feat(enterprise): add legal hold with cleanup bypass

apps/api/src/jobs/system-jobs.ts

@@ -121,16 +121,42 @@ export function decideExpiry(
 }
 
 async function storageTtlSweep(): Promise<{ removed: number; failed: number }> {
+  // Build set of user IDs under legal hold (direct or via team) once per sweep
+  const heldUserRows = await db
+    .select({ id: schema.users.id })
+    .from(schema.users)
+    .where(eq(schema.users.legalHold, true));
+  const heldUserIds = new Set(heldUserRows.map((r) => r.id));
+
+  const heldTeamRows = await db
+    .select({ name: schema.teams.name })
+    .from(schema.teams)
+    .where(eq(schema.teams.legalHold, true));
+  if (heldTeamRows.length > 0) {
+    const teamUsers = await db
+      .select({ id: schema.users.id })
+      .from(schema.users)
+      .where(
+        inArray(
+          schema.users.team,
+          heldTeamRows.map((r) => r.name),
+        ),
+      );
+    for (const u of teamUsers) heldUserIds.add(u.id);
+  }
+
   // --- Per-job deleteAfter sweep (team retention overrides) ---
   // Runs regardless of the global TTL; deleteAfter is an absolute deadline.
   let deleteAfterCleaned = 0;
   try {
     const expiredJobs = await db
-      .select({ id: schema.jobs.id })
+      .select({ id: schema.jobs.id, userId: schema.jobs.userId })
       .from(schema.jobs)
       .where(and(isNotNull(schema.jobs.deleteAfter), lt(schema.jobs.deleteAfter, new Date())));
 
     for (const job of expiredJobs) {
+      // Skip jobs belonging to users under legal hold
+      if (job.userId && heldUserIds.has(job.userId)) continue;
       try {
         await deletePrefix(`uploads/${job.id}`);
         await deletePrefix(`outputs/${job.id}`);
@@ -176,10 +202,28 @@ async function storageTtlSweep(): Promise<{ removed: number; failed: number }> {
     }
   }
 
+  // Batch-lookup userId for legal hold check (only if any users are held)
+  const jobUserMap = new Map<string, string | null>();
+  if (heldUserIds.size > 0 && allDirs.length > 0) {
+    const allJobIds = [...new Set(allDirs.map((d) => d.key.split("/")[1]))];
+    if (allJobIds.length > 0) {
+      const userRows = await db
+        .select({ id: schema.jobs.id, userId: schema.jobs.userId })
+        .from(schema.jobs)
+        .where(inArray(schema.jobs.id, allJobIds));
+      for (const r of userRows) jobUserMap.set(r.id, r.userId);
+    }
+  }
+
   let removed = 0;
   const errors: string[] = [];
   for (const dir of allDirs) {
     if (decideExpiry(dir, cutoffMs, rowsById) === "expired") {
+      // Skip deletion if the job's user is under legal hold
+      const jobId = dir.key.split("/")[1];
+      const userId = jobUserMap.get(jobId);
+      if (userId && heldUserIds.has(userId)) continue;
+
       try {
         await deletePrefix(dir.key);
         removed++;
@@ -201,9 +245,19 @@ async function storageTtlSweep(): Promise<{ removed: number; failed: number }> {
 // -- Retention sweep ----------------------------------------------------------
 
 async function retentionSweep(): Promise<void> {
+  // Subquery to find users under legal hold (direct or via team)
+  const heldUsersSubquery = sql`(
+    SELECT u.id FROM users u
+    LEFT JOIN teams t ON u.team = t.name
+    WHERE u.legal_hold = true OR t.legal_hold = true
+  )`;
+
   if (env.JOBS_RETENTION_DAYS > 0) {
     await db.execute(
-      sql`DELETE FROM jobs WHERE created_at < now() - ${env.JOBS_RETENTION_DAYS} * interval '1 day' AND status IN ('completed', 'failed', 'canceled')`,
+      sql`DELETE FROM jobs
+        WHERE created_at < now() - ${env.JOBS_RETENTION_DAYS} * interval '1 day'
+        AND status IN ('completed', 'failed', 'canceled')
+        AND (user_id IS NULL OR user_id NOT IN ${heldUsersSubquery})`,
     );
   }
   if (env.AUDIT_RETENTION_DAYS > 0) {
@@ -218,7 +272,9 @@ async function retentionSweep(): Promise<void> {
     // Only delete audit logs if tamper-resistant mode is OFF
     if (!isTamperResistant) {
       await db.execute(
-        sql`DELETE FROM audit_log WHERE created_at < now() - ${env.AUDIT_RETENTION_DAYS} * interval '1 day'`,
+        sql`DELETE FROM audit_log
+          WHERE created_at < now() - ${env.AUDIT_RETENTION_DAYS} * interval '1 day'
+          AND (actor_id IS NULL OR actor_id NOT IN ${heldUsersSubquery})`,
       );
     }
   }

apps/api/src/routes/enterprise/index.ts

@@ -1,8 +1,10 @@
 import type { FastifyInstance } from "fastify";
 import { registerAuditExport } from "./audit-export.js";
+import { registerLegalHoldRoutes } from "./legal-hold.js";
 import { registerSiemRoutes } from "./siem.js";
 
 export async function registerEnterpriseRoutes(app: FastifyInstance) {
   await registerAuditExport(app);
+  await registerLegalHoldRoutes(app);
   await registerSiemRoutes(app);
 }

apps/api/src/routes/enterprise/legal-hold.ts

@@ -0,0 +1,112 @@
+import { eq } from "drizzle-orm";
+import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
+import { z } from "zod";
+import { db, schema } from "../../db/index.js";
+import { auditFromRequest } from "../../lib/audit.js";
+import { requirePermission } from "../../permissions.js";
+
+const holdSchema = z.object({
+  targetType: z.enum(["user", "team"]),
+  targetId: z.string().min(1),
+  hold: z.boolean(),
+});
+
+export async function registerLegalHoldRoutes(app: FastifyInstance): Promise<void> {
+  // PUT /api/v1/enterprise/legal-hold -- set or release a hold
+  app.put(
+    "/api/v1/enterprise/legal-hold",
+    async (request: FastifyRequest<{ Body: unknown }>, reply: FastifyReply) => {
+      const user = await requirePermission("compliance:manage")(request, reply);
+      if (!user) return;
+
+      // Enterprise feature gate
+      let featureEnabled = false;
+      try {
+        const { isFeatureEnabled } = await import("@snapotter/enterprise");
+        featureEnabled = isFeatureEnabled("legal_hold");
+      } catch {
+        // Enterprise package not available
+      }
+      if (!featureEnabled) {
+        return reply
+          .status(403)
+          .send({ error: "Legal hold requires an enterprise license with the legal_hold feature" });
+      }
+
+      const parsed = holdSchema.safeParse(request.body);
+      if (!parsed.success) {
+        return reply
+          .status(400)
+          .send({ error: "Invalid request body", details: parsed.error.issues });
+      }
+
+      const { targetType, targetId, hold } = parsed.data;
+
+      if (targetType === "user") {
+        const [existing] = await db
+          .select({ id: schema.users.id })
+          .from(schema.users)
+          .where(eq(schema.users.id, targetId));
+        if (!existing) {
+          return reply.status(404).send({ error: "User not found" });
+        }
+        await db
+          .update(schema.users)
+          .set({ legalHold: hold, updatedAt: new Date() })
+          .where(eq(schema.users.id, targetId));
+      } else {
+        const [existing] = await db
+          .select({ id: schema.teams.id })
+          .from(schema.teams)
+          .where(eq(schema.teams.id, targetId));
+        if (!existing) {
+          return reply.status(404).send({ error: "Team not found" });
+        }
+        await db.update(schema.teams).set({ legalHold: hold }).where(eq(schema.teams.id, targetId));
+      }
+
+      await auditFromRequest(request)(hold ? "LEGAL_HOLD_APPLIED" : "LEGAL_HOLD_RELEASED", {
+        adminId: user.id,
+        username: user.username,
+        targetType,
+        targetId,
+      });
+
+      return reply.send({ success: true, targetType, targetId, hold });
+    },
+  );
+
+  // GET /api/v1/enterprise/legal-hold -- list current holds
+  app.get("/api/v1/enterprise/legal-hold", async (request: FastifyRequest, reply: FastifyReply) => {
+    const user = await requirePermission("compliance:manage")(request, reply);
+    if (!user) return;
+
+    // Enterprise feature gate
+    let featureEnabled = false;
+    try {
+      const { isFeatureEnabled } = await import("@snapotter/enterprise");
+      featureEnabled = isFeatureEnabled("legal_hold");
+    } catch {
+      // Enterprise package not available
+    }
+    if (!featureEnabled) {
+      return reply
+        .status(403)
+        .send({ error: "Legal hold requires an enterprise license with the legal_hold feature" });
+    }
+
+    const heldUsers = await db
+      .select({ id: schema.users.id, username: schema.users.username })
+      .from(schema.users)
+      .where(eq(schema.users.legalHold, true));
+
+    const heldTeams = await db
+      .select({ id: schema.teams.id, name: schema.teams.name })
+      .from(schema.teams)
+      .where(eq(schema.teams.legalHold, true));
+
+    return reply.send({ users: heldUsers, teams: heldTeams });
+  });
+
+  app.log.info("Enterprise legal hold routes registered");
+}

tests/integration/legal-hold.test.ts

@@ -0,0 +1,91 @@
+import { eq } from "drizzle-orm";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { db, schema } from "../../apps/api/src/db/index.js";
+import { buildTestApp, loginAsAdmin, type TestApp } from "./test-server.js";
+
+let testApp: TestApp;
+let adminToken: string;
+
+beforeAll(async () => {
+  testApp = await buildTestApp();
+  adminToken = await loginAsAdmin(testApp.app);
+}, 30_000);
+
+afterAll(async () => {
+  await testApp.cleanup();
+}, 10_000);
+
+describe("legal hold", () => {
+  it("returns 403 for PUT without enterprise license", async () => {
+    const res = await testApp.app.inject({
+      method: "PUT",
+      url: "/api/v1/enterprise/legal-hold",
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: { targetType: "user", targetId: "some-id", hold: true },
+    });
+    expect(res.statusCode).toBe(403);
+    const body = JSON.parse(res.body);
+    expect(body.error).toContain("enterprise");
+  });
+
+  it("returns 403 for GET without enterprise license", async () => {
+    const res = await testApp.app.inject({
+      method: "GET",
+      url: "/api/v1/enterprise/legal-hold",
+      headers: { authorization: `Bearer ${adminToken}` },
+    });
+    expect(res.statusCode).toBe(403);
+    const body = JSON.parse(res.body);
+    expect(body.error).toContain("enterprise");
+  });
+
+  it("returns 401 without auth", async () => {
+    const res = await testApp.app.inject({
+      method: "GET",
+      url: "/api/v1/enterprise/legal-hold",
+    });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it("returns 401 for PUT without auth", async () => {
+    const res = await testApp.app.inject({
+      method: "PUT",
+      url: "/api/v1/enterprise/legal-hold",
+      payload: { targetType: "user", targetId: "some-id", hold: true },
+    });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it("returns 403 for non-admin user", async () => {
+    // Create a regular user
+    await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/register",
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: {
+        username: "legalholduser",
+        password: "TestPass1",
+        role: "user",
+      },
+    });
+    await db
+      .update(schema.users)
+      .set({ mustChangePassword: false })
+      .where(eq(schema.users.username, "legalholduser"));
+
+    const loginRes = await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      payload: { username: "legalholduser", password: "TestPass1" },
+    });
+    const userToken = JSON.parse(loginRes.body).token;
+
+    const res = await testApp.app.inject({
+      method: "GET",
+      url: "/api/v1/enterprise/legal-hold",
+      headers: { authorization: `Bearer ${userToken}` },
+    });
+    // Regular users lack compliance:manage, so they get 403 before the enterprise check
+    expect(res.statusCode).toBe(403);
+  });
+});