FixTheVuln

# Python/Flask - Data export for GDPR access request
@app.route('/api/user/export', methods=['GET'])
@login_required
def export_user_data():
    user_id = current_user.id

    data = {
        'profile': get_user_profile(user_id),
        'orders': get_user_orders(user_id),
        'preferences': get_user_preferences(user_id),
        'activity_log': get_user_activity(user_id),
        'exported_at': datetime.utcnow().isoformat()
    }

    return jsonify(data), 200, {
        'Content-Disposition': f'attachment; filename=user_data_{user_id}.json'
    }

# Proper account deletion - remove all personal data
def delete_user_account(user_id):
    # Delete from all related tables
    delete_user_orders(user_id)
    delete_user_preferences(user_id)
    delete_user_activity_logs(user_id)
    delete_user_sessions(user_id)

    # Anonymize data that must be retained (e.g., for legal reasons)
    anonymize_financial_records(user_id)

    # Finally delete the user record
    delete_user(user_id)

    # Log the deletion for compliance
    log_gdpr_action('account_deletion', user_id)

// Consent tracking schema
CREATE TABLE user_consents (
    id UUID PRIMARY KEY,
    user_id UUID REFERENCES users(id),
    consent_type VARCHAR(50),  -- 'marketing', 'analytics', etc.
    granted BOOLEAN,
    granted_at TIMESTAMP,
    withdrawn_at TIMESTAMP,
    ip_address INET,
    user_agent TEXT,
    consent_text TEXT  -- Store the exact text user agreed to
);