@tantainnovative/create-ndpr 0.1.0 → 0.5.0

package/templates/nextjs-request-context.ts

@@ -0,0 +1,137 @@
+import type { NextRequest } from 'next/server';
+
+export interface NDPRVerifiedActor {
+  /** Stable identity and profile fields from a verified server session. */
+  id: string;
+  displayName: string;
+  email: string;
+  department?: string;
+  /** Stable data-subject identifier for this account, when applicable. */
+  subjectId?: string;
+  /** Map application roles to ndpr:staff or ndpr:admin server-side. */
+  roles: readonly string[];
+}
+
+export interface NDPRRequestContext {
+  /** Verified tenant boundary. Never take this value from request input. */
+  tenantId: string;
+  /** Normalized verified actor; null for public/anonymous requests. */
+  actor: NDPRVerifiedActor | null;
+  actorId: string | null;
+  /** Verified account subject ID or high-entropy anonymous browser ID. */
+  subjectId: string | null;
+  subjectSource: 'verified-account-subject' | 'anonymous-uuid-capability' | null;
+  /** Verified application roles used by your authorization policy. */
+  roles: readonly string[];
+}
+
+export type NDPRContextRequirement = 'tenant' | 'subject' | 'staff';
+export interface NDPRContextProblem { status: 401 | 403 | 503; error: string }
+export type NDPRVerifiedActorResolver = (
+  request: NextRequest,
+) => Promise<NDPRVerifiedActor | null>;
+
+const ANONYMOUS_SUBJECT_PATTERN =
+  /^anon_[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const STAFF_ROLES = new Set(['ndpr:staff', 'ndpr:admin']);
+
+/**
+ * Authentication integration seam. Replace this safe default with your
+ * verified server session provider. Never trust actor, account subject,
+ * profile, role, or tenant fields from request-controlled input.
+ */
+export async function resolveVerifiedNDPRActor(
+  _request: NextRequest,
+): Promise<NDPRVerifiedActor | null> {
+  return null;
+}
+
+/**
+ * The tenant comes only from server configuration. The only client-provided
+ * identity accepted by default is a random anon_<UUID> subject capability;
+ * it never grants staff access.
+ */
+export async function resolveNDPRRequestContext(
+  request: NextRequest,
+  actorResolver: NDPRVerifiedActorResolver = resolveVerifiedNDPRActor,
+): Promise<NDPRRequestContext> {
+  const tenantId = process.env.NDPR_TENANT_ID?.trim() ?? '';
+  const candidate = request.headers.get('x-ndpr-subject-id')?.trim() ?? '';
+  const anonymousSubjectId = ANONYMOUS_SUBJECT_PATTERN.test(candidate)
+    ? candidate
+    : null;
+  const actor = normalizeVerifiedActor(await actorResolver(request));
+  const subjectId = actor?.subjectId ?? anonymousSubjectId;
+  const subjectSource = actor?.subjectId
+    ? 'verified-account-subject' as const
+    : anonymousSubjectId
+      ? 'anonymous-uuid-capability' as const
+      : null;
+
+  return {
+    tenantId,
+    actor,
+    actorId: actor?.id ?? null,
+    subjectId,
+    subjectSource,
+    roles: actor?.roles ?? [],
+  };
+}
+
+export function getNDPRContextProblem(
+  context: NDPRRequestContext,
+  requirement: NDPRContextRequirement,
+): NDPRContextProblem | null {
+  if (!context.tenantId) {
+    return {
+      status: 503,
+      error: 'NDPR_TENANT_ID is not configured on the server',
+    };
+  }
+  if (requirement === 'subject' && !context.subjectId) {
+    return { status: 401, error: 'A verified data-subject identity is required' };
+  }
+  if (requirement === 'staff' && !context.actorId) {
+    return {
+      status: 401,
+      error: 'Connect resolveVerifiedNDPRActor to verified staff authentication',
+    };
+  }
+  if (requirement === 'staff'
+    && !context.roles.some((role) => STAFF_ROLES.has(role))) {
+    return { status: 403, error: 'NDPR staff or administrator role required' };
+  }
+  return null;
+}
+
+function normalizeVerifiedActor(
+  actor: NDPRVerifiedActor | null,
+): NDPRVerifiedActor | null {
+  if (!actor
+    || typeof actor.id !== 'string'
+    || typeof actor.displayName !== 'string'
+    || typeof actor.email !== 'string'
+    || !Array.isArray(actor.roles)) {
+    return null;
+  }
+  const id = actor.id.trim();
+  const displayName = actor.displayName.trim();
+  const email = actor.email.trim();
+  if (!id || !displayName || !email) return null;
+
+  return {
+    id,
+    displayName,
+    email,
+    department: typeof actor.department === 'string'
+      ? actor.department.trim() || undefined
+      : undefined,
+    subjectId: typeof actor.subjectId === 'string'
+      ? actor.subjectId.trim() || undefined
+      : undefined,
+    roles: actor.roles
+      .filter((role): role is string => typeof role === 'string')
+      .map((role) => role.trim())
+      .filter(Boolean),
+  };
+}

package/templates/prisma-schema.prisma

@@ -1,15 +1,5 @@
-// NDPA Compliance Schema — generated by create-ndpr
-// Organisation: {{ORG_NAME}}
-// DPO: {{DPO_EMAIL}}
-//
-// Covers:
-//   - ConsentRecord       — NDPA §25–26 (consent & withdrawal)
-//   - DSRRequest          — NDPA Part IV §34–38 (data subject rights)
-//   - BreachReport        — NDPA §40 (72-hour breach notification)
-//   - ProcessingRecord    — ROPA (accountability principle)
-//   - ComplianceAuditLog  — §44 audit trail
-//
-// Run `prisma migrate dev --name ndpr-init` to apply.
+// NDPA compliance schema — generated by create-ndpr for {{ORG_NAME_COMMENT}}
+// Every row is tenant-scoped. Derive tenantId only from verified server context.
 
 generator client {
   provider = "prisma-client-js"
@@ -21,25 +11,32 @@ datasource db {
 }
 
 model ConsentRecord {
-  id            String    @id @default(cuid())
-  subjectId     String
-  consents      Json
-  version       String
-  method        String
-  lawfulBasis   String?
-  ipAddress     String?
-  userAgent     String?
-  createdAt     DateTime  @default(now())
-  revokedAt     DateTime?
-
-  @@index([subjectId])
+  id               String   @id @default(cuid())
+  tenantId         String
+  subjectId        String
+  activeSubjectKey String?  @unique
+  consents         Json
+  version          String
+  method           String
+  hasInteracted    Boolean
+  lawfulBasis      String?
+  ipAddress        String?
+  userAgent        String?
+  clientTimestamp  DateTime
+  createdAt        DateTime @default(now())
+  revokedAt        DateTime?
+
+  @@index([tenantId, subjectId, revokedAt])
+  @@index([tenantId, subjectId, clientTimestamp, version, method])
   @@map("ndpr_consent_records")
 }
 
 model DSRRequest {
-  id              String    @id @default(cuid())
+  id              String   @id @default(cuid())
+  tenantId        String
+  subjectId       String
   type            String
-  status          String    @default("pending")
+  status          String   @default("pending")
   subjectName     String
   subjectEmail    String
   subjectPhone    String?
@@ -48,43 +45,53 @@ model DSRRequest {
   description     String?
   internalNotes   String?
   assignedTo      String?
-  submittedAt     DateTime  @default(now())
+  submittedAt     DateTime @default(now())
   acknowledgedAt  DateTime?
   completedAt     DateTime?
   dueAt           DateTime
 
-  @@index([status])
-  @@index([subjectEmail])
+  @@index([tenantId, status])
+  @@index([tenantId, subjectId])
+  @@index([tenantId, subjectEmail])
   @@map("ndpr_dsr_requests")
 }
 
 model BreachReport {
-  id                   String    @id @default(cuid())
-  title                String
-  description          String
-  category             String
-  severity             String
-  status               String    @default("ongoing")
-  discoveredAt         DateTime
-  occurredAt           DateTime?
-  reportedAt           DateTime  @default(now())
-  ndpcNotifiedAt       DateTime?
-  reporterName         String
-  reporterEmail        String
-  reporterDepartment   String?
-  affectedSystems      Json
-  dataTypes            Json
-  estimatedAffected    Int?
-  initialActions       String?
-  ndpcNotificationSent Boolean   @default(false)
-
-  @@index([status])
-  @@index([severity])
+  id                     String   @id @default(cuid())
+  tenantId               String
+  title                  String
+  description            String
+  category               String
+  severity               String
+  status                 String   @default("ongoing")
+  discoveredAt           DateTime
+  occurredAt             DateTime?
+  reportedAt             DateTime @default(now())
+  ndpcNotifiedAt         DateTime?
+  reporterName           String
+  reporterEmail          String
+  reporterDepartment     String?
+  affectedSystems        Json
+  dataTypes              Json
+  involvesSensitiveData  Boolean  @default(false)
+  estimatedAffected      Int?
+  approximateRecordCount Int?
+  dataSubjectCategories  Json
+  likelyConsequences     String?
+  mitigationMeasures     String?
+  isPhasedReport         Boolean  @default(false)
+  supplementsReportId    String?
+  initialActions         String?
+  ndpcNotificationSent   Boolean  @default(false)
+
+  @@index([tenantId, status])
+  @@index([tenantId, severity])
   @@map("ndpr_breach_reports")
 }
 
 model ProcessingRecord {
   id                String   @id @default(cuid())
+  tenantId          String
   purpose           String
   lawfulBasis       String
   dataCategories    Json
@@ -99,11 +106,74 @@ model ProcessingRecord {
   createdAt         DateTime @default(now())
   updatedAt         DateTime @updatedAt
 
+  @@index([tenantId, status])
   @@map("ndpr_processing_records")
 }
 
+model DPIARecord {
+  id          String    @id @default(cuid())
+  tenantId    String
+  projectName String
+  description String
+  dpiaData    Json
+  overallRisk String
+  score       Int
+  status      String    @default("draft")
+  conductedBy String
+  approvedBy  String?
+  createdAt   DateTime  @default(now())
+  updatedAt   DateTime  @updatedAt
+  removedAt   DateTime?
+
+  @@index([tenantId, removedAt, status])
+  @@map("ndpr_dpia_records")
+}
+
+model LawfulBasisRecord {
+  id             String    @id @default(cuid())
+  tenantId       String
+  activityName   String
+  lawfulBasis    String
+  justification  String
+  dataCategories Json
+  purposes       Json
+  assessedBy     String
+  assessedAt     DateTime  @default(now())
+  reviewDate     DateTime?
+  createdAt      DateTime  @default(now())
+  updatedAt      DateTime  @updatedAt
+  removedAt      DateTime?
+
+  @@index([tenantId, removedAt, lawfulBasis])
+  @@map("ndpr_lawful_basis_records")
+}
+
+model CrossBorderTransferRecord {
+  id                    String    @id @default(cuid())
+  tenantId              String
+  destinationCountry    String
+  recipientName         String
+  transferMechanism     String
+  safeguards            String
+  dataCategories        Json
+  adequacyStatus        String
+  ndpcApprovalRequired  Boolean   @default(false)
+  ndpcApprovalReference String?
+  riskLevel             String
+  status                String    @default("active")
+  createdAt             DateTime  @default(now())
+  updatedAt             DateTime  @updatedAt
+  removedAt             DateTime?
+
+  @@index([tenantId, removedAt, destinationCountry])
+  @@index([tenantId, removedAt, riskLevel])
+  @@index([tenantId, removedAt, status])
+  @@map("ndpr_cross_border_transfer_records")
+}
+
 model ComplianceAuditLog {
   id          String   @id @default(cuid())
+  tenantId    String
   module      String
   action      String
   entityId    String
@@ -112,6 +182,6 @@ model ComplianceAuditLog {
   performedBy String?
   createdAt   DateTime @default(now())
 
-  @@index([module, entityId])
+  @@index([tenantId, module, entityId])
   @@map("ndpr_audit_log")
 }

package/templates/express-setup.ts

@@ -1,250 +0,0 @@
-/**
- * Express — NDPR Compliance Router
- * Generated by create-ndpr for: {{ORG_NAME}}
- * DPO: {{DPO_EMAIL}}
- *
- * Mount this router in your Express app:
- *
- *   import express from 'express';
- *   import cookieParser from 'cookie-parser';
- *   import { createNDPRRouter } from './src/ndpr';
- *
- *   const app = express();
- *   app.use(express.json());
- *   app.use(cookieParser());
- *   app.use('/api/ndpr', createNDPRRouter());
- *
- * Routes exposed:
- *   GET/POST/DELETE  /api/ndpr/consent   — NDPA §25–26
- *   GET/POST         /api/ndpr/dsr       — NDPA §34–38
- *   GET/POST         /api/ndpr/breach    — NDPA §40
- */
-
-import { Router } from 'express';
-import { PrismaClient } from '@prisma/client';
-
-const prisma = new PrismaClient();
-
-// ---------------------------------------------------------------------------
-// Consent router — NDPA §25–26
-// ---------------------------------------------------------------------------
-
-function consentRouter(): Router {
-  const router = Router();
-
-  // GET /consent?subjectId=xxx
-  router.get('/', async (req, res) => {
-    const { subjectId } = req.query;
-    if (!subjectId || typeof subjectId !== 'string') {
-      return res.status(400).json({ error: 'subjectId required' });
-    }
-    const record = await prisma.consentRecord.findFirst({
-      where: { subjectId, revokedAt: null },
-      orderBy: { createdAt: 'desc' },
-    });
-    return res.json(record);
-  });
-
-  // POST /consent
-  router.post('/', async (req, res) => {
-    const { subjectId, consents, version, method, lawfulBasis } = req.body;
-    if (!subjectId || !consents || !version) {
-      return res.status(400).json({ error: 'subjectId, consents, and version are required' });
-    }
-    await prisma.consentRecord.updateMany({
-      where: { subjectId, revokedAt: null },
-      data: { revokedAt: new Date() },
-    });
-    const record = await prisma.consentRecord.create({
-      data: {
-        subjectId,
-        consents,
-        version,
-        method: method ?? 'api',
-        lawfulBasis: lawfulBasis ?? null,
-        ipAddress:
-          (req.headers['x-forwarded-for'] as string)?.split(',')[0].trim() ??
-          req.socket.remoteAddress ??
-          null,
-        userAgent: req.headers['user-agent'] ?? null,
-      },
-    });
-    await prisma.complianceAuditLog.create({
-      data: {
-        module: 'consent',
-        action: 'created',
-        entityId: record.id,
-        entityType: 'ConsentRecord',
-        changes: { subjectId, version, consents },
-      },
-    });
-    return res.status(201).json(record);
-  });
-
-  // DELETE /consent?subjectId=xxx
-  router.delete('/', async (req, res) => {
-    const { subjectId } = req.query;
-    if (!subjectId || typeof subjectId !== 'string') {
-      return res.status(400).json({ error: 'subjectId required' });
-    }
-    await prisma.consentRecord.updateMany({
-      where: { subjectId, revokedAt: null },
-      data: { revokedAt: new Date() },
-    });
-    await prisma.complianceAuditLog.create({
-      data: {
-        module: 'consent',
-        action: 'revoked',
-        entityId: subjectId,
-        entityType: 'ConsentRecord',
-      },
-    });
-    return res.json({ success: true });
-  });
-
-  return router;
-}
-
-// ---------------------------------------------------------------------------
-// DSR router — NDPA §34–38
-// ---------------------------------------------------------------------------
-
-function dsrRouter(): Router {
-  const router = Router();
-
-  // GET /dsr?status=pending
-  router.get('/', async (req, res) => {
-    const { status } = req.query;
-    const requests = await prisma.dSRRequest.findMany({
-      where: status && typeof status === 'string' ? { status } : undefined,
-      orderBy: { submittedAt: 'desc' },
-    });
-    return res.json(requests);
-  });
-
-  // POST /dsr
-  router.post('/', async (req, res) => {
-    const { type, subjectName, subjectEmail, subjectPhone, identifierType, identifierValue, description } =
-      req.body;
-    if (!type || !subjectName || !subjectEmail || !identifierType || !identifierValue) {
-      return res
-        .status(400)
-        .json({ error: 'type, subjectName, subjectEmail, identifierType, and identifierValue are required' });
-    }
-    const dueAt = new Date();
-    dueAt.setDate(dueAt.getDate() + 30);
-    const request = await prisma.dSRRequest.create({
-      data: {
-        type,
-        subjectName,
-        subjectEmail,
-        subjectPhone: subjectPhone ?? null,
-        identifierType,
-        identifierValue,
-        description: description ?? null,
-        status: 'pending',
-        dueAt,
-      },
-    });
-    await prisma.complianceAuditLog.create({
-      data: {
-        module: 'dsr',
-        action: 'submitted',
-        entityId: request.id,
-        entityType: 'DSRRequest',
-        changes: { type, subjectEmail, status: 'pending' },
-      },
-    });
-    return res.status(201).json(request);
-  });
-
-  return router;
-}
-
-// ---------------------------------------------------------------------------
-// Breach router — NDPA §40
-// ---------------------------------------------------------------------------
-
-function breachRouter(): Router {
-  const router = Router();
-
-  function calculateSeverity(category: string, estimatedAffected?: number) {
-    const highRisk = ['unauthorized_access', 'ransomware', 'data_exfiltration', 'identity_theft'];
-    if (highRisk.includes(category)) return (estimatedAffected ?? 0) > 1000 ? 'critical' : 'high';
-    if ((estimatedAffected ?? 0) > 500) return 'high';
-    if ((estimatedAffected ?? 0) > 50) return 'medium';
-    return 'low';
-  }
-
-  // GET /breach?status=ongoing
-  router.get('/', async (req, res) => {
-    const { status } = req.query;
-    const reports = await prisma.breachReport.findMany({
-      where: status && typeof status === 'string' ? { status } : undefined,
-      orderBy: { reportedAt: 'desc' },
-    });
-    return res.json(reports);
-  });
-
-  // POST /breach
-  router.post('/', async (req, res) => {
-    const {
-      title, description, category, discoveredAt, occurredAt,
-      reporterName, reporterEmail, reporterDepartment,
-      affectedSystems, dataTypes, estimatedAffected, initialActions,
-    } = req.body;
-
-    if (!title || !description || !category || !discoveredAt || !reporterName || !reporterEmail) {
-      return res.status(400).json({
-        error: 'title, description, category, discoveredAt, reporterName, and reporterEmail are required',
-      });
-    }
-    if (!Array.isArray(affectedSystems) || !Array.isArray(dataTypes)) {
-      return res.status(400).json({ error: 'affectedSystems and dataTypes must be arrays' });
-    }
-
-    const severity = calculateSeverity(category, estimatedAffected);
-    const report = await prisma.breachReport.create({
-      data: {
-        title, description, category, severity, status: 'ongoing',
-        discoveredAt: new Date(discoveredAt),
-        occurredAt: occurredAt ? new Date(occurredAt) : null,
-        reporterName, reporterEmail,
-        reporterDepartment: reporterDepartment ?? null,
-        affectedSystems, dataTypes,
-        estimatedAffected: estimatedAffected ?? null,
-        initialActions: initialActions ?? null,
-      },
-    });
-    await prisma.complianceAuditLog.create({
-      data: {
-        module: 'breach',
-        action: 'reported',
-        entityId: report.id,
-        entityType: 'BreachReport',
-        changes: { title, category, severity, status: 'ongoing' },
-      },
-    });
-    return res.status(201).json(report);
-  });
-
-  return router;
-}
-
-// ---------------------------------------------------------------------------
-// Main factory
-// ---------------------------------------------------------------------------
-
-/**
- * Returns a fully configured NDPR compliance Express Router.
- *
- * Mount with:
- *   app.use('/api/ndpr', createNDPRRouter());
- */
-export function createNDPRRouter(): Router {
-  const router = Router();
-  router.use('/consent', consentRouter());
-  router.use('/dsr', dsrRouter());
-  router.use('/breach', breachRouter());
-  return router;
-}