Leon SerfatyandClaude Fable 5
5a555c715e
- Data export (Art. 15/20): GET /api/gdpr/export serves a full JSON export of the user's data (credentials/tokens excluded, exclusions declared) - Right to erasure (Art. 17): self-service deletion with 30-day grace period (Settings -> Privacy & Data), cancellable; daily /api/cron/gdpr drain cancels Stripe billing, purges Spaces files, cascade-deletes the account, anonymizes consent rows, and writes audit evidence - Migration 0011: account_deletion_requests (partial unique index = one pending per user) + FK-less consent_log (survives erasure) - Consent: terms/privacy acceptance logged at signup (email + Google); cookie banner with analytics opt-out (umami.disabled), choices logged server-side for signed-in users via POST /api/gdpr/consent - Admin deleteUser upgraded to the same full purge (was leaving Spaces files and Stripe subscriptions orphaned) - /gdpr legal page now points at the self-service tools - scripts/verify-gdpr.ts: end-to-end verification vs live dev DB (22/22) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
65 lines
2.3 KiB
YAML
65 lines
2.3 KiB
YAML
# ─────────────────────────────────────────────────────────────────────────────
|
|
# DigitalOcean Functions — scheduled cron for Property Management Network.
|
|
#
|
|
# App Platform has no native cron, so the two daily jobs are driven by DO
|
|
# Functions scheduler triggers that call the app's CRON_SECRET-protected
|
|
# endpoints. Deploy separately from the App Platform app:
|
|
#
|
|
# doctl serverless deploy functions --env functions/.env
|
|
#
|
|
# Create functions/.env (gitignored) with:
|
|
# APP_BASE_URL=https://<your-app-url> # no trailing slash
|
|
# CRON_SECRET=<same value as the app's CRON_SECRET>
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
parameters: {}
|
|
packages:
|
|
- name: cron
|
|
functions:
|
|
- name: run
|
|
runtime: 'nodejs:18'
|
|
web: false
|
|
environment:
|
|
APP_BASE_URL: ${APP_BASE_URL}
|
|
CRON_SECRET: ${CRON_SECRET}
|
|
triggers:
|
|
# Rent reminders, overdue marking, 60/30/7-day lease-expiry emails — 09:00 UTC.
|
|
- name: daily
|
|
sourceType: scheduler
|
|
sourceDetails:
|
|
cron: '0 9 * * *'
|
|
withBody:
|
|
job: daily
|
|
function: cron/run
|
|
# Late fees (5% after the grace period) — 08:00 UTC.
|
|
- name: late-fees
|
|
sourceType: scheduler
|
|
sourceDetails:
|
|
cron: '0 8 * * *'
|
|
withBody:
|
|
job: late-fees
|
|
function: cron/run
|
|
# Automated follow-ups for all users with active rules — 10:00 UTC.
|
|
- name: follow-ups
|
|
sourceType: scheduler
|
|
sourceDetails:
|
|
cron: '0 10 * * *'
|
|
withBody:
|
|
job: follow-ups
|
|
function: cron/run
|
|
# Outbound webhook delivery retries — every 5 minutes.
|
|
- name: webhooks
|
|
sourceType: scheduler
|
|
sourceDetails:
|
|
cron: '*/5 * * * *'
|
|
withBody:
|
|
job: webhooks
|
|
function: cron/run
|
|
# GDPR: execute account deletions whose 30-day grace period elapsed — 07:00 UTC.
|
|
- name: gdpr
|
|
sourceType: scheduler
|
|
sourceDetails:
|
|
cron: '0 7 * * *'
|
|
withBody:
|
|
job: gdpr
|
|
function: cron/run
|