[ENG-1578] Added bulk finalize endpoints

[JadeCara]

Issue ENG-1578

Description Of Changes

🎯 Purpose
As a privacy admin I want to take bulk actions on many privacy requests at once, so that I can quickly approve requests or deny requests.

Details

We really want to support the use case where a privacy admin applies some search criteria, then selects DSRS that meet that criteria and applies a bulk action. This will aid us in better supporting the bulk closure of duplicate requests and unverified requests.

This PR adds the endpoints for bulk finalizing DSRs the service function was added in #6775 .

Code Changes

• Added bulk finalize to src/fides/common/api/v1/urn_registry.py
• Added endpoint to src/fides/api/api/v1/endpoints/privacy_request_endpoints.py
• Added tests to tests/ops/api/v1/endpoints/privacy_request/test_privacy_request_finalization.py

Steps to Confirm

1. list any manual steps for reviewers to confirm the changes

Pre-Merge Checklist

• Issue requirements met
• All CI pipelines succeeded
• CHANGELOG.md updated
  • Add a db-migration This indicates that a change includes a database migration label to the entry if your change includes a DB migration
  • Add a high-risk This issue suggests changes that have a high-probability of breaking existing code label to the entry if your change includes a high-risk change (i.e. potential for performance impact or unexpected regression) that should be flagged
  • Updates unreleased work already in Changelog, no new entry necessary
• Followup issues:
  • Followup issues created
  • No followup issues
• Database migrations:
  • Ensure that your downrev is up to date with the latest revision on main
  • Ensure that your downgrade() migration is correct and works
    • If a downgrade migration is not possible for this change, please call this out in the PR description!
  • No migrations
• Documentation:
  • Documentation complete, PR opened in fidesdocs
  • Documentation issue created in fidesdocs
  • If there are any new client scopes created as part of the pull request, remember to update public-facing documentation that references our scope registry
  • No documentation updates required

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Preview	Comments	Updated (UTC)
fides-plus-nightly	Ignored	Preview		Oct 27, 2025 4:05pm
fides-privacy-center	Ignored			Oct 27, 2025 4:05pm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.39%. Comparing base (0a56a1f) to head (5ae6229).
⚠️ Report is 9 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6776      +/-   ##
==========================================
- Coverage   87.39%   87.39%   -0.01%     
==========================================
  Files         518      518              
  Lines       33866    33870       +4     
  Branches     3898     3898              
==========================================
+ Hits        29596    29599       +3     
  Misses       3414     3414              
- Partials      856      857       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[greptile-apps]

Greptile Overview

Summary

Added bulk finalize endpoints to support bulk actions on privacy requests in requires_manual_finalization status.

Key Changes:

• Added PRIVACY_REQUEST_BULK_FINALIZE URN constant to the registry
• Implemented bulk_finalize_privacy_requests endpoint that delegates validation and business logic to the service layer (following custom instruction 9e0596fc)
• Endpoint properly handles authentication with PRIVACY_REQUEST_REVIEW scope and passes user_id to track who finalized requests
• Added comprehensive test coverage including authentication/authorization checks, wrong status handling, mixed valid/invalid requests, and non-existent request IDs

Implementation Details:
The endpoint follows the established bulk operation pattern by returning a BulkReviewResponse with separate succeeded and failed lists, allowing partial success when some requests can be finalized while others cannot.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The implementation correctly follows established patterns for bulk operations in the codebase, properly delegates business logic to the service layer per custom instructions, includes comprehensive test coverage for all edge cases, and maintains consistency with the single finalize endpoint's behavior
• No files require special attention

Important Files Changed

File Analysis

Filename	Score	Overview
src/fides/common/api/v1/urn_registry.py	5/5	Added PRIVACY_REQUEST_BULK_FINALIZE constant, straightforward addition following existing patterns
src/fides/api/api/v1/endpoints/privacy_request_endpoints.py	5/5	Added bulk finalize endpoint that delegates to service layer, follows established patterns and custom instructions
tests/ops/api/v1/endpoints/privacy_request/test_privacy_request_finalization.py	4/5	Added comprehensive test coverage for bulk finalize including authentication, authorization, edge cases, and error scenarios

Sequence Diagram

sequenceDiagram
    participant Client
    participant Endpoint as bulk_finalize_privacy_requests
    participant Auth as OAuth Verification
    participant Service as PrivacyRequestService
    participant DB as Database
    participant Queue as Request Queue

    Client->>Endpoint: POST /privacy-request/bulk/finalize
    Endpoint->>Auth: Verify client with required scope
    Auth-->>Endpoint: Return client details
    
    Endpoint->>Service: finalize_privacy_requests(request_ids, user_id)
    
    loop For each request_id
        Service->>Service: Validate request for bulk operation
        alt Request not found
            Service->>Service: Add to failed list
        else Request has wrong status
            Service->>Service: Add to failed list
        else Request is valid
            Service->>DB: Set finalized_at and finalized_by fields
            Service->>DB: Save privacy_request
            Service->>Queue: Queue privacy request for finalization step
            Service->>Service: Add to succeeded list
        end
    end
    
    Service-->>Endpoint: BulkReviewResponse with succeeded and failed
    Endpoint-->>Client: HTTP 200 with results

Loading

_{3 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[johnewart]

👍