@things-factory/compliance 0.0.0-stage → 10.1.255

package/dist-server/service/privacy-record/privacy-record-query.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrivacyIncidentQuery = exports.PrivacyRequestQuery = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+const auth_base_1 = require("@things-factory/auth-base");
+const organization_1 = require("@things-factory/organization");
+const shell_1 = require("@things-factory/shell");
+const correction_1 = require("../common/correction");
+const privacy_record_1 = require("./privacy-record");
+const privacy_record_service_1 = require("./privacy-record-service");
+const privacy_record_type_1 = require("./privacy-record-type");
+let PrivacyRequestQuery = class PrivacyRequestQuery {
+    async privacyRequests(params, context) {
+        const queryBuilder = (0, shell_1.getQueryBuilderFromListParams)({
+            domain: context.state.domain,
+            params,
+            repository: (0, shell_1.getRepository)(privacy_record_1.PrivacyRequest),
+            searchables: ['requesterName', 'details', 'handling'],
+            alias: 'request',
+            defaultSortings: [{ name: 'receivedOn', desc: true }]
+        });
+        const [items, total] = await queryBuilder.getManyAndCount();
+        return { items, total };
+    }
+    async myPrivacyRequests(context) {
+        return await (0, privacy_record_service_1.myPrivacyRequests)(context);
+    }
+    async requesterEmployee(row) {
+        return row.requesterEmployeeId ? await (0, shell_1.getRepository)(organization_1.Employee).findOne({ where: { id: row.requesterEmployeeId } }) : null;
+    }
+    async corrections(row, context) {
+        return await (0, correction_1.correctionsOf)((0, shell_1.getRepository)(privacy_record_1.PrivacyRequest).manager, context.state.domain, { kind: privacy_record_service_1.PRIVACY_REQUEST_KIND, id: row.id });
+    }
+    async updater(row) {
+        return row.updaterId ? await (0, shell_1.getRepository)(auth_base_1.User).findOne({ where: { id: row.updaterId } }) : null;
+    }
+};
+exports.PrivacyRequestQuery = PrivacyRequestQuery;
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)('@privilege(category: "privacy-record", privilege: "query", domainOwnerGranted: true)'),
+    (0, type_graphql_1.Query)(returns => privacy_record_type_1.PrivacyRequestList, { description: '개인정보 요구 - requests to see, correct, delete or stop the processing of personal information (ADR-0187 decision 22)' }),
+    tslib_1.__param(0, (0, type_graphql_1.Args)(type => shell_1.ListParam)),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [shell_1.ListParam, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PrivacyRequestQuery.prototype, "privacyRequests", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Query)(returns => [privacy_record_1.PrivacyRequest], { description: 'The requests the request\'s employee raised of their own personal information' }),
+    tslib_1.__param(0, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PrivacyRequestQuery.prototype, "myPrivacyRequests", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.FieldResolver)(type => organization_1.Employee, { nullable: true }),
+    tslib_1.__param(0, (0, type_graphql_1.Root)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [privacy_record_1.PrivacyRequest]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PrivacyRequestQuery.prototype, "requesterEmployee", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.FieldResolver)(type => [correction_1.ComplianceCorrection], { description: 'The values changed after they were written' }),
+    tslib_1.__param(0, (0, type_graphql_1.Root)()),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [privacy_record_1.PrivacyRequest, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PrivacyRequestQuery.prototype, "corrections", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.FieldResolver)(type => auth_base_1.User, { nullable: true }),
+    tslib_1.__param(0, (0, type_graphql_1.Root)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [privacy_record_1.PrivacyRequest]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PrivacyRequestQuery.prototype, "updater", null);
+exports.PrivacyRequestQuery = PrivacyRequestQuery = tslib_1.__decorate([
+    (0, type_graphql_1.Resolver)(privacy_record_1.PrivacyRequest),
+    (0, type_graphql_1.UseMiddleware)(shell_1.SpeakRefusals)
+], PrivacyRequestQuery);
+let PrivacyIncidentQuery = class PrivacyIncidentQuery {
+    async privacyIncidents(params, context) {
+        const queryBuilder = (0, shell_1.getQueryBuilderFromListParams)({
+            domain: context.state.domain,
+            params,
+            repository: (0, shell_1.getRepository)(privacy_record_1.PrivacyIncident),
+            searchables: ['items', 'measures', 'reportReceiptNo'],
+            alias: 'incident',
+            defaultSortings: [{ name: 'knownAt', desc: true }]
+        });
+        const [items, total] = await queryBuilder.getManyAndCount();
+        return { items, total };
+    }
+    async corrections(row, context) {
+        return await (0, correction_1.correctionsOf)((0, shell_1.getRepository)(privacy_record_1.PrivacyIncident).manager, context.state.domain, { kind: privacy_record_service_1.PRIVACY_INCIDENT_KIND, id: row.id });
+    }
+    async updater(row) {
+        return row.updaterId ? await (0, shell_1.getRepository)(auth_base_1.User).findOne({ where: { id: row.updaterId } }) : null;
+    }
+};
+exports.PrivacyIncidentQuery = PrivacyIncidentQuery;
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)('@privilege(category: "privacy-record", privilege: "query", domainOwnerGranted: true)'),
+    (0, type_graphql_1.Query)(returns => privacy_record_type_1.PrivacyIncidentList, { description: '개인정보 유출 사고 - leaks known or possible, their 72 hours, the subjects told and the report (ADR-0187 decision 22)' }),
+    tslib_1.__param(0, (0, type_graphql_1.Args)(type => shell_1.ListParam)),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [shell_1.ListParam, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PrivacyIncidentQuery.prototype, "privacyIncidents", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.FieldResolver)(type => [correction_1.ComplianceCorrection], { description: 'The values changed after they were written' }),
+    tslib_1.__param(0, (0, type_graphql_1.Root)()),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [privacy_record_1.PrivacyIncident, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PrivacyIncidentQuery.prototype, "corrections", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.FieldResolver)(type => auth_base_1.User, { nullable: true }),
+    tslib_1.__param(0, (0, type_graphql_1.Root)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [privacy_record_1.PrivacyIncident]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PrivacyIncidentQuery.prototype, "updater", null);
+exports.PrivacyIncidentQuery = PrivacyIncidentQuery = tslib_1.__decorate([
+    (0, type_graphql_1.Resolver)(privacy_record_1.PrivacyIncident),
+    (0, type_graphql_1.UseMiddleware)(shell_1.SpeakRefusals)
+], PrivacyIncidentQuery);
+//# sourceMappingURL=privacy-record-query.js.map

package/dist-server/service/privacy-record/privacy-record-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-record-query.js","sourceRoot":"","sources":["../../../server/service/privacy-record/privacy-record-query.ts"],"names":[],"mappings":";;;;AAAA,+CAAwG;AAExG,yDAAgD;AAChD,+DAAuD;AACvD,iDAA8G;AAE9G,qDAA0E;AAC1E,qDAAkE;AAClE,qEAAyG;AACzG,+DAA+E;AAIxE,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAGxB,AAAN,KAAK,CAAC,eAAe,CAA0B,MAAiB,EAAS,OAAwB;QAC/F,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,MAAM;YACN,UAAU,EAAE,IAAA,qBAAa,EAAC,+BAAc,CAAC;YACzC,WAAW,EAAE,CAAC,eAAe,EAAE,SAAS,EAAE,UAAU,CAAC;YACrD,KAAK,EAAE,SAAS;YAChB,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;SACtD,CAAC,CAAA;QACF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAGK,AAAN,KAAK,CAAC,iBAAiB,CAAQ,OAAwB;QACrD,OAAO,MAAM,IAAA,0CAAiB,EAAC,OAAO,CAAC,CAAA;IACzC,CAAC;IAGK,AAAN,KAAK,CAAC,iBAAiB,CAAS,GAAmB;QACjD,OAAO,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,uBAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3H,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAS,GAAmB,EAAS,OAAwB;QAC5E,OAAO,MAAM,IAAA,0BAAa,EAAC,IAAA,qBAAa,EAAC,+BAAc,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,6CAAoB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;IACrI,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,GAAmB;QACvC,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,gBAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnG,CAAC;CACF,CAAA;AAnCY,kDAAmB;AAGxB;IAFL,IAAA,wBAAS,EAAC,sFAAsF,CAAC;IACjG,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wCAAkB,EAAE,EAAE,WAAW,EAAE,kHAAkH,EAAE,CAAC;IACnJ,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;0DAW/D;AAGK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,+BAAc,CAAC,EAAE,EAAE,WAAW,EAAE,+EAA+E,EAAE,CAAC;IAC5G,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;4DAE7B;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,uBAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3B,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAM,+BAAc;;4DAElD;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,iCAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;IAC1F,mBAAA,IAAA,mBAAI,GAAE,CAAA;IAAuB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAtB,+BAAc;;sDAE5C;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,gBAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjC,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAM,+BAAc;;kDAExC;8BAlCU,mBAAmB;IAF/B,IAAA,uBAAQ,EAAC,+BAAc,CAAC;IACxB,IAAA,4BAAa,EAAC,qBAAa,CAAC;GAChB,mBAAmB,CAmC/B;AAIM,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAGzB,AAAN,KAAK,CAAC,gBAAgB,CAA0B,MAAiB,EAAS,OAAwB;QAChG,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,MAAM;YACN,UAAU,EAAE,IAAA,qBAAa,EAAC,gCAAe,CAAC;YAC1C,WAAW,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,iBAAiB,CAAC;YACrD,KAAK,EAAE,UAAU;YACjB,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;SACnD,CAAC,CAAA;QACF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAS,GAAoB,EAAS,OAAwB;QAC7E,OAAO,MAAM,IAAA,0BAAa,EAAC,IAAA,qBAAa,EAAC,gCAAe,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,8CAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;IACvI,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,GAAoB;QACxC,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,gBAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnG,CAAC;CACF,CAAA;AAzBY,oDAAoB;AAGzB;IAFL,IAAA,wBAAS,EAAC,sFAAsF,CAAC;IACjG,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,yCAAmB,EAAE,EAAE,WAAW,EAAE,+GAA+G,EAAE,CAAC;IAChJ,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;4DAWhE;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,iCAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;IAC1F,mBAAA,IAAA,mBAAI,GAAE,CAAA;IAAwB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAvB,gCAAe;;uDAE7C;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,gBAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjC,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAM,gCAAe;;mDAEzC;+BAxBU,oBAAoB;IAFhC,IAAA,uBAAQ,EAAC,gCAAe,CAAC;IACzB,IAAA,4BAAa,EAAC,qBAAa,CAAC;GAChB,oBAAoB,CAyBhC","sourcesContent":["import { Args, Ctx, Directive, FieldResolver, Query, Resolver, Root, UseMiddleware } from 'type-graphql'\n\nimport { User } from '@things-factory/auth-base'\nimport { Employee } from '@things-factory/organization'\nimport { getQueryBuilderFromListParams, getRepository, ListParam, SpeakRefusals } from '@things-factory/shell'\n\nimport { ComplianceCorrection, correctionsOf } from '../common/correction'\nimport { PrivacyIncident, PrivacyRequest } from './privacy-record'\nimport { myPrivacyRequests, PRIVACY_INCIDENT_KIND, PRIVACY_REQUEST_KIND } from './privacy-record-service'\nimport { PrivacyIncidentList, PrivacyRequestList } from './privacy-record-type'\n\n@Resolver(PrivacyRequest)\n@UseMiddleware(SpeakRefusals)\nexport class PrivacyRequestQuery {\n  @Directive('@privilege(category: \"privacy-record\", privilege: \"query\", domainOwnerGranted: true)')\n  @Query(returns => PrivacyRequestList, { description: '개인정보 요구 - requests to see, correct, delete or stop the processing of personal information (ADR-0187 decision 22)' })\n  async privacyRequests(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<PrivacyRequestList> {\n    const queryBuilder = getQueryBuilderFromListParams({\n      domain: context.state.domain,\n      params,\n      repository: getRepository(PrivacyRequest),\n      searchables: ['requesterName', 'details', 'handling'],\n      alias: 'request',\n      defaultSortings: [{ name: 'receivedOn', desc: true }]\n    })\n    const [items, total] = await queryBuilder.getManyAndCount()\n    return { items, total }\n  }\n\n  @Query(returns => [PrivacyRequest], { description: 'The requests the request\\'s employee raised of their own personal information' })\n  async myPrivacyRequests(@Ctx() context: ResolverContext): Promise<PrivacyRequest[]> {\n    return await myPrivacyRequests(context)\n  }\n\n  @FieldResolver(type => Employee, { nullable: true })\n  async requesterEmployee(@Root() row: PrivacyRequest): Promise<Employee | null> {\n    return row.requesterEmployeeId ? await getRepository(Employee).findOne({ where: { id: row.requesterEmployeeId } }) : null\n  }\n\n  @FieldResolver(type => [ComplianceCorrection], { description: 'The values changed after they were written' })\n  async corrections(@Root() row: PrivacyRequest, @Ctx() context: ResolverContext): Promise<ComplianceCorrection[]> {\n    return await correctionsOf(getRepository(PrivacyRequest).manager, context.state.domain, { kind: PRIVACY_REQUEST_KIND, id: row.id })\n  }\n\n  @FieldResolver(type => User, { nullable: true })\n  async updater(@Root() row: PrivacyRequest): Promise<User | null> {\n    return row.updaterId ? await getRepository(User).findOne({ where: { id: row.updaterId } }) : null\n  }\n}\n\n@Resolver(PrivacyIncident)\n@UseMiddleware(SpeakRefusals)\nexport class PrivacyIncidentQuery {\n  @Directive('@privilege(category: \"privacy-record\", privilege: \"query\", domainOwnerGranted: true)')\n  @Query(returns => PrivacyIncidentList, { description: '개인정보 유출 사고 - leaks known or possible, their 72 hours, the subjects told and the report (ADR-0187 decision 22)' })\n  async privacyIncidents(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<PrivacyIncidentList> {\n    const queryBuilder = getQueryBuilderFromListParams({\n      domain: context.state.domain,\n      params,\n      repository: getRepository(PrivacyIncident),\n      searchables: ['items', 'measures', 'reportReceiptNo'],\n      alias: 'incident',\n      defaultSortings: [{ name: 'knownAt', desc: true }]\n    })\n    const [items, total] = await queryBuilder.getManyAndCount()\n    return { items, total }\n  }\n\n  @FieldResolver(type => [ComplianceCorrection], { description: 'The values changed after they were written' })\n  async corrections(@Root() row: PrivacyIncident, @Ctx() context: ResolverContext): Promise<ComplianceCorrection[]> {\n    return await correctionsOf(getRepository(PrivacyIncident).manager, context.state.domain, { kind: PRIVACY_INCIDENT_KIND, id: row.id })\n  }\n\n  @FieldResolver(type => User, { nullable: true })\n  async updater(@Root() row: PrivacyIncident): Promise<User | null> {\n    return row.updaterId ? await getRepository(User).findOne({ where: { id: row.updaterId } }) : null\n  }\n}\n"]}

package/dist-server/service/privacy-record/privacy-record-rules.d.ts

@@ -0,0 +1,52 @@
+import { Refusal } from '@things-factory/shell';
+export declare const REQUEST_KINDS: string[];
+export declare const INCIDENT_CERTAINTIES: string[];
+/** Days from receipt a request is to be answered in. */
+export declare const REQUEST_DUE_DAYS = 10;
+/** Hours from its being known an incident is to be reported and told in. */
+export declare const INCIDENT_DUE_HOURS = 72;
+/** The day a request received on `receivedOn` is due. */
+export declare const requestDueOn: (receivedOn: string) => string;
+/** The moment an incident known at `knownAt` is due - 72 hours on, to the minute. */
+export declare const incidentDueAt: (knownAt: Date) => Date;
+/** Whole hours left before `dueAt` - below zero once it has passed. */
+export declare function hoursLeft(dueAt: Date, now: Date): number;
+/** A request not answered past the day it is due - the extended day when it was extended. */
+export declare function requestOverdue(row: {
+    repliedOn?: string | null;
+    dueOn: string;
+    extendedDueOn?: string | null;
+}, today: string): boolean;
+/** An incident not yet both reported and told - what the check counts the hours of. */
+export declare function incidentOpen(row: {
+    reportedAt?: Date | null;
+    subjectsToldAt?: Date | null;
+}): boolean;
+export interface PrivacyRequestInput {
+    kind?: string | null;
+    receivedOn?: string | null;
+    requesterName?: string | null;
+    hasEmployee?: boolean;
+    details?: string | null;
+}
+/** What a request asks for before it is written, or nothing. */
+export declare function privacyRequestRefusal(input: PrivacyRequestInput): Refusal | null;
+/** What the handling of a request asks for, or nothing. */
+export declare function privacyHandlingRefusal(next: {
+    receivedOn: string;
+    dueOn: string;
+    extendedDueOn?: string | null;
+    extensionReason?: string | null;
+    repliedOn?: string | null;
+    handling?: string | null;
+}): Refusal | null;
+export interface PrivacyIncidentInput {
+    knownAt?: Date | string | null;
+    certainty?: string | null;
+    items?: string | null;
+    subjectCount?: number | null;
+    subjectsToldAt?: Date | string | null;
+    reportedAt?: Date | string | null;
+}
+/** What an incident asks for before it is written, or nothing. */
+export declare function privacyIncidentRefusal(input: PrivacyIncidentInput): Refusal | null;

package/dist-server/service/privacy-record/privacy-record-rules.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.incidentDueAt = exports.requestDueOn = exports.INCIDENT_DUE_HOURS = exports.REQUEST_DUE_DAYS = exports.INCIDENT_CERTAINTIES = exports.REQUEST_KINDS = void 0;
+exports.hoursLeft = hoursLeft;
+exports.requestOverdue = requestOverdue;
+exports.incidentOpen = incidentOpen;
+exports.privacyRequestRefusal = privacyRequestRefusal;
+exports.privacyHandlingRefusal = privacyHandlingRefusal;
+exports.privacyIncidentRefusal = privacyIncidentRefusal;
+const shell_1 = require("@things-factory/shell");
+const compliance_case_rules_1 = require("../compliance-case/compliance-case-rules");
+/*
+ * What a privacy request and a privacy incident hold to (ADR-0187 decision 22): a request is answered within ten days
+ * of its receipt (개인정보보호법 §35~§37 ⚖), an incident is reported and its subjects told within 72 hours of its being
+ * known (§34) - counted in hours, not days. Pure.
+ */
+exports.REQUEST_KINDS = ['ACCESS', 'CORRECTION', 'DELETION', 'SUSPENSION'];
+exports.INCIDENT_CERTAINTIES = ['CONFIRMED', 'POSSIBLE'];
+/** Days from receipt a request is to be answered in. */
+exports.REQUEST_DUE_DAYS = 10;
+/** Hours from its being known an incident is to be reported and told in. */
+exports.INCIDENT_DUE_HOURS = 72;
+const HOUR = 3600 * 1000;
+const DAY = /^\d{4}-\d{2}-\d{2}$/;
+/** The day a request received on `receivedOn` is due. */
+const requestDueOn = (receivedOn) => (0, compliance_case_rules_1.dayPlus)(receivedOn, exports.REQUEST_DUE_DAYS);
+exports.requestDueOn = requestDueOn;
+/** The moment an incident known at `knownAt` is due - 72 hours on, to the minute. */
+const incidentDueAt = (knownAt) => new Date(knownAt.getTime() + exports.INCIDENT_DUE_HOURS * HOUR);
+exports.incidentDueAt = incidentDueAt;
+/** Whole hours left before `dueAt` - below zero once it has passed. */
+function hoursLeft(dueAt, now) {
+    const left = (dueAt.getTime() - now.getTime()) / HOUR;
+    return left >= 0 ? Math.floor(left) : -Math.ceil(-left);
+}
+/** A request not answered past the day it is due - the extended day when it was extended. */
+function requestOverdue(row, today) {
+    return !row.repliedOn && (row.extendedDueOn || row.dueOn) < today;
+}
+/** An incident not yet both reported and told - what the check counts the hours of. */
+function incidentOpen(row) {
+    return !row.reportedAt || !row.subjectsToldAt;
+}
+/** What a request asks for before it is written, or nothing. */
+function privacyRequestRefusal(input) {
+    if (!exports.REQUEST_KINDS.includes(input.kind ?? ''))
+        return new shell_1.Refusal('privacy-request-kind-required', {}, 'pick access, correction, deletion or suspension');
+    if (!input.receivedOn || !DAY.test(input.receivedOn))
+        return new shell_1.Refusal('privacy-request-received-on-invalid', {}, 'give the day it was received as YYYY-MM-DD');
+    if (!input.hasEmployee && !input.requesterName?.trim())
+        return new shell_1.Refusal('privacy-request-requester-required', {}, 'name who asked - an employee, or the outside person by name');
+    if (!input.details?.trim())
+        return new shell_1.Refusal('privacy-request-details-required', {}, 'say what was asked');
+    return null;
+}
+/** What the handling of a request asks for, or nothing. */
+function privacyHandlingRefusal(next) {
+    for (const field of ['extendedDueOn', 'repliedOn']) {
+        const day = next[field];
+        if (day && (!DAY.test(day) || day < next.receivedOn))
+            return new shell_1.Refusal(`privacy-request-${(0, compliance_case_rules_1.kebabOf)(field)}-invalid`, { receivedOn: next.receivedOn }, `give ${field} as YYYY-MM-DD, on or after the day it was received`);
+    }
+    if (next.extendedDueOn && next.extendedDueOn <= next.dueOn)
+        return new shell_1.Refusal('privacy-request-extension-not-later', { dueOn: next.dueOn }, `an extended day comes after the due day (${next.dueOn})`);
+    if (!!next.extendedDueOn !== !!next.extensionReason?.trim())
+        return new shell_1.Refusal('privacy-request-extension-reason', {}, 'an extension gives both its new day and its reason');
+    if (next.repliedOn && !next.handling?.trim())
+        return new shell_1.Refusal('privacy-request-handling-required', {}, 'write how it was handled before the day it was answered');
+    return null;
+}
+const moment = (value) => (value ? new Date(value) : null);
+const valid = (value) => !!value && !isNaN(value.getTime());
+/** What an incident asks for before it is written, or nothing. */
+function privacyIncidentRefusal(input) {
+    const knownAt = moment(input.knownAt);
+    if (!valid(knownAt))
+        return new shell_1.Refusal('privacy-incident-known-at-required', {}, 'give the time it became known');
+    if (!exports.INCIDENT_CERTAINTIES.includes(input.certainty ?? ''))
+        return new shell_1.Refusal('privacy-incident-certainty-required', {}, 'say whether it is confirmed or possible');
+    if (!input.items?.trim())
+        return new shell_1.Refusal('privacy-incident-items-required', {}, 'say which items of personal information');
+    if (input.subjectCount !== undefined && input.subjectCount !== null && !(Number.isInteger(input.subjectCount) && input.subjectCount >= 0))
+        return new shell_1.Refusal('privacy-incident-count-invalid', {}, 'give the number of people as a whole number of 0 or more');
+    for (const field of ['subjectsToldAt', 'reportedAt']) {
+        const at = moment(input[field]);
+        if (input[field] && (!valid(at) || at.getTime() < knownAt.getTime()))
+            return new shell_1.Refusal(`privacy-incident-${(0, compliance_case_rules_1.kebabOf)(field)}-before-known`, {}, `${field} cannot be before the time it became known`);
+    }
+    return null;
+}
+//# sourceMappingURL=privacy-record-rules.js.map

package/dist-server/service/privacy-record/privacy-record-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-record-rules.js","sourceRoot":"","sources":["../../../server/service/privacy-record/privacy-record-rules.ts"],"names":[],"mappings":";;;AA4BA,8BAGC;AAGD,wCAEC;AAGD,oCAEC;AAWD,sDAMC;AAGD,wDASC;AAeD,wDAYC;AAjGD,iDAA+C;AAE/C,oFAA2E;AAE3E;;;;GAIG;AAEU,QAAA,aAAa,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;AAClE,QAAA,oBAAoB,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;AAE7D,wDAAwD;AAC3C,QAAA,gBAAgB,GAAG,EAAE,CAAA;AAClC,4EAA4E;AAC/D,QAAA,kBAAkB,GAAG,EAAE,CAAA;AAEpC,MAAM,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AACxB,MAAM,GAAG,GAAG,qBAAqB,CAAA;AAEjC,yDAAyD;AAClD,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,IAAA,+BAAO,EAAC,UAAU,EAAE,wBAAgB,CAAC,CAAA;AAA5E,QAAA,YAAY,gBAAgE;AAEzF,qFAAqF;AAC9E,MAAM,aAAa,GAAG,CAAC,OAAa,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,0BAAkB,GAAG,IAAI,CAAC,CAAA;AAA1F,QAAA,aAAa,iBAA6E;AAEvG,uEAAuE;AACvE,SAAgB,SAAS,CAAC,KAAW,EAAE,GAAS;IAC9C,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAA;IACrD,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAA;AACzD,CAAC;AAED,6FAA6F;AAC7F,SAAgB,cAAc,CAAC,GAAgF,EAAE,KAAa;IAC5H,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;AACnE,CAAC;AAED,uFAAuF;AACvF,SAAgB,YAAY,CAAC,GAA+D;IAC1F,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,cAAc,CAAA;AAC/C,CAAC;AAUD,gEAAgE;AAChE,SAAgB,qBAAqB,CAAC,KAA0B;IAC9D,IAAI,CAAC,qBAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,eAAO,CAAC,+BAA+B,EAAE,EAAE,EAAE,iDAAiD,CAAC,CAAA;IACzJ,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,eAAO,CAAC,qCAAqC,EAAE,EAAE,EAAE,4CAA4C,CAAC,CAAA;IACjK,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,eAAO,CAAC,oCAAoC,EAAE,EAAE,EAAE,6DAA6D,CAAC,CAAA;IACnL,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,eAAO,CAAC,kCAAkC,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAA;IAC5G,OAAO,IAAI,CAAA;AACb,CAAC;AAED,2DAA2D;AAC3D,SAAgB,sBAAsB,CAAC,IAAgK;IACrM,KAAK,MAAM,KAAK,IAAI,CAAC,eAAe,EAAE,WAAW,CAAU,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACvB,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,eAAO,CAAC,mBAAmB,IAAA,+BAAO,EAAC,KAAK,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,KAAK,qDAAqD,CAAC,CAAA;IAC5N,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,eAAO,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,4CAA4C,IAAI,CAAC,KAAK,GAAG,CAAC,CAAA;IACvM,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,eAAO,CAAC,kCAAkC,EAAE,EAAE,EAAE,oDAAoD,CAAC,CAAA;IAC7K,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,eAAO,CAAC,mCAAmC,EAAE,EAAE,EAAE,yDAAyD,CAAC,CAAA;IACpK,OAAO,IAAI,CAAA;AACb,CAAC;AAWD,MAAM,MAAM,GAAG,CAAC,KAAuC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AACnG,MAAM,KAAK,GAAG,CAAC,KAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;AAExE,kEAAkE;AAClE,SAAgB,sBAAsB,CAAC,KAA2B;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,eAAO,CAAC,oCAAoC,EAAE,EAAE,EAAE,+BAA+B,CAAC,CAAA;IAClH,IAAI,CAAC,4BAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,eAAO,CAAC,qCAAqC,EAAE,EAAE,EAAE,yCAAyC,CAAC,CAAA;IACnK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,eAAO,CAAC,iCAAiC,EAAE,EAAE,EAAE,yCAAyC,CAAC,CAAA;IAC9H,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;QACvI,OAAO,IAAI,eAAO,CAAC,gCAAgC,EAAE,EAAE,EAAE,0DAA0D,CAAC,CAAA;IACtH,KAAK,MAAM,KAAK,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAU,EAAE,CAAC;QAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/B,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAG,CAAC,OAAO,EAAE,GAAG,OAAQ,CAAC,OAAO,EAAE,CAAC;YAAE,OAAO,IAAI,eAAO,CAAC,oBAAoB,IAAA,+BAAO,EAAC,KAAK,CAAC,eAAe,EAAE,EAAE,EAAE,GAAG,KAAK,4CAA4C,CAAC,CAAA;IACzM,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import { Refusal } from '@things-factory/shell'\n\nimport { dayPlus, kebabOf } from '../compliance-case/compliance-case-rules'\n\n/*\n * What a privacy request and a privacy incident hold to (ADR-0187 decision 22): a request is answered within ten days\n * of its receipt (개인정보보호법 §35~§37 ⚖), an incident is reported and its subjects told within 72 hours of its being\n * known (§34) - counted in hours, not days. Pure.\n */\n\nexport const REQUEST_KINDS = ['ACCESS', 'CORRECTION', 'DELETION', 'SUSPENSION']\nexport const INCIDENT_CERTAINTIES = ['CONFIRMED', 'POSSIBLE']\n\n/** Days from receipt a request is to be answered in. */\nexport const REQUEST_DUE_DAYS = 10\n/** Hours from its being known an incident is to be reported and told in. */\nexport const INCIDENT_DUE_HOURS = 72\n\nconst HOUR = 3600 * 1000\nconst DAY = /^\\d{4}-\\d{2}-\\d{2}$/\n\n/** The day a request received on `receivedOn` is due. */\nexport const requestDueOn = (receivedOn: string) => dayPlus(receivedOn, REQUEST_DUE_DAYS)\n\n/** The moment an incident known at `knownAt` is due - 72 hours on, to the minute. */\nexport const incidentDueAt = (knownAt: Date) => new Date(knownAt.getTime() + INCIDENT_DUE_HOURS * HOUR)\n\n/** Whole hours left before `dueAt` - below zero once it has passed. */\nexport function hoursLeft(dueAt: Date, now: Date): number {\n  const left = (dueAt.getTime() - now.getTime()) / HOUR\n  return left >= 0 ? Math.floor(left) : -Math.ceil(-left)\n}\n\n/** A request not answered past the day it is due - the extended day when it was extended. */\nexport function requestOverdue(row: { repliedOn?: string | null; dueOn: string; extendedDueOn?: string | null }, today: string): boolean {\n  return !row.repliedOn && (row.extendedDueOn || row.dueOn) < today\n}\n\n/** An incident not yet both reported and told - what the check counts the hours of. */\nexport function incidentOpen(row: { reportedAt?: Date | null; subjectsToldAt?: Date | null }): boolean {\n  return !row.reportedAt || !row.subjectsToldAt\n}\n\nexport interface PrivacyRequestInput {\n  kind?: string | null\n  receivedOn?: string | null\n  requesterName?: string | null\n  hasEmployee?: boolean\n  details?: string | null\n}\n\n/** What a request asks for before it is written, or nothing. */\nexport function privacyRequestRefusal(input: PrivacyRequestInput): Refusal | null {\n  if (!REQUEST_KINDS.includes(input.kind ?? '')) return new Refusal('privacy-request-kind-required', {}, 'pick access, correction, deletion or suspension')\n  if (!input.receivedOn || !DAY.test(input.receivedOn)) return new Refusal('privacy-request-received-on-invalid', {}, 'give the day it was received as YYYY-MM-DD')\n  if (!input.hasEmployee && !input.requesterName?.trim()) return new Refusal('privacy-request-requester-required', {}, 'name who asked - an employee, or the outside person by name')\n  if (!input.details?.trim()) return new Refusal('privacy-request-details-required', {}, 'say what was asked')\n  return null\n}\n\n/** What the handling of a request asks for, or nothing. */\nexport function privacyHandlingRefusal(next: { receivedOn: string; dueOn: string; extendedDueOn?: string | null; extensionReason?: string | null; repliedOn?: string | null; handling?: string | null }): Refusal | null {\n  for (const field of ['extendedDueOn', 'repliedOn'] as const) {\n    const day = next[field]\n    if (day && (!DAY.test(day) || day < next.receivedOn)) return new Refusal(`privacy-request-${kebabOf(field)}-invalid`, { receivedOn: next.receivedOn }, `give ${field} as YYYY-MM-DD, on or after the day it was received`)\n  }\n  if (next.extendedDueOn && next.extendedDueOn <= next.dueOn) return new Refusal('privacy-request-extension-not-later', { dueOn: next.dueOn }, `an extended day comes after the due day (${next.dueOn})`)\n  if (!!next.extendedDueOn !== !!next.extensionReason?.trim()) return new Refusal('privacy-request-extension-reason', {}, 'an extension gives both its new day and its reason')\n  if (next.repliedOn && !next.handling?.trim()) return new Refusal('privacy-request-handling-required', {}, 'write how it was handled before the day it was answered')\n  return null\n}\n\nexport interface PrivacyIncidentInput {\n  knownAt?: Date | string | null\n  certainty?: string | null\n  items?: string | null\n  subjectCount?: number | null\n  subjectsToldAt?: Date | string | null\n  reportedAt?: Date | string | null\n}\n\nconst moment = (value: Date | string | null | undefined) => (value ? new Date(value as any) : null)\nconst valid = (value: Date | null) => !!value && !isNaN(value.getTime())\n\n/** What an incident asks for before it is written, or nothing. */\nexport function privacyIncidentRefusal(input: PrivacyIncidentInput): Refusal | null {\n  const knownAt = moment(input.knownAt)\n  if (!valid(knownAt)) return new Refusal('privacy-incident-known-at-required', {}, 'give the time it became known')\n  if (!INCIDENT_CERTAINTIES.includes(input.certainty ?? '')) return new Refusal('privacy-incident-certainty-required', {}, 'say whether it is confirmed or possible')\n  if (!input.items?.trim()) return new Refusal('privacy-incident-items-required', {}, 'say which items of personal information')\n  if (input.subjectCount !== undefined && input.subjectCount !== null && !(Number.isInteger(input.subjectCount) && input.subjectCount >= 0))\n    return new Refusal('privacy-incident-count-invalid', {}, 'give the number of people as a whole number of 0 or more')\n  for (const field of ['subjectsToldAt', 'reportedAt'] as const) {\n    const at = moment(input[field])\n    if (input[field] && (!valid(at) || at!.getTime() < knownAt!.getTime())) return new Refusal(`privacy-incident-${kebabOf(field)}-before-known`, {}, `${field} cannot be before the time it became known`)\n  }\n  return null\n}\n"]}

package/dist-server/service/privacy-record/privacy-record-service.d.ts

@@ -0,0 +1,33 @@
+import { EntityManager } from 'typeorm';
+import { Domain } from '@things-factory/shell';
+import { PrivacyIncident, PrivacyRequest } from './privacy-record';
+import { NewMyPrivacyRequest, PrivacyIncidentPatch, PrivacyRequestPatch } from './privacy-record-type';
+export declare const PRIVACY_REQUEST_KIND = "PrivacyRequest";
+export declare const PRIVACY_INCIDENT_KIND = "PrivacyIncident";
+/** An employee raises a request of their own - a partner, or an account with no employee record, is refused. */
+export declare function raiseMyPrivacyRequest(input: NewMyPrivacyRequest, context: any): Promise<PrivacyRequest>;
+/** The requests the request's employee raised, newest first. */
+export declare function myPrivacyRequests(context: any): Promise<PrivacyRequest[]>;
+/** The manager writes requests - new ones from outside or by an employee, and their handling. */
+export declare function savePrivacyRequests(patches: PrivacyRequestPatch[], context: any): Promise<PrivacyRequest[]>;
+/** The manager writes incidents - new ones, and what followed: the subjects told, the report, the measures. */
+export declare function savePrivacyIncidents(patches: PrivacyIncidentPatch[], context: any): Promise<PrivacyIncident[]>;
+/** Requests not answered past the day they are due - the extended day when extended. */
+export declare function privacyRequestsOverdue(tx: EntityManager, domain: Domain, today: string): Promise<{
+    id: string;
+    kind: string;
+    receivedOn: string;
+    dueOn: string;
+}[]>;
+/**
+ * Incidents not yet both reported and told, with the hours left to their due moment - below zero once past. Counted
+ * in hours from `now`, the 72 hours of the law to the minute.
+ */
+export declare function privacyIncidentsDue(tx: EntityManager, domain: Domain, now?: Date): Promise<{
+    id: string;
+    knownAt: Date;
+    dueAt: Date;
+    hoursLeft: number;
+    reported: boolean;
+    told: boolean;
+}[]>;

package/dist-server/service/privacy-record/privacy-record-service.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRIVACY_INCIDENT_KIND = exports.PRIVACY_REQUEST_KIND = void 0;
+exports.raiseMyPrivacyRequest = raiseMyPrivacyRequest;
+exports.myPrivacyRequests = myPrivacyRequests;
+exports.savePrivacyRequests = savePrivacyRequests;
+exports.savePrivacyIncidents = savePrivacyIncidents;
+exports.privacyRequestsOverdue = privacyRequestsOverdue;
+exports.privacyIncidentsDue = privacyIncidentsDue;
+const typeorm_1 = require("typeorm");
+const organization_1 = require("@things-factory/organization");
+const shell_1 = require("@things-factory/shell");
+const correction_1 = require("../common/correction");
+const employee_reader_1 = require("../common/employee-reader");
+const privacy_record_1 = require("./privacy-record");
+const privacy_record_rules_1 = require("./privacy-record-rules");
+/*
+ * 개인정보 요구와 사고 (ADR-0187 decision 22) and the database. Written by the holders of `privacy-record`
+ * (`compliance.managing`); an employee raises and reads only their own requests. Nothing is deleted - a value changed
+ * after it was written keeps a correction.
+ */
+exports.PRIVACY_REQUEST_KIND = 'PrivacyRequest';
+exports.PRIVACY_INCIDENT_KIND = 'PrivacyIncident';
+const REQUEST_FIELDS = ['requesterEmployeeId', 'requesterName', 'requesterContact', 'kind', 'details', 'receivedOn', 'dueOn', 'extendedDueOn', 'extensionReason', 'handling', 'repliedOn'];
+const INCIDENT_FIELDS = ['knownAt', 'dueAt', 'certainty', 'items', 'subjectCount', 'subjectsToldAt', 'subjectsToldHow', 'reportedAt', 'reportReceiptNo', 'measures'];
+const text = (value) => (typeof value === 'string' ? (value.trim() ? value.trim() : null) : value === undefined ? undefined : value);
+const notFound = (what) => new shell_1.Refusal(`${what}-not-found`, {}, 'the record was not found. reload and try again.');
+/** The fields a patch names, emptied strings as null. */
+function valuesOf(patch, fields) {
+    const values = {};
+    for (const field of fields)
+        if (patch[field] !== undefined)
+            values[field] = text(patch[field]);
+    return values;
+}
+/** An employee raises a request of their own - a partner, or an account with no employee record, is refused. */
+async function raiseMyPrivacyRequest(input, context) {
+    const { domain, user, tx } = context.state;
+    const me = await (0, employee_reader_1.requireWorkingEmployee)(context);
+    const receivedOn = (0, employee_reader_1.todayIn)(domain);
+    const refusal = (0, privacy_record_rules_1.privacyRequestRefusal)({ ...input, receivedOn, hasEmployee: true });
+    if (refusal)
+        throw refusal;
+    const repository = tx.getRepository(privacy_record_1.PrivacyRequest);
+    return await repository.save(repository.create({ domain, requesterEmployee: me, kind: input.kind, details: input.details.trim(), receivedOn, dueOn: (0, privacy_record_rules_1.requestDueOn)(receivedOn), creator: user, updater: user }));
+}
+/** The requests the request's employee raised, newest first. */
+async function myPrivacyRequests(context) {
+    const { domain } = context.state;
+    const me = await (0, employee_reader_1.requireWorkingEmployee)(context);
+    return await (0, shell_1.getRepository)(privacy_record_1.PrivacyRequest).find({ where: { domain: { id: domain.id }, requesterEmployee: { id: me.id } }, order: { receivedOn: 'DESC', createdAt: 'DESC' } });
+}
+/** The manager writes requests - new ones from outside or by an employee, and their handling. */
+async function savePrivacyRequests(patches, context) {
+    const { domain, user, tx } = context.state;
+    const repository = tx.getRepository(privacy_record_1.PrivacyRequest);
+    const saved = [];
+    for (const patch of patches) {
+        const values = valuesOf(patch, REQUEST_FIELDS);
+        const fresh = patch.cuFlag === '+' || !patch.id;
+        const row = fresh ? repository.create({ domain, creator: user }) : await repository.findOne({ where: { id: patch.id, domain: { id: domain.id } } });
+        if (!row)
+            throw notFound('privacy-request');
+        const before = { ...row };
+        if (values.requesterEmployeeId !== undefined) {
+            const employee = values.requesterEmployeeId ? await tx.getRepository(organization_1.Employee).findOne({ where: { id: values.requesterEmployeeId, domain: { id: domain.id } } }) : null;
+            if (values.requesterEmployeeId && !employee)
+                throw new shell_1.Refusal('privacy-request-requester-unknown', {}, 'the one who asked must be an employee of this domain');
+            row.requesterEmployee = employee;
+        }
+        const next = { ...row, requesterEmployeeId: row.requesterEmployee ? row.requesterEmployee.id : row.requesterEmployeeId, ...values };
+        if (next.receivedOn)
+            next.dueOn = (0, privacy_record_rules_1.requestDueOn)(next.receivedOn);
+        const refusal = (0, privacy_record_rules_1.privacyRequestRefusal)({ kind: next.kind, receivedOn: next.receivedOn, requesterName: next.requesterName, hasEmployee: !!next.requesterEmployeeId, details: next.details }) ?? (0, privacy_record_rules_1.privacyHandlingRefusal)(next);
+        if (refusal)
+            throw refusal;
+        Object.assign(row, { ...values, dueOn: next.dueOn, updater: user });
+        delete row.requesterEmployeeId;
+        const written = await repository.save(row);
+        if (!fresh)
+            await (0, correction_1.recordCorrections)(tx, domain, user, { kind: exports.PRIVACY_REQUEST_KIND, id: written.id }, before, { ...values, dueOn: next.dueOn }, REQUEST_FIELDS);
+        saved.push(written);
+    }
+    return saved;
+}
+/** The manager writes incidents - new ones, and what followed: the subjects told, the report, the measures. */
+async function savePrivacyIncidents(patches, context) {
+    const { domain, user, tx } = context.state;
+    const repository = tx.getRepository(privacy_record_1.PrivacyIncident);
+    const saved = [];
+    for (const patch of patches) {
+        const values = valuesOf(patch, INCIDENT_FIELDS);
+        for (const field of ['knownAt', 'subjectsToldAt', 'reportedAt'])
+            if (values[field])
+                values[field] = new Date(values[field]);
+        const fresh = patch.cuFlag === '+' || !patch.id;
+        const row = fresh ? repository.create({ domain, creator: user }) : await repository.findOne({ where: { id: patch.id, domain: { id: domain.id } } });
+        if (!row)
+            throw notFound('privacy-incident');
+        const before = { ...row };
+        const next = { ...row, ...values };
+        const refusal = (0, privacy_record_rules_1.privacyIncidentRefusal)(next);
+        if (refusal)
+            throw refusal;
+        if (values.knownAt)
+            values.dueAt = (0, privacy_record_rules_1.incidentDueAt)(values.knownAt);
+        Object.assign(row, { ...values, updater: user });
+        const written = await repository.save(row);
+        if (!fresh)
+            await (0, correction_1.recordCorrections)(tx, domain, user, { kind: exports.PRIVACY_INCIDENT_KIND, id: written.id }, before, values, INCIDENT_FIELDS);
+        saved.push(written);
+    }
+    return saved;
+}
+/*
+ * ---------------------------------------------------------------- the management check (ADR-0146)
+ */
+/** Requests not answered past the day they are due - the extended day when extended. */
+async function privacyRequestsOverdue(tx, domain, today) {
+    const open = await tx.getRepository(privacy_record_1.PrivacyRequest).find({ where: { domain: { id: domain.id }, repliedOn: (0, typeorm_1.IsNull)() }, order: { receivedOn: 'ASC' } });
+    return open.filter(one => (0, privacy_record_rules_1.requestOverdue)(one, today)).map(one => ({ id: one.id, kind: one.kind, receivedOn: one.receivedOn, dueOn: one.extendedDueOn || one.dueOn }));
+}
+/**
+ * Incidents not yet both reported and told, with the hours left to their due moment - below zero once past. Counted
+ * in hours from `now`, the 72 hours of the law to the minute.
+ */
+async function privacyIncidentsDue(tx, domain, now = new Date()) {
+    const rows = await tx.getRepository(privacy_record_1.PrivacyIncident).find({ where: { domain: { id: domain.id } }, order: { dueAt: 'ASC' } });
+    return rows
+        .filter(privacy_record_rules_1.incidentOpen)
+        .map(one => ({ id: one.id, knownAt: new Date(one.knownAt), dueAt: new Date(one.dueAt), hoursLeft: (0, privacy_record_rules_1.hoursLeft)(new Date(one.dueAt), now), reported: !!one.reportedAt, told: !!one.subjectsToldAt }));
+}
+//# sourceMappingURL=privacy-record-service.js.map

package/dist-server/service/privacy-record/privacy-record-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-record-service.js","sourceRoot":"","sources":["../../../server/service/privacy-record/privacy-record-service.ts"],"names":[],"mappings":";;;AAkCA,sDAUC;AAGD,8CAIC;AAGD,kDA6BC;AAGD,oDAqBC;AAOD,wDAGC;AAMD,kDASC;AApID,qCAA+C;AAE/C,+DAAuD;AACvD,iDAAsE;AAEtE,qDAAwD;AACxD,+DAA2E;AAC3E,qDAAkE;AAClE,iEAAoL;AAGpL;;;;GAIG;AAEU,QAAA,oBAAoB,GAAG,gBAAgB,CAAA;AACvC,QAAA,qBAAqB,GAAG,iBAAiB,CAAA;AAEtD,MAAM,cAAc,GAAG,CAAC,qBAAqB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;AAC1L,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAA;AAEpK,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,KAAa,CAAC,CAAA;AACtJ,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,eAAO,CAAC,GAAG,IAAI,YAAY,EAAE,EAAE,EAAE,iDAAiD,CAAC,CAAA;AAE1H,yDAAyD;AACzD,SAAS,QAAQ,CAAC,KAA0B,EAAE,MAAyB;IACrE,MAAM,MAAM,GAAwB,EAAE,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gHAAgH;AACzG,KAAK,UAAU,qBAAqB,CAAC,KAA0B,EAAE,OAAY;IAClF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC1C,MAAM,EAAE,GAAG,MAAM,IAAA,wCAAsB,EAAC,OAAO,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,IAAA,yBAAO,EAAC,MAAM,CAAC,CAAA;IAClC,MAAM,OAAO,GAAG,IAAA,4CAAqB,EAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;IAClF,IAAI,OAAO;QAAE,MAAM,OAAO,CAAA;IAC1B,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,+BAAc,CAAC,CAAA;IACnD,OAAO,MAAM,UAAU,CAAC,IAAI,CAC1B,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAA,mCAAY,EAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAS,CAA8B,CACrN,CAAA;AACH,CAAC;AAED,gEAAgE;AACzD,KAAK,UAAU,iBAAiB,CAAC,OAAY;IAClD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAChC,MAAM,EAAE,GAAG,MAAM,IAAA,wCAAsB,EAAC,OAAO,CAAC,CAAA;IAChD,OAAO,MAAM,IAAA,qBAAa,EAAC,+BAAc,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAS,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAS,EAAE,CAAC,CAAA;AAC7L,CAAC;AAED,iGAAiG;AAC1F,KAAK,UAAU,mBAAmB,CAAC,OAA8B,EAAE,OAAY;IACpF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC1C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,+BAAc,CAAC,CAAA;IACnD,MAAM,KAAK,GAAqB,EAAE,CAAA;IAClC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,CAAA;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;QAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAS,CAA+B,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAS,EAAE,CAAC,CAAA;QAChM,IAAI,CAAC,GAAG;YAAE,MAAM,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAwB,EAAE,GAAG,GAAG,EAAE,CAAA;QAE9C,IAAI,MAAM,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,uBAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,mBAAmB,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAS,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAC9K,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,eAAO,CAAC,mCAAmC,EAAE,EAAE,EAAE,sDAAsD,CAAC,CAAA;YAC/J,GAAG,CAAC,iBAAiB,GAAG,QAAQ,CAAA;QAClC,CAAC;QACD,MAAM,IAAI,GAAwB,EAAE,GAAG,GAAG,EAAE,mBAAmB,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,MAAM,EAAE,CAAA;QACxJ,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,KAAK,GAAG,IAAA,mCAAY,EAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC/D,MAAM,OAAO,GACX,IAAA,4CAAqB,EAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,IAAA,6CAAsB,EAAC,IAAW,CAAC,CAAA;QACnN,IAAI,OAAO;YAAE,MAAM,OAAO,CAAA;QAE1B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACnE,OAAQ,GAAW,CAAC,mBAAmB,CAAA;QACvC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAA,8BAAiB,EAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,4BAAoB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,cAAc,CAAC,CAAA;QAC/J,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+GAA+G;AACxG,KAAK,UAAU,oBAAoB,CAAC,OAA+B,EAAE,OAAY;IACtF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC1C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,gCAAe,CAAC,CAAA;IACpD,MAAM,KAAK,GAAsB,EAAE,CAAA;IACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC,CAAA;QAC/C,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,YAAY,CAAC;YAAE,IAAI,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QAC3H,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;QAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAS,CAAgC,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAS,EAAE,CAAC,CAAA;QACjM,IAAI,CAAC,GAAG;YAAE,MAAM,QAAQ,CAAC,kBAAkB,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAwB,EAAE,GAAG,GAAG,EAAE,CAAA;QAC9C,MAAM,IAAI,GAAwB,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;QACvD,MAAM,OAAO,GAAG,IAAA,6CAAsB,EAAC,IAAI,CAAC,CAAA;QAC5C,IAAI,OAAO;YAAE,MAAM,OAAO,CAAA;QAC1B,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,KAAK,GAAG,IAAA,oCAAa,EAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAChE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAA,8BAAiB,EAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,6BAAqB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,CAAA;QACvI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AAEH,wFAAwF;AACjF,KAAK,UAAU,sBAAsB,CAAC,EAAiB,EAAE,MAAc,EAAE,KAAa;IAC3F,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAc,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAS,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAS,EAAE,CAAC,CAAA;IACnK,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAA,qCAAc,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;AACvK,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,EAAiB,EACjB,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,gCAAe,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAS,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAS,EAAE,CAAC,CAAA;IAC1I,OAAO,IAAI;SACR,MAAM,CAAC,mCAAY,CAAC;SACpB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAA,gCAAS,EAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAA;AACrM,CAAC","sourcesContent":["import { EntityManager, IsNull } from 'typeorm'\n\nimport { Employee } from '@things-factory/organization'\nimport { Domain, getRepository, Refusal } from '@things-factory/shell'\n\nimport { recordCorrections } from '../common/correction'\nimport { requireWorkingEmployee, todayIn } from '../common/employee-reader'\nimport { PrivacyIncident, PrivacyRequest } from './privacy-record'\nimport { hoursLeft, incidentDueAt, incidentOpen, privacyHandlingRefusal, privacyIncidentRefusal, privacyRequestRefusal, requestDueOn, requestOverdue } from './privacy-record-rules'\nimport { NewMyPrivacyRequest, PrivacyIncidentPatch, PrivacyRequestPatch } from './privacy-record-type'\n\n/*\n * 개인정보 요구와 사고 (ADR-0187 decision 22) and the database. Written by the holders of `privacy-record`\n * (`compliance.managing`); an employee raises and reads only their own requests. Nothing is deleted - a value changed\n * after it was written keeps a correction.\n */\n\nexport const PRIVACY_REQUEST_KIND = 'PrivacyRequest'\nexport const PRIVACY_INCIDENT_KIND = 'PrivacyIncident'\n\nconst REQUEST_FIELDS = ['requesterEmployeeId', 'requesterName', 'requesterContact', 'kind', 'details', 'receivedOn', 'dueOn', 'extendedDueOn', 'extensionReason', 'handling', 'repliedOn']\nconst INCIDENT_FIELDS = ['knownAt', 'dueAt', 'certainty', 'items', 'subjectCount', 'subjectsToldAt', 'subjectsToldHow', 'reportedAt', 'reportReceiptNo', 'measures']\n\nconst text = (value: unknown) => (typeof value === 'string' ? (value.trim() ? value.trim() : null) : value === undefined ? undefined : (value as any))\nconst notFound = (what: string) => new Refusal(`${what}-not-found`, {}, 'the record was not found. reload and try again.')\n\n/** The fields a patch names, emptied strings as null. */\nfunction valuesOf(patch: Record<string, any>, fields: readonly string[]): Record<string, any> {\n  const values: Record<string, any> = {}\n  for (const field of fields) if (patch[field] !== undefined) values[field] = text(patch[field])\n  return values\n}\n\n/** An employee raises a request of their own - a partner, or an account with no employee record, is refused. */\nexport async function raiseMyPrivacyRequest(input: NewMyPrivacyRequest, context: any): Promise<PrivacyRequest> {\n  const { domain, user, tx } = context.state\n  const me = await requireWorkingEmployee(context)\n  const receivedOn = todayIn(domain)\n  const refusal = privacyRequestRefusal({ ...input, receivedOn, hasEmployee: true })\n  if (refusal) throw refusal\n  const repository = tx.getRepository(PrivacyRequest)\n  return await repository.save(\n    repository.create({ domain, requesterEmployee: me, kind: input.kind, details: input.details.trim(), receivedOn, dueOn: requestDueOn(receivedOn), creator: user, updater: user } as any) as unknown as PrivacyRequest\n  )\n}\n\n/** The requests the request's employee raised, newest first. */\nexport async function myPrivacyRequests(context: any): Promise<PrivacyRequest[]> {\n  const { domain } = context.state\n  const me = await requireWorkingEmployee(context)\n  return await getRepository(PrivacyRequest).find({ where: { domain: { id: domain.id }, requesterEmployee: { id: me.id } } as any, order: { receivedOn: 'DESC', createdAt: 'DESC' } as any })\n}\n\n/** The manager writes requests - new ones from outside or by an employee, and their handling. */\nexport async function savePrivacyRequests(patches: PrivacyRequestPatch[], context: any): Promise<PrivacyRequest[]> {\n  const { domain, user, tx } = context.state\n  const repository = tx.getRepository(PrivacyRequest)\n  const saved: PrivacyRequest[] = []\n  for (const patch of patches) {\n    const values = valuesOf(patch, REQUEST_FIELDS)\n    const fresh = patch.cuFlag === '+' || !patch.id\n    const row = fresh ? (repository.create({ domain, creator: user } as any) as unknown as PrivacyRequest) : await repository.findOne({ where: { id: patch.id, domain: { id: domain.id } } as any })\n    if (!row) throw notFound('privacy-request')\n    const before: Record<string, any> = { ...row }\n\n    if (values.requesterEmployeeId !== undefined) {\n      const employee = values.requesterEmployeeId ? await tx.getRepository(Employee).findOne({ where: { id: values.requesterEmployeeId, domain: { id: domain.id } } as any }) : null\n      if (values.requesterEmployeeId && !employee) throw new Refusal('privacy-request-requester-unknown', {}, 'the one who asked must be an employee of this domain')\n      row.requesterEmployee = employee\n    }\n    const next: Record<string, any> = { ...row, requesterEmployeeId: row.requesterEmployee ? row.requesterEmployee.id : row.requesterEmployeeId, ...values }\n    if (next.receivedOn) next.dueOn = requestDueOn(next.receivedOn)\n    const refusal =\n      privacyRequestRefusal({ kind: next.kind, receivedOn: next.receivedOn, requesterName: next.requesterName, hasEmployee: !!next.requesterEmployeeId, details: next.details }) ?? privacyHandlingRefusal(next as any)\n    if (refusal) throw refusal\n\n    Object.assign(row, { ...values, dueOn: next.dueOn, updater: user })\n    delete (row as any).requesterEmployeeId\n    const written = await repository.save(row)\n    if (!fresh) await recordCorrections(tx, domain, user, { kind: PRIVACY_REQUEST_KIND, id: written.id }, before, { ...values, dueOn: next.dueOn }, REQUEST_FIELDS)\n    saved.push(written)\n  }\n  return saved\n}\n\n/** The manager writes incidents - new ones, and what followed: the subjects told, the report, the measures. */\nexport async function savePrivacyIncidents(patches: PrivacyIncidentPatch[], context: any): Promise<PrivacyIncident[]> {\n  const { domain, user, tx } = context.state\n  const repository = tx.getRepository(PrivacyIncident)\n  const saved: PrivacyIncident[] = []\n  for (const patch of patches) {\n    const values = valuesOf(patch, INCIDENT_FIELDS)\n    for (const field of ['knownAt', 'subjectsToldAt', 'reportedAt']) if (values[field]) values[field] = new Date(values[field])\n    const fresh = patch.cuFlag === '+' || !patch.id\n    const row = fresh ? (repository.create({ domain, creator: user } as any) as unknown as PrivacyIncident) : await repository.findOne({ where: { id: patch.id, domain: { id: domain.id } } as any })\n    if (!row) throw notFound('privacy-incident')\n    const before: Record<string, any> = { ...row }\n    const next: Record<string, any> = { ...row, ...values }\n    const refusal = privacyIncidentRefusal(next)\n    if (refusal) throw refusal\n    if (values.knownAt) values.dueAt = incidentDueAt(values.knownAt)\n    Object.assign(row, { ...values, updater: user })\n    const written = await repository.save(row)\n    if (!fresh) await recordCorrections(tx, domain, user, { kind: PRIVACY_INCIDENT_KIND, id: written.id }, before, values, INCIDENT_FIELDS)\n    saved.push(written)\n  }\n  return saved\n}\n\n/*\n * ---------------------------------------------------------------- the management check (ADR-0146)\n */\n\n/** Requests not answered past the day they are due - the extended day when extended. */\nexport async function privacyRequestsOverdue(tx: EntityManager, domain: Domain, today: string): Promise<{ id: string; kind: string; receivedOn: string; dueOn: string }[]> {\n  const open = await tx.getRepository(PrivacyRequest).find({ where: { domain: { id: domain.id }, repliedOn: IsNull() } as any, order: { receivedOn: 'ASC' } as any })\n  return open.filter(one => requestOverdue(one, today)).map(one => ({ id: one.id, kind: one.kind, receivedOn: one.receivedOn, dueOn: one.extendedDueOn || one.dueOn }))\n}\n\n/**\n * Incidents not yet both reported and told, with the hours left to their due moment - below zero once past. Counted\n * in hours from `now`, the 72 hours of the law to the minute.\n */\nexport async function privacyIncidentsDue(\n  tx: EntityManager,\n  domain: Domain,\n  now: Date = new Date()\n): Promise<{ id: string; knownAt: Date; dueAt: Date; hoursLeft: number; reported: boolean; told: boolean }[]> {\n  const rows = await tx.getRepository(PrivacyIncident).find({ where: { domain: { id: domain.id } } as any, order: { dueAt: 'ASC' } as any })\n  return rows\n    .filter(incidentOpen)\n    .map(one => ({ id: one.id, knownAt: new Date(one.knownAt), dueAt: new Date(one.dueAt), hoursLeft: hoursLeft(new Date(one.dueAt), now), reported: !!one.reportedAt, told: !!one.subjectsToldAt }))\n}\n\n"]}

package/dist-server/service/privacy-record/privacy-record-type.d.ts

@@ -0,0 +1,40 @@
+import { PrivacyIncident, PrivacyIncidentCertainty, PrivacyRequest, PrivacyRequestKind } from './privacy-record';
+export declare class NewMyPrivacyRequest {
+    kind: PrivacyRequestKind;
+    details: string;
+}
+export declare class PrivacyRequestPatch {
+    id?: string;
+    cuFlag?: string;
+    requesterEmployeeId?: string;
+    requesterName?: string;
+    requesterContact?: string;
+    kind?: PrivacyRequestKind;
+    details?: string;
+    receivedOn?: string;
+    extendedDueOn?: string;
+    extensionReason?: string;
+    handling?: string;
+    repliedOn?: string;
+}
+export declare class PrivacyIncidentPatch {
+    id?: string;
+    cuFlag?: string;
+    knownAt?: Date;
+    certainty?: PrivacyIncidentCertainty;
+    items?: string;
+    subjectCount?: number;
+    subjectsToldAt?: Date;
+    subjectsToldHow?: string;
+    reportedAt?: Date;
+    reportReceiptNo?: string;
+    measures?: string;
+}
+export declare class PrivacyRequestList {
+    items: PrivacyRequest[];
+    total: number;
+}
+export declare class PrivacyIncidentList {
+    items: PrivacyIncident[];
+    total: number;
+}