ENG-2608 Make encryption optional in consent v3 columns by erosselli · Pull Request #7413 · ethyca/fides

erosselli · 2026-02-18T16:22:56Z

Description Of Changes

This PR adds a new setting that allows disabling the encryption at the column-level for the consent v3 privacy_preferences table. The default (and recommended) value for the setting is keeping encryption enabled.

Code Changes

Adds the new consent_v3_encryption_enabled consent setting ,with a default value of True
Defines a reusable optionally_encrypted_type for optionally-encrypted columns
Adds a new is_encrypted column to the privacy preferences table
Updates the record_data column to use this new type , using the value from the new setting
Adds a new CLI command, fides db migrate-consent-encryption to easily allow encrypting/decrypting existing records ; this is not meant for production usage, just for easy of dev / testing.

Steps to Confirm

Run fidesplus using this fides branch
Create some consent v3 preferences , check they are encrypted in the DB
Set consent_v3_encryption_enabled to false and restart the server
Run fides db migrate-consent-encryption --direction=decrypt . Check rows are now decrypted
Submit new preferences, check they're stored as decrypted

Pre-Merge Checklist

vercel · 2026-02-18T16:23:01Z

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
fides-plus-nightly	Ignored	Preview	Feb 23, 2026 0:38am
fides-privacy-center	Ignored		Feb 23, 2026 0:38am

greptile-apps · 2026-02-18T19:06:48Z

Greptile Summary

This PR introduces optional encryption for the v3 privacy_preferences.record_data column, controlled by a new FIDES__CONSENT__CONSENT_V3_ENCRYPTION_ENABLED config setting (default: True).

Adds optionally_encrypted_type utility in db/util.py to conditionally apply StringEncryptedType at model definition time
Adds is_encrypted boolean column to privacy_preferences with an Alembic migration that backfills existing rows as true
Adds a startup consistency check (check_consent_encryption_consistency) that logs an error if is_encrypted values don't match the current config
Adds a dev-only CLI command fides db migrate-consent-encryption for batch encrypting/decrypting existing records, using trial decryption for idempotency
Good test coverage for the utility function and migration logic, including roundtrip, idempotency, and batching scenarios

Confidence Score: 4/5

This PR is safe to merge with minor improvements recommended around the is_encrypted column default and migration output messaging.
The core design is sound — the column type is evaluated at class definition time, the migration is idempotent, and the startup check catches configuration drift. The issues found are style-level (missing server_default, misleading row counts). No logic bugs or security issues were identified. The dev-mode guard on the CLI migration command is appropriate.
src/fides/api/models/v3/privacy_preferences.py (missing server_default on is_encrypted column) and src/fides/api/util/consent_encryption_migration.py (misleading total_processed count)

Important Files Changed

Filename	Overview
src/fides/api/alembic/migrations/versions/xx_2026_02_18_1814_d3f08ca31314_add_is_encrypted_to_privacy_preferences.py	Migration adds `is_encrypted` boolean column with a backfill-then-alter pattern. The approach is correct but the column lacks a `server_default`.
src/fides/api/app_setup.py	Adds startup consistency check for `is_encrypted` vs config setting. Creates its own DB session and cleans up properly. Previously flagged log message issues are noted.
src/fides/api/db/util.py	Adds `optionally_encrypted_type` factory function. Clean implementation, well-documented, correctly delegates to `StringEncryptedType` or returns the plain type.
src/fides/api/models/v3/privacy_preferences.py	Updates `record_data` column to use `optionally_encrypted_type`. Adds `is_encrypted` column (Python-side default only, no `server_default`) and `has_encryption_mismatch` classmethod.
src/fides/api/util/consent_encryption_migration.py	Migration utility for encrypting/decrypting `record_data`. Uses trial decryption for idempotency. `total_processed` counts fetched rows, not transformed ones, which may be misleading in output.
src/fides/cli/commands/db.py	Adds `migrate-consent-encryption` CLI command. Imports at module top, proper error handling. Success message may be misleading due to `total_processed` including skipped rows.
src/fides/config/consent_settings.py	Adds `consent_v3_encryption_enabled` boolean setting with appropriate default and documentation.
tests/api/util/test_consent_encryption_migration.py	Comprehensive tests for migration utility including roundtrip, idempotency, batching, and progress callback. Manual teardown was flagged in previous review.

_{Last reviewed commit: 41d7c2e}

greptile-apps

_{10 files reviewed, 5 comments}

_{Edit Code Review Agent Settings | Greptile}

src/fides/api/app_setup.py

src/fides/api/util/consent_encryption_migration.py

src/fides/api/models/v3/privacy_preferences.py

changelog/7413-consent-v3-optional-encryption.yaml

tests/api/util/test_consent_encryption_migration.py

erosselli · 2026-02-18T19:27:40Z

@greptile re-review

greptile-apps

_{10 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-18T19:33:33Z

src/fides/api/models/v3/privacy_preferences.py

+    is_encrypted = Column(
+        Boolean,
+        nullable=False,
+        default=lambda: CONFIG.consent.consent_v3_encryption_enabled,
+        index=True,
+    )


Missing server_default on boolean column

The is_encrypted column uses a Python-side default but has no server_default. This means any insert that bypasses the ORM (e.g., raw SQL, bulk inserts, or future migration scripts) will fail with a NOT NULL constraint violation since the database itself has no default for this column. Adding a server_default makes the schema more robust and is consistent with how other boolean columns in this model are defined (e.g., is_latest on line 67 uses server_default=text("false")).

Suggested change

is_encrypted = Column(

Boolean,

nullable=False,

default=lambda: CONFIG.consent.consent_v3_encryption_enabled,

index=True,

)

is_encrypted = Column(

Boolean,

nullable=False,

default=lambda: CONFIG.consent.consent_v3_encryption_enabled,

server_default=text("true"),

index=True,

)

Context Used: Rule from dashboard - Use server_default="f" for boolean columns in Alembic migrations instead of default=False or oth... (source)

greptile-apps · 2026-02-18T19:33:34Z

src/fides/api/util/consent_encryption_migration.py

+            db.commit()
+            result.total_processed += len(rows)


total_processed counts fetched rows, not transformed ones

result.total_processed += len(rows) adds the count of all fetched rows, including those that _process_batch skipped because they were already in the target state. This makes the progress callback and the CLI's final message (e.g., "Encrypted 5000 rows") misleading when some rows were already encrypted/decrypted.

Consider tracking actually-transformed rows separately, or renaming this to something like total_examined to set correct expectations.

johnewart

LGTM as a whole but can we put the logic in the service? 🤞

johnewart · 2026-02-18T22:16:55Z

src/fides/api/models/v3/privacy_preferences.py

    )
    updated_at = Column(DateTime(timezone=True), nullable=True)

+    @classmethod


I would put this in one of the services as it's more of a preferences-as-a-whole question

hmm we could but then it has to go in fidesplus, which is "further away" from where the is_encrypted field is defined... I was hoping we could leave all the plus code "unaware" of the is_encrypted flag. Do you think it makes sense to move all this into fidesplus?

johnewart · 2026-02-18T22:18:23Z

src/fides/api/app_setup.py

    logger.debug("Connection to cache succeeded")


+def check_consent_encryption_consistency() -> None:


Again, I think this can just be in the service - if privacy_preferences_service.has_encryption_mismatch() or something 😄

johnewart

👍🏼

Add setting for optional encryption in consent v3

b6aa519

erosselli and others added 4 commits February 18, 2026 13:23

Merge branch 'main' into erosselli/ENG-2608

88623fb

add changelog

10ff73c

Add is_encrypted column and checks

d15ced3

Merge branch 'main' into erosselli/ENG-2608

de28154

erosselli marked this pull request as ready for review February 18, 2026 19:01

erosselli requested a review from a team as a code owner February 18, 2026 19:01

erosselli requested review from galvana and johnewart and removed request for a team February 18, 2026 19:01

vercel bot deployed to Preview – fides-plus-nightly February 18, 2026 19:05 View deployment

greptile-apps bot reviewed Feb 18, 2026

View reviewed changes

code review comments

41d7c2e

greptile-apps bot reviewed Feb 18, 2026

View reviewed changes

johnewart requested changes Feb 18, 2026

View reviewed changes

Merge branch 'main' into erosselli/ENG-2608

2419ea2

vercel bot deployed to Preview – fides-plus-nightly February 19, 2026 13:43 View deployment

erosselli added 2 commits February 19, 2026 11:12

upgrade downrev, fix tests

9d64001

move things out of fides, will go in fidesplus

d433d2d

johnewart approved these changes Feb 20, 2026

View reviewed changes

Merge branch 'main' into erosselli/ENG-2608

8f9eea2

vercel bot deployed to Preview – fides-plus-nightly February 20, 2026 19:18 View deployment

erosselli added 3 commits February 23, 2026 09:26

Update down rev

dfbc2e1

Merge branch 'main' into erosselli/ENG-2608

a224091

Update DB dataset

d9d0c23

erosselli added this pull request to the merge queue Feb 23, 2026

Merged via the queue into main with commit f6c8489 Feb 23, 2026
53 of 54 checks passed

erosselli deleted the erosselli/ENG-2608 branch February 23, 2026 13:26

		logger.debug("Connection to cache succeeded")


		def check_consent_encryption_consistency() -> None:

Conversation

erosselli commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description Of Changes

Code Changes

Steps to Confirm

Pre-Merge Checklist

Uh oh!

vercel bot commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps bot commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

erosselli commented Feb 18, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

johnewart left a comment

Choose a reason for hiding this comment

Uh oh!

johnewart Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

erosselli Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johnewart Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

johnewart left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

erosselli commented Feb 18, 2026 •

edited

Loading

vercel bot commented Feb 18, 2026 •

edited

Loading

greptile-apps bot commented Feb 18, 2026 •

edited

Loading

erosselli Feb 19, 2026 •

edited

Loading