Right to erasure no código: backups, replicas, search index

import { Kafka } from 'kafkajs';
import { Client as ES } from '@elastic/elasticsearch';
import { destroyKey } from './kms';
import { db } from './db';

type ErasureEvent = { request_id: string; user_id: string; scope: 'full' | 'consented_only' };

export async function handle(event: ErasureEvent) {
  const stepKey = `${event.request_id}:postgres`;
  // idempotência: se já processou, skip
  const alreadyDone = await db.query(
    'SELECT 1 FROM erasure_step WHERE step_key = $1 AND status = $2',
    [stepKey, 'done']
  );
  if (alreadyDone.rows.length) return;

  await db.tx(async (tx) => {
    // 1. Hard delete em tabelas com PII
    await tx.query('DELETE FROM user_addresses WHERE user_id = $1', [event.user_id]);
    await tx.query('DELETE FROM user_devices  WHERE user_id = $1', [event.user_id]);
    // 2. Anonimiza transações (retidas por obrigação fiscal)
    await tx.query(
      `UPDATE transactions SET cardholder_name = NULL, masked_pan = NULL,
       email = NULL, ip_address = NULL WHERE user_id = $1`,
      [event.user_id]
    );
    // 3. Tombstone na users (para audit) — mantém id, marca anonymized_at
    await tx.query(
      `UPDATE users SET full_name = NULL, cpf = NULL, email = NULL, phone = NULL,
       anonymized_at = NOW() WHERE id = $1`,
      [event.user_id]
    );
    await tx.query(
      `INSERT INTO erasure_step (step_key, request_id, status, finished_at)
       VALUES ($1, $2, 'done', NOW())
       ON CONFLICT (step_key) DO UPDATE SET status='done', finished_at=NOW()`,
      [stepKey, event.request_id]
    );
  });
}

// ES handler: deleta documentos + invalida cache
export async function handleES(event: ErasureEvent) {
  const es = new ES({ node: process.env.ES_URL });
  await es.deleteByQuery({
    index: ['users-*', 'transactions-*'],
    refresh: true,
    body: { query: { term: { user_id: event.user_id } } },
  });
}

// Backups: destrói chave per-tenant
export async function handleBackupCryptoShred(event: ErasureEvent) {
  if (event.scope !== 'full') return;
  await destroyKey(`user/${event.user_id}/dek`);  // KMS schedule deletion (7-30d window)
}

import { NextRequest, NextResponse } from 'next/server';
import { authenticate, verifyStepUp } from '@/lib/auth';
import { db } from '@/lib/db';
import { publishToKafka } from '@/lib/kafka';

export async function POST(req: NextRequest) {
  const user = await authenticate(req);
  if (!user) return NextResponse.json({ error: 'unauthenticated' }, { status: 401 });

  // Step-up MFA para operação destrutiva
  const stepUpOk = await verifyStepUp(req, { factor: 'totp_or_webauthn' });
  if (!stepUpOk) return NextResponse.json({ error: 'step_up_required' }, { status: 403 });

  const { scope = 'full', reason } = await req.json();
  const { rows: [request] } = await db.query(
    `INSERT INTO erasure_request (user_id, scope, reason, status, requested_at)
     VALUES ($1, $2, $3, 'received', NOW()) RETURNING id`,
    [user.id, scope, reason]
  );

  // 1. Soft delete imediato
  await db.query('UPDATE users SET deleted_at = NOW() WHERE id = $1', [user.id]);

  // 2. Publica evento; downstream consumers processam idempotente
  await publishToKafka('user.erased', { request_id: request.id, user_id: user.id, scope });

  // Logout imediato; sessão revogada
  return NextResponse.json({
    request_id: request.id,
    eta_days: 14,
    notice: 'Sua solicitação foi recebida. Dados serão anonimizados em 15 dias úteis conforme Art. 19 LGPD.',
  }, { status: 202 });
}