>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3593603. --> Reported by: [mably](https://www.drupal.org/user/3375160) Related to !12 >>> <p><strong>Summary</strong></p> <p>Let an owner export everything in their vault as a portable, downloadable bundle. This is the data subject right of access and data portability (GDPR Article 15 and Article 20); for a public-sector deployment it is effectively an obligation, not just a convenience.</p> <p><strong>What it produces</strong></p> <ul> <li>A ZIP bundle of all the owner items: documents as their real files (typed and named from the vault, the kind.ext naming and MIME the read contract already returns), and records as structured JSON.</li> <li>A manifest (JSON index) listing each item: kind, label, filename, size, and timestamps, so the export is machine-readable and portable, not just a pile of files.</li> </ul> <p><strong>Access path</strong></p> <p>Export is the owner acting on their own vault, not a consumer read: it uses the owner own access (owner-equality), with no grant or trust involved. Distinct from the ConsumerApi read path.</p> <p><strong>Security and safety</strong></p> <ul> <li>The bundle is plaintext (the owner own data, decrypted), so it is sensitive: stream it over an authenticated, short-lived download; never leave the ZIP unencrypted on disk (build it in a temporary location and delete it in a finally block), the same discipline as never storing a vaulted file unencrypted.</li> <li>Require a fresh confirmation or re-authentication: a bulk export of all of one documents is a high-value action.</li> <li>Record the export in the audit trail (a bulk decrypt-and-download is security-relevant) and rate-limit it (the ConsumerFloodGuard equivalent) to prevent abuse.</li> </ul> <p><strong>Large vaults</strong></p> <p>For a vault with many or large files, generate the bundle asynchronously (queue plus cron) and hand back a one-time, short-lived secure download link when it is ready, rather than building it inline in a request. The "your export is ready" message is a consumer of the notification approach.</p> <p><strong>Multi-tenant</strong></p> <p>Export is per vault/tenant: the owner exports the vault they are in, not all tenants at once. Depends on the multi-tenant work in <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/pdv/-/work_items/3593589" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/pdv/-/work_items/3593589</a></span>.</p> <p><strong>Tests</strong></p> <ul> <li>An owner with several items of mixed kinds exports a ZIP containing the right files (typed and named) plus a manifest listing every item.</li> <li>Records export as structured JSON; documents export as their files.</li> <li>The export uses owner access only; it does not require any consumer grant.</li> <li>The temporary bundle is removed after delivery (no unencrypted residue).</li> <li>The export is recorded in the audit trail and is rate-limited.</li> </ul> <p><strong>Implementation notes (as built)</strong></p> <ul> <li>Scope: one bundle covers the owner's current-tenant vault.</li> <li>Generation is synchronous: the ZIP is built to a private temporary file, streamed back, then deleted after sending, so no decrypted bundle is left at rest. Asynchronous generation is deferred until a single owner's vault is large enough to need it.</li> <li>The action is gated by a confirmation form (the same high-value pattern as the vault purge), not a password re-authentication.</li> <li>Rate-limited per owner through the existing flood guard (sharing the consent window), and recorded on a new pdv.export audit channel.</li> </ul>