[hturnbull93]

Screenshots: https://fedora.taila91c66.ts.net:8444/docs/20261021-134938-pr-359-gdpr-export-built-from-the-schema.html

The data export now finds what to include from the Prisma schema, so a new model that holds someone's data is picked up without a code change, and the build fails until someone decides whether it belongs.

Data / export logic (lib/data-export.ts)

• Reads the runtime data model and finds every link to a person: each relation field pointing at Volunteer (authorId, assigneeId, reporterId, resolvedById, fromVolunteerId…), any bare volunteerId-style column with no relation (DeletionRequest.volunteerId), and any column outside the account holding an email address (BugReport.reporterEmail, AdminInvite.email…) or its SHA-256 (RejectedApplication.emailHash, AnonymisedEmail.emailHash).
• Email and hash links match only once the account's address is confirmed: anyone can change their account to an unused address, so an unconfirmed one would otherwise export someone else's rows. Email columns match case-insensitively; hash columns match the hash of the lower-cased, trimmed address, as the app writes them.
• Relations to the outreach tool's ExperimentalOutreachParticipant are links too, matched through the participant with the person's confirmed address: its sessions and login tokens, and the journalists it claimed or contacted. A journalist is exported as the claim alone (EXPORTED_COLUMNS: id, who, when, which template), since their name, address and notes are the journalist's data.
• Accounts merged into yours (Volunteer.mergedInto) are exported, secrets stripped: both sides confirmed the merge, and the old account can no longer sign in to export itself. duplicateOf is left out, as it is an admin's guess until a merge is confirmed.
• An export runs its queries four at a time, so one export never holds the whole connection pool.
• Each link is either in EXPORTED_LINKS or in OMITTED_LINKS with a reason.
• SECRET_FIELDS is the deny-list: password hash, the old auth token, session and API token hashes, reset/verification/merge/invite tokens, and email hashes. Only those columns are stripped. A column whose name looks secret (token/hash/password/secret/key/code/otp) fails the guard until it is named in SECRET_FIELDS or in PLAIN_FIELDS (looks secret, isn't), so a column like passwordChangedAt is a decision rather than a silent drop.
• If the Prisma client stops exposing _runtimeDataModel or a model delegate, the export throws an error naming it.

API / export shape (privacy.export)

• exportedAt and skills are unchanged.
• profile is a superset of the old one: every column of the account except the secrets (so application notes, chapter, preferences and so on are now included), plus localGroup, nationalChapter, isSuperAdmin and hasPassword. Skills are in the top-level skills only.
• projects, interests, messagesSent and messagesReceived are replaced by records: { Model: { link: rows[] } }. For example, records.Message.from is what you sent, records.Message.to what you received, and records.WorkItem.assignee the work you hold. Rows keep their real column names (relatedWorkItemId, not relatedProjectId), and work items cover tasks as well as projects.

UI

• The export description on /privacy and in Settings now lists what the export includes.

Tests

• lib/data-export.test.ts makes one row for every exported link, for the person and for someone else, and checks each link returns the first and not the second. A fixture list that doesn't match EXPORTED_LINKS fails, so a newly exported link needs a fixture. Breaking the email match or the id filter on purpose fails it with a line per link.
• The same file checks the export holds another person's id where a row involves them, but never their name or email address; that an unconfirmed address matches no email or hash link (removing the check fails it on each one); and that a missing data model or delegate throws.
• The guard also fails on a new email or email-hash column nobody has classified.
• lib/data-export.test.ts: the guard passes against the real schema. Synthetic schema changes show it catches a new model, a new relation on an existing model, a bare volunteer column, an undeclared secret-looking column, and stale classifications or secrets. Another test checks that every exported link appears in the output and that only the caller's rows are read, without token hashes.
• privacy.export router tests cover admin notes about you (included) and by you (left out), sessions, API tokens and deletion requests without secrets, and a profile with no password hash or auth token.
• The e2e test 18-gdpr-privacy now asserts against the new shape.

Decisions

• How the schema is read: the prisma-client generator (Prisma 6.19) doesn't export Prisma.dmmf. The data model is read from the client's _runtimeDataModel, which is typed in Prisma's runtime but internal. If a Prisma upgrade moves it, the guard test fails loudly rather than the export going quiet.
• What is included: rows about you, made by you, or sent to you, including admin notes about you (Article 15).
• What is left out: decisions you took as staff about other people (reviews, appointments, resolutions, audit actions), notes and endorsements you wrote about others, invites sent to other people's addresses, and other accounts that point at yours. Each has its reason in OMITTED_LINKS.
• Tokens: session, API token, password-reset and verification rows are exported without their token or hash, so you can see that they exist.
• Shape change: the shape changed rather than keeping duplicate legacy keys. Only the download button reads this endpoint.
• Matched by email: invites to the person's address (accepted or not), bug reports filed with it, rejected applications (with the admin's and applicant's notes) and anonymised-email records for it, and their experimental outreach participant and journalist rows are exported. DeletionRequest.volunteerEmail is matched too, since volunteerId has no foreign key and a request from an earlier account outlives it. Email hashes are stripped like other secrets.
• Not followed: rows that point at an exported row rather than at the person, such as the review requests on a project they created. The guard covers links to a volunteer or an outreach participant only.
• Includes others' ids, not their details: a row is exported whole, so a received message carries the sender's id, and a project its other people's ids and review notes.
• Secrets by name only: the guard reads column names; a secret stored inside a Json column would not be caught.
• Unbounded: each link is one query with no limit, and the whole export is built in memory, as the old export was.
• No maintenance checklist: there is no maintenance-checklist.md anywhere in the repo or its history, so there was no checklist item to remove.

No data migration.

Closes #118

Also in this PR: nine router handlers that didn't await notifyUser now do. They returned before the notification row existed, and projects-interests' declined-invite test failed once under check-all waiting for it. notifyUser only awaits the row, so the email still runs on its own. It no longer throws when looking up who to email fails (logged instead), so an awaited call can't turn a saved change into an error; bugReports' own .catch on it is gone.

hashEmail() in lib/auth.ts is now the one SHA-256 of a normalised address, used by registration, application review, anonymisation and the export.

🤖 Generated with Claude Code

[railway-app]

🚅 Deployed to the catalyse-pr-359 environment in PauseAI Catalyse

Service	Status	Web	Updated
web	❌ Build Failed (View Logs)	Web	Oct 24, 2026 at 7:14 pm UTC