ENG-1974 add bulk operations to privacy request service

[JadeCara]

Ticket ENG-1974

Description Of Changes

🎯 As a Fides user I want to be able to filter my results and then act on them, so that I can perform actions on many pages of results instead of having to go 1 by 1.

AC:

• Existing bulk action endpoints accept all the same filters as the search endpoint and apply the actions to the results.
• Existing bulk action endpoints accept a list of exclude_ids to be excluded from the actions
• Implementation reuses patterns for bulk actions used in the action center

This PR updates the privacy request service to batch ids when there are more than 50 (set as a constant in the schema)

Code Changes

• src/fides/service/privacy_request/privacy_request_service.py adds batching for bulk operations
• tests/ops/api/v1/endpoints/privacy_request/test_privacy_request_bulk_actions.py tests affected endpoints
• tests/service/test_privacy_request_service.py tests for the service change

PRs in this chain:

• [ENG-1974] schema updates for bulk filtered dsr #7049 updates the schemas
• ENG-1974 add bulk operations to privacy request service #7050 updates the privacy request service to batch ids
• [ENG-1974] helper functions #7051 adds the helper functions for ids and filters
• [ENG-1974] Filtered bulk actions for DSRs #7027 updates the endpoints to use the filters with tests

Steps to Confirm

1. There should be no change in current functionality. Right now the front end passes back a list for all bulk functions so any tests with the front end should work exactly the same.

Pre-Merge Checklist

• Issue requirements met
• All CI pipelines succeeded
• CHANGELOG.md updated
  • Add a db-migration This indicates that a change includes a database migration label to the entry if your change includes a DB migration
  • Add a high-risk This issue suggests changes that have a high-probability of breaking existing code label to the entry if your change includes a high-risk change (i.e. potential for performance impact or unexpected regression) that should be flagged
  • Updates unreleased work already in Changelog, no new entry necessary
• UX feedback:
  • All UX related changes have been reviewed by a designer
  • No UX review needed
• Followup issues:
  • Followup issues created
  • No followup issues
• Database migrations:
  • Ensure that your downrev is up to date with the latest revision on main
  • Ensure that your downgrade() migration is correct and works
    • If a downgrade migration is not possible for this change, please call this out in the PR description!
  • No migrations
• Documentation:
  • Documentation complete, PR opened in fidesdocs
  • Documentation issue created in fidesdocs
  • If there are any new client scopes created as part of the pull request, remember to update public-facing documentation that references our scope registry
  • No documentation updates required

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
fides-plus-nightly	Ready	Preview	Comment	Dec 8, 2025 1:58pm

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
fides-privacy-center	Ignored			Dec 8, 2025 1:58pm

[codecov]

Codecov Report

❌ Patch coverage is 93.06931% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.29%. Comparing base (99a98fa) to head (2a32908).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
...service/privacy_request/privacy_request_service.py	93.06%	7 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7050      +/-   ##
==========================================
+ Coverage   87.26%   87.29%   +0.02%     
==========================================
  Files         530      530              
  Lines       34882    34890       +8     
  Branches     4044     4046       +2     
==========================================
+ Hits        30440    30457      +17     
+ Misses       3555     3551       -4     
+ Partials      887      882       -5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[greptile-apps]

Greptile Overview

Greptile Summary

Updated privacy request service to automatically batch bulk operations when more than 50 requests are provided, removing the hard limit that previously required callers to handle batching.

• Added get_batches_for_bulk_operation class method to split request IDs into batches of 50
• Refactored approve_privacy_requests, deny_privacy_requests, cancel_privacy_requests, and finalize_privacy_requests to process batches iteratively
• Removed ValueError exceptions that enforced batch size limits at the service layer
• Added comprehensive test coverage for batching logic with various request counts

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The changes are straightforward and well-tested. The refactoring improves the API by handling batching internally rather than requiring callers to manage it. The implementation correctly preserves existing behavior for small request lists while adding automatic batching for large lists. Test coverage is comprehensive with both unit tests for the batching logic and integration tests verifying end-to-end functionality.
• No files require special attention

Important Files Changed

File Analysis

Filename	Score	Overview
src/fides/service/privacy_request/privacy_request_service.py	5/5	Added get_batches_for_bulk_operation method and refactored bulk operation methods (approve, deny, cancel, finalize) to process requests in batches of 50. Removed ValueError exceptions that previously limited bulk operations to 50 requests.
tests/service/test_privacy_request_service.py	5/5	Added comprehensive test coverage for get_batches_for_bulk_operation method with 6 parametrized test cases covering edge cases (10, 50, 51, 75, 100, 125 requests).
tests/ops/api/v1/endpoints/privacy_request/test_privacy_request_bulk_actions.py	5/5	Added integration tests for bulk operations with 75 privacy requests to verify batching works correctly across multiple batches for approve, deny, cancel, soft_delete, and finalize operations.

[greptile-apps]

_{3 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[thabofletcher]

@JadeCara code LGTM and based on automated tests passing I'm going to approve - I haven't tested mysel, but the change is definitely an improvement