| | | 1 | | using ArturRios.Heimdall.Command.Output; |
| | | 2 | | |
| | | 3 | | namespace ArturRios.Heimdall.Command.Services; |
| | | 4 | | |
| | | 5 | | /// <summary> |
| | | 6 | | /// The context Art. 15 requires an export to carry alongside the data: who else receives it, |
| | | 7 | | /// how long each category is kept, and what is held but not reproduced. |
| | | 8 | | /// </summary> |
| | | 9 | | /// <remarks> |
| | | 10 | | /// <para> |
| | | 11 | | /// This duplicates the Data Protection Document and the Data Retention Schedule, which is a |
| | | 12 | | /// real cost and is accepted deliberately: the subject receives one document, and a copy |
| | | 13 | | /// that told them to go and read a repository would not be the "concise, transparent, |
| | | 14 | | /// intelligible" form Art. 12(1) asks for. |
| | | 15 | | /// </para> |
| | | 16 | | /// <para> |
| | | 17 | | /// The duplication is guarded rather than trusted. <c>DataExportDisclosureTests</c> asserts |
| | | 18 | | /// that every recipient named here appears in the record of processing, so the two cannot |
| | | 19 | | /// drift apart silently — which is the only failure mode duplication of this kind has. |
| | | 20 | | /// </para> |
| | | 21 | | /// </remarks> |
| | | 22 | | public static class DataExportDisclosure |
| | | 23 | | { |
| | | 24 | | /// <summary>Most audit entries a single export reproduces.</summary> |
| | | 25 | | /// <remarks> |
| | | 26 | | /// A bound is needed — an old, busy account could otherwise produce a response measured in |
| | | 27 | | /// megabytes — but a silently truncated copy is not the copy Art. 15 asks for, so reaching |
| | | 28 | | /// it is reported on the document itself. |
| | | 29 | | /// </remarks> |
| | | 30 | | public const int MaximumAuditEntries = 5000; |
| | | 31 | | |
| | | 32 | | /// <summary>Who else the subject's data reaches (GDPR Art. 15(1)(c), LGPD Art. 18 VII).</summary> |
| | | 33 | | public static IEnumerable<DataExportRecipient> Recipients => |
| | 25 | 34 | | [ |
| | 25 | 35 | | new() |
| | 25 | 36 | | { |
| | 25 | 37 | | Name = "Mailgun", |
| | 25 | 38 | | Purpose = "Delivering verification, password reset and two-factor emails", |
| | 25 | 39 | | Location = "United States" |
| | 25 | 40 | | }, |
| | 25 | 41 | | new() |
| | 25 | 42 | | { |
| | 25 | 43 | | Name = "The organisation whose system this account belongs to", |
| | 25 | 44 | | Purpose = "Administering the identities within its own scope", |
| | 25 | 45 | | Location = "Varies by tenant" |
| | 25 | 46 | | }, |
| | 25 | 47 | | new() |
| | 25 | 48 | | { |
| | 25 | 49 | | Name = "Hosting provider", |
| | 25 | 50 | | Purpose = "Storing the database", |
| | 25 | 51 | | Location = "Brazil" |
| | 25 | 52 | | } |
| | 25 | 53 | | ]; |
| | | 54 | | |
| | | 55 | | /// <summary> |
| | | 56 | | /// Where data that did not come from the subject came from (GDPR Art. 14(2)(f) and Art. |
| | | 57 | | /// 15(1)(g), LGPD Art. 9). |
| | | 58 | | /// </summary> |
| | | 59 | | /// <remarks> |
| | | 60 | | /// Google was listed as a <em>recipient</em> until the transfer assessment was corrected, |
| | | 61 | | /// and it is not one: the ID token is validated offline against cached public certificates |
| | | 62 | | /// and nothing about the person is ever sent to Google. It belongs here, where the direction |
| | | 63 | | /// is right — and telling the subject where their data came from is an obligation in its own |
| | | 64 | | /// right when it did not come from them. |
| | | 65 | | /// </remarks> |
| | | 66 | | public static IEnumerable<DataExportSource> Sources => |
| | 25 | 67 | | [ |
| | 25 | 68 | | new() |
| | 25 | 69 | | { |
| | 25 | 70 | | Name = "Google", |
| | 25 | 71 | | Provides = |
| | 25 | 72 | | "Your name, email address, profile picture and Google account identifier, if you " |
| | 25 | 73 | | + "signed in with Google. They come from the token Google issues when you sign in.", |
| | 25 | 74 | | DataSentThere = |
| | 25 | 75 | | "Nothing. The token is checked against Google's published certificates on this " |
| | 25 | 76 | | + "server; it is never sent to Google." |
| | 25 | 77 | | } |
| | 25 | 78 | | ]; |
| | | 79 | | |
| | | 80 | | /// <summary>How long each category is kept (GDPR Art. 15(1)(d)).</summary> |
| | | 81 | | public static IEnumerable<DataExportRetention> Retention => |
| | 25 | 82 | | [ |
| | 25 | 83 | | new() { Category = "Account", Period = "While the account exists" }, |
| | 25 | 84 | | new() { Category = "Account, after you ask to be erased", Period = "Anonymised within 30 days" }, |
| | 25 | 85 | | new() |
| | 25 | 86 | | { |
| | 25 | 87 | | Category = "Account, after an administrator deletes it", |
| | 25 | 88 | | Period = "Anonymised after 90 days, so a mistake can be undone" |
| | 25 | 89 | | }, |
| | 25 | 90 | | new() { Category = "Password reset and verification links", Period = "A week after they expire" }, |
| | 25 | 91 | | new() |
| | 25 | 92 | | { |
| | 25 | 93 | | Category = "Records of actions on the account", |
| | 25 | 94 | | Period = "18 months, then stripped of anything identifying you" |
| | 25 | 95 | | }, |
| | 25 | 96 | | new() { Category = "Application logs", Period = "12 months" } |
| | 25 | 97 | | ]; |
| | | 98 | | |
| | | 99 | | /// <summary> |
| | | 100 | | /// Values held about the subject that this document names but does not reproduce. |
| | | 101 | | /// </summary> |
| | | 102 | | /// <remarks> |
| | | 103 | | /// Art. 15(4): the right to a copy must not adversely affect the rights of others — and |
| | | 104 | | /// reproducing a password hash or a TOTP secret would hand whoever holds the token the |
| | | 105 | | /// material to attack the account offline, which adversely affects the subject most of all. |
| | | 106 | | /// Naming them is the compromise: the subject learns what exists without the export becoming |
| | | 107 | | /// the best thing to steal. |
| | | 108 | | /// </remarks> |
| | | 109 | | public static IEnumerable<DataExportWithheld> Withheld => |
| | 25 | 110 | | [ |
| | 25 | 111 | | new() |
| | 25 | 112 | | { |
| | 25 | 113 | | Value = "Password hash and salt", |
| | 25 | 114 | | Reason = "Reproducing them would let anyone holding this document attack the password offline. " |
| | 25 | 115 | | + "The password itself is not stored and cannot be recovered from what is." |
| | 25 | 116 | | }, |
| | 25 | 117 | | new() |
| | 25 | 118 | | { |
| | 25 | 119 | | Value = "Two-factor secret", |
| | 25 | 120 | | Reason = "Encrypted at rest and never returned after the response that first generated it. " |
| | 25 | 121 | | + "Reproducing it would defeat the second factor entirely." |
| | 25 | 122 | | }, |
| | 25 | 123 | | new() |
| | 25 | 124 | | { |
| | 25 | 125 | | Value = "Two-factor recovery codes", |
| | 25 | 126 | | Reason = "Stored only as hashes, so the codes themselves no longer exist to reproduce." |
| | 25 | 127 | | }, |
| | 25 | 128 | | new() |
| | 25 | 129 | | { |
| | 25 | 130 | | Value = "Password reset and email verification tokens", |
| | 25 | 131 | | Reason = "Stored only as digests, and a live one would let this document be used to take over the account." |
| | 25 | 132 | | } |
| | 25 | 133 | | ]; |
| | | 134 | | } |