gdpr

type AuditEntry ¶

type AuditEntry struct {
	SubjectID       string    `json:"subject_id"`
	ForgottenAt     time.Time `json:"forgotten_at"`
	Operator        string    `json:"operator"` // who initiated the forget
	AffectedStreams []string  `json:"affected_streams,omitempty"`
	Reason          string    `json:"reason,omitempty"`
}

AuditEntry records a forget operation for compliance proof.

type AuditLog ¶

type AuditLog interface {
	Record(ctx context.Context, entry AuditEntry) error
	List(ctx context.Context) ([]AuditEntry, error)
	ForSubject(ctx context.Context, subjectID string) ([]AuditEntry, error)
}

AuditLog records all forget operations. Required for GDPR compliance proof.

type EncryptedFields ¶

type EncryptedFields map[string]map[string][]byte

EncryptedFields stores encrypted PII per subject within an event. The key is the subject ID, the value is field name → ciphertext.

func (ef EncryptedFields) MarshalJSON() ([]byte, error)

func (ef *EncryptedFields) UnmarshalJSON(data []byte) error

type EncryptedStore ¶

type EncryptedStore[E any] struct {
	// contains filtered or unexported fields
}

EncryptedStore wraps any EventStore[E] to transparently encrypt/decrypt PII.

Auto-detects PII declaration method:

1. PIIEvent interface (compile-time safe, no reflection)
2. PIIMultiSubjectEvent interface (multi-subject, no reflection)
3. Struct tags: pii:"key", pii:"field" (zero boilerplate, cached reflection)

Events without PII pass through with zero overhead.

func NewEncryptedStore[E any](inner eskit.EventStore[E], encryptor *SubjectEncryptor) *EncryptedStore[E]

func (s *EncryptedStore[E]) Append(ctx context.Context, streamID string, expectedVersion int, events []E, metadata ...eskit.Metadata) ([]eskit.Event[E], error)

func (s *EncryptedStore[E]) Inner() eskit.EventStore[E]

func (s *EncryptedStore[E]) Load(ctx context.Context, streamID string) ([]eskit.Event[E], error)

func (s *EncryptedStore[E]) LoadFrom(ctx context.Context, streamID string, fromVersion int) ([]eskit.Event[E], error)

type ForgetService ¶

type ForgetService struct {
	// contains filtered or unexported fields
}

ForgetService orchestrates the crypto-shred (forget) operation. It deletes the subject's key and records the operation in the audit log.

func NewForgetService(keys SubjectKeyStore, audit AuditLog) *ForgetService

func (s *ForgetService) Forget(ctx context.Context, subjectID, operator, reason string) error

type MemoryAuditLog ¶

type MemoryAuditLog struct {
	// contains filtered or unexported fields
}

MemoryAuditLog is an in-memory audit log for testing.

func NewMemoryAuditLog() *MemoryAuditLog

func (l *MemoryAuditLog) ForSubject(_ context.Context, subjectID string) ([]AuditEntry, error)

func (l *MemoryAuditLog) List(_ context.Context) ([]AuditEntry, error)

func (l *MemoryAuditLog) Record(_ context.Context, entry AuditEntry) error

type MemorySubjectKeyStore ¶

type MemorySubjectKeyStore struct {
	// contains filtered or unexported fields
}

MemorySubjectKeyStore is an in-memory SubjectKeyStore for testing.

func NewMemorySubjectKeyStore() *MemorySubjectKeyStore

func (s *MemorySubjectKeyStore) CreateKey(_ context.Context, subjectID string) ([]byte, error)

func (s *MemorySubjectKeyStore) DeleteKey(_ context.Context, subjectID string) error

func (s *MemorySubjectKeyStore) Exists(_ context.Context, subjectID string) (bool, error)

func (s *MemorySubjectKeyStore) GetKey(_ context.Context, subjectID string) ([]byte, error)

func (s *MemorySubjectKeyStore) Streams(subjectID string) []string

func (s *MemorySubjectKeyStore) TrackStream(subjectID, streamID string)

type PIICarrier ¶

type PIICarrier interface {
	// SubjectIDs returns the data subject IDs whose PII is in this event.
	SubjectIDs() []string
}

PIICarrier is implemented by events that contain PII. It declares which subject(s) own PII in this event.

type PIIEvent ¶

type PIIEvent interface {
	// SubjectID returns the data subject identifier for this event.
	SubjectID() string

	// PIIFields returns pointers to PII string fields, keyed by field name.
	// The pointers allow in-place read and write (encrypt/decrypt).
	PIIFields() map[string]*string
}

PIIEvent is the interface approach for declaring PII fields. Events implement this for compile-time safety and zero reflection cost.

func (e *OrderCreated) SubjectID() string { return e.CustomerID }
func (e *OrderCreated) PIIFields() map[string]*string {
    return map[string]*string{"email": &e.CustomerEmail, "name": &e.CustomerName}
}

type PIIFields ¶

type PIIFields interface {
	// GetPII returns PII field values keyed by field name.
	GetPII() map[string]string

	// SetPII replaces PII fields. Called with decrypted values on read,
	// or with the ForgottenPlaceholder on forgotten subjects.
	SetPII(fields map[string]string)
}

PIIFields is implemented by events to declare which fields contain PII. Returns a map of field name → plaintext value for encryption.

type PIIGroup ¶

type PIIGroup struct {
	SubjectID string
	Fields    map[string]*string
}

PIIGroup represents one data subject's PII within a multi-subject event.

type PIIMultiSubjectEvent ¶

type PIIMultiSubjectEvent interface {
	PIIGroups() map[string]PIIGroup
}

PIIMultiSubjectEvent extends PIIEvent for events with multiple data subjects. Each group maps to a subject ID and its PII fields.

func (e *Transfer) PIIGroups() map[string]PIIGroup {
    return map[string]PIIGroup{
        "sender":   {SubjectID: e.FromUserID, Fields: map[string]*string{"name": &e.FromName}},
        "receiver": {SubjectID: e.ToUserID, Fields: map[string]*string{"name": &e.ToName}},
    }
}

type SubjectEncryptor ¶

type SubjectEncryptor struct {
	// contains filtered or unexported fields
}

SubjectEncryptor handles per-subject AES-256-GCM encryption of PII fields.

func NewSubjectEncryptor(keys SubjectKeyStore) *SubjectEncryptor

func (e *SubjectEncryptor) DecryptPII(ctx context.Context, subjectID string, fields map[string][]byte) (map[string]string, error)

func (e *SubjectEncryptor) EncryptPII(ctx context.Context, subjectID string, fields map[string]string) (map[string][]byte, error)

type SubjectKeyStore ¶

type SubjectKeyStore interface {
	// CreateKey generates and stores a new key for a subject. Returns the key.
	// Returns ErrSubjectExists if the subject already has a key.
	CreateKey(ctx context.Context, subjectID string) ([]byte, error)

	// GetKey returns the encryption key for a subject.
	// Returns ErrSubjectNotFound if unknown, ErrForgotten if shredded.
	GetKey(ctx context.Context, subjectID string) ([]byte, error)

	// DeleteKey permanently deletes a subject's key (crypto-shred).
	// This is the "forget" operation — irreversible.
	// Returns the subject's stream IDs (if tracked) for audit purposes.
	DeleteKey(ctx context.Context, subjectID string) error

	// Exists checks if a subject has an active (non-forgotten) key.
	Exists(ctx context.Context, subjectID string) (bool, error)
}

SubjectKeyStore manages per-subject encryption keys. Each subject gets a unique AES-256 key for their PII.