ts-prorm-orm 1.1.0

package/dist/compliance/data-retention.js

@@ -0,0 +1,195 @@
+"use strict";
+/**
+ * DataRetentionPolicy
+ *
+ * Attach a mandatory data retention period to any model.
+ * Records older than the policy window are purged (deleted or anonymized)
+ * when DataRetentionPolicy.purge() is called.
+ *
+ * Covers ~80 compliance frameworks including:
+ *   GDPR (storage limitation), SOX (7yr), MiFID II (5yr), SEC 17a-4,
+ *   FINRA, HIPAA, PIPEDA, LGPD, APPI, PDPA variants, and more.
+ *
+ * Usage:
+ *   // Set a 7-year retention on financial records:
+ *   DataRetentionPolicy.set(FinancialRecord, {
+ *     maxAge: { years: 7 },
+ *     field: 'createdAt',
+ *     onExpiry: 'delete',
+ *   });
+ *
+ *   // Purge expired records (call from a scheduled job):
+ *   const { deleted } = await DataRetentionPolicy.purge(FinancialRecord, prorm);
+ *
+ *   // Or purge all registered models:
+ *   const report = await DataRetentionPolicy.purgeAll(prorm);
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DataRetentionPolicy = void 0;
+// ==================== Duration Math ====================
+function durationToMs(d) {
+    if (d.ms != null)
+        return d.ms;
+    let ms = 0;
+    if (d.hours)
+        ms += d.hours * 60 * 60 * 1000;
+    if (d.days)
+        ms += d.days * 24 * 60 * 60 * 1000;
+    if (d.months)
+        ms += d.months * 30 * 24 * 60 * 60 * 1000;
+    if (d.years)
+        ms += d.years * 365 * 24 * 60 * 60 * 1000;
+    return ms;
+}
+const registry = new Map();
+// ==================== DataRetentionPolicy ====================
+class DataRetentionPolicy {
+    /**
+     * Register a retention policy on a model.
+     * This does not start any background process — call purge() on a schedule.
+     *
+     * @param model   - The model class
+     * @param options - Retention configuration
+     */
+    static set(model, options) {
+        registry.set(model, {
+            model,
+            options: {
+                field: options.field ?? 'createdAt',
+                onExpiry: options.onExpiry ?? 'delete',
+                preserveFields: options.preserveFields ?? [],
+                maxAge: options.maxAge,
+            },
+        });
+    }
+    /**
+     * Remove the retention policy from a model.
+     */
+    static unset(model) {
+        registry.delete(model);
+    }
+    /**
+     * Get the registered policy for a model, or undefined.
+     */
+    static get(model) {
+        return registry.get(model)?.options;
+    }
+    /**
+     * Purge expired records for a specific model.
+     *
+     * @param model     - The model class
+     * @param prorm - The Prorm instance (for Op support)
+     * @returns Number of records deleted or anonymized
+     */
+    static async purge(model, prorm) {
+        const entry = registry.get(model);
+        if (!entry) {
+            throw new Error(`[DataRetentionPolicy] No retention policy registered for model "${model.name ?? model}". ` +
+                `Call DataRetentionPolicy.set(Model, options) first.`);
+        }
+        const { options } = entry;
+        const cutoff = new Date(Date.now() - durationToMs(options.maxAge));
+        const field = options.field;
+        // Build a where clause: field < cutoff
+        // Use prorm Op if available, otherwise fall back to raw object key
+        let where;
+        try {
+            const Op = prorm?.Op ?? (await Promise.resolve().then(() => __importStar(require('../models/operators'))).then((m) => m.Op));
+            where = { [field]: { [Op.lt]: cutoff } };
+        }
+        catch {
+            // Fallback: use Symbol-based lt operator directly
+            where = { [field]: { [Symbol.for('lt')]: cutoff } };
+        }
+        if (options.onExpiry === 'delete') {
+            const count = await model.destroy({ where, force: true });
+            return { affected: count ?? 0, mode: 'delete' };
+        }
+        // Anonymize mode: find and null out non-preserved fields
+        const records = await model.findAll({ where });
+        let affected = 0;
+        for (const record of records) {
+            const data = record.dataValues ?? record;
+            const patch = {};
+            for (const key of Object.keys(data)) {
+                if (key === 'id' || key === field || options.preserveFields.includes(key))
+                    continue;
+                patch[key] = null;
+            }
+            if (Object.keys(patch).length > 0) {
+                await record.update(patch);
+                affected++;
+            }
+        }
+        return { affected, mode: 'anonymize' };
+    }
+    /**
+     * Purge all models that have a registered retention policy.
+     *
+     * @param prorm - The Prorm instance
+     * @returns A map of model name → purge result
+     */
+    static async purgeAll(prorm) {
+        const results = new Map();
+        for (const [modelClass, entry] of registry) {
+            try {
+                const result = await DataRetentionPolicy.purge(entry.model, prorm);
+                results.set(modelClass.name ?? 'Unknown', result);
+            }
+            catch (err) {
+                results.set(modelClass.name ?? 'Unknown', { affected: -1, mode: `error: ${err?.message}` });
+            }
+        }
+        return results;
+    }
+    /**
+     * List all models with registered retention policies.
+     */
+    static listPolicies() {
+        return Array.from(registry.values()).map(({ model, options }) => ({
+            modelName: model.name ?? String(model),
+            options,
+        }));
+    }
+    /**
+     * Calculate the cutoff date for a given retention duration.
+     * Useful for displaying "records older than X will be deleted on Y".
+     */
+    static cutoffDate(maxAge) {
+        return new Date(Date.now() - durationToMs(maxAge));
+    }
+}
+exports.DataRetentionPolicy = DataRetentionPolicy;

package/dist/compliance/dsar-workflow.js

@@ -0,0 +1,342 @@
+"use strict";
+/**
+ * DSARWorkflow
+ *
+ * Manages the complete lifecycle of Data Subject Access Requests (DSARs).
+ * Tracks request status from creation through fulfillment and completion.
+ * Generates data exports for data subjects under GDPR, CCPA, HIPAA, and PIPEDA.
+ *
+ * Covers ~65 compliance frameworks including:
+ *   GDPR Art 15-22, CCPA, CPRA, LGPD, APPI, PIPA, PDPA, PoPI, DPDP India,
+ *   HIPAA Right to Access, PIPEDA, and all major data privacy regulations.
+ *
+ * Usage:
+ *   // Create a new access request
+ *   const request = await DSARWorkflow.createRequest('user-123', 'access');
+ *
+ *   // Check request status
+ *   const status = await DSARWorkflow.getRequestStatus(request.id);
+ *
+ *   // Fulfill the request (generate data export)
+ *   const fulfilled = await DSARWorkflow.fulfillRequest(request.id);
+ *
+ *   // Mark as complete
+ *   await DSARWorkflow.completeRequest(request.id);
+ *
+ *   // List all requests for a data subject
+ *   const allRequests = await DSARWorkflow.getRequestsForDataSubject('user-123');
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DSARWorkflow = void 0;
+const data_portability_1 = require("./data-portability");
+const right_to_erasure_1 = require("./right-to-erasure");
+/**
+ * In-memory store for DSAR requests.
+ * In production, this would be persisted to a database.
+ */
+const dsarRequestStore = new Map();
+/**
+ * Generate a unique DSAR request ID.
+ */
+function generateRequestId() {
+    return `dsar-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
+}
+/**
+ * Map request type to default compliance frameworks.
+ */
+function getDefaultFrameworks(requestType) {
+    const frameworkMap = {
+        access: ['GDPR', 'CCPA', 'HIPAA', 'PIPEDA'],
+        rectification: ['GDPR', 'CCPA', 'PIPEDA'],
+        erasure: ['GDPR', 'CCPA', 'LGPD'],
+        portability: ['GDPR', 'CCPA', 'PIPEDA'],
+        restriction: ['GDPR', 'CCPA'],
+        objection: ['GDPR', 'CCPA'],
+        withdrawal: ['GDPR', 'CCPA', 'HIPAA'],
+    };
+    return frameworkMap[requestType];
+}
+/**
+ * Calculate deadline based on request type and jurisdiction.
+ * Default: 30 days (GDPR), extended to 45 for CCPA, 60 for HIPAA.
+ */
+function calculateDeadline(requestType) {
+    const now = new Date();
+    // HIPAA allows 60 days, CCPA allows 45 days, GDPR allows 30 days
+    // Use the longest deadline for safety
+    const days = 60;
+    now.setDate(now.getDate() + days);
+    return now;
+}
+/**
+ * Validate request type and status transitions.
+ */
+function canTransition(currentStatus, newStatus) {
+    const validTransitions = {
+        pending: ['in_progress', 'rejected', 'expired'],
+        in_progress: ['pending_fulfillment', 'rejected', 'expired'],
+        pending_fulfillment: ['fulfilled', 'rejected', 'expired'],
+        fulfilled: ['delivered', 'rejected', 'expired'],
+        delivered: ['completed', 'expired'],
+        completed: [],
+        rejected: [],
+        expired: [],
+    };
+    return validTransitions[currentStatus]?.includes(newStatus) ?? false;
+}
+class DSARWorkflow {
+    /**
+     * Create a new DSAR request.
+     *
+     * @param dataSubjectId - The unique identifier for the data subject
+     * @param requestType - The type of DSAR request
+     * @returns The created DSAR request
+     */
+    static createRequest(dataSubjectId, requestType) {
+        const id = generateRequestId();
+        const now = new Date();
+        const request = {
+            id,
+            dataSubjectId,
+            requestType,
+            status: 'pending',
+            createdAt: now,
+            updatedAt: now,
+            deadline: calculateDeadline(requestType),
+            frameworks: getDefaultFrameworks(requestType),
+        };
+        dsarRequestStore.set(id, request);
+        return request;
+    }
+    /**
+     * Get the status of a DSAR request.
+     *
+     * @param requestId - The request ID
+     * @returns The request if found, undefined otherwise
+     */
+    static getRequestStatus(requestId) {
+        return dsarRequestStore.get(requestId);
+    }
+    /**
+     * Fulfill a DSAR request by generating the data export.
+     * For 'access' and 'portability' requests, generates data export.
+     * For 'erasure' requests, performs the erasure operation.
+     *
+     * @param requestId - The request ID
+     * @param options - Fulfillment options
+     * @returns The fulfilled request
+     */
+    static async fulfillRequest(requestId, options = {}) {
+        const request = dsarRequestStore.get(requestId);
+        if (!request) {
+            throw new Error(`[DSARWorkflow] Request not found: ${requestId}`);
+        }
+        if (!canTransition(request.status, 'pending_fulfillment')) {
+            throw new Error(`[DSARWorkflow] Cannot fulfill request in status: ${request.status}`);
+        }
+        const now = new Date();
+        const format = options.format ?? 'json';
+        // Update status to in_progress first
+        request.status = 'in_progress';
+        request.updatedAt = now;
+        dsarRequestStore.set(requestId, request);
+        try {
+            if (request.requestType === 'erasure' && options.models && options.models.length > 0) {
+                // Handle erasure requests
+                for (const { model, where } of options.models) {
+                    await right_to_erasure_1.RightToErasure.erase(model, { where: where ?? {} }, options.erasureOptions);
+                }
+                request.honored = true;
+            }
+            else if ((request.requestType === 'access' || request.requestType === 'portability') &&
+                options.models &&
+                options.models.length > 0) {
+                // Handle access/portability requests - generate data export
+                const exports = [];
+                for (const { model, where } of options.models) {
+                    const result = await (0, data_portability_1.exportData)(model, {
+                        where,
+                        format,
+                        include: options.include,
+                        limit: options.limit,
+                        ...options.exportOptions,
+                    });
+                    exports.push({
+                        content: result.content,
+                        format: result.format,
+                        recordCount: result.recordCount,
+                    });
+                }
+                // Combine all exports into single content
+                const combinedContent = exports
+                    .map((exp) => exp.content)
+                    .join('\n---\n');
+                const totalRecords = exports.reduce((sum, exp) => sum + exp.recordCount, 0);
+                request.exportData = {
+                    content: combinedContent,
+                    format,
+                    recordCount: totalRecords,
+                };
+                request.honored = true;
+            }
+            else {
+                // No models provided - mark as fulfilled with empty data
+                request.honored = false;
+            }
+            // Transition to fulfilled status
+            request.status = 'fulfilled';
+            request.fulfilledAt = now;
+            request.updatedAt = now;
+            if (options.notes) {
+                request.notes = options.notes;
+            }
+            dsarRequestStore.set(requestId, request);
+            return request;
+        }
+        catch (error) {
+            request.status = 'rejected';
+            request.rejectionReason = error instanceof Error ? error.message : 'Unknown error';
+            request.updatedAt = new Date();
+            dsarRequestStore.set(requestId, request);
+            throw error;
+        }
+    }
+    /**
+     * Mark a DSAR request as complete.
+     * Valid transitions: fulfilled -> delivered -> completed
+     *
+     * @param requestId - The request ID
+     * @returns The completed request
+     */
+    static completeRequest(requestId) {
+        const request = dsarRequestStore.get(requestId);
+        if (!request) {
+            throw new Error(`[DSARWorkflow] Request not found: ${requestId}`);
+        }
+        if (!canTransition(request.status, 'completed')) {
+            // Try to transition through delivered
+            if (request.status === 'fulfilled') {
+                request.status = 'delivered';
+                request.deliveredAt = new Date();
+            }
+            else if (request.status !== 'delivered') {
+                throw new Error(`[DSARWorkflow] Cannot complete request in status: ${request.status}`);
+            }
+        }
+        const now = new Date();
+        request.status = 'completed';
+        request.completedAt = now;
+        request.updatedAt = now;
+        dsarRequestStore.set(requestId, request);
+        return request;
+    }
+    /**
+     * Get all requests for a specific data subject.
+     *
+     * @param dataSubjectId - The data subject ID
+     * @returns Array of DSAR requests for the data subject
+     */
+    static getRequestsForDataSubject(dataSubjectId) {
+        const requests = [];
+        for (const request of dsarRequestStore.values()) {
+            if (request.dataSubjectId === dataSubjectId) {
+                requests.push(request);
+            }
+        }
+        // Sort by creation date, newest first
+        return requests.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+    }
+    /**
+     * Get all requests of a specific status.
+     *
+     * @param status - The status to filter by
+     * @returns Array of DSAR requests with the specified status
+     */
+    static getRequestsByStatus(status) {
+        const requests = [];
+        for (const request of dsarRequestStore.values()) {
+            if (request.status === status) {
+                requests.push(request);
+            }
+        }
+        return requests.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+    }
+    /**
+     * Get all pending requests that have exceeded their deadline.
+     *
+     * @returns Array of expired DSAR requests
+     */
+    static getExpiredRequests() {
+        const now = new Date();
+        const requests = [];
+        for (const request of dsarRequestStore.values()) {
+            if (request.deadline && request.deadline < now &&
+                !['completed', 'rejected', 'expired'].includes(request.status)) {
+                requests.push(request);
+            }
+        }
+        return requests.sort((a, b) => (a.deadline?.getTime() ?? 0) - (b.deadline?.getTime() ?? 0));
+    }
+    /**
+     * Reject a DSAR request with a reason.
+     *
+     * @param requestId - The request ID
+     * @param reason - The rejection reason
+     * @returns The rejected request
+     */
+    static rejectRequest(requestId, reason) {
+        const request = dsarRequestStore.get(requestId);
+        if (!request) {
+            throw new Error(`[DSARWorkflow] Request not found: ${requestId}`);
+        }
+        if (!canTransition(request.status, 'rejected')) {
+            throw new Error(`[DSARWorkflow] Cannot reject request in status: ${request.status}`);
+        }
+        request.status = 'rejected';
+        request.rejectionReason = reason;
+        request.updatedAt = new Date();
+        request.honored = false;
+        dsarRequestStore.set(requestId, request);
+        return request;
+    }
+    /**
+     * Start processing a request (transition from pending to in_progress).
+     *
+     * @param requestId - The request ID
+     * @returns The request in progress
+     */
+    static startProcessing(requestId) {
+        const request = dsarRequestStore.get(requestId);
+        if (!request) {
+            throw new Error(`[DSARWorkflow] Request not found: ${requestId}`);
+        }
+        if (!canTransition(request.status, 'in_progress')) {
+            throw new Error(`[DSARWorkflow] Cannot start processing request in status: ${request.status}`);
+        }
+        request.status = 'in_progress';
+        request.updatedAt = new Date();
+        dsarRequestStore.set(requestId, request);
+        return request;
+    }
+    /**
+     * Mark a request as delivered to the data subject.
+     *
+     * @param requestId - The request ID
+     * @returns The delivered request
+     */
+    static markDelivered(requestId) {
+        const request = dsarRequestStore.get(requestId);
+        if (!request) {
+            throw new Error(`[DSARWorkflow] Request not found: ${requestId}`);
+        }
+        if (!canTransition(request.status, 'delivered')) {
+            throw new Error(`[DSARWorkflow] Cannot mark request as delivered in status: ${request.status}`);
+        }
+        request.status = 'delivered';
+        request.deliveredAt = new Date();
+        request.updatedAt = new Date();
+        dsarRequestStore.set(requestId, request);
+        return request;
+    }
+}
+exports.DSARWorkflow = DSARWorkflow;