80 lines
2.4 KiB
TypeScript
80 lines
2.4 KiB
TypeScript
|
// Enforces the data-retention windows promised in the Privacy Policy. Run daily:
|
||
|
|
// npx tsx scripts/retention-sweep.ts
|
||
|
|
//
|
||
|
|
// Windows enforced:
|
||
|
|
// - sessions: expired → deleted
|
||
|
|
// - password resets / email verifications: consumed or expired → deleted
|
||
|
|
// - login attempts (email, IP): 90 days
|
||
|
|
// - tool usage (IP): 90 days
|
||
|
|
// - contact messages: 24 months
|
||
|
|
// - audit log: 24 months
|
||
|
|
|
||
|
|
import path from 'node:path';
|
||
|
|
import { fileURLToPath } from 'node:url';
|
||
|
|
import dotenv from 'dotenv';
|
||
|
|
|
||
|
|
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
||
|
|
dotenv.config({ path: path.resolve(__dirname, '../.env') });
|
||
|
|
|
||
|
|
import { isNotNull, lt, or } from 'drizzle-orm';
|
||
|
|
import {
|
||
|
|
getDb,
|
||
|
|
getPool,
|
||
|
|
sessions,
|
||
|
|
passwordResets,
|
||
|
|
emailVerifications,
|
||
|
|
loginAttempts,
|
||
|
|
contactMessages,
|
||
|
|
toolUsage,
|
||
|
|
auditLog,
|
||
|
|
} from '@lawdesk/db';
|
||
|
|
|
||
|
|
function daysAgo(n: number): Date {
|
||
|
|
return new Date(Date.now() - n * 24 * 60 * 60 * 1000);
|
||
|
|
}
|
||
|
|
|
||
|
|
async function main() {
|
||
|
|
const db = getDb();
|
||
|
|
const now = new Date();
|
||
|
|
|
||
|
|
const report: Array<[string, number]> = [];
|
||
|
|
const run = async (label: string, fn: () => Promise<{ rowCount?: number | null }>) => {
|
||
|
|
const res = await fn();
|
||
|
|
report.push([label, res.rowCount ?? 0]);
|
||
|
|
};
|
||
|
|
|
||
|
|
await run('expired sessions', () => db.delete(sessions).where(lt(sessions.expiresAt, now)));
|
||
|
|
await run('consumed/expired password resets', () =>
|
||
|
|
db
|
||
|
|
.delete(passwordResets)
|
||
|
|
.where(or(isNotNull(passwordResets.consumedAt), lt(passwordResets.expiresAt, now))),
|
||
|
|
);
|
||
|
|
await run('consumed/expired email verifications', () =>
|
||
|
|
db
|
||
|
|
.delete(emailVerifications)
|
||
|
|
.where(or(isNotNull(emailVerifications.consumedAt), lt(emailVerifications.expiresAt, now))),
|
||
|
|
);
|
||
|
|
await run('login attempts > 90 days', () =>
|
||
|
|
db.delete(loginAttempts).where(lt(loginAttempts.attemptedAt, daysAgo(90))),
|
||
|
|
);
|
||
|
|
await run('tool usage > 90 days', () =>
|
||
|
|
db.delete(toolUsage).where(lt(toolUsage.createdAt, daysAgo(90))),
|
||
|
|
);
|
||
|
|
await run('contact messages > 24 months', () =>
|
||
|
|
db.delete(contactMessages).where(lt(contactMessages.createdAt, daysAgo(730))),
|
||
|
|
);
|
||
|
|
await run('audit log > 24 months', () =>
|
||
|
|
db.delete(auditLog).where(lt(auditLog.createdAt, daysAgo(730))),
|
||
|
|
);
|
||
|
|
|
||
|
|
console.log('Retention sweep complete:');
|
||
|
|
for (const [label, count] of report) console.log(` ${label}: ${count} row(s) deleted`);
|
||
|
|
|
||
|
|
await getPool().end();
|
||
|
|
}
|
||
|
|
|
||
|
|
main().catch((err) => {
|
||
|
|
console.error(err);
|
||
|
|
process.exit(1);
|
||
|
|
});
|