@softure-ai/privacy 0.0.0-stage → 0.1.5

package/src/server/self-service.ts

@@ -0,0 +1,59 @@
+// What a signed-in user does for themselves: download their data and delete their account. The
+// caller passes the user id it took from the session (never from the request body); both
+// operations count an attempt per user before any work.
+import { err, ok, type Err, type Ok } from "@softure-ai/core";
+import { isCurrentPassword } from "@softure-ai/auth/server";
+import type { RateLimitRejection } from "@softure-ai/security";
+import { consumeRateLimit } from "@softure-ai/security/server";
+import { collectUserData, type CollectUserDataResult } from "./collect.js";
+import type { PrivacyContext } from "./context.js";
+import { eraseUserData } from "./erase.js";
+import { assertPrivacyBuckets, BUCKETS, userSubjectKey } from "./rate-limits.js";
+
+export interface ExportOwnDataInput {
+  /** The signed-in user, from the session. */
+  readonly userId: string;
+}
+
+export type ExportOwnDataResult = CollectUserDataResult | RateLimitRejection;
+
+/** The signed-in user's export, counted in `privacy-export`. Database errors propagate. */
+export async function exportOwnData(ctx: PrivacyContext, input: ExportOwnDataInput): Promise<ExportOwnDataResult> {
+  assertPrivacyBuckets(ctx.config);
+  const limit = await consumeRateLimit(ctx, { bucket: BUCKETS.export, key: userSubjectKey(input.userId) });
+  if (!limit.ok) return limit;
+  return collectUserData(ctx, input.userId);
+}
+
+export interface DeleteOwnAccountInput {
+  /** The signed-in user, from the session. */
+  readonly userId: string;
+  /** Their current password, typed again. */
+  readonly password: string;
+  /** Whether the "I understand" checkbox was ticked. */
+  readonly isConfirmed: boolean;
+}
+
+export type DeleteOwnAccountErrorCode = "privacy.confirmation_required" | "privacy.password_invalid" | "privacy.deletion_refused";
+
+export type DeleteOwnAccountResult = Ok<undefined> | Err<DeleteOwnAccountErrorCode> | RateLimitRejection;
+
+/**
+ * Deletes the signed-in user's account and data. The confirmation is checked first (cheap, and a
+ * missed checkbox should not spend an attempt), then `privacy-delete` is counted, then the password
+ * is verified: a session alone cannot delete an account, and the form is no faster a password
+ * oracle than the login. Database errors propagate after the rollback.
+ */
+export async function deleteOwnAccount(ctx: PrivacyContext, input: DeleteOwnAccountInput): Promise<DeleteOwnAccountResult> {
+  assertPrivacyBuckets(ctx.config);
+  if (!input.isConfirmed) return err("privacy.confirmation_required");
+
+  const limit = await consumeRateLimit(ctx, { bucket: BUCKETS.delete, key: userSubjectKey(input.userId) });
+  if (!limit.ok) return limit;
+
+  // A fresh error, not one derived from the check: the result then carries nothing of the password.
+  if (!(await isCurrentPassword(ctx, input.userId, input.password))) return err("privacy.password_invalid");
+
+  const erased = await eraseUserData(ctx, input.userId);
+  return erased.ok ? ok() : erased;
+}

package/src/ui/delete-account-form.tsx

@@ -0,0 +1,58 @@
+"use client";
+
+import type { Locale } from "@softure-ai/core";
+import { Button, Checkbox, type ClassNames, createSlotClassGetter, FormError, PasswordField } from "@softure-ai/ui";
+import { useActionState } from "react";
+import { type DeleteAccountField, type DeleteAccountFormState, INITIAL_DELETE_ACCOUNT_STATE } from "../contract.js";
+import { getPrivacyErrorMessage, type PrivacyMessages } from "../messages/index.js";
+
+// The account deletion form. It submits straight to its server action through `useActionState`,
+// so it works without JavaScript and the redirect after a deletion is followed. It asks for the
+// current password and an explicit confirmation. Copy comes from the module's messages; styling
+// only from @softure-ai/ui classes and tokens.
+
+export type DeleteAccountAction = (previous: DeleteAccountFormState, formData: FormData) => Promise<DeleteAccountFormState>;
+
+export type DeleteAccountFormSlot = "root" | "description" | "form";
+
+export interface DeleteAccountFormProps {
+  readonly action: DeleteAccountAction;
+  readonly messages: PrivacyMessages;
+  /** Locale of the built-in copy of the ui primitives. */
+  readonly locale?: Locale;
+  readonly classNames?: ClassNames<DeleteAccountFormSlot>;
+  readonly unstyled?: boolean;
+}
+
+const DEFAULT_CLASSES: Readonly<Record<DeleteAccountFormSlot, string>> = {
+  root: "sft:flex sft:flex-col sft:gap-3 sft:font-sans",
+  description: "sft:m-0 sft:text-sm sft:text-muted",
+  form: "sft:flex sft:flex-col sft:gap-3",
+};
+
+export function DeleteAccountForm({ action, messages, locale, classNames, unstyled }: DeleteAccountFormProps) {
+  const [state, formAction, isPending] = useActionState(action, INITIAL_DELETE_ACCOUNT_STATE);
+  const slot = createSlotClassGetter({ defaults: DEFAULT_CLASSES, classNames, unstyled });
+  const message = state.error === undefined ? undefined : getPrivacyErrorMessage(messages, state.error);
+  const errorAt = (field: DeleteAccountField) => (state.field === field ? message : undefined);
+  return (
+    <div className={slot("root")}>
+      <p className={slot("description")}>{messages.delete.description}</p>
+      <form action={formAction} className={slot("form")}>
+        <PasswordField
+          name="password"
+          label={messages.delete.password}
+          autoComplete="current-password"
+          error={errorAt("password")}
+          unstyled={unstyled}
+          locale={locale}
+        />
+        <Checkbox name="confirm" label={messages.delete.confirm} required error={errorAt("confirm")} unstyled={unstyled} />
+        <FormError message={state.field === undefined ? message : undefined} unstyled={unstyled} />
+        <Button type="submit" variant="danger" fullWidth pending={isPending} unstyled={unstyled}>
+          {isPending ? messages.delete.pending : messages.delete.submit}
+        </Button>
+      </form>
+    </div>
+  );
+}

package/src/ui/index.ts

@@ -0,0 +1,21 @@
+// The privacy forms and the legal document shell, to compose into the app's own pages. The form
+// takes the server action from `@softure-ai/privacy/next` as a prop: no `next/*` import here
+// (docs/02-module-standard.md §5).
+export {
+  DeleteAccountForm,
+  type DeleteAccountAction,
+  type DeleteAccountFormProps,
+  type DeleteAccountFormSlot,
+} from "./delete-account-form.js";
+export {
+  formatLegalDate,
+  LegalDocument,
+  LegalSection,
+  type LegalChange,
+  type LegalDocumentProps,
+  type LegalDocumentSlot,
+  type LegalSectionContent,
+  type LegalSectionProps,
+  type LegalSectionSlot,
+} from "./legal-document.js";
+export { LegalFooter, type LegalFooterLink, type LegalFooterProps, type LegalFooterSlot } from "./legal-footer.js";

package/src/ui/legal-document.tsx

@@ -0,0 +1,189 @@
+import type { Locale } from "@softure-ai/core";
+import { type ClassNames, createSlotClassGetter } from "@softure-ai/ui";
+import type { ReactNode } from "react";
+import type { PrivacyMessages } from "../messages/index.js";
+
+// The legal document shell: a title with the version in force and its effective date, a table of
+// contents linking to the sections, the sections, and the history of changes. Every word of the
+// document is the app's (props); the module adds only its labels, from privacy's messages. A
+// server component: no state and no client JavaScript.
+
+/** One section of a document: `id` is its anchor in the table of contents. */
+export interface LegalSectionContent {
+  /** Kebab-case anchor, unique in the document, e.g. `data-we-collect`. */
+  readonly id: string;
+  readonly title: ReactNode;
+  readonly content: ReactNode;
+}
+
+/** One entry of the change history. */
+export interface LegalChange {
+  readonly version: string;
+  /** ISO date, `YYYY-MM-DD`. */
+  readonly date: string;
+  readonly summary: ReactNode;
+}
+
+export type LegalSectionSlot = "root" | "title" | "body";
+
+export interface LegalSectionProps {
+  readonly id: string;
+  readonly title: ReactNode;
+  readonly children: ReactNode;
+  readonly classNames?: ClassNames<LegalSectionSlot>;
+  readonly unstyled?: boolean;
+}
+
+const SECTION_CLASSES: Readonly<Record<LegalSectionSlot, string>> = {
+  root: "sft:flex sft:flex-col sft:gap-2 sft:scroll-mt-4",
+  title: "sft:m-0 sft:font-heading sft:text-lg sft:font-semibold sft:text-foreground",
+  body: "sft:flex sft:flex-col sft:gap-2 sft:text-sm sft:leading-relaxed sft:text-foreground",
+};
+
+/** A titled section with an anchor; `LegalDocument` renders one per entry of `sections`. */
+export function LegalSection({ id, title, children, classNames, unstyled }: LegalSectionProps) {
+  const slot = createSlotClassGetter({ defaults: SECTION_CLASSES, classNames, unstyled });
+  return (
+    <section id={id} aria-labelledby={`${id}-title`} className={slot("root")}>
+      <h2 id={`${id}-title`} className={slot("title")}>
+        {title}
+      </h2>
+      <div className={slot("body")}>{children}</div>
+    </section>
+  );
+}
+
+export type LegalDocumentSlot =
+  | "root"
+  | "header"
+  | "title"
+  | "meta"
+  | "intro"
+  | "contents"
+  | "contentsTitle"
+  | "contentsList"
+  | "link"
+  | "changes"
+  | "changesTitle"
+  | "changesList"
+  | "change"
+  | "changeMeta";
+
+export interface LegalDocumentProps {
+  readonly title: ReactNode;
+  /** The version in force; read it from the config with `getLegalDocument(config, id).version`. */
+  readonly version: string;
+  /** ISO date, `YYYY-MM-DD`, from which this version applies. */
+  readonly effectiveFrom: string;
+  readonly intro?: ReactNode;
+  readonly sections: readonly LegalSectionContent[];
+  /** Newest first, as the reader expects; none hides the history. */
+  readonly changes?: readonly LegalChange[];
+  readonly messages: PrivacyMessages;
+  /** Formats the dates. */
+  readonly locale: Locale;
+  readonly classNames?: ClassNames<LegalDocumentSlot>;
+  /** Classes of every section. */
+  readonly sectionClassNames?: ClassNames<LegalSectionSlot>;
+  readonly unstyled?: boolean;
+}
+
+const DOCUMENT_CLASSES: Readonly<Record<LegalDocumentSlot, string>> = {
+  root: "sft:mx-auto sft:box-border sft:flex sft:w-full sft:flex-col sft:gap-4 sft:sm:max-w-3xl sft:px-4 sft:py-4 sft:font-sans",
+  header: "sft:flex sft:flex-col sft:gap-2",
+  title: "sft:m-0 sft:font-heading sft:text-2xl sft:sm:text-3xl sft:font-bold sft:tracking-tight sft:text-foreground",
+  meta: "sft:m-0 sft:text-sm sft:text-muted",
+  intro: "sft:text-sm sft:leading-relaxed sft:text-foreground",
+  contents: "sft:flex sft:flex-col sft:gap-2 sft:rounded-card sft:border sft:border-border sft:bg-surface sft:p-4",
+  contentsTitle: "sft:m-0 sft:text-base sft:font-semibold sft:text-foreground",
+  contentsList: "sft:m-0 sft:flex sft:flex-col sft:gap-1 sft:pl-8 sft:text-sm",
+  link: "sft:text-accent sft:focus-visible:outline-2 sft:focus-visible:outline-focus sft:focus-visible:outline-offset-2",
+  changes: "sft:flex sft:flex-col sft:gap-2 sft:border-t sft:border-border sft:pt-4 sft:scroll-mt-4",
+  changesTitle: "sft:m-0 sft:font-heading sft:text-lg sft:font-semibold sft:text-foreground",
+  changesList: "sft:m-0 sft:flex sft:flex-col sft:gap-2 sft:p-0 sft:list-none sft:text-sm",
+  change: "sft:flex sft:flex-col sft:gap-1",
+  changeMeta: "sft:font-medium sft:text-muted sft:tabular-nums",
+};
+
+const ISO_DATE = /^(\d{4})-(\d{2})-(\d{2})$/;
+
+/** `2026-10-01` as the locale writes it (`October 1, 2026` in English); other text as given. */
+export function formatLegalDate(date: string, locale: Locale): string {
+  const match = ISO_DATE.exec(date);
+  if (match === null) return date;
+  const [, year, month, day] = match.map(Number) as [number, number, number, number];
+  const value = new Date(Date.UTC(year, month - 1, day));
+  // A calendar date, so UTC: the server's time zone must not move it to the day before.
+  if (value.getUTCDate() !== day) return date;
+  return new Intl.DateTimeFormat(locale, { dateStyle: "long", timeZone: "UTC" }).format(value);
+}
+
+/** The id of the change history section; the table of contents does not list it. */
+const CHANGES_ID = "legal-changes";
+const CONTENTS_TITLE_ID = "legal-contents-title";
+
+export function LegalDocument({
+  title,
+  version,
+  effectiveFrom,
+  intro,
+  sections,
+  changes = [],
+  messages,
+  locale,
+  classNames,
+  sectionClassNames,
+  unstyled,
+}: LegalDocumentProps) {
+  const slot = createSlotClassGetter({ defaults: DOCUMENT_CLASSES, classNames, unstyled });
+  const copy = messages.legal;
+  return (
+    <article className={slot("root")}>
+      <header className={slot("header")}>
+        <h1 className={slot("title")}>{title}</h1>
+        <p className={slot("meta")}>
+          {copy.version} {version} · {copy.effectiveFrom} {formatLegalDate(effectiveFrom, locale)}
+        </p>
+        {intro === undefined ? null : <div className={slot("intro")}>{intro}</div>}
+      </header>
+      {sections.length === 0 ? null : (
+        <nav aria-labelledby={CONTENTS_TITLE_ID} className={slot("contents")}>
+          <h2 id={CONTENTS_TITLE_ID} className={slot("contentsTitle")}>
+            {copy.contents}
+          </h2>
+          <ol className={slot("contentsList")}>
+            {sections.map((section) => (
+              <li key={section.id}>
+                <a href={`#${section.id}`} className={slot("link")}>
+                  {section.title}
+                </a>
+              </li>
+            ))}
+          </ol>
+        </nav>
+      )}
+      {sections.map((section) => (
+        <LegalSection key={section.id} id={section.id} title={section.title} classNames={sectionClassNames} unstyled={unstyled}>
+          {section.content}
+        </LegalSection>
+      ))}
+      {changes.length === 0 ? null : (
+        <section id={CHANGES_ID} aria-labelledby={`${CHANGES_ID}-title`} className={slot("changes")}>
+          <h2 id={`${CHANGES_ID}-title`} className={slot("changesTitle")}>
+            {copy.changes}
+          </h2>
+          <ol className={slot("changesList")}>
+            {changes.map((change) => (
+              <li key={change.version} className={slot("change")}>
+                <span className={slot("changeMeta")}>
+                  {copy.version} {change.version} · {formatLegalDate(change.date, locale)}
+                </span>
+                <span>{change.summary}</span>
+              </li>
+            ))}
+          </ol>
+        </section>
+      )}
+    </article>
+  );
+}

package/src/ui/legal-footer.tsx

@@ -0,0 +1,50 @@
+import { type ClassNames, createSlotClassGetter } from "@softure-ai/ui";
+import type { ReactNode } from "react";
+import type { PrivacyMessages } from "../messages/index.js";
+
+// The links to the app's legal documents, for the bottom of every page. The app passes the links
+// and their labels (its own copy); the navigation's accessible name comes from privacy's messages.
+// A server component.
+
+export interface LegalFooterLink {
+  readonly href: string;
+  readonly label: ReactNode;
+}
+
+export type LegalFooterSlot = "root" | "list" | "link" | "note";
+
+export interface LegalFooterProps {
+  readonly links: readonly LegalFooterLink[];
+  /** A line under the links, e.g. the operator's name and address. */
+  readonly note?: ReactNode;
+  readonly messages: PrivacyMessages;
+  readonly classNames?: ClassNames<LegalFooterSlot>;
+  readonly unstyled?: boolean;
+}
+
+const DEFAULT_CLASSES: Readonly<Record<LegalFooterSlot, string>> = {
+  root: "sft:mx-auto sft:box-border sft:flex sft:w-full sft:flex-col sft:items-center sft:gap-2 sft:border-t sft:border-border sft:px-4 sft:py-4 sft:font-sans sft:text-sm sft:text-muted",
+  list: "sft:m-0 sft:flex sft:items-center sft:justify-center sft:gap-4 sft:p-0 sft:list-none",
+  link: "sft:text-muted sft:hover:text-foreground sft:focus-visible:outline-2 sft:focus-visible:outline-focus sft:focus-visible:outline-offset-2",
+  note: "sft:m-0 sft:text-xs sft:text-center",
+};
+
+export function LegalFooter({ links, note, messages, classNames, unstyled }: LegalFooterProps) {
+  const slot = createSlotClassGetter({ defaults: DEFAULT_CLASSES, classNames, unstyled });
+  return (
+    <footer className={slot("root")}>
+      <nav aria-label={messages.legal.footer}>
+        <ul className={slot("list")}>
+          {links.map((link) => (
+            <li key={link.href}>
+              <a href={link.href} className={slot("link")}>
+                {link.label}
+              </a>
+            </li>
+          ))}
+        </ul>
+      </nav>
+      {note === undefined ? null : <p className={slot("note")}>{note}</p>}
+    </footer>
+  );
+}