From 63062173538573bc994dc13e4c2408f94c17f439 Mon Sep 17 00:00:00 2001 From: Mustafa Cetin Date: Wed, 29 Jul 2026 14:27:56 +0000 Subject: [PATCH] Round 19: DSGVO/GDPR compliance, cookie consent, data export, account deletion, Jugendschutz - Add Cookie Consent component (TTDSG-compliant, essential + analytics cookies) - Add GDPR Data Export API (DSGVO Art. 20 - data portability) - Add Account Deletion API (DSGVO Art. 17 - right to erasure, 30-day grace period) - Add Datenschutz (Privacy) tab in Settings with: - Privacy policy (data collected, purpose, retention, third-party sharing) - User rights (6 DSGVO rights with descriptions) - Data export button (download all personal data as JSON) - Account deletion with confirmation dialog and grace period - Jugendschutz (youth protection) notices - DPA/AVV section for admin (Auftragsverarbeitungsvertrag) - Add Jugendschutz notice in student login (parental consent for under 16) - Add 65+ i18n keys for DE and EN (DSGVO, privacy, Jugendschutz, DPA) - All German law terms accurate (DSGVO, Jugendschutzgesetz, TTDSG, AVV) --- src/app/api/account-deletion/route.ts | 208 +++++++++++ src/app/api/gdpr-export/route.ts | 295 ++++++++++++++++ src/app/page.tsx | 15 +- src/components/auth-view.tsx | 7 + src/components/cookie-consent.tsx | 217 ++++++++++++ src/components/settings-view.tsx | 488 ++++++++++++++++++++++++++ src/lib/i18n.ts | 144 ++++++++ worklog.md | 58 +++ 8 files changed, 1430 insertions(+), 2 deletions(-) create mode 100644 src/app/api/account-deletion/route.ts create mode 100644 src/app/api/gdpr-export/route.ts create mode 100644 src/components/cookie-consent.tsx diff --git a/src/app/api/account-deletion/route.ts b/src/app/api/account-deletion/route.ts new file mode 100644 index 0000000..80dc6bc --- /dev/null +++ b/src/app/api/account-deletion/route.ts @@ -0,0 +1,208 @@ +import { NextResponse } from 'next/server'; +import { z } from 'zod'; +import { db } from '@/lib/db'; +import { getSession, verifyPassword } from '@/lib/auth'; + +const requestDeletionSchema = z.object({ + password: z.string().min(1), +}); + +const GRACE_PERIOD_DAYS = 30; + +export async function POST(request: Request) { + try { + const session = await getSession(); + if (!session) { + return NextResponse.json({ error: 'Not authenticated' }, { status: 401 }); + } + + const body = await request.json(); + const parsed = requestDeletionSchema.safeParse(body); + if (!parsed.success) { + return NextResponse.json( + { error: 'Validation failed', details: parsed.error.issues }, + { status: 400 } + ); + } + + const userId = session.userId; + + // Fetch the user with password hash + const user = await db.user.findUnique({ + where: { id: userId }, + select: { id: true, passwordHash: true, deletedAt: true, role: true, email: true }, + }); + + if (!user) { + return NextResponse.json({ error: 'User not found' }, { status: 404 }); + } + + // Check if already scheduled for deletion + if (user.deletedAt) { + const deletionDate = new Date(user.deletedAt); + deletionDate.setDate(deletionDate.getDate() + GRACE_PERIOD_DAYS); + return NextResponse.json({ + error: 'Account already scheduled for deletion', + scheduledDeletionDate: deletionDate.toISOString(), + }, { status: 409 }); + } + + // Verify password + const passwordValid = await verifyPassword(parsed.data.password, user.passwordHash); + if (!passwordValid) { + return NextResponse.json({ error: 'Wrong password' }, { status: 403 }); + } + + // Soft delete: set deletedAt to now + const now = new Date(); + const scheduledDeletionDate = new Date(now); + scheduledDeletionDate.setDate(scheduledDeletionDate.getDate() + GRACE_PERIOD_DAYS); + + await db.user.update({ + where: { id: userId }, + data: { deletedAt: now }, + }); + + // Create audit log entry + await db.auditLog.create({ + data: { + userId, + schoolId: session.user?.schoolId ?? null, + action: 'ACCOUNT_DELETION_REQUESTED', + entity: 'User', + entityId: userId, + details: JSON.stringify({ + scheduledDeletionDate: scheduledDeletionDate.toISOString(), + gracePeriodDays: GRACE_PERIOD_DAYS, + }), + }, + }); + + return NextResponse.json({ + success: true, + scheduledDeletionDate: scheduledDeletionDate.toISOString(), + gracePeriodDays: GRACE_PERIOD_DAYS, + message: `Account scheduled for deletion in ${GRACE_PERIOD_DAYS} days.`, + }); + } catch (error) { + console.error('Account deletion error:', error); + return NextResponse.json( + { error: 'Internal server error' }, + { status: 500 } + ); + } +} + +// Cancel deletion (within grace period) +export async function PUT() { + try { + const session = await getSession(); + if (!session) { + return NextResponse.json({ error: 'Not authenticated' }, { status: 401 }); + } + + const userId = session.userId; + + const user = await db.user.findUnique({ + where: { id: userId }, + select: { id: true, deletedAt: true }, + }); + + if (!user) { + return NextResponse.json({ error: 'User not found' }, { status: 404 }); + } + + if (!user.deletedAt) { + return NextResponse.json({ + error: 'Account is not scheduled for deletion', + }, { status: 400 }); + } + + // Check if within grace period + const deletionRequestedAt = new Date(user.deletedAt); + const gracePeriodEnd = new Date(deletionRequestedAt); + gracePeriodEnd.setDate(gracePeriodEnd.getDate() + GRACE_PERIOD_DAYS); + + if (new Date() > gracePeriodEnd) { + return NextResponse.json({ + error: 'Grace period has expired. Account cannot be recovered.', + }, { status: 410 }); + } + + // Cancel deletion: clear deletedAt + await db.user.update({ + where: { id: userId }, + data: { deletedAt: null }, + }); + + // Create audit log entry + await db.auditLog.create({ + data: { + userId, + schoolId: session.user?.schoolId ?? null, + action: 'ACCOUNT_DELETION_CANCELLED', + entity: 'User', + entityId: userId, + details: JSON.stringify({ + cancelledAt: new Date().toISOString(), + }), + }, + }); + + return NextResponse.json({ + success: true, + message: 'Account deletion has been cancelled.', + }); + } catch (error) { + console.error('Account deletion cancellation error:', error); + return NextResponse.json( + { error: 'Internal server error' }, + { status: 500 } + ); + } +} + +// Check deletion status +export async function GET() { + try { + const session = await getSession(); + if (!session) { + return NextResponse.json({ error: 'Not authenticated' }, { status: 401 }); + } + + const userId = session.userId; + + const user = await db.user.findUnique({ + where: { id: userId }, + select: { id: true, deletedAt: true }, + }); + + if (!user) { + return NextResponse.json({ error: 'User not found' }, { status: 404 }); + } + + if (!user.deletedAt) { + return NextResponse.json({ + scheduledForDeletion: false, + }); + } + + const deletionRequestedAt = new Date(user.deletedAt); + const scheduledDeletionDate = new Date(deletionRequestedAt); + scheduledDeletionDate.setDate(scheduledDeletionDate.getDate() + GRACE_PERIOD_DAYS); + + return NextResponse.json({ + scheduledForDeletion: true, + deletionRequestedAt: deletionRequestedAt.toISOString(), + scheduledDeletionDate: scheduledDeletionDate.toISOString(), + gracePeriodDays: GRACE_PERIOD_DAYS, + canCancel: new Date() < scheduledDeletionDate, + }); + } catch (error) { + console.error('Account deletion status error:', error); + return NextResponse.json( + { error: 'Internal server error' }, + { status: 500 } + ); + } +} diff --git a/src/app/api/gdpr-export/route.ts b/src/app/api/gdpr-export/route.ts new file mode 100644 index 0000000..8b845b1 --- /dev/null +++ b/src/app/api/gdpr-export/route.ts @@ -0,0 +1,295 @@ +import { NextResponse } from 'next/server'; +import { db } from '@/lib/db'; +import { getSession } from '@/lib/auth'; + +export async function GET() { + try { + const session = await getSession(); + if (!session) { + return NextResponse.json({ error: 'Not authenticated' }, { status: 401 }); + } + + const userId = session.userId; + + // Fetch user profile + const user = await db.user.findUnique({ + where: { id: userId }, + select: { + id: true, + email: true, + firstName: true, + lastName: true, + role: true, + locale: true, + createdAt: true, + updatedAt: true, + schoolId: true, + }, + }); + + if (!user) { + return NextResponse.json({ error: 'User not found' }, { status: 404 }); + } + + // Fetch school info + const school = user.schoolId + ? await db.school.findUnique({ + where: { id: user.schoolId }, + select: { id: true, name: true, schoolType: true, address: true }, + }) + : null; + + // Fetch class groups the user is associated with + const classGroupTeachers = await db.classGroupTeacher.findMany({ + where: { userId }, + include: { + classGroup: { + select: { id: true, name: true, gradeLevel: true, schoolType: true }, + }, + }, + }); + + // Fetch learning progress entries created by the user + const learningProgressEntries = await db.learningProgressEntry.findMany({ + where: { teacherId: userId }, + select: { + id: true, + competencyId: true, + level: true, + comment: true, + createdAt: true, + updatedAt: true, + }, + take: 500, + orderBy: { createdAt: 'desc' }, + }); + + // Fetch assessments created by the user + const assessments = await db.assessment.findMany({ + where: { teacherId: userId }, + select: { + id: true, + title: true, + type: true, + date: true, + createdAt: true, + }, + take: 200, + orderBy: { createdAt: 'desc' }, + }); + + // Fetch generated reports + const reports = await db.report.findMany({ + where: { generatedByUserId: userId }, + select: { + id: true, + type: true, + status: true, + createdAt: true, + }, + take: 200, + orderBy: { createdAt: 'desc' }, + }); + + // Fetch audit log entries + const auditLogs = await db.auditLog.findMany({ + where: { userId }, + select: { + id: true, + action: true, + entity: true, + entityId: true, + createdAt: true, + }, + take: 200, + orderBy: { createdAt: 'desc' }, + }); + + // Fetch data export requests + const dataExportRequests = await db.dataExportRequest.findMany({ + where: { requestedByUserId: userId }, + select: { + id: true, + scope: true, + status: true, + requestedAt: true, + completedAt: true, + }, + take: 100, + orderBy: { requestedAt: 'desc' }, + }); + + // Fetch teacher notes + const teacherNotes = await db.teacherNote.findMany({ + where: { userId }, + select: { + id: true, + content: true, + category: true, + createdAt: true, + updatedAt: true, + }, + take: 200, + orderBy: { createdAt: 'desc' }, + }); + + // Fetch attendance sessions + const attendanceSessions = await db.attendanceSession.findMany({ + where: { teacherId: userId }, + select: { + id: true, + date: true, + status: true, + createdAt: true, + }, + take: 200, + orderBy: { createdAt: 'desc' }, + }); + + // Fetch notifications + const notifications = await db.notification.findMany({ + where: { userId }, + select: { + id: true, + type: true, + title: true, + message: true, + read: true, + createdAt: true, + }, + take: 200, + orderBy: { createdAt: 'desc' }, + }); + + // Fetch notebooks + const notebooks = await db.notebook.findMany({ + where: { ownerId: userId }, + select: { + id: true, + title: true, + createdAt: true, + updatedAt: true, + }, + take: 100, + orderBy: { createdAt: 'desc' }, + }); + + // Fetch homework + const homeworks = await db.homework.findMany({ + where: { createdById: userId }, + select: { + id: true, + title: true, + dueDate: true, + createdAt: true, + }, + take: 100, + orderBy: { createdAt: 'desc' }, + }); + + // For students: fetch their own data + let studentData = null; + if (user.role === 'STUDENT') { + const student = await db.student.findFirst({ + where: { email: user.email, deletedAt: null }, + select: { + id: true, + firstName: true, + lastName: true, + dateOfBirth: true, + gender: true, + enrollments: { + select: { + id: true, + classGroup: { select: { name: true, gradeLevel: true } }, + startDate: true, + endDate: true, + }, + }, + learningProgressEntries: { + select: { + id: true, + level: true, + comment: true, + createdAt: true, + }, + take: 200, + orderBy: { createdAt: 'desc' }, + }, + assessmentResults: { + select: { + id: true, + score: true, + comment: true, + createdAt: true, + }, + take: 200, + orderBy: { createdAt: 'desc' }, + }, + }, + }); + studentData = student; + } + + // For parents: fetch linked students + let parentLinks = null; + if (user.role === 'PARENT') { + parentLinks = await db.parentStudentLink.findMany({ + where: { userId }, + select: { + id: true, + relationship: true, + student: { + select: { id: true, firstName: true, lastName: true }, + }, + }, + }); + } + + // Construct the export data + const exportData: Record = { + exportMetadata: { + exportDate: new Date().toISOString(), + platform: 'CompetenceTrack', + legalBasis: 'DSGVO Art. 20 - Recht auf Datenübertragbarkeit', + userId: user.id, + }, + userProfile: user, + school, + classAssociations: classGroupTeachers.map((cgt) => ({ + role: cgt.role, + classGroup: cgt.classGroup, + })), + learningProgress: learningProgressEntries, + assessments, + reports, + auditLogs, + dataExportRequests, + teacherNotes, + attendanceSessions, + notifications, + notebooks, + homeworks, + }; + + if (studentData) { + exportData.studentData = studentData; + } + + if (parentLinks) { + exportData.parentLinks = parentLinks; + } + + return NextResponse.json(exportData, { + headers: { + 'Content-Disposition': `attachment; filename="competencetrack-data-export-${new Date().toISOString().split('T')[0]}.json"`, + }, + }); + } catch (error) { + console.error('GDPR data export error:', error); + return NextResponse.json( + { error: 'Internal server error' }, + { status: 500 } + ); + } +} diff --git a/src/app/page.tsx b/src/app/page.tsx index a080b2e..f2783d3 100644 --- a/src/app/page.tsx +++ b/src/app/page.tsx @@ -5,6 +5,7 @@ import { useAppStore } from '@/lib/store'; import { fetchCurrentUser } from '@/lib/api'; import AuthView from '@/components/auth-view'; import AppLayout from '@/components/app-layout'; +import CookieConsent from '@/components/cookie-consent'; export default function Home() { const currentUser = useAppStore((s) => s.currentUser); @@ -48,8 +49,18 @@ export default function Home() { } if (!currentUser) { - return ; + return ( + <> + + + + ); } - return ; + return ( + <> + + + + ); } diff --git a/src/components/auth-view.tsx b/src/components/auth-view.tsx index c23a3ae..c64b063 100644 --- a/src/components/auth-view.tsx +++ b/src/components/auth-view.tsx @@ -464,6 +464,13 @@ export default function AuthView() { {t('auth.create_student_account')} — {t('auth.student_login_desc')}

+ {/* Jugendschutz notice for students */} +
+ +

+ {t('dsgvo.jugendschutz_login_notice')} +

+
)} diff --git a/src/components/cookie-consent.tsx b/src/components/cookie-consent.tsx new file mode 100644 index 0000000..586ffdf --- /dev/null +++ b/src/components/cookie-consent.tsx @@ -0,0 +1,217 @@ +'use client'; + +import React, { useState, useEffect } from 'react'; +import { motion, AnimatePresence } from 'framer-motion'; +import { Cookie, Shield, BarChart3, ChevronDown, ChevronUp } from 'lucide-react'; +import { Button } from '@/components/ui/button'; +import { Checkbox } from '@/components/ui/checkbox'; +import { Label } from '@/components/ui/label'; +import { t } from '@/lib/i18n'; + +const CONSENT_KEY = 'ct_cookie_consent'; + +interface CookieConsentData { + essential: boolean; + analytics: boolean; + acceptedAt: string; +} + +function getStoredConsent(): CookieConsentData | null { + try { + const stored = localStorage.getItem(CONSENT_KEY); + if (stored) return JSON.parse(stored); + } catch { + // ignore + } + return null; +} + +function storeConsent(data: CookieConsentData): void { + try { + localStorage.setItem(CONSENT_KEY, JSON.stringify(data)); + } catch { + // ignore + } +} + +export function hasAnalyticsConsent(): boolean { + const consent = getStoredConsent(); + return consent?.analytics === true; +} + +export function hasCookieConsent(): boolean { + return getStoredConsent() !== null; +} + +export default function CookieConsent() { + const [visible, setVisible] = useState(false); + const [showDetails, setShowDetails] = useState(false); + const [analyticsEnabled, setAnalyticsEnabled] = useState(false); + + useEffect(() => { + // Check if consent already given + const consent = getStoredConsent(); + if (!consent) { + setVisible(true); + } else { + setAnalyticsEnabled(consent.analytics); + } + }, []); + + const handleAcceptAll = () => { + storeConsent({ + essential: true, + analytics: true, + acceptedAt: new Date().toISOString(), + }); + setAnalyticsEnabled(true); + setVisible(false); + }; + + const handleRejectOptional = () => { + storeConsent({ + essential: true, + analytics: false, + acceptedAt: new Date().toISOString(), + }); + setAnalyticsEnabled(false); + setVisible(false); + }; + + const handleSavePreferences = () => { + storeConsent({ + essential: true, + analytics: analyticsEnabled, + acceptedAt: new Date().toISOString(), + }); + setVisible(false); + }; + + return ( + + {visible && ( + +
+
+ {/* Header */} +
+
+ +
+
+

+ {t('dsgvo.cookie_settings')} +

+

+ {t('dsgvo.cookie_consent')} +

+
+
+ + {/* Cookie categories */} + + {showDetails && ( + +
+ {/* Essential cookies */} +
+
+ +
+
+
+ + +
+

+ {t('dsgvo.cookie_essential_desc')} +

+
+
+ + {/* Analytics cookies */} +
+
+ +
+
+
+ + setAnalyticsEnabled(v === true)} + className="border-amber-300 dark:border-amber-700 data-[state=checked]:bg-amber-500 data-[state=checked]:border-amber-500" + /> +
+

+ {t('dsgvo.cookie_analytics_desc')} +

+
+
+
+ + )} + + + {/* Toggle details */} + + + {/* Action buttons */} +
+ + + {showDetails && ( + + )} +
+
+
+ + )} + + ); +} diff --git a/src/components/settings-view.tsx b/src/components/settings-view.tsx index 2ff6d1f..d76254e 100644 --- a/src/components/settings-view.tsx +++ b/src/components/settings-view.tsx @@ -695,6 +695,485 @@ function BadgeManagementTab() { ); } +// ─── Privacy / DSGVO Tab Component ───────────────────────────────────── +function PrivacyTab({ currentUser }: { currentUser: { id: string; role: string; email: string; firstName: string; lastName: string } | null }) { + const [exporting, setExporting] = useState(false); + const [deleteDialogOpen, setDeleteDialogOpen] = useState(false); + const [deletePassword, setDeletePassword] = useState(''); + const [deleting, setDeleting] = useState(false); + const [deletionStatus, setDeletionStatus] = useState<{ scheduledForDeletion: boolean; scheduledDeletionDate?: string; canCancel?: boolean } | null>(null); + const [cancelling, setCancelling] = useState(false); + + const loadDeletionStatus = useCallback(async () => { + try { + const res = await fetch('/api/account-deletion'); + if (res.ok) { + const data = await res.json(); + setDeletionStatus(data); + } + } catch { + // ignore + } + }, []); + + useEffect(() => { + loadDeletionStatus(); + }, [loadDeletionStatus]); + + const handleExportData = async () => { + setExporting(true); + try { + const res = await fetch('/api/gdpr-export'); + if (!res.ok) throw new Error('Export failed'); + const data = await res.json(); + const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' }); + const url = URL.createObjectURL(blob); + const a = document.createElement('a'); + a.href = url; + a.download = `competencetrack-data-export-${new Date().toISOString().split('T')[0]}.json`; + document.body.appendChild(a); + a.click(); + document.body.removeChild(a); + URL.revokeObjectURL(url); + toast.success(t('dsgvo.export_data_success')); + } catch { + toast.error(t('dsgvo.export_data_error')); + } finally { + setExporting(false); + } + }; + + const handleDeleteAccount = async () => { + if (!deletePassword) return; + setDeleting(true); + try { + const res = await fetch('/api/account-deletion', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ password: deletePassword }), + }); + const data = await res.json(); + if (!res.ok) { + if (data.error === 'Wrong password') { + toast.error(t('dsgvo.delete_wrong_password')); + } else { + toast.error(data.error || t('dsgvo.delete_error')); + } + return; + } + toast.success(t('dsgvo.delete_success')); + setDeleteDialogOpen(false); + setDeletePassword(''); + loadDeletionStatus(); + } catch { + toast.error(t('dsgvo.delete_error')); + } finally { + setDeleting(false); + } + }; + + const handleCancelDeletion = async () => { + setCancelling(true); + try { + const res = await fetch('/api/account-deletion', { + method: 'PUT', + headers: { 'Content-Type': 'application/json' }, + }); + if (!res.ok) { + const data = await res.json(); + toast.error(data.error || t('dsgvo.delete_error')); + return; + } + toast.success(t('dsgvo.delete_cancel_success')); + loadDeletionStatus(); + } catch { + toast.error(t('dsgvo.delete_error')); + } finally { + setCancelling(false); + } + }; + + const isAdmin = currentUser?.role === 'SCHOOL_ADMIN' || currentUser?.role === 'SUPER_ADMIN'; + + const userRights = [ + { key: 'right_access', icon: Eye, color: 'emerald' }, + { key: 'right_rectification', icon: Pencil, color: 'teal' }, + { key: 'right_erasure', icon: Trash2, color: 'rose' }, + { key: 'right_portability', icon: Download, color: 'amber' }, + { key: 'right_restriction', icon: Shield, color: 'violet' }, + { key: 'right_objection', icon: AlertTriangle, color: 'orange' }, + ]; + + return ( +
+ {/* ── Privacy Policy Card ─────────────────────────────── */} + + + +
+ +
+ {t('dsgvo.privacy_policy')} + + {t('dsgvo.data_processing')} + + +

+ {t('dsgvo.privacy_policy_text')} +

+ + {/* Data collected */} +
+
+ +

{t('dsgvo.data_collected')}

+
+

{t('dsgvo.data_collected_list')}

+
+ + {/* Purpose */} +
+
+ +

{t('dsgvo.data_purpose')}

+
+

{t('dsgvo.data_purpose_list')}

+
+ + {/* Retention */} +
+
+ +

{t('dsgvo.data_retention')}

+
+

{t('dsgvo.data_retention_list')}

+
+ + {/* Third party */} +
+
+ +

{t('dsgvo.data_third_party')}

+
+

{t('dsgvo.data_third_party_list')}

+
+ + {/* DPO Contact */} +
+
+ +

{t('dsgvo.contact_dpo')}

+
+

datenschutz@competencetrack.org

+
+ + + + {/* ── User Rights Card ─────────────────────────────── */} + + + +
+ +
+ {t('dsgvo.rights_title')} + + {t('dsgvo.rights_desc')} + + +
+ {userRights.map((right) => { + const Icon = right.icon; + const colorMap: Record = { + emerald: { bg: 'bg-emerald-100 dark:bg-emerald-900/30', text: 'text-emerald-600 dark:text-emerald-400', border: 'border-emerald-200/30 dark:border-emerald-900/20' }, + teal: { bg: 'bg-teal-100 dark:bg-teal-900/30', text: 'text-teal-600 dark:text-teal-400', border: 'border-teal-200/30 dark:border-teal-900/20' }, + rose: { bg: 'bg-rose-100 dark:bg-rose-900/30', text: 'text-rose-600 dark:text-rose-400', border: 'border-rose-200/30 dark:border-rose-900/20' }, + amber: { bg: 'bg-amber-100 dark:bg-amber-900/30', text: 'text-amber-600 dark:text-amber-400', border: 'border-amber-200/30 dark:border-amber-900/20' }, + violet: { bg: 'bg-violet-100 dark:bg-violet-900/30', text: 'text-violet-600 dark:text-violet-400', border: 'border-violet-200/30 dark:border-violet-900/20' }, + orange: { bg: 'bg-orange-100 dark:bg-orange-900/30', text: 'text-orange-600 dark:text-orange-400', border: 'border-orange-200/30 dark:border-orange-900/20' }, + }; + const c = colorMap[right.color] || colorMap.emerald; + return ( +
+
+ +
{t(`dsgvo.${right.key}`)}
+
+

{t(`dsgvo.${right.key}_desc`)}

+
+ ); + })} +
+ + + + {/* ── Data Export Card ─────────────────────────────── */} + + + +
+ +
+ {t('dsgvo.data_portability')} + + DSGVO Art. 20 + + +

{t('dsgvo.export_data_desc')}

+ + + + + {/* ── Account Deletion Card ─────────────────────────────── */} + + + +
+ +
+ {t('dsgvo.delete_account')} + + DSGVO Art. 17 + + +

{t('dsgvo.delete_account_desc')}

+ + {/* Deletion status */} + {deletionStatus?.scheduledForDeletion && ( +
+
+ + + {t('dsgvo.delete_scheduled')} {new Date(deletionStatus.scheduledDeletionDate!).toLocaleDateString()} + +
+ {deletionStatus.canCancel && ( + + )} +
+ )} + + {/* Warning */} +
+ +

{t('dsgvo.delete_warning')}

+
+ + {!deletionStatus?.scheduledForDeletion && ( + + )} + + + + {/* ── Jugendschutz Card ─────────────────────────────── */} + + + +
+ +
+ {t('dsgvo.jugendschutz')} + + Jugendschutzgesetz + + +
+

{t('dsgvo.jugendschutz_notice')}

+
+
+
+
+ +
+
+

{t('dsgvo.parental_consent')}

+

{t('dsgvo.jugendschutz_notice')}

+
+
+
+
+ +
+
+

{t('dsgvo.no_advertising')}

+
+
+
+
+ +
+
+

{t('dsgvo.no_tracking')}

+
+
+
+
+ +
+
+

{t('dsgvo.jugendschutz_rewards')}

+
+
+
+ + + + {/* ── DPA / AVV Card (Admin only) ─────────────────────── */} + {isAdmin && ( + + + +
+ +
+ {t('dsgvo.dpa')} + + Art. 28 DSGVO + + +

{t('dsgvo.dpa_template_text')}

+ + {/* DPA Status */} +
+
+ {t('dsgvo.dpa')} + + {t('dsgvo.dpa_status_pending')} + +
+ +
+ + {/* Data Processing Register */} +
+
+ +

{t('dsgvo.data_register')}

+
+

{t('dsgvo.data_register_desc')}

+ +
+ + + )} + + {/* ── Delete Account Confirmation Dialog ─────────────────────── */} + { if (!open) { setDeleteDialogOpen(false); setDeletePassword(''); } }}> + + + + + {t('dsgvo.delete_confirm_title')} + + {t('dsgvo.delete_confirm_desc')} + +
+
+ +

{t('dsgvo.delete_warning')}

+
+
+ + setDeletePassword(e.target.value)} + className="rounded-xl border-rose-200 dark:border-rose-900/30" + placeholder="••••••" + /> +
+
+ + {t('action.cancel')} + + {deleting ? : } + {t('dsgvo.delete_account')} + + + + +
+ ); +} + export default function SettingsView() { const currentUser = useAppStore((s) => s.currentUser); const [activeTab, setActiveTab] = useState('school'); @@ -1859,6 +2338,10 @@ export default function SettingsView() { {t('badges.manage')} + + + {t('dsgvo.tab_privacy')} + {/* ── School Info Tab ─────────────────────────────────── */} @@ -4568,6 +5051,11 @@ export default function SettingsView() { + + {/* ── Datenschutz / Privacy Tab ─────────────────────────────── */} + + + ); } diff --git a/src/lib/i18n.ts b/src/lib/i18n.ts index d705622..53e9ceb 100644 --- a/src/lib/i18n.ts +++ b/src/lib/i18n.ts @@ -3416,6 +3416,78 @@ const de: TranslationDict = { 'grading.ausreichend': 'Ausreichend', 'grading.mangelhaft': 'Mangelhaft', 'grading.ungenuegend': 'Ungenügend', + + // DSGVO / Datenschutz + 'dsgvo.title': 'Datenschutz', + 'dsgvo.privacy_policy': 'Datenschutzerklärung', + 'dsgvo.data_processing': 'Datenverarbeitung', + 'dsgvo.data_collected': 'Erhobene Daten', + 'dsgvo.data_purpose': 'Verarbeitungszweck', + 'dsgvo.data_retention': 'Speicherdauer', + 'dsgvo.data_third_party': 'Datenweitergabe an Dritte', + 'dsgvo.data_portability': 'Datenübertragbarkeit', + 'dsgvo.right_access': 'Auskunftsrecht', + 'dsgvo.right_rectification': 'Berichtigungsrecht', + 'dsgvo.right_erasure': 'Löschrecht', + 'dsgvo.right_portability': 'Recht auf Datenübertragbarkeit', + 'dsgvo.right_restriction': 'Recht auf Einschränkung der Verarbeitung', + 'dsgvo.right_objection': 'Widerspruchsrecht', + 'dsgvo.contact_dpo': 'Datenschutzbeauftragter', + 'dsgvo.export_data': 'Meine Daten exportieren', + 'dsgvo.export_data_desc': 'Exportieren Sie alle Ihre persönlichen Daten im JSON-Format (DSGVO Art. 20)', + 'dsgvo.export_data_success': 'Ihre Daten wurden erfolgreich exportiert.', + 'dsgvo.export_data_error': 'Fehler beim Exportieren der Daten.', + 'dsgvo.delete_account': 'Konto löschen', + 'dsgvo.delete_account_desc': 'Löschen Sie Ihr Konto und alle zugehörigen Daten (DSGVO Art. 17)', + 'dsgvo.delete_warning': 'Diese Aktion kann nicht rückgängig gemacht werden. Alle Ihre Daten werden nach 30 Tagen unwiderruflich gelöscht.', + 'dsgvo.delete_confirm_title': 'Konto wirklich löschen?', + 'dsgvo.delete_confirm_desc': 'Geben Sie Ihr Passwort ein, um die Löschung zu bestätigen. Ihr Konto wird in 30 Tagen unwiderruflich gelöscht.', + 'dsgvo.delete_password_label': 'Passwort zur Bestätigung', + 'dsgvo.delete_success': 'Ihr Konto wurde zur Löschung vorgemerkt. Sie haben 30 Tage Zeit, um den Vorgang abzubrechen.', + 'dsgvo.delete_error': 'Fehler beim Löschen des Kontos.', + 'dsgvo.delete_wrong_password': 'Falsches Passwort.', + 'dsgvo.delete_cancel_success': 'Die Löschung wurde abgebrochen.', + 'dsgvo.delete_scheduled': 'Löschung geplant am', + 'dsgvo.delete_cancel': 'Löschung abbrechen', + 'dsgvo.cookie_consent': 'Wir verwenden Cookies, um Ihnen die bestmögliche Erfahrung zu bieten.', + 'dsgvo.cookie_essential': 'Essenzielle Cookies', + 'dsgvo.cookie_essential_desc': 'Diese Cookies sind für die Funktionalität der Plattform erforderlich.', + 'dsgvo.cookie_analytics': 'Analyse-Cookies', + 'dsgvo.cookie_analytics_desc': 'Diese Cookies helfen uns, die Plattform zu verbessern.', + 'dsgvo.cookie_accept': 'Alle akzeptieren', + 'dsgvo.cookie_reject': 'Nur essenzielle', + 'dsgvo.cookie_settings': 'Cookie-Einstellungen', + 'dsgvo.jugendschutz': 'Jugendschutz', + 'dsgvo.jugendschutz_notice': 'Diese Plattform ist für Schülerinnen und Schüler unter 16 Jahren nur mit Zustimmung der Erziehungsberechtigten nutzbar.', + 'dsgvo.parental_consent': 'Einverständnis der Erziehungsberechtigten', + 'dsgvo.no_advertising': 'Keine Werbung für Schüler', + 'dsgvo.no_tracking': 'Kein Tracking von Schülern unter 16 Jahren', + 'dsgvo.dpa': 'Auftragsverarbeitungsvertrag (AVV)', + 'dsgvo.dpa_desc': 'Vertrag zur Auftragsdatenverarbeitung gemäß Art. 28 DSGVO', + 'dsgvo.data_register': 'Verzeichnis von Verarbeitungstätigkeiten', + 'dsgvo.data_register_desc': 'Übersicht aller Verarbeitungstätigkeiten gemäß Art. 30 DSGVO', + 'dsgvo.privacy_policy_text': 'Die nachfolgende Datenschutzerklärung gilt für die Nutzung der Plattform CompetenceTrack. Verantwortlich für die Datenverarbeitung ist die jeweilige Schule.', + 'dsgvo.data_collected_list': 'Name, E-Mail-Adresse, Passwort (verschlüsselt), Rollenzuordnung, Klassen- und Fächerverknüpfungen, Lernfortschritte, Bewertungen, Anwesenheitsdaten, Notizen und Zeugnisse.', + 'dsgvo.data_purpose_list': 'Bereitstellung und Betrieb der Plattform, Verwaltung von Schülern und Klassen, Dokumentation von Lernfortschritten, Erstellung von Zeugnissen und Berichten, Kommunikation mit Eltern.', + 'dsgvo.data_retention_list': 'Nutzerdaten werden für die Dauer der Nutzung gespeichert. Nach Löschung des Kontos werden die Daten nach Ablauf der 30-tägigen Widerspruchsfrist unwiderruflich gelöscht. Auswertungsdaten werden nach 3 Jahren anonymisiert.', + 'dsgvo.data_third_party_list': 'Es erfolgt keine Weitergabe personenbezogener Daten an Dritte, soweit keine gesetzliche Verpflichtung besteht oder die Datenverarbeitung im Auftrag gemäß Art. 28 DSGVO erfolgt.', + 'dsgvo.dpa_template_text': 'Der Auftragsverarbeitungsvertrag (AVV) regelt die Datenverarbeitung im Auftrag gemäß Art. 28 DSGVO. Die Schule als Verantwortliche schließt diesen Vertrag mit dem Betreiber der Plattform ab.', + 'dsgvo.dpa_status_signed': 'Unterzeichnet', + 'dsgvo.dpa_status_pending': 'Ausstehend', + 'dsgvo.dpa_sign': 'AVV unterzeichnen', + 'dsgvo.jugendschutz_login_notice': 'Für Schüler unter 16 Jahren ist die Nutzung nur mit Zustimmung der Erziehungsberechtigten erlaubt.', + 'dsgvo.jugendschutz_rewards': 'Wettbewerbspreise entsprechen den Anforderungen des Jugendschutzgesetzes.', + 'dsgvo.tab_privacy': 'Datenschutz', + 'dsgvo.rights_title': 'Ihre Rechte nach DSGVO', + 'dsgvo.rights_desc': 'Sie haben gegenüber dem Verantwortlichen folgende Rechte:', + 'dsgvo.right_access_desc': 'Sie haben das Recht, Auskunft darüber zu verlangen, welche personenbezogenen Daten über Sie verarbeitet werden.', + 'dsgvo.right_rectification_desc': 'Sie haben das Recht, die Berichtigung unrichtiger personenbezogener Daten zu verlangen.', + 'dsgvo.right_erasure_desc': 'Sie haben das Recht, die Löschung Ihrer personenbezogenen Daten zu verlangen.', + 'dsgvo.right_portability_desc': 'Sie haben das Recht, Ihre Daten in einem strukturierten, gängigen und maschinenlesbaren Format zu erhalten.', + 'dsgvo.right_restriction_desc': 'Sie haben das Recht, die Einschränkung der Verarbeitung Ihrer Daten zu verlangen.', + 'dsgvo.right_objection_desc': 'Sie haben das Recht, aus Gründen der besonderen Situation Widerspruch gegen die Verarbeitung einzulegen.', + 'dsgvo.dpa_download': 'AVV-Vorlage herunterladen', + 'dsgvo.data_register_download': 'Verzeichnis herunterladen', }; const en: TranslationDict = { @@ -6831,6 +6903,78 @@ const en: TranslationDict = { 'grading.ausreichend': 'Ausreichend', 'grading.mangelhaft': 'Mangelhaft', 'grading.ungenuegend': 'Ungenügend', + + // DSGVO / Privacy + 'dsgvo.title': 'Privacy', + 'dsgvo.privacy_policy': 'Privacy Policy', + 'dsgvo.data_processing': 'Data Processing', + 'dsgvo.data_collected': 'Data Collected', + 'dsgvo.data_purpose': 'Purpose of Processing', + 'dsgvo.data_retention': 'Retention Period', + 'dsgvo.data_third_party': 'Third-Party Data Sharing', + 'dsgvo.data_portability': 'Data Portability', + 'dsgvo.right_access': 'Right of Access', + 'dsgvo.right_rectification': 'Right to Rectification', + 'dsgvo.right_erasure': 'Right to Erasure', + 'dsgvo.right_portability': 'Right to Data Portability', + 'dsgvo.right_restriction': 'Right to Restriction of Processing', + 'dsgvo.right_objection': 'Right to Object', + 'dsgvo.contact_dpo': 'Data Protection Officer', + 'dsgvo.export_data': 'Export My Data', + 'dsgvo.export_data_desc': 'Export all your personal data in JSON format (GDPR Art. 20)', + 'dsgvo.export_data_success': 'Your data has been successfully exported.', + 'dsgvo.export_data_error': 'Error exporting data.', + 'dsgvo.delete_account': 'Delete Account', + 'dsgvo.delete_account_desc': 'Delete your account and all associated data (GDPR Art. 17)', + 'dsgvo.delete_warning': 'This action cannot be undone. All your data will be permanently deleted after 30 days.', + 'dsgvo.delete_confirm_title': 'Really delete account?', + 'dsgvo.delete_confirm_desc': 'Enter your password to confirm deletion. Your account will be permanently deleted in 30 days.', + 'dsgvo.delete_password_label': 'Password to confirm', + 'dsgvo.delete_success': 'Your account has been scheduled for deletion. You have 30 days to cancel.', + 'dsgvo.delete_error': 'Error deleting account.', + 'dsgvo.delete_wrong_password': 'Wrong password.', + 'dsgvo.delete_cancel_success': 'Deletion has been cancelled.', + 'dsgvo.delete_scheduled': 'Deletion scheduled on', + 'dsgvo.delete_cancel': 'Cancel deletion', + 'dsgvo.cookie_consent': 'We use cookies to provide you with the best possible experience.', + 'dsgvo.cookie_essential': 'Essential Cookies', + 'dsgvo.cookie_essential_desc': 'These cookies are required for the platform to function.', + 'dsgvo.cookie_analytics': 'Analytics Cookies', + 'dsgvo.cookie_analytics_desc': 'These cookies help us improve the platform.', + 'dsgvo.cookie_accept': 'Accept All', + 'dsgvo.cookie_reject': 'Essential Only', + 'dsgvo.cookie_settings': 'Cookie Settings', + 'dsgvo.jugendschutz': 'Youth Protection', + 'dsgvo.jugendschutz_notice': 'This platform may only be used by students under 16 with the consent of their legal guardians.', + 'dsgvo.parental_consent': 'Parental Consent', + 'dsgvo.no_advertising': 'No advertising for students', + 'dsgvo.no_tracking': 'No tracking of students under 16', + 'dsgvo.dpa': 'Data Processing Agreement (DPA)', + 'dsgvo.dpa_desc': 'Data processing agreement pursuant to Art. 28 GDPR', + 'dsgvo.data_register': 'Register of Processing Activities', + 'dsgvo.data_register_desc': 'Overview of all processing activities pursuant to Art. 30 GDPR', + 'dsgvo.privacy_policy_text': 'The following privacy policy applies to the use of the CompetenceTrack platform. The respective school is responsible for data processing.', + 'dsgvo.data_collected_list': 'Name, email address, password (encrypted), role assignment, class and subject associations, learning progress, assessments, attendance data, notes and reports.', + 'dsgvo.data_purpose_list': 'Provision and operation of the platform, management of students and classes, documentation of learning progress, creation of reports, communication with parents.', + 'dsgvo.data_retention_list': 'User data is stored for the duration of use. After account deletion, data is permanently deleted after the 30-day objection period. Analytics data is anonymized after 3 years.', + 'dsgvo.data_third_party_list': 'Personal data is not shared with third parties unless required by law or processed on behalf pursuant to Art. 28 GDPR.', + 'dsgvo.dpa_template_text': 'The Data Processing Agreement (DPA) regulates data processing on behalf pursuant to Art. 28 GDPR. The school as controller concludes this agreement with the platform operator.', + 'dsgvo.dpa_status_signed': 'Signed', + 'dsgvo.dpa_status_pending': 'Pending', + 'dsgvo.dpa_sign': 'Sign DPA', + 'dsgvo.jugendschutz_login_notice': 'Students under 16 may only use this platform with the consent of their legal guardians.', + 'dsgvo.jugendschutz_rewards': 'Competition prizes comply with the Youth Protection Act requirements.', + 'dsgvo.tab_privacy': 'Privacy', + 'dsgvo.rights_title': 'Your Rights under GDPR', + 'dsgvo.rights_desc': 'You have the following rights vis-à-vis the controller:', + 'dsgvo.right_access_desc': 'You have the right to request information about which personal data is processed about you.', + 'dsgvo.right_rectification_desc': 'You have the right to request the correction of inaccurate personal data.', + 'dsgvo.right_erasure_desc': 'You have the right to request the deletion of your personal data.', + 'dsgvo.right_portability_desc': 'You have the right to receive your data in a structured, commonly used, and machine-readable format.', + 'dsgvo.right_restriction_desc': 'You have the right to request the restriction of processing of your data.', + 'dsgvo.right_objection_desc': 'You have the right to object to processing on grounds relating to your particular situation.', + 'dsgvo.dpa_download': 'Download DPA template', + 'dsgvo.data_register_download': 'Download register', }; const translations: Record = { de, en }; diff --git a/worklog.md b/worklog.md index 8e3f97c..b5bd35a 100644 --- a/worklog.md +++ b/worklog.md @@ -1504,3 +1504,61 @@ Work Log: - `Trophy` is already imported in `app-layout.tsx` - **Lint**: All checks pass (`bun run lint` — no errors) + +--- +Task ID: 5 +Agent: dsgvo-compliance +Task: Add DSGVO (German GDPR) Compliance Features to CompetenceTrack +Date: 2025-01-28 + +Work Log: +- **i18n keys** (`src/lib/i18n.ts`): + - Added 65+ DSGVO/privacy translation keys in both German (DE) and English (EN) + - Covers: privacy policy, data processing, user rights (Auskunftsrecht, Berichtigungsrecht, Löschrecht, etc.), cookie consent, Jugendschutz, DPA/AVV, data export, account deletion + - All German legal terms are accurate (DSGVO, Jugendschutzgesetz, TTDSG, AVV, Art. 28/30 DSGVO) + +- **Cookie Consent Component** (`src/components/cookie-consent.tsx`): + - Bottom-fixed banner with emerald accent that appears on first visit + - Essential cookies (always on) and Analytics cookies (optional) with toggle + - "Alle akzeptieren" and "Nur essenzielle" buttons + - "Cookie-Einstellungen" expandable details panel + - Stores consent in localStorage with key `ct_cookie_consent` + - Exports `hasAnalyticsConsent()` and `hasCookieConsent()` helper functions + - Animated with framer-motion, professional design with emerald/amber accents + +- **GDPR Data Export API** (`src/app/api/gdpr-export/route.ts`): + - GET endpoint that exports all user data as JSON (DSGVO Art. 20) + - Uses `getSession()` for authentication + - Exports: user profile, school info, class associations, learning progress, assessments, reports, audit logs, data export requests, teacher notes, attendance sessions, notifications, notebooks, homework + - For students: also exports student data, enrollments, progress entries, assessment results + - For parents: also exports parent-student links + - Returns JSON with Content-Disposition header for download + - Includes export metadata with legal basis reference + +- **Account Deletion API** (`src/app/api/account-deletion/route.ts`): + - POST: Soft delete (sets `deletedAt`) with 30-day grace period (DSGVO Art. 17) + - Requires password confirmation via body `{ password: string }` + - PUT: Cancel deletion within grace period (clears `deletedAt`) + - GET: Check deletion status (scheduled date, canCancel flag) + - Creates audit log entries for both request and cancellation + - Uses `verifyPassword()` for secure confirmation + +- **Privacy Tab in Settings** (`src/components/settings-view.tsx`): + - Added "Datenschutz" (Privacy) tab with Shield icon + - Privacy Policy Card: data processing notice, data collected, purpose, retention, third-party sharing, DPO contact + - User Rights Card: 6 DSGVO rights in a 2-column grid with colored icons (Auskunftsrecht, Berichtigungsrecht, Löschrecht, Datenübertragbarkeit, Einschränkung, Widerspruchsrecht) + - Data Export Card: "Meine Daten exportieren" button with JSON download (DSGVO Art. 20) + - Account Deletion Card: "Konto löschen" button with confirmation dialog requiring password, 30-day grace period display, cancel option (DSGVO Art. 17) + - Jugendschutz Card: parental consent notice, no advertising, no tracking under 16, Jugendschutzgesetz-compliant rewards + - DPA/AVV Card (admin only): Auftragsverarbeitungsvertrag template download, Verzeichnis von Verarbeitungstätigkeiten (Art. 30 DSGVO) download, DPA status badge + +- **Cookie Consent on Main Page** (`src/app/page.tsx`): + - Imported and rendered `CookieConsent` component + - Shows on both authenticated and unauthenticated views + +- **Jugendschutz Notice in Auth** (`src/components/auth-view.tsx`): + - Added youth protection notice for student login: "Für Schüler unter 16 Jahren ist die Nutzung nur mit Zustimmung der Erziehungsberechtigten erlaubt." + - Displays with Shield icon and emerald styling below the existing student info section + +- **Lint**: All checks pass (`npx eslint` — no errors on any modified file) +- **Dev Server**: Compiles successfully, no errors in dev.log