ENG-564: Refactor SaaS dataset validation layering

[galvana]

Ticket ENG-564

Description Of Changes

Refactors the SaaS dataset backend validation feature (from the parent branch) to address two code review findings:

1. Route → Service layering: The get_dataset_protected_fields endpoint contained inline DB queries and business logic. This is now delegated to a new DatasetConfigService.get_protected_fields() method, consistent with how other endpoints in the file work.

2. Public utility API: The six _-prefixed helper functions in saas.py (_validate_saas_dataset, _restore_immutable_fields, _restore_protected_structure, _resolve_field_path, _find_field_by_name, _restore_nested_field) are now public. This makes the test imports legitimate rather than reaching into private internals.

Code Changes

• Moved protected-fields business logic from dataset_config_endpoints.py into DatasetConfigService.get_protected_fields()
• Removed 4 now-unused imports from the endpoint file (SaaSConfig, ProtectedCollectionField, get_saas_config_referenced_field_paths, MUTABLE_DATASET_FIELDS)
• Removed _ prefix from 6 functions in saas.py and updated all internal call sites
• Updated test imports and call sites to match new public names

Steps to Confirm

1. Verify the refactored get_dataset_protected_fields endpoint returns the same response as before (immutable fields + protected collection fields for SaaS connections, empty lists for non-SaaS)
2. Verify existing SaaS validation tests pass: nox -s "pytest(ops-unit)" -- tests/ops/service/dataset/test_saas_validation_step.py
3. Verify no remaining references to the old _-prefixed function names

Pre-Merge Checklist

• Issue requirements met
• All CI pipelines succeeded
• CHANGELOG.md updated
  • Add a db-migration This indicates that a change includes a database migration label to the entry if your change includes a DB migration
  • Add a high-risk This issue suggests changes that have a high-probability of breaking existing code label to the entry if your change includes a high-risk change (i.e. potential for performance impact or unexpected regression) that should be flagged
  • Updates unreleased work already in Changelog, no new entry necessary
• UX feedback:
  • No UX review needed
• Followup issues:
  • No followup issues
• Database migrations:
  • No migrations
• Documentation:
  • No documentation updates required

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
fides-plus-nightly	Ignored		Apr 7, 2026 7:45pm
fides-privacy-center	Ignored		Apr 7, 2026 7:45pm

[codecov]

Codecov Report

❌ Patch coverage is 70.37037% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.00%. Comparing base (4d25294) to head (e8817da).

Files with missing lines	Patch %	Lines
...rc/fides/service/dataset/dataset_config_service.py	45.45%	6 Missing ⚠️
...fides/api/v1/endpoints/dataset_config_endpoints.py	0.00%	2 Missing ⚠️

Additional details and impacted files

@@                             Coverage Diff                             @@
##           ENG-564-saas-dataset-backend-validation    #7850      +/-   ##
===========================================================================
- Coverage                                    85.00%   85.00%   -0.01%     
===========================================================================
  Files                                          622      622              
  Lines                                        40643    40645       +2     
  Branches                                      4748     4748              
===========================================================================
  Hits                                         34549    34549              
- Misses                                        5024     5025       +1     
- Partials                                      1070     1071       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Linker44]

lets remove the changelog entry