Leon SerfatyandClaude Fable 5
d9b807662a
CI / build-and-test (push) Has been cancelled
- E2E suite (23 tests, `npm run test:e2e -w @lawdesk/api`): boots the real Fastify app against a disposable Dockerized Postgres (never a real DB) and covers signup/login/lockout/rate limits, CSRF (incl. forged-token rejection), logout, password reset, email verification, the superadmin verified-email promotion gate, and cross-firm tenancy isolation - packages/db: DATABASE_SSL=disable opt-out for local/test databases that don't speak TLS; refused in production - retention-sweep.ts cron enforcing Privacy Policy windows (sessions, tokens, login attempts, tool usage, contact messages, audit log) + sweep-orphaned-storage.ts Spaces reconciliation + scripts/README - Expose emailVerified on the session user; in-app verify-email banner with resend, and verified=1|0 toasts on the login page - Silence Fastify logger under NODE_ENV=test; fix footer resource link; document login-attempt/tool-usage retention in the Privacy Policy Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
80 lines
2.4 KiB
TypeScript
80 lines
2.4 KiB
TypeScript
// Enforces the data-retention windows promised in the Privacy Policy. Run daily:
|
|
// npx tsx scripts/retention-sweep.ts
|
|
//
|
|
// Windows enforced:
|
|
// - sessions: expired → deleted
|
|
// - password resets / email verifications: consumed or expired → deleted
|
|
// - login attempts (email, IP): 90 days
|
|
// - tool usage (IP): 90 days
|
|
// - contact messages: 24 months
|
|
// - audit log: 24 months
|
|
|
|
import path from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import dotenv from 'dotenv';
|
|
|
|
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
dotenv.config({ path: path.resolve(__dirname, '../.env') });
|
|
|
|
import { isNotNull, lt, or } from 'drizzle-orm';
|
|
import {
|
|
getDb,
|
|
getPool,
|
|
sessions,
|
|
passwordResets,
|
|
emailVerifications,
|
|
loginAttempts,
|
|
contactMessages,
|
|
toolUsage,
|
|
auditLog,
|
|
} from '@lawdesk/db';
|
|
|
|
function daysAgo(n: number): Date {
|
|
return new Date(Date.now() - n * 24 * 60 * 60 * 1000);
|
|
}
|
|
|
|
async function main() {
|
|
const db = getDb();
|
|
const now = new Date();
|
|
|
|
const report: Array<[string, number]> = [];
|
|
const run = async (label: string, fn: () => Promise<{ rowCount?: number | null }>) => {
|
|
const res = await fn();
|
|
report.push([label, res.rowCount ?? 0]);
|
|
};
|
|
|
|
await run('expired sessions', () => db.delete(sessions).where(lt(sessions.expiresAt, now)));
|
|
await run('consumed/expired password resets', () =>
|
|
db
|
|
.delete(passwordResets)
|
|
.where(or(isNotNull(passwordResets.consumedAt), lt(passwordResets.expiresAt, now))),
|
|
);
|
|
await run('consumed/expired email verifications', () =>
|
|
db
|
|
.delete(emailVerifications)
|
|
.where(or(isNotNull(emailVerifications.consumedAt), lt(emailVerifications.expiresAt, now))),
|
|
);
|
|
await run('login attempts > 90 days', () =>
|
|
db.delete(loginAttempts).where(lt(loginAttempts.attemptedAt, daysAgo(90))),
|
|
);
|
|
await run('tool usage > 90 days', () =>
|
|
db.delete(toolUsage).where(lt(toolUsage.createdAt, daysAgo(90))),
|
|
);
|
|
await run('contact messages > 24 months', () =>
|
|
db.delete(contactMessages).where(lt(contactMessages.createdAt, daysAgo(730))),
|
|
);
|
|
await run('audit log > 24 months', () =>
|
|
db.delete(auditLog).where(lt(auditLog.createdAt, daysAgo(730))),
|
|
);
|
|
|
|
console.log('Retention sweep complete:');
|
|
for (const [label, count] of report) console.log(` ${label}: ${count} row(s) deleted`);
|
|
|
|
await getPool().end();
|
|
}
|
|
|
|
main().catch((err) => {
|
|
console.error(err);
|
|
process.exit(1);
|
|
});
|