Add TRUST_BOUNDARIES array from src/pii/policy.ts to GET /api/privacy response body

[Jagadeeshftw]

📌 Description

src/pii/policy.ts defines a TRUST_BOUNDARIES array describing what each actor class (Anonymous, Partner, Administrator, Internal Worker) may and may not do. The GET /api/privacy route in src/routes/privacy.ts currently returns field policies and retention rules but does not include the trust boundaries. Including them would make the privacy endpoint a comprehensive machine-readable policy document for data-controller integrations and privacy audits.

💡 Why it matters: Exposing the trust boundary model at /api/privacy enables automated compliance checks to verify that the declared access model matches the actual middleware configuration.

🧩 Requirements and context

• Add trustBoundaries: TRUST_BOUNDARIES to the response body of GET /api/privacy
• Update the OpenAPI schema in src/openapi/spec.ts to include a TrustBoundary[] schema
• The denied and allowed arrays must be string arrays (already the case in the type)
• Update tests/routes/privacy.test.ts to assert the new field is present and matches the policy module
• Do not include any internal implementation details in the allowed/denied strings

Non-functional requirements

• Must be secure, tested, and documented.
• Should be efficient and easy to review.

🛠️ Suggested execution

1. Fork the repo and create a branch

git checkout -b feat/privacy-trust-boundaries

2. Implement changes

• Write/modify the relevant source: src/routes/privacy.ts, src/openapi/spec.ts
• Write comprehensive tests: tests/routes/privacy.test.ts
• Add documentation: OpenAPI schema for TrustBoundary
• Include TSDoc on the GET /api/privacy handler update
• Validate security assumptions: none of the allowed/denied strings must reference internal hostnames, IPs, or connection details

3. Test and commit

• Run tests:

npm test -- --testPathPattern=privacy

• Cover edge cases: trust boundaries array is not empty, each entry has actor, allowed, denied fields
• Include test output and security notes in the PR description.

Example commit message

feat(privacy): include TRUST_BOUNDARIES in GET /api/privacy response

✅ Acceptance criteria

• GET /api/privacy response includes trustBoundaries key
• trustBoundaries array matches TRUST_BOUNDARIES from src/pii/policy.ts
• OpenAPI schema updated with TrustBoundary type
• Tests assert presence and shape of trustBoundaries
• CI passes with no type errors

🔒 Security notes

The denied arrays must not hint at internal bypass mechanisms or undocumented admin override paths. Review each entry's strings before merging.

📋 Guidelines

• Minimum 95% test coverage
• Clear documentation
• Timeframe: 96 hours

[AbuJulaybeeb]

Hi Maintainer, haven reviewed the description of the issue, and well experienced with Js Library,
I would like to hop on the issue and sure to deliver at ETA 2hrs

[greatest0fallt1me]

Hello Maintainers 👋,
I’m interested in picking up this issue and contributing to the project.
I have solid experience working across both frontend and blockchain layers, including building user interfaces with Next.js and developing Stellar smart contracts using Rust (Soroban). I’m familiar with translating Figma designs into pixel-accurate UIs, handling wallet integrations, and writing efficient, well-tested contract logic.
I focus on writing clean, maintainable code, following repository standards, and keeping communication transparent throughout the development process. I can start immediately and complete the work within the expected timeframe.
Excited to collaborate and add value to the project 🚀
Thank you!

[grantfox-oss]

🦊 GrantFox — @greatest0fallt1me has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #586)
2. Your PR will be reviewed by the Fluxora-Org maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@greatest0fallt1me's PR #594 was approved and merged by @Jagadeeshftw.

🏆 @greatest0fallt1me: You earned 40 FoxPoints for this contribution! Your current tier: Builder (1,188 total points). Track your full progress on GrantFox.

👏 Great work, @greatest0fallt1me! Keep contributing to Fluxora-Org.