed testing of distributed fides, where we had one child that had connectors configured, and another child without any connectors configured

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant