@tantainnovative/create-ndpr 0.1.0 → 0.4.0

package/templates/express-cross-border-route.ts

@@ -0,0 +1,317 @@
+/**
+ * Express — Cross-Border Transfer Router
+ * Generated by create-ndpr for: {{ORG_NAME}}
+ * DPO: {{DPO_EMAIL}}
+ *
+ * NDPA §41–43 — transfers of personal data outside Nigeria require
+ * adequate safeguards and, in some cases, NDPC approval.
+ *
+ * Routes:
+ *   GET    /cross-border               — List transfers (optional ?riskLevel= or ?destinationCountry= filter)
+ *   GET    /cross-border/:id           — Get a single transfer record
+ *   POST   /cross-border               — Register a new cross-border transfer
+ *   PUT    /cross-border/:id           — Update an existing transfer record
+ *   DELETE /cross-border/:id           — Delete a transfer record
+ *
+ * Usage:
+ *   import { crossBorderRouter } from './routes/cross-border';
+ *   app.use('/api/cross-border', crossBorderRouter);
+ */
+
+import { Router } from 'express';
+// {{#if ORM=prisma}}
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+// {{/if}}
+// {{#if ORM=drizzle}}
+import { db } from '@/drizzle';
+import { crossBorderTransferRecords, complianceAuditLog } from '@/drizzle/ndpr-schema';
+import { eq, and, desc, type SQL } from 'drizzle-orm';
+// {{/if}}
+// {{#if ORM=none}}
+// TODO ({{ORG_NAME}}): wire this to your persistent store of choice. The
+// in-memory map below is enough to develop against locally but DOES NOT
+// satisfy NDPA Section 44 (record-keeping) or the cross-border register
+// NDPC inspects under Sections 41–43. Replace `crossBorderStore`/`auditLog`
+// with your DB / KV / API.
+interface CrossBorderTransferRecord {
+  id: string;
+  destinationCountry: string;
+  recipientName: string;
+  transferMechanism: string;
+  safeguards: string;
+  dataCategories: string[];
+  adequacyStatus: string;
+  ndpcApprovalRequired: boolean;
+  ndpcApprovalReference: string | null;
+  riskLevel: string;
+  createdAt: Date;
+  updatedAt: Date;
+}
+const crossBorderStore = new Map<string, CrossBorderTransferRecord>();
+const auditLog: Array<{ id: string; module: string; action: string; entityId: string; at: Date }> = [];
+function newId() { return crypto.randomUUID(); }
+// {{/if}}
+
+export const crossBorderRouter = Router();
+
+// GET /cross-border?riskLevel=high&destinationCountry=US
+crossBorderRouter.get('/', async (req, res) => {
+  const { riskLevel, destinationCountry } = req.query;
+  const riskLevelFilter = typeof riskLevel === 'string' ? riskLevel : undefined;
+  const destinationCountryFilter = typeof destinationCountry === 'string' ? destinationCountry : undefined;
+
+  // {{#if ORM=prisma}}
+  const where: Record<string, string> = {};
+  if (riskLevelFilter) where.riskLevel = riskLevelFilter;
+  if (destinationCountryFilter) where.destinationCountry = destinationCountryFilter;
+
+  const records = await prisma.crossBorderTransferRecord.findMany({
+    where: Object.keys(where).length > 0 ? where : undefined,
+    orderBy: { createdAt: 'desc' },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const filters: SQL[] = [];
+  if (riskLevelFilter) filters.push(eq(crossBorderTransferRecords.riskLevel, riskLevelFilter));
+  if (destinationCountryFilter) filters.push(eq(crossBorderTransferRecords.destinationCountry, destinationCountryFilter));
+
+  const records = filters.length > 0
+    ? await db.select().from(crossBorderTransferRecords).where(and(...filters)).orderBy(desc(crossBorderTransferRecords.createdAt))
+    : await db.select().from(crossBorderTransferRecords).orderBy(desc(crossBorderTransferRecords.createdAt));
+  // {{/if}}
+  // {{#if ORM=none}}
+  const records = [...crossBorderStore.values()]
+    .filter((r) => (riskLevelFilter ? r.riskLevel === riskLevelFilter : true))
+    .filter((r) => (destinationCountryFilter ? r.destinationCountry === destinationCountryFilter : true))
+    .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+  // {{/if}}
+
+  return res.json(records);
+});
+
+// GET /cross-border/:id
+crossBorderRouter.get('/:id', async (req, res) => {
+  // {{#if ORM=prisma}}
+  const record = await prisma.crossBorderTransferRecord.findUnique({ where: { id: req.params.id } });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [record] = await db.select().from(crossBorderTransferRecords).where(eq(crossBorderTransferRecords.id, req.params.id)).limit(1);
+  // {{/if}}
+  // {{#if ORM=none}}
+  const record = crossBorderStore.get(req.params.id) ?? null;
+  // {{/if}}
+
+  if (!record) {
+    return res.status(404).json({ error: 'Cross-border transfer record not found' });
+  }
+
+  return res.json(record);
+});
+
+// POST /cross-border
+crossBorderRouter.post('/', async (req, res) => {
+  const {
+    destinationCountry,
+    recipientName,
+    transferMechanism,
+    safeguards,
+    dataCategories,
+    adequacyStatus,
+    ndpcApprovalRequired,
+    ndpcApprovalReference,
+    riskLevel,
+  } = req.body;
+
+  if (
+    !destinationCountry ||
+    !recipientName ||
+    !transferMechanism ||
+    !safeguards ||
+    !dataCategories ||
+    !adequacyStatus ||
+    !riskLevel
+  ) {
+    return res.status(400).json({
+      error:
+        'destinationCountry, recipientName, transferMechanism, safeguards, dataCategories, adequacyStatus, and riskLevel are required',
+    });
+  }
+
+  if (!Array.isArray(dataCategories)) {
+    return res.status(400).json({ error: 'dataCategories must be an array' });
+  }
+
+  // {{#if ORM=prisma}}
+  const record = await prisma.crossBorderTransferRecord.create({
+    data: {
+      destinationCountry,
+      recipientName,
+      transferMechanism,
+      safeguards,
+      dataCategories,
+      adequacyStatus,
+      ndpcApprovalRequired: ndpcApprovalRequired ?? false,
+      ndpcApprovalReference: ndpcApprovalReference ?? null,
+      riskLevel,
+    },
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'cross-border',
+      action: 'created',
+      entityId: record.id,
+      entityType: 'CrossBorderTransferRecord',
+      changes: { destinationCountry, recipientName, riskLevel },
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [record] = await db.insert(crossBorderTransferRecords).values({
+    destinationCountry,
+    recipientName,
+    transferMechanism,
+    safeguards,
+    dataCategories,
+    adequacyStatus,
+    ndpcApprovalRequired: ndpcApprovalRequired ?? false,
+    ndpcApprovalReference: ndpcApprovalReference ?? null,
+    riskLevel,
+  }).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'cross-border',
+    action: 'created',
+    entityId: record.id,
+    entityType: 'CrossBorderTransferRecord',
+    changes: { destinationCountry, recipientName, riskLevel },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const now = new Date();
+  const record: CrossBorderTransferRecord = {
+    id: newId(),
+    destinationCountry,
+    recipientName,
+    transferMechanism,
+    safeguards,
+    dataCategories,
+    adequacyStatus,
+    ndpcApprovalRequired: ndpcApprovalRequired ?? false,
+    ndpcApprovalReference: ndpcApprovalReference ?? null,
+    riskLevel,
+    createdAt: now,
+    updatedAt: now,
+  };
+  crossBorderStore.set(record.id, record);
+  auditLog.push({ id: newId(), module: 'cross-border', action: 'created', entityId: record.id, at: new Date() });
+  // {{/if}}
+
+  return res.status(201).json(record);
+});
+
+// PUT /cross-border/:id
+crossBorderRouter.put('/:id', async (req, res) => {
+  const { id } = req.params;
+
+  // {{#if ORM=prisma}}
+  const existing = await prisma.crossBorderTransferRecord.findUnique({ where: { id } });
+  if (!existing) {
+    return res.status(404).json({ error: 'Cross-border transfer record not found' });
+  }
+
+  const record = await prisma.crossBorderTransferRecord.update({
+    where: { id },
+    data: req.body,
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'cross-border',
+      action: 'updated',
+      entityId: record.id,
+      entityType: 'CrossBorderTransferRecord',
+      changes: req.body,
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [existing] = await db.select().from(crossBorderTransferRecords).where(eq(crossBorderTransferRecords.id, id)).limit(1);
+  if (!existing) {
+    return res.status(404).json({ error: 'Cross-border transfer record not found' });
+  }
+
+  const [record] = await db.update(crossBorderTransferRecords).set(req.body).where(eq(crossBorderTransferRecords.id, id)).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'cross-border',
+    action: 'updated',
+    entityId: record.id,
+    entityType: 'CrossBorderTransferRecord',
+    changes: req.body,
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = crossBorderStore.get(id);
+  if (!existing) {
+    return res.status(404).json({ error: 'Cross-border transfer record not found' });
+  }
+  const record: CrossBorderTransferRecord = { ...existing, ...req.body, id, updatedAt: new Date() };
+  crossBorderStore.set(id, record);
+  auditLog.push({ id: newId(), module: 'cross-border', action: 'updated', entityId: record.id, at: new Date() });
+  // {{/if}}
+
+  return res.json(record);
+});
+
+// DELETE /cross-border/:id
+crossBorderRouter.delete('/:id', async (req, res) => {
+  const { id } = req.params;
+
+  // {{#if ORM=prisma}}
+  const existing = await prisma.crossBorderTransferRecord.findUnique({ where: { id } });
+  if (!existing) {
+    return res.status(404).json({ error: 'Cross-border transfer record not found' });
+  }
+
+  await prisma.crossBorderTransferRecord.delete({ where: { id } });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'cross-border',
+      action: 'deleted',
+      entityId: id,
+      entityType: 'CrossBorderTransferRecord',
+      changes: { destinationCountry: existing.destinationCountry, recipientName: existing.recipientName },
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [existing] = await db.select().from(crossBorderTransferRecords).where(eq(crossBorderTransferRecords.id, id)).limit(1);
+  if (!existing) {
+    return res.status(404).json({ error: 'Cross-border transfer record not found' });
+  }
+
+  await db.delete(crossBorderTransferRecords).where(eq(crossBorderTransferRecords.id, id));
+
+  await db.insert(complianceAuditLog).values({
+    module: 'cross-border',
+    action: 'deleted',
+    entityId: id,
+    entityType: 'CrossBorderTransferRecord',
+    changes: { destinationCountry: existing.destinationCountry, recipientName: existing.recipientName },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = crossBorderStore.get(id);
+  if (!existing) {
+    return res.status(404).json({ error: 'Cross-border transfer record not found' });
+  }
+  crossBorderStore.delete(id);
+  auditLog.push({ id: newId(), module: 'cross-border', action: 'deleted', entityId: id, at: new Date() });
+  // {{/if}}
+
+  return res.json({ success: true });
+});

package/templates/express-dpia-route.ts

@@ -0,0 +1,287 @@
+/**
+ * Express — DPIA (Data Protection Impact Assessment) Router
+ * Generated by create-ndpr for: {{ORG_NAME}}
+ * DPO: {{DPO_EMAIL}}
+ *
+ * NDPA §28 — a DPIA must be conducted where processing is likely
+ * to result in a high risk to the rights and freedoms of data subjects.
+ *
+ * Routes:
+ *   GET    /dpia               — List DPIA records (optional ?status= filter)
+ *   GET    /dpia/:id           — Get a single DPIA record
+ *   POST   /dpia               — Create a new DPIA record
+ *   PUT    /dpia/:id           — Update an existing DPIA record
+ *   DELETE /dpia/:id           — Delete a DPIA record
+ *
+ * Usage:
+ *   import { dpiaRouter } from './routes/dpia';
+ *   app.use('/api/dpia', dpiaRouter);
+ */
+
+import { Router } from 'express';
+// {{#if ORM=prisma}}
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+// {{/if}}
+// {{#if ORM=drizzle}}
+import { db } from '@/drizzle';
+import { dpiaRecords, complianceAuditLog } from '@/drizzle/ndpr-schema';
+import { eq, desc } from 'drizzle-orm';
+// {{/if}}
+// {{#if ORM=none}}
+// TODO ({{ORG_NAME}}): wire this to your persistent store of choice. The
+// in-memory map below is enough to develop against locally but DOES NOT
+// satisfy NDPA Section 44 (record-keeping). Replace `dpiaStore`/`auditLog`
+// with your DB / KV / API.
+interface DPIARecord {
+  id: string;
+  projectName: string;
+  description: string;
+  dpiaData: unknown;
+  overallRisk: string;
+  score: number;
+  status: string;
+  conductedBy: string;
+  approvedBy: string | null;
+  createdAt: Date;
+  updatedAt: Date;
+}
+const dpiaStore = new Map<string, DPIARecord>();
+const auditLog: Array<{ id: string; module: string; action: string; entityId: string; at: Date }> = [];
+function newId() { return crypto.randomUUID(); }
+// {{/if}}
+
+export const dpiaRouter = Router();
+
+// GET /dpia?status=draft
+dpiaRouter.get('/', async (req, res) => {
+  const { status } = req.query;
+  const statusFilter = typeof status === 'string' ? status : undefined;
+
+  // {{#if ORM=prisma}}
+  const records = await prisma.dPIARecord.findMany({
+    where: statusFilter ? { status: statusFilter } : undefined,
+    orderBy: { createdAt: 'desc' },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const records = statusFilter
+    ? await db.select().from(dpiaRecords).where(eq(dpiaRecords.status, statusFilter)).orderBy(desc(dpiaRecords.createdAt))
+    : await db.select().from(dpiaRecords).orderBy(desc(dpiaRecords.createdAt));
+  // {{/if}}
+  // {{#if ORM=none}}
+  const records = [...dpiaStore.values()]
+    .filter((r) => (statusFilter ? r.status === statusFilter : true))
+    .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+  // {{/if}}
+
+  return res.json(records);
+});
+
+// GET /dpia/:id
+dpiaRouter.get('/:id', async (req, res) => {
+  // {{#if ORM=prisma}}
+  const record = await prisma.dPIARecord.findUnique({ where: { id: req.params.id } });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [record] = await db.select().from(dpiaRecords).where(eq(dpiaRecords.id, req.params.id)).limit(1);
+  // {{/if}}
+  // {{#if ORM=none}}
+  const record = dpiaStore.get(req.params.id) ?? null;
+  // {{/if}}
+
+  if (!record) {
+    return res.status(404).json({ error: 'DPIA record not found' });
+  }
+
+  return res.json(record);
+});
+
+// POST /dpia
+dpiaRouter.post('/', async (req, res) => {
+  const {
+    projectName,
+    description,
+    dpiaData,
+    overallRisk,
+    score,
+    conductedBy,
+    approvedBy,
+  } = req.body;
+
+  if (!projectName || !description || !dpiaData || !overallRisk || score == null || !conductedBy) {
+    return res.status(400).json({
+      error: 'projectName, description, dpiaData, overallRisk, score, and conductedBy are required',
+    });
+  }
+
+  // {{#if ORM=prisma}}
+  const record = await prisma.dPIARecord.create({
+    data: {
+      projectName,
+      description,
+      dpiaData,
+      overallRisk,
+      score,
+      status: 'draft',
+      conductedBy,
+      approvedBy: approvedBy ?? null,
+    },
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'dpia',
+      action: 'created',
+      entityId: record.id,
+      entityType: 'DPIARecord',
+      changes: { projectName, overallRisk, score, status: 'draft' },
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [record] = await db.insert(dpiaRecords).values({
+    projectName,
+    description,
+    dpiaData,
+    overallRisk,
+    score,
+    status: 'draft',
+    conductedBy,
+    approvedBy: approvedBy ?? null,
+  }).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'dpia',
+    action: 'created',
+    entityId: record.id,
+    entityType: 'DPIARecord',
+    changes: { projectName, overallRisk, score, status: 'draft' },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const now = new Date();
+  const record: DPIARecord = {
+    id: newId(),
+    projectName,
+    description,
+    dpiaData,
+    overallRisk,
+    score,
+    status: 'draft',
+    conductedBy,
+    approvedBy: approvedBy ?? null,
+    createdAt: now,
+    updatedAt: now,
+  };
+  dpiaStore.set(record.id, record);
+  auditLog.push({ id: newId(), module: 'dpia', action: 'created', entityId: record.id, at: new Date() });
+  // {{/if}}
+
+  return res.status(201).json(record);
+});
+
+// PUT /dpia/:id
+dpiaRouter.put('/:id', async (req, res) => {
+  const { id } = req.params;
+
+  // {{#if ORM=prisma}}
+  const existing = await prisma.dPIARecord.findUnique({ where: { id } });
+  if (!existing) {
+    return res.status(404).json({ error: 'DPIA record not found' });
+  }
+
+  const record = await prisma.dPIARecord.update({
+    where: { id },
+    data: req.body,
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'dpia',
+      action: 'updated',
+      entityId: record.id,
+      entityType: 'DPIARecord',
+      changes: req.body,
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [existing] = await db.select().from(dpiaRecords).where(eq(dpiaRecords.id, id)).limit(1);
+  if (!existing) {
+    return res.status(404).json({ error: 'DPIA record not found' });
+  }
+
+  const [record] = await db.update(dpiaRecords).set(req.body).where(eq(dpiaRecords.id, id)).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'dpia',
+    action: 'updated',
+    entityId: record.id,
+    entityType: 'DPIARecord',
+    changes: req.body,
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = dpiaStore.get(id);
+  if (!existing) {
+    return res.status(404).json({ error: 'DPIA record not found' });
+  }
+  const record: DPIARecord = { ...existing, ...req.body, id, updatedAt: new Date() };
+  dpiaStore.set(id, record);
+  auditLog.push({ id: newId(), module: 'dpia', action: 'updated', entityId: record.id, at: new Date() });
+  // {{/if}}
+
+  return res.json(record);
+});
+
+// DELETE /dpia/:id
+dpiaRouter.delete('/:id', async (req, res) => {
+  const { id } = req.params;
+
+  // {{#if ORM=prisma}}
+  const existing = await prisma.dPIARecord.findUnique({ where: { id } });
+  if (!existing) {
+    return res.status(404).json({ error: 'DPIA record not found' });
+  }
+
+  await prisma.dPIARecord.delete({ where: { id } });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'dpia',
+      action: 'deleted',
+      entityId: id,
+      entityType: 'DPIARecord',
+      changes: { projectName: existing.projectName },
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [existing] = await db.select().from(dpiaRecords).where(eq(dpiaRecords.id, id)).limit(1);
+  if (!existing) {
+    return res.status(404).json({ error: 'DPIA record not found' });
+  }
+
+  await db.delete(dpiaRecords).where(eq(dpiaRecords.id, id));
+
+  await db.insert(complianceAuditLog).values({
+    module: 'dpia',
+    action: 'deleted',
+    entityId: id,
+    entityType: 'DPIARecord',
+    changes: { projectName: existing.projectName },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = dpiaStore.get(id);
+  if (!existing) {
+    return res.status(404).json({ error: 'DPIA record not found' });
+  }
+  dpiaStore.delete(id);
+  auditLog.push({ id: newId(), module: 'dpia', action: 'deleted', entityId: id, at: new Date() });
+  // {{/if}}
+
+  return res.json({ success: true });
+});