@tantainnovative/create-ndpr 0.1.0

package/templates/drizzle-schema.ts

@@ -0,0 +1,163 @@
+/**
+ * NDPA Compliance Schema — generated by create-ndpr
+ * Organisation: {{ORG_NAME}}
+ * DPO: {{DPO_EMAIL}}
+ *
+ * Covers:
+ *   - consentRecords     — NDPA §25–26 (consent & withdrawal)
+ *   - dsrRequests        — NDPA Part IV §34–38 (data subject rights)
+ *   - breachReports      — NDPA §40 (72-hour breach notification)
+ *   - processingRecords  — ROPA (accountability principle)
+ *   - auditLog           — §44 audit trail
+ *
+ * Prerequisites: drizzle-orm, @paralleldrive/cuid2
+ * Run `drizzle-kit push` to apply.
+ */
+
+import {
+  pgTable,
+  text,
+  timestamp,
+  json,
+  boolean,
+  integer,
+  index,
+} from 'drizzle-orm/pg-core';
+import { createId } from '@paralleldrive/cuid2';
+
+// ---------------------------------------------------------------------------
+// ndpr_consent_records — NDPA §25–26
+// ---------------------------------------------------------------------------
+
+export const consentRecords = pgTable(
+  'ndpr_consent_records',
+  {
+    id:           text('id').primaryKey().$defaultFn(() => createId()),
+    subjectId:    text('subject_id').notNull(),
+    consents:     json('consents').notNull(),
+    version:      text('version').notNull(),
+    method:       text('method').notNull(),
+    lawfulBasis:  text('lawful_basis'),
+    ipAddress:    text('ip_address'),
+    userAgent:    text('user_agent'),
+    createdAt:    timestamp('created_at').defaultNow().notNull(),
+    revokedAt:    timestamp('revoked_at'),
+  },
+  (t) => ({ subjectIdIdx: index('consent_subject_id_idx').on(t.subjectId) }),
+);
+
+// ---------------------------------------------------------------------------
+// ndpr_dsr_requests — NDPA §34–38
+// ---------------------------------------------------------------------------
+
+export const dsrRequests = pgTable(
+  'ndpr_dsr_requests',
+  {
+    id:              text('id').primaryKey().$defaultFn(() => createId()),
+    type:            text('type').notNull(),
+    status:          text('status').notNull().default('pending'),
+    subjectName:     text('subject_name').notNull(),
+    subjectEmail:    text('subject_email').notNull(),
+    subjectPhone:    text('subject_phone'),
+    identifierType:  text('identifier_type').notNull(),
+    identifierValue: text('identifier_value').notNull(),
+    description:     text('description'),
+    internalNotes:   text('internal_notes'),
+    assignedTo:      text('assigned_to'),
+    submittedAt:     timestamp('submitted_at').defaultNow().notNull(),
+    acknowledgedAt:  timestamp('acknowledged_at'),
+    completedAt:     timestamp('completed_at'),
+    dueAt:           timestamp('due_at').notNull(),
+  },
+  (t) => ({
+    statusIdx:      index('dsr_status_idx').on(t.status),
+    subjectEmailIdx: index('dsr_subject_email_idx').on(t.subjectEmail),
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// ndpr_breach_reports — NDPA §40
+// ---------------------------------------------------------------------------
+
+export const breachReports = pgTable(
+  'ndpr_breach_reports',
+  {
+    id:                   text('id').primaryKey().$defaultFn(() => createId()),
+    title:                text('title').notNull(),
+    description:          text('description').notNull(),
+    category:             text('category').notNull(),
+    severity:             text('severity').notNull(),
+    status:               text('status').notNull().default('ongoing'),
+    discoveredAt:         timestamp('discovered_at').notNull(),
+    occurredAt:           timestamp('occurred_at'),
+    reportedAt:           timestamp('reported_at').defaultNow().notNull(),
+    ndpcNotifiedAt:       timestamp('ndpc_notified_at'),
+    reporterName:         text('reporter_name').notNull(),
+    reporterEmail:        text('reporter_email').notNull(),
+    reporterDepartment:   text('reporter_department'),
+    affectedSystems:      json('affected_systems').notNull(),
+    dataTypes:            json('data_types').notNull(),
+    estimatedAffected:    integer('estimated_affected'),
+    initialActions:       text('initial_actions'),
+    ndpcNotificationSent: boolean('ndpc_notification_sent').notNull().default(false),
+  },
+  (t) => ({
+    statusIdx:   index('breach_status_idx').on(t.status),
+    severityIdx: index('breach_severity_idx').on(t.severity),
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// ndpr_processing_records — ROPA
+// ---------------------------------------------------------------------------
+
+export const processingRecords = pgTable('ndpr_processing_records', {
+  id:                text('id').primaryKey().$defaultFn(() => createId()),
+  purpose:           text('purpose').notNull(),
+  lawfulBasis:       text('lawful_basis').notNull(),
+  dataCategories:    json('data_categories').notNull(),
+  dataSubjects:      json('data_subjects').notNull(),
+  recipients:        json('recipients').notNull(),
+  retentionPeriod:   text('retention_period').notNull(),
+  securityMeasures:  json('security_measures').notNull(),
+  transferCountries: json('transfer_countries'),
+  transferMechanism: text('transfer_mechanism'),
+  dpiaConducted:     boolean('dpia_conducted').notNull().default(false),
+  status:            text('status').notNull().default('active'),
+  createdAt:         timestamp('created_at').defaultNow().notNull(),
+  updatedAt:         timestamp('updated_at').defaultNow().notNull(),
+});
+
+// ---------------------------------------------------------------------------
+// ndpr_audit_log — §44 accountability
+// ---------------------------------------------------------------------------
+
+export const auditLog = pgTable(
+  'ndpr_audit_log',
+  {
+    id:          text('id').primaryKey().$defaultFn(() => createId()),
+    module:      text('module').notNull(),
+    action:      text('action').notNull(),
+    entityId:    text('entity_id').notNull(),
+    entityType:  text('entity_type').notNull(),
+    changes:     json('changes'),
+    performedBy: text('performed_by'),
+    createdAt:   timestamp('created_at').defaultNow().notNull(),
+  },
+  (t) => ({
+    moduleEntityIdx: index('audit_module_entity_idx').on(t.module, t.entityId),
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// Inferred types
+// ---------------------------------------------------------------------------
+
+export type ConsentRecord    = typeof consentRecords.$inferSelect;
+export type NewConsentRecord = typeof consentRecords.$inferInsert;
+export type DSRRequest       = typeof dsrRequests.$inferSelect;
+export type NewDSRRequest    = typeof dsrRequests.$inferInsert;
+export type BreachReport     = typeof breachReports.$inferSelect;
+export type NewBreachReport  = typeof breachReports.$inferInsert;
+export type ProcessingRecord = typeof processingRecords.$inferSelect;
+export type AuditLogEntry    = typeof auditLog.$inferSelect;

package/templates/env-example

@@ -0,0 +1,4 @@
+# NDPA Compliance Database
+# Organisation: {{ORG_NAME}}
+# DPO: {{DPO_EMAIL}}
+DATABASE_URL="postgresql://user:password@localhost:5432/myapp_dev"

package/templates/express-consent-route.ts

@@ -0,0 +1,105 @@
+/**
+ * Express — Consent Router
+ * Generated by create-ndpr for: {{ORG_NAME}}
+ * DPO: {{DPO_EMAIL}}
+ *
+ * NDPA §25 (lawful basis) and §26 (right to withdraw consent).
+ *
+ * Routes:
+ *   GET    /consent?subjectId=xxx  — Load the active consent record
+ *   POST   /consent                — Save new consent (revokes previous)
+ *   DELETE /consent?subjectId=xxx  — Revoke all active consent
+ *
+ * Usage:
+ *   import { consentRouter } from './routes/consent';
+ *   app.use('/api/consent', consentRouter);
+ */
+
+import { Router } from 'express';
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+export const consentRouter = Router();
+
+// GET /consent?subjectId=xxx
+consentRouter.get('/', async (req, res) => {
+  const { subjectId } = req.query;
+
+  if (!subjectId || typeof subjectId !== 'string') {
+    return res.status(400).json({ error: 'subjectId required' });
+  }
+
+  const record = await prisma.consentRecord.findFirst({
+    where: { subjectId, revokedAt: null },
+    orderBy: { createdAt: 'desc' },
+  });
+
+  return res.json(record);
+});
+
+// POST /consent
+consentRouter.post('/', async (req, res) => {
+  const { subjectId, consents, version, method, lawfulBasis } = req.body;
+
+  if (!subjectId || !consents || !version) {
+    return res.status(400).json({ error: 'subjectId, consents, and version are required' });
+  }
+
+  // Revoke any previously active records (immutable-audit pattern — NDPA §44).
+  await prisma.consentRecord.updateMany({
+    where: { subjectId, revokedAt: null },
+    data: { revokedAt: new Date() },
+  });
+
+  const record = await prisma.consentRecord.create({
+    data: {
+      subjectId,
+      consents,
+      version,
+      method: method ?? 'api',
+      lawfulBasis: lawfulBasis ?? null,
+      ipAddress:
+        (req.headers['x-forwarded-for'] as string)?.split(',')[0].trim() ??
+        req.socket.remoteAddress ??
+        null,
+      userAgent: req.headers['user-agent'] ?? null,
+    },
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'consent',
+      action: 'created',
+      entityId: record.id,
+      entityType: 'ConsentRecord',
+      changes: { subjectId, version, consents },
+    },
+  });
+
+  return res.status(201).json(record);
+});
+
+// DELETE /consent?subjectId=xxx
+consentRouter.delete('/', async (req, res) => {
+  const { subjectId } = req.query;
+
+  if (!subjectId || typeof subjectId !== 'string') {
+    return res.status(400).json({ error: 'subjectId required' });
+  }
+
+  await prisma.consentRecord.updateMany({
+    where: { subjectId, revokedAt: null },
+    data: { revokedAt: new Date() },
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'consent',
+      action: 'revoked',
+      entityId: subjectId,
+      entityType: 'ConsentRecord',
+    },
+  });
+
+  return res.json({ success: true });
+});

package/templates/express-setup.ts

@@ -0,0 +1,250 @@
+/**
+ * Express — NDPR Compliance Router
+ * Generated by create-ndpr for: {{ORG_NAME}}
+ * DPO: {{DPO_EMAIL}}
+ *
+ * Mount this router in your Express app:
+ *
+ *   import express from 'express';
+ *   import cookieParser from 'cookie-parser';
+ *   import { createNDPRRouter } from './src/ndpr';
+ *
+ *   const app = express();
+ *   app.use(express.json());
+ *   app.use(cookieParser());
+ *   app.use('/api/ndpr', createNDPRRouter());
+ *
+ * Routes exposed:
+ *   GET/POST/DELETE  /api/ndpr/consent   — NDPA §25–26
+ *   GET/POST         /api/ndpr/dsr       — NDPA §34–38
+ *   GET/POST         /api/ndpr/breach    — NDPA §40
+ */
+
+import { Router } from 'express';
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+
+// ---------------------------------------------------------------------------
+// Consent router — NDPA §25–26
+// ---------------------------------------------------------------------------
+
+function consentRouter(): Router {
+  const router = Router();
+
+  // GET /consent?subjectId=xxx
+  router.get('/', async (req, res) => {
+    const { subjectId } = req.query;
+    if (!subjectId || typeof subjectId !== 'string') {
+      return res.status(400).json({ error: 'subjectId required' });
+    }
+    const record = await prisma.consentRecord.findFirst({
+      where: { subjectId, revokedAt: null },
+      orderBy: { createdAt: 'desc' },
+    });
+    return res.json(record);
+  });
+
+  // POST /consent
+  router.post('/', async (req, res) => {
+    const { subjectId, consents, version, method, lawfulBasis } = req.body;
+    if (!subjectId || !consents || !version) {
+      return res.status(400).json({ error: 'subjectId, consents, and version are required' });
+    }
+    await prisma.consentRecord.updateMany({
+      where: { subjectId, revokedAt: null },
+      data: { revokedAt: new Date() },
+    });
+    const record = await prisma.consentRecord.create({
+      data: {
+        subjectId,
+        consents,
+        version,
+        method: method ?? 'api',
+        lawfulBasis: lawfulBasis ?? null,
+        ipAddress:
+          (req.headers['x-forwarded-for'] as string)?.split(',')[0].trim() ??
+          req.socket.remoteAddress ??
+          null,
+        userAgent: req.headers['user-agent'] ?? null,
+      },
+    });
+    await prisma.complianceAuditLog.create({
+      data: {
+        module: 'consent',
+        action: 'created',
+        entityId: record.id,
+        entityType: 'ConsentRecord',
+        changes: { subjectId, version, consents },
+      },
+    });
+    return res.status(201).json(record);
+  });
+
+  // DELETE /consent?subjectId=xxx
+  router.delete('/', async (req, res) => {
+    const { subjectId } = req.query;
+    if (!subjectId || typeof subjectId !== 'string') {
+      return res.status(400).json({ error: 'subjectId required' });
+    }
+    await prisma.consentRecord.updateMany({
+      where: { subjectId, revokedAt: null },
+      data: { revokedAt: new Date() },
+    });
+    await prisma.complianceAuditLog.create({
+      data: {
+        module: 'consent',
+        action: 'revoked',
+        entityId: subjectId,
+        entityType: 'ConsentRecord',
+      },
+    });
+    return res.json({ success: true });
+  });
+
+  return router;
+}
+
+// ---------------------------------------------------------------------------
+// DSR router — NDPA §34–38
+// ---------------------------------------------------------------------------
+
+function dsrRouter(): Router {
+  const router = Router();
+
+  // GET /dsr?status=pending
+  router.get('/', async (req, res) => {
+    const { status } = req.query;
+    const requests = await prisma.dSRRequest.findMany({
+      where: status && typeof status === 'string' ? { status } : undefined,
+      orderBy: { submittedAt: 'desc' },
+    });
+    return res.json(requests);
+  });
+
+  // POST /dsr
+  router.post('/', async (req, res) => {
+    const { type, subjectName, subjectEmail, subjectPhone, identifierType, identifierValue, description } =
+      req.body;
+    if (!type || !subjectName || !subjectEmail || !identifierType || !identifierValue) {
+      return res
+        .status(400)
+        .json({ error: 'type, subjectName, subjectEmail, identifierType, and identifierValue are required' });
+    }
+    const dueAt = new Date();
+    dueAt.setDate(dueAt.getDate() + 30);
+    const request = await prisma.dSRRequest.create({
+      data: {
+        type,
+        subjectName,
+        subjectEmail,
+        subjectPhone: subjectPhone ?? null,
+        identifierType,
+        identifierValue,
+        description: description ?? null,
+        status: 'pending',
+        dueAt,
+      },
+    });
+    await prisma.complianceAuditLog.create({
+      data: {
+        module: 'dsr',
+        action: 'submitted',
+        entityId: request.id,
+        entityType: 'DSRRequest',
+        changes: { type, subjectEmail, status: 'pending' },
+      },
+    });
+    return res.status(201).json(request);
+  });
+
+  return router;
+}
+
+// ---------------------------------------------------------------------------
+// Breach router — NDPA §40
+// ---------------------------------------------------------------------------
+
+function breachRouter(): Router {
+  const router = Router();
+
+  function calculateSeverity(category: string, estimatedAffected?: number) {
+    const highRisk = ['unauthorized_access', 'ransomware', 'data_exfiltration', 'identity_theft'];
+    if (highRisk.includes(category)) return (estimatedAffected ?? 0) > 1000 ? 'critical' : 'high';
+    if ((estimatedAffected ?? 0) > 500) return 'high';
+    if ((estimatedAffected ?? 0) > 50) return 'medium';
+    return 'low';
+  }
+
+  // GET /breach?status=ongoing
+  router.get('/', async (req, res) => {
+    const { status } = req.query;
+    const reports = await prisma.breachReport.findMany({
+      where: status && typeof status === 'string' ? { status } : undefined,
+      orderBy: { reportedAt: 'desc' },
+    });
+    return res.json(reports);
+  });
+
+  // POST /breach
+  router.post('/', async (req, res) => {
+    const {
+      title, description, category, discoveredAt, occurredAt,
+      reporterName, reporterEmail, reporterDepartment,
+      affectedSystems, dataTypes, estimatedAffected, initialActions,
+    } = req.body;
+
+    if (!title || !description || !category || !discoveredAt || !reporterName || !reporterEmail) {
+      return res.status(400).json({
+        error: 'title, description, category, discoveredAt, reporterName, and reporterEmail are required',
+      });
+    }
+    if (!Array.isArray(affectedSystems) || !Array.isArray(dataTypes)) {
+      return res.status(400).json({ error: 'affectedSystems and dataTypes must be arrays' });
+    }
+
+    const severity = calculateSeverity(category, estimatedAffected);
+    const report = await prisma.breachReport.create({
+      data: {
+        title, description, category, severity, status: 'ongoing',
+        discoveredAt: new Date(discoveredAt),
+        occurredAt: occurredAt ? new Date(occurredAt) : null,
+        reporterName, reporterEmail,
+        reporterDepartment: reporterDepartment ?? null,
+        affectedSystems, dataTypes,
+        estimatedAffected: estimatedAffected ?? null,
+        initialActions: initialActions ?? null,
+      },
+    });
+    await prisma.complianceAuditLog.create({
+      data: {
+        module: 'breach',
+        action: 'reported',
+        entityId: report.id,
+        entityType: 'BreachReport',
+        changes: { title, category, severity, status: 'ongoing' },
+      },
+    });
+    return res.status(201).json(report);
+  });
+
+  return router;
+}
+
+// ---------------------------------------------------------------------------
+// Main factory
+// ---------------------------------------------------------------------------
+
+/**
+ * Returns a fully configured NDPR compliance Express Router.
+ *
+ * Mount with:
+ *   app.use('/api/ndpr', createNDPRRouter());
+ */
+export function createNDPRRouter(): Router {
+  const router = Router();
+  router.use('/consent', consentRouter());
+  router.use('/dsr', dsrRouter());
+  router.use('/breach', breachRouter());
+  return router;
+}

package/templates/nextjs-breach-route.ts

@@ -0,0 +1,107 @@
+/**
+ * Next.js App Router — Breach Notification Route
+ * Generated by create-ndpr for: {{ORG_NAME}}
+ *
+ * NDPA §40 — data controllers must notify the NDPC within 72 hours of
+ * discovering a breach that poses a risk to data subject rights and freedoms.
+ *
+ * Endpoints:
+ *   GET  /api/breach             — List breach reports (optional ?status= filter)
+ *   POST /api/breach             — Create a new breach report
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+
+function calculateSeverity(
+  category: string,
+  estimatedAffected?: number,
+): 'critical' | 'high' | 'medium' | 'low' {
+  const highRisk = ['unauthorized_access', 'ransomware', 'data_exfiltration', 'identity_theft'];
+  if (highRisk.includes(category)) {
+    return (estimatedAffected ?? 0) > 1000 ? 'critical' : 'high';
+  }
+  if ((estimatedAffected ?? 0) > 500) return 'high';
+  if ((estimatedAffected ?? 0) > 50) return 'medium';
+  return 'low';
+}
+
+// GET /api/breach?status=ongoing
+export async function GET(req: NextRequest) {
+  const status = req.nextUrl.searchParams.get('status');
+
+  const reports = await prisma.breachReport.findMany({
+    where: status ? { status } : undefined,
+    orderBy: { reportedAt: 'desc' },
+  });
+
+  return NextResponse.json(reports);
+}
+
+// POST /api/breach
+export async function POST(req: NextRequest) {
+  const body = await req.json();
+  const {
+    title,
+    description,
+    category,
+    discoveredAt,
+    occurredAt,
+    reporterName,
+    reporterEmail,
+    reporterDepartment,
+    affectedSystems,
+    dataTypes,
+    estimatedAffected,
+    initialActions,
+  } = body;
+
+  if (!title || !description || !category || !discoveredAt || !reporterName || !reporterEmail) {
+    return NextResponse.json(
+      { error: 'title, description, category, discoveredAt, reporterName, and reporterEmail are required' },
+      { status: 400 },
+    );
+  }
+
+  if (!Array.isArray(affectedSystems) || !Array.isArray(dataTypes)) {
+    return NextResponse.json(
+      { error: 'affectedSystems and dataTypes must be arrays' },
+      { status: 400 },
+    );
+  }
+
+  const severity = calculateSeverity(category, estimatedAffected);
+
+  const report = await prisma.breachReport.create({
+    data: {
+      title,
+      description,
+      category,
+      severity,
+      status: 'ongoing',
+      discoveredAt: new Date(discoveredAt),
+      occurredAt: occurredAt ? new Date(occurredAt) : null,
+      reporterName,
+      reporterEmail,
+      reporterDepartment: reporterDepartment ?? null,
+      affectedSystems,
+      dataTypes,
+      estimatedAffected: estimatedAffected ?? null,
+      initialActions: initialActions ?? null,
+    },
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'breach',
+      action: 'reported',
+      entityId: report.id,
+      entityType: 'BreachReport',
+      changes: { title, category, severity, status: 'ongoing' },
+    },
+  });
+
+  return NextResponse.json(report, { status: 201 });
+}