@tantainnovative/create-ndpr 0.1.0

package/templates/nextjs-consent-route.ts

@@ -0,0 +1,100 @@
+/**
+ * Next.js App Router — Consent API Route
+ * Generated by create-ndpr for: {{ORG_NAME}}
+ *
+ * NDPA §25 (lawful basis) and §26 (right to withdraw consent).
+ *
+ * Endpoints:
+ *   GET    /api/consent?subjectId=xxx  — Load the active consent record
+ *   POST   /api/consent                — Save new consent (revokes previous)
+ *   DELETE /api/consent?subjectId=xxx  — Revoke all active consent
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+
+// GET /api/consent?subjectId=xxx
+export async function GET(req: NextRequest) {
+  const subjectId = req.nextUrl.searchParams.get('subjectId');
+
+  if (!subjectId) {
+    return NextResponse.json({ error: 'subjectId required' }, { status: 400 });
+  }
+
+  const record = await prisma.consentRecord.findFirst({
+    where: { subjectId, revokedAt: null },
+    orderBy: { createdAt: 'desc' },
+  });
+
+  return NextResponse.json(record);
+}
+
+// POST /api/consent
+export async function POST(req: NextRequest) {
+  const body = await req.json();
+  const { subjectId, consents, version, method, lawfulBasis } = body;
+
+  if (!subjectId || !consents || !version) {
+    return NextResponse.json(
+      { error: 'subjectId, consents, and version are required' },
+      { status: 400 },
+    );
+  }
+
+  // Revoke any previously active consent records (immutable-audit pattern — NDPA §44).
+  await prisma.consentRecord.updateMany({
+    where: { subjectId, revokedAt: null },
+    data: { revokedAt: new Date() },
+  });
+
+  const record = await prisma.consentRecord.create({
+    data: {
+      subjectId,
+      consents,
+      version,
+      method: method ?? 'api',
+      lawfulBasis: lawfulBasis ?? null,
+      ipAddress: req.headers.get('x-forwarded-for'),
+      userAgent: req.headers.get('user-agent'),
+    },
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'consent',
+      action: 'created',
+      entityId: record.id,
+      entityType: 'ConsentRecord',
+      changes: { subjectId, version, consents },
+    },
+  });
+
+  return NextResponse.json(record, { status: 201 });
+}
+
+// DELETE /api/consent?subjectId=xxx
+export async function DELETE(req: NextRequest) {
+  const subjectId = req.nextUrl.searchParams.get('subjectId');
+
+  if (!subjectId) {
+    return NextResponse.json({ error: 'subjectId required' }, { status: 400 });
+  }
+
+  await prisma.consentRecord.updateMany({
+    where: { subjectId, revokedAt: null },
+    data: { revokedAt: new Date() },
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'consent',
+      action: 'revoked',
+      entityId: subjectId,
+      entityType: 'ConsentRecord',
+    },
+  });
+
+  return NextResponse.json({ success: true });
+}

package/templates/nextjs-dsr-route.ts

@@ -0,0 +1,80 @@
+/**
+ * Next.js App Router — DSR (Data Subject Rights) Route
+ * Generated by create-ndpr for: {{ORG_NAME}}
+ *
+ * NDPA Part IV §34–38 — rights to access, rectification, erasure,
+ * portability, and objection. All requests must be acknowledged
+ * within 72 hours and fulfilled within 30 days.
+ *
+ * Endpoints:
+ *   GET  /api/dsr               — List DSR requests (optional ?status= filter)
+ *   POST /api/dsr               — Submit a new DSR request
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+
+// GET /api/dsr?status=pending
+export async function GET(req: NextRequest) {
+  const status = req.nextUrl.searchParams.get('status');
+
+  const requests = await prisma.dSRRequest.findMany({
+    where: status ? { status } : undefined,
+    orderBy: { submittedAt: 'desc' },
+  });
+
+  return NextResponse.json(requests);
+}
+
+// POST /api/dsr
+export async function POST(req: NextRequest) {
+  const body = await req.json();
+  const {
+    type,
+    subjectName,
+    subjectEmail,
+    subjectPhone,
+    identifierType,
+    identifierValue,
+    description,
+  } = body;
+
+  if (!type || !subjectName || !subjectEmail || !identifierType || !identifierValue) {
+    return NextResponse.json(
+      { error: 'type, subjectName, subjectEmail, identifierType, and identifierValue are required' },
+      { status: 400 },
+    );
+  }
+
+  // NDPA mandates a 30-day response window from date of submission.
+  const dueAt = new Date();
+  dueAt.setDate(dueAt.getDate() + 30);
+
+  const request = await prisma.dSRRequest.create({
+    data: {
+      type,
+      subjectName,
+      subjectEmail,
+      subjectPhone: subjectPhone ?? null,
+      identifierType,
+      identifierValue,
+      description: description ?? null,
+      status: 'pending',
+      dueAt,
+    },
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'dsr',
+      action: 'submitted',
+      entityId: request.id,
+      entityType: 'DSRRequest',
+      changes: { type, subjectEmail, status: 'pending' },
+    },
+  });
+
+  return NextResponse.json(request, { status: 201 });
+}

package/templates/nextjs-layout.tsx

@@ -0,0 +1,64 @@
+'use client';
+
+/**
+ * NDPRLayout — generated by create-ndpr
+ *
+ * Wraps your app with the NDPA-compliant consent banner and provider.
+ *
+ * Usage in app/layout.tsx:
+ *
+ *   import NDPRLayout from '@/app/ndpr-layout';
+ *
+ *   export default async function RootLayout({ children }) {
+ *     const session = await getServerSession();
+ *     return (
+ *       <html lang="en">
+ *         <body>
+ *           <NDPRLayout userId={session?.user?.id}>
+ *             {children}
+ *           </NDPRLayout>
+ *         </body>
+ *       </html>
+ *     );
+ *   }
+ */
+
+import React from 'react';
+import { NDPRProvider } from '@tantainnovative/ndpr-toolkit/core';
+import { NDPRConsent } from '@tantainnovative/ndpr-toolkit/presets';
+import { apiAdapter } from '@tantainnovative/ndpr-toolkit/adapters';
+
+interface NDPRLayoutProps {
+  children: React.ReactNode;
+  /**
+   * Authenticated user ID, or a stable anonymous identifier (e.g. UUID from
+   * a cookie) for unauthenticated visitors. NDPA requires consent to be
+   * recorded even for anonymous users.
+   */
+  userId?: string;
+}
+
+export default function NDPRLayout({ children, userId }: NDPRLayoutProps) {
+  const subjectId = userId ?? 'anonymous';
+
+  // apiAdapter connects the consent banner to the /api/consent route.
+  // Swap for prismaConsentAdapter or drizzleConsentAdapter for direct
+  // server-side usage in Server Components or Route Handlers.
+  const consentStorageAdapter = apiAdapter(`/api/consent?subjectId=${subjectId}`);
+
+  return (
+    <NDPRProvider
+      organizationName="{{ORG_NAME}}"
+      dpoEmail="{{DPO_EMAIL}}"
+    >
+      {children}
+
+      {/*
+       * NDPA-compliant consent banner.
+       * The adapter persists decisions server-side so the banner is hidden
+       * on return visits without flicker or double-prompting.
+       */}
+      <NDPRConsent adapter={consentStorageAdapter} />
+    </NDPRProvider>
+  );
+}

package/templates/prisma-schema.prisma

@@ -0,0 +1,117 @@
+// NDPA Compliance Schema — generated by create-ndpr
+// Organisation: {{ORG_NAME}}
+// DPO: {{DPO_EMAIL}}
+//
+// Covers:
+//   - ConsentRecord       — NDPA §25–26 (consent & withdrawal)
+//   - DSRRequest          — NDPA Part IV §34–38 (data subject rights)
+//   - BreachReport        — NDPA §40 (72-hour breach notification)
+//   - ProcessingRecord    — ROPA (accountability principle)
+//   - ComplianceAuditLog  — §44 audit trail
+//
+// Run `prisma migrate dev --name ndpr-init` to apply.
+
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "postgresql"
+  url      = env("DATABASE_URL")
+}
+
+model ConsentRecord {
+  id            String    @id @default(cuid())
+  subjectId     String
+  consents      Json
+  version       String
+  method        String
+  lawfulBasis   String?
+  ipAddress     String?
+  userAgent     String?
+  createdAt     DateTime  @default(now())
+  revokedAt     DateTime?
+
+  @@index([subjectId])
+  @@map("ndpr_consent_records")
+}
+
+model DSRRequest {
+  id              String    @id @default(cuid())
+  type            String
+  status          String    @default("pending")
+  subjectName     String
+  subjectEmail    String
+  subjectPhone    String?
+  identifierType  String
+  identifierValue String
+  description     String?
+  internalNotes   String?
+  assignedTo      String?
+  submittedAt     DateTime  @default(now())
+  acknowledgedAt  DateTime?
+  completedAt     DateTime?
+  dueAt           DateTime
+
+  @@index([status])
+  @@index([subjectEmail])
+  @@map("ndpr_dsr_requests")
+}
+
+model BreachReport {
+  id                   String    @id @default(cuid())
+  title                String
+  description          String
+  category             String
+  severity             String
+  status               String    @default("ongoing")
+  discoveredAt         DateTime
+  occurredAt           DateTime?
+  reportedAt           DateTime  @default(now())
+  ndpcNotifiedAt       DateTime?
+  reporterName         String
+  reporterEmail        String
+  reporterDepartment   String?
+  affectedSystems      Json
+  dataTypes            Json
+  estimatedAffected    Int?
+  initialActions       String?
+  ndpcNotificationSent Boolean   @default(false)
+
+  @@index([status])
+  @@index([severity])
+  @@map("ndpr_breach_reports")
+}
+
+model ProcessingRecord {
+  id                String   @id @default(cuid())
+  purpose           String
+  lawfulBasis       String
+  dataCategories    Json
+  dataSubjects      Json
+  recipients        Json
+  retentionPeriod   String
+  securityMeasures  Json
+  transferCountries Json?
+  transferMechanism String?
+  dpiaConducted     Boolean  @default(false)
+  status            String   @default("active")
+  createdAt         DateTime @default(now())
+  updatedAt         DateTime @updatedAt
+
+  @@map("ndpr_processing_records")
+}
+
+model ComplianceAuditLog {
+  id          String   @id @default(cuid())
+  module      String
+  action      String
+  entityId    String
+  entityType  String
+  changes     Json?
+  performedBy String?
+  createdAt   DateTime @default(now())
+
+  @@index([module, entityId])
+  @@map("ndpr_audit_log")
+}