feat: add new legal document and database schema for module L compliance

Co-authored-by: cetinmustafa83 <30570791+cetinmustafa83@users.noreply.github.com>

src/app/api/v1/gdpr/export/route.ts

@@ -0,0 +1,85 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSession } from "@/lib/auth";
+import { getAuditTrailForDataSubject } from "@/lib/audit";
+import { PrismaClient } from "@prisma/client";
+
+const prisma = new PrismaClient();
+
+/**
+ * POST /api/v1/gdpr/export
+ * Right of Access (Art. 15 GDPR)
+ * User can request export of all their personal data
+ */
+export async function POST(req: NextRequest) {
+  try {
+    const session = await getSession();
+    if (!session?.userId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const { userId: requestedUserId } = await req.json();
+
+    // Users can only export their own data; admins can export any user's data
+    const isAdmin = session.user?.role === "SCHOOL_ADMIN" || session.user?.role === "SUPER_ADMIN";
+    if (!isAdmin && session.userId !== requestedUserId) {
+      return NextResponse.json(
+        { error: "You can only export your own data" },
+        { status: 403 }
+      );
+    }
+
+    // Fetch all personal data
+    const user = await prisma.user.findUnique({
+      where: { id: requestedUserId },
+      include: {
+        student: true,
+        learningProgressEntries: true,
+        assessments: true,
+        notebooks: true,
+        parentMessagesSent: true,
+        auditLogs: { take: 100 },
+      },
+    });
+
+    if (!user) {
+      return NextResponse.json({ error: "User not found" }, { status: 404 });
+    }
+
+    // Get audit trail for this user
+    const auditTrail = await getAuditTrailForDataSubject(user.schoolId!, requestedUserId);
+
+    // Compile export data
+    const exportData = {
+      user: {
+        id: user.id,
+        email: user.email,
+        firstName: user.firstName,
+        lastName: user.lastName,
+        role: user.role,
+        createdAt: user.createdAt,
+      },
+      student: user.student || null,
+      learningProgress: user.learningProgressEntries || [],
+      assessments: user.assessments || [],
+      notebooks: user.notebooks || [],
+      messages: user.parentMessagesSent || [],
+      auditTrail: auditTrail,
+      exportedAt: new Date().toISOString(),
+      retentionNote:
+        "Some data (e.g., final grades) may be retained longer due to legal requirements. See your school's privacy notice.",
+    };
+
+    return NextResponse.json({
+      success: true,
+      data: exportData,
+      format: "json",
+      message: "Your personal data export is ready",
+    });
+  } catch (error) {
+    console.error("[v0] Error exporting user data:", error);
+    return NextResponse.json(
+      { error: "Failed to export data" },
+      { status: 500 }
+    );
+  }
+}