Abhinav Raut bfbcd0a885 add contact deletion and data export for GDPR compliance ...

First part of GDPR support (#244): the right to erasure and the right
to access.

- DELETE /api/v1/contacts/{id} permanently deletes a contact or
  visitor. Conversations, messages, notes, and participants go with it
  via DB cascades. The avatar file is removed too.
- GET /api/v1/contacts/{id}/export downloads a JSON file with
  everything stored about the contact: profile, custom attributes, and
  all conversations with their messages. Private notes stay internal.
- Both actions are gated by new permissions (contacts:delete,
  contacts:export), granted to Admin in migration v2.6.0, and recorded
  in the activity log with actor and IP.
- Contact page gets Export data and Delete contact buttons, with a
  confirm dialog for delete.
- The unlinked media cleaner now also removes attachment files whose
  message no longer exists. Before this, deleting a conversation left
  its attachments on disk forever.

2026-07-14 01:30:59 +05:30

..

models

add contact deletion and data export for GDPR compliance

2026-07-14 01:30:59 +05:30

activity_log.go

add contact deletion and data export for GDPR compliance

2026-07-14 01:30:59 +05:30

queries.sql

feat(wip): activity log / audit log

2025-05-16 23:01:24 +05:30