@tantainnovative/create-ndpr 0.4.0 → 0.5.0

package/templates/nextjs-breach-route.ts

@@ -1,239 +1,173 @@
 /**
- * Next.js App Router — Breach Notification Route
- * Generated by create-ndpr for: {{ORG_NAME}}
- *
- * NDPA §40 — data controllers must notify the NDPC within 72 hours of
- * discovering a breach that poses a risk to data subject rights and freedoms.
- *
- * Endpoints:
- *   GET  /api/breach             — List breach reports (optional ?status= filter)
- *   POST /api/breach             — Create a new breach report
+ * Next.js App Router — tenant-scoped breach register for {{ORG_NAME_COMMENT}}.
+ * All operations require verified staff context. Readiness is advisory; it is
+ * not evidence that a regulator or affected subject was notified.
  */
-
 import { NextRequest, NextResponse } from 'next/server';
 import { assessBreachNotification } from '@tantainnovative/ndpr-toolkit/server';
+import { getNDPRContextProblem, resolveNDPRRequestContext } from '{{NDPR_CONTEXT_IMPORT}}';
 // {{#if ORM=prisma}}
 import { PrismaClient } from '@prisma/client';
-
 const prisma = new PrismaClient();
 // {{/if}}
 // {{#if ORM=drizzle}}
-import { db } from '@/drizzle';
-import { breachReports, complianceAuditLog } from '@/drizzle/ndpr-schema';
-import { eq, desc } from 'drizzle-orm';
+import { db } from '{{NDPR_DB_IMPORT}}';
+import { breachReports, complianceAuditLog } from '{{NDPR_SCHEMA_IMPORT}}';
+import { and, desc, eq } from 'drizzle-orm';
 // {{/if}}
 // {{#if ORM=none}}
-// TODO ({{ORG_NAME}}): wire this to your persistent store of choice. The
-// in-memory map below is enough to develop against locally but DOES NOT
-// satisfy NDPA Section 44 (record-keeping) or the 72-hour NDPC notification
-// requirement in Section 40. Replace `breachStore`/`auditLog` with your real
-// store and connect it to your incident-response tooling.
-interface BreachReport {
-  id: string;
-  title: string;
-  description: string;
-  category: string;
-  severity: 'critical' | 'high' | 'medium' | 'low';
-  status: string;
-  discoveredAt: Date;
-  occurredAt: Date | null;
-  reportedAt: Date;
-  reporterName: string;
-  reporterEmail: string;
-  reporterDepartment: string | null;
-  affectedSystems: string[];
-  dataTypes: string[];
-  estimatedAffected: number | null;
+// DEVELOPMENT ONLY: replace both stores with one durable transactional store.
+interface BreachRow {
+  id: string; tenantId: string; title: string; description: string; category: string;
+  severity: Severity; status: string; discoveredAt: Date; occurredAt: Date | null;
+  reportedAt: Date; reporterName: string; reporterEmail: string; reporterDepartment: string | null;
+  affectedSystems: string[]; dataTypes: string[]; estimatedAffected: number | null;
+  approximateRecordCount: number | null; dataSubjectCategories: string[];
+  likelyConsequences: string | null; mitigationMeasures: string | null;
+  involvesSensitiveData: boolean; isPhasedReport: boolean; supplementsReportId: string | null;
   initialActions: string | null;
 }
-const breachStore = new Map<string, BreachReport>();
-const auditLog: Array<{ id: string; module: string; action: string; entityId: string; at: Date }> = [];
-function newId() { return crypto.randomUUID(); }
+const breachStore = new Map<string, BreachRow>();
+const auditLog: Array<{ id: string; tenantId: string; action: string; entityId: string; performedBy: string; at: Date }> = [];
 // {{/if}}
 
-function calculateSeverity(
-  category: string,
-  estimatedAffected?: number,
-): 'critical' | 'high' | 'medium' | 'low' {
-  const highRisk = ['unauthorized_access', 'ransomware', 'data_exfiltration', 'identity_theft'];
-  if (highRisk.includes(category)) {
-    return (estimatedAffected ?? 0) > 1000 ? 'critical' : 'high';
-  }
+type Severity = 'critical' | 'high' | 'medium' | 'low';
+function calculateSeverity(category: string, estimatedAffected: number | null): Severity {
+  const highRisk = new Set(['unauthorized_access', 'ransomware', 'data_exfiltration', 'identity_theft']);
+  if (highRisk.has(category)) return (estimatedAffected ?? 0) > 1000 ? 'critical' : 'high';
   if ((estimatedAffected ?? 0) > 500) return 'high';
   if ((estimatedAffected ?? 0) > 50) return 'medium';
   return 'low';
 }
+function finiteNonNegative(value: unknown): number | null {
+  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
 
-// GET /api/breach?status=ongoing
 export async function GET(req: NextRequest) {
+  const context = await resolveNDPRRequestContext(req);
+  const problem = getNDPRContextProblem(context, 'staff');
+  if (problem) return NextResponse.json({ error: problem.error }, { status: problem.status });
   const status = req.nextUrl.searchParams.get('status');
 
   // {{#if ORM=prisma}}
   const reports = await prisma.breachReport.findMany({
-    where: status ? { status } : undefined,
+    where: { tenantId: context.tenantId, ...(status ? { status } : {}) },
     orderBy: { reportedAt: 'desc' },
   });
   // {{/if}}
   // {{#if ORM=drizzle}}
   const reports = status
-    ? await db.select().from(breachReports).where(eq(breachReports.status, status)).orderBy(desc(breachReports.reportedAt))
-    : await db.select().from(breachReports).orderBy(desc(breachReports.reportedAt));
+    ? await db.select().from(breachReports).where(and(eq(breachReports.tenantId, context.tenantId), eq(breachReports.status, status))).orderBy(desc(breachReports.reportedAt))
+    : await db.select().from(breachReports).where(eq(breachReports.tenantId, context.tenantId)).orderBy(desc(breachReports.reportedAt));
   // {{/if}}
   // {{#if ORM=none}}
   const reports = [...breachStore.values()]
-    .filter((r) => (status ? r.status === status : true))
+    .filter((row) => row.tenantId === context.tenantId && (!status || row.status === status))
     .sort((a, b) => b.reportedAt.getTime() - a.reportedAt.getTime());
   // {{/if}}
-
   return NextResponse.json(reports);
 }
 
-// POST /api/breach
 export async function POST(req: NextRequest) {
-  const body = await req.json();
-  const {
-    title,
-    description,
-    category,
-    discoveredAt,
-    occurredAt,
-    reporterName,
-    reporterEmail,
-    reporterDepartment,
-    affectedSystems,
-    dataTypes,
-    estimatedAffected,
-    initialActions,
-  } = body;
-
-  if (!title || !description || !category || !discoveredAt || !reporterName || !reporterEmail) {
-    return NextResponse.json(
-      { error: 'title, description, category, discoveredAt, reporterName, and reporterEmail are required' },
-      { status: 400 },
-    );
+  const context = await resolveNDPRRequestContext(req);
+  const problem = getNDPRContextProblem(context, 'staff');
+  if (problem) return NextResponse.json({ error: problem.error }, { status: problem.status });
+  const actor = context.actor;
+  if (!actor) {
+    return NextResponse.json({ error: 'Verified staff profile is required' }, { status: 401 });
   }
-
-  if (!Array.isArray(affectedSystems) || !Array.isArray(dataTypes)) {
-    return NextResponse.json(
-      { error: 'affectedSystems and dataTypes must be arrays' },
-      { status: 400 },
-    );
+  const actorId = actor.id;
+  const body: unknown = await req.json().catch(() => null);
+  if (!body || typeof body !== 'object') return NextResponse.json({ error: 'A JSON object is required' }, { status: 400 });
+  const input = body as Record<string, unknown>;
+  const required = ['title', 'description', 'category', 'discoveredAt'] as const;
+  if (required.some((field) => typeof input[field] !== 'string' || !(input[field] as string).trim())) {
+    return NextResponse.json({ error: `${required.join(', ')} are required strings` }, { status: 400 });
   }
-
-  const severity = calculateSeverity(category, estimatedAffected);
+  if (!Array.isArray(input.affectedSystems) || !input.affectedSystems.every((v) => typeof v === 'string') ||
+      !Array.isArray(input.dataTypes) || !input.dataTypes.every((v) => typeof v === 'string')) {
+    return NextResponse.json({ error: 'affectedSystems and dataTypes must be string arrays' }, { status: 400 });
+  }
+  const discoveredAt = new Date(input.discoveredAt as string);
+  const occurredAt = typeof input.occurredAt === 'string' ? new Date(input.occurredAt) : null;
+  if (!Number.isFinite(discoveredAt.getTime()) || discoveredAt.getTime() > Date.now() ||
+      (occurredAt && (!Number.isFinite(occurredAt.getTime()) || occurredAt > discoveredAt))) {
+    return NextResponse.json({ error: 'Breach dates are invalid or inconsistent' }, { status: 400 });
+  }
+  const estimatedAffected = input.estimatedAffected == null ? null : finiteNonNegative(input.estimatedAffected);
+  const approximateRecordCount = input.approximateRecordCount == null ? null : finiteNonNegative(input.approximateRecordCount);
+  if ((input.estimatedAffected != null && estimatedAffected === null) ||
+      (input.approximateRecordCount != null && approximateRecordCount === null)) {
+    return NextResponse.json({ error: 'Affected-subject and record counts must be finite non-negative numbers' }, { status: 400 });
+  }
+  const dataSubjectCategories = Array.isArray(input.dataSubjectCategories) && input.dataSubjectCategories.every((v) => typeof v === 'string')
+    ? input.dataSubjectCategories as string[] : [];
+  const severity = calculateSeverity(input.category as string, estimatedAffected);
+  const reportedAt = new Date();
+  const data = {
+    tenantId: context.tenantId,
+    title: input.title as string, description: input.description as string,
+    category: input.category as string, severity, status: 'ongoing', discoveredAt, occurredAt,
+    reporterName: actor.displayName, reporterEmail: actor.email,
+    reporterDepartment: actor.department ?? null,
+    affectedSystems: input.affectedSystems as string[], dataTypes: input.dataTypes as string[],
+    estimatedAffected, approximateRecordCount, dataSubjectCategories,
+    likelyConsequences: typeof input.likelyConsequences === 'string' ? input.likelyConsequences : null,
+    mitigationMeasures: typeof input.mitigationMeasures === 'string' ? input.mitigationMeasures : null,
+    involvesSensitiveData: input.involvesSensitiveData === true,
+    isPhasedReport: input.isPhasedReport === true,
+    supplementsReportId: typeof input.supplementsReportId === 'string' ? input.supplementsReportId : null,
+    initialActions: typeof input.initialActions === 'string' ? input.initialActions : null,
+  };
 
   // {{#if ORM=prisma}}
-  const report = await prisma.breachReport.create({
-    data: {
-      title,
-      description,
-      category,
-      severity,
-      status: 'ongoing',
-      discoveredAt: new Date(discoveredAt),
-      occurredAt: occurredAt ? new Date(occurredAt) : null,
-      reporterName,
-      reporterEmail,
-      reporterDepartment: reporterDepartment ?? null,
-      affectedSystems,
-      dataTypes,
-      estimatedAffected: estimatedAffected ?? null,
-      initialActions: initialActions ?? null,
-    },
-  });
-
-  await prisma.complianceAuditLog.create({
-    data: {
-      module: 'breach',
-      action: 'reported',
-      entityId: report.id,
-      entityType: 'BreachReport',
-      changes: { title, category, severity, status: 'ongoing' },
-    },
+  const report = await prisma.$transaction(async (tx) => {
+    const created = await tx.breachReport.create({ data });
+    await tx.complianceAuditLog.create({ data: {
+      tenantId: context.tenantId, module: 'breach', action: 'reported',
+      entityId: created.id, entityType: 'BreachReport', performedBy: actorId,
+      changes: { title: data.title, category: data.category, severity, status: 'ongoing' },
+    } });
+    return created;
   });
   // {{/if}}
   // {{#if ORM=drizzle}}
-  const [report] = await db.insert(breachReports).values({
-    title,
-    description,
-    category,
-    severity,
-    status: 'ongoing',
-    discoveredAt: new Date(discoveredAt),
-    occurredAt: occurredAt ? new Date(occurredAt) : null,
-    reporterName,
-    reporterEmail,
-    reporterDepartment: reporterDepartment ?? null,
-    affectedSystems,
-    dataTypes,
-    estimatedAffected: estimatedAffected ?? null,
-    initialActions: initialActions ?? null,
-  }).returning();
-
-  await db.insert(complianceAuditLog).values({
-    module: 'breach',
-    action: 'reported',
-    entityId: report.id,
-    entityType: 'BreachReport',
-    changes: { title, category, severity, status: 'ongoing' },
+  const report = await db.transaction(async (tx) => {
+    const [created] = await tx.insert(breachReports).values(data).returning();
+    await tx.insert(complianceAuditLog).values({
+      tenantId: context.tenantId, module: 'breach', action: 'reported',
+      entityId: created.id, entityType: 'BreachReport', performedBy: actorId,
+      changes: { title: data.title, category: data.category, severity, status: 'ongoing' },
+    });
+    return created;
   });
   // {{/if}}
   // {{#if ORM=none}}
-  const report: BreachReport = {
-    id: newId(),
-    title,
-    description,
-    category,
-    severity,
-    status: 'ongoing',
-    discoveredAt: new Date(discoveredAt),
-    occurredAt: occurredAt ? new Date(occurredAt) : null,
-    reportedAt: new Date(),
-    reporterName,
-    reporterEmail,
-    reporterDepartment: reporterDepartment ?? null,
-    affectedSystems,
-    dataTypes,
-    estimatedAffected: estimatedAffected ?? null,
-    initialActions: initialActions ?? null,
-  };
+  const report: BreachRow = { id: crypto.randomUUID(), ...data, reportedAt };
   breachStore.set(report.id, report);
-  auditLog.push({ id: newId(), module: 'breach', action: 'reported', entityId: report.id, at: new Date() });
+  auditLog.push({ id: crypto.randomUUID(), tenantId: context.tenantId, action: 'reported', entityId: report.id, performedBy: actorId, at: reportedAt });
   // {{/if}}
 
-  // NDPC readiness — NDPA S.40 / GAID 2025 Art. 33(5). Advisory and
-  // non-blocking: you must record every incident, but this surfaces which
-  // mandated notification fields are still missing (and how long is left on
-  // the 72-hour clock) before you file with the Commission. Collect the
-  // missing fields — likely consequences, mitigation measures, data-subject
-  // categories, record count — as your investigation progresses.
   const ndpcReadiness = assessBreachNotification({
-    id: report.id,
-    title,
-    description,
-    category,
-    discoveredAt: new Date(discoveredAt).getTime(),
-    occurredAt: occurredAt ? new Date(occurredAt).getTime() : undefined,
-    reportedAt: Date.now(),
-    reporter: { name: reporterName, email: reporterEmail, department: reporterDepartment ?? '' },
-    affectedSystems,
-    dataTypes,
+    id: report.id, title: data.title, description: data.description, category: data.category,
+    discoveredAt: discoveredAt.getTime(), occurredAt: occurredAt?.getTime(), reportedAt: reportedAt.getTime(),
+    reporter: { name: data.reporterName, email: data.reporterEmail, department: data.reporterDepartment ?? '' },
+    affectedSystems: data.affectedSystems, dataTypes: data.dataTypes,
+    involvesSensitiveData: data.involvesSensitiveData,
     estimatedAffectedSubjects: estimatedAffected ?? undefined,
-    initialActions: initialActions ?? undefined,
-    dpoContact: { name: '{{ORG_NAME}} DPO', email: '{{DPO_EMAIL}}' },
-    status: 'ongoing',
+    approximateRecordCount: approximateRecordCount ?? undefined,
+    dataSubjectCategories, likelyConsequences: data.likelyConsequences ?? undefined,
+    mitigationMeasures: data.mitigationMeasures ?? undefined,
+    isPhasedReport: data.isPhasedReport, supplementsReportId: data.supplementsReportId ?? undefined,
+    initialActions: data.initialActions ?? undefined,
+    dpoContact: { name: `{{ORG_NAME_TEMPLATE}} DPO`, email: `{{DPO_EMAIL_TEMPLATE}}` }, status: 'ongoing',
   });
-
-  return NextResponse.json(
-    {
-      ...report,
-      ndpcReadiness: {
-        complete: ndpcReadiness.complete,
-        completeness: ndpcReadiness.completeness,
-        missing: ndpcReadiness.missing,
-        hoursRemaining: ndpcReadiness.timing.hoursRemaining,
-      },
-    },
-    { status: 201 },
-  );
+  return NextResponse.json({ ...report, ndpcReadiness: {
+    complete: ndpcReadiness.complete, ready: ndpcReadiness.ready, valid: ndpcReadiness.valid,
+    completeness: ndpcReadiness.completeness, missing: ndpcReadiness.missing,
+    validationErrors: ndpcReadiness.validationErrors,
+    notificationRequired: ndpcReadiness.notificationRequired,
+    hoursRemaining: ndpcReadiness.timing.hoursRemaining,
+    evidenceRecorded: ndpcReadiness.evidence.notificationProvided,
+  } }, { status: 201 });
 }