stapel-gdpr 0.3.1__tar.gz

stapel_gdpr-0.3.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 usestapel
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

stapel_gdpr-0.3.1/PKG-INFO

@@ -0,0 +1,55 @@
+Metadata-Version: 2.4
+Name: stapel-gdpr
+Version: 0.3.1
+Summary: GDPR data export and account deletion Django app for the Stapel framework
+License: MIT
+Keywords: django,stapel,gdpr,privacy,data-export,right-to-erasure
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 5.2
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: stapel-core<0.4,>=0.3.0
+Requires-Dist: celery>=5.3
+Provides-Extra: s3
+Requires-Dist: boto3>=1.34; extra == "s3"
+Provides-Extra: all
+Requires-Dist: stapel-gdpr[s3]; extra == "all"
+Dynamic: license-file
+
+# stapel-gdpr
+
+[![CI](https://github.com/usestapel/stapel-gdpr/actions/workflows/ci.yml/badge.svg)](https://github.com/usestapel/stapel-gdpr/actions/workflows/ci.yml)
+
+> GDPR compliance — data export (Art. 15/20), account deletion with grace period (Art. 17), inactivity closure, retention cleanup
+
+Part of the [Stapel framework](https://github.com/usestapel) — composable Django apps for building production-grade platforms.
+
+## Installation
+
+```bash
+pip install stapel-gdpr
+```
+
+## Quick start
+
+```python
+# settings.py
+INSTALLED_APPS = [
+    ...
+    'stapel_gdpr',
+]
+```
+
+## Bus events
+
+### Emits
+| `user.deleted` | [schema](schemas/emits/user.deleted.json) | All user PII permanently deleted after grace period. Every package storing user  |
+| `user.deletion_initiated` | [schema](schemas/emits/user.deletion_initiated.json) | Account closure started. 30-day grace period begins; account is deactivated. |
+| `user.export_ready` | [schema](schemas/emits/user.export_ready.json) | Data export archive is ready for download. |
+
+## License
+
+MIT — see [LICENSE](LICENSE)

stapel_gdpr-0.3.1/README.md

@@ -0,0 +1,34 @@
+# stapel-gdpr
+
+[![CI](https://github.com/usestapel/stapel-gdpr/actions/workflows/ci.yml/badge.svg)](https://github.com/usestapel/stapel-gdpr/actions/workflows/ci.yml)
+
+> GDPR compliance — data export (Art. 15/20), account deletion with grace period (Art. 17), inactivity closure, retention cleanup
+
+Part of the [Stapel framework](https://github.com/usestapel) — composable Django apps for building production-grade platforms.
+
+## Installation
+
+```bash
+pip install stapel-gdpr
+```
+
+## Quick start
+
+```python
+# settings.py
+INSTALLED_APPS = [
+    ...
+    'stapel_gdpr',
+]
+```
+
+## Bus events
+
+### Emits
+| `user.deleted` | [schema](schemas/emits/user.deleted.json) | All user PII permanently deleted after grace period. Every package storing user  |
+| `user.deletion_initiated` | [schema](schemas/emits/user.deletion_initiated.json) | Account closure started. 30-day grace period begins; account is deactivated. |
+| `user.export_ready` | [schema](schemas/emits/user.export_ready.json) | Data export archive is ready for download. |
+
+## License
+
+MIT — see [LICENSE](LICENSE)

stapel_gdpr-0.3.1/__init__.py

@@ -0,0 +1,53 @@
+"""Stapel GDPR — data export (Art. 15/20) and account deletion (Art. 17) for Django.
+
+Public API (all attributes are lazily imported via PEP 562, so importing
+``stapel_gdpr`` itself never touches Django):
+
+- ``gdpr_settings``     — the ``STAPEL_GDPR`` settings namespace (:mod:`stapel_gdpr.conf`).
+- ``gdpr_orchestrator`` — the :class:`~stapel_gdpr.orchestrator.GDPROrchestrator`
+  singleton coordinating export and deletion across providers/services.
+- ``is_reregistration`` — signup-time check: does an email/phone belong to a
+  previously deleted account? (:mod:`stapel_gdpr.reregistration`)
+- ``store_hashes``      — persist salted identifier hashes before erasure
+  (:mod:`stapel_gdpr.reregistration`).
+- ``LegalHold``         — Django model blocking closure/deletion while data must
+  be preserved (GDPR Art. 17(3)). Requires configured Django settings with
+  ``stapel_gdpr`` in ``INSTALLED_APPS``::
+
+      from stapel_gdpr import LegalHold
+      LegalHold.objects.create(user_id=user.pk, reason="litigation", created_by="legal")
+"""
+
+__all__ = [
+    "LegalHold",
+    "gdpr_orchestrator",
+    "gdpr_settings",
+    "is_reregistration",
+    "store_hashes",
+]
+
+# name -> (module, attribute); resolved on first access so that plain
+# `import stapel_gdpr` stays free of Django (and Django-settings) imports.
+_LAZY_EXPORTS = {
+    "gdpr_settings": ("stapel_gdpr.conf", "gdpr_settings"),
+    "gdpr_orchestrator": ("stapel_gdpr.orchestrator", "gdpr_orchestrator"),
+    "is_reregistration": ("stapel_gdpr.reregistration", "is_reregistration"),
+    "store_hashes": ("stapel_gdpr.reregistration", "store_hashes"),
+    "LegalHold": ("stapel_gdpr.models", "LegalHold"),
+}
+
+
+def __getattr__(name):  # PEP 562
+    try:
+        module_path, attr = _LAZY_EXPORTS[name]
+    except KeyError:
+        raise AttributeError(f"module {__name__!r} has no attribute {name!r}") from None
+    from importlib import import_module
+
+    value = getattr(import_module(module_path), attr)
+    globals()[name] = value  # cache so subsequent lookups skip __getattr__
+    return value
+
+
+def __dir__():
+    return sorted(set(globals()) | set(__all__))

stapel_gdpr-0.3.1/actions.py

@@ -0,0 +1,38 @@
+"""Action subscriptions of the GDPR module.
+
+Remote services confirm erasure of their data slice by emitting
+``gdpr.section.erased`` with the correlation_id they received in
+``user.deleted``. Handlers must be idempotent — delivery is at-least-once.
+"""
+import logging
+
+from stapel_core.comm import on_action
+
+logger = logging.getLogger(__name__)
+
+SECTION_ERASED_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "title": "gdpr.section.erased",
+    "type": "object",
+    "required": ["user_id", "correlation_id", "service"],
+    "properties": {
+        "user_id":        {"type": "string"},
+        "correlation_id": {"type": "string"},
+        "service":        {"type": "string"},
+    },
+    "additionalProperties": False,
+}
+
+
+@on_action("gdpr.section.erased", schema=SECTION_ERASED_SCHEMA)
+def handle_section_erased(event):
+    """Mark the remote deletion part done; finalize the closure when complete."""
+    correlation_id = event.payload.get("correlation_id")
+    service = event.payload.get("service") or event.service
+    if not correlation_id or not service:
+        logger.error("Malformed gdpr.section.erased event: %s", getattr(event, "event_id", "?"))
+        return
+
+    from .orchestrator import gdpr_orchestrator
+
+    gdpr_orchestrator.mark_section_erased(correlation_id, service)

stapel_gdpr-0.3.1/admin.py

@@ -0,0 +1,44 @@
+from django.contrib import admin
+
+from .models import (
+    AccountClosureRequest,
+    AccountDeletionPart,
+    DataExportRequest,
+    LegalHold,
+    ReRegistrationHash,
+)
+
+
+@admin.register(LegalHold)
+class LegalHoldAdmin(admin.ModelAdmin):
+    list_display  = ('user_id', 'reason', 'created_by', 'created_at', 'released_at')
+    list_filter   = ('released_at',)
+    search_fields = ('user_id', 'reason', 'created_by')
+    readonly_fields = ('created_at',)
+
+
+class AccountDeletionPartInline(admin.TabularInline):
+    model = AccountDeletionPart
+    extra = 0
+    readonly_fields = ('service', 'status', 'completed_at', 'error')
+
+
+@admin.register(AccountClosureRequest)
+class AccountClosureRequestAdmin(admin.ModelAdmin):
+    list_display = ('user_id', 'trigger', 'status', 'initiated_at', 'grace_ends_at', 'deleted_at')
+    list_filter  = ('status', 'trigger')
+    search_fields = ('user_id', 'correlation_id')
+    inlines = [AccountDeletionPartInline]
+
+
+@admin.register(DataExportRequest)
+class DataExportRequestAdmin(admin.ModelAdmin):
+    list_display = ('user_id', 'status', 'created_at', 'deadline', 'download_expires_at')
+    list_filter  = ('status',)
+    search_fields = ('user_id', 'correlation_id')
+
+
+@admin.register(ReRegistrationHash)
+class ReRegistrationHashAdmin(admin.ModelAdmin):
+    list_display = ('hash_type', 'user_id_was', 'created_at', 'expires_at')
+    list_filter  = ('hash_type',)

stapel_gdpr-0.3.1/apps.py

@@ -0,0 +1,33 @@
+from django.apps import AppConfig
+
+
+class StapelGDPRConfig(AppConfig):
+    default_auto_field = 'django.db.models.BigAutoField'
+    name = 'stapel_gdpr'
+    label = 'gdpr'
+    verbose_name = 'Stapel GDPR'
+
+    def ready(self):
+        from . import actions  # noqa: F401  — register comm subscribers
+        self._register_gdpr_providers()
+
+    def _register_gdpr_providers(self):
+        """Load and register GDPR providers declared in settings.
+
+        Configure in Django settings which services this deployment collects data from:
+
+            GDPR_PROVIDERS = [
+                'stapel_auth.gdpr.AuthGDPRProvider',
+                'stapel_cdn.gdpr.CdnGDPRProvider',
+            ]
+
+        The providers are loaded dynamically — stapel_gdpr has no compile-time
+        dependency on any of the service packages.
+        """
+        from django.conf import settings
+        from django.utils.module_loading import import_string
+        from stapel_core.gdpr import gdpr_registry
+
+        for cls_path in getattr(settings, 'GDPR_PROVIDERS', []):
+            provider_cls = import_string(cls_path)
+            gdpr_registry.register(provider_cls())

stapel_gdpr-0.3.1/conf.py

@@ -0,0 +1,29 @@
+"""STAPEL_GDPR settings namespace.
+
+Configure in Django settings:
+
+    STAPEL_GDPR = {
+        # Remote services (comm consumers) that must confirm erasure with a
+        # gdpr.section.erased action before a closure is marked DELETED.
+        "REMOTE_DELETION_SERVICES": ["profiles", "cdn"],
+        # Salt for re-registration hashes. Defaults to SECRET_KEY.
+        "REREG_SALT": "",
+        # Filesystem roots for export staging / final archives.
+        # Default: MEDIA_ROOT/gdpr/staging and MEDIA_ROOT/gdpr/exports.
+        "STAGING_ROOT": "",
+        "ARCHIVE_ROOT": "",
+    }
+"""
+from stapel_core.conf import AppSettings
+
+gdpr_settings = AppSettings(
+    "STAPEL_GDPR",
+    defaults={
+        "REMOTE_DELETION_SERVICES": [],
+        "REREG_SALT": "",
+        "STAGING_ROOT": "",
+        "ARCHIVE_ROOT": "",
+    },
+)
+
+__all__ = ["gdpr_settings"]

stapel_gdpr-0.3.1/conftest.py

@@ -0,0 +1,132 @@
+import tempfile
+import uuid
+
+
+def pytest_configure(config):
+    from django.conf import settings
+
+    if not settings.configured:
+        settings.configure(
+            SECRET_KEY="test-secret-key-not-for-production",
+            INSTALLED_APPS=[
+                "django.contrib.contenttypes",
+                "django.contrib.auth",
+                "django.contrib.sessions",
+                "django.contrib.messages",
+                "django.contrib.admin",  # so stapel_gdpr.admin is importable/testable
+                "stapel_core.django.users",
+                "rest_framework",
+                "stapel_gdpr",
+            ],
+            AUTH_USER_MODEL="users.User",
+            DATABASES={
+                "default": {
+                    "ENGINE": "django.db.backends.sqlite3",
+                    "NAME": ":memory:",
+                }
+            },
+            DEFAULT_AUTO_FIELD="django.db.models.BigAutoField",
+            USE_TZ=True,
+            APPEND_SLASH=False,
+            ROOT_URLCONF="tests.urls",
+            MEDIA_ROOT=tempfile.mkdtemp(prefix="gdpr-tests-"),
+            CACHES={
+                "default": {
+                    "BACKEND": "django.core.cache.backends.locmem.LocMemCache",
+                }
+            },
+            # In-memory bus — no Kafka/Redis broker needed
+            STAPEL_BUS_BACKEND="stapel_core.bus.backends.memory.MemoryBus",
+            # Synchronous in-process comm — no outbox tables / relay needed
+            STAPEL_COMM={
+                "OUTBOX_ENABLED": False,
+                "ACTION_TRANSPORT": "inprocess",
+            },
+            MIDDLEWARE=[
+                "django.middleware.common.CommonMiddleware",
+                "stapel_core.django.jwt.middleware.ServiceAPIKeyMiddleware",
+            ],
+            SERVICE_API_KEY="test-service-key",
+            FRONTEND_URL="https://app.example.com",
+            # Skip migrations — create tables directly from models
+            MIGRATION_MODULES={
+                "users": None,
+                "gdpr": None,
+            },
+        )
+        import django
+
+        django.setup()
+
+    # Run celery tasks inline (.delay executes synchronously)
+    from celery import Celery
+
+    celery_app = Celery("stapel-gdpr-tests")
+    celery_app.conf.update(
+        task_always_eager=True,
+        task_eager_propagates=True,
+        broker_url="memory://",
+        result_backend="cache+memory://",
+    )
+    celery_app.set_default()
+
+
+import pytest  # noqa: E402
+
+
+@pytest.fixture
+def user(db):
+    from django.contrib.auth import get_user_model
+
+    User = get_user_model()
+    u = User.objects.create_user(
+        username=f"u-{uuid.uuid4().hex[:8]}",
+        email=f"{uuid.uuid4().hex[:8]}@example.com",
+        password="testpass-1234",
+    )
+    return u
+
+
+@pytest.fixture
+def api_client():
+    from rest_framework.test import APIClient
+
+    return APIClient()
+
+
+@pytest.fixture
+def authed_client(api_client, user):
+    api_client.force_authenticate(user=user)
+    return api_client
+
+
+@pytest.fixture
+def fake_provider():
+    """Register an in-process GDPR provider for the duration of a test."""
+    from stapel_core.gdpr import GDPRProvider, gdpr_registry
+
+    class FakeProvider(GDPRProvider):
+        section = "fake"
+
+        def __init__(self):
+            self.exported = []
+            self.deleted = []
+            self.anonymized = []
+            self.fail_delete = False
+
+        def export(self, user_id):
+            self.exported.append(str(user_id))
+            return {"user_id": str(user_id), "items": [1, 2, 3]}
+
+        def delete(self, user_id):
+            if self.fail_delete:
+                raise RuntimeError("boom")
+            self.deleted.append(str(user_id))
+
+        def anonymize(self, user_id):
+            self.anonymized.append(str(user_id))
+
+    provider = FakeProvider()
+    gdpr_registry.register(provider)
+    yield provider
+    gdpr_registry._providers.remove(provider)

stapel_gdpr-0.3.1/dto.py

@@ -0,0 +1,50 @@
+from dataclasses import dataclass
+from typing import Optional
+
+
+@dataclass
+class ExportRequestDTO:
+    """Response after initiating a data export request.
+
+    Attributes:
+        request_id: Unique export request ID. Example: 42
+        status: Current status. Example: pending
+        message: Human-readable status message. Example: Your archive will be ready within 48 hours.
+    """
+    request_id: int
+    status: str
+    message: str
+
+
+@dataclass
+class ExportStatusDTO:
+    """Status of a data export request.
+
+    Attributes:
+        request_id: Export request ID. Example: 42
+        status: One of pending, processing, ready, failed, expired. Example: ready
+        parts_done: Number of sections completed. Example: 4
+        parts_total: Total sections expected. Example: 5
+        download_available: Whether archive is ready to download. Example: true
+        expires_at: ISO datetime when download link expires, null if not ready. Example: 2026-07-01T12:00:00Z
+    """
+    request_id: int
+    status: str
+    parts_done: int
+    parts_total: int
+    download_available: bool
+    expires_at: Optional[str]
+
+
+@dataclass
+class ClosureStatusDTO:
+    """Status of an account closure request.
+
+    Attributes:
+        status: One of grace, deleting, deleted, cancelled. Example: grace
+        grace_ends_at: ISO datetime when grace period ends. Example: 2026-07-24T10:00:00Z
+        can_cancel: Whether the closure can still be cancelled. Example: true
+    """
+    status: str
+    grace_ends_at: str
+    can_cancel: bool

stapel_gdpr-0.3.1/errors.py

@@ -0,0 +1,20 @@
+from stapel_core.django.api.errors import register_service_errors
+
+ERR_409_EXPORT_COOLDOWN     = 'error.409.gdpr.export_cooldown'
+ERR_409_CLOSURE_PENDING     = 'error.409.gdpr.closure_already_pending'
+ERR_409_LEGAL_HOLD          = 'error.409.gdpr.legal_hold'
+ERR_404_NO_ACTIVE_CLOSURE   = 'error.404.gdpr.no_active_closure'
+ERR_404_EXPORT_NOT_FOUND    = 'error.404.gdpr.export_not_found'
+ERR_410_DOWNLOAD_EXPIRED    = 'error.410.gdpr.download_expired'
+ERR_425_EXPORT_NOT_READY    = 'error.425.gdpr.export_not_ready'
+
+_ERRORS = {
+    ERR_409_EXPORT_COOLDOWN:   'A data export was already requested in the last 30 days.',
+    ERR_409_CLOSURE_PENDING:   'Account closure is already in progress.',
+    ERR_409_LEGAL_HOLD:        'Account data is under a legal hold and cannot be deleted.',
+    ERR_404_NO_ACTIVE_CLOSURE: 'No pending account closure found.',
+    ERR_404_EXPORT_NOT_FOUND:  'Export request not found.',
+    ERR_410_DOWNLOAD_EXPIRED:  'Download link has expired.',
+    ERR_425_EXPORT_NOT_READY:  'Export is still being prepared.',
+}
+register_service_errors(_ERRORS)

stapel_gdpr-0.3.1/management/commands/consume_gdpr_completions.py

@@ -0,0 +1,45 @@
+"""
+Bus consumer for GDPR completion events published by individual services.
+
+Run one instance per GDPR service deployment:
+
+    python manage.py consume_gdpr_completions
+"""
+from stapel_core.bus.consumer import BaseBusConsumerCommand
+from stapel_core.bus.event import Event
+from stapel_core.gdpr import GDPR_DELETE_COMPLETED, GDPR_EXPORT_COMPLETED
+
+
+class Command(BaseBusConsumerCommand):
+    help = 'Consume GDPR export/delete completion events from services'
+
+    topics = [GDPR_EXPORT_COMPLETED, GDPR_DELETE_COMPLETED]
+    consumer_group = 'gdpr-orchestrator'
+
+    def handle_event(self, event: Event) -> None:
+        if event.event_type == GDPR_EXPORT_COMPLETED:
+            self._on_export_completed(event)
+        elif event.event_type == GDPR_DELETE_COMPLETED:
+            self._on_delete_completed(event)
+
+    def _on_export_completed(self, event: Event) -> None:
+        from stapel_gdpr.orchestrator import gdpr_orchestrator
+        correlation_id = event.payload.get('correlation_id')
+        service        = event.service
+        bucket_path    = event.payload.get('bucket_path', '')
+
+        if not correlation_id or not service:
+            self.stderr.write(f'Malformed gdpr.export.completed event: {event.event_id}')
+            return
+
+        gdpr_orchestrator.mark_part_ready(correlation_id, service, bucket_path)
+
+    def _on_delete_completed(self, event: Event) -> None:
+        # Deletion is fire-and-forget — just log. Closure status is updated by sweep task
+        # once all services have confirmed (or deadline passes).
+        user_id = event.payload.get('user_id')
+        correlation_id = event.payload.get('correlation_id')
+        self.stdout.write(
+            f'GDPR delete completed: service={event.service} user={user_id} '
+            f'correlation={correlation_id}'
+        )

stapel_gdpr-0.3.1/migrations/0001_initial.py

@@ -0,0 +1,106 @@
+# Generated by Django 6.0.6 on 2026-07-02 10:26
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='AccountClosureRequest',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('user_id', models.UUIDField(db_index=True)),
+                ('trigger', models.CharField(choices=[('manual', 'Manual'), ('inactivity', 'Inactivity'), ('platform', 'Platform')], max_length=20)),
+                ('status', models.CharField(choices=[('grace', 'Grace Period'), ('deleting', 'Deleting'), ('deleted', 'Deleted'), ('cancelled', 'Cancelled')], default='grace', max_length=20)),
+                ('correlation_id', models.CharField(blank=True, db_index=True, max_length=36, null=True, unique=True)),
+                ('local_erasure_done', models.BooleanField(default=False)),
+                ('initiated_at', models.DateTimeField(auto_now_add=True)),
+                ('grace_ends_at', models.DateTimeField()),
+                ('deleted_at', models.DateTimeField(blank=True, null=True)),
+                ('cancelled_at', models.DateTimeField(blank=True, null=True)),
+            ],
+        ),
+        migrations.CreateModel(
+            name='DataExportRequest',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('user_id', models.UUIDField(db_index=True)),
+                ('status', models.CharField(choices=[('pending', 'Pending'), ('processing', 'Processing'), ('assembling', 'Assembling'), ('ready', 'Ready'), ('failed', 'Failed'), ('expired', 'Expired')], default='pending', max_length=20)),
+                ('correlation_id', models.CharField(blank=True, db_index=True, max_length=36, null=True, unique=True)),
+                ('expected_services', models.JSONField(default=list)),
+                ('archive_path', models.CharField(blank=True, max_length=500, null=True)),
+                ('download_token', models.CharField(blank=True, max_length=64, null=True, unique=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('deadline', models.DateTimeField()),
+                ('download_expires_at', models.DateTimeField(blank=True, null=True)),
+                ('error', models.TextField(blank=True, null=True)),
+            ],
+            options={
+                'ordering': ['-created_at'],
+            },
+        ),
+        migrations.CreateModel(
+            name='LegalHold',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('user_id', models.UUIDField(db_index=True)),
+                ('reason', models.TextField()),
+                ('created_by', models.CharField(blank=True, default='', max_length=150)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('released_at', models.DateTimeField(blank=True, null=True)),
+            ],
+            options={
+                'ordering': ['-created_at'],
+            },
+        ),
+        migrations.CreateModel(
+            name='ReRegistrationHash',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('hash_type', models.CharField(choices=[('email', 'Email'), ('phone', 'Phone')], max_length=10)),
+                ('hash_value', models.CharField(db_index=True, max_length=128)),
+                ('user_id_was', models.CharField(max_length=64)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('expires_at', models.DateTimeField()),
+            ],
+            options={
+                'unique_together': {('hash_type', 'hash_value')},
+            },
+        ),
+        migrations.CreateModel(
+            name='AccountDeletionPart',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('service', models.CharField(max_length=50)),
+                ('status', models.CharField(choices=[('pending', 'Pending'), ('done', 'Done'), ('failed', 'Failed')], default='pending', max_length=20)),
+                ('completed_at', models.DateTimeField(blank=True, null=True)),
+                ('error', models.TextField(blank=True, null=True)),
+                ('closure', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='parts', to='gdpr.accountclosurerequest')),
+            ],
+            options={
+                'unique_together': {('closure', 'service')},
+            },
+        ),
+        migrations.CreateModel(
+            name='DataExportPart',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('service', models.CharField(max_length=50)),
+                ('status', models.CharField(choices=[('pending', 'Pending'), ('done', 'Done'), ('failed', 'Failed')], default='pending', max_length=20)),
+                ('bucket_path', models.CharField(blank=True, max_length=500, null=True)),
+                ('completed_at', models.DateTimeField(blank=True, null=True)),
+                ('error', models.TextField(blank=True, null=True)),
+                ('request', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='parts', to='gdpr.dataexportrequest')),
+            ],
+            options={
+                'unique_together': {('request', 'service')},
+            },
+        ),
+    ]