Leon SerfatyandClaude Fable 5
5a555c715e
- Data export (Art. 15/20): GET /api/gdpr/export serves a full JSON export of the user's data (credentials/tokens excluded, exclusions declared) - Right to erasure (Art. 17): self-service deletion with 30-day grace period (Settings -> Privacy & Data), cancellable; daily /api/cron/gdpr drain cancels Stripe billing, purges Spaces files, cascade-deletes the account, anonymizes consent rows, and writes audit evidence - Migration 0011: account_deletion_requests (partial unique index = one pending per user) + FK-less consent_log (survives erasure) - Consent: terms/privacy acceptance logged at signup (email + Google); cookie banner with analytics opt-out (umami.disabled), choices logged server-side for signed-in users via POST /api/gdpr/consent - Admin deleteUser upgraded to the same full purge (was leaving Spaces files and Stripe subscriptions orphaned) - /gdpr legal page now points at the self-service tools - scripts/verify-gdpr.ts: end-to-end verification vs live dev DB (22/22) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
56 lines
1.8 KiB
TypeScript
56 lines
1.8 KiB
TypeScript
import { redirect } from "next/navigation"
|
|
import Link from "next/link"
|
|
import { and, eq } from "drizzle-orm"
|
|
import { db } from "@/lib/db"
|
|
import { account_deletion_requests } from "@/lib/db/schema"
|
|
import { getSessionUser } from "@/lib/session"
|
|
import { LEGAL } from "@/lib/legal"
|
|
import { PrivacyManager } from "@/components/dashboard/privacy-manager"
|
|
|
|
export const metadata = { title: "Privacy & Data" }
|
|
|
|
export default async function PrivacySettingsPage() {
|
|
const user = await getSessionUser()
|
|
if (!user) redirect("/login")
|
|
|
|
const pending = await db.query.account_deletion_requests.findFirst({
|
|
where: and(
|
|
eq(account_deletion_requests.user_id, user.id),
|
|
eq(account_deletion_requests.status, "pending")
|
|
),
|
|
})
|
|
|
|
return (
|
|
<div className="max-w-2xl space-y-6">
|
|
<div>
|
|
<h2 className="text-lg font-semibold text-white">Privacy & Data</h2>
|
|
<p className="text-sm text-white/40">
|
|
Exercise your data rights under the GDPR — export a copy of your data or delete your
|
|
account. Details are in our{" "}
|
|
<Link
|
|
href="/gdpr"
|
|
className="text-indigo-400 underline underline-offset-2 transition hover:text-indigo-300"
|
|
>
|
|
GDPR & Data Rights
|
|
</Link>{" "}
|
|
and{" "}
|
|
<Link
|
|
href="/privacy"
|
|
className="text-indigo-400 underline underline-offset-2 transition hover:text-indigo-300"
|
|
>
|
|
Privacy Policy
|
|
</Link>{" "}
|
|
pages.
|
|
</p>
|
|
</div>
|
|
<PrivacyManager
|
|
accountEmail={user.email}
|
|
graceDays={LEGAL.dataDeletionDays}
|
|
pendingDeletion={
|
|
pending ? { scheduled_for: pending.scheduled_for, created_at: pending.created_at } : null
|
|
}
|
|
/>
|
|
</div>
|
|
)
|
|
}
|