| | | 1 | | using System.Text.Json.Serialization; |
| | | 2 | | using ArturRios.Heimdall.Shared.Security; |
| | | 3 | | using ArturRios.Mediator.Command; |
| | | 4 | | |
| | | 5 | | namespace ArturRios.Heimdall.Command.Input; |
| | | 6 | | |
| | | 7 | | /// <summary> |
| | | 8 | | /// A data subject's request for a copy of everything held about them (UC-41, GDPR Art. 15 and |
| | | 9 | | /// 20, LGPD Art. 18 II and V). |
| | | 10 | | /// </summary> |
| | | 11 | | /// <remarks> |
| | | 12 | | /// <para> |
| | | 13 | | /// The subject is the authenticated caller, always. There is no identifier in the path or |
| | | 14 | | /// the body, so the endpoint has no shape in which one identity could export another's data. |
| | | 15 | | /// </para> |
| | | 16 | | /// <para> |
| | | 17 | | /// <b>Why a command for something that reads nothing.</b> Two reasons, and neither is |
| | | 18 | | /// tidiness. An export is the single highest-value action a stolen token can perform — it |
| | | 19 | | /// discloses everything about a person in one response — so it has to reach the audit trail, |
| | | 20 | | /// and in this codebase only commands are audited. And a <c>GET</c> would invite caching: a |
| | | 21 | | /// document containing everything about a person is exactly what must never sit in a proxy |
| | | 22 | | /// or a browser cache. Both point the same way. |
| | | 23 | | /// </para> |
| | | 24 | | /// </remarks> |
| | | 25 | | public class ExportMyDataCommand : BaseCommand, IActorScoped |
| | | 26 | | { |
| | | 27 | | [JsonIgnore] |
| | 49 | 28 | | public Guid ActingPersonId { get; set; } |
| | | 29 | | |
| | | 30 | | [JsonIgnore] |
| | 24 | 31 | | public int ActingRole { get; set; } |
| | | 32 | | } |