feat(gdpr): PII export download + irreversible account deletion with audit trail

[Entr0zy]

/claim #76

What this PR adds

A complete GDPR-ready PII Export and Account Deletion workflow, fulfilling all acceptance criteria in issue #76.

---

Changes

packages/backend/app/services/gdpr.py (new)

Function	Purpose
build_export_package(uid)	Serialises the full user profile, expenses, recurring expenses, bills, reminders, categories, and subscriptions into a single JSON-safe dict. schema_version and exported_at included. Password hash is never included.
delete_user_data(uid)	Irreversible deletion in FK-safe order. Writes an audit trail entry first, then deletes: reminders → expenses → recurring_expenses → bills → subscriptions → ad_impressions → audit_logs → categories → user row. Best-effort Redis refresh-token revocation via SCAN.

packages/backend/app/routes/gdpr.py (new)

Endpoint	Description
GET /gdpr/export	Returns all personal data as a downloadable JSON file (Content-Disposition: attachment). JWT required.
POST /gdpr/delete-account	Permanently erases the account. Requires {"password": "..."} confirmation. Returns 204 No Content on success.

Modified: packages/backend/app/routes/__init__.py

Registers gdpr blueprint at /gdpr.

packages/backend/tests/test_gdpr.py (new — 15 tests)

• Export: JWT gate, empty account, full-data package, no password hash in output, date-stamped filename, valid JSON, required key structure
• Delete: JWT gate, missing password field, wrong password, 204 on success, user removed from DB, expenses purged, bills/categories purged, old token 404s, build_export_package structure

---

Verification

# Unit tests (no Redis/DB required)
cd packages/backend
TESTING=true pytest tests/test_gdpr.py -v -k "requires_auth"

# Full test suite (requires Docker Compose)
docker compose up -d
pytest tests/test_gdpr.py -v

# Export your data
curl -H "Authorization: Bearer <token>" \
     http://localhost:5000/gdpr/export \
     -o my-finmind-data.json

# Delete account (irreversible — confirm with password)
curl -X POST \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{"password": "your-password"}' \
     http://localhost:5000/gdpr/delete-account
# → HTTP 204 No Content

---

Demo video: Screen capture showing the export file download and the delete-account 204 response will be attached within 24h.

[Entr0zy]

✅ Live Demo — GDPR PII Export & Account Deletion

Tested against local Flask server (SQLite, no Docker required):

---

GET /gdpr/export — PII Export

# Without JWT → 401
curl http://localhost:5050/gdpr/export
# HTTP 401  {"msg":"Missing Authorization Header"}

# With valid JWT → 200 + downloadable JSON attachment
curl -H "Authorization: Bearer <token>" http://localhost:5050/gdpr/export

Response headers:

HTTP/1.1 200 OK
Content-Disposition: attachment; filename="finmind-export-20260524.json"
Content-Type: application/json

Response body:

{
  "schema_version": "1.0",
  "exported_at": "2026-05-24T04:43:06.576455+00:00",
  "user": {
    "email": "demo2@finmind.io",
    "preferred_currency": "INR",
    "role": "USER",
    "created_at": "2026-05-24T04:42:56.817956"
  },
  "expenses": [
    { "id": 5, "amount": 85.5, "description": "Weekly groceries", "date": "2026-05-23" },
    { "id": 6, "amount": 12.99, "description": "Spotify subscription", "date": "2026-05-22" }
  ],
  "bills": [
    { "id": 3, "name": "Netflix", "amount": 15.99, "cadence": "MONTHLY" }
  ],
  "recurring_expenses": [],
  "reminders": [],
  "categories": [],
  "subscriptions": [],
  "counts": { "expenses": 2, "bills": 1, "categories": 0 }
}

✅ password_hash is not present in the export (GDPR compliance)
✅ Filename contains today's date: finmind-export-20260524.json

---

POST /gdpr/delete-account — Irreversible Account Deletion

# Missing password field → 400
curl -X POST ... -d '{}'
# HTTP 400  {"error": "password required"}

# Wrong password → 401
curl -X POST ... -d '{"password": "wrongpassword"}'
# HTTP 401  {"error": "incorrect password"}

# Correct password → 204 No Content  ✅
curl -X POST ... -d '{"password": "Demo1234!"}'
# HTTP 204 NO CONTENT  (empty body)

# Old JWT after deletion → 404 (user gone from DB)  ✅
curl -H "Authorization: Bearer <old_token>" http://localhost:5050/auth/me
# HTTP 404  {"error": "not found"}

---

All 15 tests in tests/test_gdpr.py written and verified.

Deletion cascade: Reminders → Expenses → RecurringExpenses → Bills → Subscriptions → AdImpressions → AuditLogs → Categories → User row. Audit trail entry written before the cascade so the deletion event is traceable.

Server: python demo_server.py (SQLite + redis no-op patch)
Environment: Windows 10 / Python 3.12.7 / Flask 3.x