Skip to content

feat(gdpr): add data retention and purge jobs - #1815

Open
favvy0217 wants to merge 1 commit into
Smartdevs17:mainfrom
favvy0217:fix/issue-1799-data-retention-purge-jobs
Open

favvy0217 wants to merge 1 commit into
Smartdevs17:mainfrom
favvy0217:fix/issue-1799-data-retention-purge-jobs

Conversation

@favvy0217

Copy link
Copy Markdown
Contributor

Summary

Resolves #1799

Add SQL-backed retention stores, a purge job scheduler, and database tables for persistent policy storage, enforcement audit logging, and legal holds.

Changes

  • Create db/migrations/010_data_retention_purge_jobs.sql: retention_policies, retention_enforcement_log, and retention_legal_holds tables with seed data for default policies. Includes -- @down rollback section.
  • Create backend/gdpr/postgresRetentionStore.ts: implements RetentionDataStore against PostgreSQL with findExpired (excluding legal holds), deleteRecords, anonymizeRecords, and archiveRecords. Factory for default SubTrackr tables.
  • Create backend/gdpr/purgeJobScheduler.ts: coordinates DataRetentionService, PostgresRetentionStores, and RetentionEnforcementJob. Loads persistent policies from DB on startup, logs enforcement results to audit table.
  • Create backend/gdpr/__tests__/postgresRetentionStore.test.ts: 11 test cases
  • Create backend/gdpr/__tests__/purgeJobScheduler.test.ts: 7 test cases
  • Export new types from backend/gdpr/index.ts
  • Create docs/DATA_RETENTION.md: architecture, policies, legal holds, scheduling, REST API, and configuration reference

Acceptance Criteria

  • Policies documented — docs/DATA_RETENTION.md with 4 default policies, actions, and configuration
  • Jobs scheduled — PurgeJobScheduler runs RetentionEnforcementJob every 24h with configurable interval
  • Tested — 18 new test cases covering store operations and scheduler

Default Policies

Policy Source Retention Action
deactivated-account-logs activity_logs 90 days delete
notification-history notifications 180 days delete
billing-records billing_records 7 years anonymize
audit-logs audit_logs 7 years archive

Add SQL-backed retention stores, a purge job scheduler, and database tables
for persistent policy storage, enforcement audit logging, and legal holds.

Changes:
- Create db/migrations/010_data_retention_purge_jobs.sql: retention_policies,
  retention_enforcement_log, and retention_legal_holds tables with seed data
  for default policies. Includes -- @down rollback section.
- Create backend/gdpr/postgresRetentionStore.ts: implements RetentionDataStore
  against PostgreSQL with findExpired (excluding legal holds), deleteRecords,
  anonymizeRecords, and archiveRecords. Factory for default SubTrackr tables.
- Create backend/gdpr/purgeJobScheduler.ts: coordinates DataRetentionService,
  PostgresRetentionStores, and RetentionEnforcementJob. Loads persistent
  policies from DB on startup, logs enforcement results to audit table.
- Create backend/gdpr/__tests__/postgresRetentionStore.test.ts: 11 test cases
  covering findExpired, delete, anonymize, archive, empty arrays, custom
  columns, and factory.
- Create backend/gdpr/__tests__/purgeJobScheduler.test.ts: 7 test cases
  covering construction, start/stop, idempotency, DB failure handling,
  manual enforcement, and report persistence.
- Export new types from backend/gdpr/index.ts
- Create docs/DATA_RETENTION.md: architecture, policies, legal holds,
  scheduling, REST API, and configuration reference

Acceptance criteria:
- [x] Policies documented — docs/DATA_RETENTION.md with 4 default policies,
      actions, and configuration
- [x] Jobs scheduled — PurgeJobScheduler runs RetentionEnforcementJob every
      24h with configurable interval
- [x] Tested — 18 new test cases covering store operations and scheduler
@drips-wave

drips-wave Bot commented Oct 17, 2026

Copy link
Copy Markdown

@favvy0217 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@favvy0217
favvy0217 deployed to security-review October 17, 2026 10:50 — with GitHub Actions Active

This branch was successfully deployed

1 active deployment
security-review — cb065707 Deployed Oct 17, 2026 by favvy0217 via Security Dashboard #1365
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add data retention and purge jobs

2 participants