1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

// Data classification system
 
enum DataTier {
  PUBLIC = 1,      // Visible to all
  FRIENDS = 2,     // Visible to connections
  PERSONAL = 3,    // Visible to owner only
  SENSITIVE = 4,   // Regulated data
  SYSTEM = 5,      // Internal only
}
 
interface DataClassification {
  field: string;
  tier: DataTier;
  piiType?: PiiType;
  retentionPolicy: RetentionPolicy;
  encryptionRequired: boolean;
  auditRequired: boolean;
}
 
const classificationSchema: DataClassification[] = [
  // Profile data
  { field: 'profile.name', tier: DataTier.PUBLIC, piiType: 'name', retentionPolicy: 'until_deletion', encryptionRequired: false, auditRequired: false },
  { field: 'profile.email', tier: DataTier.PERSONAL, piiType: 'email', retentionPolicy: 'until_deletion', encryptionRequired: true, auditRequired: true },
  { field: 'profile.phone', tier: DataTier.PERSONAL, piiType: 'phone', retentionPolicy: 'until_deletion', encryptionRequired: true, auditRequired: true },
  
  // Post data
  { field: 'post.content', tier: DataTier.FRIENDS, retentionPolicy: 'until_deletion', encryptionRequired: false, auditRequired: false },
  { field: 'post.location', tier: DataTier.SENSITIVE, piiType: 'location', retentionPolicy: '90_days', encryptionRequired: true, auditRequired: true },
  
  // Behavioral data
  { field: 'activity.pages_viewed', tier: DataTier.PERSONAL, retentionPolicy: '30_days', encryptionRequired: false, auditRequired: false },
  { field: 'activity.search_history', tier: DataTier.PERSONAL, piiType: 'behavior', retentionPolicy: '90_days', encryptionRequired: true, auditRequired: true },
  
  // System data
  { field: 'auth.password_hash', tier: DataTier.SYSTEM, retentionPolicy: 'until_deletion', encryptionRequired: true, auditRequired: true },
  { field: 'auth.session_token', tier: DataTier.SYSTEM, retentionPolicy: '30_days', encryptionRequired: true, auditRequired: false },
];

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

// Post visibility model
 
enum VisibilityLevel {
  PUBLIC = 'public',           // Anyone on/off Facebook
  FRIENDS = 'friends',         // Approved connections only
  FRIENDS_OF_FRIENDS = 'fof',  // 2-degree connections
  FRIENDS_EXCEPT = 'friends_except',  // Friends minus exceptions
  SPECIFIC_FRIENDS = 'specific',      // Whitelist only
  ONLY_ME = 'only_me',         // Private to author
}
 
interface PostVisibility {
  level: VisibilityLevel;
  
  // For complex visibility rules
  includedLists?: string[];    // Custom friend lists to include
  excludedUsers?: string[];    // Specific users to block
  
  // Derived visibility (cached for performance)
  allowedViewers?: string[];   // Pre-computed for small whitelists
}
 
// Visibility check is called on EVERY post in feed
async function canViewPost(
  viewerId: string, 
  post: Post
): Promise<boolean> {
  
  // Fast path: Public posts
  if (post.visibility.level === VisibilityLevel.PUBLIC) {
    return !await isBlockedBy(viewerId, post.authorId);
  }
  
  // Author can always view their own posts
  if (viewerId === post.authorId) {
    return true;
  }
  
  // Only Me = only author
  if (post.visibility.level === VisibilityLevel.ONLY_ME) {
    return false;
  }
  
  // Check if blocked (mutual blocks hide all content)
  if (await isBlockedBy(viewerId, post.authorId) || 
      await isBlockedBy(post.authorId, viewerId)) {
    return false;
  }
  
  // Friends visibility
  if (post.visibility.level === VisibilityLevel.FRIENDS) {
    return await areFriends(viewerId, post.authorId);
  }
  
  // Friends of friends
  if (post.visibility.level === VisibilityLevel.FRIENDS_OF_FRIENDS) {
    return await areFriendsOrFof(viewerId, post.authorId);
  }
  
  // Friends except specific users
  if (post.visibility.level === VisibilityLevel.FRIENDS_EXCEPT) {
    if (post.visibility.excludedUsers?.includes(viewerId)) {
      return false;
    }
    return await areFriends(viewerId, post.authorId);
  }
  
  // Specific friends only (whitelist)
  if (post.visibility.level === VisibilityLevel.SPECIFIC_FRIENDS) {
    return post.visibility.allowedViewers?.includes(viewerId) || 
           await isInFriendList(viewerId, post.visibility.includedLists);
  }
  
  return false;  // Default deny
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

// Block action implementation
 
class BlockService {
  private socialGraph: SocialGraphService;
  private feedCache: FeedCacheService;
  private eventBus: EventBus;
  
  async blockUser(blockerId: string, blockedId: string): Promise<void> {
    // 1. Create block edge in social graph (strongly consistent)
    await this.socialGraph.createEdge({
      from: blockerId,
      to: blockedId,
      type: 'block',
      createdAt: Date.now(),
    });
    
    // 2. Remove any existing friendship
    await this.socialGraph.removeEdge(blockerId, blockedId, 'friend');
    await this.socialGraph.removeEdge(blockedId, blockerId, 'friend');
    
    // 3. Invalidate feed caches (immediate)
    await Promise.all([
      this.feedCache.invalidate(blockerId),
      this.feedCache.invalidate(blockedId),
    ]);
    
    // 4. Publish event for async cleanup
    await this.eventBus.publish('user:blocked', {
      blockerId,
      blockedId,
      timestamp: Date.now(),
    });
    
    // 5. Kill any active sessions that might serve stale data
    await this.invalidateActiveSessions(blockerId, blockedId);
  }
  
  // Async cleanup jobs triggered by block event
  async handleBlockEvent(event: BlockEvent) {
    const { blockerId, blockedId } = event;
    
    // Remove blocked user's posts from blocker's feed cache
    await this.scrubFeedCache(blockerId, blockedId);
    
    // Remove blocker's posts from blocked user's feed cache
    await this.scrubFeedCache(blockedId, blockerId);
    
    // Remove from any shared group activity
    await this.scrubGroupActivity(blockerId, blockedId);
    
    // Clear any pending notifications between users
    await this.clearPendingNotifications(blockerId, blockedId);
    
    // Remove from 'People You May Know' suggestions
    await this.removeSuggestions(blockerId, blockedId);
  }
  
  // Real-time session invalidation
  async invalidateActiveSessions(user1: string, user2: string) {
    // Push invalidation message to connected clients
    await this.pushService.sendToUser(user1, {
      type: 'privacy_state_change',
      action: 'refresh_feed',
    });
    
    await this.pushService.sendToUser(user2, {
      type: 'privacy_state_change', 
      action: 'refresh_feed',
    });
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74

// Privacy settings change propagation
 
class PrivacySettingsService {
  
  async changeDefaultPostVisibility(
    userId: string, 
    newDefault: VisibilityLevel
  ): Promise<void> {
    // 1. Update user settings
    await this.userSettings.update(userId, {
      defaultPostVisibility: newDefault,
    });
    
    // No retroactive changes needed - affects future posts only
  }
  
  async changeExistingPostVisibility(
    userId: string,
    postId: string,
    newVisibility: PostVisibility
  ): Promise<void> {
    const post = await this.postStore.get(postId);
    
    // Verify ownership
    if (post.authorId !== userId) {
      throw new UnauthorizedError('Cannot modify others posts');
    }
    
    // 1. Update post visibility (sync)
    await this.postStore.update(postId, {
      visibility: newVisibility,
    });
    
    // 2. Determine affected users
    const previouslyVisible = await this.getVisibleUsers(post.visibility);
    const nowVisible = await this.getVisibleUsers(newVisibility);
    
    // Users who can no longer see the post
    const newlyHidden = previouslyVisible.filter(u => !nowVisible.includes(u));
    
    // Users who can now see the post
    const newlyVisible = nowVisible.filter(u => !previouslyVisible.includes(u));
    
    // 3. Invalidate affected feed caches
    for (const affectedUser of newlyHidden) {
      await this.feedCache.removePost(affectedUser, postId);
    }
    
    // 4. Potentially add to newly visible users' feeds
    // (handled by next aggregation cycle - eventual consistency OK for additions)
  }
  
  async makePastPostsMorePrivate(
    userId: string,
    newLevel: VisibilityLevel
  ): Promise<void> {
    // "Limit past posts" feature - make all historical posts more private
    
    // 1. Queue batch job (too many posts to do synchronously)
    await this.jobQueue.enqueue('privacy:batch_update', {
      userId,
      newVisibility: newLevel,
      createdBefore: Date.now(),
    });
    
    // 2. Immediately invalidate all feed caches that might have old posts
    // This is expensive but necessary for privacy guarantees
    const allFriends = await this.socialGraph.getFriends(userId);
    await this.feedCache.invalidateBatch(allFriends);
    
    // 3. Return immediately - user gets confirmation
    // Batch job processes posts over minutes/hours
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

// Privacy-aware feature engineering
 
// ❌ Bad: Direct PII usage
const badFeatures = {
  user_email: user.email,           // Direct PII
  user_location: user.city,         // Precise location
  user_age: user.birthday,          // Age (protected attribute)
  user_political_views: user.views, // Sensitive category
};
 
// ✅ Good: Privacy-preserving alternatives
const goodFeatures = {
  // Hashed, opaque ID
  user_id_hash: hash(user.id + salt),
  
  // Bucketed, aggregated location (country-level only)
  user_region_bucket: getRegionBucket(user.country),
  
  // Age removed entirely (or very coarse buckets if needed)
  user_generation: getGenerationBucket(user.age),  // "GenZ", "Millennial", "GenX"
  
  // Behavioral signals instead of declared attributes
  user_engagement_rate: user.avgLikesPerDay,
  user_content_type_affinity: computeContentAffinity(user.interactions),
  
  // Differential privacy noise added
  user_session_count: addLaplacianNoise(user.sessionCount, epsilon=1.0),
};
 
// Feature audit checks
function auditFeature(feature: Feature): AuditResult {
  const issues = [];
  
  // Check 1: PII detection
  if (containsPII(feature.values)) {
    issues.push('Feature contains PII');
  }
  
  // Check 2: Protected attribute correlation
  const correlation = computeCorrelation(feature, protectedAttributes);
  if (correlation > 0.7) {
    issues.push(`High correlation (${correlation}) with protected attribute`);
  }
  
  // Check 3: K-anonymity
  const kValue = computeKAnonymity(feature);
  if (kValue < 100) {
    issues.push(`Low k-anonymity (k=${kValue})`);
  }
  
  return {
    approved: issues.length === 0,
    issues,
  };
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

// Federated learning for ranking personalization
 
// On-device model: learns user preferences without uploading behavior
class OnDeviceRankingModel {
  private localModel: TFLiteModel;
  
  async personalizeLocally(
    impressions: Impression[],
    interactions: Interaction[]
  ): Promise<void> {
    // Train on local data only
    const examples = this.createTrainingExamples(impressions, interactions);
    
    await this.localModel.fit(examples, {
      epochs: 5,
      batchSize: 32,
    });
    
    // Model weights updated locally
    // Raw impression/interaction data never leaves device
  }
  
  async contributeToCentralModel(): Promise<void> {
    // Compute gradient update (not raw data)
    const gradients = this.localModel.computeGradients();
    
    // Add differential privacy noise
    const noisyGradients = addGaussianNoise(gradients, {
      epsilon: 2.0,
      delta: 1e-5,
      sensitivity: 1.0,
    });
    
    // Clip gradients to bound sensitivity
    const clippedGradients = clipGradients(noisyGradients, maxNorm=1.0);
    
    // Send to server using secure aggregation
    await this.secureAggregation.contribute(clippedGradients);
  }
}
 
// Server: aggregates without seeing individual contributions
class FederatedServer {
  async aggregateRound(contributors: string[]): Promise<ModelUpdate> {
    // Secure aggregation ensures server only sees sum
    const aggregatedGradients = await this.secureAggregation.aggregate(
      contributors,
      minContributors: 1000  // Privacy guarantee
    );
    
    // Average gradients
    const avgGradients = divideByScalar(aggregatedGradients, contributors.length);
    
    // Update global model
    await this.globalModel.applyGradients(avgGradients);
    
    return this.globalModel.getUpdate();
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120

// GDPR Article 17 - Right to Erasure implementation
 
class DataDeletionService {
  // Track all data stores that hold user data
  private dataStores: DataStore[] = [
    profileStore,
    postStore,
    engagementStore,
    commentStore,
    messageStore,
    activityLogStore,
    mlFeatureStore,
    analyticsStore,
    backupStore,
    cdnCache,
    searchIndex,
    // ... hundreds more in practice
  ];
  
  async processDeleteRequest(userId: string): Promise<DeletionReport> {
    const report = new DeletionReport();
    report.requestId = generateId();
    report.userId = userId;
    report.requestedAt = Date.now();
    
    // 1. Validate request (verify identity, not duplicate)
    await this.validateRequest(userId);
    
    // 2. Immediate actions
    await this.disableAccount(userId);  // Prevent new data creation
    await this.invalidateTokens(userId);  // Force logout
    
    // 3. Queue deletion jobs for each data store
    for (const store of this.dataStores) {
      const job = await this.jobQueue.enqueue('data:delete', {
        userId,
        storeName: store.name,
        requestId: report.requestId,
      });
      report.jobs.push(job.id);
    }
    
    // 4. Schedule verification (GDPR requires 30-day deadline)
    await this.scheduler.schedule('deletion:verify', {
      requestId: report.requestId,
      deadline: Date.now() + 25 * 24 * 60 * 60 * 1000,  // Day 25 check
    });
    
    return report;
  }
  
  // Individual store deletion
  async deleteFromStore(
    userId: string, 
    store: DataStore
  ): Promise<StoreDeleteResult> {
    const result = new StoreDeleteResult();
    
    try {
      // Delete primary data
      const primaryCount = await store.deleteByUser(userId);
      result.primaryDeleted = primaryCount;
      
      // Delete from caches
      const cacheCount = await store.invalidateUserCaches(userId);
      result.cachesInvalidated = cacheCount;
      
      // Delete from indexes
      const indexCount = await store.removeFromIndexes(userId);
      result.indexEntriesRemoved = indexCount;
      
      // Trigger backup tombstone (for retention-protected backups)
      await this.backupService.markForDeletion(userId, store.name);
      
      result.success = true;
    } catch (e) {
      result.success = false;
      result.error = e.message;
      
      // Alert for manual remediation
      await this.alerting.trigger('deletion_failure', {
        userId,
        store: store.name,
        error: e.message,
      });
    }
    
    return result;
  }
  
  // Verify deletion completed
  async verifyDeletion(requestId: string): Promise<VerificationResult> {
    const report = await this.getReport(requestId);
    const failures = [];
    
    for (const store of this.dataStores) {
      const remaining = await store.checkForRemainingData(report.userId);
      if (remaining > 0) {
        failures.push({
          store: store.name,
          remainingRecords: remaining,
        });
      }
    }
    
    if (failures.length > 0) {
      // Escalate for manual cleanup
      await this.escalate('incomplete_deletion', {
        requestId,
        failures,
        daysRemaining: this.getDaysUntilDeadline(report),
      });
    }
    
    return {
      complete: failures.length === 0,
      failures,
    };
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

// GDPR Article 15 - Right of Access implementation
 
class DataExportService {
  
  async createExport(userId: string): Promise<ExportJob> {
    // This is expensive - queue as background job
    const job = await this.jobQueue.enqueue('data:export', {
      userId,
      format: 'json',  // Machine-readable (GDPR portability)
    });
    
    return {
      jobId: job.id,
      estimatedCompletion: Date.now() + 24 * 60 * 60 * 1000,  // 24 hours
      status: 'pending',
    };
  }
  
  async processExport(userId: string): Promise<string> {
    const exportData = {
      exportedAt: new Date().toISOString(),
      userId: userId,
      categories: {},
    };
    
    // Profile data
    exportData.categories.profile = await this.exportProfile(userId);
    
    // Posts and content
    exportData.categories.posts = await this.exportPosts(userId);
    
    // Comments
    exportData.categories.comments = await this.exportComments(userId);
    
    // Messages (only user's side)
    exportData.categories.messages = await this.exportMessages(userId);
    
    // Activity log
    exportData.categories.activity = await this.exportActivity(userId);
    
    // Ad interactions
    exportData.categories.adInteractions = await this.exportAdData(userId);
    
    // Inferred data (interests, predictions)
    exportData.categories.inferredData = await this.exportInferences(userId);
    
    // Write to secure storage
    const exportFile = await this.storage.write(
      `exports/${userId}/${Date.now()}.json`,
      JSON.stringify(exportData, null, 2)
    );
    
    // Generate secure download link (time-limited)
    const downloadUrl = await this.storage.createSignedUrl(exportFile, {
      expiresIn: '7d',
    });
    
    // Notify user
    await this.notify(userId, 'data_export_ready', { downloadUrl });
    
    return downloadUrl;
  }
  
  // Include inferred data (GDPR requires this)
  async exportInferences(userId: string): Promise<InferredData> {
    return {
      interests: await this.mlService.getInferredInterests(userId),
      ageRange: await this.mlService.getInferredAgeRange(userId),
      adCategories: await this.adService.getTargetingCategories(userId),
      relationshipStrengths: await this.socialService.getRelationshipScores(userId),
    };
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

// Generate explanation for why post appeared in feed
 
interface RankingExplanation {
  primaryReason: string;
  contributingFactors: Factor[];
  actions: Action[];
}
 
async function generateExplanation(
  viewerId: string,
  post: Post,
  rankingContext: RankingContext
): Promise<RankingExplanation> {
  
  const factors: Factor[] = [];
  const actions: Action[] = [];
  
  // Determine primary reason
  let primaryReason: string;
  
  if (post.authorId in await getFriends(viewerId)) {
    primaryReason = `${post.author.name} is your friend`;
    actions.push({
      label: 'Unfollow',
      action: `unfollow:${post.authorId}`,
    });
    
    // Check relationship strength
    const strength = await getRelationshipStrength(viewerId, post.authorId);
    if (strength > 0.8) {
      factors.push({
        type: 'relationship',
        description: 'You interact frequently with this person',
        weight: 'high',
      });
    }
  } else if (post.sourcePage) {
    primaryReason = `You follow ${post.sourcePage.name}`;
    actions.push({
      label: 'Unlike Page',
      action: `unlike_page:${post.sourcePage.id}`,
    });
  }
  
  // Content factors
  if (rankingContext.topicMatch > 0.7) {
    const matchedTopics = await getMatchedTopics(viewerId, post);
    factors.push({
      type: 'topic_interest',
      description: `You've shown interest in ${matchedTopics.join(', ')}`,
      weight: 'medium',
    });
    actions.push({
      label: 'See less of this topic',
      action: `reduce_topic:${matchedTopics[0]}`,
    });
  }
  
  // Engagement velocity
  if (rankingContext.engagementVelocity > 100) {
    factors.push({
      type: 'engagement',
      description: 'Many people are engaging with this post',
      weight: 'low',
    });
  }
  
  // Always offer hide action
  actions.push({
    label: 'Hide this post',
    action: `hide:${post.id}`,
  });
  
  return {
    primaryReason,
    contributingFactors: factors,
    actions,
  };
}