feat: add new legal document and database schema for module L compliance

Co-authored-by: cetinmustafa83 <30570791+cetinmustafa83@users.noreply.github.com>

src/lib/auth.ts

@@ -87,3 +87,93 @@ export async function clearSession(): Promise<void> {
   const cookieStore = await cookies();
   cookieStore.delete(SESSION_COOKIE_NAME);
 }
+
+// ─── Module L: Access Control & DPO Role ───────────────────────────────
+
+/**
+ * Check if user has DPO (Data Protection Officer) role
+ */
+export async function isDPORole(userId: string): Promise<boolean> {
+  const cookieStore = await cookies();
+  const sessionUserId = cookieStore.get(SESSION_COOKIE_NAME)?.value;
+
+  if (!sessionUserId || sessionUserId !== userId) {
+    return false;
+  }
+
+  const user = await db.user.findUnique({
+    where: { id: userId },
+    select: { role: true },
+  });
+
+  return user?.role === 'DPO';
+}
+
+/**
+ * Check if user has admin role (SCHOOL_ADMIN or higher)
+ */
+export async function isAdminRole(userId: string): Promise<boolean> {
+  const user = await db.user.findUnique({
+    where: { id: userId },
+    select: { role: true },
+  });
+
+  return user?.role === 'SCHOOL_ADMIN' || user?.role === 'SUPER_ADMIN';
+}
+
+/**
+ * Check if user can access compliance features (DPO or Admin)
+ */
+export async function canAccessCompliance(userId: string): Promise<boolean> {
+  const isDPO = await isDPORole(userId);
+  const isAdmin = await isAdminRole(userId);
+  return isDPO || isAdmin;
+}
+
+/**
+ * Verify user can perform compliance actions
+ * Returns { allowed: boolean, reason?: string }
+ */
+export async function verifyComplianceAccess(
+  userId: string
+): Promise<{ allowed: boolean; reason?: string }> {
+  const user = await db.user.findUnique({
+    where: { id: userId, deletedAt: null },
+    select: { role: true, schoolId: true },
+  });
+
+  if (!user) {
+    return { allowed: false, reason: 'User not found' };
+  }
+
+  if (user.role !== 'DPO' && user.role !== 'SCHOOL_ADMIN' && user.role !== 'SUPER_ADMIN') {
+    return {
+      allowed: false,
+      reason: 'Only DPO and administrators can access compliance features',
+    };
+  }
+
+  if (!user.schoolId) {
+    return { allowed: false, reason: 'User not associated with a school' };
+  }
+
+  return { allowed: true };
+}
+
+/**
+ * Check if user can view audit logs
+ * Only DPO and admins can view full audit logs
+ */
+export async function canViewAuditLogs(userId: string): Promise<boolean> {
+  const canAccess = await canAccessCompliance(userId);
+  return canAccess;
+}
+
+/**
+ * Check if user can approve deletion flags
+ * Only DPO can approve data deletion
+ */
+export async function canApproveDeletion(userId: string): Promise<boolean> {
+  const isDPO = await isDPORole(userId);
+  return isDPO;
+}