Closes #3477
❗ Dependent on Fideslang release https://github.com/ethyca/fideslang/pull/115
❗ Contains migration; check downrev before merge

Description Of Changes

As a privacy admin, I want to document the cookies utilized by a system to deliver its services and functionalities, so that they can be mapped to privacy notices and operated on by the privacy experiences for consent related opt-in/out and so that I have a record of cookies for compliance purposes.

Code Changes

• Add a Cookies table with a FK to both privacy_declaration and system, in case the privacy declaration gets deleted, we still have cookies that are unassociated with a specific data use and still connected to the system.
• Cookies are currently specified under privacy_declarations when creating/updating systems via the API
• Add an upsert_cookies method that is called when privacy declarations are created/updated
• Add a PrivacyNotice property that calculates at runtime which cookies are relevant based on data use
  • Relevant if a data use matches exactly, or a system's data use is a child of a privacy notice's data use, but not the other way around.

Steps to Confirm

• Make a POST to create a system, with a list of cookies specified under the relevant privacy declaration(s). Confirm cookies are in the response under both the privacy declaration, and the system
  POST {{host}}/system

{
   "fides_key":"test_systems",
   "name":"Test system",
   "organization_fides_key":"default_organization",
   "system_type": "system",
   "privacy_declarations":[
      {
         "name":"Collect data for marketing",
         "data_categories":[
            "user.device.cookie_id"
         ],
         "data_use":"personalize",
         "data_qualifier":"aggregated.anonymized.unlinked_pseudonymized.pseudonymized.identified",
         "data_subjects":[
            "customer"
         ],
         "cookies":[
            {
               "name":"test_cookie",
               "path":"/"
            },
              {
               "name":"test_cookie",
               "path":"/"
            }
         ]
      }
   ]
}

• Create a privacy notice with the same data use as your privacy declaration above. POST {{host}}/privacy-notice. Verify that the cookie created above is displayed in the response. If data uses don't overlap with any privacy declaration data uses, the cookies should return as an empty list.

[
   {
      "name":"Profiling",
      "notice_key": "profiling",
      "regions":[
         "us_va"
      ],
      "description":"Making a decision solely by automated means.",
      "consent_mechanism":"opt_in",
      "data_uses":[
         "personalize"
      ],
      "enforcement_level":"system_wide",
      "has_gpc_flag":false,
      "displayed_in_overlay":true
   }
]

Pre-Merge Checklist

• All CI Pipelines Succeeded
• Documentation:
  • documentation complete, PR opened in fidesdocs
  • documentation issue created in fidesdocs
• Issue Requirements are Met
• Relevant Follow-Up Issues Created
• Update CHANGELOG.md
• For API changes, the Postman collection has been updated